_CMHIVE

//0x908 bytes (sizeof) struct _CMHIVE { struct _HHIVE Hive; //0x0 VOID* FileHandles[6]; //0x3a0 struct _LIST_ENTRY NotifyList; //0x3b8 struct _LIST_ENTRY HiveList; //0x3c0 struct _LIST_ENTRY PreloadedHiveList; //0x3c8 struct _EX_RUNDOWN_REF HiveRundown; //0x3d0 struct _LIST_ENTRY ParseCacheEntries; //0x3d4 struct _CM_KEY_HASH_TABLE_ENTRY* KcbCacheTable; //0x3dc ULONG KcbCacheTableSize; //0x3e0 struct _CM_KEY_HASH_TABLE_ENTRY* DeletedKcbTable; //0x3e4 ULONG DeletedKcbTableSize; //0x3e8 ULONG Identity; //0x3ec struct _FAST_MUTEX* HiveLock; //0x3f0 struct _FAST_MUTEX* WriterLock; //0x3f4 struct _ERESOURCE* FlusherLock; //0x3f8 struct _RTL_BITMAP FlushDirtyVector; //0x3fc struct CMP_OFFSET_ARRAY* FlushOffsetArray; //0x404 ULONG FlushOffsetArrayCount; //0x408 struct _HBASE_BLOCK* FlushBaseBlock; //0x40c ULONG FlushHiveTruncated; //0x410 struct _EX_PUSH_LOCK SecurityLock; //0x414 ULONG UseCount; //0x418 ULONG LastShrinkHiveSize; //0x41c union _LARGE_INTEGER ActualFileSize; //0x420 union _LARGE_INTEGER LogFileSizes[2]; //0x428 struct _UNICODE_STRING FileFullPath; //0x438 struct _UNICODE_STRING FileUserName; //0x440 struct _UNICODE_STRING HiveRootPath; //0x448 ULONG SecurityCount; //0x450 ULONG SecurityCacheSize; //0x454 LONG SecurityHitHint; //0x458 struct _CM_KEY_SECURITY_CACHE_ENTRY* SecurityCache; //0x45c struct _LIST_ENTRY SecurityHash[64]; //0x460 ULONG UnloadEventCount; //0x660 struct _KEVENT** UnloadEventArray; //0x664 struct _CM_KEY_CONTROL_BLOCK* RootKcb; //0x668 UCHAR Frozen; //0x66c struct _CM_WORKITEM* UnloadWorkItem; //0x670 struct _CM_WORKITEM UnloadWorkItemHolder; //0x674 UCHAR GrowOnlyMode; //0x688 ULONG GrowOffset; //0x68c struct _LIST_ENTRY KcbConvertListHead; //0x690 struct _LIST_ENTRY KnodeConvertListHead; //0x698 struct _CM_CELL_REMAP_BLOCK* CellRemapArray; //0x6a0 ULONG Flags; //0x6a4 struct _LIST_ENTRY TrustClassEntry; //0x6a8 ULONGLONG DirtyTime; //0x6b0 struct _CM_RM* CmRm; //0x6b8 ULONG CmRmInitFailPoint; //0x6bc LONG CmRmInitFailStatus; //0x6c0 struct _KTHREAD* CreatorOwner; //0x6c4 struct _KTHREAD* RundownThread; //0x6c8 struct _ETHREAD* ActiveFlushThread; //0x6cc struct _EX_PUSH_LOCK FlushBoostLock; //0x6d0 union _LARGE_INTEGER LastWriteTime; //0x6d8 volatile LONG ReferenceCount; //0x6e0 union { ULONG FlushFlags; //0x6e4 struct { ULONG FlushActive:1; //0x6e4 ULONG DiskFileBad:1; //0x6e4 ULONG FlushBoosted:1; //0x6e4 ULONG PrimaryWritePending:1; //0x6e4 ULONG PriorPurgeComplete:1; //0x6e4 }; }; struct _HIVE_WAIT_PACKET* FlushWaitList; //0x6e8 LONG UnloadHistoryIndex; //0x6ec ULONG UnloadHistory[128]; //0x6f0 ULONG BootStart; //0x8f0 ULONG UnaccessedStart; //0x8f4 ULONG UnaccessedEnd; //0x8f8 ULONG LoadedKeyCount; //0x8fc volatile ULONG HandleClosePending; //0x900 struct _EX_PUSH_LOCK HandleClosePendingEvent; //0x904 };