_ETW_REALTIME_CONSUMER

Metadatacopy
struct _ETW_REALTIME_CONSUMER {
    struct _LIST_ENTRY Links;/* 0x0  8 */
    void* ProcessHandle;/* 0x8  4 */
    struct _EPROCESS* ProcessObject;/* 0xc  4 */
    void* NextNotDelivered;/* 0x10  4 */
    void* RealtimeConnectContext;/* 0x14  4 */
    struct _KEVENT* DisconnectEvent;/* 0x18  4 */
    struct _KEVENT* DataAvailableEvent;/* 0x1c  4 */
    unsigned long* UserBufferCount;/* 0x20  4 */
    struct _SINGLE_LIST_ENTRY* UserBufferListHead;/* 0x24  4 */
    unsigned long BuffersLost;/* 0x28  4 */
    unsigned long EmptyBuffersCount;/* 0x2c  4 */
    unsigned short LoggerId;/* 0x30  2 */
    union {
        unsigned char Flags;/* 0x32  1 */
        struct {
            unsigned char ShutDownRequested : 1;/* 0x32:0  1 */
            unsigned char NewBuffersLost : 1;/* 0x32:1  1 */
            unsigned char Disconnected : 1;/* 0x32:2  1 */
            unsigned char Notified : 1;/* 0x32:3  1 */
        };/* 0x32  1 */
    };/* 0x32  1 */
    /* 1 byte padding */
    struct _RTL_BITMAP ReservedBufferSpaceBitMap;/* 0x34  8 */
    unsigned char* ReservedBufferSpace;/* 0x3c  4 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    unsigned long ReservedBufferSpaceSize;/* 0x40  4 */
    unsigned long UserPagesAllocated;/* 0x44  4 */
    unsigned long UserPagesReused;/* 0x48  4 */
    unsigned long* EventsLostCount;/* 0x4c  4 */
    unsigned long* BuffersLostCount;/* 0x50  4 */
    struct _ETW_SILODRIVERSTATE* SiloState;/* 0x54  4 */
};