_CMHIVE

Metadatacopy
struct _CMHIVE {
    struct _HHIVE Hive;/* 0x0  1024 */
    /* ── cacheline 16 boundary (1024 bytes) ── */
    void* FileHandles[6];/* 0x400  24 */
    struct _LIST_ENTRY NotifyList;/* 0x418  8 */
    struct _LIST_ENTRY HiveList;/* 0x420  8 */
    struct _LIST_ENTRY PreloadedHiveList;/* 0x428  8 */
    struct _EX_RUNDOWN_REF HiveRundown;/* 0x430  4 */
    struct _CM_KEY_HASH_TABLE_ENTRY* KcbCacheTable;/* 0x434  4 */
    unsigned long KcbCacheTableSize;/* 0x438  4 */
    struct _CM_KEY_HASH_TABLE_ENTRY* DeletedKcbTable;/* 0x43c  4 */
    /* ── cacheline 17 boundary (1088 bytes) ── */
    unsigned long DeletedKcbTableSize;/* 0x440  4 */
    unsigned long Identity;/* 0x444  4 */
    struct _CMSI_RW_LOCK HiveLock;/* 0x448  4 */
    struct _RTL_BITMAP FlushDirtyVector;/* 0x44c  8 */
    unsigned long FlushDirtyVectorSize;/* 0x454  4 */
    struct CMP_OFFSET_ARRAY* FlushLogEntryOffsetArray;/* 0x458  4 */
    unsigned long FlushLogEntryOffsetArrayCount;/* 0x45c  4 */
    unsigned long FlushLogEntrySize;/* 0x460  4 */
    unsigned long FlushHiveTruncated;/* 0x464  4 */
    unsigned char FlushBaseBlockDirty;/* 0x468  1 */
    /* 3 bytes padding */
    struct _RTL_BITMAP CapturedUnreconciledVector;/* 0x46c  8 */
    unsigned long CapturedUnreconciledVectorSize;/* 0x474  4 */
    struct CMP_OFFSET_ARRAY* UnreconciledOffsetArray;/* 0x478  4 */
    unsigned long UnreconciledOffsetArrayCount;/* 0x47c  4 */
    /* ── cacheline 18 boundary (1152 bytes) ── */
    struct _HBASE_BLOCK* UnreconciledBaseBlock;/* 0x480  4 */
    struct _EX_PUSH_LOCK SecurityLock;/* 0x484  4 */
    unsigned long LastShrinkHiveSize;/* 0x488  4 */
    /* 4 bytes padding */
    union _LARGE_INTEGER ActualFileSize;/* 0x490  8 */
    union _LARGE_INTEGER LogFileSizes[2];/* 0x498  16 */
    struct _UNICODE_STRING FileFullPath;/* 0x4a8  8 */
    struct _UNICODE_STRING FileUserName;/* 0x4b0  8 */
    struct _UNICODE_STRING HiveRootPath;/* 0x4b8  8 */
    /* ── cacheline 19 boundary (1216 bytes) ── */
    unsigned long SecurityCount;/* 0x4c0  4 */
    unsigned long SecurityCacheSize;/* 0x4c4  4 */
    long SecurityHitHint;/* 0x4c8  4 */
    struct _CM_KEY_SECURITY_CACHE_ENTRY* SecurityCache;/* 0x4cc  4 */
    struct _LIST_ENTRY SecurityHash[64];/* 0x4d0  512 */
    /* ── cacheline 27 boundary (1728 bytes) ── */
    unsigned long UnloadEventCount;/* 0x6d0  4 */
    struct _KEVENT** UnloadEventArray;/* 0x6d4  4 */
    struct _CM_KEY_CONTROL_BLOCK* RootKcb;/* 0x6d8  4 */
    unsigned char Frozen;/* 0x6dc  1 */
    /* 3 bytes padding */
    struct _CM_WORKITEM* UnloadWorkItem;/* 0x6e0  4 */
    struct _CM_WORKITEM UnloadWorkItemHolder;/* 0x6e4  20 */
    struct _CM_DIRTY_VECTOR_LOG DirtyVectorLog;/* 0x6f8  648 */
    /* ── cacheline 38 boundary (2432 bytes) ── */
    unsigned long Flags;/* 0x980  4 */
    struct _LIST_ENTRY TrustClassEntry;/* 0x984  8 */
    /* 4 bytes padding */
    unsigned __int64 DirtyTime;/* 0x990  8 */
    unsigned __int64 UnreconciledTime;/* 0x998  8 */
    struct _CM_RM* CmRm;/* 0x9a0  4 */
    unsigned long CmRmInitFailPoint;/* 0x9a4  4 */
    long CmRmInitFailStatus;/* 0x9a8  4 */
    struct _KTHREAD* CreatorOwner;/* 0x9ac  4 */
    struct _KTHREAD* RundownThread;/* 0x9b0  4 */
    /* 4 bytes padding */
    union _LARGE_INTEGER LastWriteTime;/* 0x9b8  8 */
    /* ── cacheline 39 boundary (2496 bytes) ── */
    struct _HIVE_WRITE_WAIT_QUEUE FlushQueue;/* 0x9c0  8 */
    struct _HIVE_WRITE_WAIT_QUEUE ReconcileQueue;/* 0x9c8  8 */
    union {
        unsigned long FlushFlags;/* 0x9d0  4 */
        struct {
            unsigned long PrimaryFilePurged : 1;/* 0x9d0:0  4 */
            unsigned long DiskFileBad : 1;/* 0x9d0:1  4 */
        };/* 0x9d0  4 */
    };/* 0x9d0  4 */
    unsigned long PrimaryFileSizeBeforeLastFlush;/* 0x9d4  4 */
    volatile long ReferenceCount;/* 0x9d8  4 */
    long UnloadHistoryIndex;/* 0x9dc  4 */
    unsigned long UnloadHistory[128];/* 0x9e0  512 */
    /* ── cacheline 47 boundary (3008 bytes) ── */
    unsigned long BootStart;/* 0xbe0  4 */
    unsigned long UnaccessedStart;/* 0xbe4  4 */
    unsigned long UnaccessedEnd;/* 0xbe8  4 */
    unsigned long LoadedKeyCount;/* 0xbec  4 */
    volatile unsigned long HandleClosePending;/* 0xbf0  4 */
    struct _EX_PUSH_LOCK HandleClosePendingEvent;/* 0xbf4  4 */
    unsigned char FinalFlushSucceeded;/* 0xbf8  1 */
    /* 3 bytes padding */
    struct _CMP_VOLUME_CONTEXT* VolumeContext;/* 0xbfc  4 */
};