Geoff Chappell - Software Analyst
The USERKDX debugger extension as supplied with the Platform SDK in the January 1997 edition (if not others) and later with the Device Driver Kit (DDK) for Windows 2000 exports a dso function and thus supports a !dso command.
The !dso command is in some sense an early form of what Microsoft’s debuggers would soon offer as the built-in dt command. A key difference is that the dt command dumps from type information in whatever symbol files the debugger has handy (or can download) but the !dso command dumps only the debugger extension’s built-in knowledge.
The extension’s own description of the !dso command is variously:
dso <Struct> [Field] [Address]- Dumps Struct field(s)'s offset(s) and value(s).
or
dso <Struct> [Field] [addr [*n]]-Dumps Struct field(s)'s offsets(s) & value(s).
It is not this note’s purpose, however, to pick over the syntax of an old command. The point is instead to note that in the years before Microsoft built type information into public symbol files, the !dso command was often the most detailed public record (by far) that Microsoft left of undocumented Windows structures. Not all the structures that are known to the !dso command are undocumented, but many are, including some for which type information has hardly ever (and in some few cases never) turned up in public symbol files even through to Windows 10.
Please be aware that a different !dso command is implemented in another debugger extension, named USEREXTS, which Microsoft is thought to have distributed only with the DDKs. Inevitably, the same command in the other extension supports a different set of structures.
The large table that follows lists the structures whose offsets can be dumped by the !userkdx.dso command. The USERKDX from the Platform SDK in 1997 has structures for Windows NT 4.0. The USERKDX from the DDK for Windows 2000 of course shows structures as they were for Windows version 5.0. No USERKDX is known for version 5.1 or higher.
| Structure | Versions |
|---|---|
| AAS | 4.0 and 5.0 |
| ACCEL | 4.0 and 5.0 |
| ACCELTABLE | 4.0 and 5.0 |
| ACCESS_STATE | 5.0 only |
| ACL | 5.0 only |
| ACON | 5.0 only |
| ACON_COMMON | 5.0 only |
| ANIHEADER | 4.0 and 5.0 |
| ANIMATIONINFO | 4.0 and 5.0 |
| ATOM_BASIC_INFORMATION | 4.0 and 5.0 |
| ATOM_TABLE_INFORMATION | 4.0 and 5.0 |
| ATTACHINFO | 4.0 and 5.0 |
| ATTRIBUTE_DEFINITION_COLUMNS | 5.0 only |
| ATTRIBUTE_ENUMERATION_CONTEXT | 5.0 only |
| ATTRIBUTE_LIST_CONTEXT | 5.0 only |
| ATTRIBUTE_LIST_ENTRY | 5.0 only |
| ATTRIBUTE_NAME_ENTRY | 5.0 only |
| ATTRIBUTE_RECORD_HEADER | 5.0 only |
| BCB | 5.0 only |
| BITMAP | 4.0 and 5.0 |
| BITMAPCOREHEADER | 4.0 and 5.0 |
| BITMAPCOREINFO | 4.0 and 5.0 |
| BITMAPFILEHEADER | 4.0 and 5.0 |
| BITMAPINFO | 4.0 and 5.0 |
| BITMAPINFOHEADER | 4.0 and 5.0 |
| BITMAPV4HEADER | 4.0 and 5.0 |
| BITMAP_RANGE | 5.0 only |
| BROADCASTSYSMSG | 4.0 only |
| BROADCASTSYSTEMMSGPARAMS | 4.0 and 5.0 |
| BWL | 4.0 and 5.0 |
| CALLPROCDATA | 4.0 and 5.0 |
| CANDIDATEFORM | 4.0 and 5.0 |
| CANDIDATEINFO | 5.0 only |
| CANDIDATELIST | 4.0 and 5.0 |
| CAPTIONCACHE | 4.0 and 5.0 |
| CAPTUREBUF | 4.0 and 5.0 |
| CARET | 4.0 and 5.0 |
| CBOX | 5.0 only |
| CBTACTIVATESTRUCT | 4.0 and 5.0 |
| CBT_CREATEWNDA | 4.0 and 5.0 |
| CBT_CREATEWNDW | 4.0 and 5.0 |
| CCB | 5.0 only |
| CCB_DATA | 5.0 only |
| CHAR2 | 5.0 only |
| CHAR_IMAGE_INFO | 5.0 only |
| CHECKPOINT | 5.0 only |
| CLIENTCREATESTRUCT | 4.0 and 5.0 |
| CLIENTIMC | 5.0 only |
| CLIENTINFO | 4.0 and 5.0 |
| CLIENTTHREADINFO | 4.0 and 5.0 |
| CLS | 4.0 and 5.0 |
| CLSMENUNAME | 4.0 and 5.0 |
| CNSSDATA | 5.0 only |
| CNSSCACHE | 5.0 only |
| CNSSCONVMAP | 5.0 only |
| CNSSIOBUFFER | 5.0 only |
| CNSSTRUNCDESCR | 5.0 only |
| CNSS_DEVICE_EXT | 5.0 only |
| CNSS_FILE_DESCR | 5.0 only |
| CNSS_MDL_CHAINS | 5.0 only |
| CNSS_MDL_RECORD | 5.0 only |
| CNSS_OPENLOCK | 5.0 only |
| CNSS_OPEN_PACKET | 5.0 only |
| CNSS_SHARE_DESCR | 5.0 only |
| CNSS_SHARE_NPAGED | 5.0 only |
| CNSS_STATISTICS | 5.0 only |
| CNSS_STK_IODESCR | 5.0 only |
| COMBOBOXINFO | 5.0 only |
| COMMON_WNDCLASS | 4.0 and 5.0 |
| COMMPROP | 4.0 and 5.0 |
| COMMTIMEOUTS | 4.0 and 5.0 |
| COMPAREITEMSTRUCT | 4.0 and 5.0 |
| COMPOSITIONSTRING | 5.0 only |
| COMPRESSED_DATA_INFO | 5.0 only |
| CONSOLE_CURSOR_INFO | 4.0 and 5.0 |
| CONSOLE_FONT_INFO | 4.0 and 5.0 |
| CONSOLE_GRAPHICS_BUFFER_INFO | 4.0 and 5.0 |
| CONSOLE_INFORMATION | 5.0 only |
| CONSOLE_PER_PROCESS_DATA | 5.0 only |
| CONSOLE_READCONSOLE_CONTROL | 4.0 and 5.0 |
| CONSOLE_SCREEN_BUFFER_INFO | 4.0 and 5.0 |
| CONTEXT | 5.0 only |
| COORD | 5.0 only |
| COPYDATASTRUCT | 4.0 and 5.0 |
| CPINFO | 4.0 and 5.0 |
| CPTABLEINFO | 4.0 and 5.0 |
| CREATESTRUCTA | 4.0 and 5.0 |
| CREATESTRUCTEX | 4.0 and 5.0 |
| CREATESTRUCTW | 4.0 and 5.0 |
| CSR_PROCESS | 5.0 only |
| CSR_THREAD | 5.0 only |
| CTLCOLOR | 4.0 and 5.0 |
| CURDIR | 5.0 only |
| CURSINFO | 4.0 and 5.0 |
| CURSOR | 4.0 and 5.0 |
| CURSORDATA | 4.0 and 5.0 |
| CURSORFIND | 4.0 and 5.0 |
| CURSORSHAPE | 4.0 and 5.0 |
| CURSOR_ACON | 5.0 only |
| CURSOR_COMMON | 5.0 only |
| CVR | 4.0 and 5.0 |
| CWPRETSTRUCT | 4.0 and 5.0 |
| CWPRETSTRUCTEX | 4.0 and 5.0 |
| CWPSTRUCT | 4.0 and 5.0 |
| CWPSTRUCTEX | 4.0 and 5.0 |
| DCE | 5.0 only |
| DDECONV | 4.0 and 5.0 |
| DDEIMP | 4.0 and 5.0 |
| DDEML_MSG_HOOK_DATA | 4.0 and 5.0 |
| DDEPACK | 4.0 and 5.0 |
| DDE_DATA | 4.0 and 5.0 |
| DEALLOCATED_CLUSTERS | 5.0 only |
| DEALLOCATED_RECORDS | 5.0 only |
| DEBUGHOOKINFO | 4.0 and 5.0 |
| DEFERRED_WRITE | 5.0 only |
| DEFRAG_MFT | 5.0 only |
| DELETEITEMSTRUCT | 4.0 and 5.0 |
| DESKTOP | 4.0 and 5.0 |
| DESKTOPINFO | 4.0 and 5.0 |
| DESKTOPTHREADINIT | 4.0 only |
| DESKTOPVIEW | 4.0 and 5.0 |
| DEVCAPS | 4.0 and 5.0 |
| DEVICEINFO | 5.0 only |
| DEVICE_FLAGS | 5.0 only |
| DEVICE_OBJECT | 5.0 only |
| DEVICE_TEMPLATE | 5.0 only |
| DIALOG | 4.0 and 5.0 |
| DIRENTRY | 5.0 only |
| DIRTY_PAGE_ENTRY | 5.0 only |
| DISCDLGSTRUCTA | 4.0 and 5.0 |
| DISCDLGSTRUCTW | 4.0 and 5.0 |
| DISPATCHER_HEADER | 5.0 only |
| DISPLAYINFO | 4.0 and 5.0 |
| DISPLAYRESOURCE | 4.0 and 5.0 |
| DLG | 4.0 and 5.0 |
| DLGENUMDATA | 4.0 and 5.0 |
| DLGITEMTEMPLATE | 4.0 and 5.0 |
| DLGITEMTEMPLATE2 | 4.0 and 5.0 |
| DLGTEMPLATE | 4.0 and 5.0 |
| DLGTEMPLATE2 | 4.0 and 5.0 |
| DOCHDR | 5.0 only |
| DOCONNECTDATA | 5.0 only |
| DORECONNECTDATA | 5.0 only |
| DRAWICONEXDATA | 4.0 and 5.0 |
| DRAWITEMSTRUCT | 4.0 and 5.0 |
| DRAWTEXTPARMS | 4.0 and 5.0 |
| DRIVER_OBJECT | 5.0 only |
| DUPLICATED_INFORMATION | 5.0 only |
| DbgHeapHead | 5.0 only |
| EA_INFORMATION | 5.0 only |
| EA_LIST_HEADER | 5.0 only |
| EJOB | 5.0 only |
| ENCRYPTED_DATA_INFO | 5.0 only |
| ENCRYPTION_BUFFER | 5.0 only |
| ENCRYPTION_CALL_BACK | 5.0 only |
| EOF_WAIT_BLOCK | 5.0 only |
| EPROCESS | 4.0 and 5.0 |
| ERESOURCE | 4.0 and 5.0 |
| ETHREAD | 4.0 and 5.0 |
| EVENTHOOK | 4.0 and 5.0 |
| EVENTMSG | 5.0 only |
| EXCEPTION_DEBUG_INFO | 4.0 and 5.0 |
| EXCEPTION_POINTERS | 4.0 and 5.0 |
| EXCEPTION_RECORD | 4.0 and 5.0 |
| EXCEPTION_REGISTRATION_RECORD | 4.0 and 5.0 |
| EXIT_PROCESS_DEBUG_INFO | 4.0 and 5.0 |
| EXIT_THREAD_DEBUG_INFO | 4.0 and 5.0 |
| EXT_API_VERSION | 4.0 and 5.0 |
| EX_DEBUG_LOG | 4.0 and 5.0 |
| EX_DEBUG_LOG_EVENT | 4.0 and 5.0 |
| EX_DEBUG_LOG_TAG | 4.0 and 5.0 |
| EX_LOCK | 5.0 only |
| FAST_IO_DISPATCH | 5.0 only |
| FAST_MUTEX | 5.0 only |
| FAT_STATISTICS | 5.0 only |
| FCB | 5.0 only |
| FCB_DATA | 5.0 only |
| FCB_INDEX | 5.0 only |
| FCB_TABLE_ELEMENT | 5.0 only |
| FCB_USN_RECORD | 5.0 only |
| FILESYSTEM_STATISTICS | 5.0 only |
| FILE_ACCESS_INFORMATION | 5.0 only |
| FILE_ALIGNMENT_INFORMATION | 5.0 only |
| FILE_ALLOCATED_RANGE_BUFFER | 5.0 only |
| FILE_ALLOCATION_INFORMATION | 5.0 only |
| FILE_ALL_INFORMATION | 5.0 only |
| FILE_ATTRIBUTE_TAG_INFORMATION | 5.0 only |
| FILE_BASIC_INFORMATION | 5.0 only |
| FILE_BOTH_DIR_INFORMATION | 5.0 only |
| FILE_COMPLETION_INFORMATION | 5.0 only |
| FILE_COMPRESSION_INFORMATION | 5.0 only |
| FILE_DIRECTORY_INFORMATION | 5.0 only |
| FILE_EA_INFORMATION | 5.0 only |
| FILE_END_OF_FILE_INFORMATION | 5.0 only |
| FILE_FS_ATTRIBUTE_INFORMATION | 5.0 only |
| FILE_FS_CONTROL_INFORMATION | 5.0 only |
| FILE_FS_DEVICE_INFORMATION | 5.0 only |
| FILE_FS_FULL_SIZE_INFORMATION | 5.0 only |
| FILE_FS_LABEL_INFORMATION | 5.0 only |
| FILE_FS_OBJECTID_INFORMATION | 5.0 only |
| FILE_FS_SIZE_INFORMATION | 5.0 only |
| FILE_FS_VOLUME_INFORMATION | 5.0 only |
| FILE_FULL_DIR_INFORMATION | 5.0 only |
| FILE_FULL_EA_INFORMATION | 5.0 only |
| FILE_GET_EA_INFORMATION | 5.0 only |
| FILE_GET_QUOTA_INFORMATION | 5.0 only |
| FILE_INTERNAL_INFORMATION | 5.0 only |
| FILE_LINK_INFORMATION | 5.0 only |
| FILE_LOCK | 5.0 only |
| FILE_LOCK_INFO | 5.0 only |
| FILE_MAILSLOT_PEEK_BUFFER | 5.0 only |
| FILE_MAILSLOT_QUERY_INFORMATION | 5.0 only |
| FILE_MAILSLOT_SET_INFORMATION | 5.0 only |
| FILE_MODE_INFORMATION | 5.0 only |
| FILE_MOVE_CLUSTER_INFORMATION | 5.0 only |
| FILE_NAME | 5.0 only |
| FILE_NAMES_INFORMATION | 5.0 only |
| FILE_NAME_INFORMATION | 5.0 only |
| FILE_NETWORK_OPEN_INFORMATION | 5.0 only |
| FILE_NOTIFY_INFORMATION | 5.0 only |
| FILE_OBJECT | 5.0 only |
| FILE_OBJECTID_BUFFER | 5.0 only |
| FILE_OBJECTID_INFORMATION | 5.0 only |
| FILE_PIPE_ASSIGN_EVENT_BUFFER | 5.0 only |
| FILE_PIPE_CLIENT_PROCESS_BUFFER | 5.0 only |
| FILE_PIPE_EVENT_BUFFER | 5.0 only |
| FILE_PIPE_INFORMATION | 5.0 only |
| FILE_PIPE_LOCAL_INFORMATION | 5.0 only |
| FILE_PIPE_PEEK_BUFFER | 5.0 only |
| FILE_PIPE_REMOTE_INFORMATION | 5.0 only |
| FILE_PIPE_WAIT_FOR_BUFFER | 5.0 only |
| FILE_POSITION_INFORMATION | 5.0 only |
| FILE_QUOTA_INFORMATION | 5.0 only |
| FILE_RECORD_SEGMENT_HEADER | 5.0 only |
| FILE_RENAME_INFORMATION | 5.0 only |
| FILE_REPARSE_POINT_INFORMATION | 5.0 only |
| FILE_STANDARD_INFORMATION | 5.0 only |
| FILE_STREAM_INFORMATION | 5.0 only |
| FILE_SYSTEM_STATISTICS | 5.0 only |
| FILE_TRACKING_INFORMATION | 5.0 only |
| FILE_ZERO_DATA_INFORMATION | 5.0 only |
| FLOATING_SAVE_AREA | 5.0 only |
| FOUND_ATTRIBUTE | 5.0 only |
| FREELIST | 5.0 only |
| FSCNTL_SCREEN_INFO | 5.0 only |
| FSCTL_QUERY_FAT_BPB_BUFFER | 5.0 only |
| FSRTL_ADVANCED_FCB_HEADER | 5.0 only |
| FSRTL_AUXILIARY_BUFFER | 5.0 only |
| FSRTL_COMMON_FCB_HEADER | 5.0 only |
| FSRTL_FILTER_CONTEXT | 5.0 only |
| GENERAL_LOOKASIDE | 5.0 only |
| GENERATE_NAME_CONTEXT | 5.0 only |
| GENERIC_DEVICE_INFO | 5.0 only |
| GUID | 5.0 only |
| GUIDELINE | 5.0 only |
| HANDLEENTRY | 4.0 and 5.0 |
| HARDERRORHANDLER | 4.0 and 5.0 |
| HARDERROR_MSG | 5.0 only |
| HARDWAREHOOKSTRUCT | 4.0 and 5.0 |
| HEAD | 4.0 and 5.0 |
| HEAP | 5.0 only |
| HEAP_BASE | 4.0 only |
| HEAP_ENTRY | 4.0 and 5.0 |
| HEAP_FREE_ENTRY | 4.0 and 5.0 |
| HEAP_SEGMENT | 5.0 only |
| HELPINFO | 4.0 and 5.0 |
| HELPWININFOA | 4.0 and 5.0 |
| HELPWININFOW | 4.0 and 5.0 |
| HLP | 4.0 and 5.0 |
| HOOK | 4.0 and 5.0 |
| HOOKMSGSTRUCT | 4.0 and 5.0 |
| HOTKEY | 4.0 and 5.0 |
| ICONINFO | 4.0 and 5.0 |
| ICONMETRICSA | 4.0 and 5.0 |
| ICONMETRICSW | 4.0 and 5.0 |
| IMAGEHLP_DEFERRED_SYMBOL_LOAD | 4.0 and 5.0 |
| IMAGEHLP_DUPLICATE_SYMBOL | 4.0 and 5.0 |
| IMAGEHLP_MODULE | 4.0 and 5.0 |
| IMAGEHLP_SYMBOL | 4.0 and 5.0 |
| IMAGE_ARCHIVE_MEMBER_HEADER | 4.0 and 5.0 |
| IMAGE_BASE_RELOCATION | 4.0 and 5.0 |
| IMAGE_BOUND_FORWARDER_REF | 4.0 and 5.0 |
| IMAGE_BOUND_IMPORT_DESCRIPTOR | 4.0 and 5.0 |
| IMAGE_COFF_SYMBOLS_HEADER | 4.0 and 5.0 |
| IMAGE_DATA_DIRECTORY | 4.0 and 5.0 |
| IMAGE_DEBUG_DIRECTORY | 4.0 and 5.0 |
| IMAGE_DEBUG_INFORMATION | 4.0 and 5.0 |
| IMAGE_DEBUG_MISC | 4.0 and 5.0 |
| IMAGE_DOS_HEADER | 4.0 and 5.0 |
| IMAGE_EXPORT_DIRECTORY | 4.0 and 5.0 |
| IMAGE_FILE_HEADER | 4.0 and 5.0 |
| IMAGE_FUNCTION_ENTRY | 4.0 and 5.0 |
| IMAGE_IMPORT_BY_NAME | 4.0 and 5.0 |
| IMAGE_IMPORT_DESCRIPTOR | 4.0 and 5.0 |
| IMAGE_LINENUMBER | 4.0 and 5.0 |
| IMAGE_LOAD_CONFIG_DIRECTORY | 4.0 only |
| IMAGE_NT_HEADERS | 4.0 only |
| IMAGE_OPTIONAL_HEADER | 4.0 only |
| IMAGE_OS2_HEADER | 4.0 and 5.0 |
| IMAGE_RELOCATION | 4.0 and 5.0 |
| IMAGE_RESOURCE_DATA_ENTRY | 4.0 and 5.0 |
| IMAGE_RESOURCE_DIRECTORY | 4.0 and 5.0 |
| IMAGE_RESOURCE_DIRECTORY_ENTRY | 4.0 and 5.0 |
| IMAGE_RESOURCE_DIRECTORY_STRING | 4.0 and 5.0 |
| IMAGE_RESOURCE_DIR_STRING_U | 4.0 and 5.0 |
| IMAGE_ROM_HEADERS | 4.0 and 5.0 |
| IMAGE_ROM_OPTIONAL_HEADER | 4.0 and 5.0 |
| IMAGE_RUNTIME_FUNCTION_ENTRY | 4.0 only |
| IMAGE_SECTION_HEADER | 4.0 and 5.0 |
| IMAGE_SEPARATE_DEBUG_HEADER | 4.0 and 5.0 |
| IMAGE_SYMBOL | 4.0 and 5.0 |
| IMAGE_THUNK_DATA | 4.0 only |
| IMAGE_TLS_DIRECTORY | 4.0 only |
| IMAGE_VXD_HEADER | 4.0 and 5.0 |
| IMC | 5.0 only |
| IMECHARPOSITION | 5.0 only |
| IMEHOTKEY | 5.0 only |
| IMEHOTKEYOBJ | 5.0 only |
| IMEINFO | 5.0 only |
| IMEINFOEX | 5.0 only |
| IMEUI | 5.0 only |
| IMEWND | 5.0 only |
| INDEX_ALLOCATION_BUFFER | 5.0 only |
| INDEX_CONTEXT | 5.0 only |
| INDEX_DATA | 5.0 only |
| INDEX_ENTRY | 5.0 only |
| INDEX_HEADER | 5.0 only |
| INDEX_KEY | 5.0 only |
| INDEX_LOOKUP_STACK | 5.0 only |
| INDEX_ROOT | 5.0 only |
| INDEX_ROW | 5.0 only |
| INDICATOR_LIST | 4.0 and 5.0 |
| INITIALIZATION_CONTEXT | 4.0 and 5.0 |
| INITIAL_PEB | 4.0 and 5.0 |
| INITIAL_PRIVILEGE_SET | 4.0 and 5.0 |
| INITIAL_TEB | 4.0 and 5.0 |
| INPUTCONTEXT | 5.0 only |
| INPUT_RECORD | 4.0 and 5.0 |
| INTDDEINFO | 4.0 and 5.0 |
| INTRSENDMSGEX | 4.0 and 5.0 |
| IOSPACE | 4.0 and 5.0 |
| IOSPACE_EX | 4.0 and 5.0 |
| IO_COMPLETION_BASIC_INFORMATION | 4.0 and 5.0 |
| IO_COMPLETION_CONTEXT | 4.0 and 5.0 |
| IO_COUNTERS | 4.0 and 5.0 |
| IO_ERROR_LOG_MESSAGE | 4.0 and 5.0 |
| IO_ERROR_LOG_PACKET | 4.0 and 5.0 |
| IO_INTERRUPT_STRUCTURE | 4.0 and 5.0 |
| IO_SECURITY_CONTEXT | 4.0 and 5.0 |
| IO_STATUS_BLOCK | 4.0 and 5.0 |
| IO_RESOURCE_DESCRIPTOR | 4.0 and 5.0 |
| IO_RESOURCE_LIST | 4.0 and 5.0 |
| IO_RESOURCE_REQUIREMENTS_LIST | 4.0 and 5.0 |
| IO_RUN | 5.0 only |
| IO_STACK_LOCATION | 4.0 and 5.0 |
| IO_TIMER | 4.0 and 5.0 |
| IRP | 4.0 and 5.0 |
| IRP_CONTEXT | 5.0 only |
| IRP_FILE_RECORD_CACHE_ENTRY | 5.0 only |
| ITEM | 4.0 and 5.0 |
| KAPC | 5.0 only |
| KBDFILE | 4.0 and 5.0 |
| KBDLANGTOGGLE | 4.0 and 5.0 |
| KBDNLSTABLES | 5.0 only |
| KBDTABLES | 4.0 and 5.0 |
| KDEVICE_QUEUE | 5.0 only |
| KDEVICE_QUEUE_ENTRY | 5.0 only |
| KDPC | 5.0 only |
| KE | 4.0 and 5.0 |
| KERNEL_USER_TIMES | 5.0 only |
| KEVENT | 5.0 only |
| KEYBOARD_ATTRIBUTES | 5.0 only |
| KEYBOARD_DEVICE_INFO | 5.0 only |
| KEYBOARD_INPUT_DATA | 5.0 only |
| KFLOATING_SAVE | 5.0 only |
| KINTERRUPT | 5.0 only |
| KL | 5.0 only |
| KMUTANT | 5.0 only |
| KPCR | 5.0 only |
| KPROCESS | 5.0 only |
| KQUEUE | 5.0 only |
| KSEMAPHORE | 5.0 only |
| KSYSTEM_TIME | 5.0 only |
| KTHREAD | 4.0 and 5.0 |
| KTIMER | 5.0 only |
| KTRAP_FRAME | 5.0 only |
| KUSER_SHARED_DATA | 5.0 only |
| KWAIT_BLOCK | 5.0 only |
| LARGE_MCB | 5.0 only |
| LARGE_STANDARD_INFORMATION | 5.0 only |
| LARGE_STRING | 5.0 only |
| LARGE_UNICODE_STRING | 5.0 only |
| LAST_EXCEPTION_LOG | 5.0 only |
| LAZY_WRITER | 5.0 only |
| LBIV | 5.0 only |
| LCN_RANGE | 5.0 only |
| LINK_TRACKING_INFORMATION | 5.0 only |
| LOCKTREE_NODE | 5.0 only |
| LOCK_INFO | 5.0 only |
| LOCK_QUEUE | 5.0 only |
| LOGFONTW | 5.0 only |
| LPCP_PORT_OBJECT | 5.0 only |
| MAP_HANDLE | 5.0 only |
| MDICREATESTRUCTA | 4.0 and 5.0 |
| MDICREATESTRUCTEX | 4.0 and 5.0 |
| MDICREATESTRUCTW | 4.0 and 5.0 |
| MDINEXTMENU | 4.0 and 5.0 |
| MDL | 4.0 and 5.0 |
| MDL_WRITE | 5.0 only |
| MEASUREITEMSTRUCT | 4.0 and 5.0 |
| MEASUREITEMSTRUCT_EX | 4.0 and 5.0 |
| MENU | 4.0 and 5.0 |
| MENUINFO | 5.0 only |
| MENUITEMINFOA | 4.0 and 5.0 |
| MENUITEMINFOW | 4.0 and 5.0 |
| MENUITEMTEMPLATE | 4.0 and 5.0 |
| MENUITEMTEMPLATE2 | 4.0 and 5.0 |
| MENUITEMTEMPLATEHEADER | 4.0 and 5.0 |
| MENUSTATE | 4.0 and 5.0 |
| MENUWND | 4.0 and 5.0 |
| MENU_EVENT_RECORD | 4.0 and 5.0 |
| MESSAGE_RESOURCE_BLOCK | 4.0 and 5.0 |
| MESSAGE_RESOURCE_DATA | 4.0 and 5.0 |
| MESSAGE_RESOURCE_ENTRY | 4.0 and 5.0 |
| MFT_SEGMENT_REFERENCE | 5.0 only |
| MLIST | 4.0 and 5.0 |
| MINIMIZEDMETRICS | 4.0 and 5.0 |
| MINMAXINFO | 4.0 and 5.0 |
| MONITOR | 5.0 only |
| MONITORPOS | 5.0 only |
| MONITORRECTS | 5.0 only |
| MOUSEHOOKSTRUCT | 4.0 and 5.0 |
| MOUSEHOOKSTRUCTEX | 5.0 only |
| MOUSEKEYS | 4.0 and 5.0 |
| MOUSE_ATTRIBUTES | 5.0 only |
| MOUSE_DEVICE_INFO | 5.0 only |
| MOUSE_INPUT_DATA | 5.0 only |
| MOVESIZEDATA | 4.0 and 5.0 |
| MSG | 4.0 and 5.0 |
| MSGBOXDATA | 4.0 and 5.0 |
| MSGBOXPARAMSA | 4.0 and 5.0 |
| MSGBOXPARAMSW | 4.0 and 5.0 |
| NAME_LINK | 5.0 only |
| NAME_PAIR | 5.0 only |
| NCCALCSIZE_PARAMS | 4.0 and 5.0 |
| NEW_ATTRIBUTE_SIZES | 5.0 only |
| NONCLIENTMETRICSA | 4.0 and 5.0 |
| NONCLIENTMETRICSW | 4.0 and 5.0 |
| NONOPAQUE_OPLOCK | 5.0 only |
| NOTIFY | 4.0 and 5.0 |
| NPAGED_LOOKASIDE_LIST | 5.0 only |
| NSSHDR | 5.0 only |
| NSSMINIHDR | 5.0 only |
| NTFS_DATA | 5.0 only |
| NTFS_IO_CONTEXT | 5.0 only |
| NTFS_LOG_RECORD_HEADER | 5.0 only |
| NTFS_MCB | 5.0 only |
| NTFS_MCB_ARRAY | 5.0 only |
| NTFS_MCB_ENTRY | 5.0 only |
| NTFS_NAME_DESCRIPTOR | 5.0 only |
| NTFS_OBJECTID_INFORMATION | 5.0 only |
| NTFS_STATISTICS | 5.0 only |
| NTFS_TUNNELED_DATA | 5.0 only |
| NUKEM | 5.0 only |
| OBCB | 5.0 only |
| OBJECT_ATTRIBUTES | 5.0 only |
| OBJECT_TYPE | 5.0 only |
| OEMBITMAPINFO | 5.0 only |
| OLD_FCB_SNAPSHOT | 5.0 only |
| OPEN_ATTRIBUTE_ENTRY | 5.0 only |
| OPFILTER_TIMER | 5.0 only |
| OPLOCK_CLEANUP | 5.0 only |
| PAGED_LOOKASIDE_LIST | 5.0 only |
| PATHNAME_BUFFER | 5.0 only |
| PEB | 5.0 only |
| PERUSERSERVERINFO | 5.0 only |
| POPUPMENU | 4.0 and 5.0 |
| PREFIX_TABLE | 5.0 only |
| PREFIX_TABLE_ENTRY | 5.0 only |
| PRIVATE_CACHE_MAP | 5.0 only |
| PROCESSINFO | 4.0 and 5.0 |
| PROCOBJHEAD | 4.0 and 5.0 |
| PROP | 4.0 and 5.0 |
| PROPSET | 4.0 and 5.0 |
| Q | 4.0 and 5.0 |
| QMSG | 4.0 and 5.0 |
| QUICK_INDEX | 5.0 only |
| QUICK_INDEX_HINT | 5.0 only |
| QUOTA_CONTROL_BLOCK | 5.0 only |
| QUOTA_USER_DATA | 5.0 only |
| READ_AHEAD_THREAD | 5.0 only |
| RECONVERTSTRING | 5.0 only |
| RECORD_ALLOCATION_CONTEXT | 5.0 only |
| REPARSE_INDEX_KEY | 5.0 only |
| REPARSE_POINT_INFORMATION | 5.0 only |
| REQUEST_RAW_ENCRYPTED_DATA | 5.0 only |
| RESERVED_BITMAP_RANGE | 5.0 only |
| RESTART_AREA | 5.0 only |
| RESTART_POINTERS | 5.0 only |
| RESTART_TABLE | 5.0 only |
| RTL_BITMAP | 5.0 only |
| RTL_BITMAP_RUN | 5.0 only |
| RTL_DRIVE_LETTER_CURDIR | 5.0 only |
| RTL_GENERIC_TABLE | 5.0 only |
| RTL_HEAP_PARAMETERS | 5.0 only |
| RTL_PROCESS_BACKTRACES | 5.0 only |
| RTL_PROCESS_BACKTRACE_INFORMATION | 5.0 only |
| RTL_PROCESS_LOCKS | 5.0 only |
| RTL_PROCESS_LOCK_INFORMATION | 5.0 only |
| RTL_QUERY_REGISTRY_TABLE | 5.0 only |
| RTL_RANGE | 5.0 only |
| RTL_RANGE_LIST | 5.0 only |
| RTL_RXACT_LOG | 5.0 only |
| RTL_SPLAY_LINKS | 5.0 only |
| RTL_TIME_ZONE_INFORMATION | 5.0 only |
| RTL_USER_PROCESS_INFORMATION | 5.0 only |
| RTL_USER_PROCESS_PARAMETERS | 5.0 only |
| SBCALC | 4.0 and 5.0 |
| SBDATA | 4.0 and 5.0 |
| SBINFO | 4.0 and 5.0 |
| SBTRACK | 4.0 and 5.0 |
| SBWND | 4.0 and 5.0 |
| SCB | 5.0 only |
| SCB_DATA | 5.0 only |
| SCB_INDEX | 5.0 only |
| SCB_MFT | 5.0 only |
| SCB_NONPAGED | 5.0 only |
| SCB_SNAPSHOT | 5.0 only |
| SCOPE_CONTEXT | 5.0 only |
| SCREEN_INFORMATION | 5.0 only |
| SCROLLINFO | 4.0 and 5.0 |
| SECTION_OBJECT_POINTERS | 5.0 only |
| SECURITY_DESCRIPTOR_HEADER | 5.0 only |
| SECURITY_HASH_KEY | 5.0 only |
| SERVERINFO | 4.0 and 5.0 |
| SHAREDINFO | 4.0 and 5.0 |
| SHARED_CACHE_MAP | 5.0 only |
| SHARED_CACHE_MAP_LIST_CURSOR | 5.0 only |
| SHARED_SECURITY | 5.0 only |
| SHARE_ACCESS | 5.0 only |
| SHORT2 | 5.0 only |
| SHROBJHEAD | 4.0 only |
| SH_LOCK | 5.0 only |
| SID | 5.0 only |
| SINGLE_LIST_ENTRY | 5.0 only |
| SMS | 4.0 and 5.0 |
| SMWP | 4.0 and 5.0 |
| SPB | 5.0 only |
| STANDARD_INFORMATION | 5.0 only |
| TEB | 4.0 and 5.0 |
| TERMINAL | 5.0 only |
| TEXTMETRICA | 4.0 and 5.0 |
| TEXTMETRICW | 4.0 and 5.0 |
| THREADINFO | 4.0 and 5.0 |
| THROBJHEAD | 4.0 and 5.0 |
| TIMER | 4.0 and 5.0 |
| TIME_FIELDS | 5.0 only |
| TL | 5.0 only |
| TOOLTIP | 5.0 only |
| TOP_LEVEL_CONTEXT | 5.0 only |
| TRACKMOUSEEVENT | 5.0 only |
| TRANSACTION_ENTRY | 5.0 only |
| TRANSMSG | 5.0 only |
| TRANSMSGLIST | 5.0 only |
| UNICODE_PREFIX_TABLE | 5.0 only |
| UNICODE_PREFIX_TABLE_ENTRY | 5.0 only |
| UNICODE_STRING | 5.0 only |
| UPCASE_TABLE_AND_KEY | 5.0 only |
| USERSTARTUPINFO | 4.0 and 5.0 |
| VACB | 5.0 only |
| VCB | 5.0 only |
| VK_F | 5.0 only |
| VK_TO_WCHAR_TABLE | 5.0 only |
| VK_VSC | 5.0 only |
| VM_COUNTERS | 5.0 only |
| VOLUME_DEVICE_OBJECT | 5.0 only |
| VOLUME_INFORMATION | 5.0 only |
| VPB | 5.0 only |
| VSC_VK | 5.0 only |
| W32JOB | 5.0 only |
| W32PROCESS | 4.0 and 5.0 |
| W32THREAD | 4.0 and 5.0 |
| WAITING_IRP | 5.0 only |
| WAITING_LOCK | 5.0 only |
| WAIT_FOR_NEW_LENGTH | 5.0 only |
| WIN32HEAP | 5.0 only |
| WINDOWPLACEMENT | 4.0 and 5.0 |
| WINDOWPOS | 4.0 and 5.0 |
| WINDOWSTATION | 4.0 and 5.0 |
| WND | 4.0 and 5.0 |
| WNDCLASSA | 4.0 and 5.0 |
| WNDCLASSEXA | 4.0 and 5.0 |
| WNDCLASSEXW | 4.0 and 5.0 |
| WNDCLASSW | 4.0 and 5.0 |
| WNDMSG | 4.0 and 5.0 |
| WNDOBJ | 4.0 and 5.0 |
| WORK_QUEUE_ENTRY | 5.0 only |
| WORK_QUEUE_ITEM | 5.0 only |
| WOWPROCESSINFO | 4.0 and 5.0 |
| WOWTHREADINFO | 4.0 and 5.0 |
| WW | 5.0 only |
| Win32MapView | 5.0 only |
| Win32Section | 5.0 only |
| XSTATE | 5.0 only |
What principle ever governed the selection of structures for presentation through the !dso command is not known. The name USERKDX suggests help for kernel-mode debugging of the windowing system as implemented by the WIN32K.SYS driver.
One influence on the selection may be that a structure was eligible only if it was thought stable. The USERKDX debugger extension shipped with development kits which were new for each Windows version but not for each build and not even for each formally released service pack. Even assuming that programmers (both Microsoft’s and not) use the debugger, including its extensions, from the kit for the same version of Windows that they’re debugging, the !dso command would have greatly reduced worth if the structures it dumps change between builds.
Many structures were added to the !dso output for version 5.0. Some of these structures truly were new for version 5.0. Many were perhaps added simply because Microsoft’s own programmers had found the !dso command to be useful and sought to increase its coverage. Only a few were withdrawn.