mips / ntdllntoskrnl

_KEY_FULL_INFORMATION

incomplete only the Native API and process/thread environment structures two MIPS binaries were compiled with (_TEB, _PEB, _KPCR, RTL, object/file/registry information classes, image headers): no kernel objects


struct _KEY_FULL_INFORMATION {
    union _LARGE_INTEGER LastWriteTime;/* 0x0  8 */
    unsigned long TitleIndex;/* 0x8  4 */
    unsigned long ClassOffset;/* 0xc  4 */
    unsigned long ClassLength;/* 0x10  4 */
    unsigned long SubKeys;/* 0x14  4 */
    unsigned long MaxNameLen;/* 0x18  4 */
    unsigned long MaxClassLen;/* 0x1c  4 */
    unsigned long Values;/* 0x20  4 */
    unsigned long MaxValueNameLen;/* 0x24  4 */
    unsigned long MaxValueDataLen;/* 0x28  4 */
    unsigned short Class[1];/* 0x2c  2 */
};
/* source: Windows NT 3.1 beta DDK, MIPS/CDPLAYER.EXE and MIPS/DISKPERF.EXE inline CodeView 4 (NB08) type records; build 404.1 per the DDK's version.h */

size 48 (0x30)11 members0 holespadding 21 cacheline