x64x86arm64ia64 / ntdllntoskrnl

PO_MEMORY_IMAGE

← first 1 build latest →
struct PO_MEMORY_IMAGE {
unsigned long Signature;/* 0x0 4 */
unsigned long ImageType;/* 0x4 4 */
unsigned long CheckSum;/* 0x8 4 */
unsigned long LengthSelf;/* 0xc 4 */
unsigned __int64 PageSelf;/* 0x10 8 */
unsigned long PageSize;/* 0x18 4 */
/* 4 bytes padding */
unsigned __int64 InterruptTime;/* 0x28 8 */
unsigned long FeatureFlags;/* 0x30 4 */
unsigned char HiberFlags;/* 0x34 1 */
unsigned char HiberSimulateFlags;/* 0x35 1 */
unsigned char spare[2];/* 0x36 2 */
unsigned long NoHiberPtes;/* 0x38 4 */
/* 4 bytes padding */
/* ── cacheline 1 boundary (64 bytes) ── */
unsigned __int64 HiberVa;/* 0x40 8 */
unsigned long RestoredPagesBitmapSize;/* 0x48 4 */
unsigned long RestoredPagesBitmapBitmapCheck;/* 0x4c 4 */
unsigned long WakeCheck;/* 0x50 4 */
/* 4 bytes padding */
unsigned __int64 NumPagesForLoader;/* 0x58 8 */
unsigned __int64 FirstSecureRestorePage;/* 0x60 8 */
unsigned __int64 FirstBootRestorePage;/* 0x68 8 */
unsigned __int64 FirstKernelRestorePage;/* 0x70 8 */
unsigned __int64 FirstChecksumRestorePage;/* 0x78 8 */
/* ── cacheline 2 boundary (128 bytes) ── */
unsigned __int64 NoChecksumEntries;/* 0x80 8 */
/* ── cacheline 13 boundary (832 bytes) ── */
unsigned long FirmwareRuntimeInformationPages;/* 0x370 4 */
/* 4 bytes padding */
unsigned __int64 FirmwareRuntimeInformation[1];/* 0x378 8 */
/* ── cacheline 14 boundary (896 bytes) ── */
unsigned __int64 IumFirmwareRuntimeInformationPageCount;/* 0x380 8 */
unsigned __int64 IumFirmwareRuntimeInformationPfnBase;/* 0x388 8 */
unsigned long SpareUlong;/* 0x390 4 */
unsigned long NoBootLoaderLogPages;/* 0x394 4 */
unsigned __int64 BootLoaderLogPages[24];/* 0x398 192 */
/* ── cacheline 17 boundary (1088 bytes) ── */
unsigned long NotUsed;/* 0x458 4 */
unsigned long ResumeContextCheck;/* 0x45c 4 */
unsigned long ResumeContextPages;/* 0x460 4 */
unsigned long Hiberboot : 1;/* 0x464:0 4 */
unsigned long SecureLaunched : 1;/* 0x464:1 4 */
unsigned long SecureBoot : 1;/* 0x464:2 4 */
unsigned long Fasr : 1;/* 0x464:3 4 */
unsigned long HiberResumeXhciHandoffSkip : 1;/* 0x464:4 4 */
unsigned long InitializeUSBCore : 1;/* 0x464:5 4 */
unsigned long ValidUSBCoreId : 1;/* 0x464:6 4 */
unsigned long SkipMemoryMapValidation : 1;/* 0x464:7 4 */
unsigned long SuppressResumePrompt : 1;/* 0x464:8 4 */
unsigned long Reserved : 23;/* 0x464:9 4 */
unsigned __int64 HvPageTableRoot;/* 0x468 8 */
unsigned __int64 HvEntryPoint;/* 0x470 8 */
unsigned __int64 HvReservedTransitionAddress;/* 0x478 8 */
/* ── cacheline 18 boundary (1152 bytes) ── */
unsigned __int64 HvReservedTransitionAddressSize;/* 0x480 8 */
unsigned __int64 BootFlags;/* 0x488 8 */
unsigned __int64 RestoreProcessorStateRoutine;/* 0x490 8 */
unsigned __int64 HighestPhysicalPage;/* 0x498 8 */
unsigned __int64 BitlockerKeyPfns[4];/* 0x4a0 32 */
/* ── cacheline 19 boundary (1216 bytes) ── */
unsigned long HardwareSignature;/* 0x4c0 4 */
/* 4 bytes padding */
unsigned long SMBiosTableLength;/* 0x4d0 4 */
unsigned char SMBiosMajorVersion;/* 0x4d4 1 */
unsigned char SMBiosMinorVersion;/* 0x4d5 1 */
unsigned char USBCoreId;/* 0x4d6 1 */
};
size 1240 (0x4d8)58 members5 holes (20 bytes)padding 120 cachelines
Used in (1)