Geoff Chappell, Software Analyst
The MOVESIZEDATA structure is what WIN32K.SYS—and before it, WINSRV.DLL—keeps while moving or sizing a window.
The MOVESIZEDATA is not documented. Though symbol files for WIN32K.SYS in Windows 8 and higher name the MOVESIZEDATA in the C++ decorations of internal routines, type information for the structure is present only in symbol files for Windows 7—not before and not since.
Originally, the MOVESIZEDATA was nested in the THREADINFO. Version 3.51 instead formed it on the stack and pointed to it from the THREADINFO. Since version 4.0, it is in per-session paged pool. The following changes of size are known:
| Version | Size (x86) | Size (x64) |
|---|---|---|
| 3.10 | 0x7C | |
| 3.51 | 0x68 | |
| 4.0 to 6.0 | 0x74 | 0x78 |
| 6.1 to 6.2 | 0xDC | 0xF0 |
| 6.3 | 0xF0 | 0x0108 |
| 10.0 | 0x012C | 0x0140 |
| Offset (x86) | Offset (x64) | Definition | Versions | Remarks |
|---|---|---|---|---|
| 0x00 | 0x00 |
WND *spWnd; |
all | |
| 0x04 | 0x08 |
RECT rcDrag; |
all | |
| 0x14 | 0x18 |
RECT rcDragCursor; |
4.0 and higher | |
| 0x24 (6.1) | 0x28 (6.1) |
RECT rcPreview; |
6.1 and higher | |
| 0x34 (6.1) | 0x38 (6.1) |
RECT rcPreviewCursor; |
6.1 and higher | |
| 0x14 (3.10 to 3.51); 0x24 (4.0 to 6.0); 0x44 (6.1) |
0x28 (5.2 to 6.0); 0x48 (6.1) |
RECT rcParent; |
all | |
| 0x24 (3.10 to 3.51); 0x34 (4.0 to 6.0); 0x54 (6.1) |
0x38 (5.2 to 6.0); 0x58 (6.1) |
POINT ptMinTrack; |
all | |
| 0x2C (3.10 to 3.51); 0x3C (4.0 to 6.0); 0x5C (6.1) |
0x40 (5.2 to 6.0); 0x60 (6.1) |
POINT ptMaxTrack; |
all | |
| 0x34 (3.10 to 3.51); 0x44 (4.0 to 6.0) ; 0x64 (6.1) |
0x48 (5.2 to 6.0); 0x68 (6.1) |
RECT rcWindow; |
all | |
| 0x74 (6.1) | 0x78 (6.1) |
RECT rcNormalStartCheckPt; |
6.1 and higher | |
| 0x44 (3.10 to 3.51); 0x54 (4.0 to 6.0); 0x84 (6.1) |
0x58 (5.2 to 6.0); 0x88 (6.1) |
INT dxMouse; |
all | |
| 0x48 (3.10 to 3.51); 0x58 (4.0 to 6.0); 0x88 (6.1) |
0x5C (5.2 to 6.0); 0x8C (6.1) |
INT dyMouse; |
all | |
| 0x4C (3.10 to 3.51); 0x5C (4.0 to 6.0); 0x8C (6.1) |
0x60 (5.2 to 6.0); 0x90 (6.1) |
INT cmd; |
all | |
| 0x50 (3.10 to 3.51); 0x60 (4.0 to 6.0); 0x90 (6.1) |
0x64 (5.2 to 6.0); 0x94 (6.1) |
INT impx; |
all | |
| 0x54 (3.10 to 3.51); 0x64 (4.0 to 6.0); 0x94 (6.1) |
0x68 (5.2 to 6.0); 0x98 (6.1) |
INT impy; |
all | |
| 0x58 (3.10 to 3.51); 0x68 (4.0 to 6.0); 0x98 (6.1) |
0x6C (5.2 to 6.0); 0x9C (6.1) |
POINT ptRestore; |
all | |
| 0x60 (3.10 to 3.51) | unknown pointer | 3.10 to 3.51 | ||
| 0x64 (3.10) |
BOOL fInitSize; |
3.10 only | next as bit in Flags | |
| 0x68 (3.10) |
BOOL fmsKbd; |
3.10 only | next as bit in Flags | |
| 0x6C (3.10) | unknown BOOL | 3.10 only | ||
| 0x70 (3.10) | unaccounted four bytes | 3.10 only | ||
| 0x74 (3.10) |
BOOL fTrackCancelled; |
3.10 only | next as bit in Flags | |
| 0x78 (3.10) |
BOOL fForeground; |
3.10 only |
next as bit in Flags; last member in 3.10 |
|
| 0x64 (3.51); 0x70 (4.0 to 6.0); 0xA0 (6.1) |
0x74 (5.2 to 6.0); 0xA4 (6.1) |
union {
ULONG Flags;
struct {
/* bit fields, follow link */
};
};
|
3.51 and higher | last member in 3.51 to 6.0 |
| Offset (x86) | Offset (x64) | Definition | Versions | Remarks |
|---|---|---|---|---|
| 0xA4 (6.1) | 0xA8 (6.1) |
MONITOR *pStartMonitorCurrentHitTarget; |
6.1 and higher | |
| 0xA8 (6.1) | 0xB0 (6.1) |
eTHRESHOLD_MARGIN_DIRECTION StartCurrentHitTarget; |
6.1 and higher | |
| 0xAC (6.1) | 0xB8 (6.1) |
MONITOR *pMonitorCurrentHitTarget; |
6.1 and higher | |
| 0xB0 (6.1) | 0xC0 (6.1) |
eTHRESHOLD_MARGIN_DIRECTION CurrentHitTarget; |
6.1 and higher | |
| 0xB4 (6.1) | 0xC4 (6.1) |
MOVERECT_STYLE MoveRectStyle; |
6.1 and higher | |
| 0xB8 (6.1) | 0xC8 (6.1) |
POINT ptHitWindowRelative; |
6.1 and higher | |
| 0xC0 (6.1) | 0xD0 (6.1) |
POINT ptStartHitWindowRelative; |
6.1 and higher | |
| 0xC8 (6.1) | 0xD8 (6.1) |
POINT ptLastTrack; |
6.1 and higher | |
| 0xD0 (6.1) | 0xE0 (6.1) |
ULONG ulCountDragOutOfTopTarget; |
6.1 and higher | |
| 0xD4 (6.1) | 0xE4 (6.1) |
ULONG ulCountDragOutOfLeftRightTarget; |
6.1 and higher | |
| 0xD8 (6.1) | 0xE8 (6.1) |
ULONG ulCountSizeOutOfTopBottomTarget; |
6.1 and higher |