struct _POP_HIBER_CONTEXT { unsigned char WriteToFile;/* 0x0 1 */ unsigned char ReserveLoaderMemory;/* 0x1 1 */ unsigned char ReserveFreeMemory;/* 0x2 1 */ unsigned char VerifyOnWake;/* 0x3 1 */ unsigned char Reset;/* 0x4 1 */ unsigned char HiberFlags;/* 0x5 1 */ unsigned char WroteHiberFile;/* 0x6 1 */ /* 1 byte padding */ unsigned __int64 Lock;/* 0x8 8 */ unsigned char MapFrozen;/* 0x10 1 */ /* 7 bytes padding */ struct _RTL_BITMAP MemoryMap;/* 0x18 16 */ struct _RTL_BITMAP DiscardedMemoryPages;/* 0x28 16 */ struct _LIST_ENTRY ClonedRanges;/* 0x38 16 */ /* ── cacheline 1 boundary (64 bytes) ── */ unsigned long ClonedRangeCount;/* 0x48 4 */ /* 4 bytes padding */ struct _LIST_ENTRY* NextCloneRange;/* 0x50 8 */ unsigned __int64 NextPreserve;/* 0x58 8 */ struct _MDL* LoaderMdl;/* 0x60 8 */ struct _MDL* AllocatedMdl;/* 0x68 8 */ unsigned __int64 PagesOut;/* 0x70 8 */ void* IoPages;/* 0x78 8 */ /* ── cacheline 2 boundary (128 bytes) ── */ unsigned long IoPagesCount;/* 0x80 4 */ /* 4 bytes padding */ void* CurrentMcb;/* 0x88 8 */ struct _DUMP_STACK_CONTEXT* DumpStack;/* 0x90 8 */ struct _KPROCESSOR_STATE* WakeState;/* 0x98 8 */ unsigned __int64 HiberVa;/* 0xa0 8 */ union _LARGE_INTEGER HiberPte;/* 0xa8 8 */ long Status;/* 0xb0 4 */ /* 4 bytes padding */ struct PO_MEMORY_IMAGE* MemoryImage;/* 0xb8 8 */ /* ── cacheline 3 boundary (192 bytes) ── */ struct _PO_MEMORY_RANGE_TABLE* TableHead;/* 0xc0 8 */ unsigned char* CompressionWorkspace;/* 0xc8 8 */ unsigned char* CompressedWriteBuffer;/* 0xd0 8 */ unsigned long* PerformanceStats;/* 0xd8 8 */ void* CompressionBlock;/* 0xe0 8 */ void* DmaIO;/* 0xe8 8 */ void* TemporaryHeap;/* 0xf0 8 */ struct _PO_HIBER_PERF PerfInfo;/* 0xf8 96 */ /* ── cacheline 5 boundary (320 bytes) ── */ struct _MDL* BootLoaderLogMdl;/* 0x158 8 */ struct _MDL* FirmwareRuntimeInformationMdl;/* 0x160 8 */ void* ResumeContext;/* 0x168 8 */ unsigned long ResumeContextPages;/* 0x170 4 */};size 376 (0x178)39 members5 holes (20 bytes)padding 46 cachelines
Used in (1)