struct _KALPC_MESSAGE { struct _LIST_ENTRY Entry;/* 0x0 16 */ struct _ALPC_PORT* PortQueue;/* 0x10 8 */ struct _ALPC_PORT* OwnerPort;/* 0x18 8 */ struct _ETHREAD* WaitingThread;/* 0x20 8 */ union { struct { unsigned long QueueType : 3;/* 0x28:0 4 */ unsigned long QueuePortType : 4;/* 0x28:3 4 */ unsigned long Canceled : 1;/* 0x28:7 4 */ unsigned long Ready : 1;/* 0x28:8 4 */ unsigned long ReleaseMessage : 1;/* 0x28:9 4 */ unsigned long SharedQuota : 1;/* 0x28:10 4 */ unsigned long ReplyWaitReply : 1;/* 0x28:11 4 */ unsigned long OwnerPortReference : 1;/* 0x28:12 4 */ unsigned long ReceiverReference : 1;/* 0x28:13 4 */ unsigned long ViewAttributeRetrieved : 1;/* 0x28:14 4 */ unsigned long ViewAttributeDeleteOnRelease : 1;/* 0x28:15 4 */ unsigned long InDispatch : 1;/* 0x28:16 4 */ unsigned long InCanceledQueue : 1;/* 0x28:17 4 */ unsigned long CommunicationInfoReference : 1;/* 0x28:18 4 */ } s1;/* 0x28 4 */ unsigned long State;/* 0x28 4 */ } u1;/* 0x28 4 */ long SequenceNo;/* 0x2c 4 */ union { struct _EPROCESS* QuotaProcess;/* 0x30 8 */ void* QuotaBlock;/* 0x30 8 */ };/* 0x30 8 */ struct _ALPC_PORT* CancelSequencePort;/* 0x38 8 */ /* ── cacheline 1 boundary (64 bytes) ── */ struct _ALPC_PORT* CancelQueuePort;/* 0x40 8 */ long CancelSequenceNo;/* 0x48 4 */ /* 4 bytes padding */ struct _LIST_ENTRY CancelListEntry;/* 0x50 16 */ struct _KALPC_RESERVE* Reserve;/* 0x60 8 */ struct _KALPC_MESSAGE_ATTRIBUTES MessageAttributes;/* 0x68 64 */ /* ── cacheline 2 boundary (128 bytes) ── */ unsigned __int64 DataUserVa;/* 0xa8 8 */ struct _ALPC_COMMUNICATION_INFO* CommunicationInfo;/* 0xb0 8 */ struct _ALPC_PORT* ConnectionPort;/* 0xb8 8 */ /* ── cacheline 3 boundary (192 bytes) ── */ struct _ETHREAD* ServerThread;/* 0xc0 8 */ void* WakeReference;/* 0xc8 8 */ void* WakeReference2;/* 0xd0 8 */ void* ExtensionBuffer;/* 0xd8 8 */ unsigned __int64 ExtensionBufferSize;/* 0xe0 8 */ struct _PORT_MESSAGE PortMessage;/* 0xe8 40 */};size 272 (0x110)23 members1 hole (4 bytes)padding 05 cachelines
Used in (4)