mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
wj32
d055238154
* fixed PEB struct definition * added struct reader preprocessor git-svn-id: svn://svn.code.sf.net/p/processhacker/code@2363 21ef857c-d57f-4fe0-8362-d861dc6d29cd
244 lines
6.7 KiB
Plaintext
244 lines
6.7 KiB
Plaintext
/*
|
|
* Process Hacker's Structs file - contains
|
|
* common structures used in Windows
|
|
*
|
|
* wj32.
|
|
*/
|
|
|
|
include "base.txt";
|
|
|
|
typedef int NTSTATUS; /* no enum support yet */
|
|
|
|
/* A counted UTF-16 string. Same as LSA_UNICODE_STRING. */
|
|
struct UNICODE_STRING
|
|
{
|
|
ushort Length;
|
|
ushort MaximumLength;
|
|
wstr* Buffer[Length / 2]; /* Length is in bytes, and each wchar is 2 bytes */
|
|
}
|
|
|
|
/* A doubly-linked list. */
|
|
struct LIST_ENTRY
|
|
{
|
|
LIST_ENTRY* Flink;
|
|
LIST_ENTRY* Blink;
|
|
}
|
|
|
|
struct CLIENT_ID
|
|
{
|
|
pvoid UniqueProcess;
|
|
pvoid UniqueThread;
|
|
}
|
|
|
|
struct RTL_DRIVE_LETTER_CURDIR
|
|
{
|
|
ushort Flags;
|
|
ushort Length;
|
|
ulong TimeStamp;
|
|
UNICODE_STRING DosPath;
|
|
}
|
|
|
|
/* Lots of useful stuff like current directory and command line */
|
|
struct RTL_USER_PROCESS_PARAMETERS
|
|
{
|
|
ulong MaximumLength;
|
|
ulong Length;
|
|
ulong Flags;
|
|
ulong DebugFlags;
|
|
pvoid ConsoleHandle;
|
|
ulong ConsoleFlags;
|
|
handle StdInputHandle;
|
|
handle StdOutputHandle;
|
|
handle StdErrorHandle;
|
|
UNICODE_STRING CurrentDirectoryPath;
|
|
handle CurrentDirectoryHandle;
|
|
UNICODE_STRING DllPath;
|
|
UNICODE_STRING ImagePathName;
|
|
UNICODE_STRING CommandLine;
|
|
pvoid Environment;
|
|
ulong StartingPositionLeft;
|
|
ulong StartingPositionTop;
|
|
ulong Width;
|
|
ulong Height;
|
|
ulong CharWidth;
|
|
ulong CharHeight;
|
|
ulong ConsoleTextAttributes;
|
|
ulong WindowFlags;
|
|
ulong ShowWindowFlags;
|
|
UNICODE_STRING WindowTitle;
|
|
UNICODE_STRING DesktopName;
|
|
UNICODE_STRING ShellInfo;
|
|
UNICODE_STRING RuntimeData;
|
|
RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];
|
|
}
|
|
|
|
/* Module information for the process */
|
|
struct PEB_LDR_DATA
|
|
{
|
|
ulong Length;
|
|
boolean Initialized;
|
|
pvoid SsHandle;
|
|
LIST_ENTRY InLoadOrderModuleList;
|
|
LIST_ENTRY InMemoryOrderModuleList;
|
|
LIST_ENTRY InInitializationOrderModuleList;
|
|
}
|
|
|
|
/* Contains the address of a fast-locking routine for the PEB */
|
|
struct PEBLOCKROUTINE
|
|
{
|
|
pvoid PebLock;
|
|
}
|
|
|
|
/* Process Environment Block */
|
|
struct PEB
|
|
{
|
|
/* +0x00 */ boolean InheritedAddressSpace;
|
|
/* +0x01 */ boolean ReadImageFileExecOptions;
|
|
/* +0x02 */ boolean BeingDebugged;
|
|
/* +0x03 */ boolean Spare;
|
|
/* +0x04 */ handle Mutant;
|
|
/* +0x08 */ pvoid ImageBaseAddress;
|
|
/* PEB_LDR_DATA* LoaderData; */
|
|
/* +0x0c */ pvoid LoaderData;
|
|
/* +0x10 */ RTL_USER_PROCESS_PARAMETERS* ProcessParameters;
|
|
/* +0x14 */ pvoid SubSystemData;
|
|
/* +0x18 */ pvoid ProcessHeap;
|
|
/* +0x1c */ pvoid FastPebLock;
|
|
/* +0x20 */ PEBLOCKROUTINE* FastPebLockRoutine;
|
|
/* +0x24 */ PEBLOCKROUTINE* FastPebUnlockRoutine;
|
|
/* +0x28 */ ulong EnvironmentUpdateCount;
|
|
/* +0x2c */ ppvoid KernelCallbackTable;
|
|
/* +0x30 */ pvoid EventLogSection;
|
|
/* +0x34 */ pvoid EventLog;
|
|
/* +0x38 */ pvoid FreeList; /* should be PEB_FREE_BLOCK* */
|
|
/* +0x3c */ ulong TlsExpansionCounter;
|
|
/* +0x40 */ pvoid TlsBitmap;
|
|
/* +0x44 */ ulong TlsBitmapBits[0x2];
|
|
/* +0x4c */ pvoid ReadOnlySharedMemoryBase;
|
|
/* +0x50 */ pvoid ReadOnlySharedMemoryHeap;
|
|
/* +0x54 */ ppvoid ReadOnlyStaticServerData;
|
|
/* +0x58 */ pvoid AnsiCodePageData;
|
|
/* +0x5c */ pvoid OemCodePageData;
|
|
/* +0x60 */ pvoid UnicodeCaseTableData;
|
|
/* +0x64 */ ulong NumberOfProcessors;
|
|
/* +0x68 */ ulong NtGlobalFlag;
|
|
/* +0x6c */ byte Spare2[0x4];
|
|
/* +0x70 */ large_integer CriticalSectionTimeout;
|
|
/* +0x78 */ ulong HeapSegmentReserve;
|
|
/* +0x7c */ ulong HeapSegmentCommit;
|
|
/* +0x80 */ ulong HeapDeCommitTotalFreeThreshold;
|
|
/* +0x84 */ ulong HeapDeCommitFreeBlockThreshold;
|
|
/* +0x88 */ ulong NumberOfHeaps;
|
|
/* +0x8c */ ulong MaximumNumberOfHeaps;
|
|
/* +0x90 */ ppvoid ProcessHeaps;
|
|
/* +0x94 */ pvoid GdiSharedHandleTable;
|
|
/* +0x98 */ pvoid ProcessStarterHelper;
|
|
/* +0x9c */ pvoid GdiDCAttributeList;
|
|
/* +0xa0 */ pvoid LoaderLock;
|
|
/* +0xa4 */ ulong OSMajorVersion;
|
|
/* +0xa8 */ ulong OSMinorVersion;
|
|
/* +0xac */ ushort OSBuildNumber;
|
|
/* +0xae */ ushort OSCSDVersion;
|
|
/* +0xb0 */ ulong OSPlatformId;
|
|
/* +0xb4 */ ulong ImageSubSystem;
|
|
ulong ImageSubSystemMajorVersion;
|
|
ulong ImageSubSystemMinorVersion;
|
|
ulong_ptr ImageProcessAffinityMask;
|
|
#if _X86_
|
|
ulong GdiHandleBuffer[0x22];
|
|
#else
|
|
ulong GdiHandleBuffer[0x3c];
|
|
#endif
|
|
pvoid PostProcessInitRoutine;
|
|
pvoid TlsExpansionBitmap;
|
|
byte TlsExpansionBitmapBits[0x80];
|
|
ulong SessionId;
|
|
large_integer AppCompatFlags;
|
|
large_integer AppCompatFlagsUser;
|
|
pvoid pShimData;
|
|
pvoid AppCompatInfo;
|
|
UNICODE_STRING CSDVersion;
|
|
pvoid ActivationContextData;
|
|
pvoid ProcessAssemblyStorageMap;
|
|
pvoid SystemDefaultActivationContextData;
|
|
pvoid SystemAssemblyStorageMap;
|
|
size_t MinimumStackCommit;
|
|
}
|
|
|
|
struct NT_TIB
|
|
{
|
|
pvoid ExceptionList; /* EXCEPTION_REGISTRATION_RECORD* */
|
|
pvoid StackBase;
|
|
pvoid StackLimit;
|
|
pvoid SubSystemTib;
|
|
pvoid FiberData_Version_Union;
|
|
pvoid ArbitraryUserPointer;
|
|
pvoid Self; /* NT_TIB* */
|
|
}
|
|
|
|
/* Thread Environment Block */
|
|
struct TEB
|
|
{
|
|
NT_TIB Tib;
|
|
pvoid EnvironmentPointer;
|
|
CLIENT_ID Cid;
|
|
pvoid ActiveRpcInfo;
|
|
pvoid ThreadLocalStoragePointer;
|
|
PEB* Peb;
|
|
ulong LastErrorValue;
|
|
ulong CountOfOwnedCriticalSections;
|
|
pvoid CsrClientThread;
|
|
pvoid Win32ThreadInfo;
|
|
ulong Win32ClientInfo[0x1f];
|
|
pvoid WOW32Reserved;
|
|
ulong CurrentLocale;
|
|
ulong FpSoftwareStatusRegister;
|
|
pvoid SystemReserved1[0x36];
|
|
pvoid Spare1;
|
|
ulong ExceptionCode;
|
|
#ifdef _X86_
|
|
ulong SpareBytes1[0x28];
|
|
#else
|
|
ulong SpareBytes1[0x1c];
|
|
#endif
|
|
pvoid SystemReserved2[0xa];
|
|
ulong GdiRgn;
|
|
ulong GdiPen;
|
|
ulong GdiBrush;
|
|
CLIENT_ID RealClientId;
|
|
handle GdiCachedProcessHandle;
|
|
ulong GdiClientPID;
|
|
ulong GdiClientTID;
|
|
pvoid GdiThreadLocaleInfo;
|
|
ulong_ptr UserReserved[5];
|
|
pvoid GlDispatchTable[0x118];
|
|
ulong_ptr GlReserved1[0x1a];
|
|
pvoid GlReserved2;
|
|
pvoid GlSectionInfo;
|
|
pvoid GlSection;
|
|
pvoid GlTable;
|
|
pvoid GlCurrentRC;
|
|
pvoid GlContext;
|
|
NTSTATUS LastStatusValue;
|
|
UNICODE_STRING StaticUnicodeString;
|
|
wchar StaticUnicodeBuffer[0x105];
|
|
pvoid DeallocationStack;
|
|
pvoid TlsSlots[0x40];
|
|
LIST_ENTRY TlsLinks;
|
|
pvoid Vdm;
|
|
pvoid ReservedForNtRpc;
|
|
pvoid DbgSsReserved[0x2];
|
|
ulong HardErrorDisabled;
|
|
pvoid Instrumentation[0x10];
|
|
pvoid WinSockData;
|
|
ulong GdiBatchCount;
|
|
ulong Spare2;
|
|
ulong Spare3;
|
|
ulong Spare4;
|
|
pvoid ReservedForOle;
|
|
ulong WaitingOnLoaderLock;
|
|
pvoid StackCommit;
|
|
pvoid StackCommitMax;
|
|
pvoid StackReserved;
|
|
}
|