arm64 / ntdllntoskrnl /

_ETWP_NOTIFICATION_HEADER

← first 1 build latest →
struct _ETWP_NOTIFICATION_HEADER {
unsigned long NotificationSize;/* 0x4 4 */
long RefCount;/* 0x8 4 */
unsigned char ReplyRequested;/* 0xc 1 */
/* 3 bytes padding */
union {
unsigned long ReplyIndex;/* 0x10 4 */
unsigned long Timeout;/* 0x10 4 */
};/* 0x10 4 */
union {
unsigned long ReplyCount;/* 0x14 4 */
unsigned long NotifyeeCount;/* 0x14 4 */
};/* 0x14 4 */
union {
unsigned __int64 ReplyHandle;/* 0x18 8 */
void* ReplyObject;/* 0x18 8 */
unsigned long RegIndex;/* 0x18 4 */
};/* 0x18 8 */
unsigned long TargetPID;/* 0x20 4 */
unsigned long SourcePID;/* 0x24 4 */
};
size 72 (0x48)15 members1 hole (3 bytes)padding 02 cachelines
Used in (1)