Wrong offsets for KPCR::Prcb and others

[VelocityRa]

And possibly others.

Take this example: https://github.com/ntdiff/headers/blob/master/Win10_1909_19H2/x64/System32/ntoskrnl.exe/Standalone/_KPCR.h#L1331

For all major compilers , the calculated offset is 0x178, not 0x180: https://godbolt.org/z/ZJ-DfV

Edit: And if I use #pragma pack, the size is 0x174.

---

Apparently the reason is:

Curiously, PcrAlign1 does not by itself align the Prcb that follows. That Prcb is meant to be cache-aligned
is certain: cache  alignment is plainly a recurring concern within the KPRCB and is obviously simpler to
arrange if the KPRCB is itself cache aligned (which it isn’t for 32-bit Windows).

Source

[VelocityRa]

This is also wrong https://github.com/ntdiff/headers/blob/master/Win10_1909_19H2/x64/System32/ntoskrnl.exe/Standalone/_KPRCB.h#L915

It should be at offset 0xFA. Same for the following struct, since said struct has an alignment because of 2 because of the short in there.

[wbenny]

You're probably missing #pragma pack(1) - which is recommended to use with any structs on ntdiff.

[VelocityRa]

@wbenny If I do this, it works in this case, but most other structs break.

For example _EPROCESS size is calculated as 0x868 instead of 0x880 as it says in the ntdiff headers.

[wbenny]

Yup, I've seen that some of the structures in newer Win10 builds are somewhat broken :/ I'll have to look into this.

[john-8998]

any update on this issue?