mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
updated NT headers for Windows 8
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@5117 21ef857c-d57f-4fe0-8362-d861dc6d29cd
This commit is contained in:
@@ -318,6 +318,8 @@ NTSTATUS PhGetProcessKnownType(
|
||||
knownProcessType = TaskHostProcessType;
|
||||
else if (PhEqualStringRef2(&name, L"\\taskhost.exe", TRUE))
|
||||
knownProcessType = TaskHostProcessType;
|
||||
else if (PhEqualStringRef2(&name, L"\\taskhostex.exe", TRUE))
|
||||
knownProcessType = TaskHostProcessType;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -161,7 +161,7 @@ typedef enum _PH_KNOWN_PROCESS_TYPE
|
||||
ServiceHostProcessType, // svchost
|
||||
RunDllAsAppProcessType, // rundll32
|
||||
ComSurrogateProcessType, // dllhost
|
||||
TaskHostProcessType, // taskeng, taskhost
|
||||
TaskHostProcessType, // taskeng, taskhost, taskhostex
|
||||
ExplorerProcessType, // explorer
|
||||
MaximumProcessType,
|
||||
KnownProcessTypeMask = 0xffff,
|
||||
|
||||
@@ -356,7 +356,7 @@ typedef enum _PH_KNOWN_PROCESS_TYPE
|
||||
ServiceHostProcessType, // svchost
|
||||
RunDllAsAppProcessType, // rundll32
|
||||
ComSurrogateProcessType, // dllhost
|
||||
TaskHostProcessType, // taskeng, taskhost
|
||||
TaskHostProcessType, // taskeng, taskhost, taskhostex
|
||||
ExplorerProcessType, // explorer
|
||||
MaximumProcessType,
|
||||
KnownProcessTypeMask = 0xffff,
|
||||
|
||||
@@ -115,6 +115,31 @@ typedef const UNICODE_STRING *PCUNICODE_STRING;
|
||||
|
||||
#define RTL_CONSTANT_STRING(s) { sizeof(s) - sizeof((s)[0]), sizeof(s), s }
|
||||
|
||||
// Balanced tree node
|
||||
|
||||
#define RTL_BALANCED_NODE_RESERVED_PARENT_MASK 3
|
||||
|
||||
typedef struct _RTL_BALANCED_NODE
|
||||
{
|
||||
union
|
||||
{
|
||||
struct _RTL_BALANCED_NODE *Children[2];
|
||||
struct
|
||||
{
|
||||
struct _RTL_BALANCED_NODE *Left;
|
||||
struct _RTL_BALANCED_NODE *Right;
|
||||
};
|
||||
};
|
||||
union
|
||||
{
|
||||
UCHAR Red : 1;
|
||||
UCHAR Balance : 2;
|
||||
ULONG_PTR ParentValue;
|
||||
};
|
||||
} RTL_BALANCED_NODE, *PRTL_BALANCED_NODE;
|
||||
|
||||
#define RTL_BALANCED_NODE_GET_PARENT_POINTER(Node) ((PRTL_BALANCED_NODE)((Node)->ParentValue & ~RTL_BALANCED_NODE_RESERVED_PARENT_MASK))
|
||||
|
||||
// Portability
|
||||
|
||||
typedef struct _SINGLE_LIST_ENTRY32
|
||||
@@ -231,6 +256,7 @@ typedef enum _SUITE_TYPE
|
||||
StorageServer,
|
||||
ComputeServer,
|
||||
WHServer,
|
||||
PhoneNT,
|
||||
MaxSuiteType
|
||||
} SUITE_TYPE;
|
||||
|
||||
|
||||
@@ -869,6 +869,22 @@ typedef enum _SYSTEM_INFORMATION_CLASS
|
||||
SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26
|
||||
SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation
|
||||
SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1
|
||||
SystemSessionBigPoolInformation, // since WIN8
|
||||
SystemBootGraphicsInformation,
|
||||
SystemScrubPhysicalMemoryInformation,
|
||||
SystemBadPageInformation,
|
||||
SystemProcessorProfileControlArea,
|
||||
SystemCombinePhysicalMemoryInformation,
|
||||
SystemEntropyInterruptTimingCallback,
|
||||
SystemConsoleInformation,
|
||||
SystemPlatformBinaryInformation,
|
||||
SystemThrottleNotificationInformation,
|
||||
SystemHypervisorProcessorCountInformation,
|
||||
SystemDeviceDataInformation,
|
||||
SystemDeviceDataEnumerationInformation,
|
||||
SystemMemoryTopologyInformation,
|
||||
SystemMemoryChannelInformation,
|
||||
SystemBootLogoInformation,
|
||||
MaxSystemInfoClass
|
||||
} SYSTEM_INFORMATION_CLASS;
|
||||
|
||||
|
||||
@@ -573,6 +573,13 @@ typedef struct _FILE_INTEGRITY_STREAM_INFORMATION
|
||||
ULONG Flags;
|
||||
} FILE_INTEGRITY_STREAM_INFORMATION, *PFILE_INTEGRITY_STREAM_INFORMATION;
|
||||
|
||||
// private
|
||||
typedef struct _FILE_VOLUME_NAME_INFORMATION
|
||||
{
|
||||
ULONG DeviceNameLength;
|
||||
WCHAR DeviceName[1];
|
||||
} FILE_VOLUME_NAME_INFORMATION, *PFILE_VOLUME_NAME_INFORMATION;
|
||||
|
||||
// NtQueryDirectoryFile types
|
||||
|
||||
typedef struct _FILE_DIRECTORY_INFORMATION
|
||||
@@ -758,7 +765,7 @@ typedef enum _FSINFOCLASS
|
||||
FileFsVolumeFlagsInformation,
|
||||
FileFsSectorSizeInformation, // since WIN8
|
||||
FileFsMaximumInformation
|
||||
} FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;
|
||||
} FSINFOCLASS, *PFSINFOCLASS;
|
||||
|
||||
// NtQueryVolumeInformation/NtSetVolumeInformation types
|
||||
|
||||
@@ -1045,7 +1052,7 @@ NtQueryVolumeInformationFile(
|
||||
__out PIO_STATUS_BLOCK IoStatusBlock,
|
||||
__out_bcount(Length) PVOID FsInformation,
|
||||
__in ULONG Length,
|
||||
__in FS_INFORMATION_CLASS FsInformationClass
|
||||
__in FSINFOCLASS FsInformationClass
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
@@ -1056,7 +1063,7 @@ NtSetVolumeInformationFile(
|
||||
__out PIO_STATUS_BLOCK IoStatusBlock,
|
||||
__in_bcount(Length) PVOID FsInformation,
|
||||
__in ULONG Length,
|
||||
__in FS_INFORMATION_CLASS FsInformationClass
|
||||
__in FSINFOCLASS FsInformationClass
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
|
||||
@@ -438,8 +438,8 @@ typedef enum _ALPC_PORT_INFORMATION_CLASS
|
||||
AlpcRegisterCompletionListInformation, // s: in ALPC_PORT_COMPLETION_LIST_INFORMATION
|
||||
AlpcUnregisterCompletionListInformation, // s: VOID
|
||||
AlpcAdjustCompletionListConcurrencyCountInformation, // s: in ULONG
|
||||
AlpcRegisterCallback, // kernel-mode only // rev
|
||||
AlpcDisableCompletionList, // s: VOID // rev
|
||||
AlpcRegisterCallbackInformation, // kernel-mode only
|
||||
AlpcCompletionListRundownInformation, // s: VOID
|
||||
MaxAlpcPortInfoClass
|
||||
} ALPC_PORT_INFORMATION_CLASS;
|
||||
|
||||
|
||||
@@ -201,7 +201,8 @@ typedef struct _SECTION_IMAGE_INFORMATION
|
||||
UCHAR ComPlusILOnly : 1;
|
||||
UCHAR ImageDynamicallyRelocated : 1;
|
||||
UCHAR ImageMappedFlat : 1;
|
||||
UCHAR Reserved : 4;
|
||||
UCHAR BaseBelow4gb : 1;
|
||||
UCHAR Reserved : 3;
|
||||
};
|
||||
};
|
||||
ULONG LoaderFlags;
|
||||
|
||||
@@ -136,9 +136,11 @@ typedef struct _PEB
|
||||
{
|
||||
ULONG HeapTracingEnabled : 1;
|
||||
ULONG CritSecTracingEnabled : 1;
|
||||
ULONG SpareTracingBits : 30;
|
||||
ULONG LibLoaderTracingEnabled : 1;
|
||||
ULONG SpareTracingBits : 29;
|
||||
};
|
||||
};
|
||||
ULONGLONG CsrServerReadOnlySharedMemoryBase;
|
||||
} PEB, *PPEB;
|
||||
|
||||
#define GDI_BATCH_BUFFER_SIZE 310
|
||||
@@ -294,7 +296,9 @@ typedef struct _TEB
|
||||
USHORT DisableUserStackWalk : 1;
|
||||
USHORT RtlExceptionAttached : 1;
|
||||
USHORT InitialThread : 1;
|
||||
USHORT SpareSameTebBits : 1;
|
||||
USHORT SessionAware : 1;
|
||||
USHORT DisabledStackCheck : 1;
|
||||
USHORT SpareSameTebBits : 3;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -304,6 +308,7 @@ typedef struct _TEB
|
||||
ULONG LockCount;
|
||||
ULONG SpareUlong0;
|
||||
PVOID ResourceRetValue;
|
||||
PVOID ReservedForWdf;
|
||||
} TEB, *PTEB;
|
||||
|
||||
#endif
|
||||
|
||||
@@ -929,6 +929,7 @@ typedef enum _PS_ATTRIBUTE_NUM
|
||||
PsAttributeIdealProcessor, // in PPROCESSOR_NUMBER
|
||||
PsAttributeUmsThread, // ? in PUMS_CREATE_THREAD_ATTRIBUTES
|
||||
PsAttributeMitigationOptions, // in UCHAR
|
||||
PsAttributeSecurityCapabilities,
|
||||
PsAttributeMax
|
||||
} PS_ATTRIBUTE_NUM;
|
||||
|
||||
|
||||
@@ -88,7 +88,7 @@ typedef struct _KEY_VIRTUALIZATION_INFORMATION
|
||||
ULONG VirtualizationCandidate : 1; // Tells whether the key is part of the virtualization namespace scope (only HKLM\Software for now).
|
||||
ULONG VirtualizationEnabled : 1; // Tells whether virtualization is enabled on this key. Can be 1 only if above flag is 1.
|
||||
ULONG VirtualTarget : 1; // Tells if the key is a virtual key. Can be 1 only if above 2 are 0. Valid only on the virtual store key handles.
|
||||
ULONG VirtualStore : 1; // Tells if the key is a part of the virtual sore path. Valid only on the virtual store key handles.
|
||||
ULONG VirtualStore : 1; // Tells if the key is a part of the virtual store path. Valid only on the virtual store key handles.
|
||||
ULONG VirtualSource : 1; // Tells if the key has ever been virtualized, can be 1 only if VirtualizationCandidate is 1.
|
||||
ULONG Reserved : 27;
|
||||
} KEY_VIRTUALIZATION_INFORMATION, *PKEY_VIRTUALIZATION_INFORMATION;
|
||||
|
||||
@@ -547,25 +547,6 @@ RtlIsGenericTableEmpty(
|
||||
|
||||
// RB trees
|
||||
|
||||
typedef struct _RTL_BALANCED_NODE
|
||||
{
|
||||
union
|
||||
{
|
||||
struct _RTL_BALANCED_NODE *Children[2];
|
||||
struct
|
||||
{
|
||||
struct _RTL_BALANCED_NODE *Left;
|
||||
struct _RTL_BALANCED_NODE *Right;
|
||||
};
|
||||
};
|
||||
union
|
||||
{
|
||||
ULONG_PTR Red : 1;
|
||||
ULONG_PTR Balance : 2;
|
||||
ULONG_PTR ParentValue;
|
||||
};
|
||||
} RTL_BALANCED_NODE, *PRTL_BALANCED_NODE;
|
||||
|
||||
typedef struct _RTL_RB_TREE
|
||||
{
|
||||
PRTL_BALANCED_NODE Root;
|
||||
@@ -1131,9 +1112,9 @@ RtlWakeAllConditionVariable(
|
||||
#endif
|
||||
|
||||
// begin_rev
|
||||
#define RTL_BARRIER_SPIN_ONLY 0x00000001 // never block on event - always spin
|
||||
#define RTL_BARRIER_NEVER_SPIN 0x00000002 // always block on event - never spin
|
||||
#define RTL_BARRIER_INCREMENT_MAXIMUM_COUNT 0x00010000 // ?
|
||||
#define RTL_BARRIER_FLAGS_SPIN_ONLY 0x00000001 // never block on event - always spin
|
||||
#define RTL_BARRIER_FLAGS_BLOCK_ONLY 0x00000002 // always block on event - never spin
|
||||
#define RTL_BARRIER_FLAGS_NO_DELETE 0x00000004 // use if barrier will never be deleted
|
||||
// end_rev
|
||||
|
||||
// begin_private
|
||||
@@ -2334,6 +2315,9 @@ typedef struct _RTL_USER_PROCESS_PARAMETERS
|
||||
|
||||
ULONG EnvironmentSize;
|
||||
ULONG EnvironmentVersion;
|
||||
UNICODE_STRING PackageMoniker;
|
||||
PVOID PackageDependencyData;
|
||||
ULONG ProcessGroupId;
|
||||
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
|
||||
|
||||
#define RTL_USER_PROC_PARAMS_NORMALIZED 0x00000001
|
||||
|
||||
@@ -22,7 +22,9 @@ typedef enum _WOW64_SHARED_INFORMATION
|
||||
SharedNtdll32pQueryProcessDebugInformationRemote = 9,
|
||||
SharedNtdll32EtwpNotificationThread = 10,
|
||||
SharedNtdll32BaseAddress = 11,
|
||||
Wow64SharedPageEntriesCount = 12
|
||||
SharedNtdll32RtlpWnfNotificationThread = 12,
|
||||
SharedNtdll32LdrSystemDllInitBlock = 13,
|
||||
Wow64SharedPageEntriesCount = 14
|
||||
} WOW64_SHARED_INFORMATION;
|
||||
|
||||
// 32-bit definitions
|
||||
@@ -42,8 +44,8 @@ typedef struct _RTL_BALANCED_NODE32
|
||||
};
|
||||
union
|
||||
{
|
||||
WOW64_POINTER(ULONG_PTR) Red : 1;
|
||||
WOW64_POINTER(ULONG_PTR) Balance : 2;
|
||||
WOW64_POINTER(UCHAR) Red : 1;
|
||||
WOW64_POINTER(UCHAR) Balance : 2;
|
||||
WOW64_POINTER(ULONG_PTR) ParentValue;
|
||||
};
|
||||
} RTL_BALANCED_NODE32, *PRTL_BALANCED_NODE32;
|
||||
@@ -216,6 +218,9 @@ typedef struct _RTL_USER_PROCESS_PARAMETERS32
|
||||
|
||||
ULONG EnvironmentSize;
|
||||
ULONG EnvironmentVersion;
|
||||
UNICODE_STRING32 PackageMoniker;
|
||||
WOW64_POINTER(PVOID) PackageDependencyData;
|
||||
ULONG ProcessGroupId;
|
||||
} RTL_USER_PROCESS_PARAMETERS32, *PRTL_USER_PROCESS_PARAMETERS32;
|
||||
|
||||
typedef struct _PEB32
|
||||
@@ -345,9 +350,11 @@ typedef struct _PEB32
|
||||
{
|
||||
ULONG HeapTracingEnabled : 1;
|
||||
ULONG CritSecTracingEnabled : 1;
|
||||
ULONG SpareTracingBits : 30;
|
||||
ULONG LibLoaderTracingEnabled : 1;
|
||||
ULONG SpareTracingBits : 29;
|
||||
};
|
||||
};
|
||||
ULONGLONG CsrServerReadOnlySharedMemoryBase;
|
||||
} PEB32, *PPEB32;
|
||||
|
||||
#define GDI_BATCH_BUFFER_SIZE 310
|
||||
|
||||
@@ -2655,7 +2655,7 @@ ZwQueryVolumeInformationFile(
|
||||
__out PIO_STATUS_BLOCK IoStatusBlock,
|
||||
__out_bcount(Length) PVOID FsInformation,
|
||||
__in ULONG Length,
|
||||
__in FS_INFORMATION_CLASS FsInformationClass
|
||||
__in FSINFOCLASS FsInformationClass
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
@@ -3478,7 +3478,7 @@ ZwSetVolumeInformationFile(
|
||||
__out PIO_STATUS_BLOCK IoStatusBlock,
|
||||
__in_bcount(Length) PVOID FsInformation,
|
||||
__in ULONG Length,
|
||||
__in FS_INFORMATION_CLASS FsInformationClass
|
||||
__in FSINFOCLASS FsInformationClass
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
|
||||
Reference in New Issue
Block a user