
ClearTypes

AddType  uint64_t, QWORD
AddType  uint32_t, DWORD
AddType  uint16_t, WORD
AddType  uint8_t,  BYTE
AddType  wchar_t,  UNICODE
AddType  char,     ASCII

AddStruct  LIST_ENTRY32
  AppendMember DWORD,FLink
  AppendMember DWORD,BLink
SizeofType LIST_ENTRY32

AddStruct  LIST_ENTRY64
  AppendMember QWORD,FLink
  AppendMember QWORD,BLink
SizeofType LIST_ENTRY64

AddStruct  STRING32
  AppendMember WORD,Length
  AppendMember WORD,MaxLength
  AppendMember DWORD,Buffer
SizeofType STRING32

AddStruct UNICODE_STRING
  AppendMember WORD,Length
  AppendMember WORD,MaxLength
  AppendMember DWORD,Padding
  AppendMember QWORD,Buffer
SizeofType UNICODE_STRING

AddStruct CLIENT_ID64
  AppendMember QWORD,UniqueProcess
  AppendMember QWORD,UniqueThread
SizeofType CLIENT_ID64

AddStruct CLIENT_ID32
  AppendMember DWORD,UniqueProcess
  AppendMember DWORD,UniqueThread
SizeofType CLIENT_ID32

AddStruct FILETIME
  AppendMember DWORD,LowDateTime
  AppendMember DWORD,HighDateTime
SizeofType FILETIME

AddStruct SYSTEMTIME
  AppendMember WORD,Year
  AppendMember WORD,Month
  AppendMember WORD,DayOfWeek
  AppendMember WORD,Day
  AppendMember WORD,Hour
  AppendMember WORD,Minute
  AppendMember WORD,Second
  AppendMember WORD,Milliseconds
SizeofType SYSTEMTIME

//-----------------------------------------------------------

AddStruct PEB32
  AppendMember BYTE,InheritedAddressSpace
  AppendMember BYTE,ReadImageFileExecOptions
  AppendMember BYTE,BeingDebugged
  AppendMember BYTE,BitField
  AppendMember DWORD,Mutant
  AppendMember DWORD,ImageBaseAddress
  AppendMember DWORD,Ldr
  AppendMember DWORD,ProcessParameters
  AppendMember DWORD,SubSystemData
  AppendMember DWORD,ProcessHeap
  AppendMember DWORD,FastPEBLock
  AppendMember DWORD,AtlThunkSListPtr
  AppendMember DWORD,IFEOKey
  AppendMember DWORD,CrossProcessFlags
  AppendMember DWORD,KernelCallbackTable
  AppendMember DWORD,SystemReserved
  AppendMember DWORD,AtlThunkSListPtr32
  AppendMember DWORD,ApiSetMap
  AppendMember DWORD,TlsExpansionCounter
  AppendMember DWORD,TlsBitmap
  AppendMember QWORD,TlsBitmapBits
  AppendMember DWORD,ReadOnlySharedMemoryBase
  AppendMember DWORD,HotpatchInformation
  AppendMember DWORD,ReadOnlyStaticServerData
  AppendMember DWORD,AnsiCodePageData
  AppendMember DWORD,OemCodePageData
  AppendMember DWORD,UnicodeCaseTableData
  AppendMember DWORD,NumberOfProcessors
  AppendMember QWORD,NtGlobalFlag
  AppendMember QWORD,CriticalSectionTimeout
  AppendMember DWORD,HeapSegmentReserve
  AppendMember DWORD,HeapSegmentCommit
  AppendMember DWORD,HeapDeCommitTotalFreeThreshold
  AppendMember DWORD,HeapDeCommitFreeBlockThreshold
  AppendMember DWORD,NumberOfHeaps
  AppendMember DWORD,MaximumNumberOfHeaps
  AppendMember DWORD,ProcessHeaps
  AppendMember DWORD,GdiSharedHandleTable
  AppendMember DWORD,ProcessStarterHelper
  AppendMember DWORD,GdiDCAttributeList
  AppendMember DWORD,LoaderLock
  AppendMember DWORD,OSMajorVersion
  AppendMember DWORD,OSMinorVersion
  AppendMember WORD,OSBuildNumber
  AppendMember WORD,OSCSDVersion
  AppendMember DWORD,OSPlatformId
  AppendMember DWORD,ImageSubsystem
  AppendMember DWORD,ImageSubsystemMajorVersion
  AppendMember DWORD,ImageSubsystemMinorVersion
  AppendMember DWORD,ActiveProcessAffinityMask
  AppendMember QWORD,Reserved1,0x11
  AppendMember DWORD,PostProcessInitRoutine
  AppendMember DWORD,TlsExpansionBitmap
  AppendMember QWORD,Reserved2,0x10
  AppendMember DWORD,SessionId
  AppendMember QWORD,AppCompatFlags
  AppendMember QWORD,AppCompatFlagsUser
  AppendMember DWORD,pShimData
  AppendMember DWORD,AppCompatInfo
  AppendMember STRING32,CSDVersion
  AppendMember DWORD,ActivationContextData
  AppendMember DWORD,ProcessAssemblyStorageMap
  AppendMember DWORD,SystemDefaultActivationContextData
  AppendMember DWORD,SystemAssemblyStorageMap
  AppendMember DWORD,MinimumStackCommit
  AppendMember DWORD,FlsCallback
  AppendMember LIST_ENTRY32,FlsListHead
  AppendMember DWORD,FlsBitmap
  AppendMember QWORD,FlsBitmapBitsLow
  AppendMember QWORD,FlsBitmapBitsHight
  AppendMember DWORD,FlsHighIndex
  AppendMember DWORD,WerRegistrationData
  AppendMember DWORD,WerShipAssertPtr
  AppendMember DWORD,pContextData
  AppendMember DWORD,pImageHeaderHash
  AppendMember DWORD,TracingFlags

//-----------------------------------------------------

AddStruct PEB64
  AppendMember BYTE,InheritedAddressSpace
  AppendMember BYTE,ReadImageFileExecOptions
  AppendMember BYTE,BeingDebugged
  AppendMember BYTE,BitField
  AppendMember DWORD,Reserved
  AppendMember QWORD,Mutant
  AppendMember QWORD,ImageBaseAddress
  AppendMember QWORD,Ldr
  AppendMember QWORD,ProcessParameters
  AppendMember QWORD,SubSystemData
  AppendMember QWORD,ProcessHeap
  AppendMember QWORD,FastPEB64Lock
  AppendMember QWORD,AtlThunkSListPtr
  AppendMember QWORD,IFEOKey
  AppendMember QWORD,CrossProcessFlags
  AppendMember QWORD,KernelCallbackTable
  AppendMember DWORD,SystemReserved
  AppendMember DWORD,AtlThunkSListPtr32
  AppendMember QWORD,ApiSetMap
  AppendMember QWORD,TlsExpansionCounter
  AppendMember QWORD,TlsBitmap
  AppendMember QWORD,TlsBitmapBits
  AppendMember QWORD,ReadOnlySharedMemoryBase
  AppendMember QWORD,HotPatchInformation
  AppendMember QWORD,ReadOnlyStaticServerData
  AppendMember QWORD,AnsiCodePageData
  AppendMember QWORD,OemCodePageData
  AppendMember QWORD,UnicodeCaseTableData
  AppendMember DWORD,NumberOfProcessors
  AppendMember DWORD,NtGlobalFlag
  AppendMember QWORD,CriticalSectionTimeout
  AppendMember QWORD,HeapSegmentReserve
  AppendMember QWORD,HeapSegmentCommit
  AppendMember QWORD,HeapDeCommitTotalFreeThreshold
  AppendMember QWORD,HeapDeCommitFreeBlockThreshold
  AppendMember DWORD,NumberOfHeaps
  AppendMember DWORD,MaxNumberOfHeaps
  AppendMember QWORD,ProcessHeaps
  AppendMember QWORD,GdiSharedHandleTable
  AppendMember QWORD,ProcessStarterHelper
  AppendMember QWORD,GdiDCAttributeList
  AppendMember QWORD,LoaderLock
  AppendMember DWORD,OSMajorVersion
  AppendMember DWORD,OSMinorVersion
  AppendMember WORD,OSBuildNumber
  AppendMember WORD,OSCSDVersion
  AppendMember DWORD,OSPlatformId
  AppendMember DWORD,ImageSubsystem
  AppendMember DWORD,ImageSubsystemMajorVersion
  AppendMember DWORD,ImageSubsystemMinorVersion
  AppendMember DWORD,Reserved1
  AppendMember QWORD,ActiveProcessAffinityMask
  AppendMember QWORD,GdiHandlerBuffer,0x1E
  AppendMember QWORD,PostProcessInitRoutine
  AppendMember QWORD,TlsExpansionBitmap
  AppendMember QWORD,TlsExpansionBitmapBit,0x10
  AppendMember QWORD,SessionId
  AppendMember QWORD,AppCompatFlags
  AppendMember QWORD,AppCompatFlagsUser
  AppendMember QWORD,pShimData
  AppendMember QWORD,AppCompatInfo
  AppendMember UNICODE_STRING,CSDVersion
  AppendMember QWORD,ActivationContextData
  AppendMember QWORD,ProcessAssemblyStorageMap
  AppendMember QWORD,SystemDefaultActivationContextData
  AppendMember QWORD,SystemAssemblyStorageMap
  AppendMember QWORD,MinimumStackCommit
  AppendMember QWORD,FlsCallback
  AppendMember LIST_ENTRY64,FlsListHead
  AppendMember QWORD,FlsBitmap
  AppendMember QWORD,FlsBitmapBitsLow
  AppendMember QWORD,FlsBitmapBitsHight
  AppendMember QWORD,FlsHighIndex
  AppendMember QWORD,WerRegistrationData
  AppendMember QWORD,WerShipAssertPtr
  AppendMember QWORD,pContextData
  AppendMember QWORD,pImageHeaderHash
  AppendMember DWORD,TracingFlags

//----------- PEB64 -> LDR   (  = 0x58 )

AddStruct PEB_LDR_DATA
  AppendMember DWORD,Length
  AppendMember DWORD,Initialized
  AppendMember QWORD,SsHandle
  AppendMember LIST_ENTRY64,InLoadOrderModuleList
  AppendMember LIST_ENTRY64,InMemoryOrderModuleList
  AppendMember LIST_ENTRY64,InInitializationOrderModuleList
  AppendMember QWORD,EntryInProgress
  AppendMember QWORD,ShutdownInProgress
  AppendMember QWORD,ShutdownThreadId


//----------- PEB64 -> LDR -> LIST_ENTRY  (  = 0xE0 )

AddStruct LDR_DATA_TABLE_ENTRY64
  AppendMember LIST_ENTRY64,InLoadOrderLinks
  AppendMember LIST_ENTRY64,InMemoryOrderLinks
  AppendMember LIST_ENTRY64,InInitializationOrderLinks
  AppendMember QWORD,DllBase
  AppendMember QWORD,EntryPoint
  AppendMember QWORD,SizeOfImage
  AppendMember UNICODE_STRING,FullDllName
  AppendMember UNICODE_STRING,BaseDllName
  AppendMember DWORD,Flags
  AppendMember WORD,LoadCount
  AppendMember WORD,TlsIndex
  AppendMember LIST_ENTRY64,HashLinks
  AppendMember QWORD,SectionPointer
  AppendMember QWORD,CheckSum
  AppendMember DWORD,TimeDateStamp
  AppendMember QWORD,LoadedImports
  AppendMember QWORD,EntryPointActivationContext
  AppendMember QWORD,PatchInformation
  AppendMember LIST_ENTRY64,ForwarderLinks
  AppendMember LIST_ENTRY64,ServiceTagLinks
  AppendMember LIST_ENTRY64,StaticLinks
  AppendMember QWORD,ContextInformation
  AppendMember QWORD,OriginalBase
  AppendMember QWORD,LoadTime

//-----------------------------------------------------

AddStruct NT_TIB32                                // union and its members
  AppendMember DWORD,ExceptionList
  AppendMember DWORD,StackBase
  AppendMember DWORD,StackLimit
  AppendMember DWORD,SubSystemTib
  AppendMember WORD,FiberData
  AppendMember WORD,Version
  AppendMember DWORD,ArbitraryUserPointer
  AppendMember DWORD,Self
SizeofType NT_TIB32

AddStruct TEB32                                  //create an empty structure 
  AppendMember NT_TIB32,NtTib
  AppendMember DWORD,EnvironmentPointer
  AppendMember CLIENT_ID32,ClientId
  AppendMember DWORD,ActiveRpcHandle
  AppendMember DWORD,TLSPointer
  AppendMember DWORD,PEB
  AppendMember DWORD,LastErrorValue
  AppendMember DWORD,CountOfOwnedCriticalSections
  AppendMember DWORD,CsrClientThread
  AppendMember DWORD,Win32ThreadInfo
  AppendMember DWORD,User32Reserved,0x1F
  AppendMember DWORD,WOW32Reserved
  AppendMember DWORD,CurrentLocale
  AppendMember DWORD,FpSoftwareStatusRegister
  AppendMember DWORD,SystemReserved1,0x36 
  AppendMember DWORD,ExceptionCode
  AppendMember DWORD,ActivationContextStackPointer
  AppendMember DWORD,SpareBytes,0x09 
  AppendMember DWORD,TxFsContext
  AppendMember QWORD,GdiTebBatch,0x9C 
  AppendMember CLIENT_ID32,RealClientId
  AppendMember DWORD,GdiCachedProcessHandle
  AppendMember DWORD,GdiClientPID
  AppendMember DWORD,GdiClientTID
  AppendMember DWORD,GdiThreadLocalInfo

AddStruct NT_TIB64
  AppendMember QWORD,ExceptionList
  AppendMember QWORD,StackBase
  AppendMember QWORD,StackLimit
  AppendMember QWORD,SubSystemTib
  AppendMember DWORD,FiberData
  AppendMember DWORD,Version
  AppendMember QWORD,ArbitraryUserPointer
  AppendMember QWORD,Self
SizeofType NT_TIB64

AddStruct TEB64 
  AppendMember NT_TIB64,NtTib
  AppendMember QWORD,EnvironmentPointer
  AppendMember CLIENT_ID64,ClientId
  AppendMember QWORD,ActiveRpcHandle
  AppendMember QWORD,TLSPointer
  AppendMember QWORD,PEB
  AppendMember DWORD,LastErrorValue
  AppendMember DWORD,CountOfOwnedCriticalSections
  AppendMember QWORD,CsrClientThread
  AppendMember QWORD,Win32ThreadInfo
  AppendMember QWORD,User32Reserved,0x10
  AppendMember QWORD,WOW32Reserved
  AppendMember DWORD,CurrentLocale
  AppendMember DWORD,FpSoftwareStatusRegister
  AppendMember QWORD,SystemReserved1,0x36 
  AppendMember QWORD,ExceptionCode
  AppendMember QWORD,ActivationContextStackPointer
  AppendMember DWORD,SpareBytes,0x06 
  AppendMember QWORD,TxFsContext
  AppendMember QWORD,GdiTebBatch,0x9D 
  AppendMember CLIENT_ID64,RealClientId
  AppendMember QWORD,GdiCachedProcessHandle
  AppendMember DWORD,GdiClientPID
  AppendMember DWORD,GdiClientTID
  AppendMember QWORD,GdiThreadLocalInfo
  AppendMember QWORD,Win32ClientInfo,0x3E
  AppendMember QWORD,glDispatchTable,0xE9
  AppendMember QWORD,glReserved1,0x1D
  AppendMember QWORD,glReserved2
  AppendMember QWORD,glSectionInfo
  AppendMember QWORD,glSection
  AppendMember QWORD,glTable
  AppendMember QWORD,glCurrentRC
  AppendMember QWORD,glContext
  AppendMember QWORD,LastStatusValue
  AppendMember UNICODE_STRING,StaticUnicodeString
  AppendMember QWORD,StaticUnicodeBuffer,0x42
  AppendMember QWORD,DeallocationStack
  AppendMember QWORD,TlsSlots,0x40
  AppendMember LIST_ENTRY64,TlsLinks
  AppendMember QWORD,Vdm
  AppendMember QWORD,ReservedForNtRpc
  AppendMember QWORD,Reserved2,0x02
  AppendMember DWORD,HardErrorMode
  AppendMember QWORD,Reserved3,0x0B
  AppendMember QWORD,Reserved4,0x02
  AppendMember QWORD,SubProcessTag
  AppendMember QWORD,EtwLocalData
  AppendMember QWORD,EtwTraceData
  AppendMember QWORD,WinSockData
  AppendMember DWORD,GdiBatchCount
  AppendMember DWORD,Reserved5
  AppendMember BYTE,IdealProcessor
  AppendMember DWORD,GuaranteedStackBytes
  AppendMember QWORD,ReservedForPerf
  AppendMember QWORD,ReservedForOle
  AppendMember DWORD,WaitingOnLoaderLock
  AppendMember QWORD,SavedPriorityState
  AppendMember QWORD,SoftPatchPtr1
  AppendMember QWORD,ThreadPoolData
  AppendMember QWORD,TlsExpansionSlots
  AppendMember QWORD,DeallocationBStore
  AppendMember QWORD,BStoreLimit
  AppendMember DWORD,MuiGeneration
  AppendMember DWORD,IsImpersonating
  AppendMember QWORD,NlsCache
  AppendMember QWORD,pShimData
  AppendMember DWORD,HeapVirtualAffinity
  AppendMember QWORD,CurrentTransactionHandle
  AppendMember QWORD,ActiveFrame
  AppendMember QWORD,FlsData
  AppendMember QWORD,PreferredLanguages
  AppendMember QWORD,UserPrefLanguages
  AppendMember QWORD,MergedPrefLanguages
  AppendMember DWORD,MuiImpersonation
  AppendMember WORD,CrossTEB64Flags
  AppendMember WORD,SpareCrossTEB64Bits
  AppendMember WORD,SameTEB64Flags
  AppendMember QWORD,TxnScopeEnterCallback
  AppendMember QWORD,TxnScopeExitCallback
  AppendMember QWORD,TxnScopeContext
  AppendMember DWORD,LockCount
  AppendMember DWORD,SpareUlong0
  AppendMember QWORD,ResourceRetValue

//--------------------------------------------

AddStruct BY_HANDLE_FILE_INFORMATION  //<-------------------- GetFileInfoByHandle()
  AppendMember DWORD,FileAttributes
  AppendMember FILETIME,CreationTime
  AppendMember FILETIME,LastAccessTime
  AppendMember FILETIME,LastWriteTime
  AppendMember DWORD,VolumeSerialNumber
  AppendMember DWORD,FileSizeHigh
  AppendMember DWORD,FileSizeLow
  AppendMember DWORD,NumberOfLinks
  AppendMember DWORD,FileIndexHigh
  AppendMember DWORD,FileIndexLow

AddStruct WIN32_FIND_DATA  //<------------------------------- FindNextFile/Process()
  AppendMember DWORD,FileAttributes
  AppendMember FILETIME,CreationTime     
  AppendMember FILETIME,LastAccessTime
  AppendMember FILETIME,LastWriteTime
  AppendMember DWORD,FileSizeHigh
  AppendMember DWORD,FileSizeLow
  AppendMember QWORD,Reserved
  AppendMember ASCII,FileName,0xFF
  AppendMember ASCII,AlternateFileName,0x0E

AddStruct SYSTEM_INFO32
  AppendMember WORD,ProcessorArchitecture
  AppendMember WORD,Reserved
  AppendMember DWORD,PageSize
  AppendMember DWORD,MinApplicationAddress
  AppendMember DWORD,MaxApplicationAddress
  AppendMember DWORD,ActiveProcessorMask
  AppendMember DWORD,NumberOfProcessors
  AppendMember DWORD,ProcessorType
  AppendMember DWORD,AllocationGranularity
  AppendMember WORD,ProcessorLevel
  AppendMember WORD,ProcessorRevision

AddStruct SYSTEM_INFO64
  AppendMember WORD,ProcessorArchitecture
  AppendMember WORD,Reserved
  AppendMember DWORD,PageSize
  AppendMember QWORD,MinApplicationAddress
  AppendMember QWORD,MaxApplicationAddress
  AppendMember QWORD,ActiveProcessorMask
  AppendMember DWORD,NumberOfProcessors
  AppendMember DWORD,ProcessorType
  AppendMember DWORD,AllocationGranularity
  AppendMember WORD,ProcessorLevel
  AppendMember WORD,ProcessorRevision

AddStruct PROCESSINFO64 
  AppendMember DWORD,NextEntryOffset
  AppendMember DWORD,NumberOfThreads 
  AppendMember QWORD,WorkingSetPrivateSize
  AppendMember DWORD,HardFaultCount
  AppendMember DWORD,NumberOfThreadsHighWatermark
  AppendMember QWORD,CycleTim
  AppendMember QWORD,CreateTime
  AppendMember QWORD,UserTime
  AppendMember QWORD,KernelTime
  AppendMember QWORD,Reserved1
  AppendMember QWORD,ImageName
  AppendMember QWORD,BasePriority
  AppendMember QWORD,UniqueProcessId
  AppendMember QWORD,InheritedFromUniqueProcessId
  AppendMember QWORD,HandleCount
  AppendMember QWORD,SessionId
  AppendMember QWORD,UniqueProcessKey
  AppendMember QWORD,PeakVirtualSize
  AppendMember QWORD,VirtualSize
  AppendMember QWORD,PageFaultCount
  AppendMember QWORD,PeakWorkingSetSize
  AppendMember QWORD,WorkingSetSize
  AppendMember QWORD,QuotaPeakPagedPoolUsage
  AppendMember QWORD,QuotaPagedPoolUsage
  AppendMember QWORD,QuotaPeakNonPagedPoolUsage
  AppendMember QWORD,QuotaNonPagedPoolUsage
  AppendMember QWORD,PagefileUsage
  AppendMember QWORD,PeakPagefileUsage
  AppendMember QWORD,PrivatePageCount
  AppendMember QWORD,ReadOperationCount
  AppendMember QWORD,WriteOperationCount
  AppendMember QWORD,OtherOperationCount
  AppendMember QWORD,ReadTransferCount
  AppendMember QWORD,WriteTransferCount
  AppendMember QWORD,OtherTransferCount

AddStruct MEMORYSTATUS_EX     //<------ GlobalMemoryStatusEx()
  AppendMember DWORD,dwLength
  AppendMember DWORD,dwMemoryLoad
  AppendMember QWORD,dqTotalPhys
  AppendMember QWORD,dqAvailPhys
  AppendMember QWORD,dqTotalPageFile
  AppendMember QWORD,dqAvailPageFile
  AppendMember QWORD,dqTotalVirtual
  AppendMember QWORD,dqAvailVirtual
  AppendMember QWORD,dqAvailExVirtual

//--------------------------------------------

AddStruct OPTIONAL_HEADER64
  AppendMember WORD,Magic
  AppendMember BYTE,LinkerVersionMajor
  AppendMember BYTE,LinkerVersionMinor
  AppendMember DWORD,SizeOfCode
  AppendMember DWORD,SizeOfInitData
  AppendMember DWORD,SizeOfUnInitData
  AppendMember DWORD,EntryPointRVA
  AppendMember DWORD,BaseOfCodeRVA
  AppendMember QWORD,ImageBase
  AppendMember DWORD,SectionAlign
  AppendMember DWORD,FileAlign
  AppendMember DWORD,OsVersion
  AppendMember DWORD,ImageVersion
  AppendMember DWORD,SubSysVersion
  AppendMember DWORD,Reserved
  AppendMember DWORD,ImageSize
  AppendMember DWORD,HeaderSize
  AppendMember DWORD,FileChecksum
  AppendMember WORD,SubSystem
  AppendMember WORD,DLLcharacteristics
  AppendMember QWORD,StackReserve
  AppendMember QWORD,StackCommit
  AppendMember QWORD,HeapReserve
  AppendMember QWORD,HeapCommit
  AppendMember DWORD,LoaderFlag
  AppendMember DWORD,NumberDataDir
SizeofType OPTIONAL_HEADER64

AddStruct OPTIONAL_HEADER32
  AppendMember WORD,Magic
  AppendMember BYTE,LinkerVersionMajor
  AppendMember BYTE,LinkerVersionMinor
  AppendMember DWORD,SizeOfCode
  AppendMember DWORD,SizeOfInitData
  AppendMember DWORD,SizeOfUnInitData
  AppendMember DWORD,EntryPointRVA
  AppendMember DWORD,BaseOfCodeRVA
  AppendMember DWORD,BaseOfDataRVA
  AppendMember DWORD,ImageBase
  AppendMember DWORD,SectionAlign
  AppendMember DWORD,FileAlign
  AppendMember DWORD,OsVersion
  AppendMember DWORD,ImageVersion
  AppendMember DWORD,SubSysVersion
  AppendMember DWORD,Reserved
  AppendMember DWORD,ImageSize
  AppendMember DWORD,HeaderSize
  AppendMember DWORD,FileChecksum
  AppendMember WORD,SubSystem
  AppendMember WORD,DLLcharacteristics
  AppendMember DWORD,StackReserve
  AppendMember DWORD,StackCommit
  AppendMember DWORD,HeapReserve
  AppendMember DWORD,HeapCommit
  AppendMember DWORD,LoaderFlag
  AppendMember DWORD,NumberDataDir
SizeofType OPTIONAL_HEADER32

AddStruct DATA_DIRECTORY
  AppendMember DWORD,ExportRVA
  AppendMember DWORD,ExportSize
  AppendMember DWORD,ImportRVA
  AppendMember DWORD,ImportSize
  AppendMember DWORD,ResourceRVA
  AppendMember DWORD,ResourceSize
  AppendMember DWORD,ExceptionRVA
  AppendMember DWORD,ExceptionSize
  AppendMember DWORD,SecurityRVA
  AppendMember DWORD,SecuritySize
  AppendMember DWORD,RelocationRVA
  AppendMember DWORD,RelocationSize
  AppendMember DWORD,DebugRVA
  AppendMember DWORD,DebugSize
  AppendMember DWORD,ArchitectureRVA
  AppendMember DWORD,ArchitectureSize
  AppendMember DWORD,GlobalRVA
  AppendMember DWORD,GlobalSize
  AppendMember DWORD,TlsRVA
  AppendMember DWORD,TlsSize
  AppendMember DWORD,LoadConfigRVA
  AppendMember DWORD,LoadConfigSize
  AppendMember DWORD,BoundImportRVA
  AppendMember DWORD,BoundImportSize
  AppendMember DWORD,IatRVA
  AppendMember DWORD,IatSize
  AppendMember DWORD,DelayImportRVA
  AppendMember DWORD,DelayImportSize
  AppendMember DWORD,NetMetaDataRVA
  AppendMember DWORD,NetMetaDataSize
  AppendMember QWORD,Padding
SizeofType DATA_DIRECTORY

AddStruct SECTION_TABLE
  AppendMember ASCII,ObjectName,8
  AppendMember DWORD,VirtualSize
  AppendMember DWORD,VirtualOffsetRVA
  AppendMember DWORD,PhysicalSize
  AppendMember DWORD,PhysicalOffsetRVA
  AppendMember BYTE,Reserved,0x0C
  AppendMember DWORD,SectionFlags
SizeofType SECTION_TABLE

AddStruct PE64
  AppendMember ASCII,Signature,4
  AppendMember WORD,Machine
  AppendMember WORD,NumberOfSection
  AppendMember DWORD,TimeStamp
  AppendMember DWORD,SymbolPointer
  AppendMember DWORD,SymbolSize
  AppendMember WORD,OptHeaderSize
  AppendMember WORD,Flags
  AppendMember OPTIONAL_HEADER64,OptHeader
  AppendMember DATA_DIRECTORY,DataDir
  AppendMember SECTION_TABLE,SectTable(1)
  AppendMember SECTION_TABLE,SectTable(2)
  
AddStruct PE32
  AppendMember ASCII,Signature,4
  AppendMember WORD,Machine
  AppendMember WORD,NumberOfSection
  AppendMember DWORD,TimeStamp
  AppendMember DWORD,SymbolPointer
  AppendMember DWORD,SymbolSize
  AppendMember WORD,OptHeaderSize
  AppendMember WORD,Flags
  AppendMember OPTIONAL_HEADER32,OptHeader
  AppendMember DATA_DIRECTORY,DataDir
  AppendMember SECTION_TABLE,SectTable(1)
  AppendMember SECTION_TABLE,SectTable(2)
  

//-------------------- Ntdll.dll ---------------------
//
// SystemProcessInformation class = 5
//-----------------------------------
AddStruct SYSTEM_PROCESS_INFO64
  AppendMember DWORD,NextEntryOffset
  AppendMember DWORD,NumberOfThreads
  AppendMember QWORD,WorkingSetPrivateSize
  AppendMember DWORD,HardFaultCount
  AppendMember DWORD,NumberOfThreadsHighWatermark
  AppendMember QWORD,CycleTime
  AppendMember QWORD,CreateTime
  AppendMember QWORD,UserTime
  AppendMember QWORD,KernelTime
  AppendMember QWORD,Reserved1
  AppendMember QWORD,ImageName
  AppendMember QWORD,BasePriority
  AppendMember QWORD,UniqueProcessId
  AppendMember QWORD,InheritedFromUniqueProcessId
  AppendMember QWORD,HandleCount
  AppendMember QWORD,SessionId
  AppendMember QWORD,UniqueProcessKey
  AppendMember QWORD,PeakVirtualSize 
  AppendMember QWORD,VirtualSize
  AppendMember QWORD,PageFaultCount
  AppendMember QWORD,PeakWorkingSetSize
  AppendMember QWORD,WorkingSetSize
  AppendMember QWORD,QuotaPeakPagedPoolUsage 
  AppendMember QWORD,QuotaPagedPoolUsage
  AppendMember QWORD,QuotaPeakNonPagedPoolUsage
  AppendMember QWORD,QuotaNonPagedPoolUsage
  AppendMember QWORD,PagefileUsage 
  AppendMember QWORD,PeakPagefileUsage
  AppendMember QWORD,PrivatePageCount
  AppendMember QWORD,ReadOperationCount
  AppendMember QWORD,WriteOperationCount
  AppendMember QWORD,OtherOperationCount
  AppendMember QWORD,ReadTransferCount
  AppendMember QWORD,WriteTransferCount
  AppendMember QWORD,OtherTransferCount

AddStruct SYSTEM_PROCESS_INFO32
  AppendMember DWORD,NextEntryOffset
  AppendMember DWORD,ThreadCount
  AppendMember DWORD,Reserved1
  AppendMember DWORD,ProcessName
  AppendMember DWORD,BasePriority
  AppendMember DWORD,UniqueProcessId
  AppendMember DWORD,ParentProcessID
  AppendMember DWORD,HandleCount
  AppendMember DWORD,Reserved2,0x05
  AppendMember DWORD,PeakVirtualSize
  AppendMember DWORD,VirtualSize
  AppendMember DWORD,Reserved3,0x13

AddStruct SYSTEM_THREAD_INFO
  AppendMember QWORD,KernelTime
  AppendMember QWORD,UserTime
  AppendMember QWORD,CreateTime
  AppendMember DWORD,WaitTime
  AppendMember DWORD,StartAddress
  AppendMember QWORD,ClientId
  AppendMember DWORD,Priority
  AppendMember DWORD,BasePriority
  AppendMember DWORD,ContextSwitches
  AppendMember DWORD,ThreadState
  AppendMember DWORD,WaitReason

// SystemModuleInformation class = 11
//-----------------------------------

AddStruct SYSTEM_MODULE_ENTRY64
  AppendMember DWORD,Reserved,5
  AppendMember QWORD,ImageBase
  AppendMember DWORD,ImageSize
  AppendMember DWORD,Flags
  AppendMember WORD,LoadOrderIndex
  AppendMember WORD,InitOrderIndex
  AppendMember WORD,LoadCount
  AppendMember WORD,OffsetToFileName
  AppendMember ASCII,FullPathName,0xFF
SizeofType  SYSTEM_MODULE_ENTRY64

AddStruct SYSTEM_MODULE_INFO64
  AppendMember DWORD,Counter
  AppendMember SYSTEM_MODULE_ENTRY64,Module

AddStruct KSYSTEM_TIME
   AppendMember DWORD,LowPart
   AppendMember DWORD,High1Time
   AppendMember DWORD,High2Time
SizeofType SYSTEM_MODULE_ENTRY64

AddStruct XSTATE_FEATURE
   AppendMember DWORD,Offset
   AppendMember DWORD,Size
SizeofType XSTATE_FEATURE

AddStruct XSTATE_CONFIGURATION
   AppendMember QWORD,EnabledFeatures
   AppendMember DWORD,Size
   AppendMember DWORD,OptimizedSave
   AppendMember XSTATE_FEATURE,Features,0x40
SizeofType XSTATE_CONFIGURATION

AddStruct KUSER_SHARED_DATA
   AppendMember DWORD,TickCountLowDeprecated
   AppendMember DWORD,TickCountMultiplier
   AppendMember KSYSTEM_TIME,InterruptTime
   AppendMember KSYSTEM_TIME,SystemTime
   AppendMember KSYSTEM_TIME,TimeZoneBias
   AppendMember WORD,ImageNumberLow
   AppendMember WORD,ImageNumberHigh
   AppendMember UNICODE,NtSystemRoot,0x104
   AppendMember DWORD,MaxStackTraceDepth
   AppendMember DWORD,CryptoExponent
   AppendMember DWORD,TimeZoneId
   AppendMember DWORD,LargePageMinimum
   AppendMember DWORD,Reserved2,7
   AppendMember DWORD,NtProductType
   AppendMember DWORD,ProductTypeIsValid
   AppendMember DWORD,NtMajorVersion
   AppendMember DWORD,NtMinorVersion
   AppendMember BYTE,ProcessorFeatures,0x40
   AppendMember QWORD,Reserved1
   AppendMember DWORD,TimeSlip
   AppendMember DWORD,AlternativeArchitecture
   AppendMember DWORD,AltArchitecturePad
   AppendMember QWORD,SystemExpirationDate
   AppendMember DWORD,SuiteMask
   AppendMember BYTE,KdDebuggerEnabled
   AppendMember BYTE,NXSupportPolicy
   AppendMember WORD,Padding
   AppendMember DWORD,ActiveConsoleId
   AppendMember DWORD,DismountCount
   AppendMember DWORD,ComPlusPackage
   AppendMember DWORD,LastSystemRITEventTickCount
   AppendMember DWORD,NumberOfPhysicalPages
   AppendMember BYTE,SafeBootMode
   AppendMember BYTE,TscQpcData
   AppendMember WORD,TscQpcPad
   AppendMember DWORD,SharedDataFlags
   AppendMember DWORD,DataFlagsPad
   AppendMember QWORD,TestRetInstruction
   AppendMember DWORD,SystemCall
   AppendMember DWORD,SystemCallReturn
   AppendMember QWORD,SystemCallPad,3
   AppendMember KSYSTEM_TIME,TickCount
   AppendMember DWORD,TickCountPad
   AppendMember DWORD,Cookie             //<-------- Stop x32
   AppendMember DWORD,CookiePad
   AppendMember QWORD,ConsoleSessionForegroundProcessId
   AppendMember DWORD,Wow64SharedInformation,0x10
   AppendMember DWORD,UserModeGlobalLogger,8
   AppendMember DWORD,ImageFileExecutionOptions
   AppendMember DWORD,LangGenerationCount
   AppendMember QWORD,Reserved5
   AppendMember QWORD,InterruptTimeBias
   AppendMember QWORD,TscQpcBias
   AppendMember DWORD,ActiveProcessorCount
   AppendMember WORD,ActiveGroupCount
   AppendMember WORD,Reserved4
   AppendMember DWORD,AitSamplingValue
   AppendMember DWORD,AppCompatFlag
   AppendMember QWORD,SystemDllNativeRelocation
   AppendMember DWORD,SystemDllWowRelocation
   AppendMember DWORD,XStatePad
   AppendMember XSTATE_CONFIGURATION,XState


//  HDEngine
//-----------------------------------

AddStruct HDE32
  AppendMember BYTE,len
  AppendMember BYTE,p_rep
  AppendMember BYTE,p_lock
  AppendMember BYTE,p_seg
  AppendMember BYTE,p_66
  AppendMember BYTE,p_67
  AppendMember BYTE,opcode
  AppendMember BYTE,opcode2
  AppendMember BYTE,modrm
  AppendMember BYTE,modrm_mod
  AppendMember BYTE,modrm_reg
  AppendMember BYTE,modrm_rm
  AppendMember BYTE,sib
  AppendMember BYTE,sib_scale
  AppendMember BYTE,sib_index
  AppendMember BYTE,sib_base
  AppendMember BYTE,imm8
  AppendMember WORD,imm16
  AppendMember DWORD,imm32
  AppendMember BYTE,disp8
  AppendMember WORD,disp16
  AppendMember DWORD,disp32
  AppendMember BYTE,rel8
  AppendMember WORD,rel16
  AppendMember DWORD,rel32











