SYSTEM_VDM_INSTEMUL_INFORMATION

The SYSTEM_VDM_INSTEMUL_INFORMATION structure is what a successful call to ZwQuerySystemInformation or NtQuerySystemInformation produces in its output buffer when given the information class SystemVdmInstemulInformation (0x13).

The x64 builds reject this information class as not implemented.

Documentation Status

The SYSTEM_VDM_INSTEMUL_INFORMATION structure is not documented.

Layout

The SYSTEM_VDM_INSTEMUL_INFORMATION is 0x88 bytes in both 32-bit and 64-bit Windows.

Offset Definition
0x00
ULONG SegmentNotPresent;
0x04
ULONG VdmOpcode0F;
0x08
ULONG OpcodeESPrefix;
0x0C
ULONG OpcodeCSPrefix;
0x10
ULONG OpcodeSSPrefix;
0x14
ULONG OpcodeDSPrefix;
0x18
ULONG OpcodeFSPrefix;
0x1C
ULONG OpcodeGSPrefix;
0x20
ULONG OpcodeOPER32Prefix;
0x24
ULONG OpcodeADDR32Prefix;
0x28
ULONG OpcodeINSB;
0x2C
ULONG OpcodeINSW;
0x30
ULONG OpcodeOUTSB;
0x34
ULONG OpcodeOUTSW;
0x38
ULONG OpcodePUSHF;
0x3C
ULONG OpcodePOPF;
0x40
ULONG OpcodeINTnn;
0x44
ULONG OpcodeINTO;
0x48
ULONG OpcodeIRET;
0x4C
ULONG OpcodeINBimm;
0x50
ULONG OpcodeINWimm;
0x54
ULONG OpcodeOUTBimm;
0x58
ULONG OpcodeOUTWimm;
0x5C
ULONG OpcodeINB;
0x60
ULONG OpcodeINW;
0x64
ULONG OpcodeOUTB;
0x68
ULONG OpcodeOUTW;
0x6C
ULONG OpcodeLOCKPrefix;
0x70
ULONG OpcodeREPNEPrefix;
0x74
ULONG OpcodeREPPrefix;
0x78
ULONG OpcodeHLT;
0x7C
ULONG OpcodeCLI;
0x80
ULONG OpcodeSTI;
0x84
ULONG BopCount;