File tree Expand file tree Collapse file tree 5 files changed +26
-106
lines changed Expand file tree Collapse file tree 5 files changed +26
-106
lines changed Original file line number Diff line number Diff line change @@ -133,6 +133,32 @@ typedef union _EXHANDLE
133
133
134
134
#pragma warning(disable : 4214 4201)
135
135
136
+ #pragma pack(push, 1)
137
+ typedef struct _POOL_HEADER // Size=16
138
+ {
139
+ union
140
+ {
141
+ struct
142
+ {
143
+ unsigned long PreviousSize : 8 ; // Size=4 Offset=0 BitOffset=0 BitCount=8
144
+ unsigned long PoolIndex : 8 ; // Size=4 Offset=0 BitOffset=8 BitCount=8
145
+ unsigned long BlockSize : 8 ; // Size=4 Offset=0 BitOffset=16 BitCount=8
146
+ unsigned long PoolType : 8 ; // Size=4 Offset=0 BitOffset=24 BitCount=8
147
+ };
148
+ unsigned long Ulong1 ; // Size=4 Offset=0
149
+ };
150
+ unsigned long PoolTag ; // Size=4 Offset=4
151
+ union
152
+ {
153
+ struct _EPROCESS * ProcessBilled ; // Size=8 Offset=8
154
+ struct
155
+ {
156
+ unsigned short AllocatorBackTraceIndex ; // Size=2 Offset=8
157
+ unsigned short PoolTagHash ; // Size=2 Offset=10
158
+ };
159
+ };
160
+ } POOL_HEADER , * PPOOL_HEADER ;
161
+ #pragma pack(pop)
136
162
137
163
typedef struct _HANDLE_TABLE_ENTRY // Size=16
138
164
{
Original file line number Diff line number Diff line change @@ -136,34 +136,6 @@ typedef struct _MMVAD // Size=128
136
136
union ___unnamed2048 u4 ; // Size=8 Offset=120
137
137
struct _FILE_OBJECT * FileObject ; // Size=8 Offset=128
138
138
} MMVAD , * PMMVAD ;
139
-
140
- typedef struct _POOL_HEADER // Size=16
141
- {
142
- union
143
- {
144
- struct
145
- {
146
- unsigned short PreviousSize : 8 ; // Size=2 Offset=0 BitOffset=0 BitCount=8
147
- unsigned short PoolIndex : 8 ; // Size=2 Offset=0 BitOffset=8 BitCount=8
148
- };
149
- unsigned long Ulong1 ; // Size=4 Offset=0
150
- };
151
- struct
152
- {
153
- unsigned short BlockSize : 8 ; // Size=2 Offset=2 BitOffset=0 BitCount=8
154
- unsigned short PoolType : 8 ; // Size=2 Offset=2 BitOffset=8 BitCount=8
155
- };
156
- unsigned long PoolTag ; // Size=4 Offset=4
157
- union
158
- {
159
- struct _EPROCESS * ProcessBilled ; // Size=8 Offset=8
160
- struct
161
- {
162
- unsigned short AllocatorBackTraceIndex ; // Size=2 Offset=8
163
- unsigned short PoolTagHash ; // Size=2 Offset=10
164
- };
165
- };
166
- } POOL_HEADER , * PPOOL_HEADER ;
167
139
#pragma pack(pop)
168
140
169
141
typedef struct _HANDLE_TABLE
Original file line number Diff line number Diff line change @@ -153,31 +153,6 @@ typedef struct _MMVAD_LONG // Size=144
153
153
union ___unnamed1320 u4 ; // Size=8 Offset=136
154
154
} MMVAD_LONG , * PMMVAD_LONG ;
155
155
156
- typedef struct _POOL_HEADER // Size=16
157
- {
158
- union
159
- {
160
- struct
161
- {
162
- unsigned long PreviousSize : 8 ; // Size=4 Offset=0 BitOffset=0 BitCount=8
163
- unsigned long PoolIndex : 8 ; // Size=4 Offset=0 BitOffset=8 BitCount=8
164
- unsigned long BlockSize : 8 ; // Size=4 Offset=0 BitOffset=16 BitCount=8
165
- unsigned long PoolType : 8 ; // Size=4 Offset=0 BitOffset=24 BitCount=8
166
- };
167
- unsigned long Ulong1 ; // Size=4 Offset=0
168
- };
169
- unsigned long PoolTag ; // Size=4 Offset=4
170
- union
171
- {
172
- struct _EPROCESS * ProcessBilled ; // Size=8 Offset=8
173
- struct
174
- {
175
- unsigned short AllocatorBackTraceIndex ; // Size=2 Offset=8
176
- unsigned short PoolTagHash ; // Size=2 Offset=10
177
- };
178
- };
179
- } POOL_HEADER , * PPOOL_HEADER ;
180
-
181
156
typedef struct _HANDLE_TABLE
182
157
{
183
158
ULONG_PTR TableCode ;
Original file line number Diff line number Diff line change @@ -136,31 +136,6 @@ typedef struct _MMVAD // Size=128
136
136
union ___unnamed1885 u4 ; // Size=8 Offset=120
137
137
} MMVAD , * PMMVAD ;
138
138
139
- typedef struct _POOL_HEADER // Size=16
140
- {
141
- union
142
- {
143
- struct
144
- {
145
- unsigned long PreviousSize : 8 ; // Size=4 Offset=0 BitOffset=0 BitCount=8
146
- unsigned long PoolIndex : 8 ; // Size=4 Offset=0 BitOffset=8 BitCount=8
147
- unsigned long BlockSize : 8 ; // Size=4 Offset=0 BitOffset=16 BitCount=8
148
- unsigned long PoolType : 8 ; // Size=4 Offset=0 BitOffset=24 BitCount=8
149
- };
150
- unsigned long Ulong1 ; // Size=4 Offset=0
151
- };
152
- unsigned long PoolTag ; // Size=4 Offset=4
153
- union
154
- {
155
- struct _EPROCESS * ProcessBilled ; // Size=8 Offset=8
156
- struct
157
- {
158
- unsigned short AllocatorBackTraceIndex ; // Size=2 Offset=8
159
- unsigned short PoolTagHash ; // Size=2 Offset=10
160
- };
161
- };
162
- } POOL_HEADER , * PPOOL_HEADER ;
163
-
164
139
typedef struct _HANDLE_TABLE
165
140
{
166
141
ULONG NextHandleNeedingPool ;
Original file line number Diff line number Diff line change @@ -132,34 +132,6 @@ typedef struct _MMVAD // Size=128
132
132
struct _EPROCESS * VadsProcess ; // Size=8 Offset=112
133
133
union ___unnamed1957 u4 ; // Size=8 Offset=120
134
134
} MMVAD , * PMMVAD ;
135
-
136
- typedef struct _POOL_HEADER // Size=16
137
- {
138
- union
139
- {
140
- struct
141
- {
142
- unsigned short PreviousSize : 8 ; // Size=2 Offset=0 BitOffset=0 BitCount=8
143
- unsigned short PoolIndex : 8 ; // Size=2 Offset=0 BitOffset=8 BitCount=8
144
- };
145
- unsigned long Ulong1 ; // Size=4 Offset=0
146
- };
147
- struct
148
- {
149
- unsigned short BlockSize : 8 ; // Size=2 Offset=2 BitOffset=0 BitCount=8
150
- unsigned short PoolType : 8 ; // Size=2 Offset=2 BitOffset=8 BitCount=8
151
- };
152
- unsigned long PoolTag ; // Size=4 Offset=4
153
- union
154
- {
155
- struct _EPROCESS * ProcessBilled ; // Size=8 Offset=8
156
- struct
157
- {
158
- unsigned short AllocatorBackTraceIndex ; // Size=2 Offset=8
159
- unsigned short PoolTagHash ; // Size=2 Offset=10
160
- };
161
- };
162
- } POOL_HEADER , * PPOOL_HEADER ;
163
135
#pragma pack(pop)
164
136
165
137
typedef struct _HANDLE_TABLE
You can’t perform that action at this time.
0 commit comments