_CMHIVE

//0x12d8 bytes (sizeof) struct _CMHIVE { struct _HHIVE Hive; //0x0 VOID* FileHandles[6]; //0x608 struct _LIST_ENTRY NotifyList; //0x638 struct _LIST_ENTRY HiveList; //0x648 struct _LIST_ENTRY PreloadedHiveList; //0x658 struct _EX_RUNDOWN_REF HiveRundown; //0x668 struct _CM_KEY_HASH_TABLE_ENTRY* KcbCacheTable; //0x670 ULONG KcbCacheTableSize; //0x678 struct _CM_KEY_HASH_TABLE_ENTRY* DeletedKcbTable; //0x680 ULONG DeletedKcbTableSize; //0x688 ULONG Identity; //0x68c struct _CMSI_RW_LOCK HiveLock; //0x690 struct _RTL_BITMAP FlushDirtyVector; //0x698 ULONG FlushDirtyVectorSize; //0x6a8 struct CMP_OFFSET_ARRAY* FlushLogEntryOffsetArray; //0x6b0 ULONG FlushLogEntryOffsetArrayCount; //0x6b8 ULONG FlushLogEntrySize; //0x6bc ULONG FlushHiveTruncated; //0x6c0 UCHAR FlushBaseBlockDirty; //0x6c4 struct _RTL_BITMAP CapturedUnreconciledVector; //0x6c8 ULONG CapturedUnreconciledVectorSize; //0x6d8 struct CMP_OFFSET_ARRAY* UnreconciledOffsetArray; //0x6e0 ULONG UnreconciledOffsetArrayCount; //0x6e8 struct _HBASE_BLOCK* UnreconciledBaseBlock; //0x6f0 struct _EX_PUSH_LOCK SecurityLock; //0x6f8 ULONG LastShrinkHiveSize; //0x700 union _LARGE_INTEGER ActualFileSize; //0x708 union _LARGE_INTEGER LogFileSizes[2]; //0x710 struct _UNICODE_STRING FileFullPath; //0x720 struct _UNICODE_STRING FileUserName; //0x730 struct _UNICODE_STRING HiveRootPath; //0x740 ULONG SecurityCount; //0x750 ULONG SecurityCacheSize; //0x754 LONG SecurityHitHint; //0x758 struct _CM_KEY_SECURITY_CACHE_ENTRY* SecurityCache; //0x760 struct _LIST_ENTRY SecurityHash[64]; //0x768 ULONG UnloadEventCount; //0xb68 struct _KEVENT** UnloadEventArray; //0xb70 struct _CM_KEY_CONTROL_BLOCK* RootKcb; //0xb78 UCHAR Frozen; //0xb80 struct _CM_DIRTY_VECTOR_LOG DirtyVectorLog; //0xb88 ULONG Flags; //0x1010 struct _LIST_ENTRY TrustClassEntry; //0x1018 ULONGLONG DirtyTime; //0x1028 ULONGLONG UnreconciledTime; //0x1030 struct _CM_RM* CmRm; //0x1038 ULONG CmRmInitFailPoint; //0x1040 LONG CmRmInitFailStatus; //0x1044 struct _KTHREAD* CreatorOwner; //0x1048 struct _KTHREAD* RundownThread; //0x1050 union _LARGE_INTEGER LastWriteTime; //0x1058 struct _HIVE_WRITE_WAIT_QUEUE FlushQueue; //0x1060 struct _HIVE_WRITE_WAIT_QUEUE ReconcileQueue; //0x1070 union { ULONG FlushFlags; //0x1080 struct { ULONG PrimaryFilePurged:1; //0x1080 ULONG DiskFileBad:1; //0x1080 }; }; ULONG PrimaryFileSizeBeforeLastFlush; //0x1084 volatile LONG ReferenceCount; //0x1088 LONG UnloadHistoryIndex; //0x108c ULONG UnloadHistory[128]; //0x1090 ULONG BootStart; //0x1290 ULONG UnaccessedStart; //0x1294 ULONG UnaccessedEnd; //0x1298 ULONG LoadedKeyCount; //0x129c volatile ULONG HandleClosePending; //0x12a0 struct _EX_PUSH_LOCK HandleClosePendingEvent; //0x12a8 UCHAR FinalFlushSucceeded; //0x12b0 struct _CMP_VOLUME_CONTEXT* VolumeContext; //0x12b8 ULONG LateUnloadWorkItemState; //0x12c0 struct _EX_PUSH_LOCK LateUnloadFinishedEvent; //0x12c8 struct _WORK_QUEUE_ITEM* LateUnloadWorkItem; //0x12d0 };