kernel.h

#pragma once

using NT_PRODUCT_TYPE = enum _NT_PRODUCT_TYPE : std::int32_t
{
	NtProductWinNt = 1,
	NtProductLanManNt = 2,
	NtProductServer = 3
};

using ALTERNATIVE_ARCHITECTURE_TYPE = enum _ALTERNATIVE_ARCHITECTURE_TYPE : std::int32_t
{
	StandardDesign = 0,
	NEC98x86 = 1,
	EndAlternatives = 2
};

using KPRIORITY = std::int32_t;

using KTHREAD_STATE = enum _KTHREAD_STATE : std::int32_t
{
	Initialized = 0,
	Ready = 1,
	Running = 2,
	Standby = 3,
	Terminated = 4,
	Waiting = 5,
	Transition = 6,
	DeferredReady = 7,
#if Q_NT_VERSION >= Q_NT_WIN8
	GateWaitObsolete = 8,
#else
	GateWait = 8,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10
	WaitingForProcessInSwap = 9
#endif
};

using KWAIT_REASON = enum _KWAIT_REASON : std::int32_t
{
	Executive = 0,
	FreePage = 1,
	PageIn = 2,
	PoolAllocation = 3,
	DelayExecution = 4,
	Suspended = 5,
	UserRequest = 6,
	WrExecutive = 7,
	WrFreePage = 8,
	WrPageIn = 9,
	WrPoolAllocation = 10,
	WrDelayExecution = 11,
	WrSuspended = 12,
	WrUserRequest = 13,
	WrSpare0 = 14,
	WrQueue = 15,
	WrLpcReceive = 16,
	WrLpcReply = 17,
	WrVirtualMemory = 18,
	WrPageOut = 19,
	WrRendezvous = 20,
	WrKeyedEvent = 21,
	WrTerminated = 22,
	WrProcessInSwap = 23,
	WrCpuRateControl = 24,
	WrCalloutStack = 25,
	WrKernel = 26,
	WrResource = 27,
	WrPushLock = 28,
	WrMutex = 29,
	WrQuantumEnd = 30,
	WrDispatchInt = 31,
	WrPreempted = 32,
	WrYieldExecution = 33,
	WrFastMutex = 34,
	WrGuardedMutex = 35,
	WrRundown = 36,
#if Q_NT_VERSION >= Q_NT_WIN8
	WrAlertByThreadId = 37,
	WrDeferredPreempt = 38,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
	WrPhysicalFault = 39,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11
	WrIoRing = 40,
	WrMdlCache = 41,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11_24H2
	WrRcu = 42,
#endif
	MaximumWaitReason
};

using KPROFILE_SOURCE = enum _KPROFILE_SOURCE
{
	ProfileTime = 0,
	ProfileAlignmentFixup = 1,
	ProfileTotalIssues = 2,
	ProfilePipelineDry = 3,
	ProfileLoadInstructions = 4,
	ProfilePipelineFrozen = 5,
	ProfileBranchInstructions = 6,
	ProfileTotalNonissues = 7,
	ProfileDcacheMisses = 8,
	ProfileIcacheMisses = 9,
	ProfileCacheMisses = 10,
	ProfileBranchMispredictions = 11,
	ProfileStoreInstructions = 12,
	ProfileFpInstructions = 13,
	ProfileIntegerInstructions = 14,
	Profile2Issue = 15,
	Profile3Issue = 16,
	Profile4Issue = 17,
	ProfileSpecialInstructions = 18,
	ProfileTotalCycles = 19,
	ProfileIcacheIssues = 20,
	ProfileDcacheAccesses = 21,
	ProfileMemoryBarrierCycles = 22,
	ProfileLoadLinkedIssues = 23,
	ProfileMaximum = 24
};

#if Q_NT_VERSION >= Q_NT_WIN10
using KHETERO_CPU_POLICY = enum _KHETERO_CPU_POLICY
{
	KHeteroCpuPolicyAll = 0,
	KHeteroCpuPolicyLarge = 1,
	KHeteroCpuPolicyLargeOrIdle = 2,
	KHeteroCpuPolicySmall = 3,
	KHeteroCpuPolicySmallOrIdle = 4,
	KHeteroCpuPolicyDynamic = 5,
	KHeteroCpuPolicyStaticMax = 5,
	KHeteroCpuPolicyBiasedSmall = 6,
	KHeteroCpuPolicyBiasedLarge = 7,
	KHeteroCpuPolicyDefault = 8,
	KHeteroCpuPolicyMax = 9
};
#endif

#pragma pack(push, 8)
struct KSYSTEM_TIME
{
	std::uint32_t LowPart; // 0x0
	std::int32_t High1Time; // 0x4
	std::int32_t High2Time; // 0x8
};
static_assert(sizeof(KSYSTEM_TIME) == 0xC);

struct KERNEL_USER_TIMES
{
	LARGE_INTEGER CreateTime; // 0x00
	LARGE_INTEGER ExitTime; // 0x08
	LARGE_INTEGER KernelTime; // 0x10
	LARGE_INTEGER UserTime; // 0x18
};
static_assert(sizeof(KERNEL_USER_TIMES) == 0x20);

#if Q_NT_VERSION >= Q_NT_WIN7
#ifndef MAXIMUM_XSTATE_FEATURES
#define MAXIMUM_XSTATE_FEATURES 64
#endif

struct XSTATE_FEATURE
{
	std::uint32_t Offset; // 0x0
	std::uint32_t Size; // 0x4
};
static_assert(sizeof(XSTATE_FEATURE) == 0x8);

struct XSTATE_CONFIGURATION
{
	std::uint64_t EnabledFeatures; // 0x0000
	std::uint64_t EnabledVolatileFeatures; // 0x0008
	std::uint32_t Size; // 0x0010
	union
	{
		std::uint32_t ControlFlags;
		struct
		{
			std::uint32_t OptimizedSave : 1;
#if Q_NT_VERSION >= Q_NT_WIN10
			std::uint32_t CompactionEnabled : 1;
			std::uint32_t ExtendedFeatureDisable : 1;
#endif
		};
	}; // 0x0014
	XSTATE_FEATURE Features[MAXIMUM_XSTATE_FEATURES]; // 0x0018
#if Q_NT_VERSION >= Q_NT_WIN10
	std::uint64_t EnabledSupervisorFeatures; // 0x0218
	std::uint64_t AlignedFeatures; // 0x0220
	std::uint32_t AllFeatureSize; // 0x0228
	std::uint32_t AllFeatures[MAXIMUM_XSTATE_FEATURES]; // 0x022C
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS5
	std::uint64_t EnabledUserVisibleSupervisorFeatures; // 0x0330
#endif
#if Q_NT_VERSION >= Q_NT_WIN11
	std::uint64_t ExtendedFeatureDisableFeatures; // 0x0338
	std::uint32_t AllNonLargeFeatureSize; // 0x0340
#if Q_NT_VERSION >= Q_NT_WIN11_24H2
	std::uint16_t MaxSveVectorLength; // 0x0344
	std::uint16_t Spare1; // 0x0346
#else
	std::uint32_t Spare; // 0x0344
#endif
#endif
};
static_assert(sizeof(XSTATE_CONFIGURATION) == 0x348);
#endif

struct KUSER_SHARED_DATA
{
	std::uint32_t TickCountLowDeprecated; // 0x0000
	std::uint32_t TickCountMultiplier; // 0x0004
	volatile KSYSTEM_TIME InterruptTime; // 0x0008
	volatile KSYSTEM_TIME SystemTime; // 0x0014
	volatile KSYSTEM_TIME TimeZoneBias; // 0x0020
	std::uint16_t ImageNumberLow; // 0x002C
	std::uint16_t ImageNumberHigh; // 0x002E
	wchar_t NtSystemRoot[MAX_PATH]; // 0x0030
	std::uint32_t MaxStackTraceDepth; // 0x0238
	std::uint32_t CryptoExponent; // 0x023C
	std::uint32_t TimeZoneId; // 0x0240
	std::uint32_t LargePageMinimum; // 0x0244
#if Q_NT_VERSION >= Q_NT_WIN8
	std::uint32_t AitSamplingValue; // 0x0248
	std::uint32_t AppCompatFlag; // 0x024C
	std::uint64_t RNGSeedVersion; // 0x0250
	std::uint32_t GlobalValidationRunlevel; // 0x0258
	volatile std::int32_t TimeZoneBiasStamp; // 0x025C
#if Q_NT_VERSION >= Q_NT_WIN10
	std::uint32_t NtBuildNumber; // 0x0260
#else
	std::uint32_t Reserved2; // 0x0260
#endif
#else
	std::uint32_t Reserved2[7]; // 0x0248
#endif
	NT_PRODUCT_TYPE NtProductType; // 0x0264
	std::uint8_t ProductTypeIsValid; // 0x0268
#if Q_NT_VERSION >= Q_NT_WIN8
	std::uint8_t Reserved0[1]; // 0x0269
	std::uint16_t NativeProcessorArchitecture; // 0x026A
#endif
	std::uint32_t NtMajorVersion; // 0x026C
	std::uint32_t NtMinorVersion; // 0x0270
	std::uint8_t ProcessorFeatures[64]; // 0x0274
	std::uint32_t Reserved1; // 0x02B4
	std::uint32_t Reserved3; // 0x02B8
	volatile std::uint32_t TimeSlip; // 0x02BC
	ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture; // 0x02C0
#if Q_NT_VERSION >= Q_NT_WIN10
	std::uint32_t BootId; // 0x02C4
#endif
	LARGE_INTEGER SystemExpirationDate; // 0x02C8
	std::uint32_t SuiteMask; // 0x02D0
	std::uint8_t KdDebuggerEnabled; // 0x02D4
#if Q_NT_VERSION >= Q_NT_WIN8
	union
	{
		std::uint8_t MitigationPolicies;
		struct
		{
			std::uint8_t NXSupportPolicy : 2;
			std::uint8_t SEHValidationPolicy : 2;
			std::uint8_t CurDirDevicesSkippedForDlls : 2;
			std::uint8_t Reserved : 2;
		};
	}; // 0x02D5
#else
	std::uint8_t NXSupportPolicy; // 0x02D5
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_19H1
	std::uint16_t CyclesPerYield; // 0x02D6
#endif
	volatile std::uint32_t ActiveConsoleId; // 0x02D8
	volatile std::uint32_t DismountCount; // 0x02DC
	std::uint32_t ComPlusPackage; // 0x02E0
	std::uint32_t LastSystemRITEventTickCount; // 0x02E4
	std::uint32_t NumberOfPhysicalPages; // 0x02E8
	std::uint8_t SafeBootMode; // 0x02EC
#if Q_NT_VERSION >= Q_NT_WIN10_RS1
	union
	{
		std::uint8_t VirtualizationFlags;
#if Q_NT_VERSION >= Q_NT_WIN11_24H2
		struct
		{
			std::uint8_t ArchStartedInEl2 : 1;
			std::uint8_t QcSlIsSupported : 1;

		};
#endif
	}; // 0x02ED
	std::uint8_t Reserved12[2]; // 0x02EE
#endif
	union
	{
		std::uint32_t SharedDataFlags;
		struct
		{
			std::uint32_t DbgErrorPortPresent : 1;
			std::uint32_t DbgElevationEnabled : 1;
			std::uint32_t DbgVirtEnabled : 1;
			std::uint32_t DbgInstallerDetectEnabled : 1;
#if Q_NT_VERSION >= Q_NT_WIN8
			std::uint32_t DbgLkgEnabled : 1;
#elif Q_NT_VERSION >= Q_NT_VISTA_SP1
			std::uint32_t DbgSystemDllRelocated : 1;
#else
			std::uint32_t SystemDllRelocated : 1;
#endif
#if Q_NT_VERSION >= Q_NT_VISTA_SP1
			std::uint32_t DbgDynProcessorEnabled : 1;
#if Q_NT_VERSION >= Q_NT_WIN8
			std::uint32_t DbgConsoleBrokerEnabled : 1;
			std::uint32_t DbgSecureBootEnabled : 1;
#if Q_NT_VERSION >= Q_NT_WIN10
			std::uint32_t DbgMultiSessionSku : 1;
#if Q_NT_VERSION >= Q_NT_WIN10_RS1
			std::uint32_t DbgMultiUsersInSessionSku : 1;
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
			std::uint32_t DbgStateSeparationEnabled : 1;
			std::uint32_t SpareBits : 21;
#else
			std::uint32_t SpareBits : 22;
#endif
#else
			std::uint32_t SpareBits : 23;
#endif
#else
			std::uint32_t SpareBits : 24;
#endif
#else
			std::uint32_t SpareBits : 25;
#endif
#else
			std::uint32_t SpareBits : 27;
#endif
		};
	}; // 0x02F0
	std::uint64_t TestRetInstruction; // 0x02F8
#if Q_NT_VERSION >= Q_NT_WIN8
	std::int64_t QpcFrequency; // 0x0300
#else
	std::uint32_t SystemCall; // 0x0300
	std::uint32_t SystemCallReturn; // 0x0304
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_TH2
	std::uint32_t SystemCall; // 0x0308
	std::uint32_t Reserved2; // 0x030C
#if Q_NT_VERSION>= Q_NT_WIN11_24H2
	std::uint64_t FullNumberOfPhysicalPages; // 0x0310
	std::uint64_t SystemCallPad[1]; // 0x0318
#else
	std::uint64_t SystemCallPad[2]; // 0x0310
#endif
#else
	std::uint64_t SystemCallPad[3]; // 0x0308
#endif
	union
	{
		volatile KSYSTEM_TIME TickCount;
		volatile std::uint64_t TickCountQuad;
#if Q_NT_VERSION >= Q_NT_WIN7
		std::uint32_t ReservedTickCountOverlay[3];
#endif
	}; // 0x0320
	std::uint32_t Cookie; // 0x0330
	std::int64_t ConsoleSessionForegroundProcessId; // 0x0338
#if Q_NT_VERSION >= Q_NT_WIN8
#if Q_NT_VERSION >= Q_NT_WINBLUE
	std::uint64_t TimeUpdateLock; // 0x0340
#else
	volatile std::uint64_t TimeUpdateSequence; // 0x0340
#endif
	std::uint64_t BaselineSystemTimeQpc; // 0x0348
	std::uint64_t BaselineInterruptTimeQpc; // 0x0350
	std::uint64_t QpcSystemTimeIncrement; // 0x0358
	std::uint64_t QpcInterruptTimeIncrement; // 0x0360
#if Q_NT_VERSION < Q_NT_WIN10
	std::uint32_t QpcSystemTimeIncrement32; // 0x0368
	std::uint32_t QpcInterruptTimeIncrement32; // 0x036C
#endif
	std::uint8_t QpcSystemTimeIncrementShift; // 0x0368
	std::uint8_t QpcInterruptTimeIncrementShift; // 0x0369
#if Q_NT_VERSION >= Q_NT_WINBLUE
	std::uint16_t UnparkedProcessorCount; // 0x036A
#if Q_NT_VERSION >= Q_NT_WIN10_TH2
	std::uint32_t EnclaveFeatureMask[4]; // 0x036C
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
	std::uint32_t TelemetryCoverageRound; // 0x037C
#else
	std::uint32_t Reserved8; // 0x037C
#endif
#elif Q_NT_VERSION >= Q_NT_WIN10
	std::uint8_t Reserved8[20]; // 0x036C
#else
	std::uint8_t Reserved8[12]; // 0x0374
#endif
#else
	std::uint8_t Reserved8[14]; // 0x0372
#endif
#else
	std::uint32_t Wow64SharedInformation[16]; // 0x0340
#endif
#if Q_NT_VERSION >= Q_NT_WIN7
	std::uint16_t UserModeGlobalLogger[16]; // 0x0380
#else
	std::uint16_t UserModeGlobalLogger[8]; // 0x0380
	std::uint32_t HeapTracingPid[2]; // 0x0390
	std::uint32_t CritSecTracingPid[2]; // 0x0398
#endif
	std::uint32_t ImageFileExecutionOptions; // 0x03A0
#if Q_NT_VERSION >= Q_NT_VISTA_SP1
	std::uint32_t LangGenerationCount; // 0x03A4
#endif
#if Q_NT_VERSION >= Q_NT_WIN7
	std::uint64_t Reserved5; // 0x03A8
#else
	union
	{
		std::uint64_t AffinityPad;
		std::uint64_t ActiveProcessAffinity;
	}; // 0x03A8
#endif
	volatile std::uint64_t InterruptTimeBias; // 0x03B0
#if Q_NT_VERSION >= Q_NT_WIN7
	volatile std::uint64_t QpcBias; // 0x03B8
	std::uint32_t ActiveProcessorCount; // 0x03C0
	volatile std::uint8_t ActiveGroupCount; // 0x03C4
#if Q_NT_VERSION >= Q_NT_WIN8
	std::uint8_t Reserved9; // 0x03C5
	union
	{
		std::uint16_t QpcData;
		struct
		{
			volatile std::uint8_t QpcBypassEnabled;
			std::uint8_t QpcShift;
		};
	}; // 0x03C6
	LARGE_INTEGER TimeZoneBiasEffectiveStart; // 0x03C8
	LARGE_INTEGER TimeZoneBiasEffectiveEnd; // 0x03D0
#else
	std::uint16_t Reserved4; // 0x03C6
	volatile std::uint32_t AitSamplingValue; // 0x03C8
	volatile std::uint32_t AppCompatFlag; // 0x03CC
	std::uint64_t SystemDllNativeRelocation; // 0x03D0
	std::uint32_t SystemDllWowRelocation; // 0x03D8
	std::uint32_t XStatePad[1]; // 0x03DC
#endif
	XSTATE_CONFIGURATION XState; // 0x03D8
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_20H1
	KSYSTEM_TIME FeatureConfigurationChangeStamp; // 0x0720
	std::uint32_t Spare; // 0x072C
#endif
#if Q_NT_VERSION >= Q_NT_WIN11_22H2
	std::uint64_t UserPointerAuthMask; // 0x0730
#endif
#if Q_NT_VERSION >= Q_NT_WIN11_24H2
	std::uint32_t Reserved10[210]; // 0x0738
#endif
};
static_assert(sizeof(KUSER_SHARED_DATA) == 0xA80);
#pragma pack(pop)