Geoff Chappell - Software Analyst
The KDEX2X86 debugger extension for Windows NT 4.0 and Windows 2000 exports a strct function and thus supports a !strct command. This was in some sense an early form of what Microsoft’s debuggers would soon offer as the built-in dt command to dump a type. A key difference is that the dt command dumps from type information in whatever symbol files the debugger has handy (or can download) but the !strct command was developed to do this work without such help. By default it has only the debugger extension’s built-in knowledge of system-defined structures, but this can be extended by loading definitions from separate structure definition files.
The extension’s own description of the !strct command is
strct [-?h] <structname/"load"/"unload"> [fieldname] [expression]
- Display member offset and structure data
This is from the extension’s !help command. Extensive help is given by the !strct command’s -? or -h switch. Even this, inevitably, is not comprehensive: for instance, the _lists and _listd keywords for showing the externally specified types that are managed by load and unload are apparently private. This note’s purpose, however, is not to pick over the syntax of a long-gone command, but to record which structures the command recognises. In the years before Microsoft built type information in public symbol files, output from the !strct command was the whole of what Microsoft showed in public about more than a few undocumented Windows structures.
The large table that follows lists the structures for which names and offsets of members can be dumped by the !strct command for Windows NT 4.0 or Windows 2000. It is not known what principle ever governed the selection of structures for presentation through the !strct command. Notes follow the table, especially about case insensitivity and leading underscores.
| Structure | Versions | Remarks |
|---|---|---|
| ACCESS_STATE | 4.0 and 5.0 | |
| ACL | 4.0 and 5.0 | |
| BCTL_DEVICE_CAPABILITIES | 4.0 | |
| BUS_HANDLER | 5.0 | |
| CLIENT_ID | 4.0 and 5.0 | |
| CM_COMPONENT_INFORMATION | 4.0 and 5.0 | |
| CM_DISK_GEOMETRY_DEVICE_DATA | 4.0 and 5.0 | |
| CM_EISA_FUNCTION_INFORMATION | 4.0 and 5.0 | |
| CM_EISA_SLOT_INFORMATION | 4.0 and 5.0 | |
| CM_FLOPPY_DEVICE_DATA | 4.0 and 5.0 | |
| CM_FULL_RESOURCE_DESCRIPTOR | 4.0 and 5.0 | |
| CM_INT13_DRIVE_PARAMETER | 4.0 and 5.0 | |
| CM_KEYBOARD_DEVICE_DATA | 4.0 and 5.0 | |
| CM_MCA_POS_DATA | 4.0 and 5.0 | |
| CM_MONITOR_DEVICE_DATA | 4.0 and 5.0 | |
| CM_PARTIAL_RESOURCE_DESCRIPTOR | 4.0 and 5.0 | |
| CM_PARTIAL_RESOURCE_LIST | 4.0 and 5.0 | |
| CM_RESOURCE_LIST | 4.0 and 5.0 | |
| CM_ROM_BLOCK | 4.0 and 5.0 | |
| CM_SCSI_DEVICE_DATA | 4.0 and 5.0 | |
| CM_SERIAL_DEVICE_DATA | 4.0 and 5.0 | |
| CM_SONIC_DEVICE_DATA | 4.0 and 5.0 | |
| CM_VIDEO_DEVICE_DATA | 4.0 and 5.0 | |
| COMPRESSION_TECHNOLOGY_1 | 4.0 | |
| CONFIGURATION_INFORMATION | 4.0 and 5.0 | |
| CONTEXT | 4.0 and 5.0 | |
| CONTROLLER_OBJECT | 4.0 and 5.0 | |
| CURDIR | 4.0 and 5.0 | |
| DESCRIPTOR | 5.0 | |
| DEVICE_CAPABILITIES | 5.0 | |
| DEVICE_CONTROL_CONTEXT | 4.0 and 5.0 | |
| DEVICE_DESCRIPTION | 4.0 and 5.0 | |
| DEVICE_FLAGS | 4.0 and 5.0 | |
| DEVICE_HANDLER_OBJECT | 5.0 | |
| DEVICE_OBJECT | 4.0 and 5.0 | |
| DEVOBJ_EXTENSION | 4.0 and 5.0 | |
| DISPATCHER_HEADER | 4.0 and 5.0 | |
| DMA_CONFIGURATION_BYTE0 | 4.0 and 5.0 | |
| DMA_CONFIGURATION_BYTE1 | 4.0 and 5.0 | |
| DRIVER_EXTENSION | 4.0 and 5.0 | |
| DRIVER_OBJECT | 4.0 and 5.0 | |
| EISA_DMA_CONFIGURATION | 4.0 and 5.0 | |
| EISA_IRQ_CONFIGURATION | 4.0 and 5.0 | |
| EISA_IRQ_DESCRIPTOR | 4.0 and 5.0 | |
| EISA_MEMORY_CONFIGURATION | 4.0 and 5.0 | |
| EISA_MEMORY_TYPE | 4.0 and 5.0 | |
| EISA_PORT_CONFIGURATION | 4.0 and 5.0 | |
| EISA_PORT_DESCRIPTOR | 4.0 and 5.0 | |
| EJOB | 5.0 | |
| EPROCESS | 4.0 and 5.0 | |
| EPROCESS_QUOTA_BLOCK | 5.0 | |
| ERESOURCE | 4.0 and 5.0 | |
| ETHREAD | 4.0 and 5.0 | |
| EXCEPTION_POINTERS | 4.0 and 5.0 | |
| EXCEPTION_RECORD | 4.0 and 5.0 | |
| EXCEPTION_REGISTRATION_RECORD | 5.0 | |
| FAST_IO_DISPATCH | 4.0 and 5.0 | |
| FAST_MUTEX | 4.0 and 5.0 | |
| FILE_ALIGNMENT_INFORMATION | 4.0 and 5.0 | |
| FILE_BASIC_INFORMATION | 4.0 and 5.0 | |
| FILE_DISPOSITION_INFORMATION | 4.0 and 5.0 | |
| FILE_END_OF_FILE_INFORMATION | 4.0 and 5.0 | |
| FILE_FS_DEVICE_INFORMATION | 4.0 and 5.0 | |
| FILE_FULL_EA_INFORMATION | 4.0 and 5.0 | |
| FILE_GET_QUOTA_INFORMATION | 5.0 | |
| FILE_NETWORK_OPEN_INFORMATION | 4.0 and 5.0 | |
| FILE_OBJECT | 4.0 and 5.0 | |
| FILE_POSITION_INFORMATION | 4.0 and 5.0 | |
| FILE_STANDARD_INFORMATION | 4.0 and 5.0 | |
| FLOATING_SAVE_AREA | 4.0 and 5.0 | |
| FNSAVE_FORMAT | 5.0 | |
| FX_SAVE_AREA | 5.0 | |
| FXSAVE_FORMAT | 5.0 | |
| GENERAL_LOOKASIDE | 4.0 and 5.0 | |
| GENERIC_MAPPING | 4.0 and 5.0 | |
| GUID | 4.0 and 5.0 | |
| HAL_BUS_INFORMATION | 4.0 and 5.0 | |
| HAL_CALLBACKS | 4.0 and 5.0 | |
| HAL_DISPATCH | 4.0 and 5.0 | |
| HAL_POWER_INFORMATION | 4.0 and 5.0 | |
| HAL_PROCESSOR_SPEED_INFO | 5.0 | |
| HAL_PROCESSOR_SPEED_INFORMATION | 4.0 | |
| 5.0 | as alias of _HAL_PROCESSOR_SPEED_INFO | |
| HAL_PROFILE_SOURCE_INFORMATION | 4.0 and 5.0 | |
| HAL_PROFILE_SOURCE_INTERVAL | 4.0 and 5.0 | |
| HANDLE_TABLE | 5.0 | |
| HANDLE_TABLE_ENTRY | 5.0 | |
| HARDWARE_PTE | 4.0 | |
| HARDWARE_PTE_X86 | 5.0 | |
| INITIAL_PRIVILEGE_SET | 4.0 and 5.0 | |
| INTERFACE | 5.0 | |
| IO_CLIENT_EXTENSION | 5.0 | |
| IO_COMPLETION_CONTEXT | 4.0 and 5.0 | |
| IO_COUNTERS | 4.0 and 5.0 | |
| IO_ERROR_LOG_MESSAGE | 4.0 and 5.0 | |
| IO_ERROR_LOG_PACKET | 4.0 and 5.0 | |
| IO_RESOURCE_DESCRIPTOR | 4.0 and 5.0 | |
| IO_RESOURCE_LIST | 4.0 and 5.0 | |
| IO_RESOURCE_REQUIREMENTS_LIST | 4.0 and 5.0 | |
| IO_SECURITY_CONTEXT | 4.0 and 5.0 | |
| IO_STACK_LOCATION | 4.0 and 5.0 | |
| IO_STATUS_BLOCK | 4.0 and 5.0 | |
| IO_SYSTEM_INFORMATION | 4.0 | |
| IO_TIMER | 5.0 | |
| IRP | 4.0 and 5.0 | |
| KAPC | 4.0 and 5.0 | |
| KAPC_STATE | 4.0 and 5.0 | |
| KBUGCHECK_CALLBACK_RECORD | 4.0 and 5.0 | |
| KDESCRIPTOR | 4.0 | |
| 5.0 | as alias of _DESCRIPTOR | |
| KDEVICE_QUEUE | 4.0 and 5.0 | |
| KDEVICE_QUEUE_ENTRY | 4.0 and 5.0 | |
| KDPC | 4.0 and 5.0 | |
| KERNEL_USER_TIMES | 4.0 and 5.0 | |
| KEVENT | 4.0 and 5.0 | |
| KEVENT_PAIR | 4.0 | |
| KEY_BASIC_INFORMATION | 4.0 and 5.0 | |
| KEY_FULL_INFORMATION | 4.0 and 5.0 | |
| KEY_NODE_INFORMATION | 4.0 and 5.0 | |
| KEY_VALUE_BASIC_INFORMATION | 4.0 and 5.0 | |
| KEY_VALUE_ENTRY | 4.0 and 5.0 | |
| KEY_VALUE_FULL_INFORMATION | 4.0 and 5.0 | |
| KEY_VALUE_PARTIAL_INFORMATION | 4.0 and 5.0 | |
| KEY_WRITE_TIME_INFORMATION | 4.0 and 5.0 | |
| KGDTENTRY | 4.0 and 5.0 | |
| KIDTENTRY | 4.0 and 5.0 | |
| KIIO_ACCESS_MAP | 4.0 | |
| 5.0 | as alias of _KiIoAccessMap | |
| KIPI_COUNTS | 4.0 and 5.0 | |
| KiIoAccessMap | 5.0 | |
| KMUTANT | 4.0 and 5.0 | |
| KPCR | 4.0 and 5.0 | |
| KPRCB | 4.0 and 5.0 | |
| KPROCESS | 4.0 and 5.0 | |
| KPROCESSOR_STATE | 4.0 and 5.0 | |
| KQUEUE | 4.0 and 5.0 | |
| KSEMAPHORE | 4.0 and 5.0 | |
| KSPECIAL_REGISTERS | 4.0 and 5.0 | |
| KSPIN_LOCK_QUEUE | 5.0 | |
| KSYSTEM_TIME | 4.0 and 5.0 | |
| KTHREAD | 4.0 and 5.0 | |
| KTIMER | 4.0 and 5.0 | |
| KTRAP_FRAME | 5.0 | |
| KTSS | 5.0 | |
| KWAIT_BLOCK | 4.0 and 5.0 | |
| LARGE_INTEGER | 5.0 | |
| LIST_ENTRY | 4.0 and 5.0 | |
| LUID | 4.0 and 5.0 | |
| LUID_AND_ATTRIBUTES | 4.0 and 5.0 | |
| MAILSLOT_CREATE_PARAMETERS | 5.0 | |
| MCA_DRIVER_INFO | 4.0 and 5.0 | |
| MCA_EXCEPTION | 4.0 and 5.0 | |
| MCI_ADDR | 5.0 | |
| MCI_STATS | 5.0 | |
| MDL | 4.0 and 5.0 | |
| MMSUPPORT | 4.0 and 5.0 | |
| MMSUPPORT_FLAGS | 5.0 | |
| NAMED_PIPE_CREATE_PARAMETERS | 5.0 | |
| NPAGED_LOOKASIDE_LIST | 4.0 and 5.0 | |
| NT_SMB_HEADER | 4.0 and 5.0 | |
| NT_TIB | 4.0 and 5.0 | |
| OBJECT_HANDLE_INFORMATION | 4.0 and 5.0 | |
| OBJECT_NAME_INFORMATION | 4.0 and 5.0 | |
| OWNER_ENTRY | 4.0 and 5.0 | |
| PAGED_LOOKASIDE_LIST | 4.0 and 5.0 | |
| PAGEFAULT_HISTORY | 5.0 | |
| PCI_COMMON_CONFIG | 4.0 and 5.0 | |
| PCI_HEADER_TYPE_0 | 5.0 | |
| PCI_HEADER_TYPE_1 | 5.0 | |
| PCI_HEADER_TYPE_2 | 5.0 | |
| PCI_SLOT_NUMBER | 4.0 and 5.0 | |
| PEB | 5.0 | |
| PEB_FREE_BLOCK | 5.0 | |
| PEB_LDR_DATA | 5.0 | |
| POOLED_USAGE_AND_LIMITS | 4.0 and 5.0 | |
| POWER_SEQUENCE | 5.0 | |
| POWER_STATE | 5.0 | |
| PP_LOOKASIDE_LIST | 5.0 | |
| PRIVILEGE_SET | 4.0 and 5.0 | |
| PROCESSOR_IDLE_TIMES | 5.0 | |
| PROCESSOR_POWER_STATE | 5.0 | |
| PROCESS_ACCESS_TOKEN | 4.0 and 5.0 | |
| PROCESS_BASIC_INFORMATION | 4.0 and 5.0 | |
| PROCESS_WS_WATCH_INFORMATION | 4.0 and 5.0 | |
| PS_IMPERSONATION_INFORMATION | 5.0 | |
| PS_JOB_TOKEN_FILTER | 5.0 | |
| QUOTA_LIMITS | 4.0 and 5.0 | |
| REQ_103_WRITE_RAW | 4.0 and 5.0 | |
| REQ_CANCEL_FORWARD | 4.0 and 5.0 | |
| REQ_CHECK_DIRECTORY | 4.0 and 5.0 | |
| REQ_CLOSE | 4.0 and 5.0 | |
| REQ_CLOSE_AND_TREE_DISC | 4.0 and 5.0 | |
| REQ_CLOSE_PRINT_FILE | 4.0 and 5.0 | |
| REQ_COPY | 4.0 and 5.0 | |
| REQ_CREATE | 4.0 and 5.0 | |
| REQ_CREATE_DIRECTORY | 4.0 and 5.0 | |
| REQ_CREATE_TEMPORARY | 4.0 and 5.0 | |
| REQ_DELETE | 4.0 and 5.0 | |
| REQ_DELETE_DIRECTORY | 4.0 and 5.0 | |
| REQ_ECHO | 4.0 and 5.0 | |
| REQ_FIND_CLOSE2 | 4.0 and 5.0 | |
| REQ_FIND_NOTIFY_CLOSE | 4.0 and 5.0 | |
| REQ_FLUSH | 4.0 and 5.0 | |
| REQ_FORWARD_USER_NAME | 4.0 and 5.0 | |
| REQ_GET_MACHINE_NAME | 4.0 and 5.0 | |
| REQ_GET_PRINT_QUEUE | 4.0 and 5.0 | |
| REQ_IOCTL | 4.0 and 5.0 | |
| REQ_IOCTL_SECONDARY | 4.0 and 5.0 | |
| REQ_LOCKING_ANDX | 4.0 and 5.0 | |
| REQ_LOCK_BYTE_RANGE | 4.0 and 5.0 | |
| REQ_LOGOFF_ANDX | 4.0 and 5.0 | |
| REQ_MOVE | 4.0 and 5.0 | |
| REQ_NEGOTIATE | 4.0 and 5.0 | |
| REQ_NTRENAME | 4.0 and 5.0 | |
| REQ_NT_CANCEL | 4.0 and 5.0 | |
| REQ_NT_CREATE_ANDX | 4.0 and 5.0 | |
| REQ_NT_EXTENDED_SESSION_SETUP_ANDX | 5.0 | |
| REQ_NT_READ_ANDX | 4.0 and 5.0 | |
| REQ_NT_READ_RAW | 4.0 and 5.0 | |
| REQ_NT_SESSION_SETUP_ANDX | 4.0 and 5.0 | |
| REQ_NT_TRANSACTION | 4.0 and 5.0 | |
| REQ_NT_TRANSACTION_SECONDARY | 4.0 and 5.0 | |
| REQ_NT_WRITE_ANDX | 4.0 and 5.0 | |
| REQ_NT_WRITE_RAW | 4.0 and 5.0 | |
| REQ_OPEN | 4.0 and 5.0 | |
| REQ_OPEN_ANDX | 4.0 and 5.0 | |
| REQ_OPEN_PRINT_FILE | 4.0 and 5.0 | |
| REQ_PROCESS_EXIT | 4.0 and 5.0 | |
| REQ_QUERY_INFORMATION | 4.0 and 5.0 | |
| REQ_QUERY_INFORMATION2 | 4.0 and 5.0 | |
| REQ_QUERY_INFORMATION_DISK | 4.0 and 5.0 | |
| REQ_QUERY_INFORMATION_SRV | 4.0 and 5.0 | |
| REQ_READ | 4.0 and 5.0 | |
| REQ_READ_ANDX | 4.0 and 5.0 | |
| REQ_READ_BULK | 4.0 | |
| REQ_READ_MPX | 4.0 and 5.0 | |
| REQ_READ_RAW | 4.0 and 5.0 | |
| REQ_RENAME | 4.0 and 5.0 | |
| REQ_SEARCH | 4.0 and 5.0 | |
| REQ_SEEK | 4.0 and 5.0 | |
| REQ_SEND_BROADCAST_MESSAGE | 4.0 and 5.0 | |
| REQ_SEND_END_MB_MESSAGE | 4.0 and 5.0 | |
| REQ_SEND_MESSAGE | 4.0 and 5.0 | |
| REQ_SEND_START_MB_MESSAGE | 4.0 and 5.0 | |
| REQ_SEND_TEXT_MB_MESSAGE | 4.0 and 5.0 | |
| REQ_SESSION_SETUP_ANDX | 4.0 and 5.0 | |
| REQ_SET_INFORMATION | 4.0 and 5.0 | |
| REQ_SET_INFORMATION2 | 4.0 and 5.0 | |
| REQ_TRANSACTION | 4.0 and 5.0 | |
| REQ_TRANSACTION_SECONDARY | 4.0 and 5.0 | |
| REQ_TREE_CONNECT | 4.0 and 5.0 | |
| REQ_TREE_CONNECT_ANDX | 4.0 and 5.0 | |
| REQ_TREE_DISCONNECT | 4.0 and 5.0 | |
| REQ_UNLOCK_BYTE_RANGE | 4.0 and 5.0 | |
| REQ_WRITE | 4.0 and 5.0 | |
| REQ_WRITE_ANDX | 4.0 and 5.0 | |
| REQ_WRITE_AND_CLOSE | 4.0 and 5.0 | |
| REQ_WRITE_AND_CLOSE_LONG | 4.0 and 5.0 | |
| REQ_WRITE_BULK | 4.0 | |
| REQ_WRITE_BULK_DATA | 4.0 | |
| REQ_WRITE_MPX | 4.0 and 5.0 | |
| REQ_WRITE_MPX_SECONDARY | 4.0 and 5.0 | |
| REQ_WRITE_PRINT_FILE | 4.0 and 5.0 | |
| REQ_WRITE_RAW | 4.0 and 5.0 | |
| RESOURCE_HASH_ENTRY | 4.0 and 5.0 | |
| RESOURCE_PERFORMANCE_DATA | 4.0 and 5.0 | |
| RESP_103_WRITE_RAW | 4.0 and 5.0 | |
| RESP_21_TREE_CONNECT_ANDX | 4.0 and 5.0 | |
| RESP_CANCEL_FORWARD | 4.0 and 5.0 | |
| RESP_CHECK_DIRECTORY | 4.0 and 5.0 | |
| RESP_CLOSE | 4.0 and 5.0 | |
| RESP_CLOSE_AND_TREE_DISC | 4.0 and 5.0 | |
| RESP_CLOSE_PRINT_FILE | 4.0 and 5.0 | |
| RESP_COPY | 4.0 and 5.0 | |
| RESP_CREATE | 4.0 and 5.0 | |
| RESP_CREATE_DIRECTORY | 4.0 and 5.0 | |
| RESP_CREATE_TEMPORARY | 4.0 and 5.0 | |
| RESP_DELETE | 4.0 and 5.0 | |
| RESP_DELETE_DIRECTORY | 4.0 and 5.0 | |
| RESP_ECHO | 4.0 and 5.0 | |
| RESP_EXTENDED_NT_CREATE_ANDX | 5.0 | |
| RESP_EXTENDED_OPEN_ANDX | 5.0 | |
| RESP_EXTENDED_TREE_CONNECT_ANDX | 5.0 | |
| RESP_FIND_CLOSE2 | 4.0 and 5.0 | |
| RESP_FIND_NOTIFY_CLOSE | 4.0 and 5.0 | |
| RESP_FLUSH | 4.0 and 5.0 | |
| RESP_FORWARD_USER_NAME | 4.0 and 5.0 | |
| RESP_GET_MACHINE_NAME | 4.0 and 5.0 | |
| RESP_GET_PRINT_QUEUE | 4.0 and 5.0 | |
| RESP_IOCTL | 4.0 and 5.0 | |
| RESP_IOCTL_INTERIM | 4.0 and 5.0 | |
| RESP_LOCKING_ANDX | 4.0 and 5.0 | |
| RESP_LOCK_BYTE_RANGE | 4.0 and 5.0 | |
| RESP_LOGOFF_ANDX | 4.0 and 5.0 | |
| RESP_MOVE | 4.0 and 5.0 | |
| RESP_NEGOTIATE | 4.0 and 5.0 | |
| RESP_NT_CANCEL | 4.0 and 5.0 | |
| RESP_NT_CREATE_ANDX | 4.0 and 5.0 | |
| RESP_NT_EXTENDED_SESSION_SETUP_ANDX | 5.0 | |
| RESP_NT_NEGOTIATE | 4.0 and 5.0 | |
| RESP_NT_TRANSACTION | 4.0 and 5.0 | |
| RESP_NT_TRANSACTION_INTERIM | 4.0 and 5.0 | |
| RESP_OLD_NEGOTIATE | 4.0 and 5.0 | |
| RESP_OPEN | 4.0 and 5.0 | |
| RESP_OPEN_ANDX | 4.0 and 5.0 | |
| RESP_OPEN_PRINT_FILE | 4.0 and 5.0 | |
| RESP_PROCESS_EXIT | 4.0 and 5.0 | |
| RESP_QUERY_INFORMATION | 4.0 and 5.0 | |
| RESP_QUERY_INFORMATION2 | 4.0 and 5.0 | |
| RESP_QUERY_INFORMATION_DISK | 4.0 and 5.0 | |
| RESP_QUERY_INFORMATION_SRV | 4.0 and 5.0 | |
| RESP_READ | 4.0 and 5.0 | |
| RESP_READ_ANDX | 4.0 and 5.0 | |
| RESP_READ_BULK | 4.0 | |
| RESP_READ_MPX | 4.0 and 5.0 | |
| RESP_RENAME | 4.0 and 5.0 | |
| RESP_SEARCH | 4.0 and 5.0 | |
| RESP_SEEK | 4.0 and 5.0 | |
| RESP_SEND_END_MB_MESSAGE | 4.0 and 5.0 | |
| RESP_SEND_MESSAGE | 4.0 and 5.0 | |
| RESP_SEND_START_MB_MESSAGE | 4.0 and 5.0 | |
| RESP_SEND_TEXT_MB_MESSAGE | 4.0 and 5.0 | |
| RESP_SESSION_SETUP_ANDX | 4.0 and 5.0 | |
| RESP_SET_INFORMATION | 4.0 and 5.0 | |
| RESP_SET_INFORMATION2 | 4.0 and 5.0 | |
| RESP_TRANSACTION | 4.0 and 5.0 | |
| RESP_TRANSACTION_INTERIM | 4.0 and 5.0 | |
| RESP_TREE_CONNECT | 4.0 and 5.0 | |
| RESP_TREE_CONNECT_ANDX | 4.0 and 5.0 | |
| RESP_TREE_DISCONNECT | 4.0 and 5.0 | |
| RESP_UNLOCK_BYTE_RANGE | 4.0 and 5.0 | |
| RESP_WRITE | 4.0 and 5.0 | |
| RESP_WRITE_ANDX | 4.0 and 5.0 | |
| RESP_WRITE_AND_CLOSE | 4.0 and 5.0 | |
| RESP_WRITE_BULK | 4.0 | |
| RESP_WRITE_COMPLETE | 4.0 and 5.0 | |
| RESP_WRITE_MPX_DATAGRAM | 4.0 and 5.0 | |
| RESP_WRITE_MPX_INTERIM | 4.0 and 5.0 | |
| RESP_WRITE_PRINT_FILE | 4.0 and 5.0 | |
| RESP_WRITE_RAW_INTERIM | 4.0 and 5.0 | |
| RESP_WRITE_RAW_SECONDARY | 4.0 and 5.0 | |
| RTL_BITMAP | 5.0 | |
| RTL_DRIVE_LETTER_CURDIR | 4.0 and 5.0 | |
| RTL_QUERY_REGISTRY_TABLE | 4.0 and 5.0 | |
| RTL_USER_PROCESS_PARAMETERS | 5.0 | |
| SECTION_OBJECT_POINTERS | 4.0 and 5.0 | |
| SECURITY_DESCRIPTOR | 4.0 and 5.0 | |
| SECURITY_QUALITY_OF_SERVICE | 4.0 and 5.0 | |
| SECURITY_SUBJECT_CONTEXT | 4.0 and 5.0 | |
| SECURITY_TOKEN_AUDIT_DATA | 4.0 and 5.0 | |
| SECURITY_TOKEN_PROXY_DATA | 4.0 and 5.0 | |
| SE_IMPERSONATION_STATE | 4.0 and 5.0 | |
| SHARE_ACCESS | 4.0 and 5.0 | |
| SID | 5.0 | |
| SID_AND_ATTRIBUTES | 5.0 | |
| SID_IDENTIFIER_AUTHORITY | 5.0 | |
| SINGLE_LIST_ENTRY | 4.0 and 5.0 | |
| SLIST_HEADER | 5.0 | |
| SMB_DATE | 5.0 | |
| SMB_HEADER | 4.0 and 5.0 | |
| SMB_TIME | 5.0 | |
| STRING | 4.0 and 5.0 | |
| SUPPORTED_RANGE | 5.0 | |
| SUPPORTED_RANGES | 5.0 | |
| TIME_FIELDS | 4.0 and 5.0 | |
| ULARGE_INTEGER | 5.0 | |
| UNICODE_STRING | 4.0 and 5.0 | |
| VM_COUNTERS | 4.0 and 5.0 | |
| VPB | 4.0 and 5.0 | |
| WAIT_CONTEXT_BLOCK | 4.0 and 5.0 | |
| WORK_QUEUE_ITEM | 4.0 and 5.0 | |
| WOW64_PROCESS | 5.0 | |
| ZONE_HEADER | 4.0 and 5.0 | |
| ZONE_SEGMENT_HEADER | 4.0 and 5.0 |
Though the !strct command is primitive relative to the later dt command, it was in some ways more practical. Because the dt command dumps types as known exactly from the symbol files for binaries in the debugging target, the experience for most programmers is that structures used by the Windows kernel must always be given by their formal names, not the typedef names that Microsoft has always encouraged programmers to use instead. Mostly, the difference is just that the formal name has a leading underscore. Programmers soon enough adjust to the habit of inserting the underscore when using the dt command, but it’s perhaps no small thing that !strct was designed from the start to spare them the trouble.
In the KDEX2X86 for Windows NT 4.0, the tables of structures that can be dumped by the !strct command have only the typedef names. This is what’s reproduced above. The command does not recognise the formal names, only the familiar typedef names—well, familiar for those structures that are at least declared in NTDDK.H, if not documented.
The KDEX2X86 for Windows 2000 clearly shifts to the formal names. Its tables, which have a different format, have only the formal names. Each begins with an underscore, which this page’s table leaves as understood. The command recognises all of them both with and without the leading underscore and makes special cases of three for which the difference between names is more substantial.
Of the special cases, the _HAL_PROCESSOR_SPEED_INFO structure and its longer typedef name HAL_PROCESSOR_SPEED_INFORMATION are defined in NTDDK.H from as long ago as the Device Driver Kit (DDK) for Windows NT 3.51. It is a little noteworthy since the definition changes. In the lifetime of the !strct command, the structure was reduced to just one member, which was anyway named just TBD. The other two special cases did not have definitions in NTDDK.H at the time or indeed in any header from a DDK or Windows Driver Kit (WDK) until the NTOSP.H from some editions of the WDK for Windows 10. This disclosed both the formal names _DESCRIPTOR and _KiIoAccessMap and the typedef names KDESCRIPTOR and KIIO_ACCESS_MAP. Both structures were known from public symbol files, starting with Windows 2000 SP3, but only under their formal names. The friendly names, though, were very nearly a new disclosure, having been knowable in the preceding 20 years only from the KDEX2X86 debugger extension’s implementation of its !strct command for two early Windows versions.
Presumably as some additional convenience for programmers, the !strct command in both versions treats structures’ names as case-insensitive.