admin/entropy-z-Kharon
1
0
Fork 0
mirror of https://github.com/entropy-z/Kharon synced 2026-06-06 15:34:34 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
dev
entropy-z-Kharon/agent_kharon/src_core/include/win32.h
T
unknown 3e287544d6 .
2026-02-12 06:44:13 -03:00

2036 lines
99 KiB
C
Raw Permalink Blame History

#ifndef WIN32_H
#define WIN32_H
#include <windows.h>
#include <psapi.h>
#include <tlhelp32.h>
#define nt_success( status ) ( ( (NTSTATUS) (status) ) >= 0 )
typedef enum _PROCESSINFOCLASS {
ProcessBasicInformation, // q: PROCESS_BASIC_INFORMATION, PROCESS_EXTENDED_BASIC_INFORMATION
ProcessQuotaLimits, // qs: QUOTA_LIMITS, QUOTA_LIMITS_EX
ProcessIoCounters, // q: IO_COUNTERS
ProcessVmCounters, // q: VM_COUNTERS, VM_COUNTERS_EX, VM_COUNTERS_EX2
ProcessTimes, // q: KERNEL_USER_TIMES
ProcessBasePriority, // s: KPRIORITY
ProcessRaisePriority, // s: ULONG
ProcessDebugPort, // q: HANDLE
ProcessExceptionPort, // s: PROCESS_EXCEPTION_PORT (requires SeTcbPrivilege)
ProcessAccessToken, // s: PROCESS_ACCESS_TOKEN
ProcessLdtInformation, // qs: PROCESS_LDT_INFORMATION // 10
ProcessLdtSize, // s: PROCESS_LDT_SIZE
ProcessDefaultHardErrorMode, // qs: ULONG
ProcessIoPortHandlers, // s: PROCESS_IO_PORT_HANDLER_INFORMATION // (kernel-mode only)
ProcessPooledUsageAndLimits, // q: POOLED_USAGE_AND_LIMITS
ProcessWorkingSetWatch, // q: PROCESS_WS_WATCH_INFORMATION[]; s: void
ProcessUserModeIOPL, // qs: ULONG (requires SeTcbPrivilege)
ProcessEnableAlignmentFaultFixup, // s: BOOLEAN
ProcessPriorityClass, // qs: PROCESS_PRIORITY_CLASS
ProcessWx86Information, // qs: ULONG (requires SeTcbPrivilege) (VdmAllowed)
ProcessHandleCount, // q: ULONG, PROCESS_HANDLE_INFORMATION // 20
ProcessAffinityMask, // qs: KAFFINITY, qs: GROUP_AFFINITY
ProcessPriorityBoost, // qs: ULONG
ProcessDeviceMap, // qs: PROCESS_DEVICEMAP_INFORMATION, PROCESS_DEVICEMAP_INFORMATION_EX
ProcessSessionInformation, // q: PROCESS_SESSION_INFORMATION
ProcessForegroundInformation, // s: PROCESS_FOREGROUND_BACKGROUND
ProcessWow64Information, // q: ULONG_PTR
ProcessImageFileName, // q: UNICODE_STRING
ProcessLUIDDeviceMapsEnabled, // q: ULONG
ProcessBreakOnTermination, // qs: ULONG
ProcessDebugObjectHandle, // q: HANDLE // 30
ProcessDebugFlags, // qs: ULONG
ProcessHandleTracing, // q: PROCESS_HANDLE_TRACING_QUERY; s: PROCESS_HANDLE_TRACING_ENABLE[_EX] or void to disable
ProcessIoPriority, // qs: IO_PRIORITY_HINT
ProcessExecuteFlags, // qs: ULONG (MEM_EXECUTE_OPTION_*)
ProcessTlsInformation, // qs: PROCESS_TLS_INFORMATION // ProcessResourceManagement
ProcessCookie, // q: ULONG
ProcessImageInformation, // q: SECTION_IMAGE_INFORMATION
ProcessCycleTime, // q: PROCESS_CYCLE_TIME_INFORMATION // since VISTA
ProcessPagePriority, // qs: PAGE_PRIORITY_INFORMATION
ProcessInstrumentationCallback, // s: PVOID or PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION // 40
ProcessThreadStackAllocation, // s: PROCESS_STACK_ALLOCATION_INFORMATION, PROCESS_STACK_ALLOCATION_INFORMATION_EX
ProcessWorkingSetWatchEx, // q: PROCESS_WS_WATCH_INFORMATION_EX[]; s: void
ProcessImageFileNameWin32, // q: UNICODE_STRING
ProcessImageFileMapping, // q: HANDLE (input)
ProcessAffinityUpdateMode, // qs: PROCESS_AFFINITY_UPDATE_MODE
ProcessMemoryAllocationMode, // qs: PROCESS_MEMORY_ALLOCATION_MODE
ProcessGroupInformation, // q: USHORT[]
ProcessTokenVirtualizationEnabled, // s: ULONG
ProcessConsoleHostProcess, // qs: ULONG_PTR // ProcessOwnerInformation
ProcessWindowInformation, // q: PROCESS_WINDOW_INFORMATION // 50
ProcessHandleInformation, // q: PROCESS_HANDLE_SNAPSHOT_INFORMATION // since WIN8
ProcessMitigationPolicy, // s: PROCESS_MITIGATION_POLICY_INFORMATION
ProcessDynamicFunctionTableInformation, // s: PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION
ProcessHandleCheckingMode, // qs: ULONG; s: 0 disables, otherwise enables
ProcessKeepAliveCount, // q: PROCESS_KEEPALIVE_COUNT_INFORMATION
ProcessRevokeFileHandles, // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION
ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL
ProcessHandleTable, // q: ULONG[] // since WINBLUE
ProcessCheckStackExtentsMode, // qs: ULONG // KPROCESS->CheckStackExtents (CFG)
ProcessCommandLineInformation, // q: UNICODE_STRING // 60
ProcessProtectionInformation, // q: PS_PROTECTION
ProcessMemoryExhaustion, // s: PROCESS_MEMORY_EXHAUSTION_INFO // since THRESHOLD
ProcessFaultInformation, // s: PROCESS_FAULT_INFORMATION
ProcessTelemetryIdInformation, // q: PROCESS_TELEMETRY_ID_INFORMATION
ProcessCommitReleaseInformation, // qs: PROCESS_COMMIT_RELEASE_INFORMATION
ProcessDefaultCpuSetsInformation, // qs: SYSTEM_CPU_SET_INFORMATION[5] // ProcessReserved1Information
ProcessAllowedCpuSetsInformation, // qs: SYSTEM_CPU_SET_INFORMATION[5] // ProcessReserved2Information
ProcessSubsystemProcess, // s: void // EPROCESS->SubsystemProcess
ProcessJobMemoryInformation, // q: PROCESS_JOB_MEMORY_INFO
ProcessInPrivate, // q: BOOLEAN; s: void // ETW // since THRESHOLD2 // 70
ProcessRaiseUMExceptionOnInvalidHandleClose, // qs: ULONG; s: 0 disables, otherwise enables
ProcessIumChallengeResponse, // q: PROCESS_IUM_CHALLENGE_RESPONSE
ProcessChildProcessInformation, // q: PROCESS_CHILD_PROCESS_INFORMATION
ProcessHighGraphicsPriorityInformation, // q: BOOLEAN; s: BOOLEAN (requires SeTcbPrivilege)
ProcessSubsystemInformation, // q: SUBSYSTEM_INFORMATION_TYPE // since REDSTONE2
ProcessEnergyValues, // q: PROCESS_ENERGY_VALUES, PROCESS_EXTENDED_ENERGY_VALUES, PROCESS_EXTENDED_ENERGY_VALUES_V1
ProcessPowerThrottlingState, // qs: POWER_THROTTLING_PROCESS_STATE
ProcessActivityThrottlePolicy, // qs: PROCESS_ACTIVITY_THROTTLE_POLICY // ProcessReserved3Information
ProcessWin32kSyscallFilterInformation, // q: WIN32K_SYSCALL_FILTER
ProcessDisableSystemAllowedCpuSets, // s: BOOLEAN // 80
ProcessWakeInformation, // q: PROCESS_WAKE_INFORMATION // (kernel-mode only)
ProcessEnergyTrackingState, // qs: PROCESS_ENERGY_TRACKING_STATE
ProcessManageWritesToExecutableMemory, // s: MANAGE_WRITES_TO_EXECUTABLE_MEMORY // since REDSTONE3
ProcessCaptureTrustletLiveDump, // q: ULONG
ProcessTelemetryCoverage, // q: TELEMETRY_COVERAGE_HEADER; s: TELEMETRY_COVERAGE_POINT
ProcessEnclaveInformation,
ProcessEnableReadWriteVmLogging, // qs: PROCESS_READWRITEVM_LOGGING_INFORMATION
ProcessUptimeInformation, // q: PROCESS_UPTIME_INFORMATION
ProcessImageSection, // q: HANDLE
ProcessDebugAuthInformation, // s: CiTool.exe --device-id // PplDebugAuthorization // since RS4 // 90
ProcessSystemResourceManagement, // s: PROCESS_SYSTEM_RESOURCE_MANAGEMENT
ProcessSequenceNumber, // q: ULONGLONG
ProcessLoaderDetour, // qs: Obsolete // since RS5
ProcessSecurityDomainInformation, // q: PROCESS_SECURITY_DOMAIN_INFORMATION
ProcessCombineSecurityDomainsInformation, // s: PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION
ProcessEnableLogging, // qs: PROCESS_LOGGING_INFORMATION
ProcessLeapSecondInformation, // qs: PROCESS_LEAP_SECOND_INFORMATION
ProcessFiberShadowStackAllocation, // s: PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION // since 19H1
ProcessFreeFiberShadowStackAllocation, // s: PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION
ProcessAltSystemCallInformation, // s: PROCESS_SYSCALL_PROVIDER_INFORMATION // since 20H1 // 100
ProcessDynamicEHContinuationTargets, // s: PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION
ProcessDynamicEnforcedCetCompatibleRanges, // s: PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE_INFORMATION // since 20H2
ProcessCreateStateChange, // s: Obsolete // since WIN11
ProcessApplyStateChange, // s: Obsolete
ProcessEnableOptionalXStateFeatures, // s: ULONG64 // EnableProcessOptionalXStateFeatures
ProcessAltPrefetchParam, // qs: OVERRIDE_PREFETCH_PARAMETER // App Launch Prefetch (ALPF) // since 22H1
ProcessAssignCpuPartitions, // s: HANDLE
ProcessPriorityClassEx, // s: PROCESS_PRIORITY_CLASS_EX
ProcessMembershipInformation, // q: PROCESS_MEMBERSHIP_INFORMATION
ProcessEffectiveIoPriority, // q: IO_PRIORITY_HINT // 110
ProcessEffectivePagePriority, // q: ULONG
ProcessSchedulerSharedData, // q: SCHEDULER_SHARED_DATA_SLOT_INFORMATION // since 24H2
ProcessSlistRollbackInformation,
ProcessNetworkIoCounters, // q: PROCESS_NETWORK_COUNTERS
ProcessFindFirstThreadByTebValue, // q: PROCESS_TEB_VALUE_INFORMATION // NtCurrentProcess
ProcessEnclaveAddressSpaceRestriction, // qs: // since 25H2
ProcessAvailableCpus, // q: PROCESS_AVAILABLE_CPUS_INFORMATION
MaxProcessInfoClass
} PROCESSINFOCLASS;
typedef struct _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION
{
ULONG Version; // The version of the instrumentation callback information.
ULONG Reserved; // Reserved for future use.
PVOID Callback; // Pointer to the callback function.
} PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION, *PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION;
typedef struct _PROCESS_MITIGATION_ACTIVATION_CONTEXT_TRUST_POLICY2
{
union
{
ULONG Flags;
struct
{
ULONG AssemblyManifestRedirectionTrust : 1;
ULONG ReservedFlags : 31;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
} PROCESS_MITIGATION_ACTIVATION_CONTEXT_TRUST_POLICY2, *PPROCESS_MITIGATION_ACTIVATION_CONTEXT_TRUST_POLICY2;
typedef struct _PROCESS_MITIGATION_POLICY_INFORMATION
{
PROCESS_MITIGATION_POLICY Policy;
union
{
PROCESS_MITIGATION_ASLR_POLICY ASLRPolicy;
PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY StrictHandleCheckPolicy;
PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY SystemCallDisablePolicy;
PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY ExtensionPointDisablePolicy;
PROCESS_MITIGATION_DYNAMIC_CODE_POLICY DynamicCodePolicy;
PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY ControlFlowGuardPolicy;
PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY SignaturePolicy;
PROCESS_MITIGATION_FONT_DISABLE_POLICY FontDisablePolicy;
PROCESS_MITIGATION_IMAGE_LOAD_POLICY ImageLoadPolicy;
PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY SystemCallFilterPolicy;
PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY PayloadRestrictionPolicy;
PROCESS_MITIGATION_CHILD_PROCESS_POLICY ChildProcessPolicy;
PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY SideChannelIsolationPolicy;
PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY UserShadowStackPolicy;
PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY RedirectionTrustPolicy;
PROCESS_MITIGATION_USER_POINTER_AUTH_POLICY UserPointerAuthPolicy;
PROCESS_MITIGATION_SEHOP_POLICY SEHOPPolicy;
PROCESS_MITIGATION_ACTIVATION_CONTEXT_TRUST_POLICY2 ActivationContextTrustPolicy;
};
} PROCESS_MITIGATION_POLICY_INFORMATION, *PPROCESS_MITIGATION_POLICY_INFORMATION;
typedef struct _PROCESS_HANDLE_TABLE_ENTRY_INFO
{
HANDLE HandleValue; // The value of the handle.
SIZE_T HandleCount; // The number of references to the handle.
SIZE_T PointerCount; // The number of pointers to the handle.
ACCESS_MASK GrantedAccess; // The access rights granted to the handle.
ULONG ObjectTypeIndex; // The index of the object type.
ULONG HandleAttributes; // The attributes of the handle.
ULONG Reserved; // Reserved for future use.
} PROCESS_HANDLE_TABLE_ENTRY_INFO, *PPROCESS_HANDLE_TABLE_ENTRY_INFO;
typedef struct _PROCESS_HANDLE_SNAPSHOT_INFORMATION
{
ULONG_PTR NumberOfHandles;
ULONG_PTR Reserved;
_Field_size_(NumberOfHandles) PROCESS_HANDLE_TABLE_ENTRY_INFO Handles[1];
} PROCESS_HANDLE_SNAPSHOT_INFORMATION, *PPROCESS_HANDLE_SNAPSHOT_INFORMATION;
typedef struct _PS_PROTECTION
{
union
{
UCHAR Level;
struct
{
UCHAR Type : 3;
UCHAR Audit : 1;
UCHAR Signer : 4;
};
};
} PS_PROTECTION, *PPS_PROTECTION;
typedef struct _LEAP_SECOND_DATA *PLEAP_SECOND_DATA;
typedef struct _PEB_LDR_DATA
{
ULONG Length;
BOOLEAN Initialized;
HANDLE SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID EntryInProgress;
BOOLEAN ShutdownInProgress;
HANDLE ShutdownThreadId;
} PEB_LDR_DATA, *PPEB_LDR_DATA;
typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWCH Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef struct _STRING
{
USHORT Length;
USHORT MaximumLength;
PCH Buffer;
} STRING, *PSTRING;
typedef struct _CURDIR
{
UNICODE_STRING DosPath;
HANDLE Handle;
} CURDIR, *PCURDIR;
#define RTL_MAX_DRIVE_LETTERS 32
typedef struct _RTL_DRIVE_LETTER_CURDIR
{
USHORT Flags;
USHORT Length;
ULONG TimeStamp;
STRING DosPath;
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
typedef struct _RTL_USER_PROCESS_PARAMETERS
{
ULONG MaximumLength;
ULONG Length;
ULONG Flags;
ULONG DebugFlags;
HANDLE ConsoleHandle;
ULONG ConsoleFlags;
HANDLE StandardInput;
HANDLE StandardOutput;
HANDLE StandardError;
CURDIR CurrentDirectory;
UNICODE_STRING DllPath;
UNICODE_STRING ImagePathName;
UNICODE_STRING CommandLine;
PVOID Environment;
ULONG StartingX;
ULONG StartingY;
ULONG CountX;
ULONG CountY;
ULONG CountCharsX;
ULONG CountCharsY;
ULONG FillAttribute;
ULONG WindowFlags;
ULONG ShowWindowFlags;
UNICODE_STRING WindowTitle;
UNICODE_STRING DesktopInfo;
UNICODE_STRING ShellInfo;
UNICODE_STRING RuntimeData;
RTL_DRIVE_LETTER_CURDIR CurrentDirectories[RTL_MAX_DRIVE_LETTERS];
ULONG_PTR EnvironmentSize;
ULONG_PTR EnvironmentVersion;
PVOID PackageDependencyData;
ULONG ProcessGroupId;
ULONG LoaderThreads;
UNICODE_STRING RedirectionDllName; // REDSTONE4
UNICODE_STRING HeapPartitionName; // 19H1
PULONGLONG DefaultThreadpoolCpuSetMasks;
ULONG DefaultThreadpoolCpuSetMaskCount;
ULONG DefaultThreadpoolThreadMaximum;
ULONG HeapMemoryTypeMask; // WIN11
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
typedef _Function_class_(FN_DISPATCH)
NTSTATUS NTAPI FN_DISPATCH(
_In_opt_ PVOID Context
);
typedef FN_DISPATCH* PFN_DISPATCH;
typedef struct _KERNEL_CALLBACK_TABLE
{
PFN_DISPATCH __fnCOPYDATA;
PFN_DISPATCH __fnCOPYGLOBALDATA;
PFN_DISPATCH __fnEMPTY1;
PFN_DISPATCH __fnNCDESTROY;
PFN_DISPATCH __fnDWORDOPTINLPMSG;
PFN_DISPATCH __fnINOUTDRAG;
PFN_DISPATCH __fnGETTEXTLENGTHS1;
PFN_DISPATCH __fnINCNTOUTSTRING;
PFN_DISPATCH __fnINCNTOUTSTRINGNULL;
PFN_DISPATCH __fnINLPCOMPAREITEMSTRUCT;
PFN_DISPATCH __fnINLPCREATESTRUCT;
PFN_DISPATCH __fnINLPDELETEITEMSTRUCT;
PFN_DISPATCH __fnINLPDRAWITEMSTRUCT;
PFN_DISPATCH __fnPOPTINLPUINT1;
PFN_DISPATCH __fnPOPTINLPUINT2;
PFN_DISPATCH __fnINLPMDICREATESTRUCT;
PFN_DISPATCH __fnINOUTLPMEASUREITEMSTRUCT;
PFN_DISPATCH __fnINLPWINDOWPOS;
PFN_DISPATCH __fnINOUTLPPOINT51;
PFN_DISPATCH __fnINOUTLPSCROLLINFO;
PFN_DISPATCH __fnINOUTLPRECT;
PFN_DISPATCH __fnINOUTNCCALCSIZE;
PFN_DISPATCH __fnINOUTLPPOINT52;
PFN_DISPATCH __fnINPAINTCLIPBRD;
PFN_DISPATCH __fnINSIZECLIPBRD;
PFN_DISPATCH __fnINDESTROYCLIPBRD;
PFN_DISPATCH __fnINSTRINGNULL1;
PFN_DISPATCH __fnINSTRINGNULL2;
PFN_DISPATCH __fnINDEVICECHANGE;
PFN_DISPATCH __fnPOWERBROADCAST;
PFN_DISPATCH __fnINLPUAHDRAWMENU1;
PFN_DISPATCH __fnOPTOUTLPDWORDOPTOUTLPDWORD1;
PFN_DISPATCH __fnOPTOUTLPDWORDOPTOUTLPDWORD2;
PFN_DISPATCH __fnOUTDWORDINDWORD;
PFN_DISPATCH __fnOUTLPRECT;
PFN_DISPATCH __fnOUTSTRING;
PFN_DISPATCH __fnPOPTINLPUINT3;
PFN_DISPATCH __fnPOUTLPINT;
PFN_DISPATCH __fnSENTDDEMSG;
PFN_DISPATCH __fnINOUTSTYLECHANGE1;
PFN_DISPATCH __fnHkINDWORD;
PFN_DISPATCH __fnHkINLPCBTACTIVATESTRUCT;
PFN_DISPATCH __fnHkINLPCBTCREATESTRUCT;
PFN_DISPATCH __fnHkINLPDEBUGHOOKSTRUCT;
PFN_DISPATCH __fnHkINLPMOUSEHOOKSTRUCTEX1;
PFN_DISPATCH __fnHkINLPKBDLLHOOKSTRUCT;
PFN_DISPATCH __fnHkINLPMSLLHOOKSTRUCT;
PFN_DISPATCH __fnHkINLPMSG;
PFN_DISPATCH __fnHkINLPRECT;
PFN_DISPATCH __fnHkOPTINLPEVENTMSG;
PFN_DISPATCH __xxxClientCallDelegateThread;
PFN_DISPATCH __ClientCallDummyCallback1;
PFN_DISPATCH __ClientCallDummyCallback2;
PFN_DISPATCH __fnSHELLWINDOWMANAGEMENTCALLOUT;
PFN_DISPATCH __fnSHELLWINDOWMANAGEMENTNOTIFY;
PFN_DISPATCH __ClientCallDummyCallback3;
PFN_DISPATCH __xxxClientCallDitThread;
PFN_DISPATCH __xxxClientEnableMMCSS;
PFN_DISPATCH __xxxClientUpdateDpi;
PFN_DISPATCH __xxxClientExpandStringW;
PFN_DISPATCH __ClientCopyDDEIn1;
PFN_DISPATCH __ClientCopyDDEIn2;
PFN_DISPATCH __ClientCopyDDEOut1;
PFN_DISPATCH __ClientCopyDDEOut2;
PFN_DISPATCH __ClientCopyImage;
PFN_DISPATCH __ClientEventCallback;
PFN_DISPATCH __ClientFindMnemChar;
PFN_DISPATCH __ClientFreeDDEHandle;
PFN_DISPATCH __ClientFreeLibrary;
PFN_DISPATCH __ClientGetCharsetInfo;
PFN_DISPATCH __ClientGetDDEFlags;
PFN_DISPATCH __ClientGetDDEHookData;
PFN_DISPATCH __ClientGetListboxString;
PFN_DISPATCH __ClientGetMessageMPH;
PFN_DISPATCH __ClientLoadImage;
PFN_DISPATCH __ClientLoadLibrary;
PFN_DISPATCH __ClientLoadMenu;
PFN_DISPATCH __ClientLoadLocalT1Fonts;
PFN_DISPATCH __ClientPSMTextOut;
PFN_DISPATCH __ClientLpkDrawTextEx;
PFN_DISPATCH __ClientExtTextOutW;
PFN_DISPATCH __ClientGetTextExtentPointW;
PFN_DISPATCH __ClientCharToWchar;
PFN_DISPATCH __ClientAddFontResourceW;
PFN_DISPATCH __ClientThreadSetup;
PFN_DISPATCH __ClientDeliverUserApc;
PFN_DISPATCH __ClientNoMemoryPopup;
PFN_DISPATCH __ClientMonitorEnumProc;
PFN_DISPATCH __ClientCallWinEventProc;
PFN_DISPATCH __ClientWaitMessageExMPH;
PFN_DISPATCH __ClientCallDummyCallback4;
PFN_DISPATCH __ClientCallDummyCallback5;
PFN_DISPATCH __ClientImmLoadLayout;
PFN_DISPATCH __ClientImmProcessKey;
PFN_DISPATCH __fnIMECONTROL;
PFN_DISPATCH __fnINWPARAMDBCSCHAR;
PFN_DISPATCH __fnGETTEXTLENGTHS2;
PFN_DISPATCH __ClientCallDummyCallback6;
PFN_DISPATCH __ClientLoadStringW;
PFN_DISPATCH __ClientLoadOLE;
PFN_DISPATCH __ClientRegisterDragDrop;
PFN_DISPATCH __ClientRevokeDragDrop;
PFN_DISPATCH __fnINOUTMENUGETOBJECT;
PFN_DISPATCH __ClientPrinterThunk;
PFN_DISPATCH __fnOUTLPCOMBOBOXINFO;
PFN_DISPATCH __fnOUTLPSCROLLBARINFO;
PFN_DISPATCH __fnINLPUAHDRAWMENU2;
PFN_DISPATCH __fnINLPUAHDRAWMENUITEM;
PFN_DISPATCH __fnINLPUAHDRAWMENU3;
PFN_DISPATCH __fnINOUTLPUAHMEASUREMENUITEM;
PFN_DISPATCH __fnINLPUAHDRAWMENU4;
PFN_DISPATCH __fnOUTLPTITLEBARINFOEX;
PFN_DISPATCH __fnTOUCH;
PFN_DISPATCH __fnGESTURE;
PFN_DISPATCH __fnPOPTINLPUINT4;
PFN_DISPATCH __fnPOPTINLPUINT5;
PFN_DISPATCH __xxxClientCallDefaultInputHandler;
PFN_DISPATCH __fnEMPTY2;
PFN_DISPATCH __ClientRimDevCallback;
PFN_DISPATCH __xxxClientCallMinTouchHitTestingCallback;
PFN_DISPATCH __ClientCallLocalMouseHooks;
PFN_DISPATCH __xxxClientBroadcastThemeChange;
PFN_DISPATCH __xxxClientCallDevCallbackSimple;
PFN_DISPATCH __xxxClientAllocWindowClassExtraBytes;
PFN_DISPATCH __xxxClientFreeWindowClassExtraBytes;
PFN_DISPATCH __fnGETWINDOWDATA;
PFN_DISPATCH __fnINOUTSTYLECHANGE2;
PFN_DISPATCH __fnHkINLPMOUSEHOOKSTRUCTEX2;
PFN_DISPATCH __xxxClientCallDefWindowProc;
PFN_DISPATCH __fnSHELLSYNCDISPLAYCHANGED;
PFN_DISPATCH __fnHkINLPCHARHOOKSTRUCT;
PFN_DISPATCH __fnINTERCEPTEDWINDOWACTION;
PFN_DISPATCH __xxxTooltipCallback;
PFN_DISPATCH __xxxClientInitPSBInfo;
PFN_DISPATCH __xxxClientDoScrollMenu;
PFN_DISPATCH __xxxClientEndScroll;
PFN_DISPATCH __xxxClientDrawSize;
PFN_DISPATCH __xxxClientDrawScrollBar;
PFN_DISPATCH __xxxClientHitTestScrollBar;
PFN_DISPATCH __xxxClientTrackInit;
} KERNEL_CALLBACK_TABLE, *PKERNEL_CALLBACK_TABLE;
typedef struct _API_SET_NAMESPACE
{
ULONG Version; // API_SET_SCHEMA_VERSION_V6
ULONG Size;
ULONG Flags; // API_SET_SCHEMA_FLAGS_*
ULONG Count;
ULONG EntryOffset; // to API_SET_NAMESPACE_ENTRY[Count], from this struct base
ULONG HashOffset; // to API_SET_HASH_ENTRY[Count], from this struct base
ULONG HashFactor;
} API_SET_NAMESPACE, *PAPI_SET_NAMESPACE;
typedef struct _RTL_BITMAP
{
ULONG SizeOfBitMap;
PULONG Buffer;
} RTL_BITMAP, *PRTL_BITMAP;
typedef enum _NT_PRODUCT_TYPE
{
NtProductWinNt = 1,
NtProductLanManNt,
NtProductServer
} NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
typedef struct _KSYSTEM_TIME
{
ULONG LowPart;
LONG High1Time;
LONG High2Time;
} KSYSTEM_TIME, *PKSYSTEM_TIME;
typedef struct _SILO_USER_SHARED_DATA
{
ULONG ServiceSessionId;
ULONG ActiveConsoleId;
LONGLONG ConsoleSessionForegroundProcessId;
NT_PRODUCT_TYPE NtProductType;
ULONG SuiteMask;
ULONG SharedUserSessionId; // since RS2
BOOLEAN IsMultiSessionSku;
BOOLEAN IsStateSeparationEnabled;
WCHAR NtSystemRoot[260];
USHORT UserModeGlobalLogger[16];
ULONG TimeZoneId; // since 21H2
LONG TimeZoneBiasStamp;
KSYSTEM_TIME TimeZoneBias;
LARGE_INTEGER TimeZoneBiasEffectiveStart;
LARGE_INTEGER TimeZoneBiasEffectiveEnd;
} SILO_USER_SHARED_DATA, *PSILO_USER_SHARED_DATA;
#define MAXIMUM_LEADBYTES 12
typedef struct _CPTABLEINFO
{
USHORT CodePage; // Specifies the code page number.
USHORT MaximumCharacterSize; // Specifies the maximum length in bytes of a character.
USHORT DefaultChar; // Specifies the default character (MB).
USHORT UniDefaultChar; // Specifies the default character (Unicode).
USHORT TransDefaultChar; // Specifies the translation of the default character (Unicode).
USHORT TransUniDefaultChar; // Specifies the translation of the Unicode default character (MB).
USHORT DBCSCodePage; // Specifies non-zero for DBCS code pages.
UCHAR LeadByte[MAXIMUM_LEADBYTES]; // Specifies the lead byte ranges.
PUSHORT MultiByteTable; // Specifies a pointer to a MB translation table.
PVOID WideCharTable; // Specifies a pointer to a WC translation table.
PUSHORT DBCSRanges; // Specifies a pointer to DBCS ranges.
PUSHORT DBCSOffsets; // Specifies a pointer to DBCS offsets.
} CPTABLEINFO, *PCPTABLEINFO;
typedef struct _NLSTABLEINFO
{
CPTABLEINFO OemTableInfo; // Specifies OEM table.
CPTABLEINFO AnsiTableInfo; // Specifies an ANSI table.
PUSHORT UpperCaseTable; // Specifies an 844 format uppercase table.
PUSHORT LowerCaseTable; // Specifies an 844 format lowercase table.
} NLSTABLEINFO, *PNLSTABLEINFO;
#define GDI_HANDLE_BUFFER_SIZE32 34
#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE32
typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE];
typedef struct tagSDBQUERYRESULT
{
ULONG Exes[16];
ULONG ExeFlags[16];
ULONG Layers[8];
ULONG LayerFlags;
ULONG AppHelp;
ULONG ExeCount;
ULONG LayerCount;
GUID ID;
ULONG ExtraFlags;
ULONG CustomSDBMap;
GUID DB[16];
} SDBQUERYRESULT, *PSDBQUERYRESULT;
typedef struct _AFD_SWITCH_CONTEXT
{
LONG EventsActive;
LONG RcvCount;
LONG ExpCount;
LONG SndCount;
BOOLEAN SelectFlag;
} AFD_SWITCH_CONTEXT, *PAFD_SWITCH_CONTEXT;
typedef struct tagSWITCH_CONTEXT_ATTRIBUTE
{
ULONG_PTR ContextUpdateCounter;
BOOL AllowContextUpdate;
BOOL EnableTrace;
HANDLE EtwHandle;
} SWITCH_CONTEXT_ATTRIBUTE, *PSWITCH_CONTEXT_ATTRIBUTE;
typedef struct tagSWITCH_CONTEXT_DATA
{
ULONGLONG OsMaxVersionTested;
ULONG TargetPlatform;
ULONGLONG ContextMinimum;
GUID Platform;
GUID MinPlatform;
ULONG ContextSource;
ULONG ElementCount;
GUID Elements[48];
} SWITCH_CONTEXT_DATA, * PSWITCH_CONTEXT_DATA;
typedef struct tagSWITCH_CONTEXT
{
SWITCH_CONTEXT_ATTRIBUTE Attribute;
SWITCH_CONTEXT_DATA Data;
} SWITCH_CONTEXT, *PSWITCH_CONTEXT;
typedef struct _SDB_CSTRUCT_COBALT_PROCFLAG
{
KAFFINITY AffinityMask;
ULONG CPUIDEcxOverride;
ULONG CPUIDEdxOverride;
USHORT ProcessorGroup;
USHORT FastSelfModThreshold;
USHORT Reserved1;
UCHAR Reserved2;
UCHAR BackgroundWork : 5;
UCHAR CPUIDBrand : 4;
UCHAR Reserved3 : 4;
UCHAR RdtscScaling : 3;
UCHAR Reserved4 : 2;
UCHAR UnalignedAtomicApproach : 2;
UCHAR Win11Atomics : 2;
UCHAR RunOnSingleCore : 1;
UCHAR X64CPUID : 1;
UCHAR PatchUnaligned : 1;
UCHAR InterpreterOrJitter : 1;
UCHAR ForceSegmentHeap : 1;
UCHAR Reserved5 : 1;
UCHAR Reserved6 : 1;
union
{
ULONGLONG Group1AsUINT64;
struct _SDB_CSTRUCT_COBALT_PROCFLAG* Specified;
};
} SDB_CSTRUCT_COBALT_PROCFLAG, *PSDB_CSTRUCT_COBALT_PROCFLAG;
typedef struct _ACTIVATION_CONTEXT_DATA
{
ULONG Magic;
ULONG HeaderSize;
ULONG FormatVersion;
ULONG TotalSize;
ULONG DefaultTocOffset; // to ACTIVATION_CONTEXT_DATA_TOC_HEADER
ULONG ExtendedTocOffset; // to ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_HEADER
ULONG AssemblyRosterOffset; // to ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_HEADER
ULONG Flags; // ACTIVATION_CONTEXT_FLAG_*
} ACTIVATION_CONTEXT_DATA, *PACTIVATION_CONTEXT_DATA;
typedef struct _ASSEMBLY_STORAGE_MAP_ENTRY
{
ULONG Flags;
UNICODE_STRING DosPath;
HANDLE Handle;
} ASSEMBLY_STORAGE_MAP_ENTRY, *PASSEMBLY_STORAGE_MAP_ENTRY;
typedef struct _WER_RECOVERY_INFO
{
ULONG Length;
PVOID Callback;
PVOID Parameter;
HANDLE Started;
HANDLE Finished;
HANDLE InProgress;
LONG LastError;
BOOL Successful;
ULONG PingInterval;
ULONG Flags;
} WER_RECOVERY_INFO, *PWER_RECOVERY_INFO;
typedef struct _WER_METADATA
{
PVOID Next;
WCHAR Key[64];
WCHAR Value[128];
} WER_METADATA, *PWER_METADATA;
typedef struct _WER_FILE
{
USHORT Flags;
WCHAR Path[MAX_PATH];
} WER_FILE, *PWER_FILE;
typedef struct _WER_MEMORY
{
PVOID Address;
ULONG Size;
} WER_MEMORY, *PWER_MEMORY;
typedef struct _WER_GATHER
{
PVOID Next;
USHORT Flags;
union
{
WER_FILE File;
WER_MEMORY Memory;
} v;
} WER_GATHER, *PWER_GATHER;
typedef struct _WER_RUNTIME_DLL
{
PVOID Next;
ULONG Length;
PVOID Context;
WCHAR CallbackDllPath[MAX_PATH];
} WER_RUNTIME_DLL, *PWER_RUNTIME_DLL;
typedef struct _WER_DUMP_COLLECTION
{
PVOID Next;
ULONG ProcessId;
ULONG ThreadId;
} WER_DUMP_COLLECTION, *PWER_DUMP_COLLECTION;
typedef struct _WER_HEAP_MAIN_HEADER
{
WCHAR Signature[16];
LIST_ENTRY Links;
HANDLE Mutex;
PVOID FreeHeap;
ULONG FreeCount;
} WER_HEAP_MAIN_HEADER, *PWER_HEAP_MAIN_HEADER;
typedef struct _WER_PEB_HEADER_BLOCK
{
LONG Length;
WCHAR Signature[16];
WCHAR AppDataRelativePath[64];
WCHAR RestartCommandLine[RESTART_MAX_CMD_LINE];
WER_RECOVERY_INFO RecoveryInfo;
PWER_GATHER Gather;
PWER_METADATA MetaData;
PWER_RUNTIME_DLL RuntimeDll;
PWER_DUMP_COLLECTION DumpCollection;
LONG GatherCount;
LONG MetaDataCount;
LONG DumpCount;
LONG Flags;
WER_HEAP_MAIN_HEADER MainHeader;
PVOID Reserved;
} WER_PEB_HEADER_BLOCK, *PWER_PEB_HEADER_BLOCK;
typedef struct _ASSEMBLY_STORAGE_MAP
{
ULONG Flags;
ULONG AssemblyCount;
PASSEMBLY_STORAGE_MAP_ENTRY *AssemblyArray;
} ASSEMBLY_STORAGE_MAP, *PASSEMBLY_STORAGE_MAP;
// typedef struct _APPCOMPAT_EXE_DATA
// {
// ULONG_PTR Reserved[65];
// ULONG Size;
// ULONG Magic;
// BOOL LoadShimEngine;
// USHORT ExeType;
// SDBQUERYRESULT SdbQueryResult;
// ULONG_PTR DbgLogChannels[128];
// SWITCH_CONTEXT SwitchContext;
// ULONG ParentProcessId;
// WCHAR ParentImageName[260];
// WCHAR ParentCompatLayers[256];
// WCHAR ActiveCompatLayers[256];
// ULONG ImageFileSize;
// ULONG ImageCheckSum;
// BOOL LatestOs;
// BOOL PackageId;
// BOOL SwitchBackManifest;
// BOOL UacManifest;
// BOOL LegacyInstaller;
// ULONG RunLevel;
// ULONG_PTR WinRTFlags;
// PVOID HookCOM;
// PVOID ComponentOnDemandEvent;
// PVOID Quirks;
// ULONG QuirksSize;
// SDB_CSTRUCT_COBALT_PROCFLAG CobaltProcFlags;
// ULONG FullMatchDbSizeCb;
// ULONG FullMatchDbOffset;
// } APPCOMPAT_EXE_DATA;
typedef struct _TELEMETRY_COVERAGE_HEADER
{
UCHAR MajorVersion;
UCHAR MinorVersion;
struct
{
USHORT TracingEnabled : 1;
USHORT Reserved1 : 15;
};
ULONG HashTableEntries;
ULONG HashIndexMask;
ULONG TableUpdateVersion;
ULONG TableSizeInBytes;
ULONG LastResetTick;
ULONG ResetRound;
ULONG Reserved2;
ULONG RecordedCount;
ULONG Reserved3[4];
ULONG HashTable[ANYSIZE_ARRAY];
} TELEMETRY_COVERAGE_HEADER, *PTELEMETRY_COVERAGE_HEADER;
typedef struct _APPCOMPAT_EXE_DATA
{
ULONG_PTR Reserved[65];
ULONG Size;
ULONG Magic;
BOOL LoadShimEngine;
USHORT ExeType;
SDBQUERYRESULT SdbQueryResult;
ULONG_PTR DbgLogChannels[128];
SWITCH_CONTEXT SwitchContext;
ULONG ParentProcessId;
WCHAR ParentImageName[260];
WCHAR ParentCompatLayers[256];
WCHAR ActiveCompatLayers[256];
ULONG ImageFileSize;
ULONG ImageCheckSum;
BOOL LatestOs;
BOOL PackageId;
BOOL SwitchBackManifest;
BOOL UacManifest;
BOOL LegacyInstaller;
ULONG RunLevel;
ULONG_PTR WinRTFlags;
PVOID HookCOM;
PVOID ComponentOnDemandEvent;
PVOID Quirks;
ULONG QuirksSize;
SDB_CSTRUCT_COBALT_PROCFLAG CobaltProcFlags;
ULONG FullMatchDbSizeCb;
ULONG FullMatchDbOffset;
} APPCOMPAT_EXE_DATA;
typedef struct _GDI_HANDLE_ENTRY
{
union
{
PVOID Object;
PVOID NextFree;
};
union
{
struct
{
USHORT ProcessId;
USHORT Lock : 1;
USHORT Count : 15;
};
ULONG Value;
} Owner;
USHORT Unique;
UCHAR Type;
UCHAR Flags;
PVOID UserPointer;
} GDI_HANDLE_ENTRY, *PGDI_HANDLE_ENTRY;
typedef _Function_class_(PS_POST_PROCESS_INIT_ROUTINE)
VOID NTAPI PS_POST_PROCESS_INIT_ROUTINE(
VOID
);
typedef PS_POST_PROCESS_INIT_ROUTINE* PPS_POST_PROCESS_INIT_ROUTINE;
typedef struct _PEB
{
//
// The process was cloned with an inherited address space.
//
BOOLEAN InheritedAddressSpace;
//
// The process has image file execution options (IFEO).
//
BOOLEAN ReadImageFileExecOptions;
//
// The process has a debugger attached.
//
BOOLEAN BeingDebugged;
union
{
BOOLEAN BitField;
struct
{
BOOLEAN ImageUsesLargePages : 1; // The process uses large image regions (4 MB).
BOOLEAN IsProtectedProcess : 1; // The process is a protected process.
BOOLEAN IsImageDynamicallyRelocated : 1; // The process image base address was relocated.
BOOLEAN SkipPatchingUser32Forwarders : 1; // The process skipped forwarders for User32.dll functions. 1 for 64-bit, 0 for 32-bit.
BOOLEAN IsPackagedProcess : 1; // The process is a packaged store process (APPX/MSIX).
BOOLEAN IsAppContainerProcess : 1; // The process has an AppContainer token.
BOOLEAN IsProtectedProcessLight : 1; // The process is a protected process (light).
BOOLEAN IsLongPathAwareProcess : 1; // The process is long path aware.
};
};
//
// Handle to a mutex for synchronization.
//
HANDLE Mutant;
//
// Pointer to the base address of the process image.
//
PVOID ImageBaseAddress;
//
// Pointer to the process loader data.
//
PPEB_LDR_DATA Ldr;
//
// Pointer to the process parameters.
//
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
//
// Reserved.
//
PVOID SubSystemData;
//
// Pointer to the process default heap.
//
PVOID ProcessHeap;
//
// Pointer to a critical section used to synchronize access to the PEB.
//
PRTL_CRITICAL_SECTION FastPebLock;
//
// Pointer to a singly linked list used by ATL.
//
PSLIST_HEADER AtlThunkSListPtr;
//
// Handle to the Image File Execution Options key.
//
HANDLE IFEOKey;
//
// Cross process flags.
//
union
{
ULONG CrossProcessFlags;
struct
{
ULONG ProcessInJob : 1; // The process is part of a job.
ULONG ProcessInitializing : 1; // The process is initializing.
ULONG ProcessUsingVEH : 1; // The process is using VEH.
ULONG ProcessUsingVCH : 1; // The process is using VCH.
ULONG ProcessUsingFTH : 1; // The process is using FTH.
ULONG ProcessPreviouslyThrottled : 1; // The process was previously throttled.
ULONG ProcessCurrentlyThrottled : 1; // The process is currently throttled.
ULONG ProcessImagesHotPatched : 1; // The process images are hot patched. // RS5
ULONG ReservedBits0 : 24;
};
};
//
// User32 KERNEL_CALLBACK_TABLE (ntuser.h)
//
union
{
PKERNEL_CALLBACK_TABLE KernelCallbackTable;
PVOID UserSharedInfoPtr;
};
//
// Reserved.
//
ULONG SystemReserved;
//
// Pointer to the Active Template Library (ATL) singly linked list (32-bit)
//
ULONG AtlThunkSListPtr32;
//
// Pointer to the API Set Schema.
//
PAPI_SET_NAMESPACE ApiSetMap;
//
// Counter for TLS expansion.
//
ULONG TlsExpansionCounter;
//
// Pointer to the TLS bitmap.
//
PRTL_BITMAP TlsBitmap;
//
// Bits for the TLS bitmap.
//
ULONG TlsBitmapBits[2];
//
// Reserved for CSRSS.
//
PVOID ReadOnlySharedMemoryBase;
//
// Pointer to the USER_SHARED_DATA for the current SILO.
//
PSILO_USER_SHARED_DATA SharedData;
//
// Reserved for CSRSS.
//
PVOID* ReadOnlyStaticServerData;
//
// Pointer to the ANSI code page data.
//
PCPTABLEINFO AnsiCodePageData;
//
// Pointer to the OEM code page data.
//
PCPTABLEINFO OemCodePageData;
//
// Pointer to the Unicode case table data.
//
PNLSTABLEINFO UnicodeCaseTableData;
//
// The total number of system processors.
//
ULONG NumberOfProcessors;
//
// Global flags for the system.
//
union
{
ULONG NtGlobalFlag;
struct
{
ULONG StopOnException : 1; // FLG_STOP_ON_EXCEPTION
ULONG ShowLoaderSnaps : 1; // FLG_SHOW_LDR_SNAPS
ULONG DebugInitialCommand : 1; // FLG_DEBUG_INITIAL_COMMAND
ULONG StopOnHungGUI : 1; // FLG_STOP_ON_HUNG_GUI
ULONG HeapEnableTailCheck : 1; // FLG_HEAP_ENABLE_TAIL_CHECK
ULONG HeapEnableFreeCheck : 1; // FLG_HEAP_ENABLE_FREE_CHECK
ULONG HeapValidateParameters : 1; // FLG_HEAP_VALIDATE_PARAMETERS
ULONG HeapValidateAll : 1; // FLG_HEAP_VALIDATE_ALL
ULONG ApplicationVerifier : 1; // FLG_APPLICATION_VERIFIER
ULONG MonitorSilentProcessExit : 1; // FLG_MONITOR_SILENT_PROCESS_EXIT
ULONG PoolEnableTagging : 1; // FLG_POOL_ENABLE_TAGGING
ULONG HeapEnableTagging : 1; // FLG_HEAP_ENABLE_TAGGING
ULONG UserStackTraceDb : 1; // FLG_USER_STACK_TRACE_DB
ULONG KernelStackTraceDb : 1; // FLG_KERNEL_STACK_TRACE_DB
ULONG MaintainObjectTypeList : 1; // FLG_MAINTAIN_OBJECT_TYPELIST
ULONG HeapEnableTagByDll : 1; // FLG_HEAP_ENABLE_TAG_BY_DLL
ULONG DisableStackExtension : 1; // FLG_DISABLE_STACK_EXTENSION
ULONG EnableCsrDebug : 1; // FLG_ENABLE_CSRDEBUG
ULONG EnableKDebugSymbolLoad : 1; // FLG_ENABLE_KDEBUG_SYMBOL_LOAD
ULONG DisablePageKernelStacks : 1; // FLG_DISABLE_PAGE_KERNEL_STACKS
ULONG EnableSystemCritBreaks : 1; // FLG_ENABLE_SYSTEM_CRIT_BREAKS
ULONG HeapDisableCoalescing : 1; // FLG_HEAP_DISABLE_COALESCING
ULONG EnableCloseExceptions : 1; // FLG_ENABLE_CLOSE_EXCEPTIONS
ULONG EnableExceptionLogging : 1; // FLG_ENABLE_EXCEPTION_LOGGING
ULONG EnableHandleTypeTagging : 1; // FLG_ENABLE_HANDLE_TYPE_TAGGING
ULONG HeapPageAllocs : 1; // FLG_HEAP_PAGE_ALLOCS
ULONG DebugInitialCommandEx : 1; // FLG_DEBUG_INITIAL_COMMAND_EX
ULONG DisableDbgPrint : 1; // FLG_DISABLE_DBGPRINT
ULONG CritSecEventCreation : 1; // FLG_CRITSEC_EVENT_CREATION
ULONG LdrTopDown : 1; // FLG_LDR_TOP_DOWN
ULONG EnableHandleExceptions : 1; // FLG_ENABLE_HANDLE_EXCEPTIONS
ULONG DisableProtDlls : 1; // FLG_DISABLE_PROTDLLS
} NtGlobalFlags;
};
//
// Timeout for critical sections.
//
LARGE_INTEGER CriticalSectionTimeout;
//
// Reserved size for heap segments.
//
SIZE_T HeapSegmentReserve;
//
// Committed size for heap segments.
//
SIZE_T HeapSegmentCommit;
//
// Threshold for decommitting total free heap.
//
SIZE_T HeapDeCommitTotalFreeThreshold;
//
// Threshold for decommitting free heap blocks.
//
SIZE_T HeapDeCommitFreeBlockThreshold;
//
// Number of process heaps.
//
ULONG NumberOfHeaps;
//
// Maximum number of process heaps.
//
ULONG MaximumNumberOfHeaps;
//
// Pointer to an array of process heaps. ProcessHeaps is initialized
// to point to the first free byte after the PEB and MaximumNumberOfHeaps
// is computed from the page size used to hold the PEB, less the fixed
// size of this data structure.
//
PVOID* ProcessHeaps;
//
// Pointer to the system GDI shared handle table.
//
PGDI_HANDLE_ENTRY GdiSharedHandleTable;
//
// Pointer to the process starter helper.
//
PVOID ProcessStarterHelper;
//
// The maximum number of GDI function calls during batch operations (GdiSetBatchLimit)
//
ULONG GdiDCAttributeList;
//
// Pointer to the loader lock critical section.
//
PRTL_CRITICAL_SECTION LoaderLock;
//
// Major version of the operating system.
//
ULONG OSMajorVersion;
//
// Minor version of the operating system.
//
ULONG OSMinorVersion;
//
// Build number of the operating system.
//
USHORT OSBuildNumber;
//
// CSD version of the operating system.
//
USHORT OSCSDVersion;
//
// Platform ID of the operating system.
//
ULONG OSPlatformId;
//
// Subsystem version of the current process image (PE Headers).
//
ULONG ImageSubsystem;
//
// Major version of the current process image subsystem (PE Headers).
//
ULONG ImageSubsystemMajorVersion;
//
// Minor version of the current process image subsystem (PE Headers).
//
ULONG ImageSubsystemMinorVersion;
//
// Affinity mask for the current process.
//
KAFFINITY ActiveProcessAffinityMask;
//
// Temporary buffer for GDI handles accumulated in the current batch.
//
GDI_HANDLE_BUFFER GdiHandleBuffer;
//
// Pointer to the post-process initialization routine available for use by the application.
//
PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
//
// Pointer to the TLS expansion bitmap.
//
PRTL_BITMAP TlsExpansionBitmap;
//
// Bits for the TLS expansion bitmap. TLS_EXPANSION_SLOTS
//
ULONG TlsExpansionBitmapBits[32];
//
// Session ID of the current process.
//
ULONG SessionId;
//
// Application compatibility flags. KACF_*
//
ULARGE_INTEGER AppCompatFlags;
//
// Application compatibility flags. KACF_*
//
ULARGE_INTEGER AppCompatFlagsUser;
//
// Pointer to the Application SwitchBack Compatibility Engine.
//
PVOID pShimData;
//
// Pointer to the Application Compatibility Engine.
//
APPCOMPAT_EXE_DATA* AppCompatInfo;
//
// CSD version string of the operating system.
//
UNICODE_STRING CSDVersion;
//
// Pointer to the process activation context.
//
PACTIVATION_CONTEXT_DATA ActivationContextData;
//
// Pointer to the process assembly storage map.
//
PASSEMBLY_STORAGE_MAP ProcessAssemblyStorageMap;
//
// Pointer to the system default activation context.
//
PACTIVATION_CONTEXT_DATA SystemDefaultActivationContextData;
//
// Pointer to the system assembly storage map.
//
PASSEMBLY_STORAGE_MAP SystemAssemblyStorageMap;
//
// Minimum stack commit size.
//
SIZE_T MinimumStackCommit;
//
// since 19H1 (previously FlsCallback to FlsHighIndex)
//
PVOID SparePointers[2];
//
// Pointer to the patch loader data.
//
PVOID PatchLoaderData;
//
// Pointer to the CHPE V2 process information. CHPEV2_PROCESS_INFO
//
PVOID ChpeV2ProcessInfo;
//
// Packaged process feature state.
//
ULONG AppModelFeatureState;
//
// SpareUlongs
//
ULONG SpareUlongs[2];
//
// Active code page.
//
USHORT ActiveCodePage;
//
// OEM code page.
//
USHORT OemCodePage;
//
// Code page case mapping.
//
USHORT UseCaseMapping;
//
// Unused NLS field.
//
USHORT UnusedNlsField;
//
// Pointer to the application WER registration data.
//
PWER_PEB_HEADER_BLOCK WerRegistrationData;
//
// Pointer to the application WER assert pointer.
//
PVOID WerShipAssertPtr;
//
// Pointer to the EC bitmap on ARM64. (Windows 11 and above)
//
union
{
PVOID pContextData; // Pointer to the switchback compatibility engine (Windows 7 and below)
PVOID EcCodeBitMap; // Pointer to the EC bitmap on ARM64 (Windows 11 and above) // since WIN11
};
//
// Reserved.
//
PVOID ImageHeaderHash;
//
// ETW tracing flags.
//
union
{
ULONG TracingFlags;
struct
{
ULONG HeapTracingEnabled : 1; // ETW heap tracing enabled.
ULONG CritSecTracingEnabled : 1; // ETW lock tracing enabled.
ULONG LibLoaderTracingEnabled : 1; // ETW loader tracing enabled.
ULONG SpareTracingBits : 29;
};
};
//
// Reserved for CSRSS.
//
ULONGLONG CsrServerReadOnlySharedMemoryBase;
//
// Pointer to the thread pool worker list lock.
//
PRTL_CRITICAL_SECTION TppWorkerpListLock;
//
// Pointer to the thread pool worker list.
//
LIST_ENTRY TppWorkerpList;
//
// Wait on address hash table. (RtlWaitOnAddress)
//
PVOID WaitOnAddressHashTable[128];
//
// Pointer to the telemetry coverage header. // since RS3
//
PTELEMETRY_COVERAGE_HEADER TelemetryCoverageHeader;
//
// Cloud file flags. (ProjFs and Cloud Files) // since RS4
//
ULONG CloudFileFlags;
//
// Cloud file diagnostic flags.
//
ULONG CloudFileDiagFlags;
//
// Placeholder compatibility mode. (ProjFs and Cloud Files)
//
CHAR PlaceholderCompatibilityMode;
//
// Reserved for placeholder compatibility mode.
//
CHAR PlaceholderCompatibilityModeReserved[7];
//
// Pointer to leap second data. // since RS5
//
PLEAP_SECOND_DATA LeapSecondData;
//
// Leap second flags.
//
union
{
ULONG LeapSecondFlags;
struct
{
ULONG SixtySecondEnabled : 1; // Leap seconds enabled.
ULONG Reserved : 31;
};
};
//
// Global flags for the process.
//
ULONG NtGlobalFlag2;
//
// Extended feature disable mask (AVX). // since WIN11
//
ULONGLONG ExtendedFeatureDisableMask;
} PEB, *PPEB;
typedef LONG KPRIORITY, *PKPRIORITY;
typedef struct _PROCESS_BASIC_INFORMATION
{
NTSTATUS ExitStatus; // The exit status of the process. (GetExitCodeProcess)
PPEB PebBaseAddress; // A pointer to the process environment block (PEB) of the process.
KAFFINITY AffinityMask; // The affinity mask of the process. (GetProcessAffinityMask) (deprecated)
KPRIORITY BasePriority; // The base priority of the process. (GetPriorityClass)
HANDLE UniqueProcessId; // The unique identifier of the process. (GetProcessId)
HANDLE InheritedFromUniqueProcessId; // The unique identifier of the parent process.
} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
typedef struct _PROCESS_EXTENDED_BASIC_INFORMATION
{
_In_ SIZE_T Size; // The size of the structure, in bytes. This member must be set to sizeof(PROCESS_EXTENDED_BASIC_INFORMATION).
union
{
PROCESS_BASIC_INFORMATION BasicInfo;
struct
{
NTSTATUS ExitStatus; // The exit status of the process. (GetExitCodeProcess)
PPEB PebBaseAddress; // A pointer to the process environment block (PEB) of the process.
KAFFINITY AffinityMask; // The affinity mask of the process. (GetProcessAffinityMask) (deprecated)
KPRIORITY BasePriority; // The base priority of the process. (GetPriorityClass)
HANDLE UniqueProcessId; // The unique identifier of the process. (GetProcessId)
HANDLE InheritedFromUniqueProcessId; // The unique identifier of the parent process.
};
};
union
{
ULONG Flags;
struct
{
ULONG IsProtectedProcess : 1;
ULONG IsWow64Process : 1;
ULONG IsProcessDeleting : 1;
ULONG IsCrossSessionCreate : 1;
ULONG IsFrozen : 1;
ULONG IsBackground : 1; // WIN://BGKD
ULONG IsStronglyNamed : 1; // WIN://SYSAPPID
ULONG IsSecureProcess : 1;
ULONG IsSubsystemProcess : 1;
ULONG IsTrustedApp : 1; // since 24H2
ULONG SpareBits : 22;
};
};
} PROCESS_EXTENDED_BASIC_INFORMATION, *PPROCESS_EXTENDED_BASIC_INFORMATION;
typedef struct _CLIENT_ID
{
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
typedef enum _KWAIT_REASON
{
Executive, // Waiting for an executive event.
FreePage, // Waiting for a free page.
PageIn, // Waiting for a page to be read in.
PoolAllocation, // Waiting for a pool allocation.
DelayExecution, // Waiting due to a delay execution. // NtDelayExecution
Suspended, // Waiting because the thread is suspended. // NtSuspendThread
UserRequest, // Waiting due to a user request. // NtWaitForSingleObject
WrExecutive, // Waiting for an executive event.
WrFreePage, // Waiting for a free page.
WrPageIn, // Waiting for a page to be read in.
WrPoolAllocation, // Waiting for a pool allocation. // 10
WrDelayExecution, // Waiting due to a delay execution.
WrSuspended, // Waiting because the thread is suspended.
WrUserRequest, // Waiting due to a user request.
WrEventPair, // Waiting for an event pair. // NtCreateEventPair
WrQueue, // Waiting for a queue. // NtRemoveIoCompletion
WrLpcReceive, // Waiting for an LPC receive. // NtReplyWaitReceivePort
WrLpcReply, // Waiting for an LPC reply. // NtRequestWaitReplyPort
WrVirtualMemory, // Waiting for virtual memory.
WrPageOut, // Waiting for a page to be written out. // NtFlushVirtualMemory
WrRendezvous, // Waiting for a rendezvous. // 20
WrKeyedEvent, // Waiting for a keyed event. // NtCreateKeyedEvent
WrTerminated, // Waiting for thread termination.
WrProcessInSwap, // Waiting for a process to be swapped in.
WrCpuRateControl, // Waiting for CPU rate control.
WrCalloutStack, // Waiting for a callout stack.
WrKernel, // Waiting for a kernel event.
WrResource, // Waiting for a resource.
WrPushLock, // Waiting for a push lock.
WrMutex, // Waiting for a mutex.
WrQuantumEnd, // Waiting for the end of a quantum. // 30
WrDispatchInt, // Waiting for a dispatch interrupt.
WrPreempted, // Waiting because the thread was preempted.
WrYieldExecution, // Waiting to yield execution.
WrFastMutex, // Waiting for a fast mutex.
WrGuardedMutex, // Waiting for a guarded mutex.
WrRundown, // Waiting for a rundown.
WrAlertByThreadId, // Waiting for an alert by thread ID.
WrDeferredPreempt, // Waiting for a deferred preemption.
WrPhysicalFault, // Waiting for a physical fault.
WrIoRing, // Waiting for an I/O ring. // 40
WrMdlCache, // Waiting for an MDL cache.
WrRcu, // Waiting for read-copy-update (RCU) synchronization.
MaximumWaitReason
} KWAIT_REASON, *PKWAIT_REASON;
typedef enum _KTHREAD_STATE
{
Initialized,
Ready,
Running,
Standby,
Terminated,
Waiting,
Transition,
DeferredReady,
GateWaitObsolete,
WaitingForProcessInSwap,
MaximumThreadState
} KTHREAD_STATE, *PKTHREAD_STATE;
typedef struct _SYSTEM_THREAD_INFORMATION
{
LARGE_INTEGER KernelTime; // Number of 100-nanosecond intervals spent executing kernel code.
LARGE_INTEGER UserTime; // Number of 100-nanosecond intervals spent executing user code.
LARGE_INTEGER CreateTime; // The date and time when the thread was created.
ULONG WaitTime; // The current time spent in ready queue or waiting (depending on the thread state).
PVOID StartAddress; // The initial start address of the thread.
CLIENT_ID ClientId; // The identifier of the thread and the process owning the thread.
KPRIORITY Priority; // The dynamic priority of the thread.
KPRIORITY BasePriority; // The starting priority of the thread.
ULONG ContextSwitches; // The total number of context switches performed.
KTHREAD_STATE ThreadState; // The current state of the thread.
KWAIT_REASON WaitReason; // The current reason the thread is waiting.
} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
typedef struct _SYSTEM_PROCESS_INFORMATION
{
ULONG NextEntryOffset; // The address of the previous item plus the value in the NextEntryOffset member. For the last item in the array, NextEntryOffset is 0.
ULONG NumberOfThreads; // The NumberOfThreads member contains the number of threads in the process.
ULONGLONG WorkingSetPrivateSize; // The total private memory that a process currently has allocated and is physically resident in memory. // since VISTA
ULONG HardFaultCount; // The total number of hard faults for data from disk rather than from in-memory pages. // since WIN7
ULONG NumberOfThreadsHighWatermark; // The peak number of threads that were running at any given point in time, indicative of potential performance bottlenecks related to thread management.
ULONGLONG CycleTime; // The sum of the cycle time of all threads in the process.
LARGE_INTEGER CreateTime; // Number of 100-nanosecond intervals since the creation time of the process. Not updated during system timezone changes.
LARGE_INTEGER UserTime; // Number of 100-nanosecond intervals the process has executed in user mode.
LARGE_INTEGER KernelTime; // Number of 100-nanosecond intervals the process has executed in kernel mode.
UNICODE_STRING ImageName; // The file name of the executable image.
KPRIORITY BasePriority; // The starting priority of the process.
HANDLE UniqueProcessId; // The identifier of the process.
HANDLE InheritedFromUniqueProcessId; // The identifier of the process that created this process. Not updated and incorrectly refers to processes with recycled identifiers.
ULONG HandleCount; // The current number of open handles used by the process.
ULONG SessionId; // The identifier of the Remote Desktop Services session under which the specified process is running.
ULONG_PTR UniqueProcessKey; // since VISTA (requires SystemExtendedProcessInformation)
SIZE_T PeakVirtualSize; // The peak size, in bytes, of the virtual memory used by the process.
SIZE_T VirtualSize; // The current size, in bytes, of virtual memory used by the process.
ULONG PageFaultCount; // The total number of page faults for data that is not currently in memory. The value wraps around to zero on average 24 hours.
SIZE_T PeakWorkingSetSize; // The peak size, in kilobytes, of the working set of the process.
SIZE_T WorkingSetSize; // The number of pages visible to the process in physical memory. These pages are resident and available for use without triggering a page fault.
SIZE_T QuotaPeakPagedPoolUsage; // The peak quota charged to the process for pool usage, in bytes.
SIZE_T QuotaPagedPoolUsage; // The quota charged to the process for paged pool usage, in bytes.
SIZE_T QuotaPeakNonPagedPoolUsage; // The peak quota charged to the process for nonpaged pool usage, in bytes.
SIZE_T QuotaNonPagedPoolUsage; // The current quota charged to the process for nonpaged pool usage.
SIZE_T PagefileUsage; // The total number of bytes of page file storage in use by the process.
SIZE_T PeakPagefileUsage; // The maximum number of bytes of page-file storage used by the process.
SIZE_T PrivatePageCount; // The number of memory pages allocated for the use by the process.
LARGE_INTEGER ReadOperationCount; // The total number of read operations performed.
LARGE_INTEGER WriteOperationCount; // The total number of write operations performed.
LARGE_INTEGER OtherOperationCount; // The total number of I/O operations performed other than read and write operations.
LARGE_INTEGER ReadTransferCount; // The total number of bytes read during a read operation.
LARGE_INTEGER WriteTransferCount; // The total number of bytes written during a write operation.
LARGE_INTEGER OtherTransferCount; // The total number of bytes transferred during operations other than read and write operations.
SYSTEM_THREAD_INFORMATION Threads[1]; // This type is not defined in the structure but was added for convenience.
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
typedef enum _SYSTEM_INFORMATION_CLASS
{
SystemBasicInformation, // q: SYSTEM_BASIC_INFORMATION
SystemProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION
SystemPerformanceInformation, // q: SYSTEM_PERFORMANCE_INFORMATION
SystemTimeOfDayInformation, // q: SYSTEM_TIMEOFDAY_INFORMATION
SystemPathInformation, // q: not implemented
SystemProcessInformation, // q: SYSTEM_PROCESS_INFORMATION
SystemCallCountInformation, // q: SYSTEM_CALL_COUNT_INFORMATION
SystemDeviceInformation, // q: SYSTEM_DEVICE_INFORMATION
SystemProcessorPerformanceInformation, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION (EX in: USHORT ProcessorGroup)
SystemFlagsInformation, // qs: SYSTEM_FLAGS_INFORMATION
SystemCallTimeInformation, // q: SYSTEM_CALL_TIME_INFORMATION // not implemented // 10
SystemModuleInformation, // q: RTL_PROCESS_MODULES
SystemLocksInformation, // q: RTL_PROCESS_LOCKS
SystemStackTraceInformation, // q: RTL_PROCESS_BACKTRACES
SystemPagedPoolInformation, // q: not implemented
SystemNonPagedPoolInformation, // q: not implemented
SystemHandleInformation, // q: SYSTEM_HANDLE_INFORMATION
SystemObjectInformation, // q: SYSTEM_OBJECTTYPE_INFORMATION mixed with SYSTEM_OBJECT_INFORMATION
SystemPageFileInformation, // q: SYSTEM_PAGEFILE_INFORMATION
SystemVdmInstemulInformation, // q: SYSTEM_VDM_INSTEMUL_INFO
SystemVdmBopInformation, // q: not implemented // 20
SystemFileCacheInformation, // qs: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemCache)
SystemPoolTagInformation, // q: SYSTEM_POOLTAG_INFORMATION
SystemInterruptInformation, // q: SYSTEM_INTERRUPT_INFORMATION (EX in: USHORT ProcessorGroup)
SystemDpcBehaviorInformation, // qs: SYSTEM_DPC_BEHAVIOR_INFORMATION; s: SYSTEM_DPC_BEHAVIOR_INFORMATION (requires SeLoadDriverPrivilege)
SystemFullMemoryInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION // not implemented
SystemLoadGdiDriverInformation, // s: (kernel-mode only)
SystemUnloadGdiDriverInformation, // s: (kernel-mode only)
SystemTimeAdjustmentInformation, // qs: SYSTEM_QUERY_TIME_ADJUST_INFORMATION; s: SYSTEM_SET_TIME_ADJUST_INFORMATION (requires SeSystemtimePrivilege)
SystemSummaryMemoryInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION // not implemented
SystemMirrorMemoryInformation, // qs: (requires license value "Kernel-MemoryMirroringSupported") (requires SeShutdownPrivilege) // 30
SystemPerformanceTraceInformation, // qs: (type depends on EVENT_TRACE_INFORMATION_CLASS)
SystemObsolete0, // q: not implemented
SystemExceptionInformation, // q: SYSTEM_EXCEPTION_INFORMATION
SystemCrashDumpStateInformation, // s: SYSTEM_CRASH_DUMP_STATE_INFORMATION (requires SeDebugPrivilege)
SystemKernelDebuggerInformation, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION
SystemContextSwitchInformation, // q: SYSTEM_CONTEXT_SWITCH_INFORMATION
SystemRegistryQuotaInformation, // qs: SYSTEM_REGISTRY_QUOTA_INFORMATION; s (requires SeIncreaseQuotaPrivilege)
SystemExtendServiceTableInformation, // s: (requires SeLoadDriverPrivilege) // loads win32k only
SystemPrioritySeparation, // s: (requires SeTcbPrivilege)
SystemVerifierAddDriverInformation, // s: UNICODE_STRING (requires SeDebugPrivilege) // 40
SystemVerifierRemoveDriverInformation, // s: UNICODE_STRING (requires SeDebugPrivilege)
SystemProcessorIdleInformation, // q: SYSTEM_PROCESSOR_IDLE_INFORMATION (EX in: USHORT ProcessorGroup)
SystemLegacyDriverInformation, // q: SYSTEM_LEGACY_DRIVER_INFORMATION
SystemCurrentTimeZoneInformation, // qs: RTL_TIME_ZONE_INFORMATION
SystemLookasideInformation, // q: SYSTEM_LOOKASIDE_INFORMATION
SystemTimeSlipNotification, // s: HANDLE (NtCreateEvent) (requires SeSystemtimePrivilege)
SystemSessionCreate, // q: not implemented
SystemSessionDetach, // q: not implemented
SystemSessionInformation, // q: not implemented (SYSTEM_SESSION_INFORMATION)
SystemRangeStartInformation, // q: SYSTEM_RANGE_START_INFORMATION // 50
SystemVerifierInformation, // qs: SYSTEM_VERIFIER_INFORMATION; s (requires SeDebugPrivilege)
SystemVerifierThunkExtend, // qs: (kernel-mode only)
SystemSessionProcessInformation, // q: SYSTEM_SESSION_PROCESS_INFORMATION
SystemLoadGdiDriverInSystemSpace, // qs: SYSTEM_GDI_DRIVER_INFORMATION (kernel-mode only) (same as SystemLoadGdiDriverInformation)
SystemNumaProcessorMap, // q: SYSTEM_NUMA_INFORMATION
SystemPrefetcherInformation, // qs: PREFETCHER_INFORMATION // PfSnQueryPrefetcherInformation
SystemExtendedProcessInformation, // q: SYSTEM_EXTENDED_PROCESS_INFORMATION
SystemRecommendedSharedDataAlignment, // q: ULONG // KeGetRecommendedSharedDataAlignment
SystemComPlusPackage, // qs: ULONG
SystemNumaAvailableMemory, // q: SYSTEM_NUMA_INFORMATION // 60
SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION (EX in: USHORT ProcessorGroup)
SystemEmulationBasicInformation, // q: SYSTEM_BASIC_INFORMATION
SystemEmulationProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION
SystemExtendedHandleInformation, // q: SYSTEM_HANDLE_INFORMATION_EX
SystemLostDelayedWriteInformation, // q: ULONG
SystemBigPoolInformation, // q: SYSTEM_BIGPOOL_INFORMATION
SystemSessionPoolTagInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION
SystemSessionMappedViewInformation, // q: SYSTEM_SESSION_MAPPED_VIEW_INFORMATION
SystemHotpatchInformation, // qs: SYSTEM_HOTPATCH_CODE_INFORMATION
SystemObjectSecurityMode, // q: ULONG // 70
SystemWatchdogTimerHandler, // s: SYSTEM_WATCHDOG_HANDLER_INFORMATION // (kernel-mode only)
SystemWatchdogTimerInformation, // qs: out: SYSTEM_WATCHDOG_TIMER_INFORMATION (EX in: ULONG WATCHDOG_INFORMATION_CLASS) // NtQuerySystemInformationEx
SystemLogicalProcessorInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx
SystemWow64SharedInformationObsolete, // q: not implemented
SystemRegisterFirmwareTableInformationHandler, // s: SYSTEM_FIRMWARE_TABLE_HANDLER // (kernel-mode only)
SystemFirmwareTableInformation, // q: SYSTEM_FIRMWARE_TABLE_INFORMATION
SystemModuleInformationEx, // q: RTL_PROCESS_MODULE_INFORMATION_EX // since VISTA
SystemVerifierTriageInformation, // q: not implemented
SystemSuperfetchInformation, // qs: SUPERFETCH_INFORMATION // PfQuerySuperfetchInformation
SystemMemoryListInformation, // q: SYSTEM_MEMORY_LIST_INFORMATION; s: SYSTEM_MEMORY_LIST_COMMAND (requires SeProfileSingleProcessPrivilege) // 80
SystemFileCacheInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (same as SystemFileCacheInformation)
SystemThreadPriorityClientIdInformation, // s: SYSTEM_THREAD_CID_PRIORITY_INFORMATION (requires SeIncreaseBasePriorityPrivilege) // NtQuerySystemInformationEx
SystemProcessorIdleCycleTimeInformation, // q: SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION[] (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx
SystemVerifierCancellationInformation, // q: SYSTEM_VERIFIER_CANCELLATION_INFORMATION // name:wow64:whNT32QuerySystemVerifierCancellationInformation
SystemProcessorPowerInformationEx, // q: not implemented
SystemRefTraceInformation, // qs: SYSTEM_REF_TRACE_INFORMATION // ObQueryRefTraceInformation
SystemSpecialPoolInformation, // qs: SYSTEM_SPECIAL_POOL_INFORMATION (requires SeDebugPrivilege) // MmSpecialPoolTag, then MmSpecialPoolCatchOverruns != 0
SystemProcessIdInformation, // q: SYSTEM_PROCESS_ID_INFORMATION
SystemErrorPortInformation, // s: (requires SeTcbPrivilege)
SystemBootEnvironmentInformation, // q: SYSTEM_BOOT_ENVIRONMENT_INFORMATION // 90
SystemHypervisorInformation, // q: SYSTEM_HYPERVISOR_QUERY_INFORMATION
SystemVerifierInformationEx, // qs: SYSTEM_VERIFIER_INFORMATION_EX
SystemTimeZoneInformation, // qs: RTL_TIME_ZONE_INFORMATION (requires SeTimeZonePrivilege)
SystemImageFileExecutionOptionsInformation, // s: SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION (requires SeTcbPrivilege)
SystemCoverageInformation, // q: COVERAGE_MODULES s: COVERAGE_MODULE_REQUEST // ExpCovQueryInformation (requires SeDebugPrivilege)
SystemPrefetchPatchInformation, // q: SYSTEM_PREFETCH_PATCH_INFORMATION
SystemVerifierFaultsInformation, // s: SYSTEM_VERIFIER_FAULTS_INFORMATION (requires SeDebugPrivilege)
SystemSystemPartitionInformation, // q: SYSTEM_SYSTEM_PARTITION_INFORMATION
SystemSystemDiskInformation, // q: SYSTEM_SYSTEM_DISK_INFORMATION
SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx // 100
SystemNumaProximityNodeInformation, // qs: SYSTEM_NUMA_PROXIMITY_MAP
SystemDynamicTimeZoneInformation, // qs: RTL_DYNAMIC_TIME_ZONE_INFORMATION (requires SeTimeZonePrivilege)
SystemCodeIntegrityInformation, // q: SYSTEM_CODEINTEGRITY_INFORMATION // SeCodeIntegrityQueryInformation
SystemProcessorMicrocodeUpdateInformation, // s: SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION (requires SeLoadDriverPrivilege)
SystemProcessorBrandString, // q: CHAR[] // HaliQuerySystemInformation -> HalpGetProcessorBrandString, info class 23
SystemVirtualAddressInformation, // q: SYSTEM_VA_LIST_INFORMATION[]; s: SYSTEM_VA_LIST_INFORMATION[] (requires SeIncreaseQuotaPrivilege) // MmQuerySystemVaInformation
SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX (EX in: LOGICAL_PROCESSOR_RELATIONSHIP RelationshipType) // since WIN7 // NtQuerySystemInformationEx // KeQueryLogicalProcessorRelationship
SystemProcessorCycleTimeInformation, // q: SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[] (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx
SystemStoreInformation, // qs: SYSTEM_STORE_INFORMATION (requires SeProfileSingleProcessPrivilege) // SmQueryStoreInformation
SystemRegistryAppendString, // s: SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // 110
SystemAitSamplingValue, // s: ULONG (requires SeProfileSingleProcessPrivilege)
SystemVhdBootInformation, // q: SYSTEM_VHD_BOOT_INFORMATION
SystemCpuQuotaInformation, // qs: PS_CPU_QUOTA_QUERY_INFORMATION
SystemNativeBasicInformation, // q: SYSTEM_BASIC_INFORMATION
SystemErrorPortTimeouts, // q: SYSTEM_ERROR_PORT_TIMEOUTS
SystemLowPriorityIoInformation, // q: SYSTEM_LOW_PRIORITY_IO_INFORMATION
SystemTpmBootEntropyInformation, // q: BOOT_ENTROPY_NT_RESULT // ExQueryBootEntropyInformation
SystemVerifierCountersInformation, // q: SYSTEM_VERIFIER_COUNTERS_INFORMATION
SystemPagedPoolInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypePagedPool)
SystemSystemPtesInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemPtes) // 120
SystemNodeDistanceInformation, // q: USHORT[4*NumaNodes] // (EX in: USHORT NodeNumber) // NtQuerySystemInformationEx
SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26
SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation
SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1
SystemSessionBigPoolInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION // since WIN8
SystemBootGraphicsInformation, // qs: SYSTEM_BOOT_GRAPHICS_INFORMATION (kernel-mode only)
SystemScrubPhysicalMemoryInformation, // qs: MEMORY_SCRUB_INFORMATION
SystemBadPageInformation, // q: SYSTEM_BAD_PAGE_INFORMATION
SystemProcessorProfileControlArea, // qs: SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA
SystemCombinePhysicalMemoryInformation, // s: MEMORY_COMBINE_INFORMATION, MEMORY_COMBINE_INFORMATION_EX, MEMORY_COMBINE_INFORMATION_EX2 // 130
SystemEntropyInterruptTimingInformation, // qs: SYSTEM_ENTROPY_TIMING_INFORMATION
SystemConsoleInformation, // qs: SYSTEM_CONSOLE_INFORMATION // (requires SeLoadDriverPrivilege)
SystemPlatformBinaryInformation, // q: SYSTEM_PLATFORM_BINARY_INFORMATION (requires SeTcbPrivilege)
SystemPolicyInformation, // q: SYSTEM_POLICY_INFORMATION (Warbird/Encrypt/Decrypt/Execute)
SystemHypervisorProcessorCountInformation, // q: SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION
SystemDeviceDataInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION
SystemDeviceDataEnumerationInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION
SystemMemoryTopologyInformation, // q: SYSTEM_MEMORY_TOPOLOGY_INFORMATION
SystemMemoryChannelInformation, // q: SYSTEM_MEMORY_CHANNEL_INFORMATION
SystemBootLogoInformation, // q: SYSTEM_BOOT_LOGO_INFORMATION // 140
SystemProcessorPerformanceInformationEx, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx // since WINBLUE
SystemCriticalProcessErrorLogInformation, // q: CRITICAL_PROCESS_EXCEPTION_DATA
SystemSecureBootPolicyInformation, // q: SYSTEM_SECUREBOOT_POLICY_INFORMATION
SystemPageFileInformationEx, // q: SYSTEM_PAGEFILE_INFORMATION_EX
SystemSecureBootInformation, // q: SYSTEM_SECUREBOOT_INFORMATION
SystemEntropyInterruptTimingRawInformation, // qs: SYSTEM_ENTROPY_TIMING_INFORMATION
SystemPortableWorkspaceEfiLauncherInformation, // q: SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION
SystemFullProcessInformation, // q: SYSTEM_EXTENDED_PROCESS_INFORMATION with SYSTEM_PROCESS_INFORMATION_EXTENSION (requires admin)
SystemKernelDebuggerInformationEx, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX
SystemBootMetadataInformation, // q: (requires SeTcbPrivilege) // 150
SystemSoftRebootInformation, // q: ULONG
SystemElamCertificateInformation, // s: SYSTEM_ELAM_CERTIFICATE_INFORMATION
SystemOfflineDumpConfigInformation, // q: OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2
SystemProcessorFeaturesInformation, // q: SYSTEM_PROCESSOR_FEATURES_INFORMATION
SystemRegistryReconciliationInformation, // s: NULL (requires admin) (flushes registry hives)
SystemEdidInformation, // q: SYSTEM_EDID_INFORMATION
SystemManufacturingInformation, // q: SYSTEM_MANUFACTURING_INFORMATION // since THRESHOLD
SystemEnergyEstimationConfigInformation, // q: SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION
SystemHypervisorDetailInformation, // q: SYSTEM_HYPERVISOR_DETAIL_INFORMATION
SystemProcessorCycleStatsInformation, // q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx // 160
SystemVmGenerationCountInformation, // s:
SystemTrustedPlatformModuleInformation, // q: SYSTEM_TPM_INFORMATION
SystemKernelDebuggerFlags, // q: SYSTEM_KERNEL_DEBUGGER_FLAGS
SystemCodeIntegrityPolicyInformation, // qs: SYSTEM_CODEINTEGRITYPOLICY_INFORMATION
SystemIsolatedUserModeInformation, // q: SYSTEM_ISOLATED_USER_MODE_INFORMATION
SystemHardwareSecurityTestInterfaceResultsInformation, // q:
SystemSingleModuleInformation, // q: SYSTEM_SINGLE_MODULE_INFORMATION
SystemAllowedCpuSetsInformation, // s: SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION
SystemVsmProtectionInformation, // q: SYSTEM_VSM_PROTECTION_INFORMATION (previously SystemDmaProtectionInformation)
SystemInterruptCpuSetsInformation, // q: SYSTEM_INTERRUPT_CPU_SET_INFORMATION // 170
SystemSecureBootPolicyFullInformation, // q: SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION
SystemCodeIntegrityPolicyFullInformation, // q:
SystemAffinitizedInterruptProcessorInformation, // q: KAFFINITY_EX // (requires SeIncreaseBasePriorityPrivilege)
SystemRootSiloInformation, // q: SYSTEM_ROOT_SILO_INFORMATION
SystemCpuSetInformation, // q: SYSTEM_CPU_SET_INFORMATION // since THRESHOLD2
SystemCpuSetTagInformation, // q: SYSTEM_CPU_SET_TAG_INFORMATION
SystemWin32WerStartCallout, // s:
SystemSecureKernelProfileInformation, // q: SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION
SystemCodeIntegrityPlatformManifestInformation, // q: SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION // NtQuerySystemInformationEx // since REDSTONE
SystemInterruptSteeringInformation, // q: in: SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT, out: SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT // NtQuerySystemInformationEx
SystemSupportedProcessorArchitectures, // p: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx // 180
SystemMemoryUsageInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION
SystemCodeIntegrityCertificateInformation, // q: SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION
SystemPhysicalMemoryInformation, // q: SYSTEM_PHYSICAL_MEMORY_INFORMATION // since REDSTONE2
SystemControlFlowTransition, // qs: (Warbird/Encrypt/Decrypt/Execute)
SystemKernelDebuggingAllowed, // s: ULONG
SystemActivityModerationExeState, // s: SYSTEM_ACTIVITY_MODERATION_EXE_STATE
SystemActivityModerationUserSettings, // q: SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS
SystemCodeIntegrityPoliciesFullInformation, // qs: NtQuerySystemInformationEx
SystemCodeIntegrityUnlockInformation, // q: SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION // 190
SystemIntegrityQuotaInformation, // s: SYSTEM_INTEGRITY_QUOTA_INFORMATION (requires SeDebugPrivilege)
SystemFlushInformation, // q: SYSTEM_FLUSH_INFORMATION
SystemProcessorIdleMaskInformation, // q: ULONG_PTR[ActiveGroupCount] // since REDSTONE3
SystemSecureDumpEncryptionInformation, // qs: NtQuerySystemInformationEx // (q: requires SeDebugPrivilege) (s: requires SeTcbPrivilege)
SystemWriteConstraintInformation, // q: SYSTEM_WRITE_CONSTRAINT_INFORMATION
SystemKernelVaShadowInformation, // q: SYSTEM_KERNEL_VA_SHADOW_INFORMATION
SystemHypervisorSharedPageInformation, // q: SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION // since REDSTONE4
SystemFirmwareBootPerformanceInformation, // q:
SystemCodeIntegrityVerificationInformation, // q: SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION
SystemFirmwarePartitionInformation, // q: SYSTEM_FIRMWARE_PARTITION_INFORMATION // 200
SystemSpeculationControlInformation, // q: SYSTEM_SPECULATION_CONTROL_INFORMATION // (CVE-2017-5715) REDSTONE3 and above.
SystemDmaGuardPolicyInformation, // q: SYSTEM_DMA_GUARD_POLICY_INFORMATION
SystemEnclaveLaunchControlInformation, // q: SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION
SystemWorkloadAllowedCpuSetsInformation, // q: SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION // since REDSTONE5
SystemCodeIntegrityUnlockModeInformation, // q: SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION
SystemLeapSecondInformation, // qs: SYSTEM_LEAP_SECOND_INFORMATION // (s: requires SeSystemtimePrivilege)
SystemFlags2Information, // q: SYSTEM_FLAGS_INFORMATION // (s: requires SeDebugPrivilege)
SystemSecurityModelInformation, // q: SYSTEM_SECURITY_MODEL_INFORMATION // since 19H1
SystemCodeIntegritySyntheticCacheInformation, // qs: NtQuerySystemInformationEx
SystemFeatureConfigurationInformation, // q: in: SYSTEM_FEATURE_CONFIGURATION_QUERY, out: SYSTEM_FEATURE_CONFIGURATION_INFORMATION; s: SYSTEM_FEATURE_CONFIGURATION_UPDATE // NtQuerySystemInformationEx // since 20H1 // 210
SystemFeatureConfigurationSectionInformation, // q: in: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST, out: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION // NtQuerySystemInformationEx
SystemFeatureUsageSubscriptionInformation, // q: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS; s: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE
SystemSecureSpeculationControlInformation, // q: SECURE_SPECULATION_CONTROL_INFORMATION
SystemSpacesBootInformation, // qs: // since 20H2
SystemFwRamdiskInformation, // q: SYSTEM_FIRMWARE_RAMDISK_INFORMATION
SystemWheaIpmiHardwareInformation, // q:
SystemDifSetRuleClassInformation, // s: SYSTEM_DIF_VOLATILE_INFORMATION (requires SeDebugPrivilege)
SystemDifClearRuleClassInformation, // s: NULL (requires SeDebugPrivilege)
SystemDifApplyPluginVerificationOnDriver, // q: SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION (requires SeDebugPrivilege)
SystemDifRemovePluginVerificationOnDriver, // q: SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION (requires SeDebugPrivilege) // 220
SystemShadowStackInformation, // q: SYSTEM_SHADOW_STACK_INFORMATION
SystemBuildVersionInformation, // q: in: ULONG (LayerNumber), out: SYSTEM_BUILD_VERSION_INFORMATION // NtQuerySystemInformationEx
SystemPoolLimitInformation, // q: SYSTEM_POOL_LIMIT_INFORMATION (requires SeIncreaseQuotaPrivilege) // NtQuerySystemInformationEx
SystemCodeIntegrityAddDynamicStore, // q: CodeIntegrity-AllowConfigurablePolicy-CustomKernelSigners
SystemCodeIntegrityClearDynamicStores, // q: CodeIntegrity-AllowConfigurablePolicy-CustomKernelSigners
SystemDifPoolTrackingInformation, // s: SYSTEM_DIF_POOL_TRACKING_INFORMATION (requires SeDebugPrivilege)
SystemPoolZeroingInformation, // q: SYSTEM_POOL_ZEROING_INFORMATION
SystemDpcWatchdogInformation, // qs: SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION
SystemDpcWatchdogInformation2, // qs: SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION_V2
SystemSupportedProcessorArchitectures2, // q: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx // 230
SystemSingleProcessorRelationshipInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // (EX in: PROCESSOR_NUMBER Processor) // NtQuerySystemInformationEx
SystemXfgCheckFailureInformation, // q: SYSTEM_XFG_FAILURE_INFORMATION
SystemIommuStateInformation, // q: SYSTEM_IOMMU_STATE_INFORMATION // since 22H1
SystemHypervisorMinrootInformation, // q: SYSTEM_HYPERVISOR_MINROOT_INFORMATION
SystemHypervisorBootPagesInformation, // q: SYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION
SystemPointerAuthInformation, // q: SYSTEM_POINTER_AUTH_INFORMATION
SystemSecureKernelDebuggerInformation, // qs: NtQuerySystemInformationEx
SystemOriginalImageFeatureInformation, // q: in: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT, out: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT // NtQuerySystemInformationEx
SystemMemoryNumaInformation, // q: SYSTEM_MEMORY_NUMA_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT // NtQuerySystemInformationEx
SystemMemoryNumaPerformanceInformation, // q: SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT // since 24H2 // 240
SystemCodeIntegritySignedPoliciesFullInformation, // qs: NtQuerySystemInformationEx
SystemSecureCoreInformation, // qs: SystemSecureSecretsInformation
SystemTrustedAppsRuntimeInformation, // q: SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION
SystemBadPageInformationEx, // q: SYSTEM_BAD_PAGE_INFORMATION
SystemResourceDeadlockTimeout, // q: ULONG
SystemBreakOnContextUnwindFailureInformation, // q: ULONG (requires SeDebugPrivilege)
SystemOslRamdiskInformation, // q: SYSTEM_OSL_RAMDISK_INFORMATION
SystemCodeIntegrityPolicyManagementInformation, // q: SYSTEM_CODEINTEGRITYPOLICY_MANAGEMENT // since 25H2
SystemMemoryNumaCacheInformation, // q:
SystemProcessorFeaturesBitMapInformation, // q: // 250
SystemRefTraceInformationEx, // q: SYSTEM_REF_TRACE_INFORMATION_EX
SystemBasicProcessInformation, // q: SYSTEM_BASICPROCESS_INFORMATION
SystemHandleCountInformation, // q: SYSTEM_HANDLECOUNT_INFORMATION
SystemRuntimeAttestationReport, // q:
SystemPoolTagInformation2, // q: SYSTEM_POOLTAG_INFORMATION2 // since 26H1
MaxSystemInfoClass
} SYSTEM_INFORMATION_CLASS;
typedef enum _FILE_INFORMATION_CLASS
{
FileDirectoryInformation = 1, // q: FILE_DIRECTORY_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex])
FileFullDirectoryInformation, // q: FILE_FULL_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex])
FileBothDirectoryInformation, // q: FILE_BOTH_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex])
FileBasicInformation, // qs: FILE_BASIC_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES)
FileStandardInformation, // q: FILE_STANDARD_INFORMATION, FILE_STANDARD_INFORMATION_EX
FileInternalInformation, // q: FILE_INTERNAL_INFORMATION
FileEaInformation, // q: FILE_EA_INFORMATION (requires FILE_READ_EA)
FileAccessInformation, // q: FILE_ACCESS_INFORMATION
FileNameInformation, // q: FILE_NAME_INFORMATION
FileRenameInformation, // s: FILE_RENAME_INFORMATION (requires DELETE) // 10
FileLinkInformation, // s: FILE_LINK_INFORMATION
FileNamesInformation, // q: FILE_NAMES_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex])
FileDispositionInformation, // s: FILE_DISPOSITION_INFORMATION (requires DELETE)
FilePositionInformation, // qs: FILE_POSITION_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES)
FileFullEaInformation, // q: FILE_FULL_EA_INFORMATION (requires FILE_READ_EA)
FileModeInformation, // qs: FILE_MODE_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES)
FileAlignmentInformation, // q: FILE_ALIGNMENT_INFORMATION
FileAllInformation, // q: FILE_ALL_INFORMATION
FileAllocationInformation, // s: FILE_ALLOCATION_INFORMATION (requires FILE_WRITE_DATA)
FileEndOfFileInformation, // s: FILE_END_OF_FILE_INFORMATION (requires FILE_WRITE_DATA) // 20
FileAlternateNameInformation, // q: FILE_NAME_INFORMATION
FileStreamInformation, // q: FILE_STREAM_INFORMATION
FilePipeInformation, // qs: FILE_PIPE_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES)
FilePipeLocalInformation, // q: FILE_PIPE_LOCAL_INFORMATION
FilePipeRemoteInformation, // qs: FILE_PIPE_REMOTE_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES)
FileMailslotQueryInformation, // q: FILE_MAILSLOT_QUERY_INFORMATION
FileMailslotSetInformation, // s: FILE_MAILSLOT_SET_INFORMATION
FileCompressionInformation, // q: FILE_COMPRESSION_INFORMATION
FileObjectIdInformation, // q: FILE_OBJECTID_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex])
FileCompletionInformation, // s: FILE_COMPLETION_INFORMATION // 30
FileMoveClusterInformation, // s: FILE_MOVE_CLUSTER_INFORMATION (requires FILE_WRITE_DATA)
FileQuotaInformation, // q: FILE_QUOTA_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex])
FileReparsePointInformation, // q: FILE_REPARSE_POINT_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex])
FileNetworkOpenInformation, // q: FILE_NETWORK_OPEN_INFORMATION
FileAttributeTagInformation, // q: FILE_ATTRIBUTE_TAG_INFORMATION
FileTrackingInformation, // s: FILE_TRACKING_INFORMATION (requires FILE_WRITE_DATA)
FileIdBothDirectoryInformation, // q: FILE_ID_BOTH_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex])
FileIdFullDirectoryInformation, // q: FILE_ID_FULL_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex])
FileValidDataLengthInformation, // s: FILE_VALID_DATA_LENGTH_INFORMATION (requires FILE_WRITE_DATA and/or SeManageVolumePrivilege)
FileShortNameInformation, // s: FILE_NAME_INFORMATION (requires DELETE) // 40
FileIoCompletionNotificationInformation, // qs: FILE_IO_COMPLETION_NOTIFICATION_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) // since VISTA
FileIoStatusBlockRangeInformation, // s: FILE_IOSTATUSBLOCK_RANGE_INFORMATION (requires SeLockMemoryPrivilege)
FileIoPriorityHintInformation, // qs: FILE_IO_PRIORITY_HINT_INFORMATION, FILE_IO_PRIORITY_HINT_INFORMATION_EX (q: requires FILE_READ_DATA)
FileSfioReserveInformation, // qs: FILE_SFIO_RESERVE_INFORMATION (q: requires FILE_READ_DATA)
FileSfioVolumeInformation, // q: FILE_SFIO_VOLUME_INFORMATION
FileHardLinkInformation, // q: FILE_LINKS_INFORMATION
FileProcessIdsUsingFileInformation, // q: FILE_PROCESS_IDS_USING_FILE_INFORMATION
FileNormalizedNameInformation, // q: FILE_NAME_INFORMATION
FileNetworkPhysicalNameInformation, // q: FILE_NETWORK_PHYSICAL_NAME_INFORMATION
FileIdGlobalTxDirectoryInformation, // q: FILE_ID_GLOBAL_TX_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) // since WIN7 // 50
FileIsRemoteDeviceInformation, // q: FILE_IS_REMOTE_DEVICE_INFORMATION
FileUnusedInformation, // q:
FileNumaNodeInformation, // q: FILE_NUMA_NODE_INFORMATION
FileStandardLinkInformation, // q: FILE_STANDARD_LINK_INFORMATION
FileRemoteProtocolInformation, // q: FILE_REMOTE_PROTOCOL_INFORMATION
FileRenameInformationBypassAccessCheck, // s: FILE_RENAME_INFORMATION // (kernel-mode only) // since WIN8
FileLinkInformationBypassAccessCheck, // s: FILE_LINK_INFORMATION // (kernel-mode only)
FileVolumeNameInformation, // q: FILE_VOLUME_NAME_INFORMATION
FileIdInformation, // q: FILE_ID_INFORMATION
FileIdExtdDirectoryInformation, // q: FILE_ID_EXTD_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) // 60
FileReplaceCompletionInformation, // s: FILE_COMPLETION_INFORMATION // since WINBLUE
FileHardLinkFullIdInformation, // q: FILE_LINK_ENTRY_FULL_ID_INFORMATION // FILE_LINKS_FULL_ID_INFORMATION
FileIdExtdBothDirectoryInformation, // q: FILE_ID_EXTD_BOTH_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) // since THRESHOLD
FileDispositionInformationEx, // s: FILE_DISPOSITION_INFO_EX (requires DELETE) // since REDSTONE
FileRenameInformationEx, // s: FILE_RENAME_INFORMATION_EX
FileRenameInformationExBypassAccessCheck, // s: FILE_RENAME_INFORMATION_EX // (kernel-mode only)
FileDesiredStorageClassInformation, // qs: FILE_DESIRED_STORAGE_CLASS_INFORMATION // since REDSTONE2
FileStatInformation, // q: FILE_STAT_INFORMATION
FileMemoryPartitionInformation, // s: FILE_MEMORY_PARTITION_INFORMATION // since REDSTONE3
FileStatLxInformation, // q: FILE_STAT_LX_INFORMATION (requires FILE_READ_ATTRIBUTES and FILE_READ_EA) // since REDSTONE4 // 70
FileCaseSensitiveInformation, // qs: FILE_CASE_SENSITIVE_INFORMATION
FileLinkInformationEx, // s: FILE_LINK_INFORMATION_EX // since REDSTONE5
FileLinkInformationExBypassAccessCheck, // s: FILE_LINK_INFORMATION_EX // (kernel-mode only)
FileStorageReserveIdInformation, // qs: FILE_STORAGE_RESERVE_ID_INFORMATION
FileCaseSensitiveInformationForceAccessCheck, // qs: FILE_CASE_SENSITIVE_INFORMATION
FileKnownFolderInformation, // qs: FILE_KNOWN_FOLDER_INFORMATION // since WIN11
FileStatBasicInformation, // qs: FILE_STAT_BASIC_INFORMATION // since 23H2
FileId64ExtdDirectoryInformation, // q: FILE_ID_64_EXTD_DIR_INFORMATION
FileId64ExtdBothDirectoryInformation, // q: FILE_ID_64_EXTD_BOTH_DIR_INFORMATION
FileIdAllExtdDirectoryInformation, // q: FILE_ID_ALL_EXTD_DIR_INFORMATION
FileIdAllExtdBothDirectoryInformation, // q: FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION
FileStreamReservationInformation, // q: FILE_STREAM_RESERVATION_INFORMATION // since 24H2
FileMupProviderInfo, // qs: MUP_PROVIDER_INFORMATION
FileMaximumInformation
} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
typedef const UNICODE_STRING *PCUNICODE_STRING;
typedef enum _SECTION_INHERIT
{
ViewShare = 1, // The mapped view of the section will be mapped into any child processes created by the process.
ViewUnmap = 2 // The mapped view of the section will not be mapped into any child processes created by the process.
} SECTION_INHERIT;
typedef struct _OBJECT_ATTRIBUTES
{
ULONG Length;
HANDLE RootDirectory;
PCUNICODE_STRING ObjectName;
ULONG Attributes;
PSECURITY_DESCRIPTOR SecurityDescriptor;
PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef struct _IO_STATUS_BLOCK
{
union
{
NTSTATUS Status;
PVOID Pointer;
};
ULONG_PTR Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
typedef const OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;
NTSYSCALLAPI NTSTATUS NTAPI NtQuerySystemInformation(
_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
_Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
_In_ ULONG SystemInformationLength,
_Out_opt_ PULONG ReturnLength
);
NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationProcess(
_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass,
_Out_writes_bytes_(ProcessInformationLength) PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength
);
NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationToken(
_In_ HANDLE TokenHandle, _In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
_Out_writes_bytes_to_opt_(TokenInformationLength, *ReturnLength) PVOID TokenInformation,
_In_ ULONG TokenInformationLength, _Out_ PULONG ReturnLength
);
NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationProcess(
_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass,
_In_reads_bytes_(ProcessInformationLength) PVOID ProcessInformation, _In_ ULONG ProcessInformationLength
);
NTSYSCALLAPI BOOL WINAPI EnumProcessModules(
_In_ HANDLE hProcess, _Out_ HMODULE *lphModule,
_In_ DWORD cb, _Out_ LPDWORD lpcbNeeded
);
NTSYSCALLAPI DWORD WINAPI K32GetModuleFileNameExA(
HANDLE hProcess, HMODULE hModule,
LPSTR lpFilename, DWORD nSize
);
NTSYSCALLAPI INT32 WINAPI DbgPrint(
_In_ PCH Format, ...
);
NTSYSCALLAPI NTSTATUS NTAPI RtlStringCchPrintfW(
WCHAR* pszDest, size_t cchDest, WCHAR* pszFormat, ...
);
NTSYSCALLAPI NTSTATUS NTAPI NtOpenSection(
_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess, _In_ PCOBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSCALLAPI NTSTATUS NTAPI NtCreateSection( _Out_ PHANDLE SectionHandle,
_In_ ACCESS_MASK DesiredAccess, _In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PLARGE_INTEGER MaximumSize,
_In_ ULONG SectionPageProtection, _In_ ULONG AllocationAttributes, _In_opt_ HANDLE FileHandle
);
NTSYSCALLAPI NTSTATUS NTAPI NtMapViewOfSection(
_In_ HANDLE SectionHandle, _In_ HANDLE ProcessHandle, _Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID *BaseAddress,
_In_ ULONG_PTR ZeroBits, _In_ SIZE_T CommitSize, _Inout_opt_ PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize, _In_ SECTION_INHERIT InheritDisposition,
_In_ ULONG AllocationType, _In_ ULONG PageProtection
);
NTSYSCALLAPI NTSTATUS NTAPI NtUnmapViewOfSection(
_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress
);
NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationFile(
_In_ HANDLE FileHandle, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _Out_writes_bytes_(Length) PVOID FileInformation,
_In_ ULONG Length, _In_ FILE_INFORMATION_CLASS FileInformationClass
);
NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationProcess(
_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass,
_Out_writes_bytes_(ProcessInformationLength) PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength
);
NTSYSAPI ULONG RtlRandomEx(
PULONG Seed
);
NTSYSCALLAPI NTSTATUS NTAPI NtFreeVirtualMemory(
_In_ HANDLE ProcessHandle,
_Inout_ __drv_freesMem(Mem) PVOID *BaseAddress,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG FreeType
);
#endif // WIN32_H
Reference in New Issue View Git Blame Copy Permalink