KDBG Structure

- https://code.google.com/p/volatility/source/browse/branches/scudette/docs/blogg_posts/scudette/kdbg.txt?r=2805

- SANS Poster 2015-Memory-Forensic2.pdf

- http://www.rekall-forensic.com/posts/2014-02-21-do-we-need-kdbg.html

00392 KDDEBUGGER_DATA64 KdDebuggerDataBlock = 00393 { 00394     {{0}}, 00395     0, 00396     {(ULONG_PTR)RtlpBreakWithStatusInstruction}, 00397     0, 00398     FIELD_OFFSET(KTHREAD, CallbackStack), 00399     FIELD_OFFSET(KCALLOUT_FRAME, CallbackStack), 00400     FIELD_OFFSET(KCALLOUT_FRAME, CBSTACK_FRAME_POINTER), 00401     FALSE, 00402     {(ULONG_PTR)KiCallUserMode}, 00403     0, 00404     {(ULONG_PTR)&PsLoadedModuleList}, 00405     {(ULONG_PTR)&PsActiveProcessHead}, 00406     {(ULONG_PTR)&PspCidTable}, 00407     {(ULONG_PTR)&ExpSystemResourcesList}, 00408     {(ULONG_PTR)ExpPagedPoolDescriptor}, 00409     {(ULONG_PTR)&ExpNumberOfPagedPools}, 00410     {(ULONG_PTR)&KeTimeIncrement}, ... 00555     {(ULONG_PTR)&IopNumTriageDumpDataBlocks}, 00556     {(ULONG_PTR)IopTriageDumpDataBlocks}, 00557 };