_ETW_REALTIME_CONSUMER

Metadatacopy
struct _ETW_REALTIME_CONSUMER {
    struct _LIST_ENTRY Links;/* 0x0  16 */
    void* ProcessHandle;/* 0x10  8 */
    struct _EPROCESS* ProcessObject;/* 0x18  8 */
    void* NextNotDelivered;/* 0x20  8 */
    void* RealtimeConnectContext;/* 0x28  8 */
    struct _KEVENT* DisconnectEvent;/* 0x30  8 */
    struct _KEVENT* DataAvailableEvent;/* 0x38  8 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    unsigned long* UserBufferCount;/* 0x40  8 */
    struct _SINGLE_LIST_ENTRY* UserBufferListHead;/* 0x48  8 */
    unsigned long BuffersLost;/* 0x50  4 */
    unsigned long EmptyBuffersCount;/* 0x54  4 */
    unsigned short LoggerId;/* 0x58  2 */
    union {
        unsigned char Flags;/* 0x5a  1 */
        struct {
            unsigned char ShutDownRequested : 1;/* 0x5a:0  1 */
            unsigned char NewBuffersLost : 1;/* 0x5a:1  1 */
            unsigned char Disconnected : 1;/* 0x5a:2  1 */
            unsigned char Notified : 1;/* 0x5a:3  1 */
            unsigned char Wow : 1;/* 0x5a:4  1 */
        };/* 0x5a  1 */
    };/* 0x5a  1 */
    /* 5 bytes padding */
    struct _RTL_KUSER_BITMAP ReservedBufferSpaceBitMap;/* 0x60  16 */
    unsigned char* ReservedBufferSpace;/* 0x70  8 */
    unsigned long ReservedBufferSpaceSize;/* 0x78  4 */
    unsigned long UserPagesAllocated;/* 0x7c  4 */
    /* ── cacheline 2 boundary (128 bytes) ── */
    unsigned long UserPagesReused;/* 0x80  4 */
    /* 4 bytes padding */
    unsigned long* EventsLostCount;/* 0x88  8 */
    unsigned long* BuffersLostCount;/* 0x90  8 */
    struct _ETW_SILODRIVERSTATE* SiloState;/* 0x98  8 */
};