KAFFINITY_ENUMERATION_CONTEXT

The KAFFINITY_ENUMERATION_CONTEXT structure seems to exist for a handful of functions that are exported from the kernel for tidier access to a KAFFINITY_EX for the limited purpose of enumerating its set bits:

• KeEnumerateNextProcessor (6.1 and higher);
• KeInitializeEnumerationContext (6.1 and higher);
• KeInitializeEnumerationContextFromAffinity (10.0 and higher);
• KeInitializeEnumerationContextFromGroup (6.1 and higher).

Documentation Status

The KAFFINITY_ENUMERATION_CONTEXT structure is not documented. Nor is it even declared in any header from a known Windows Driver Kit (WDK).

The related functions are not documented either, though they are declared in the NTOSP.H from the Enterprise edition of the Windows Driver Kit (WDK) for Windows 10 Version 1511. Quite what the point is to declaring them there is anyone’s guess, however, for the declarations depend on the PKAFFINITY_ENUMERATION_CONTEXT type, which is in turn not declared in any header that’s supplied with that WDK.

Layout

The KAFFINITY_ENUMERATION_CONTEXT is 0x0C or 0x18 bytes in 32-bit and 64-bit Windows, respectively.

Sizes, offsets, types and names in the table that follows are from Microsoft’s symbol files for URLMON.DLL. Yes, this user-mode DLL—not even one that’s vital for user-mode interactions with the kernel but is instead a component of Internet Explorer—knows this structure that for some years wasn’t even declared for kernel-mode programming and still isn’t defined.

KAFFINITY_EX *Affinity;

ULONGLONG CurrentMask;

USHORT CurrentIndex;