This is the whole reason why I stated that this was the 26100 version of the SDK and that earlier versions of the SDK will be at earlier lines.
To give two extra examples of this, but I am not going through the entire Windows SDK history, for the initial release of Windows 11 SDK (22000, or 21H2) then the following are the lines for the CONTEXT structure definitions for each architecture.
x64: 4203-4320
ARM: 5164-5222
ARM64: 6518-6588 (with the typedef on 6598)
x86: 8198-8284
For Windows 11 22621 SDK (this would be the 22H2/23H2 versions of Windows 11), then the following are the lines for the definition of the structures for each architecture.
x64: 4206-4323
ARM: 5181-5239
ARM64: 6549-6619 (with the typedef on 6629)
x86: 8236-8322
If there is a real struggle to find the definitions, then there is one more trick you can use. There is a function named RtlCaptureContext, and this is one of the ways that an application is able to generate a CONTEXT structure based on the current processor state. It is possible to use Visual Studio's intellisense to navigate from this function definition to the currently active CONTEXT structure.
Visual Studio has a Go To Definition feature, which is on the F12 key, or it can be accessed by right clicking.
If RtlCaptureContext is typed into a C++ source file:
the caret is placed in or near the function name:
and then F12 is pressed, or the mouse cursor is placed over the function name, the right mouse button is pressed and Go To Definition is selected, then Visual Studio will go to the definition for RtlCaptureContext. This is important here because this returns a pointer to the CONTEXT structure, and this is defined along with the CONTEXT structure itself. The Go To Definition will navigate to the RtlCaptureContext in the winnt.h header.
Go To Definition can then be used to go to the currently active CONTEXT structure. Also, DISPATCHER_CONTEXT is defined really close to CONTEXT and always has a pointer to the CONTEXT structure as part of it for x64, ARM and ARM64. So if that structure has been located then it should be very easy to find CONTEXT.
As an example of how close DISPATCHER_CONTEXT is to CONTEXT. This is for the x64 version.
22000: DISPATCHER_CONTEXT at 4378-4390, CONTEXT at 4203-4320
22621: DISPATCHER_CONTEXT at 4381-4393, CONTEXT at 4206-4323
26100: DISPATCHER_CONTEXT at 4476-4488, CONTEXT at 4301-4418
Because of the definition of DISPATCHER_CONTEXT, it will always be defined after CONTEXT. It doesn't need to be there, but the way CONTEXT is defined in winnt.h will give this result.
//x64 DISPATCHER_CONTEXT structure, exceprt from winnt.h.
//Taken from the Windows 11 SDK version 10.0.26100.1742
//Lines 4476-4488.
typedef struct _DISPATCHER_CONTEXT {
DWORD64 ControlPc;
DWORD64 ImageBase;
PRUNTIME_FUNCTION FunctionEntry;
DWORD64 EstablisherFrame;
DWORD64 TargetIp;
PCONTEXT ContextRecord; //Pointer to CONTEXT structure
PEXCEPTION_ROUTINE LanguageHandler;
PVOID HandlerData;
struct _UNWIND_HISTORY_TABLE *HistoryTable;
DWORD ScopeIndex;
DWORD Fill0;
} DISPATCHER_CONTEXT, *PDISPATCHER_CONTEXT;