From 2b64a6d316f633eed807d20628a05504a7977c6b Mon Sep 17 00:00:00 2001 From: hakril Date: Sun, 26 Jan 2025 20:01:57 +0100 Subject: [PATCH] Add definition for _TEB --- .../definitions/structures/simple_structs.txt | 29 + .../definitions/structures/teb_peb.txt | 227 ++ .../definitions/structures/winstruct.txt | 219 -- docs/source/winstructs_generated.rst | 2390 +++++++++-------- windows/generated_def/meta.py | 4 + windows/generated_def/winstructs.py | 788 +++--- 6 files changed, 1927 insertions(+), 1730 deletions(-) create mode 100644 ctypes_generation/definitions/structures/simple_structs.txt create mode 100644 ctypes_generation/definitions/structures/teb_peb.txt diff --git a/ctypes_generation/definitions/structures/simple_structs.txt b/ctypes_generation/definitions/structures/simple_structs.txt new file mode 100644 index 0000000..535b363 --- /dev/null +++ b/ctypes_generation/definitions/structures/simple_structs.txt @@ -0,0 +1,29 @@ +/* Structures that do not depends on anything other that basic type + Simplify structure dependancy file graph +*/ + +typedef struct _LIST_ENTRY { + struct _LIST_ENTRY *Flink; + struct _LIST_ENTRY *Blink; +} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY; + +typedef struct _LSA_UNICODE_STRING { + USHORT Length; + USHORT MaximumLength; + PVOID Buffer; // PVOID to prevent ctypes to automatically read the content of the buffer till a \0 +} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING; + +typedef struct _CLIENT_ID{ + HANDLE UniqueProcess; + HANDLE UniqueThread; +} CLIENT_ID, *PCLIENT_ID; + +typedef struct _CLIENT_ID64{ + ULONG64 UniqueProcess; + ULONG64 UniqueThread; +} CLIENT_ID64, *PCLIENT_ID64; + +typedef struct _CLIENT_ID32{ + ULONG UniqueProcess; + ULONG UniqueThread; +} CLIENT_ID32, *PCLIENT_ID32; \ No newline at end of file diff --git a/ctypes_generation/definitions/structures/teb_peb.txt b/ctypes_generation/definitions/structures/teb_peb.txt new file mode 100644 index 0000000..05947e1 --- /dev/null +++ b/ctypes_generation/definitions/structures/teb_peb.txt @@ -0,0 +1,227 @@ +/* This is the part of RTL_USER_PROCESS_PARAMETERS that works from XP to Windows 10 + http://terminus.rewolf.pl/terminus/structures/ntdll/_RTL_USER_PROCESS_PARAMETERS_x86.html +*/ + +typedef struct _CURDIR +{ + UNICODE_STRING DosPath; + PVOID Handle; +} CURDIR, *PCURDIR; + +typedef struct _RTL_DRIVE_LETTER_CURDIR +{ + WORD Flags; + WORD Length; + ULONG TimeStamp; + UNICODE_STRING DosPath; +} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR; + +typedef struct _RTL_USER_PROCESS_PARAMETERS +{ + ULONG MaximumLength; + ULONG Length; + ULONG Flags; + ULONG DebugFlags; + PVOID ConsoleHandle; + ULONG ConsoleFlags; + PVOID StandardInput; + PVOID StandardOutput; + PVOID StandardError; + CURDIR CurrentDirectory; + UNICODE_STRING DllPath; + UNICODE_STRING ImagePathName; + UNICODE_STRING CommandLine; + PVOID Environment; + ULONG StartingX; + ULONG StartingY; + ULONG CountX; + ULONG CountY; + ULONG CountCharsX; + ULONG CountCharsY; + ULONG FillAttribute; + ULONG WindowFlags; + ULONG ShowWindowFlags; + UNICODE_STRING WindowTitle; + UNICODE_STRING DesktopInfo; + UNICODE_STRING ShellInfo; + UNICODE_STRING RuntimeData; + RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32]; +} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS; + +// PEB: Thank to +// https://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx +// http://blog.rewolf.pl/blog/?p=573 +// http://terminus.rewolf.pl/terminus/structures/ntdll/_PEB_combined.html + +typedef struct _LDR_DATA_TABLE_ENTRY { + PVOID Reserved1[2]; + LIST_ENTRY InMemoryOrderLinks; + PVOID Reserved2[2]; + PVOID DllBase; + PVOID EntryPoint; + PVOID SizeOfImage; + UNICODE_STRING FullDllName; + UNICODE_STRING BaseDllName; + PVOID Reserved5[3]; + ULONG CheckSum; + ULONG TimeDateStamp; +} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; + +typedef struct _PEB_LDR_DATA { + BYTE Reserved1[8]; + PVOID Reserved2[3]; + LIST_ENTRY InMemoryOrderModuleList; +} PEB_LDR_DATA, *PPEB_LDR_DATA; + + + +typedef union _ANON_PEB_SYSTEM_DEPENDENT_02 { + PVOID FastPebLockRoutine; + PVOID SparePtr1; + PVOID AtlThunkSListPtr; +}; + +typedef union _ANON_PEB_SYSTEM_DEPENDENT_03 { + PVOID FastPebUnlockRoutine; + PVOID SparePtr2; + PVOID IFEOKey; +}; + + +typedef union _ANON_PEB_SYSTEM_DEPENDENT_06 { + PVOID FreeList; + PVOID SparePebPtr0; + PVOID ApiSetMap; +}; + +typedef union _ANON_PEB_SYSTEM_DEPENDENT_07 { + PVOID ReadOnlySharedMemoryHeap; + PVOID HotpatchInformation; + PVOID SparePvoid0; +}; + + +typedef union _ANON_PEB_UNION_1 { + PVOID KernelCallbackTable; + PVOID UserSharedInfoPtr; +}; + +typedef union _ANON_PEB_UNION_2 { + PVOID ImageProcessAffinityMask; + PVOID ActiveProcessAffinityMask; +}; + +typedef struct _PEB { + BYTE Reserved1[2]; + BYTE BeingDebugged; + BYTE Reserved2[1]; + PVOID Mutant; + PVOID ImageBaseAddress; + PPEB_LDR_DATA Ldr; + PRTL_USER_PROCESS_PARAMETERS ProcessParameters; + PVOID SubSystemData; + PVOID ProcessHeap; + PVOID FastPebLock; + _ANON_PEB_SYSTEM_DEPENDENT_02 _SYSTEM_DEPENDENT_02; + _ANON_PEB_SYSTEM_DEPENDENT_03 _SYSTEM_DEPENDENT_03; + PVOID _SYSTEM_DEPENDENT_04; + union { + PVOID KernelCallbackTable; + PVOID UserSharedInfoPtr; + }; + DWORD SystemReserved; + DWORD _SYSTEM_DEPENDENT_05; + _ANON_PEB_SYSTEM_DEPENDENT_06 _SYSTEM_DEPENDENT_06; + PVOID TlsExpansionCounter; + PVOID TlsBitmap; + DWORD TlsBitmapBits[2]; + PVOID ReadOnlySharedMemoryBase; + _ANON_PEB_SYSTEM_DEPENDENT_07 _SYSTEM_DEPENDENT_07; + PVOID ReadOnlyStaticServerData; + PVOID AnsiCodePageData; + PVOID OemCodePageData; + PVOID UnicodeCaseTableData; + DWORD NumberOfProcessors; + DWORD NtGlobalFlag; + LARGE_INTEGER CriticalSectionTimeout; + PVOID HeapSegmentReserve; + PVOID HeapSegmentCommit; + PVOID HeapDeCommitTotalFreeThreshold; + PVOID HeapDeCommitFreeBlockThreshold; + DWORD NumberOfHeaps; + DWORD MaximumNumberOfHeaps; + PVOID ProcessHeaps; + PVOID GdiSharedHandleTable; + PVOID ProcessStarterHelper; + PVOID GdiDCAttributeList; + PVOID LoaderLock; + DWORD OSMajorVersion; + DWORD OSMinorVersion; + WORD OSBuildNumber; + WORD OSCSDVersion; + DWORD OSPlatformId; + DWORD ImageSubsystem; + DWORD ImageSubsystemMajorVersion; + PVOID ImageSubsystemMinorVersion; + union { + PVOID ImageProcessAffinityMask; + PVOID ActiveProcessAffinityMask; + }; + PVOID GdiHandleBuffer[26]; + BYTE GdiHandleBuffer2[32]; + PVOID PostProcessInitRoutine; + PVOID TlsExpansionBitmap; + DWORD TlsExpansionBitmapBits[32]; + PVOID SessionId; + ULARGE_INTEGER AppCompatFlags; + ULARGE_INTEGER AppCompatFlagsUser; + PVOID pShimData; + PVOID AppCompatInfo; + UNICODE_STRING CSDVersion; + PVOID ActivationContextData; + PVOID ProcessAssemblyStorageMap; + PVOID SystemDefaultActivationContextData; + PVOID SystemAssemblyStorageMap; + PVOID MinimumStackCommit; +} PEB, *PPEB; + + +/* Partial TEB description + Based on: + - fields that did not move since XP + - https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-teb +*/ + +typedef struct _EXCEPTION_REGISTRATION_RECORD { + _EXCEPTION_REGISTRATION_RECORD *Next; + PVOID Handler; +}; + +typedef struct _NT_TIB { + _EXCEPTION_REGISTRATION_RECORD *ExceptionList; + PVOID StackBase; + PVOID StackLimit; + PVOID SubSystemTib; + PVOID FiberData; + ULONG Version; + PVOID ArbitraryUserPointer; + _NT_TIB *Self; +}; + +typedef struct _TEB { + _NT_TIB NtTib; + PVOID EnvironmentPointer; + _CLIENT_ID ClientId; + PVOID ActiveRpcHandle; + PVOID ThreadLocalStoragePointer; + _PEB *ProcessEnvironmentBlock; + ULONG LastErrorValue; + ULONG CountOfOwnedCriticalSections; + PVOID CsrClientThread; + PVOID Win32ThreadInfo; + ULONG User32Reserved[26]; + ULONG UserReserved[5]; + PVOID WOW32Reserved; + ULONG CurrentLocale; + ULONG FpSoftwareStatusRegister; +} TEB; diff --git a/ctypes_generation/definitions/structures/winstruct.txt b/ctypes_generation/definitions/structures/winstruct.txt index 80ada30..713e17a 100644 --- a/ctypes_generation/definitions/structures/winstruct.txt +++ b/ctypes_generation/definitions/structures/winstruct.txt @@ -1,195 +1,3 @@ -typedef struct _LIST_ENTRY { - struct _LIST_ENTRY *Flink; - struct _LIST_ENTRY *Blink; -} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY; - - -/* Definition of WinXP : Still same base in win11 with some extra field */ -typedef struct _PEB_LDR_DATA { - ULONG Length; - BYTE Initialized; - PVOID SsHandle; - _LIST_ENTRY InLoadOrderModuleList; - _LIST_ENTRY InMemoryOrderModuleList; - _LIST_ENTRY InInitializationOrderModuleList; - PVOID EntryInProgress; - // BYTE ShutdownInProgress; // New field - // PVOID ShutdownThreadId; // New field -}PEB_LDR_DATA, *PPEB_LDR_DATA; - - -typedef struct _LSA_UNICODE_STRING { - USHORT Length; - USHORT MaximumLength; - PVOID Buffer; // PVOID to prevent ctypes to automatically read the content of the buffer till a \0 -} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING; - -typedef struct _CURDIR -{ - UNICODE_STRING DosPath; - PVOID Handle; -} CURDIR, *PCURDIR; - -typedef struct _RTL_DRIVE_LETTER_CURDIR -{ - WORD Flags; - WORD Length; - ULONG TimeStamp; - UNICODE_STRING DosPath; -} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR; - -/* This is the part of RTL_USER_PROCESS_PARAMETERS that works from XP to Windows 10 - http://terminus.rewolf.pl/terminus/structures/ntdll/_RTL_USER_PROCESS_PARAMETERS_x86.html -*/ -typedef struct _RTL_USER_PROCESS_PARAMETERS -{ - ULONG MaximumLength; - ULONG Length; - ULONG Flags; - ULONG DebugFlags; - PVOID ConsoleHandle; - ULONG ConsoleFlags; - PVOID StandardInput; - PVOID StandardOutput; - PVOID StandardError; - CURDIR CurrentDirectory; - UNICODE_STRING DllPath; - UNICODE_STRING ImagePathName; - UNICODE_STRING CommandLine; - PVOID Environment; - ULONG StartingX; - ULONG StartingY; - ULONG CountX; - ULONG CountY; - ULONG CountCharsX; - ULONG CountCharsY; - ULONG FillAttribute; - ULONG WindowFlags; - ULONG ShowWindowFlags; - UNICODE_STRING WindowTitle; - UNICODE_STRING DesktopInfo; - UNICODE_STRING ShellInfo; - UNICODE_STRING RuntimeData; - RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32]; -} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS; - - -// Thank to: -// https://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx -// http://blog.rewolf.pl/blog/?p=573 -// http://terminus.rewolf.pl/terminus/structures/ntdll/_PEB_combined.html - -typedef union _ANON_PEB_SYSTEM_DEPENDENT_02 { - PVOID FastPebLockRoutine; - PVOID SparePtr1; - PVOID AtlThunkSListPtr; -}; - -typedef union _ANON_PEB_SYSTEM_DEPENDENT_03 { - PVOID FastPebUnlockRoutine; - PVOID SparePtr2; - PVOID IFEOKey; -}; - - -typedef union _ANON_PEB_SYSTEM_DEPENDENT_06 { - PVOID FreeList; - PVOID SparePebPtr0; - PVOID ApiSetMap; -}; - -typedef union _ANON_PEB_SYSTEM_DEPENDENT_07 { - PVOID ReadOnlySharedMemoryHeap; - PVOID HotpatchInformation; - PVOID SparePvoid0; -}; - - -typedef union _ANON_PEB_UNION_1 { - PVOID KernelCallbackTable; - PVOID UserSharedInfoPtr; -}; - -typedef union _ANON_PEB_UNION_2 { - PVOID ImageProcessAffinityMask; - PVOID ActiveProcessAffinityMask; -}; - -typedef struct _PEB { - BYTE Reserved1[2]; - BYTE BeingDebugged; - BYTE Reserved2[1]; - PVOID Mutant; - PVOID ImageBaseAddress; - PPEB_LDR_DATA Ldr; - PRTL_USER_PROCESS_PARAMETERS ProcessParameters; - PVOID SubSystemData; - PVOID ProcessHeap; - PVOID FastPebLock; - _ANON_PEB_SYSTEM_DEPENDENT_02 _SYSTEM_DEPENDENT_02; - _ANON_PEB_SYSTEM_DEPENDENT_03 _SYSTEM_DEPENDENT_03; - PVOID _SYSTEM_DEPENDENT_04; - union { - PVOID KernelCallbackTable; - PVOID UserSharedInfoPtr; - }; - DWORD SystemReserved; - DWORD _SYSTEM_DEPENDENT_05; - _ANON_PEB_SYSTEM_DEPENDENT_06 _SYSTEM_DEPENDENT_06; - PVOID TlsExpansionCounter; - PVOID TlsBitmap; - DWORD TlsBitmapBits[2]; - PVOID ReadOnlySharedMemoryBase; - _ANON_PEB_SYSTEM_DEPENDENT_07 _SYSTEM_DEPENDENT_07; - PVOID ReadOnlyStaticServerData; - PVOID AnsiCodePageData; - PVOID OemCodePageData; - PVOID UnicodeCaseTableData; - DWORD NumberOfProcessors; - DWORD NtGlobalFlag; - LARGE_INTEGER CriticalSectionTimeout; - PVOID HeapSegmentReserve; - PVOID HeapSegmentCommit; - PVOID HeapDeCommitTotalFreeThreshold; - PVOID HeapDeCommitFreeBlockThreshold; - DWORD NumberOfHeaps; - DWORD MaximumNumberOfHeaps; - PVOID ProcessHeaps; - PVOID GdiSharedHandleTable; - PVOID ProcessStarterHelper; - PVOID GdiDCAttributeList; - PVOID LoaderLock; - DWORD OSMajorVersion; - DWORD OSMinorVersion; - WORD OSBuildNumber; - WORD OSCSDVersion; - DWORD OSPlatformId; - DWORD ImageSubsystem; - DWORD ImageSubsystemMajorVersion; - PVOID ImageSubsystemMinorVersion; - union { - PVOID ImageProcessAffinityMask; - PVOID ActiveProcessAffinityMask; - }; - PVOID GdiHandleBuffer[26]; - BYTE GdiHandleBuffer2[32]; - PVOID PostProcessInitRoutine; - PVOID TlsExpansionBitmap; - DWORD TlsExpansionBitmapBits[32]; - PVOID SessionId; - ULARGE_INTEGER AppCompatFlags; - ULARGE_INTEGER AppCompatFlagsUser; - PVOID pShimData; - PVOID AppCompatInfo; - UNICODE_STRING CSDVersion; - PVOID ActivationContextData; - PVOID ProcessAssemblyStorageMap; - PVOID SystemDefaultActivationContextData; - PVOID SystemAssemblyStorageMap; - PVOID MinimumStackCommit; -} PEB, *PPEB; - - typedef struct _SECURITY_ATTRIBUTES { DWORD nLength; LPVOID lpSecurityDescriptor; @@ -870,34 +678,7 @@ typedef enum _SE_OBJECT_TYPE { } SE_OBJECT_TYPE; -typedef struct _CLIENT_ID{ - HANDLE UniqueProcess; - HANDLE UniqueThread; -} CLIENT_ID, *PCLIENT_ID; -typedef struct _CLIENT_ID64{ - ULONG64 UniqueProcess; - ULONG64 UniqueThread; -} CLIENT_ID64, *PCLIENT_ID64; - -typedef struct _CLIENT_ID32{ - ULONG UniqueProcess; - ULONG UniqueThread; -} CLIENT_ID32, *PCLIENT_ID32; - -typedef struct _LDR_DATA_TABLE_ENTRY { - PVOID Reserved1[2]; - LIST_ENTRY InMemoryOrderLinks; - PVOID Reserved2[2]; - PVOID DllBase; - PVOID EntryPoint; - PVOID SizeOfImage; - UNICODE_STRING FullDllName; - UNICODE_STRING BaseDllName; - PVOID Reserved5[3]; - ULONG CheckSum; - ULONG TimeDateStamp; -} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; typedef struct _MEMORY_BASIC_INFORMATION { diff --git a/docs/source/winstructs_generated.rst b/docs/source/winstructs_generated.rst index dabdef8..b30da86 100644 --- a/docs/source/winstructs_generated.rst +++ b/docs/source/winstructs_generated.rst @@ -8509,6 +8509,128 @@ _SHFILEOPSTRUCTA :class:`PCSTR` +_LIST_ENTRY +''''''''''' +.. class:: LIST_ENTRY + + Alias for :class:`_LIST_ENTRY` + +.. class:: PLIST_ENTRY + + Pointer to :class:`_LIST_ENTRY` + +.. class:: PRLIST_ENTRY + + Pointer to :class:`_LIST_ENTRY` + +.. class:: _LIST_ENTRY + + .. attribute:: Flink + + :class:`_LIST_ENTRY` + + + .. attribute:: Blink + + :class:`_LIST_ENTRY` + +_LSA_UNICODE_STRING +''''''''''''''''''' +.. class:: LSA_UNICODE_STRING + + Alias for :class:`_LSA_UNICODE_STRING` + +.. class:: PLSA_UNICODE_STRING + + Pointer to :class:`_LSA_UNICODE_STRING` + +.. class:: PUNICODE_STRING + + Pointer to :class:`_LSA_UNICODE_STRING` + +.. class:: UNICODE_STRING + + Alias for :class:`_LSA_UNICODE_STRING` + +.. class:: _LSA_UNICODE_STRING + + .. attribute:: Length + + :class:`USHORT` + + + .. attribute:: MaximumLength + + :class:`USHORT` + + + .. attribute:: Buffer + + :class:`PVOID` + +_CLIENT_ID +'''''''''' +.. class:: CLIENT_ID + + Alias for :class:`_CLIENT_ID` + +.. class:: PCLIENT_ID + + Pointer to :class:`_CLIENT_ID` + +.. class:: _CLIENT_ID + + .. attribute:: UniqueProcess + + :class:`HANDLE` + + + .. attribute:: UniqueThread + + :class:`HANDLE` + +_CLIENT_ID64 +'''''''''''' +.. class:: CLIENT_ID64 + + Alias for :class:`_CLIENT_ID64` + +.. class:: PCLIENT_ID64 + + Pointer to :class:`_CLIENT_ID64` + +.. class:: _CLIENT_ID64 + + .. attribute:: UniqueProcess + + :class:`ULONG64` + + + .. attribute:: UniqueThread + + :class:`ULONG64` + +_CLIENT_ID32 +'''''''''''' +.. class:: CLIENT_ID32 + + Alias for :class:`_CLIENT_ID32` + +.. class:: PCLIENT_ID32 + + Pointer to :class:`_CLIENT_ID32` + +.. class:: _CLIENT_ID32 + + .. attribute:: UniqueProcess + + :class:`ULONG` + + + .. attribute:: UniqueThread + + :class:`ULONG` + _IMAGEHLP_MODULE64 '''''''''''''''''' .. class:: IMAGEHLP_MODULE64 @@ -9971,6 +10093,1102 @@ _tagSTACKFRAME_EX :class:`DWORD` +_SYSTEM_PROCESS_INFORMATION +''''''''''''''''''''''''''' +.. class:: PSYSTEM_PROCESS_INFORMATION + + Pointer to :class:`_SYSTEM_PROCESS_INFORMATION` + +.. class:: SYSTEM_PROCESS_INFORMATION + + Alias for :class:`_SYSTEM_PROCESS_INFORMATION` + +.. class:: _SYSTEM_PROCESS_INFORMATION + + .. attribute:: NextEntryOffset + + :class:`ULONG` + + + .. attribute:: NumberOfThreads + + :class:`ULONG` + + + .. attribute:: Reserved1 + + :class:`BYTE` ``[24]`` + + + .. attribute:: CreateTime + + :class:`LARGE_INTEGER` + + + .. attribute:: UserTime + + :class:`LARGE_INTEGER` + + + .. attribute:: KernelTime + + :class:`LARGE_INTEGER` + + + .. attribute:: ImageName + + :class:`UNICODE_STRING` + + + .. attribute:: BasePriority + + :class:`LONG` + + + .. attribute:: UniqueProcessId + + :class:`HANDLE` + + + .. attribute:: InheritedFromUniqueProcessId + + :class:`PVOID` + + + .. attribute:: HandleCount + + :class:`ULONG` + + + .. attribute:: Reserved4 + + :class:`BYTE` ``[4]`` + + + .. attribute:: Reserved5 + + :class:`PVOID` + + + .. attribute:: PeakVirtualSize + + :class:`PVOID` + + + .. attribute:: VirtualSize + + :class:`PVOID` + + + .. attribute:: PageFaultCount + + :class:`PVOID` + + + .. attribute:: PeakWorkingSetSize + + :class:`PVOID` + + + .. attribute:: WorkingSetSize + + :class:`PVOID` + + + .. attribute:: QuotaPeakPagedPoolUsage + + :class:`PVOID` + + + .. attribute:: QuotaPagedPoolUsage + + :class:`PVOID` + + + .. attribute:: QuotaPeakNonPagedPoolUsage + + :class:`PVOID` + + + .. attribute:: QuotaNonPagedPoolUsage + + :class:`PVOID` + + + .. attribute:: PagefileUsage + + :class:`PVOID` + + + .. attribute:: PeakPagefileUsage + + :class:`SIZE_T` + + + .. attribute:: PrivatePageCount + + :class:`SIZE_T` + + + .. attribute:: Reserved6 + + :class:`LARGE_INTEGER` ``[6]`` + +_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION +''''''''''''''''''''''''''''''''''''''''' +.. class:: PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + + Pointer to :class:`_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION` + +.. class:: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + + Alias for :class:`_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION` + +.. class:: _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + + .. attribute:: IdleTime + + :class:`LARGE_INTEGER` + + + .. attribute:: KernelTime + + :class:`LARGE_INTEGER` + + + .. attribute:: UserTime + + :class:`LARGE_INTEGER` + + + .. attribute:: Reserved1 + + :class:`LARGE_INTEGER` ``[2]`` + + + .. attribute:: Reserved2 + + :class:`ULONG` + +_SYSTEM_REGISTRY_QUOTA_INFORMATION +'''''''''''''''''''''''''''''''''' +.. class:: PSYSTEM_REGISTRY_QUOTA_INFORMATION + + Pointer to :class:`_SYSTEM_REGISTRY_QUOTA_INFORMATION` + +.. class:: SYSTEM_REGISTRY_QUOTA_INFORMATION + + Alias for :class:`_SYSTEM_REGISTRY_QUOTA_INFORMATION` + +.. class:: _SYSTEM_REGISTRY_QUOTA_INFORMATION + + .. attribute:: RegistryQuotaAllowed + + :class:`ULONG` + + + .. attribute:: RegistryQuotaUsed + + :class:`ULONG` + + + .. attribute:: Reserved1 + + :class:`PVOID` + +_SYSTEM_BASIC_INFORMATION +''''''''''''''''''''''''' +.. class:: PSYSTEM_BASIC_INFORMATION + + Pointer to :class:`_SYSTEM_BASIC_INFORMATION` + +.. class:: SYSTEM_BASIC_INFORMATION + + Alias for :class:`_SYSTEM_BASIC_INFORMATION` + +.. class:: _SYSTEM_BASIC_INFORMATION + + .. attribute:: Reserved1 + + :class:`BYTE` ``[24]`` + + + .. attribute:: Reserved2 + + :class:`PVOID` ``[4]`` + + + .. attribute:: NumberOfProcessors + + :class:`CHAR` + +_CURDIR +''''''' +.. class:: CURDIR + + Alias for :class:`_CURDIR` + +.. class:: PCURDIR + + Pointer to :class:`_CURDIR` + +.. class:: _CURDIR + + .. attribute:: DosPath + + :class:`UNICODE_STRING` + + + .. attribute:: Handle + + :class:`PVOID` + +_RTL_DRIVE_LETTER_CURDIR +'''''''''''''''''''''''' +.. class:: PRTL_DRIVE_LETTER_CURDIR + + Pointer to :class:`_RTL_DRIVE_LETTER_CURDIR` + +.. class:: RTL_DRIVE_LETTER_CURDIR + + Alias for :class:`_RTL_DRIVE_LETTER_CURDIR` + +.. class:: _RTL_DRIVE_LETTER_CURDIR + + .. attribute:: Flags + + :class:`WORD` + + + .. attribute:: Length + + :class:`WORD` + + + .. attribute:: TimeStamp + + :class:`ULONG` + + + .. attribute:: DosPath + + :class:`UNICODE_STRING` + +_RTL_USER_PROCESS_PARAMETERS +'''''''''''''''''''''''''''' +.. class:: PRTL_USER_PROCESS_PARAMETERS + + Pointer to :class:`_RTL_USER_PROCESS_PARAMETERS` + +.. class:: RTL_USER_PROCESS_PARAMETERS + + Alias for :class:`_RTL_USER_PROCESS_PARAMETERS` + +.. class:: _RTL_USER_PROCESS_PARAMETERS + + .. attribute:: MaximumLength + + :class:`ULONG` + + + .. attribute:: Length + + :class:`ULONG` + + + .. attribute:: Flags + + :class:`ULONG` + + + .. attribute:: DebugFlags + + :class:`ULONG` + + + .. attribute:: ConsoleHandle + + :class:`PVOID` + + + .. attribute:: ConsoleFlags + + :class:`ULONG` + + + .. attribute:: StandardInput + + :class:`PVOID` + + + .. attribute:: StandardOutput + + :class:`PVOID` + + + .. attribute:: StandardError + + :class:`PVOID` + + + .. attribute:: CurrentDirectory + + :class:`CURDIR` + + + .. attribute:: DllPath + + :class:`UNICODE_STRING` + + + .. attribute:: ImagePathName + + :class:`UNICODE_STRING` + + + .. attribute:: CommandLine + + :class:`UNICODE_STRING` + + + .. attribute:: Environment + + :class:`PVOID` + + + .. attribute:: StartingX + + :class:`ULONG` + + + .. attribute:: StartingY + + :class:`ULONG` + + + .. attribute:: CountX + + :class:`ULONG` + + + .. attribute:: CountY + + :class:`ULONG` + + + .. attribute:: CountCharsX + + :class:`ULONG` + + + .. attribute:: CountCharsY + + :class:`ULONG` + + + .. attribute:: FillAttribute + + :class:`ULONG` + + + .. attribute:: WindowFlags + + :class:`ULONG` + + + .. attribute:: ShowWindowFlags + + :class:`ULONG` + + + .. attribute:: WindowTitle + + :class:`UNICODE_STRING` + + + .. attribute:: DesktopInfo + + :class:`UNICODE_STRING` + + + .. attribute:: ShellInfo + + :class:`UNICODE_STRING` + + + .. attribute:: RuntimeData + + :class:`UNICODE_STRING` + + + .. attribute:: CurrentDirectores + + :class:`RTL_DRIVE_LETTER_CURDIR` ``[32]`` + +_LDR_DATA_TABLE_ENTRY +''''''''''''''''''''' +.. class:: LDR_DATA_TABLE_ENTRY + + Alias for :class:`_LDR_DATA_TABLE_ENTRY` + +.. class:: PLDR_DATA_TABLE_ENTRY + + Pointer to :class:`_LDR_DATA_TABLE_ENTRY` + +.. class:: _LDR_DATA_TABLE_ENTRY + + .. attribute:: Reserved1 + + :class:`PVOID` ``[2]`` + + + .. attribute:: InMemoryOrderLinks + + :class:`LIST_ENTRY` + + + .. attribute:: Reserved2 + + :class:`PVOID` ``[2]`` + + + .. attribute:: DllBase + + :class:`PVOID` + + + .. attribute:: EntryPoint + + :class:`PVOID` + + + .. attribute:: SizeOfImage + + :class:`PVOID` + + + .. attribute:: FullDllName + + :class:`UNICODE_STRING` + + + .. attribute:: BaseDllName + + :class:`UNICODE_STRING` + + + .. attribute:: Reserved5 + + :class:`PVOID` ``[3]`` + + + .. attribute:: CheckSum + + :class:`ULONG` + + + .. attribute:: TimeDateStamp + + :class:`ULONG` + +_PEB_LDR_DATA +''''''''''''' +.. class:: PEB_LDR_DATA + + Alias for :class:`_PEB_LDR_DATA` + +.. class:: PPEB_LDR_DATA + + Pointer to :class:`_PEB_LDR_DATA` + +.. class:: _PEB_LDR_DATA + + .. attribute:: Reserved1 + + :class:`BYTE` ``[8]`` + + + .. attribute:: Reserved2 + + :class:`PVOID` ``[3]`` + + + .. attribute:: InMemoryOrderModuleList + + :class:`LIST_ENTRY` + +_ANON_PEB_SYSTEM_DEPENDENT_02 +''''''''''''''''''''''''''''' +.. class:: _ANON_PEB_SYSTEM_DEPENDENT_02 + + .. attribute:: FastPebLockRoutine + + :class:`PVOID` + + + .. attribute:: SparePtr1 + + :class:`PVOID` + + + .. attribute:: AtlThunkSListPtr + + :class:`PVOID` + +_ANON_PEB_SYSTEM_DEPENDENT_03 +''''''''''''''''''''''''''''' +.. class:: _ANON_PEB_SYSTEM_DEPENDENT_03 + + .. attribute:: FastPebUnlockRoutine + + :class:`PVOID` + + + .. attribute:: SparePtr2 + + :class:`PVOID` + + + .. attribute:: IFEOKey + + :class:`PVOID` + +_ANON_PEB_SYSTEM_DEPENDENT_06 +''''''''''''''''''''''''''''' +.. class:: _ANON_PEB_SYSTEM_DEPENDENT_06 + + .. attribute:: FreeList + + :class:`PVOID` + + + .. attribute:: SparePebPtr0 + + :class:`PVOID` + + + .. attribute:: ApiSetMap + + :class:`PVOID` + +_ANON_PEB_SYSTEM_DEPENDENT_07 +''''''''''''''''''''''''''''' +.. class:: _ANON_PEB_SYSTEM_DEPENDENT_07 + + .. attribute:: ReadOnlySharedMemoryHeap + + :class:`PVOID` + + + .. attribute:: HotpatchInformation + + :class:`PVOID` + + + .. attribute:: SparePvoid0 + + :class:`PVOID` + +_ANON_PEB_UNION_1 +''''''''''''''''' +.. class:: _ANON_PEB_UNION_1 + + .. attribute:: KernelCallbackTable + + :class:`PVOID` + + + .. attribute:: UserSharedInfoPtr + + :class:`PVOID` + +_ANON_PEB_UNION_2 +''''''''''''''''' +.. class:: _ANON_PEB_UNION_2 + + .. attribute:: ImageProcessAffinityMask + + :class:`PVOID` + + + .. attribute:: ActiveProcessAffinityMask + + :class:`PVOID` + +_PEB +'''' +.. class:: PEB + + Alias for :class:`_PEB` + +.. class:: PPEB + + Pointer to :class:`_PEB` + +.. class:: _PEB + + .. attribute:: Reserved1 + + :class:`BYTE` ``[2]`` + + + .. attribute:: BeingDebugged + + :class:`BYTE` + + + .. attribute:: Reserved2 + + :class:`BYTE` + + + .. attribute:: Mutant + + :class:`PVOID` + + + .. attribute:: ImageBaseAddress + + :class:`PVOID` + + + .. attribute:: Ldr + + :class:`PPEB_LDR_DATA` + + + .. attribute:: ProcessParameters + + :class:`PRTL_USER_PROCESS_PARAMETERS` + + + .. attribute:: SubSystemData + + :class:`PVOID` + + + .. attribute:: ProcessHeap + + :class:`PVOID` + + + .. attribute:: FastPebLock + + :class:`PVOID` + + + .. attribute:: _SYSTEM_DEPENDENT_02 + + :class:`_ANON_PEB_SYSTEM_DEPENDENT_02` + + + .. attribute:: _SYSTEM_DEPENDENT_03 + + :class:`_ANON_PEB_SYSTEM_DEPENDENT_03` + + + .. attribute:: _SYSTEM_DEPENDENT_04 + + :class:`PVOID` + + + .. attribute:: anon_01 + + :class:`_ANON__PEB_SUB_UNION_1` + + + .. attribute:: SystemReserved + + :class:`DWORD` + + + .. attribute:: _SYSTEM_DEPENDENT_05 + + :class:`DWORD` + + + .. attribute:: _SYSTEM_DEPENDENT_06 + + :class:`_ANON_PEB_SYSTEM_DEPENDENT_06` + + + .. attribute:: TlsExpansionCounter + + :class:`PVOID` + + + .. attribute:: TlsBitmap + + :class:`PVOID` + + + .. attribute:: TlsBitmapBits + + :class:`DWORD` ``[2]`` + + + .. attribute:: ReadOnlySharedMemoryBase + + :class:`PVOID` + + + .. attribute:: _SYSTEM_DEPENDENT_07 + + :class:`_ANON_PEB_SYSTEM_DEPENDENT_07` + + + .. attribute:: ReadOnlyStaticServerData + + :class:`PVOID` + + + .. attribute:: AnsiCodePageData + + :class:`PVOID` + + + .. attribute:: OemCodePageData + + :class:`PVOID` + + + .. attribute:: UnicodeCaseTableData + + :class:`PVOID` + + + .. attribute:: NumberOfProcessors + + :class:`DWORD` + + + .. attribute:: NtGlobalFlag + + :class:`DWORD` + + + .. attribute:: CriticalSectionTimeout + + :class:`LARGE_INTEGER` + + + .. attribute:: HeapSegmentReserve + + :class:`PVOID` + + + .. attribute:: HeapSegmentCommit + + :class:`PVOID` + + + .. attribute:: HeapDeCommitTotalFreeThreshold + + :class:`PVOID` + + + .. attribute:: HeapDeCommitFreeBlockThreshold + + :class:`PVOID` + + + .. attribute:: NumberOfHeaps + + :class:`DWORD` + + + .. attribute:: MaximumNumberOfHeaps + + :class:`DWORD` + + + .. attribute:: ProcessHeaps + + :class:`PVOID` + + + .. attribute:: GdiSharedHandleTable + + :class:`PVOID` + + + .. attribute:: ProcessStarterHelper + + :class:`PVOID` + + + .. attribute:: GdiDCAttributeList + + :class:`PVOID` + + + .. attribute:: LoaderLock + + :class:`PVOID` + + + .. attribute:: OSMajorVersion + + :class:`DWORD` + + + .. attribute:: OSMinorVersion + + :class:`DWORD` + + + .. attribute:: OSBuildNumber + + :class:`WORD` + + + .. attribute:: OSCSDVersion + + :class:`WORD` + + + .. attribute:: OSPlatformId + + :class:`DWORD` + + + .. attribute:: ImageSubsystem + + :class:`DWORD` + + + .. attribute:: ImageSubsystemMajorVersion + + :class:`DWORD` + + + .. attribute:: ImageSubsystemMinorVersion + + :class:`PVOID` + + + .. attribute:: anon_02 + + :class:`_ANON__PEB_SUB_UNION_2` + + + .. attribute:: GdiHandleBuffer + + :class:`PVOID` ``[26]`` + + + .. attribute:: GdiHandleBuffer2 + + :class:`BYTE` ``[32]`` + + + .. attribute:: PostProcessInitRoutine + + :class:`PVOID` + + + .. attribute:: TlsExpansionBitmap + + :class:`PVOID` + + + .. attribute:: TlsExpansionBitmapBits + + :class:`DWORD` ``[32]`` + + + .. attribute:: SessionId + + :class:`PVOID` + + + .. attribute:: AppCompatFlags + + :class:`ULARGE_INTEGER` + + + .. attribute:: AppCompatFlagsUser + + :class:`ULARGE_INTEGER` + + + .. attribute:: pShimData + + :class:`PVOID` + + + .. attribute:: AppCompatInfo + + :class:`PVOID` + + + .. attribute:: CSDVersion + + :class:`UNICODE_STRING` + + + .. attribute:: ActivationContextData + + :class:`PVOID` + + + .. attribute:: ProcessAssemblyStorageMap + + :class:`PVOID` + + + .. attribute:: SystemDefaultActivationContextData + + :class:`PVOID` + + + .. attribute:: SystemAssemblyStorageMap + + :class:`PVOID` + + + .. attribute:: MinimumStackCommit + + :class:`PVOID` + +_EXCEPTION_REGISTRATION_RECORD +'''''''''''''''''''''''''''''' +.. class:: _EXCEPTION_REGISTRATION_RECORD + + .. attribute:: Next + + :class:`_EXCEPTION_REGISTRATION_RECORD` + + + .. attribute:: Handler + + :class:`PVOID` + +_NT_TIB +''''''' +.. class:: _NT_TIB + + .. attribute:: ExceptionList + + :class:`_EXCEPTION_REGISTRATION_RECORD` + + + .. attribute:: StackBase + + :class:`PVOID` + + + .. attribute:: StackLimit + + :class:`PVOID` + + + .. attribute:: SubSystemTib + + :class:`PVOID` + + + .. attribute:: FiberData + + :class:`PVOID` + + + .. attribute:: Version + + :class:`ULONG` + + + .. attribute:: ArbitraryUserPointer + + :class:`PVOID` + + + .. attribute:: Self + + :class:`_NT_TIB` + +_TEB +'''' +.. class:: TEB + + Alias for :class:`_TEB` + +.. class:: _TEB + + .. attribute:: NtTib + + :class:`_NT_TIB` + + + .. attribute:: EnvironmentPointer + + :class:`PVOID` + + + .. attribute:: ClientId + + :class:`_CLIENT_ID` + + + .. attribute:: ActiveRpcHandle + + :class:`PVOID` + + + .. attribute:: ThreadLocalStoragePointer + + :class:`PVOID` + + + .. attribute:: ProcessEnvironmentBlock + + :class:`_PEB` + + + .. attribute:: LastErrorValue + + :class:`ULONG` + + + .. attribute:: CountOfOwnedCriticalSections + + :class:`ULONG` + + + .. attribute:: CsrClientThread + + :class:`PVOID` + + + .. attribute:: Win32ThreadInfo + + :class:`PVOID` + + + .. attribute:: User32Reserved + + :class:`ULONG` ``[26]`` + + + .. attribute:: UserReserved + + :class:`ULONG` ``[5]`` + + + .. attribute:: WOW32Reserved + + :class:`PVOID` + + + .. attribute:: CurrentLocale + + :class:`ULONG` + + + .. attribute:: FpSoftwareStatusRegister + + :class:`ULONG` + _TRACE_PROVIDER_INFO '''''''''''''''''''' .. class:: TRACE_PROVIDER_INFO @@ -10484,748 +11702,6 @@ tagWNDCLASSEXW :class:`HICON` -_LIST_ENTRY -''''''''''' -.. class:: LIST_ENTRY - - Alias for :class:`_LIST_ENTRY` - -.. class:: PLIST_ENTRY - - Pointer to :class:`_LIST_ENTRY` - -.. class:: PRLIST_ENTRY - - Pointer to :class:`_LIST_ENTRY` - -.. class:: _LIST_ENTRY - - .. attribute:: Flink - - :class:`_LIST_ENTRY` - - - .. attribute:: Blink - - :class:`_LIST_ENTRY` - -_PEB_LDR_DATA -''''''''''''' -.. class:: PEB_LDR_DATA - - Alias for :class:`_PEB_LDR_DATA` - -.. class:: PPEB_LDR_DATA - - Pointer to :class:`_PEB_LDR_DATA` - -.. class:: _PEB_LDR_DATA - - .. attribute:: Length - - :class:`ULONG` - - - .. attribute:: Initialized - - :class:`BYTE` - - - .. attribute:: SsHandle - - :class:`PVOID` - - - .. attribute:: InLoadOrderModuleList - - :class:`_LIST_ENTRY` - - - .. attribute:: InMemoryOrderModuleList - - :class:`_LIST_ENTRY` - - - .. attribute:: InInitializationOrderModuleList - - :class:`_LIST_ENTRY` - - - .. attribute:: EntryInProgress - - :class:`PVOID` - -_LSA_UNICODE_STRING -''''''''''''''''''' -.. class:: LSA_UNICODE_STRING - - Alias for :class:`_LSA_UNICODE_STRING` - -.. class:: PLSA_UNICODE_STRING - - Pointer to :class:`_LSA_UNICODE_STRING` - -.. class:: PUNICODE_STRING - - Pointer to :class:`_LSA_UNICODE_STRING` - -.. class:: UNICODE_STRING - - Alias for :class:`_LSA_UNICODE_STRING` - -.. class:: _LSA_UNICODE_STRING - - .. attribute:: Length - - :class:`USHORT` - - - .. attribute:: MaximumLength - - :class:`USHORT` - - - .. attribute:: Buffer - - :class:`PVOID` - -_CURDIR -''''''' -.. class:: CURDIR - - Alias for :class:`_CURDIR` - -.. class:: PCURDIR - - Pointer to :class:`_CURDIR` - -.. class:: _CURDIR - - .. attribute:: DosPath - - :class:`UNICODE_STRING` - - - .. attribute:: Handle - - :class:`PVOID` - -_RTL_DRIVE_LETTER_CURDIR -'''''''''''''''''''''''' -.. class:: PRTL_DRIVE_LETTER_CURDIR - - Pointer to :class:`_RTL_DRIVE_LETTER_CURDIR` - -.. class:: RTL_DRIVE_LETTER_CURDIR - - Alias for :class:`_RTL_DRIVE_LETTER_CURDIR` - -.. class:: _RTL_DRIVE_LETTER_CURDIR - - .. attribute:: Flags - - :class:`WORD` - - - .. attribute:: Length - - :class:`WORD` - - - .. attribute:: TimeStamp - - :class:`ULONG` - - - .. attribute:: DosPath - - :class:`UNICODE_STRING` - -_RTL_USER_PROCESS_PARAMETERS -'''''''''''''''''''''''''''' -.. class:: PRTL_USER_PROCESS_PARAMETERS - - Pointer to :class:`_RTL_USER_PROCESS_PARAMETERS` - -.. class:: RTL_USER_PROCESS_PARAMETERS - - Alias for :class:`_RTL_USER_PROCESS_PARAMETERS` - -.. class:: _RTL_USER_PROCESS_PARAMETERS - - .. attribute:: MaximumLength - - :class:`ULONG` - - - .. attribute:: Length - - :class:`ULONG` - - - .. attribute:: Flags - - :class:`ULONG` - - - .. attribute:: DebugFlags - - :class:`ULONG` - - - .. attribute:: ConsoleHandle - - :class:`PVOID` - - - .. attribute:: ConsoleFlags - - :class:`ULONG` - - - .. attribute:: StandardInput - - :class:`PVOID` - - - .. attribute:: StandardOutput - - :class:`PVOID` - - - .. attribute:: StandardError - - :class:`PVOID` - - - .. attribute:: CurrentDirectory - - :class:`CURDIR` - - - .. attribute:: DllPath - - :class:`UNICODE_STRING` - - - .. attribute:: ImagePathName - - :class:`UNICODE_STRING` - - - .. attribute:: CommandLine - - :class:`UNICODE_STRING` - - - .. attribute:: Environment - - :class:`PVOID` - - - .. attribute:: StartingX - - :class:`ULONG` - - - .. attribute:: StartingY - - :class:`ULONG` - - - .. attribute:: CountX - - :class:`ULONG` - - - .. attribute:: CountY - - :class:`ULONG` - - - .. attribute:: CountCharsX - - :class:`ULONG` - - - .. attribute:: CountCharsY - - :class:`ULONG` - - - .. attribute:: FillAttribute - - :class:`ULONG` - - - .. attribute:: WindowFlags - - :class:`ULONG` - - - .. attribute:: ShowWindowFlags - - :class:`ULONG` - - - .. attribute:: WindowTitle - - :class:`UNICODE_STRING` - - - .. attribute:: DesktopInfo - - :class:`UNICODE_STRING` - - - .. attribute:: ShellInfo - - :class:`UNICODE_STRING` - - - .. attribute:: RuntimeData - - :class:`UNICODE_STRING` - - - .. attribute:: CurrentDirectores - - :class:`RTL_DRIVE_LETTER_CURDIR` ``[32]`` - -_ANON_PEB_SYSTEM_DEPENDENT_02 -''''''''''''''''''''''''''''' -.. class:: _ANON_PEB_SYSTEM_DEPENDENT_02 - - .. attribute:: FastPebLockRoutine - - :class:`PVOID` - - - .. attribute:: SparePtr1 - - :class:`PVOID` - - - .. attribute:: AtlThunkSListPtr - - :class:`PVOID` - -_ANON_PEB_SYSTEM_DEPENDENT_03 -''''''''''''''''''''''''''''' -.. class:: _ANON_PEB_SYSTEM_DEPENDENT_03 - - .. attribute:: FastPebUnlockRoutine - - :class:`PVOID` - - - .. attribute:: SparePtr2 - - :class:`PVOID` - - - .. attribute:: IFEOKey - - :class:`PVOID` - -_ANON_PEB_SYSTEM_DEPENDENT_06 -''''''''''''''''''''''''''''' -.. class:: _ANON_PEB_SYSTEM_DEPENDENT_06 - - .. attribute:: FreeList - - :class:`PVOID` - - - .. attribute:: SparePebPtr0 - - :class:`PVOID` - - - .. attribute:: ApiSetMap - - :class:`PVOID` - -_ANON_PEB_SYSTEM_DEPENDENT_07 -''''''''''''''''''''''''''''' -.. class:: _ANON_PEB_SYSTEM_DEPENDENT_07 - - .. attribute:: ReadOnlySharedMemoryHeap - - :class:`PVOID` - - - .. attribute:: HotpatchInformation - - :class:`PVOID` - - - .. attribute:: SparePvoid0 - - :class:`PVOID` - -_ANON_PEB_UNION_1 -''''''''''''''''' -.. class:: _ANON_PEB_UNION_1 - - .. attribute:: KernelCallbackTable - - :class:`PVOID` - - - .. attribute:: UserSharedInfoPtr - - :class:`PVOID` - -_ANON_PEB_UNION_2 -''''''''''''''''' -.. class:: _ANON_PEB_UNION_2 - - .. attribute:: ImageProcessAffinityMask - - :class:`PVOID` - - - .. attribute:: ActiveProcessAffinityMask - - :class:`PVOID` - -_PEB -'''' -.. class:: PEB - - Alias for :class:`_PEB` - -.. class:: PPEB - - Pointer to :class:`_PEB` - -.. class:: _PEB - - .. attribute:: Reserved1 - - :class:`BYTE` ``[2]`` - - - .. attribute:: BeingDebugged - - :class:`BYTE` - - - .. attribute:: Reserved2 - - :class:`BYTE` - - - .. attribute:: Mutant - - :class:`PVOID` - - - .. attribute:: ImageBaseAddress - - :class:`PVOID` - - - .. attribute:: Ldr - - :class:`PPEB_LDR_DATA` - - - .. attribute:: ProcessParameters - - :class:`PRTL_USER_PROCESS_PARAMETERS` - - - .. attribute:: SubSystemData - - :class:`PVOID` - - - .. attribute:: ProcessHeap - - :class:`PVOID` - - - .. attribute:: FastPebLock - - :class:`PVOID` - - - .. attribute:: _SYSTEM_DEPENDENT_02 - - :class:`_ANON_PEB_SYSTEM_DEPENDENT_02` - - - .. attribute:: _SYSTEM_DEPENDENT_03 - - :class:`_ANON_PEB_SYSTEM_DEPENDENT_03` - - - .. attribute:: _SYSTEM_DEPENDENT_04 - - :class:`PVOID` - - - .. attribute:: anon_01 - - :class:`_ANON__PEB_SUB_UNION_1` - - - .. attribute:: SystemReserved - - :class:`DWORD` - - - .. attribute:: _SYSTEM_DEPENDENT_05 - - :class:`DWORD` - - - .. attribute:: _SYSTEM_DEPENDENT_06 - - :class:`_ANON_PEB_SYSTEM_DEPENDENT_06` - - - .. attribute:: TlsExpansionCounter - - :class:`PVOID` - - - .. attribute:: TlsBitmap - - :class:`PVOID` - - - .. attribute:: TlsBitmapBits - - :class:`DWORD` ``[2]`` - - - .. attribute:: ReadOnlySharedMemoryBase - - :class:`PVOID` - - - .. attribute:: _SYSTEM_DEPENDENT_07 - - :class:`_ANON_PEB_SYSTEM_DEPENDENT_07` - - - .. attribute:: ReadOnlyStaticServerData - - :class:`PVOID` - - - .. attribute:: AnsiCodePageData - - :class:`PVOID` - - - .. attribute:: OemCodePageData - - :class:`PVOID` - - - .. attribute:: UnicodeCaseTableData - - :class:`PVOID` - - - .. attribute:: NumberOfProcessors - - :class:`DWORD` - - - .. attribute:: NtGlobalFlag - - :class:`DWORD` - - - .. attribute:: CriticalSectionTimeout - - :class:`LARGE_INTEGER` - - - .. attribute:: HeapSegmentReserve - - :class:`PVOID` - - - .. attribute:: HeapSegmentCommit - - :class:`PVOID` - - - .. attribute:: HeapDeCommitTotalFreeThreshold - - :class:`PVOID` - - - .. attribute:: HeapDeCommitFreeBlockThreshold - - :class:`PVOID` - - - .. attribute:: NumberOfHeaps - - :class:`DWORD` - - - .. attribute:: MaximumNumberOfHeaps - - :class:`DWORD` - - - .. attribute:: ProcessHeaps - - :class:`PVOID` - - - .. attribute:: GdiSharedHandleTable - - :class:`PVOID` - - - .. attribute:: ProcessStarterHelper - - :class:`PVOID` - - - .. attribute:: GdiDCAttributeList - - :class:`PVOID` - - - .. attribute:: LoaderLock - - :class:`PVOID` - - - .. attribute:: OSMajorVersion - - :class:`DWORD` - - - .. attribute:: OSMinorVersion - - :class:`DWORD` - - - .. attribute:: OSBuildNumber - - :class:`WORD` - - - .. attribute:: OSCSDVersion - - :class:`WORD` - - - .. attribute:: OSPlatformId - - :class:`DWORD` - - - .. attribute:: ImageSubsystem - - :class:`DWORD` - - - .. attribute:: ImageSubsystemMajorVersion - - :class:`DWORD` - - - .. attribute:: ImageSubsystemMinorVersion - - :class:`PVOID` - - - .. attribute:: anon_02 - - :class:`_ANON__PEB_SUB_UNION_2` - - - .. attribute:: GdiHandleBuffer - - :class:`PVOID` ``[26]`` - - - .. attribute:: GdiHandleBuffer2 - - :class:`BYTE` ``[32]`` - - - .. attribute:: PostProcessInitRoutine - - :class:`PVOID` - - - .. attribute:: TlsExpansionBitmap - - :class:`PVOID` - - - .. attribute:: TlsExpansionBitmapBits - - :class:`DWORD` ``[32]`` - - - .. attribute:: SessionId - - :class:`PVOID` - - - .. attribute:: AppCompatFlags - - :class:`ULARGE_INTEGER` - - - .. attribute:: AppCompatFlagsUser - - :class:`ULARGE_INTEGER` - - - .. attribute:: pShimData - - :class:`PVOID` - - - .. attribute:: AppCompatInfo - - :class:`PVOID` - - - .. attribute:: CSDVersion - - :class:`UNICODE_STRING` - - - .. attribute:: ActivationContextData - - :class:`PVOID` - - - .. attribute:: ProcessAssemblyStorageMap - - :class:`PVOID` - - - .. attribute:: SystemDefaultActivationContextData - - :class:`PVOID` - - - .. attribute:: SystemAssemblyStorageMap - - :class:`PVOID` - - - .. attribute:: MinimumStackCommit - - :class:`PVOID` - _SECURITY_ATTRIBUTES '''''''''''''''''''' .. class:: LPSECURITY_ATTRIBUTES @@ -11413,135 +11889,6 @@ _SYSTEM_PROCESS_ID_INFORMATION :class:`UNICODE_STRING` -_CLIENT_ID -'''''''''' -.. class:: CLIENT_ID - - Alias for :class:`_CLIENT_ID` - -.. class:: PCLIENT_ID - - Pointer to :class:`_CLIENT_ID` - -.. class:: _CLIENT_ID - - .. attribute:: UniqueProcess - - :class:`HANDLE` - - - .. attribute:: UniqueThread - - :class:`HANDLE` - -_CLIENT_ID64 -'''''''''''' -.. class:: CLIENT_ID64 - - Alias for :class:`_CLIENT_ID64` - -.. class:: PCLIENT_ID64 - - Pointer to :class:`_CLIENT_ID64` - -.. class:: _CLIENT_ID64 - - .. attribute:: UniqueProcess - - :class:`ULONG64` - - - .. attribute:: UniqueThread - - :class:`ULONG64` - -_CLIENT_ID32 -'''''''''''' -.. class:: CLIENT_ID32 - - Alias for :class:`_CLIENT_ID32` - -.. class:: PCLIENT_ID32 - - Pointer to :class:`_CLIENT_ID32` - -.. class:: _CLIENT_ID32 - - .. attribute:: UniqueProcess - - :class:`ULONG` - - - .. attribute:: UniqueThread - - :class:`ULONG` - -_LDR_DATA_TABLE_ENTRY -''''''''''''''''''''' -.. class:: LDR_DATA_TABLE_ENTRY - - Alias for :class:`_LDR_DATA_TABLE_ENTRY` - -.. class:: PLDR_DATA_TABLE_ENTRY - - Pointer to :class:`_LDR_DATA_TABLE_ENTRY` - -.. class:: _LDR_DATA_TABLE_ENTRY - - .. attribute:: Reserved1 - - :class:`PVOID` ``[2]`` - - - .. attribute:: InMemoryOrderLinks - - :class:`LIST_ENTRY` - - - .. attribute:: Reserved2 - - :class:`PVOID` ``[2]`` - - - .. attribute:: DllBase - - :class:`PVOID` - - - .. attribute:: EntryPoint - - :class:`PVOID` - - - .. attribute:: SizeOfImage - - :class:`PVOID` - - - .. attribute:: FullDllName - - :class:`UNICODE_STRING` - - - .. attribute:: BaseDllName - - :class:`UNICODE_STRING` - - - .. attribute:: Reserved5 - - :class:`PVOID` ``[3]`` - - - .. attribute:: CheckSum - - :class:`ULONG` - - - .. attribute:: TimeDateStamp - - :class:`ULONG` - _MEMORY_BASIC_INFORMATION ''''''''''''''''''''''''' .. class:: MEMORY_BASIC_INFORMATION @@ -25403,235 +25750,6 @@ _EXPLICIT_ACCESS_W :class:`TRUSTEE_W` -_SYSTEM_PROCESS_INFORMATION -''''''''''''''''''''''''''' -.. class:: PSYSTEM_PROCESS_INFORMATION - - Pointer to :class:`_SYSTEM_PROCESS_INFORMATION` - -.. class:: SYSTEM_PROCESS_INFORMATION - - Alias for :class:`_SYSTEM_PROCESS_INFORMATION` - -.. class:: _SYSTEM_PROCESS_INFORMATION - - .. attribute:: NextEntryOffset - - :class:`ULONG` - - - .. attribute:: NumberOfThreads - - :class:`ULONG` - - - .. attribute:: Reserved1 - - :class:`BYTE` ``[24]`` - - - .. attribute:: CreateTime - - :class:`LARGE_INTEGER` - - - .. attribute:: UserTime - - :class:`LARGE_INTEGER` - - - .. attribute:: KernelTime - - :class:`LARGE_INTEGER` - - - .. attribute:: ImageName - - :class:`UNICODE_STRING` - - - .. attribute:: BasePriority - - :class:`LONG` - - - .. attribute:: UniqueProcessId - - :class:`HANDLE` - - - .. attribute:: InheritedFromUniqueProcessId - - :class:`PVOID` - - - .. attribute:: HandleCount - - :class:`ULONG` - - - .. attribute:: Reserved4 - - :class:`BYTE` ``[4]`` - - - .. attribute:: Reserved5 - - :class:`PVOID` - - - .. attribute:: PeakVirtualSize - - :class:`PVOID` - - - .. attribute:: VirtualSize - - :class:`PVOID` - - - .. attribute:: PageFaultCount - - :class:`PVOID` - - - .. attribute:: PeakWorkingSetSize - - :class:`PVOID` - - - .. attribute:: WorkingSetSize - - :class:`PVOID` - - - .. attribute:: QuotaPeakPagedPoolUsage - - :class:`PVOID` - - - .. attribute:: QuotaPagedPoolUsage - - :class:`PVOID` - - - .. attribute:: QuotaPeakNonPagedPoolUsage - - :class:`PVOID` - - - .. attribute:: QuotaNonPagedPoolUsage - - :class:`PVOID` - - - .. attribute:: PagefileUsage - - :class:`PVOID` - - - .. attribute:: PeakPagefileUsage - - :class:`SIZE_T` - - - .. attribute:: PrivatePageCount - - :class:`SIZE_T` - - - .. attribute:: Reserved6 - - :class:`LARGE_INTEGER` ``[6]`` - -_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION -''''''''''''''''''''''''''''''''''''''''' -.. class:: PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION - - Pointer to :class:`_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION` - -.. class:: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION - - Alias for :class:`_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION` - -.. class:: _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION - - .. attribute:: IdleTime - - :class:`LARGE_INTEGER` - - - .. attribute:: KernelTime - - :class:`LARGE_INTEGER` - - - .. attribute:: UserTime - - :class:`LARGE_INTEGER` - - - .. attribute:: Reserved1 - - :class:`LARGE_INTEGER` ``[2]`` - - - .. attribute:: Reserved2 - - :class:`ULONG` - -_SYSTEM_REGISTRY_QUOTA_INFORMATION -'''''''''''''''''''''''''''''''''' -.. class:: PSYSTEM_REGISTRY_QUOTA_INFORMATION - - Pointer to :class:`_SYSTEM_REGISTRY_QUOTA_INFORMATION` - -.. class:: SYSTEM_REGISTRY_QUOTA_INFORMATION - - Alias for :class:`_SYSTEM_REGISTRY_QUOTA_INFORMATION` - -.. class:: _SYSTEM_REGISTRY_QUOTA_INFORMATION - - .. attribute:: RegistryQuotaAllowed - - :class:`ULONG` - - - .. attribute:: RegistryQuotaUsed - - :class:`ULONG` - - - .. attribute:: Reserved1 - - :class:`PVOID` - -_SYSTEM_BASIC_INFORMATION -''''''''''''''''''''''''' -.. class:: PSYSTEM_BASIC_INFORMATION - - Pointer to :class:`_SYSTEM_BASIC_INFORMATION` - -.. class:: SYSTEM_BASIC_INFORMATION - - Alias for :class:`_SYSTEM_BASIC_INFORMATION` - -.. class:: _SYSTEM_BASIC_INFORMATION - - .. attribute:: Reserved1 - - :class:`BYTE` ``[24]`` - - - .. attribute:: Reserved2 - - :class:`PVOID` ``[4]`` - - - .. attribute:: NumberOfProcessors - - :class:`CHAR` - _TIME_ZONE_INFORMATION '''''''''''''''''''''' .. class:: LPTIME_ZONE_INFORMATION @@ -29723,6 +29841,42 @@ ADDRESS_MODE .. attribute:: AddrModeFlat(3) +_COMPUTER_NAME_FORMAT +''''''''''''''''''''' +.. class:: COMPUTER_NAME_FORMAT + + Alias for :class:`_COMPUTER_NAME_FORMAT` + + +.. class:: _COMPUTER_NAME_FORMAT + + + .. attribute:: ComputerNameNetBIOS(0) + + + .. attribute:: ComputerNameDnsHostname(1) + + + .. attribute:: ComputerNameDnsDomain(2) + + + .. attribute:: ComputerNameDnsFullyQualified(3) + + + .. attribute:: ComputerNamePhysicalNetBIOS(4) + + + .. attribute:: ComputerNamePhysicalDnsHostname(5) + + + .. attribute:: ComputerNamePhysicalDnsDomain(6) + + + .. attribute:: ComputerNamePhysicalDnsFullyQualified(7) + + + .. attribute:: ComputerNameMax(8) + _TASK_ACTION_TYPE ''''''''''''''''' .. class:: TASK_ACTION_TYPE @@ -33523,42 +33677,6 @@ _ACCESS_MODE .. attribute:: SET_AUDIT_FAILURE(6) -_COMPUTER_NAME_FORMAT -''''''''''''''''''''' -.. class:: COMPUTER_NAME_FORMAT - - Alias for :class:`_COMPUTER_NAME_FORMAT` - - -.. class:: _COMPUTER_NAME_FORMAT - - - .. attribute:: ComputerNameNetBIOS(0) - - - .. attribute:: ComputerNameDnsHostname(1) - - - .. attribute:: ComputerNameDnsDomain(2) - - - .. attribute:: ComputerNameDnsFullyQualified(3) - - - .. attribute:: ComputerNamePhysicalNetBIOS(4) - - - .. attribute:: ComputerNamePhysicalDnsHostname(5) - - - .. attribute:: ComputerNamePhysicalDnsDomain(6) - - - .. attribute:: ComputerNamePhysicalDnsFullyQualified(7) - - - .. attribute:: ComputerNameMax(8) - TRACE_INFO_CLASS '''''''''''''''' .. class:: TRACE_QUERY_INFO_CLASS diff --git a/windows/generated_def/meta.py b/windows/generated_def/meta.py index 1a57ebb..6ee67ec 100644 --- a/windows/generated_def/meta.py +++ b/windows/generated_def/meta.py @@ -13471,6 +13471,7 @@ structs = {'ACCESS_ALLOWED_ACE', 'SYSTEM_RESOURCE_ATTRIBUTE_ACE', 'SYSTEM_SCOPED_POLICY_ID_ACE', 'SYSTEM_VERIFIER_INFORMATION', +'TEB', 'THREADENTRY32', 'THREAD_BASIC_INFORMATION', 'TIME_ZONE_INFORMATION', @@ -13772,6 +13773,7 @@ structs = {'ACCESS_ALLOWED_ACE', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', +'_EXCEPTION_REGISTRATION_RECORD', '_EXIT_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXPLICIT_ACCESS_W', @@ -13917,6 +13919,7 @@ structs = {'ACCESS_ALLOWED_ACE', '_NET_DISPLAY_GROUP', '_NET_DISPLAY_MACHINE', '_NET_DISPLAY_USER', +'_NT_TIB', '_OBJECTS_AND_NAME_A', '_OBJECTS_AND_NAME_W', '_OBJECTS_AND_SID', @@ -14047,6 +14050,7 @@ structs = {'ACCESS_ALLOWED_ACE', '_SYSTEM_RESOURCE_ATTRIBUTE_ACE', '_SYSTEM_SCOPED_POLICY_ID_ACE', '_SYSTEM_VERIFIER_INFORMATION', +'_TEB', '_THREAD_BASIC_INFORMATION', '_TIME_ZONE_INFORMATION', '_TMPUNION_CERT_ID', diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index ef09ba6..17154fa 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -3876,6 +3876,92 @@ class _SHFILEOPSTRUCTA(Structure): LPSHFILEOPSTRUCTA = POINTER(_SHFILEOPSTRUCTA) SHFILEOPSTRUCTA = _SHFILEOPSTRUCTA +# Self referencing struct tricks +class _LIST_ENTRY(Structure): pass +LIST_ENTRY = _LIST_ENTRY +PLIST_ENTRY = POINTER(_LIST_ENTRY) +PRLIST_ENTRY = POINTER(_LIST_ENTRY) +_LIST_ENTRY._fields_ = [ + ("Flink", POINTER(_LIST_ENTRY)), + ("Blink", POINTER(_LIST_ENTRY)), +] + +class _LSA_UNICODE_STRING(Structure): + _fields_ = [ + ("Length", USHORT), + ("MaximumLength", USHORT), + ("Buffer", PVOID), + ] +LSA_UNICODE_STRING = _LSA_UNICODE_STRING +PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +UNICODE_STRING = _LSA_UNICODE_STRING + +INITIAL_LSA_UNICODE_STRING = _LSA_UNICODE_STRING + +class _LSA_UNICODE_STRING(INITIAL_LSA_UNICODE_STRING): + @property + def str(self): + """The python string of the LSA_UNICODE_STRING object + + :type: :class:`unicode` + """ + if not self.Length: + return "" + if getattr(self, "_target", None) is not None: #remote ctypes :D -> TRICKS OF THE YEAR + raw_data = self._target.read_memory(self.Buffer, self.Length) + return raw_data.decode("utf16") + size = int(self.Length / 2) + return (ctypes.c_wchar * size).from_address(self.Buffer)[:] + + @classmethod + def from_string(cls, s): + utf16_len = len(s) * 2 + return cls(utf16_len, utf16_len, ctypes.cast(PWSTR(s), PVOID)) + + @classmethod + def from_size(cls, size): + buffer = ctypes.create_string_buffer(size) + return cls(size, size, ctypes.cast(buffer, PVOID)) + + def __repr__(self): + return windows.pycompat.urepr_encode(u"""<{0} "{1}" at {2}>""".format(type(self).__name__, self.str, hex(id(self)))) + + def __sprint__(self): + try: + return self.__repr__() + except TypeError as e: + # Bad buffer: print raw infos + return """<{0} len={1} maxlen={2} buffer={3}>""".format(type(self).__name__, self.Length, self.MaximumLength, self.Buffer) + +LSA_UNICODE_STRING = _LSA_UNICODE_STRING +PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +UNICODE_STRING = _LSA_UNICODE_STRING +class _CLIENT_ID(Structure): + _fields_ = [ + ("UniqueProcess", HANDLE), + ("UniqueThread", HANDLE), + ] +CLIENT_ID = _CLIENT_ID +PCLIENT_ID = POINTER(_CLIENT_ID) + +class _CLIENT_ID64(Structure): + _fields_ = [ + ("UniqueProcess", ULONG64), + ("UniqueThread", ULONG64), + ] +CLIENT_ID64 = _CLIENT_ID64 +PCLIENT_ID64 = POINTER(_CLIENT_ID64) + +class _CLIENT_ID32(Structure): + _fields_ = [ + ("UniqueProcess", ULONG), + ("UniqueThread", ULONG), + ] +CLIENT_ID32 = _CLIENT_ID32 +PCLIENT_ID32 = POINTER(_CLIENT_ID32) + SymNone = EnumValue("SYM_TYPE", "SymNone", 0x0) SymCoff = EnumValue("SYM_TYPE", "SymCoff", 0x1) SymCv = EnumValue("SYM_TYPE", "SymCv", 0x2) @@ -4437,6 +4523,82 @@ class _tagSTACKFRAME_EX(Structure): LPSTACKFRAME_EX = POINTER(_tagSTACKFRAME_EX) STACKFRAME_EX = _tagSTACKFRAME_EX +ComputerNameNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameNetBIOS", 0x0) +ComputerNameDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsHostname", 0x1) +ComputerNameDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsDomain", 0x2) +ComputerNameDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsFullyQualified", 0x3) +ComputerNamePhysicalNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalNetBIOS", 0x4) +ComputerNamePhysicalDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsHostname", 0x5) +ComputerNamePhysicalDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsDomain", 0x6) +ComputerNamePhysicalDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsFullyQualified", 0x7) +ComputerNameMax = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameMax", 0x8) +class _COMPUTER_NAME_FORMAT(EnumType): + values = [ComputerNameNetBIOS, ComputerNameDnsHostname, ComputerNameDnsDomain, ComputerNameDnsFullyQualified, ComputerNamePhysicalNetBIOS, ComputerNamePhysicalDnsHostname, ComputerNamePhysicalDnsDomain, ComputerNamePhysicalDnsFullyQualified, ComputerNameMax] + mapper = FlagMapper(*values) +COMPUTER_NAME_FORMAT = _COMPUTER_NAME_FORMAT + + +class _SYSTEM_PROCESS_INFORMATION(Structure): + _fields_ = [ + ("NextEntryOffset", ULONG), + ("NumberOfThreads", ULONG), + ("Reserved1", BYTE * (24)), + ("CreateTime", LARGE_INTEGER), + ("UserTime", LARGE_INTEGER), + ("KernelTime", LARGE_INTEGER), + ("ImageName", UNICODE_STRING), + ("BasePriority", LONG), + ("UniqueProcessId", HANDLE), + ("InheritedFromUniqueProcessId", PVOID), + ("HandleCount", ULONG), + ("Reserved4", BYTE * (4)), + ("Reserved5", PVOID * (1)), + ("PeakVirtualSize", PVOID), + ("VirtualSize", PVOID), + ("PageFaultCount", PVOID), + ("PeakWorkingSetSize", PVOID), + ("WorkingSetSize", PVOID), + ("QuotaPeakPagedPoolUsage", PVOID), + ("QuotaPagedPoolUsage", PVOID), + ("QuotaPeakNonPagedPoolUsage", PVOID), + ("QuotaNonPagedPoolUsage", PVOID), + ("PagefileUsage", PVOID), + ("PeakPagefileUsage", SIZE_T), + ("PrivatePageCount", SIZE_T), + ("Reserved6", LARGE_INTEGER * (6)), + ] +PSYSTEM_PROCESS_INFORMATION = POINTER(_SYSTEM_PROCESS_INFORMATION) +SYSTEM_PROCESS_INFORMATION = _SYSTEM_PROCESS_INFORMATION + +class _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION(Structure): + _fields_ = [ + ("IdleTime", LARGE_INTEGER), + ("KernelTime", LARGE_INTEGER), + ("UserTime", LARGE_INTEGER), + ("Reserved1", LARGE_INTEGER * (2)), + ("Reserved2", ULONG), + ] +PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = POINTER(_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION) +SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + +class _SYSTEM_REGISTRY_QUOTA_INFORMATION(Structure): + _fields_ = [ + ("RegistryQuotaAllowed", ULONG), + ("RegistryQuotaUsed", ULONG), + ("Reserved1", PVOID), + ] +PSYSTEM_REGISTRY_QUOTA_INFORMATION = POINTER(_SYSTEM_REGISTRY_QUOTA_INFORMATION) +SYSTEM_REGISTRY_QUOTA_INFORMATION = _SYSTEM_REGISTRY_QUOTA_INFORMATION + +class _SYSTEM_BASIC_INFORMATION(Structure): + _fields_ = [ + ("Reserved1", BYTE * (24)), + ("Reserved2", PVOID * (4)), + ("NumberOfProcessors", CHAR), + ] +PSYSTEM_BASIC_INFORMATION = POINTER(_SYSTEM_BASIC_INFORMATION) +SYSTEM_BASIC_INFORMATION = _SYSTEM_BASIC_INFORMATION + TASK_ACTION_EXEC = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_EXEC", 0x0) TASK_ACTION_COM_HANDLER = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_COM_HANDLER", 0x5) TASK_ACTION_SEND_EMAIL = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_SEND_EMAIL", 0x6) @@ -4545,6 +4707,257 @@ class TASK_RUN_FLAGS(EnumType): mapper = FlagMapper(*values) +class _CURDIR(Structure): + _fields_ = [ + ("DosPath", UNICODE_STRING), + ("Handle", PVOID), + ] +CURDIR = _CURDIR +PCURDIR = POINTER(_CURDIR) + +class _RTL_DRIVE_LETTER_CURDIR(Structure): + _fields_ = [ + ("Flags", WORD), + ("Length", WORD), + ("TimeStamp", ULONG), + ("DosPath", UNICODE_STRING), + ] +PRTL_DRIVE_LETTER_CURDIR = POINTER(_RTL_DRIVE_LETTER_CURDIR) +RTL_DRIVE_LETTER_CURDIR = _RTL_DRIVE_LETTER_CURDIR + +class _RTL_USER_PROCESS_PARAMETERS(Structure): + _fields_ = [ + ("MaximumLength", ULONG), + ("Length", ULONG), + ("Flags", ULONG), + ("DebugFlags", ULONG), + ("ConsoleHandle", PVOID), + ("ConsoleFlags", ULONG), + ("StandardInput", PVOID), + ("StandardOutput", PVOID), + ("StandardError", PVOID), + ("CurrentDirectory", CURDIR), + ("DllPath", UNICODE_STRING), + ("ImagePathName", UNICODE_STRING), + ("CommandLine", UNICODE_STRING), + ("Environment", PVOID), + ("StartingX", ULONG), + ("StartingY", ULONG), + ("CountX", ULONG), + ("CountY", ULONG), + ("CountCharsX", ULONG), + ("CountCharsY", ULONG), + ("FillAttribute", ULONG), + ("WindowFlags", ULONG), + ("ShowWindowFlags", ULONG), + ("WindowTitle", UNICODE_STRING), + ("DesktopInfo", UNICODE_STRING), + ("ShellInfo", UNICODE_STRING), + ("RuntimeData", UNICODE_STRING), + ("CurrentDirectores", RTL_DRIVE_LETTER_CURDIR * (32)), + ] +PRTL_USER_PROCESS_PARAMETERS = POINTER(_RTL_USER_PROCESS_PARAMETERS) +RTL_USER_PROCESS_PARAMETERS = _RTL_USER_PROCESS_PARAMETERS + +class _LDR_DATA_TABLE_ENTRY(Structure): + _fields_ = [ + ("Reserved1", PVOID * (2)), + ("InMemoryOrderLinks", LIST_ENTRY), + ("Reserved2", PVOID * (2)), + ("DllBase", PVOID), + ("EntryPoint", PVOID), + ("SizeOfImage", PVOID), + ("FullDllName", UNICODE_STRING), + ("BaseDllName", UNICODE_STRING), + ("Reserved5", PVOID * (3)), + ("CheckSum", ULONG), + ("TimeDateStamp", ULONG), + ] +LDR_DATA_TABLE_ENTRY = _LDR_DATA_TABLE_ENTRY +PLDR_DATA_TABLE_ENTRY = POINTER(_LDR_DATA_TABLE_ENTRY) + +class _PEB_LDR_DATA(Structure): + _fields_ = [ + ("Reserved1", BYTE * (8)), + ("Reserved2", PVOID * (3)), + ("InMemoryOrderModuleList", LIST_ENTRY), + ] +PEB_LDR_DATA = _PEB_LDR_DATA +PPEB_LDR_DATA = POINTER(_PEB_LDR_DATA) + +class _ANON_PEB_SYSTEM_DEPENDENT_02(Union): + _fields_ = [ + ("FastPebLockRoutine", PVOID), + ("SparePtr1", PVOID), + ("AtlThunkSListPtr", PVOID), + ] + + +class _ANON_PEB_SYSTEM_DEPENDENT_03(Union): + _fields_ = [ + ("FastPebUnlockRoutine", PVOID), + ("SparePtr2", PVOID), + ("IFEOKey", PVOID), + ] + + +class _ANON_PEB_SYSTEM_DEPENDENT_06(Union): + _fields_ = [ + ("FreeList", PVOID), + ("SparePebPtr0", PVOID), + ("ApiSetMap", PVOID), + ] + + +class _ANON_PEB_SYSTEM_DEPENDENT_07(Union): + _fields_ = [ + ("ReadOnlySharedMemoryHeap", PVOID), + ("HotpatchInformation", PVOID), + ("SparePvoid0", PVOID), + ] + + +class _ANON_PEB_UNION_1(Union): + _fields_ = [ + ("KernelCallbackTable", PVOID), + ("UserSharedInfoPtr", PVOID), + ] + + +class _ANON_PEB_UNION_2(Union): + _fields_ = [ + ("ImageProcessAffinityMask", PVOID), + ("ActiveProcessAffinityMask", PVOID), + ] + + +class _ANON__PEB_SUB_UNION_1(Union): + _fields_ = [ + ("KernelCallbackTable", PVOID), + ("UserSharedInfoPtr", PVOID), + ] + + +class _ANON__PEB_SUB_UNION_2(Union): + _fields_ = [ + ("ImageProcessAffinityMask", PVOID), + ("ActiveProcessAffinityMask", PVOID), + ] + +class _PEB(Structure): + _anonymous_ = ("_SYSTEM_DEPENDENT_02","_SYSTEM_DEPENDENT_03","anon_01","_SYSTEM_DEPENDENT_06","_SYSTEM_DEPENDENT_07","anon_02") + _fields_ = [ + ("Reserved1", BYTE * (2)), + ("BeingDebugged", BYTE), + ("Reserved2", BYTE * (1)), + ("Mutant", PVOID), + ("ImageBaseAddress", PVOID), + ("Ldr", PPEB_LDR_DATA), + ("ProcessParameters", PRTL_USER_PROCESS_PARAMETERS), + ("SubSystemData", PVOID), + ("ProcessHeap", PVOID), + ("FastPebLock", PVOID), + ("_SYSTEM_DEPENDENT_02", _ANON_PEB_SYSTEM_DEPENDENT_02), + ("_SYSTEM_DEPENDENT_03", _ANON_PEB_SYSTEM_DEPENDENT_03), + ("_SYSTEM_DEPENDENT_04", PVOID), + ("anon_01", _ANON__PEB_SUB_UNION_1), + ("SystemReserved", DWORD), + ("_SYSTEM_DEPENDENT_05", DWORD), + ("_SYSTEM_DEPENDENT_06", _ANON_PEB_SYSTEM_DEPENDENT_06), + ("TlsExpansionCounter", PVOID), + ("TlsBitmap", PVOID), + ("TlsBitmapBits", DWORD * (2)), + ("ReadOnlySharedMemoryBase", PVOID), + ("_SYSTEM_DEPENDENT_07", _ANON_PEB_SYSTEM_DEPENDENT_07), + ("ReadOnlyStaticServerData", PVOID), + ("AnsiCodePageData", PVOID), + ("OemCodePageData", PVOID), + ("UnicodeCaseTableData", PVOID), + ("NumberOfProcessors", DWORD), + ("NtGlobalFlag", DWORD), + ("CriticalSectionTimeout", LARGE_INTEGER), + ("HeapSegmentReserve", PVOID), + ("HeapSegmentCommit", PVOID), + ("HeapDeCommitTotalFreeThreshold", PVOID), + ("HeapDeCommitFreeBlockThreshold", PVOID), + ("NumberOfHeaps", DWORD), + ("MaximumNumberOfHeaps", DWORD), + ("ProcessHeaps", PVOID), + ("GdiSharedHandleTable", PVOID), + ("ProcessStarterHelper", PVOID), + ("GdiDCAttributeList", PVOID), + ("LoaderLock", PVOID), + ("OSMajorVersion", DWORD), + ("OSMinorVersion", DWORD), + ("OSBuildNumber", WORD), + ("OSCSDVersion", WORD), + ("OSPlatformId", DWORD), + ("ImageSubsystem", DWORD), + ("ImageSubsystemMajorVersion", DWORD), + ("ImageSubsystemMinorVersion", PVOID), + ("anon_02", _ANON__PEB_SUB_UNION_2), + ("GdiHandleBuffer", PVOID * (26)), + ("GdiHandleBuffer2", BYTE * (32)), + ("PostProcessInitRoutine", PVOID), + ("TlsExpansionBitmap", PVOID), + ("TlsExpansionBitmapBits", DWORD * (32)), + ("SessionId", PVOID), + ("AppCompatFlags", ULARGE_INTEGER), + ("AppCompatFlagsUser", ULARGE_INTEGER), + ("pShimData", PVOID), + ("AppCompatInfo", PVOID), + ("CSDVersion", UNICODE_STRING), + ("ActivationContextData", PVOID), + ("ProcessAssemblyStorageMap", PVOID), + ("SystemDefaultActivationContextData", PVOID), + ("SystemAssemblyStorageMap", PVOID), + ("MinimumStackCommit", PVOID), + ] +PEB = _PEB +PPEB = POINTER(_PEB) + +# Self referencing struct tricks +class _EXCEPTION_REGISTRATION_RECORD(Structure): pass + +_EXCEPTION_REGISTRATION_RECORD._fields_ = [ + ("Next", POINTER(_EXCEPTION_REGISTRATION_RECORD)), + ("Handler", PVOID), +] + +# Self referencing struct tricks +class _NT_TIB(Structure): pass + +_NT_TIB._fields_ = [ + ("ExceptionList", POINTER(_EXCEPTION_REGISTRATION_RECORD)), + ("StackBase", PVOID), + ("StackLimit", PVOID), + ("SubSystemTib", PVOID), + ("FiberData", PVOID), + ("Version", ULONG), + ("ArbitraryUserPointer", PVOID), + ("Self", POINTER(_NT_TIB)), +] + +class _TEB(Structure): + _fields_ = [ + ("NtTib", _NT_TIB), + ("EnvironmentPointer", PVOID), + ("ClientId", _CLIENT_ID), + ("ActiveRpcHandle", PVOID), + ("ThreadLocalStoragePointer", PVOID), + ("ProcessEnvironmentBlock", POINTER(_PEB)), + ("LastErrorValue", ULONG), + ("CountOfOwnedCriticalSections", ULONG), + ("CsrClientThread", PVOID), + ("Win32ThreadInfo", PVOID), + ("User32Reserved", ULONG * (26)), + ("UserReserved", ULONG * (5)), + ("WOW32Reserved", PVOID), + ("CurrentLocale", ULONG), + ("FpSoftwareStatusRegister", ULONG), + ] +TEB = _TEB + class _TRACE_PROVIDER_INFO(Structure): _fields_ = [ ("ProviderGuid", GUID), @@ -5426,264 +5839,6 @@ NT_PRODUCT_TYPE = _NT_PRODUCT_TYPE PNT_PRODUCT_TYPE = POINTER(_NT_PRODUCT_TYPE) -# Self referencing struct tricks -class _LIST_ENTRY(Structure): pass -LIST_ENTRY = _LIST_ENTRY -PLIST_ENTRY = POINTER(_LIST_ENTRY) -PRLIST_ENTRY = POINTER(_LIST_ENTRY) -_LIST_ENTRY._fields_ = [ - ("Flink", POINTER(_LIST_ENTRY)), - ("Blink", POINTER(_LIST_ENTRY)), -] - -class _PEB_LDR_DATA(Structure): - _fields_ = [ - ("Length", ULONG), - ("Initialized", BYTE), - ("SsHandle", PVOID), - ("InLoadOrderModuleList", _LIST_ENTRY), - ("InMemoryOrderModuleList", _LIST_ENTRY), - ("InInitializationOrderModuleList", _LIST_ENTRY), - ("EntryInProgress", PVOID), - ] -PEB_LDR_DATA = _PEB_LDR_DATA -PPEB_LDR_DATA = POINTER(_PEB_LDR_DATA) - -class _LSA_UNICODE_STRING(Structure): - _fields_ = [ - ("Length", USHORT), - ("MaximumLength", USHORT), - ("Buffer", PVOID), - ] -LSA_UNICODE_STRING = _LSA_UNICODE_STRING -PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) -PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) -UNICODE_STRING = _LSA_UNICODE_STRING - -INITIAL_LSA_UNICODE_STRING = _LSA_UNICODE_STRING - -class _LSA_UNICODE_STRING(INITIAL_LSA_UNICODE_STRING): - @property - def str(self): - """The python string of the LSA_UNICODE_STRING object - - :type: :class:`unicode` - """ - if not self.Length: - return "" - if getattr(self, "_target", None) is not None: #remote ctypes :D -> TRICKS OF THE YEAR - raw_data = self._target.read_memory(self.Buffer, self.Length) - return raw_data.decode("utf16") - size = int(self.Length / 2) - return (ctypes.c_wchar * size).from_address(self.Buffer)[:] - - @classmethod - def from_string(cls, s): - utf16_len = len(s) * 2 - return cls(utf16_len, utf16_len, ctypes.cast(PWSTR(s), PVOID)) - - @classmethod - def from_size(cls, size): - buffer = ctypes.create_string_buffer(size) - return cls(size, size, ctypes.cast(buffer, PVOID)) - - def __repr__(self): - return windows.pycompat.urepr_encode(u"""<{0} "{1}" at {2}>""".format(type(self).__name__, self.str, hex(id(self)))) - - def __sprint__(self): - try: - return self.__repr__() - except TypeError as e: - # Bad buffer: print raw infos - return """<{0} len={1} maxlen={2} buffer={3}>""".format(type(self).__name__, self.Length, self.MaximumLength, self.Buffer) - -LSA_UNICODE_STRING = _LSA_UNICODE_STRING -PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) -PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) -UNICODE_STRING = _LSA_UNICODE_STRING -class _CURDIR(Structure): - _fields_ = [ - ("DosPath", UNICODE_STRING), - ("Handle", PVOID), - ] -CURDIR = _CURDIR -PCURDIR = POINTER(_CURDIR) - -class _RTL_DRIVE_LETTER_CURDIR(Structure): - _fields_ = [ - ("Flags", WORD), - ("Length", WORD), - ("TimeStamp", ULONG), - ("DosPath", UNICODE_STRING), - ] -PRTL_DRIVE_LETTER_CURDIR = POINTER(_RTL_DRIVE_LETTER_CURDIR) -RTL_DRIVE_LETTER_CURDIR = _RTL_DRIVE_LETTER_CURDIR - -class _RTL_USER_PROCESS_PARAMETERS(Structure): - _fields_ = [ - ("MaximumLength", ULONG), - ("Length", ULONG), - ("Flags", ULONG), - ("DebugFlags", ULONG), - ("ConsoleHandle", PVOID), - ("ConsoleFlags", ULONG), - ("StandardInput", PVOID), - ("StandardOutput", PVOID), - ("StandardError", PVOID), - ("CurrentDirectory", CURDIR), - ("DllPath", UNICODE_STRING), - ("ImagePathName", UNICODE_STRING), - ("CommandLine", UNICODE_STRING), - ("Environment", PVOID), - ("StartingX", ULONG), - ("StartingY", ULONG), - ("CountX", ULONG), - ("CountY", ULONG), - ("CountCharsX", ULONG), - ("CountCharsY", ULONG), - ("FillAttribute", ULONG), - ("WindowFlags", ULONG), - ("ShowWindowFlags", ULONG), - ("WindowTitle", UNICODE_STRING), - ("DesktopInfo", UNICODE_STRING), - ("ShellInfo", UNICODE_STRING), - ("RuntimeData", UNICODE_STRING), - ("CurrentDirectores", RTL_DRIVE_LETTER_CURDIR * (32)), - ] -PRTL_USER_PROCESS_PARAMETERS = POINTER(_RTL_USER_PROCESS_PARAMETERS) -RTL_USER_PROCESS_PARAMETERS = _RTL_USER_PROCESS_PARAMETERS - -class _ANON_PEB_SYSTEM_DEPENDENT_02(Union): - _fields_ = [ - ("FastPebLockRoutine", PVOID), - ("SparePtr1", PVOID), - ("AtlThunkSListPtr", PVOID), - ] - - -class _ANON_PEB_SYSTEM_DEPENDENT_03(Union): - _fields_ = [ - ("FastPebUnlockRoutine", PVOID), - ("SparePtr2", PVOID), - ("IFEOKey", PVOID), - ] - - -class _ANON_PEB_SYSTEM_DEPENDENT_06(Union): - _fields_ = [ - ("FreeList", PVOID), - ("SparePebPtr0", PVOID), - ("ApiSetMap", PVOID), - ] - - -class _ANON_PEB_SYSTEM_DEPENDENT_07(Union): - _fields_ = [ - ("ReadOnlySharedMemoryHeap", PVOID), - ("HotpatchInformation", PVOID), - ("SparePvoid0", PVOID), - ] - - -class _ANON_PEB_UNION_1(Union): - _fields_ = [ - ("KernelCallbackTable", PVOID), - ("UserSharedInfoPtr", PVOID), - ] - - -class _ANON_PEB_UNION_2(Union): - _fields_ = [ - ("ImageProcessAffinityMask", PVOID), - ("ActiveProcessAffinityMask", PVOID), - ] - - -class _ANON__PEB_SUB_UNION_1(Union): - _fields_ = [ - ("KernelCallbackTable", PVOID), - ("UserSharedInfoPtr", PVOID), - ] - - -class _ANON__PEB_SUB_UNION_2(Union): - _fields_ = [ - ("ImageProcessAffinityMask", PVOID), - ("ActiveProcessAffinityMask", PVOID), - ] - -class _PEB(Structure): - _anonymous_ = ("_SYSTEM_DEPENDENT_02","_SYSTEM_DEPENDENT_03","anon_01","_SYSTEM_DEPENDENT_06","_SYSTEM_DEPENDENT_07","anon_02") - _fields_ = [ - ("Reserved1", BYTE * (2)), - ("BeingDebugged", BYTE), - ("Reserved2", BYTE * (1)), - ("Mutant", PVOID), - ("ImageBaseAddress", PVOID), - ("Ldr", PPEB_LDR_DATA), - ("ProcessParameters", PRTL_USER_PROCESS_PARAMETERS), - ("SubSystemData", PVOID), - ("ProcessHeap", PVOID), - ("FastPebLock", PVOID), - ("_SYSTEM_DEPENDENT_02", _ANON_PEB_SYSTEM_DEPENDENT_02), - ("_SYSTEM_DEPENDENT_03", _ANON_PEB_SYSTEM_DEPENDENT_03), - ("_SYSTEM_DEPENDENT_04", PVOID), - ("anon_01", _ANON__PEB_SUB_UNION_1), - ("SystemReserved", DWORD), - ("_SYSTEM_DEPENDENT_05", DWORD), - ("_SYSTEM_DEPENDENT_06", _ANON_PEB_SYSTEM_DEPENDENT_06), - ("TlsExpansionCounter", PVOID), - ("TlsBitmap", PVOID), - ("TlsBitmapBits", DWORD * (2)), - ("ReadOnlySharedMemoryBase", PVOID), - ("_SYSTEM_DEPENDENT_07", _ANON_PEB_SYSTEM_DEPENDENT_07), - ("ReadOnlyStaticServerData", PVOID), - ("AnsiCodePageData", PVOID), - ("OemCodePageData", PVOID), - ("UnicodeCaseTableData", PVOID), - ("NumberOfProcessors", DWORD), - ("NtGlobalFlag", DWORD), - ("CriticalSectionTimeout", LARGE_INTEGER), - ("HeapSegmentReserve", PVOID), - ("HeapSegmentCommit", PVOID), - ("HeapDeCommitTotalFreeThreshold", PVOID), - ("HeapDeCommitFreeBlockThreshold", PVOID), - ("NumberOfHeaps", DWORD), - ("MaximumNumberOfHeaps", DWORD), - ("ProcessHeaps", PVOID), - ("GdiSharedHandleTable", PVOID), - ("ProcessStarterHelper", PVOID), - ("GdiDCAttributeList", PVOID), - ("LoaderLock", PVOID), - ("OSMajorVersion", DWORD), - ("OSMinorVersion", DWORD), - ("OSBuildNumber", WORD), - ("OSCSDVersion", WORD), - ("OSPlatformId", DWORD), - ("ImageSubsystem", DWORD), - ("ImageSubsystemMajorVersion", DWORD), - ("ImageSubsystemMinorVersion", PVOID), - ("anon_02", _ANON__PEB_SUB_UNION_2), - ("GdiHandleBuffer", PVOID * (26)), - ("GdiHandleBuffer2", BYTE * (32)), - ("PostProcessInitRoutine", PVOID), - ("TlsExpansionBitmap", PVOID), - ("TlsExpansionBitmapBits", DWORD * (32)), - ("SessionId", PVOID), - ("AppCompatFlags", ULARGE_INTEGER), - ("AppCompatFlagsUser", ULARGE_INTEGER), - ("pShimData", PVOID), - ("AppCompatInfo", PVOID), - ("CSDVersion", UNICODE_STRING), - ("ActivationContextData", PVOID), - ("ProcessAssemblyStorageMap", PVOID), - ("SystemDefaultActivationContextData", PVOID), - ("SystemAssemblyStorageMap", PVOID), - ("MinimumStackCommit", PVOID), - ] -PEB = _PEB -PPEB = POINTER(_PEB) - class _SECURITY_ATTRIBUTES(Structure): _fields_ = [ ("nLength", DWORD), @@ -5733,47 +5888,6 @@ class _SYSTEM_PROCESS_ID_INFORMATION(Structure): PSYSTEM_PROCESS_ID_INFORMATION = POINTER(_SYSTEM_PROCESS_ID_INFORMATION) SYSTEM_PROCESS_ID_INFORMATION = _SYSTEM_PROCESS_ID_INFORMATION -class _CLIENT_ID(Structure): - _fields_ = [ - ("UniqueProcess", HANDLE), - ("UniqueThread", HANDLE), - ] -CLIENT_ID = _CLIENT_ID -PCLIENT_ID = POINTER(_CLIENT_ID) - -class _CLIENT_ID64(Structure): - _fields_ = [ - ("UniqueProcess", ULONG64), - ("UniqueThread", ULONG64), - ] -CLIENT_ID64 = _CLIENT_ID64 -PCLIENT_ID64 = POINTER(_CLIENT_ID64) - -class _CLIENT_ID32(Structure): - _fields_ = [ - ("UniqueProcess", ULONG), - ("UniqueThread", ULONG), - ] -CLIENT_ID32 = _CLIENT_ID32 -PCLIENT_ID32 = POINTER(_CLIENT_ID32) - -class _LDR_DATA_TABLE_ENTRY(Structure): - _fields_ = [ - ("Reserved1", PVOID * (2)), - ("InMemoryOrderLinks", LIST_ENTRY), - ("Reserved2", PVOID * (2)), - ("DllBase", PVOID), - ("EntryPoint", PVOID), - ("SizeOfImage", PVOID), - ("FullDllName", UNICODE_STRING), - ("BaseDllName", UNICODE_STRING), - ("Reserved5", PVOID * (3)), - ("CheckSum", ULONG), - ("TimeDateStamp", ULONG), - ] -LDR_DATA_TABLE_ENTRY = _LDR_DATA_TABLE_ENTRY -PLDR_DATA_TABLE_ENTRY = POINTER(_LDR_DATA_TABLE_ENTRY) - class _MEMORY_BASIC_INFORMATION(Structure): _fields_ = [ ("BaseAddress", PVOID), @@ -11064,82 +11178,6 @@ EXPLICIT_ACCESS_W = _EXPLICIT_ACCESS_W PEXPLICIT_ACCESSW = POINTER(_EXPLICIT_ACCESS_W) PEXPLICIT_ACCESS_W = POINTER(_EXPLICIT_ACCESS_W) -ComputerNameNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameNetBIOS", 0x0) -ComputerNameDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsHostname", 0x1) -ComputerNameDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsDomain", 0x2) -ComputerNameDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsFullyQualified", 0x3) -ComputerNamePhysicalNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalNetBIOS", 0x4) -ComputerNamePhysicalDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsHostname", 0x5) -ComputerNamePhysicalDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsDomain", 0x6) -ComputerNamePhysicalDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsFullyQualified", 0x7) -ComputerNameMax = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameMax", 0x8) -class _COMPUTER_NAME_FORMAT(EnumType): - values = [ComputerNameNetBIOS, ComputerNameDnsHostname, ComputerNameDnsDomain, ComputerNameDnsFullyQualified, ComputerNamePhysicalNetBIOS, ComputerNamePhysicalDnsHostname, ComputerNamePhysicalDnsDomain, ComputerNamePhysicalDnsFullyQualified, ComputerNameMax] - mapper = FlagMapper(*values) -COMPUTER_NAME_FORMAT = _COMPUTER_NAME_FORMAT - - -class _SYSTEM_PROCESS_INFORMATION(Structure): - _fields_ = [ - ("NextEntryOffset", ULONG), - ("NumberOfThreads", ULONG), - ("Reserved1", BYTE * (24)), - ("CreateTime", LARGE_INTEGER), - ("UserTime", LARGE_INTEGER), - ("KernelTime", LARGE_INTEGER), - ("ImageName", UNICODE_STRING), - ("BasePriority", LONG), - ("UniqueProcessId", HANDLE), - ("InheritedFromUniqueProcessId", PVOID), - ("HandleCount", ULONG), - ("Reserved4", BYTE * (4)), - ("Reserved5", PVOID * (1)), - ("PeakVirtualSize", PVOID), - ("VirtualSize", PVOID), - ("PageFaultCount", PVOID), - ("PeakWorkingSetSize", PVOID), - ("WorkingSetSize", PVOID), - ("QuotaPeakPagedPoolUsage", PVOID), - ("QuotaPagedPoolUsage", PVOID), - ("QuotaPeakNonPagedPoolUsage", PVOID), - ("QuotaNonPagedPoolUsage", PVOID), - ("PagefileUsage", PVOID), - ("PeakPagefileUsage", SIZE_T), - ("PrivatePageCount", SIZE_T), - ("Reserved6", LARGE_INTEGER * (6)), - ] -PSYSTEM_PROCESS_INFORMATION = POINTER(_SYSTEM_PROCESS_INFORMATION) -SYSTEM_PROCESS_INFORMATION = _SYSTEM_PROCESS_INFORMATION - -class _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION(Structure): - _fields_ = [ - ("IdleTime", LARGE_INTEGER), - ("KernelTime", LARGE_INTEGER), - ("UserTime", LARGE_INTEGER), - ("Reserved1", LARGE_INTEGER * (2)), - ("Reserved2", ULONG), - ] -PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = POINTER(_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION) -SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION - -class _SYSTEM_REGISTRY_QUOTA_INFORMATION(Structure): - _fields_ = [ - ("RegistryQuotaAllowed", ULONG), - ("RegistryQuotaUsed", ULONG), - ("Reserved1", PVOID), - ] -PSYSTEM_REGISTRY_QUOTA_INFORMATION = POINTER(_SYSTEM_REGISTRY_QUOTA_INFORMATION) -SYSTEM_REGISTRY_QUOTA_INFORMATION = _SYSTEM_REGISTRY_QUOTA_INFORMATION - -class _SYSTEM_BASIC_INFORMATION(Structure): - _fields_ = [ - ("Reserved1", BYTE * (24)), - ("Reserved2", PVOID * (4)), - ("NumberOfProcessors", CHAR), - ] -PSYSTEM_BASIC_INFORMATION = POINTER(_SYSTEM_BASIC_INFORMATION) -SYSTEM_BASIC_INFORMATION = _SYSTEM_BASIC_INFORMATION - class _TIME_ZONE_INFORMATION(Structure): _fields_ = [ ("Bias", LONG),