#ifndef _NTDBG_H

/**
 * The DBGUI_WAIT_STATE_CHANGE structure contains a debug state change returned by NtWaitForDebugEvent.
 * \remarks NewState identifies the event and selects the active StateInfo member.
 * AppClientId contains the process and thread identifiers of the event source.
 * DbgExceptionStateChange, DbgBreakpointStateChange, and DbgSingleStepStateChange share the Exception member.
 * Check the wait status before using the event data; a timeout or an alerted wait does not supply an event.
 * On x64, the structure is 0xB8 bytes, with NewState at 0x00, AppClientId at 0x08, and StateInfo at 0x18.
 */
typedef struct _DBGUI_WAIT_STATE_CHANGE
{
    DBG_STATE NewState;
    CLIENT_ID AppClientId;
    union
    {
        DBGKM_EXCEPTION Exception;              // DbgExceptionStateChange, DbgBreakpointStateChange, DbgSingleStepStateChange
        DBGUI_CREATE_THREAD CreateThread;       // DbgCreateThreadStateChange
        DBGUI_CREATE_PROCESS CreateProcessInfo; // DbgCreateProcessStateChange
        DBGKM_EXIT_THREAD ExitThread;           // DbgExitThreadStateChange
        DBGKM_EXIT_PROCESS ExitProcess;         // DbgExitProcessStateChange
        DBGKM_LOAD_DLL LoadDll;                 // DbgLoadDllStateChange
        DBGKM_UNLOAD_DLL UnloadDll;             // DbgUnloadDllStateChange
    } StateInfo;
} DBGUI_WAIT_STATE_CHANGE, *PDBGUI_WAIT_STATE_CHANGE;

#endif
View code on GitHub