//0x70 bytes (sizeof)
struct _IRP
{
SHORT Type; //0x0
USHORT Size; //0x2
struct _MDL* MdlAddress; //0x4
ULONG Flags; //0x8
union
{
struct _IRP* MasterIrp; //0xc
LONG IrpCount; //0xc
VOID* SystemBuffer; //0xc
} AssociatedIrp; //0xc
struct _LIST_ENTRY ThreadListEntry; //0x10
struct _IO_STATUS_BLOCK IoStatus; //0x18
CHAR RequestorMode; //0x20
UCHAR PendingReturned; //0x21
CHAR StackCount; //0x22
CHAR CurrentLocation; //0x23
UCHAR Cancel; //0x24
UCHAR CancelIrql; //0x25
CHAR ApcEnvironment; //0x26
UCHAR AllocationFlags; //0x27
struct _IO_STATUS_BLOCK* UserIosb; //0x28
struct _KEVENT* UserEvent; //0x2c
union
{
struct
{
union
{
VOID (*UserApcRoutine)(VOID* arg1, struct _IO_STATUS_BLOCK* arg2, ULONG arg3); //0x30
VOID* IssuingProcess; //0x30
};
VOID* UserApcContext; //0x34
} AsynchronousParameters; //0x30
union _LARGE_INTEGER AllocationSize; //0x30
} Overlay; //0x30
VOID (*CancelRoutine)(struct _DEVICE_OBJECT* arg1, struct _IRP* arg2); //0x38
VOID* UserBuffer; //0x3c
union
{
struct
{
union
{
struct _KDEVICE_QUEUE_ENTRY DeviceQueueEntry; //0x40
VOID* DriverContext[4]; //0x40
};
struct _ETHREAD* Thread; //0x50
CHAR* AuxiliaryBuffer; //0x54
struct _LIST_ENTRY ListEntry; //0x58
union
{
struct _IO_STACK_LOCATION* CurrentStackLocation; //0x60
ULONG PacketType; //0x60
};
struct _FILE_OBJECT* OriginalFileObject; //0x64
} Overlay; //0x40
struct _KAPC Apc; //0x40
VOID* CompletionKey; //0x40
} Tail; //0x40
};