SYSTEM_VDM_INSTEMUL_INFO

The SYSTEM_VDM_INSTEMUL_INFO structure (formally _SYSTEM_VDM_INSTEMUL_INFO) is what a successful call to ZwQuerySystemInformation or NtQuerySystemInformation produces in its output buffer when given the information class SystemVdmInstemulInformation (0x13).

The x64 builds reject this information class as not implemented.

Documentation Status

The SYSTEM_VDM_INSTEMUL_INFO structure is not documented.

Microsoft does publish the practical equivalent of a C-language definition as type information in symbol files—not for the kernel, where the structure is prepared, nor even for low-level user-mode DLLs that interpret the structure, but for a handful of higher-level DLLs that might ordinarily be thought very distant from any involvement with the structure. Perhaps only by oversight, but starting as long ago as Windows 8, Microsoft’s downloadable packages of public symbols have included a smattering of private symbol files and these continue to be available through the public symbol server. Precisely which DLLs have the type information varies between versions. COMBASE.DLL is among the more reliable nowadays. Disclosure in symbol files for URLMON.DLL stopped for the 1803 release of Windows 10 but is specially notable because of this DLL’s origins in Internet Explorer and thence for the strong suggestion that Microsoft’s programmers of Internet Explorer had access to more details of low-level Windows programming than Microsoft publishes for wider use (including by the programmers of competing web browsers).

Type information for the structure has also seeped out at the other end of the Windows timeline, though not in symbol files but in statically linked libraries: GDISRVL.LIB from the Device Driver Kit (DDK) for Windows NT 3.51; and SHELL32.LIB from the DDK for Windows NT 4.0.

Layout

The SYSTEM_VDM_INSTEMUL_INFO is 0x88 bytes in both 32-bit and 64-bit Windows in all known versions.

ULONG SegmentNotPresent;

ULONG VdmOpcode0F;

ULONG OpcodeESPrefix;

ULONG OpcodeCSPrefix;

ULONG OpcodeSSPrefix;

ULONG OpcodeDSPrefix;

ULONG OpcodeFSPrefix;

ULONG OpcodeGSPrefix;

ULONG OpcodeOPER32Prefix;

ULONG OpcodeADDR32Prefix;

ULONG OpcodeINSB;

ULONG OpcodeINSW;

ULONG OpcodeOUTSB;

ULONG OpcodeOUTSW;

ULONG OpcodePUSHF;

ULONG OpcodePOPF;

ULONG OpcodeINTnn;

ULONG OpcodeINTO;

ULONG OpcodeIRET;

ULONG OpcodeINBimm;

ULONG OpcodeINWimm;

ULONG OpcodeOUTBimm;

ULONG OpcodeOUTWimm;

ULONG OpcodeINB;

ULONG OpcodeINW;

ULONG OpcodeOUTB;

ULONG OpcodeOUTW;

ULONG OpcodeLOCKPrefix;

ULONG OpcodeREPNEPrefix;

ULONG OpcodeREPPrefix;

ULONG OpcodeHLT;

ULONG OpcodeCLI;

ULONG OpcodeSTI;

ULONG BopCount;

Each member is a dispatch count, mostly for a corresponding opcode whose virtual-8086 execution is handled first in ring 0.