3 ms·

Windows uses a field that contains the size of the structure being passed to the API, presumably to differentiate between different versions. Ex: DOCINFO d

Windows uses a field that contains the size of the structure being passed to the API, presumably to differentiate between different versions. Ex: DOCINFO doc; memset(&doc, 0, sizeof(doc)); doc.cbSize = sizeof(DOCINFO);

cbsks 4y ago
I’m not familiar with Windows programming, but that could also be due to variable length structs.
sedatk 4y ago
Also, NT kernel's pool allocation code receives a 4-char string called "tag" to identify an allocated block. Almost all kernel allocated memory use that feature.