using dbgeng one could not get the bitfields
as the underlying type is is not a struct but a char or uchar or int etc.
there is an old post here too.
https://community.osr.com/t/how-to-get-the-right-offset-of-a-bit-field-member-in-extension/29628
windbg knows somehow to print the bitfields in its api OutputTypedDataVirtual()
you could probably parse it from the string
the code below displays the same info that would be returned by dt ntdll!_PS_PROTECTION
m_Symbols->GetSymbolTypeId("ntdll!_PS_PROTECTION", &TypeId, &ModBase);
Out("TypeId of ntdll!_PS_PROTECTION = %X\nModule Base = %I64X\n", TypeId, ModBase);
m_Symbols->GetTypeSize(ModBase, TypeId, &TypeSize);
Out("Size of Type ntdll!_PS_PROTECTION = %x\n", TypeSize);
m_Symbols->OutputTypedDataVirtual(
DEBUG_OUTCTL_ALL_CLIENTS, 0, ModBase, TypeId, DEBUG_TYPEOPTS_LONGSTATUS_DISPLAY);
output
0:000> .load F:\wdbgextensions\typeinfo\typeinfo.dll
0:000> !typeinfo
===================================================================================
TypeId of ntdll!_PS_PROTECTION = 2
Module Base = 7FFD1FA50000
Size of Type ntdll!_PS_PROTECTION = 1
Level : UChar
Type : Pos 0, 3 Bits
Audit : Pos 3, 1 Bit
Signer : Pos 4, 4 Bits
but using the latest javascript or i think with a c++ or com abi you could get it from getModuleType ()
I cant get the old engext.cpp and the new dbgmodel.h to coexist in an extension they throw innumerous errors when compiling also the headers that come with debuggers are stale and you may need to get the latest headers via nuget it seems
but here is a javascript output
0:000> dx Debugger.State.Scripts.tinfo.Contents.host.getModuleType("ntdll","_PS_PROTECTION").fields.Audit.type.bitFieldPositions
Debugger.State.Scripts.tinfo.Contents.host.getModuleType("ntdll","_PS_PROTECTION").fields.Audit.type.bitFieldPositions : [object Object]
lsb : 0x3
length : 0x1
0:000> dx Debugger.State.Scripts.tinfo.Contents.host.getModuleType("ntdll","_PS_PROTECTION").fields.Signer.type.bitFieldPositions
Debugger.State.Scripts.tinfo.Contents.host.getModuleType("ntdll","_PS_PROTECTION").fields.Signer.type.bitFieldPositions : [object Object]
lsb : 0x4
length : 0x4