#ifndef _NTPFAPI_H

// rev
/**
 * The PF_PRIVSOURCE_QUERY_REQUEST structure enumerates private-page sources and their memory-use information.
 * \remarks Initialize Version and Flags before querying. The x64 buffer has a 16-byte header
 * followed by 96-byte PF_PRIVSOURCE_INFO records and requires 8-byte alignment. InfoCount is output, not
 * the input capacity. STATUS_BUFFER_TOO_SMALL reports a required payload length through query ReturnLength;
 * retry with that capacity because the process population can change between calls.
 */
typedef struct _PF_PRIVSOURCE_QUERY_REQUEST
{
    ULONG Version;                              // Request version: PF_PRIVSOURCE_QUERY_REQUEST_VERSION (8).
    ULONG Flags;                                // PF_PRIVSOURCE_QUERY_REQUEST_FLAGS_* options; valid mask 0x7.
    ULONG InfoCount;                            // Number of source records written to InfoArray.
    PF_PRIVSOURCE_INFO InfoArray[1];            // Variable array of returned source records; allocate using the required buffer length.
} PF_PRIVSOURCE_QUERY_REQUEST, *PPF_PRIVSOURCE_QUERY_REQUEST;

#endif
View code on GitHub