updated NT headers for Windows 8

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@5117 21ef857c-d57f-4fe0-8362-d861dc6d29cd
This commit is contained in:
wj32
2012-12-06 09:02:25 +00:00
parent 2667e6ea00
commit 365f364166
14 changed files with 88 additions and 39 deletions
+2
View File
@@ -318,6 +318,8 @@ NTSTATUS PhGetProcessKnownType(
knownProcessType = TaskHostProcessType;
else if (PhEqualStringRef2(&name, L"\\taskhost.exe", TRUE))
knownProcessType = TaskHostProcessType;
else if (PhEqualStringRef2(&name, L"\\taskhostex.exe", TRUE))
knownProcessType = TaskHostProcessType;
}
}
+1 -1
View File
@@ -161,7 +161,7 @@ typedef enum _PH_KNOWN_PROCESS_TYPE
ServiceHostProcessType, // svchost
RunDllAsAppProcessType, // rundll32
ComSurrogateProcessType, // dllhost
TaskHostProcessType, // taskeng, taskhost
TaskHostProcessType, // taskeng, taskhost, taskhostex
ExplorerProcessType, // explorer
MaximumProcessType,
KnownProcessTypeMask = 0xffff,
+1 -1
View File
@@ -356,7 +356,7 @@ typedef enum _PH_KNOWN_PROCESS_TYPE
ServiceHostProcessType, // svchost
RunDllAsAppProcessType, // rundll32
ComSurrogateProcessType, // dllhost
TaskHostProcessType, // taskeng, taskhost
TaskHostProcessType, // taskeng, taskhost, taskhostex
ExplorerProcessType, // explorer
MaximumProcessType,
KnownProcessTypeMask = 0xffff,
+26
View File
@@ -115,6 +115,31 @@ typedef const UNICODE_STRING *PCUNICODE_STRING;
#define RTL_CONSTANT_STRING(s) { sizeof(s) - sizeof((s)[0]), sizeof(s), s }
// Balanced tree node
#define RTL_BALANCED_NODE_RESERVED_PARENT_MASK 3
typedef struct _RTL_BALANCED_NODE
{
union
{
struct _RTL_BALANCED_NODE *Children[2];
struct
{
struct _RTL_BALANCED_NODE *Left;
struct _RTL_BALANCED_NODE *Right;
};
};
union
{
UCHAR Red : 1;
UCHAR Balance : 2;
ULONG_PTR ParentValue;
};
} RTL_BALANCED_NODE, *PRTL_BALANCED_NODE;
#define RTL_BALANCED_NODE_GET_PARENT_POINTER(Node) ((PRTL_BALANCED_NODE)((Node)->ParentValue & ~RTL_BALANCED_NODE_RESERVED_PARENT_MASK))
// Portability
typedef struct _SINGLE_LIST_ENTRY32
@@ -231,6 +256,7 @@ typedef enum _SUITE_TYPE
StorageServer,
ComputeServer,
WHServer,
PhoneNT,
MaxSuiteType
} SUITE_TYPE;
+16
View File
@@ -869,6 +869,22 @@ typedef enum _SYSTEM_INFORMATION_CLASS
SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26
SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation
SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1
SystemSessionBigPoolInformation, // since WIN8
SystemBootGraphicsInformation,
SystemScrubPhysicalMemoryInformation,
SystemBadPageInformation,
SystemProcessorProfileControlArea,
SystemCombinePhysicalMemoryInformation,
SystemEntropyInterruptTimingCallback,
SystemConsoleInformation,
SystemPlatformBinaryInformation,
SystemThrottleNotificationInformation,
SystemHypervisorProcessorCountInformation,
SystemDeviceDataInformation,
SystemDeviceDataEnumerationInformation,
SystemMemoryTopologyInformation,
SystemMemoryChannelInformation,
SystemBootLogoInformation,
MaxSystemInfoClass
} SYSTEM_INFORMATION_CLASS;
+10 -3
View File
@@ -573,6 +573,13 @@ typedef struct _FILE_INTEGRITY_STREAM_INFORMATION
ULONG Flags;
} FILE_INTEGRITY_STREAM_INFORMATION, *PFILE_INTEGRITY_STREAM_INFORMATION;
// private
typedef struct _FILE_VOLUME_NAME_INFORMATION
{
ULONG DeviceNameLength;
WCHAR DeviceName[1];
} FILE_VOLUME_NAME_INFORMATION, *PFILE_VOLUME_NAME_INFORMATION;
// NtQueryDirectoryFile types
typedef struct _FILE_DIRECTORY_INFORMATION
@@ -758,7 +765,7 @@ typedef enum _FSINFOCLASS
FileFsVolumeFlagsInformation,
FileFsSectorSizeInformation, // since WIN8
FileFsMaximumInformation
} FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;
} FSINFOCLASS, *PFSINFOCLASS;
// NtQueryVolumeInformation/NtSetVolumeInformation types
@@ -1045,7 +1052,7 @@ NtQueryVolumeInformationFile(
__out PIO_STATUS_BLOCK IoStatusBlock,
__out_bcount(Length) PVOID FsInformation,
__in ULONG Length,
__in FS_INFORMATION_CLASS FsInformationClass
__in FSINFOCLASS FsInformationClass
);
NTSYSCALLAPI
@@ -1056,7 +1063,7 @@ NtSetVolumeInformationFile(
__out PIO_STATUS_BLOCK IoStatusBlock,
__in_bcount(Length) PVOID FsInformation,
__in ULONG Length,
__in FS_INFORMATION_CLASS FsInformationClass
__in FSINFOCLASS FsInformationClass
);
NTSYSCALLAPI
+2 -2
View File
@@ -438,8 +438,8 @@ typedef enum _ALPC_PORT_INFORMATION_CLASS
AlpcRegisterCompletionListInformation, // s: in ALPC_PORT_COMPLETION_LIST_INFORMATION
AlpcUnregisterCompletionListInformation, // s: VOID
AlpcAdjustCompletionListConcurrencyCountInformation, // s: in ULONG
AlpcRegisterCallback, // kernel-mode only // rev
AlpcDisableCompletionList, // s: VOID // rev
AlpcRegisterCallbackInformation, // kernel-mode only
AlpcCompletionListRundownInformation, // s: VOID
MaxAlpcPortInfoClass
} ALPC_PORT_INFORMATION_CLASS;
+2 -1
View File
@@ -201,7 +201,8 @@ typedef struct _SECTION_IMAGE_INFORMATION
UCHAR ComPlusILOnly : 1;
UCHAR ImageDynamicallyRelocated : 1;
UCHAR ImageMappedFlat : 1;
UCHAR Reserved : 4;
UCHAR BaseBelow4gb : 1;
UCHAR Reserved : 3;
};
};
ULONG LoaderFlags;
+7 -2
View File
@@ -136,9 +136,11 @@ typedef struct _PEB
{
ULONG HeapTracingEnabled : 1;
ULONG CritSecTracingEnabled : 1;
ULONG SpareTracingBits : 30;
ULONG LibLoaderTracingEnabled : 1;
ULONG SpareTracingBits : 29;
};
};
ULONGLONG CsrServerReadOnlySharedMemoryBase;
} PEB, *PPEB;
#define GDI_BATCH_BUFFER_SIZE 310
@@ -294,7 +296,9 @@ typedef struct _TEB
USHORT DisableUserStackWalk : 1;
USHORT RtlExceptionAttached : 1;
USHORT InitialThread : 1;
USHORT SpareSameTebBits : 1;
USHORT SessionAware : 1;
USHORT DisabledStackCheck : 1;
USHORT SpareSameTebBits : 3;
};
};
@@ -304,6 +308,7 @@ typedef struct _TEB
ULONG LockCount;
ULONG SpareUlong0;
PVOID ResourceRetValue;
PVOID ReservedForWdf;
} TEB, *PTEB;
#endif
+1
View File
@@ -929,6 +929,7 @@ typedef enum _PS_ATTRIBUTE_NUM
PsAttributeIdealProcessor, // in PPROCESSOR_NUMBER
PsAttributeUmsThread, // ? in PUMS_CREATE_THREAD_ATTRIBUTES
PsAttributeMitigationOptions, // in UCHAR
PsAttributeSecurityCapabilities,
PsAttributeMax
} PS_ATTRIBUTE_NUM;
+1 -1
View File
@@ -88,7 +88,7 @@ typedef struct _KEY_VIRTUALIZATION_INFORMATION
ULONG VirtualizationCandidate : 1; // Tells whether the key is part of the virtualization namespace scope (only HKLM\Software for now).
ULONG VirtualizationEnabled : 1; // Tells whether virtualization is enabled on this key. Can be 1 only if above flag is 1.
ULONG VirtualTarget : 1; // Tells if the key is a virtual key. Can be 1 only if above 2 are 0. Valid only on the virtual store key handles.
ULONG VirtualStore : 1; // Tells if the key is a part of the virtual sore path. Valid only on the virtual store key handles.
ULONG VirtualStore : 1; // Tells if the key is a part of the virtual store path. Valid only on the virtual store key handles.
ULONG VirtualSource : 1; // Tells if the key has ever been virtualized, can be 1 only if VirtualizationCandidate is 1.
ULONG Reserved : 27;
} KEY_VIRTUALIZATION_INFORMATION, *PKEY_VIRTUALIZATION_INFORMATION;
+6 -22
View File
@@ -547,25 +547,6 @@ RtlIsGenericTableEmpty(
// RB trees
typedef struct _RTL_BALANCED_NODE
{
union
{
struct _RTL_BALANCED_NODE *Children[2];
struct
{
struct _RTL_BALANCED_NODE *Left;
struct _RTL_BALANCED_NODE *Right;
};
};
union
{
ULONG_PTR Red : 1;
ULONG_PTR Balance : 2;
ULONG_PTR ParentValue;
};
} RTL_BALANCED_NODE, *PRTL_BALANCED_NODE;
typedef struct _RTL_RB_TREE
{
PRTL_BALANCED_NODE Root;
@@ -1131,9 +1112,9 @@ RtlWakeAllConditionVariable(
#endif
// begin_rev
#define RTL_BARRIER_SPIN_ONLY 0x00000001 // never block on event - always spin
#define RTL_BARRIER_NEVER_SPIN 0x00000002 // always block on event - never spin
#define RTL_BARRIER_INCREMENT_MAXIMUM_COUNT 0x00010000 // ?
#define RTL_BARRIER_FLAGS_SPIN_ONLY 0x00000001 // never block on event - always spin
#define RTL_BARRIER_FLAGS_BLOCK_ONLY 0x00000002 // always block on event - never spin
#define RTL_BARRIER_FLAGS_NO_DELETE 0x00000004 // use if barrier will never be deleted
// end_rev
// begin_private
@@ -2334,6 +2315,9 @@ typedef struct _RTL_USER_PROCESS_PARAMETERS
ULONG EnvironmentSize;
ULONG EnvironmentVersion;
UNICODE_STRING PackageMoniker;
PVOID PackageDependencyData;
ULONG ProcessGroupId;
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
#define RTL_USER_PROC_PARAMS_NORMALIZED 0x00000001
+11 -4
View File
@@ -22,7 +22,9 @@ typedef enum _WOW64_SHARED_INFORMATION
SharedNtdll32pQueryProcessDebugInformationRemote = 9,
SharedNtdll32EtwpNotificationThread = 10,
SharedNtdll32BaseAddress = 11,
Wow64SharedPageEntriesCount = 12
SharedNtdll32RtlpWnfNotificationThread = 12,
SharedNtdll32LdrSystemDllInitBlock = 13,
Wow64SharedPageEntriesCount = 14
} WOW64_SHARED_INFORMATION;
// 32-bit definitions
@@ -42,8 +44,8 @@ typedef struct _RTL_BALANCED_NODE32
};
union
{
WOW64_POINTER(ULONG_PTR) Red : 1;
WOW64_POINTER(ULONG_PTR) Balance : 2;
WOW64_POINTER(UCHAR) Red : 1;
WOW64_POINTER(UCHAR) Balance : 2;
WOW64_POINTER(ULONG_PTR) ParentValue;
};
} RTL_BALANCED_NODE32, *PRTL_BALANCED_NODE32;
@@ -216,6 +218,9 @@ typedef struct _RTL_USER_PROCESS_PARAMETERS32
ULONG EnvironmentSize;
ULONG EnvironmentVersion;
UNICODE_STRING32 PackageMoniker;
WOW64_POINTER(PVOID) PackageDependencyData;
ULONG ProcessGroupId;
} RTL_USER_PROCESS_PARAMETERS32, *PRTL_USER_PROCESS_PARAMETERS32;
typedef struct _PEB32
@@ -345,9 +350,11 @@ typedef struct _PEB32
{
ULONG HeapTracingEnabled : 1;
ULONG CritSecTracingEnabled : 1;
ULONG SpareTracingBits : 30;
ULONG LibLoaderTracingEnabled : 1;
ULONG SpareTracingBits : 29;
};
};
ULONGLONG CsrServerReadOnlySharedMemoryBase;
} PEB32, *PPEB32;
#define GDI_BATCH_BUFFER_SIZE 310
+2 -2
View File
@@ -2655,7 +2655,7 @@ ZwQueryVolumeInformationFile(
__out PIO_STATUS_BLOCK IoStatusBlock,
__out_bcount(Length) PVOID FsInformation,
__in ULONG Length,
__in FS_INFORMATION_CLASS FsInformationClass
__in FSINFOCLASS FsInformationClass
);
NTSYSCALLAPI
@@ -3478,7 +3478,7 @@ ZwSetVolumeInformationFile(
__out PIO_STATUS_BLOCK IoStatusBlock,
__in_bcount(Length) PVOID FsInformation,
__in ULONG Length,
__in FS_INFORMATION_CLASS FsInformationClass
__in FSINFOCLASS FsInformationClass
);
NTSYSCALLAPI