//0xd8 bytes (sizeof)
struct _FILE_OBJECT
{
SHORT Type; //0x0
SHORT Size; //0x2
struct
_DEVICE_OBJECT* DeviceObject; //0x8
struct
_VPB* Vpb; //0x10
VOID* FsContext; //0x18
VOID* FsContext2; //0x20
struct
_SECTION_OBJECT_POINTERS* SectionObjectPointer; //0x28
VOID* PrivateCacheMap; //0x30
LONG FinalStatus; //0x38
struct
_FILE_OBJECT* RelatedFileObject; //0x40
UCHAR LockOperation; //0x48
UCHAR DeletePending; //0x49
UCHAR ReadAccess; //0x4a
UCHAR WriteAccess; //0x4b
UCHAR DeleteAccess; //0x4c
UCHAR SharedRead; //0x4d
UCHAR SharedWrite; //0x4e
UCHAR SharedDelete; //0x4f
ULONG Flags; //0x50
struct
_UNICODE_STRING FileName; //0x58
union
_LARGE_INTEGER CurrentByteOffset; //0x68
ULONG Waiters; //0x70
ULONG Busy; //0x74
VOID* LastLock; //0x78
struct
_KEVENT Lock; //0x80
struct
_KEVENT Event; //0x98
struct
_IO_COMPLETION_CONTEXT* CompletionContext; //0xb0
ULONGLONG IrpListLock; //0xb8
struct
_LIST_ENTRY IrpList; //0xc0
VOID* FileObjectExtension; //0xd0
};