KSPECIAL_REGISTERS (amd64)

The KSPECIAL_REGISTERS (formally _KSPECIAL_REGISTERS) is a structure for recording processor state that is not ordinarily needed in a CONTEXT structure. It is necessarily highly specific to the processor architecture. Public symbols for the kernel starting with Windows 8 confirm that Microsoft defines the structure separately (in different headers) for different processors. This page concerns itself only with the KSPECIAL_REGISTERS in 64-bit Windows for the processor architecture that’s variously named amd64 or x64. The x86 KSPECIAL_REGISTERS is presented separately.

The KSPECIAL_REGISTERS is 0xD8 bytes before version 6.2 and is then 0xE0 bytes.

ULONG64 Cr0;

ULONG64 Cr2;

ULONG64 Cr3;

ULONG64 Cr4;

ULONG64 KernelDr0;

ULONG64 KernelDr1;

ULONG64 KernelDr2;

ULONG64 KernelDr3;

ULONG64 KernelDr6;

ULONG64 KernelDr7;

KDESCRIPTOR Gdtr;

KDESCRIPTOR Idtr;

USHORT Tr;

USHORT Ldtr;

ULONG MxCsr;

ULONG64 DebugControl;

ULONG64 LastBranchToRip;

ULONG64 LastBranchFromRip;

ULONG64 LastExceptionToRip;

ULONG64 LastExceptionFromRip;

ULONG64 Cr8;

ULONG64 MsrGsBase;

ULONG64 MsrGsSwap;

ULONG64 MsrStar;

ULONG64 MsrLStar;

ULONG64 MsrCStar;

ULONG64 MsrSyscallMask;

ULONG64 Xcr0;