diff --git a/ctypes_generation/definitions/structures/process.txt b/ctypes_generation/definitions/structures/process.txt new file mode 100644 index 0000000..d5494d2 --- /dev/null +++ b/ctypes_generation/definitions/structures/process.txt @@ -0,0 +1,124 @@ +typedef enum _MEMORY_INFORMATION_CLASS { + MemoryBasicInformation, + MemoryWorkingSetList, + MemorySectionName, + MemoryBasicVlmInformation, + MemoryWorkingSetListEx +} MEMORY_INFORMATION_CLASS; + +typedef enum _THREAD_INFORMATION_CLASS { + ThreadBasicInformation, + ThreadTimes, + ThreadPriority, + ThreadBasePriority, + ThreadAffinityMask, + ThreadImpersonationToken, + ThreadDescriptorTableEntry, + ThreadEnableAlignmentFaultFixup, + ThreadEventPair, + ThreadQuerySetWin32StartAddress, + ThreadZeroTlsCell, + ThreadPerformanceCount, + ThreadAmILastThread, + ThreadIdealProcessor, + ThreadPriorityBoost, + ThreadSetTlsArrayAddress, + ThreadIsIoPending, + ThreadHideFromDebugger +} THREAD_INFORMATION_CLASS, *PTHREAD_INFORMATION_CLASS; + +// For NtQueryInformationProcess +typedef enum _PROCESSINFOCLASS { + ProcessBasicInformation = 0, + ProcessQuotaLimits = 1, + ProcessIoCounters = 2, + ProcessVmCounters = 3, + ProcessTimes = 4, + ProcessBasePriority = 5, + ProcessRaisePriority = 6, + ProcessDebugPort = 7, + ProcessExceptionPort = 8, + ProcessAccessToken = 9, + ProcessLdtInformation = 10, + ProcessLdtSize = 11, + ProcessDefaultHardErrorMode = 12, + ProcessIoPortHandlers = 13, // Note: this is kernel mode only + ProcessPooledUsageAndLimits = 14, + ProcessWorkingSetWatch = 15, + ProcessUserModeIOPL = 16, + ProcessEnableAlignmentFaultFixup = 17, + ProcessPriorityClass = 18, + ProcessWx86Information = 19, + ProcessHandleCount = 20, + ProcessAffinityMask = 21, + ProcessPriorityBoost = 22, + ProcessDeviceMap = 23, + ProcessSessionInformation = 24, + ProcessForegroundInformation = 25, + ProcessWow64Information = 26, + ProcessImageFileName = 27, + ProcessLUIDDeviceMapsEnabled = 28, + ProcessBreakOnTermination = 29, + ProcessDebugObjectHandle = 30, + ProcessDebugFlags = 31, + ProcessHandleTracing = 32, + ProcessIoPriority = 33, + ProcessExecuteFlags = 34, + ProcessTlsInformation = 35, + ProcessCookie = 36, + ProcessImageInformation = 37, + ProcessCycleTime = 38, + ProcessPagePriority = 39, + ProcessInstrumentationCallback = 40, + ProcessThreadStackAllocation = 41, + ProcessWorkingSetWatchEx = 42, + ProcessImageFileNameWin32 = 43, + ProcessImageFileMapping = 44, + ProcessAffinityUpdateMode = 45, + ProcessMemoryAllocationMode = 46, + ProcessGroupInformation = 47, + ProcessTokenVirtualizationEnabled = 48, + ProcessOwnerInformation = 49, + ProcessWindowInformation = 50, + ProcessHandleInformation = 51, + ProcessMitigationPolicy = 52, + ProcessDynamicFunctionTableInformation = 53, + ProcessHandleCheckingMode = 54, + ProcessKeepAliveCount = 55, + ProcessRevokeFileHandles = 56, + ProcessWorkingSetControl = 57, + ProcessHandleTable = 58, + ProcessCheckStackExtentsMode = 59, + ProcessCommandLineInformation = 60, + ProcessProtectionInformation = 61, + ProcessMemoryExhaustion = 62, + ProcessFaultInformation = 63, + ProcessTelemetryIdInformation = 64, + ProcessCommitReleaseInformation = 65, + ProcessReserved1Information = 66, + ProcessReserved2Information = 67, + ProcessSubsystemProcess = 68, + ProcessInPrivate = 70, + ProcessRaiseUMExceptionOnInvalidHandleClose = 71, + ProcessSubsystemInformation = 75, + ProcessWin32kSyscallFilterInformation = 79, + ProcessEnergyTrackingState = 82, + MaxProcessInfoClass // MaxProcessInfoClass should always be the last enum +} PROCESSINFOCLASS; + +// GetProcessInfo +typedef enum _PROCESS_INFORMATION_CLASS { + ProcessMemoryPriority, + ProcessMemoryExhaustionInfo, + ProcessAppMemoryInfo, + ProcessInPrivateInfo, + ProcessPowerThrottling, + ProcessReservedValue1, + ProcessTelemetryCoverageInfo, + ProcessProtectionLevelInfo, + ProcessLeapSecondInfo, + ProcessMachineTypeInfo, // Map to 0xe6(230) for the syscall NtQueryInformationProcess + ProcessOverrideSubsequentPrefetchParameter, + ProcessMaxOverridePrefetchParameter, + ProcessInformationClassMax +} PROCESS_INFORMATION_CLASS; \ No newline at end of file diff --git a/ctypes_generation/definitions/structures/processor.txt b/ctypes_generation/definitions/structures/processor.txt new file mode 100644 index 0000000..4f8a983 --- /dev/null +++ b/ctypes_generation/definitions/structures/processor.txt @@ -0,0 +1,11 @@ +typedef enum _MACHINE_ATTRIBUTES { + UserEnabled = 0x00000001, + KernelEnabled = 0x00000002, + Wow64Container = 0x00000004 +} MACHINE_ATTRIBUTES; + +typedef struct _PROCESS_MACHINE_INFORMATION { + USHORT ProcessMachine; + USHORT Res0; + MACHINE_ATTRIBUTES MachineAttributes; +} PROCESS_MACHINE_INFORMATION; \ No newline at end of file