_CM_KEY_CONTROL_BLOCK

//0x138 bytes (sizeof) struct _CM_KEY_CONTROL_BLOCK { ULONGLONG RefCount; //0x0 ULONG ExtFlags:16; //0x8 ULONG Freed:1; //0x8 ULONG Discarded:1; //0x8 ULONG HiveUnloaded:1; //0x8 ULONG Decommissioned:1; //0x8 ULONG SpareExtFlag:1; //0x8 ULONG TotalLevels:10; //0x8 union { struct _CM_KEY_HASH KeyHash; //0x10 struct { struct _CM_PATH_HASH ConvKey; //0x10 struct _CM_KEY_HASH* NextHash; //0x18 struct _HHIVE* KeyHive; //0x20 ULONG KeyCell; //0x28 }; }; struct _EX_PUSH_LOCK KcbPushlock; //0x30 union { struct _KTHREAD* Owner; //0x38 LONG SharedCount; //0x38 }; UCHAR DelayedDeref:1; //0x40 UCHAR DelayedClose:1; //0x40 UCHAR Parking:1; //0x40 UCHAR LayerSemantics; //0x41 SHORT LayerHeight; //0x42 ULONG Spare1; //0x44 struct _CM_KEY_CONTROL_BLOCK* ParentKcb; //0x48 struct _CM_NAME_CONTROL_BLOCK* NameBlock; //0x50 struct _CM_KEY_SECURITY_CACHE* CachedSecurity; //0x58 struct _CHILD_LIST ValueList; //0x60 struct _CM_KEY_CONTROL_BLOCK* LinkTarget; //0x68 union { struct _CM_INDEX_HINT_BLOCK* IndexHint; //0x70 ULONG HashKey; //0x70 ULONG SubKeyCount; //0x70 }; union { struct _LIST_ENTRY KeyBodyListHead; //0x78 struct _LIST_ENTRY ClonedListEntry; //0x78 }; struct _CM_KEY_BODY* KeyBodyArray[4]; //0x88 union _LARGE_INTEGER KcbLastWriteTime; //0xa8 USHORT KcbMaxNameLen; //0xb0 USHORT KcbMaxValueNameLen; //0xb2 ULONG KcbMaxValueDataLen; //0xb4 ULONG KcbUserFlags:4; //0xb8 ULONG KcbVirtControlFlags:4; //0xb8 ULONG KcbDebug:8; //0xb8 ULONG Flags:16; //0xb8 ULONG Spare3; //0xbc struct _CM_KCB_LAYER_INFO* LayerInfo; //0xc0 CHAR* RealKeyName; //0xc8 struct _LIST_ENTRY KCBUoWListHead; //0xd0 union { struct _LIST_ENTRY DelayQueueEntry; //0xe0 volatile UCHAR* Stolen; //0xe0 }; struct _CM_TRANS* TransKCBOwner; //0xf0 struct _CM_INTENT_LOCK KCBLock; //0xf8 struct _CM_INTENT_LOCK KeyLock; //0x108 struct _CHILD_LIST TransValueCache; //0x118 struct _CM_TRANS* TransValueListOwner; //0x120 union { struct _UNICODE_STRING* FullKCBName; //0x128 struct { ULONGLONG FullKCBNameStale:1; //0x128 ULONGLONG Reserved:63; //0x128 }; }; ULONGLONG SequenceNumber; //0x130 };