fbc
fbc copied to clipboard
The _DISPATCHER_HEADER structure is incorrect
This is really too complicated, the original structure in FB should be wrong, I want to correct, but I don't know how to define this structure in FB.
fb
type _DISPATCHER_HEADER
Type as UCHAR
Absolute as UCHAR
Size as UCHAR
Inserted as UCHAR
SignalState as LONG
WaitListHead as LIST_ENTRY
end type
vc wdm10
typedef struct _DISPATCHER_HEADER {
union {
union {
volatile LONG Lock;
LONG LockNV;
} DUMMYUNIONNAME;
struct { // Events, Semaphores, Gates, etc.
UCHAR Type; // All (accessible via KOBJECT_TYPE)
UCHAR Signalling;
UCHAR Size;
UCHAR Reserved1;
} DUMMYSTRUCTNAME;
struct { // Timer
UCHAR TimerType;
union {
UCHAR TimerControlFlags;
struct {
UCHAR Absolute : 1;
UCHAR Wake : 1;
UCHAR EncodedTolerableDelay : TIMER_TOLERABLE_DELAY_BITS;
} DUMMYSTRUCTNAME;
};
UCHAR Hand;
union {
UCHAR TimerMiscFlags;
struct {
#if !defined(KENCODED_TIMER_PROCESSOR)
UCHAR Index : TIMER_EXPIRED_INDEX_BITS;
#else
UCHAR Index : 1;
UCHAR Processor : TIMER_PROCESSOR_INDEX_BITS;
#endif
UCHAR Inserted : 1;
volatile UCHAR Expired : 1;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
} DUMMYSTRUCTNAME2;
struct { // Timer2
UCHAR Timer2Type;
union {
UCHAR Timer2Flags;
struct {
UCHAR Timer2Inserted : 1;
UCHAR Timer2Expiring : 1;
UCHAR Timer2CancelPending : 1;
UCHAR Timer2SetPending : 1;
UCHAR Timer2Running : 1;
UCHAR Timer2Disabled : 1;
UCHAR Timer2ReservedFlags : 2;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
UCHAR Timer2ComponentId;
UCHAR Timer2RelativeId;
} DUMMYSTRUCTNAME3;
struct { // Queue
UCHAR QueueType;
union {
UCHAR QueueControlFlags;
struct {
UCHAR Abandoned : 1;
UCHAR DisableIncrement : 1;
UCHAR QueueReservedControlFlags : 6;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
UCHAR QueueSize;
UCHAR QueueReserved;
} DUMMYSTRUCTNAME4;
struct { // Thread
UCHAR ThreadType;
UCHAR ThreadReserved;
union {
UCHAR ThreadControlFlags;
struct {
UCHAR CycleProfiling : 1;
UCHAR CounterProfiling : 1;
UCHAR GroupScheduling : 1;
UCHAR AffinitySet : 1;
UCHAR Tagged : 1;
UCHAR EnergyProfiling: 1;
#if !defined(_X86_)
UCHAR ThreadReservedControlFlags : 2;
#else
UCHAR Instrumented : 1;
UCHAR ThreadReservedControlFlags : 1;
#endif
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
union {
UCHAR DebugActive;
#if !defined(_X86_)
struct {
BOOLEAN ActiveDR7 : 1;
BOOLEAN Instrumented : 1;
BOOLEAN Minimal : 1;
BOOLEAN Reserved4 : 3;
BOOLEAN UmsScheduled : 1;
BOOLEAN UmsPrimary : 1;
} DUMMYSTRUCTNAME;
#endif
} DUMMYUNIONNAME2;
} DUMMYSTRUCTNAME5;
struct { // Mutant
UCHAR MutantType;
UCHAR MutantSize;
BOOLEAN DpcActive;
UCHAR MutantReserved;
} DUMMYSTRUCTNAME6;
} DUMMYUNIONNAME;
LONG SignalState; // Object lock
LIST_ENTRY WaitListHead; // Object lock
} DISPATCHER_HEADER, *PDISPATCHER_HEADER;
Put ``` on a line before and after code to format it as code, or highlight it and click the 'Add code' button (ctrl-E). I've edited your post to do so.
I recommend using fbfrog to translate complicated structs like that.
FB's version of it seems to be from earlier versions of Windows, but seems to be correct. You want it updated just for interest/poking around? You're welcome to submit an updated version, though I read
Although its layout is public, the DISPATCHER_HEADER surely is intended to be treated as opaque outside the kernel. The definition seems to have been published only so that in those cases where drivers and other kernel-mode modules create the waitable object they can know how much space to allocate.
Yes, I am learning to use FB to develop drivers. There's just too little data, too much structure, and no type. They are struggling to replenish themselves