/*
 * Process Hacker Driver - 
 *   run-time library
 * 
 * Copyright (C) 2009 wj32
 * 
 * This file is part of Process Hacker.
 * 
 * Process Hacker is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * Process Hacker is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Process Hacker.  If not, see <http://www.gnu.org/licenses/>.
 */

#ifndef _RTL_H
#define _RTL_H

#include "types.h"

/* Stack Tracing */

/* Sensible limit that may or may not correspond to the actual Windows value. */
#define MAX_STACK_DEPTH 32

#define RTL_WALK_USER_MODE_STACK 0x00000001
#define RTL_WALK_VALID_FLAGS 0x00000001

/* RtlWalkFrameChain
 * 
 * Walks an EBP chain and fills out an array of addresses.
 * 
 * Return value: the number of frames found.
 */
NTSYSAPI ULONG NTAPI RtlWalkFrameChain(
    __out PVOID *Callers,
    __in ULONG Count,
    __in ULONG Flags
    );

/* Trace Database */

#define RTL_TRACE_IN_USER_MODE 0x00000001
#define RTL_TRACE_IN_KERNEL_MODE 0x00000002
#define RTL_TRACE_USE_NONPAGED_POOL 0x00000004
#define RTL_TRACE_USE_PAGED_POOL 0x00000008

typedef struct _RTL_TRACE_BLOCK
{
    ULONG Magic;
    ULONG Count;
    ULONG Size;
    
    SIZE_T UserCount;
    SIZE_T UserSize;
    PVOID UserContext;
    
    struct _RTL_TRACE_BLOCK *Next;
    PVOID *Trace;
} RTL_TRACE_BLOCK, *PRTL_TRACE_BLOCK;

typedef struct _RTL_TRACE_DATABASE *PRTL_TRACE_DATABASE;

/* Enumeration context. */
typedef struct _RTL_TRACE_ENUMERATE
{
    PRTL_TRACE_DATABASE Database;
    ULONG Index;
    PRTL_TRACE_BLOCK Block;
} RTL_TRACE_ENUMERATE, *PRTL_TRACE_ENUMERATE;

typedef ULONG (*RTL_TRACE_HASH_FUNCTION)(
    ULONG Count,
    PVOID *Trace
    );

PRTL_TRACE_DATABASE RtlTraceDatabaseCreate(
    __in ULONG Buckets,
    __in_opt SIZE_T MaximumSize,
    __in ULONG Flags, /* optional in user-mode */
    __in ULONG Tag, /* optional in user-mode */
    __in_opt RTL_TRACE_HASH_FUNCTION HashFunction
    );

BOOLEAN RtlTraceDatabaseDestroy(
    __in PRTL_TRACE_DATABASE Database
    );

BOOLEAN RtlTraceDatabaseValidate(
    __in PRTL_TRACE_DATABASE Database
    );

BOOLEAN RtlTraceDatabaseAdd(
    __in PRTL_TRACE_DATABASE Database,
    __in ULONG Count,
    __in PVOID *Trace,
    __out_opt PRTL_TRACE_BLOCK *TraceBlock
    );

BOOLEAN RtlTraceDatabaseEnumerate(
    __in PRTL_TRACE_DATABASE Database,
    __inout PRTL_TRACE_ENUMERATE Enumerate,
    __out PRTL_TRACE_BLOCK *TraceBlock
    );

BOOLEAN RtlTraceDatabaseFind(
    __in PRTL_TRACE_DATABASE Database,
    __in ULONG Count,
    __in PVOID *Trace,
    __out_opt PRTL_TRACE_BLOCK *TraceBlock
    );

/* Note: locking/unlocking is only needed when trace blocks are modified. 
 * It is not needed for adding/enumerating/finding. */
VOID RtlTraceDatabaseLock(
    __in PRTL_TRACE_DATABASE Database
    );

VOID RtlTraceDatabaseUnlock(
    __in PRTL_TRACE_DATABASE Database
    );

#endif