/* * Process Hacker - * native API enumerations * * Copyright (C) 2009 Flavio Erlich * Copyright (C) 2008-2009 wj32 * * This file is part of Process Hacker. * * Process Hacker is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * Process Hacker is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with Process Hacker. If not, see . */ using System; using System.Collections.Generic; using System.Text; namespace ProcessHacker.Native.Api { [Flags] public enum ContextFlags : int { I386 = 0x00010000, I486 = 0x00010000, Control = I386 | 0x00000001, Integer = I386 | 0x00000002, Segments = I386 | 0x00000004, FloatingPoint = I386 | 0x00000008, DebugRegisters = I386 | 0x00000010, ExtendedRegisters = I386 | 0x00000020, Full = Control | Integer | Segments, All = Control | Integer | Segments | FloatingPoint | DebugRegisters | ExtendedRegisters } [Flags] public enum DebugObjectFlags : uint { KillOnClose = 0x1 } [Flags] public enum DebugObjectInformationClass : int { DebugObjectFlags, MaxDebugObjectInfoClass } [Flags] public enum DbgState : int { DbgIdle, DbgReplyPending, DbgCreateThreadStateChange, DbgCreateProcessStateChange, DbgExitThreadStateChange, DbgExitProcessStateChange, DbgExceptionStateChange, DbgBreakpointStateChange, DbgSingleStepStateChange, DbgLoadDllStateChange, DbgUnloadDllStateChange } [Flags] public enum DuplicateOptions : int { CloseSource = 0x1, SameAccess = 0x2, SameAttributes = 0x4 } public enum EventInformationClass : int { EventBasicInformation } public enum EventType : int { NotificationEvent, SynchronizationEvent } [Flags] public enum HandleFlags : byte { ProtectFromClose = 0x1, Inherit = 0x2 } [Flags] public enum HashStringAlgorithm : int { Default = 0, X65599 = 1, Invalid = -1 } [Flags] public enum JobObjectBasicUiRestrictions : uint { Handles = 0x1, ReadClipboard = 0x2, WriteClipboard = 0x4, SystemParameters = 0x8, DisplaySettings = 0x10, GlobalAtoms = 0x20, Desktop = 0x40, ExitWindows = 0x80 } public enum JobObjectInformationClass : int { JobObjectBasicAccountingInformation = 1, JobObjectBasicLimitInformation, JobObjectBasicProcessIdList, JobObjectBasicUIRestrictions, JobObjectSecurityLimitInformation, JobObjectEndOfJobTimeInformation, JobObjectAssociateCompletionPortInformation, JobObjectBasicAndIoAccountingInformation, JobObjectExtendedLimitInformation, JobObjectJobSetInformation } [Flags] public enum JobObjectLimitFlags : uint { WorkingSet = 0x1, ProcessTime = 0x2, JobTime = 0x4, ActiveProcess = 0x8, Affinity = 0x10, PriorityClass = 0x20, PreserveJobTime = 0x40, SchedulingClass = 0x80, ProcessMemory = 0x100, JobMemory = 0x200, DieOnUnhandledException = 0x400, BreakawayOk = 0x800, SilentBreakawayOk = 0x1000, KillOnJobClose = 0x2000, } public enum KProfileSource : int { ProfileTime, ProfileAlignmentFixup, ProfileTotalIssues, ProfilePipelineDry, ProfileLoadInstructions, ProfilePipelineFrozen, ProfileBranchInstructions, ProfileTotalNonissues, ProfileDcacheMisses, ProfileIcacheMisses, ProfileCacheMisses, ProfileBranchMispredictions, ProfileStoreInstructions, ProfileFpInstructions, ProfileIntegerInstructions, Profile2Issue, Profile3Issue, Profile4Issue, ProfileSpecialInstructions, ProfileTotalCycles, ProfileIcacheIssues, ProfileDcacheAccesses, ProfileMemoryBarrierCycles, ProfileLoadLinkedIssues, ProfileMaximum } public enum KWaitReason : int { Executive = 0, FreePage = 1, PageIn = 2, PoolAllocation = 3, DelayExecution = 4, Suspended = 5, UserRequest = 6, WrExecutive = 7, WrFreePage = 8, WrPageIn = 9, WrPoolAllocation = 10, WrDelayExecution = 11, WrSuspended = 12, WrUserRequest = 13, WrEventPair = 14, WrQueue = 15, WrLpcReceive = 16, WrLpcReply = 17, WrVirtualMemory = 18, WrPageOut = 19, WrRendezvous = 20, Spare2 = 21, Spare3 = 22, Spare4 = 23, Spare5 = 24, WrCalloutStack = 25, WrKernel = 26, WrResource = 27, WrPushLock = 28, WrMutex = 29, WrQuantumEnd = 30, WrDispatchInt = 31, WrPreempted = 32, WrYieldExecution = 33, WrFastMutex = 34, WrGuardedMutex = 35, WrRundown = 36, MaximumWaitReason = 37 } [Flags] public enum MemExecuteOptions : int { ExecuteDisable = 0x1, ExecuteEnable = 0x2, DisableThunkEmulation = 0x4, Permanent = 0x8 } [Flags] public enum MemoryFlags : uint { Commit = 0x1000, Reserve = 0x2000, Decommit = 0x4000, Release = 0x8000, Free = 0x10000, Private = 0x20000, Mapped = 0x40000, Reset = 0x80000, TopDown = 0x100000, WriteWatch = 0x200000, Physical = 0x400000, LargePages = 0x20000000, DosLimit = 0x40000000, FourMbPages = 0x80000000 } public enum MemoryInformationClass : int { MemoryBasicInformation, MemoryWorkingSetInformation, MemoryMappedFilenameInformation, MemoryRegionInformation, MemoryWorkingSetExInformation } [Flags] public enum MemoryProtection : uint { AccessDenied = 0x0, Execute = 0x10, ExecuteRead = 0x20, ExecuteReadWrite = 0x40, ExecuteWriteCopy = 0x80, Guard = 0x100, NoCache = 0x200, WriteCombine = 0x400, NoAccess = 0x01, ReadOnly = 0x02, ReadWrite = 0x04, WriteCopy = 0x08 } public enum MutantInformationClass : int { MutantBasicInformation } public enum ObjectFlags : uint { Inherit = 0x2, Permanent = 0x10, Exclusive = 0x20, CaseInsensitive = 0x40, OpenIf = 0x80, OpenLink = 0x100, KernelHandle = 0x200, ForceAccessCheck = 0x400, ValidAttributes = 0x7f2 } public enum ObjectInformationClass : int { ObjectBasicInformation = 0, ObjectNameInformation = 1, ObjectTypeInformation = 2, ObjectTypesInformation = 3, ObjectHandleFlagInformation = 4, ObjectSessionInformation = 5 } public enum ProcessInformationClass : int { ProcessBasicInformation, // 0 ProcessQuotaLimits, ProcessIoCounters, ProcessVmCounters, ProcessTimes, ProcessBasePriority, ProcessRaisePriority, ProcessDebugPort, ProcessExceptionPort, ProcessAccessToken, ProcessLdtInformation, // 10 ProcessLdtSize, ProcessDefaultHardErrorMode, ProcessIoPortHandlers, ProcessPooledUsageAndLimits, ProcessWorkingSetWatch, ProcessUserModeIOPL, ProcessEnableAlignmentFaultFixup, ProcessPriorityClass, ProcessWx86Information, ProcessHandleCount, // 20 ProcessAffinityMask, ProcessPriorityBoost, ProcessDeviceMap, ProcessSessionInformation, ProcessForegroundInformation, ProcessWow64Information, ProcessImageFileName, ProcessLUIDDeviceMapsEnabled, ProcessBreakOnTermination, ProcessDebugObjectHandle, // 30 ProcessDebugFlags, ProcessHandleTracing, ProcessIoPriority, ProcessExecuteFlags, ProcessResourceManagement, ProcessCookie, ProcessImageInformation, ProcessCycleTime, ProcessPagePriority, ProcessInstrumentationCallback, // 40 ProcessThreadStackAllocation, ProcessWorkingSetWatchEx, ProcessImageFileNameWin32, ProcessImageFileMapping, ProcessAffinityUpdateMode, ProcessMemoryAllocationMode, MaxProcessInfoClass } [Flags] public enum RtlDuplicateUnicodeStringFlags : int { NullTerminate = 0x1, AllocateNullString = 0x2 } [Flags] public enum RtlUserProcessFlags : uint { ParamsNormalized = 0x00000001, ProfileUser = 0x00000002, ProfileKernel = 0x00000004, ProfileServer = 0x00000008, Reserve1Mb = 0x00000020, Reserve16Mb = 0x00000040, CaseSensitive = 0x00000080, DisableHeapDecommit = 0x00000100, DllRedirectionLocal = 0x00001000, AppManifestPresent = 0x00002000, ImageKeyMissing = 0x00004000, OptInProcess = 0x00020000 } [Flags] public enum SectionAttributes : uint { Based = 0x200000, NoChange = 0x400000, File = 0x800000, Image = 0x1000000, Reserve = 0x4000000, Commit = 0x8000000, NoCache = 0x10000000, Global = 0x20000000, LargePages = 0x80000000 } [Flags] public enum SectionInformationClass : int { SectionBasicInformation, SectionImageInformation } public enum SectionInherit : int { ViewShare = 1, ViewUnmap = 2 } public enum SecurityImpersonationLevel : int { SecurityAnonymous, SecurityIdentification, SecurityImpersonation, SecurityDelegation } [Flags] public enum SecurityInformation : uint { Owner = 0x00000001, Group = 0x00000002, Dacl = 0x00000004, Sacl = 0x00000008, Label = 0x00000010, ProtectedDacl = 0x80000000, ProtectedSacl = 0x40000000, UnprotectedDacl = 0x20000000, UnprotectedSacl = 0x10000000 } public enum SemaphoreInformationClass : int { SemaphoreBasicInformation } public enum SidAttributes : uint { Mandatory = 0x00000001, EnabledByDefault = 0x00000002, Enabled = 0x00000004, Owner = 0x00000008, UseForDenyOnly = 0x00000010, Integrity = 0x00000020, IntegrityEnabled = 0x00000040, LogonId = 0xc0000000, Resource = 0x20000000 } public enum SidNameUse : int { User = 1, Group, Domain, Alias, WellKnownGroup, DeletedAccount, Invalid, Unknown, Computer, Label } [Flags] public enum SiRequested : uint { OwnerSecurityInformation = 0x1, GroupSecurityInformation = 0x2, DaclSecurityInformation = 0x4, SaclSecurityInformation = 0x8, LabelSecurityInformation = 0x10 } public enum SystemInformationClass : int { SystemBasicInformation, SystemProcessorInformation, SystemPerformanceInformation, SystemTimeOfDayInformation, SystemPathInformation, SystemProcessInformation, SystemCallCountInformation, SystemDeviceInformation, SystemProcessorPerformanceInformation, SystemFlagsInformation, SystemCallTimeInformation, // 10 SystemModuleInformation, SystemLocksInformation, SystemStackTraceInformation, SystemPagedPoolInformation, SystemNonPagedPoolInformation, SystemHandleInformation, SystemObjectInformation, SystemPageFileInformation, SystemVdmInstemulInformation, SystemVdmBopInformation, // 20 SystemFileCacheInformation, SystemPoolTagInformation, SystemInterruptInformation, SystemDpcBehaviorInformation, SystemFullMemoryInformation, SystemLoadGdiDriverInformation, SystemUnloadGdiDriverInformation, SystemTimeAdjustmentInformation, SystemSummaryMemoryInformation, SystemMirrorMemoryInformation, // 30 SystemPerformanceTraceInformation, SystemCrashDumpInformation, SystemExceptionInformation, SystemCrashDumpStateInformation, SystemKernelDebuggerInformation, SystemContextSwitchInformation, SystemRegistryQuotaInformation, SystemExtendServiceTableInformation, // used to be SystemLoadAndCallImage SystemPrioritySeparation, SystemVerifierAddDriverInformation, // 40 SystemVerifierRemoveDriverInformation, SystemProcessorIdleInformation, SystemLegacyDriverInformation, SystemCurrentTimeZoneInformation, SystemLookasideInformation, SystemTimeSlipNotification, SystemSessionCreate, SystemSessionDetach, SystemSessionInformation, SystemRangeStartInformation, // 50 SystemVerifierInformation, SystemVerifierThunkExtend, SystemSessionProcessInformation, SystemLoadGdiDriverInSystemSpace, SystemNumaProcessorMap, SystemPrefetcherInformation, SystemExtendedProcessInformation, SystemRecommendedSharedDataAlignment, SystemComPlusPackage, SystemNumaAvailableMemory, // 60 SystemProcessorPowerInformation, SystemEmulationBasicInformation, SystemEmulationProcessorInformation, SystemExtendedHandleInformation, SystemLostDelayedWriteInformation, SystemBigPoolInformation, SystemSessionPoolTagInformation, SystemSessionMappedViewInformation, SystemHotpatchInformation, SystemObjectSecurityMode, // 70 SystemWatchdogTimerHandler, // doesn't seem to be implemented SystemWatchdogTimerInformation, SystemLogicalProcessorInformation, SystemWow64SharedInformation, SystemRegisterFirmwareTableInformationHandler, SystemFirmwareTableInformation, SystemModuleInformationEx, SystemVerifierTriageInformation, SystemSuperfetchInformation, SystemMemoryListInformation, // 80 SystemFileCacheInformationEx, SystemNotImplemented19, SystemProcessorDebugInformation, SystemVerifierInformation2, SystemNotImplemented20, SystemRefTraceInformation, SystemSpecialPoolTag, // MmSpecialPoolTag, then MmSpecialPoolCatchOverruns != 0 SystemProcessImageName, SystemNotImplemented21, SystemBootEnvironmentInformation, // 90 SystemEnlightenmentInformation, SystemVerifierInformationEx, SystemNotImplemented22, SystemNotImplemented23, SystemCovInformation, SystemNotImplemented24, SystemNotImplemented25, SystemPartitionInformation, SystemSystemDiskInformation, // this and SystemPartitionInformation both call IoQuerySystemDeviceName SystemPerformanceDistributionInformation, // 100 SystemNumaProximityNodeInformation, SystemTimeZoneInformation2, SystemCodeIntegrityInformation, SystemNotImplemented26, SystemUnknownInformation, // No symbols for this case, very strange... SystemVaInformation // 106, calls MmQuerySystemVaInformation } public enum ThreadInformationClass : uint { ThreadBasicInformation, ThreadTimes, ThreadPriority, ThreadBasePriority, ThreadAffinityMask, ThreadImpersonationToken, ThreadDescriptorTableEntry, ThreadEnableAlignmentFaultFixup, ThreadEventPair, ThreadQuerySetWin32StartAddress, ThreadZeroTlsCell, ThreadPerformanceCount, ThreadAmILastThread, ThreadIdealProcessor, ThreadPriorityBoost, ThreadSetTlsArrayAddress, ThreadIsIoPending, ThreadHideFromDebugger, ThreadBreakOnTermination, ThreadSwitchLegacyState, ThreadIsTerminated, ThreadLastSystemCall, ThreadIoPriority, ThreadCycleTime, ThreadPagePriority, ThreadActualBasePriority, ThreadTebInformation, ThreadCSwitchMon, MaxThreadInfoClass } public enum TimerInformationClass : int { TimerBasicInformation } public enum TimerType : int { NotificationTimer, SynchronizationTimer } public enum TokenElevationType : int { Default = 1, Full, Limited } public enum TokenInformationClass { TokenUser = 1, TokenGroups, TokenPrivileges, TokenOwner, TokenPrimaryGroup, TokenDefaultDacl, TokenSource, TokenType, TokenImpersonationLevel, TokenStatistics, TokenRestrictedSids, TokenSessionId, TokenGroupsAndPrivileges, TokenSessionReference, TokenSandBoxInert, TokenAuditPolicy, TokenOrigin, TokenElevationType, TokenLinkedToken, TokenElevation, TokenHasRestrictions, TokenAccessInformation, TokenVirtualizationAllowed, TokenVirtualizationEnabled, TokenIntegrityLevel, TokenUIAccess, TokenMandatoryPolicy, TokenLogonSid, MaxTokenInfoClass // MaxTokenInfoClass should always be the last enum } public enum TokenType : int { Primary = 1, Impersonation } public enum WaitType : int { WaitAll, WaitAny } }