Skip to content

Wrong offsets for KPCR::Prcb #1

Description

@VelocityRa

And possibly others.

Take this example: https://github.com/ntdiff/headers/blob/master/Win10_1909_19H2/x64/System32/ntoskrnl.exe/Standalone/_KPCR.h#L1331

For all major compilers , the calculated offset is 0x178, not 0x180: https://godbolt.org/z/ZJ-DfV


Apparently the reason is:

Curiously, PcrAlign1 does not by itself align the Prcb that follows. That Prcb is meant to be cache-aligned
is certain: cache  alignment is plainly a recurring concern within the KPRCB and is obviously simpler to
arrange if the KPRCB is itself cache aligned (which it isn’t for 32-bit Windows).

Source

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions