mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
wj32
29a8edfe4f
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@2311 21ef857c-d57f-4fe0-8362-d861dc6d29cd
364 lines
11 KiB
C
364 lines
11 KiB
C
#ifndef NTEXAPI_H
|
|
#define NTEXAPI_H
|
|
|
|
#include <ntbasic.h>
|
|
|
|
#ifndef EVENT_QUERY_STATE
|
|
#define EVENT_QUERY_STATE 0x0001
|
|
#endif
|
|
#ifndef EVENT_MODIFY_STATE
|
|
#define EVENT_MODIFY_STATE 0x0002
|
|
#endif
|
|
#ifndef EVENT_ALL_ACCESS
|
|
#define EVENT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3)
|
|
#endif
|
|
|
|
typedef enum _EVENT_INFORMATION_CLASS
|
|
{
|
|
EventBasicInformation
|
|
} EVENT_INFORMATION_CLASS;
|
|
|
|
typedef struct _EVENT_BASIC_INFORMATION
|
|
{
|
|
EVENT_TYPE EventType;
|
|
LONG EventState;
|
|
} EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;
|
|
|
|
typedef enum _SYSTEM_INFORMATION_CLASS
|
|
{
|
|
SystemBasicInformation,
|
|
SystemProcessorInformation,
|
|
SystemPerformanceInformation,
|
|
SystemTimeOfDayInformation,
|
|
SystemPathInformation,
|
|
SystemProcessInformation,
|
|
SystemCallCountInformation,
|
|
SystemDeviceInformation,
|
|
SystemProcessorPerformanceInformation,
|
|
SystemFlagsInformation,
|
|
SystemCallTimeInformation, // 10
|
|
SystemModuleInformation,
|
|
SystemLocksInformation,
|
|
SystemStackTraceInformation,
|
|
SystemPagedPoolInformation,
|
|
SystemNonPagedPoolInformation,
|
|
SystemHandleInformation,
|
|
SystemObjectInformation,
|
|
SystemPageFileInformation,
|
|
SystemVdmInstemulInformation,
|
|
SystemVdmBopInformation, // 20
|
|
SystemFileCacheInformation,
|
|
SystemPoolTagInformation,
|
|
SystemInterruptInformation,
|
|
SystemDpcBehaviorInformation,
|
|
SystemFullMemoryInformation,
|
|
SystemLoadGdiDriverInformation,
|
|
SystemUnloadGdiDriverInformation,
|
|
SystemTimeAdjustmentInformation,
|
|
SystemSummaryMemoryInformation,
|
|
SystemMirrorMemoryInformation, // 30
|
|
SystemPerformanceTraceInformation,
|
|
SystemCrashDumpInformation,
|
|
SystemExceptionInformation,
|
|
SystemCrashDumpStateInformation,
|
|
SystemKernelDebuggerInformation,
|
|
SystemContextSwitchInformation,
|
|
SystemRegistryQuotaInformation,
|
|
SystemExtendServiceTableInformation, // used to be SystemLoadAndCallImage
|
|
SystemPrioritySeparation,
|
|
SystemVerifierAddDriverInformation, // 40
|
|
SystemVerifierRemoveDriverInformation,
|
|
SystemProcessorIdleInformation,
|
|
SystemLegacyDriverInformation,
|
|
SystemCurrentTimeZoneInformation,
|
|
SystemLookasideInformation,
|
|
SystemTimeSlipNotification,
|
|
SystemSessionCreate,
|
|
SystemSessionDetach,
|
|
SystemSessionInformation,
|
|
SystemRangeStartInformation, // 50
|
|
SystemVerifierInformation,
|
|
SystemVerifierThunkExtend,
|
|
SystemSessionProcessInformation,
|
|
SystemLoadGdiDriverInSystemSpace,
|
|
SystemNumaProcessorMap,
|
|
SystemPrefetcherInformation,
|
|
SystemExtendedProcessInformation,
|
|
SystemRecommendedSharedDataAlignment,
|
|
SystemComPlusPackage,
|
|
SystemNumaAvailableMemory, // 60
|
|
SystemProcessorPowerInformation,
|
|
SystemEmulationBasicInformation,
|
|
SystemEmulationProcessorInformation,
|
|
SystemExtendedHandleInformation,
|
|
SystemLostDelayedWriteInformation,
|
|
SystemBigPoolInformation,
|
|
SystemSessionPoolTagInformation,
|
|
SystemSessionMappedViewInformation,
|
|
SystemHotpatchInformation,
|
|
SystemObjectSecurityMode, // 70
|
|
SystemWatchdogTimerHandler, // doesn't seem to be implemented
|
|
SystemWatchdogTimerInformation,
|
|
SystemLogicalProcessorInformation,
|
|
SystemWow64SharedInformation,
|
|
SystemRegisterFirmwareTableInformationHandler,
|
|
SystemFirmwareTableInformation,
|
|
SystemModuleInformationEx,
|
|
SystemVerifierTriageInformation,
|
|
SystemSuperfetchInformation,
|
|
SystemMemoryListInformation, // 80
|
|
SystemFileCacheInformationEx,
|
|
SystemNotImplemented19,
|
|
SystemProcessorDebugInformation,
|
|
SystemVerifierInformation2,
|
|
SystemNotImplemented20,
|
|
SystemRefTraceInformation,
|
|
SystemSpecialPoolTag, // MmSpecialPoolTag, then MmSpecialPoolCatchOverruns != 0
|
|
SystemProcessImageName,
|
|
SystemNotImplemented21,
|
|
SystemBootEnvironmentInformation, // 90
|
|
SystemEnlightenmentInformation,
|
|
SystemVerifierInformationEx,
|
|
SystemNotImplemented22,
|
|
SystemNotImplemented23,
|
|
SystemCovInformation,
|
|
SystemNotImplemented24,
|
|
SystemNotImplemented25,
|
|
SystemPartitionInformation,
|
|
SystemSystemDiskInformation, // this and SystemPartitionInformation both call IoQuerySystemDeviceName
|
|
SystemPerformanceDistributionInformation, // 100
|
|
SystemNumaProximityNodeInformation,
|
|
SystemTimeZoneInformation2,
|
|
SystemCodeIntegrityInformation,
|
|
SystemNotImplemented26,
|
|
SystemUnknownInformation, // No symbols for this case, very strange...
|
|
SystemVaInformation, // 106, calls MmQuerySystemVaInformation
|
|
MaxSystemInfoClass
|
|
} SYSTEM_INFORMATION_CLASS;
|
|
|
|
typedef struct _SYSTEM_TIMEOFDAY_INFORMATION
|
|
{
|
|
LARGE_INTEGER BootTime;
|
|
LARGE_INTEGER CurrentTime;
|
|
LARGE_INTEGER TimeZoneBias;
|
|
ULONG TimeZoneId;
|
|
ULONG Reserved;
|
|
ULONGLONG BootTimeBias;
|
|
ULONGLONG SleepTimeBias;
|
|
} SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION;
|
|
|
|
typedef struct _SYSTEM_BASIC_INFORMATION
|
|
{
|
|
ULONG Reserved;
|
|
ULONG TimerResolution;
|
|
ULONG PageSize;
|
|
ULONG NumberOfPhysicalPages;
|
|
ULONG LowestPhysicalPageNumber;
|
|
ULONG HighestPhysicalPageNumber;
|
|
ULONG AllocationGranularity;
|
|
ULONG_PTR MinimumUserModeAddress;
|
|
ULONG_PTR MaximumUserModeAddress;
|
|
ULONG_PTR ActiveProcessorsAffinityMask;
|
|
CCHAR NumberOfProcessors;
|
|
} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
|
|
|
|
typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
|
|
{
|
|
LARGE_INTEGER IdleTime;
|
|
LARGE_INTEGER KernelTime;
|
|
LARGE_INTEGER UserTime;
|
|
LARGE_INTEGER DpcTime;
|
|
LARGE_INTEGER InterruptTime;
|
|
ULONG InterruptCount;
|
|
} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;
|
|
|
|
typedef struct _SYSTEM_PERFORMANCE_INFORMATION
|
|
{
|
|
LARGE_INTEGER IdleProcessTime;
|
|
LARGE_INTEGER IoReadTransferCount;
|
|
LARGE_INTEGER IoWriteTransferCount;
|
|
LARGE_INTEGER IoOtherTransferCount;
|
|
ULONG IoReadOperationCount;
|
|
ULONG IoWriteOperationCount;
|
|
ULONG IoOtherOperationCount;
|
|
ULONG AvailablePages;
|
|
ULONG CommittedPages;
|
|
ULONG CommitLimit;
|
|
ULONG PeakCommitment;
|
|
ULONG PageFaultCount;
|
|
ULONG CopyOnWriteCount;
|
|
ULONG TransitionCount;
|
|
ULONG CacheTransitionCount;
|
|
ULONG DemandZeroCount;
|
|
ULONG PageReadCount;
|
|
ULONG PageReadIoCount;
|
|
ULONG CacheReadCount;
|
|
ULONG CacheIoCount;
|
|
ULONG DirtyPagesWriteCount;
|
|
ULONG DirtyWriteIoCount;
|
|
ULONG MappedPagesWriteCount;
|
|
ULONG MappedWriteIoCount;
|
|
ULONG PagedPoolPages;
|
|
ULONG NonPagedPoolPages;
|
|
ULONG PagedPoolAllocs;
|
|
ULONG PagedPoolFrees;
|
|
ULONG NonPagedPoolAllocs;
|
|
ULONG NonPagedPoolFrees;
|
|
ULONG FreeSystemPtes;
|
|
ULONG ResidentSystemCodePage;
|
|
ULONG TotalSystemDriverPages;
|
|
ULONG TotalSystemCodePages;
|
|
ULONG NonPagedPoolLookasideHits;
|
|
ULONG PagedPoolLookasideHits;
|
|
ULONG AvailablePagedPoolPages;
|
|
ULONG ResidentSystemCachePage;
|
|
ULONG ResidentPagedPoolPage;
|
|
ULONG ResidentSystemDriverPage;
|
|
ULONG CcFastReadNoWait;
|
|
ULONG CcFastReadWait;
|
|
ULONG CcFastReadResourceMiss;
|
|
ULONG CcFastReadNotPossible;
|
|
ULONG CcFastMdlReadNoWait;
|
|
ULONG CcFastMdlReadWait;
|
|
ULONG CcFastMdlReadResourceMiss;
|
|
ULONG CcFastMdlReadNotPossible;
|
|
ULONG CcMapDataNoWait;
|
|
ULONG CcMapDataWait;
|
|
ULONG CcMapDataNoWaitMiss;
|
|
ULONG CcMapDataWaitMiss;
|
|
ULONG CcPinMappedDataCount;
|
|
ULONG CcPinReadNoWait;
|
|
ULONG CcPinReadWait;
|
|
ULONG CcPinReadNoWaitMiss;
|
|
ULONG CcPinReadWaitMiss;
|
|
ULONG CcCopyReadNoWait;
|
|
ULONG CcCopyReadWait;
|
|
ULONG CcCopyReadNoWaitMiss;
|
|
ULONG CcCopyReadWaitMiss;
|
|
ULONG CcMdlReadNoWait;
|
|
ULONG CcMdlReadWait;
|
|
ULONG CcMdlReadNoWaitMiss;
|
|
ULONG CcMdlReadWaitMiss;
|
|
ULONG CcReadAheadIos;
|
|
ULONG CcLazyWriteIos;
|
|
ULONG CcLazyWritePages;
|
|
ULONG CcDataFlushes;
|
|
ULONG CcDataPages;
|
|
ULONG ContextSwitches;
|
|
ULONG FirstLevelTbFills;
|
|
ULONG SecondLevelTbFills;
|
|
ULONG SystemCalls;
|
|
} SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;
|
|
|
|
typedef struct _SYSTEM_PROCESS_INFORMATION
|
|
{
|
|
ULONG NextEntryOffset;
|
|
ULONG NumberOfThreads;
|
|
LARGE_INTEGER SpareLi1;
|
|
LARGE_INTEGER SpareLi2;
|
|
LARGE_INTEGER SpareLi3;
|
|
LARGE_INTEGER CreateTime;
|
|
LARGE_INTEGER UserTime;
|
|
LARGE_INTEGER KernelTime;
|
|
UNICODE_STRING ImageName;
|
|
KPRIORITY BasePriority;
|
|
HANDLE UniqueProcessId;
|
|
HANDLE InheritedFromUniqueProcessId;
|
|
ULONG HandleCount;
|
|
ULONG SessionId;
|
|
ULONG_PTR PageDirectoryBase;
|
|
SIZE_T PeakVirtualSize;
|
|
SIZE_T VirtualSize;
|
|
ULONG PageFaultCount;
|
|
SIZE_T PeakWorkingSetSize;
|
|
SIZE_T WorkingSetSize;
|
|
SIZE_T QuotaPeakPagedPoolUsage;
|
|
SIZE_T QuotaPagedPoolUsage;
|
|
SIZE_T QuotaPeakNonPagedPoolUsage;
|
|
SIZE_T QuotaNonPagedPoolUsage;
|
|
SIZE_T PagefileUsage;
|
|
SIZE_T PeakPagefileUsage;
|
|
SIZE_T PrivatePageCount;
|
|
LARGE_INTEGER ReadOperationCount;
|
|
LARGE_INTEGER WriteOperationCount;
|
|
LARGE_INTEGER OtherOperationCount;
|
|
LARGE_INTEGER ReadTransferCount;
|
|
LARGE_INTEGER WriteTransferCount;
|
|
LARGE_INTEGER OtherTransferCount;
|
|
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
|
|
|
|
typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
|
|
{
|
|
ULONG SessionId;
|
|
ULONG SizeOfBuf;
|
|
PVOID Buffer;
|
|
} SYSTEM_SESSION_PROCESS_INFORMATION, *PSYSTEM_SESSION_PROCESS_INFORMATION;
|
|
|
|
typedef struct _SYSTEM_THREAD_INFORMATION
|
|
{
|
|
LARGE_INTEGER KernelTime;
|
|
LARGE_INTEGER UserTime;
|
|
LARGE_INTEGER CreateTime;
|
|
ULONG WaitTime;
|
|
PVOID StartAddress;
|
|
CLIENT_ID ClientId;
|
|
KPRIORITY Priority;
|
|
LONG BasePriority;
|
|
ULONG ContextSwitches;
|
|
ULONG ThreadState;
|
|
ULONG WaitReason;
|
|
} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
|
|
|
|
typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION
|
|
{
|
|
SYSTEM_THREAD_INFORMATION ThreadInfo;
|
|
PVOID StackBase;
|
|
PVOID StackLimit;
|
|
PVOID Win32StartAddress;
|
|
ULONG_PTR Reserved1;
|
|
ULONG_PTR Reserved2;
|
|
ULONG_PTR Reserved3;
|
|
ULONG_PTR Reserved4;
|
|
} SYSTEM_EXTENDED_THREAD_INFORMATION, *PSYSTEM_EXTENDED_THREAD_INFORMATION;
|
|
|
|
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
|
|
{
|
|
USHORT UniqueProcessId;
|
|
USHORT CreatorBackTraceIndex;
|
|
UCHAR ObjectTypeIndex;
|
|
UCHAR HandleAttributes;
|
|
USHORT HandleValue;
|
|
PVOID Object;
|
|
ULONG GrantedAccess;
|
|
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
|
|
|
|
typedef struct _SYSTEM_HANDLE_INFORMATION
|
|
{
|
|
ULONG NumberOfHandles;
|
|
SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
|
|
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
|
|
|
|
typedef struct _SYSTEM_OBJECTTYPE_INFORMATION
|
|
{
|
|
ULONG NextEntryOffset;
|
|
ULONG NumberOfObjects;
|
|
ULONG NumberOfHandles;
|
|
ULONG TypeIndex;
|
|
ULONG InvalidAttributes;
|
|
GENERIC_MAPPING GenericMapping;
|
|
ULONG ValidAccessMask;
|
|
ULONG PoolType;
|
|
BOOLEAN SecurityRequired;
|
|
BOOLEAN WaitableObject;
|
|
UNICODE_STRING TypeName;
|
|
} SYSTEM_OBJECTTYPE_INFORMATION, *PSYSTEM_OBJECTTYPE_INFORMATION;
|
|
|
|
typedef NTSTATUS (NTAPI *_NtQuerySystemInformation)(
|
|
__in SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
|
__out_bcount_opt(SystemInformationLength) PVOID SystemInformation,
|
|
__in ULONG SystemInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
#endif
|