From f23533aa3f283bf510d0dc1ea30e62afdf70cb8a Mon Sep 17 00:00:00 2001
From: evilpie <evilpie@21ef857c-d57f-4fe0-8362-d861dc6d29cd>
Date: Fri, 14 May 2010 12:18:28 +0000
Subject: [PATCH] added additional reverse-engineered service tag defs [wj32]

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@3140 21ef857c-d57f-4fe0-8362-d861dc6d29cd
---
 2.x/trunk/phlib/include/rev.h | 42 ++++++++++++++++++++++++++++++++---
 2.x/trunk/phlib/svcsup.c      |  2 +-
 2 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/2.x/trunk/phlib/include/rev.h b/2.x/trunk/phlib/include/rev.h
index a1c705f2d..54fe6525d 100644
--- a/2.x/trunk/phlib/include/rev.h
+++ b/2.x/trunk/phlib/include/rev.h
@@ -2,6 +2,7 @@
  * Process Hacker - 
  *   reverse engineered definitions
  * 
+ * Copyright (C) 2010 evilpie
  * Copyright (C) 2010 wj32
  * 
  * This file is part of Process Hacker.
@@ -34,18 +35,53 @@ typedef enum _SC_SERVICE_TAG_QUERY_TYPE
     ServiceNameTagMappingInformation
 } SC_SERVICE_TAG_QUERY_TYPE, *PSC_SERVICE_TAG_QUERY_TYPE;
 
-typedef struct _SC_SERVICE_TAG_QUERY
+// ServiceNameFromTagInformation
+
+typedef struct _SC_SERVICE_NAME_FROM_TAG_QUERY
 {
     ULONG ProcessId;
     ULONG ServiceTag;
     ULONG Unknown;
     PVOID Buffer;
-} SC_SERVICE_TAG_QUERY, *PSC_SERVICE_TAG_QUERY;
+} SC_SERVICE_NAME_FROM_TAG_QUERY, *PSC_SERVICE_NAME_FROM_TAG_QUERY;
+
+// ServiceNamesReferencingModuleInformation
+
+typedef struct _SC_SERVICE_NAMES_REFERENCING_MODULE_QUERY
+{
+    ULONG ProcessId;
+    PWSTR Module;
+    ULONG Count;
+    PWSTR *ServiceNames;
+} SC_SERVICE_NAMES_REFERENCING_MODULE_QUERY, *PSC_SERVICE_NAMES_REFERENCING_MODULE_QUERY;
+
+// ServiceNameTagMappingInformation
+
+typedef struct _SC_SERVICE_TAG_INFO
+{
+    ULONG ServiceTag;
+    PWSTR ServiceName;
+    ULONG Unknown;
+} SC_SERVICE_TAG_INFO, *PSC_SERVICE_TAG_INFO;
+
+typedef struct _SC_SERVICE_TAG_LIST
+{
+    ULONG Count;
+    PVOID Unknown1;
+    PVOID Unknown2;
+    SC_SERVICE_TAG_INFO Services[1];
+} SC_SERVICE_TAG_LIST, *PSC_SERVICE_TAG_LIST;
+
+typedef struct _SC_SERVICE_NAME_TAG_MAPPING_QUERY
+{
+    ULONG Unknown;
+    PVOID Buffer;
+} SC_SERVICE_NAME_TAG_MAPPING_QUERY, *PSC_SERVICE_NAME_TAG_MAPPING_QUERY;
 
 typedef ULONG (NTAPI *_I_QueryTagInformation)(
     __in PVOID Unknown,
     __in SC_SERVICE_TAG_QUERY_TYPE QueryType,
-    __inout PSC_SERVICE_TAG_QUERY Query
+    __inout PVOID Query
     );
 
 // Winsta
diff --git a/2.x/trunk/phlib/svcsup.c b/2.x/trunk/phlib/svcsup.c
index 55d839fbf..e4d71bc2a 100644
--- a/2.x/trunk/phlib/svcsup.c
+++ b/2.x/trunk/phlib/svcsup.c
@@ -332,7 +332,7 @@ PPH_STRING PhGetServiceNameFromTag(
 {
     PPH_STRING serviceName = NULL;
     _I_QueryTagInformation I_QueryTagInformation;
-    SC_SERVICE_TAG_QUERY query;
+    SC_SERVICE_NAME_FROM_TAG_QUERY query;
 
     I_QueryTagInformation = PhGetProcAddress(L"advapi32.dll", "I_QueryTagInformation");