The RTL_RB_TREE structure has pointers to the root node and left-most node of a Red-Black Tree.


The RTL_RB_TREE structure looks to have been introduced for version 6.2 in both the kernel and NTDLL.DLL. As many as three exported functions work specifically with the RTL_RB_TREE:

From public symbol files it is also knowable that Microsoft has an inline routine RtlRbInitialize whose whole work is of course to initialise an RTL_RB_TREE. There are also inline routines that work with nodes in Red-Black trees, but which work also for AVL trees: RtlTreeDelete; RtlTreeFindInsertLocation; RtlTreeFindFirstNode; and RtlTreeFindFirstMatchingNode.

Documentation Status

The RTL_RB_TREE structure is not documented.


The RTL_RB_TREE is 0x08 and 0x10 bytes, respectively, in 32-bit and 64-bit Windows.

Offset (x86) Offset (x64) Definition Versions
0x00 0x00
6.2 and higher
0x04 0x08
6.2 and higher

Nodes are ordered in the tree according to some abstract key. The Root is a starting point for searching the tree, moving left or right at successive nodes according to whether the desired node has a lower or higher key. The Min is a starting point for enumerating the tree in increasing order of the key.