_CMHIVE

//0x12f0 bytes (sizeof) struct _CMHIVE { struct _HHIVE Hive; //0x0 VOID* FileHandles[6]; //0x608 struct _LIST_ENTRY NotifyList; //0x638 struct _LIST_ENTRY HiveList; //0x648 struct _LIST_ENTRY PreloadedHiveList; //0x658 struct _EX_RUNDOWN_REF HiveRundown; //0x668 struct _CM_KEY_HASH_TABLE_ENTRY* KcbCacheTable; //0x670 ULONG KcbCacheTableSize; //0x678 struct _CM_KEY_HASH_TABLE_ENTRY* DeletedKcbTable; //0x680 ULONG DeletedKcbTableSize; //0x688 ULONG Identity; //0x68c struct _CMSI_RW_LOCK HiveLock; //0x690 struct _RTL_BITMAP FlushDirtyVector; //0x698 ULONG FlushDirtyVectorSize; //0x6a8 struct CMP_OFFSET_ARRAY* FlushLogEntryOffsetArray; //0x6b0 ULONG FlushLogEntryOffsetArrayCount; //0x6b8 ULONG FlushLogEntrySize; //0x6bc ULONG FlushHiveTruncated; //0x6c0 UCHAR FlushBaseBlockDirty; //0x6c4 struct _RTL_BITMAP CapturedUnreconciledVector; //0x6c8 ULONG CapturedUnreconciledVectorSize; //0x6d8 struct CMP_OFFSET_ARRAY* UnreconciledOffsetArray; //0x6e0 ULONG UnreconciledOffsetArrayCount; //0x6e8 struct _HBASE_BLOCK* UnreconciledBaseBlock; //0x6f0 struct _EX_PUSH_LOCK SecurityLock; //0x6f8 ULONG LastShrinkHiveSize; //0x700 union _LARGE_INTEGER ActualFileSize; //0x708 union _LARGE_INTEGER LogFileSizes[2]; //0x710 struct _UNICODE_STRING FileFullPath; //0x720 struct _UNICODE_STRING FileUserName; //0x730 struct _UNICODE_STRING HiveRootPath; //0x740 ULONG SecurityCount; //0x750 ULONG SecurityCacheSize; //0x754 LONG SecurityHitHint; //0x758 struct _CM_KEY_SECURITY_CACHE_ENTRY* SecurityCache; //0x760 struct _LIST_ENTRY SecurityHash[64]; //0x768 ULONG UnloadEventCount; //0xb68 struct _KEVENT** UnloadEventArray; //0xb70 struct _CM_KEY_CONTROL_BLOCK* RootKcb; //0xb78 UCHAR Frozen; //0xb80 struct _CM_WORKITEM* UnloadWorkItem; //0xb88 struct _CM_WORKITEM UnloadWorkItemHolder; //0xb90 struct _CM_DIRTY_VECTOR_LOG DirtyVectorLog; //0xbb8 ULONG Flags; //0x1040 struct _LIST_ENTRY TrustClassEntry; //0x1048 ULONGLONG DirtyTime; //0x1058 ULONGLONG UnreconciledTime; //0x1060 struct _CM_RM* CmRm; //0x1068 ULONG CmRmInitFailPoint; //0x1070 LONG CmRmInitFailStatus; //0x1074 struct _KTHREAD* CreatorOwner; //0x1078 struct _KTHREAD* RundownThread; //0x1080 union _LARGE_INTEGER LastWriteTime; //0x1088 struct _HIVE_WRITE_WAIT_QUEUE FlushQueue; //0x1090 struct _HIVE_WRITE_WAIT_QUEUE ReconcileQueue; //0x10a0 union { ULONG FlushFlags; //0x10b0 struct { ULONG PrimaryFilePurged:1; //0x10b0 ULONG DiskFileBad:1; //0x10b0 }; }; ULONG PrimaryFileSizeBeforeLastFlush; //0x10b4 volatile LONG ReferenceCount; //0x10b8 LONG UnloadHistoryIndex; //0x10bc ULONG UnloadHistory[128]; //0x10c0 ULONG BootStart; //0x12c0 ULONG UnaccessedStart; //0x12c4 ULONG UnaccessedEnd; //0x12c8 ULONG LoadedKeyCount; //0x12cc volatile ULONG HandleClosePending; //0x12d0 struct _EX_PUSH_LOCK HandleClosePendingEvent; //0x12d8 UCHAR FinalFlushSucceeded; //0x12e0 struct _CMP_VOLUME_CONTEXT* VolumeContext; //0x12e8 };