mirror of
https://github.com/0xJs/BYOVD_read_write_primitive
synced 2026-06-06 15:04:29 +00:00
0xjs
382 lines
26 KiB
C
382 lines
26 KiB
C
/*
|
|
Defines all the data structures used across the project
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include <Windows.h>
|
|
#include "config.h"
|
|
|
|
// ***** STRUCTS FOR RTCORE64 READ AND WRITE ***** //
|
|
|
|
typedef struct RTCORE64_MEMORY_READ {
|
|
BYTE Pad0[8];
|
|
DWORD64 Address;
|
|
BYTE Pad1[8];
|
|
DWORD ReadSize;
|
|
DWORD Value;
|
|
BYTE Pad3[16];
|
|
} RTCORE64_MEMORY_READ;
|
|
|
|
typedef struct RTCORE64_MEMORY_WRITE {
|
|
BYTE Pad0[8];
|
|
DWORD64 Address;
|
|
BYTE Pad1[8];
|
|
DWORD WriteSize;
|
|
DWORD Value;
|
|
BYTE Pad3[16];
|
|
} RTCORE64_MEMORY_WRITE;
|
|
|
|
// ***** STRUCTS FOR ntoskrnlOffsets.c ***** //
|
|
|
|
typedef enum NtoskrnlOffsetType {
|
|
ETW_THREAT_INT_PROV_REG_HANDLE = 0,
|
|
ETW_REG_ENTRY_GUIDENTRY,
|
|
ETW_GUID_ENTRY_PROVIDERENABLEINFO,
|
|
_SUPPORTED_NTOSKRNL_OFFSETS_END
|
|
};
|
|
|
|
typedef union NtoskrnlOffsets {
|
|
// structure version of ntoskrnl.exe offsets
|
|
struct {
|
|
|
|
// Kernel Callback Arrays
|
|
//
|
|
// ntoskrnl's PspCreateProcessNotifyRoutine
|
|
DWORD64 pspCreateProcessNotifyRoutine;
|
|
// ntoskrnl's PspCreateThreadNotifyRoutine
|
|
DWORD64 pspCreateThreadNotifyRoutine;
|
|
// ntoskrnl's PspLoadImageNotifyRoutine
|
|
DWORD64 pspLoadImageNotifyRoutine;
|
|
|
|
// ntoskrnl CallbackListHead symbol offset
|
|
DWORD64 CallbackListHead;
|
|
|
|
// ntoskrnl PsProcessType symbol offset
|
|
DWORD64 psProcessType;
|
|
// ntoskrnl PsThreadType symbol offset
|
|
DWORD64 psThreadType;
|
|
// ntoskrnl _OBJECT_TYPE's CallbackList symbol offset
|
|
DWORD64 object_type_callbacklist;
|
|
|
|
} st;
|
|
|
|
// array version (usefull for code factoring)
|
|
DWORD64 ar[_SUPPORTED_NTOSKRNL_OFFSETS_END];
|
|
} NtoskrnlOffsets;
|
|
|
|
// ***** STRUCTS FOR fltMgrOffsets.c ***** //
|
|
|
|
enum FltmgrOffsetType {
|
|
FltGlobals = 0,
|
|
_GLOBALS_FrameList,
|
|
_FLT_RESOURCE_LIST_HEAD_rList,
|
|
_FLTP_FRAME_Links,
|
|
_FLTP_FRAME_RegisteredFilters,
|
|
_FLT_OBJECT_PrimaryLink,
|
|
_FLT_FILTER_DriverObject,
|
|
_FLT_FILTER_InstanceList,
|
|
_DRIVER_OBJECT_DriverInit,
|
|
_FLT_INSTANCE_CallbackNodes,
|
|
_FLT_INSTANCE_FilterLink,
|
|
_SUPPORTED_FLTMGR_OFFSETS_END
|
|
};
|
|
|
|
typedef union FltmgrOffsets {
|
|
// structure version of fltmgr.sys's offsets
|
|
struct {
|
|
DWORD64 FltGlobals;
|
|
DWORD64 _GLOBALS_FrameList;
|
|
DWORD64 _FLT_RESOURCE_LIST_HEAD_rList;
|
|
DWORD64 _FLTP_FRAME_Links;
|
|
DWORD64 _FLTP_FRAME_RegisteredFilters;
|
|
DWORD64 _FLT_OBJECT_PrimaryLink;
|
|
DWORD64 _FLT_FILTER_DriverObject;
|
|
DWORD64 _FLT_FILTER_InstanceList;
|
|
DWORD64 _DRIVER_OBJECT_DriverInit;
|
|
DWORD64 _FLT_INSTANCE_CallbackNodes;
|
|
DWORD64 _FLT_INSTANCE_FilterLink;
|
|
} st;
|
|
|
|
// array version (usefull for code factoring)
|
|
DWORD64 ar[_SUPPORTED_FLTMGR_OFFSETS_END];
|
|
} fltMgrOffsets;
|
|
|
|
// ***** STRUCTS FOR kernelCallback.c ***** //
|
|
|
|
typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY {
|
|
PVOID Section;
|
|
PVOID MappedBase;
|
|
PVOID ImageBase; // Base address of the module
|
|
ULONG ImageSize;
|
|
ULONG Flags;
|
|
USHORT LoadOrderIndex;
|
|
USHORT InitOrderIndex;
|
|
USHORT LoadCount;
|
|
USHORT OffsetToFileName;
|
|
UCHAR FullPathName[256]; // Full path of the module
|
|
} SYSTEM_MODULE_INFORMATION_ENTRY, * PSYSTEM_MODULE_INFORMATION_ENTRY;
|
|
|
|
typedef struct _SYSTEM_MODULE_INFORMATION {
|
|
ULONG ModulesCount;
|
|
SYSTEM_MODULE_INFORMATION_ENTRY Modules[1];
|
|
} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION;
|
|
|
|
// https://github.com/winsiderss/systeminformer/blob/dd202c415c24540475bbd47f9e02d8334ee01671/phnt/include/ntexapi.h#L1830
|
|
typedef enum _SYSTEM_INFORMATION_CLASS
|
|
{
|
|
SystemBasicInformation, // q: SYSTEM_BASIC_INFORMATION
|
|
SystemProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION
|
|
SystemPerformanceInformation, // q: SYSTEM_PERFORMANCE_INFORMATION
|
|
SystemTimeOfDayInformation, // q: SYSTEM_TIMEOFDAY_INFORMATION
|
|
SystemPathInformation, // not implemented
|
|
SystemProcessInformation, // q: SYSTEM_PROCESS_INFORMATION
|
|
SystemCallCountInformation, // q: SYSTEM_CALL_COUNT_INFORMATION
|
|
SystemDeviceInformation, // q: SYSTEM_DEVICE_INFORMATION
|
|
SystemProcessorPerformanceInformation, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION (EX in: USHORT ProcessorGroup)
|
|
SystemFlagsInformation, // q: SYSTEM_FLAGS_INFORMATION
|
|
SystemCallTimeInformation, // not implemented // SYSTEM_CALL_TIME_INFORMATION // 10
|
|
SystemModuleInformation, // q: RTL_PROCESS_MODULES
|
|
SystemLocksInformation, // q: RTL_PROCESS_LOCKS
|
|
SystemStackTraceInformation, // q: RTL_PROCESS_BACKTRACES
|
|
SystemPagedPoolInformation, // not implemented
|
|
SystemNonPagedPoolInformation, // not implemented
|
|
SystemHandleInformation, // q: SYSTEM_HANDLE_INFORMATION
|
|
SystemObjectInformation, // q: SYSTEM_OBJECTTYPE_INFORMATION mixed with SYSTEM_OBJECT_INFORMATION
|
|
SystemPageFileInformation, // q: SYSTEM_PAGEFILE_INFORMATION
|
|
SystemVdmInstemulInformation, // q: SYSTEM_VDM_INSTEMUL_INFO
|
|
SystemVdmBopInformation, // not implemented // 20
|
|
SystemFileCacheInformation, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemCache)
|
|
SystemPoolTagInformation, // q: SYSTEM_POOLTAG_INFORMATION
|
|
SystemInterruptInformation, // q: SYSTEM_INTERRUPT_INFORMATION (EX in: USHORT ProcessorGroup)
|
|
SystemDpcBehaviorInformation, // q: SYSTEM_DPC_BEHAVIOR_INFORMATION; s: SYSTEM_DPC_BEHAVIOR_INFORMATION (requires SeLoadDriverPrivilege)
|
|
SystemFullMemoryInformation, // not implemented // SYSTEM_MEMORY_USAGE_INFORMATION
|
|
SystemLoadGdiDriverInformation, // s (kernel-mode only)
|
|
SystemUnloadGdiDriverInformation, // s (kernel-mode only)
|
|
SystemTimeAdjustmentInformation, // q: SYSTEM_QUERY_TIME_ADJUST_INFORMATION; s: SYSTEM_SET_TIME_ADJUST_INFORMATION (requires SeSystemtimePrivilege)
|
|
SystemSummaryMemoryInformation, // not implemented // SYSTEM_MEMORY_USAGE_INFORMATION
|
|
SystemMirrorMemoryInformation, // s (requires license value "Kernel-MemoryMirroringSupported") (requires SeShutdownPrivilege) // 30
|
|
SystemPerformanceTraceInformation, // q; s: (type depends on EVENT_TRACE_INFORMATION_CLASS)
|
|
SystemObsolete0, // not implemented
|
|
SystemExceptionInformation, // q: SYSTEM_EXCEPTION_INFORMATION
|
|
SystemCrashDumpStateInformation, // s: SYSTEM_CRASH_DUMP_STATE_INFORMATION (requires SeDebugPrivilege)
|
|
SystemKernelDebuggerInformation, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION
|
|
SystemContextSwitchInformation, // q: SYSTEM_CONTEXT_SWITCH_INFORMATION
|
|
SystemRegistryQuotaInformation, // q: SYSTEM_REGISTRY_QUOTA_INFORMATION; s (requires SeIncreaseQuotaPrivilege)
|
|
SystemExtendServiceTableInformation, // s (requires SeLoadDriverPrivilege) // loads win32k only
|
|
SystemPrioritySeparation, // s (requires SeTcbPrivilege)
|
|
SystemVerifierAddDriverInformation, // s: UNICODE_STRING (requires SeDebugPrivilege) // 40
|
|
SystemVerifierRemoveDriverInformation, // s: UNICODE_STRING (requires SeDebugPrivilege)
|
|
SystemProcessorIdleInformation, // q: SYSTEM_PROCESSOR_IDLE_INFORMATION (EX in: USHORT ProcessorGroup)
|
|
SystemLegacyDriverInformation, // q: SYSTEM_LEGACY_DRIVER_INFORMATION
|
|
SystemCurrentTimeZoneInformation, // q; s: RTL_TIME_ZONE_INFORMATION
|
|
SystemLookasideInformation, // q: SYSTEM_LOOKASIDE_INFORMATION
|
|
SystemTimeSlipNotification, // s: HANDLE (NtCreateEvent) (requires SeSystemtimePrivilege)
|
|
SystemSessionCreate, // not implemented
|
|
SystemSessionDetach, // not implemented
|
|
SystemSessionInformation, // not implemented (SYSTEM_SESSION_INFORMATION)
|
|
SystemRangeStartInformation, // q: SYSTEM_RANGE_START_INFORMATION // 50
|
|
SystemVerifierInformation, // q: SYSTEM_VERIFIER_INFORMATION; s (requires SeDebugPrivilege)
|
|
SystemVerifierThunkExtend, // s (kernel-mode only)
|
|
SystemSessionProcessInformation, // q: SYSTEM_SESSION_PROCESS_INFORMATION
|
|
SystemLoadGdiDriverInSystemSpace, // s: SYSTEM_GDI_DRIVER_INFORMATION (kernel-mode only) (same as SystemLoadGdiDriverInformation)
|
|
SystemNumaProcessorMap, // q: SYSTEM_NUMA_INFORMATION
|
|
SystemPrefetcherInformation, // q; s: PREFETCHER_INFORMATION // PfSnQueryPrefetcherInformation
|
|
SystemExtendedProcessInformation, // q: SYSTEM_EXTENDED_PROCESS_INFORMATION
|
|
SystemRecommendedSharedDataAlignment, // q: ULONG // KeGetRecommendedSharedDataAlignment
|
|
SystemComPlusPackage, // q; s: ULONG
|
|
SystemNumaAvailableMemory, // q: SYSTEM_NUMA_INFORMATION // 60
|
|
SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION (EX in: USHORT ProcessorGroup)
|
|
SystemEmulationBasicInformation, // q: SYSTEM_BASIC_INFORMATION
|
|
SystemEmulationProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION
|
|
SystemExtendedHandleInformation, // q: SYSTEM_HANDLE_INFORMATION_EX
|
|
SystemLostDelayedWriteInformation, // q: ULONG
|
|
SystemBigPoolInformation, // q: SYSTEM_BIGPOOL_INFORMATION
|
|
SystemSessionPoolTagInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION
|
|
SystemSessionMappedViewInformation, // q: SYSTEM_SESSION_MAPPED_VIEW_INFORMATION
|
|
SystemHotpatchInformation, // q; s: SYSTEM_HOTPATCH_CODE_INFORMATION
|
|
SystemObjectSecurityMode, // q: ULONG // 70
|
|
SystemWatchdogTimerHandler, // s: SYSTEM_WATCHDOG_HANDLER_INFORMATION // (kernel-mode only)
|
|
SystemWatchdogTimerInformation, // q: SYSTEM_WATCHDOG_TIMER_INFORMATION // NtQuerySystemInformationEx // (kernel-mode only)
|
|
SystemLogicalProcessorInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx
|
|
SystemWow64SharedInformationObsolete, // not implemented
|
|
SystemRegisterFirmwareTableInformationHandler, // s: SYSTEM_FIRMWARE_TABLE_HANDLER // (kernel-mode only)
|
|
SystemFirmwareTableInformation, // SYSTEM_FIRMWARE_TABLE_INFORMATION
|
|
SystemModuleInformationEx, // q: RTL_PROCESS_MODULE_INFORMATION_EX // since VISTA
|
|
SystemVerifierTriageInformation, // not implemented
|
|
SystemSuperfetchInformation, // q; s: SUPERFETCH_INFORMATION // PfQuerySuperfetchInformation
|
|
SystemMemoryListInformation, // q: SYSTEM_MEMORY_LIST_INFORMATION; s: SYSTEM_MEMORY_LIST_COMMAND (requires SeProfileSingleProcessPrivilege) // 80
|
|
SystemFileCacheInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (same as SystemFileCacheInformation)
|
|
SystemThreadPriorityClientIdInformation, // s: SYSTEM_THREAD_CID_PRIORITY_INFORMATION (requires SeIncreaseBasePriorityPrivilege) // NtQuerySystemInformationEx
|
|
SystemProcessorIdleCycleTimeInformation, // q: SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION[] (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx
|
|
SystemVerifierCancellationInformation, // SYSTEM_VERIFIER_CANCELLATION_INFORMATION // name:wow64:whNT32QuerySystemVerifierCancellationInformation
|
|
SystemProcessorPowerInformationEx, // not implemented
|
|
SystemRefTraceInformation, // q; s: SYSTEM_REF_TRACE_INFORMATION // ObQueryRefTraceInformation
|
|
SystemSpecialPoolInformation, // q; s: SYSTEM_SPECIAL_POOL_INFORMATION (requires SeDebugPrivilege) // MmSpecialPoolTag, then MmSpecialPoolCatchOverruns != 0
|
|
SystemProcessIdInformation, // q: SYSTEM_PROCESS_ID_INFORMATION
|
|
SystemErrorPortInformation, // s (requires SeTcbPrivilege)
|
|
SystemBootEnvironmentInformation, // q: SYSTEM_BOOT_ENVIRONMENT_INFORMATION // 90
|
|
SystemHypervisorInformation, // q: SYSTEM_HYPERVISOR_QUERY_INFORMATION
|
|
SystemVerifierInformationEx, // q; s: SYSTEM_VERIFIER_INFORMATION_EX
|
|
SystemTimeZoneInformation, // q; s: RTL_TIME_ZONE_INFORMATION (requires SeTimeZonePrivilege)
|
|
SystemImageFileExecutionOptionsInformation, // s: SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION (requires SeTcbPrivilege)
|
|
SystemCoverageInformation, // q: COVERAGE_MODULES s: COVERAGE_MODULE_REQUEST // ExpCovQueryInformation (requires SeDebugPrivilege)
|
|
SystemPrefetchPatchInformation, // SYSTEM_PREFETCH_PATCH_INFORMATION
|
|
SystemVerifierFaultsInformation, // s: SYSTEM_VERIFIER_FAULTS_INFORMATION (requires SeDebugPrivilege)
|
|
SystemSystemPartitionInformation, // q: SYSTEM_SYSTEM_PARTITION_INFORMATION
|
|
SystemSystemDiskInformation, // q: SYSTEM_SYSTEM_DISK_INFORMATION
|
|
SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx // 100
|
|
SystemNumaProximityNodeInformation, // q; s: SYSTEM_NUMA_PROXIMITY_MAP
|
|
SystemDynamicTimeZoneInformation, // q; s: RTL_DYNAMIC_TIME_ZONE_INFORMATION (requires SeTimeZonePrivilege)
|
|
SystemCodeIntegrityInformation, // q: SYSTEM_CODEINTEGRITY_INFORMATION // SeCodeIntegrityQueryInformation
|
|
SystemProcessorMicrocodeUpdateInformation, // s: SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION
|
|
SystemProcessorBrandString, // q: CHAR[] // HaliQuerySystemInformation -> HalpGetProcessorBrandString, info class 23
|
|
SystemVirtualAddressInformation, // q: SYSTEM_VA_LIST_INFORMATION[]; s: SYSTEM_VA_LIST_INFORMATION[] (requires SeIncreaseQuotaPrivilege) // MmQuerySystemVaInformation
|
|
SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX (EX in: LOGICAL_PROCESSOR_RELATIONSHIP RelationshipType) // since WIN7 // NtQuerySystemInformationEx // KeQueryLogicalProcessorRelationship
|
|
SystemProcessorCycleTimeInformation, // q: SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[] (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx
|
|
SystemStoreInformation, // q; s: SYSTEM_STORE_INFORMATION (requires SeProfileSingleProcessPrivilege) // SmQueryStoreInformation
|
|
SystemRegistryAppendString, // s: SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // 110
|
|
SystemAitSamplingValue, // s: ULONG (requires SeProfileSingleProcessPrivilege)
|
|
SystemVhdBootInformation, // q: SYSTEM_VHD_BOOT_INFORMATION
|
|
SystemCpuQuotaInformation, // q; s: PS_CPU_QUOTA_QUERY_INFORMATION
|
|
SystemNativeBasicInformation, // q: SYSTEM_BASIC_INFORMATION
|
|
SystemErrorPortTimeouts, // SYSTEM_ERROR_PORT_TIMEOUTS
|
|
SystemLowPriorityIoInformation, // q: SYSTEM_LOW_PRIORITY_IO_INFORMATION
|
|
SystemTpmBootEntropyInformation, // q: BOOT_ENTROPY_NT_RESULT // ExQueryBootEntropyInformation
|
|
SystemVerifierCountersInformation, // q: SYSTEM_VERIFIER_COUNTERS_INFORMATION
|
|
SystemPagedPoolInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypePagedPool)
|
|
SystemSystemPtesInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemPtes) // 120
|
|
SystemNodeDistanceInformation, // q: USHORT[4*NumaNodes] // (EX in: USHORT NodeNumber) // NtQuerySystemInformationEx
|
|
SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26
|
|
SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation
|
|
SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1
|
|
SystemSessionBigPoolInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION // since WIN8
|
|
SystemBootGraphicsInformation, // q; s: SYSTEM_BOOT_GRAPHICS_INFORMATION (kernel-mode only)
|
|
SystemScrubPhysicalMemoryInformation, // q; s: MEMORY_SCRUB_INFORMATION
|
|
SystemBadPageInformation, // SYSTEM_BAD_PAGE_INFORMATION
|
|
SystemProcessorProfileControlArea, // q; s: SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA
|
|
SystemCombinePhysicalMemoryInformation, // s: MEMORY_COMBINE_INFORMATION, MEMORY_COMBINE_INFORMATION_EX, MEMORY_COMBINE_INFORMATION_EX2 // 130
|
|
SystemEntropyInterruptTimingInformation, // q; s: SYSTEM_ENTROPY_TIMING_INFORMATION
|
|
SystemConsoleInformation, // q; s: SYSTEM_CONSOLE_INFORMATION
|
|
SystemPlatformBinaryInformation, // q: SYSTEM_PLATFORM_BINARY_INFORMATION (requires SeTcbPrivilege)
|
|
SystemPolicyInformation, // q: SYSTEM_POLICY_INFORMATION (Warbird/Encrypt/Decrypt/Execute)
|
|
SystemHypervisorProcessorCountInformation, // q: SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION
|
|
SystemDeviceDataInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION
|
|
SystemDeviceDataEnumerationInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION
|
|
SystemMemoryTopologyInformation, // q: SYSTEM_MEMORY_TOPOLOGY_INFORMATION
|
|
SystemMemoryChannelInformation, // q: SYSTEM_MEMORY_CHANNEL_INFORMATION
|
|
SystemBootLogoInformation, // q: SYSTEM_BOOT_LOGO_INFORMATION // 140
|
|
SystemProcessorPerformanceInformationEx, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx // since WINBLUE
|
|
SystemCriticalProcessErrorLogInformation, // CRITICAL_PROCESS_EXCEPTION_DATA
|
|
SystemSecureBootPolicyInformation, // q: SYSTEM_SECUREBOOT_POLICY_INFORMATION
|
|
SystemPageFileInformationEx, // q: SYSTEM_PAGEFILE_INFORMATION_EX
|
|
SystemSecureBootInformation, // q: SYSTEM_SECUREBOOT_INFORMATION
|
|
SystemEntropyInterruptTimingRawInformation, // q; s: SYSTEM_ENTROPY_TIMING_INFORMATION
|
|
SystemPortableWorkspaceEfiLauncherInformation, // q: SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION
|
|
SystemFullProcessInformation, // q: SYSTEM_EXTENDED_PROCESS_INFORMATION with SYSTEM_PROCESS_INFORMATION_EXTENSION (requires admin)
|
|
SystemKernelDebuggerInformationEx, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX
|
|
SystemBootMetadataInformation, // 150 // (requires SeTcbPrivilege)
|
|
SystemSoftRebootInformation, // q: ULONG
|
|
SystemElamCertificateInformation, // s: SYSTEM_ELAM_CERTIFICATE_INFORMATION
|
|
SystemOfflineDumpConfigInformation, // q: OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2
|
|
SystemProcessorFeaturesInformation, // q: SYSTEM_PROCESSOR_FEATURES_INFORMATION
|
|
SystemRegistryReconciliationInformation, // s: NULL (requires admin) (flushes registry hives)
|
|
SystemEdidInformation, // q: SYSTEM_EDID_INFORMATION
|
|
SystemManufacturingInformation, // q: SYSTEM_MANUFACTURING_INFORMATION // since THRESHOLD
|
|
SystemEnergyEstimationConfigInformation, // q: SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION
|
|
SystemHypervisorDetailInformation, // q: SYSTEM_HYPERVISOR_DETAIL_INFORMATION
|
|
SystemProcessorCycleStatsInformation, // q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx // 160
|
|
SystemVmGenerationCountInformation,
|
|
SystemTrustedPlatformModuleInformation, // q: SYSTEM_TPM_INFORMATION
|
|
SystemKernelDebuggerFlags, // SYSTEM_KERNEL_DEBUGGER_FLAGS
|
|
SystemCodeIntegrityPolicyInformation, // q; s: SYSTEM_CODEINTEGRITYPOLICY_INFORMATION
|
|
SystemIsolatedUserModeInformation, // q: SYSTEM_ISOLATED_USER_MODE_INFORMATION
|
|
SystemHardwareSecurityTestInterfaceResultsInformation,
|
|
SystemSingleModuleInformation, // q: SYSTEM_SINGLE_MODULE_INFORMATION
|
|
SystemAllowedCpuSetsInformation, // s: SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION
|
|
SystemVsmProtectionInformation, // q: SYSTEM_VSM_PROTECTION_INFORMATION (previously SystemDmaProtectionInformation)
|
|
SystemInterruptCpuSetsInformation, // q: SYSTEM_INTERRUPT_CPU_SET_INFORMATION // 170
|
|
SystemSecureBootPolicyFullInformation, // q: SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION
|
|
SystemCodeIntegrityPolicyFullInformation,
|
|
SystemAffinitizedInterruptProcessorInformation, // q: KAFFINITY_EX // (requires SeIncreaseBasePriorityPrivilege)
|
|
SystemRootSiloInformation, // q: SYSTEM_ROOT_SILO_INFORMATION
|
|
SystemCpuSetInformation, // q: SYSTEM_CPU_SET_INFORMATION // since THRESHOLD2
|
|
SystemCpuSetTagInformation, // q: SYSTEM_CPU_SET_TAG_INFORMATION
|
|
SystemWin32WerStartCallout,
|
|
SystemSecureKernelProfileInformation, // q: SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION
|
|
SystemCodeIntegrityPlatformManifestInformation, // q: SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION // NtQuerySystemInformationEx // since REDSTONE
|
|
SystemInterruptSteeringInformation, // q: in: SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT, out: SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT // NtQuerySystemInformationEx // 180
|
|
SystemSupportedProcessorArchitectures, // p: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx
|
|
SystemMemoryUsageInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION
|
|
SystemCodeIntegrityCertificateInformation, // q: SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION
|
|
SystemPhysicalMemoryInformation, // q: SYSTEM_PHYSICAL_MEMORY_INFORMATION // since REDSTONE2
|
|
SystemControlFlowTransition, // (Warbird/Encrypt/Decrypt/Execute)
|
|
SystemKernelDebuggingAllowed, // s: ULONG
|
|
SystemActivityModerationExeState, // SYSTEM_ACTIVITY_MODERATION_EXE_STATE
|
|
SystemActivityModerationUserSettings, // SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS
|
|
SystemCodeIntegrityPoliciesFullInformation, // NtQuerySystemInformationEx
|
|
SystemCodeIntegrityUnlockInformation, // SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION // 190
|
|
SystemIntegrityQuotaInformation,
|
|
SystemFlushInformation, // q: SYSTEM_FLUSH_INFORMATION
|
|
SystemProcessorIdleMaskInformation, // q: ULONG_PTR[ActiveGroupCount] // since REDSTONE3
|
|
SystemSecureDumpEncryptionInformation, // NtQuerySystemInformationEx
|
|
SystemWriteConstraintInformation, // SYSTEM_WRITE_CONSTRAINT_INFORMATION
|
|
SystemKernelVaShadowInformation, // SYSTEM_KERNEL_VA_SHADOW_INFORMATION
|
|
SystemHypervisorSharedPageInformation, // SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION // since REDSTONE4
|
|
SystemFirmwareBootPerformanceInformation,
|
|
SystemCodeIntegrityVerificationInformation, // SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION
|
|
SystemFirmwarePartitionInformation, // SYSTEM_FIRMWARE_PARTITION_INFORMATION // 200
|
|
SystemSpeculationControlInformation, // SYSTEM_SPECULATION_CONTROL_INFORMATION // (CVE-2017-5715) REDSTONE3 and above.
|
|
SystemDmaGuardPolicyInformation, // SYSTEM_DMA_GUARD_POLICY_INFORMATION
|
|
SystemEnclaveLaunchControlInformation, // SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION
|
|
SystemWorkloadAllowedCpuSetsInformation, // SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION // since REDSTONE5
|
|
SystemCodeIntegrityUnlockModeInformation, // SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION
|
|
SystemLeapSecondInformation, // SYSTEM_LEAP_SECOND_INFORMATION
|
|
SystemFlags2Information, // q: SYSTEM_FLAGS_INFORMATION
|
|
SystemSecurityModelInformation, // SYSTEM_SECURITY_MODEL_INFORMATION // since 19H1
|
|
SystemCodeIntegritySyntheticCacheInformation, // NtQuerySystemInformationEx
|
|
SystemFeatureConfigurationInformation, // q: in: SYSTEM_FEATURE_CONFIGURATION_QUERY, out: SYSTEM_FEATURE_CONFIGURATION_INFORMATION; s: SYSTEM_FEATURE_CONFIGURATION_UPDATE // NtQuerySystemInformationEx // since 20H1 // 210
|
|
SystemFeatureConfigurationSectionInformation, // q: in: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST, out: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION // NtQuerySystemInformationEx
|
|
SystemFeatureUsageSubscriptionInformation, // q: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS; s: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE
|
|
SystemSecureSpeculationControlInformation, // SECURE_SPECULATION_CONTROL_INFORMATION
|
|
SystemSpacesBootInformation, // since 20H2
|
|
SystemFwRamdiskInformation, // SYSTEM_FIRMWARE_RAMDISK_INFORMATION
|
|
SystemWheaIpmiHardwareInformation,
|
|
SystemDifSetRuleClassInformation, // SYSTEM_DIF_VOLATILE_INFORMATION
|
|
SystemDifClearRuleClassInformation,
|
|
SystemDifApplyPluginVerificationOnDriver, // SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION
|
|
SystemDifRemovePluginVerificationOnDriver, // SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION // 220
|
|
SystemShadowStackInformation, // SYSTEM_SHADOW_STACK_INFORMATION
|
|
SystemBuildVersionInformation, // q: in: ULONG (LayerNumber), out: SYSTEM_BUILD_VERSION_INFORMATION // NtQuerySystemInformationEx // 222
|
|
SystemPoolLimitInformation, // SYSTEM_POOL_LIMIT_INFORMATION (requires SeIncreaseQuotaPrivilege) // NtQuerySystemInformationEx
|
|
SystemCodeIntegrityAddDynamicStore,
|
|
SystemCodeIntegrityClearDynamicStores,
|
|
SystemDifPoolTrackingInformation,
|
|
SystemPoolZeroingInformation, // q: SYSTEM_POOL_ZEROING_INFORMATION
|
|
SystemDpcWatchdogInformation, // q; s: SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION
|
|
SystemDpcWatchdogInformation2, // q; s: SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION_V2
|
|
SystemSupportedProcessorArchitectures2, // q: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx // 230
|
|
SystemSingleProcessorRelationshipInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // (EX in: PROCESSOR_NUMBER Processor) // NtQuerySystemInformationEx
|
|
SystemXfgCheckFailureInformation, // q: SYSTEM_XFG_FAILURE_INFORMATION
|
|
SystemIommuStateInformation, // SYSTEM_IOMMU_STATE_INFORMATION // since 22H1
|
|
SystemHypervisorMinrootInformation, // SYSTEM_HYPERVISOR_MINROOT_INFORMATION
|
|
SystemHypervisorBootPagesInformation, // SYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION
|
|
SystemPointerAuthInformation, // SYSTEM_POINTER_AUTH_INFORMATION
|
|
SystemSecureKernelDebuggerInformation, // NtQuerySystemInformationEx
|
|
SystemOriginalImageFeatureInformation, // q: in: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT, out: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT // NtQuerySystemInformationEx
|
|
SystemMemoryNumaInformation, // SYSTEM_MEMORY_NUMA_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT // NtQuerySystemInformationEx
|
|
SystemMemoryNumaPerformanceInformation, // SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUTSYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT // since 24H2 // 240
|
|
SystemCodeIntegritySignedPoliciesFullInformation,
|
|
SystemSecureCoreInformation, // SystemSecureSecretsInformation
|
|
SystemTrustedAppsRuntimeInformation, // SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION
|
|
SystemBadPageInformationEx, // SYSTEM_BAD_PAGE_INFORMATION
|
|
SystemResourceDeadlockTimeout, // ULONG
|
|
SystemBreakOnContextUnwindFailureInformation, // ULONG (requires SeDebugPrivilege)
|
|
SystemOslRamdiskInformation, // SYSTEM_OSL_RAMDISK_INFORMATION
|
|
SystemCodeIntegrityPolicyManagementInformation, // since 25H2
|
|
SystemMemoryNumaCacheInformation,
|
|
SystemProcessorFeaturesBitMapInformation,
|
|
MaxSystemInfoClass
|
|
} SYSTEM_INFORMATION_CLASS;
|
|
|
|
// ***** STRUCTS FOR ETW.c ***** //
|