// PRIVATE/WINCEOS/COREOS/NK/INC/nkarm.h
typedef struct ARM_HIGH {
	ulong   firstPT[4096];      // 0xFFFD0000: 1st level page table
	char    reserved2[0x20000-0x4000];

	char    exVectors[0x400];   // 0xFFFF0000: exception vectors
	char    reserved3[0x2400-0x400];

	char    intrStack[0x400];   // 0xFFFF2400: interrupt stack
	char    reserved4[0x4900-0x2800];

	char    abortStack[0x700];  // 0xFFFF4900: abort stack
	char    reserved5[0x6800-0x5000];

	char    fiqStack[0x100];    // 0xFFFF6800: FIQ stack
	char    reserved6[0xC000-0x6900];

	char    kStack[0x800];      // 0xFFFFC000: kernel stack
	struct KDataStruct kdata;   // 0xFFFFC800: kernel data page
} ARM_HIGH;
struct KDataStruct {
	LPDWORD lpvTls;         /* 0x000 Current thread local storage pointer */
	HANDLE  ahSys[NUM_SYS_HANDLES]; /* 0x004 If this moves, change kapi.h */
	// NUM_SYS_HANDLES == 32 : PUBLIC/COMMON/SDK/INC/kfuncs.h
		0x004 SH_WIN32
		0x008 SH_CURTHREAD
		0x00c SH_CURPROC
		0x010 SH_KWIN32
		0x044 SH_GDI
		0x048 SH_WMGR
		0x04c SH_WNET
		0x050 SH_COMM
		0x054 SH_FILESYS_APIS
		0x058 SH_SHELL
		0x05c SH_DEVMGR_APIS
		0x060 SH_TAPI
		0x064 SH_PATCHER
		0x06c SH_SERVICES

	char    bResched;       /* 0x084 reschedule flag */
	char    cNest;          /* 0x085 kernel exception nesting */
	char    bPowerOff;      /* 0x086 TRUE during "power off" processing */
	char    bProfileOn;     /* 0x087 TRUE if profiling enabled */
	ulong   unused;         /* 0x088 unused */
	ulong   rsvd2;          /* 0x08c was DiffMSec */
	PPROCESS pCurPrc;       /* 0x090 ptr to current PROCESS struct */
	PTHREAD pCurThd;        /* 0x094 ptr to current THREAD struct */
	DWORD   dwKCRes;        /* 0x098  */
	ulong   handleBase;     /* 0x09c handle table base address */
	PSECTION aSections[64]; /* 0x0a0 section table for virutal memory */
	LPEVENT alpeIntrEvents[SYSINTR_MAX_DEVICES];/* 0x1a0 */
	LPVOID  alpvIntrData[SYSINTR_MAX_DEVICES];  /* 0x220 */
	ulong   pAPIReturn;     /* 0x2a0 direct API return address for kernel mode */
	uchar   *pMap;          /* 0x2a4 ptr to MemoryMap array */
	DWORD   dwInDebugger;   /* 0x2a8 !0 when in debugger */
	PTHREAD pCurFPUOwner;   /* 0x2ac current FPU owner */
	PPROCESS pCpuASIDPrc;   /* 0x2b0 current ASID proc */
	long    nMemForPT;      /* 0x2b4 - Memory used for PageTables */

	long    alPad[18];      /* 0x2b8 - padding */
	DWORD   aInfo[32];      /* 0x300 - misc. kernel info */
	// PUBLIC/COMMON/OAK/INC/pkfuncs.h
		0x300  KINX_PROCARRAY     address of process array
		0x304  KINX_PAGESIZE      system page size
		0x308  KINX_PFN_SHIFT     shift for page # in PTE
		0x30c  KINX_PFN_MASK      mask for page # in PTE
		0x310  KINX_PAGEFREE      # of free physical pages
		0x314  KINX_SYSPAGES      # of pages used by kernel
		0x318  KINX_KHEAP         ptr to kernel heap array
		0x31c  KINX_SECTIONS      ptr to SectionTable array
		0x320  KINX_MEMINFO       ptr to system MemoryInfo struct
		0x324  KINX_MODULES       ptr to module list
		0x328  KINX_DLL_LOW       lower bound of DLL shared space
		0x32c  KINX_NUMPAGES      total # of RAM pages
		0x330  KINX_PTOC          ptr to ROM table of contents
		0x334  KINX_KDATA_ADDR    kernel mode version of KData
		0x338  KINX_GWESHEAPINFO  Current amount of gwes heap in use
		0x33c  KINX_TIMEZONEBIAS  Fast timezone bias info
		0x340  KINX_PENDEVENTS    bit mask for pending interrupt events
		0x344  KINX_KERNRESERVE   number of kernel reserved pages
		0x348  KINX_API_MASK      bit mask for registered api sets
		0x34c  KINX_NLS_CP        hiword OEM code page, loword ANSI code page
		0x350  KINX_NLS_SYSLOC    Default System locale
		0x354  KINX_NLS_USERLOC   Default User locale
		0x358  KINX_HEAP_WASTE    Kernel heap wasted space
		0x35c  KINX_DEBUGGER      For use by debugger for protocol communication
		0x360  KINX_APISETS       APIset pointers
		0x364  KINX_MINPAGEFREE   water mark of the minimum number of free pages
		0x368  KINX_CELOGSTATUS   CeLog status flags
		0x36c  KINX_NKSECTION     Address of NKSection
		0x370  KINX_PWR_EVTS      Events to be set after power on
		0x37c  KINX_NKSIG         last entry of KINFO -- signature when NK is ready

	    /* 0x380 - interlocked api code */
	    /* 0x400 - end */
}

// PRIVATE/WINCEOS/COREOS/NK/INC/kernel.h
typedef struct Module {
    LPVOID      lpSelf;                 /* 0x00 Self pointer for validation */
    PMODULE     pMod;                   /* 0x04 Next module in chain */
    LPWSTR      lpszModName;            /* 0x08 Module name */
    DWORD       inuse;                  /* 0x0c Bit vector of use */
    DWORD       calledfunc;             /* 0x10 Called entry but not exit */
    WORD        refcnt[MAX_PROCESSES];  /* 0x14 Reference count per process*/
    LPVOID      BasePtr;                /* 0x54 Base pointer of dll load (not 0 based) */
    DWORD       DbgFlags;               /* 0x58 Debug flags */
    LPDBGPARAM  ZonePtr;                /* 0x5c Debug zone pointer */
    ulong       startip;                /* 0x60 0 based entrypoint */
    openexe_t   oe;                     /* 0x64 Pointer to executable file handle */
		typedef struct openexe_t {
			 union {
				  int hppfs;           // ppfs handle
				  HANDLE hf;           // object store handle
				  TOCentry *tocptr;    // rom entry pointer
			 };	                    // 0x64
			 BYTE filetype;           // 0x68
			 BYTE bIsOID;             // 0x69
			 WORD pagemode;           // 0x6a
			 union {
				  DWORD offset;
				  DWORD dwExtRomAttrib;
			 };                       // 0x6c
			 union {
				  Name *lpName;
				  CEOID ceOid;
			 };                       // 0x70
		} openexe_t;
    e32_lite    e32;                    /* 0x74 E32 header */
    // PUBLIC/COMMON/OAK/INC/pehdr.h
      typedef struct e32_lite {           /* PE 32-bit .EXE header               */
          unsigned short  e32_objcnt;     /* 0x74 Number of memory objects            */
          BYTE            e32_cevermajor; /* 0x76 version of CE built for             */
          BYTE            e32_ceverminor; /* 0x77 version of CE built for             */
          unsigned long   e32_stackmax;   /* 0x78 Maximum stack size                  */
          unsigned long   e32_vbase;      /* 0x7c Virtual base address of module      */
          unsigned long   e32_vsize;      /* 0x80 Virtual size of the entire image    */
          unsigned long e32_sect14rva;    /* 0x84 section 14 rva */
          unsigned long e32_sect14size;   /* 0x88 section 14 size */
          struct info e32_unit[LITE_EXTRA]; /* 0x8c  Array of extra info units     */
            struct info {                       /* Extra information header block      */
                unsigned long   rva;            /* Virtual relative address of info    */
                unsigned long   size;           /* Size of information block           */
            }
            0x8c   EXP Export table position    
            0x94   IMP Import table position    
            0x9c   RES Resource table position  
            0xa4   EXC Exception table position 
            0xac   SEC Security table position  
            0xb4   FIX Fixup table position     
      } e32_lite, *LPe32_list;

    o32_lite    *o32_ptr;               /* 0xbc  O32 chain ptr */
    DWORD       dwNoNotify;             /* 0xc0  1 bit per process, set if notifications disabled */
    WORD        wFlags;                 // 0xc4
    BYTE        bTrustLevel;            // 0xc6
    BYTE        bPadding;               // 0xc7
    PMODULE     pmodResource;           /* 0xc8 module that contains the resources */
    DWORD       rwLow;                  /* 0xcc base address of RW section for ROM DLL */
    DWORD       rwHigh;                 /* 0xd0 high address RW section for ROM DLL */
    PGPOOL_Q    pgqueue;                /* 0xcc list of the page owned by the module */
      typedef struct _PGPOOL_Q {
          WORD    idxHead;            /* head of the queue */
          WORD    idxTail;            /* tail of the queue */
      } PGPOOL_Q, *PPGPOOL_Q;
} Module;