Processor Control Region
Processor Control Region (PCR) is a Windows kernel mode data structure that contains information about the current processor. It can be accessed via the fs segment register.
Structure
In C and C++, the PCR is known as KPCR. It contains information about the current processor.
typedef struct _KPCR
{
union
{
NT_TIB NtTib;
struct
{
PEXCEPTION_REGISTRATION_RECORD Used_ExceptionList;
PVOID Used_StackBase;
PVOID Spare2;
PVOID TssCopy;
ULONG ContextSwitches;
ULONG SetMemberCopy;
PVOID Used_Self;
};
};
PKPCR SelfPcr;
PKPRCB Prcb;
UCHAR Irql;
ULONG IRR;
ULONG IrrActive;
ULONG IDR;
PVOID KdVersionBlock;
PKIDTENTRY IDT;
PKGDTENTRY GDT;
PKTSS TSS;
USHORT MajorVersion;
USHORT MinorVersion;
ULONG SetMember;
ULONG StallScaleFactor;
UCHAR SpareUnused;
UCHAR Number;
UCHAR Spare0;
UCHAR SecondLevelCacheAssociativity;
ULONG VdmAlert;
ULONG KernelReserved[14];
ULONG SecondLevelCacheSize;
ULONG HalReserved[16];
ULONG InterruptMode;
UCHAR Spare1;
ULONG KernelReserved2[17];
KPRCB PrcbData;
} KPCR,*PKPCR;
Processor Control Block
The PCR contains a substructure called Processor Control Block (KPRCB), which contain information such CPU step and pointer to the thread object of current thread.
typedef struct _KPRCB
{
USHORT MinorVersion;
USHORT MajorVersion;
PKTHREAD CurrentThread;
PKTHREAD NextThread;
PKTHREAD IdleThread;
UCHAR Number;
UCHAR NestingLevel;
USHORT BuildType;
ULONG SetMember;
CHAR CpuType;
CHAR CpuID;
union
{
USHORT CpuStep;
struct
{
UCHAR CpuStepping;
UCHAR CpuModel;
};
};
KPROCESSOR_STATE ProcessorState;
ULONG KernelReserved[16];
ULONG HalReserved[16];
ULONG CFlushSize;
UCHAR PrcbPad0[88];
KSPIN_LOCK_QUEUE LockQueue[33];
PKTHREAD NpxThread;
ULONG InterruptCount;
ULONG KernelTime;
ULONG UserTime;
ULONG DpcTime;
ULONG DpcTimeCount;
ULONG InterruptTime;
ULONG AdjustDpcThreshold;
ULONG PageColor;
UCHAR SkipTick;
UCHAR DebuggerSavedIRQL;
UCHAR NodeColor;
UCHAR PollSlot;
ULONG NodeShiftedColor;
PKNODE ParentNode;
ULONG MultiThreadProcessorSet;
PKPRCB MultiThreadSetMaster;
ULONG SecondaryColorMask;
ULONG DpcTimeLimit;
ULONG CcFastReadNoWait;
ULONG CcFastReadWait;
ULONG CcFastReadNotPossible;
ULONG CcCopyReadNoWait;
ULONG CcCopyReadWait;
ULONG CcCopyReadNoWaitMiss;
LONG MmSpinLockOrdering;
LONG IoReadOperationCount;
LONG IoWriteOperationCount;
LONG IoOtherOperationCount;
LARGE_INTEGER IoReadTransferCount;
LARGE_INTEGER IoWriteTransferCount;
LARGE_INTEGER IoOtherTransferCount;
ULONG CcFastMdlReadNoWait;
ULONG CcFastMdlReadWait;
ULONG CcFastMdlReadNotPossible;
ULONG CcMapDataNoWait;
ULONG CcMapDataWait;
ULONG CcPinMappedDataCount;
ULONG CcPinReadNoWait;
ULONG CcPinReadWait;
ULONG CcMdlReadNoWait;
ULONG CcMdlReadWait;
ULONG CcLazyWriteHotSpots;
ULONG CcLazyWriteIos;
ULONG CcLazyWritePages;
ULONG CcDataFlushes;
ULONG CcDataPages;
ULONG CcLostDelayedWrites;
ULONG CcFastReadResourceMiss;
ULONG CcCopyReadWaitMiss;
ULONG CcFastMdlReadResourceMiss;
ULONG CcMapDataNoWaitMiss;
ULONG CcMapDataWaitMiss;
ULONG CcPinReadNoWaitMiss;
ULONG CcPinReadWaitMiss;
ULONG CcMdlReadNoWaitMiss;
ULONG CcMdlReadWaitMiss;
ULONG CcReadAheadIos;
ULONG KeAlignmentFixupCount;
ULONG KeExceptionDispatchCount;
ULONG KeSystemCalls;
ULONG PrcbPad1[3];
PP_LOOKASIDE_LIST PPLookasideList[16];
GENERAL_LOOKASIDE_POOL PPNPagedLookasideList[32];
GENERAL_LOOKASIDE_POOL PPPagedLookasideList[32];
ULONG PacketBarrier;
LONG ReverseStall;
PVOID IpiFrame;
UCHAR PrcbPad2[52];
VOID * CurrentPacket[3];
ULONG TargetSet;
PVOID WorkerRoutine;
ULONG IpiFrozen;
UCHAR PrcbPad3[40];
ULONG RequestSummary;
PKPRCB SignalDone;
UCHAR PrcbPad4[56];
KDPC_DATA DpcData[2];
PVOID DpcStack;
LONG MaximumDpcQueueDepth;
ULONG DpcRequestRate;
ULONG MinimumDpcRate;
UCHAR DpcInterruptRequested;
UCHAR DpcThreadRequested;
UCHAR DpcRoutineActive;
UCHAR DpcThreadActive;
ULONG PrcbLock;
ULONG DpcLastCount;
ULONG TimerHand;
ULONG TimerRequest;
PVOID PrcbPad41;
KEVENT DpcEvent;
UCHAR ThreadDpcEnable;
UCHAR QuantumEnd;
UCHAR PrcbPad50;
UCHAR IdleSchedule;
LONG DpcSetEventRequest;
LONG Sleeping;
ULONG PeriodicCount;
ULONG PeriodicBias;
UCHAR PrcbPad5[6];
LONG TickOffset;
KDPC CallDpc;
LONG ClockKeepAlive;
UCHAR ClockCheckSlot;
UCHAR ClockPollCycle;
UCHAR PrcbPad6[2];
LONG DpcWatchdogPeriod;
LONG DpcWatchdogCount;
LONG ThreadWatchdogPeriod;
LONG ThreadWatchdogCount;
ULONG PrcbPad70[2];
LIST_ENTRY WaitListHead;
ULONG WaitLock;
ULONG ReadySummary;
ULONG QueueIndex;
SINGLE_LIST_ENTRY DeferredReadyListHead;
UINT64 StartCycles;
UINT64 CycleTime;
UINT64 PrcbPad71[3];
LIST_ENTRY DispatcherReadyListHead[32];
PVOID ChainedInterruptList;
LONG LookasideIrpFloat;
LONG MmPageFaultCount;
LONG MmCopyOnWriteCount;
LONG MmTransitionCount;
LONG MmCacheTransitionCount;
LONG MmDemandZeroCount;
LONG MmPageReadCount;
LONG MmPageReadIoCount;
LONG MmCacheReadCount;
LONG MmCacheIoCount;
LONG MmDirtyPagesWriteCount;
LONG MmDirtyWriteIoCount;
LONG MmMappedPagesWriteCount;
LONG MmMappedWriteIoCount;
ULONG CachedCommit;
ULONG CachedResidentAvailable;
PVOID HyperPte;
UCHAR CpuVendor;
UCHAR PrcbPad9[3];
UCHAR VendorString[13];
UCHAR InitialApicId;
UCHAR CoresPerPhysicalProcessor;
UCHAR LogicalProcessorsPerPhysicalProcessor;
ULONG MHz;
ULONG FeatureBits;
LARGE_INTEGER UpdateSignature;
UINT64 IsrTime;
UINT64 SpareField1;
FX_SAVE_AREA NpxSaveArea;
PROCESSOR_POWER_STATE PowerState;
KDPC DpcWatchdogDpc;
KTIMER DpcWatchdogTimer;
PVOID WheaInfo;
PVOID EtwSupport;
SLIST_HEADER InterruptObjectPool;
LARGE_INTEGER HypercallPagePhysical;
PVOID HypercallPageVirtual;
PVOID RateControl;
CACHE_DESCRIPTOR Cache[5];
ULONG CacheCount;
ULONG CacheProcessorMask[5];
UCHAR LogicalProcessorsPerCore;
UCHAR PrcbPad8[3];
ULONG PackageProcessorSet;
ULONG CoreProcessorSet;
} KPRCB, *PKPRCB;
References
- http://www.nirsoft.net/kernel_struct/vista/KPCR.html
- http://www.nirsoft.net/kernel_struct/vista/KPRCB.html
See also
 | This Microsoft Windows article is a stub. You can help Wikipedia by expanding it. |