rtl.h

#pragma once

// @todo: diff arch
#define RtlInitializeSplayLinks(LINKS) \
{ \
	RTL_SPLAY_LINKS* pSplayLinks; \
	pSplayLinks = (RTL_SPLAY_LINKS*)(LINKS); \
	pSplayLinks->Parent = pSplayLinks; \
	pSplayLinks->LeftChild = nullptr; \
	pSplayLinks->RightChild = nullptr; \
}

#define RtlParent(LINKS) ((RTL_SPLAY_LINKS*)(LINKS)->Parent)
#define RtlLeftChild(LINKS) ((RTL_SPLAY_LINKS*)(LINKS)->LeftChild)
#define RtlRightChild(LINKS) ((RTL_SPLAY_LINKS*)(LINKS)->RightChild)
#define RtlIsRoot(LINKS) ((RtlParent(LINKS) == (RTL_SPLAY_LINKS*)(LINKS)))
#define RtlIsLeftChild(LINKS) ((RtlLeftChild(RtlParent(LINKS)) == (RTL_SPLAY_LINKS*)(LINKS)))
#define RtlIsRightChild(LINKS) ((RtlRightChild(RtlParent(LINKS)) == (RTL_SPLAY_LINKS*)(LINKS)))

#define RtlInsertAsLeftChild(PARENT_LINKS, CHILD_LINKS) \
{ \
	RTL_SPLAY_LINKS* pSplayParent; \
	RTL_SPLAY_LINKS* pSplayChild; \
	pSplayParent = (RTL_SPLAY_LINKS*)(PARENT_LINKS); \
	pSplayChild = (RTL_SPLAY_LINKS*)(CHILD_LINKS); \
	pSplayParent->LeftChild = pSplayChild; \
	pSplayChild->Parent = pSplayParent; \
}

#define RtlInsertAsRightChild(PARENT_LINKS, CHILD_LINKS) \
{ \
	RTL_SPLAY_LINKS* pSplayParent; \
	RTL_SPLAY_LINKS* pSplayChild; \
	pSplayParent = (RTL_SPLAY_LINKS*)(PARENT_LINKS); \
	pSplayChild = (RTL_SPLAY_LINKS*)(CHILD_LINKS); \
	pSplayParent->RightChild = pSplayChild; \
	pSplayChild->Parent = pSplayParent; \
}

#pragma pack(push, 8)
_Q_NT_BIT_TEMPLATE struct RTL_SPLAY_LINKS
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<RTL_SPLAY_LINKS*> Parent; // 0x00
	BitnessType_t<RTL_SPLAY_LINKS*> LeftChild; // 0x04 / 0x08
	BitnessType_t<RTL_SPLAY_LINKS*> RightChild; // 0x08 / 0x10
};
_Q_NT_BIT_ASSERT(RTL_SPLAY_LINKS, 0xC, 0x18);

_Q_NT_BIT_TEMPLATE struct RTL_BALANCED_LINKS
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<RTL_BALANCED_LINKS*> Parent; // 0x00
	BitnessType_t<RTL_BALANCED_LINKS*> LeftChild; // 0x04 / 0x08
	BitnessType_t<RTL_BALANCED_LINKS*> RightChild; // 0x08 / 0x10
	std::int8_t Balance; // 0x0C / 0x18
	std::uint8_t Reserved[3]; // 0x0D // 0x19
};
_Q_NT_BIT_ASSERT(RTL_BALANCED_LINKS, 0x10, 0x20);

#if Q_NT_VERSION >= Q_NT_WIN8
_Q_NT_BIT_TEMPLATE struct RTL_BALANCED_NODE
{
private:
	_Q_NT_BIT_TYPE
public:
	union
	{
		BitnessType_t<RTL_BALANCED_NODE*> Children[2];

		struct
		{
			BitnessType_t<RTL_BALANCED_NODE*> Left;
			BitnessType_t<RTL_BALANCED_NODE*> Right;
		};
	}; // 0x00
	union
	{
		std::uint8_t Red : 1;
		std::uint8_t Balance : 2;
		BitnessType_t<std::size_t> ParentValue;
	}; // 0x08 / 0x10
};
_Q_NT_BIT_ASSERT(RTL_BALANCED_NODE, 0xC, 0x18);

_Q_NT_BIT_TEMPLATE struct RTL_RB_TREE
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<RTL_BALANCED_NODE<nBitness>*> Root; // 0x0
	BitnessType_t<RTL_BALANCED_NODE<nBitness>*> Min; // 0x4 / 0x8
};
_Q_NT_BIT_ASSERT(RTL_RB_TREE, 0x8, 0x10);
#endif

#define RTL_MAX_DRIVE_LETTERS 32

#define RTL_USER_PROC_CURDIR_CLOSE		0x00000002
#define RTL_USER_PROC_CURDIR_INHERIT	0x00000003

_Q_NT_BIT_TEMPLATE struct RTL_DRIVE_LETTER_CURDIR
{
	std::uint16_t Flags; // 0x0 // RTL_USER_PROC_CURDIR_*
	std::uint16_t Length; // 0x2
	std::uint32_t TimeStamp; // 0x4
	STRING<nBitness> DosPath; // 0x8
};
_Q_NT_BIT_ASSERT(RTL_DRIVE_LETTER_CURDIR, 0x10, 0x18);

#pragma region rtl_avl_table
using TABLE_SEARCH_RESULT = enum _TABLE_SEARCH_RESULT
{
	TableEmptyTree,
	TableFoundNode,
	TableInsertAsLeft,
	TableInsertAsRight
};

using RTL_GENERIC_COMPARE_RESULTS = enum _RTL_GENERIC_COMPARE_RESULTS
{
	GenericLessThan,
	GenericGreaterThan,
	GenericEqual
};

template <std::size_t nBitness> requires (nBitness == 32U || nBitness == 64U)
struct RTL_AVL_TABLE;

using PRTL_AVL_COMPARE_ROUTINE = RTL_GENERIC_COMPARE_RESULTS(NTAPI*)(RTL_AVL_TABLE<Q_ARCH_BIT>* Table, void* FirstStruct, void* SecondStruct);
using PRTL_AVL_ALLOCATE_ROUTINE = void*(NTAPI*)(RTL_AVL_TABLE<Q_ARCH_BIT>* Table, std::uint32_t ByteSize);
using PRTL_AVL_FREE_ROUTINE = void(NTAPI*)(RTL_AVL_TABLE<Q_ARCH_BIT>* Table, void* Buffer);
using PRTL_AVL_MATCH_FUNCTION = NTSTATUS(NTAPI*)(RTL_AVL_TABLE<Q_ARCH_BIT>* Table, void* UserData, void* MatchData);

template <std::size_t nBitness> requires (nBitness == 32U || nBitness == 64U)
struct RTL_AVL_TABLE
{
private:
	_Q_NT_BIT_TYPE
public:
	RTL_BALANCED_LINKS<nBitness> BalancedRoot; // 0x00
	BitnessType_t<void*> OrderedPointer; // 0x10 / 0x20
	std::uint32_t WhichOrderedElement; // 0x14 / 0x28
	std::uint32_t NumberGenericTableElements; // 0x18 / 0x2C
	std::uint32_t DepthOfTree; // 0x1C / 0x30
	BitnessType_t<RTL_BALANCED_LINKS<nBitness>*> RestartKey; // 0x20 / 0x38
	std::uint32_t DeleteCount; // 0x24 / 0x40
	BitnessType_t<PRTL_AVL_COMPARE_ROUTINE> CompareRoutine; // 0x28 / 0x48
	BitnessType_t<PRTL_AVL_ALLOCATE_ROUTINE> AllocateRoutine; // 0x2C / 0x50
	BitnessType_t<PRTL_AVL_FREE_ROUTINE> FreeRoutine; // 0x30 / 0x58
	BitnessType_t<void*> TableContext; // 0x34 / 0x60
};
_Q_NT_BIT_ASSERT(RTL_AVL_TABLE, 0x38, 0x68);
#pragma endregion

#pragma region rtl_generic_table
template <std::size_t nBitness> requires (nBitness == 32U || nBitness == 64U)
struct RTL_GENERIC_TABLE;

using PRTL_GENERIC_COMPARE_ROUTINE = RTL_GENERIC_COMPARE_RESULTS(NTAPI*)(RTL_GENERIC_TABLE<Q_ARCH_BIT>* Table, void* FirstStruct, void* SecondStruct);
using PRTL_GENERIC_ALLOCATE_ROUTINE = void*(NTAPI*)(RTL_GENERIC_TABLE<Q_ARCH_BIT>* Table, std::uint32_t ByteSize);
using PRTL_GENERIC_FREE_ROUTINE = void(NTAPI*)(RTL_GENERIC_TABLE<Q_ARCH_BIT>* Table, void* Buffer);

template <std::size_t nBitness> requires (nBitness == 32U || nBitness == 64U)
struct RTL_GENERIC_TABLE
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<RTL_SPLAY_LINKS<nBitness>*> TableRoot; // 0x00
	LIST_ENTRY<nBitness> InsertOrderList; // 0x04 / 0x08
	BitnessType_t<LIST_ENTRY<nBitness>*> OrderedPointer; // 0x0C / 0x18
	std::uint32_t WhichOrderedElement; // 0x10 / 0x20
	std::uint32_t NumberGenericTableElements; // 0x14 / 0x24
	BitnessType_t<PRTL_GENERIC_COMPARE_ROUTINE> CompareRoutine; // 0x18 / 0x28
	BitnessType_t<PRTL_GENERIC_ALLOCATE_ROUTINE> AllocateRoutine; // 0x1C / 0x30
	BitnessType_t<PRTL_GENERIC_FREE_ROUTINE> FreeRoutine; // 0x20 / 0x38
	BitnessType_t<void*> TableContext; // 0x24 / 0x40
};
_Q_NT_BIT_ASSERT(RTL_GENERIC_TABLE, 0x28, 0x48);
#pragma endregion

#pragma region rtl_hash_table
#if Q_NT_VERSION >= Q_NT_WIN7
#define RTL_HASH_ALLOCATED_HEADER 0x00000001
#define RTL_HASH_RESERVED_SIGNATURE 0

_Q_NT_BIT_TEMPLATE struct RTL_DYNAMIC_HASH_TABLE_ENTRY
{
private:
	_Q_NT_BIT_TYPE
public:
	LIST_ENTRY<nBitness> Linkage; // 0x00
	BitnessType_t<std::uintptr_t> Signature; // 0x08 / 0x10
};
_Q_NT_BIT_ASSERT(RTL_DYNAMIC_HASH_TABLE_ENTRY, 0xC, 0x18);

_Q_NT_BIT_TEMPLATE struct RTL_DYNAMIC_HASH_TABLE_CONTEXT
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<LIST_ENTRY<nBitness>*> ChainHead; // 0x00
	BitnessType_t<LIST_ENTRY<nBitness>*> PrevLinkage; // 0x04 / 0x08
	BitnessType_t<std::uintptr_t> Signature; // 0x08 / 0x10
};
_Q_NT_BIT_ASSERT(RTL_DYNAMIC_HASH_TABLE_CONTEXT, 0xC, 0x18);

_Q_NT_BIT_TEMPLATE struct RTL_DYNAMIC_HASH_TABLE_ENUMERATOR
{
private:
	_Q_NT_BIT_TYPE
public:
	RTL_DYNAMIC_HASH_TABLE_ENTRY<nBitness> HashEntry; // 0x00
	BitnessType_t<LIST_ENTRY<nBitness>*> ChainHead; // 0x0C / 0x18
	std::uint32_t BucketIndex; // 0x10 / 0x20
};
_Q_NT_BIT_ASSERT(RTL_DYNAMIC_HASH_TABLE_ENUMERATOR, 0x14, 0x28);

_Q_NT_BIT_TEMPLATE struct RTL_DYNAMIC_HASH_TABLE
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t Flags; // 0x00
	std::uint32_t Shift; // 0x04
	std::uint32_t TableSize; // 0x08
	std::uint32_t Pivot; // 0x0C
	std::uint32_t DivisorMask; // 0x10
	std::uint32_t NumEntries; // 0x14
	std::uint32_t NonEmptyBuckets; // 0x18
	std::uint32_t NumEnumerators; // 0x1C
	BitnessType_t<void*> Directory; // 0x20
};
_Q_NT_BIT_ASSERT(RTL_DYNAMIC_HASH_TABLE, 0x24, 0x28);
#endif
#pragma endregion

#pragma region rtl_critical_section
#define RTL_CRITICAL_SECTION_FLAG_NO_DEBUG_INFO		0x01000000
#define RTL_CRITICAL_SECTION_FLAG_DYNAMIC_SPIN		0x02000000
#define RTL_CRITICAL_SECTION_FLAG_STATIC_INIT		0x04000000
#define RTL_CRITICAL_SECTION_FLAG_RESOURCE_TYPE		0x08000000
#define RTL_CRITICAL_SECTION_FLAG_FORCE_DEBUG_INFO	0x10000000
#define RTL_CRITICAL_SECTION_ALL_FLAG_BITS			0xFF000000
#define RTL_CRITICAL_SECTION_FLAG_RESERVED			(RTL_CRITICAL_SECTION_ALL_FLAG_BITS & (~(RTL_CRITICAL_SECTION_FLAG_NO_DEBUG_INFO | RTL_CRITICAL_SECTION_FLAG_DYNAMIC_SPIN | RTL_CRITICAL_SECTION_FLAG_STATIC_INIT | RTL_CRITICAL_SECTION_FLAG_RESOURCE_TYPE | RTL_CRITICAL_SECTION_FLAG_FORCE_DEBUG_INFO)))
#define RTL_CRITICAL_SECTION_DEBUG_FLAG_STATIC_INIT	0x00000001

template <std::size_t nBitness> requires (nBitness == 32U || nBitness == 64U)
struct RTL_CRITICAL_SECTION_DEBUG;

_Q_NT_BIT_TEMPLATE struct RTL_CRITICAL_SECTION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<RTL_CRITICAL_SECTION_DEBUG<nBitness>*> DebugInfo; // 0x00
	std::int32_t LockCount; // 0x04 / 0x08
	std::int32_t RecursionCount; // 0x08 / 0x0C
	BitnessType_t<void*> OwningThread; // 0x0C / 0x10
	BitnessType_t<void*> LockSemaphore; // 0x10 / 0x18
	BitnessType_t<std::size_t> SpinCount; // 0x14 / 0x20
};
_Q_NT_BIT_ASSERT(RTL_CRITICAL_SECTION, 0x18, 0x28);

_Q_NT_BIT_TEMPLATE struct RTL_CRITICAL_SECTION_DEBUG
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint16_t Type; // 0x00
	std::uint16_t CreatorBackTraceIndex; // 0x02
	BitnessType_t<RTL_CRITICAL_SECTION<nBitness>*> CriticalSection; // 0x04 / 0x08
	LIST_ENTRY<nBitness> ProcessLocksList; // 0x08 / 0x10
	std::uint32_t EntryCount; // 0x10 / 0x20
	std::uint32_t ContentionCount; // 0x14 / 0x24
	std::uint32_t Flags; // 0x18 / 0x28
	std::uint16_t CreatorBackTraceIndexHigh; // 0x1C / 0x2C
	std::uint16_t SpareWORD; // 0x1E / 0x2E
};
_Q_NT_BIT_ASSERT(RTL_CRITICAL_SECTION_DEBUG, 0x20, 0x30);

_Q_NT_BIT_TEMPLATE struct RTL_RESOURCE
{
private:
	_Q_NT_BIT_TYPE
public:
	RTL_CRITICAL_SECTION<nBitness> CriticalSection; // 0x00
	BitnessType_t<HANDLE> SharedSemaphore; // 0x18 / 0x28
	volatile std::uint32_t NumberOfWaitingShared; // 0x1C / 0x30
	BitnessType_t<HANDLE> ExclusiveSemaphore; // 0x20 / 0x38
	volatile std::uint32_t NumberOfWaitingExclusive; // 0x24 / 0x40
	volatile std::int32_t NumberOfActive; // 0x28 / 0x44
	BitnessType_t<HANDLE> ExclusiveOwnerThread; // 0x2C / 0x48
	std::uint32_t Flags; // 0x30 / 0x50
	BitnessType_t<RTL_CRITICAL_SECTION_DEBUG<nBitness>*> DebugInfo; // 0x34 / 0x58
};
_Q_NT_BIT_ASSERT(RTL_RESOURCE, 0x38, 0x60);

_Q_NT_BIT_TEMPLATE struct RTL_SRWLOCK
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> Ptr;
};
_Q_NT_BIT_ASSERT(RTL_SRWLOCK, 0x4, 0x8);
#pragma endregion

#pragma region rtl_prefix
#define RTL_NTC_PREFIX_TABLE static_cast<std::int16_t>(0x0200)
#define RTL_NTC_ROOT static_cast<std::int16_t>(0x0201)
#define RTL_NTC_INTERNAL static_cast<std::int16_t>(0x0202)

_Q_NT_BIT_TEMPLATE struct PREFIX_TABLE_ENTRY
{
private:
	_Q_NT_BIT_TYPE
public:
	std::int16_t NodeTypeCode; // 0x00 // RTL_NTC_*
	std::int16_t NameLength; // 0x02
	BitnessType_t<PREFIX_TABLE_ENTRY*> NextPrefixTree; // 0x04 / 0x08
	RTL_SPLAY_LINKS<nBitness> Links; // 0x08 / 0x10
	BitnessType_t<STRING<nBitness>*> Prefix; // 0x14 / 0x28
};
_Q_NT_BIT_ASSERT(PREFIX_TABLE_ENTRY, 0x18, 0x30);

_Q_NT_BIT_TEMPLATE struct PREFIX_TABLE
{
private:
	_Q_NT_BIT_TYPE
public:
	std::int16_t NodeTypeCode; // 0x0
	std::int16_t NameLength; // 0x2
	BitnessType_t<PREFIX_TABLE_ENTRY<nBitness>*> NextPrefixTree; // 0x4 / 0x8
};
_Q_NT_BIT_ASSERT(PREFIX_TABLE, 0x8, 0x10);

#define RTL_NTC_UNICODE_PREFIX_TABLE static_cast<std::int16_t>(0x0800)
#define RTL_NTC_UNICODE_ROOT static_cast<std::int16_t>(0x0801)
#define RTL_NTC_UNICODE_INTERNAL static_cast<std::int16_t>(0x0802)
#define RTL_NTC_UNICODE_CASE_MATCH static_cast<std::int16_t>(0x0803)

_Q_NT_BIT_TEMPLATE struct UNICODE_PREFIX_TABLE_ENTRY
{
private:
	_Q_NT_BIT_TYPE
public:
	std::int16_t NodeTypeCode; // 0x00 // RTL_NTC_UNICODE_*
	std::int16_t NameLength; // 0x02
	BitnessType_t<UNICODE_PREFIX_TABLE_ENTRY*> NextPrefixTree; // 0x04 / 0x08
	BitnessType_t<UNICODE_PREFIX_TABLE_ENTRY*> CaseMatch; // 0x08 / 0x10
	RTL_SPLAY_LINKS<nBitness> Links; // 0x0C / 0x18
	BitnessType_t<UNICODE_STRING<nBitness>*> Prefix; // 0x18 / 0x30
};
_Q_NT_BIT_ASSERT(UNICODE_PREFIX_TABLE_ENTRY, 0x1C, 0x38);

_Q_NT_BIT_TEMPLATE struct UNICODE_PREFIX_TABLE
{
private:
	_Q_NT_BIT_TYPE
public:
	std::int16_t NodeTypeCode; // 0x00
	std::int16_t NameLength; // 0x02
	BitnessType_t<UNICODE_PREFIX_TABLE_ENTRY<nBitness>*> NextPrefixTree; // 0x04 / 0x08
	BitnessType_t<UNICODE_PREFIX_TABLE_ENTRY<nBitness>*> LastNextEntry; // 0x08 / 0x10
};
_Q_NT_BIT_ASSERT(UNICODE_PREFIX_TABLE, 0xC, 0x18);
#pragma endregion

#pragma region rtl_compression
#define COMPRESSION_FORMAT_NONE			(0x0000)
#define COMPRESSION_FORMAT_DEFAULT		(0x0001)
#define COMPRESSION_FORMAT_LZNT1		(0x0002)
// @todo: below after WINXP
#define COMPRESSION_FORMAT_XPRESS		(0x0003)
#define COMPRESSION_FORMAT_XPRESS_HUFF	(0x0004)
#define COMPRESSION_FORMAT_XP10			(0x0005)
#define COMPRESSION_FORMAT_LZ4			(0x0006)
#define COMPRESSION_FORMAT_DEFLATE		(0x0007)
#define COMPRESSION_FORMAT_ZLIB			(0x0008)

#define COMPRESSION_ENGINE_STANDARD		(0x0000)
#define COMPRESSION_ENGINE_MAXIMUM		(0x0100)
#define COMPRESSION_ENGINE_HIBER		(0x0200)

struct COMPRESSED_DATA_INFO
{
	std::uint16_t CompressionFormatAndEngine; // 0x0
	std::uint8_t CompressionUnitShift; // 0x2
	std::uint8_t ChunkShift; // 0x3
	std::uint8_t ClusterShift; // 0x4
	std::uint8_t Reserved; // 0x5
	std::uint16_t NumberOfChunks; // 0x6
	std::uint32_t CompressedChunkSizes[ANYSIZE_ARRAY]; // 0x8
};
#pragma endregion

#pragma region rtl_process
#define RTL_USER_PROC_DETACHED_PROCESS reinterpret_cast<HANDLE>(reinterpret_cast<std::intptr_t>(-1))
#define RTL_USER_PROC_CREATE_NEW_CONSOLE reinterpret_cast<HANDLE>(reinterpret_cast<std::intptr_t>(-2))
#define RTL_USER_PROC_CREATE_NO_WINDOW reinterpret_cast<HANDLE>(reinterpret_cast<std::intptr_t>(-3))

#define RTL_USER_PROC_PARAMS_NORMALIZED					0x00000001
#define RTL_USER_PROC_PROFILE_USER						0x00000002
#define RTL_USER_PROC_PROFILE_KERNEL					0x00000004
#define RTL_USER_PROC_PROFILE_SERVER					0x00000008
#define RTL_USER_PROC_RESERVE_1MB						0x00000020
#define RTL_USER_PROC_RESERVE_16MB						0x00000040
#define RTL_USER_PROC_CASE_SENSITIVE					0x00000080
#define RTL_USER_PROC_DISABLE_HEAP_DECOMMIT				0x00000100
#define RTL_USER_PROC_DLL_REDIRECTION_LOCAL				0x00001000
#define RTL_USER_PROC_APP_MANIFEST_PRESENT				0x00002000
// @todo: below after WINXP
#define RTL_USER_PROC_IMAGE_KEY_MISSING					0x00004000
#define RTL_USER_PROC_DEV_OVERRIDE_ENABLED				0x00008000
#define RTL_USER_PROC_OPTIN_PROCESS						0x00020000
#define RTL_USER_PROC_OPTIN_PROCESS						0x00020000
#define RTL_USER_PROC_SESSION_OWNER						0x00040000
#define RTL_USER_PROC_HANDLE_USER_CALLBACK_EXCEPTIONS	0x00080000
#define RTL_USER_PROC_PROTECTED_PROCESS					0x00400000
#define RTL_USER_PROC_SECURE_PROCESS					0x80000000

_Q_NT_BIT_TEMPLATE struct RTL_USER_PROCESS_PARAMETERS
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t MaximumLength; // 0x0000
	std::uint32_t Length; // 0x0004
	std::uint32_t Flags; // 0x0008 // RTL_USER_PROC_*
	std::uint32_t DebugFlags; // 0x000C
	BitnessType_t<void*> ConsoleHandle; // 0x0010
	std::uint32_t ConsoleFlags; // 0x0014 / 0x0018
	BitnessType_t<void*> StandardInput; // 0x0018 / 0x0020
	BitnessType_t<void*> StandardOutput; // 0x001C / 0x0028
	BitnessType_t<void*> StandardError; // 0x0020 / 0x0030
	CURDIR<nBitness> CurrentDirectory; // 0x0024 / 0x0038
	UNICODE_STRING<nBitness> DllPath; // 0x0030 / 0x0050
	UNICODE_STRING<nBitness> ImagePathName; // 0x0038 / 0x0060
	UNICODE_STRING<nBitness> CommandLine; // 0x0040 / 0x0070
	BitnessType_t<void*> Environment; // 0x0048 / 0x0080
	std::uint32_t StartingX; // 0x004C / 0x0088
	std::uint32_t StartingY; // 0x0050 / 0x008C
	std::uint32_t CountX; // 0x0054 / 0x0090
	std::uint32_t CountY; // 0x0058 / 0x0094
	std::uint32_t CountCharsX; // 0x005C / 0x0098
	std::uint32_t CountCharsY; // 0x0060 / 0x009C
	std::uint32_t FillAttribute; // 0x0064 / 0x00A0
	std::uint32_t WindowFlags; // 0x0068 / 0x00A4
	std::uint32_t ShowWindowFlags; // 0x006C / 0x00A8
	UNICODE_STRING<nBitness> WindowTitle; // 0x0070 / 0x00B0
	UNICODE_STRING<nBitness> DesktopInfo; // 0x0078 / 0x00C0
	UNICODE_STRING<nBitness> ShellInfo; // 0x0080 / 0x00D0
	UNICODE_STRING<nBitness> RuntimeData; // 0x0088 / 0x00E0
	RTL_DRIVE_LETTER_CURDIR<nBitness> CurrentDirectories[RTL_MAX_DRIVE_LETTERS]; // 0x0090 / 0x00F0 // @note: originally "CurrentDirectores"
	BitnessType_t<std::size_t> EnvironmentSize; // 0x0290 / 0x03F0
#if Q_NT_VERSION >= Q_NT_WIN7
	BitnessType_t<std::size_t> EnvironmentVersion; // 0x0294 / 0x03F8
#endif
#if Q_NT_VERSION >= Q_NT_WIN8
	BitnessType_t<void*> PackageDependencyData; // 0x0298 / 0x0400
	std::uint32_t ProcessGroupId; // 0x029C / 0x0408
#endif
#if Q_NT_VERSION >= Q_NT_WIN10
	std::uint32_t LoaderThreads; // 0x02A0 / 0x040C
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS5
	UNICODE_STRING<nBitness> RedirectionDllName; // 0x02A4 / 0x0410
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_19H1
	UNICODE_STRING<nBitness> HeapPartitionName; // 0x02AC / 0x0420
	BitnessType_t<std::uint64_t*> DefaultThreadpoolCpuSetMasks; // 0x02B4 / 0x0430
	std::uint32_t DefaultThreadpoolCpuSetMaskCount; // 0x02B8 / 0x0438
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_20H1
	std::uint32_t DefaultThreadpoolThreadMaximum; // 0x02BC / 0x043C
#endif
#if Q_NT_VERSION >= Q_NT_WIN11_22H2
	std::uint32_t HeapMemoryTypeMask; // 0x02C0 / 0x0440
#endif
};
_Q_NT_BIT_ASSERT(RTL_USER_PROCESS_PARAMETERS, 0x2C4, 0x448);

using PUSER_PROCESS_START_ROUTINE = NTSTATUS(NTAPI*)(RTL_USER_PROCESS_PARAMETERS<Q_ARCH_BIT>* ProcessParameters);
using PUSER_THREAD_START_ROUTINE = NTSTATUS(NTAPI*)(void* ThreadParameter);

_Q_NT_BIT_TEMPLATE struct RTL_USER_PROCESS_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t Length; // 0x00
	BitnessType_t<HANDLE> ProcessHandle; // 0x04 / 0x08
	BitnessType_t<HANDLE> ThreadHandle; // 0x08 / 0x10
	CLIENT_ID<nBitness> ClientId; // 0x0C / 0x18
	SECTION_IMAGE_INFORMATION<nBitness> ImageInformation; // 0x14 / 0x28
};
_Q_NT_BIT_ASSERT(RTL_USER_PROCESS_INFORMATION, 0x44, 0x68);

// @todo: move smw?
_Q_NT_BIT_TEMPLATE struct SECURITY_DESCRIPTOR
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint8_t Revision; // 0x00
	std::uint8_t Sbz1; // 0x01
	SECURITY_DESCRIPTOR_CONTROL Control; // 0x02
	BitnessType_t<SID*> Owner; // 0x04 / 0x08
	BitnessType_t<SID*> Group; // 0x08 / 0x10
	BitnessType_t<ACL*> Sacl; // 0x0C / 0x18
	BitnessType_t<ACL*> Dacl; // 0x10 / 0x20
};
_Q_NT_BIT_ASSERT(SECURITY_DESCRIPTOR, 0x14, 0x28);

#if Q_NT_VERSION >= Q_NT_WIN10_RS2
_Q_NT_BIT_TEMPLATE struct RTL_USER_PROCESS_EXTENDED_PARAMETERS
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint16_t Version; // 0x00
	std::uint16_t NodeNumber; // 0x02
	BitnessType_t<SECURITY_DESCRIPTOR<nBitness>*> ProcessSecurityDescriptor; // 0x04 / 0x08
	BitnessType_t<SECURITY_DESCRIPTOR<nBitness>*> ThreadSecurityDescriptor; // 0x08 / 0x10
	BitnessType_t<HANDLE> ParentProcess; // 0x0C / 0x18
	BitnessType_t<HANDLE> DebugPort; // 0x10 / 0x20
	BitnessType_t<HANDLE> TokenHandle; // 0x14 / 0x28
	BitnessType_t<HANDLE> JobHandle; // 0x18 / 0x30
};
_Q_NT_BIT_ASSERT(RTL_USER_PROCESS_EXTENDED_PARAMETERS, 0x1C, 0x38);
#endif

#if Q_NT_VERSION >= Q_NT_WIN7
_Q_NT_BIT_TEMPLATE struct RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<HANDLE> ReflectionProcessHandle; // 0x00
	BitnessType_t<HANDLE> ReflectionThreadHandle; // 0x04 / 0x08
	CLIENT_ID<nBitness> ReflectionClientId; // 0x08 / 0x10
};
_Q_NT_BIT_ASSERT(RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION, 0x10, 0x20);
#endif

_Q_NT_BIT_TEMPLATE struct RTL_PROCESS_MODULE_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> Section; // 0x00
	BitnessType_t<void*> MappedBase; // 0x04 / 0x08
	BitnessType_t<void*> ImageBase; // 0x08 / 0x10
	std::uint32_t ImageSize; // 0x0C / 0x18
	std::uint32_t Flags; // 0x10 / 0x1C
	std::uint16_t LoadOrderIndex; // 0x14 / 0x20
	std::uint16_t InitOrderIndex; // 0x16 / 0x22
	std::uint16_t LoadCount; // 0x18 / 0x24
	std::uint16_t OffsetToFileName; // 0x1A / 0x26
	std::uint8_t FullPathName[256]; // 0x1C / 0x28
};
_Q_NT_BIT_ASSERT(RTL_PROCESS_MODULE_INFORMATION, 0x11C, 0x128);

_Q_NT_BIT_TEMPLATE struct RTL_PROCESS_MODULES
{
	std::uint32_t NumberOfModules; // 0x0
	RTL_PROCESS_MODULE_INFORMATION<nBitness> Modules[ANYSIZE_ARRAY]; // 0x4 / 0x8
};

_Q_NT_BIT_TEMPLATE struct RTL_PROCESS_MODULE_INFORMATION_EX
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint16_t NextOffset; // 0x0000
	RTL_PROCESS_MODULE_INFORMATION<nBitness> BaseInfo; // 0x0004 / 0x0008
	std::uint32_t ImageChecksum; // 0x0120 / 0x0130
	std::uint32_t TimeDateStamp; // 0x0124 / 0x0134
	BitnessType_t<void*> DefaultBase; // 0x0128 / 0x0x138
};
_Q_NT_BIT_ASSERT(RTL_PROCESS_MODULE_INFORMATION_EX, 0x12C, 0x140);
#pragma endregion

#pragma region rtl_context
struct CONTEXT_CHUNK
{
	std::int32_t Offset;
	std::uint32_t Length;
};

struct CONTEXT_EX
{
	CONTEXT_CHUNK All;
	CONTEXT_CHUNK Legacy;
	CONTEXT_CHUNK XState;
	CONTEXT_CHUNK KernelCet;
};
#pragma endregion

#pragma region rtl_function_table
using FUNCTION_TABLE_TYPE = enum _FUNCTION_TABLE_TYPE
{
	RF_SORTED = 0,
	RF_UNSORTED = 1,
	RF_CALLBACK = 2,
#if Q_NT_VERSION >= Q_NT_WIN8
	RF_KERNEL_DYNAMIC = 3
#endif
};

#if Q_NT_VERSION >= Q_NT_WIN8
struct IMAGE_RUNTIME_FUNCTION_ENTRY
#else
struct RUNTIME_FUNCTION
#endif
{
	std::uint32_t BeginAddress; // 0x00
	std::uint32_t EndAddress; // 0x04
	union
	{
		std::uint32_t UnwindInfoAddress;
#if Q_NT_VERSION >= Q_NT_WIN8
		std::uint32_t UnwindData;
#endif
	}; // 0x08
};
static_assert(sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY) == 0xC);

#if Q_NT_VERSION >= Q_NT_WIN8
using PGET_RUNTIME_FUNCTION_CALLBACK = IMAGE_RUNTIME_FUNCTION_ENTRY*(NTAPI*)(std::uint64_t ControlPc, void* Context);
#else
using PGET_RUNTIME_FUNCTION_CALLBACK = RUNTIME_FUNCTION*(NTAPI*)(std::uint64_t ControlPc, void* Context);
#endif

struct DYNAMIC_FUNCTION_TABLE
{
private:
	template <typename T>
	using BitnessType_t = DETAIL::BitnessConditional_t<64U, T>;

public:
	LIST_ENTRY<64U> ListEntry; // 0x00
#if Q_NT_VERSION >= Q_NT_WIN8
	BitnessType_t<IMAGE_RUNTIME_FUNCTION_ENTRY*> FunctionTable; // 0x10
#else
	BitnessType_t<RUNTIME_FUNCTION*> FunctionTable; // 0x10
#endif
	LARGE_INTEGER TimeStamp; // 0x18
	std::uint64_t MinimumAddress; // 0x20
	std::uint64_t MaximumAddress; // 0x28
	std::uint64_t BaseAddress; // 0x30
	BitnessType_t<PGET_RUNTIME_FUNCTION_CALLBACK> Callback; // 0x38
	BitnessType_t<void*> Context; // 0x40
	BitnessType_t<wchar_t*> OutOfProcessCallbackDll; // 0x48
	FUNCTION_TABLE_TYPE Type; // 0x50
	std::uint32_t EntryCount; // 0x54
#if Q_NT_VERSION >= Q_NT_WIN10_21H1
	RTL_BALANCED_NODE<64U> TreeNodeMin; // 0x58
	RTL_BALANCED_NODE<64U> TreeNodeMax; // 0x70
#endif
};
static_assert(sizeof(DYNAMIC_FUNCTION_TABLE) == 0x88);
#pragma endregion

#pragma region rtl_heap
_Q_NT_BIT_TEMPLATE struct RTL_HEAP_ENTRY
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::size_t> Size; // 0x00
	std::uint16_t Flags; // 0x04 / 0x08
	std::uint16_t AllocatorBackTraceIndex; // 0x06 / 0x0A
	union
	{
		struct
		{
			BitnessType_t<std::size_t> Settable;
			std::uint32_t Tag;
		} s1;
		struct
		{
			BitnessType_t<std::size_t> CommittedSize;
			BitnessType_t<void*> FirstBlock;
		} s2;
	} u; // 0x08 / 0x10
};
_Q_NT_BIT_ASSERT(RTL_HEAP_ENTRY, 0x10, 0x20);

#define RTL_HEAP_BUSY static_cast<std::uint16_t>(0x0001)
#define RTL_HEAP_SEGMENT static_cast<std::uint16_t>(0x0002)
#define RTL_HEAP_SETTABLE_VALUE static_cast<std::uint16_t>(0x0010)
#define RTL_HEAP_SETTABLE_FLAG1 static_cast<std::uint16_t>(0x0020)
#define RTL_HEAP_SETTABLE_FLAG2 static_cast<std::uint16_t>(0x0040)
#define RTL_HEAP_SETTABLE_FLAG3 static_cast<std::uint16_t>(0x0080)
#define RTL_HEAP_SETTABLE_FLAGS static_cast<std::uint16_t>(0x00E0)
#define RTL_HEAP_UNCOMMITTED_RANGE static_cast<std::uint16_t>(0x1000) // @test: 0x0100 on XP
#define RTL_HEAP_PROTECTED_ENTRY static_cast<std::uint16_t>(0x2000) // @test: 0x0200 on XP
#define RTL_HEAP_LARGE_ALLOC static_cast<std::uint16_t>(0x4000)
#define RTL_HEAP_LFH_ALLOC static_cast<std::uint16_t>(0x8000)

_Q_NT_BIT_TEMPLATE struct RTL_HEAP_TAG
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t NumberOfAllocations; // 0x00
	std::uint32_t NumberOfFrees; // 0x04
	BitnessType_t<std::size_t> BytesAllocated; // 0x08
	std::uint16_t TagIndex; // 0x0C / 0x10
	std::uint16_t CreatorBackTraceIndex; // 0x0E / 0x12
	wchar_t TagName[24]; // 0x10 / 0x14
};
_Q_NT_BIT_ASSERT(RTL_HEAP_TAG, 0x40, 0x48);

#define RTL_HEAP_SIGNATURE 0xFFEEFFEEUL
#define RTL_HEAP_SEGMENT_SIGNATURE 0xDDEEDDEEUL

_Q_NT_BIT_TEMPLATE struct RTL_HEAP_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> BaseAddress; // 0x00
	std::uint32_t Flags; // 0x04 / 0x08 // RTL_HEAP_*
	std::uint16_t EntryOverhead; // 0x08 / 0x0C
	std::uint16_t CreatorBackTraceIndex; // 0x0A / 0x0E
	BitnessType_t<std::size_t> BytesAllocated; // 0x0C / 0x10
	BitnessType_t<std::size_t> BytesCommitted; // 0x10 / 0x18
	std::uint32_t NumberOfTags; // 0x14 / 0x20
	std::uint32_t NumberOfEntries; // 0x18 / 0x24
	std::uint32_t NumberOfPseudoTags; // 0x1C / 0x28
	std::uint32_t PseudoTagGranularity; // 0x20 / 0x2C
	std::uint32_t Reserved[5]; // 0x24 / 0x30
	BitnessType_t<RTL_HEAP_TAG<nBitness>*> Tags; // 0x38 / 0x48
	BitnessType_t<RTL_HEAP_ENTRY<nBitness>*> Entries; // 0x3C / 0x50
#if Q_NT_VERSION >= Q_NT_WIN11_22H2
	std::uint64_t HeapTag; // 0x40 / 0x58
#endif
};
_Q_NT_BIT_ASSERT(RTL_HEAP_INFORMATION, 0x48, 0x60);

_Q_NT_BIT_TEMPLATE struct RTL_PROCESS_HEAPS
{
	std::uint32_t NumberOfHeaps; // 0x0
	RTL_HEAP_INFORMATION<nBitness> Heaps[ANYSIZE_ARRAY]; // 0x4 / 0x8
};

#if Q_NT_VERSION >= Q_NT_WIN11_22H2
using HEAP_MEMORY_INFO_CLASS = enum _HEAP_MEMORY_INFO_CLASS
{
	HeapMemoryBasicInformation = 0
};

using PALLOCATE_VIRTUAL_MEMORY_EX_CALLBACK = NTSTATUS(NTAPI*)(HANDLE CallbackContext, HANDLE ProcessHandle, void** BaseAddress, std::size_t* RegionSize, std::uint32_t AllocationType, std::uint32_t PageProtection, MEM_EXTENDED_PARAMETER* ExtendedParameters, std::uint32_t ExtendedParameterCount);
using PFREE_VIRTUAL_MEMORY_EX_CALLBACK = NTSTATUS(NTAPI*)(HANDLE CallbackContext, HANDLE ProcessHandle, void** BaseAddress, std::size_t* RegionSize, std::uint32_t FreeType);
using PQUERY_VIRTUAL_MEMORY_CALLBACK = NTSTATUS(NTAPI*)(HANDLE CallbackContext, HANDLE ProcessHandle, void* BaseAddress, HEAP_MEMORY_INFO_CLASS MemoryInformationClass, void* MemoryInformation, std::size_t MemoryInformationLength, std::size_t* ReturnLength);

_Q_NT_BIT_TEMPLATE struct RTL_SEGMENT_HEAP_VA_CALLBACKS
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<HANDLE> CallbackContext; // 0x00
	BitnessType_t<PALLOCATE_VIRTUAL_MEMORY_EX_CALLBACK> AllocateVirtualMemory; // 0x04 / 0x08
	BitnessType_t<PFREE_VIRTUAL_MEMORY_EX_CALLBACK> FreeVirtualMemory; // 0x08 / 0x10
	BitnessType_t<PQUERY_VIRTUAL_MEMORY_CALLBACK> QueryVirtualMemory; // 0x0C / 0x18
};
_Q_NT_BIT_ASSERT(RTL_SEGMENT_HEAP_VA_CALLBACKS, 0x10, 0x20);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_RS4
using RTL_MEMORY_TYPE = enum _RTL_MEMORY_TYPE
{
	MemoryTypePaged,
	MemoryTypeNonPaged,
#if Q_NT_VERSION >= Q_NT_WIN10_21H1
	MemoryType64KPage,
#endif
	MemoryTypeLargePage,
	MemoryTypeHugePage,
#if Q_NT_VERSION >= Q_NT_WIN11_22H2
	MemoryTypeCustom,
#endif
	MemoryTypeMax
};

#define RTL_SEGHEAP_MEM_SOURCE_ANY_NODE static_cast<std::uint32_t>(-1)

_Q_NT_BIT_TEMPLATE struct RTL_SEGMENT_HEAP_MEMORY_SOURCE
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t Flags; // 0x00
	std::uint32_t MemoryTypeMask; // 0x04
	std::uint32_t NumaNode; // 0x08
	union
	{
		BitnessType_t<HANDLE> PartitionHandle;
#if Q_NT_VERSION >= Q_NT_WIN11_22H2
		BitnessType_t<RTL_SEGMENT_HEAP_VA_CALLBACKS<nBitness>*> Callbacks;
#endif
	}; // 0x0C / 0x10
	BitnessType_t<std::size_t> Reserved[2]; // 0x10 / 0x18
};
_Q_NT_BIT_ASSERT(RTL_SEGMENT_HEAP_MEMORY_SOURCE, 0x18, 0x28);

#define SEGMENT_HEAP_PARAMETERS_VERSION	3
#define SEGMENT_HEAP_FLG_USE_PAGE_HEAP	0x1
#define SEGMENT_HEAP_FLG_NO_LFH			0x2
#define SEGMENT_HEAP_PARAMS_VALID_FLAGS	0x3

_Q_NT_BIT_TEMPLATE struct RTL_SEGMENT_HEAP_PARAMETERS
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint16_t Version; // 0x00
	std::uint16_t Size; // 0x02
	std::uint32_t Flags; // 0x04 // SEGMENT_HEAP_FLG_*
	RTL_SEGMENT_HEAP_MEMORY_SOURCE<nBitness> MemorySource; // 0x08
	BitnessType_t<std::size_t> Reserved[4]; // 0x20 / 0x30
};
_Q_NT_BIT_ASSERT(RTL_SEGMENT_HEAP_PARAMETERS, 0x30, 0x50);
#endif

using PRTL_HEAP_COMMIT_ROUTINE = NTSTATUS(NTAPI*)(void* Base, void** CommitAddress, std::size_t* CommitSize);

_Q_NT_BIT_TEMPLATE struct RTL_HEAP_PARAMETERS
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t Length; // 0x00
	BitnessType_t<std::size_t> SegmentReserve; // 0x04 / 0x08
	BitnessType_t<std::size_t> SegmentCommit; // 0x08 / 0x10
	BitnessType_t<std::size_t> DeCommitFreeBlockThreshold; // 0x0C / 0x18
	BitnessType_t<std::size_t> DeCommitTotalFreeThreshold; // 0x10 / 0x20
	BitnessType_t<std::size_t> MaximumAllocationSize; // 0x14 / 0x28
	BitnessType_t<std::size_t> VirtualMemoryThreshold; // 0x18 / 0x30
	BitnessType_t<std::size_t> InitialCommit; // 0x1C / 0x38
	BitnessType_t<std::size_t> InitialReserve; // 0x20 / 0x40
	BitnessType_t<PRTL_HEAP_COMMIT_ROUTINE> CommitRoutine; // 0x24 / 0x48
	BitnessType_t<std::size_t> Reserved[2]; // 0x28 / 0x50
};
_Q_NT_BIT_ASSERT(RTL_HEAP_PARAMETERS, 0x30, 0x60);

#define HEAP_SETTABLE_USER_VALUE 0x00000100
#define HEAP_SETTABLE_USER_FLAG1 0x00000200
#define HEAP_SETTABLE_USER_FLAG2 0x00000400
#define HEAP_SETTABLE_USER_FLAG3 0x00000800
#define HEAP_SETTABLE_USER_FLAGS 0x00000E00

#define HEAP_CLASS_0 0x00000000 // Process heap
#define HEAP_CLASS_1 0x00001000 // Private heap
#define HEAP_CLASS_2 0x00002000 // Kernel heap
#define HEAP_CLASS_3 0x00003000 // GDI heap
#define HEAP_CLASS_4 0x00004000 // User heap
#define HEAP_CLASS_5 0x00005000 // Console heap
#define HEAP_CLASS_6 0x00006000 // User desktop heap
#define HEAP_CLASS_7 0x00007000 // CSR shared heap
#define HEAP_CLASS_8 0x00008000 // CSR port heap
#define HEAP_CLASS_MASK 0x0000F000

_Q_NT_BIT_TEMPLATE struct RTL_HEAP_TAG_INFO
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t NumberOfAllocations; // 0x0
	std::uint32_t NumberOfFrees; // 0x4
	BitnessType_t<std::size_t> BytesAllocated; // 0x8
};
_Q_NT_BIT_ASSERT(RTL_HEAP_TAG_INFO, 0xC, 0x10);

using PRTL_ENUM_HEAPS_ROUTINE = NTSTATUS(NTAPI*)(void* HeapHandle, void* Parameter);

_Q_NT_BIT_TEMPLATE struct RTL_HEAP_USAGE_ENTRY
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<RTL_HEAP_USAGE_ENTRY*> Next; // 0x00
	BitnessType_t<void*> Address; // 0x04 / 0x08
	BitnessType_t<std::size_t> Size; // 0x08 / 0x10
	std::uint16_t AllocatorBackTraceIndex; // 0x0C / 0x18
	std::uint16_t TagIndex; // 0x0E / 0x1A
};
_Q_NT_BIT_ASSERT(RTL_HEAP_USAGE_ENTRY, 0x10, 0x20);

_Q_NT_BIT_TEMPLATE struct RTL_HEAP_USAGE
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t Length; // 0x00
	BitnessType_t<std::size_t> BytesAllocated; // 0x04 / 0x08
	BitnessType_t<std::size_t> BytesCommitted; // 0x08 / 0x10
	BitnessType_t<std::size_t> BytesReserved; // 0x0C / 0x18
	BitnessType_t<std::size_t> BytesReservedMaximum; // 0x10 / 0x20
	BitnessType_t<RTL_HEAP_USAGE_ENTRY<nBitness>*> Entries; // 0x14 / 0x28
	BitnessType_t<RTL_HEAP_USAGE_ENTRY<nBitness>*> AddedEntries; // 0x18 / 0x30
	BitnessType_t<RTL_HEAP_USAGE_ENTRY<nBitness>*> RemovedEntries; // 0x1C / 0x38
	BitnessType_t<std::uintptr_t> Reserved[8]; // 0x20 / 0x40
};
_Q_NT_BIT_ASSERT(RTL_HEAP_USAGE, 0x40, 0x80);

_Q_NT_BIT_TEMPLATE struct RTL_HEAP_WALK_ENTRY
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> DataAddress; // 0x00
	BitnessType_t<std::size_t> DataSize; // 0x04 / 0x08
	std::uint8_t OverheadBytes; // 0x08 / 0x10
	std::uint8_t SegmentIndex; // 0x09 / 0x11
	std::uint16_t Flags; // 0x0A / 0x12
	union
	{
		struct
		{
			BitnessType_t<std::size_t> Settable;
			std::uint16_t TagIndex;
			std::uint16_t AllocatorBackTraceIndex;
			std::uint32_t Reserved[2];
		} Block;
		struct
		{
			std::uint32_t CommittedSize;
			std::uint32_t UnCommittedSize;
			BitnessType_t<void*> FirstEntry;
			BitnessType_t<void*> LastEntry;
		} Segment;
	}; // 0x0C / 0x18
};
_Q_NT_BIT_ASSERT(RTL_HEAP_WALK_ENTRY, 0x1C, 0x30);

using HEAP_INFORMATION_CLASS = enum _HEAP_INFORMATION_CLASS : std::uint32_t
{
	HeapCompatibilityInformation = 0,
	HeapEnableTerminationOnCorruption = 1,
#if Q_NT_VERSION >= Q_NT_WIN8
	HeapExtendedInformation = 2,
#if Q_NT_VERSION >= Q_NT_WINBLUE // @test: since WINBLUE_U1 to be exact
	HeapOptimizeResources = 3,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_TH2
	HeapTaggingInformation = 4,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS2
	HeapStackDatabase = 5,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS5
	HeapMemoryLimit = 6,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11
	HeapTag = 7,
#endif
	HeapDetailedFailureInformation = 0x80000001,
	HeapSetDebuggingInformation = 0x80000002
#endif
};

#if Q_NT_VERSION >= Q_NT_WIN10_TH2
_Q_NT_BIT_TEMPLATE struct RTLP_TAG_INFO
{
private:
	_Q_NT_BIT_TYPE
public:
	GUID Id; // 0x00
	BitnessType_t<std::size_t> CurrentAllocatedBytes; // 0x10
};
_Q_NT_BIT_ASSERT(RTLP_TAG_INFO, 0x14, 0x18);

_Q_NT_BIT_TEMPLATE struct RTLP_HEAP_TAGGING_INFO
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint16_t Version; // 0x00
	std::uint16_t Flags; // 0x02
	BitnessType_t<HANDLE> ProcessHandle; // 0x04 / 0x08
	BitnessType_t<std::size_t> EntriesCount; // 0x08 / 0x10
	RTLP_TAG_INFO<nBitness> Entries[ANYSIZE_ARRAY]; // 0x0C / 0x18
};
#endif

_Q_NT_BIT_TEMPLATE struct PROCESS_HEAP_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::size_t> ReserveSize; // 0x00
	BitnessType_t<std::size_t> CommitSize; // 0x04 / 0x08
	std::uint32_t NumberOfHeaps; // 0x08 / 0x10
	BitnessType_t<std::uintptr_t> FirstHeapInformationOffset; // 0x0C / 0x18
};
_Q_NT_BIT_ASSERT(PROCESS_HEAP_INFORMATION, 0x10, 0x20);

_Q_NT_BIT_TEMPLATE struct HEAP_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> Address; // 0x00
	std::uint32_t Mode; // 0x04 / 0x08
	BitnessType_t<std::size_t> ReserveSize; // 0x08 // 0x10
	BitnessType_t<std::size_t> CommitSize; // 0x0C / 0x18
	BitnessType_t<std::uintptr_t> FirstRegionInformationOffset; // 0x10 / 0x20
	BitnessType_t<std::uintptr_t> NextHeapInformationOffset; // 0x14 / 0x28
};
_Q_NT_BIT_ASSERT(HEAP_INFORMATION, 0x18, 0x30);

_Q_NT_BIT_TEMPLATE struct HEAP_REGION_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> Address; // 0x00
	BitnessType_t<std::size_t> ReserveSize; // 0x04 / 0x08
	BitnessType_t<std::size_t> CommitSize; // 0x08 / 0x10
	BitnessType_t<std::uintptr_t> FirstRangeInformationOffset; // 0x0C / 0x18
	BitnessType_t<std::uintptr_t> NextRegionInformationOffset; // 0x10 / 0x20
};
_Q_NT_BIT_ASSERT(HEAP_REGION_INFORMATION, 0x14, 0x28);

_Q_NT_BIT_TEMPLATE struct HEAP_RANGE_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> Address; // 0x00
	BitnessType_t<std::size_t> Size; // 0x04 / 0x08
	std::uint32_t Type; // 0x08 / 0x10
	std::uint32_t Protection; // 0x0C / 0x14
	BitnessType_t<std::uintptr_t> FirstBlockInformationOffset; // 0x10 / 0x18
	BitnessType_t<std::uintptr_t> NextRangeInformationOffset; // 0x14 / 0x20
};
_Q_NT_BIT_ASSERT(HEAP_RANGE_INFORMATION, 0x18, 0x28);

_Q_NT_BIT_TEMPLATE struct HEAP_BLOCK_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> Address; // 0x00
	std::uint32_t Flags; // 0x04 / 0x08
	BitnessType_t<std::size_t> DataSize; // 0x08 / 0x10
	BitnessType_t<std::uintptr_t> OverheadSize; // 0x0C / 0x18
	BitnessType_t<std::uintptr_t> NextBlockInformationOffset; // 0x10 / 0x20
};
_Q_NT_BIT_ASSERT(HEAP_BLOCK_INFORMATION, 0x14, 0x28);

#if Q_NT_VERSION >= Q_NT_WINBLUE
_Q_NT_BIT_TEMPLATE struct SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::size_t> SegmentReserveSize; // 0x00
	BitnessType_t<std::size_t> SegmentCommitSize; // 0x04 / 0x08
	BitnessType_t<std::size_t> SegmentCount; // 0x08 / 0x10
	BitnessType_t<std::size_t> AllocatedSize; // 0x0C / 0x18
	BitnessType_t<std::size_t> LargeAllocReserveSize; // 0x10 / 0x20
	BitnessType_t<std::size_t> LargeAllocCommitSize; // 0x14 / 0x28
};
_Q_NT_BIT_ASSERT(SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION, 0x18, 0x30);
#endif

_Q_NT_BIT_TEMPLATE struct HEAP_PERFORMANCE_COUNTERS_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t Size; // 0x00
	std::uint32_t Version; // 0x04
	std::uint32_t HeapIndex; // 0x08
	std::uint32_t LastHeapIndex; // 0x0C
	BitnessType_t<void*> BaseAddress; // 0x10
	BitnessType_t<std::size_t> ReserveSize; // 0x14 / 0x18
	BitnessType_t<std::size_t> CommitSize; // 0x18 / 0x20
	std::uint32_t SegmentCount; // 0x1C / 0x28
	BitnessType_t<std::size_t> LargeUCRMemory; // 0x20 / 0x30
	std::uint32_t UCRLength; // 0x24 / 0x38
#if Q_NT_VERSION >= Q_NT_WIN7
	BitnessType_t<std::size_t> AllocatedSpace; // 0x28 / 0x40
#endif
	BitnessType_t<std::size_t> FreeSpace; // 0x2C / 0x48
	std::uint32_t FreeListLength; // 0x30 / 0x50
	std::uint32_t Contention; // 0x34 / 0x54
	std::uint32_t VirtualBlocks; // 0x38 / 0x58
	std::uint32_t CommitRate; // 0x3C / 0x5C
	std::uint32_t DecommitRate; // 0x40 / 0x60
#if Q_NT_VERSION >= Q_NT_WIN11_22H2
	std::uint64_t HeapTag; // 0x48 / 0x68
#endif
#if Q_NT_VERSION >= Q_NT_WINBLUE
	SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION<nBitness> SegmentHeapPerfInformation; // 0x50 / 0x70
#endif
};
_Q_NT_BIT_ASSERT(HEAP_PERFORMANCE_COUNTERS_INFORMATION, 0x68, 0xA0);

_Q_NT_BIT_TEMPLATE struct HEAP_INFORMATION_ITEM
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t Level; // 0x00
	BitnessType_t<std::size_t> Size; // 0x04 / 0x08
	union
	{
		PROCESS_HEAP_INFORMATION<nBitness> ProcessHeapInformation;
		HEAP_INFORMATION<nBitness> HeapInformation;
		HEAP_REGION_INFORMATION<nBitness> HeapRegionInformation;
		HEAP_RANGE_INFORMATION<nBitness> HeapRangeInformation;
		HEAP_BLOCK_INFORMATION<nBitness> HeapBlockInformation;
		HEAP_PERFORMANCE_COUNTERS_INFORMATION<nBitness> HeapPerfInformation;
		BitnessType_t<std::uintptr_t> DynamicStart;
	}; // 0x08 / 0x10
};
_Q_NT_BIT_ASSERT(HEAP_INFORMATION_ITEM, 0x70, 0xB0);

using PRTL_HEAP_EXTENDED_ENUMERATION_ROUTINE = NTSTATUS(NTAPI*)(HEAP_INFORMATION_ITEM<Q_ARCH_BIT>* Information, void* Context);

_Q_NT_BIT_TEMPLATE struct HEAP_EXTENDED_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<HANDLE> ProcessHandle; // 0x00
	BitnessType_t<void*> Heap; // 0x04 / 0x08
	std::uint32_t Level; // 0x08 / 0x10
	BitnessType_t<PRTL_HEAP_EXTENDED_ENUMERATION_ROUTINE> CallbackRoutine; // 0x0C / 0x18
	BitnessType_t<void*> CallbackContext; // 0x10 / 0x20
	union
	{
		PROCESS_HEAP_INFORMATION<nBitness> ProcessHeapInformation;
		HEAP_INFORMATION<nBitness> HeapInformation;
	}; // 0x14 / 0x28
};
_Q_NT_BIT_ASSERT(HEAP_EXTENDED_INFORMATION, 0x2C, 0x58);

#if Q_NT_VERSION >= Q_NT_WIN10_RS1
using PRTL_HEAP_STACK_WRITE_ROUTINE = NTSTATUS(NTAPI*)(void* Information, std::uint32_t Size, void* Context);

_Q_NT_BIT_TEMPLATE struct RTL_HEAP_STACK_QUERY
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t Version; // 0x00
	BitnessType_t<HANDLE> ProcessHandle; // 0x04 / 0x08
	BitnessType_t<PRTL_HEAP_STACK_WRITE_ROUTINE> WriteRoutine; // 0x08 / 0x10
	BitnessType_t<void*> SerializationContext; // 0x0C / 0x18
#if Q_NT_VERSION >= Q_NT_WIN10_RS5
	std::uint8_t QueryLevel; // 0x10 / 0x20
	std::uint8_t Flags; // 0x11 / 0x21
#endif
};
_Q_NT_BIT_ASSERT(RTL_HEAP_STACK_QUERY, 0x14, 0x28);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_RS2
_Q_NT_BIT_TEMPLATE struct RTL_HEAP_STACK_CONTROL
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint16_t Version; // 0x0
	std::uint16_t Flags; // 0x2
	BitnessType_t<HANDLE> ProcessHandle; // 0x4 / 0x8
};
_Q_NT_BIT_ASSERT(RTL_HEAP_STACK_CONTROL, 0x8, 0x10);
#endif

using PRTL_HEAP_DEBUGGING_INTERCEPTOR_ROUTINE = NTSTATUS(NTAPI*)(void* HeapHandle, std::uint32_t Action, std::uint32_t StackFramesToCapture, void** StackTrace);
using PRTL_HEAP_LEAK_ENUMERATION_ROUTINE = NTSTATUS(NTAPI*)(std::int32_t Reserved, void* HeapHandle, void* BaseAddress, std::size_t BlockSize, std::uint32_t StackTraceDepth, void** StackTrace);

_Q_NT_BIT_TEMPLATE struct HEAP_DEBUGGING_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<PRTL_HEAP_DEBUGGING_INTERCEPTOR_ROUTINE> InterceptorFunction; // 0x00
	std::uint16_t InterceptorValue; // 0x04 / 0x08
	std::uint32_t ExtendedOptions; // 0x08 / 0x0C
	std::uint32_t StackTraceDepth; // 0x0C / 0x10
	BitnessType_t<std::size_t> MinTotalBlockSize; // 0x10 / 0x18
	BitnessType_t<std::size_t> MaxTotalBlockSize; // 0x14 / 0x20
	BitnessType_t<PRTL_HEAP_LEAK_ENUMERATION_ROUTINE> HeapLeakEnumerationRoutine; // 0x18 / 0x28
};
_Q_NT_BIT_ASSERT(HEAP_DEBUGGING_INFORMATION, 0x1C, 0x30);
#pragma endregion

#pragma region rtl_memory_zone
#if Q_NT_VERSION >= Q_NT_VISTA
_Q_NT_BIT_TEMPLATE struct RTL_MEMORY_ZONE_SEGMENT
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<RTL_MEMORY_ZONE_SEGMENT*> NextSegment; // 0x00
	BitnessType_t<std::size_t> Size; // 0x04 / 0x08
	BitnessType_t<void*> Next; // 0x08 / 0x10
	BitnessType_t<void*> Limit; // 0x0C / 0x18
};
_Q_NT_BIT_ASSERT(RTL_MEMORY_ZONE_SEGMENT, 0x10, 0x20);

_Q_NT_BIT_TEMPLATE struct RTL_MEMORY_ZONE
{
private:
	_Q_NT_BIT_TYPE
public:
	RTL_MEMORY_ZONE_SEGMENT<nBitness> Segment; // 0x00
	RTL_SRWLOCK<nBitness> Lock; // 0x10 / 0x20
	std::uint32_t LockCount; // 0x14 / 0x28
	BitnessType_t<RTL_MEMORY_ZONE_SEGMENT<nBitness>*> FirstSegment; // 0x18 / 0x30
};
_Q_NT_BIT_ASSERT(RTL_MEMORY_ZONE, 0x1C, 0x38);
#endif
#pragma endregion

#pragma region rtl_stack
#define MAX_STACK_DEPTH 32

_Q_NT_BIT_TEMPLATE struct RTL_PROCESS_BACKTRACE_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<char*> SymbolicBackTrace; // 0x00
	std::uint32_t TraceCount; // 0x04 / 0x08
	std::uint16_t Index; // 0x08 / 0x0C
	std::uint16_t Depth; // 0x0A / 0x0E
	BitnessType_t<void*> BackTrace[MAX_STACK_DEPTH]; // 0x0C / 0x10
};
_Q_NT_BIT_ASSERT(RTL_PROCESS_BACKTRACE_INFORMATION, 0x8C, 0x110);

_Q_NT_BIT_TEMPLATE struct RTL_PROCESS_BACKTRACES
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::size_t> CommittedMemory; // 0x00
	BitnessType_t<std::size_t> ReservedMemory; // 0x04 / 0x08
	std::uint32_t NumberOfBackTraceLookups; // 0x08 / 0x10
	std::uint32_t NumberOfBackTraces; // 0x0C / 0x14
	RTL_PROCESS_BACKTRACE_INFORMATION<nBitness> BackTraces[ANYSIZE_ARRAY]; // 0x10 / 0x18
};

_Q_NT_BIT_TEMPLATE struct RTL_STACK_CONTEXT_ENTRY
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::uintptr_t> Address; // 0x0
	BitnessType_t<std::uintptr_t> Data; // 0x4 / 0x8
};
_Q_NT_BIT_ASSERT(RTL_STACK_CONTEXT_ENTRY, 0x8, 0x10);

_Q_NT_BIT_TEMPLATE struct RTL_STACK_CONTEXT
{
	std::uint32_t NumberOfEntries; // 0x0
	RTL_STACK_CONTEXT_ENTRY<nBitness> Entry[ANYSIZE_ARRAY]; // 0x4 / 0x8
};
#pragma endregion

#pragma region rtl_debug
#define RTL_QUERY_PROCESS_MODULES		0x00000001
#define RTL_QUERY_PROCESS_BACKTRACES	0x00000002
#define RTL_QUERY_PROCESS_HEAP_SUMMARY	0x00000004
#define RTL_QUERY_PROCESS_HEAP_TAGS		0x00000008
#define RTL_QUERY_PROCESS_HEAP_ENTRIES	0x00000010
#define RTL_QUERY_PROCESS_LOCKS			0x00000020
#define RTL_QUERY_PROCESS_MODULES32		0x00000040
#define RTL_QUERY_PROCESS_NONINVASIVE	0x80000000

_Q_NT_BIT_TEMPLATE struct RTL_PROCESS_LOCK_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> Address; // 0x00
	std::uint16_t Type; // 0x04 / 0x08
	std::uint16_t CreatorBackTraceIndex; // 0x06 / 0x0A
	BitnessType_t<void*> OwningThread; // 0x08 / 0x10
	std::int32_t LockCount; // 0x0C / 0x18
	std::uint32_t ContentionCount; // 0x10 / 0x1C
	std::uint32_t EntryCount; // 0x14 / 0x20
	std::int32_t RecursionCount; // 0x18 / 0x24
	std::uint32_t NumberOfWaitingShared; // 0x1C / 0x28
	std::uint32_t NumberOfWaitingExclusive; // 0x20 / 0x2C
};
_Q_NT_BIT_ASSERT(RTL_PROCESS_LOCK_INFORMATION, 0x24, 0x30);

_Q_NT_BIT_TEMPLATE struct RTL_PROCESS_LOCKS
{
	std::uint32_t NumberOfLocks; // 0x0
	RTL_PROCESS_LOCK_INFORMATION<nBitness> Locks[ANYSIZE_ARRAY]; // 0x8
};

struct RTL_PROCESS_VERIFIER_OPTIONS
{
	std::uint32_t SizeStruct; // 0x0
	std::uint32_t Option; // 0x4
	std::uint8_t OptionData[ANYSIZE_ARRAY]; // 0x8
};

_Q_NT_BIT_TEMPLATE struct RTL_DEBUG_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<HANDLE> SectionHandleClient; // 0x00
	BitnessType_t<void*> ViewBaseClient; // 0x04 / 0x08
	BitnessType_t<void*> ViewBaseTarget; // 0x08 / 0x10
	BitnessType_t<std::uintptr_t> ViewBaseDelta; // 0x0C / 0x18
	BitnessType_t<HANDLE> EventPairClient; // 0x10 / 0x20
	BitnessType_t<HANDLE> EventPairTarget; // 0x14 / 0x28
	BitnessType_t<HANDLE> TargetProcessId; // 0x18 / 0x30
	BitnessType_t<HANDLE> TargetThreadHandle; // 0x1C / 0x38
	std::uint32_t Flags; // 0x20 / 0x40
	BitnessType_t<std::size_t> OffsetFree; // 0x24 / 0x48
	BitnessType_t<std::size_t> CommitSize; // 0x28 / 0x50
	BitnessType_t<std::size_t> ViewSize; // 0x2C / 0x58
	union
	{
		BitnessType_t<RTL_PROCESS_MODULES<nBitness>*> Modules;
		BitnessType_t<RTL_PROCESS_MODULE_INFORMATION_EX<nBitness>*> ModulesEx;
	}; // 0x30 / 0x60
	BitnessType_t<RTL_PROCESS_BACKTRACES<nBitness>*> BackTraces; // 0x34 / 0x68
	BitnessType_t<void*> Heaps; // 0x38 / 0x70
	BitnessType_t<RTL_PROCESS_LOCKS<nBitness>*> Locks; // 0x3C / 0x78
	BitnessType_t<void*> SpecificHeap; // 0x40 / 0x80
	BitnessType_t<HANDLE> TargetProcessHandle; // 0x44 / 0x88
	BitnessType_t<RTL_PROCESS_VERIFIER_OPTIONS*> VerifierOptions; // 0x48 / 0x90
	BitnessType_t<void*> ProcessHeap; // 0x4C / 0x98
	BitnessType_t<HANDLE> CriticalSectionHandle; // 0x50 / 0xA0
	BitnessType_t<HANDLE> CriticalSectionOwnerThread; // 0x54 / 0xA8
	BitnessType_t<void*> Reserved[4]; // 0x58 / 0xB0
};
_Q_NT_BIT_ASSERT(RTL_DEBUG_INFORMATION, 0x68, 0xD0);
#pragma endregion

#pragma region rtl_message
_Q_NT_BIT_TEMPLATE struct PARSE_MESSAGE_CONTEXT
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t fFlags; // 0x00
	std::uint32_t cwSavColumn; // 0x04
	BitnessType_t<std::size_t> iwSrc; // 0x08
	BitnessType_t<std::size_t> iwDst; // 0x0C / 0x10
	BitnessType_t<std::size_t> iwDstSpace; // 0x10 / 0x18
	BitnessType_t<va_list> lpvArgStart; // 0x14 / 0x20
};
_Q_NT_BIT_ASSERT(PARSE_MESSAGE_CONTEXT, 0x18, 0x28);
#pragma endregion

#pragma region rtl_time
struct RTL_TIME_ZONE_INFORMATION
{
	std::int32_t Bias; // 0x00
	wchar_t StandardName[32]; // 0x04
	TIME_FIELDS StandardStart; // 0x44
	std::int32_t StandardBias; // 0x54
	wchar_t DaylightName[32]; // 0x58
	TIME_FIELDS DaylightStart; // 0x98
	std::int32_t DaylightBias; // 0xA8
};
static_assert(sizeof(RTL_TIME_ZONE_INFORMATION) == 0xAC);
#pragma endregion

#pragma region rtl_bitmap
_Q_NT_BIT_TEMPLATE struct RTL_BITMAP
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t SizeOfBitMap; // 0x0
	BitnessType_t<std::uint32_t*> Buffer; // 0x4 / 0x8
};
_Q_NT_BIT_ASSERT(RTL_BITMAP, 0x8, 0x10);

_Q_NT_BIT_TEMPLATE struct RTL_BITMAP_EX
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint64_t SizeOfBitMap; // 0x0
	BitnessType_t<std::uint64_t*> Buffer; // 0x8
};
_Q_NT_BIT_ASSERT(RTL_BITMAP_EX, 0x10, 0x10);

struct RTL_BITMAP_RUN
{
	std::uint32_t StartingIndex; // 0x0
	std::uint32_t NumberOfBits; // 0x4
};
static_assert(sizeof(RTL_BITMAP_RUN) == 0x8);
#pragma endregion

#pragma region rtl_handle_table
#define RTL_HANDLE_ALLOCATED static_cast<std::uint16_t>(0x0001)

_Q_NT_BIT_TEMPLATE struct RTL_HANDLE_TABLE_ENTRY
{
private:
	_Q_NT_BIT_TYPE
public:
	union
	{
		std::uint32_t Flags;
		BitnessType_t<RTL_HANDLE_TABLE_ENTRY*> NextFree;
	};
};
_Q_NT_BIT_ASSERT(RTL_HANDLE_TABLE_ENTRY, 0x4, 0x8);

_Q_NT_BIT_TEMPLATE struct RTL_HANDLE_TABLE
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t MaximumNumberOfHandles; // 0x00
	std::uint32_t SizeOfHandleTableEntry; // 0x04
	std::uint32_t Reserved[2]; // 0x08
	BitnessType_t<RTL_HANDLE_TABLE_ENTRY<nBitness>*> FreeHandles; // 0x10
	BitnessType_t<RTL_HANDLE_TABLE_ENTRY<nBitness>*> CommittedHandles; // 0x14 / 0x18
	BitnessType_t<RTL_HANDLE_TABLE_ENTRY<nBitness>*> UnCommittedHandles; // 0x18 / 0x20
	BitnessType_t<RTL_HANDLE_TABLE_ENTRY<nBitness>*> MaxReservedHandles; // 0x1C / 0x28
};
_Q_NT_BIT_ASSERT(RTL_HANDLE_TABLE, 0x20, 0x30);
#pragma endregion

#pragma region rtl_atom_table
using RTL_ATOM = std::uint16_t;

#define RTL_ATOM_MAXIMUM_INTEGER_ATOM static_cast<NT::RTL_ATOM>(0xC000)
#define RTL_ATOM_INVALID_ATOM static_cast<NT::RTL_ATOM>(0x0000)

#define RTL_ATOM_TABLE_DEFAULT_NUMBER_OF_BUCKETS 37
#define RTL_ATOM_MAXIMUM_NAME_LENGTH 255

#define RTL_ATOM_PINNED 0x01

#if Q_NT_VERSION >= Q_NT_WIN8
_Q_NT_BIT_TEMPLATE struct RTL_ATOM_TABLE_REFERENCE
{
	LIST_ENTRY<nBitness> LowBoxList; // 0x00
	std::uint32_t LowBoxID; // 0x08 / 0x10
	std::uint16_t ReferenceCount; // 0x0C / 0x14
	std::uint16_t Flags; // 0x0E / 0x16
};
_Q_NT_BIT_ASSERT(RTL_ATOM_TABLE_REFERENCE, 0x10, 0x18);
#endif

_Q_NT_BIT_TEMPLATE struct RTL_ATOM_TABLE_ENTRY
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<RTL_ATOM_TABLE_ENTRY*> HashLink; // 0x00
	std::uint16_t HandleIndex; // 0x04 / 0x08
	RTL_ATOM Atom; // 0x06 / 0x0A
#if Q_NT_VERSION >= Q_NT_WIN8
	RTL_ATOM_TABLE_REFERENCE<nBitness> Reference; // 0x08 / 0x10
#else
	std::uint16_t ReferenceCount; // 0x08 / 0x0C
	std::uint8_t Flags; // 0x18 / 0x28
#endif
	std::uint8_t NameLength; // 0x18 / 0x28
	wchar_t Name[ANYSIZE_ARRAY]; // 0x1A / 0x2A
};

_Q_NT_BIT_TEMPLATE struct RTL_ATOM_TABLE
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t Signature; // 0x00
	RTL_CRITICAL_SECTION<nBitness> CriticalSection; // 0x04 / 0x08
	RTL_HANDLE_TABLE<nBitness> RtlHandleTable; // 0x1C / 0x30
	std::uint32_t NumberOfBuckets; // 0x3C / 0x60
	BitnessType_t<RTL_ATOM_TABLE_ENTRY<nBitness>*> Buckets[ANYSIZE_ARRAY]; // 0x40 / 0x68
};
#pragma endregion

#pragma region rtl_registry
#define RTL_QUERY_REGISTRY_SUBKEY		0x00000001
#define RTL_QUERY_REGISTRY_TOPKEY		0x00000002
#define RTL_QUERY_REGISTRY_REQUIRED		0x00000004
#define RTL_QUERY_REGISTRY_NOVALUE		0x00000008
#define RTL_QUERY_REGISTRY_NOEXPAND		0x00000010
#define RTL_QUERY_REGISTRY_DIRECT		0x00000020
#define RTL_QUERY_REGISTRY_DELETE		0x00000040
// @todo: below after WINXP
#define RTL_QUERY_REGISTRY_NOSTRING		0x00000080 // deprecated
#define RTL_QUERY_REGISTRY_TYPECHECK	0x00000100

using PRTL_QUERY_REGISTRY_ROUTINE = NTSTATUS(NTAPI*)(const wchar_t* ValueName, std::uint32_t ValueType, void* ValueData, std::uint32_t ValueLength, void* Context, void* EntryContext);

_Q_NT_BIT_TEMPLATE struct RTL_QUERY_REGISTRY_TABLE
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<PRTL_QUERY_REGISTRY_ROUTINE> QueryRoutine; // 0x00
	std::uint32_t Flags; // 0x04 / 0x08 // RTL_QUERY_REGISTRY_*
	BitnessType_t<wchar_t*> Name; // 0x08 / 0x10
	BitnessType_t<void*> EntryContext; // 0x0C / 0x18
	std::uint32_t DefaultType; // 0x10 / 0x20
	BitnessType_t<void*> DefaultData; // 0x14 / 0x28
	std::uint32_t DefaultLength; // 0x18 / 0x30
};
_Q_NT_BIT_ASSERT(RTL_QUERY_REGISTRY_TABLE, 0x1C, 0x38);
#pragma endregion

#pragma region rtl_event_trace
#define RTL_UNLOAD_EVENT_TRACE_NUMBER 64

_Q_NT_BIT_TEMPLATE struct RTL_UNLOAD_EVENT_TRACE
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> BaseAddress; // 0x00
	BitnessType_t<std::size_t> SizeOfImage; // 0x04 / 0x08
	std::uint32_t Sequence; // 0x08 / 0x10
	std::uint32_t TimeDateStamp; // 0x0C / 0x14
	std::uint32_t CheckSum; // 0x10 / 0x18
	wchar_t ImageName[32]; // 0x14 / 0x1C
#if Q_NT_VERSION >= Q_NT_WIN7
	std::uint32_t Version[2]; // 0x54 / 0x5C
#endif
};
_Q_NT_BIT_ASSERT(RTL_UNLOAD_EVENT_TRACE, 0x5C, 0x68);
#pragma endregion

#pragma region rtl_feature
#if Q_NT_VERSION >= Q_NT_WIN10_20H1
struct RTL_FEATURE_USAGE_REPORT
{
	std::uint32_t FeatureId; // 0x0
	std::uint16_t ReportingKind; // 0x4
	std::uint16_t ReportingOptions; // 0x6
};
static_assert(sizeof(RTL_FEATURE_USAGE_REPORT) == 0x8);

using RTL_FEATURE_CONFIGURATION_TYPE = enum _RTL_FEATURE_CONFIGURATION_TYPE
{
	RtlFeatureConfigurationBoot = 0,
	RtlFeatureConfigurationRuntime = 1,
	RtlFeatureConfigurationCount = 2
};

struct RTL_FEATURE_CONFIGURATION
{
	std::uint32_t FeatureId; // 0x0
	struct
	{
		std::uint32_t Priority : 4;
		std::uint32_t EnabledState : 2;
		std::uint32_t IsWexpConfiguration : 1;
		std::uint32_t HasSubscriptions : 1;
		std::uint32_t Variant : 6;
		std::uint32_t VariantPayloadKind : 2;
	}; // 0x4
	std::uint32_t VariantPayload; // 0x8
};
static_assert(sizeof(RTL_FEATURE_CONFIGURATION) == 0xC);

struct RTL_FEATURE_CONFIGURATION_TABLE
{
	std::uint32_t FeatureCount;
	RTL_FEATURE_CONFIGURATION Features[ANYSIZE_ARRAY];
};

using RTL_FEATURE_CONFIGURATION_PRIORITY = enum _RTL_FEATURE_CONFIGURATION_PRIORITY
{
#if Q_NT_VERSION >= Q_NT_WIN10_20H2
	FeatureConfigurationPriorityImageDefault = 0,
#else
	FeatureConfigurationPriorityAll = 0,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11_23H2
	FeatureConfigurationPriorityEKB = 1,
	FeatureConfigurationPrioritySafeguard = 2,
	FeatureConfigurationPriorityPersistent = FeatureConfigurationPrioritySafeguard,
#endif
	FeatureConfigurationPriorityService = 4,
#if Q_NT_VERSION >= Q_NT_WIN11_23H2
	FeatureConfigurationPriorityDynamic = 6,
#endif
	FeatureConfigurationPriorityUser = 8,
#if Q_NT_VERSION >= Q_NT_WIN11_23H2
	FeatureConfigurationPrioritySecurity = 9,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_20H2
	FeatureConfigurationPriorityUserPolicy = 10,
	FeatureConfigurationPriorityTest = 12,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_20H2
	FeatureConfigurationPriorityImageOverride = 15,
#endif
	FeatureConfigurationPriorityMax = 15
};

using RTL_FEATURE_ENABLED_STATE = enum _RTL_FEATURE_ENABLED_STATE
{
	FeatureEnabledStateDefault = 0,
	FeatureEnabledStateDisabled = 1,
	FeatureEnabledStateEnabled = 2
};

using RTL_FEATURE_ENABLED_STATE_OPTIONS = enum _RTL_FEATURE_ENABLED_STATE_OPTIONS
{
	FeatureEnabledStateOptionsNone = 0,
	FeatureEnabledStateOptionsWexpConfig = 1
};

using RTL_FEATURE_VARIANT_PAYLOAD_KIND = enum _RTL_FEATURE_VARIANT_PAYLOAD_KIND
{
	FeatureVariantPayloadKindNone = 0,
	FeatureVariantPayloadKindResident = 1,
	FeatureVariantPayloadKindExternal = 2
};

using RTL_FEATURE_CONFIGURATION_OPERATION = enum _RTL_FEATURE_CONFIGURATION_OPERATION
{
	FeatureConfigurationOperationNone = 0,
	FeatureConfigurationOperationFeatureState = 1,
	FeatureConfigurationOperationVariantState = 2,
	FeatureConfigurationOperationResetState = 4
};

struct RTL_FEATURE_CONFIGURATION_UPDATE
{
	std::uint32_t FeatureId; // 0x00
	RTL_FEATURE_CONFIGURATION_PRIORITY Priority; // 0x04
	RTL_FEATURE_ENABLED_STATE EnabledState; // 0x08
	RTL_FEATURE_ENABLED_STATE_OPTIONS EnabledStateOptions; // 0x0C
	std::uint8_t Variant; // 0x10
	std::uint8_t Reserved[3]; // 0x11
	RTL_FEATURE_VARIANT_PAYLOAD_KIND VariantPayloadKind; // 0x14
	std::uint32_t VariantPayload; // 0x18
	RTL_FEATURE_CONFIGURATION_OPERATION Operation; // 0x1C
};
static_assert(sizeof(RTL_FEATURE_CONFIGURATION_UPDATE) == 0x20);

struct RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET
{
	std::uint32_t Data[2];
};
static_assert(sizeof(RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET) == 0x8);

struct RTL_FEATURE_USAGE_DATA
{
	std::uint32_t FeatureId; // 0x0
	std::uint16_t ReportingKind; // 0x4
	std::uint16_t Reserved; // 0x6
};
static_assert(sizeof(RTL_FEATURE_USAGE_DATA) == 0x8);

struct RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS
{
	std::uint32_t FeatureId; // 0x0
	std::uint16_t ReportingKind; // 0x4
	std::uint16_t ReportingOptions; // 0x6
	RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET ReportingTarget; // 0x8
};
static_assert(sizeof(RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS) == 0x10);

struct RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE
{
	std::uint32_t SubscriptionCount;
	RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS Subscriptions[ANYSIZE_ARRAY];
};

using PRTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK = void(NTAPI*)(void* Context);

struct SYSTEM_FEATURE_CONFIGURATION_QUERY
{
	RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType; // 0x0
	std::uint32_t FeatureId; // 0x4
};
static_assert(sizeof(SYSTEM_FEATURE_CONFIGURATION_QUERY) == 0x8);

struct SYSTEM_FEATURE_CONFIGURATION_INFORMATION
{
	std::uint64_t ChangeStamp; // 0x0
	RTL_FEATURE_CONFIGURATION Configuration; // 0x8
};
static_assert(sizeof(SYSTEM_FEATURE_CONFIGURATION_INFORMATION) == 0x18);

using SYSTEM_FEATURE_CONFIGURATION_UPDATE_TYPE = enum _SYSTEM_FEATURE_CONFIGURATION_UPDATE_TYPE
{
	SystemFeatureConfigurationUpdateTypeUpdate = 0,
	SystemFeatureConfigurationUpdateTypeOverwrite = 1,
	SystemFeatureConfigurationUpdateTypeCount = 2
};

_Q_NT_BIT_TEMPLATE struct SYSTEM_FEATURE_CONFIGURATION_UPDATE
{
#if Q_NT_VERSION >= Q_NT_WIN11_22H2
private:
	_Q_NT_BIT_TYPE
public:
	SYSTEM_FEATURE_CONFIGURATION_UPDATE_TYPE UpdateType; // 0x00
	union
	{
		struct
		{
			std::uint64_t PreviousChangeStamp;
			RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType;
			std::uint32_t UpdateCount;
			RTL_FEATURE_CONFIGURATION_UPDATE Updates[ANYSIZE_ARRAY];
		} Update;
		struct
		{
			std::uint64_t PreviousChangeStamp;
			RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType;
			BitnessType_t<std::size_t> BufferSize;
			BitnessType_t<void*> Buffer;
		} Overwrite;
	}; // 0x08
#else
	std::uint64_t PreviousChangeStamp; // 0x00
	RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType; // 0x08
	std::uint32_t UpdateCount; // 0x0C
	RTL_FEATURE_CONFIGURATION_UPDATE Updates[ANYSIZE_ARRAY]; // 0x10
#endif
};
_Q_NT_BIT_ASSERT(SYSTEM_FEATURE_CONFIGURATION_UPDATE, 0x38, 0x38);

_Q_NT_BIT_TEMPLATE struct SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint64_t ChangeStamp; // 0x00
	BitnessType_t<void*> Section; // 0x08
	BitnessType_t<std::size_t> Size; // 0x0C / 0x10
};
_Q_NT_BIT_ASSERT(SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY, 0x10, 0x18);

using SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE = enum _SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE
{
	SystemFeatureConfigurationSectionTypeBoot = 0,
	SystemFeatureConfigurationSectionTypeRuntime = 1,
	SystemFeatureConfigurationSectionTypeUsageTriggers = 2,
	SystemFeatureConfigurationSectionTypeCount = 3
};

struct SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST
{
	std::uint64_t PreviousChangeStamps[SystemFeatureConfigurationSectionTypeCount];
};
static_assert(sizeof(SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST) == 0x18);

_Q_NT_BIT_TEMPLATE struct SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION
{
	std::uint64_t OverallChangeStamp; // 0x0
	SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY<nBitness> Descriptors[SystemFeatureConfigurationSectionTypeCount]; // 0x8
};
_Q_NT_BIT_ASSERT(SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION, 0x38, 0x50);

struct SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS
{
	std::uint32_t FeatureId; // 0x0
	std::uint16_t ReportingKind; // 0x4
	std::uint16_t ReportingOptions; // 0x6
	RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET ReportingTarget; // 0x8
};
static_assert(sizeof(SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS) == 0x10);

struct SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY
{
	std::uint32_t Remove; // 0x0
	RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS Details; // 0x4
};
static_assert(sizeof(SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY) == 0x14);

struct SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE
{
	std::uint32_t UpdateCount; // 0x0
	SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY Updates[ANYSIZE_ARRAY]; // 0x4
};
#endif
#pragma endregion

#pragma region rtl_run_once
_Q_NT_BIT_TEMPLATE union RTL_RUN_ONCE
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> Ptr;
};
_Q_NT_BIT_ASSERT(RTL_RUN_ONCE, 0x4, 0x8);
#pragma endregion
#pragma pack(pop)