Min version | XP | Vista |
---|---|---|
Max version | 2003/XP64 SP2 | 10 TH2 |
x86 offset offset:bitpos | Field Name | |
0x0000 | int16_t Type | |
0x0002 | int16_t Size | |
0x0004 | struct _DEVICE_OBJECT * DeviceObject | |
0x0008 | struct _VPB * Vpb | |
0x000C | void * FsContext | |
0x0010 | void * FsContext2 | |
0x0014 | struct _SECTION_OBJECT_POINTERS * SectionObjectPointer | |
0x0018 | void * PrivateCacheMap | |
0x001C | long FinalStatus | |
0x0020 | struct _FILE_OBJECT * RelatedFileObject | |
0x0024 | uint8_t LockOperation | |
0x0025 | uint8_t DeletePending | |
0x0026 | uint8_t ReadAccess | |
0x0027 | uint8_t WriteAccess | |
0x0028 | uint8_t DeleteAccess | |
0x0029 | uint8_t SharedRead | |
0x002A | uint8_t SharedWrite | |
0x002B | uint8_t SharedDelete | |
0x002C | unsigned long Flags | |
0x0030 | struct _UNICODE_STRING FileName | |
0x0038 | union _LARGE_INTEGER CurrentByteOffset | |
0x0040 | unsigned long Waiters | |
0x0044 | unsigned long Busy | |
0x0048 | void * LastLock | |
0x004C | struct _KEVENT Lock | |
0x005C | struct _KEVENT Event | |
0x006C | struct _IO_COMPLETION_CONTEXT * CompletionContext | |
0x0070 | unsigned long IrpListLock | |
0x0074 | struct _LIST_ENTRY IrpList | |
0x007C | void * FileObjectExtension |