6.2.9200内核结构

kd> dt ndis!_NDIS_FILTER_BLOCK
   +0x000 Header           : _NDIS_OBJECT_HEADER
   +0x008 NextFilter       : Ptr64 _NDIS_FILTER_BLOCK
   +0x010 FilterDriver     : Ptr64 _NDIS_FILTER_DRIVER_BLOCK
   +0x018 FilterModuleContext : Ptr64 Void
   +0x020 Miniport         : Ptr64 _NDIS_MINIPORT_BLOCK
   +0x028 FilterInstanceName : Ptr64 _UNICODE_STRING
   +0x030 FilterFriendlyName : Ptr64 _UNICODE_STRING
   +0x038 Flags            : Uint4B
   +0x03c StackFlags       : Uint4B
   +0x040 State            : _NDIS_FILTER_STATE
   +0x048 Ref              : _REFERENCE_EX
   +0x060 FakeStatus       : Int4B
   +0x068 NextGlobalFilter : Ptr64 _NDIS_FILTER_BLOCK
   +0x070 LowerFilter      : Ptr64 _NDIS_FILTER_BLOCK
   +0x078 HigherFilter     : Ptr64 _NDIS_FILTER_BLOCK
   +0x080 AsyncOpContext   : Ptr64 _FILTER_PAUSE_RESTART_CONTEXT
   +0x088 NumOfPauseRestartRequests : Int4B
   +0x090 Lock             : Uint8B
   +0x098 LockThread       : Ptr64 Void
   +0x0a0 LockDbg          : Uint4B
   +0x0a8 OidRequestList   : _LIST_ENTRY
   +0x0b8 PendingOidRequest : Ptr64 _NDIS_OID_REQUEST
   +0x0c0 StackExpansionFallback : <unnamed-tag>
   +0x120 StatusIndicationsQueued : UChar
   +0x124 DroppedReceiveNbls : Int4B
   +0x128 DroppedSendNbls  : Int4B
   +0x12c DroppedStatusIndications : Uint4B
   +0x130 DroppedUncloneableStatusIndications : Uint4B
   +0x138 PnPRef           : _REFERENCE_EX
   +0x150 MediaType        : _NDIS_MEDIUM
   +0x154 PhysicalMediaType : _NDIS_PHYSICAL_MEDIUM
   +0x158 MediaConnectState : _NET_IF_MEDIA_CONNECT_STATE
   +0x15c MediaDuplexState : _NET_IF_MEDIA_DUPLEX_STATE
   +0x160 XmitLinkSpeed    : Uint8B
   +0x168 RcvLinkSpeed     : Uint8B
   +0x170 PauseFunctions   : _NDIS_SUPPORTED_PAUSE_FUNCTIONS
   +0x174 AutoNegotiationFlags : Uint4B
   +0x178 XState           : UChar
   +0x179 Reserved1        : UChar
   +0x17a Reserved2        : UChar
   +0x17b Reserved3        : UChar
   +0x17c MediaConnectStateIndicateUp : _NET_IF_MEDIA_CONNECT_STATE
   +0x180 MediaDuplexStateIndicateUp : _NET_IF_MEDIA_DUPLEX_STATE
   +0x188 XmitLinkSpeedIndicateUp : Uint8B
   +0x190 RcvLinkSpeedIndicateUp : Uint8B
   +0x198 PauseFunctionsIndicateUp : _NDIS_SUPPORTED_PAUSE_FUNCTIONS
   +0x19c AutoNegotiationFlagsIndicateUp : Uint4B
   +0x1a0 NextRequestHandle : Ptr64 Void
   +0x1a8 IterativeDataPathTracker : Ptr64 [4] _NDIS_ITERATIVE_DATA_PATH_TRACKER_ENTRY
   +0x1b0 NextSendNetBufferListsHandler : Ptr64     void 
   +0x1b8 NextSendNetBufferListsContext : Ptr64 Void
   +0x1c0 NextSendNetBufferListsTracker : Ptr64 NDIS_NBL_TRACKER_HANDLE__
   +0x1c8 NextSendNetBufferListsObject : Ptr64 _NDIS_OBJECT_HEADER
   +0x1d0 NextSendNetBufferListsCompleteHandler : Ptr64     void 
   +0x1d8 NextSendNetBufferListsCompleteContext : Ptr64 Void
   +0x1e0 NextSendNetBufferListsCompleteTracker : Ptr64 NDIS_NBL_TRACKER_HANDLE__
   +0x1e8 NextSendNetBufferListsCompleteObject : Ptr64 _NDIS_OBJECT_HEADER
   +0x1f0 NextIndicateReceiveNetBufferListsHandler : Ptr64     void 
   +0x1f8 NextIndicateReceiveNetBufferListsContext : Ptr64 Void
   +0x200 NextIndicateReceiveNetBufferListsTracker : Ptr64 NDIS_NBL_TRACKER_HANDLE__
   +0x208 NextIndicateReceiveNetBufferListsObject : Ptr64 _NDIS_OBJECT_HEADER
   +0x210 NextReturnNetBufferListsHandler : Ptr64     void 
   +0x218 NextReturnNetBufferListsContext : Ptr64 Void
   +0x220 NextReturnNetBufferListsTracker : Ptr64 NDIS_NBL_TRACKER_HANDLE__
   +0x228 NextReturnNetBufferListsObject : Ptr64 _NDIS_OBJECT_HEADER
   +0x230 NextCancelSendNetBufferListsHandler : Ptr64     void 
   +0x238 NextCancelSendNetBufferListsContext : Ptr64 Void
   +0x240 Characteristics  : _NDIS_FILTER_PARTIAL_CHARACTERISTICS
   +0x270 FilterSendNetBufferListsHandler : Ptr64     void 
   +0x278 FilterIndicateReceiveNetBufferListsHandler : Ptr64     void 
   +0x280 FilterCancelSendNetBufferListsHandler : Ptr64     void 
   +0x288 InitiateOffloadCompleteHandler : Ptr64     void 
   +0x290 TerminateOffloadCompleteHandler : Ptr64     void 
   +0x298 UpdateOffloadCompleteHandler : Ptr64     void 
   +0x2a0 InvalidateOffloadCompleteHandler : Ptr64     void 
   +0x2a8 QueryOffloadCompleteHandler : Ptr64     void 
   +0x2b0 IndicateOffloadEventHandler : Ptr64     void 
   +0x2b8 TcpOffloadSendCompleteHandler : Ptr64     void 
   +0x2c0 TcpOffloadReceiveCompleteHandler : Ptr64     void 
   +0x2c8 TcpOffloadDisconnectCompleteHandler : Ptr64     void 
   +0x2d0 TcpOffloadForwardCompleteHandler : Ptr64     void 
   +0x2d8 TcpOffloadEventHandler : Ptr64     void 
   +0x2e0 TcpOffloadReceiveIndicateHandler : Ptr64     int 
   +0x2e8 InitiateOffloadHandler : Ptr64     void 
   +0x2f0 TerminateOffloadHandler : Ptr64     void 
   +0x2f8 UpdateOffloadHandler : Ptr64     void 
   +0x300 InvalidateOffloadHandler : Ptr64     void 
   +0x308 QueryOffloadHandler : Ptr64     void 
   +0x310 TcpOffloadReceiveReturnHandler : Ptr64     int 
   +0x318 NblTracker       : Ptr64 NDIS_NBL_TRACKER_HANDLE__
   +0x320 Offload          : Ptr64 _NDIS_FILTER_TASK_OFFLOAD
   +0x328 InterfaceGuid    : _GUID
   +0x338 IfIndex          : Uint4B
   +0x340 IfBlock          : Ptr64 _NDIS_IF_BLOCK
   +0x348 NextDirectRequestHandle : Ptr64 Void
   +0x350 DirectOidRequestCount : Uint4B
   +0x358 WOLPatternList   : _SINGLE_LIST_ENTRY
   +0x360 PMProtocolOffloadList : _SINGLE_LIST_ENTRY
   +0x368 PMCurrentParameters : _NDIS_PM_PARAMETERS

kd> dt ndis!_NDIS_IF_BLOCK
   +0x000 Header           : _NDIS_OBJECT_HEADER
   +0x008 Link             : _LIST_ENTRY
   +0x018 ProviderLink     : _LIST_ENTRY
   +0x028 NetworkLink      : _LIST_ENTRY
   +0x038 ifRcvAddressTable : Ptr64 _NDIS_IF_RCV_ADDRESS
   +0x040 ifRcvAddressCount : Uint4B
   +0x044 ifMaxRcvAddressCount : Uint4B
   +0x048 LowerLayerIfCount : Uint4B
   +0x04c HigherLayerIfCount : Uint4B
   +0x050 Ref              : Int4B
   +0x058 NetLuid          : _NET_LUID_LH
   +0x060 ProviderIfContext : Ptr64 Void
   +0x068 ProviderHandle   : Ptr64 _NDIS_IF_PROVIDER_BLOCK
   +0x070 Flags            : Uint4B
   +0x074 PhysicalLocation : _NET_PHYSICAL_LOCATION_LH
   +0x080 WanTunnelType    : Uint4B
   +0x084 PortNumber       : Uint4B
   +0x088 ifLastChange     : Uint8B
   +0x090 ifCounterDiscontinuityTime : Uint8B
   +0x098 RosInfo          : UChar
   +0x098 ifIndex          : Uint4B
   +0x09c ifDescr          : _IF_COUNTED_STRING_LH
   +0x2a0 ifType           : Uint2B
   +0x2a4 AccessType       : _NET_IF_ACCESS_TYPE
   +0x2a8 DirectionType    : _NET_IF_DIRECTION_TYPE
   +0x2ac ConnectionType   : _NET_IF_CONNECTION_TYPE
   +0x2b0 InterfaceGuid    : _GUID
   +0x2c0 ifConnectorPresent : UChar
   +0x2c4 ifFlags          : Uint4B
   +0x2c8 MediaType        : _NDIS_MEDIUM
   +0x2cc PhysicalMediumType : _NDIS_PHYSICAL_MEDIUM
   +0x2d0 RodInfo          : UChar
   +0x2d0 CompartmentId    : Uint4B
   +0x2d4 NetworkGuid      : _GUID
   +0x2e4 ifAlias          : _IF_COUNTED_STRING_LH
   +0x4e8 ifOperStatus     : _NET_IF_OPER_STATUS
   +0x4ec ifOperStatusFlags : Uint4B
   +0x4f0 ifMtu            : Uint4B
   +0x4f4 ifPhysAddress    : _IF_PHYSICAL_ADDRESS_LH
   +0x516 PermanentPhysAddress : _IF_PHYSICAL_ADDRESS_LH
   +0x538 ifAdminStatus    : _NET_IF_ADMIN_STATUS
   +0x540 XmitLinkSpeed    : Uint8B
   +0x548 RcvLinkSpeed     : Uint8B
   +0x550 ifPromiscuousMode : UChar
   +0x551 ifDeviceWakeUpEnable : UChar
   +0x554 MediaConnectState : _NET_IF_MEDIA_CONNECT_STATE
   +0x558 MediaDuplexState : _NET_IF_MEDIA_DUPLEX_STATE
   +0x560 Network          : Ptr64 _NDIS_IF_NETWORK_BLOCK
   +0x568 Compartment      : Ptr64 _NDIS_IF_COMPARTMENT_BLOCK
   +0x570 AsyncEvent       : Ptr64 _KEVENT
   +0x578 bNdisIsProvider  : UChar
   +0x579 IsNdisFilter     : UChar
   +0x57a MiniportAvailable : UChar
   +0x57c MiniportLinkReference : Uint4B
   +0x580 Miniport         : Ptr64 _NDIS_MINIPORT_BLOCK
   +0x580 Filter           : Ptr64 _NDIS_FILTER_BLOCK
   +0x588 SupportedStatistics : Uint4B
   +0x590 ifL2NetworkInfo  : Ptr64 _IF_COUNTED_STRING_LH
   +0x598 RefCountTracker  : Ptr64 NDIS_REFCOUNT_HANDLE__
   +0x5a0 MpRefCountTracker : Ptr64 NDIS_REFCOUNT_HANDLE__

kd> dt nt!_EPROCESS
   +0x000 Pcb              : _KPROCESS
   +0x2c8 ProcessLock      : _EX_PUSH_LOCK
   +0x2d0 CreateTime       : _LARGE_INTEGER
   +0x2d8 RundownProtect   : _EX_RUNDOWN_REF
   +0x2e0 UniqueProcessId  : Ptr64 Void
   +0x2e8 ActiveProcessLinks : _LIST_ENTRY
   +0x2f8 Flags2           : Uint4B
   +0x2f8 JobNotReallyActive : Pos 0, 1 Bit
   +0x2f8 AccountingFolded : Pos 1, 1 Bit
   +0x2f8 NewProcessReported : Pos 2, 1 Bit
   +0x2f8 ExitProcessReported : Pos 3, 1 Bit
   +0x2f8 ReportCommitChanges : Pos 4, 1 Bit
   +0x2f8 LastReportMemory : Pos 5, 1 Bit
   +0x2f8 NoWakeCharge     : Pos 6, 1 Bit
   +0x2f8 HandleTableRundown : Pos 7, 1 Bit
   +0x2f8 NeedsHandleRundown : Pos 8, 1 Bit
   +0x2f8 RefTraceEnabled  : Pos 9, 1 Bit
   +0x2f8 NumaAware        : Pos 10, 1 Bit
   +0x2f8 EmptyJobEvaluated : Pos 11, 1 Bit
   +0x2f8 DefaultPagePriority : Pos 12, 3 Bits
   +0x2f8 PrimaryTokenFrozen : Pos 15, 1 Bit
   +0x2f8 ProcessVerifierTarget : Pos 16, 1 Bit
   +0x2f8 StackRandomizationDisabled : Pos 17, 1 Bit
   +0x2f8 AffinityPermanent : Pos 18, 1 Bit
   +0x2f8 AffinityUpdateEnable : Pos 19, 1 Bit
   +0x2f8 PropagateNode    : Pos 20, 1 Bit
   +0x2f8 ExplicitAffinity : Pos 21, 1 Bit
   +0x2f8 ProcessExecutionState : Pos 22, 2 Bits
   +0x2f8 DisallowStrippedImages : Pos 24, 1 Bit
   +0x2f8 HighEntropyASLREnabled : Pos 25, 1 Bit
   +0x2f8 ExtensionPointDisable : Pos 26, 1 Bit
   +0x2f8 ForceRelocateImages : Pos 27, 1 Bit
   +0x2f8 ProcessStateChangeRequest : Pos 28, 2 Bits
   +0x2f8 ProcessStateChangeInProgress : Pos 30, 1 Bit
   +0x2f8 DisallowWin32kSystemCalls : Pos 31, 1 Bit
   +0x2fc Flags            : Uint4B
   +0x2fc CreateReported   : Pos 0, 1 Bit
   +0x2fc NoDebugInherit   : Pos 1, 1 Bit
   +0x2fc ProcessExiting   : Pos 2, 1 Bit
   +0x2fc ProcessDelete    : Pos 3, 1 Bit
   +0x2fc Wow64SplitPages  : Pos 4, 1 Bit
   +0x2fc VmDeleted        : Pos 5, 1 Bit
   +0x2fc OutswapEnabled   : Pos 6, 1 Bit
   +0x2fc Outswapped       : Pos 7, 1 Bit
   +0x2fc ForkFailed       : Pos 8, 1 Bit
   +0x2fc Wow64VaSpace4Gb  : Pos 9, 1 Bit
   +0x2fc AddressSpaceInitialized : Pos 10, 2 Bits
   +0x2fc SetTimerResolution : Pos 12, 1 Bit
   +0x2fc BreakOnTermination : Pos 13, 1 Bit
   +0x2fc DeprioritizeViews : Pos 14, 1 Bit
   +0x2fc WriteWatch       : Pos 15, 1 Bit
   +0x2fc ProcessInSession : Pos 16, 1 Bit
   +0x2fc OverrideAddressSpace : Pos 17, 1 Bit
   +0x2fc HasAddressSpace  : Pos 18, 1 Bit
   +0x2fc LaunchPrefetched : Pos 19, 1 Bit
   +0x2fc Background       : Pos 20, 1 Bit
   +0x2fc VmTopDown        : Pos 21, 1 Bit
   +0x2fc ImageNotifyDone  : Pos 22, 1 Bit
   +0x2fc PdeUpdateNeeded  : Pos 23, 1 Bit
   +0x2fc VdmAllowed       : Pos 24, 1 Bit
   +0x2fc CrossSessionCreate : Pos 25, 1 Bit
   +0x2fc ProcessInserted  : Pos 26, 1 Bit
   +0x2fc DefaultIoPriority : Pos 27, 3 Bits
   +0x2fc ProcessSelfDelete : Pos 30, 1 Bit
   +0x2fc SetTimerResolutionLink : Pos 31, 1 Bit
   +0x300 ProcessQuotaUsage : [2] Uint8B
   +0x310 ProcessQuotaPeak : [2] Uint8B
   +0x320 PeakVirtualSize  : Uint8B
   +0x328 VirtualSize      : Uint8B
   +0x330 SessionProcessLinks : _LIST_ENTRY
   +0x340 ExceptionPortData : Ptr64 Void
   +0x340 ExceptionPortValue : Uint8B
   +0x340 ExceptionPortState : Pos 0, 3 Bits
   +0x348 Token            : _EX_FAST_REF
   +0x350 WorkingSetPage   : Uint8B
   +0x358 AddressCreationLock : _EX_PUSH_LOCK
   +0x360 RotateInProgress : Ptr64 _ETHREAD
   +0x368 ForkInProgress   : Ptr64 _ETHREAD
   +0x370 HardwareTrigger  : Uint8B
   +0x378 CommitChargeJob  : Ptr64 _EJOB
   +0x380 CloneRoot        : Ptr64 _MM_AVL_TABLE
   +0x388 NumberOfPrivatePages : Uint8B
   +0x390 NumberOfLockedPages : Uint8B
   +0x398 Win32Process     : Ptr64 Void
   +0x3a0 Job              : Ptr64 _EJOB
   +0x3a8 SectionObject    : Ptr64 Void
   +0x3b0 SectionBaseAddress : Ptr64 Void
   +0x3b8 Cookie           : Uint4B
   +0x3c0 WorkingSetWatch  : Ptr64 _PAGEFAULT_HISTORY
   +0x3c8 Win32WindowStation : Ptr64 Void
   +0x3d0 InheritedFromUniqueProcessId : Ptr64 Void
   +0x3d8 LdtInformation   : Ptr64 Void
   +0x3e0 CreatorProcess   : Ptr64 _EPROCESS
   +0x3e0 ConsoleHostProcess : Uint8B
   +0x3e8 Peb              : Ptr64 _PEB
   +0x3f0 Session          : Ptr64 Void
   +0x3f8 AweInfo          : Ptr64 Void
   +0x400 QuotaBlock       : Ptr64 _EPROCESS_QUOTA_BLOCK
   +0x408 ObjectTable      : Ptr64 _HANDLE_TABLE
   +0x410 DebugPort        : Ptr64 Void
   +0x418 Wow64Process     : Ptr64 Void
   +0x420 DeviceMap        : Ptr64 Void
   +0x428 EtwDataSource    : Ptr64 Void
   +0x430 PageDirectoryPte : Uint8B
   +0x438 ImageFileName    : [15] UChar
   +0x447 PriorityClass    : UChar
   +0x448 SecurityPort     : Ptr64 Void
   +0x450 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
   +0x458 JobLinks         : _LIST_ENTRY
   +0x468 HighestUserAddress : Ptr64 Void
   +0x470 ThreadListHead   : _LIST_ENTRY
   +0x480 ActiveThreads    : Uint4B
   +0x484 ImagePathHash    : Uint4B
   +0x488 DefaultHardErrorProcessing : Uint4B
   +0x48c LastThreadExitStatus : Int4B
   +0x490 PrefetchTrace    : _EX_FAST_REF
   +0x498 LockedPagesList  : Ptr64 _MM_AVL_TABLE
   +0x4a0 ReadOperationCount : _LARGE_INTEGER
   +0x4a8 WriteOperationCount : _LARGE_INTEGER
   +0x4b0 OtherOperationCount : _LARGE_INTEGER
   +0x4b8 ReadTransferCount : _LARGE_INTEGER
   +0x4c0 WriteTransferCount : _LARGE_INTEGER
   +0x4c8 OtherTransferCount : _LARGE_INTEGER
   +0x4d0 CommitChargeLimit : Uint8B
   +0x4d8 CommitCharge     : Uint8B
   +0x4e0 CommitChargePeak : Uint8B
   +0x4e8 Vm               : _MMSUPPORT
   +0x578 MmProcessLinks   : _LIST_ENTRY
   +0x588 ModifiedPageCount : Uint4B
   +0x58c ExitStatus       : Int4B
   +0x590 VadRoot          : _MM_AVL_TABLE
   +0x5c0 VadPhysicalPages : Uint8B
   +0x5c8 VadPhysicalPagesLimit : Uint8B
   +0x5d0 AlpcContext      : _ALPC_PROCESS_CONTEXT
   +0x5f0 TimerResolutionLink : _LIST_ENTRY
   +0x600 TimerResolutionStackRecord : Ptr64 _PO_DIAG_STACK_RECORD
   +0x608 RequestedTimerResolution : Uint4B
   +0x60c SmallestTimerResolution : Uint4B
   +0x610 ExitTime         : _LARGE_INTEGER
   +0x618 InvertedFunctionTable : Ptr64 _INVERTED_FUNCTION_TABLE
   +0x620 InvertedFunctionTableLock : _EX_PUSH_LOCK
   +0x628 ActiveThreadsHighWatermark : Uint4B
   +0x62c LargePrivateVadCount : Uint4B
   +0x630 ThreadListLock   : _EX_PUSH_LOCK
   +0x638 WnfContext       : Ptr64 Void
   +0x640 SectionMappingSize : Uint8B
   +0x648 SignatureLevel   : UChar
   +0x649 SectionSignatureLevel : UChar
   +0x64a SpareByte20      : [2] UChar
   +0x64c KeepAliveCounter : Uint4B
   +0x650 DiskCounters     : Ptr64 _PROCESS_DISK_COUNTERS
   +0x658 LastFreezeInterruptTime : Uint8B