_FILE_OBJECT

Metadatacopy
struct _FILE_OBJECT {
    short Type;/* 0x0  2 */
    short Size;/* 0x2  2 */
    struct _DEVICE_OBJECT* DeviceObject;/* 0x4  4 */
    struct _VPB* Vpb;/* 0x8  4 */
    void* FsContext;/* 0xc  4 */
    void* FsContext2;/* 0x10  4 */
    struct _SECTION_OBJECT_POINTERS* SectionObjectPointer;/* 0x14  4 */
    void* PrivateCacheMap;/* 0x18  4 */
    long FinalStatus;/* 0x1c  4 */
    struct _FILE_OBJECT* RelatedFileObject;/* 0x20  4 */
    unsigned char LockOperation;/* 0x24  1 */
    unsigned char DeletePending;/* 0x25  1 */
    unsigned char ReadAccess;/* 0x26  1 */
    unsigned char WriteAccess;/* 0x27  1 */
    unsigned char DeleteAccess;/* 0x28  1 */
    unsigned char SharedRead;/* 0x29  1 */
    unsigned char SharedWrite;/* 0x2a  1 */
    unsigned char SharedDelete;/* 0x2b  1 */
    unsigned long Flags;/* 0x2c  4 */
    struct _UNICODE_STRING FileName;/* 0x30  8 */
    union _LARGE_INTEGER CurrentByteOffset;/* 0x38  8 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    unsigned long Waiters;/* 0x40  4 */
    unsigned long Busy;/* 0x44  4 */
    void* LastLock;/* 0x48  4 */
    struct _KEVENT Lock;/* 0x4c  16 */
    struct _KEVENT Event;/* 0x5c  16 */
    struct _IO_COMPLETION_CONTEXT* CompletionContext;/* 0x6c  4 */
};
/* source: NT 4.0 DDK (August 1996) MIPS LIBCNTPR.LIB CodeView type records; _EPROCESS/_ETHREAD offsets match KDEXTMIP.DLL (NT 4.0 Server CD) */