_CMHIVE

Metadatacopy
struct _CMHIVE {
    struct _HHIVE Hive;/* 0x0  1544 */
    /* ── cacheline 24 boundary (1536 bytes) ── */
    void* FileHandles[6];/* 0x608  48 */
    struct _LIST_ENTRY NotifyList;/* 0x638  16 */
    /* ── cacheline 25 boundary (1600 bytes) ── */
    struct _LIST_ENTRY HiveList;/* 0x648  16 */
    struct _LIST_ENTRY PreloadedHiveList;/* 0x658  16 */
    struct _EX_RUNDOWN_REF HiveRundown;/* 0x668  8 */
    struct _CM_KEY_HASH_TABLE_ENTRY* KcbCacheTable;/* 0x670  8 */
    unsigned long KcbCacheTableSize;/* 0x678  4 */
    /* 4 bytes padding */
    /* ── cacheline 26 boundary (1664 bytes) ── */
    struct _CM_KEY_HASH_TABLE_ENTRY* DeletedKcbTable;/* 0x680  8 */
    unsigned long DeletedKcbTableSize;/* 0x688  4 */
    unsigned long Identity;/* 0x68c  4 */
    struct _CMSI_RW_LOCK HiveLock;/* 0x690  8 */
    struct _RTL_BITMAP FlushDirtyVector;/* 0x698  16 */
    unsigned long FlushDirtyVectorSize;/* 0x6a8  4 */
    /* 4 bytes padding */
    struct CMP_OFFSET_ARRAY* FlushLogEntryOffsetArray;/* 0x6b0  8 */
    unsigned long FlushLogEntryOffsetArrayCount;/* 0x6b8  4 */
    unsigned long FlushLogEntrySize;/* 0x6bc  4 */
    /* ── cacheline 27 boundary (1728 bytes) ── */
    unsigned long FlushHiveTruncated;/* 0x6c0  4 */
    unsigned char FlushBaseBlockDirty;/* 0x6c4  1 */
    /* 3 bytes padding */
    struct _RTL_BITMAP CapturedUnreconciledVector;/* 0x6c8  16 */
    unsigned long CapturedUnreconciledVectorSize;/* 0x6d8  4 */
    /* 4 bytes padding */
    struct CMP_OFFSET_ARRAY* UnreconciledOffsetArray;/* 0x6e0  8 */
    unsigned long UnreconciledOffsetArrayCount;/* 0x6e8  4 */
    /* 4 bytes padding */
    struct _HBASE_BLOCK* UnreconciledBaseBlock;/* 0x6f0  8 */
    struct _EX_PUSH_LOCK SecurityLock;/* 0x6f8  8 */
    /* ── cacheline 28 boundary (1792 bytes) ── */
    unsigned long LastShrinkHiveSize;/* 0x700  4 */
    /* 4 bytes padding */
    union _LARGE_INTEGER ActualFileSize;/* 0x708  8 */
    union _LARGE_INTEGER LogFileSizes[2];/* 0x710  16 */
    struct _UNICODE_STRING FileFullPath;/* 0x720  16 */
    struct _UNICODE_STRING FileUserName;/* 0x730  16 */
    /* ── cacheline 29 boundary (1856 bytes) ── */
    struct _UNICODE_STRING HiveRootPath;/* 0x740  16 */
    unsigned long SecurityCount;/* 0x750  4 */
    unsigned long SecurityCacheSize;/* 0x754  4 */
    long SecurityHitHint;/* 0x758  4 */
    /* 4 bytes padding */
    struct _CM_KEY_SECURITY_CACHE_ENTRY* SecurityCache;/* 0x760  8 */
    struct _LIST_ENTRY SecurityHash[64];/* 0x768  1024 */
    /* ── cacheline 45 boundary (2880 bytes) ── */
    unsigned long UnloadEventCount;/* 0xb68  4 */
    /* 4 bytes padding */
    struct _KEVENT** UnloadEventArray;/* 0xb70  8 */
    struct _CM_KEY_CONTROL_BLOCK* RootKcb;/* 0xb78  8 */
    /* ── cacheline 46 boundary (2944 bytes) ── */
    unsigned char Frozen;/* 0xb80  1 */
    /* 7 bytes padding */
    struct _CM_DIRTY_VECTOR_LOG DirtyVectorLog;/* 0xb88  1160 */
    /* ── cacheline 64 boundary (4096 bytes) ── */
    unsigned long Flags;/* 0x1010  4 */
    /* 4 bytes padding */
    struct _LIST_ENTRY TrustClassEntry;/* 0x1018  16 */
    unsigned __int64 DirtyTime;/* 0x1028  8 */
    unsigned __int64 UnreconciledTime;/* 0x1030  8 */
    struct _CM_RM* CmRm;/* 0x1038  8 */
    /* ── cacheline 65 boundary (4160 bytes) ── */
    unsigned long CmRmInitFailPoint;/* 0x1040  4 */
    long CmRmInitFailStatus;/* 0x1044  4 */
    struct _KTHREAD* CreatorOwner;/* 0x1048  8 */
    struct _KTHREAD* RundownThread;/* 0x1050  8 */
    union _LARGE_INTEGER LastWriteTime;/* 0x1058  8 */
    struct _HIVE_WRITE_WAIT_QUEUE FlushQueue;/* 0x1060  16 */
    struct _HIVE_WRITE_WAIT_QUEUE ReconcileQueue;/* 0x1070  16 */
    /* ── cacheline 66 boundary (4224 bytes) ── */
    union {
        unsigned long FlushFlags;/* 0x1080  4 */
        struct {
            unsigned long PrimaryFilePurged : 1;/* 0x1080:0  4 */
            unsigned long DiskFileBad : 1;/* 0x1080:1  4 */
        };/* 0x1080  4 */
    };/* 0x1080  4 */
    unsigned long PrimaryFileSizeBeforeLastFlush;/* 0x1084  4 */
    volatile long ReferenceCount;/* 0x1088  4 */
    long UnloadHistoryIndex;/* 0x108c  4 */
    unsigned long UnloadHistory[128];/* 0x1090  512 */
    /* ── cacheline 74 boundary (4736 bytes) ── */
    unsigned long BootStart;/* 0x1290  4 */
    unsigned long UnaccessedStart;/* 0x1294  4 */
    unsigned long UnaccessedEnd;/* 0x1298  4 */
    unsigned long LoadedKeyCount;/* 0x129c  4 */
    volatile unsigned long HandleClosePending;/* 0x12a0  4 */
    /* 4 bytes padding */
    struct _EX_PUSH_LOCK HandleClosePendingEvent;/* 0x12a8  8 */
    unsigned char FinalFlushSucceeded;/* 0x12b0  1 */
    /* 7 bytes padding */
    struct _CMP_VOLUME_CONTEXT* VolumeContext;/* 0x12b8  8 */
    /* ── cacheline 75 boundary (4800 bytes) ── */
    unsigned long LateUnloadWorkItemState;/* 0x12c0  4 */
    /* 4 bytes padding */
    struct _EX_PUSH_LOCK LateUnloadFinishedEvent;/* 0x12c8  8 */
    struct _WORK_QUEUE_ITEM* LateUnloadWorkItem;/* 0x12d0  8 */
};