admin/entropy-z-Kharon
1
0
Fork 0
mirror of https://github.com/entropy-z/Kharon synced 2026-06-06 15:34:34 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
dev
entropy-z-Kharon/agent_kharon/src_beacon/Include/Win32.h
T

2798 lines
104 KiB
C
Raw Permalink Blame History

#ifndef WIN32_H
#define WIN32_H
#include <windows.h>
/* ========== [ Structs ] ========== */
typedef LONG ERROR_CODE;
typedef UINT_PTR UPTR;
typedef struct _TASK_RESULT {
ERROR_CODE ErrorCode;
BOOL ShouldClean;
} TASK_RESULT;
typedef struct _MM_INFO {
PBYTE Ptr;
SIZE_T Size;
} MM_INFO;
#define KhGetError NtCurrentTeb()->LastErrorValue
#define KhSetError( x ) NtCurrentTeb()->LastErrorValue = x
#define KhRetError( x ) KhSetError( x ); return KhGetError
#define KhRetSuccess KhSetError( ERROR_SUCCESS ); return KhGetError
// Task result helpers
#define KhTaskSuccess( clean ) TASK_RESULT{ KhGetError, clean }
#define KhTaskError( error, clean ) KhSetError( error ); TASK_RESULT{ KhGetError, clean }
#define KhTaskRetSuccess( clean ) KhSetError( ERROR_SUCCESS ); return TASK_RESULT{ KhGetError, clean }
#define KhTaskRetError( error, clean ) KhSetError( error ); return TASK_RESULT{ KhGetError, clean }
typedef struct {
CHAR* FileID;
ULONG ErrorCode;
CHAR* Reason;
BYTE* Data;
ULONG DataLen;
ULONG CurChunk;
ULONG TotalChunks;
} FILE_DOWNLOAD_EVENT;
typedef struct {
ULONG ChannelID;
ULONG SubCmd;
ULONG Result;
} COMMAND_TUNNEL_START_TCP_EVENT;
typedef struct {
ULONG ChannelID;
ULONG SubCmd;
BYTE* Data;
ULONG DataLen;
} COMMAND_TUNNEL_WRITE_TCP_EVENT;
typedef struct {
ULONG TunnelID;
ULONG SubCmd;
ULONG ChannelID;
} COMMAND_TUNNEL_ACCEPT_EVENT;
// typedef struct _PROCESSOR_NUMBER {
// WORD Group;
// BYTE Number;
// BYTE Reserved;
// } PROCESSOR_NUMBER, *PPROCESSOR_NUMBER;
// typedef struct _CFG_CALL_TARGET_INFO {
// ULONG_PTR Offset;
// ULONG_PTR Flags;
// } CFG_CALL_TARGET_INFO, *PCFG_CALL_TARGET_INFO;
typedef struct {
ULONG_PTR Attribute;
SIZE_T Size;
union {
ULONG_PTR Value;
PVOID ValuePtr;
};
SIZE_T* ReturnLength;
} PS_ATTRIBUTE, *PPS_ATTRIBUTE;
typedef struct {
USHORT Length;
USHORT MaximumLength;
_Field_size_bytes_part_opt_(MaximumLength, Length) PCHAR Buffer;
} STRING, *PSTRING, ANSI_STRING, *PANSI_STRING, OEM_STRING, *POEM_STRING;
typedef const ANSI_STRING *PCANSI_STRING;
typedef struct {
USHORT Length;
USHORT MaximumLength;
_Field_size_bytes_part_opt_(MaximumLength, Length) PWCH Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef const UNICODE_STRING *PCUNICODE_STRING;
typedef struct {
ULONG Length;
HANDLE RootDirectory;
PCUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor; // PSECURITY_DESCRIPTOR;
PVOID SecurityQualityOfService; // PSECURITY_QUALITY_OF_SERVICE
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef const OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;
typedef struct {
SIZE_T TotalLength;
PS_ATTRIBUTE Attributes[1];
} PS_ATTRIBUTE_LIST, *PPS_ATTRIBUTE_LIST;
typedef NTSTATUS (NTAPI *PUSER_THREAD_START_ROUTINE)( PVOID ThreadParameter );
typedef struct _ACTIVATION_CONTEXT_DATA {
ULONG Magic;
ULONG HeaderSize;
ULONG FormatVersion;
ULONG TotalSize;
ULONG DefaultTocOffset; // to ACTIVATION_CONTEXT_DATA_TOC_HEADER
ULONG ExtendedTocOffset; // to ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_HEADER
ULONG AssemblyRosterOffset; // to ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_HEADER
ULONG Flags; // ACTIVATION_CONTEXT_FLAG_*
} ACTIVATION_CONTEXT_DATA, *PACTIVATION_CONTEXT_DATA;
typedef VOID (NTAPI *PACTIVATION_CONTEXT_NOTIFY_ROUTINE)(
_In_ ULONG NotificationType, // ACTIVATION_CONTEXT_NOTIFICATION_*
_In_ PVOID ActivationContext,
_In_ PACTIVATION_CONTEXT_DATA ActivationContextData,
_In_opt_ PVOID NotificationContext,
_In_opt_ PVOID NotificationData,
_Inout_ PBOOLEAN DisableThisNotification
);
#define WIN32_CLIENT_INFO_LENGTH 62
typedef struct _ASSEMBLY_STORAGE_MAP_ENTRY
{
ULONG Flags;
UNICODE_STRING DosPath;
HANDLE Handle;
} ASSEMBLY_STORAGE_MAP_ENTRY, *PASSEMBLY_STORAGE_MAP_ENTRY;
typedef struct _ASSEMBLY_STORAGE_MAP {
ULONG Flags;
ULONG AssemblyCount;
PASSEMBLY_STORAGE_MAP_ENTRY *AssemblyArray;
} ASSEMBLY_STORAGE_MAP, *PASSEMBLY_STORAGE_MAP;
#define GDI_BATCH_BUFFER_SIZE 310
typedef struct _GDI_TEB_BATCH {
ULONG Offset;
ULONG_PTR HDC;
ULONG Buffer[GDI_BATCH_BUFFER_SIZE];
} GDI_TEB_BATCH, *PGDI_TEB_BATCH;
typedef struct {
LONG RefCount;
ULONG Flags;
PACTIVATION_CONTEXT_DATA ActivationContextData;
PACTIVATION_CONTEXT_NOTIFY_ROUTINE NotificationRoutine;
PVOID NotificationContext;
ULONG SentNotifications[8];
ULONG DisabledNotifications[8];
ASSEMBLY_STORAGE_MAP StorageMap;
PASSEMBLY_STORAGE_MAP_ENTRY InlineStorageMapEntries[32];
} ACTIVATION_CONTEXT, *PACTIVATION_CONTEXT;
typedef struct {
struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME *Previous;
PACTIVATION_CONTEXT ActivationContext;
ULONG Flags; // RTL_ACTIVATION_CONTEXT_STACK_FRAME_FLAG_*
} RTL_ACTIVATION_CONTEXT_STACK_FRAME, *PRTL_ACTIVATION_CONTEXT_STACK_FRAME;
typedef struct {
PRTL_ACTIVATION_CONTEXT_STACK_FRAME ActiveFrame;
LIST_ENTRY FrameListCache;
ULONG Flags; // ACTIVATION_CONTEXT_STACK_FLAG_*
ULONG NextCookieSequenceNumber;
ULONG StackId;
} ACTIVATION_CONTEXT_STACK, *PACTIVATION_CONTEXT_STACK;
typedef struct {
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
typedef struct _TEB_ACTIVE_FRAME_CONTEXT {
ULONG Flags;
PCSTR FrameName;
} TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;
typedef struct _TEB_ACTIVE_FRAME {
ULONG Flags;
struct _TEB_ACTIVE_FRAME *Previous;
PTEB_ACTIVE_FRAME_CONTEXT Context;
} TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
#define STATIC_UNICODE_BUFFER_LENGTH 261
typedef struct _TELEMETRY_COVERAGE_HEADER
{
UCHAR MajorVersion;
UCHAR MinorVersion;
struct
{
USHORT TracingEnabled : 1;
USHORT Reserved1 : 15;
};
ULONG HashTableEntries;
ULONG HashIndexMask;
ULONG TableUpdateVersion;
ULONG TableSizeInBytes;
ULONG LastResetTick;
ULONG ResetRound;
ULONG Reserved2;
ULONG RecordedCount;
ULONG Reserved3[4];
ULONG HashTable[ANYSIZE_ARRAY];
} TELEMETRY_COVERAGE_HEADER, *PTELEMETRY_COVERAGE_HEADER;
typedef struct _PEB_LDR_DATA
{
ULONG Length;
BOOLEAN Initialized;
HANDLE SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID EntryInProgress;
BOOLEAN ShutdownInProgress;
HANDLE ShutdownThreadId;
} PEB_LDR_DATA, *PPEB_LDR_DATA;
typedef struct _CURDIR {
UNICODE_STRING DosPath;
HANDLE Handle;
} CURDIR, *PCURDIR;
typedef struct _RTL_DRIVE_LETTER_CURDIR {
USHORT Flags;
USHORT Length;
ULONG TimeStamp;
STRING DosPath;
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
#define RTL_MAX_DRIVE_LETTERS 32
typedef struct _RTL_BITMAP {
ULONG SizeOfBitMap;
ULONG* Buffer;
} RTL_BITMAP, *PRTL_BITMAP;
typedef struct _RTL_USER_PROCESS_PARAMETERS {
ULONG MaximumLength;
ULONG Length;
ULONG Flags;
ULONG DebugFlags;
HANDLE ConsoleHandle;
ULONG ConsoleFlags;
HANDLE StandardInput;
HANDLE StandardOutput;
HANDLE StandardError;
CURDIR CurrentDirectory;
UNICODE_STRING DllPath;
UNICODE_STRING ImagePathName;
UNICODE_STRING CommandLine;
PVOID Environment;
ULONG StartingX;
ULONG StartingY;
ULONG CountX;
ULONG CountY;
ULONG CountCharsX;
ULONG CountCharsY;
ULONG FillAttribute;
ULONG WindowFlags;
ULONG ShowWindowFlags;
UNICODE_STRING WindowTitle;
UNICODE_STRING DesktopInfo;
UNICODE_STRING ShellInfo;
UNICODE_STRING RuntimeData;
RTL_DRIVE_LETTER_CURDIR CurrentDirectories[RTL_MAX_DRIVE_LETTERS];
ULONG_PTR EnvironmentSize;
ULONG_PTR EnvironmentVersion;
PVOID PackageDependencyData;
ULONG ProcessGroupId;
ULONG LoaderThreads;
UNICODE_STRING RedirectionDllName; // REDSTONE4
UNICODE_STRING HeapPartitionName; // 19H1
PULONGLONG DefaultThreadpoolCpuSetMasks;
ULONG DefaultThreadpoolCpuSetMaskCount;
ULONG DefaultThreadpoolThreadMaximum;
ULONG HeapMemoryTypeMask; // WIN11
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
typedef struct _API_SET_NAMESPACE {
ULONG Version;
ULONG Size;
ULONG Flags;
ULONG Count;
ULONG EntryOffset;
ULONG HashOffset;
ULONG HashFactor;
} API_SET_NAMESPACE, *PAPI_SET_NAMESPACE;
typedef enum _NT_PRODUCT_TYPE {
NtProductWinNt = 1,
NtProductLanManNt,
NtProductServer
} NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
typedef VOID (NTAPI* PPS_POST_PROCESS_INIT_ROUTINE)( VOID );
typedef struct _KSYSTEM_TIME {
ULONG LowPart;
LONG High1Time;
LONG High2Time;
} KSYSTEM_TIME, *PKSYSTEM_TIME;
#define GDI_HANDLE_BUFFER_SIZE32 34
#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE32
typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE];
typedef struct _SILO_USER_SHARED_DATA {
ULONG ServiceSessionId;
ULONG ActiveConsoleId;
LONGLONG ConsoleSessionForeRootProcessId;
NT_PRODUCT_TYPE NtProductType;
ULONG SuiteMask;
ULONG SharedUserSessionId; // since RS2
BOOLEAN IsMultiSessionSku;
BOOLEAN IsStateSeparationEnabled;
WCHAR NtSystemRoot[260];
USHORT UserModeGlobalLogger[16];
ULONG TimeZoneId; // since 21H2
LONG TimeZoneBiasStamp;
KSYSTEM_TIME TimeZoneBias;
LARGE_INTEGER TimeZoneBiasEffectiveStart;
LARGE_INTEGER TimeZoneBiasEffectiveEnd;
} SILO_USER_SHARED_DATA, *PSILO_USER_SHARED_DATA;
typedef struct _WER_RECOVERY_INFO {
ULONG Length;
PVOID Callback;
PVOID Parameter;
HANDLE Started;
HANDLE Finished;
HANDLE InProgress;
LONG LastError;
BOOL Successful;
ULONG PingInterval;
ULONG Flags;
} WER_RECOVERY_INFO, *PWER_RECOVERY_INFO;
typedef struct _WER_FILE {
USHORT Flags;
WCHAR Path[MAX_PATH];
} WER_FILE, *PWER_FILE;
typedef struct _WER_MEMORY {
PVOID Address;
ULONG Size;
} WER_MEMORY, *PWER_MEMORY;
typedef struct _WER_GATHER {
PVOID Next;
USHORT Flags;
union {
WER_FILE File;
WER_MEMORY Memory;
} v;
} WER_GATHER, *PWER_GATHER;
typedef struct _WER_METADATA {
PVOID Next;
WCHAR Key[64];
WCHAR Value[128];
} WER_METADATA, *PWER_METADATA;
typedef struct _WER_DUMP_COLLECTION {
PVOID Next;
ULONG ProcessId;
ULONG ThreadId;
} WER_DUMP_COLLECTION, *PWER_DUMP_COLLECTION;
typedef struct _WER_RUNTIME_DLL {
PVOID Next;
ULONG Length;
PVOID Context;
WCHAR CallbackDllPath[MAX_PATH];
} WER_RUNTIME_DLL, *PWER_RUNTIME_DLL;
typedef struct _WER_HEAP_MAIN_HEADER {
WCHAR Signature[16];
LIST_ENTRY Links;
HANDLE Mutex;
PVOID FreeHeap;
ULONG FreeCount;
} WER_HEAP_MAIN_HEADER, *PWER_HEAP_MAIN_HEADER;
typedef struct _WER_PEB_HEADER_BLOCK {
LONG Length;
WCHAR Signature[16];
WCHAR AppDataRelativePath[64];
WCHAR RestartCommandLine[RESTART_MAX_CMD_LINE];
WER_RECOVERY_INFO RecoveryInfo;
PWER_GATHER Gather;
PWER_METADATA MetaData;
PWER_RUNTIME_DLL RuntimeDll;
PWER_DUMP_COLLECTION DumpCollection;
LONG GatherCount;
LONG MetaDataCount;
LONG DumpCount;
LONG Flags;
WER_HEAP_MAIN_HEADER MainHeader;
PVOID Reserved;
} WER_PEB_HEADER_BLOCK, *PWER_PEB_HEADER_BLOCK;
typedef struct _LEAP_SECOND_DATA *PLEAP_SECOND_DATA;
typedef enum _LDR_HOT_PATCH_STATE {
LdrHotPatchBaseImage,
LdrHotPatchNotApplied,
LdrHotPatchAppliedReverse,
LdrHotPatchAppliedForward,
LdrHotPatchFailedToPatch,
LdrHotPatchStateMax,
} LDR_HOT_PATCH_STATE, *PLDR_HOT_PATCH_STATE;
typedef _Function_class_(LDR_INIT_ROUTINE)
BOOLEAN NTAPI LDR_INIT_ROUTINE( PVOID DllHandle, ULONG Reason, PVOID Context );
typedef LDR_INIT_ROUTINE* PLDR_INIT_ROUTINE;
typedef struct _LDR_SERVICE_TAG_RECORD {
struct _LDR_SERVICE_TAG_RECORD *Next;
ULONG ServiceTag;
} LDR_SERVICE_TAG_RECORD, *PLDR_SERVICE_TAG_RECORD;
typedef struct _LDRP_CSLIST {
PSINGLE_LIST_ENTRY Tail;
} LDRP_CSLIST, *PLDRP_CSLIST;
typedef enum _LDR_DDAG_STATE {
LdrModulesMerged = -5,
LdrModulesInitError = -4,
LdrModulesSnapError = -3,
LdrModulesUnloaded = -2,
LdrModulesUnloading = -1,
LdrModulesPlaceHolder = 0,
LdrModulesMapping = 1,
LdrModulesMapped = 2,
LdrModulesWaitingForDependencies = 3,
LdrModulesSnapping = 4,
LdrModulesSnapped = 5,
LdrModulesCondensed = 6,
LdrModulesReadyToInit = 7,
LdrModulesInitializing = 8,
LdrModulesReadyToRun = 9
} LDR_DDAG_STATE;
typedef struct _LDR_DDAG_NODE {
LIST_ENTRY Modules;
PLDR_SERVICE_TAG_RECORD ServiceTagList;
ULONG LoadCount;
ULONG LoadWhileUnloadingCount;
ULONG LowestLink;
union
{
LDRP_CSLIST Dependencies;
SINGLE_LIST_ENTRY RemovalLink;
};
LDRP_CSLIST IncomingDependencies;
LDR_DDAG_STATE State;
SINGLE_LIST_ENTRY CondenseLink;
ULONG PreorderNumber;
} LDR_DDAG_NODE, *PLDR_DDAG_NODE;
typedef struct _LDRP_LOAD_CONTEXT *PLDRP_LOAD_CONTEXT;
typedef struct _RTL_BALANCED_NODE{
union
{
struct _RTL_BALANCED_NODE *Children[2];
struct
{
struct _RTL_BALANCED_NODE *Left;
struct _RTL_BALANCED_NODE *Right;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
union
{
UCHAR Red : 1;
UCHAR Balance : 2;
ULONG_PTR ParentValue;
} DUMMYUNIONNAME2;
} RTL_BALANCED_NODE, *PRTL_BALANCED_NODE;
typedef enum _LDR_DLL_LOAD_REASON
{
LoadReasonStaticDependency,
LoadReasonStaticForwarderDependency,
LoadReasonDynamicForwarderDependency,
LoadReasonDelayloadDependency,
LoadReasonDynamicLoad,
LoadReasonAsImageLoad,
LoadReasonAsDataLoad,
LoadReasonEnclavePrimary, // since REDSTONE3
LoadReasonEnclaveDependency,
LoadReasonPatchImage, // since WIN11
LoadReasonUnknown = -1
} LDR_DLL_LOAD_REASON, *PLDR_DLL_LOAD_REASON;
typedef struct _LDR_DATA_TABLE_ENTRY {
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID DllBase;
PLDR_INIT_ROUTINE EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
union
{
UCHAR FlagGroup[4];
ULONG Flags;
struct
{
ULONG PackagedBinary : 1;
ULONG MarkedForRemoval : 1;
ULONG ImageDll : 1;
ULONG LoadNotificationsSent : 1;
ULONG TelemetryEntryProcessed : 1;
ULONG ProcessStaticImport : 1;
ULONG InLegacyLists : 1;
ULONG InIndexes : 1;
ULONG ShimDll : 1;
ULONG InExceptionTable : 1;
ULONG ReservedFlags1 : 2;
ULONG LoadInProgress : 1;
ULONG LoadConfigProcessed : 1;
ULONG EntryProcessed : 1;
ULONG ProtectDelayLoad : 1;
ULONG ReservedFlags3 : 2;
ULONG DontCallForThreads : 1;
ULONG ProcessAttachCalled : 1;
ULONG ProcessAttachFailed : 1;
ULONG CorDeferredValidate : 1;
ULONG CorImage : 1;
ULONG DontRelocate : 1;
ULONG CorILOnly : 1;
ULONG ChpeImage : 1;
ULONG ChpeEmulatorImage : 1;
ULONG ReservedFlags5 : 1;
ULONG Redirected : 1;
ULONG ReservedFlags6 : 2;
ULONG CompatDatabaseProcessed : 1;
};
};
USHORT ObsoleteLoadCount;
USHORT TlsIndex;
LIST_ENTRY HashLinks;
ULONG TimeDateStamp;
PACTIVATION_CONTEXT EntryPointActivationContext;
PVOID Lock; // RtlAcquireSRWLockExclusive
PLDR_DDAG_NODE DdagNode;
LIST_ENTRY NodeModuleLink;
PLDRP_LOAD_CONTEXT LoadContext;
PVOID ParentDllBase;
PVOID SwitchBackContext;
RTL_BALANCED_NODE BaseAddressIndexNode;
RTL_BALANCED_NODE MappingInfoIndexNode;
PVOID OriginalBase;
LARGE_INTEGER LoadTime;
ULONG BaseNameHashValue;
LDR_DLL_LOAD_REASON LoadReason; // since WIN8
ULONG ImplicitPathOptions;
ULONG ReferenceCount; // since WIN10
ULONG DependentLoadFlags;
UCHAR SigningLevel; // since REDSTONE2
ULONG CheckSum; // since 22H1
PVOID ActivePatchImageBase;
LDR_HOT_PATCH_STATE HotPatchState;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
typedef struct _PEB {
//
// The process was cloned with an inherited address space.
//
BOOLEAN InheritedAddressSpace;
//
// The process has image file execution options (IFEO).
//
BOOLEAN ReadImageFileExecOptions;
//
// The process has a debugger attached.
//
BOOLEAN BeingDebugged;
union
{
BOOLEAN BitField;
struct
{
BOOLEAN ImageUsesLargePages : 1; // The process uses large image regions (4 MB).
BOOLEAN IsProtectedProcess : 1; // The process is a protected process.
BOOLEAN IsImageDynamicallyRelocated : 1; // The process image base address was relocated.
BOOLEAN SkipPatchingUser32Forwarders : 1; // The process skipped forwarders for User32.dll functions. 1 for 64-bit, 0 for 32-bit.
BOOLEAN IsPackagedProcess : 1; // The process is a packaged store process (APPX/MSIX).
BOOLEAN IsAppContainer : 1; // The process has an AppContainer token.
BOOLEAN IsProtectedProcessLight : 1; // The process is a protected process (light).
BOOLEAN IsLongPathAwareProcess : 1; // The process is long path aware.
};
};
//
// Handle to a mutex for synchronization.
//
HANDLE Mutant;
//
// Pointer to the base address of the process image.
//
PVOID ImageBaseAddress;
//
// Pointer to the process loader data.
//
PPEB_LDR_DATA Ldr;
//
// Pointer to the process parameters.
//
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
//
// Reserved.
//
PVOID SubSystemData;
//
// Pointer to the process default heap.
//
PVOID ProcessHeap;
//
// Pointer to a critical section used to synchronize access to the PEB.
//
RTL_CRITICAL_SECTION* FastPebLock;
//
// Pointer to a singly linked list used by ATL.
//
PSLIST_HEADER AtlThunkSListPtr;
//
// Pointer to the Image File Execution Options key.
//
PVOID IFEOKey;
//
// Cross process flags.
//
union
{
ULONG CrossProcessFlags;
struct
{
ULONG ProcessInJob : 1; // The process is part of a job.
ULONG ProcessInitializing : 1; // The process is initializing.
ULONG ProcessUsingVEH : 1; // The process is using VEH.
ULONG ProcessUsingVCH : 1; // The process is using VCH.
ULONG ProcessUsingFTH : 1; // The process is using FTH.
ULONG ProcessPreviouslyThrottled : 1; // The process was previously throttled.
ULONG ProcessCurrentlyThrottled : 1; // The process is currently throttled.
ULONG ProcessImagesHotPatched : 1; // The process images are hot patched. // RS5
ULONG ReservedBits0 : 24;
};
};
//
// User32 KERNEL_CALLBACK_TABLE (ntuser.h)
//
union
{
PVOID KernelCallbackTable;
PVOID UserSharedInfoPtr;
};
//
// Reserved.
//
ULONG SystemReserved;
//
// Pointer to the Active Template Library (ATL) singly linked list (32-bit)
//
ULONG AtlThunkSListPtr32;
//
// Pointer to the API Set Schema.
//
PAPI_SET_NAMESPACE ApiSetMap;
//
// Counter for TLS expansion.
//
ULONG TlsExpansionCounter;
//
// Pointer to the TLS bitmap.
//
PRTL_BITMAP TlsBitmap;
//
// Bits for the TLS bitmap.
//
ULONG TlsBitmapBits[2];
//
// Reserved for CSRSS.
//
PVOID ReadOnlySharedMemoryBase;
//
// Pointer to the USER_SHARED_DATA for the current SILO.
//
PSILO_USER_SHARED_DATA SharedData;
//
// Reserved for CSRSS.
//
PVOID* ReadOnlyStaticServerData;
//
// Pointer to the ANSI code page data. (PCPTABLEINFO)
//
PVOID AnsiCodePageData;
//
// Pointer to the OEM code page data. (PCPTABLEINFO)
//
PVOID OemCodePageData;
//
// Pointer to the Unicode case table data. (PNLSTABLEINFO)
//
PVOID UnicodeCaseTableData;
//
// The total number of system processors.
//
ULONG NumberOfProcessors;
//
// Global flags for the system.
//
union
{
ULONG NtGlobalFlag;
struct
{
ULONG StopOnException : 1; // FLG_STOP_ON_EXCEPTION
ULONG ShowLoaderSnaps : 1; // FLG_SHOW_LDR_SNAPS
ULONG DebugInitialCommand : 1; // FLG_DEBUG_INITIAL_COMMAND
ULONG StopOnHungGUI : 1; // FLG_STOP_ON_HUNG_GUI
ULONG HeapEnableTailCheck : 1; // FLG_HEAP_ENABLE_TAIL_CHECK
ULONG HeapEnableFreeCheck : 1; // FLG_HEAP_ENABLE_FREE_CHECK
ULONG HeapValidateParameters : 1; // FLG_HEAP_VALIDATE_PARAMETERS
ULONG HeapValidateAll : 1; // FLG_HEAP_VALIDATE_ALL
ULONG ApplicationVerifier : 1; // FLG_APPLICATION_VERIFIER
ULONG MonitorSilentProcessExit : 1; // FLG_MONITOR_SILENT_PROCESS_EXIT
ULONG PoolEnableTagging : 1; // FLG_POOL_ENABLE_TAGGING
ULONG HeapEnableTagging : 1; // FLG_HEAP_ENABLE_TAGGING
ULONG UserStackTraceDb : 1; // FLG_USER_STACK_TRACE_DB
ULONG KernelStackTraceDb : 1; // FLG_KERNEL_STACK_TRACE_DB
ULONG MaintainObjectTypeList : 1; // FLG_MAINTAIN_OBJECT_TYPELIST
ULONG HeapEnableTagByDll : 1; // FLG_HEAP_ENABLE_TAG_BY_DLL
ULONG DisableStackExtension : 1; // FLG_DISABLE_STACK_EXTENSION
ULONG EnableCsrDebug : 1; // FLG_ENABLE_CSRDEBUG
ULONG EnableKDebugSymbolLoad : 1; // FLG_ENABLE_KDEBUG_SYMBOL_LOAD
ULONG DisablePageKernelStacks : 1; // FLG_DISABLE_PAGE_KERNEL_STACKS
ULONG EnableSystemCritBreaks : 1; // FLG_ENABLE_SYSTEM_CRIT_BREAKS
ULONG HeapDisableCoalescing : 1; // FLG_HEAP_DISABLE_COALESCING
ULONG EnableCloseExceptions : 1; // FLG_ENABLE_CLOSE_EXCEPTIONS
ULONG EnableExceptionLogging : 1; // FLG_ENABLE_EXCEPTION_LOGGING
ULONG EnableHandleTypeTagging : 1; // FLG_ENABLE_HANDLE_TYPE_TAGGING
ULONG HeapPageAllocs : 1; // FLG_HEAP_PAGE_ALLOCS
ULONG DebugInitialCommandEx : 1; // FLG_DEBUG_INITIAL_COMMAND_EX
ULONG DisableDbgPrint : 1; // FLG_DISABLE_DBGPRINT
ULONG CritSecEventCreation : 1; // FLG_CRITSEC_EVENT_CREATION
ULONG LdrTopDown : 1; // FLG_LDR_TOP_DOWN
ULONG EnableHandleExceptions : 1; // FLG_ENABLE_HANDLE_EXCEPTIONS
ULONG DisableProtDlls : 1; // FLG_DISABLE_PROTDLLS
} NtGlobalFlags;
};
//
// Timeout for critical sections.
//
LARGE_INTEGER CriticalSectionTimeout;
//
// Reserved size for heap segments.
//
SIZE_T HeapSegmentReserve;
//
// Committed size for heap segments.
//
SIZE_T HeapSegmentCommit;
//
// Threshold for decommitting total free heap.
//
SIZE_T HeapDeCommitTotalFreeThreshold;
//
// Threshold for decommitting free heap blocks.
//
SIZE_T HeapDeCommitFreeBlockThreshold;
//
// Number of process heaps.
//
ULONG NumberOfHeaps;
//
// Maximum number of process heaps.
//
ULONG MaximumNumberOfHeaps;
//
// Pointer to an array of process heaps. ProcessHeaps is initialized
// to point to the first free byte after the PEB and MaximumNumberOfHeaps
// is computed from the page size used to hold the PEB, less the fixed
// size of this data structure.
//
PVOID* ProcessHeaps;
//
// Pointer to the system GDI shared handle table.
//
PVOID GdiSharedHandleTable;
//
// Pointer to the process starter helper.
//
PVOID ProcessStarterHelper;
//
// The maximum number of GDI function calls during batch operations (GdiSetBatchLimit)
//
ULONG GdiDCAttributeList;
//
// Pointer to the loader lock critical section.
//
RTL_CRITICAL_SECTION* LoaderLock;
//
// Major version of the operating system.
//
ULONG OSMajorVersion;
//
// Minor version of the operating system.
//
ULONG OSMinorVersion;
//
// Build number of the operating system.
//
USHORT OSBuildNumber;
//
// CSD version of the operating system.
//
USHORT OSCSDVersion;
//
// Platform ID of the operating system.
//
ULONG OSPlatformId;
//
// Subsystem version of the current process image (PE Headers).
//
ULONG ImageSubsystem;
//
// Major version of the current process image subsystem (PE Headers).
//
ULONG ImageSubsystemMajorVersion;
//
// Minor version of the current process image subsystem (PE Headers).
//
ULONG ImageSubsystemMinorVersion;
//
// Affinity mask for the current process.
//
KAFFINITY ActiveProcessAffinityMask;
//
// Temporary buffer for GDI handles accumulated in the current batch.
//
GDI_HANDLE_BUFFER GdiHandleBuffer;
//
// Pointer to the post-process initialization routine available for use by the application.
//
PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
//
// Pointer to the TLS expansion bitmap.
//
PRTL_BITMAP TlsExpansionBitmap;
//
// Bits for the TLS expansion bitmap. TLS_EXPANSION_SLOTS
//
ULONG TlsExpansionBitmapBits[32];
//
// Session ID of the current process.
//
ULONG SessionId;
//
// Application compatibility flags. KACF_*
//
ULARGE_INTEGER AppCompatFlags;
//
// Application compatibility flags. KACF_*
//
ULARGE_INTEGER AppCompatFlagsUser;
//
// Pointer to the Application SwitchBack Compatibility Engine.
//
PVOID pShimData;
//
// Pointer to the Application Compatibility Engine. // APPCOMPAT_EXE_DATA
//
PVOID AppCompatInfo;
//
// CSD version string of the operating system.
//
UNICODE_STRING CSDVersion;
//
// Pointer to the process activation context.
//
PACTIVATION_CONTEXT_DATA ActivationContextData;
//
// Pointer to the process assembly storage map.
//
PASSEMBLY_STORAGE_MAP ProcessAssemblyStorageMap;
//
// Pointer to the system default activation context.
//
PACTIVATION_CONTEXT_DATA SystemDefaultActivationContextData;
//
// Pointer to the system assembly storage map.
//
PASSEMBLY_STORAGE_MAP SystemAssemblyStorageMap;
//
// Minimum stack commit size.
//
SIZE_T MinimumStackCommit;
//
// since 19H1 (previously FlsCallback to FlsHighIndex)
//
PVOID SparePointers[2];
//
// Pointer to the patch loader data.
//
PVOID PatchLoaderData;
//
// Pointer to the CHPE V2 process information. CHPEV2_PROCESS_INFO
//
PVOID ChpeV2ProcessInfo;
//
// Packaged process feature state.
//
union
{
ULONG AppModelFeatureState;
struct
{
ULONG ForeRootBoostProcesses : 1;
ULONG AppModelFeatureStateReserved : 31;
};
};
//
// SpareUlongs
//
ULONG SpareUlongs[2];
//
// Active code page.
//
USHORT ActiveCodePage;
//
// OEM code page.
//
USHORT OemCodePage;
//
// Code page case mapping.
//
USHORT UseCaseMapping;
//
// Unused NLS field.
//
USHORT UnusedNlsField;
//
// Pointer to the application WER registration data.
//
PWER_PEB_HEADER_BLOCK WerRegistrationData;
//
// Pointer to the application WER assert pointer.
//
PVOID WerShipAssertPtr;
//
// Pointer to the EC bitmap on ARM64. (Windows 11 and above)
//
union
{
PVOID pContextData; // Pointer to the switchback compatibility engine (Windows 7 and below)
PVOID EcCodeBitMap; // Pointer to the EC bitmap on ARM64 (Windows 11 and above) // since WIN11
};
//
// Reserved.
//
PVOID pImageHeaderHash;
//
// ETW tracing flags.
//
union
{
ULONG TracingFlags;
struct
{
ULONG HeapTracingEnabled : 1; // ETW heap tracing enabled.
ULONG CritSecTracingEnabled : 1; // ETW lock tracing enabled.
ULONG LibLoaderTracingEnabled : 1; // ETW loader tracing enabled.
ULONG SpareTracingBits : 29;
};
};
//
// Reserved for CSRSS.
//
ULONGLONG CsrServerReadOnlySharedMemoryBase;
//
// Pointer to the thread pool worker list lock.
//
RTL_CRITICAL_SECTION* TppWorkerpListLock;
//
// Pointer to the thread pool worker list.
//
LIST_ENTRY TppWorkerpList;
//
// Wait on address hash table. (RtlWaitOnAddress)
//
PVOID WaitOnAddressHashTable[128];
//
// Pointer to the telemetry coverage header. // since RS3
//
PTELEMETRY_COVERAGE_HEADER TelemetryCoverageHeader;
//
// Cloud file flags. (ProjFs and Cloud Files) // since RS4
//
ULONG CloudFileFlags;
//
// Cloud file diagnostic flags.
//
ULONG CloudFileDiagFlags;
//
// Placeholder compatibility mode. (ProjFs and Cloud Files)
//
CHAR PlaceholderCompatibilityMode;
//
// Reserved for placeholder compatibility mode.
//
CHAR PlaceholderCompatibilityModeReserved[7];
//
// Pointer to leap second data. // since RS5
//
PLEAP_SECOND_DATA LeapSecondData;
//
// Leap second flags.
//
union
{
ULONG LeapSecondFlags;
struct
{
ULONG SixtySecondEnabled : 1; // Leap seconds enabled.
ULONG Reserved : 31;
};
};
//
// Global flags for the process.
//
ULONG NtGlobalFlag2;
//
// Extended feature disable mask (AVX). // since WIN11
//
ULONGLONG ExtendedFeatureDisableMask;
} PEB, * PPEB;
/**
* Thread Environment Block (TEB) structure.
*
* \remarks https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-teb
*/
typedef struct _TEB {
NT_TIB NtTib;
//
// Reserved.
//
PVOID EnvironmentPointer;
//
// Client ID for this thread.
//
CLIENT_ID ClientId;
//
// A handle to an active Remote Procedure Call (RPC) if the thread is currently involved in an RPC operation.
//
PVOID ActiveRpcHandle;
//
// A pointer to the __declspec(thread) local storage array.
//
PVOID ThreadLocalStoragePointer;
//
// A pointer to the Process Environment Block (PEB), which contains information about the process.
//
PPEB ProcessEnvironmentBlock;
//
// The previous Win32 error value for this thread.
//
ULONG LastErrorValue;
//
// The number of critical sections currently owned by this thread.
//
ULONG CountOfOwnedCriticalSections;
//
// Reserved.
//
PVOID CsrClientThread;
//
// Reserved.
//
PVOID Win32ThreadInfo;
//
// Reserved.
//
ULONG User32Reserved[26];
//
// Reserved.
//
ULONG UserReserved[5];
//
// Reserved.
//
PVOID WOW32Reserved;
//
// The LCID of the current thread. (Kernel32!GetThreadLocale)
//
LCID CurrentLocale;
//
// Reserved.
//
ULONG FpSoftwareStatusRegister;
//
// Reserved.
//
PVOID ReservedForDebuggerInstrumentation[16];
#ifdef _WIN64
//
// Reserved.
//
PVOID SystemReserved1[25];
//
// Per-thread fiber local storage. (Teb->HasFiberData)
//
PVOID HeapFlsData;
//
// Reserved.
//
ULONG_PTR RngState[4];
#else
//
// Reserved.
//
PVOID SystemReserved1[26];
#endif
//
// Placeholder compatibility mode. (ProjFs and Cloud Files)
//
CHAR PlaceholderCompatibilityMode;
//
// Indicates whether placeholder hydration is always explicit.
//
BOOLEAN PlaceholderHydrationAlwaysExplicit;
//
// Reserved.
//
CHAR PlaceholderReserved[10];
//
// The process ID (PID) that the current COM server thread is acting on behalf of.
//
ULONG ProxiedProcessId;
//
// Pointer to the activation context stack for the current thread.
//
ACTIVATION_CONTEXT_STACK ActivationStack;
//
// Opaque operation on behalf of another user or process.
//
UCHAR WorkingOnBehalfTicket[8];
//
// The last exception status for the current thread.
//
NTSTATUS ExceptionCode;
//
// Pointer to the activation context stack for the current thread.
//
PACTIVATION_CONTEXT_STACK ActivationContextStackPointer;
//
// The stack pointer (SP) of the current system call or exception during instrumentation.
//
ULONG_PTR InstrumentationCallbackSp;
//
// The program counter (PC) of the previous system call or exception during instrumentation.
//
ULONG_PTR InstrumentationCallbackPreviousPc;
//
// The stack pointer (SP) of the previous system call or exception during instrumentation.
//
ULONG_PTR InstrumentationCallbackPreviousSp;
#ifdef _WIN64
//
// The miniversion ID of the current transacted file operation.
//
ULONG TxFsContext;
#endif
//
// Indicates the state of the system call or exception instrumentation callback.
//
BOOLEAN InstrumentationCallbackDisabled;
#ifdef _WIN64
//
// Indicates the state of alignment exceptions for unaligned load/store operations.
//
BOOLEAN UnalignedLoadStoreExceptions;
#endif
#ifndef _WIN64
//
// SpareBytes.
//
UCHAR SpareBytes[23];
//
// The miniversion ID of the current transacted file operation.
//
ULONG TxFsContext;
#endif
//
// Reserved for GDI.
//
GDI_TEB_BATCH GdiTebBatch;
CLIENT_ID RealClientId;
HANDLE GdiCachedProcessHandle;
ULONG GdiClientPID;
ULONG GdiClientTID;
PVOID GdiThreadLocalInfo;
//
// Reserved for User32.
//
ULONG_PTR Win32ClientInfo[WIN32_CLIENT_INFO_LENGTH];
//
// Reserved for opengl32.dll
//
PVOID glDispatchTable[233];
ULONG_PTR glReserved1[29];
PVOID glReserved2;
PVOID glSectionInfo;
PVOID glSection;
PVOID glTable;
PVOID glCurrentRC;
PVOID glContext;
//
// The previous status value for this thread.
//
NTSTATUS LastStatusValue;
//
// A static string for use by the application.
//
UNICODE_STRING StaticUnicodeString;
//
// A static buffer for use by the application.
//
WCHAR StaticUnicodeBuffer[STATIC_UNICODE_BUFFER_LENGTH];
//
// The maximum stack size and indicates the base of the stack.
//
PVOID DeallocationStack;
//
// Data for Thread Local Storage. (TlsGetValue)
//
PVOID TlsSlots[TLS_MINIMUM_AVAILABLE];
//
// Reserved.
//
LIST_ENTRY TlsLinks;
//
// Reserved for NTVDM.
//
PVOID Vdm;
//
// Reserved.
//
PVOID ReservedForNtRpc;
//
// Reserved.
//
PVOID DbgSsReserved[2];
//
// The error mode for the current thread. (GetThreadErrorMode)
//
ULONG HardErrorMode;
//
// Reserved.
//
#ifdef _WIN64
PVOID Instrumentation[11];
#else
PVOID Instrumentation[9];
#endif
//
// Reserved.
//
GUID ActivityId;
//
// The service creating the thread (svchost).
//
PVOID SubProcessTag;
//
// Reserved.
//
PVOID PerflibData;
//
// Reserved.
//
PVOID EtwTraceData;
//
// The address of a socket handle during a blocking socket operation. (WSAStartup)
//
HANDLE WinSockData;
//
// The number of function calls accumulated in the current GDI batch. (GdiSetBatchLimit)
//
ULONG GdiBatchCount;
//
// The preferred processor for the curremt thread. (SetThreadIdealProcessor/SetThreadIdealProcessorEx)
//
union
{
PROCESSOR_NUMBER CurrentIdealProcessor;
ULONG IdealProcessorValue;
struct
{
UCHAR ReservedPad0;
UCHAR ReservedPad1;
UCHAR ReservedPad2;
UCHAR IdealProcessor;
};
};
//
// The minimum size of the stack available during any stack overflow exceptions. (SetThreadStackGuarantee)
//
ULONG GuaranteedStackBytes;
//
// Reserved.
//
PVOID ReservedForPerf;
//
// tagSOleTlsData.
//
PVOID ReservedForOle;
ULONG WaitingOnLoaderLock;
PVOID SavedPriorityState;
ULONG_PTR ReservedForCodeCoverage;
PVOID ThreadPoolData;
PVOID *TlsExpansionSlots;
#ifdef _WIN64
PVOID ChpeV2CpuAreaInfo; // CHPEV2_CPUAREA_INFO // previously DeallocationBStore
PVOID Unused; // previously BStoreLimit
#endif
ULONG MuiGeneration;
ULONG IsImpersonating;
PVOID NlsCache;
PVOID pShimData;
ULONG HeapData;
HANDLE CurrentTransactionHandle;
PTEB_ACTIVE_FRAME ActiveFrame;
//
// Reserved for FLS (RtlProcessFlsData).
//
PVOID FlsData;
PVOID PreferredLanguages;
PVOID UserPrefLanguages;
PVOID MergedPrefLanguages;
ULONG MuiImpersonation;
union
{
USHORT CrossTebFlags;
USHORT SpareCrossTebBits : 16;
};
union
{
USHORT SameTebFlags;
struct
{
USHORT SafeThunkCall : 1;
USHORT InDebugPrint : 1;
USHORT HasFiberData : 1;
USHORT SkipThreadAttach : 1;
USHORT WerInShipAssertCode : 1;
USHORT RanProcessInit : 1;
USHORT ClonedThread : 1;
USHORT SuppressDebugMsg : 1;
USHORT DisableUserStackWalk : 1;
USHORT RtlExceptionAttached : 1;
USHORT InitialThread : 1;
USHORT SessionAware : 1;
USHORT LoadOwner : 1;
USHORT LoaderWorker : 1;
USHORT SkipLoaderInit : 1;
USHORT SkipFileAPIBrokering : 1;
};
};
PVOID TxnScopeEnterCallback;
PVOID TxnScopeExitCallback;
PVOID TxnScopeContext;
ULONG LockCount;
LONG WowTebOffset;
PVOID ResourceRetValue;
PVOID ReservedForWdf;
ULONGLONG ReservedForCrt;
GUID EffectiveContainerId;
ULONGLONG LastSleepCounter; // Win11
ULONG SpinCallCount;
ULONGLONG ExtendedFeatureDisableMask;
PVOID SchedulerSharedDataSlot; // 24H2
PVOID HeapWalkContext;
GROUP_AFFINITY PrimaryGroupAffinity;
ULONG Rcu[2];
} TEB, *PTEB;
typedef VOID (NTAPI* PPS_APC_ROUTINE)(
_In_opt_ PVOID ApcArgument1,
_In_opt_ PVOID ApcArgument2,
_In_opt_ PVOID ApcArgument3
);
typedef struct _MEMORY_RANGE_ENTRY
{
PVOID VirtualAddress;
SIZE_T NumberOfBytes;
} MEMORY_RANGE_ENTRY, *PMEMORY_RANGE_ENTRY;
typedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS
{
VmPrefetchInformation, // MEMORY_PREFETCH_INFORMATION
VmPagePriorityInformation, // MEMORY_PAGE_PRIORITY_INFORMATION
VmCfgCallTargetInformation, // CFG_CALL_TARGET_LIST_INFORMATION // REDSTONE2
VmPageDirtyStateInformation, // REDSTONE3
VmImageHotPatchInformation, // 19H1
VmPhysicalContiguityInformation, // 20H1
VmVirtualMachinePrepopulateInformation,
VmRemoveFromWorkingSetInformation,
MaxVmInfoClass
} VIRTUAL_MEMORY_INFORMATION_CLASS;
typedef enum _EVENT_TYPE
{
NotificationEvent,
SynchronizationEvent
} EVENT_TYPE;
typedef enum _SECTION_INHERIT
{
ViewShare = 1,
ViewUnmap = 2
} SECTION_INHERIT;
typedef LONG KPRIORITY, *PKPRIORITY;
typedef struct _PROCESS_BASIC_INFORMATION
{
NTSTATUS ExitStatus; // The exit status of the process. (GetExitCodeProcess)
PPEB PebBaseAddress; // A pointer to the process environment block (PEB) of the process.
KAFFINITY AffinityMask; // The affinity mask of the process. (GetProcessAffinityMask) (deprecated)
KPRIORITY BasePriority; // The base priority of the process. (GetPriorityClass)
HANDLE UniqueProcessId; // The unique identifier of the process. (GetProcessId)
HANDLE InheritedFromUniqueProcessId; // The unique identifier of the parent process.
} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
typedef struct _PROCESS_EXTENDED_BASIC_INFORMATION
{
_In_ SIZE_T Size; // The size of the structure, in bytes. This member must be set to sizeof(PROCESS_EXTENDED_BASIC_INFORMATION).
union
{
PROCESS_BASIC_INFORMATION BasicInfo;
struct
{
NTSTATUS ExitStatus; // The exit status of the process. (GetExitCodeProcess)
PPEB PebBaseAddress; // A pointer to the process environment block (PEB) of the process.
KAFFINITY AffinityMask; // The affinity mask of the process. (GetProcessAffinityMask) (deprecated)
KPRIORITY BasePriority; // The base priority of the process. (GetPriorityClass)
HANDLE UniqueProcessId; // The unique identifier of the process. (GetProcessId)
HANDLE InheritedFromUniqueProcessId; // The unique identifier of the parent process.
};
};
union
{
ULONG Flags;
struct
{
ULONG IsProtectedProcess : 1;
ULONG IsWow64Process : 1;
ULONG IsProcessDeleting : 1;
ULONG IsCrossSessionCreate : 1;
ULONG IsFrozen : 1;
ULONG IsBackground : 1; // WIN://BGKD
ULONG IsStronglyNamed : 1; // WIN://SYSAPPID
ULONG IsSecureProcess : 1;
ULONG IsSubsystemProcess : 1;
ULONG IsTrustedApp : 1; // since 24H2
ULONG SpareBits : 22;
};
};
} PROCESS_EXTENDED_BASIC_INFORMATION, *PPROCESS_EXTENDED_BASIC_INFORMATION;
typedef enum _PROCESSINFOCLASS
{
ProcessBasicInformation, // q: PROCESS_BASIC_INFORMATION, PROCESS_EXTENDED_BASIC_INFORMATION
ProcessQuotaLimits, // qs: QUOTA_LIMITS, QUOTA_LIMITS_EX
ProcessIoCounters, // q: IO_COUNTERS
ProcessVmCounters, // q: VM_COUNTERS, VM_COUNTERS_EX, VM_COUNTERS_EX2
ProcessTimes, // q: KERNEL_USER_TIMES
ProcessBasePriority, // s: KPRIORITY
ProcessRaisePriority, // s: ULONG
ProcessDebugPort, // q: HANDLE
ProcessExceptionPort, // s: PROCESS_EXCEPTION_PORT (requires SeTcbPrivilege)
ProcessAccessToken, // s: PROCESS_ACCESS_TOKEN
ProcessLdtInformation, // qs: PROCESS_LDT_INFORMATION // 10
ProcessLdtSize, // s: PROCESS_LDT_SIZE
ProcessDefaultHardErrorMode, // qs: ULONG
ProcessIoPortHandlers, // (kernel-mode only) // s: PROCESS_IO_PORT_HANDLER_INFORMATION
ProcessPooledUsageAndLimits, // q: POOLED_USAGE_AND_LIMITS
ProcessWorkingSetWatch, // q: PROCESS_WS_WATCH_INFORMATION[]; s: void
ProcessUserModeIOPL, // qs: ULONG (requires SeTcbPrivilege)
ProcessEnableAlignmentFaultFixup, // s: BOOLEAN
ProcessPriorityClass, // qs: PROCESS_PRIORITY_CLASS
ProcessWx86Information, // qs: ULONG (requires SeTcbPrivilege) (VdmAllowed)
ProcessHandleCount, // q: ULONG, PROCESS_HANDLE_INFORMATION // 20
ProcessAffinityMask, // (q >WIN7)s: KAFFINITY, qs: GROUP_AFFINITY
ProcessPriorityBoost, // qs: ULONG
ProcessDeviceMap, // qs: PROCESS_DEVICEMAP_INFORMATION, PROCESS_DEVICEMAP_INFORMATION_EX
ProcessSessionInformation, // q: PROCESS_SESSION_INFORMATION
ProcessForegroundInformation, // s: PROCESS_FOREGROUND_BACKGROUND
ProcessWow64Information, // q: ULONG_PTR
ProcessImageFileName, // q: UNICODE_STRING
ProcessLUIDDeviceMapsEnabled, // q: ULONG
ProcessBreakOnTermination, // qs: ULONG
ProcessDebugObjectHandle, // q: HANDLE // 30
ProcessDebugFlags, // qs: ULONG
ProcessHandleTracing, // q: PROCESS_HANDLE_TRACING_QUERY; s: PROCESS_HANDLE_TRACING_ENABLE[_EX] or void to disable
ProcessIoPriority, // qs: IO_PRIORITY_HINT
ProcessExecuteFlags, // qs: ULONG (MEM_EXECUTE_OPTION_*)
ProcessTlsInformation, // PROCESS_TLS_INFORMATION // ProcessResourceManagement
ProcessCookie, // q: ULONG
ProcessImageInformation, // q: SECTION_IMAGE_INFORMATION
ProcessCycleTime, // q: PROCESS_CYCLE_TIME_INFORMATION // since VISTA
ProcessPagePriority, // qs: PAGE_PRIORITY_INFORMATION
ProcessInstrumentationCallback, // s: PVOID or PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION // 40
ProcessThreadStackAllocation, // s: PROCESS_STACK_ALLOCATION_INFORMATION, PROCESS_STACK_ALLOCATION_INFORMATION_EX
ProcessWorkingSetWatchEx, // q: PROCESS_WS_WATCH_INFORMATION_EX[]; s: void
ProcessImageFileNameWin32, // q: UNICODE_STRING
ProcessImageFileMapping, // q: HANDLE (input)
ProcessAffinityUpdateMode, // qs: PROCESS_AFFINITY_UPDATE_MODE
ProcessMemoryAllocationMode, // qs: PROCESS_MEMORY_ALLOCATION_MODE
ProcessGroupInformation, // q: USHORT[]
ProcessTokenVirtualizationEnabled, // s: ULONG
ProcessConsoleHostProcess, // qs: ULONG_PTR // ProcessOwnerInformation
ProcessWindowInformation, // q: PROCESS_WINDOW_INFORMATION // 50
ProcessHandleInformation, // q: PROCESS_HANDLE_SNAPSHOT_INFORMATION // since WIN8
ProcessMitigationPolicy, // s: PROCESS_MITIGATION_POLICY_INFORMATION
ProcessDynamicFunctionTableInformation, // s: PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION
ProcessHandleCheckingMode, // qs: ULONG; s: 0 disables, otherwise enables
ProcessKeepAliveCount, // q: PROCESS_KEEPALIVE_COUNT_INFORMATION
ProcessRevokeFileHandles, // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION
ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL
ProcessHandleTable, // q: ULONG[] // since WINBLUE
ProcessCheckStackExtentsMode, // qs: ULONG // KPROCESS->CheckStackExtents (CFG)
ProcessCommandLineInformation, // q: UNICODE_STRING // 60
ProcessProtectionInformation, // q: PS_PROTECTION
ProcessMemoryExhaustion, // s: PROCESS_MEMORY_EXHAUSTION_INFO // since THRESHOLD
ProcessFaultInformation, // s: PROCESS_FAULT_INFORMATION
ProcessTelemetryIdInformation, // q: PROCESS_TELEMETRY_ID_INFORMATION
ProcessCommitReleaseInformation, // qs: PROCESS_COMMIT_RELEASE_INFORMATION
ProcessDefaultCpuSetsInformation, // qs: SYSTEM_CPU_SET_INFORMATION[5]
ProcessAllowedCpuSetsInformation, // qs: SYSTEM_CPU_SET_INFORMATION[5]
ProcessSubsystemProcess,
ProcessJobMemoryInformation, // q: PROCESS_JOB_MEMORY_INFO
ProcessInPrivate, // q: BOOLEAN; s: void // ETW // since THRESHOLD2 // 70
ProcessRaiseUMExceptionOnInvalidHandleClose, // qs: ULONG; s: 0 disables, otherwise enables
ProcessIumChallengeResponse,
ProcessChildProcessInformation, // q: PROCESS_CHILD_PROCESS_INFORMATION
ProcessHighGraphicsPriorityInformation, // qs: BOOLEAN (requires SeTcbPrivilege)
ProcessSubsystemInformation, // q: SUBSYSTEM_INFORMATION_TYPE // since REDSTONE2
ProcessEnergyValues, // q: PROCESS_ENERGY_VALUES, PROCESS_EXTENDED_ENERGY_VALUES
ProcessPowerThrottlingState, // qs: POWER_THROTTLING_PROCESS_STATE
ProcessReserved3Information, // ProcessActivityThrottlePolicy // PROCESS_ACTIVITY_THROTTLE_POLICY
ProcessWin32kSyscallFilterInformation, // q: WIN32K_SYSCALL_FILTER
ProcessDisableSystemAllowedCpuSets, // s: BOOLEAN // 80
ProcessWakeInformation, // q: PROCESS_WAKE_INFORMATION
ProcessEnergyTrackingState, // qs: PROCESS_ENERGY_TRACKING_STATE
ProcessManageWritesToExecutableMemory, // MANAGE_WRITES_TO_EXECUTABLE_MEMORY // since REDSTONE3
ProcessCaptureTrustletLiveDump,
ProcessTelemetryCoverage, // q: TELEMETRY_COVERAGE_HEADER; s: TELEMETRY_COVERAGE_POINT
ProcessEnclaveInformation,
ProcessEnableReadWriteVmLogging, // qs: PROCESS_READWRITEVM_LOGGING_INFORMATION
ProcessUptimeInformation, // q: PROCESS_UPTIME_INFORMATION
ProcessImageSection, // q: HANDLE
ProcessDebugAuthInformation, // since REDSTONE4 // 90
ProcessSystemResourceManagement, // s: PROCESS_SYSTEM_RESOURCE_MANAGEMENT
ProcessSequenceNumber, // q: ULONGLONG
ProcessLoaderDetour, // since REDSTONE5
ProcessSecurityDomainInformation, // q: PROCESS_SECURITY_DOMAIN_INFORMATION
ProcessCombineSecurityDomainsInformation, // s: PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION
ProcessEnableLogging, // qs: PROCESS_LOGGING_INFORMATION
ProcessLeapSecondInformation, // qs: PROCESS_LEAP_SECOND_INFORMATION
ProcessFiberShadowStackAllocation, // s: PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION // since 19H1
ProcessFreeFiberShadowStackAllocation, // s: PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION
ProcessAltSystemCallInformation, // s: PROCESS_SYSCALL_PROVIDER_INFORMATION // since 20H1 // 100
ProcessDynamicEHContinuationTargets, // s: PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION
ProcessDynamicEnforcedCetCompatibleRanges, // s: PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE_INFORMATION // since 20H2
ProcessCreateStateChange, // since WIN11
ProcessApplyStateChange,
ProcessEnableOptionalXStateFeatures, // s: ULONG64 // optional XState feature bitmask
ProcessAltPrefetchParam, // qs: OVERRIDE_PREFETCH_PARAMETER // App Launch Prefetch (ALPF) // since 22H1
ProcessAssignCpuPartitions, // HANDLE
ProcessPriorityClassEx, // s: PROCESS_PRIORITY_CLASS_EX
ProcessMembershipInformation, // q: PROCESS_MEMBERSHIP_INFORMATION
ProcessEffectiveIoPriority, // q: IO_PRIORITY_HINT // 110
ProcessEffectivePagePriority, // q: ULONG
ProcessSchedulerSharedData, // SCHEDULER_SHARED_DATA_SLOT_INFORMATION // since 24H2
ProcessSlistRollbackInformation,
ProcessNetworkIoCounters, // q: PROCESS_NETWORK_COUNTERS
ProcessFindFirstThreadByTebValue, // PROCESS_TEB_VALUE_INFORMATION
ProcessEnclaveAddressSpaceRestriction, // since 25H2
ProcessAvailableCpus,
MaxProcessInfoClass
} PROCESSINFOCLASS;
typedef enum _KTHREAD_STATE
{
Initialized,
Ready,
Running,
Standby,
Terminated,
Waiting,
Transition,
DeferredReady,
GateWaitObsolete,
WaitingForProcessInSwap,
MaximumThreadState
} KTHREAD_STATE, *PKTHREAD_STATE;
typedef enum _KWAIT_REASON
{
Executive, // Waiting for an executive event.
FreePage, // Waiting for a free page.
PageIn, // Waiting for a page to be read in.
PoolAllocation, // Waiting for a pool allocation.
DelayExecution, // Waiting due to a delay execution. // NtDelayExecution
Suspended, // Waiting because the thread is suspended. // NtSuspendThread
UserRequest, // Waiting due to a user request. // NtWaitForSingleObject
WrExecutive, // Waiting for an executive event.
WrFreePage, // Waiting for a free page.
WrPageIn, // Waiting for a page to be read in.
WrPoolAllocation, // Waiting for a pool allocation.
WrDelayExecution, // Waiting due to a delay execution.
WrSuspended, // Waiting because the thread is suspended.
WrUserRequest, // Waiting due to a user request.
WrEventPair, // Waiting for an event pair. // NtCreateEventPair
WrQueue, // Waiting for a queue. // NtRemoveIoCompletion
WrLpcReceive, // Waiting for an LPC receive.
WrLpcReply, // Waiting for an LPC reply.
WrVirtualMemory, // Waiting for virtual memory.
WrPageOut, // Waiting for a page to be written out.
WrRendezvous, // Waiting for a rendezvous.
WrKeyedEvent, // Waiting for a keyed event. // NtCreateKeyedEvent
WrTerminated, // Waiting for thread termination.
WrProcessInSwap, // Waiting for a process to be swapped in.
WrCpuRateControl, // Waiting for CPU rate control.
WrCalloutStack, // Waiting for a callout stack.
WrKernel, // Waiting for a kernel event.
WrResource, // Waiting for a resource.
WrPushLock, // Waiting for a push lock.
WrMutex, // Waiting for a mutex.
WrQuantumEnd, // Waiting for the end of a quantum.
WrDispatchInt, // Waiting for a dispatch interrupt.
WrPreempted, // Waiting because the thread was preempted.
WrYieldExecution, // Waiting to yield execution.
WrFastMutex, // Waiting for a fast mutex.
WrGuardedMutex, // Waiting for a guarded mutex.
WrRundown, // Waiting for a rundown.
WrAlertByThreadId, // Waiting for an alert by thread ID.
WrDeferredPreempt, // Waiting for a deferred preemption.
WrPhysicalFault, // Waiting for a physical fault.
WrIoRing, // Waiting for an I/O ring.
WrMdlCache, // Waiting for an MDL cache.
WrRcu, // Waiting for read-copy-update (RCU) synchronization.
MaximumWaitReason
} KWAIT_REASON, *PKWAIT_REASON;
typedef struct _SYSTEM_THREAD_INFORMATION
{
LARGE_INTEGER KernelTime; // Number of 100-nanosecond intervals spent executing kernel code.
LARGE_INTEGER UserTime; // Number of 100-nanosecond intervals spent executing user code.
LARGE_INTEGER CreateTime; // System time when the thread was created.
ULONG WaitTime; // Time spent in ready queue or waiting (depending on the thread state).
PVOID StartAddress; // Start address of the thread.
CLIENT_ID ClientId; // ID of the thread and the process owning the thread.
KPRIORITY Priority; // Dynamic thread priority.
KPRIORITY BasePriority; // Base thread priority.
ULONG ContextSwitches; // Total context switches.
KTHREAD_STATE ThreadState; // Current thread state.
KWAIT_REASON WaitReason; // The reason the thread is waiting.
} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
typedef struct _SYSTEM_PROCESS_INFORMATION
{
ULONG NextEntryOffset; // The address of the previous item plus the value in the NextEntryOffset member. For the last item in the array, NextEntryOffset is 0.
ULONG NumberOfThreads; // The NumberOfThreads member contains the number of threads in the process.
ULONGLONG WorkingSetPrivateSize; // since VISTA
ULONG HardFaultCount; // since WIN7
ULONG NumberOfThreadsHighWatermark; // The peak number of threads that were running at any given point in time, indicative of potential performance bottlenecks related to thread management.
ULONGLONG CycleTime; // The sum of the cycle time of all threads in the process.
LARGE_INTEGER CreateTime; // Number of 100-nanosecond intervals since the creation time of the process. Not updated during system timezone changes resullting in an incorrect value.
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ImageName; // The file name of the executable image.
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
HANDLE InheritedFromUniqueProcessId;
ULONG HandleCount;
ULONG SessionId;
ULONG_PTR UniqueProcessKey; // since VISTA (requires SystemExtendedProcessInformation)
SIZE_T PeakVirtualSize; // The peak size, in bytes, of the virtual memory used by the process.
SIZE_T VirtualSize; // The current size, in bytes, of virtual memory used by the process.
ULONG PageFaultCount; // The member of page faults for data that is not currently in memory.
SIZE_T PeakWorkingSetSize; // The peak size, in kilobytes, of the working set of the process.
SIZE_T WorkingSetSize; // The number of pages visible to the process in physical memory. These pages are resident and available for use without triggering a page fault.
SIZE_T QuotaPeakPagedPoolUsage; // The peak quota charged to the process for pool usage, in bytes.
SIZE_T QuotaPagedPoolUsage; // The quota charged to the process for paged pool usage, in bytes.
SIZE_T QuotaPeakNonPagedPoolUsage; // The peak quota charged to the process for nonpaged pool usage, in bytes.
SIZE_T QuotaNonPagedPoolUsage; // The current quota charged to the process for nonpaged pool usage.
SIZE_T PagefileUsage; // The PagefileUsage member contains the number of bytes of page file storage in use by the process.
SIZE_T PeakPagefileUsage; // The maximum number of bytes of page-file storage used by the process.
SIZE_T PrivatePageCount; // The number of memory pages allocated for the use by the process.
LARGE_INTEGER ReadOperationCount; // The total number of read operations performed.
LARGE_INTEGER WriteOperationCount; // The total number of write operations performed.
LARGE_INTEGER OtherOperationCount; // The total number of I/O operations performed other than read and write operations.
LARGE_INTEGER ReadTransferCount; // The total number of bytes read during a read operation.
LARGE_INTEGER WriteTransferCount; // The total number of bytes written during a write operation.
LARGE_INTEGER OtherTransferCount; // The total number of bytes transferred during operations other than read and write operations.
SYSTEM_THREAD_INFORMATION Threads[1]; // This type is not defined in the structure but was added for convenience.
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
typedef enum _SYSTEM_INFORMATION_CLASS
{
SystemBasicInformation, // q: SYSTEM_BASIC_INFORMATION
SystemProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION
SystemPerformanceInformation, // q: SYSTEM_PERFORMANCE_INFORMATION
SystemTimeOfDayInformation, // q: SYSTEM_TIMEOFDAY_INFORMATION
SystemPathInformation, // not implemented
SystemProcessInformation, // q: SYSTEM_PROCESS_INFORMATION
SystemCallCountInformation, // q: SYSTEM_CALL_COUNT_INFORMATION
SystemDeviceInformation, // q: SYSTEM_DEVICE_INFORMATION
SystemProcessorPerformanceInformation, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION (EX in: USHORT ProcessorGroup)
SystemFlagsInformation, // q: SYSTEM_FLAGS_INFORMATION
SystemCallTimeInformation, // not implemented // SYSTEM_CALL_TIME_INFORMATION // 10
SystemModuleInformation, // q: RTL_PROCESS_MODULES
SystemLocksInformation, // q: RTL_PROCESS_LOCKS
SystemStackTraceInformation, // q: RTL_PROCESS_BACKTRACES
SystemPagedPoolInformation, // not implemented
SystemNonPagedPoolInformation, // not implemented
SystemHandleInformation, // q: SYSTEM_HANDLE_INFORMATION
SystemObjectInformation, // q: SYSTEM_OBJECTTYPE_INFORMATION mixed with SYSTEM_OBJECT_INFORMATION
SystemPageFileInformation, // q: SYSTEM_PAGEFILE_INFORMATION
SystemVdmInstemulInformation, // q: SYSTEM_VDM_INSTEMUL_INFO
SystemVdmBopInformation, // not implemented // 20
SystemFileCacheInformation, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemCache)
SystemPoolTagInformation, // q: SYSTEM_POOLTAG_INFORMATION
SystemInterruptInformation, // q: SYSTEM_INTERRUPT_INFORMATION (EX in: USHORT ProcessorGroup)
SystemDpcBehaviorInformation, // q: SYSTEM_DPC_BEHAVIOR_INFORMATION; s: SYSTEM_DPC_BEHAVIOR_INFORMATION (requires SeLoadDriverPrivilege)
SystemFullMemoryInformation, // not implemented // SYSTEM_MEMORY_USAGE_INFORMATION
SystemLoadGdiDriverInformation, // s (kernel-mode only)
SystemUnloadGdiDriverInformation, // s (kernel-mode only)
SystemTimeAdjustmentInformation, // q: SYSTEM_QUERY_TIME_ADJUST_INFORMATION; s: SYSTEM_SET_TIME_ADJUST_INFORMATION (requires SeSystemtimePrivilege)
SystemSummaryMemoryInformation, // not implemented // SYSTEM_MEMORY_USAGE_INFORMATION
SystemMirrorMemoryInformation, // s (requires license value "Kernel-MemoryMirroringSupported") (requires SeShutdownPrivilege) // 30
SystemPerformanceTraceInformation, // q; s: (type depends on EVENT_TRACE_INFORMATION_CLASS)
SystemObsolete0, // not implemented
SystemExceptionInformation, // q: SYSTEM_EXCEPTION_INFORMATION
SystemCrashDumpStateInformation, // s: SYSTEM_CRASH_DUMP_STATE_INFORMATION (requires SeDebugPrivilege)
SystemKernelDebuggerInformation, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION
SystemContextSwitchInformation, // q: SYSTEM_CONTEXT_SWITCH_INFORMATION
SystemRegistryQuotaInformation, // q: SYSTEM_REGISTRY_QUOTA_INFORMATION; s (requires SeIncreaseQuotaPrivilege)
SystemExtendServiceTableInformation, // s (requires SeLoadDriverPrivilege) // loads win32k only
SystemPrioritySeparation, // s (requires SeTcbPrivilege)
SystemVerifierAddDriverInformation, // s: UNICODE_STRING (requires SeDebugPrivilege) // 40
SystemVerifierRemoveDriverInformation, // s: UNICODE_STRING (requires SeDebugPrivilege)
SystemProcessorIdleInformation, // q: SYSTEM_PROCESSOR_IDLE_INFORMATION (EX in: USHORT ProcessorGroup)
SystemLegacyDriverInformation, // q: SYSTEM_LEGACY_DRIVER_INFORMATION
SystemCurrentTimeZoneInformation, // q; s: RTL_TIME_ZONE_INFORMATION
SystemLookasideInformation, // q: SYSTEM_LOOKASIDE_INFORMATION
SystemTimeSlipNotification, // s: HANDLE (NtCreateEvent) (requires SeSystemtimePrivilege)
SystemSessionCreate, // not implemented
SystemSessionDetach, // not implemented
SystemSessionInformation, // not implemented (SYSTEM_SESSION_INFORMATION)
SystemRangeStartInformation, // q: SYSTEM_RANGE_START_INFORMATION // 50
SystemVerifierInformation, // q: SYSTEM_VERIFIER_INFORMATION; s (requires SeDebugPrivilege)
SystemVerifierThunkExtend, // s (kernel-mode only)
SystemSessionProcessInformation, // q: SYSTEM_SESSION_PROCESS_INFORMATION
SystemLoadGdiDriverInSystemSpace, // s: SYSTEM_GDI_DRIVER_INFORMATION (kernel-mode only) (same as SystemLoadGdiDriverInformation)
SystemNumaProcessorMap, // q: SYSTEM_NUMA_INFORMATION
SystemPrefetcherInformation, // q; s: PREFETCHER_INFORMATION // PfSnQueryPrefetcherInformation
SystemExtendedProcessInformation, // q: SYSTEM_EXTENDED_PROCESS_INFORMATION
SystemRecommendedSharedDataAlignment, // q: ULONG // KeGetRecommendedSharedDataAlignment
SystemComPlusPackage, // q; s: ULONG
SystemNumaAvailableMemory, // q: SYSTEM_NUMA_INFORMATION // 60
SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION (EX in: USHORT ProcessorGroup)
SystemEmulationBasicInformation, // q: SYSTEM_BASIC_INFORMATION
SystemEmulationProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION
SystemExtendedHandleInformation, // q: SYSTEM_HANDLE_INFORMATION_EX
SystemLostDelayedWriteInformation, // q: ULONG
SystemBigPoolInformation, // q: SYSTEM_BIGPOOL_INFORMATION
SystemSessionPoolTagInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION
SystemSessionMappedViewInformation, // q: SYSTEM_SESSION_MAPPED_VIEW_INFORMATION
SystemHotpatchInformation, // q; s: SYSTEM_HOTPATCH_CODE_INFORMATION
SystemObjectSecurityMode, // q: ULONG // 70
SystemWatchdogTimerHandler, // s: SYSTEM_WATCHDOG_HANDLER_INFORMATION // (kernel-mode only)
SystemWatchdogTimerInformation, // q: SYSTEM_WATCHDOG_TIMER_INFORMATION // NtQuerySystemInformationEx // (kernel-mode only)
SystemLogicalProcessorInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx
SystemWow64SharedInformationObsolete, // not implemented
SystemRegisterFirmwareTableInformationHandler, // s: SYSTEM_FIRMWARE_TABLE_HANDLER // (kernel-mode only)
SystemFirmwareTableInformation, // SYSTEM_FIRMWARE_TABLE_INFORMATION
SystemModuleInformationEx, // q: RTL_PROCESS_MODULE_INFORMATION_EX // since VISTA
SystemVerifierTriageInformation, // not implemented
SystemSuperfetchInformation, // q; s: SUPERFETCH_INFORMATION // PfQuerySuperfetchInformation
SystemMemoryListInformation, // q: SYSTEM_MEMORY_LIST_INFORMATION; s: SYSTEM_MEMORY_LIST_COMMAND (requires SeProfileSingleProcessPrivilege) // 80
SystemFileCacheInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (same as SystemFileCacheInformation)
SystemThreadPriorityClientIdInformation, // s: SYSTEM_THREAD_CID_PRIORITY_INFORMATION (requires SeIncreaseBasePriorityPrivilege) // NtQuerySystemInformationEx
SystemProcessorIdleCycleTimeInformation, // q: SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION[] (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx
SystemVerifierCancellationInformation, // SYSTEM_VERIFIER_CANCELLATION_INFORMATION // name:wow64:whNT32QuerySystemVerifierCancellationInformation
SystemProcessorPowerInformationEx, // not implemented
SystemRefTraceInformation, // q; s: SYSTEM_REF_TRACE_INFORMATION // ObQueryRefTraceInformation
SystemSpecialPoolInformation, // q; s: SYSTEM_SPECIAL_POOL_INFORMATION (requires SeDebugPrivilege) // MmSpecialPoolTag, then MmSpecialPoolCatchOverruns != 0
SystemProcessIdInformation, // q: SYSTEM_PROCESS_ID_INFORMATION
SystemErrorPortInformation, // s (requires SeTcbPrivilege)
SystemBootEnvironmentInformation, // q: SYSTEM_BOOT_ENVIRONMENT_INFORMATION // 90
SystemHypervisorInformation, // q: SYSTEM_HYPERVISOR_QUERY_INFORMATION
SystemVerifierInformationEx, // q; s: SYSTEM_VERIFIER_INFORMATION_EX
SystemTimeZoneInformation, // q; s: RTL_TIME_ZONE_INFORMATION (requires SeTimeZonePrivilege)
SystemImageFileExecutionOptionsInformation, // s: SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION (requires SeTcbPrivilege)
SystemCoverageInformation, // q: COVERAGE_MODULES s: COVERAGE_MODULE_REQUEST // ExpCovQueryInformation (requires SeDebugPrivilege)
SystemPrefetchPatchInformation, // SYSTEM_PREFETCH_PATCH_INFORMATION
SystemVerifierFaultsInformation, // s: SYSTEM_VERIFIER_FAULTS_INFORMATION (requires SeDebugPrivilege)
SystemSystemPartitionInformation, // q: SYSTEM_SYSTEM_PARTITION_INFORMATION
SystemSystemDiskInformation, // q: SYSTEM_SYSTEM_DISK_INFORMATION
SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx // 100
SystemNumaProximityNodeInformation, // q; s: SYSTEM_NUMA_PROXIMITY_MAP
SystemDynamicTimeZoneInformation, // q; s: RTL_DYNAMIC_TIME_ZONE_INFORMATION (requires SeTimeZonePrivilege)
SystemCodeIntegrityInformation, // q: SYSTEM_CODEINTEGRITY_INFORMATION // SeCodeIntegrityQueryInformation
SystemProcessorMicrocodeUpdateInformation, // s: SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION
SystemProcessorBrandString, // q: CHAR[] // HaliQuerySystemInformation -> HalpGetProcessorBrandString, info class 23
SystemVirtualAddressInformation, // q: SYSTEM_VA_LIST_INFORMATION[]; s: SYSTEM_VA_LIST_INFORMATION[] (requires SeIncreaseQuotaPrivilege) // MmQuerySystemVaInformation
SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX (EX in: LOGICAL_PROCESSOR_RELATIONSHIP RelationshipType) // since WIN7 // NtQuerySystemInformationEx // KeQueryLogicalProcessorRelationship
SystemProcessorCycleTimeInformation, // q: SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[] (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx
SystemStoreInformation, // q; s: SYSTEM_STORE_INFORMATION (requires SeProfileSingleProcessPrivilege) // SmQueryStoreInformation
SystemRegistryAppendString, // s: SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // 110
SystemAitSamplingValue, // s: ULONG (requires SeProfileSingleProcessPrivilege)
SystemVhdBootInformation, // q: SYSTEM_VHD_BOOT_INFORMATION
SystemCpuQuotaInformation, // q; s: PS_CPU_QUOTA_QUERY_INFORMATION
SystemNativeBasicInformation, // q: SYSTEM_BASIC_INFORMATION
SystemErrorPortTimeouts, // SYSTEM_ERROR_PORT_TIMEOUTS
SystemLowPriorityIoInformation, // q: SYSTEM_LOW_PRIORITY_IO_INFORMATION
SystemTpmBootEntropyInformation, // q: BOOT_ENTROPY_NT_RESULT // ExQueryBootEntropyInformation
SystemVerifierCountersInformation, // q: SYSTEM_VERIFIER_COUNTERS_INFORMATION
SystemPagedPoolInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypePagedPool)
SystemSystemPtesInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemPtes) // 120
SystemNodeDistanceInformation, // q: USHORT[4*NumaNodes] // (EX in: USHORT NodeNumber) // NtQuerySystemInformationEx
SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26
SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation
SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1
SystemSessionBigPoolInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION // since WIN8
SystemBootGraphicsInformation, // q; s: SYSTEM_BOOT_GRAPHICS_INFORMATION (kernel-mode only)
SystemScrubPhysicalMemoryInformation, // q; s: MEMORY_SCRUB_INFORMATION
SystemBadPageInformation, // SYSTEM_BAD_PAGE_INFORMATION
SystemProcessorProfileControlArea, // q; s: SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA
SystemCombinePhysicalMemoryInformation, // s: MEMORY_COMBINE_INFORMATION, MEMORY_COMBINE_INFORMATION_EX, MEMORY_COMBINE_INFORMATION_EX2 // 130
SystemEntropyInterruptTimingInformation, // q; s: SYSTEM_ENTROPY_TIMING_INFORMATION
SystemConsoleInformation, // q; s: SYSTEM_CONSOLE_INFORMATION
SystemPlatformBinaryInformation, // q: SYSTEM_PLATFORM_BINARY_INFORMATION (requires SeTcbPrivilege)
SystemPolicyInformation, // q: SYSTEM_POLICY_INFORMATION (Warbird/Encrypt/Decrypt/Execute)
SystemHypervisorProcessorCountInformation, // q: SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION
SystemDeviceDataInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION
SystemDeviceDataEnumerationInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION
SystemMemoryTopologyInformation, // q: SYSTEM_MEMORY_TOPOLOGY_INFORMATION
SystemMemoryChannelInformation, // q: SYSTEM_MEMORY_CHANNEL_INFORMATION
SystemBootLogoInformation, // q: SYSTEM_BOOT_LOGO_INFORMATION // 140
SystemProcessorPerformanceInformationEx, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx // since WINBLUE
SystemCriticalProcessErrorLogInformation, // CRITICAL_PROCESS_EXCEPTION_DATA
SystemSecureBootPolicyInformation, // q: SYSTEM_SECUREBOOT_POLICY_INFORMATION
SystemPageFileInformationEx, // q: SYSTEM_PAGEFILE_INFORMATION_EX
SystemSecureBootInformation, // q: SYSTEM_SECUREBOOT_INFORMATION
SystemEntropyInterruptTimingRawInformation, // q; s: SYSTEM_ENTROPY_TIMING_INFORMATION
SystemPortableWorkspaceEfiLauncherInformation, // q: SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION
SystemFullProcessInformation, // q: SYSTEM_EXTENDED_PROCESS_INFORMATION with SYSTEM_PROCESS_INFORMATION_EXTENSION (requires admin)
SystemKernelDebuggerInformationEx, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX
SystemBootMetadataInformation, // 150 // (requires SeTcbPrivilege)
SystemSoftRebootInformation, // q: ULONG
SystemElamCertificateInformation, // s: SYSTEM_ELAM_CERTIFICATE_INFORMATION
SystemOfflineDumpConfigInformation, // q: OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2
SystemProcessorFeaturesInformation, // q: SYSTEM_PROCESSOR_FEATURES_INFORMATION
SystemRegistryReconciliationInformation, // s: NULL (requires admin) (flushes registry hives)
SystemEdidInformation, // q: SYSTEM_EDID_INFORMATION
SystemManufacturingInformation, // q: SYSTEM_MANUFACTURING_INFORMATION // since THRESHOLD
SystemEnergyEstimationConfigInformation, // q: SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION
SystemHypervisorDetailInformation, // q: SYSTEM_HYPERVISOR_DETAIL_INFORMATION
SystemProcessorCycleStatsInformation, // q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx // 160
SystemVmGenerationCountInformation,
SystemTrustedPlatformModuleInformation, // q: SYSTEM_TPM_INFORMATION
SystemKernelDebuggerFlags, // SYSTEM_KERNEL_DEBUGGER_FLAGS
SystemCodeIntegrityPolicyInformation, // q; s: SYSTEM_CODEINTEGRITYPOLICY_INFORMATION
SystemIsolatedUserModeInformation, // q: SYSTEM_ISOLATED_USER_MODE_INFORMATION
SystemHardwareSecurityTestInterfaceResultsInformation,
SystemSingleModuleInformation, // q: SYSTEM_SINGLE_MODULE_INFORMATION
SystemAllowedCpuSetsInformation, // s: SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION
SystemVsmProtectionInformation, // q: SYSTEM_VSM_PROTECTION_INFORMATION (previously SystemDmaProtectionInformation)
SystemInterruptCpuSetsInformation, // q: SYSTEM_INTERRUPT_CPU_SET_INFORMATION // 170
SystemSecureBootPolicyFullInformation, // q: SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION
SystemCodeIntegrityPolicyFullInformation,
SystemAffinitizedInterruptProcessorInformation, // q: KAFFINITY_EX // (requires SeIncreaseBasePriorityPrivilege)
SystemRootSiloInformation, // q: SYSTEM_ROOT_SILO_INFORMATION
SystemCpuSetInformation, // q: SYSTEM_CPU_SET_INFORMATION // since THRESHOLD2
SystemCpuSetTagInformation, // q: SYSTEM_CPU_SET_TAG_INFORMATION
SystemWin32WerStartCallout,
SystemSecureKernelProfileInformation, // q: SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION
SystemCodeIntegrityPlatformManifestInformation, // q: SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION // NtQuerySystemInformationEx // since REDSTONE
SystemInterruptSteeringInformation, // q: in: SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT, out: SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT // NtQuerySystemInformationEx // 180
SystemSupportedProcessorArchitectures, // p: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx
SystemMemoryUsageInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION
SystemCodeIntegrityCertificateInformation, // q: SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION
SystemPhysicalMemoryInformation, // q: SYSTEM_PHYSICAL_MEMORY_INFORMATION // since REDSTONE2
SystemControlFlowTransition, // (Warbird/Encrypt/Decrypt/Execute)
SystemKernelDebuggingAllowed, // s: ULONG
SystemActivityModerationExeState, // SYSTEM_ACTIVITY_MODERATION_EXE_STATE
SystemActivityModerationUserSettings, // SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS
SystemCodeIntegrityPoliciesFullInformation, // NtQuerySystemInformationEx
SystemCodeIntegrityUnlockInformation, // SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION // 190
SystemIntegrityQuotaInformation,
SystemFlushInformation, // q: SYSTEM_FLUSH_INFORMATION
SystemProcessorIdleMaskInformation, // q: ULONG_PTR[ActiveGroupCount] // since REDSTONE3
SystemSecureDumpEncryptionInformation, // NtQuerySystemInformationEx
SystemWriteConstraintInformation, // SYSTEM_WRITE_CONSTRAINT_INFORMATION
SystemKernelVaShadowInformation, // SYSTEM_KERNEL_VA_SHADOW_INFORMATION
SystemHypervisorSharedPageInformation, // SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION // since REDSTONE4
SystemFirmwareBootPerformanceInformation,
SystemCodeIntegrityVerificationInformation, // SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION
SystemFirmwarePartitionInformation, // SYSTEM_FIRMWARE_PARTITION_INFORMATION // 200
SystemSpeculationControlInformation, // SYSTEM_SPECULATION_CONTROL_INFORMATION // (CVE-2017-5715) REDSTONE3 and above.
SystemDmaGuardPolicyInformation, // SYSTEM_DMA_GUARD_POLICY_INFORMATION
SystemEnclaveLaunchControlInformation, // SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION
SystemWorkloadAllowedCpuSetsInformation, // SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION // since REDSTONE5
SystemCodeIntegrityUnlockModeInformation, // SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION
SystemLeapSecondInformation, // SYSTEM_LEAP_SECOND_INFORMATION
SystemFlags2Information, // q: SYSTEM_FLAGS_INFORMATION
SystemSecurityModelInformation, // SYSTEM_SECURITY_MODEL_INFORMATION // since 19H1
SystemCodeIntegritySyntheticCacheInformation, // NtQuerySystemInformationEx
SystemFeatureConfigurationInformation, // q: in: SYSTEM_FEATURE_CONFIGURATION_QUERY, out: SYSTEM_FEATURE_CONFIGURATION_INFORMATION; s: SYSTEM_FEATURE_CONFIGURATION_UPDATE // NtQuerySystemInformationEx // since 20H1 // 210
SystemFeatureConfigurationSectionInformation, // q: in: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST, out: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION // NtQuerySystemInformationEx
SystemFeatureUsageSubscriptionInformation, // q: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS; s: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE
SystemSecureSpeculationControlInformation, // SECURE_SPECULATION_CONTROL_INFORMATION
SystemSpacesBootInformation, // since 20H2
SystemFwRamdiskInformation, // SYSTEM_FIRMWARE_RAMDISK_INFORMATION
SystemWheaIpmiHardwareInformation,
SystemDifSetRuleClassInformation, // SYSTEM_DIF_VOLATILE_INFORMATION
SystemDifClearRuleClassInformation,
SystemDifApplyPluginVerificationOnDriver, // SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION
SystemDifRemovePluginVerificationOnDriver, // SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION // 220
SystemShadowStackInformation, // SYSTEM_SHADOW_STACK_INFORMATION
SystemBuildVersionInformation, // q: in: ULONG (LayerNumber), out: SYSTEM_BUILD_VERSION_INFORMATION // NtQuerySystemInformationEx // 222
SystemPoolLimitInformation, // SYSTEM_POOL_LIMIT_INFORMATION (requires SeIncreaseQuotaPrivilege) // NtQuerySystemInformationEx
SystemCodeIntegrityAddDynamicStore,
SystemCodeIntegrityClearDynamicStores,
SystemDifPoolTrackingInformation,
SystemPoolZeroingInformation, // q: SYSTEM_POOL_ZEROING_INFORMATION
SystemDpcWatchdogInformation, // q; s: SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION
SystemDpcWatchdogInformation2, // q; s: SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION_V2
SystemSupportedProcessorArchitectures2, // q: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx // 230
SystemSingleProcessorRelationshipInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // (EX in: PROCESSOR_NUMBER Processor) // NtQuerySystemInformationEx
SystemXfgCheckFailureInformation, // q: SYSTEM_XFG_FAILURE_INFORMATION
SystemIommuStateInformation, // SYSTEM_IOMMU_STATE_INFORMATION // since 22H1
SystemHypervisorMinrootInformation, // SYSTEM_HYPERVISOR_MINROOT_INFORMATION
SystemHypervisorBootPagesInformation, // SYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION
SystemPointerAuthInformation, // SYSTEM_POINTER_AUTH_INFORMATION
SystemSecureKernelDebuggerInformation, // NtQuerySystemInformationEx
SystemOriginalImageFeatureInformation, // q: in: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT, out: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT // NtQuerySystemInformationEx
SystemMemoryNumaInformation, // SYSTEM_MEMORY_NUMA_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT // NtQuerySystemInformationEx
SystemMemoryNumaPerformanceInformation, // SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUTSYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT // since 24H2 // 240
SystemCodeIntegritySignedPoliciesFullInformation,
SystemSecureCoreInformation, // SystemSecureSecretsInformation
SystemTrustedAppsRuntimeInformation, // SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION
SystemBadPageInformationEx, // SYSTEM_BAD_PAGE_INFORMATION
SystemResourceDeadlockTimeout, // ULONG
SystemBreakOnContextUnwindFailureInformation, // ULONG (requires SeDebugPrivilege)
SystemOslRamdiskInformation, // SYSTEM_OSL_RAMDISK_INFORMATION
SystemCodeIntegrityPolicyManagementInformation, // since 25H2
SystemMemoryNumaCacheInformation,
SystemProcessorFeaturesBitMapInformation,
MaxSystemInfoClass
} SYSTEM_INFORMATION_CLASS;
#define IMAGE_REL_TYPE IMAGE_REL_BASED_DIR64
typedef struct {
WORD Offset :12;
WORD Type :4;
} IMAGE_RELOC, *PIMAGE_RELOC;
typedef unsigned char UBYTE;
typedef union _UNWIND_CODE {
struct {
UBYTE CodeOffset; // 0xFF00
UBYTE UnwindOp : 4; // 0x000f OPCODE
UBYTE OpInfo : 4; // 0x00f0
};
USHORT FrameOffset;
} UNWIND_CODE, * PUNWIND_CODE;
typedef struct _UNWIND_INFO {
UBYTE Version : 3;
UBYTE Flags : 5; // 4 bytes
UBYTE SizeOfProlog; // 4 bytes
UBYTE CountOfCodes; // 4 bytes
UBYTE FrameRegister : 4;
UBYTE FrameOffset : 4; // 4bytes
UNWIND_CODE UnwindCode[1];
union {
OPTIONAL ULONG ExceptionHandler;
OPTIONAL ULONG FunctionEntry;
};
OPTIONAL ULONG ExceptionData[];
} UNWIND_INFO, * PUNWIND_INFO;
struct _REG_CTX {
UPTR Rax;
UPTR Rcx;
UPTR Rdx;
UPTR Rsp;
UPTR Rbp;
UPTR Rsi;
UPTR Rdi;
UPTR R8;
UPTR R9;
UPTR R10;
UPTR R11;
UPTR R12;
UPTR R13;
UPTR R14;
UPTR R15;
UPTR Rip;
UPTR Reserved;
UPTR StackSize;
};
typedef _REG_CTX REG_CTX;
typedef enum _UNWIND_OP_CODES {
// x86_64. https://docs.microsoft.com/en-us/cpp/build/exception-handling-x64.
UWOP_PUSH_NONVOL = 0,
UWOP_ALLOC_LARGE, // 1
UWOP_ALLOC_SMALL, // 2
UWOP_SET_FPREG, // 3
UWOP_SAVE_NONVOL, // 4
UWOP_SAVE_NONVOL_BIG, // 5
UWOP_EPILOG, // 6
UWOP_SPARE_CODE, // 7
UWOP_SAVE_XMM128, // 8
UWOP_SAVE_XMM128BIG, // 9
UWOP_PUSH_MACH_FRAME, // 10
// ARM64. https://docs.microsoft.com/en-us/cpp/build/arm64-exception-handling
UWOP_ALLOC_MEDIUM,
UWOP_SAVE_R19R20X,
UWOP_SAVE_FPLRX,
UWOP_SAVE_FPLR,
UWOP_SAVE_REG,
UWOP_SAVE_REGX,
UWOP_SAVE_REGP,
UWOP_SAVE_REGPX,
UWOP_SAVE_LRPAIR,
UWOP_SAVE_FREG,
UWOP_SAVE_FREGX,
UWOP_SAVE_FREGP,
UWOP_SAVE_FREGPX,
UWOP_SET_FP,
UWOP_ADD_FP,
UWOP_NOP,
UWOP_END,
UWOP_SAVE_NEXT,
UWOP_TRAP_FRAME,
UWOP_CONTEXT,
UWOP_CLEAR_UNWOUND_TO_CALL,
// ARM: https://docs.microsoft.com/en-us/cpp/build/arm-exception-handling
UWOP_ALLOC_HUGE,
UWOP_WIDE_ALLOC_MEDIUM,
UWOP_WIDE_ALLOC_LARGE,
UWOP_WIDE_ALLOC_HUGE,
UWOP_WIDE_SAVE_REG_MASK,
UWOP_WIDE_SAVE_SP,
UWOP_SAVE_REGS_R4R7LR,
UWOP_WIDE_SAVE_REGS_R4R11LR,
UWOP_SAVE_FREG_D8D15,
UWOP_SAVE_REG_MASK,
UWOP_SAVE_LR,
UWOP_SAVE_FREG_D0D15,
UWOP_SAVE_FREG_D16D31,
UWOP_WIDE_NOP, // UWOP_NOP
UWOP_END_NOP, // UWOP_END
UWOP_WIDE_END_NOP,
// Custom implementation opcodes (implementation specific).
UWOP_CUSTOM,
} UNWIND_OP_CODES;
enum OpInf {
Rax,
Rcx,
Rdx,
Rbx,
Rsp,
Rbp,
Rsi,
Rdi,
R8,
R9,
R10,
R11,
R12,
R13,
R14,
R15
};
typedef struct _WORKER_FACTORY_BASIC_INFORMATION
{
LARGE_INTEGER Timeout;
LARGE_INTEGER RetryTimeout;
LARGE_INTEGER IdleTimeout;
BOOLEAN Paused;
BOOLEAN TimerSet;
BOOLEAN QueuedToExWorker;
BOOLEAN MayCreate;
BOOLEAN CreateInProgress;
BOOLEAN InsertedIntoQueue;
BOOLEAN Shutdown;
ULONG BindingCount;
ULONG ThreadMinimum;
ULONG ThreadMaximum;
ULONG PendingWorkerCount;
ULONG WaitingWorkerCount;
ULONG TotalWorkerCount;
ULONG ReleaseCount;
LONGLONG InfiniteWaitGoal;
PVOID StartRoutine;
PVOID StartParameter;
HANDLE ProcessId;
SIZE_T StackReserve;
SIZE_T StackCommit;
NTSTATUS LastThreadCreationStatus;
} WORKER_FACTORY_BASIC_INFORMATION, *PWORKER_FACTORY_BASIC_INFORMATION;
typedef struct
{
ULONG ExtendedProcessInfo;
ULONG ExtendedProcessInfoBuffer;
} EXTENDED_PROCESS_INFORMATION, *PEXTENDED_PROCESS_INFORMATION;
typedef struct _VM_INFORMATION
{
DWORD dwNumberOfOffsets;
PULONG plOutput;
PCFG_CALL_TARGET_INFO ptOffsets;
PVOID pMustBeZero;
PVOID pMoarZero;
} VM_INFORMATION, * PVM_INFORMATION;
typedef struct _TP_TASK_CALLBACKS
{
void* ExecuteCallback;
void* Unposted;
} TP_TASK_CALLBACKS, * PTP_TASK_CALLBACKS;
typedef struct _TP_TASK
{
struct _TP_TASK_CALLBACKS* Callbacks;
UINT32 NumaNode;
UINT8 IdealProcessor;
char Padding_242[3];
struct _LIST_ENTRY ListEntry;
} TP_TASK, * PTP_TASK;
typedef struct _TPP_REFCOUNT
{
volatile INT32 Refcount;
} TPP_REFCOUNT, * PTPP_REFCOUNT;
typedef struct _TPP_CALLER
{
void* ReturnAddress;
} TPP_CALLER, * PTPP_CALLER;
typedef struct _TPP_PH
{
struct _TPP_PH_LINKS* Root;
} TPP_PH, * PTPP_PH;
typedef struct _TP_DIRECT
{
struct _TP_TASK Task;
UINT64 Lock;
struct _LIST_ENTRY IoCompletionInformationList;
void* Callback;
UINT32 NumaNode;
UINT8 IdealProcessor;
char __PADDING__[3];
} TP_DIRECT, * PTP_DIRECT;
typedef struct _TPP_TIMER_SUBQUEUE
{
INT64 Expiration;
struct _TPP_PH WindowStart;
struct _TPP_PH WindowEnd;
void* Timer;
void* TimerPkt;
struct _TP_DIRECT Direct;
UINT32 ExpirationWindow;
INT32 __PADDING__[1];
} TPP_TIMER_SUBQUEUE, * PTPP_TIMER_SUBQUEUE;
typedef struct _TPP_TIMER_QUEUE
{
struct _RTL_SRWLOCK Lock;
struct _TPP_TIMER_SUBQUEUE AbsoluteQueue;
struct _TPP_TIMER_SUBQUEUE RelativeQueue;
INT32 AllocatedTimerCount;
INT32 __PADDING__[1];
} TPP_TIMER_QUEUE, * PTPP_TIMER_QUEUE;
typedef struct _TPP_NUMA_NODE
{
INT32 WorkerCount;
} TPP_NUMA_NODE, * PTPP_NUMA_NODE;
typedef union _TPP_POOL_QUEUE_STATE
{
union
{
INT64 Exchange;
struct
{
INT32 RunningThreadGoal : 16;
UINT32 PendingReleaseCount : 16;
UINT32 QueueLength;
};
};
} TPP_POOL_QUEUE_STATE, * PTPP_POOL_QUEUE_STATE;
typedef struct _TPP_QUEUE
{
struct _LIST_ENTRY Queue;
struct _RTL_SRWLOCK Lock;
} TPP_QUEUE, * PTPP_QUEUE;
typedef struct _SYSTEM_SECUREBOOT_POLICY_INFORMATION
{
GUID PolicyPublisher;
ULONG PolicyVersion;
ULONG PolicyOptions;
} SYSTEM_SECUREBOOT_POLICY_INFORMATION, *PSYSTEM_SECUREBOOT_POLICY_INFORMATION;
#define MEM_EXECUTE_OPTION_ENABLE 0x2 // ignore the NX bit: DEP off, enable executing most of ro/rw memory; trumps over the _DISABLE option
typedef struct _FULL_TP_POOL
{
struct _TPP_REFCOUNT Refcount;
long Padding_239;
union _TPP_POOL_QUEUE_STATE QueueState;
struct _TPP_QUEUE* TaskQueue[3];
struct _TPP_NUMA_NODE* NumaNode;
struct _GROUP_AFFINITY* ProximityInfo;
void* WorkerFactory;
void* CompletionPort;
struct _RTL_SRWLOCK Lock;
struct _LIST_ENTRY PoolObjectList;
struct _LIST_ENTRY WorkerList;
struct _TPP_TIMER_QUEUE TimerQueue;
struct _RTL_SRWLOCK ShutdownLock;
UINT8 ShutdownInitiated;
UINT8 Released;
UINT16 PoolFlags;
long Padding_240;
struct _LIST_ENTRY PoolLinks;
struct _TPP_CALLER AllocCaller;
struct _TPP_CALLER ReleaseCaller;
volatile INT32 AvailableWorkerCount;
volatile INT32 LongRunningWorkerCount;
UINT32 LastProcCount;
volatile INT32 NodeStatus;
volatile INT32 BindingCount;
UINT32 CallbackChecksDisabled : 1;
UINT32 TrimTarget : 11;
UINT32 TrimmedThrdCount : 11;
UINT32 SelectedCpuSetCount;
long Padding_241;
struct _RTL_CONDITION_VARIABLE TrimComplete;
struct _LIST_ENTRY TrimmedWorkerList;
} FULL_TP_POOL, * PFULL_TP_POOL;
typedef struct _ALPC_WORK_ON_BEHALF_TICKET
{
UINT32 ThreadId;
UINT32 ThreadCreationTimeLow;
} ALPC_WORK_ON_BEHALF_TICKET, * PALPC_WORK_ON_BEHALF_TICKET;
typedef union _TPP_WORK_STATE
{
union
{
INT32 Exchange;
UINT32 Insertable : 1;
UINT32 PendingCallbackCount : 31;
};
} TPP_WORK_STATE, * PTPP_WORK_STATE;
typedef struct _TPP_ITE_WAITER
{
struct _TPP_ITE_WAITER* Next;
void* ThreadId;
} TPP_ITE_WAITER, * PTPP_ITE_WAITER;
typedef struct _TPP_PH_LINKS
{
struct _LIST_ENTRY Siblings;
struct _LIST_ENTRY Children;
INT64 Key;
} TPP_PH_LINKS, * PTPP_PH_LINKS;
typedef struct _TPP_ITE
{
struct _TPP_ITE_WAITER* First;
} TPP_ITE, * PTPP_ITE;
typedef union _TPP_FLAGS_COUNT
{
union
{
UINT64 Count : 60;
UINT64 Flags : 4;
INT64 Data;
};
} TPP_FLAGS_COUNT, * PTPP_FLAGS_COUNT;
typedef struct _TPP_BARRIER
{
volatile union _TPP_FLAGS_COUNT Ptr;
struct _RTL_SRWLOCK WaitLock;
struct _TPP_ITE WaitList;
} TPP_BARRIER, * PTPP_BARRIER;
typedef struct _TP_CLEANUP_GROUP
{
struct _TPP_REFCOUNT Refcount;
INT32 Released;
struct _RTL_SRWLOCK MemberLock;
struct _LIST_ENTRY MemberList;
struct _TPP_BARRIER Barrier;
struct _RTL_SRWLOCK CleanupLock;
struct _LIST_ENTRY CleanupList;
} TP_CLEANUP_GROUP, * PTP_CLEANUP_GROUP;
typedef struct _TPP_CLEANUP_GROUP_MEMBER
{
struct _TPP_REFCOUNT Refcount;
long Padding_233;
const struct _TPP_CLEANUP_GROUP_MEMBER_VFUNCS* VFuncs;
struct _TP_CLEANUP_GROUP* CleanupGroup;
void* CleanupGroupCancelCallback;
void* FinalizationCallback;
struct _LIST_ENTRY CleanupGroupMemberLinks;
struct _TPP_BARRIER CallbackBarrier;
union
{
void* Callback;
void* WorkCallback;
void* SimpleCallback;
void* TimerCallback;
void* WaitCallback;
void* IoCallback;
void* AlpcCallback;
void* AlpcCallbackEx;
void* JobCallback;
};
void* Context;
struct _ACTIVATION_CONTEXT* ActivationContext;
void* SubProcessTag;
struct _GUID ActivityId;
struct _ALPC_WORK_ON_BEHALF_TICKET WorkOnBehalfTicket;
void* RaceDll;
FULL_TP_POOL* Pool;
struct _LIST_ENTRY PoolObjectLinks;
union
{
volatile INT32 Flags;
UINT32 LongFunction : 1;
UINT32 Persistent : 1;
UINT32 UnusedPublic : 14;
UINT32 Released : 1;
UINT32 CleanupGroupReleased : 1;
UINT32 InCleanupGroupCleanupList : 1;
UINT32 UnusedPrivate : 13;
};
long Padding_234;
struct _TPP_CALLER AllocCaller;
struct _TPP_CALLER ReleaseCaller;
enum _TP_CALLBACK_PRIORITY CallbackPriority;
INT32 __PADDING__[1];
} TPP_CLEANUP_GROUP_MEMBER, * PTPP_CLEANUP_GROUP_MEMBER;
typedef struct _FULL_TP_WORK
{
struct _TPP_CLEANUP_GROUP_MEMBER CleanupGroupMember;
struct _TP_TASK Task;
volatile union _TPP_WORK_STATE WorkState;
INT32 __PADDING__[1];
} FULL_TP_WORK, * PFULL_TP_WORK;
typedef struct _FULL_TP_TIMER
{
struct _FULL_TP_WORK Work;
struct _RTL_SRWLOCK Lock;
union
{
struct _TPP_PH_LINKS WindowEndLinks;
struct _LIST_ENTRY ExpirationLinks;
};
struct _TPP_PH_LINKS WindowStartLinks;
INT64 DueTime;
struct _TPP_ITE Ite;
UINT32 Window;
UINT32 Period;
UINT8 Inserted;
UINT8 WaitTimer;
union
{
UINT8 TimerStatus;
UINT8 InQueue : 1;
UINT8 Absolute : 1;
UINT8 Cancelled : 1;
};
UINT8 BlockInsert;
INT32 __PADDING__[1];
} FULL_TP_TIMER, * PFULL_TP_TIMER;
typedef struct _FULL_TP_WAIT
{
struct _FULL_TP_TIMER Timer;
void* Handle;
void* WaitPkt;
void* NextWaitHandle;
union _LARGE_INTEGER NextWaitTimeout;
struct _TP_DIRECT Direct;
union
{
union
{
UINT8 AllFlags;
UINT8 NextWaitActive : 1;
UINT8 NextTimeoutActive : 1;
UINT8 CallbackCounted : 1;
UINT8 Spare : 5;
};
} WaitFlags;
char __PADDING__[7];
} FULL_TP_WAIT, * PFULL_TP_WAIT;
typedef struct _FULL_TP_IO
{
struct _TPP_CLEANUP_GROUP_MEMBER CleanupGroupMember;
struct _TP_DIRECT Direct;
void* File;
volatile INT32 PendingIrpCount;
INT32 __PADDING__[1];
} FULL_TP_IO, * PFULL_TP_IO;
typedef struct _FULL_TP_ALPC
{
struct _TP_DIRECT Direct;
struct _TPP_CLEANUP_GROUP_MEMBER CleanupGroupMember;
void* AlpcPort;
INT32 DeferredSendCount;
INT32 LastConcurrencyCount;
union
{
UINT32 Flags;
UINT32 ExTypeCallback : 1;
UINT32 CompletionListRegistered : 1;
UINT32 Reserved : 30;
};
INT32 __PADDING__[1];
} FULL_TP_ALPC, * PFULL_TP_ALPC;
typedef enum _WORKERFACTORYINFOCLASS
{
WorkerFactoryTimeout, // LARGE_INTEGER
WorkerFactoryRetryTimeout, // LARGE_INTEGER
WorkerFactoryIdleTimeout, // s: LARGE_INTEGER
WorkerFactoryBindingCount, // s: ULONG
WorkerFactoryThreadMinimum, // s: ULONG
WorkerFactoryThreadMaximum, // s: ULONG
WorkerFactoryPaused, // ULONG or BOOLEAN
WorkerFactoryBasicInformation, // q: WORKER_FACTORY_BASIC_INFORMATION
WorkerFactoryAdjustThreadGoal,
WorkerFactoryCallbackType,
WorkerFactoryStackInformation, // 10
WorkerFactoryThreadBasePriority, // s: ULONG
WorkerFactoryTimeoutWaiters, // s: ULONG, since THRESHOLD
WorkerFactoryFlags, // s: ULONG
WorkerFactoryThreadSoftMaximum, // s: ULONG
WorkerFactoryThreadCpuSets, // since REDSTONE5
MaxWorkerFactoryInfoClass
} WORKERFACTORYINFOCLASS, *PWORKERFACTORYINFOCLASS;
#define FILE_DISPOSITION_DELETE 0x00000001
#define FILE_DISPOSITION_POSIX_SEMANTICS 0x00000002
#define FileDispositionInfoEx 21
typedef struct _SYSTEM_CODEINTEGRITY_INFORMATION {
ULONG Length;
ULONG CodeIntegrityOptions;
} SYSTEM_CODEINTEGRITY_INFORMATION, *PSYSTEM_CODEINTEGRITY_INFORMATION;
#define CODEINTEGRITY_OPTION_ENABLED 0x0001
#define CODEINTEGRITY_OPTION_TESTSIGN 0x0002
#define CODEINTEGRITY_OPTION_UMCI_ENABLED 0x0004
#define CODEINTEGRITY_OPTION_UMCI_AUDITMODE_ENABLED 0x0008
#define CODEINTEGRITY_OPTION_UMCI_EXCLUSIONPATHS_ENABLED 0x0010
#define CODEINTEGRITY_OPTION_TEST_BUILD 0x0020
#define CODEINTEGRITY_OPTION_PREPRODUCTION_BUILD 0x0040
#define CODEINTEGRITY_OPTION_DEBUGMODE_ENABLED 0x0080
#define CODEINTEGRITY_OPTION_FLIGHT_BUILD 0x0100
#define CODEINTEGRITY_OPTION_FLIGHTING_ENABLED 0x0200
#define CODEINTEGRITY_OPTION_HVCI_KMCI_ENABLED 0x0400
#define CODEINTEGRITY_OPTION_HVCI_KMCI_AUDITMODE_ENABLED 0x0800
#define CODEINTEGRITY_OPTION_HVCI_KMCI_STRICTMODE_ENABLED 0x1000
#define CODEINTEGRITY_OPTION_HVCI_IUM_ENABLED 0x2000
typedef struct _SYSTEM_SECUREBOOT_INFORMATION {
BOOLEAN SecureBootEnabled;
BOOLEAN SecureBootCapable;
} SYSTEM_SECUREBOOT_INFORMATION, *PSYSTEM_SECUREBOOT_INFORMATION;
/* ========== [ Expands ] ========== */
#define THREAD_CREATE_FLAGS_CREATE_SUSPENDED 0x00000001 // NtCreateUserProcess & NtCreateThreadEx
#define NtCurrentProcessId() HandleToUlong( NtCurrentTeb()->ClientId.UniqueProcess )
#define NtCurrentProcess() ( (HANDLE) (LONG_PTR)-1 )
#define NtCurrentThread() ( (HANDLE) (LONG_PTR)-2 )
#define NtCurrentPeb() ( NtCurrentTeb()->ProcessEnvironmentBlock )
#define NT_SUCCESS( Status ) ( ( (NTSTATUS) (Status) ) >= 0 )
/* ========== [ Functions ] ========== */
WINAPI void DeleteProcThreadAttributeList( LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList );
WINAPI BOOL UpdateProcThreadAttribute( LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList, DWORD dwFlags, DWORD_PTR Attribute, PVOID lpValue, SIZE_T cbSize, PVOID lpPreviousValue, PSIZE_T lpReturnSize );
WINAPI BOOL InitializeProcThreadAttributeList( LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList, DWORD dwAttributeCount, DWORD dwFlags, PSIZE_T lpSize );
WINAPI HANDLE CreateFileTransactedA( LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile, HANDLE hTransaction, PUSHORT pusMiniVersion, PVOID lpExtendedParameter );
WINAPI HANDLE CreateTransaction( LPSECURITY_ATTRIBUTES lpTransactionAttributes, LPGUID UOW, DWORD CreateOptions, DWORD IsolationLevel, DWORD IsolationFlags, DWORD Timeout, LPWSTR Description );
NTSYSAPI NTSTATUS NTAPI NtSetInformationWorkerFactory(_In_ HANDLE WorkerFactoryHandle,_In_ WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,_In_reads_bytes_(WorkerFactoryInformationLength) PVOID WorkerFactoryInformation,_In_ ULONG WorkerFactoryInformationLength);
NTSYSAPI NTSTATUS NTAPI NtCreateWorkerFactory( _Out_ PHANDLE WorkerFactoryHandleReturn,_In_ ACCESS_MASK DesiredAccess,_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,_In_ HANDLE CompletionPortHandle,_In_ HANDLE WorkerProcessHandle,_In_ PVOID StartRoutine,_In_opt_ PVOID StartParameter,_In_opt_ ULONG MaxThreadCount,_In_opt_ SIZE_T StackReserve,_In_opt_ SIZE_T StackCommit);
NTSYSAPI NTSTATUS NTAPI NtQueryInformationWorkerFactory( _In_ HANDLE WorkerFactoryHandle,_In_ WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,_Out_writes_bytes_(WorkerFactoryInformationLength) PVOID WorkerFactoryInformation,_In_ ULONG WorkerFactoryInformationLength,_Out_opt_ PULONG ReturnLength);
NTSYSAPI ULONG NTAPI DbgPrint( PCSTR Format, ... );
NTSYSAPI NTSTATUS NTAPI NtClose( _In_ HANDLE Handle );
NTSYSAPI PVOID NTAPI RtlAllocateHeap( _In_ PVOID HeapHandle, _In_opt_ ULONG Flags, _In_ SIZE_T Size );
NTSYSAPI PVOID NTAPI RtlReAllocateHeap( _In_ PVOID HeapHandle, _In_ ULONG Flags, PVOID BaseAddress, _In_ SIZE_T Size );
NTSYSAPI ULONG NTAPI RtlFreeHeap( _In_ PVOID HeapHandle, _In_opt_ ULONG Flags, PVOID BaseAddress );
NTSYSAPI NTSTATUS NTAPI NtAllocateVirtualMemory( _In_ HANDLE ProcessHandle, _Inout_ _At_(*BaseAddress, _Readable_bytes_(*RegionSize) _Writable_bytes_(*RegionSize) _Post_readable_byte_size_(*RegionSize)) PVOID *BaseAddress, _In_ ULONG_PTR ZeroBits, _Inout_ SIZE_T* RegionSize, _In_ ULONG AllocationType, _In_ ULONG PageProtection );
NTSYSAPI ULONG NTAPI RtlRandomEx( _Inout_ PULONG Seed );
NTSYSAPI NTSTATUS NTAPI NtWriteVirtualMemory( _In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, _In_reads_bytes_(NumberOfBytesToWrite) PVOID Buffer, _In_ SIZE_T NumberOfBytesToWrite, _Out_opt_ SIZE_T* NumberOfBytesWritten );
NTSYSAPI NTSTATUS NTAPI NtFreeVirtualMemory( _In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ SIZE_T* RegionSize, _In_ ULONG FreeType );
NTSYSAPI NTSTATUS NTAPI NtProtectVirtualMemory( _In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ SIZE_T* RegionSize, _In_ ULONG NewProtection, _Out_ ULONG* OldProtection );
NTSYSAPI NTSTATUS NTAPI NtCreateSection( _Out_ HANDLE* SectionHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ LARGE_INTEGER* MaximumSize, _In_ ULONG SectionPageProtection, _In_ ULONG AllocationAttributes, _In_opt_ HANDLE FileHandle );
NTSYSAPI NTSTATUS NTAPI NtMapViewOfSection( _In_ HANDLE SectionHandle, _In_ HANDLE ProcessHandle, _Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID *BaseAddress, _In_ ULONG_PTR ZeroBits, _In_ SIZE_T CommitSize, _Inout_opt_ LARGE_INTEGER* SectionOffset, _Inout_ SIZE_T* ViewSize, _In_ SECTION_INHERIT InheritDisposition, _In_ ULONG AllocationType, _In_ ULONG PageProtection );
// NTSYSAPI void NTAPI RtlCopyMemory( void* Destination, const void* Source, size_t Length );
// NTSYSAPI void NTAPI RtlFillMemory( void* Destination, size_t Length, int Fill );
NTSYSAPI NTSTATUS NTAPI NtOpenProcess( _Out_ HANDLE* ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_ PCOBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PCLIENT_ID ClientId );
NTSYSAPI NTSTATUS NTAPI NtOpenThread( _Out_ HANDLE* ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ PCOBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PCLIENT_ID ClientId );
NTSYSAPI NTSTATUS NTAPI NtCreateThreadEx( _Out_ HANDLE* ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ProcessHandle, _In_ PUSER_THREAD_START_ROUTINE StartRoutine, _In_opt_ PVOID Argument, _In_ ULONG CreateFlags, _In_ SIZE_T ZeroBits, _In_ SIZE_T StackSize, _In_ SIZE_T MaximumStackSize, _In_opt_ PPS_ATTRIBUTE_LIST AttributeList );
NTSYSAPI VOID NTAPI RtlExitUserThread( _In_ NTSTATUS ExitStatus );
NTSYSAPI VOID NTAPI RtlExitUserProcess( _In_ NTSTATUS ExitStatus );
NTSYSAPI NTSTATUS NTAPI NtGetContextThread( _In_ HANDLE ThreadHandle, _Inout_ PCONTEXT ThreadContext );
NTSYSAPI NTSTATUS NTAPI NtSetContextThread( _In_ HANDLE ThreadHandle, _In_ PCONTEXT ThreadContext );
NTSYSAPI NTSTATUS NTAPI NtCreateEvent( _Out_ HANDLE* EventHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ EVENT_TYPE EventType, _In_ BOOLEAN InitialState );
NTSYSAPI NTSTATUS NTAPI NtContinue( _In_ PCONTEXT ContextRecord, _In_ BOOLEAN TestAlert );
NTSYSAPI NTSTATUS NTAPI NtWaitForSingleObject( _In_ HANDLE Handle, _In_ BOOLEAN Alertable, _In_opt_ LARGE_INTEGER* Timeout );
NTSYSAPI NTSTATUS NTAPI NtSignalAndWaitForSingleObject( _In_ HANDLE SignalHandle, _In_ HANDLE WaitHandle, _In_ BOOLEAN Alertable, _In_opt_ LARGE_INTEGER* Timeout );
NTSYSAPI NTSTATUS NTAPI NtTestAlert( VOID );
NTSYSAPI NTSTATUS NTAPI NtAlertResumeThread( _In_ HANDLE ThreadHandle, _Out_opt_ ULONG* PreviousSuspendCount );
NTSYSAPI NTSTATUS NTAPI NtQueueApcThread( _In_ HANDLE ThreadHandle, _In_ PPS_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcArgument1, _In_opt_ PVOID ApcArgument2, _In_opt_ PVOID ApcArgument3 );
NTSYSAPI NTSTATUS NTAPI RtlCreateTimer( _In_ HANDLE TimerQueueHandle, _Out_ HANDLE* Handle, _In_ WAITORTIMERCALLBACKFUNC Function, _In_opt_ PVOID Context, _In_ ULONG DueTime, _In_ ULONG Period, _In_ ULONG Flags );
NTSYSAPI NTSTATUS NTAPI RtlCreateTimerQueue( _Out_ HANDLE* TimerQueueHandle );
NTSYSAPI NTSTATUS NTAPI RtlDeleteTimer( _In_ HANDLE TimerQueueHandle, _In_ HANDLE TimerToCancel, _In_opt_ HANDLE Event );
NTSYSAPI NTSTATUS NTAPI RtlDeleteTimerQueue( _In_ HANDLE TimerQueueHandle );
NTSYSAPI NTSTATUS NTAPI NtSetInformationVirtualMemory( _In_ HANDLE ProcessHandle, _In_ VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass, _In_ SIZE_T NumberOfEntries, _In_reads_(NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses, _In_reads_bytes_(VmInformationLength) PVOID VmInformation, _In_ ULONG VmInformationLength );
NTSYSAPI NTSTATUS NTAPI LdrGetProcedureAddress( HMODULE ModuleHandle, PANSI_STRING FunctionName OPTIONAL, WORD Oridinal, PVOID *FunctionAddress );
NTSYSAPI NTSTATUS NTAPI LdrLoadDll( PWCHAR PathToFile, ULONG Flags, PUNICODE_STRING ModuleFileName, HANDLE* ModuleHandle );
NTSYSAPI NTSTATUS NTAPI NtQueryInformationProcess( _In_ HANDLE ProcessHandle, _In_ INT8 ProcessInformationClass, PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ ULONG* ReturnLength );
NTSYSAPI NTSTATUS NTAPI NtSetEvent( _In_ HANDLE EventHandle, _Out_opt_ PLONG PreviousState );
NTSYSAPI NTSTATUS NTAPI NtQueryInformationToken( _In_ HANDLE TokenHandle, _In_ TOKEN_INFORMATION_CLASS TokenInformationClass, PVOID TokenInformation, _In_ ULONG TokenInformationLength, _Out_ ULONG* ReturnLength );
NTSYSAPI NTSTATUS NTAPI NtQuerySystemInformation( _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, _In_ ULONG SystemInformationLength, _Out_opt_ ULONG* ReturnLength );
NTSYSAPI NTSTATUS NTAPI SystemFunction040( PVOID Memory, ULONG MemorySize, ULONG OptionFlags );
NTSYSAPI NTSTATUS NTAPI SystemFunction041( PVOID Memory, ULONG MemorySize, ULONG OptionFlags );
NTSYSAPI ULONG NTAPI RtlNtStatusToDosError( NTSTATUS Status );
NTSYSAPI NTSTATUS NTAPI RtlInitializeCriticalSection( _Out_ RTL_CRITICAL_SECTION* CriticalSection );
NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection( _Inout_ RTL_CRITICAL_SECTION* CriticalSection );
NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection( _Inout_ RTL_CRITICAL_SECTION* CriticalSection );
NTSYSAPI NTSTATUS NTAPI RtlDeleteCriticalSection( _Inout_ RTL_CRITICAL_SECTION* CriticalSection );
NTSYSAPI PVOID NTAPI RtlAddVectoredContinueHandler( _In_ ULONG First, _In_ PVECTORED_EXCEPTION_HANDLER Handler );
NTSYSAPI PVOID NTAPI RtlAddVectoredExceptionHandler( _In_ ULONG First, _In_ PVECTORED_EXCEPTION_HANDLER Handler );
NTSYSAPI ULONG NTAPI RtlRemoveVectoredContinueHandler( _In_ PVOID Handle );
NTSYSAPI ULONG NTAPI RtlRemoveVectoredExceptionHandler( _In_ PVOID Handle );
NTSYSAPI ULONG NTAPI khRtlFillMemory( void* Destination, size_t Length, int Fill );
WINAPI BOOL EnumProcessModules( HANDLE hProcess, HMODULE *lphModule, DWORD cb, LPDWORD lpcbNeeded );
WINAPI DWORD K32GetModuleFileNameExA( HANDLE hProcess, HMODULE hModule, LPSTR lpFilename, DWORD nSize );
NTSYSAPI NTSTATUS NTAPI RtlQueueWorkItem( _In_ WORKERCALLBACKFUNC Function, _In_opt_ PVOID Context, _In_ ULONG Flags );
NTSYSAPI VOID NTAPI RtlUserThreadStart( _In_ PUSER_THREAD_START_ROUTINE Function, _In_ PVOID Parameter );
NTSTATUS NTAPI TpAllocPool(_Out_ PTP_POOL *PoolReturn, _Reserved_ PVOID Reserved);
NTSTATUS NTAPI TpAllocTimer(_Out_ PTP_TIMER *Timer, _In_ PTP_TIMER_CALLBACK Callback, _Inout_opt_ PVOID Context, _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron);
NTSYSAPI VOID NTAPI TpSetTimer(_Inout_ PTP_TIMER Timer, _In_opt_ PLARGE_INTEGER DueTime, _In_ LONG Period, _In_opt_ LONG WindowLength);
VOID WINAPI BaseThreadInitThunk( IN DWORD LdrReserved, IN LPTHREAD_START_ROUTINE lpStartAddress, IN LPVOID lpParameter );
ULONG StringCchPrintfW( LPWSTR pszDest, size_t cchDest, LPWSTR pszFormat, ... );
NTSYSAPI NTSTATUS NTAPI NtReadVirtualMemory( IN HANDLE ProcessHandle, IN PVOID BaseAddress, OUT PVOID Buffer, IN ULONG NumberOfBytesToRead, OUT PULONG NumberOfBytesReaded OPTIONAL );
NTSYSCALLAPI NTSTATUS NtOpenThreadTokenEx( HANDLE ThreadHandle, ACCESS_MASK DesiredAccess, BOOLEAN OpenAsSelf, ULONG HandleAttributes, PHANDLE TokenHandle );
NTSYSCALLAPI NTSTATUS NtOpenProcessTokenEx( HANDLE ProcessHandle, ACCESS_MASK DesiredAccess, ULONG HandleAttributes, PHANDLE TokenHandle );
NTSYSAPI BOOLEAN STDAPIVCALLTYPE RtlAddFunctionTable( _In_reads_(EntryCount) PRUNTIME_FUNCTION FunctionTable, _In_ ULONG EntryCount, _In_ ULONG64 BaseAddress );
NTSYSAPI PRUNTIME_FUNCTION RtlLookupFunctionEntry( DWORD64 ControlPc, PDWORD64 ImageBase, PUNWIND_HISTORY_TABLE HistoryTable );
int k_vswprintf(wchar_t *buffer, size_t count, const wchar_t *format, va_list argptr);
int k_vscwprintf( const wchar_t* format, va_list argptr );
int k_swprintf(wchar_t* buffer, const wchar_t* format, ...);
EXTERN_C VOID volatile ___chkstk_ms( VOID );
#endif // WIN32_H
Reference in New Issue View Git Blame Copy Permalink