//0x78 bytes (sizeof)
struct _OBJECT_TYPE_INITIALIZER
{
USHORT Length; //0x0
union
{
USHORT ObjectTypeFlags; //0x2
struct
{
UCHAR CaseInsensitive:1; //0x2
UCHAR UnnamedObjectsOnly:1; //0x2
UCHAR UseDefaultObject:1; //0x2
UCHAR SecurityRequired:1; //0x2
UCHAR MaintainHandleCount:1; //0x2
UCHAR MaintainTypeList:1; //0x2
UCHAR SupportsObjectCallbacks:1; //0x2
UCHAR CacheAligned:1; //0x2
UCHAR UseExtendedParameters:1; //0x3
UCHAR Reserved:7; //0x3
};
};
ULONG ObjectTypeCode; //0x4
ULONG InvalidAttributes; //0x8
struct
_GENERIC_MAPPING GenericMapping; //0xc
ULONG ValidAccessMask; //0x1c
ULONG RetainAccess; //0x20
enum
_POOL_TYPE PoolType; //0x24
ULONG DefaultPagedPoolCharge; //0x28
ULONG DefaultNonPagedPoolCharge; //0x2c
VOID (*DumpProcedure)(VOID* arg1, struct
_OBJECT_DUMP_CONTROL* arg2); //0x30
LONG (*OpenProcedure)(enum
_OB_OPEN_REASON arg1, CHAR arg2, struct
_EPROCESS* arg3, VOID* arg4, ULONG* arg5, ULONG arg6); //0x38
VOID (*CloseProcedure)(struct
_EPROCESS* arg1, VOID* arg2, ULONGLONG arg3, ULONGLONG arg4); //0x40
VOID (*DeleteProcedure)(VOID* arg1); //0x48
union
{
LONG (*ParseProcedure)(VOID* arg1, VOID* arg2, struct
_ACCESS_STATE* arg3, CHAR arg4, ULONG arg5, struct
_UNICODE_STRING* arg6, struct
_UNICODE_STRING* arg7, VOID* arg8, struct
_SECURITY_QUALITY_OF_SERVICE* arg9, VOID** arg10); //0x50
LONG (*ParseProcedureEx)(VOID* arg1, VOID* arg2, struct
_ACCESS_STATE* arg3, CHAR arg4, ULONG arg5, struct
_UNICODE_STRING* arg6, struct
_UNICODE_STRING* arg7, VOID* arg8, struct
_SECURITY_QUALITY_OF_SERVICE* arg9, struct
_OB_EXTENDED_PARSE_PARAMETERS* arg10, VOID** arg11); //0x50
};
LONG (*SecurityProcedure)(VOID* arg1, enum
_SECURITY_OPERATION_CODE arg2, ULONG* arg3, VOID* arg4, ULONG* arg5, VOID** arg6, enum
_POOL_TYPE arg7, struct
_GENERIC_MAPPING* arg8, CHAR arg9); //0x58
LONG (*QueryNameProcedure)(VOID* arg1, UCHAR arg2, struct
_OBJECT_NAME_INFORMATION* arg3, ULONG arg4, ULONG* arg5, CHAR arg6); //0x60
UCHAR (*OkayToCloseProcedure)(struct
_EPROCESS* arg1, VOID* arg2, VOID* arg3, CHAR arg4); //0x68
ULONG WaitObjectFlagMask; //0x70
USHORT WaitObjectFlagOffset; //0x74
USHORT WaitObjectPointerOffset; //0x76
};