Min version | XP | 2003/XP64 SP1 | Vista | Vista SP1 | |
---|---|---|---|---|---|
Max version | 2003/XP64 SP2 | 10 TH2 | |||
Architecture | x86 | x64 | x86 | x64 | |
x86 offset offset:bitpos | Field Name | x64 offset offset:bitpos | |||
0x0000 | int16_t Type | 0x0000 | |||
0x0002 | int16_t Size | 0x0002 | |||
0x0004 | struct _DEVICE_OBJECT * DeviceObject | 0x0008 | |||
0x0008 | struct _VPB * Vpb | 0x0010 | |||
0x000C | void * FsContext | 0x0018 | |||
0x0010 | void * FsContext2 | 0x0020 | |||
0x0014 | struct _SECTION_OBJECT_POINTERS * SectionObjectPointer | 0x0028 | |||
0x0018 | void * PrivateCacheMap | 0x0030 | |||
0x001C | long FinalStatus | 0x0038 | |||
0x0020 | struct _FILE_OBJECT * RelatedFileObject | 0x0040 | |||
0x0024 | uint8_t LockOperation | 0x0048 | |||
0x0025 | uint8_t DeletePending | 0x0049 | |||
0x0026 | uint8_t ReadAccess | 0x004A | |||
0x0027 | uint8_t WriteAccess | 0x004B | |||
0x0028 | uint8_t DeleteAccess | 0x004C | |||
0x0029 | uint8_t SharedRead | 0x004D | |||
0x002A | uint8_t SharedWrite | 0x004E | |||
0x002B | uint8_t SharedDelete | 0x004F | |||
0x002C | unsigned long Flags | 0x0050 | |||
0x0030 | struct _UNICODE_STRING FileName | 0x0058 | |||
0x0038 | union _LARGE_INTEGER CurrentByteOffset | 0x0068 | |||
0x0040 | unsigned long Waiters | 0x0070 | |||
0x0044 | unsigned long Busy | 0x0074 | |||
0x0048 | void * LastLock | 0x0078 | |||
0x004C | struct _KEVENT Lock | 0x0080 | |||
0x005C | struct _KEVENT Event | 0x0098 | |||
0x006C | struct _IO_COMPLETION_CONTEXT * CompletionContext | 0x00B0 | |||
0x0070 | uintptr_t IrpListLock | 0x00B8 | |||
0x0074 | struct _LIST_ENTRY IrpList | 0x00C0 | |||
0x007C | void * FileObjectExtension | 0x00D0 |