KSPECIAL_REGISTERS (i386)

The KSPECIAL_REGISTERS (formally _KSPECIAL_REGISTERS) is a structure for recording processor state that is not ordinarily needed in a CONTEXT structure. It is necessarily highly specific to the processor architecture. Public symbols for the kernel starting with Windows 8 confirm that Microsoft defines the structure separately (in different headers) for different processors. This page concerns itself only with the KSPECIAL_REGISTERS in 32-bit Windows for the processor architecture that’s variously named i386 or x86. The x64 KSPECIAL_REGISTERS is presented separately.

The KSPECIAL_REGISTERS is 0x54 bytes in all known versions. Note that the structure contains a ULONG64 that does not have 8-byte alignment.

ULONG Cr0;

ULONG Cr2;

ULONG Cr3;

ULONG Cr4;

ULONG KernelDr0;

ULONG KernelDr1;

ULONG KernelDr2;

ULONG KernelDr3;

ULONG KernelDr6;

ULONG KernelDr7;

KDESCRIPTOR Gdtr;

KDESCRIPTOR Idtr;

USHORT Tr;

USHORT Ldtr;

ULONG64 Xcr0;

ULONG ExceptionList;

ULONG Reserved [3];