Archive for May 18th, 2008

Yet another great Xen book

Sunday, May 18th, 2008

This is a new Xen book that I got in the post a few days ago and it seems to be so good that I took it home from work to start reading it during this weekend:

Running Xen: A Hands-On Guide to the Art of Virtualization

Buy from Amazon

I’ll post a review once I read past the first chapter which is the excellent overview of different virtualization technologies.

See also another good Xen book that I discovered previously:

XEN from a system programmer’s perspective

- Dmitry Vostokov @ DumpAnalysis.org -

WinDbg 6.9.3.113 lost type discovery?

Sunday, May 18th, 2008

Seems dt command wildcards doesn’t work anymore for ntdll and nt modules (I haven’t tested other modules):

1: kd> dt nt!*
1: kd>

Previous version of WinDbg on the same crash dump works fine. I’m listing its sorted output to preserve types for future reference in case Microsoft decided to remove this feature (NTDLL types can be found here):

  nt!LIST_ENTRY64
  nt!_ACCESS_STATE
  nt!_ACL
  nt!_ACTIVATION_CONTEXT
  nt!_ACTIVATION_CONTEXT_DATA
  nt!_ACTIVATION_CONTEXT_STACK
  nt!_ADAPTER_OBJECT
  nt!_ALPC_COMMUNICATION_INFO
  nt!_ALPC_COMPLETION_LIST
  nt!_ALPC_COMPLETION_LIST_HEADER
  nt!_ALPC_COMPLETION_LIST_STATE
  nt!_ALPC_COMPLETION_PACKET_LOOKASIDE
  nt!_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY
  nt!_ALPC_DISPATCH_CONTEXT
  nt!_ALPC_HANDLE_ENTRY
  nt!_ALPC_HANDLE_TABLE
  nt!_ALPC_MESSAGE_ATTRIBUTES
  nt!_ALPC_MESSAGE_ZONE
  nt!_ALPC_PORT
  nt!_ALPC_PORT_ATTRIBUTES
  nt!_ALPC_PROCESS_CONTEXT
  nt!_ALPHA_LOADER_BLOCK
  nt!_ALTERNATIVE_ARCHITECTURE_TYPE
  nt!_AMD64_DBGKD_CONTROL_SET
  nt!_ARBITER_ACTION
  nt!_ARBITER_ADD_RESERVED_PARAMETERS
  nt!_ARBITER_ALLOCATION_STATE
  nt!_ARBITER_ALTERNATIVE
  nt!_ARBITER_BOOT_ALLOCATION_PARAMETERS
  nt!_ARBITER_CONFLICT_INFO
  nt!_ARBITER_INSTANCE
  nt!_ARBITER_INTERFACE
  nt!_ARBITER_LIST_ENTRY
  nt!_ARBITER_ORDERING
  nt!_ARBITER_ORDERING_LIST
  nt!_ARBITER_PARAMETERS
  nt!_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS
  nt!_ARBITER_QUERY_ARBITRATE_PARAMETERS
  nt!_ARBITER_QUERY_CONFLICT_PARAMETERS
  nt!_ARBITER_REQUEST_SOURCE
  nt!_ARBITER_RESULT
  nt!_ARBITER_RETEST_ALLOCATION_PARAMETERS
  nt!_ARBITER_TEST_ALLOCATION_PARAMETERS
  nt!_ARC_DISK_INFORMATION
  nt!_ARM_DBGKD_CONTROL_SET
  nt!_ASSEMBLY_STORAGE_MAP
  nt!_BITMAP_RANGE
  nt!_BLOB
  nt!_BLOB_ID
  nt!_BLOB_TYPE
  nt!_BUS_EXTENSION_LIST
  nt!_CACHE_DESCRIPTOR
  nt!_CACHE_MANAGER_CALLBACKS
  nt!_CACHE_UNINITIALIZE_EVENT
  nt!_CACHED_CHILD_LIST
  nt!_CACHED_KSTACK_LIST
  nt!_CALL_HASH_ENTRY
  nt!_CALL_PERFORMANCE_DATA
  nt!_CELL_DATA
  nt!_CHILD_LIST
  nt!_CLIENT_ID
  nt!_CLS_LSN
  nt!_CM_BIG_DATA
  nt!_CM_CACHED_VALUE_INDEX
  nt!_CM_CELL_REMAP_BLOCK
  nt!_CM_FULL_RESOURCE_DESCRIPTOR
  nt!_CM_INDEX_HINT_BLOCK
  nt!_CM_INTENT_LOCK
  nt!_CM_KCB_UOW
  nt!_CM_KEY_BODY
  nt!_CM_KEY_CONTROL_BLOCK
  nt!_CM_KEY_HASH
  nt!_CM_KEY_INDEX
  nt!_CM_KEY_NODE
  nt!_CM_KEY_REFERENCE
  nt!_CM_KEY_SECURITY
  nt!_CM_KEY_SECURITY_CACHE
  nt!_CM_KEY_SECURITY_CACHE_ENTRY
  nt!_CM_KEY_VALUE
  nt!_CM_NAME_CONTROL_BLOCK
  nt!_CM_NAME_HASH
  nt!_CM_NOTIFY_BLOCK
  nt!_CM_PARTIAL_RESOURCE_DESCRIPTOR
  nt!_CM_PARTIAL_RESOURCE_LIST
  nt!_CM_RESOURCE_LIST
  nt!_CM_RM
  nt!_CM_TRANS
  nt!_CM_VIEW_OF_FILE
  nt!_CM_WORKITEM
  nt!_CMHIVE
  nt!_COMPRESSED_DATA_INFO
  nt!_CONFIGURATION_CLASS
  nt!_CONFIGURATION_COMPONENT
  nt!_CONFIGURATION_COMPONENT_DATA
  nt!_CONFIGURATION_TYPE
  nt!_CONTEXT
  nt!_CONTROL_AREA
  nt!_CURDIR
  nt!_DBGKD_ANY_CONTROL_SET
  nt!_DBGKD_BREAKPOINTEX
  nt!_DBGKD_CONTINUE
  nt!_DBGKD_CONTINUE2
  nt!_DBGKD_FILL_MEMORY
  nt!_DBGKD_GET_CONTEXT
  nt!_DBGKD_GET_INTERNAL_BREAKPOINT32
  nt!_DBGKD_GET_INTERNAL_BREAKPOINT64
  nt!_DBGKD_GET_SET_BUS_DATA
  nt!_DBGKD_GET_VERSION32
  nt!_DBGKD_GET_VERSION64
  nt!_DBGKD_LOAD_SYMBOLS32
  nt!_DBGKD_LOAD_SYMBOLS64
  nt!_DBGKD_MANIPULATE_STATE32
  nt!_DBGKD_MANIPULATE_STATE64
  nt!_DBGKD_QUERY_MEMORY
  nt!_DBGKD_QUERY_SPECIAL_CALLS
  nt!_DBGKD_READ_MEMORY32
  nt!_DBGKD_READ_MEMORY64
  nt!_DBGKD_READ_WRITE_IO_EXTENDED32
  nt!_DBGKD_READ_WRITE_IO_EXTENDED64
  nt!_DBGKD_READ_WRITE_IO32
  nt!_DBGKD_READ_WRITE_IO64
  nt!_DBGKD_READ_WRITE_MSR
  nt!_DBGKD_RESTORE_BREAKPOINT
  nt!_DBGKD_SEARCH_MEMORY
  nt!_DBGKD_SET_CONTEXT
  nt!_DBGKD_SET_INTERNAL_BREAKPOINT32
  nt!_DBGKD_SET_INTERNAL_BREAKPOINT64
  nt!_DBGKD_SET_SPECIAL_CALL32
  nt!_DBGKD_SET_SPECIAL_CALL64
  nt!_DBGKD_SWITCH_PARTITION
  nt!_DBGKD_WRITE_BREAKPOINT32
  nt!_DBGKD_WRITE_BREAKPOINT64
  nt!_DBGKD_WRITE_MEMORY32
  nt!_DBGKD_WRITE_MEMORY64
  nt!_DBGKM_EXCEPTION32
  nt!_DBGKM_EXCEPTION64
  nt!_DEFERRED_WRITE
  nt!_DESCRIPTOR
  nt!_DEVICE_CAPABILITIES
  nt!_DEVICE_FLAGS
  nt!_DEVICE_MAP
  nt!_DEVICE_NODE
  nt!_DEVICE_OBJECT
  nt!_DEVICE_OBJECT_POWER_EXTENSION
  nt!_DEVICE_POWER_STATE
  nt!_DEVICE_RELATION_TYPE
  nt!_DEVICE_RELATIONS
  nt!_DEVICE_USAGE_NOTIFICATION_TYPE
  nt!_DEVOBJ_EXTENSION
  nt!_DEVPROPKEY
  nt!_DISPATCHER_HEADER
  nt!_DPFLTR_TYPE
  nt!_DRIVER_EXTENSION
  nt!_DRIVER_OBJECT
  nt!_DUAL
  nt!_DUMP_INITIALIZATION_CONTEXT
  nt!_DUMP_STACK_CONTEXT
  nt!_ECP_LIST
  nt!_EFI_FIRMWARE_INFORMATION
  nt!_EJOB
  nt!_EPROCESS
  nt!_EPROCESS_QUOTA_BLOCK
  nt!_ERESOURCE
  nt!_ETHREAD
  nt!_ETIMER
  nt!_ETW_BUFFER_CONTEXT
  nt!_ETW_BUFFER_STATE
  nt!_ETW_GUID_ENTRY
  nt!_ETW_GUID_TYPE
  nt!_ETW_KERNEL_TRACE_TIMESTAMP
  nt!_ETW_LAST_ENABLE_INFO
  nt!_ETW_PROVIDER_STATE
  nt!_ETW_PROVIDER_TABLE_ENTRY
  nt!_ETW_REF_CLOCK
  nt!_ETW_REG_ENTRY
  nt!_ETW_REPLY_QUEUE
  nt!_ETW_RT_EVENT_LOSS
  nt!_ETW_SYSTEMTIME
  nt!_EVENT_DATA_DESCRIPTOR
  nt!_EVENT_DESCRIPTOR
  nt!_EVENT_TYPE
  nt!_EX_FAST_REF
  nt!_EX_PUSH_LOCK
  nt!_EX_PUSH_LOCK_CACHE_AWARE
  nt!_EX_PUSH_LOCK_WAIT_BLOCK
  nt!_EX_RUNDOWN_REF
  nt!_EX_WORK_QUEUE
  nt!_EXCEPTION_DISPOSITION
  nt!_EXCEPTION_POINTERS
  nt!_EXCEPTION_RECORD
  nt!_EXCEPTION_RECORD32
  nt!_EXCEPTION_RECORD64
  nt!_EXCEPTION_REGISTRATION_RECORD
  nt!_FAST_IO_DISPATCH
  nt!_FAST_MUTEX
  nt!_FILE_BASIC_INFORMATION
  nt!_FILE_GET_QUOTA_INFORMATION
  nt!_FILE_INFORMATION_CLASS
  nt!_FILE_NETWORK_OPEN_INFORMATION
  nt!_FILE_OBJECT
  nt!_FILE_STANDARD_INFORMATION
  nt!_FIRMWARE_INFORMATION_LOADER_BLOCK
  nt!_flags
  nt!_FLOATING_SAVE_AREA
  nt!_FLS_CALLBACK_INFO
  nt!_FNSAVE_FORMAT
  nt!_FREE_DISPLAY
  nt!_FS_FILTER_CALLBACK_DATA
  nt!_FS_FILTER_CALLBACKS
  nt!_FS_FILTER_PARAMETERS
  nt!_FS_FILTER_SECTION_SYNC_TYPE
  nt!_FS_FILTER_STREAM_FO_NOTIFICATION_TYPE
  nt!_FSINFOCLASS
  nt!_FX_SAVE_AREA
  nt!_FXSAVE_FORMAT
  nt!_GDI_TEB_BATCH
  nt!_GENERAL_LOOKASIDE
  nt!_GENERAL_LOOKASIDE_POOL
  nt!_GENERIC_MAPPING
  nt!_GUID
  nt!_HANDLE_TABLE
  nt!_HANDLE_TABLE_ENTRY
  nt!_HANDLE_TABLE_ENTRY_INFO
  nt!_HANDLE_TRACE_DB_ENTRY
  nt!_HANDLE_TRACE_DEBUG_INFO
  nt!_HARDWARE_PTE
  nt!_HBASE_BLOCK
  nt!_HEADLESS_LOADER_BLOCK
  nt!_HEAP
  nt!_HEAP_COUNTERS
  nt!_HEAP_DEBUGGING_INFORMATION
  nt!_HEAP_ENTRY
  nt!_HEAP_ENTRY_EXTRA
  nt!_HEAP_FAILURE_TYPE
  nt!_HEAP_FREE_ENTRY
  nt!_HEAP_FREE_ENTRY_EXTRA
  nt!_HEAP_LIST_LOOKUP
  nt!_HEAP_LOCAL_SEGMENT_INFO
  nt!_HEAP_LOCK
  nt!_HEAP_LOOKASIDE
  nt!_HEAP_PSEUDO_TAG_ENTRY
  nt!_HEAP_SEGMENT
  nt!_HEAP_STOP_ON_TAG
  nt!_HEAP_STOP_ON_VALUES
  nt!_HEAP_SUBSEGMENT
  nt!_HEAP_TAG_ENTRY
  nt!_HEAP_TUNING_PARAMETERS
  nt!_HEAP_UCR_DESCRIPTOR
  nt!_HEAP_USERDATA_HEADER
  nt!_HEAP_VIRTUAL_ALLOC_ENTRY
  nt!_HHIVE
  nt!_HIVE_LIST_ENTRY
  nt!_HMAP_DIRECTORY
  nt!_HMAP_ENTRY
  nt!_HMAP_TABLE
  nt!_I386_LOADER_BLOCK
  nt!_IA64_DBGKD_CONTROL_SET
  nt!_IA64_LOADER_BLOCK
  nt!_IMAGE_DATA_DIRECTORY
  nt!_IMAGE_DEBUG_DIRECTORY
  nt!_IMAGE_DOS_HEADER
  nt!_IMAGE_FILE_HEADER
  nt!_IMAGE_NT_HEADERS
  nt!_IMAGE_OPTIONAL_HEADER
  nt!_IMAGE_ROM_OPTIONAL_HEADER
  nt!_IMAGE_SECTION_HEADER
  nt!_IMAGE_SECURITY_CONTEXT
  nt!_INITIAL_PRIVILEGE_SET
  nt!_INTERFACE
  nt!_INTERFACE_TYPE
  nt!_INTERLOCK_SEQ
  nt!_IO_ALLOCATION_ACTION
  nt!_IO_CLIENT_EXTENSION
  nt!_IO_COMPLETION_CONTEXT
  nt!_IO_DRIVER_CREATE_CONTEXT
  nt!_IO_PAGING_PRIORITY
  nt!_IO_PRIORITY_HINT
  nt!_IO_PRIORITY_INFO
  nt!_IO_RESOURCE_DESCRIPTOR
  nt!_IO_RESOURCE_LIST
  nt!_IO_RESOURCE_REQUIREMENTS_LIST
  nt!_IO_SECURITY_CONTEXT
  nt!_IO_STACK_LOCATION
  nt!_IO_STATUS_BLOCK
  nt!_IO_TIMER
  nt!_iobuf
  nt!_IOV_FORCED_PENDING_TRACE
  nt!_IRP
  nt!_IRQ_DEVICE_POLICY
  nt!_IRQ_PRIORITY
  nt!_JOB_ACCESS_STATE
  nt!_KALPC_HANDLE_DATA
  nt!_KALPC_MESSAGE
  nt!_KALPC_MESSAGE_ATTRIBUTES
  nt!_KALPC_REGION
  nt!_KALPC_RESERVE
  nt!_KALPC_SECTION
  nt!_KALPC_SECURITY_DATA
  nt!_KALPC_VIEW
  nt!_KAPC
  nt!_KAPC_STATE
  nt!_KDEVICE_QUEUE
  nt!_KDEVICE_QUEUE_ENTRY
  nt!_KDPC
  nt!_KDPC_DATA
  nt!_KENLISTMENT
  nt!_KENLISTMENT_HISTORY
  nt!_KENLISTMENT_STATE
  nt!_KERNEL_STACK_CONTROL
  nt!_KERNEL_STACK_SEGMENT
  nt!_KEVENT
  nt!_KEXECUTE_OPTIONS
  nt!_KGATE
  nt!_KGDTENTRY
  nt!_KGUARDED_MUTEX
  nt!_KIDTENTRY
  nt!_KiIoAccessMap
  nt!_KINTERRUPT
  nt!_KINTERRUPT_MODE
  nt!_KINTERRUPT_POLARITY
  nt!_KLOCK_QUEUE_HANDLE
  nt!_KMUTANT
  nt!_KNODE
  nt!_KOBJECTS
  nt!_KPCR
  nt!_KPRCB
  nt!_KPROCESS
  nt!_KPROCESSOR_STATE
  nt!_KQUEUE
  nt!_KRESOURCEMANAGER
  nt!_KRESOURCEMANAGER_COMPLETION_BINDING
  nt!_KRESOURCEMANAGER_STATE
  nt!_KSEMAPHORE
  nt!_KSPECIAL_REGISTERS
  nt!_KSPIN_LOCK_QUEUE
  nt!_KSPIN_LOCK_QUEUE_NUMBER
  nt!_KSYSTEM_TIME
  nt!_KTHREAD
  nt!_KTHREAD_STATE
  nt!_KTIMER
  nt!_KTIMER_TABLE_ENTRY
  nt!_KTM
  nt!_KTMNOTIFICATION_PACKET
  nt!_KTMOBJECT_NAMESPACE
  nt!_KTMOBJECT_NAMESPACE_LINK
  nt!_KTRANSACTION
  nt!_KTRANSACTION_HISTORY
  nt!_KTRANSACTION_OUTCOME
  nt!_KTRANSACTION_STATE
  nt!_KTRAP_FRAME
  nt!_KTSS
  nt!_KUSER_SHARED_DATA
  nt!_KWAIT_BLOCK
  nt!_KWAIT_REASON
  nt!_LARGE_INTEGER
  nt!_LAZY_WRITER
  nt!_LDR_DATA_TABLE_ENTRY
  nt!_LIST_ENTRY
  nt!_LOADER_PARAMETER_BLOCK
  nt!_LOADER_PARAMETER_EXTENSION
  nt!_LOADER_PERFORMANCE_DATA
  nt!_LOOKASIDE_LIST_EX
  nt!_LPCP_MESSAGE
  nt!_LPCP_NONPAGED_PORT_QUEUE
  nt!_LPCP_PORT_OBJECT
  nt!_LPCP_PORT_QUEUE
  nt!_LUID
  nt!_LUID_AND_ATTRIBUTES
  nt!_MAILSLOT_CREATE_PARAMETERS
  nt!_MAPPED_FILE_SEGMENT
  nt!_MBCB
  nt!_MDL
  nt!_MEMORY_ALLOCATION_DESCRIPTOR
  nt!_MEMORY_CACHING_TYPE
  nt!_MEMORY_CACHING_TYPE_ORIG
  nt!_MI_COLOR_BASE
  nt!_MI_DYNAMIC_MEMORY_LOCKTYPE
  nt!_MI_EXTRA_IMAGE_INFORMATION
  nt!_MI_IMAGE_SECURITY_REFERENCE
  nt!_MI_PAGEFILE_TRACES
  nt!_MI_PER_SESSION_PROTOS
  nt!_MI_PFN_CACHE_ATTRIBUTE
  nt!_MI_SECTION_CREATION_GATE
  nt!_MI_SECTION_IMAGE_INFORMATION
  nt!_MI_SPECIAL_POOL
  nt!_MI_SYSTEM_PTE_TYPE
  nt!_MI_SYSTEM_VA_TYPE
  nt!_MI_VAD_TYPE
  nt!_MI_VERIFIER_DRIVER_ENTRY
  nt!_MI_VERIFIER_POOL_HEADER
  nt!_MM_AVL_TABLE
  nt!_MM_DRIVER_VERIFIER_DATA
  nt!_MM_PAGE_ACCESS_INFO
  nt!_MM_PAGE_ACCESS_INFO_FLAGS
  nt!_MM_PAGE_ACCESS_INFO_HEADER
  nt!_MM_PAGE_ACCESS_TYPE
  nt!_MM_PAGED_POOL_INFO
  nt!_MM_POOL_FAILURE_REASONS
  nt!_MM_POOL_PRIORITIES
  nt!_MM_POOL_TYPES
  nt!_MM_PREEMPTIVE_TRIMS
  nt!_MM_SESSION_SPACE
  nt!_MM_SESSION_SPACE_FLAGS
  nt!_MM_SUBSECTION_AVL_TABLE
  nt!_MMADDRESS_LIST
  nt!_MMADDRESS_NODE
  nt!_MMBANKED_SECTION
  nt!_MMEXTEND_INFO
  nt!_MMLISTS
  nt!_MMMOD_WRITER_MDL_ENTRY
  nt!_MMPAGING_FILE
  nt!_MMPAGING_FILE_FREE_ENTRY
  nt!_MMPFN
  nt!_MMPFNENTRY
  nt!_MMPFNLIST
  nt!_MMPTE
  nt!_MMPTE_FLUSH_LIST
  nt!_MMPTE_HARDWARE
  nt!_MMPTE_HIGHLOW
  nt!_MMPTE_LIST
  nt!_MMPTE_PROTOTYPE
  nt!_MMPTE_SOFTWARE
  nt!_MMPTE_SUBSECTION
  nt!_MMPTE_TIMESTAMP
  nt!_MMPTE_TRANSITION
  nt!_MMSECTION_FLAGS
  nt!_MMSECURE_FLAGS
  nt!_MMSESSION
  nt!_MMSUBSECTION_FLAGS
  nt!_MMSUBSECTION_NODE
  nt!_MMSUPPORT
  nt!_MMSUPPORT_FLAGS
  nt!_MMVAD
  nt!_MMVAD_FLAGS
  nt!_MMVAD_FLAGS2
  nt!_MMVAD_FLAGS3
  nt!_MMVAD_LONG
  nt!_MMVAD_SHORT
  nt!_MMVIEW
  nt!_MMWSL
  nt!_MMWSLE
  nt!_MMWSLE_FREE_ENTRY
  nt!_MMWSLE_HASH
  nt!_MMWSLE_NONDIRECT_HASH
  nt!_MMWSLENTRY
  nt!_MODE
  nt!_MSUBSECTION
  nt!_NAMED_PIPE_CREATE_PARAMETERS
  nt!_NETWORK_LOADER_BLOCK
  nt!_NLS_DATA_BLOCK
  nt!_NPAGED_LOOKASIDE_LIST
  nt!_NT_PRODUCT_TYPE
  nt!_NT_TIB
  nt!_OB_DUPLICATE_OBJECT_STATE
  nt!_OB_OPEN_REASON
  nt!_OBJECT_ATTRIBUTES
  nt!_OBJECT_CREATE_INFORMATION
  nt!_OBJECT_DIRECTORY
  nt!_OBJECT_DIRECTORY_ENTRY
  nt!_OBJECT_DUMP_CONTROL
  nt!_OBJECT_HANDLE_COUNT_DATABASE
  nt!_OBJECT_HANDLE_COUNT_ENTRY
  nt!_OBJECT_HANDLE_INFORMATION
  nt!_OBJECT_HEADER
  nt!_OBJECT_HEADER_CREATOR_INFO
  nt!_OBJECT_HEADER_HANDLE_INFO
  nt!_OBJECT_HEADER_NAME_INFO
  nt!_OBJECT_HEADER_QUOTA_INFO
  nt!_OBJECT_INFORMATION_CLASS
  nt!_OBJECT_NAME_INFORMATION
  nt!_OBJECT_REF_INFO
  nt!_OBJECT_REF_STACK_INFO
  nt!_OBJECT_REF_TRACE
  nt!_OBJECT_SYMBOLIC_LINK
  nt!_OBJECT_TYPE
  nt!_OBJECT_TYPE_INITIALIZER
  nt!_OBP_LOOKUP_CONTEXT
  nt!_OWNER_ENTRY
  nt!_PAGED_LOOKASIDE_LIST
  nt!_PAGEFAULT_HISTORY
  nt!_PCAT_FIRMWARE_INFORMATION
  nt!_PCI_HOTPLUG_SLOT_INTERRUPT
  nt!_PEB
  nt!_PEB_LDR_DATA
  nt!_PERFINFO_GROUPMASK
  nt!_PERFINFO_HARDPAGEFAULT_INFORMATION
  nt!_PERFINFO_TRACE_HEADER
  nt!_PF_FILE_ACCESS_TYPE
  nt!_PF_HARD_FAULT_INFO
  nt!_PF_KERNEL_GLOBALS
  nt!_PHYSICAL_MEMORY_DESCRIPTOR
  nt!_PHYSICAL_MEMORY_RUN
  nt!_PI_BUS_EXTENSION
  nt!_PI_RESOURCE_ARBITER_ENTRY
  nt!_PLUGPLAY_EVENT_BLOCK
  nt!_PLUGPLAY_EVENT_CATEGORY
  nt!_PNP_ASSIGN_RESOURCES_CONTEXT
  nt!_PNP_DEVICE_COMPLETION_QUEUE
  nt!_PNP_DEVICE_EVENT_ENTRY
  nt!_PNP_DEVICE_EVENT_LIST
  nt!_PNP_DEVNODE_STATE
  nt!_PNP_RESOURCE_REQUEST
  nt!_PNP_VETO_TYPE
  nt!_PO_DEVICE_NOTIFY
  nt!_PO_DEVICE_NOTIFY_ORDER
  nt!_PO_HIBER_PERF
  nt!_PO_IRP_MANAGER
  nt!_PO_IRP_QUEUE
  nt!_PO_MEMORY_RANGE_ARRAY
  nt!_PO_MEMORY_RANGE_ARRAY_LINK
  nt!_PO_MEMORY_RANGE_ARRAY_RANGE
  nt!_PO_NOTIFY_ORDER_LEVEL
  nt!_POLICY_AUDIT_EVENT_TYPE
  nt!_POOL_BLOCK_HEAD
  nt!_POOL_DESCRIPTOR
  nt!_POOL_HACKER
  nt!_POOL_HEADER
  nt!_POOL_TRACKER_BIG_PAGES
  nt!_POOL_TRACKER_TABLE
  nt!_POOL_TYPE
  nt!_POP_ACTION_TRIGGER
  nt!_POP_CPU_INFO
  nt!_POP_DEVICE_SYS_STATE
  nt!_POP_DISPLAY_RESUME_CONTEXT
  nt!_POP_HIBER_CONTEXT
  nt!_POP_POWER_ACTION
  nt!_POP_SHUTDOWN_BUG_CHECK
  nt!_POP_THERMAL_ZONE
  nt!_POP_TRIGGER_WAIT
  nt!_PORT_MESSAGE
  nt!_POWER_CHANNEL_SUMMARY
  nt!_POWER_SEQUENCE
  nt!_POWER_STATE
  nt!_POWER_STATE_TYPE
  nt!_PP_LOOKASIDE_LIST
  nt!_PP_NPAGED_LOOKASIDE_NUMBER
  nt!_PPM_DIA_STATS
  nt!_PPM_IDLE_STATE
  nt!_PPM_IDLE_STATES
  nt!_PPM_PERF_STATE
  nt!_PPM_PERF_STATES
  nt!_PRIVATE_CACHE_MAP
  nt!_PRIVATE_CACHE_MAP_FLAGS
  nt!_PRIVILEGE_SET
  nt!_PROCESSOR_CACHE_TYPE
  nt!_PROCESSOR_POWER_STATE
  nt!_PROFILE_PARAMETER_BLOCK
  nt!_PROXY_CLASS
  nt!_PS_CLIENT_SECURITY_CONTEXT
  nt!_PS_RESOURCE_TYPE
  nt!_PSP_RATE_APC
  nt!_PTE_TRACKER
  nt!_QUAD
  nt!_REG_NOTIFY_CLASS
  nt!_REMOTE_PORT_VIEW
  nt!_RTL_ACTIVATION_CONTEXT_STACK_FRAME
  nt!_RTL_ATOM_TABLE
  nt!_RTL_ATOM_TABLE_ENTRY
  nt!_RTL_AVL_TABLE
  nt!_RTL_BALANCED_LINKS
  nt!_RTL_BITMAP
  nt!_RTL_CRITICAL_SECTION
  nt!_RTL_CRITICAL_SECTION_DEBUG
  nt!_RTL_DRIVE_LETTER_CURDIR
  nt!_RTL_GENERIC_COMPARE_RESULTS
  nt!_RTL_HANDLE_TABLE
  nt!_RTL_HANDLE_TABLE_ENTRY
  nt!_RTL_RANGE
  nt!_RTL_RANGE_LIST
  nt!_RTL_SRWLOCK
  nt!_RTL_USER_PROCESS_PARAMETERS
  nt!_RTLP_RANGE_LIST_ENTRY
  nt!_SCSI_REQUEST_BLOCK
  nt!_SE_AUDIT_PROCESS_CREATION_INFO
  nt!_SECTION_IMAGE_INFORMATION
  nt!_SECTION_OBJECT
  nt!_SECTION_OBJECT_POINTERS
  nt!_SECURITY_CLIENT_CONTEXT
  nt!_SECURITY_DESCRIPTOR
  nt!_SECURITY_DESCRIPTOR_RELATIVE
  nt!_SECURITY_IMPERSONATION_LEVEL
  nt!_SECURITY_OPERATION_CODE
  nt!_SECURITY_QUALITY_OF_SERVICE
  nt!_SECURITY_SUBJECT_CONTEXT
  nt!_SECURITY_TOKEN_AUDIT_DATA
  nt!_SECURITY_TOKEN_PROXY_DATA
  nt!_SEGMENT
  nt!_SEGMENT_FLAGS
  nt!_SEGMENT_OBJECT
  nt!_SEP_AUDIT_POLICY
  nt!_SEP_LOGON_SESSION_REFERENCES
  nt!_SEP_TOKEN_PRIVILEGES
  nt!_SETUP_LOADER_BLOCK
  nt!_SHARED_CACHE_MAP
  nt!_SHARED_CACHE_MAP_LIST_CURSOR
  nt!_SID
  nt!_SID_AND_ATTRIBUTES
  nt!_SID_AND_ATTRIBUTES_HASH
  nt!_SID_IDENTIFIER_AUTHORITY
  nt!_SINGLE_LIST_ENTRY
  nt!_SLIST_HEADER
  nt!_SMBIOS_TABLE_HEADER
  nt!_STACK_TABLE
  nt!_STRING
  nt!_SUBSECTION
  nt!_SYSPTES_HEADER
  nt!_SYSTEM_POWER_POLICY
  nt!_SYSTEM_POWER_STATE
  nt!_SYSTEM_POWER_STATE_CONTEXT
  nt!_SYSTEM_TRACE_HEADER
  nt!_TEB
  nt!_TEB_ACTIVE_FRAME
  nt!_TEB_ACTIVE_FRAME_CONTEXT
  nt!_TERMINATION_PORT
  nt!_THERMAL_INFORMATION
  nt!_THERMAL_INFORMATION_EX
  nt!_TIME_FIELDS
  nt!_TOKEN
  nt!_TOKEN_AUDIT_POLICY
  nt!_TOKEN_CONTROL
  nt!_TOKEN_SOURCE
  nt!_TOKEN_TYPE
  nt!_TP_CALLBACK_ENVIRON
  nt!_TP_CALLBACK_INSTANCE
  nt!_TP_CLEANUP_GROUP
  nt!_TP_DIRECT
  nt!_TP_POOL
  nt!_TP_TASK
  nt!_TP_TASK_CALLBACKS
  nt!_TRACE_ENABLE_CONTEXT
  nt!_TRACE_ENABLE_CONTEXT_EX
  nt!_TRACE_ENABLE_INFO
  nt!_TXN_PARAMETER_BLOCK
  nt!_TYPE_OF_MEMORY
  nt!_u
  nt!_ULARGE_INTEGER
  nt!_UNICODE_STRING
  nt!_VACB
  nt!_VACB_ARRAY_HEADER
  nt!_VACB_LEVEL_REFERENCE
  nt!_VF_BTS_DATA_MANAGEMENT_AREA
  nt!_VF_BTS_RECORD
  nt!_VF_POOL_TRACE
  nt!_VF_TRACKER
  nt!_VF_TRACKER_STAMP
  nt!_VI_CANCEL_GLOBALS
  nt!_VI_CNT_INDEX_TYPE
  nt!_VI_DEADLOCK_ADDRESS_RANGE
  nt!_VI_DEADLOCK_GLOBALS
  nt!_VI_DEADLOCK_NODE
  nt!_VI_DEADLOCK_RESOURCE
  nt!_VI_DEADLOCK_RESOURCE_TYPE
  nt!_VI_DEADLOCK_THREAD
  nt!_VI_FAULT_TRACE
  nt!_VI_POOL_ENTRY
  nt!_VI_POOL_ENTRY_INUSE
  nt!_VI_POOL_PAGE_HEADER
  nt!_VI_TRACK_IRQL
  nt!_VI_VERIFIER_ISSUE
  nt!_VIRTUAL_EFI_RUNTIME_SERVICES
  nt!_VOLUME_CACHE_MAP
  nt!_VPB
  nt!_WAIT_CONTEXT_BLOCK
  nt!_WAIT_TYPE
  nt!_WHEA_ERROR_PACKET
  nt!_WHEA_ERROR_PACKET_FLAGS
  nt!_WHEA_ERROR_RECORD
  nt!_WHEA_ERROR_RECORD_HEADER
  nt!_WHEA_ERROR_RECORD_HEADER_FLAGS
  nt!_WHEA_ERROR_RECORD_HEADER_VALIDBITS
  nt!_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR
  nt!_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS
  nt!_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS
  nt!_WHEA_ERROR_SEVERITY
  nt!_WHEA_ERROR_SOURCE_TYPE
  nt!_WHEA_ERROR_STATUS
  nt!_WHEA_ERROR_TYPE
  nt!_WHEA_GENERIC_PROCESSOR_ERROR
  nt!_WHEA_GENERIC_PROCESSOR_ERROR_VALIDBITS
  nt!_WHEA_MEMORY_ERROR
  nt!_WHEA_MEMORY_ERROR_VALIDBITS
  nt!_WHEA_NMI_ERROR
  nt!_WHEA_NMI_ERROR_FLAGS
  nt!_WHEA_PCIEXPRESS_BRIDGE_CONTROL_STATUS
  nt!_WHEA_PCIEXPRESS_COMMAND_STATUS
  nt!_WHEA_PCIEXPRESS_DEVICE_ID
  nt!_WHEA_PCIEXPRESS_ERROR
  nt!_WHEA_PCIEXPRESS_ERROR_VALIDBITS
  nt!_WHEA_PCIEXPRESS_VERSION
  nt!_WHEA_PCIXBUS_COMMAND
  nt!_WHEA_PCIXBUS_ERROR
  nt!_WHEA_PCIXBUS_ERROR_VALIDBITS
  nt!_WHEA_PCIXBUS_ID
  nt!_WHEA_PCIXDEVICE_ERROR
  nt!_WHEA_PCIXDEVICE_ERROR_VALIDBITS
  nt!_WHEA_PCIXDEVICE_ID
  nt!_WHEA_PERSISTENCE_INFO
  nt!_WHEA_RAW_DATA_FORMAT
  nt!_WHEA_REVISION
  nt!_WHEA_TIMESTAMP
  nt!_WMI_BUFFER_HEADER
  nt!_WMI_LOGGER_CONTEXT
  nt!_WMI_TRACE_PACKET
  nt!_WNODE_HEADER
  nt!_WORK_QUEUE_ENTRY
  nt!_WORK_QUEUE_ITEM
  nt!_WOW64_SHARED_INFORMATION
  nt!_X86_DBGKD_CONTROL_SET
  nt!BATTERY_REPORTING_SCALE
  nt!BUS_QUERY_ID_TYPE
  nt!CMP_OFFSET_ARRAY
  nt!DEVICE_TEXT_TYPE
  nt!EX_QUEUE_WORKER_INFO
  nt!HSTORAGE_TYPE
  nt!KTM_STATE
  nt!LIST_ENTRY32
  nt!LIST_ENTRY64
  nt!LSA_FOREST_TRUST_RECORD_TYPE
  nt!PO_MEMORY_IMAGE
  nt!POP_POLICY_DEVICE_TYPE
  nt!POWER_ACTION
  nt!POWER_ACTION_POLICY
  nt!PPM_IDLE_ACCOUNTING
  nt!PPM_IDLE_STATE_ACCOUNTING
  nt!PROCESSOR_IDLESTATE_INFO
  nt!PROCESSOR_IDLESTATE_POLICY
  nt!PROCESSOR_PERFSTATE_POLICY
  nt!PROFILE_STATUS
  nt!ReplacesCorHdrNumericDefines
  nt!SYSTEM_POWER_CAPABILITIES
  nt!SYSTEM_POWER_CONDITION
  nt!SYSTEM_POWER_LEVEL
  nt!UoWActionType
  nt!WHEA_PCIEXPRESS_DEVICE_TYPE
  nt!WHEA_PCIXDEVICE_REGISTER_PAIR

- Dmitry Vostokov @ DumpAnalysis.org -