Geoff Chappell, Software Analyst
The HAL_PRIVATE_DISPATCH structure is a table of pointers to optional HAL functionality. The kernel keeps the one instance of this table. It’s in the kernel’s read-write data section and its address is exported as HalPrivateDispatchTable. The table initially has the kernel’s built-in implementations for most (but not all) of the functions. The HAL overrides most. No known HAL overrides all. Functionality that has no meaning to a particular HAL is left to the kernel’s default (and HAL programmers are spared from writing even dummy code for nothing that matters to them). Moreover, since the address is exported, rather than communicated specifically to the HAL, it seems to have been intended all along—whatever might be inferred from the word private—that the functionality is exposed to other kernel-mode modules such as drivers not only for them to call but also to override further.
Though all Windows versions have a HalPrivateDispatchTable in the kernel and have the HAL override at least some functions, no calling of these functions through the table is known until Windows 2000. In that version and since, the kernel and the HAL each call through the table, and so do other kernel-mode modules. In Windows 2000, these others are BOOTVID.DLL (which calls through the table) and PCI.SYS (which overrides functionality in the table).
Both HAL_PRIVATE_DISPATCH and HalPrivateDispatchTable have always been undocumented. Unlike many other undocumented kernel structures, HAL_PRIVATE_DISPATCH does not have a type definition in any of Microsoft’s published symbol files for any known Windows release. In a recent development, however, a header file, NTOSP.H, in the Windows Driver Kit (WDK) for Windows 10 supplies a C-language definition. This appears to be Microsoft’s first formal disclosure of the structure’s layout. It comes with no conditional compilation blocks for accommodating earlier versions. As supplied, it is immediately useful only for programming that targets Windows 10 specifically, yet doesn’t say so. Add that it appears under a directory named “um” (for user mode) but is meaningful only in kernel mode, and one might wonder if it’s supplied by mistake.
Also likely as a disclosure by mistake is that where the NTDDK.H file, back as far as the Device Driver Kit (DDK) for Windows 2000, defines types for function pointers in the HAL_DISPATCH structure, it has others that can only be for function pointers in the otherwise unmentioned HAL_PRIVATE_DISPATCH. Thus, for instance, the Windows 2000 DDK defines pHalTranslateBusAddress and the Windows XP DDK defines pKdSetupPciDeviceForDebugging, yet uses them nowhere. They are instead the types for the HalPciTranslateBusAddress and KdSetupPciDeviceForDebugging members of the HAL_PRIVATE_DISPATCH. The information that’s disclosed this way is nowhere near complete and is sometimes fleeting: though the two preceding examples survive into the WDK for Windows 10, the pHalGetVectorInput type disappears betwen the WDKs for Windows Vista and Windows 7. Still, combined with symbols for the implementations in the kernel, the HAL and elsewhere, these type definitions have long sufficed for reverse engineers to make relatively easy and confident work of reconstructing what must be a close approximation to Microsoft’s own (evolving) definition of HAL_PRIVATE_DISPATCH. The structure may not have been defined in public until recently, but it has certainly not been unknown to those who fiddle around in the bowels of kernel-mode Windows.
Part of knowing HAL_PRIVATE_DISPATCH, especially if imagining that you actually do have good cause to contemplate real-world use of it, is to appreciate how susceptible is its layout to change from one build of Windows to another. Being touched by many hands—not just shared between the kernel and HAL but also with bus drivers and others—it is far more stable than is any structure that’s internal to one module. Yet it does change.
From the definition in the WDK for Windows 10, one might get the impression that the HAL_PRIVATE_DISPATCH structure accumulated functions in lock step with an increasing Version member that’s at the structure’s very beginning. This would be to misread what Microsoft has disclosed. A comment that “changes to this interface need to be backward-compatible” looks, with access to the historical record, to have been added as a warning, or even as admonishment, after the desired backward-compability had been broken more than a few times. Comments pick up the increasing Version only at 14, by when the changes were indeed more orderly.
The earliest history is a special shambles. Through the first three known Windows versions, the Version stayed at 1 while functions were not just added but redefined. During the life of the second Version, a function was inserted, thus changing the offsets of others. No third or fourth Version is observed in any formal release, but although Version 5 does extend the structure just by adding members, Version 6 not only adds but redefines, and additions for Version 7 get shifted by later insertions. Offsets are stable in Version 14 and higher, apparently after the last build of version 6.1: from then, the structure grows only by adding at its end, and functions that fall out of use are not removed but are instead changed to placeholders. Even so, functions do get redefined and no trace of this remains in Microsoft’s header to alert (even Microsoft’s own) programmers to the variability.
The following table summarises the correspondence between the Version member and the Windows version, as known from formal releases, giving in each case the size of the structure as a rough guide to its growth. Note that by far the most substantial growth was for Windows 8.
Version | Windows Versions | Size (x86) | Size (x64) |
---|---|---|---|
1 | 3.51 and 4.0 | 0x1C | |
5.0 | 0x30 | ||
2 | 5.1 | 0x4C | |
5.2 | 0x50 | 0xA0 | |
5 | early 6.0 (before Windows Vista SP1) | 0x6C | 0xD8 |
6 | late 6.0 (Windows Vista SP1) | 0x88 | 0x0110 |
7 | very late 6.0 (Windows Vista SP2) | 0x90 | 0x0120 |
13 | 6.1 | 0xB8 | 0x0170 |
21 | 6.2 | 0x016C | 0x02D8 |
23 | 6.3 | 0x01A8 | 0x0350 |
32 | 10.0 | 0x01DC | 0x03B8 |
The detailed layout below combines the “official” definition from the WDK for Windows 10 with the best that I have from old notes. For no version before Windows 10 are Microsoft’s names for members known with certainty. The type of function that a member points to can often be deduced either from a known call through the pointer or from a known implementation of the function. Where the type has not changed on the way to Windows 10 I infer that the name has not changed either. Continuity of the name often seems reasonable even if the type has changed (as when arguments are added) and even if the member has moved (because of insertion or removal earlier in the structure). Still, you should understand that this attempt at conveying the historical record cannot be perfect.
Offset (x86) | Offset (x64) | Definition | Versions | Remarks |
---|---|---|---|---|
0x00 | 0x00 |
ULONG Version; |
3.51 and higher | |
0x04 | 0x08 |
BUS_HANDLER * (FASTCALL *HalHandlerForBus) ( INTERFACE_TYPE, ULONG); |
3.51 and higher | |
0x08 | 0x10 |
BUS_HANDLER * (FASTCALL *HalHandlerForConfigSpace) ( BUS_DATA_TYPE, ULONG); |
3.51 and higher | |
0x0C |
VOID (*HalCompleteSlotControl) ( SLOT_CONTROL_CONTEXT *); |
3.51 only |
no default; name inferred from HAL symbols |
|
VOID (*HalCompleteDeviceControl) ( DEVICE_CONTROL_CONTEXT *); |
4.0 only |
no default; name inferred from HAL symbols |
||
0x18 |
VOID (*HalLocateHiberRanges) ( PVOID); |
5.0 and higher | ||
0x10 | 0x20 |
NTSTATUS (*HalRegisterBusHandler) ( INTERFACE_TYPE, BUS_DATA_TYPE, ULONG, INTERFACE_TYPE, ULONG, ULONG, PINSTALL_BUS_HANDLER, BUS_HANDLER *); |
3.51 and higher | |
0x14 | 0x28 | 3.51 and 4.0 |
no default; name and type not known |
|
VOID (*HalSetWakeEnable) ( BOOLEAN); |
5.0 and higher |
no default in 6.2 and higher | ||
0x18 |
PVOID HalSuspendHibernateSystem; |
3.51 and 4.0 |
name inferred from kernel symbols; type not known (8 bytes of arguments) |
|
0x30 |
NTSTATUS (*HalSetWakeAlarm) ( ULONGLONG, TIME_FIELDS *); |
5.0 to 6.1 | ||
NTSTATUS (*HalSetWakeAlarm) ( ULONGLONG, ULONGLONG); |
6.2 and higher |
Offset (x86) | Offset (x64) | Definition | Versions | Remarks |
---|---|---|---|---|
0x1C | 0x38 |
BOOLEAN (*HalPciTranslateBusAddress) ( INTERFACE_TYPE, ULONG, PHYSICAL_ADDRESS, ULONG *, PHYSICAL_ADDRESS *); |
5.0 and higher | |
0x20 | 0x40 |
NTSTATUS (*HalPciAssignSlotResources) ( UNICODE_STRING *, UNICODE_STRING *, DRIVER_OBJECT *, DEVICE_OBJECT *, INTERFACE_TYPE, ULONG, ULONG, CM_RESOURCE_LIST **); |
5.0 and higher | |
0x24 | 0x48 |
VOID (*HalHaltSystem) ( VOID); |
5.0 and higher | |
0x28 | 0x50 |
BOOLEAN (*HalFindBusAddressTranslation) ( PHYSICAL_ADDRESS, ULONG *, PHYSICAL_ADDRESS *, ULONG_PTR *, BOOLEAN); |
5.0 and higher | no default |
0x2C | 0x58 |
BOOLEAN (*HalResetDisplay) ( VOID); |
5.0 and higher | no default |
Offset (x86) | Offset (x64) | Definition | Versions |
---|---|---|---|
0x30 | 0x60 |
NTSTATUS (*HalAllocateMapRegisters) ( ADAPTER_OBJECT *, ULONG, ULONG, MAP_REGISTER_ENTRY *); |
5.2 and higher |
Offset (x86) | Offset (x64) | Definition | Versions |
---|---|---|---|
0x30 (5.1) 0x34 |
0x68 |
NTSTATUS (*KdSetupPciDeviceForDebugging) ( PVOID, DEBUG_DEVICE_DESCRIPTOR *); |
5.1 and higher |
0x34 (5.1) 0x38 |
0x70 |
NTSTATUS (*KdReleasePciDeviceForDebugging) ( DEBUG_DEVICE_DESCRIPTOR *); |
5.1 and higher |
0x38 (5.1) 0x3C |
0x78 |
PVOID (*KdGetAcpiTablePhase0) ( LOADER_PARAMETER_BLOCK *, ULONG); |
5.1 and higher |
0x3C (5.1) 0x40 |
0x80 |
VOID (*KdCheckPowerButton) ( VOID); |
5.1 and higher |
0x40 (5.1) 0x44 |
0x88 |
UCHAR (*HalVectorToIDTEntry) ( ULONG); |
5.1 and higher |
0x44 (5.1) 0x48 |
0x90 |
PVOID (*KdMapPhysicalMemory64) ( PHYSICAL_ADDRESS, ULONG); |
5.1 to early 6.0 |
PVOID (*KdMapPhysicalMemory64) ( PHYSICAL_ADDRESS, ULONG, BOOLEAN); |
late 6.0 and higher | ||
0x48 (5.1) 0x4C |
0x98 |
VOID (*KdUnmapVirtualAddress) ( PVOID, ULONG); |
5.1 to early 6.0 |
VOID (*KdUnmapVirtualAddress) ( PVOID, ULONG, BOOLEAN); |
late 6.0 and higher |
Offset (x86) | Offset (x64) | Definition | Versions | Remarks |
---|---|---|---|---|
0x50 | 0xA0 |
ULONG (*KdGetPciDataByOffset) ( ULONG, ULONG, PVOID, ULONG, ULONG); |
6.0 and higher | no default |
0x54 | 0xA8 |
ULONG (*KdSetPciDataByOffset) ( ULONG, ULONG, PVOID, ULONG, ULONG); |
6.0 and higher | no default |
0x58 | 0xB0 |
ULONG (*HalGetInterruptVectorOverride) ( INTERFACE_TYPE, ULONG, ULONG, ULONG, KIRQL *, KAFFINITY *); |
6.0 and higher | |
0x5C | 0xB8 |
NTSTATUS (*HalGetVectorInputOverride) ( ULONG, KAFFINITY, ULONG *, KINTERRUPT_POLARITY *); |
6.0 only | |
NTSTATUS (*HalGetVectorInputOverride) ( ULONG, GROUP_AFFINITY *, ULONG *, KINTERRUPT_POLARITY *, KINTERRUPT_REMAPPING_INFO *); |
6.1 and higher | |||
0x60 | 0xC0 |
NTSTATUS (*HalLoadMicrocode) ( PVOID); |
6.0 and higher | |
0x64 | 0xC8 |
NTSTATUS (*HalUnloadMicrocode) ( VOID); |
6.0 and higher | |
0x68 | 0xD0 |
NTSTATUS (*HalPostMicrocodeUpdate) ( VOID); |
6.0 and higher |
Offset (x86) | Offset (x64) | Definition | Versions |
---|---|---|---|
0x6C | 0xD8 |
NTSTATUS (*HalAllocateMessageTargetOverride) ( DEVICE_OBJECT *, KAFFINITY, ULONG, KINTERRUPT_MODE, BOOLEAN, ULONG *, KIRQL *, ULONG *); |
late 6.0 |
NTSTATUS (*HalAllocateMessageTargetOverride) ( DEVICE_OBJECT *, GROUP_AFFINITY *, ULONG, KINTERRUPT_MODE, BOOLEAN, ULONG *, KIRQL *, ULONG *); |
6.1 and higher | ||
0x70 | 0xE0 |
VOID (*HalFreeMessageTargetOverride) ( DEVICE_OBJECT *, ULONG, KAFFINITY); |
late 6.0 |
VOID (*HalFreeMessageTargetOverride) ( DEVICE_OBJECT *, ULONG, GROUP_AFFINITY *); |
6.1 and higher | ||
0x74 | 0xE8 |
NTSTATUS (*HalDpReplaceBegin) ( HAL_DP_REPLACE_PARAMETERS *, PVOID *); |
late 6.0 and higher |
0x78 | 0xF0 |
VOID (*HalDpReplaceTarget) ( PVOID); |
late 6.0 and higher |
0x7C | 0xF8 |
NTSTATUS (*HalDpReplaceControl) ( ULONG, PVOID); |
late 6.0 and higher |
0x80 | 0x0100 |
VOID (*HalDpReplaceEnd) ( PVOID); |
late 6.0 and higher |
0x84 | 0x0108 |
VOID (*HalPrepareForBugcheck) ( ULONG); |
late 6.0 and higher |
Offset (x86) | Offset (x64) | Definition | Versions |
---|---|---|---|
0x88 | 0x0110 |
NTSTATUS (*HalQueryWakeTime) ( ULONGLONG *); |
6.1 only |
BOOLEAN (*HalQueryWakeTime) ( ULONGLONG *, ULONGLONG *); |
6.2 and higher | ||
0x8C | 0x0118 |
VOID (*HalReportIdleStateUsage) ( UCHAR, AFFINITY_EX *); |
6.1 and higher |
0x90 | 0x0120 |
VOID (*HalTscSynchronization) ( BOOLEAN, ULONG *); |
6.1 and higher |
0x94 | 0x0128 |
NTSTATUS (*HalWheaInitProcessorGenericSection) ( WHEA_ERROR_RECORD_SECTION_DESCRIPTOR *, WHEA_PROCESSOR_GENERIC_ERROR_SECTION *); |
6.1 and higher |
0x98 | 0x0130 |
VOID (*HalStopLegacyUsbInterrupts) ( VOID); |
6.1 only |
VOID (*HalStopLegacyUsbInterrupts) ( SYSTEM_POWER_STATE); |
6.2 and higher |
Offset (x86) | Offset (x64) | Definition | Versions |
---|---|---|---|
0x88 (6.0) 0x9C |
0x0138 |
NTSTATUS (*HalReadWheaPhysicalMemory) ( PHYSICAL_ADDRESS, ULONG, PVOID); |
very late 6.0 and higher |
0x8C (6.0) 0xA0 |
0x0140 |
NTSTATUS (*HalWriteWheaPhysicalMemory) ( PHYSICAL_ADDRESS, ULONG, PVOID); |
very late 6.0 and higher |
Offset (x86) | Offset (x64) | Definition | Versions |
---|---|---|---|
0xA4 | 0x0148 |
NTSTATUS (*HalDpMaskLevelTriggeredInterrupts) ( VOID); |
6.1 and higher |
0xA8 | 0x0150 |
NTSTATUS (*HalDpUnmaskLevelTriggeredInterrupts) ( VOID); |
6.1 and higher |
0xAC | 0x0158 |
NTSTATUS (*HalDpGetInterruptReplayState) ( PVOID, PVOID *); |
6.1 and higher |
0xB0 | 0x0160 |
NTSTATUS (*HalDpReplayInterrupts) ( PVOID); |
6.1 and higher |
0xB4 | 0x0168 |
BOOLEAN (*HalQueryIoPortAccessSupported) ( VOID); |
6.1 and higher |
Offset (x86) | Offset (x64) | Definition | Versions | Remarks |
---|---|---|---|---|
0xB8 | 0x0170 |
NTSTATUS (*KdSetupIntegratedDeviceForDebugging) ( PVOID, DEBUG_DEVICE_DESCRIPTOR *); |
6.2 and higher | |
0xBC | 0x0178 |
NTSTATUS (*KdReleaseIntegratedDeviceForDebugging) ( DEBUG_DEVICE_DESCRIPTOR *); |
6.2 and higher | |
0xC0 | 0x0180 |
VOID (*HalGetEnlightenmentInformation) ( HAL_ENLIGHTENMENT_INFORMATION *); |
6.2 and higher | conditional default |
0xC4 | 0x0188 |
PVOID (*HalAllocateEarlyPages) ( LOADER_PARAMETER_BLOCK *, ULONG, ULONG64 *, ULONG); |
6.2 and higher; no default |
|
0xC8 | 0x0190 |
PVOID (*HalMapEarlyPages) ( ULONG64, ULONG, ULONG); |
6.2 and higher; no default |
|
0xCC | 0x0198 |
ULONG (*HalGetClockOwner) ( VOID); |
6.2 only |
name inferred from symbols |
PVOID Dummy1; |
6.3 and higher | |||
0xD0 | 0x01A0 |
VOID (*HalGetClockConfiguration) ( ULONG *, ULONG *, UCHAR *); |
6.2 only |
name inferred from symbols; type uncertain |
PVOID Dummy2; |
6.3 and higher | |||
0xD4 | 0x01A8 |
VOID (*HalNotifyProcessorFreeze) ( BOOLEAN); |
6.2 only | |
VOID (*HalNotifyProcessorFreeze) ( BOOLEAN, BOOLEAN); |
6.3 and higher | |||
0xD8 | 0x01B0 |
NTSTATUS (*HalPrepareProcessorForIdle) ( ULONG, ULONG, ULONG); |
6.2 only |
type uncertain |
NTSTATUS (*HalPrepareProcessorForIdle) ( ULONG); |
6.3 and higher | |||
0xDC | 0x01B8 |
VOID (*HalRegisterLogRoutine) ( HAL_LOG_REGISTER_CONTEXT *); |
6.2 and higher | |
0xE0 | 0x01C0 |
VOID (*HalResumeProcessorFromIdle) ( ULONG *); |
6.2 only |
type uncertain |
VOID (*HalResumeProcessorFromIdle) ( VOID); |
6.3 and higher | |||
0xE4 | 0x01C8 |
PVOID Dummy; |
6.2 and higher | |
0xE8 | 0x01D0 |
ULONG (*HalVectorToIDTEntryEx) ( ULONG); |
6.2 and higher | |
0xEC | 0x01D8 |
NTSTATUS (*HalSecondaryInterruptQueryPrimaryInformation) ( INTERRUPT_VECTOR_DATA *, ULONG *); |
6.2 and higher | |
0xF0 | 0x01E0 |
NTSTATUS (*HalMaskInterrupt) ( ULONG, ULONG); |
6.2 and higher | |
0xF4 | 0x01E8 |
NTSTATUS (*HalUnmaskInterrupt) ( ULONG, ULONG); |
6.2 and higher | |
0xF8 | 0x01F0 |
BOOLEAN (*HalIsInterruptTypeSecondary) ( ULONG, ULONG); |
6.2 and higher | |
0xFC | 0x01F8 |
NTSTATUS (*HalAllocateGsivForSecondaryInterrupt) ( PCCHAR, USHORT, ULONG *); |
6.2 and higher | |
0x0100 | 0x0200 |
NTSTATUS (*HalAddInterruptRemapping) ( ULONG, ULONG, PCI_BUSMASTER_DESCRIPTOR *, UCHAR, INTERRUPT_VECTOR_DATA *, ULONG); |
6.2 and higher | |
0x0104 | 0x0208 |
VOID (*HalRemoveInterruptRemapping) ( ULONG, ULONG, PCI_BUSMASTER_DESCRIPTOR *, UCHAR, INTERRUPT_VECTOR_DATA *, ULONG); |
6.2 and higher | |
0x0108 | 0x0210 |
VOID (*HalSaveAndDisableHvEnlightenment) ( VOID); |
6.2 and higher | |
0x010C | 0x0218 |
VOID (*HalRestoreHvEnlightenment) ( VOID); |
6.2 and higher | |
0x0110 | 0x0220 |
VOID (*HalFlushIoBuffersExternalCache) ( MDL *, BOOLEAN); |
6.2 and higher | |
0x0114 | 0x0228 |
VOID (*HalFlushExternalCache) ( BOOLEAN); |
6.2 and higher | |
0x0118 | 0x0230 |
NTSTATUS (*HalPciEarlyRestore) ( SYSTEM_POWER_STATE); |
6.2 and higher | |
0x011C | 0x0238 |
NTSTATUS (*HalGetProcessorId) ( ULONG, ULONG *); |
6.2 and higher | |
0x0120 | 0x0240 |
NTSTATUS (*HalAllocatePmcCounterSet) ( ULONG, KPROFILE_SOURCE *, ULONG, PMC_HANDLE *); |
6.2 and higher | |
0x0124 | 0x0248 |
VOID (*HalCollectPmcCounters) ( PMC_HANDLE, ULONG64 *); |
6.2 and higher | |
0x0128 | 0x0250 |
VOID (*HalFreePmcCounterSet) ( PMC_HANDLE); |
6.2 and higher | |
0x012C | 0x0258 |
NTSTATUS (*HalProcessorHalt) ( ULONG, PVOID, PPROCESSOR_HALT_ROUTINE); |
6.2 and higher | |
0x0130 | 0x0260 |
ULONG (*HalTimerQueryCycleCounter) ( ULONGLONG *); |
6.2 and higher | |
0x0134 | 0x0268 |
VOID (*HalGetNextTickDuration) ( KPRCB *, BOOLEAN, ULONG, ULONG64, ULONGLONG *); |
6.2 only |
name inferred from kernel symbols; type uncertain |
PVOID Dummy3; |
6.3 and higher | |||
0x0138 | 0x0270 |
VOID (*HalPciMarkHiberPhase) ( VOID); |
6.2 and higher | |
0x013C | 0x0278 |
NTSTATUS (*HalQueryProcessorRestartEntryPoint) ( PHYSICAL_ADDRESS *); |
6.2 and higher | |
0x0140 | 0x0280 |
NTSTATUS (*HalRequestInterrupt) ( ULONG); |
6.2 and higher | |
0x0144 | 0x0288 |
NTSTATUS (*HalEnumerateUnmaskedInterrupts) ( PHAL_ENUMERATE_INTERRUPT_SOURCE_CALLBACK, PVOID, HAL_UNMASKED_INTERRUPT_INFORMATION *); |
6.2 and higher | |
0x0148 | 0x0290 |
VOID (*HalFlushAndInvalidatePageExternalCache) ( PHYSICAL_ADDRESS); |
6.2 and higher | |
0x014C | 0x0298 |
NTSTATUS (*KdEnumerateDebuggingDevices) ( PVOID, DEBUG_DEVICE_DESCRIPTOR *, PDEBUG_DEVICE_FOUND_FUNCTION); |
6.2 and higher | |
0x0150 | 0x02A0 |
VOID (*HalFlushIoRectangleExternalCache) ( MDL *, ULONG, ULONG, ULONG, ULONG, BOOLEAN); |
6.2 and higher | |
0x0154 | 0x02A8 |
VOID (*HalPowerEarlyRestore) ( ULONG); |
6.2 and higher | |
0x0158 | 0x02B0 |
NTSTATUS (*HalQueryCapsuleCapabilities) ( PVOID, ULONG, ULONGLONG *, ULONG *); |
6.2 and higher | |
0x015C | 0x02B8 |
NTSTATUS (*HalUpdateCapsule) ( PVOID, ULONG, PHYSICAL_ADDRESS); |
6.2 and higher | |
0x0160 | 0x02C0 |
BOOLEAN (*HalPciMultiStageResumeCapable) ( VOID); |
6.2 and higher | |
0x0164 | 0x02C8 |
VOID (*HalDmaFreeCrashDumpRegisters) ( ULONG); |
6.2 and higher | |
0x0168 | 0x02D0 |
BOOLEAN (*HalAcpiAoacCapable) ( VOID); |
6.2 and higher |
The HalGetEnlightenmentInformation member starts as NULL in the kernel’s HalPrivateDispatchTable but the kernel may set a default while initialising.
Offset (x86) | Offset (x64) | Definition | Versions | Remarks |
---|---|---|---|---|
0x016C | 0x02D8 |
NTSTATUS (*HalInterruptSetDestination) ( INTERRUPT_CONNECTION_DATA *, GROUP_AFFINITY *); |
6.3 and higher |
type uncertain |
NTSTATUS (*HalInterruptSetDestination) ( ULONG, INTERRUPT_VECTOR_DATA *, GROUP_AFFINITY *); |
10.0 and higher | |||
0x0170 | 0x02E0 |
VOID (*HalGetClockConfiguration) ( HAL_CLOCK_TIMER_CONFIGURATION *); |
6.3 and higher | |
0x0174 | 0x02E8 |
VOID (*HalClockTimerActivate) ( BOOLEAN); |
6.3 and higher | |
0x0178 | 0x02F0 |
VOID (*HalClockTimerInitialize) ( VOID); |
6.3 and higher | |
0x017C | 0x02F8 |
VOID (*HalClockTimerStop) ( VOID); |
6.3 and higher | |
0x0180 | 0x0300 |
NTSTATUS (*HalClockTimerArm) ( HAL_CLOCK_TIMER_MODE, ULONG64, ULONG64 *); |
6.3 and higher | |
0x0184 | 0x0308 |
BOOLEAN (*HalTimerOnlyClockInterruptPending) ( VOID); |
6.3 and higher | |
0x0188 | 0x0310 |
PVOID (*HalAcpiGetMultiNode) ( VOID); |
6.3 and higher | |
0x018C | 0x0318 |
PHALREBOOTHANDLER (*HalPowerSetRebootHandler) ( PHALREBOOTHANDLER); |
6.3 and higher | |
0x0190 | 0x0320 |
VOID (*HalIommuRegisterDispatchTable) ( HAL_IOMMU_DISPATCH *); |
6.3 and higher | |
0x0194 | 0x0328 |
NTSTATUS (*HalTimerWatchdogStart) ( VOID); |
6.3 and higher | |
0x0198 | 0x0330 |
VOID (*HalTimerWatchdogResetCountdown) ( VOID); |
6.3 only | |
VOID (*HalTimerWatchdogResetCountdown) ( LOGICAL); |
10.0 and higher | |||
0x019C | 0x0338 |
NTSTATUS (*HalTimerWatchdogStop) ( VOID); |
6.3 and higher | |
0x01A0 | 0x0340 |
BOOLEAN (*HalTimerWatchdogGeneratedLastReset) ( VOID); |
6.3 and higher | |
0x01A4 | 0x0348 |
NTSTATUS (*HalTimerWatchdogTriggerSystemReset) ( BOOLEAN); |
6.3 and higher |
Offset (x86) | Offset (x64) | Definition | Versions |
---|---|---|---|
0x01A8 | 0x0350 |
NTSTATUS (*HalInterruptVectorDataToGsiv) ( INTERRUPT_VECTOR_DATA *, ULONG *); |
10.0 and higher |
0x01AC | 0x0358 |
NTSTATUS (*HalInterruptGetHighestPriorityInterrupt) ( ULONG *, BOOLEAN *); |
10.0 and higher |
0x01B0 | 0x0360 |
NTSTATUS (*HalProcessorOn) ( ULONG); |
10.0 and higher |
0x01B4 | 0x0368 |
NTSTATUS (*HalProcessorOff) ( VOID); |
10.0 and higher |
0x01B8 | 0x0370 |
NTSTATUS (*HalProcessorFreeze) ( VOID); |
10.0 and higher |
0x01BC | 0x0378 |
NTSTATUS (*HalDmaLinkDeviceObjectByToken) ( ULONG_PTR, DEVICE_OBJECT *); |
10.0 and higher |
0x01C0 | 0x0380 |
NTSTATUS (*HalDmaCheckAdapterToken) ( ULONG_PTR); |
10.0 and higher |
0x01C4 | 0x0388 |
VOID (*HalPciLateRestore) ( VOID); |
10.0 and higher |
0x01C8 | 0x0390 |
NTSTATUS (*HalTimerConvertPerformanceCounterToAuxiliaryCounter) ( ULONG64, ULONG64 *, ULONG64 *); |
10.0 and higher |
0x01CC | 0x0398 |
NTSTATUS (*HalTimerConvertAuxiliaryCounterToPerformanceCounter) ( ULONG64, ULONG64 *, ULONG64 *); |
10.0 and higher |
0x01D0 | 0x03A0 |
NTSTATUS (*HalTimerQueryAuxiliaryCounterFrequency) ( ULONG64 *); |
10.0 and higher |
0x01D4 | 0x03A8 |
NTSTATUS (*HalConnectThermalInterrupt) ( PKSERVICE_ROUTINE); |
10.0 and higher |
0x01D8 | 0x03B0 |
BOOLEAN (*HalIsEFIRuntimeActive) ( VOID); |
10.0 and higher |
All non-obvious types in the preceding table are structures or enumerations except for the following function pointers:
typedef NTSTATUS (*PINSTALL_BUS_HANDLER) ( BUS_HANDLER *); typedef NTSTATUS (*PPROCESSOR_HALT_ROUTINE) ( PVOID); typedef BOOLEAN (*PHAL_ENUMERATE_INTERRUPT_SOURCE_CALLBACK) ( PVOID, HAL_UNMASKED_INTERRUPT_INFORMATION *); typedef KD_CALLBACK_ACTION (*PDEBUG_DEVICE_FOUND_FUNCTION) ( DEBUG_DEVICE_DESCRIPTOR *); typedef VOID (*PHALREBOOTHANDLER) ( ULONG, LONG volatile *); typedef BOOLEAN (*PKSERVICE_ROUTINE) ( KINTERRUPT *, PVOID);
Of course, almost all members of the HAL_PRIVATE_DISPATCH are function pointers, but these are the ones that can be given as arguments: function pointers in function pointers get just a bit too complicated for easy presentation.