_CMHIVE

Metadatacopy
struct _CMHIVE {
    struct _HHIVE Hive;/* 0x0  1424 */
    /* ── cacheline 22 boundary (1408 bytes) ── */
    void* FileHandles[6];/* 0x590  48 */
    /* ── cacheline 23 boundary (1472 bytes) ── */
    struct _LIST_ENTRY NotifyList;/* 0x5c0  16 */
    struct _LIST_ENTRY HiveList;/* 0x5d0  16 */
    struct _FAST_MUTEX* HiveLock;/* 0x5e0  8 */
    struct _EX_PUSH_LOCK ViewLock;/* 0x5e8  8 */
    struct _KTHREAD* ViewLockOwner;/* 0x5f0  8 */
    unsigned long ViewLockLast;/* 0x5f8  4 */
    unsigned long ViewUnLockLast;/* 0x5fc  4 */
    /* ── cacheline 24 boundary (1536 bytes) ── */
    struct _FAST_MUTEX* WriterLock;/* 0x600  8 */
    struct _EX_PUSH_LOCK FlusherLock;/* 0x608  8 */
    struct _EX_PUSH_LOCK SecurityLock;/* 0x610  8 */
    struct _LIST_ENTRY MappedViewList;/* 0x618  16 */
    struct _LIST_ENTRY PinnedViewList;/* 0x628  16 */
    struct _LIST_ENTRY FlushedViewList;/* 0x638  16 */
    /* ── cacheline 25 boundary (1600 bytes) ── */
    unsigned short MappedViewCount;/* 0x648  2 */
    unsigned short PinnedViewCount;/* 0x64a  2 */
    unsigned long UseCount;/* 0x64c  4 */
    unsigned long ViewsPerHive;/* 0x650  4 */
    /* 4 bytes padding */
    struct _FILE_OBJECT* FileObject;/* 0x658  8 */
    unsigned long LastShrinkHiveSize;/* 0x660  4 */
    /* 4 bytes padding */
    union _LARGE_INTEGER ActualFileSize;/* 0x668  8 */
    struct _UNICODE_STRING FileFullPath;/* 0x670  16 */
    /* ── cacheline 26 boundary (1664 bytes) ── */
    struct _UNICODE_STRING FileUserName;/* 0x680  16 */
    struct _UNICODE_STRING HiveRootPath;/* 0x690  16 */
    unsigned long SecurityCount;/* 0x6a0  4 */
    unsigned long SecurityCacheSize;/* 0x6a4  4 */
    long SecurityHitHint;/* 0x6a8  4 */
    /* 4 bytes padding */
    struct _CM_KEY_SECURITY_CACHE_ENTRY* SecurityCache;/* 0x6b0  8 */
    struct _LIST_ENTRY SecurityHash[64];/* 0x6b8  1024 */
    /* ── cacheline 42 boundary (2688 bytes) ── */
    unsigned long UnloadEventCount;/* 0xab8  4 */
    /* 4 bytes padding */
    /* ── cacheline 43 boundary (2752 bytes) ── */
    struct _KEVENT** UnloadEventArray;/* 0xac0  8 */
    struct _CM_KEY_CONTROL_BLOCK* RootKcb;/* 0xac8  8 */
    unsigned char Frozen;/* 0xad0  1 */
    /* 7 bytes padding */
    struct _CM_WORKITEM* UnloadWorkItem;/* 0xad8  8 */
    unsigned char GrowOnlyMode;/* 0xae0  1 */
    /* 3 bytes padding */
    unsigned long GrowOffset;/* 0xae4  4 */
    struct _LIST_ENTRY KcbConvertListHead;/* 0xae8  16 */
    struct _LIST_ENTRY KnodeConvertListHead;/* 0xaf8  16 */
    /* ── cacheline 44 boundary (2816 bytes) ── */
    struct _CM_CELL_REMAP_BLOCK* CellRemapArray;/* 0xb08  8 */
    unsigned long Flags;/* 0xb10  4 */
    /* 4 bytes padding */
    struct _LIST_ENTRY TrustClassEntry;/* 0xb18  16 */
    unsigned long FlushCount;/* 0xb28  4 */
    /* 4 bytes padding */
    struct _CM_RM* CmRm;/* 0xb30  8 */
    unsigned long CmRmInitFailPoint;/* 0xb38  4 */
    long CmRmInitFailStatus;/* 0xb3c  4 */
    /* ── cacheline 45 boundary (2880 bytes) ── */
    struct _KTHREAD* CreatorOwner;/* 0xb40  8 */
};