Repository navigation
Wrong offsets for KPCR::Prcb #1
Description
And possibly others.
Take this example: https://github.com/ntdiff/headers/blob/master/Win10_1909_19H2/x64/System32/ntoskrnl.exe/Standalone/_KPCR.h#L1331
For all major compilers , the calculated offset is 0x178, not 0x180: https://godbolt.org/z/ZJ-DfV
Apparently the reason is:
Curiously, PcrAlign1 does not by itself align the Prcb that follows. That Prcb is meant to be cache-aligned
is certain: cache alignment is plainly a recurring concern within the KPRCB and is obviously simpler to
arrange if the KPRCB is itself cache aligned (which it isn’t for 32-bit Windows).
Activity