A simple but useful project maybe help you reverse Windows.
This project include header files that contain undocuments types can be compiled by both WDK , IDAPro , BinaryNinja.
Just copy header files in the include directory.
Just Parse header files in the include directory.
Install ktypes.sys at target guest virtual machine and setup a kernel debugger at host machine to debug it.
Start windbg at host machine and debug utypes.exe , it will auto break into the debugger.
Now you can use windbg to display any undocuments types.
-
If there is no special instructions, the type definition is reverse-engineered on the latest stable version of Windows 10 x64 & Windows 11 x64.
-
When this types applied to other versions, some type definitions may need to be adjusted.
-
Microsoft owns the full copyright of Windows.
-
Reverse engineering of these structures is only for research and learning purposes.
-
This project does not bear any legal responsibility and I am reserves the right of final interpretation.