A simple but useful project maybe help you reverse Windows.

This project include header files that contain undocuments types can be compiled by both WDK , IDAPro , BinaryNinja.

Just copy header files in the include directory.

Just Parse header files in the include directory.

Install ktypes.sys at target guest virtual machine and setup a kernel debugger at host machine to debug it.

Start windbg at host machine and debug utypes.exe , it will auto break into the debugger.

Now you can use windbg to display any undocuments types.

1. If there is no special instructions, the type definition is reverse-engineered on the latest official version of Windows 10 x64.

2. When this types applied to other versions, some type definitions may need to be adjusted.

3. Microsoft owns the full copyright of Windows.

4. Reverse engineering of these structures is only for research and learning purposes.

5. This project does not bear any legal responsibility and I am reserves the right of final interpretation.