10.0.22000.258内核结构

1: kd> dt ndis!_NDIS_FILTER_BLOCK
   +0x000 Header           : _NDIS_OBJECT_HEADER
   +0x008 NextFilter       : Ptr64 _NDIS_FILTER_BLOCK
   +0x010 FilterDriver     : Ptr64 _NDIS_FILTER_DRIVER_BLOCK
   +0x018 FilterModuleContext : Ptr64 Void
   +0x020 Miniport         : Ptr64 _NDIS_MINIPORT_BLOCK
   +0x028 FilterInstanceName : wistd::unique_ptr<Rtl::KString,wistd::default_delete<Rtl::KString> >
   +0x030 FilterFriendlyName : Ptr64 _UNICODE_STRING
   +0x038 Flags            : Uint4B
   +0x03c StackFlags       : Uint4B
   +0x040 State            : _NDIS_FILTER_STATE
   +0x048 Ref              : _REFERENCE_EX
   +0x060 FakeStatus       : Int4B
   +0x068 NextGlobalFilter : Ptr64 _NDIS_FILTER_BLOCK
   +0x070 LowerFilter      : Ptr64 _NDIS_FILTER_BLOCK
   +0x078 HigherFilter     : Ptr64 _NDIS_FILTER_BLOCK
   +0x080 AsyncOpContext   : Ptr64 _FILTER_PAUSE_RESTART_CONTEXT
   +0x088 NumOfPauseRestartRequests : Int4B
   +0x090 Lock             : Uint8B
   +0x098 LockThread       : Ptr64 Void
   +0x0a0 OidRequestList   : _LIST_ENTRY
   +0x0b0 PendingOidRequest : Ptr64 _NDIS_OID_REQUEST
   +0x0b8 PendingOidWatchdog : wil::unique_any_t<wil::details::unique_storage<wil::details::resource_policy<NDISWATCHDOG__ *,void (__cdecl*)(NDISWATCHDOG__ *),&ndisFreeWatchdog,wistd::integral_constant<unsigned __int64,1>,NDISWATCHDOG__ *,__int64,-1,std::nullptr_t> > >
   +0x0c0 StackExpansionFallback : _NDIS_FILTER_BLOCK::<unnamed-type-StackExpansionFallback>
   +0x120 StatusIndicationsQueued : UChar
   +0x124 DroppedReceiveNbls : Int4B
   +0x128 DroppedSendNbls  : Int4B
   +0x12c DroppedStatusIndications : Uint4B
   +0x130 DroppedUncloneableStatusIndications : Uint4B
   +0x138 PnPRef           : _REFERENCE_EX
   +0x150 MediaType        : _NDIS_MEDIUM
   +0x154 PhysicalMediaType : _NDIS_PHYSICAL_MEDIUM
   +0x158 MediaConnectState : _NET_IF_MEDIA_CONNECT_STATE
   +0x15c MediaDuplexState : _NET_IF_MEDIA_DUPLEX_STATE
   +0x160 XmitLinkSpeed    : Uint8B
   +0x168 RcvLinkSpeed     : Uint8B
   +0x170 PauseFunctions   : _NDIS_SUPPORTED_PAUSE_FUNCTIONS
   +0x174 AutoNegotiationFlags : Uint4B
   +0x178 XState           : UChar
   +0x179 Reserved1        : UChar
   +0x17a Reserved2        : UChar
   +0x17b Reserved3        : UChar
   +0x17c MediaConnectStateIndicateUp : _NET_IF_MEDIA_CONNECT_STATE
   +0x180 MediaDuplexStateIndicateUp : _NET_IF_MEDIA_DUPLEX_STATE
   +0x188 XmitLinkSpeedIndicateUp : Uint8B
   +0x190 RcvLinkSpeedIndicateUp : Uint8B
   +0x198 PauseFunctionsIndicateUp : _NDIS_SUPPORTED_PAUSE_FUNCTIONS
   +0x19c AutoNegotiationFlagsIndicateUp : Uint4B
   +0x1a0 NextRequestHandle : Ptr64 Void
   +0x1a8 IterativeDataPathTracker : Ptr64 [4] _NDIS_ITERATIVE_DATA_PATH_TRACKER_ENTRY
   +0x1b0 NextSendNetBufferListsHandler : Ptr64     void 
   +0x1b8 NextSendNetBufferListsContext : Ptr64 Void
   +0x1c0 NextSendNetBufferListsTracker : Ptr64 NDIS_NBL_TRACKER_HANDLE__
   +0x1c8 NextSendNetBufferListsObject : Ptr64 _NDIS_OBJECT_HEADER
   +0x1d0 NextSendNetBufferListsCompleteHandler : Ptr64     void 
   +0x1d8 NextSendNetBufferListsCompleteContext : Ptr64 Void
   +0x1e0 NextSendNetBufferListsCompleteTracker : Ptr64 NDIS_NBL_TRACKER_HANDLE__
   +0x1e8 NextSendNetBufferListsCompleteObject : Ptr64 _NDIS_OBJECT_HEADER
   +0x1f0 NextIndicateReceiveNetBufferListsHandler : Ptr64     void 
   +0x1f8 NextIndicateReceiveNetBufferListsContext : Ptr64 Void
   +0x200 NextIndicateReceiveNetBufferListsTracker : Ptr64 NDIS_NBL_TRACKER_HANDLE__
   +0x208 NextIndicateReceiveNetBufferListsObject : Ptr64 _NDIS_OBJECT_HEADER
   +0x210 NextReturnNetBufferListsHandler : Ptr64     void 
   +0x218 NextReturnNetBufferListsContext : Ptr64 Void
   +0x220 NextReturnNetBufferListsTracker : Ptr64 NDIS_NBL_TRACKER_HANDLE__
   +0x228 NextReturnNetBufferListsObject : Ptr64 _NDIS_OBJECT_HEADER
   +0x230 NextCancelSendNetBufferListsHandler : Ptr64     void 
   +0x238 NextCancelSendNetBufferListsContext : Ptr64 Void
   +0x240 Characteristics  : _NDIS_FILTER_PARTIAL_CHARACTERISTICS
   +0x270 FilterSendNetBufferListsHandler : Ptr64     void 
   +0x278 FilterIndicateReceiveNetBufferListsHandler : Ptr64     void 
   +0x280 FilterCancelSendNetBufferListsHandler : Ptr64     void 
   +0x288 NblTracker       : Ptr64 NDIS_NBL_TRACKER_HANDLE__
   +0x290 Offload          : Ptr64 _NDIS_FILTER_TASK_OFFLOAD
   +0x298 InterfaceGuid    : _GUID
   +0x2a8 IfIndex          : Uint4B
   +0x2b0 IfBlock          : Ptr64 _NDIS_IF_BLOCK
   +0x2b8 NextDirectRequestHandle : Ptr64 Void
   +0x2c0 DirectOidRequestCount : Uint4B
   +0x2c8 WOLPatternList   : _SINGLE_LIST_ENTRY
   +0x2d0 PMProtocolOffloadList : _SINGLE_LIST_ENTRY
   +0x2d8 PMCurrentParameters : _NDIS_PM_PARAMETERS
   +0x2f0 Bind             : Ptr64 NDIS_BIND_FILTER_LINK
   +0x2f8 HwTimestampCapabilities : Ptr64 _NDIS_TIMESTAMP_CAPABILITIES
   +0x300 HwTimestampCurrentConfig : Ptr64 _NDIS_TIMESTAMP_CAPABILITIES
   +0x308 VerifierContext  : Ptr64 Void
   +0x310 PktMonComp       : _PKTMON_COMPONENT_CONTEXT
   +0x320 PktMonEdgeLower  : _PKTMON_EDGE_CONTEXT
   +0x338 PktMonEdgeUpper  : _PKTMON_EDGE_CONTEXT

1: kd> dt ndis!_NDIS_IF_BLOCK
   +0x000 Type             : UChar
   +0x001 Revision         : UChar
   +0x002 Size             : Uint2B
   +0x004 ifIndex          : Uint4B
   +0x008 ifDescr          : _IF_COUNTED_STRING_LH
   +0x20c ifType           : Uint2B
   +0x210 AccessType       : _NET_IF_ACCESS_TYPE
   +0x214 DirectionType    : _NET_IF_DIRECTION_TYPE
   +0x218 ConnectionType   : _NET_IF_CONNECTION_TYPE
   +0x21c InterfaceGuid    : _GUID
   +0x22c ifConnectorPresent : UChar
   +0x230 ifFlags          : Uint4B
   +0x234 MediaType        : _NDIS_MEDIUM
   +0x238 PhysicalMediumType : _NDIS_PHYSICAL_MEDIUM
   +0x240 CompartmentId    : Uint4B
   +0x244 NetworkGuid      : _GUID
   +0x254 ifAlias          : _IF_COUNTED_STRING_LH
   +0x458 ifOperStatus     : _NET_IF_OPER_STATUS
   +0x45c ifOperStatusFlags : Uint4B
   +0x460 ifMtu            : Uint4B
   +0x464 ifPhysAddress    : _IF_PHYSICAL_ADDRESS_LH
   +0x486 PermanentPhysAddress : _IF_PHYSICAL_ADDRESS_LH
   +0x4a8 ifAdminStatus    : _NET_IF_ADMIN_STATUS
   +0x4b0 XmitLinkSpeed    : Uint8B
   +0x4b8 RcvLinkSpeed     : Uint8B
   +0x4c0 ifPromiscuousMode : UChar
   +0x4c1 ifDeviceWakeUpEnable : UChar
   +0x4c2 ifHideInterfaceInUi : UChar
   +0x4c4 MediaConnectState : _NET_IF_MEDIA_CONNECT_STATE
   +0x4c8 MediaDuplexState : _NET_IF_MEDIA_DUPLEX_STATE
   +0x4d0 Link             : _LIST_ENTRY
   +0x4e0 ProviderLink     : _LIST_ENTRY
   +0x4f0 NetworkLink      : _LIST_ENTRY
   +0x500 ifRcvAddressTable : Ptr64 _NDIS_IF_RCV_ADDRESS
   +0x508 ifRcvAddressCount : Uint4B
   +0x50c ifMaxRcvAddressCount : Uint4B
   +0x510 LowerLayerIfCount : Uint4B
   +0x514 HigherLayerIfCount : Uint4B
   +0x518 Ref              : Int4B
   +0x520 NetLuid          : _NET_LUID_LH
   +0x528 ProviderIfContext : Ptr64 Void
   +0x530 ProviderHandle   : Ptr64 _NDIS_IF_PROVIDER_BLOCK
   +0x538 Flags            : Uint4B
   +0x53c WanTunnelType    : Uint4B
   +0x540 PortNumber       : Uint4B
   +0x548 ifLastChange     : Uint8B
   +0x550 ifCounterDiscontinuityTime : Uint8B
   +0x558 Network          : Ptr64 _NDIS_IF_NETWORK_BLOCK
   +0x560 Compartment      : Ptr64 _NDIS_IF_COMPARTMENT_BLOCK
   +0x568 AsyncEvent       : Ptr64 _KEVENT
   +0x570 AlreadyDeregistered : UChar
   +0x571 bNdisIsProvider  : UChar
   +0x572 IsNdisFilter     : UChar
   +0x573 MiniportAvailable : UChar
   +0x574 MiniportLinkReference : Uint4B
   +0x578 Source           : NdisIfBlockSource
   +0x580 Miniport         : Ptr64 _NDIS_MINIPORT_BLOCK
   +0x580 Filter           : Ptr64 _NDIS_FILTER_BLOCK
   +0x588 SupportedStatistics : Uint4B
   +0x590 ifL2NetworkInfo  : Ptr64 _IF_COUNTED_STRING_LH
   +0x598 RefCountTracker  : Ptr64 NDIS_REFCOUNT_HANDLE__
   +0x5a0 MpRefCountTracker : Ptr64 NDIS_REFCOUNT_HANDLE__
   +0x5a8 InterlockedFlags : Uint4B
   +0x5ac LastMiniportFatalErrorReason : _NDIS_MINIPORT_EVENT
   +0x5b0 MiniportFatalErrorTimestamp : [3] Uint8B
   +0x5c8 MiniportFatalErrorTimestampIndex : UChar
   +0x5c9 NetworkIdOverridden : UChar
   +0x5ca IsWDFMiniportInterface : UChar
   +0x5cc ifPurpose        : _NDIS_NSI_INTERFACE_PURPOSE
   +0x5d0 PcwDataBlock     : Ptr64 _NDIS_PCW_DATA_BLOCK

1: kd> dt nt!_EPROCESS
   +0x000 Pcb              : _KPROCESS
   +0x438 ProcessLock      : _EX_PUSH_LOCK
   +0x440 UniqueProcessId  : Ptr64 Void