Geoff Chappell, Software Analyst
The SYSTEM_VHD_BOOT_INFORMATION structure is what a successful call to ZwQuerySystemInformation or NtQuerySystemInformation produces at the start of its output buffer when given the information class SystemVhdBootInformation (0x70).
The structure is a fixed-size header to introduce two variable-size items which are both null-terminated Unicode strings.
The SYSTEM_VHD_BOOT_INFORMATION structure is not documented.
The SYSTEM_VHD_BOOT_INFORMATION is 0x0C bytes in both 32-bit and 64-bit Windows.
Offset | Definition |
---|---|
0x00 |
BOOLEAN OsDiskIsVhd; |
0x04 |
ULONG OsVhdFilePathOffset; |
0x08 |
WCHAR OsVhdParentVolume [ANYSIZE_ARRAY]; |
The first of the two strings begins at OsVhdParentVolume. The second begins OsVhdFilePathOffset bytes from the beginning of the structure.