HyperDbg Debugger
Loading...
Searching...
No Matches
nt-list.h File Reference

Cross-platform NT-style intrusive doubly-linked list helpers + CONTAINING_RECORD. More...

#include <stddef.h>

Go to the source code of this file.

Macros

#define CONTAINING_RECORD(address, type, field)

Detailed Description

Cross-platform NT-style intrusive doubly-linked list helpers + CONTAINING_RECORD.

Author
Max Raulea (max.r.nosp@m.aule.nosp@m.a@gma.nosp@m.il.c.nosp@m.om)

The shared debugger code uses the NT LIST_ENTRY API (InitializeListHead, InsertHeadList, RemoveEntryList, CONTAINING_RECORD, ...). On Windows these come from <windows.h> (or, under USE_NATIVE_SDK_HEADERS, from the in-tree platform/user/header/Windows.h). Platforms whose system headers don't ship them (Linux) get them here, so the shared code compiles unchanged.

These operate on the exact LIST_ENTRY {Flink, Blink} layout defined in SDK/headers/DataTypes.h, which is part of the kernel<->user IOCTL ABI – that's why we mirror the NT list rather than reaching for sys/queue.h (different layout + a colliding LIST_ENTRY name).

The body is compiled only where the OS headers don't already provide these (i.e. not on Windows), so including this unconditionally is safe.

Version
0.20
Date
2026-06-16

Macro Definition Documentation

◆ CONTAINING_RECORD

#define CONTAINING_RECORD ( address,
type,
field )
Value:
((type *)((char *)(address) - offsetof(type, field)))
36# define CONTAINING_RECORD(address, type, field) \
37 ((type *)((char *)(address) - offsetof(type, field)))