结构体:

typedef struct _OBJECT_TYPE_INITIALIZER
{
	USHORT Length;
	union
	{
		UCHAR ObjectTypeFlags;
		struct
		{
			UCHAR CaseInsensitive: 1;    //  +0x002 CaseInsensitive  : Pos 0, 1 Bit
			UCHAR UnnamedObjectsOnly: 1;  //  +0x002 UnnamedObjectsOnly : Pos 1, 1 Bit
			UCHAR UseDefaultObject: 1;    //  +0x002 UseDefaultObject : Pos 2, 1 Bit
			UCHAR SecurityRequired: 1;    //  +0x002 SecurityRequired : Pos 3, 1 Bit
			UCHAR MaintainHandleCount: 1;  //  +0x002 MaintainHandleCount : Pos 4, 1 Bit
			UCHAR MaintainTypeList: 1;    //  +0x002 MaintainTypeList : Pos 5, 1 Bit
			UCHAR SupportsObjectCallbacks: 1;    //  +0x002 SupportsObjectCallbacks : Pos 6, 1 Bit
			UCHAR CacheAligned: 1;      //  +0x002 CacheAligned     : Pos 7, 1 Bit
		};
	};
	ULONG ObjectTypeCode;
	ULONG InvalidAttributes;
	GENERIC_MAPPING GenericMapping;
	ULONG ValidAccessMask;
	POOL_TYPE PoolType;
	ULONG DefaultPagedPoolCharge;
	ULONG DefaultNonPagedPoolCharge;
	PVOID DumpProcedure;
	LONG * OpenProcedure;
	PVOID CloseProcedure;
	PVOID DeleteProcedure;
	LONG * ParseProcedure;
	LONG * SecurityProcedure;
	LONG * QueryNameProcedure;
	UCHAR * OkayToCloseProcedure;

} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;

typedef struct _OBJECT_TYPE_INITIALIZER_WIN8
{
	USHORT Length;
	union
	{
		UCHAR ObjectTypeFlags;
		struct
		{
			UCHAR CaseInsensitive: 1;    //  +0x002 CaseInsensitive  : Pos 0, 1 Bit
			UCHAR UnnamedObjectsOnly: 1;  //  +0x002 UnnamedObjectsOnly : Pos 1, 1 Bit
			UCHAR UseDefaultObject: 1;    //  +0x002 UseDefaultObject : Pos 2, 1 Bit
			UCHAR SecurityRequired: 1;    //  +0x002 SecurityRequired : Pos 3, 1 Bit
			UCHAR MaintainHandleCount: 1;  //  +0x002 MaintainHandleCount : Pos 4, 1 Bit
			UCHAR MaintainTypeList: 1;    //  +0x002 MaintainTypeList : Pos 5, 1 Bit
			UCHAR SupportsObjectCallbacks: 1;    //  +0x002 SupportsObjectCallbacks : Pos 6, 1 Bit
			UCHAR CacheAligned: 1;      //  +0x002 CacheAligned     : Pos 7, 1 Bit
		};
	};
	ULONG ObjectTypeCode;
	ULONG InvalidAttributes;
	GENERIC_MAPPING GenericMapping;
	ULONG ValidAccessMask;
	POOL_TYPE PoolType;
	ULONG DefaultPagedPoolCharge;
	ULONG DefaultNonPagedPoolCharge;
	PVOID DumpProcedure;
	LONG * OpenProcedure;
	PVOID CloseProcedure;
	PVOID DeleteProcedure;
	LONG * ParseProcedure;
	LONG * SecurityProcedure;
	LONG * QueryNameProcedure;
	UCHAR * OkayToCloseProcedure;
	ULONG WaitObjectFlagMask;
	USHORT WaitObjectFlagOffset;
	USHORT WaitObjectPointerOffset;

} OBJECT_TYPE_INITIALIZER_WIN8, *POBJECT_TYPE_INITIALIZER_WIN8;

typedef struct _FAKE_OBJECT_TYPE_WIN7
{
	LIST_ENTRY TypeList;
	UNICODE_STRING Name;
	PVOID DefaultObject;
	ULONG Index;
	ULONG TotalNumberOfObjects;
	ULONG TotalNumberOfHandles;
	ULONG HighWaterNumberOfObjects;
	ULONG HighWaterNumberOfHandles;
	OBJECT_TYPE_INITIALIZER TypeInfo;
	EX_PUSH_LOCK TypeLock;
 	ULONG Key;
 	LIST_ENTRY CallbackList;
} FAKE_OBJECT_TYPE_WIN7, *PFAKE_OBJECT_TYPE_WIN7;

typedef struct _FAKE_OBJECT_TYPE_WIN8
{
	LIST_ENTRY TypeList;
	UNICODE_STRING Name;
	PVOID DefaultObject;
	ULONG Index;
	ULONG TotalNumberOfObjects;
	ULONG TotalNumberOfHandles;
	ULONG HighWaterNumberOfObjects;
	ULONG HighWaterNumberOfHandles;
	OBJECT_TYPE_INITIALIZER_WIN8 TypeInfo;
	EX_PUSH_LOCK TypeLock;
	ULONG Key;
	LIST_ENTRY CallbackList;
} FAKE_OBJECT_TYPE_WIN8, *PFAKE_OBJECT_TYPE_WIN8;

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)