Created
April 30, 2019 15:06
-
-
Save AndreyBazhan/0c12ea4c83833f756b9afbfa6bb66cdd to your computer and use it in GitHub Desktop.
List of Windows kernels that have incorrect offsets in MiState _MI_SYSTEM_INFORMATION structure
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ?? @@(ntoskrnl!MiState) + #FIELD_OFFSET(ntoskrnl!_MI_SYSTEM_INFORMATION, Vs); ? poi(ntoskrnl!MiVisibleState) | |
| 10.0.15063.1659 x64 | |
| unsigned int64 0x00000001`4036d080 | |
| Evaluate expression: 5372301504 = 00000001`4036d0c0 | |
| 10.0.15063.1659 x86 | |
| unsigned int64 0x60f700 | |
| Evaluate expression: 6354816 = 0060f780 | |
| 10.0.16299.1004 x64 | |
| unsigned int64 0x00000001`40388280 | |
| Evaluate expression: 5372412608 = 00000001`403882c0 | |
| 10.0.16299.1004 x86 | |
| unsigned int64 0x65ed80 | |
| Evaluate expression: 6680064 = 0065ee00 | |
| 10.0.17134.1 x86 | |
| unsigned int64 0x68e400 | |
| Evaluate expression: 6874240 = 0068e480 | |
| 10.0.17134.590 x86 | |
| unsigned int64 0x686480 | |
| Evaluate expression: 6841664 = 00686540 | |
| 10.0.17763.1 x86 | |
| unsigned int64 0x6aa040 | |
| Evaluate expression: 6987968 = 006aa0c0 | |
| 10.0.17763.316 x86 | |
| unsigned int64 0x6a5f80 | |
| Evaluate expression: 6971392 = 006a6000 | |
| 10.0.18362.30 x86 | |
| unsigned int64 0x6c2d00 | |
| Evaluate expression: 7089536 = 006c2d80 | |
| 10.0.18362.30 x64 | |
| unsigned int64 0x00000001`40463600 | |
| Evaluate expression: 5373310528 = 00000001`40463640 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment