KDDEBUGGER_DATA64

using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct LIST_ENTRY64
{
    public ulong Flink;
    public ulong Blink;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DBGKD_DEBUG_DATA_HEADER64
{
    public LIST_ENTRY64 List;
    public uint OwnerTag;
    public uint Size;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct KDDEBUGGER_DATA64
{
    public DBGKD_DEBUG_DATA_HEADER64 Header;
    public ulong KernBase;
    public ulong BreakpointWithStatus;
    public ulong SavedContext;
    public ushort ThCallbackStack;
    public ushort NextCallback;
    public ushort FramePointer;
    public ushort _bitfield;
    public ulong KiCallUserMode;
    public ulong KeUserCallbackDispatcher;
    public ulong PsLoadedModuleList;
    public ulong PsActiveProcessHead;
    public ulong PspCidTable;
    public ulong ExpSystemResourcesList;
    public ulong ExpPagedPoolDescriptor;
    public ulong ExpNumberOfPagedPools;
    public ulong KeTimeIncrement;
    public ulong KeBugCheckCallbackListHead;
    public ulong KiBugcheckData;
    public ulong IopErrorLogListHead;
    public ulong ObpRootDirectoryObject;
    public ulong ObpTypeObjectType;
    public ulong MmSystemCacheStart;
    public ulong MmSystemCacheEnd;
    public ulong MmSystemCacheWs;
    public ulong MmPfnDatabase;
    public ulong MmSystemPtesStart;
    public ulong MmSystemPtesEnd;
    public ulong MmSubsectionBase;
    public ulong MmNumberOfPagingFiles;
    public ulong MmLowestPhysicalPage;
    public ulong MmHighestPhysicalPage;
    public ulong MmNumberOfPhysicalPages;
    public ulong MmMaximumNonPagedPoolInBytes;
    public ulong MmNonPagedSystemStart;
    public ulong MmNonPagedPoolStart;
    public ulong MmNonPagedPoolEnd;
    public ulong MmPagedPoolStart;
    public ulong MmPagedPoolEnd;
    public ulong MmPagedPoolInformation;
    public ulong MmPageSize;
    public ulong MmSizeOfPagedPoolInBytes;
    public ulong MmTotalCommitLimit;
    public ulong MmTotalCommittedPages;
    public ulong MmSharedCommit;
    public ulong MmDriverCommit;
    public ulong MmProcessCommit;
    public ulong MmPagedPoolCommit;
    public ulong MmExtendedCommit;
    public ulong MmZeroedPageListHead;
    public ulong MmFreePageListHead;
    public ulong MmStandbyPageListHead;
    public ulong MmModifiedPageListHead;
    public ulong MmModifiedNoWritePageListHead;
    public ulong MmAvailablePages;
    public ulong MmResidentAvailablePages;
    public ulong PoolTrackTable;
    public ulong NonPagedPoolDescriptor;
    public ulong MmHighestUserAddress;
    public ulong MmSystemRangeStart;
    public ulong MmUserProbeAddress;
    public ulong KdPrintCircularBuffer;
    public ulong KdPrintCircularBufferEnd;
    public ulong KdPrintWritePointer;
    public ulong KdPrintRolloverCount;
    public ulong MmLoadedUserImageList;
    public ulong NtBuildLab;
    public ulong KiNormalSystemCall;
    public ulong KiProcessorBlock;
    public ulong MmUnloadedDrivers;
    public ulong MmLastUnloadedDriver;
    public ulong MmTriageActionTaken;
    public ulong MmSpecialPoolTag;
    public ulong KernelVerifier;
    public ulong MmVerifierData;
    public ulong MmAllocatedNonPagedPool;
    public ulong MmPeakCommitment;
    public ulong MmTotalCommitLimitMaximum;
    public ulong CmNtCSDVersion;
    public ulong MmPhysicalMemoryBlock;
    public ulong MmSessionBase;
    public ulong MmSessionSize;
    public ulong MmSystemParentTablePage;
    public ulong MmVirtualTranslationBase;
    public ushort OffsetKThreadNextProcessor;
    public ushort OffsetKThreadTeb;
    public ushort OffsetKThreadKernelStack;
    public ushort OffsetKThreadInitialStack;
    public ushort OffsetKThreadApcProcess;
    public ushort OffsetKThreadState;
    public ushort OffsetKThreadBStore;
    public ushort OffsetKThreadBStoreLimit;
    public ushort SizeEProcess;
    public ushort OffsetEprocessPeb;
    public ushort OffsetEprocessParentCID;
    public ushort OffsetEprocessDirectoryTableBase;
    public ushort SizePrcb;
    public ushort OffsetPrcbDpcRoutine;
    public ushort OffsetPrcbCurrentThread;
    public ushort OffsetPrcbMhz;
    public ushort OffsetPrcbCpuType;
    public ushort OffsetPrcbVendorString;
    public ushort OffsetPrcbProcStateContext;
    public ushort OffsetPrcbNumber;
    public ushort SizeEThread;
    public byte L1tfHighPhysicalBitIndex;
    public byte L1tfSwizzleBitIndex;
    public uint Padding0;
    public ulong KdPrintCircularBufferPtr;
    public ulong KdPrintBufferSize;
    public ulong KeLoaderBlock;
    public ushort SizePcr;
    public ushort OffsetPcrSelfPcr;
    public ushort OffsetPcrCurrentPrcb;
    public ushort OffsetPcrContainedPrcb;
    public ushort OffsetPcrInitialBStore;
    public ushort OffsetPcrBStoreLimit;
    public ushort OffsetPcrInitialStack;
    public ushort OffsetPcrStackLimit;
    public ushort OffsetPrcbPcrPage;
    public ushort OffsetPrcbProcStateSpecialReg;
    public ushort GdtR0Code;
    public ushort GdtR0Data;
    public ushort GdtR0Pcr;
    public ushort GdtR3Code;
    public ushort GdtR3Data;
    public ushort GdtR3Teb;
    public ushort GdtLdt;
    public ushort GdtTss;
    public ushort Gdt64R3CmCode;
    public ushort Gdt64R3CmTeb;
    public ulong IopNumTriageDumpDataBlocks;
    public ulong IopTriageDumpDataBlocks;
    public ulong VfCrashDataBlock;
    public ulong MmBadPagesDetected;
    public ulong MmZeroedPageSingleBitErrorsDetected;
    public ulong EtwpDebuggerData;
    public ushort OffsetPrcbContext;
    public ushort OffsetPrcbMaxBreakpoints;
    public ushort OffsetPrcbMaxWatchpoints;
    public uint OffsetKThreadStackLimit;
    public uint OffsetKThreadStackBase;
    public uint OffsetKThreadQueueListEntry;
    public uint OffsetEThreadIrpList;
    public ushort OffsetPrcbIdleThread;
    public ushort OffsetPrcbNormalDpcState;
    public ushort OffsetPrcbDpcStack;
    public ushort OffsetPrcbIsrStack;
    public ushort SizeKDPC_STACK_FRAME;
    public ushort OffsetKPriQueueThreadListHead;
    public ushort OffsetKThreadWaitReason;
    public ushort Padding1;
    public ulong PteBase;
    public ulong RetpolineStubFunctionTable;
    public uint RetpolineStubFunctionTableSize;
    public uint RetpolineStubOffset;
    public uint RetpolineStubSize;
    public ushort OffsetEProcessMmHotPatchContext;
    public uint OffsetKThreadShadowStackLimit;
    public uint OffsetKThreadShadowStackBase;
    public ulong ShadowStackEnabled;
    public ulong PointerAuthMask;
    public ushort OffsetPrcbExceptionStack;
}

Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure LIST_ENTRY64
    Public Flink As ULong
    Public Blink As ULong
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DBGKD_DEBUG_DATA_HEADER64
    Public List As LIST_ENTRY64
    Public OwnerTag As UInteger
    Public Size As UInteger
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure KDDEBUGGER_DATA64
    Public Header As DBGKD_DEBUG_DATA_HEADER64
    Public KernBase As ULong
    Public BreakpointWithStatus As ULong
    Public SavedContext As ULong
    Public ThCallbackStack As UShort
    Public NextCallback As UShort
    Public FramePointer As UShort
    Public _bitfield As UShort
    Public KiCallUserMode As ULong
    Public KeUserCallbackDispatcher As ULong
    Public PsLoadedModuleList As ULong
    Public PsActiveProcessHead As ULong
    Public PspCidTable As ULong
    Public ExpSystemResourcesList As ULong
    Public ExpPagedPoolDescriptor As ULong
    Public ExpNumberOfPagedPools As ULong
    Public KeTimeIncrement As ULong
    Public KeBugCheckCallbackListHead As ULong
    Public KiBugcheckData As ULong
    Public IopErrorLogListHead As ULong
    Public ObpRootDirectoryObject As ULong
    Public ObpTypeObjectType As ULong
    Public MmSystemCacheStart As ULong
    Public MmSystemCacheEnd As ULong
    Public MmSystemCacheWs As ULong
    Public MmPfnDatabase As ULong
    Public MmSystemPtesStart As ULong
    Public MmSystemPtesEnd As ULong
    Public MmSubsectionBase As ULong
    Public MmNumberOfPagingFiles As ULong
    Public MmLowestPhysicalPage As ULong
    Public MmHighestPhysicalPage As ULong
    Public MmNumberOfPhysicalPages As ULong
    Public MmMaximumNonPagedPoolInBytes As ULong
    Public MmNonPagedSystemStart As ULong
    Public MmNonPagedPoolStart As ULong
    Public MmNonPagedPoolEnd As ULong
    Public MmPagedPoolStart As ULong
    Public MmPagedPoolEnd As ULong
    Public MmPagedPoolInformation As ULong
    Public MmPageSize As ULong
    Public MmSizeOfPagedPoolInBytes As ULong
    Public MmTotalCommitLimit As ULong
    Public MmTotalCommittedPages As ULong
    Public MmSharedCommit As ULong
    Public MmDriverCommit As ULong
    Public MmProcessCommit As ULong
    Public MmPagedPoolCommit As ULong
    Public MmExtendedCommit As ULong
    Public MmZeroedPageListHead As ULong
    Public MmFreePageListHead As ULong
    Public MmStandbyPageListHead As ULong
    Public MmModifiedPageListHead As ULong
    Public MmModifiedNoWritePageListHead As ULong
    Public MmAvailablePages As ULong
    Public MmResidentAvailablePages As ULong
    Public PoolTrackTable As ULong
    Public NonPagedPoolDescriptor As ULong
    Public MmHighestUserAddress As ULong
    Public MmSystemRangeStart As ULong
    Public MmUserProbeAddress As ULong
    Public KdPrintCircularBuffer As ULong
    Public KdPrintCircularBufferEnd As ULong
    Public KdPrintWritePointer As ULong
    Public KdPrintRolloverCount As ULong
    Public MmLoadedUserImageList As ULong
    Public NtBuildLab As ULong
    Public KiNormalSystemCall As ULong
    Public KiProcessorBlock As ULong
    Public MmUnloadedDrivers As ULong
    Public MmLastUnloadedDriver As ULong
    Public MmTriageActionTaken As ULong
    Public MmSpecialPoolTag As ULong
    Public KernelVerifier As ULong
    Public MmVerifierData As ULong
    Public MmAllocatedNonPagedPool As ULong
    Public MmPeakCommitment As ULong
    Public MmTotalCommitLimitMaximum As ULong
    Public CmNtCSDVersion As ULong
    Public MmPhysicalMemoryBlock As ULong
    Public MmSessionBase As ULong
    Public MmSessionSize As ULong
    Public MmSystemParentTablePage As ULong
    Public MmVirtualTranslationBase As ULong
    Public OffsetKThreadNextProcessor As UShort
    Public OffsetKThreadTeb As UShort
    Public OffsetKThreadKernelStack As UShort
    Public OffsetKThreadInitialStack As UShort
    Public OffsetKThreadApcProcess As UShort
    Public OffsetKThreadState As UShort
    Public OffsetKThreadBStore As UShort
    Public OffsetKThreadBStoreLimit As UShort
    Public SizeEProcess As UShort
    Public OffsetEprocessPeb As UShort
    Public OffsetEprocessParentCID As UShort
    Public OffsetEprocessDirectoryTableBase As UShort
    Public SizePrcb As UShort
    Public OffsetPrcbDpcRoutine As UShort
    Public OffsetPrcbCurrentThread As UShort
    Public OffsetPrcbMhz As UShort
    Public OffsetPrcbCpuType As UShort
    Public OffsetPrcbVendorString As UShort
    Public OffsetPrcbProcStateContext As UShort
    Public OffsetPrcbNumber As UShort
    Public SizeEThread As UShort
    Public L1tfHighPhysicalBitIndex As Byte
    Public L1tfSwizzleBitIndex As Byte
    Public Padding0 As UInteger
    Public KdPrintCircularBufferPtr As ULong
    Public KdPrintBufferSize As ULong
    Public KeLoaderBlock As ULong
    Public SizePcr As UShort
    Public OffsetPcrSelfPcr As UShort
    Public OffsetPcrCurrentPrcb As UShort
    Public OffsetPcrContainedPrcb As UShort
    Public OffsetPcrInitialBStore As UShort
    Public OffsetPcrBStoreLimit As UShort
    Public OffsetPcrInitialStack As UShort
    Public OffsetPcrStackLimit As UShort
    Public OffsetPrcbPcrPage As UShort
    Public OffsetPrcbProcStateSpecialReg As UShort
    Public GdtR0Code As UShort
    Public GdtR0Data As UShort
    Public GdtR0Pcr As UShort
    Public GdtR3Code As UShort
    Public GdtR3Data As UShort
    Public GdtR3Teb As UShort
    Public GdtLdt As UShort
    Public GdtTss As UShort
    Public Gdt64R3CmCode As UShort
    Public Gdt64R3CmTeb As UShort
    Public IopNumTriageDumpDataBlocks As ULong
    Public IopTriageDumpDataBlocks As ULong
    Public VfCrashDataBlock As ULong
    Public MmBadPagesDetected As ULong
    Public MmZeroedPageSingleBitErrorsDetected As ULong
    Public EtwpDebuggerData As ULong
    Public OffsetPrcbContext As UShort
    Public OffsetPrcbMaxBreakpoints As UShort
    Public OffsetPrcbMaxWatchpoints As UShort
    Public OffsetKThreadStackLimit As UInteger
    Public OffsetKThreadStackBase As UInteger
    Public OffsetKThreadQueueListEntry As UInteger
    Public OffsetEThreadIrpList As UInteger
    Public OffsetPrcbIdleThread As UShort
    Public OffsetPrcbNormalDpcState As UShort
    Public OffsetPrcbDpcStack As UShort
    Public OffsetPrcbIsrStack As UShort
    Public SizeKDPC_STACK_FRAME As UShort
    Public OffsetKPriQueueThreadListHead As UShort
    Public OffsetKThreadWaitReason As UShort
    Public Padding1 As UShort
    Public PteBase As ULong
    Public RetpolineStubFunctionTable As ULong
    Public RetpolineStubFunctionTableSize As UInteger
    Public RetpolineStubOffset As UInteger
    Public RetpolineStubSize As UInteger
    Public OffsetEProcessMmHotPatchContext As UShort
    Public OffsetKThreadShadowStackLimit As UInteger
    Public OffsetKThreadShadowStackBase As UInteger
    Public ShadowStackEnabled As ULong
    Public PointerAuthMask As ULong
    Public OffsetPrcbExceptionStack As UShort
End Structure

import ctypes
from ctypes import wintypes

class LIST_ENTRY64(ctypes.Structure):
    _fields_ = [
        ("Flink", ctypes.c_ulonglong),
        ("Blink", ctypes.c_ulonglong),
    ]

class DBGKD_DEBUG_DATA_HEADER64(ctypes.Structure):
    _fields_ = [
        ("List", LIST_ENTRY64),
        ("OwnerTag", wintypes.DWORD),
        ("Size", wintypes.DWORD),
    ]

class KDDEBUGGER_DATA64(ctypes.Structure):
    _fields_ = [
        ("Header", DBGKD_DEBUG_DATA_HEADER64),
        ("KernBase", ctypes.c_ulonglong),
        ("BreakpointWithStatus", ctypes.c_ulonglong),
        ("SavedContext", ctypes.c_ulonglong),
        ("ThCallbackStack", ctypes.c_ushort),
        ("NextCallback", ctypes.c_ushort),
        ("FramePointer", ctypes.c_ushort),
        ("_bitfield", ctypes.c_ushort),
        ("KiCallUserMode", ctypes.c_ulonglong),
        ("KeUserCallbackDispatcher", ctypes.c_ulonglong),
        ("PsLoadedModuleList", ctypes.c_ulonglong),
        ("PsActiveProcessHead", ctypes.c_ulonglong),
        ("PspCidTable", ctypes.c_ulonglong),
        ("ExpSystemResourcesList", ctypes.c_ulonglong),
        ("ExpPagedPoolDescriptor", ctypes.c_ulonglong),
        ("ExpNumberOfPagedPools", ctypes.c_ulonglong),
        ("KeTimeIncrement", ctypes.c_ulonglong),
        ("KeBugCheckCallbackListHead", ctypes.c_ulonglong),
        ("KiBugcheckData", ctypes.c_ulonglong),
        ("IopErrorLogListHead", ctypes.c_ulonglong),
        ("ObpRootDirectoryObject", ctypes.c_ulonglong),
        ("ObpTypeObjectType", ctypes.c_ulonglong),
        ("MmSystemCacheStart", ctypes.c_ulonglong),
        ("MmSystemCacheEnd", ctypes.c_ulonglong),
        ("MmSystemCacheWs", ctypes.c_ulonglong),
        ("MmPfnDatabase", ctypes.c_ulonglong),
        ("MmSystemPtesStart", ctypes.c_ulonglong),
        ("MmSystemPtesEnd", ctypes.c_ulonglong),
        ("MmSubsectionBase", ctypes.c_ulonglong),
        ("MmNumberOfPagingFiles", ctypes.c_ulonglong),
        ("MmLowestPhysicalPage", ctypes.c_ulonglong),
        ("MmHighestPhysicalPage", ctypes.c_ulonglong),
        ("MmNumberOfPhysicalPages", ctypes.c_ulonglong),
        ("MmMaximumNonPagedPoolInBytes", ctypes.c_ulonglong),
        ("MmNonPagedSystemStart", ctypes.c_ulonglong),
        ("MmNonPagedPoolStart", ctypes.c_ulonglong),
        ("MmNonPagedPoolEnd", ctypes.c_ulonglong),
        ("MmPagedPoolStart", ctypes.c_ulonglong),
        ("MmPagedPoolEnd", ctypes.c_ulonglong),
        ("MmPagedPoolInformation", ctypes.c_ulonglong),
        ("MmPageSize", ctypes.c_ulonglong),
        ("MmSizeOfPagedPoolInBytes", ctypes.c_ulonglong),
        ("MmTotalCommitLimit", ctypes.c_ulonglong),
        ("MmTotalCommittedPages", ctypes.c_ulonglong),
        ("MmSharedCommit", ctypes.c_ulonglong),
        ("MmDriverCommit", ctypes.c_ulonglong),
        ("MmProcessCommit", ctypes.c_ulonglong),
        ("MmPagedPoolCommit", ctypes.c_ulonglong),
        ("MmExtendedCommit", ctypes.c_ulonglong),
        ("MmZeroedPageListHead", ctypes.c_ulonglong),
        ("MmFreePageListHead", ctypes.c_ulonglong),
        ("MmStandbyPageListHead", ctypes.c_ulonglong),
        ("MmModifiedPageListHead", ctypes.c_ulonglong),
        ("MmModifiedNoWritePageListHead", ctypes.c_ulonglong),
        ("MmAvailablePages", ctypes.c_ulonglong),
        ("MmResidentAvailablePages", ctypes.c_ulonglong),
        ("PoolTrackTable", ctypes.c_ulonglong),
        ("NonPagedPoolDescriptor", ctypes.c_ulonglong),
        ("MmHighestUserAddress", ctypes.c_ulonglong),
        ("MmSystemRangeStart", ctypes.c_ulonglong),
        ("MmUserProbeAddress", ctypes.c_ulonglong),
        ("KdPrintCircularBuffer", ctypes.c_ulonglong),
        ("KdPrintCircularBufferEnd", ctypes.c_ulonglong),
        ("KdPrintWritePointer", ctypes.c_ulonglong),
        ("KdPrintRolloverCount", ctypes.c_ulonglong),
        ("MmLoadedUserImageList", ctypes.c_ulonglong),
        ("NtBuildLab", ctypes.c_ulonglong),
        ("KiNormalSystemCall", ctypes.c_ulonglong),
        ("KiProcessorBlock", ctypes.c_ulonglong),
        ("MmUnloadedDrivers", ctypes.c_ulonglong),
        ("MmLastUnloadedDriver", ctypes.c_ulonglong),
        ("MmTriageActionTaken", ctypes.c_ulonglong),
        ("MmSpecialPoolTag", ctypes.c_ulonglong),
        ("KernelVerifier", ctypes.c_ulonglong),
        ("MmVerifierData", ctypes.c_ulonglong),
        ("MmAllocatedNonPagedPool", ctypes.c_ulonglong),
        ("MmPeakCommitment", ctypes.c_ulonglong),
        ("MmTotalCommitLimitMaximum", ctypes.c_ulonglong),
        ("CmNtCSDVersion", ctypes.c_ulonglong),
        ("MmPhysicalMemoryBlock", ctypes.c_ulonglong),
        ("MmSessionBase", ctypes.c_ulonglong),
        ("MmSessionSize", ctypes.c_ulonglong),
        ("MmSystemParentTablePage", ctypes.c_ulonglong),
        ("MmVirtualTranslationBase", ctypes.c_ulonglong),
        ("OffsetKThreadNextProcessor", ctypes.c_ushort),
        ("OffsetKThreadTeb", ctypes.c_ushort),
        ("OffsetKThreadKernelStack", ctypes.c_ushort),
        ("OffsetKThreadInitialStack", ctypes.c_ushort),
        ("OffsetKThreadApcProcess", ctypes.c_ushort),
        ("OffsetKThreadState", ctypes.c_ushort),
        ("OffsetKThreadBStore", ctypes.c_ushort),
        ("OffsetKThreadBStoreLimit", ctypes.c_ushort),
        ("SizeEProcess", ctypes.c_ushort),
        ("OffsetEprocessPeb", ctypes.c_ushort),
        ("OffsetEprocessParentCID", ctypes.c_ushort),
        ("OffsetEprocessDirectoryTableBase", ctypes.c_ushort),
        ("SizePrcb", ctypes.c_ushort),
        ("OffsetPrcbDpcRoutine", ctypes.c_ushort),
        ("OffsetPrcbCurrentThread", ctypes.c_ushort),
        ("OffsetPrcbMhz", ctypes.c_ushort),
        ("OffsetPrcbCpuType", ctypes.c_ushort),
        ("OffsetPrcbVendorString", ctypes.c_ushort),
        ("OffsetPrcbProcStateContext", ctypes.c_ushort),
        ("OffsetPrcbNumber", ctypes.c_ushort),
        ("SizeEThread", ctypes.c_ushort),
        ("L1tfHighPhysicalBitIndex", ctypes.c_ubyte),
        ("L1tfSwizzleBitIndex", ctypes.c_ubyte),
        ("Padding0", wintypes.DWORD),
        ("KdPrintCircularBufferPtr", ctypes.c_ulonglong),
        ("KdPrintBufferSize", ctypes.c_ulonglong),
        ("KeLoaderBlock", ctypes.c_ulonglong),
        ("SizePcr", ctypes.c_ushort),
        ("OffsetPcrSelfPcr", ctypes.c_ushort),
        ("OffsetPcrCurrentPrcb", ctypes.c_ushort),
        ("OffsetPcrContainedPrcb", ctypes.c_ushort),
        ("OffsetPcrInitialBStore", ctypes.c_ushort),
        ("OffsetPcrBStoreLimit", ctypes.c_ushort),
        ("OffsetPcrInitialStack", ctypes.c_ushort),
        ("OffsetPcrStackLimit", ctypes.c_ushort),
        ("OffsetPrcbPcrPage", ctypes.c_ushort),
        ("OffsetPrcbProcStateSpecialReg", ctypes.c_ushort),
        ("GdtR0Code", ctypes.c_ushort),
        ("GdtR0Data", ctypes.c_ushort),
        ("GdtR0Pcr", ctypes.c_ushort),
        ("GdtR3Code", ctypes.c_ushort),
        ("GdtR3Data", ctypes.c_ushort),
        ("GdtR3Teb", ctypes.c_ushort),
        ("GdtLdt", ctypes.c_ushort),
        ("GdtTss", ctypes.c_ushort),
        ("Gdt64R3CmCode", ctypes.c_ushort),
        ("Gdt64R3CmTeb", ctypes.c_ushort),
        ("IopNumTriageDumpDataBlocks", ctypes.c_ulonglong),
        ("IopTriageDumpDataBlocks", ctypes.c_ulonglong),
        ("VfCrashDataBlock", ctypes.c_ulonglong),
        ("MmBadPagesDetected", ctypes.c_ulonglong),
        ("MmZeroedPageSingleBitErrorsDetected", ctypes.c_ulonglong),
        ("EtwpDebuggerData", ctypes.c_ulonglong),
        ("OffsetPrcbContext", ctypes.c_ushort),
        ("OffsetPrcbMaxBreakpoints", ctypes.c_ushort),
        ("OffsetPrcbMaxWatchpoints", ctypes.c_ushort),
        ("OffsetKThreadStackLimit", wintypes.DWORD),
        ("OffsetKThreadStackBase", wintypes.DWORD),
        ("OffsetKThreadQueueListEntry", wintypes.DWORD),
        ("OffsetEThreadIrpList", wintypes.DWORD),
        ("OffsetPrcbIdleThread", ctypes.c_ushort),
        ("OffsetPrcbNormalDpcState", ctypes.c_ushort),
        ("OffsetPrcbDpcStack", ctypes.c_ushort),
        ("OffsetPrcbIsrStack", ctypes.c_ushort),
        ("SizeKDPC_STACK_FRAME", ctypes.c_ushort),
        ("OffsetKPriQueueThreadListHead", ctypes.c_ushort),
        ("OffsetKThreadWaitReason", ctypes.c_ushort),
        ("Padding1", ctypes.c_ushort),
        ("PteBase", ctypes.c_ulonglong),
        ("RetpolineStubFunctionTable", ctypes.c_ulonglong),
        ("RetpolineStubFunctionTableSize", wintypes.DWORD),
        ("RetpolineStubOffset", wintypes.DWORD),
        ("RetpolineStubSize", wintypes.DWORD),
        ("OffsetEProcessMmHotPatchContext", ctypes.c_ushort),
        ("OffsetKThreadShadowStackLimit", wintypes.DWORD),
        ("OffsetKThreadShadowStackBase", wintypes.DWORD),
        ("ShadowStackEnabled", ctypes.c_ulonglong),
        ("PointerAuthMask", ctypes.c_ulonglong),
        ("OffsetPrcbExceptionStack", ctypes.c_ushort),
    ]

#[repr(C)]
pub struct LIST_ENTRY64 {
    pub Flink: u64,
    pub Blink: u64,
}

#[repr(C)]
pub struct DBGKD_DEBUG_DATA_HEADER64 {
    pub List: LIST_ENTRY64,
    pub OwnerTag: u32,
    pub Size: u32,
}

#[repr(C)]
pub struct KDDEBUGGER_DATA64 {
    pub Header: DBGKD_DEBUG_DATA_HEADER64,
    pub KernBase: u64,
    pub BreakpointWithStatus: u64,
    pub SavedContext: u64,
    pub ThCallbackStack: u16,
    pub NextCallback: u16,
    pub FramePointer: u16,
    pub _bitfield: u16,
    pub KiCallUserMode: u64,
    pub KeUserCallbackDispatcher: u64,
    pub PsLoadedModuleList: u64,
    pub PsActiveProcessHead: u64,
    pub PspCidTable: u64,
    pub ExpSystemResourcesList: u64,
    pub ExpPagedPoolDescriptor: u64,
    pub ExpNumberOfPagedPools: u64,
    pub KeTimeIncrement: u64,
    pub KeBugCheckCallbackListHead: u64,
    pub KiBugcheckData: u64,
    pub IopErrorLogListHead: u64,
    pub ObpRootDirectoryObject: u64,
    pub ObpTypeObjectType: u64,
    pub MmSystemCacheStart: u64,
    pub MmSystemCacheEnd: u64,
    pub MmSystemCacheWs: u64,
    pub MmPfnDatabase: u64,
    pub MmSystemPtesStart: u64,
    pub MmSystemPtesEnd: u64,
    pub MmSubsectionBase: u64,
    pub MmNumberOfPagingFiles: u64,
    pub MmLowestPhysicalPage: u64,
    pub MmHighestPhysicalPage: u64,
    pub MmNumberOfPhysicalPages: u64,
    pub MmMaximumNonPagedPoolInBytes: u64,
    pub MmNonPagedSystemStart: u64,
    pub MmNonPagedPoolStart: u64,
    pub MmNonPagedPoolEnd: u64,
    pub MmPagedPoolStart: u64,
    pub MmPagedPoolEnd: u64,
    pub MmPagedPoolInformation: u64,
    pub MmPageSize: u64,
    pub MmSizeOfPagedPoolInBytes: u64,
    pub MmTotalCommitLimit: u64,
    pub MmTotalCommittedPages: u64,
    pub MmSharedCommit: u64,
    pub MmDriverCommit: u64,
    pub MmProcessCommit: u64,
    pub MmPagedPoolCommit: u64,
    pub MmExtendedCommit: u64,
    pub MmZeroedPageListHead: u64,
    pub MmFreePageListHead: u64,
    pub MmStandbyPageListHead: u64,
    pub MmModifiedPageListHead: u64,
    pub MmModifiedNoWritePageListHead: u64,
    pub MmAvailablePages: u64,
    pub MmResidentAvailablePages: u64,
    pub PoolTrackTable: u64,
    pub NonPagedPoolDescriptor: u64,
    pub MmHighestUserAddress: u64,
    pub MmSystemRangeStart: u64,
    pub MmUserProbeAddress: u64,
    pub KdPrintCircularBuffer: u64,
    pub KdPrintCircularBufferEnd: u64,
    pub KdPrintWritePointer: u64,
    pub KdPrintRolloverCount: u64,
    pub MmLoadedUserImageList: u64,
    pub NtBuildLab: u64,
    pub KiNormalSystemCall: u64,
    pub KiProcessorBlock: u64,
    pub MmUnloadedDrivers: u64,
    pub MmLastUnloadedDriver: u64,
    pub MmTriageActionTaken: u64,
    pub MmSpecialPoolTag: u64,
    pub KernelVerifier: u64,
    pub MmVerifierData: u64,
    pub MmAllocatedNonPagedPool: u64,
    pub MmPeakCommitment: u64,
    pub MmTotalCommitLimitMaximum: u64,
    pub CmNtCSDVersion: u64,
    pub MmPhysicalMemoryBlock: u64,
    pub MmSessionBase: u64,
    pub MmSessionSize: u64,
    pub MmSystemParentTablePage: u64,
    pub MmVirtualTranslationBase: u64,
    pub OffsetKThreadNextProcessor: u16,
    pub OffsetKThreadTeb: u16,
    pub OffsetKThreadKernelStack: u16,
    pub OffsetKThreadInitialStack: u16,
    pub OffsetKThreadApcProcess: u16,
    pub OffsetKThreadState: u16,
    pub OffsetKThreadBStore: u16,
    pub OffsetKThreadBStoreLimit: u16,
    pub SizeEProcess: u16,
    pub OffsetEprocessPeb: u16,
    pub OffsetEprocessParentCID: u16,
    pub OffsetEprocessDirectoryTableBase: u16,
    pub SizePrcb: u16,
    pub OffsetPrcbDpcRoutine: u16,
    pub OffsetPrcbCurrentThread: u16,
    pub OffsetPrcbMhz: u16,
    pub OffsetPrcbCpuType: u16,
    pub OffsetPrcbVendorString: u16,
    pub OffsetPrcbProcStateContext: u16,
    pub OffsetPrcbNumber: u16,
    pub SizeEThread: u16,
    pub L1tfHighPhysicalBitIndex: u8,
    pub L1tfSwizzleBitIndex: u8,
    pub Padding0: u32,
    pub KdPrintCircularBufferPtr: u64,
    pub KdPrintBufferSize: u64,
    pub KeLoaderBlock: u64,
    pub SizePcr: u16,
    pub OffsetPcrSelfPcr: u16,
    pub OffsetPcrCurrentPrcb: u16,
    pub OffsetPcrContainedPrcb: u16,
    pub OffsetPcrInitialBStore: u16,
    pub OffsetPcrBStoreLimit: u16,
    pub OffsetPcrInitialStack: u16,
    pub OffsetPcrStackLimit: u16,
    pub OffsetPrcbPcrPage: u16,
    pub OffsetPrcbProcStateSpecialReg: u16,
    pub GdtR0Code: u16,
    pub GdtR0Data: u16,
    pub GdtR0Pcr: u16,
    pub GdtR3Code: u16,
    pub GdtR3Data: u16,
    pub GdtR3Teb: u16,
    pub GdtLdt: u16,
    pub GdtTss: u16,
    pub Gdt64R3CmCode: u16,
    pub Gdt64R3CmTeb: u16,
    pub IopNumTriageDumpDataBlocks: u64,
    pub IopTriageDumpDataBlocks: u64,
    pub VfCrashDataBlock: u64,
    pub MmBadPagesDetected: u64,
    pub MmZeroedPageSingleBitErrorsDetected: u64,
    pub EtwpDebuggerData: u64,
    pub OffsetPrcbContext: u16,
    pub OffsetPrcbMaxBreakpoints: u16,
    pub OffsetPrcbMaxWatchpoints: u16,
    pub OffsetKThreadStackLimit: u32,
    pub OffsetKThreadStackBase: u32,
    pub OffsetKThreadQueueListEntry: u32,
    pub OffsetEThreadIrpList: u32,
    pub OffsetPrcbIdleThread: u16,
    pub OffsetPrcbNormalDpcState: u16,
    pub OffsetPrcbDpcStack: u16,
    pub OffsetPrcbIsrStack: u16,
    pub SizeKDPC_STACK_FRAME: u16,
    pub OffsetKPriQueueThreadListHead: u16,
    pub OffsetKThreadWaitReason: u16,
    pub Padding1: u16,
    pub PteBase: u64,
    pub RetpolineStubFunctionTable: u64,
    pub RetpolineStubFunctionTableSize: u32,
    pub RetpolineStubOffset: u32,
    pub RetpolineStubSize: u32,
    pub OffsetEProcessMmHotPatchContext: u16,
    pub OffsetKThreadShadowStackLimit: u32,
    pub OffsetKThreadShadowStackBase: u32,
    pub ShadowStackEnabled: u64,
    pub PointerAuthMask: u64,
    pub OffsetPrcbExceptionStack: u16,
}

import "golang.org/x/sys/windows"

type LIST_ENTRY64 struct {
	Flink uint64
	Blink uint64
}

type DBGKD_DEBUG_DATA_HEADER64 struct {
	List LIST_ENTRY64
	OwnerTag uint32
	Size uint32
}

type KDDEBUGGER_DATA64 struct {
	Header DBGKD_DEBUG_DATA_HEADER64
	KernBase uint64
	BreakpointWithStatus uint64
	SavedContext uint64
	ThCallbackStack uint16
	NextCallback uint16
	FramePointer uint16
	_bitfield uint16
	KiCallUserMode uint64
	KeUserCallbackDispatcher uint64
	PsLoadedModuleList uint64
	PsActiveProcessHead uint64
	PspCidTable uint64
	ExpSystemResourcesList uint64
	ExpPagedPoolDescriptor uint64
	ExpNumberOfPagedPools uint64
	KeTimeIncrement uint64
	KeBugCheckCallbackListHead uint64
	KiBugcheckData uint64
	IopErrorLogListHead uint64
	ObpRootDirectoryObject uint64
	ObpTypeObjectType uint64
	MmSystemCacheStart uint64
	MmSystemCacheEnd uint64
	MmSystemCacheWs uint64
	MmPfnDatabase uint64
	MmSystemPtesStart uint64
	MmSystemPtesEnd uint64
	MmSubsectionBase uint64
	MmNumberOfPagingFiles uint64
	MmLowestPhysicalPage uint64
	MmHighestPhysicalPage uint64
	MmNumberOfPhysicalPages uint64
	MmMaximumNonPagedPoolInBytes uint64
	MmNonPagedSystemStart uint64
	MmNonPagedPoolStart uint64
	MmNonPagedPoolEnd uint64
	MmPagedPoolStart uint64
	MmPagedPoolEnd uint64
	MmPagedPoolInformation uint64
	MmPageSize uint64
	MmSizeOfPagedPoolInBytes uint64
	MmTotalCommitLimit uint64
	MmTotalCommittedPages uint64
	MmSharedCommit uint64
	MmDriverCommit uint64
	MmProcessCommit uint64
	MmPagedPoolCommit uint64
	MmExtendedCommit uint64
	MmZeroedPageListHead uint64
	MmFreePageListHead uint64
	MmStandbyPageListHead uint64
	MmModifiedPageListHead uint64
	MmModifiedNoWritePageListHead uint64
	MmAvailablePages uint64
	MmResidentAvailablePages uint64
	PoolTrackTable uint64
	NonPagedPoolDescriptor uint64
	MmHighestUserAddress uint64
	MmSystemRangeStart uint64
	MmUserProbeAddress uint64
	KdPrintCircularBuffer uint64
	KdPrintCircularBufferEnd uint64
	KdPrintWritePointer uint64
	KdPrintRolloverCount uint64
	MmLoadedUserImageList uint64
	NtBuildLab uint64
	KiNormalSystemCall uint64
	KiProcessorBlock uint64
	MmUnloadedDrivers uint64
	MmLastUnloadedDriver uint64
	MmTriageActionTaken uint64
	MmSpecialPoolTag uint64
	KernelVerifier uint64
	MmVerifierData uint64
	MmAllocatedNonPagedPool uint64
	MmPeakCommitment uint64
	MmTotalCommitLimitMaximum uint64
	CmNtCSDVersion uint64
	MmPhysicalMemoryBlock uint64
	MmSessionBase uint64
	MmSessionSize uint64
	MmSystemParentTablePage uint64
	MmVirtualTranslationBase uint64
	OffsetKThreadNextProcessor uint16
	OffsetKThreadTeb uint16
	OffsetKThreadKernelStack uint16
	OffsetKThreadInitialStack uint16
	OffsetKThreadApcProcess uint16
	OffsetKThreadState uint16
	OffsetKThreadBStore uint16
	OffsetKThreadBStoreLimit uint16
	SizeEProcess uint16
	OffsetEprocessPeb uint16
	OffsetEprocessParentCID uint16
	OffsetEprocessDirectoryTableBase uint16
	SizePrcb uint16
	OffsetPrcbDpcRoutine uint16
	OffsetPrcbCurrentThread uint16
	OffsetPrcbMhz uint16
	OffsetPrcbCpuType uint16
	OffsetPrcbVendorString uint16
	OffsetPrcbProcStateContext uint16
	OffsetPrcbNumber uint16
	SizeEThread uint16
	L1tfHighPhysicalBitIndex byte
	L1tfSwizzleBitIndex byte
	Padding0 uint32
	KdPrintCircularBufferPtr uint64
	KdPrintBufferSize uint64
	KeLoaderBlock uint64
	SizePcr uint16
	OffsetPcrSelfPcr uint16
	OffsetPcrCurrentPrcb uint16
	OffsetPcrContainedPrcb uint16
	OffsetPcrInitialBStore uint16
	OffsetPcrBStoreLimit uint16
	OffsetPcrInitialStack uint16
	OffsetPcrStackLimit uint16
	OffsetPrcbPcrPage uint16
	OffsetPrcbProcStateSpecialReg uint16
	GdtR0Code uint16
	GdtR0Data uint16
	GdtR0Pcr uint16
	GdtR3Code uint16
	GdtR3Data uint16
	GdtR3Teb uint16
	GdtLdt uint16
	GdtTss uint16
	Gdt64R3CmCode uint16
	Gdt64R3CmTeb uint16
	IopNumTriageDumpDataBlocks uint64
	IopTriageDumpDataBlocks uint64
	VfCrashDataBlock uint64
	MmBadPagesDetected uint64
	MmZeroedPageSingleBitErrorsDetected uint64
	EtwpDebuggerData uint64
	OffsetPrcbContext uint16
	OffsetPrcbMaxBreakpoints uint16
	OffsetPrcbMaxWatchpoints uint16
	OffsetKThreadStackLimit uint32
	OffsetKThreadStackBase uint32
	OffsetKThreadQueueListEntry uint32
	OffsetEThreadIrpList uint32
	OffsetPrcbIdleThread uint16
	OffsetPrcbNormalDpcState uint16
	OffsetPrcbDpcStack uint16
	OffsetPrcbIsrStack uint16
	SizeKDPC_STACK_FRAME uint16
	OffsetKPriQueueThreadListHead uint16
	OffsetKThreadWaitReason uint16
	Padding1 uint16
	PteBase uint64
	RetpolineStubFunctionTable uint64
	RetpolineStubFunctionTableSize uint32
	RetpolineStubOffset uint32
	RetpolineStubSize uint32
	OffsetEProcessMmHotPatchContext uint16
	OffsetKThreadShadowStackLimit uint32
	OffsetKThreadShadowStackBase uint32
	ShadowStackEnabled uint64
	PointerAuthMask uint64
	OffsetPrcbExceptionStack uint16
}

type
  LIST_ENTRY64 = record
    Flink: UInt64;
    Blink: UInt64;
  end;

  DBGKD_DEBUG_DATA_HEADER64 = record
    List: LIST_ENTRY64;
    OwnerTag: DWORD;
    Size: DWORD;
  end;

  KDDEBUGGER_DATA64 = record
    Header: DBGKD_DEBUG_DATA_HEADER64;
    KernBase: UInt64;
    BreakpointWithStatus: UInt64;
    SavedContext: UInt64;
    ThCallbackStack: Word;
    NextCallback: Word;
    FramePointer: Word;
    _bitfield: Word;
    KiCallUserMode: UInt64;
    KeUserCallbackDispatcher: UInt64;
    PsLoadedModuleList: UInt64;
    PsActiveProcessHead: UInt64;
    PspCidTable: UInt64;
    ExpSystemResourcesList: UInt64;
    ExpPagedPoolDescriptor: UInt64;
    ExpNumberOfPagedPools: UInt64;
    KeTimeIncrement: UInt64;
    KeBugCheckCallbackListHead: UInt64;
    KiBugcheckData: UInt64;
    IopErrorLogListHead: UInt64;
    ObpRootDirectoryObject: UInt64;
    ObpTypeObjectType: UInt64;
    MmSystemCacheStart: UInt64;
    MmSystemCacheEnd: UInt64;
    MmSystemCacheWs: UInt64;
    MmPfnDatabase: UInt64;
    MmSystemPtesStart: UInt64;
    MmSystemPtesEnd: UInt64;
    MmSubsectionBase: UInt64;
    MmNumberOfPagingFiles: UInt64;
    MmLowestPhysicalPage: UInt64;
    MmHighestPhysicalPage: UInt64;
    MmNumberOfPhysicalPages: UInt64;
    MmMaximumNonPagedPoolInBytes: UInt64;
    MmNonPagedSystemStart: UInt64;
    MmNonPagedPoolStart: UInt64;
    MmNonPagedPoolEnd: UInt64;
    MmPagedPoolStart: UInt64;
    MmPagedPoolEnd: UInt64;
    MmPagedPoolInformation: UInt64;
    MmPageSize: UInt64;
    MmSizeOfPagedPoolInBytes: UInt64;
    MmTotalCommitLimit: UInt64;
    MmTotalCommittedPages: UInt64;
    MmSharedCommit: UInt64;
    MmDriverCommit: UInt64;
    MmProcessCommit: UInt64;
    MmPagedPoolCommit: UInt64;
    MmExtendedCommit: UInt64;
    MmZeroedPageListHead: UInt64;
    MmFreePageListHead: UInt64;
    MmStandbyPageListHead: UInt64;
    MmModifiedPageListHead: UInt64;
    MmModifiedNoWritePageListHead: UInt64;
    MmAvailablePages: UInt64;
    MmResidentAvailablePages: UInt64;
    PoolTrackTable: UInt64;
    NonPagedPoolDescriptor: UInt64;
    MmHighestUserAddress: UInt64;
    MmSystemRangeStart: UInt64;
    MmUserProbeAddress: UInt64;
    KdPrintCircularBuffer: UInt64;
    KdPrintCircularBufferEnd: UInt64;
    KdPrintWritePointer: UInt64;
    KdPrintRolloverCount: UInt64;
    MmLoadedUserImageList: UInt64;
    NtBuildLab: UInt64;
    KiNormalSystemCall: UInt64;
    KiProcessorBlock: UInt64;
    MmUnloadedDrivers: UInt64;
    MmLastUnloadedDriver: UInt64;
    MmTriageActionTaken: UInt64;
    MmSpecialPoolTag: UInt64;
    KernelVerifier: UInt64;
    MmVerifierData: UInt64;
    MmAllocatedNonPagedPool: UInt64;
    MmPeakCommitment: UInt64;
    MmTotalCommitLimitMaximum: UInt64;
    CmNtCSDVersion: UInt64;
    MmPhysicalMemoryBlock: UInt64;
    MmSessionBase: UInt64;
    MmSessionSize: UInt64;
    MmSystemParentTablePage: UInt64;
    MmVirtualTranslationBase: UInt64;
    OffsetKThreadNextProcessor: Word;
    OffsetKThreadTeb: Word;
    OffsetKThreadKernelStack: Word;
    OffsetKThreadInitialStack: Word;
    OffsetKThreadApcProcess: Word;
    OffsetKThreadState: Word;
    OffsetKThreadBStore: Word;
    OffsetKThreadBStoreLimit: Word;
    SizeEProcess: Word;
    OffsetEprocessPeb: Word;
    OffsetEprocessParentCID: Word;
    OffsetEprocessDirectoryTableBase: Word;
    SizePrcb: Word;
    OffsetPrcbDpcRoutine: Word;
    OffsetPrcbCurrentThread: Word;
    OffsetPrcbMhz: Word;
    OffsetPrcbCpuType: Word;
    OffsetPrcbVendorString: Word;
    OffsetPrcbProcStateContext: Word;
    OffsetPrcbNumber: Word;
    SizeEThread: Word;
    L1tfHighPhysicalBitIndex: Byte;
    L1tfSwizzleBitIndex: Byte;
    Padding0: DWORD;
    KdPrintCircularBufferPtr: UInt64;
    KdPrintBufferSize: UInt64;
    KeLoaderBlock: UInt64;
    SizePcr: Word;
    OffsetPcrSelfPcr: Word;
    OffsetPcrCurrentPrcb: Word;
    OffsetPcrContainedPrcb: Word;
    OffsetPcrInitialBStore: Word;
    OffsetPcrBStoreLimit: Word;
    OffsetPcrInitialStack: Word;
    OffsetPcrStackLimit: Word;
    OffsetPrcbPcrPage: Word;
    OffsetPrcbProcStateSpecialReg: Word;
    GdtR0Code: Word;
    GdtR0Data: Word;
    GdtR0Pcr: Word;
    GdtR3Code: Word;
    GdtR3Data: Word;
    GdtR3Teb: Word;
    GdtLdt: Word;
    GdtTss: Word;
    Gdt64R3CmCode: Word;
    Gdt64R3CmTeb: Word;
    IopNumTriageDumpDataBlocks: UInt64;
    IopTriageDumpDataBlocks: UInt64;
    VfCrashDataBlock: UInt64;
    MmBadPagesDetected: UInt64;
    MmZeroedPageSingleBitErrorsDetected: UInt64;
    EtwpDebuggerData: UInt64;
    OffsetPrcbContext: Word;
    OffsetPrcbMaxBreakpoints: Word;
    OffsetPrcbMaxWatchpoints: Word;
    OffsetKThreadStackLimit: DWORD;
    OffsetKThreadStackBase: DWORD;
    OffsetKThreadQueueListEntry: DWORD;
    OffsetEThreadIrpList: DWORD;
    OffsetPrcbIdleThread: Word;
    OffsetPrcbNormalDpcState: Word;
    OffsetPrcbDpcStack: Word;
    OffsetPrcbIsrStack: Word;
    SizeKDPC_STACK_FRAME: Word;
    OffsetKPriQueueThreadListHead: Word;
    OffsetKThreadWaitReason: Word;
    Padding1: Word;
    PteBase: UInt64;
    RetpolineStubFunctionTable: UInt64;
    RetpolineStubFunctionTableSize: DWORD;
    RetpolineStubOffset: DWORD;
    RetpolineStubSize: DWORD;
    OffsetEProcessMmHotPatchContext: Word;
    OffsetKThreadShadowStackLimit: DWORD;
    OffsetKThreadShadowStackBase: DWORD;
    ShadowStackEnabled: UInt64;
    PointerAuthMask: UInt64;
    OffsetPrcbExceptionStack: Word;
  end;

const LIST_ENTRY64 = extern struct {
    Flink: u64,
    Blink: u64,
};

const DBGKD_DEBUG_DATA_HEADER64 = extern struct {
    List: LIST_ENTRY64,
    OwnerTag: u32,
    Size: u32,
};

const KDDEBUGGER_DATA64 = extern struct {
    Header: DBGKD_DEBUG_DATA_HEADER64,
    KernBase: u64,
    BreakpointWithStatus: u64,
    SavedContext: u64,
    ThCallbackStack: u16,
    NextCallback: u16,
    FramePointer: u16,
    _bitfield: u16,
    KiCallUserMode: u64,
    KeUserCallbackDispatcher: u64,
    PsLoadedModuleList: u64,
    PsActiveProcessHead: u64,
    PspCidTable: u64,
    ExpSystemResourcesList: u64,
    ExpPagedPoolDescriptor: u64,
    ExpNumberOfPagedPools: u64,
    KeTimeIncrement: u64,
    KeBugCheckCallbackListHead: u64,
    KiBugcheckData: u64,
    IopErrorLogListHead: u64,
    ObpRootDirectoryObject: u64,
    ObpTypeObjectType: u64,
    MmSystemCacheStart: u64,
    MmSystemCacheEnd: u64,
    MmSystemCacheWs: u64,
    MmPfnDatabase: u64,
    MmSystemPtesStart: u64,
    MmSystemPtesEnd: u64,
    MmSubsectionBase: u64,
    MmNumberOfPagingFiles: u64,
    MmLowestPhysicalPage: u64,
    MmHighestPhysicalPage: u64,
    MmNumberOfPhysicalPages: u64,
    MmMaximumNonPagedPoolInBytes: u64,
    MmNonPagedSystemStart: u64,
    MmNonPagedPoolStart: u64,
    MmNonPagedPoolEnd: u64,
    MmPagedPoolStart: u64,
    MmPagedPoolEnd: u64,
    MmPagedPoolInformation: u64,
    MmPageSize: u64,
    MmSizeOfPagedPoolInBytes: u64,
    MmTotalCommitLimit: u64,
    MmTotalCommittedPages: u64,
    MmSharedCommit: u64,
    MmDriverCommit: u64,
    MmProcessCommit: u64,
    MmPagedPoolCommit: u64,
    MmExtendedCommit: u64,
    MmZeroedPageListHead: u64,
    MmFreePageListHead: u64,
    MmStandbyPageListHead: u64,
    MmModifiedPageListHead: u64,
    MmModifiedNoWritePageListHead: u64,
    MmAvailablePages: u64,
    MmResidentAvailablePages: u64,
    PoolTrackTable: u64,
    NonPagedPoolDescriptor: u64,
    MmHighestUserAddress: u64,
    MmSystemRangeStart: u64,
    MmUserProbeAddress: u64,
    KdPrintCircularBuffer: u64,
    KdPrintCircularBufferEnd: u64,
    KdPrintWritePointer: u64,
    KdPrintRolloverCount: u64,
    MmLoadedUserImageList: u64,
    NtBuildLab: u64,
    KiNormalSystemCall: u64,
    KiProcessorBlock: u64,
    MmUnloadedDrivers: u64,
    MmLastUnloadedDriver: u64,
    MmTriageActionTaken: u64,
    MmSpecialPoolTag: u64,
    KernelVerifier: u64,
    MmVerifierData: u64,
    MmAllocatedNonPagedPool: u64,
    MmPeakCommitment: u64,
    MmTotalCommitLimitMaximum: u64,
    CmNtCSDVersion: u64,
    MmPhysicalMemoryBlock: u64,
    MmSessionBase: u64,
    MmSessionSize: u64,
    MmSystemParentTablePage: u64,
    MmVirtualTranslationBase: u64,
    OffsetKThreadNextProcessor: u16,
    OffsetKThreadTeb: u16,
    OffsetKThreadKernelStack: u16,
    OffsetKThreadInitialStack: u16,
    OffsetKThreadApcProcess: u16,
    OffsetKThreadState: u16,
    OffsetKThreadBStore: u16,
    OffsetKThreadBStoreLimit: u16,
    SizeEProcess: u16,
    OffsetEprocessPeb: u16,
    OffsetEprocessParentCID: u16,
    OffsetEprocessDirectoryTableBase: u16,
    SizePrcb: u16,
    OffsetPrcbDpcRoutine: u16,
    OffsetPrcbCurrentThread: u16,
    OffsetPrcbMhz: u16,
    OffsetPrcbCpuType: u16,
    OffsetPrcbVendorString: u16,
    OffsetPrcbProcStateContext: u16,
    OffsetPrcbNumber: u16,
    SizeEThread: u16,
    L1tfHighPhysicalBitIndex: u8,
    L1tfSwizzleBitIndex: u8,
    Padding0: u32,
    KdPrintCircularBufferPtr: u64,
    KdPrintBufferSize: u64,
    KeLoaderBlock: u64,
    SizePcr: u16,
    OffsetPcrSelfPcr: u16,
    OffsetPcrCurrentPrcb: u16,
    OffsetPcrContainedPrcb: u16,
    OffsetPcrInitialBStore: u16,
    OffsetPcrBStoreLimit: u16,
    OffsetPcrInitialStack: u16,
    OffsetPcrStackLimit: u16,
    OffsetPrcbPcrPage: u16,
    OffsetPrcbProcStateSpecialReg: u16,
    GdtR0Code: u16,
    GdtR0Data: u16,
    GdtR0Pcr: u16,
    GdtR3Code: u16,
    GdtR3Data: u16,
    GdtR3Teb: u16,
    GdtLdt: u16,
    GdtTss: u16,
    Gdt64R3CmCode: u16,
    Gdt64R3CmTeb: u16,
    IopNumTriageDumpDataBlocks: u64,
    IopTriageDumpDataBlocks: u64,
    VfCrashDataBlock: u64,
    MmBadPagesDetected: u64,
    MmZeroedPageSingleBitErrorsDetected: u64,
    EtwpDebuggerData: u64,
    OffsetPrcbContext: u16,
    OffsetPrcbMaxBreakpoints: u16,
    OffsetPrcbMaxWatchpoints: u16,
    OffsetKThreadStackLimit: u32,
    OffsetKThreadStackBase: u32,
    OffsetKThreadQueueListEntry: u32,
    OffsetEThreadIrpList: u32,
    OffsetPrcbIdleThread: u16,
    OffsetPrcbNormalDpcState: u16,
    OffsetPrcbDpcStack: u16,
    OffsetPrcbIsrStack: u16,
    SizeKDPC_STACK_FRAME: u16,
    OffsetKPriQueueThreadListHead: u16,
    OffsetKThreadWaitReason: u16,
    Padding1: u16,
    PteBase: u64,
    RetpolineStubFunctionTable: u64,
    RetpolineStubFunctionTableSize: u32,
    RetpolineStubOffset: u32,
    RetpolineStubSize: u32,
    OffsetEProcessMmHotPatchContext: u16,
    OffsetKThreadShadowStackLimit: u32,
    OffsetKThreadShadowStackBase: u32,
    ShadowStackEnabled: u64,
    PointerAuthMask: u64,
    OffsetPrcbExceptionStack: u16,
};

type
  LIST_ENTRY64 {.bycopy.} = object
    Flink: uint64
    Blink: uint64

  DBGKD_DEBUG_DATA_HEADER64 {.bycopy.} = object
    List: LIST_ENTRY64
    OwnerTag: uint32
    Size: uint32

  KDDEBUGGER_DATA64 {.bycopy.} = object
    Header: DBGKD_DEBUG_DATA_HEADER64
    KernBase: uint64
    BreakpointWithStatus: uint64
    SavedContext: uint64
    ThCallbackStack: uint16
    NextCallback: uint16
    FramePointer: uint16
    _bitfield: uint16
    KiCallUserMode: uint64
    KeUserCallbackDispatcher: uint64
    PsLoadedModuleList: uint64
    PsActiveProcessHead: uint64
    PspCidTable: uint64
    ExpSystemResourcesList: uint64
    ExpPagedPoolDescriptor: uint64
    ExpNumberOfPagedPools: uint64
    KeTimeIncrement: uint64
    KeBugCheckCallbackListHead: uint64
    KiBugcheckData: uint64
    IopErrorLogListHead: uint64
    ObpRootDirectoryObject: uint64
    ObpTypeObjectType: uint64
    MmSystemCacheStart: uint64
    MmSystemCacheEnd: uint64
    MmSystemCacheWs: uint64
    MmPfnDatabase: uint64
    MmSystemPtesStart: uint64
    MmSystemPtesEnd: uint64
    MmSubsectionBase: uint64
    MmNumberOfPagingFiles: uint64
    MmLowestPhysicalPage: uint64
    MmHighestPhysicalPage: uint64
    MmNumberOfPhysicalPages: uint64
    MmMaximumNonPagedPoolInBytes: uint64
    MmNonPagedSystemStart: uint64
    MmNonPagedPoolStart: uint64
    MmNonPagedPoolEnd: uint64
    MmPagedPoolStart: uint64
    MmPagedPoolEnd: uint64
    MmPagedPoolInformation: uint64
    MmPageSize: uint64
    MmSizeOfPagedPoolInBytes: uint64
    MmTotalCommitLimit: uint64
    MmTotalCommittedPages: uint64
    MmSharedCommit: uint64
    MmDriverCommit: uint64
    MmProcessCommit: uint64
    MmPagedPoolCommit: uint64
    MmExtendedCommit: uint64
    MmZeroedPageListHead: uint64
    MmFreePageListHead: uint64
    MmStandbyPageListHead: uint64
    MmModifiedPageListHead: uint64
    MmModifiedNoWritePageListHead: uint64
    MmAvailablePages: uint64
    MmResidentAvailablePages: uint64
    PoolTrackTable: uint64
    NonPagedPoolDescriptor: uint64
    MmHighestUserAddress: uint64
    MmSystemRangeStart: uint64
    MmUserProbeAddress: uint64
    KdPrintCircularBuffer: uint64
    KdPrintCircularBufferEnd: uint64
    KdPrintWritePointer: uint64
    KdPrintRolloverCount: uint64
    MmLoadedUserImageList: uint64
    NtBuildLab: uint64
    KiNormalSystemCall: uint64
    KiProcessorBlock: uint64
    MmUnloadedDrivers: uint64
    MmLastUnloadedDriver: uint64
    MmTriageActionTaken: uint64
    MmSpecialPoolTag: uint64
    KernelVerifier: uint64
    MmVerifierData: uint64
    MmAllocatedNonPagedPool: uint64
    MmPeakCommitment: uint64
    MmTotalCommitLimitMaximum: uint64
    CmNtCSDVersion: uint64
    MmPhysicalMemoryBlock: uint64
    MmSessionBase: uint64
    MmSessionSize: uint64
    MmSystemParentTablePage: uint64
    MmVirtualTranslationBase: uint64
    OffsetKThreadNextProcessor: uint16
    OffsetKThreadTeb: uint16
    OffsetKThreadKernelStack: uint16
    OffsetKThreadInitialStack: uint16
    OffsetKThreadApcProcess: uint16
    OffsetKThreadState: uint16
    OffsetKThreadBStore: uint16
    OffsetKThreadBStoreLimit: uint16
    SizeEProcess: uint16
    OffsetEprocessPeb: uint16
    OffsetEprocessParentCID: uint16
    OffsetEprocessDirectoryTableBase: uint16
    SizePrcb: uint16
    OffsetPrcbDpcRoutine: uint16
    OffsetPrcbCurrentThread: uint16
    OffsetPrcbMhz: uint16
    OffsetPrcbCpuType: uint16
    OffsetPrcbVendorString: uint16
    OffsetPrcbProcStateContext: uint16
    OffsetPrcbNumber: uint16
    SizeEThread: uint16
    L1tfHighPhysicalBitIndex: uint8
    L1tfSwizzleBitIndex: uint8
    Padding0: uint32
    KdPrintCircularBufferPtr: uint64
    KdPrintBufferSize: uint64
    KeLoaderBlock: uint64
    SizePcr: uint16
    OffsetPcrSelfPcr: uint16
    OffsetPcrCurrentPrcb: uint16
    OffsetPcrContainedPrcb: uint16
    OffsetPcrInitialBStore: uint16
    OffsetPcrBStoreLimit: uint16
    OffsetPcrInitialStack: uint16
    OffsetPcrStackLimit: uint16
    OffsetPrcbPcrPage: uint16
    OffsetPrcbProcStateSpecialReg: uint16
    GdtR0Code: uint16
    GdtR0Data: uint16
    GdtR0Pcr: uint16
    GdtR3Code: uint16
    GdtR3Data: uint16
    GdtR3Teb: uint16
    GdtLdt: uint16
    GdtTss: uint16
    Gdt64R3CmCode: uint16
    Gdt64R3CmTeb: uint16
    IopNumTriageDumpDataBlocks: uint64
    IopTriageDumpDataBlocks: uint64
    VfCrashDataBlock: uint64
    MmBadPagesDetected: uint64
    MmZeroedPageSingleBitErrorsDetected: uint64
    EtwpDebuggerData: uint64
    OffsetPrcbContext: uint16
    OffsetPrcbMaxBreakpoints: uint16
    OffsetPrcbMaxWatchpoints: uint16
    OffsetKThreadStackLimit: uint32
    OffsetKThreadStackBase: uint32
    OffsetKThreadQueueListEntry: uint32
    OffsetEThreadIrpList: uint32
    OffsetPrcbIdleThread: uint16
    OffsetPrcbNormalDpcState: uint16
    OffsetPrcbDpcStack: uint16
    OffsetPrcbIsrStack: uint16
    SizeKDPC_STACK_FRAME: uint16
    OffsetKPriQueueThreadListHead: uint16
    OffsetKThreadWaitReason: uint16
    Padding1: uint16
    PteBase: uint64
    RetpolineStubFunctionTable: uint64
    RetpolineStubFunctionTableSize: uint32
    RetpolineStubOffset: uint32
    RetpolineStubSize: uint32
    OffsetEProcessMmHotPatchContext: uint16
    OffsetKThreadShadowStackLimit: uint32
    OffsetKThreadShadowStackBase: uint32
    ShadowStackEnabled: uint64
    PointerAuthMask: uint64
    OffsetPrcbExceptionStack: uint16

struct LIST_ENTRY64
{
    ulong Flink;
    ulong Blink;
}

struct DBGKD_DEBUG_DATA_HEADER64
{
    LIST_ENTRY64 List;
    uint OwnerTag;
    uint Size;
}

struct KDDEBUGGER_DATA64
{
    DBGKD_DEBUG_DATA_HEADER64 Header;
    ulong KernBase;
    ulong BreakpointWithStatus;
    ulong SavedContext;
    ushort ThCallbackStack;
    ushort NextCallback;
    ushort FramePointer;
    ushort _bitfield;
    ulong KiCallUserMode;
    ulong KeUserCallbackDispatcher;
    ulong PsLoadedModuleList;
    ulong PsActiveProcessHead;
    ulong PspCidTable;
    ulong ExpSystemResourcesList;
    ulong ExpPagedPoolDescriptor;
    ulong ExpNumberOfPagedPools;
    ulong KeTimeIncrement;
    ulong KeBugCheckCallbackListHead;
    ulong KiBugcheckData;
    ulong IopErrorLogListHead;
    ulong ObpRootDirectoryObject;
    ulong ObpTypeObjectType;
    ulong MmSystemCacheStart;
    ulong MmSystemCacheEnd;
    ulong MmSystemCacheWs;
    ulong MmPfnDatabase;
    ulong MmSystemPtesStart;
    ulong MmSystemPtesEnd;
    ulong MmSubsectionBase;
    ulong MmNumberOfPagingFiles;
    ulong MmLowestPhysicalPage;
    ulong MmHighestPhysicalPage;
    ulong MmNumberOfPhysicalPages;
    ulong MmMaximumNonPagedPoolInBytes;
    ulong MmNonPagedSystemStart;
    ulong MmNonPagedPoolStart;
    ulong MmNonPagedPoolEnd;
    ulong MmPagedPoolStart;
    ulong MmPagedPoolEnd;
    ulong MmPagedPoolInformation;
    ulong MmPageSize;
    ulong MmSizeOfPagedPoolInBytes;
    ulong MmTotalCommitLimit;
    ulong MmTotalCommittedPages;
    ulong MmSharedCommit;
    ulong MmDriverCommit;
    ulong MmProcessCommit;
    ulong MmPagedPoolCommit;
    ulong MmExtendedCommit;
    ulong MmZeroedPageListHead;
    ulong MmFreePageListHead;
    ulong MmStandbyPageListHead;
    ulong MmModifiedPageListHead;
    ulong MmModifiedNoWritePageListHead;
    ulong MmAvailablePages;
    ulong MmResidentAvailablePages;
    ulong PoolTrackTable;
    ulong NonPagedPoolDescriptor;
    ulong MmHighestUserAddress;
    ulong MmSystemRangeStart;
    ulong MmUserProbeAddress;
    ulong KdPrintCircularBuffer;
    ulong KdPrintCircularBufferEnd;
    ulong KdPrintWritePointer;
    ulong KdPrintRolloverCount;
    ulong MmLoadedUserImageList;
    ulong NtBuildLab;
    ulong KiNormalSystemCall;
    ulong KiProcessorBlock;
    ulong MmUnloadedDrivers;
    ulong MmLastUnloadedDriver;
    ulong MmTriageActionTaken;
    ulong MmSpecialPoolTag;
    ulong KernelVerifier;
    ulong MmVerifierData;
    ulong MmAllocatedNonPagedPool;
    ulong MmPeakCommitment;
    ulong MmTotalCommitLimitMaximum;
    ulong CmNtCSDVersion;
    ulong MmPhysicalMemoryBlock;
    ulong MmSessionBase;
    ulong MmSessionSize;
    ulong MmSystemParentTablePage;
    ulong MmVirtualTranslationBase;
    ushort OffsetKThreadNextProcessor;
    ushort OffsetKThreadTeb;
    ushort OffsetKThreadKernelStack;
    ushort OffsetKThreadInitialStack;
    ushort OffsetKThreadApcProcess;
    ushort OffsetKThreadState;
    ushort OffsetKThreadBStore;
    ushort OffsetKThreadBStoreLimit;
    ushort SizeEProcess;
    ushort OffsetEprocessPeb;
    ushort OffsetEprocessParentCID;
    ushort OffsetEprocessDirectoryTableBase;
    ushort SizePrcb;
    ushort OffsetPrcbDpcRoutine;
    ushort OffsetPrcbCurrentThread;
    ushort OffsetPrcbMhz;
    ushort OffsetPrcbCpuType;
    ushort OffsetPrcbVendorString;
    ushort OffsetPrcbProcStateContext;
    ushort OffsetPrcbNumber;
    ushort SizeEThread;
    ubyte L1tfHighPhysicalBitIndex;
    ubyte L1tfSwizzleBitIndex;
    uint Padding0;
    ulong KdPrintCircularBufferPtr;
    ulong KdPrintBufferSize;
    ulong KeLoaderBlock;
    ushort SizePcr;
    ushort OffsetPcrSelfPcr;
    ushort OffsetPcrCurrentPrcb;
    ushort OffsetPcrContainedPrcb;
    ushort OffsetPcrInitialBStore;
    ushort OffsetPcrBStoreLimit;
    ushort OffsetPcrInitialStack;
    ushort OffsetPcrStackLimit;
    ushort OffsetPrcbPcrPage;
    ushort OffsetPrcbProcStateSpecialReg;
    ushort GdtR0Code;
    ushort GdtR0Data;
    ushort GdtR0Pcr;
    ushort GdtR3Code;
    ushort GdtR3Data;
    ushort GdtR3Teb;
    ushort GdtLdt;
    ushort GdtTss;
    ushort Gdt64R3CmCode;
    ushort Gdt64R3CmTeb;
    ulong IopNumTriageDumpDataBlocks;
    ulong IopTriageDumpDataBlocks;
    ulong VfCrashDataBlock;
    ulong MmBadPagesDetected;
    ulong MmZeroedPageSingleBitErrorsDetected;
    ulong EtwpDebuggerData;
    ushort OffsetPrcbContext;
    ushort OffsetPrcbMaxBreakpoints;
    ushort OffsetPrcbMaxWatchpoints;
    uint OffsetKThreadStackLimit;
    uint OffsetKThreadStackBase;
    uint OffsetKThreadQueueListEntry;
    uint OffsetEThreadIrpList;
    ushort OffsetPrcbIdleThread;
    ushort OffsetPrcbNormalDpcState;
    ushort OffsetPrcbDpcStack;
    ushort OffsetPrcbIsrStack;
    ushort SizeKDPC_STACK_FRAME;
    ushort OffsetKPriQueueThreadListHead;
    ushort OffsetKThreadWaitReason;
    ushort Padding1;
    ulong PteBase;
    ulong RetpolineStubFunctionTable;
    uint RetpolineStubFunctionTableSize;
    uint RetpolineStubOffset;
    uint RetpolineStubSize;
    ushort OffsetEProcessMmHotPatchContext;
    uint OffsetKThreadShadowStackLimit;
    uint OffsetKThreadShadowStackBase;
    ulong ShadowStackEnabled;
    ulong PointerAuthMask;
    ushort OffsetPrcbExceptionStack;
}