Min versionXPVista
Max version2003/XP64 SP210 TH2
x86 offset
offset:bitpos
Field Name
0x0000int16_t
Type
0x0002int16_t
Size
0x0004struct _DEVICE_OBJECT *
DeviceObject
0x0008struct _VPB *
Vpb
0x000Cvoid *
FsContext
0x0010void *
FsContext2
0x0014struct _SECTION_OBJECT_POINTERS *
SectionObjectPointer
0x0018void *
PrivateCacheMap
0x001Clong
FinalStatus
0x0020struct _FILE_OBJECT *
RelatedFileObject
0x0024uint8_t
LockOperation
0x0025uint8_t
DeletePending
0x0026uint8_t
ReadAccess
0x0027uint8_t
WriteAccess
0x0028uint8_t
DeleteAccess
0x0029uint8_t
SharedRead
0x002Auint8_t
SharedWrite
0x002Buint8_t
SharedDelete
0x002Cunsigned long
Flags
0x0030struct _UNICODE_STRING
FileName
0x0038union _LARGE_INTEGER
CurrentByteOffset
0x0040unsigned long
Waiters
0x0044unsigned long
Busy
0x0048void *
LastLock
0x004Cstruct _KEVENT
Lock
0x005Cstruct _KEVENT
Event
0x006Cstruct _IO_COMPLETION_CONTEXT *
CompletionContext
0x0070unsigned long
IrpListLock
0x0074struct _LIST_ENTRY
IrpList
0x007Cvoid *
FileObjectExtension