The !dso Debugger Extension Command

The USERKDX debugger extension as supplied with the Platform SDK in the January 1997 edition (if not others) and later with the Device Driver Kit (DDK) for Windows 2000 exports a dso function and thus supports a !dso command.

The !dso command is in some sense an early form of what Microsoft’s debuggers would soon offer as the built-in dt command. A key difference is that the dt command dumps from type information in whatever symbol files the debugger has handy (or can download) but the !dso command dumps only the debugger extension’s built-in knowledge.

The extension’s own description of the !dso command is variously:

dso <Struct> [Field] [Address]- Dumps Struct field(s)'s offset(s) and value(s).

or

dso <Struct> [Field] [addr [*n]]-Dumps Struct field(s)'s offsets(s) & value(s).

It is not this note’s purpose, however, to pick over the syntax of an old command. The point is instead to note that in the years before Microsoft built type information into public symbol files, the !dso command was often (and by far) the most detailed public record that Microsoft left of undocumented Windows structures. Not all the structures that are known to the !dso command are undocumented, but many are, including some for which type information has hardly ever (or even never) turned up in public symbol files even through to Windows 10.

The large table that follows lists the structures whose offsets can be dumped by the !userkdx.dso command. Please be aware that the !dso command is also implemented in a different debugger extension, named USEREXTS, which Microsoft is thought to have distributed only with the DDKs. It supports a different set of structures.

Structure Versions
AAS 4.0 and 5.0
ACCEL 4.0 and 5.0
ACCELTABLE 4.0 and 5.0
ACCESS_STATE 5.0 only
ACL 5.0 only
ACON 5.0 only
ACON_COMMON 5.0 only
ANIHEADER 4.0 and 5.0
ANIMATIONINFO 4.0 and 5.0
ATOM_BASIC_INFORMATION 4.0 and 5.0
ATOM_TABLE_INFORMATION 4.0 and 5.0
ATTACHINFO 4.0 and 5.0
ATTRIBUTE_DEFINITION_COLUMNS 5.0 only
ATTRIBUTE_ENUMERATION_CONTEXT 5.0 only
ATTRIBUTE_LIST_CONTEXT 5.0 only
ATTRIBUTE_LIST_ENTRY 5.0 only
ATTRIBUTE_NAME_ENTRY 5.0 only
ATTRIBUTE_RECORD_HEADER 5.0 only
BCB 5.0 only
BITMAP 4.0 and 5.0
BITMAPCOREHEADER 4.0 and 5.0
BITMAPCOREINFO 4.0 and 5.0
BITMAPFILEHEADER 4.0 and 5.0
BITMAPINFO 4.0 and 5.0
BITMAPINFOHEADER 4.0 and 5.0
BITMAPV4HEADER 4.0 and 5.0
BITMAP_RANGE 5.0 only
BROADCASTSYSMSG 4.0 only
BROADCASTSYSTEMMSGPARAMS 4.0 and 5.0
BWL 4.0 and 5.0
CALLPROCDATA 4.0 and 5.0
CANDIDATEFORM 4.0 and 5.0
CANDIDATEINFO 5.0 only
CANDIDATELIST 4.0 and 5.0
CAPTIONCACHE 4.0 and 5.0
CAPTUREBUF 4.0 and 5.0
CARET 4.0 and 5.0
CBOX 5.0 only
CBTACTIVATESTRUCT 4.0 and 5.0
CBT_CREATEWNDA 4.0 and 5.0
CBT_CREATEWNDW 4.0 and 5.0
CCB 5.0 only
CCB_DATA 5.0 only
CHAR2 5.0 only
CHAR_IMAGE_INFO 5.0 only
CHECKPOINT 5.0 only
CLIENTCREATESTRUCT 4.0 and 5.0
CLIENTIMC 5.0 only
CLIENTINFO 4.0 and 5.0
CLIENTTHREADINFO 4.0 and 5.0
CLS 4.0 and 5.0
CLSMENUNAME 4.0 and 5.0
CNSSDATA 5.0 only
CNSSCACHE 5.0 only
CNSSCONVMAP 5.0 only
CNSSIOBUFFER 5.0 only
CNSSTRUNCDESCR 5.0 only
CNSS_DEVICE_EXT 5.0 only
CNSS_FILE_DESCR 5.0 only
CNSS_MDL_CHAINS 5.0 only
CNSS_MDL_RECORD 5.0 only
CNSS_OPENLOCK 5.0 only
CNSS_OPEN_PACKET 5.0 only
CNSS_SHARE_DESCR 5.0 only
CNSS_SHARE_NPAGED 5.0 only
CNSS_STATISTICS 5.0 only
CNSS_STK_IODESCR 5.0 only
COMBOBOXINFO 5.0 only
COMMON_WNDCLASS 4.0 and 5.0
COMMPROP 4.0 and 5.0
COMMTIMEOUTS 4.0 and 5.0
COMPAREITEMSTRUCT 4.0 and 5.0
COMPOSITIONSTRING 5.0 only
COMPRESSED_DATA_INFO 5.0 only
CONSOLE_CURSOR_INFO 4.0 and 5.0
CONSOLE_FONT_INFO 4.0 and 5.0
CONSOLE_GRAPHICS_BUFFER_INFO 4.0 and 5.0
CONSOLE_INFORMATION 5.0 only
CONSOLE_PER_PROCESS_DATA 5.0 only
CONSOLE_READCONSOLE_CONTROL 4.0 and 5.0
CONSOLE_SCREEN_BUFFER_INFO 4.0 and 5.0
CONTEXT 5.0 only
COORD 5.0 only
COPYDATASTRUCT 4.0 and 5.0
CPINFO 4.0 and 5.0
CPTABLEINFO 4.0 and 5.0
CREATESTRUCTA 4.0 and 5.0
CREATESTRUCTEX 4.0 and 5.0
CREATESTRUCTW 4.0 and 5.0
CSR_PROCESS 5.0 only
CSR_THREAD 5.0 only
CTLCOLOR 4.0 and 5.0
CURDIR 5.0 only
CURSINFO 4.0 and 5.0
CURSOR 4.0 and 5.0
CURSORDATA 4.0 and 5.0
CURSORFIND 4.0 and 5.0
CURSORSHAPE 4.0 and 5.0
CURSOR_ACON 5.0 only
CURSOR_COMMON 5.0 only
CVR 4.0 and 5.0
CWPRETSTRUCT 4.0 and 5.0
CWPRETSTRUCTEX 4.0 and 5.0
CWPSTRUCT 4.0 and 5.0
CWPSTRUCTEX 4.0 and 5.0
DCE 5.0 only
DDECONV 4.0 and 5.0
DDEIMP 4.0 and 5.0
DDEML_MSG_HOOK_DATA 4.0 and 5.0
DDEPACK 4.0 and 5.0
DDE_DATA 4.0 and 5.0
DEALLOCATED_CLUSTERS 5.0 only
DEALLOCATED_RECORDS 5.0 only
DEBUGHOOKINFO 4.0 and 5.0
DEFERRED_WRITE 5.0 only
DEFRAG_MFT 5.0 only
DELETEITEMSTRUCT 4.0 and 5.0
DESKTOP 4.0 and 5.0
DESKTOPINFO 4.0 and 5.0
DESKTOPTHREADINIT 4.0 only
DESKTOPVIEW 4.0 and 5.0
DEVCAPS 4.0 and 5.0
DEVICEINFO 5.0 only
DEVICE_FLAGS 5.0 only
DEVICE_OBJECT 5.0 only
DEVICE_TEMPLATE 5.0 only
DIALOG 4.0 and 5.0
DIRENTRY 5.0 only
DIRTY_PAGE_ENTRY 5.0 only
DISCDLGSTRUCTA 4.0 and 5.0
DISCDLGSTRUCTW 4.0 and 5.0
DISPATCHER_HEADER 5.0 only
DISPLAYINFO 4.0 and 5.0
DISPLAYRESOURCE 4.0 and 5.0
DLG 4.0 and 5.0
DLGENUMDATA 4.0 and 5.0
DLGITEMTEMPLATE 4.0 and 5.0
DLGITEMTEMPLATE2 4.0 and 5.0
DLGTEMPLATE 4.0 and 5.0
DLGTEMPLATE2 4.0 and 5.0
DOCHDR 5.0 only
DOCONNECTDATA 5.0 only
DORECONNECTDATA 5.0 only
DRAWICONEXDATA 4.0 and 5.0
DRAWITEMSTRUCT 4.0 and 5.0
DRAWTEXTPARMS 4.0 and 5.0
DRIVER_OBJECT 5.0 only
DUPLICATED_INFORMATION 5.0 only
DbgHeapHead 5.0 only
EA_INFORMATION 5.0 only
EA_LIST_HEADER 5.0 only
EJOB 5.0 only
ENCRYPTED_DATA_INFO 5.0 only
ENCRYPTION_BUFFER 5.0 only
ENCRYPTION_CALL_BACK 5.0 only
EOF_WAIT_BLOCK 5.0 only
EPROCESS 4.0 and 5.0
ERESOURCE 4.0 and 5.0
ETHREAD 4.0 and 5.0
EVENTHOOK 4.0 and 5.0
EVENTMSG 5.0 only
EXCEPTION_DEBUG_INFO 4.0 and 5.0
EXCEPTION_POINTERS 4.0 and 5.0
EXCEPTION_RECORD 4.0 and 5.0
EXCEPTION_REGISTRATION_RECORD 4.0 and 5.0
EXIT_PROCESS_DEBUG_INFO 4.0 and 5.0
EXIT_THREAD_DEBUG_INFO 4.0 and 5.0
EXT_API_VERSION 4.0 and 5.0
EX_DEBUG_LOG 4.0 and 5.0
EX_DEBUG_LOG_EVENT 4.0 and 5.0
EX_DEBUG_LOG_TAG 4.0 and 5.0
EX_LOCK 5.0 only
FAST_IO_DISPATCH 5.0 only
FAST_MUTEX 5.0 only
FAT_STATISTICS 5.0 only
FCB 5.0 only
FCB_DATA 5.0 only
FCB_INDEX 5.0 only
FCB_TABLE_ELEMENT 5.0 only
FCB_USN_RECORD 5.0 only
FILESYSTEM_STATISTICS 5.0 only
FILE_ACCESS_INFORMATION 5.0 only
FILE_ALIGNMENT_INFORMATION 5.0 only
FILE_ALLOCATED_RANGE_BUFFER 5.0 only
FILE_ALLOCATION_INFORMATION 5.0 only
FILE_ALL_INFORMATION 5.0 only
FILE_ATTRIBUTE_TAG_INFORMATION 5.0 only
FILE_BASIC_INFORMATION 5.0 only
FILE_BOTH_DIR_INFORMATION 5.0 only
FILE_COMPLETION_INFORMATION 5.0 only
FILE_COMPRESSION_INFORMATION 5.0 only
FILE_DIRECTORY_INFORMATION 5.0 only
FILE_EA_INFORMATION 5.0 only
FILE_END_OF_FILE_INFORMATION 5.0 only
FILE_FS_ATTRIBUTE_INFORMATION 5.0 only
FILE_FS_CONTROL_INFORMATION 5.0 only
FILE_FS_DEVICE_INFORMATION 5.0 only
FILE_FS_FULL_SIZE_INFORMATION 5.0 only
FILE_FS_LABEL_INFORMATION 5.0 only
FILE_FS_OBJECTID_INFORMATION 5.0 only
FILE_FS_SIZE_INFORMATION 5.0 only
FILE_FS_VOLUME_INFORMATION 5.0 only
FILE_FULL_DIR_INFORMATION 5.0 only
FILE_FULL_EA_INFORMATION 5.0 only
FILE_GET_EA_INFORMATION 5.0 only
FILE_GET_QUOTA_INFORMATION 5.0 only
FILE_INTERNAL_INFORMATION 5.0 only
FILE_LINK_INFORMATION 5.0 only
FILE_LOCK 5.0 only
FILE_LOCK_INFO 5.0 only
FILE_MAILSLOT_PEEK_BUFFER 5.0 only
FILE_MAILSLOT_QUERY_INFORMATION 5.0 only
FILE_MAILSLOT_SET_INFORMATION 5.0 only
FILE_MODE_INFORMATION 5.0 only
FILE_MOVE_CLUSTER_INFORMATION 5.0 only
FILE_NAME 5.0 only
FILE_NAMES_INFORMATION 5.0 only
FILE_NAME_INFORMATION 5.0 only
FILE_NETWORK_OPEN_INFORMATION 5.0 only
FILE_NOTIFY_INFORMATION 5.0 only
FILE_OBJECT 5.0 only
FILE_OBJECTID_BUFFER 5.0 only
FILE_OBJECTID_INFORMATION 5.0 only
FILE_PIPE_ASSIGN_EVENT_BUFFER 5.0 only
FILE_PIPE_CLIENT_PROCESS_BUFFER 5.0 only
FILE_PIPE_EVENT_BUFFER 5.0 only
FILE_PIPE_INFORMATION 5.0 only
FILE_PIPE_LOCAL_INFORMATION 5.0 only
FILE_PIPE_PEEK_BUFFER 5.0 only
FILE_PIPE_REMOTE_INFORMATION 5.0 only
FILE_PIPE_WAIT_FOR_BUFFER 5.0 only
FILE_POSITION_INFORMATION 5.0 only
FILE_QUOTA_INFORMATION 5.0 only
FILE_RECORD_SEGMENT_HEADER 5.0 only
FILE_RENAME_INFORMATION 5.0 only
FILE_REPARSE_POINT_INFORMATION 5.0 only
FILE_STANDARD_INFORMATION 5.0 only
FILE_STREAM_INFORMATION 5.0 only
FILE_SYSTEM_STATISTICS 5.0 only
FILE_TRACKING_INFORMATION 5.0 only
FILE_ZERO_DATA_INFORMATION 5.0 only
FLOATING_SAVE_AREA 5.0 only
FOUND_ATTRIBUTE 5.0 only
FREELIST 5.0 only
FSCNTL_SCREEN_INFO 5.0 only
FSCTL_QUERY_FAT_BPB_BUFFER 5.0 only
FSRTL_ADVANCED_FCB_HEADER 5.0 only
FSRTL_AUXILIARY_BUFFER 5.0 only
FSRTL_COMMON_FCB_HEADER 5.0 only
FSRTL_FILTER_CONTEXT 5.0 only
GENERAL_LOOKASIDE 5.0 only
GENERATE_NAME_CONTEXT 5.0 only
GENERIC_DEVICE_INFO 5.0 only
GUID 5.0 only
GUIDELINE 5.0 only
HANDLEENTRY 4.0 and 5.0
HARDERRORHANDLER 4.0 and 5.0
HARDERROR_MSG 5.0 only
HARDWAREHOOKSTRUCT 4.0 and 5.0
HEAD 4.0 and 5.0
HEAP 5.0 only
HEAP_BASE 4.0 only
HEAP_ENTRY 4.0 and 5.0
HEAP_FREE_ENTRY 4.0 and 5.0
HEAP_SEGMENT 5.0 only
HELPINFO 4.0 and 5.0
HELPWININFOA 4.0 and 5.0
HELPWININFOW 4.0 and 5.0
HLP 4.0 and 5.0
HOOK 4.0 and 5.0
HOOKMSGSTRUCT 4.0 and 5.0
HOTKEY 4.0 and 5.0
ICONINFO 4.0 and 5.0
ICONMETRICSA 4.0 and 5.0
ICONMETRICSW 4.0 and 5.0
IMAGEHLP_DEFERRED_SYMBOL_LOAD 4.0 and 5.0
IMAGEHLP_DUPLICATE_SYMBOL 4.0 and 5.0
IMAGEHLP_MODULE 4.0 and 5.0
IMAGEHLP_SYMBOL 4.0 and 5.0
IMAGE_ARCHIVE_MEMBER_HEADER 4.0 and 5.0
IMAGE_BASE_RELOCATION 4.0 and 5.0
IMAGE_BOUND_FORWARDER_REF 4.0 and 5.0
IMAGE_BOUND_IMPORT_DESCRIPTOR 4.0 and 5.0
IMAGE_COFF_SYMBOLS_HEADER 4.0 and 5.0
IMAGE_DATA_DIRECTORY 4.0 and 5.0
IMAGE_DEBUG_DIRECTORY 4.0 and 5.0
IMAGE_DEBUG_INFORMATION 4.0 and 5.0
IMAGE_DEBUG_MISC 4.0 and 5.0
IMAGE_DOS_HEADER 4.0 and 5.0
IMAGE_EXPORT_DIRECTORY 4.0 and 5.0
IMAGE_FILE_HEADER 4.0 and 5.0
IMAGE_FUNCTION_ENTRY 4.0 and 5.0
IMAGE_IMPORT_BY_NAME 4.0 and 5.0
IMAGE_IMPORT_DESCRIPTOR 4.0 and 5.0
IMAGE_LINENUMBER 4.0 and 5.0
IMAGE_LOAD_CONFIG_DIRECTORY 4.0 only
IMAGE_NT_HEADERS 4.0 only
IMAGE_OPTIONAL_HEADER 4.0 only
IMAGE_OS2_HEADER 4.0 and 5.0
IMAGE_RELOCATION 4.0 and 5.0
IMAGE_RESOURCE_DATA_ENTRY 4.0 and 5.0
IMAGE_RESOURCE_DIRECTORY 4.0 and 5.0
IMAGE_RESOURCE_DIRECTORY_ENTRY 4.0 and 5.0
IMAGE_RESOURCE_DIRECTORY_STRING 4.0 and 5.0
IMAGE_RESOURCE_DIR_STRING_U 4.0 and 5.0
IMAGE_ROM_HEADERS 4.0 and 5.0
IMAGE_ROM_OPTIONAL_HEADER 4.0 and 5.0
IMAGE_RUNTIME_FUNCTION_ENTRY 4.0 only
IMAGE_SECTION_HEADER 4.0 and 5.0
IMAGE_SEPARATE_DEBUG_HEADER 4.0 and 5.0
IMAGE_SYMBOL 4.0 and 5.0
IMAGE_THUNK_DATA 4.0 only
IMAGE_TLS_DIRECTORY 4.0 only
IMAGE_VXD_HEADER 4.0 and 5.0
IMC 5.0 only
IMECHARPOSITION 5.0 only
IMEHOTKEY 5.0 only
IMEHOTKEYOBJ 5.0 only
IMEINFO 5.0 only
IMEINFOEX 5.0 only
IMEUI 5.0 only
IMEWND 5.0 only
INDEX_ALLOCATION_BUFFER 5.0 only
INDEX_CONTEXT 5.0 only
INDEX_DATA 5.0 only
INDEX_ENTRY 5.0 only
INDEX_HEADER 5.0 only
INDEX_KEY 5.0 only
INDEX_LOOKUP_STACK 5.0 only
INDEX_ROOT 5.0 only
INDEX_ROW 5.0 only
INDICATOR_LIST 4.0 and 5.0
INITIALIZATION_CONTEXT 4.0 and 5.0
INITIAL_PEB 4.0 and 5.0
INITIAL_PRIVILEGE_SET 4.0 and 5.0
INITIAL_TEB 4.0 and 5.0
INPUTCONTEXT 5.0 only
INPUT_RECORD 4.0 and 5.0
INTDDEINFO 4.0 and 5.0
INTRSENDMSGEX 4.0 and 5.0
IOSPACE 4.0 and 5.0
IOSPACE_EX 4.0 and 5.0
IO_COMPLETION_BASIC_INFORMATION 4.0 and 5.0
IO_COMPLETION_CONTEXT 4.0 and 5.0
IO_COUNTERS 4.0 and 5.0
IO_ERROR_LOG_MESSAGE 4.0 and 5.0
IO_ERROR_LOG_PACKET 4.0 and 5.0
IO_INTERRUPT_STRUCTURE 4.0 and 5.0
IO_SECURITY_CONTEXT 4.0 and 5.0
IO_STATUS_BLOCK 4.0 and 5.0
IO_RESOURCE_DESCRIPTOR 4.0 and 5.0
IO_RESOURCE_LIST 4.0 and 5.0
IO_RESOURCE_REQUIREMENTS_LIST 4.0 and 5.0
IO_RUN 5.0 only
IO_STACK_LOCATION 4.0 and 5.0
IO_TIMER 4.0 and 5.0
IRP 4.0 and 5.0
IRP_CONTEXT 5.0 only
IRP_FILE_RECORD_CACHE_ENTRY 5.0 only
ITEM 4.0 and 5.0
KAPC 5.0 only
KBDFILE 4.0 and 5.0
KBDLANGTOGGLE 4.0 and 5.0
KBDNLSTABLES 5.0 only
KBDTABLES 4.0 and 5.0
KDEVICE_QUEUE 5.0 only
KDEVICE_QUEUE_ENTRY 5.0 only
KDPC 5.0 only
KE 4.0 and 5.0
KERNEL_USER_TIMES 5.0 only
KEVENT 5.0 only
KEYBOARD_ATTRIBUTES 5.0 only
KEYBOARD_DEVICE_INFO 5.0 only
KEYBOARD_INPUT_DATA 5.0 only
KFLOATING_SAVE 5.0 only
KINTERRUPT 5.0 only
KL 5.0 only
KMUTANT 5.0 only
KPCR 5.0 only
KPROCESS 5.0 only
KQUEUE 5.0 only
KSEMAPHORE 5.0 only
KSYSTEM_TIME 5.0 only
KTHREAD 4.0 and 5.0
KTIMER 5.0 only
KTRAP_FRAME 5.0 only
KUSER_SHARED_DATA 5.0 only
KWAIT_BLOCK 5.0 only
LARGE_MCB 5.0 only
LARGE_STANDARD_INFORMATION 5.0 only
LARGE_STRING 5.0 only
LARGE_UNICODE_STRING 5.0 only
LAST_EXCEPTION_LOG 5.0 only
LAZY_WRITER 5.0 only
LBIV 5.0 only
LCN_RANGE 5.0 only
LINK_TRACKING_INFORMATION 5.0 only
LOCKTREE_NODE 5.0 only
LOCK_INFO 5.0 only
LOCK_QUEUE 5.0 only
LOGFONTW 5.0 only
LPCP_PORT_OBJECT 5.0 only
MAP_HANDLE 5.0 only
MDICREATESTRUCTA 4.0 and 5.0
MDICREATESTRUCTEX 4.0 and 5.0
MDICREATESTRUCTW 4.0 and 5.0
MDINEXTMENU 4.0 and 5.0
MDL 4.0 and 5.0
MDL_WRITE 5.0 only
MEASUREITEMSTRUCT 4.0 and 5.0
MEASUREITEMSTRUCT_EX 4.0 and 5.0
MENU 4.0 and 5.0
MENUINFO 5.0 only
MENUITEMINFOA 4.0 and 5.0
MENUITEMINFOW 4.0 and 5.0
MENUITEMTEMPLATE 4.0 and 5.0
MENUITEMTEMPLATE2 4.0 and 5.0
MENUITEMTEMPLATEHEADER 4.0 and 5.0
MENUSTATE 4.0 and 5.0
MENUWND 4.0 and 5.0
MENU_EVENT_RECORD 4.0 and 5.0
MESSAGE_RESOURCE_BLOCK 4.0 and 5.0
MESSAGE_RESOURCE_DATA 4.0 and 5.0
MESSAGE_RESOURCE_ENTRY 4.0 and 5.0
MFT_SEGMENT_REFERENCE 5.0 only
MLIST 4.0 and 5.0
MINIMIZEDMETRICS 4.0 and 5.0
MINMAXINFO 4.0 and 5.0
MONITOR 5.0 only
MONITORPOS 5.0 only
MONITORRECTS 5.0 only
MOUSEHOOKSTRUCT 4.0 and 5.0
MOUSEHOOKSTRUCTEX 5.0 only
MOUSEKEYS 4.0 and 5.0
MOUSE_ATTRIBUTES 5.0 only
MOUSE_DEVICE_INFO 5.0 only
MOUSE_INPUT_DATA 5.0 only
MOVESIZEDATA 4.0 and 5.0
MSG 4.0 and 5.0
MSGBOXDATA 4.0 and 5.0
MSGBOXPARAMSA 4.0 and 5.0
MSGBOXPARAMSW 4.0 and 5.0
NAME_LINK 5.0 only
NAME_PAIR 5.0 only
NCCALCSIZE_PARAMS 4.0 and 5.0
NEW_ATTRIBUTE_SIZES 5.0 only
NONCLIENTMETRICSA 4.0 and 5.0
NONCLIENTMETRICSW 4.0 and 5.0
NONOPAQUE_OPLOCK 5.0 only
NOTIFY 4.0 and 5.0
NPAGED_LOOKASIDE_LIST 5.0 only
NSSHDR 5.0 only
NSSMINIHDR 5.0 only
NTFS_DATA 5.0 only
NTFS_IO_CONTEXT 5.0 only
NTFS_LOG_RECORD_HEADER 5.0 only
NTFS_MCB 5.0 only
NTFS_MCB_ARRAY 5.0 only
NTFS_MCB_ENTRY 5.0 only
NTFS_NAME_DESCRIPTOR 5.0 only
NTFS_OBJECTID_INFORMATION 5.0 only
NTFS_STATISTICS 5.0 only
NTFS_TUNNELED_DATA 5.0 only
NUKEM 5.0 only
OBCB 5.0 only
OBJECT_ATTRIBUTES 5.0 only
OBJECT_TYPE 5.0 only
OEMBITMAPINFO 5.0 only
OLD_FCB_SNAPSHOT 5.0 only
OPEN_ATTRIBUTE_ENTRY 5.0 only
OPFILTER_TIMER 5.0 only
OPLOCK_CLEANUP 5.0 only
PAGED_LOOKASIDE_LIST 5.0 only
PATHNAME_BUFFER 5.0 only
PEB 5.0 only
PERUSERSERVERINFO 5.0 only
POPUPMENU 4.0 and 5.0
PREFIX_TABLE 5.0 only
PREFIX_TABLE_ENTRY 5.0 only
PRIVATE_CACHE_MAP 5.0 only
PROCESSINFO 4.0 and 5.0
PROCOBJHEAD 4.0 and 5.0
PROP 4.0 and 5.0
PROPSET 4.0 and 5.0
Q 4.0 and 5.0
QMSG 4.0 and 5.0
QUICK_INDEX 5.0 only
QUICK_INDEX_HINT 5.0 only
QUOTA_CONTROL_BLOCK 5.0 only
QUOTA_USER_DATA 5.0 only
READ_AHEAD_THREAD 5.0 only
RECONVERTSTRING 5.0 only
RECORD_ALLOCATION_CONTEXT 5.0 only
REPARSE_INDEX_KEY 5.0 only
REPARSE_POINT_INFORMATION 5.0 only
REQUEST_RAW_ENCRYPTED_DATA 5.0 only
RESERVED_BITMAP_RANGE 5.0 only
RESTART_AREA 5.0 only
RESTART_POINTERS 5.0 only
RESTART_TABLE 5.0 only
RTL_BITMAP 5.0 only
RTL_BITMAP_RUN 5.0 only
RTL_DRIVE_LETTER_CURDIR 5.0 only
RTL_GENERIC_TABLE 5.0 only
RTL_HEAP_PARAMETERS 5.0 only
RTL_PROCESS_BACKTRACES 5.0 only
RTL_PROCESS_BACKTRACE_INFORMATION 5.0 only
RTL_PROCESS_LOCKS 5.0 only
RTL_PROCESS_LOCK_INFORMATION 5.0 only
RTL_QUERY_REGISTRY_TABLE 5.0 only
RTL_RANGE 5.0 only
RTL_RANGE_LIST 5.0 only
RTL_RXACT_LOG 5.0 only
RTL_SPLAY_LINKS 5.0 only
RTL_TIME_ZONE_INFORMATION 5.0 only
RTL_USER_PROCESS_INFORMATION 5.0 only
RTL_USER_PROCESS_PARAMETERS 5.0 only
SBCALC 4.0 and 5.0
SBDATA 4.0 and 5.0
SBINFO 4.0 and 5.0
SBTRACK 4.0 and 5.0
SBWND 4.0 and 5.0
SCB 5.0 only
SCB_DATA 5.0 only
SCB_INDEX 5.0 only
SCB_MFT 5.0 only
SCB_NONPAGED 5.0 only
SCB_SNAPSHOT 5.0 only
SCOPE_CONTEXT 5.0 only
SCREEN_INFORMATION 5.0 only
SCROLLINFO 4.0 and 5.0
SECTION_OBJECT_POINTERS 5.0 only
SECURITY_DESCRIPTOR_HEADER 5.0 only
SECURITY_HASH_KEY 5.0 only
SERVERINFO 4.0 and 5.0
SHAREDINFO 4.0 and 5.0
SHARED_CACHE_MAP 5.0 only
SHARED_CACHE_MAP_LIST_CURSOR 5.0 only
SHARED_SECURITY 5.0 only
SHARE_ACCESS 5.0 only
SHORT2 5.0 only
SHROBJHEAD 4.0 only
SH_LOCK 5.0 only
SID 5.0 only
SINGLE_LIST_ENTRY 5.0 only
SMS 4.0 and 5.0
SMWP 4.0 and 5.0
SPB 5.0 only
STANDARD_INFORMATION 5.0 only
TEB 4.0 and 5.0
TERMINAL 5.0 only
TEXTMETRICA 4.0 and 5.0
TEXTMETRICW 4.0 and 5.0
THREADINFO 4.0 and 5.0
THROBJHEAD 4.0 and 5.0
TIMER 4.0 and 5.0
TIME_FIELDS 5.0 only
TL 5.0 only
TOOLTIP 5.0 only
TOP_LEVEL_CONTEXT 5.0 only
TRACKMOUSEEVENT 5.0 only
TRANSACTION_ENTRY 5.0 only
TRANSMSG 5.0 only
TRANSMSGLIST 5.0 only
UNICODE_PREFIX_TABLE 5.0 only
UNICODE_PREFIX_TABLE_ENTRY 5.0 only
UNICODE_STRING 5.0 only
UPCASE_TABLE_AND_KEY 5.0 only
USERSTARTUPINFO 4.0 and 5.0
VACB 5.0 only
VCB 5.0 only
VK_F 5.0 only
VK_TO_WCHAR_TABLE 5.0 only
VK_VSC 5.0 only
VM_COUNTERS 5.0 only
VOLUME_DEVICE_OBJECT 5.0 only
VOLUME_INFORMATION 5.0 only
VPB 5.0 only
VSC_VK 5.0 only
W32JOB 5.0 only
W32PROCESS 4.0 and 5.0
W32THREAD 4.0 and 5.0
WAITING_IRP 5.0 only
WAITING_LOCK 5.0 only
WAIT_FOR_NEW_LENGTH 5.0 only
WIN32HEAP 5.0 only
WINDOWPLACEMENT 4.0 and 5.0
WINDOWPOS 4.0 and 5.0
WINDOWSTATION 4.0 and 5.0
WND 4.0 and 5.0
WNDCLASSA 4.0 and 5.0
WNDCLASSEXA 4.0 and 5.0
WNDCLASSEXW 4.0 and 5.0
WNDCLASSW 4.0 and 5.0
WNDMSG 4.0 and 5.0
WNDOBJ 4.0 and 5.0
WORK_QUEUE_ENTRY 5.0 only
WORK_QUEUE_ITEM 5.0 only
WOWPROCESSINFO 4.0 and 5.0
WOWTHREADINFO 4.0 and 5.0
WW 5.0 only
Win32MapView 5.0 only
Win32Section 5.0 only
XSTATE 5.0 only

What principle ever governed the selection of structures for presentation through the !dso command is not known. Some of the supported structures are creatures of user mode, but many have no visibility except in kernel mode.

One influence on the selection may be that a structure was eligible only if it was thought stable. The USEREXTS debugger extension ships with the DDK which in turn is new for each Windows version but not for each build and not even for each formally released service pack. Even assuming that programmers (both Microsoft’s and not) use the debugger, including its extensions, from the DDK for the same version of Windows that they’re debugging, the !dso command would have greatly reduced worth if the structures it dumps change between builds.

Many structures were added to the !dso output for version 5.0. Some of these structures truly were new for version 5.0. Many were perhaps added simply because Microsoft’s own programmers had found the !dso command to be useful and sought to increase its coverage. Only a few were withdrawn.