admin/MSxDOS-ntapi
1
0
Fork 0
mirror of https://github.com/MSxDOS/ntapi synced 2026-06-08 11:37:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add new bindings

Browse Source
This commit is contained in:
MSxDOS
2019-03-01 22:44:48 +03:00
parent c61f6f0ede
commit 1303f4f49d
10 changed files with 257 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ntexapi.rs
+80 -16
View File
@@ -933,7 +933,11 @@ ENUM!{enum SYSTEM_INFORMATION_CLASS {
SystemSpeculationControlInformation = 201,
SystemDmaGuardPolicyInformation = 202,
SystemEnclaveLaunchControlInformation = 203,
MaxSystemInfoClass = 204,
SystemWorkloadAllowedCpuSetsInformation = 204,
SystemCodeIntegrityUnlockModeInformation = 205,
SystemLeapSecondInformation = 206,
SystemFlags2Information = 207,
MaxSystemInfoClass = 208,
}}
STRUCT!{struct SYSTEM_BASIC_INFORMATION {
Reserved: ULONG,
@@ -2399,7 +2403,10 @@ BITFIELD!{SYSTEM_KERNEL_VA_SHADOW_INFORMATION Flags: ULONG [
KvaShadowInvpcid set_KvaShadowInvpcid[3..4],
KvaShadowRequired set_KvaShadowRequired[4..5],
KvaShadowRequiredAvailable set_KvaShadowRequiredAvailable[5..6],
Reserved set_Reserved[6..32],
InvalidPteBit set_InvalidPteBit[6..12],
L1DataCacheFlushSupported set_L1DataCacheFlushSupported[12..13],
L1TerminalFaultMitigationPresent set_L1TerminalFaultMitigationPresent[13..14],
Reserved set_Reserved[14..32],
]}
pub type PSYSTEM_KERNEL_VA_SHADOW_INFORMATION = *mut SYSTEM_KERNEL_VA_SHADOW_INFORMATION;
STRUCT!{struct SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION {
@@ -2417,14 +2424,6 @@ pub type PSYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION =
STRUCT!{struct SYSTEM_SPECULATION_CONTROL_INFORMATION {
Flags: ULONG,
}}
pub type PSYSTEM_SPECULATION_CONTROL_INFORMATION = *mut SYSTEM_SPECULATION_CONTROL_INFORMATION;
STRUCT!{struct SYSTEM_DMA_GUARD_POLICY_INFORMATION {
DmaGuardPolicyEnabled: BOOLEAN,
}}
pub type PSYSTEM_DMA_GUARD_POLICY_INFORMATION = *mut SYSTEM_DMA_GUARD_POLICY_INFORMATION;
STRUCT!{struct SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION {
EnclaveLaunchSigner: [UCHAR; 32],
}}
BITFIELD!{SYSTEM_SPECULATION_CONTROL_INFORMATION Flags: ULONG [
BpbEnabled set_BpbEnabled[0..1],
BpbDisabledSystemPolicy set_BpbDisabledSystemPolicy[1..2],
@@ -2434,15 +2433,32 @@ BITFIELD!{SYSTEM_SPECULATION_CONTROL_INFORMATION Flags: ULONG [
IbrsPresent set_IbrsPresent[5..6],
StibpPresent set_StibpPresent[6..7],
SmepPresent set_SmepPresent[7..8],
MemoryDisambiguationDisableAvailable set_MemoryDisambiguationDisableAvailable[8..9],
MemoryDisambiguationDisableSupported set_MemoryDisambiguationDisableSupported[9..10],
MemoryDisambiguationDisabledSystemWide set_MemoryDisambiguationDisabledSystemWide[10..11],
MemoryDisambiguationDisabledKernel set_MemoryDisambiguationDisabledKernel[11..12],
MemoryDisambiguationDisableRequired set_MemoryDisambiguationDisableRequired[12..13],
Reserved set_Reserved[13..32],
SpeculativeStoreBypassDisableAvailable set_SpeculativeStoreBypassDisableAvailable[8..9],
SpeculativeStoreBypassDisableSupported set_SpeculativeStoreBypassDisableSupported[9..10],
SpeculativeStoreBypassDisabledSystemWide set_SpeculativeStoreBypassDisabledSystemWide[10..11],
SpeculativeStoreBypassDisabledKernel set_SpeculativeStoreBypassDisabledKernel[11..12],
SpeculativeStoreBypassDisableRequired set_SpeculativeStoreBypassDisableRequired[12..13],
BpbDisabledKernelToUser set_BpbDisabledKernelToUser[13..14],
SpecCtrlRetpolineEnabled set_SpecCtrlRetpolineEnabled[14..15],
SpecCtrlImportOptimizationEnabled set_SpecCtrlImportOptimizationEnabled[15..16],
Reserved set_Reserved[16..32],
]}
pub type PSYSTEM_SPECULATION_CONTROL_INFORMATION = *mut SYSTEM_SPECULATION_CONTROL_INFORMATION;
STRUCT!{struct SYSTEM_DMA_GUARD_POLICY_INFORMATION {
DmaGuardPolicyEnabled: BOOLEAN,
}}
pub type PSYSTEM_DMA_GUARD_POLICY_INFORMATION = *mut SYSTEM_DMA_GUARD_POLICY_INFORMATION;
STRUCT!{struct SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION {
EnclaveLaunchSigner: [UCHAR; 32],
}}
pub type PSYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION =
*mut SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION;
STRUCT!{struct SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION {
WorkloadClass: ULONGLONG,
CpuSets: [ULONGLONG; 1],
}}
pub type PSYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION =
*mut SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION;
EXTERN!{extern "system" {
fn NtQuerySystemInformation(
SystemInformationClass: SYSTEM_INFORMATION_CLASS,
@@ -2857,6 +2873,9 @@ EXTERN!{extern "system" {
Length: ULONG,
Atom: PRTL_ATOM,
) -> NTSTATUS;
}}
pub const ATOM_FLAG_GLOBAL: ULONG = 0x2;
EXTERN!{extern "system" {
fn NtAddAtomEx(
AtomName: PWSTR,
Length: ULONG,
@@ -2897,6 +2916,51 @@ EXTERN!{extern "system" {
ReturnLength: PULONG,
) -> NTSTATUS;
}}
pub const FLG_STOP_ON_EXCEPTION: u32 = 0x00000001;
pub const FLG_SHOW_LDR_SNAPS: u32 = 0x00000002;
pub const FLG_DEBUG_INITIAL_COMMAND: u32 = 0x00000004;
pub const FLG_STOP_ON_HUNG_GUI: u32 = 0x00000008;
pub const FLG_HEAP_ENABLE_TAIL_CHECK: u32 = 0x00000010;
pub const FLG_HEAP_ENABLE_FREE_CHECK: u32 = 0x00000020;
pub const FLG_HEAP_VALIDATE_PARAMETERS: u32 = 0x00000040;
pub const FLG_HEAP_VALIDATE_ALL: u32 = 0x00000080;
pub const FLG_APPLICATION_VERIFIER: u32 = 0x00000100;
pub const FLG_POOL_ENABLE_TAGGING: u32 = 0x00000400;
pub const FLG_HEAP_ENABLE_TAGGING: u32 = 0x00000800;
pub const FLG_USER_STACK_TRACE_DB: u32 = 0x00001000;
pub const FLG_KERNEL_STACK_TRACE_DB: u32 = 0x00002000;
pub const FLG_MAINTAIN_OBJECT_TYPELIST: u32 = 0x00004000;
pub const FLG_HEAP_ENABLE_TAG_BY_DLL: u32 = 0x00008000;
pub const FLG_DISABLE_STACK_EXTENSION: u32 = 0x00010000;
pub const FLG_ENABLE_CSRDEBUG: u32 = 0x00020000;
pub const FLG_ENABLE_KDEBUG_SYMBOL_LOAD: u32 = 0x00040000;
pub const FLG_DISABLE_PAGE_KERNEL_STACKS: u32 = 0x00080000;
pub const FLG_ENABLE_SYSTEM_CRIT_BREAKS: u32 = 0x00100000;
pub const FLG_HEAP_DISABLE_COALESCING: u32 = 0x00200000;
pub const FLG_ENABLE_CLOSE_EXCEPTIONS: u32 = 0x00400000;
pub const FLG_ENABLE_EXCEPTION_LOGGING: u32 = 0x00800000;
pub const FLG_ENABLE_HANDLE_TYPE_TAGGING: u32 = 0x01000000;
pub const FLG_HEAP_PAGE_ALLOCS: u32 = 0x02000000;
pub const FLG_DEBUG_INITIAL_COMMAND_EX: u32 = 0x04000000;
pub const FLG_DISABLE_DBGPRINT: u32 = 0x08000000;
pub const FLG_CRITSEC_EVENT_CREATION: u32 = 0x10000000;
pub const FLG_LDR_TOP_DOWN: u32 = 0x20000000;
pub const FLG_ENABLE_HANDLE_EXCEPTIONS: u32 = 0x40000000;
pub const FLG_DISABLE_PROTDLLS: u32 = 0x80000000;
pub const FLG_VALID_BITS: u32 = 0xfffffdff;
pub const FLG_USERMODE_VALID_BITS: u32 = FLG_STOP_ON_EXCEPTION | FLG_SHOW_LDR_SNAPS
| FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS
| FLG_HEAP_VALIDATE_ALL | FLG_APPLICATION_VERIFIER | FLG_HEAP_ENABLE_TAGGING
| FLG_USER_STACK_TRACE_DB | FLG_HEAP_ENABLE_TAG_BY_DLL | FLG_DISABLE_STACK_EXTENSION
| FLG_ENABLE_SYSTEM_CRIT_BREAKS | FLG_HEAP_DISABLE_COALESCING | FLG_DISABLE_PROTDLLS
| FLG_HEAP_PAGE_ALLOCS | FLG_CRITSEC_EVENT_CREATION | FLG_LDR_TOP_DOWN;
pub const FLG_BOOTONLY_VALID_BITS: u32 = FLG_KERNEL_STACK_TRACE_DB | FLG_MAINTAIN_OBJECT_TYPELIST
| FLG_ENABLE_CSRDEBUG | FLG_DEBUG_INITIAL_COMMAND | FLG_DEBUG_INITIAL_COMMAND_EX
| FLG_DISABLE_PAGE_KERNEL_STACKS;
pub const FLG_KERNELMODE_VALID_BITS: u32 = FLG_STOP_ON_EXCEPTION | FLG_SHOW_LDR_SNAPS
| FLG_STOP_ON_HUNG_GUI | FLG_POOL_ENABLE_TAGGING | FLG_ENABLE_KDEBUG_SYMBOL_LOAD
| FLG_ENABLE_CLOSE_EXCEPTIONS | FLG_ENABLE_EXCEPTION_LOGGING | FLG_ENABLE_HANDLE_TYPE_TAGGING
| FLG_DISABLE_DBGPRINT | FLG_ENABLE_HANDLE_EXCEPTIONS;
EXTERN!{extern "system" {
fn NtQueryLicenseValue(
ValueName: PUNICODE_STRING,
src/ntioapi.rs
+30 -4
View File
@@ -202,7 +202,11 @@ ENUM!{enum FILE_INFORMATION_CLASS {
FileMemoryPartitionInformation = 69,
FileStatLxInformation = 70,
FileCaseSensitiveInformation = 71,
FileMaximumInformation = 72,
FileLinkInformationEx = 72,
FileLinkInformationExBypassAccessCheck = 73,
FileStorageReserveIdInformation = 74,
FileCaseSensitiveInformationForceAccessCheck = 75,
FileMaximumInformation = 76,
}}
pub type PFILE_INFORMATION_CLASS = *mut FILE_INFORMATION_CLASS;
STRUCT!{struct FILE_BASIC_INFORMATION {
@@ -784,7 +788,8 @@ ENUM!{enum FS_INFORMATION_CLASS {
FileFsSectorSizeInformation = 11,
FileFsDataCopyInformation = 12,
FileFsMetadataSizeInformation = 13,
FileFsMaximumInformation = 14,
FileFsFullSizeInformationEx = 14,
FileFsMaximumInformation = 15,
}}
pub type PFS_INFORMATION_CLASS = *mut FS_INFORMATION_CLASS;
STRUCT!{struct FILE_FS_LABEL_INFORMATION {
@@ -874,6 +879,22 @@ STRUCT!{struct FILE_FS_METADATA_SIZE_INFORMATION {
BytesPerSector: ULONG,
}}
pub type PFILE_FS_METADATA_SIZE_INFORMATION = *mut FILE_FS_METADATA_SIZE_INFORMATION;
STRUCT!{struct FILE_FS_FULL_SIZE_INFORMATION_EX {
ActualTotalAllocationUnits: ULONGLONG,
ActualAvailableAllocationUnits: ULONGLONG,
ActualPoolUnavailableAllocationUnits: ULONGLONG,
CallerTotalAllocationUnits: ULONGLONG,
CallerAvailableAllocationUnits: ULONGLONG,
CallerPoolUnavailableAllocationUnits: ULONGLONG,
UsedAllocationUnits: ULONGLONG,
TotalReservedAllocationUnits: ULONGLONG,
VolumeStorageReserveAllocationUnits: ULONGLONG,
AvailableCommittedAllocationUnits: ULONGLONG,
PoolAvailableAllocationUnits: ULONGLONG,
SectorsPerAllocationUnit: ULONG,
BytesPerSector: ULONG,
}}
pub type PFILE_FS_FULL_SIZE_INFORMATION_EX = *mut FILE_FS_FULL_SIZE_INFORMATION_EX;
EXTERN!{extern "system" {
fn NtCreateFile(
FileHandle: PHANDLE,
@@ -929,8 +950,6 @@ EXTERN!{extern "system" {
FileHandle: HANDLE,
IoStatusBlock: PIO_STATUS_BLOCK,
) -> NTSTATUS;
}}
EXTERN!{extern "system" {
fn NtFlushBuffersFileEx(
FileHandle: HANDLE,
Flags: ULONG,
@@ -945,6 +964,13 @@ EXTERN!{extern "system" {
Length: ULONG,
FileInformationClass: FILE_INFORMATION_CLASS,
) -> NTSTATUS;
fn NtQueryInformationByName(
ObjectAttributes: POBJECT_ATTRIBUTES,
IoStatusBlock: PIO_STATUS_BLOCK,
FileInformation: PVOID,
Length: ULONG,
FileInformationClass: FILE_INFORMATION_CLASS,
) -> NTSTATUS;
fn NtSetInformationFile(
FileHandle: HANDLE,
IoStatusBlock: PIO_STATUS_BLOCK,
src/ntmmapi.rs
+14
View File
@@ -1,3 +1,4 @@
use crate::winapi_local::um::winnt::PMEM_EXTENDED_PARAMETER;
use winapi::shared::basetsd::{PSIZE_T, PULONG_PTR, SIZE_T, ULONG_PTR};
use winapi::shared::ntdef::{
BOOLEAN, HANDLE, LARGE_INTEGER, NTSTATUS, PHANDLE, PLARGE_INTEGER, POBJECT_ATTRIBUTES, PULONG,
@@ -390,6 +391,8 @@ STRUCT!{struct CFG_CALL_TARGET_LIST_INFORMATION {
Reserved: ULONG,
NumberOfEntriesProcessed: PULONG,
CallTargetInfo: PCFG_CALL_TARGET_INFO,
Section: PVOID,
FileOffset: ULONGLONG,
}}
pub type PCFG_CALL_TARGET_LIST_INFORMATION = *mut CFG_CALL_TARGET_LIST_INFORMATION;
EXTERN!{extern "system" {
@@ -422,6 +425,17 @@ EXTERN!{extern "system" {
AllocationAttributes: ULONG,
FileHandle: HANDLE,
) -> NTSTATUS;
fn NtCreateSectionEx(
SectionHandle: PHANDLE,
DesiredAccess: ACCESS_MASK,
ObjectAttributes: POBJECT_ATTRIBUTES,
MaximumSize: PLARGE_INTEGER,
SectionPageProtection: ULONG,
AllocationAttributes: ULONG,
FileHandle: HANDLE,
ExtendedParameters: PMEM_EXTENDED_PARAMETER,
ExtendedParameterCount: ULONG,
) -> NTSTATUS;
fn NtOpenSection(
SectionHandle: PHANDLE,
DesiredAccess: ACCESS_MASK,
src/ntpebteb.rs
+11 -1
View File
@@ -61,6 +61,8 @@ UNION!{union PEB_u {
KernelCallbackTable: PVOID,
UserSharedInfoPtr: PVOID,
}}
#[repr(C)]
pub struct LEAP_SECOND_DATA([u8; 0]); //fixme
STRUCT!{struct PEB {
InheritedAddressSpace: BOOLEAN,
ReadImageFileExecOptions: BOOLEAN,
@@ -146,6 +148,9 @@ STRUCT!{struct PEB {
CloudFileDiagFlags: ULONG,
PlaceholderCompatibilityMode: CHAR,
PlaceholderCompatibilityModeReserved: [CHAR; 7],
LeapSecondData: *mut LEAP_SECOND_DATA,
LeapSecondFlags: ULONG,
NtGlobalFlag2: ULONG,
}}
BITFIELD!{PEB BitField: BOOLEAN [
ImageUsesLargePages set_ImageUsesLargePages[0..1],
@@ -165,7 +170,8 @@ BITFIELD!{PEB CrossProcessFlags: ULONG [
ProcessUsingFTH set_ProcessUsingFTH[4..5],
ProcessPreviouslyThrottled set_ProcessPreviouslyThrottled[5..6],
ProcessCurrentlyThrottled set_ProcessCurrentlyThrottled[6..7],
ReservedBits0 set_ReservedBits0[7..32],
ProcessImagesHotPatched set_ProcessImagesHotPatched[7..8],
ReservedBits0 set_ReservedBits0[8..32],
]}
BITFIELD!{PEB TracingFlags: ULONG [
HeapTracingEnabled set_HeapTracingEnabled[0..1],
@@ -173,6 +179,10 @@ BITFIELD!{PEB TracingFlags: ULONG [
LibLoaderTracingEnabled set_LibLoaderTracingEnabled[2..3],
SpareTracingBits set_SpareTracingBits[3..32],
]}
BITFIELD!{PEB LeapSecondFlags: ULONG [
SixtySecondEnabled set_SixtySecondEnabled[0..1],
Reserved set_Reserved[1..32],
]}
pub type PPEB = *mut PEB;
pub const GDI_BATCH_BUFFER_SIZE: usize = 310;
STRUCT!{struct GDI_TEB_BATCH {
src/ntpsapi.rs
+43 -2
View File
@@ -152,7 +152,12 @@ ENUM!{enum PROCESSINFOCLASS {
ProcessDebugAuthInformation = 90,
ProcessSystemResourceManagement = 91,
ProcessSequenceNumber = 92,
MaxProcessInfoClass = 93,
ProcessLoaderDetour = 93,
ProcessSecurityDomainInformation = 94,
ProcessCombineSecurityDomainsInformation = 95,
ProcessEnableLogging = 96,
ProcessLeapSecondInformation = 97,
MaxProcessInfoClass = 98,
}}
ENUM!{enum THREADINFOCLASS {
ThreadBasicInformation = 0,
@@ -205,7 +210,8 @@ ENUM!{enum THREADINFOCLASS {
ThreadAttachContainer = 47,
ThreadManageWritesToExecutableMemory = 48,
ThreadPowerThrottlingState = 49,
MaxThreadInfoClass = 50,
ThreadWorkloadClass = 50,
MaxThreadInfoClass = 51,
}}
STRUCT!{struct PAGE_PRIORITY_INFORMATION {
PagePriority: ULONG,
@@ -510,6 +516,7 @@ UNION!{union PROCESS_MITIGATION_POLICY_INFORMATION_u {
SystemCallFilterPolicy: PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY,
PayloadRestrictionPolicy: PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY,
ChildProcessPolicy: PROCESS_MITIGATION_CHILD_PROCESS_POLICY,
// SideChannelIsolationPolicy: PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY, //TODO
}}
STRUCT!{struct PROCESS_MITIGATION_POLICY_INFORMATION {
Policy: PROCESS_MITIGATION_POLICY,
@@ -705,6 +712,32 @@ BITFIELD!{PROCESS_SYSTEM_RESOURCE_MANAGEMENT Flags: ULONG [
Foreground set_Foreground[0..1],
Reserved set_Reserved[1..32],
]}
STRUCT!{struct PROCESS_SECURITY_DOMAIN_INFORMATION {
SecurityDomain: ULONGLONG,
}}
pub type PPROCESS_SECURITY_DOMAIN_INFORMATION = *mut PROCESS_SECURITY_DOMAIN_INFORMATION;
STRUCT!{struct PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION {
ProcessHandle: HANDLE,
}}
pub type PPROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION =
*mut PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION;
STRUCT!{struct PROCESS_LOGGING_INFORMATION {
Flags: ULONG,
BitFields: ULONG,
}}
BITFIELD!{PROCESS_LOGGING_INFORMATION BitFields: ULONG [
EnableReadVmLogging set_EnableReadVmLogging[0..1],
EnableWriteVmLogging set_EnableWriteVmLogging[1..2],
EnableProcessSuspendResumeLogging set_EnableProcessSuspendResumeLogging[2..3],
EnableThreadSuspendResumeLogging set_EnableThreadSuspendResumeLogging[3..4],
Reserved set_Reserved[4..32],
]}
pub type PPROCESS_LOGGING_INFORMATION = *mut PROCESS_LOGGING_INFORMATION;
STRUCT!{struct PROCESS_LEAP_SECOND_INFORMATION {
Flags: ULONG,
Reserved: ULONG,
}}
pub type PPROCESS_LEAP_SECOND_INFORMATION = *mut PROCESS_LEAP_SECOND_INFORMATION;
STRUCT!{struct THREAD_BASIC_INFORMATION {
ExitStatus: NTSTATUS,
TebBaseAddress: PTEB,
@@ -839,6 +872,11 @@ ENUM!{enum SUBSYSTEM_INFORMATION_TYPE {
SubsystemInformationTypeWSL = 1,
MaxSubsystemInformationType = 2,
}}
ENUM!{enum THREAD_WORKLOAD_CLASS {
ThreadWorkloadClassDefault = 0,
ThreadWorkloadClassGraphics = 1,
MaxThreadWorkloadClass = 2,
}}
EXTERN!{extern "system" {
fn NtCreateProcess(
ProcessHandle: PHANDLE,
@@ -1191,6 +1229,9 @@ ENUM!{enum PS_MITIGATION_OPTION {
PS_MITIGATION_OPTION_IMPORT_ADDRESS_FILTER = 26,
PS_MITIGATION_OPTION_MODULE_TAMPERING_PROTECTION = 27,
PS_MITIGATION_OPTION_RESTRICT_INDIRECT_BRANCH_PREDICTION = 28,
PS_MITIGATION_OPTION_SPECULATIVE_STORE_BYPASS_DISABLE = 29,
PS_MITIGATION_OPTION_ALLOW_DOWNGRADE_DYNAMIC_CODE_POLICY = 30,
PS_MITIGATION_OPTION_CET_SHADOW_STACKS = 31,
}}
ENUM!{enum PS_CREATE_STATE {
PsCreateInitialState = 0,
src/ntrtl.rs
+13 -1
View File
@@ -1472,6 +1472,13 @@ EXTERN!{extern "system" {
TokenHandle: HANDLE,
ProcessInformation: PRTL_USER_PROCESS_INFORMATION,
) -> NTSTATUS;
fn RtlCreateUserProcessEx(
NtImagePathName: PUNICODE_STRING,
ProcessParameters: PRTL_USER_PROCESS_PARAMETERS,
InheritHandles: BOOLEAN,
Flags: ULONG,
ProcessInformation: PRTL_USER_PROCESS_INFORMATION,
) -> NTSTATUS;
fn RtlExitUserProcess(
ExitStatus: NTSTATUS,
);
@@ -1910,6 +1917,9 @@ EXTERN!{extern "system" {
fn RtlDetermineDosPathNameType_U(
DosFileName: PWSTR,
) -> RTL_PATH_TYPE;
fn RtlDetermineDosPathNameType_Ustr(
DosFileName: PCUNICODE_STRING,
) -> RTL_PATH_TYPE;
fn RtlIsDosDeviceName_U(
DosFileName: PWSTR,
) -> ULONG;
@@ -3911,7 +3921,9 @@ EXTERN!{extern "system" {
);
fn RtlGetFrame() -> PTEB_ACTIVE_FRAME;
}}
pub const RTL_STACK_WALKING_MODE_FRAMES_TO_SKIP_SHIFT: ULONG = 8;
pub const RTL_WALK_USER_MODE_STACK: ULONG = 0x00000001;
pub const RTL_WALK_VALID_FLAGS: ULONG = 0x00000001;
pub const RTL_STACK_WALKING_MODE_FRAMES_TO_SKIP_SHIFT: ULONG = 0x00000008;
EXTERN!{extern "system" {
fn RtlWalkFrameChain(
Callers: *mut PVOID,
src/ntseapi.rs
+3 -1
View File
@@ -45,7 +45,8 @@ pub const SE_RELABEL_PRIVILEGE: LONG = 32;
pub const SE_INC_WORKING_SET_PRIVILEGE: LONG = 33;
pub const SE_TIME_ZONE_PRIVILEGE: LONG = 34;
pub const SE_CREATE_SYMBOLIC_LINK_PRIVILEGE: LONG = 35;
pub const SE_MAX_WELL_KNOWN_PRIVILEGE: LONG = SE_CREATE_SYMBOLIC_LINK_PRIVILEGE;
pub const SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE: LONG = 36;
pub const SE_MAX_WELL_KNOWN_PRIVILEGE: LONG = SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE;
pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_INVALID: USHORT = 0x00;
pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_INT64: USHORT = 0x01;
pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_UINT64: USHORT = 0x02;
@@ -60,6 +61,7 @@ pub const TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY: USHORT = 0x0004;
pub const TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT: USHORT = 0x0008;
pub const TOKEN_SECURITY_ATTRIBUTE_DISABLED: USHORT = 0x0010;
pub const TOKEN_SECURITY_ATTRIBUTE_MANDATORY: USHORT = 0x0020;
pub const TOKEN_SECURITY_ATTRIBUTE_COMPARE_IGNORE: USHORT = 0x0040;
pub const TOKEN_SECURITY_ATTRIBUTE_VALID_FLAGS: USHORT = TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE
| TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE | TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY
| TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT | TOKEN_SECURITY_ATTRIBUTE_DISABLED
src/winapi_local/um/winnt.rs
+28 -2
View File
@@ -1,3 +1,7 @@
use winapi::shared::basetsd::{DWORD64, SIZE_T, ULONG64};
use winapi::shared::minwindef::DWORD;
use winapi::um::winnt::{HANDLE, PVOID};
#[doc(hidden)]
#[inline]
pub const fn UInt32x32To64(a: u32, b: u32) -> u64 {
a as u64 * b as u64
@@ -5,8 +9,6 @@ pub const fn UInt32x32To64(a: u32, b: u32) -> u64 {
#[cfg(feature = "nightly")]
IFDEF!{
use crate::ntpebteb::TEB;
use winapi::shared::basetsd::DWORD64;
use winapi::shared::minwindef::DWORD;
#[inline]
pub unsafe fn _bittest64(Base: *const i64, Offset: i64) -> u8 {
let out: u8;
@@ -52,3 +54,27 @@ pub unsafe fn NtCurrentTeb() -> *mut TEB {
}
}
}
ENUM!{enum MEM_EXTENDED_PARAMETER_TYPE {
MemExtendedParameterInvalidType = 0,
MemExtendedParameterAddressRequirements = 1,
MemExtendedParameterNumaNode = 2,
MemExtendedParameterPartitionHandle = 3,
MemExtendedParameterMax = 4,
}}
pub type PMEM_EXTENDED_PARAMETER_TYPE = *mut MEM_EXTENDED_PARAMETER_TYPE;
UNION!{union MEM_EXTENDED_PARAMETER_u {
ULong64: DWORD64,
Pointer: PVOID,
Size: SIZE_T,
Handle: HANDLE,
ULong: DWORD,
}}
STRUCT!{struct MEM_EXTENDED_PARAMETER {
BitFields: ULONG64,
u: MEM_EXTENDED_PARAMETER_u,
}}
BITFIELD!{MEM_EXTENDED_PARAMETER BitFields: ULONG64 [
Type set_Type[0..8],
Reserved set_Reserved[8..64],
]}
pub type PMEM_EXTENDED_PARAMETER = *mut MEM_EXTENDED_PARAMETER;
tests/layout_x86.rs
+18 -3
View File
@@ -383,6 +383,8 @@ fn ntexapi() {
assert_eq!(align_of::<SYSTEM_DMA_GUARD_POLICY_INFORMATION>(), 1);
assert_eq!(size_of::<SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION>(), 32);
assert_eq!(align_of::<SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION>(), 1);
assert_eq!(size_of::<SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION>(), 16);
assert_eq!(align_of::<SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION>(), 8);
assert_eq!(size_of::<SYSDBG_VIRTUAL>(), 12);
assert_eq!(align_of::<SYSDBG_VIRTUAL>(), 4);
assert_eq!(size_of::<SYSDBG_PHYSICAL>(), 16);
@@ -661,6 +663,8 @@ fn ntioapi() {
assert_eq!(align_of::<FILE_FS_DATA_COPY_INFORMATION>(), 4);
assert_eq!(size_of::<FILE_FS_METADATA_SIZE_INFORMATION>(), 16);
assert_eq!(align_of::<FILE_FS_METADATA_SIZE_INFORMATION>(), 8);
assert_eq!(size_of::<FILE_FS_FULL_SIZE_INFORMATION_EX>(), 96);
assert_eq!(align_of::<FILE_FS_FULL_SIZE_INFORMATION_EX>(), 8);
assert_eq!(size_of::<IO_COMPLETION_BASIC_INFORMATION>(), 4);
assert_eq!(align_of::<IO_COMPLETION_BASIC_INFORMATION>(), 4);
assert_eq!(size_of::<REPARSE_DATA_BUFFER>(), 24);
@@ -837,8 +841,8 @@ fn ntmmapi() {
assert_eq!(align_of::<SECTION_INTERNAL_IMAGE_INFORMATION>(), 4);
assert_eq!(size_of::<MEMORY_RANGE_ENTRY>(), 8);
assert_eq!(align_of::<MEMORY_RANGE_ENTRY>(), 4);
assert_eq!(size_of::<CFG_CALL_TARGET_LIST_INFORMATION>(), 16);
assert_eq!(align_of::<CFG_CALL_TARGET_LIST_INFORMATION>(), 4);
assert_eq!(size_of::<CFG_CALL_TARGET_LIST_INFORMATION>(), 32);
assert_eq!(align_of::<CFG_CALL_TARGET_LIST_INFORMATION>(), 8);
assert_eq!(size_of::<MEMORY_PARTITION_CONFIGURATION_INFORMATION>(), 128);
assert_eq!(align_of::<MEMORY_PARTITION_CONFIGURATION_INFORMATION>(), 4);
assert_eq!(size_of::<MEMORY_PARTITION_TRANSFER_INFORMATION>(), 12);
@@ -891,7 +895,7 @@ fn ntpebteb() {
assert_eq!(align_of::<API_SET_NAMESPACE_ENTRY>(), 4);
assert_eq!(size_of::<API_SET_VALUE_ENTRY>(), 20);
assert_eq!(align_of::<API_SET_VALUE_ENTRY>(), 4);
assert_eq!(size_of::<PEB>(), 1136);
assert_eq!(size_of::<PEB>(), 1152);
assert_eq!(align_of::<PEB>(), 8);
assert_eq!(FIELD_OFFSET!(PEB, InheritedAddressSpace), 0);
assert_eq!(FIELD_OFFSET!(PEB, ReadImageFileExecOptions), 1);
@@ -974,6 +978,9 @@ fn ntpebteb() {
assert_eq!(FIELD_OFFSET!(PEB, CloudFileDiagFlags), 1124);
assert_eq!(FIELD_OFFSET!(PEB, PlaceholderCompatibilityMode), 1128);
assert_eq!(FIELD_OFFSET!(PEB, PlaceholderCompatibilityModeReserved), 1129);
assert_eq!(FIELD_OFFSET!(PEB, LeapSecondData), 1136);
assert_eq!(FIELD_OFFSET!(PEB, LeapSecondFlags), 1140);
assert_eq!(FIELD_OFFSET!(PEB, NtGlobalFlag2), 1144);
assert_eq!(size_of::<GDI_TEB_BATCH>(), 1248);
assert_eq!(align_of::<GDI_TEB_BATCH>(), 4);
assert_eq!(size_of::<TEB_ACTIVE_FRAME_CONTEXT>(), 8);
@@ -1256,6 +1263,14 @@ fn ntpsapi() {
assert_eq!(align_of::<PROCESS_UPTIME_INFORMATION>(), 8);
assert_eq!(size_of::<PROCESS_SYSTEM_RESOURCE_MANAGEMENT>(), 4);
assert_eq!(align_of::<PROCESS_SYSTEM_RESOURCE_MANAGEMENT>(), 4);
assert_eq!(size_of::<PROCESS_SECURITY_DOMAIN_INFORMATION>(), 8);
assert_eq!(align_of::<PROCESS_SECURITY_DOMAIN_INFORMATION>(), 8);
assert_eq!(size_of::<PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION>(), 4);
assert_eq!(align_of::<PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION>(), 4);
assert_eq!(size_of::<PROCESS_LOGGING_INFORMATION>(), 8);
assert_eq!(align_of::<PROCESS_LOGGING_INFORMATION>(), 4);
assert_eq!(size_of::<PROCESS_LEAP_SECOND_INFORMATION>(), 8);
assert_eq!(align_of::<PROCESS_LEAP_SECOND_INFORMATION>(), 4);
assert_eq!(size_of::<THREAD_BASIC_INFORMATION>(), 28);
assert_eq!(align_of::<THREAD_BASIC_INFORMATION>(), 4);
assert_eq!(size_of::<THREAD_LAST_SYSCALL_INFORMATION>(), 16);
tests/layout_x86_64.rs
+17 -2
View File
@@ -383,6 +383,8 @@ fn ntexapi() {
assert_eq!(align_of::<SYSTEM_DMA_GUARD_POLICY_INFORMATION>(), 1);
assert_eq!(size_of::<SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION>(), 32);
assert_eq!(align_of::<SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION>(), 1);
assert_eq!(size_of::<SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION>(), 16);
assert_eq!(align_of::<SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION>(), 8);
assert_eq!(size_of::<SYSDBG_VIRTUAL>(), 24);
assert_eq!(align_of::<SYSDBG_VIRTUAL>(), 8);
assert_eq!(size_of::<SYSDBG_PHYSICAL>(), 24);
@@ -661,6 +663,8 @@ fn ntioapi() {
assert_eq!(align_of::<FILE_FS_DATA_COPY_INFORMATION>(), 4);
assert_eq!(size_of::<FILE_FS_METADATA_SIZE_INFORMATION>(), 16);
assert_eq!(align_of::<FILE_FS_METADATA_SIZE_INFORMATION>(), 8);
assert_eq!(size_of::<FILE_FS_FULL_SIZE_INFORMATION_EX>(), 96);
assert_eq!(align_of::<FILE_FS_FULL_SIZE_INFORMATION_EX>(), 8);
assert_eq!(size_of::<IO_COMPLETION_BASIC_INFORMATION>(), 4);
assert_eq!(align_of::<IO_COMPLETION_BASIC_INFORMATION>(), 4);
assert_eq!(size_of::<REPARSE_DATA_BUFFER>(), 24);
@@ -837,7 +841,7 @@ fn ntmmapi() {
assert_eq!(align_of::<SECTION_INTERNAL_IMAGE_INFORMATION>(), 8);
assert_eq!(size_of::<MEMORY_RANGE_ENTRY>(), 16);
assert_eq!(align_of::<MEMORY_RANGE_ENTRY>(), 8);
assert_eq!(size_of::<CFG_CALL_TARGET_LIST_INFORMATION>(), 24);
assert_eq!(size_of::<CFG_CALL_TARGET_LIST_INFORMATION>(), 40);
assert_eq!(align_of::<CFG_CALL_TARGET_LIST_INFORMATION>(), 8);
assert_eq!(size_of::<MEMORY_PARTITION_CONFIGURATION_INFORMATION>(), 240);
assert_eq!(align_of::<MEMORY_PARTITION_CONFIGURATION_INFORMATION>(), 8);
@@ -891,7 +895,7 @@ fn ntpebteb() {
assert_eq!(align_of::<API_SET_NAMESPACE_ENTRY>(), 4);
assert_eq!(size_of::<API_SET_VALUE_ENTRY>(), 20);
assert_eq!(align_of::<API_SET_VALUE_ENTRY>(), 4);
assert_eq!(size_of::<PEB>(), 1976);
assert_eq!(size_of::<PEB>(), 1992);
assert_eq!(align_of::<PEB>(), 8);
assert_eq!(FIELD_OFFSET!(PEB, InheritedAddressSpace), 0);
assert_eq!(FIELD_OFFSET!(PEB, ReadImageFileExecOptions), 1);
@@ -974,6 +978,9 @@ fn ntpebteb() {
assert_eq!(FIELD_OFFSET!(PEB, CloudFileDiagFlags), 1964);
assert_eq!(FIELD_OFFSET!(PEB, PlaceholderCompatibilityMode), 1968);
assert_eq!(FIELD_OFFSET!(PEB, PlaceholderCompatibilityModeReserved), 1969);
assert_eq!(FIELD_OFFSET!(PEB, LeapSecondData), 1976);
assert_eq!(FIELD_OFFSET!(PEB, LeapSecondFlags), 1984);
assert_eq!(FIELD_OFFSET!(PEB, NtGlobalFlag2), 1988);
assert_eq!(size_of::<GDI_TEB_BATCH>(), 1256);
assert_eq!(align_of::<GDI_TEB_BATCH>(), 8);
assert_eq!(size_of::<TEB_ACTIVE_FRAME_CONTEXT>(), 16);
@@ -1256,6 +1263,14 @@ fn ntpsapi() {
assert_eq!(align_of::<PROCESS_UPTIME_INFORMATION>(), 8);
assert_eq!(size_of::<PROCESS_SYSTEM_RESOURCE_MANAGEMENT>(), 4);
assert_eq!(align_of::<PROCESS_SYSTEM_RESOURCE_MANAGEMENT>(), 4);
assert_eq!(size_of::<PROCESS_SECURITY_DOMAIN_INFORMATION>(), 8);
assert_eq!(align_of::<PROCESS_SECURITY_DOMAIN_INFORMATION>(), 8);
assert_eq!(size_of::<PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION>(), 8);
assert_eq!(align_of::<PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION>(), 8);
assert_eq!(size_of::<PROCESS_LOGGING_INFORMATION>(), 8);
assert_eq!(align_of::<PROCESS_LOGGING_INFORMATION>(), 4);
assert_eq!(size_of::<PROCESS_LEAP_SECOND_INFORMATION>(), 8);
assert_eq!(align_of::<PROCESS_LEAP_SECOND_INFORMATION>(), 4);
assert_eq!(size_of::<THREAD_BASIC_INFORMATION>(), 48);
assert_eq!(align_of::<THREAD_BASIC_INFORMATION>(), 8);
assert_eq!(size_of::<THREAD_LAST_SYSCALL_INFORMATION>(), 24);