win 10 64 14393遍历进程VAD

typedef struct _SEGMENT{

 /*(*((ntkrnlmp!_SEGMENT *)0xffffa405114286d0))[Type:_SEGMENT]
  [+0x000] ControlArea      : 0xffffd18b3276d370[Type:_CONTROL_AREA *]
  [+0x008] TotalNumberOfPtes : 0xa[Type:unsigned long]
  [+0x00c] SegmentFlags[Type:_SEGMENT_FLAGS]
  [+0x010] NumberOfCommittedPages : 0x0[Type:unsigned __int64]
  [+0x018] SizeOfSegment : 0xa000[Type:unsigned __int64]
  [+0x020] ExtendInfo : 0x5dd00000[Type:_MMEXTEND_INFO *]
  [+0x020] BasedAddress : 0x5dd00000[Type:void *]
  [+0x028] SegmentLock[Type:_EX_PUSH_LOCK]
  [+0x030] u1[Type:<unnamed - tag>]
  [+0x038] u2[Type:<unnamed - tag>]
  [+0x040] PrototypePte : 0xffffa4050feab820[Type:_MMPTE *]*/

 PVOID ControlArea;
 LONG32 TotalNumberOfPtes;
 LONG32 SegmentFlags;
 ULONG64 NumberOfCommittedPages;
 ULONG64 SizeOfSegment;
 ULONG64 BasedAddress;//这里也可以利用PE结构体获取模块名字
 //.............

}SEGMENT,*PSEGMENT;

typedef struct _EX_FAST_REF
{
 union
 {
  PVOID Object;
  ULONG_PTR RefCnt : 3;
  ULONG_PTR Value;
 };
} EX_FAST_REF, *PEX_FAST_REF;