Geoff Chappell, Software Analyst
The SYSTEM_VERIFIER_INFORMATION structure is what a successful call to ZwQuerySystemInformation or NtQuerySystemInformation produces in its output buffer when given the information class SystemVerifierInformation (0x33).
The SYSTEM_VERIFIER_INFORMATION structure is not documented.
The SYSTEM_VERIFIER_INFORMATION is 0x68 and 0x80 bytes in 32-bit and 64-bit Windows, respectively.
| Offset (x86) | Offset (x64) | Definition |
|---|---|---|
| 0x00 | 0x00 |
ULONG NextEntryOffset; |
| 0x04 | 0x04 |
ULONG Level; |
| 0x08 | 0x08 |
UNICODE_STRING DriverName; |
| 0x10 | 0x18 |
ULONG RaiseIrqls; |
| 0x14 | 0x1C |
ULONG AcquireSpinLocks; |
| 0x18 | 0x20 |
ULONG SynchronizeExecutions; |
| 0x1C | 0x24 |
ULONG AllocationsAttempted; |
| 0x20 | 0x28 |
ULONG AllocationsSucceeded; |
| 0x24 | 0x2C |
ULONG AllocationsSucceededSpecialPool; |
| 0x28 | 0x30 |
ULONG AllocationsWithNoTag; |
| 0x2C | 0x34 |
ULONG TrimRequests; |
| 0x30 | 0x38 |
ULONG Trims; |
| 0x34 | 0x3C |
ULONG AllocationsFailed; |
| 0x38 | 0x40 |
ULONG AllocationsFailedDeliberately; |
| 0x3C | 0x44 |
ULONG Loads; |
| 0x40 | 0x48 |
ULONG Unloads; |
| 0x44 | 0x4C |
ULONG UntrackedPool; |
| 0x48 | 0x50 |
ULONG CurrentPagedPoolAllocations; |
| 0x4C | 0x54 |
ULONG CurrentNonPagedPoolAllocations; |
| 0x50 | 0x58 |
ULONG PeakPagedPoolAllocations; |
| 0x54 | 0x5C |
ULONG PeakNonPagedPoolAllocations; |
| 0x58 | 0x60 |
ULONG_PTR PagedPoolUsageInBytes; |
| 0x5C | 0x68 |
ULONG_PTR NonPagedPoolUsageInBytes; |
| 0x60 | 0x70 |
ULONG_PTR PeakPagedPoolUsageInBytes; |
| 0x64 | 0x78 |
ULONG_PTR PeakNonPagedPoolUsageInBytes; |