_IRP

//0x70 bytes (sizeof) struct _IRP { SHORT Type; //0x0 USHORT Size; //0x2 struct _MDL* MdlAddress; //0x4 ULONG Flags; //0x8 union { struct _IRP* MasterIrp; //0xc LONG IrpCount; //0xc VOID* SystemBuffer; //0xc } AssociatedIrp; //0xc struct _LIST_ENTRY ThreadListEntry; //0x10 struct _IO_STATUS_BLOCK IoStatus; //0x18 CHAR RequestorMode; //0x20 UCHAR PendingReturned; //0x21 CHAR StackCount; //0x22 CHAR CurrentLocation; //0x23 UCHAR Cancel; //0x24 UCHAR CancelIrql; //0x25 CHAR ApcEnvironment; //0x26 UCHAR AllocationFlags; //0x27 struct _IO_STATUS_BLOCK* UserIosb; //0x28 struct _KEVENT* UserEvent; //0x2c union { struct { union { VOID (*UserApcRoutine)(VOID* arg1, struct _IO_STATUS_BLOCK* arg2, ULONG arg3); //0x30 VOID* IssuingProcess; //0x30 }; VOID* UserApcContext; //0x34 } AsynchronousParameters; //0x30 union _LARGE_INTEGER AllocationSize; //0x30 } Overlay; //0x30 VOID (*CancelRoutine)(struct _DEVICE_OBJECT* arg1, struct _IRP* arg2); //0x38 VOID* UserBuffer; //0x3c union { struct { union { struct _KDEVICE_QUEUE_ENTRY DeviceQueueEntry; //0x40 VOID* DriverContext[4]; //0x40 }; struct _ETHREAD* Thread; //0x50 CHAR* AuxiliaryBuffer; //0x54 struct _LIST_ENTRY ListEntry; //0x58 union { struct _IO_STACK_LOCATION* CurrentStackLocation; //0x60 ULONG PacketType; //0x60 }; struct _FILE_OBJECT* OriginalFileObject; //0x64 VOID* IrpExtension; //0x68 } Overlay; //0x40 struct _KAPC Apc; //0x40 VOID* CompletionKey; //0x40 } Tail; //0x40 };