admin/processhacker-phnt
1
0
Fork 0
mirror of https://github.com/processhacker/phnt synced 2026-06-08 16:49:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Sync latest fixes and updates (contributions thanks to @diversenok and @JustasMasiulis)

Browse Source 
Co-Authored-By: Justas Masiulis <Justas.masiulis@yahoo.com>
Co-Authored-By: diversenok <diversenok@gmail.com>
This commit is contained in:
dmex
2022-05-13 11:50:17 +10:00
parent 461f7b6462
commit 0f32b6e513
10 changed files with 907 additions and 166 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ntbcd.h
+19 -13
View File
@@ -153,6 +153,15 @@ BcdExportStore(
_In_ UNICODE_STRING BcdFilePath
);
NTSYSAPI
NTSTATUS
NTAPI
BcdExportStoreEx(
_In_ HANDLE BcdStoreHandle,
_In_ ULONG Flags,
_In_ UNICODE_STRING BcdFilePath
);
NTSYSAPI
NTSTATUS
NTAPI
@@ -290,7 +299,7 @@ typedef enum _BCD_INHERITED_CLASS_TYPE
((BCD_APPLICATION_OBJECT_TYPE)((((ULONG)DataType)) & 0xFFFFF))
#define BCD_OBJECT_OSLOADER_TYPE \
MAKE_BCD_APPLICATION_OBJECT(BCD_APPLICATION_IMAGE_BOOT_APPLICATION, BCD_APPLICATION_OBJECT_WINDOWS_BOOT_LOADER);
MAKE_BCD_APPLICATION_OBJECT(BCD_APPLICATION_IMAGE_BOOT_APPLICATION, BCD_APPLICATION_OBJECT_WINDOWS_BOOT_LOADER)
typedef union _BCD_OBJECT_DATATYPE
{
@@ -307,19 +316,19 @@ typedef union _BCD_OBJECT_DATATYPE
BCD_APPLICATION_OBJECT_TYPE ApplicationType : 20;
BCD_APPLICATION_IMAGE_TYPE ImageType : 4;
ULONG Reserved : 4;
ULONG ObjectType : 4;
BCD_OBJECT_TYPE ObjectType : 4;
} Application;
struct
{
ULONG Value : 20;
BCD_INHERITED_CLASS_TYPE Class : 4;
ULONG Reserved : 4;
ULONG ObjectType : 4;
BCD_OBJECT_TYPE ObjectType : 4;
} Inherit;
struct
{
ULONG Reserved : 28;
ULONG ObjectType : 4;
BCD_OBJECT_TYPE ObjectType : 4;
} Device;
};
} BCD_OBJECT_DATATYPE, *PBCD_OBJECT_DATATYPE;
@@ -493,17 +502,14 @@ typedef enum _BCD_ELEMENT_DEVICE_TYPE
#define GET_BCDE_DATA_SUBTYPE(DataType) \
((ULONG)((((ULONG)DataType)) & 0x00FFFFFF))
typedef struct _BCD_ELEMENT_DATATYPE
typedef union _BCD_ELEMENT_DATATYPE
{
union
ULONG PackedValue;
struct
{
ULONG PackedValue;
struct
{
ULONG SubType : 24;
BCD_ELEMENT_DATATYPE_FORMAT Format : 4;
BCD_ELEMENT_DATATYPE_CLASS Class : 4;
};
ULONG SubType : 24;
BCD_ELEMENT_DATATYPE_FORMAT Format : 4;
BCD_ELEMENT_DATATYPE_CLASS Class : 4;
};
} BCD_ELEMENT_DATATYPE, *PBCD_ELEMENT_DATATYPE;
ntexapi.h
+470 -46
View File
@@ -1187,6 +1187,29 @@ NtWorkerFactoryWorkerReady(
struct _FILE_IO_COMPLETION_INFORMATION;
#if (PHNT_VERSION >= PHNT_WIN8)
typedef struct _WORKER_FACTORY_DEFERRED_WORK
{
struct _PORT_MESSAGE *AlpcSendMessage;
PVOID AlpcSendMessagePort;
ULONG AlpcSendMessageFlags;
ULONG Flags;
} WORKER_FACTORY_DEFERRED_WORK, *PWORKER_FACTORY_DEFERRED_WORK;
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForWorkViaWorkerFactory(
_In_ HANDLE WorkerFactoryHandle,
_Out_writes_to_(Count, *PacketsReturned) struct _FILE_IO_COMPLETION_INFORMATION *MiniPackets,
_In_ ULONG Count,
_Out_ PULONG PacketsReturned,
_In_ PWORKER_FACTORY_DEFERRED_WORK DeferredWork
);
#else
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1197,6 +1220,8 @@ NtWaitForWorkViaWorkerFactory(
#endif
#endif
// Time
NTSYSCALLAPI
@@ -1301,7 +1326,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS
SystemVdmBopInformation, // not implemented // 20
SystemFileCacheInformation, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemCache)
SystemPoolTagInformation, // q: SYSTEM_POOLTAG_INFORMATION
SystemInterruptInformation, // q: SYSTEM_INTERRUPT_INFORMATION
SystemInterruptInformation, // q: SYSTEM_INTERRUPT_INFORMATION (EX in: USHORT ProcessorGroup)
SystemDpcBehaviorInformation, // q: SYSTEM_DPC_BEHAVIOR_INFORMATION; s: SYSTEM_DPC_BEHAVIOR_INFORMATION (requires SeLoadDriverPrivilege)
SystemFullMemoryInformation, // not implemented // SYSTEM_MEMORY_USAGE_INFORMATION
SystemLoadGdiDriverInformation, // s (kernel-mode only)
@@ -1320,7 +1345,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS
SystemPrioritySeperation, // s (requires SeTcbPrivilege)
SystemVerifierAddDriverInformation, // s (requires SeDebugPrivilege) // 40
SystemVerifierRemoveDriverInformation, // s (requires SeDebugPrivilege)
SystemProcessorIdleInformation, // q: SYSTEM_PROCESSOR_IDLE_INFORMATION
SystemProcessorIdleInformation, // q: SYSTEM_PROCESSOR_IDLE_INFORMATION (EX in: USHORT ProcessorGroup)
SystemLegacyDriverInformation, // q: SYSTEM_LEGACY_DRIVER_INFORMATION
SystemCurrentTimeZoneInformation, // q; s: RTL_TIME_ZONE_INFORMATION
SystemLookasideInformation, // q: SYSTEM_LOOKASIDE_INFORMATION
@@ -1339,7 +1364,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS
SystemRecommendedSharedDataAlignment, // q: ULONG // KeGetRecommendedSharedDataAlignment
SystemComPlusPackage, // q; s: ULONG
SystemNumaAvailableMemory, // q: SYSTEM_NUMA_INFORMATION // 60
SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION
SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION (EX in: USHORT ProcessorGroup)
SystemEmulationBasicInformation, // q: SYSTEM_BASIC_INFORMATION
SystemEmulationProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION
SystemExtendedHandleInformation, // q: SYSTEM_HANDLE_INFORMATION_EX
@@ -1378,14 +1403,14 @@ typedef enum _SYSTEM_INFORMATION_CLASS
SystemVerifierFaultsInformation, // s: SYSTEM_VERIFIER_FAULTS_INFORMATION (requires SeDebugPrivilege)
SystemSystemPartitionInformation, // q: SYSTEM_SYSTEM_PARTITION_INFORMATION
SystemSystemDiskInformation, // q: SYSTEM_SYSTEM_DISK_INFORMATION
SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION // 100
SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION (EX in: USHORT ProcessorGroup) // 100
SystemNumaProximityNodeInformation, // q; s: SYSTEM_NUMA_PROXIMITY_MAP
SystemDynamicTimeZoneInformation, // q; s: RTL_DYNAMIC_TIME_ZONE_INFORMATION (requires SeTimeZonePrivilege)
SystemCodeIntegrityInformation, // q: SYSTEM_CODEINTEGRITY_INFORMATION // SeCodeIntegrityQueryInformation
SystemProcessorMicrocodeUpdateInformation, // s: SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION
SystemProcessorBrandString, // q: CHAR[] // HaliQuerySystemInformation -> HalpGetProcessorBrandString, info class 23
SystemVirtualAddressInformation, // q: SYSTEM_VA_LIST_INFORMATION[]; s: SYSTEM_VA_LIST_INFORMATION[] (requires SeIncreaseQuotaPrivilege) // MmQuerySystemVaInformation
SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // since WIN7 // KeQueryLogicalProcessorRelationship
SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX (EX in: LOGICAL_PROCESSOR_RELATIONSHIP RelationshipType) // since WIN7 // KeQueryLogicalProcessorRelationship
SystemProcessorCycleTimeInformation, // q: SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[] (EX in: USHORT ProcessorGroup)
SystemStoreInformation, // q; s: SYSTEM_STORE_INFORMATION (requires SeProfileSingleProcessPrivilege) // SmQueryStoreInformation
SystemRegistryAppendString, // s: SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // 110
@@ -1399,7 +1424,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS
SystemVerifierCountersInformation, // q: SYSTEM_VERIFIER_COUNTERS_INFORMATION
SystemPagedPoolInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypePagedPool)
SystemSystemPtesInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemPtes) // 120
SystemNodeDistanceInformation,
SystemNodeDistanceInformation, // q: USHORT[4*NumaNodes] // (EX in: USHORT NodeNumber)
SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26
SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation
SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1
@@ -1419,7 +1444,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS
SystemMemoryTopologyInformation, // q: SYSTEM_MEMORY_TOPOLOGY_INFORMATION
SystemMemoryChannelInformation, // q: SYSTEM_MEMORY_CHANNEL_INFORMATION
SystemBootLogoInformation, // q: SYSTEM_BOOT_LOGO_INFORMATION // 140
SystemProcessorPerformanceInformationEx, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // since WINBLUE
SystemProcessorPerformanceInformationEx, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // (EX in: USHORT ProcessorGroup) // since WINBLUE
SystemCriticalProcessErrorLogInformation,
SystemSecureBootPolicyInformation, // q: SYSTEM_SECUREBOOT_POLICY_INFORMATION
SystemPageFileInformationEx, // q: SYSTEM_PAGEFILE_INFORMATION_EX
@@ -1438,7 +1463,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS
SystemManufacturingInformation, // q: SYSTEM_MANUFACTURING_INFORMATION // since THRESHOLD
SystemEnergyEstimationConfigInformation, // q: SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION
SystemHypervisorDetailInformation, // q: SYSTEM_HYPERVISOR_DETAIL_INFORMATION
SystemProcessorCycleStatsInformation, // q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION // 160
SystemProcessorCycleStatsInformation, // q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION (EX in: USHORT ProcessorGroup) // 160
SystemVmGenerationCountInformation,
SystemTrustedPlatformModuleInformation, // q: SYSTEM_TPM_INFORMATION
SystemKernelDebuggerFlags, // SYSTEM_KERNEL_DEBUGGER_FLAGS
@@ -1471,7 +1496,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS
SystemCodeIntegrityUnlockInformation, // SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION // 190
SystemIntegrityQuotaInformation,
SystemFlushInformation, // q: SYSTEM_FLUSH_INFORMATION
SystemProcessorIdleMaskInformation, // q: ULONG_PTR // since REDSTONE3
SystemProcessorIdleMaskInformation, // q: ULONG_PTR[ActiveGroupCount] // since REDSTONE3
SystemSecureDumpEncryptionInformation,
SystemWriteConstraintInformation, // SYSTEM_WRITE_CONSTRAINT_INFORMATION
SystemKernelVaShadowInformation, // SYSTEM_KERNEL_VA_SHADOW_INFORMATION
@@ -1509,7 +1534,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS
SystemDpcWatchdogInformation,
SystemDpcWatchdogInformation2,
SystemSupportedProcessorArchitectures2, // q: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx // 230
SystemSingleProcessorRelationshipInformation,
SystemSingleProcessorRelationshipInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // (EX in: PROCESSOR_NUMBER Processor)
SystemXfgCheckFailureInformation,
SystemIommuStateInformation, // SYSTEM_IOMMU_STATE_INFORMATION // since 22H1
SystemHypervisorMinrootInformation, // SYSTEM_HYPERVISOR_MINROOT_INFORMATION
@@ -1531,7 +1556,7 @@ typedef struct _SYSTEM_BASIC_INFORMATION
ULONG AllocationGranularity;
ULONG_PTR MinimumUserModeAddress;
ULONG_PTR MaximumUserModeAddress;
ULONG_PTR ActiveProcessorsAffinityMask;
KAFFINITY ActiveProcessorsAffinityMask;
CCHAR NumberOfProcessors;
} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
@@ -1646,7 +1671,7 @@ typedef struct _SYSTEM_THREAD_INFORMATION
PVOID StartAddress;
CLIENT_ID ClientId;
KPRIORITY Priority;
LONG BasePriority;
KPRIORITY BasePriority;
ULONG ContextSwitches;
KTHREAD_STATE ThreadState;
KWAIT_REASON WaitReason;
@@ -2019,9 +2044,9 @@ typedef struct _EVENT_TRACE_VERSION_INFORMATION
ULONG EventTraceKernelVersion;
} EVENT_TRACE_VERSION_INFORMATION, *PEVENT_TRACE_VERSION_INFORMATION;
#define PERF_MASK_INDEX (0xe0000000)
#define PERF_MASK_GROUP (~PERF_MASK_INDEX)
#define PERF_NUM_MASKS 8
#define PERF_MASK_INDEX (0xe0000000)
#define PERF_MASK_GROUP (~PERF_MASK_INDEX)
#define PERF_NUM_MASKS 8
#define PERF_GET_MASK_INDEX(GM) (((GM) & PERF_MASK_INDEX) >> 29)
#define PERF_GET_MASK_GROUP(GM) ((GM) & PERF_MASK_GROUP)
@@ -2972,26 +2997,26 @@ typedef struct _SYSTEM_VA_LIST_INFORMATION
typedef enum _STORE_INFORMATION_CLASS
{
StorePageRequest = 1,
StoreStatsRequest = 2, // (requires SeProfileSingleProcessPrivilege) // SmProcessStatsRequest
StoreCreateRequest = 3,
StoreDeleteRequest = 4,
StoreListRequest = 5, // SmProcessListRequest
StoreStatsRequest = 2, // q: SM_STATS_REQUEST // SmProcessStatsRequest
StoreCreateRequest = 3, // s: SM_CREATE_REQUEST (requires SeProfileSingleProcessPrivilege)
StoreDeleteRequest = 4, // s: SM_DELETE_REQUEST (requires SeProfileSingleProcessPrivilege)
StoreListRequest = 5, // q: SM_STORE_LIST_REQUEST / SM_STORE_LIST_REQUEST_EX // SmProcessListRequest
Available1 = 6,
StoreEmptyRequest = 7,
CacheListRequest = 8, // SmcProcessListRequest
CacheCreateRequest = 9,
CacheDeleteRequest = 10,
CacheStoreCreateRequest = 11,
CacheStoreDeleteRequest = 12,
CacheStatsRequest = 13, // SmcProcessStatsRequest
CacheListRequest = 8, // q: SMC_CACHE_LIST_REQUEST // SmcProcessListRequest
CacheCreateRequest = 9, // s: SMC_CACHE_CREATE_REQUEST (requires SeProfileSingleProcessPrivilege)
CacheDeleteRequest = 10, // s: SMC_CACHE_DELETE_REQUEST (requires SeProfileSingleProcessPrivilege)
CacheStoreCreateRequest = 11, // s: SMC_STORE_CREATE_REQUEST (requires SeProfileSingleProcessPrivilege)
CacheStoreDeleteRequest = 12, // s: SMC_STORE_DELETE_REQUEST (requires SeProfileSingleProcessPrivilege)
CacheStatsRequest = 13, // q: SMC_CACHE_STATS_REQUEST // SmcProcessStatsRequest
Available2 = 14,
RegistrationRequest = 15, // SmProcessRegistrationRequest
RegistrationRequest = 15, // q: SM_REGISTRATION_REQUEST (requires SeProfileSingleProcessPrivilege) // SmProcessRegistrationRequest
GlobalCacheStatsRequest = 16,
StoreResizeRequest = 17,
CacheStoreResizeRequest = 18,
SmConfigRequest = 19,
StoreHighMemoryPriorityRequest = 20, // SM_STORE_HIGH_MEM_PRIORITY_REQUEST
SystemStoreTrimRequest = 21, // SM_SYSTEM_STORE_TRIM_REQUEST
StoreResizeRequest = 17, // s: SM_STORE_RESIZE_REQUEST (requires SeProfileSingleProcessPrivilege)
CacheStoreResizeRequest = 18, // s: SMC_STORE_RESIZE_REQUEST (requires SeProfileSingleProcessPrivilege)
SmConfigRequest = 19, // s: SM_CONFIG_REQUEST (requires SeProfileSingleProcessPrivilege)
StoreHighMemoryPriorityRequest = 20, // s: SM_STORE_HIGH_MEM_PRIORITY_REQUEST (requires SeProfileSingleProcessPrivilege)
SystemStoreTrimRequest = 21, // s: SM_SYSTEM_STORE_TRIM_REQUEST (requires SeProfileSingleProcessPrivilege)
MemCompressionInfoRequest = 22, // q: SM_MEM_COMPRESSION_INFO_REQUEST // SmProcessCompressionInfoRequest
ProcessStoreInfoRequest = 23, // SmProcessProcessStoreInfoRequest
StoreInformationMax
@@ -3001,27 +3026,403 @@ typedef enum _STORE_INFORMATION_CLASS
#define SYSTEM_STORE_INFORMATION_VERSION 1
// rev
typedef struct _STORE_INFORMATION
typedef struct _SYSTEM_STORE_INFORMATION
{
_In_ ULONG Version;
_In_ STORE_INFORMATION_CLASS StoreInformationClass;
_Inout_ PVOID Data;
_Inout_ ULONG Length;
} STORE_INFORMATION, *PSTORE_INFORMATION;
} SYSTEM_STORE_INFORMATION, *PSYSTEM_STORE_INFORMATION;
#define SYSTEM_STORE_STATS_INFORMATION_VERSION 2
typedef enum _ST_STATS_LEVEL
{
StStatsLevelBasic = 0,
StStatsLevelIoStats = 1,
StStatsLevelRegionSpace = 2, // requires SeProfileSingleProcessPrivilege
StStatsLevelSpaceBitmap = 3, // requires SeProfileSingleProcessPrivilege
StStatsLevelMax = 4
} ST_STATS_LEVEL;
typedef struct _SM_STATS_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_STATS_INFORMATION_VERSION
ULONG DetailLevel : 8; // ST_STATS_LEVEL
ULONG StoreId : 16;
ULONG BufferSize;
PVOID Buffer; // PST_STATS
} SM_STATS_REQUEST, *PSM_STATS_REQUEST;
typedef struct _ST_DATA_MGR_STATS
{
ULONG RegionCount;
ULONG PagesStored;
ULONG UniquePagesStored;
ULONG LazyCleanupRegionCount;
struct {
ULONG RegionsInUse;
ULONG SpaceUsed;
} Space[8];
} ST_DATA_MGR_STATS, *PST_DATA_MGR_STATS;
typedef struct _ST_IO_STATS_PERIOD
{
ULONG PageCounts[5];
} ST_IO_STATS_PERIOD, *PST_IO_STATS_PERIOD;
typedef struct _ST_IO_STATS
{
ULONG PeriodCount;
ST_IO_STATS_PERIOD Periods[64];
} ST_IO_STATS, *PST_IO_STATS;
typedef struct _ST_READ_LATENCY_BUCKET
{
ULONG LatencyUs;
ULONG Count;
} ST_READ_LATENCY_BUCKET, *PST_READ_LATENCY_BUCKET;
typedef struct _ST_READ_LATENCY_STATS
{
ST_READ_LATENCY_BUCKET Buckets[8];
} ST_READ_LATENCY_STATS, *PST_READ_LATENCY_STATS;
// rev
typedef struct _ST_STATS_REGION_INFO
{
USHORT SpaceUsed;
UCHAR Priority;
UCHAR Spare;
} ST_STATS_REGION_INFO, *PST_STATS_REGION_INFO;
// rev
typedef struct _ST_STATS_SPACE_BITMAP
{
SIZE_T CompressedBytes;
ULONG BytesPerBit;
UCHAR StoreBitmap[1];
} ST_STATS_SPACE_BITMAP, PST_STATS_SPACE_BITMAP;
// rev
typedef struct _ST_STATS
{
ULONG Version : 8;
ULONG Level : 4;
ULONG StoreType : 4;
ULONG NoDuplication : 1;
ULONG NoCompression : 1;
ULONG EncryptionStrength : 12;
ULONG VirtualRegions : 1;
ULONG Spare0 : 1;
ULONG Size;
USHORT CompressionFormat;
USHORT Spare;
struct
{
ULONG RegionSize;
ULONG RegionCount;
ULONG RegionCountMax;
ULONG Granularity;
ST_DATA_MGR_STATS UserData;
ST_DATA_MGR_STATS Metadata;
} Basic;
struct
{
ST_IO_STATS IoStats;
ST_READ_LATENCY_STATS ReadLatencyStats;
} Io;
// ST_STATS_REGION_INFO[RegionCountMax]
// ST_STATS_SPACE_BITMAP
} ST_STATS, *PST_STATS;
#define SYSTEM_STORE_CREATE_INFORMATION_VERSION 6
typedef enum _SM_STORE_TYPE
{
StoreTypeInMemory=0,
StoreTypeFile=1,
StoreTypeMax=2
} SM_STORE_TYPE;
typedef struct _SM_STORE_BASIC_PARAMS
{
union
{
struct
{
ULONG StoreType : 8; // SM_STORE_TYPE
ULONG NoDuplication : 1;
ULONG FailNoCompression : 1;
ULONG NoCompression : 1 ;
ULONG NoEncryption : 1;
ULONG NoEvictOnAdd : 1;
ULONG PerformsFileIo : 1;
ULONG VdlNotSet : 1 ;
ULONG UseIntermediateAddBuffer : 1;
ULONG CompressNoHuff : 1;
ULONG LockActiveRegions : 1;
ULONG VirtualRegions : 1;
ULONG Spare : 13;
};
ULONG StoreFlags;
};
ULONG Granularity;
ULONG RegionSize;
ULONG RegionCountMax;
} SM_STORE_BASIC_PARAMS, *PSM_STORE_BASIC_PARAMS;
typedef struct _SMKM_REGION_EXTENT
{
ULONG RegionCount;
SIZE_T ByteOffset;
} SMKM_REGION_EXTENT, *PSMKM_REGION_EXTENT;
typedef struct _SMKM_FILE_INFO
{
HANDLE FileHandle;
struct _FILE_OBJECT *FileObject;
struct _FILE_OBJECT *VolumeFileObject;
struct _DEVICE_OBJECT *VolumeDeviceObject;
HANDLE VolumePnpHandle;
struct _IRP *UsageNotificationIrp;
PSMKM_REGION_EXTENT Extents;
ULONG ExtentCount;
} SMKM_FILE_INFO, *PSMKM_FILE_INFO;
typedef struct _SM_STORE_CACHE_BACKED_PARAMS
{
ULONG SectorSize;
PCHAR EncryptionKey;
ULONG EncryptionKeySize;
PSMKM_FILE_INFO FileInfo;
PVOID EtaContext;
struct _RTL_BITMAP *StoreRegionBitmap;
} SM_STORE_CACHE_BACKED_PARAMS, *PSM_STORE_CACHE_BACKED_PARAMS;
typedef struct _SM_STORE_PARAMETERS
{
SM_STORE_BASIC_PARAMS Store;
ULONG Priority;
ULONG Flags;
SM_STORE_CACHE_BACKED_PARAMS CacheBacked;
} SM_STORE_PARAMETERS, *PSM_STORE_PARAMETERS;
typedef struct _SM_CREATE_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_CREATE_INFORMATION_VERSION
ULONG AcquireReference : 1;
ULONG KeyedStore : 1;
ULONG Spare : 22;
SM_STORE_PARAMETERS Params;
ULONG StoreId;
} SM_CREATE_REQUEST, *PSM_CREATE_REQUEST;
#define SYSTEM_STORE_DELETE_INFORMATION_VERSION 1
typedef struct _SM_DELETE_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_DELETE_INFORMATION_VERSION
ULONG Spare : 24;
ULONG StoreId;
} SM_DELETE_REQUEST, *PSM_DELETE_REQUEST;
#define SYSTEM_STORE_LIST_INFORMATION_VERSION 2
typedef struct _SM_STORE_LIST_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_LIST_INFORMATION_VERSION
ULONG StoreCount : 8; // = 0
ULONG ExtendedRequest : 1; // SM_STORE_LIST_REQUEST_EX if set
ULONG Spare : 15;
ULONG StoreId[32];
} SM_STORE_LIST_REQUEST, *PSM_STORE_LIST_REQUEST;
typedef struct _SM_STORE_LIST_REQUEST_EX
{
SM_STORE_LIST_REQUEST Request;
WCHAR NameBuffer[32][64];
} SM_STORE_LIST_REQUEST_EX, *PSM_STORE_LIST_REQUEST_EX;
#define SYSTEM_CACHE_LIST_INFORMATION_VERSION 2
typedef struct _SMC_CACHE_LIST_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_LIST_INFORMATION_VERSION
ULONG CacheCount : 8; // = 0
ULONG Spare : 16;
ULONG CacheId[16];
} SMC_CACHE_LIST_REQUEST, *PSMC_CACHE_LIST_REQUEST;
#define SYSTEM_CACHE_CREATE_INFORMATION_VERSION 3
typedef struct _SMC_CACHE_PARAMETERS
{
SIZE_T CacheFileSize;
ULONG StoreAlignment;
ULONG PerformsFileIo : 1;
ULONG VdlNotSet : 1;
ULONG Spare : 30;
ULONG CacheFlags;
ULONG Priority;
} SMC_CACHE_PARAMETERS, *PSMC_CACHE_PARAMETERS;
typedef struct _SMC_CACHE_CREATE_PARAMETERS
{
SMC_CACHE_PARAMETERS CacheParameters;
WCHAR TemplateFilePath[512];
} SMC_CACHE_CREATE_PARAMETERS, *PSMC_CACHE_CREATE_PARAMETERS;
typedef struct _SMC_CACHE_CREATE_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_CREATE_INFORMATION_VERSION
ULONG Spare : 24;
ULONG CacheId;
SMC_CACHE_CREATE_PARAMETERS CacheCreateParams;
} SMC_CACHE_CREATE_REQUEST, *PSMC_CACHE_CREATE_REQUEST;
#define SYSTEM_CACHE_DELETE_INFORMATION_VERSION 1
typedef struct _SMC_CACHE_DELETE_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_DELETE_INFORMATION_VERSION
ULONG Spare : 24;
ULONG CacheId;
} SMC_CACHE_DELETE_REQUEST, *PSMC_CACHE_DELETE_REQUEST;
#define SYSTEM_CACHE_STORE_CREATE_INFORMATION_VERSION 2
typedef enum _SM_STORE_MANAGER_TYPE
{
SmStoreManagerTypePhysical=0,
SmStoreManagerTypeVirtual=1,
SmStoreManagerTypeMax=2
} SM_STORE_MANAGER_TYPE;
typedef struct _SMC_STORE_CREATE_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_STORE_CREATE_INFORMATION_VERSION
ULONG Spare : 24;
SM_STORE_BASIC_PARAMS StoreParams;
ULONG CacheId;
SM_STORE_MANAGER_TYPE StoreManagerType;
ULONG StoreId;
} SMC_STORE_CREATE_REQUEST, *PSMC_STORE_CREATE_REQUEST;
#define SYSTEM_CACHE_STORE_DELETE_INFORMATION_VERSION 1
typedef struct _SMC_STORE_DELETE_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_STORE_DELETE_INFORMATION_VERSION
ULONG Spare : 24;
ULONG CacheId;
SM_STORE_MANAGER_TYPE StoreManagerType;
ULONG StoreId;
} SMC_STORE_DELETE_REQUEST, *PSMC_STORE_DELETE_REQUEST;
#define SYSTEM_CACHE_STATS_INFORMATION_VERSION 3
typedef struct _SMC_CACHE_STATS
{
SIZE_T TotalFileSize;
ULONG StoreCount;
ULONG RegionCount;
ULONG RegionSizeBytes;
ULONG FileCount : 6;
ULONG PerformsFileIo : 1;
ULONG Spare : 25;
ULONG StoreIds[16];
ULONG PhysicalStoreBitmap;
ULONG Priority;
WCHAR TemplateFilePath[512];
} SMC_CACHE_STATS, *PSMC_CACHE_STATS;
typedef struct _SMC_CACHE_STATS_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_STATS_INFORMATION_VERSION
ULONG NoFilePath : 1;
ULONG Spare : 23;
ULONG CacheId;
SMC_CACHE_STATS CacheStats;
} SMC_CACHE_STATS_REQUEST, *PSMC_CACHE_STATS_REQUEST;
#define SYSTEM_STORE_REGISTRATION_INFORMATION_VERSION 2
typedef struct _SM_REGISTRATION_INFO
{
HANDLE CachesUpdatedEvent;
} SM_REGISTRATION_INFO, PSM_REGISTRATION_INFO;
typedef struct _SM_REGISTRATION_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_REGISTRATION_INFORMATION_VERSION
ULONG Spare : 24;
SM_REGISTRATION_INFO RegInfo;
} SM_REGISTRATION_REQUEST, *PSM_REGISTRATION_REQUEST;
#define SYSTEM_STORE_RESIZE_INFORMATION_VERSION 6
typedef struct _SM_STORE_RESIZE_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_RESIZE_INFORMATION_VERSION
ULONG AddRegions : 1;
ULONG Spare : 23;
ULONG StoreId;
ULONG NumberOfRegions;
struct _RTL_BITMAP *RegionBitmap;
} SM_STORE_RESIZE_REQUEST, *PSM_STORE_RESIZE_REQUEST;
#define SYSTEM_CACHE_STORE_RESIZE_INFORMATION_VERSION 1
typedef struct _SMC_STORE_RESIZE_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_STORE_RESIZE_INFORMATION_VERSION
ULONG AddRegions : 1;
ULONG Spare : 23;
ULONG CacheId;
ULONG StoreId;
SM_STORE_MANAGER_TYPE StoreManagerType;
ULONG RegionCount;
} SMC_STORE_RESIZE_REQUEST, *PSMC_STORE_RESIZE_REQUEST;
#define SYSTEM_STORE_CONFIG_INFORMATION_VERSION 4
typedef enum _SM_CONFIG_TYPE
{
SmConfigDirtyPageCompression = 0,
SmConfigAsyncInswap = 1,
SmConfigPrefetchSeekThreshold = 2,
SmConfigTypeMax = 3
} SM_CONFIG_TYPE;
typedef struct _SM_CONFIG_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_CONFIG_INFORMATION_VERSION
ULONG Spare : 16;
ULONG ConfigType : 8; // SM_CONFIG_TYPE
ULONG ConfigValue;
} SM_CONFIG_REQUEST, *PSM_CONFIG_REQUEST;
#define SYSTEM_STORE_HIGH_MEM_PRIORITY_INFORMATION_VERSION 1
// rev
typedef struct _SM_STORE_HIGH_MEM_PRIORITY_REQUEST
{
ULONG Version : 8;
ULONG Version : 8; // SYSTEM_STORE_HIGH_MEM_PRIORITY_INFORMATION_VERSION
ULONG SetHighMemoryPriority : 1;
ULONG Spare : 23;
HANDLE ProcessHandle;
} SM_STORE_HIGH_MEM_PRIORITY_REQUEST, *PSM_STORE_HIGH_MEM_PRIORITY_REQUEST;
#define SYSTEM_STORE_TRIM_INFORMATION_VERSION 1
// rev
typedef struct _SM_SYSTEM_STORE_TRIM_REQUEST
{
ULONG Version : 8;
ULONG Version : 8; // SYSTEM_STORE_TRIM_INFORMATION_VERSION
ULONG Spare : 24;
SIZE_T PagesToTrim; // ULONG?
} SM_SYSTEM_STORE_TRIM_REQUEST, *PSM_SYSTEM_STORE_TRIM_REQUEST;
@@ -3032,13 +3433,13 @@ typedef struct _SM_SYSTEM_STORE_TRIM_REQUEST
// rev
typedef struct _SM_MEM_COMPRESSION_INFO_REQUEST
{
ULONG Version : 8;
ULONG Version : 8; // SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION
ULONG Spare : 24;
ULONG CompressionPid;
ULONG WorkingSetSize; // ULONGLONG?
ULONGLONG TotalDataCompressed;
ULONGLONG TotalCompressedSize;
ULONGLONG TotalUniqueDataCompressed;
ULONG WorkingSetSize;
SIZE_T TotalDataCompressed;
SIZE_T TotalCompressedSize;
SIZE_T TotalUniqueDataCompressed;
} SM_MEM_COMPRESSION_INFO_REQUEST, *PSM_MEM_COMPRESSION_INFO_REQUEST;
// private
@@ -3061,7 +3462,7 @@ typedef struct _SYSTEM_VHD_BOOT_INFORMATION
{
BOOLEAN OsDiskIsVhd;
ULONG OsVhdFilePathOffset;
WCHAR OsVhdParentVolume[ANYSIZE_ARRAY];
WCHAR OsVhdParentVolume[1];
} SYSTEM_VHD_BOOT_INFORMATION, *PSYSTEM_VHD_BOOT_INFORMATION;
// private
@@ -3667,7 +4068,7 @@ typedef struct _SYSTEM_HYPERVISOR_DETAIL_INFORMATION
// private
typedef struct _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION
{
ULONGLONG Cycles[2][4];
ULONGLONG Cycles[4][2];
} SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION, *PSYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION;
// private
@@ -4407,7 +4808,8 @@ typedef union _SYSDBG_LIVEDUMP_CONTROL_FLAGS
ULONG CompressMemoryPagesData : 1;
ULONG IncludeUserSpaceMemoryPages : 1;
ULONG AbortIfMemoryPressure : 1; // REDSTONE4
ULONG Reserved : 28;
ULONG SelectiveDump : 1; // WIN11
ULONG Reserved : 27;
};
ULONG AsUlong;
} SYSDBG_LIVEDUMP_CONTROL_FLAGS, *PSYSDBG_LIVEDUMP_CONTROL_FLAGS;
@@ -4418,12 +4820,31 @@ typedef union _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES
struct
{
ULONG HypervisorPages : 1;
ULONG Reserved : 31;
ULONG NonEssentialHypervisorPages : 1; // WIN11
ULONG Reserved : 30;
};
ULONG AsUlong;
} SYSDBG_LIVEDUMP_CONTROL_ADDPAGES, *PSYSDBG_LIVEDUMP_CONTROL_ADDPAGES;
// rev
typedef struct _SYSDBG_LIVEDUMP_SELECTIVE_CONTROL
{
ULONG Version;
ULONG Size;
union
{
ULONGLONG Flags;
struct
{
ULONGLONG ThreadKernelStacks : 1;
ULONGLONG ReservedFlags : 63;
};
};
ULONGLONG Reserved[4];
} SYSDBG_LIVEDUMP_SELECTIVE_CONTROL, *PSYSDBG_LIVEDUMP_SELECTIVE_CONTROL;
#define SYSDBG_LIVEDUMP_CONTROL_VERSION 1
#define SYSDBG_LIVEDUMP_CONTROL_VERSION_WIN11 2
// private
typedef struct _SYSDBG_LIVEDUMP_CONTROL
@@ -4438,6 +4859,7 @@ typedef struct _SYSDBG_LIVEDUMP_CONTROL
HANDLE CancelEventHandle;
SYSDBG_LIVEDUMP_CONTROL_FLAGS Flags;
SYSDBG_LIVEDUMP_CONTROL_ADDPAGES AddPagesControl;
PSYSDBG_LIVEDUMP_SELECTIVE_CONTROL SelectiveControl; // WIN11
} SYSDBG_LIVEDUMP_CONTROL, *PSYSDBG_LIVEDUMP_CONTROL;
// private
@@ -5019,6 +5441,7 @@ NtQueryInformationAtom(
#define FLG_HEAP_VALIDATE_ALL 0x00000080 // u
#define FLG_APPLICATION_VERIFIER 0x00000100 // u
#define FLG_MONITOR_SILENT_PROCESS_EXIT 0x00000200 // uk
#define FLG_POOL_ENABLE_TAGGING 0x00000400 // k
#define FLG_HEAP_ENABLE_TAGGING 0x00000800 // u
@@ -5043,7 +5466,7 @@ NtQueryInformationAtom(
#define FLG_DISABLE_DBGPRINT 0x08000000 // k
#define FLG_CRITSEC_EVENT_CREATION 0x10000000 // u
#define FLG_LDR_TOP_DOWN 0x20000000 // u,64
#define FLG_STOP_ON_UNHANDLED_EXCEPTION 0x20000000 // u,64
#define FLG_ENABLE_HANDLE_EXCEPTIONS 0x40000000 // k
#define FLG_DISABLE_PROTDLLS 0x80000000 // u
@@ -5111,7 +5534,8 @@ typedef enum _SHUTDOWN_ACTION
{
ShutdownNoReboot,
ShutdownReboot,
ShutdownPowerOff
ShutdownPowerOff,
ShutdownRebootForRecovery // since WIN11
} SHUTDOWN_ACTION;
NTSYSCALLAPI
ntioapi.h
+3 -1
View File
@@ -1662,7 +1662,9 @@ NtNotifyChangeDirectoryFile(
typedef enum _DIRECTORY_NOTIFY_INFORMATION_CLASS
{
DirectoryNotifyInformation = 1, // FILE_NOTIFY_INFORMATION
DirectoryNotifyExtendedInformation = 2 // FILE_NOTIFY_EXTENDED_INFORMATION
DirectoryNotifyExtendedInformation, // FILE_NOTIFY_EXTENDED_INFORMATION
DirectoryNotifyFullInformation, // since 22H2
DirectoryNotifyMaximumInformation
} DIRECTORY_NOTIFY_INFORMATION_CLASS, *PDIRECTORY_NOTIFY_INFORMATION_CLASS;
#if (PHNT_VERSION >= PHNT_REDSTONE3)
ntldr.h
+21 -18
View File
@@ -109,28 +109,31 @@ typedef enum _LDR_HOT_PATCH_STATE
LdrHotPatchStateMax,
} LDR_HOT_PATCH_STATE, *PLDR_HOT_PATCH_STATE;
// LDR_DATA_TABLE_ENTRY->Flags
#define LDRP_PACKAGED_BINARY 0x00000001
#define LDRP_STATIC_LINK 0x00000002
#define LDRP_MARKED_FOR_REMOVAL 0x00000002
#define LDRP_IMAGE_DLL 0x00000004
#define LDRP_LOAD_NOTIFICATIONS_SENT 0x00000008
#define LDRP_TELEMETRY_ENTRY_PROCESSED 0x00000010
#define LDRP_PROCESS_STATIC_IMPORT 0x00000020
#define LDRP_IN_LEGACY_LISTS 0x00000040
#define LDRP_IN_INDEXES 0x00000080
#define LDRP_SHIM_DLL 0x00000100
#define LDRP_IN_EXCEPTION_TABLE 0x00000200
#define LDRP_LOAD_IN_PROGRESS 0x00001000
#define LDRP_UNLOAD_IN_PROGRESS 0x00002000
#define LDRP_LOAD_CONFIG_PROCESSED 0x00002000
#define LDRP_ENTRY_PROCESSED 0x00004000
#define LDRP_ENTRY_INSERTED 0x00008000
#define LDRP_CURRENT_LOAD 0x00010000
#define LDRP_FAILED_BUILTIN_LOAD 0x00020000
#define LDRP_PROTECT_DELAY_LOAD 0x00008000
#define LDRP_DONT_CALL_FOR_THREADS 0x00040000
#define LDRP_PROCESS_ATTACH_CALLED 0x00080000
#define LDRP_DEBUG_SYMBOLS_LOADED 0x00100000
#define LDRP_IMAGE_NOT_AT_BASE 0x00200000 // Vista and below
#define LDRP_PROCESS_ATTACH_FAILED 0x00100000
#define LDRP_COR_DEFERRED_VALIDATE 0x00200000
#define LDRP_COR_IMAGE 0x00400000
#define LDRP_DONT_RELOCATE 0x00800000 // LDR_COR_OWNS_UNMAP
#define LDRP_SYSTEM_MAPPED 0x01000000
#define LDRP_IMAGE_VERIFYING 0x02000000
#define LDRP_DRIVER_DEPENDENT_DLL 0x04000000
#define LDRP_ENTRY_NATIVE 0x08000000
#define LDRP_DONT_RELOCATE 0x00800000
#define LDRP_COR_IL_ONLY 0x01000000
#define LDRP_CHPE_IMAGE 0x02000000
#define LDRP_CHPE_EMULATOR_IMAGE 0x04000000
#define LDRP_REDIRECTED 0x10000000
#define LDRP_NON_PAGED_DEBUG_INFO 0x20000000
#define LDRP_MM_LOADED 0x40000000
#define LDRP_COMPAT_DATABASE_PROCESSED 0x80000000
#define LDR_DATA_TABLE_ENTRY_SIZE_WINXP FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, DdagNode)
@@ -207,9 +210,9 @@ typedef struct _LDR_DATA_TABLE_ENTRY
ULONG_PTR OriginalBase;
LARGE_INTEGER LoadTime;
ULONG BaseNameHashValue;
LDR_DLL_LOAD_REASON LoadReason;
LDR_DLL_LOAD_REASON LoadReason; // since WIN8
ULONG ImplicitPathOptions;
ULONG ReferenceCount;
ULONG ReferenceCount; // since WIN10
ULONG DependentLoadFlags;
UCHAR SigningLevel; // since REDSTONE2
ULONG CheckSum; // since 22H1
@@ -610,7 +613,7 @@ typedef struct _PS_SYSTEM_DLL_INIT_BLOCK
ULONG Size;
ULONG_PTR SystemDllWowRelocation;
ULONG_PTR SystemDllNativeRelocation;
ULONG_PTR Wow64SharedInformation[16];
ULONG_PTR Wow64SharedInformation[16]; // use WOW64_SHARED_INFORMATION as index
ULONG RngData;
union
{
@@ -647,7 +650,7 @@ LdrAddLoadAsDataTable(
_In_ PWSTR FilePath,
_In_ SIZE_T Size,
_In_ HANDLE Handle,
_In_ HANDLE ActCtx // param added on Win10
_In_opt_ HANDLE ActCtx
);
// private
ntmmapi.h
+3 -3
View File
@@ -91,8 +91,8 @@ typedef enum _MEMORY_INFORMATION_CLASS
MemoryWorkingSetInformation, // MEMORY_WORKING_SET_INFORMATION
MemoryMappedFilenameInformation, // UNICODE_STRING
MemoryRegionInformation, // MEMORY_REGION_INFORMATION
MemoryWorkingSetExInformation, // MEMORY_WORKING_SET_EX_INFORMATION
MemorySharedCommitInformation, // MEMORY_SHARED_COMMIT_INFORMATION
MemoryWorkingSetExInformation, // MEMORY_WORKING_SET_EX_INFORMATION // since VISTA
MemorySharedCommitInformation, // MEMORY_SHARED_COMMIT_INFORMATION // since WIN8
MemoryImageInformation, // MEMORY_IMAGE_INFORMATION
MemoryRegionInformationEx, // MEMORY_REGION_INFORMATION
MemoryPrivilegedBasicInformation,
@@ -426,7 +426,7 @@ typedef enum _SECTION_INFORMATION_CLASS
{
SectionBasicInformation, // q; SECTION_BASIC_INFORMATION
SectionImageInformation, // q; SECTION_IMAGE_INFORMATION
SectionRelocationInformation, // q; PVOID RelocationAddress // name:wow64:whNtQuerySection_SectionRelocationInformation
SectionRelocationInformation, // q; PVOID RelocationAddress // name:wow64:whNtQuerySection_SectionRelocationInformation // since WIN7
SectionOriginalBaseInformation, // PVOID BaseAddress
SectionInternalImageInformation, // SECTION_INTERNAL_IMAGE_INFORMATION // since REDSTONE2
MaxSectionInfoClass
ntpebteb.h
+1 -1
View File
@@ -161,7 +161,7 @@ typedef struct _PEB
ULONG ImageSubsystem;
ULONG ImageSubsystemMajorVersion;
ULONG ImageSubsystemMinorVersion;
ULONG_PTR ActiveProcessAffinityMask;
KAFFINITY ActiveProcessAffinityMask;
GDI_HANDLE_BUFFER GdiHandleBuffer;
PVOID PostProcessInitRoutine;
ntpsapi.h
+256 -60
View File
@@ -134,7 +134,7 @@ typedef enum _PROCESSINFOCLASS
ProcessPriorityClass, // qs: PROCESS_PRIORITY_CLASS
ProcessWx86Information, // qs: ULONG (requires SeTcbPrivilege) (VdmAllowed)
ProcessHandleCount, // q: ULONG, PROCESS_HANDLE_INFORMATION // 20
ProcessAffinityMask, // s: KAFFINITY
ProcessAffinityMask, // qs: KAFFINITY, qs: GROUP_AFFINITY
ProcessPriorityBoost, // qs: ULONG
ProcessDeviceMap, // qs: PROCESS_DEVICEMAP_INFORMATION, PROCESS_DEVICEMAP_INFORMATION_EX
ProcessSessionInformation, // q: PROCESS_SESSION_INFORMATION
@@ -179,8 +179,8 @@ typedef enum _PROCESSINFOCLASS
ProcessFaultInformation, // PROCESS_FAULT_INFORMATION
ProcessTelemetryIdInformation, // q: PROCESS_TELEMETRY_ID_INFORMATION
ProcessCommitReleaseInformation, // PROCESS_COMMIT_RELEASE_INFORMATION
ProcessDefaultCpuSetsInformation,
ProcessAllowedCpuSetsInformation,
ProcessDefaultCpuSetsInformation, // SYSTEM_CPU_SET_INFORMATION[5]
ProcessAllowedCpuSetsInformation, // SYSTEM_CPU_SET_INFORMATION[5]
ProcessSubsystemProcess,
ProcessJobMemoryInformation, // q: PROCESS_JOB_MEMORY_INFO
ProcessInPrivate, // s: void // ETW // since THRESHOLD2 // 70
@@ -235,7 +235,7 @@ typedef enum _THREADINFOCLASS
ThreadBasicInformation, // q: THREAD_BASIC_INFORMATION
ThreadTimes, // q: KERNEL_USER_TIMES
ThreadPriority, // s: KPRIORITY (requires SeIncreaseBasePriorityPrivilege)
ThreadBasePriority, // s: LONG
ThreadBasePriority, // s: KPRIORITY
ThreadAffinityMask, // s: KAFFINITY
ThreadImpersonationToken, // s: HANDLE
ThreadDescriptorTableEntry, // q: DESCRIPTOR_TABLE_ENTRY (or WOW64_DESCRIPTOR_TABLE_ENTRY)
@@ -262,10 +262,10 @@ typedef enum _THREADINFOCLASS
ThreadCSwitchMon,
ThreadCSwitchPmu,
ThreadWow64Context, // qs: WOW64_CONTEXT
ThreadGroupInformation, // q: GROUP_AFFINITY // 30
ThreadGroupInformation, // qs: GROUP_AFFINITY // 30
ThreadUmsInformation, // q: THREAD_UMS_INFORMATION
ThreadCounterProfiling, // q: BOOLEAN; s: THREAD_PROFILING_INFORMATION?
ThreadIdealProcessorEx, // q: PROCESSOR_NUMBER
ThreadIdealProcessorEx, // qs: PROCESSOR_NUMBER; s: previous PROCESSOR_NUMBER on return
ThreadCpuAccountingInformation, // q: BOOLEAN; s: HANDLE (NtOpenSession) // NtCurrentThread // since WIN8
ThreadSuspendCount, // q: ULONG // since WINBLUE
ThreadHeterogeneousCpuPolicy, // q: KHETERO_CPU_POLICY // since THRESHOLD
@@ -308,7 +308,7 @@ typedef struct _PROCESS_BASIC_INFORMATION
{
NTSTATUS ExitStatus;
PPEB PebBaseAddress;
ULONG_PTR AffinityMask;
KAFFINITY AffinityMask;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
HANDLE InheritedFromUniqueProcessId;
@@ -663,6 +663,20 @@ typedef struct _PROCESS_HANDLE_SNAPSHOT_INFORMATION
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#if !defined(NTDDI_WIN10_CO) || (NTDDI_VERSION < NTDDI_WIN10_CO)
typedef struct _PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY
{
union {
ULONG Flags;
struct {
ULONG EnforceRedirectionTrust : 1;
ULONG AuditRedirectionTrust : 1;
ULONG ReservedFlags : 30;
};
};
} PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY, * PPROCESS_MITIGATION_REDIRECTION_TRUST_POLICY;
#endif
// private
typedef struct _PROCESS_MITIGATION_POLICY_INFORMATION
{
@@ -838,6 +852,11 @@ typedef struct _POWER_THROTTLING_PROCESS_STATE
ULONG StateMask;
} POWER_THROTTLING_PROCESS_STATE, *PPOWER_THROTTLING_PROCESS_STATE;
// rev (tyranid)
#define WIN32K_SYSCALL_FILTER_STATE_ENABLE 0x1
#define WIN32K_SYSCALL_FILTER_STATE_AUDIT 0x2
// private
typedef struct _WIN32K_SYSCALL_FILTER
{
ULONG FilterState;
@@ -1000,9 +1019,9 @@ typedef struct _THREAD_BASIC_INFORMATION
NTSTATUS ExitStatus;
PTEB TebBaseAddress;
CLIENT_ID ClientId;
ULONG_PTR AffinityMask;
KAFFINITY AffinityMask;
KPRIORITY Priority;
LONG BasePriority;
KPRIORITY BasePriority;
} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
// private
@@ -1206,7 +1225,11 @@ NtCreateProcess(
#define PROCESS_CREATE_FLAGS_FORCE_BREAKAWAY 0x00000400 // NtCreateProcessEx & NtCreateUserProcess, requires SeTcb
#define PROCESS_CREATE_FLAGS_MINIMAL_PROCESS 0x00000800 // NtCreateProcessEx only
#define PROCESS_CREATE_FLAGS_RELEASE_SECTION 0x00001000 // NtCreateProcessEx & NtCreateUserProcess
#define PROCESS_CREATE_FLAGS_CLONE_MINIMAL 0x00002000 // NtCreateProcessEx only
#define PROCESS_CREATE_FLAGS_CLONE_MINIMAL_REDUCED_COMMIT 0x00004000 //
#define PROCESS_CREATE_FLAGS_AUXILIARY_PROCESS 0x00008000 // NtCreateProcessEx & NtCreateUserProcess, requires SeTcb
#define PROCESS_CREATE_FLAGS_CREATE_STORE 0x00020000 // NtCreateProcessEx & NtCreateUserProcess
#define PROCESS_CREATE_FLAGS_USE_PROTECTED_ENVIRONMENT 0x00040000 // NtCreateProcessEx & NtCreateUserProcess
// end_rev
NTSYSCALLAPI
@@ -1559,6 +1582,12 @@ typedef VOID (*PPS_APC_ROUTINE)(
_In_opt_ PVOID ApcArgument3
);
#define Wow64EncodeApcRoutine(ApcRoutine) \
((PVOID)((0 - ((LONG_PTR)(ApcRoutine))) << 2))
#define Wow64DecodeApcRoutine(ApcRoutine) \
((PVOID)(0 - (((LONG_PTR)(ApcRoutine)) >> 2)))
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1588,6 +1617,15 @@ NtQueueApcThreadEx(
#endif
#if (PHNT_VERSION >= PHNT_WIN11)
#if !defined(NTDDI_WIN10_CO) || (NTDDI_VERSION < NTDDI_WIN10_CO)
typedef enum _QUEUE_USER_APC_FLAGS
{
QUEUE_USER_APC_FLAGS_NONE = 0x0,
QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC = 0x1,
} QUEUE_USER_APC_FLAGS;
#endif
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1600,6 +1638,7 @@ NtQueueApcThreadEx2(
_In_opt_ PVOID ApcArgument2,
_In_opt_ PVOID ApcArgument3
);
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
@@ -1629,52 +1668,120 @@ NtWaitForAlertByThreadId(
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// Attributes
// Attributes (Win32 CreateProcess)
// private
#define PS_ATTRIBUTE_NUMBER_MASK 0x0000ffff
#define PS_ATTRIBUTE_THREAD 0x00010000 // may be used with thread creation
#define PS_ATTRIBUTE_INPUT 0x00020000 // input only
#define PS_ATTRIBUTE_ADDITIVE 0x00040000 // "accumulated" e.g. bitmasks, counters, etc.
// PROC_THREAD_ATTRIBUTE_NUM (Win32 CreateProcess) (dmex)
// PROC_THREAD_ATTRIBUTE_NUM (dmex)
#define ProcThreadAttributeParentProcess 0 // in HANDLE
#define ProcThreadAttributeExtendedFlags 1 // in ULONG (PROC_EXTENDED_FLAG)
#define ProcThreadAttributeExtendedFlags 1 // in ULONG (EXTENDED_PROCESS_CREATION_FLAG_*)
#define ProcThreadAttributeHandleList 2 // in HANDLE[]
#define ProcThreadAttributeGroupAffinity 3 // in GROUP_AFFINITY // since WIN7
#define ProcThreadAttributePreferredNode 4 // in USHORT
#define ProcThreadAttributeIdealProcessor 5// in PROCESSOR_NUMBER
#define ProcThreadAttributeIdealProcessor 5 // in PROCESSOR_NUMBER
#define ProcThreadAttributeUmsThread 6 // in UMS_CREATE_THREAD_ATTRIBUTES
#define ProcThreadAttributeMitigationPolicy 7 // in ULONG[] or ULONG64[]
#define ProcThreadAttributePackageName 8 // in WCHAR[] // since WIN8
#define ProcThreadAttributeMitigationPolicy 7 // in ULONG, ULONG64, or ULONG64[2]
#define ProcThreadAttributePackageFullName 8 // in WCHAR[] // since WIN8
#define ProcThreadAttributeSecurityCapabilities 9 // in SECURITY_CAPABILITIES
#define ProcThreadAttributeConsoleReference 10 // BaseGetConsoleReference (kernelbase.dll)
#define ProcThreadAttributeProtectionLevel 11 // in ULONG
#define ProcThreadAttributeJobList 13 // in HANDLE[] // since WIN10
#define ProcThreadAttributeChildProcessPolicy 14 // in ULONG
#define ProcThreadAttributeAllApplicationPackagesPolicy 15 // in ULONG
#define ProcThreadAttributeWin32kFilter 16 // in PROC_THREAD_WIN32KFILTER_ATTRIBUTE
#define ProcThreadAttributeSafeOpenPromptOriginClaim 17 // since RS1
#define ProcThreadAttributeDesktopAppPolicy 18 // in ULONG // since RS2
#define ProcThreadAttributeProtectionLevel 11 // in ULONG (PROTECTION_LEVEL_*) // since WINBLUE
#define ProcThreadAttributeOsMaxVersionTested 12 // in MAXVERSIONTESTED_INFO // since THRESHOLD // (from exe.manifest)
#define ProcThreadAttributeJobList 13 // in HANDLE[]
#define ProcThreadAttributeChildProcessPolicy 14 // in ULONG (PROCESS_CREATION_CHILD_PROCESS_*) // since THRESHOLD2
#define ProcThreadAttributeAllApplicationPackagesPolicy 15 // in ULONG (PROCESS_CREATION_ALL_APPLICATION_PACKAGES_*) // since REDSTONE
#define ProcThreadAttributeWin32kFilter 16 // in WIN32K_SYSCALL_FILTER
#define ProcThreadAttributeSafeOpenPromptOriginClaim 17 // in SE_SAFE_OPEN_PROMPT_RESULTS
#define ProcThreadAttributeDesktopAppPolicy 18 // in ULONG (PROCESS_CREATION_DESKTOP_APP_*) // since RS2
#define ProcThreadAttributeBnoIsolation 19 // in PROC_THREAD_BNOISOLATION_ATTRIBUTE
#define ProcThreadAttributePseudoConsole 22 // in HANDLE (HPCON) // since RS5
#define ProcThreadAttributeMitigationAuditPolicy 24 // in ULONG[] or ULONG64[] // since 20H1
#define ProcThreadAttributeMachineType 25 // in ULONG
#define ProcThreadAttributeIsolationManifest 23 // in ISOLATION_MANIFEST_PROPERTIES // rev (diversenok) // since 19H2+
#define ProcThreadAttributeMitigationAuditPolicy 24 // in ULONG, ULONG64, or ULONG64[2] // since 21H1
#define ProcThreadAttributeMachineType 25 // in USHORT // since 21H2
#define ProcThreadAttributeComponentFilter 26 // in ULONG
#define ProcThreadAttributeEnableOptionalXStateFeatures 27 // in ULONG // since 20H2
#define ProcThreadAttributeEnableOptionalXStateFeatures 27 // in ULONG64 // since WIN11
#define ProcThreadAttributeCreateStore 28 // ULONG // rev (diversenok)
#define PROC_EXTENDED_FLAG_LOG_ELEVATION_FAILURE 0x1
#define PROC_EXTENDED_FLAG_IGNORE_ELEVATION 0x2
#define PROC_EXTENDED_FLAG_FORCE_JOB_BREAKAWAY 0x4 // (requires SeTcbPrivilege)
#ifndef PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS
#define PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS \
ProcThreadAttributeValue(ProcThreadAttributeExtendedFlags, FALSE, TRUE, TRUE)
#endif
#ifndef PROC_THREAD_ATTRIBUTE_PACKAGE_FULL_NAME
#define PROC_THREAD_ATTRIBUTE_PACKAGE_FULL_NAME \
ProcThreadAttributeValue(ProcThreadAttributePackageFullName, FALSE, TRUE, FALSE)
#endif
#ifndef PROC_THREAD_ATTRIBUTE_CONSOLE_REFERENCE
#define PROC_THREAD_ATTRIBUTE_CONSOLE_REFERENCE \
ProcThreadAttributeValue(ProcThreadAttributeConsoleReference, FALSE, TRUE, FALSE)
#endif
#ifndef PROC_THREAD_ATTRIBUTE_OSMAXVERSIONTESTED
#define PROC_THREAD_ATTRIBUTE_OSMAXVERSIONTESTED \
ProcThreadAttributeValue(ProcThreadAttributeOsMaxVersionTested, FALSE, TRUE, FALSE)
#endif
#ifndef PROC_THREAD_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM
#define PROC_THREAD_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM \
ProcThreadAttributeValue(ProcThreadAttributeSafeOpenPromptOriginClaim, FALSE, TRUE, FALSE)
#endif
#ifndef PROC_THREAD_ATTRIBUTE_BNO_ISOLATION
#define PROC_THREAD_ATTRIBUTE_BNO_ISOLATION \
ProcThreadAttributeValue(ProcThreadAttributeBnoIsolation, FALSE, TRUE, FALSE)
#endif
#ifndef PROC_THREAD_ATTRIBUTE_ISOLATION_MANIFEST
#define PROC_THREAD_ATTRIBUTE_ISOLATION_MANIFEST \
ProcThreadAttributeValue(ProcThreadAttributeIsolationManifest, FALSE, TRUE, FALSE)
#endif
#ifndef PROC_THREAD_ATTRIBUTE_CREATE_STORE
#define PROC_THREAD_ATTRIBUTE_CREATE_STORE \
ProcThreadAttributeValue(ProcThreadAttributeCreateStore, FALSE, TRUE, FALSE)
#endif
#define WIN32KFILTER_FLAG_ENABLE 0x1
#define WIN32KFILTER_FLAG_AUDIT 0x2
// private
typedef struct _PROC_THREAD_ATTRIBUTE {
ULONG_PTR Attribute;
SIZE_T Size;
ULONG_PTR Value;
} PROC_THREAD_ATTRIBUTE, *PPROC_THREAD_ATTRIBUTE;
typedef struct _PROC_THREAD_WIN32KFILTER_ATTRIBUTE
{
ULONG Flags;
ULONG FilterLevel;
} PROC_THREAD_WIN32KFILTER_ATTRIBUTE, *PPROC_THREAD_WIN32KFILTER_ATTRIBUTE;
// private
typedef struct _PROC_THREAD_ATTRIBUTE_LIST {
ULONG PresentFlags;
ULONG AttributeCount;
ULONG LastAttribute;
ULONG SpareUlong0;
PPROC_THREAD_ATTRIBUTE ExtendedFlagsAttribute;
PROC_THREAD_ATTRIBUTE Attributes[1];
} PROC_THREAD_ATTRIBUTE_LIST;
// private
#define EXTENDED_PROCESS_CREATION_FLAG_ELEVATION_HANDLED 0x00000001
#define EXTENDED_PROCESS_CREATION_FLAG_FORCELUA 0x00000002
#define EXTENDED_PROCESS_CREATION_FLAG_FORCE_BREAKAWAY 0x00000004 // requires SeTcbPrivilege // since WINBLUE
// private
#define PROTECTION_LEVEL_WINTCB_LIGHT 0x00000000
#define PROTECTION_LEVEL_WINDOWS 0x00000001
#define PROTECTION_LEVEL_WINDOWS_LIGHT 0x00000002
#define PROTECTION_LEVEL_ANTIMALWARE_LIGHT 0x00000003
#define PROTECTION_LEVEL_LSA_LIGHT 0x00000004
#define PROTECTION_LEVEL_WINTCB 0x00000005
#define PROTECTION_LEVEL_CODEGEN_LIGHT 0x00000006
#define PROTECTION_LEVEL_AUTHENTICODE 0x00000007
// private
typedef enum _SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS {
SeSafeOpenExperienceNone = 0x00,
SeSafeOpenExperienceCalled = 0x01,
SeSafeOpenExperienceAppRepCalled = 0x02,
SeSafeOpenExperiencePromptDisplayed = 0x04,
SeSafeOpenExperienceUAC = 0x08,
SeSafeOpenExperienceUninstaller = 0x10,
SeSafeOpenExperienceIgnoreUnknownOrBad = 0x20,
SeSafeOpenExperienceDefenderTrustedInstaller = 0x40,
SeSafeOpenExperienceMOTWPresent = 0x80
} SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS;
// private
typedef struct _SE_SAFE_OPEN_PROMPT_RESULTS {
SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS Results;
WCHAR Path[MAX_PATH];
} SE_SAFE_OPEN_PROMPT_RESULTS, *PSE_SAFE_OPEN_PROMPT_RESULTS;
typedef struct _PROC_THREAD_BNOISOLATION_ATTRIBUTE
{
@@ -1682,6 +1789,14 @@ typedef struct _PROC_THREAD_BNOISOLATION_ATTRIBUTE
WCHAR IsolationPrefix[0x88];
} PROC_THREAD_BNOISOLATION_ATTRIBUTE, *PPROC_THREAD_BNOISOLATION_ATTRIBUTE;
// private
typedef struct _ISOLATION_MANIFEST_PROPERTIES {
UNICODE_STRING InstancePath;
UNICODE_STRING FriendlyName;
UNICODE_STRING Description;
ULONG_PTR Level;
} ISOLATION_MANIFEST_PROPERTIES, *PISOLATION_MANIFEST_PROPERTIES;
#ifndef PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS
#define PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS \
ProcThreadAttributeValue(ProcThreadAttributeExtendedFlags, FALSE, TRUE, TRUE)
@@ -1690,6 +1805,10 @@ typedef struct _PROC_THREAD_BNOISOLATION_ATTRIBUTE
#define PROC_THREAD_ATTRIBUTE_CONSOLE_REFERENCE \
ProcThreadAttributeValue(ProcThreadAttributeConsoleReference, FALSE, TRUE, FALSE)
#endif
#ifndef PROC_THREAD_ATTRIBUTE_OSMAXVERSIONTESTED
#define PROC_THREAD_ATTRIBUTE_OSMAXVERSIONTESTED \
ProcThreadAttributeValue(ProcThreadAttributeOsMaxVersionTested, FALSE, TRUE, FALSE)
#endif
#ifndef PROC_THREAD_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM
#define PROC_THREAD_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM \
ProcThreadAttributeValue(ProcThreadAttributeSafeOpenPromptOriginClaim, FALSE, TRUE, FALSE)
@@ -1699,11 +1818,13 @@ typedef struct _PROC_THREAD_BNOISOLATION_ATTRIBUTE
ProcThreadAttributeValue(ProcThreadAttributeBnoIsolation, FALSE, TRUE, FALSE)
#endif
// Attributes (Native)
// private
typedef enum _PS_ATTRIBUTE_NUM
{
PsAttributeParentProcess, // in HANDLE
PsAttributeDebugPort, // in HANDLE
PsAttributeDebugObject, // in HANDLE
PsAttributeToken, // in HANDLE
PsAttributeClientId, // out PCLIENT_ID
PsAttributeTebAddress, // out PTEB *
@@ -1713,29 +1834,35 @@ typedef enum _PS_ATTRIBUTE_NUM
PsAttributePriorityClass, // in UCHAR
PsAttributeErrorMode, // in ULONG
PsAttributeStdHandleInfo, // 10, in PPS_STD_HANDLE_INFO
PsAttributeHandleList, // in PHANDLE
PsAttributeHandleList, // in HANDLE[]
PsAttributeGroupAffinity, // in PGROUP_AFFINITY
PsAttributePreferredNode, // in PUSHORT
PsAttributeIdealProcessor, // in PPROCESSOR_NUMBER
PsAttributeUmsThread, // ? in PUMS_CREATE_THREAD_ATTRIBUTES
PsAttributeMitigationOptions, // in UCHAR
PsAttributeProtectionLevel, // in ULONG
PsAttributeSecureProcess, // since THRESHOLD
PsAttributeJobList,
PsAttributeChildProcessPolicy, // since THRESHOLD2
PsAttributeAllApplicationPackagesPolicy, // since REDSTONE
PsAttributeWin32kFilter,
PsAttributeSafeOpenPromptOriginClaim,
PsAttributeBnoIsolation, // PS_BNO_ISOLATION_PARAMETERS
PsAttributeDesktopAppPolicy, // in ULONG
PsAttributeChpe, // since REDSTONE3
PsAttributeMitigationAuditOptions, // since 21H1
PsAttributeMachineType, // since WIN11
PsAttributeMitigationOptions, // in PPS_MITIGATION_OPTIONS_MAP (PROCESS_CREATION_MITIGATION_POLICY_*) // since WIN8
PsAttributeProtectionLevel, // in PS_PROTECTION // since WINBLUE
PsAttributeSecureProcess, // in PPS_TRUSTLET_CREATE_ATTRIBUTES, since THRESHOLD
PsAttributeJobList, // in HANDLE[]
PsAttributeChildProcessPolicy, // 20, in PULONG (PROCESS_CREATION_CHILD_PROCESS_*) // since THRESHOLD2
PsAttributeAllApplicationPackagesPolicy, // in PULONG (PROCESS_CREATION_ALL_APPLICATION_PACKAGES_*) // since REDSTONE
PsAttributeWin32kFilter, // in PWIN32K_SYSCALL_FILTER
PsAttributeSafeOpenPromptOriginClaim, // in
PsAttributeBnoIsolation, // in PPS_BNO_ISOLATION_PARAMETERS // since REDSTONE2
PsAttributeDesktopAppPolicy, // in PULONG (PROCESS_CREATION_DESKTOP_APP_*)
PsAttributeChpe, // in BOOLEAN // since REDSTONE3
PsAttributeMitigationAuditOptions, // in PPS_MITIGATION_AUDIT_OPTIONS_MAP (PROCESS_CREATION_MITIGATION_AUDIT_POLICY_*) // since 21H1
PsAttributeMachineType, // in WORD // since 21H2
PsAttributeComponentFilter,
PsAttributeEnableOptionalXStateFeatures,
PsAttributeEnableOptionalXStateFeatures, // since WIN11
PsAttributeMax
} PS_ATTRIBUTE_NUM;
// private
#define PS_ATTRIBUTE_NUMBER_MASK 0x0000ffff
#define PS_ATTRIBUTE_THREAD 0x00010000 // may be used with thread creation
#define PS_ATTRIBUTE_INPUT 0x00020000 // input only
#define PS_ATTRIBUTE_ADDITIVE 0x00040000 // "accumulated" e.g. bitmasks, counters, etc.
// begin_rev
#define PsAttributeValue(Number, Thread, Input, Additive) \
@@ -1746,8 +1873,8 @@ typedef enum _PS_ATTRIBUTE_NUM
#define PS_ATTRIBUTE_PARENT_PROCESS \
PsAttributeValue(PsAttributeParentProcess, FALSE, TRUE, TRUE)
#define PS_ATTRIBUTE_DEBUG_PORT \
PsAttributeValue(PsAttributeDebugPort, FALSE, TRUE, TRUE)
#define PS_ATTRIBUTE_DEBUG_OBJECT \
PsAttributeValue(PsAttributeDebugObject, FALSE, TRUE, TRUE)
#define PS_ATTRIBUTE_TOKEN \
PsAttributeValue(PsAttributeToken, FALSE, TRUE, TRUE)
#define PS_ATTRIBUTE_CLIENT_ID \
@@ -1777,7 +1904,7 @@ typedef enum _PS_ATTRIBUTE_NUM
#define PS_ATTRIBUTE_UMS_THREAD \
PsAttributeValue(PsAttributeUmsThread, TRUE, TRUE, FALSE)
#define PS_ATTRIBUTE_MITIGATION_OPTIONS \
PsAttributeValue(PsAttributeMitigationOptions, FALSE, TRUE, TRUE)
PsAttributeValue(PsAttributeMitigationOptions, FALSE, TRUE, FALSE)
#define PS_ATTRIBUTE_PROTECTION_LEVEL \
PsAttributeValue(PsAttributeProtectionLevel, FALSE, TRUE, TRUE)
#define PS_ATTRIBUTE_SECURE_PROCESS \
@@ -1796,6 +1923,16 @@ typedef enum _PS_ATTRIBUTE_NUM
PsAttributeValue(PsAttributeBnoIsolation, FALSE, TRUE, FALSE)
#define PS_ATTRIBUTE_DESKTOP_APP_POLICY \
PsAttributeValue(PsAttributeDesktopAppPolicy, FALSE, TRUE, FALSE)
#define PS_ATTRIBUTE_CHPE \
PsAttributeValue(PsAttributeChpe, FALSE, TRUE, TRUE)
#define PS_ATTRIBUTE_MITIGATION_AUDIT_OPTIONS \
PsAttributeValue(PsAttributeMitigationAuditOptions, FALSE, TRUE, FALSE)
#define PS_ATTRIBUTE_MACHINE_TYPE \
PsAttributeValue(PsAttributeMachineType, FALSE, TRUE, TRUE)
#define PS_ATTRIBUTE_COMPONENT_FILTER \
PsAttributeValue(PsAttributeComponentFilter, FALSE, TRUE, FALSE)
#define PS_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES \
PsAttributeValue(PsAttributeEnableOptionalXStateFeatures, TRUE, TRUE, FALSE)
// end_rev
@@ -1853,6 +1990,50 @@ typedef struct _PS_STD_HANDLE_INFO
ULONG StdHandleSubsystemType;
} PS_STD_HANDLE_INFO, *PPS_STD_HANDLE_INFO;
typedef union _PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS
{
UCHAR Trustlet : 1;
UCHAR Ntos : 1;
UCHAR WriteHandle : 1;
UCHAR ReadHandle : 1;
UCHAR Reserved : 4;
UCHAR AccessRights;
} PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS, *PPS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS;
typedef struct _PS_TRUSTLET_ATTRIBUTE_TYPE
{
union
{
struct
{
UCHAR Version;
UCHAR DataCount;
UCHAR SemanticType;
PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS AccessRights;
};
ULONG AttributeType;
};
} PS_TRUSTLET_ATTRIBUTE_TYPE, *PPS_TRUSTLET_ATTRIBUTE_TYPE;
typedef struct _PS_TRUSTLET_ATTRIBUTE_HEADER
{
PS_TRUSTLET_ATTRIBUTE_TYPE AttributeType;
ULONG InstanceNumber : 8;
ULONG Reserved : 24;
} PS_TRUSTLET_ATTRIBUTE_HEADER, *PPS_TRUSTLET_ATTRIBUTE_HEADER;
typedef struct _PS_TRUSTLET_ATTRIBUTE_DATA
{
PS_TRUSTLET_ATTRIBUTE_HEADER Header;
ULONGLONG Data[1];
} PS_TRUSTLET_ATTRIBUTE_DATA, *PPS_TRUSTLET_ATTRIBUTE_DATA;
typedef struct _PS_TRUSTLET_CREATE_ATTRIBUTES
{
ULONGLONG TrustletIdentity;
PS_TRUSTLET_ATTRIBUTE_DATA Attributes[1];
} PS_TRUSTLET_CREATE_ATTRIBUTES, *PPS_TRUSTLET_CREATE_ATTRIBUTES;
// private
typedef struct _PS_BNO_ISOLATION_PARAMETERS
{
@@ -2309,6 +2490,21 @@ NtAllocateReserveObject(
);
#endif
// Process snapshotting
#if (PHNT_VERSION >= PHNT_WINBLUE)
// rev
NTSYSCALLAPI
NTSTATUS
NTAPI
PssNtCaptureSnapshot(
_Out_ PHANDLE SnapshotHandle,
_In_ HANDLE ProcessHandle,
_In_ ULONG CaptureFlags,
_In_ ULONG ThreadContextFlags
);
#endif
#endif
#endif
ntrtl.h
+118 -22
View File
@@ -1323,7 +1323,7 @@ RtlFreeAnsiString(
_Inout_ _At_(AnsiString->Buffer, _Frees_ptr_opt_) PANSI_STRING AnsiString
);
#if (PHNT_VERSION >= PHNT_19H2)
#if (PHNT_VERSION >= PHNT_20H1)
NTSYSAPI
VOID
NTAPI
@@ -1603,7 +1603,7 @@ RtlPrefixUnicodeString(
_In_ BOOLEAN CaseInSensitive
);
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_MODE == PHNT_MODE_KERNEL && PHNT_VERSION >= PHNT_THRESHOLD)
_Must_inspect_result_
NTSYSAPI
BOOLEAN
@@ -1700,7 +1700,7 @@ RtlUnicodeStringToAnsiString(
_In_ BOOLEAN AllocateDestinationString
);
#if (PHNT_VERSION >= PHNT_19H2)
#if (PHNT_VERSION >= PHNT_20H1)
NTSYSAPI
NTSTATUS
NTAPI
@@ -2049,12 +2049,14 @@ RtlIsNameInUnUpcasedExpression(
);
#endif
#if (PHNT_VERSION >= PHNT_19H1)
NTSYSAPI
BOOLEAN
NTAPI
RtlDoesNameContainWildCards(
_In_ PUNICODE_STRING Expression
);
#endif
NTSYSAPI
BOOLEAN
@@ -2833,6 +2835,12 @@ RtlUpdateClonedSRWLock(
_In_ LOGICAL Shared // TRUE to set to shared acquire
);
// rev
#define RTL_PROCESS_REFLECTION_FLAGS_INHERIT_HANDLES 0x2
#define RTL_PROCESS_REFLECTION_FLAGS_NO_SUSPEND 0x4
#define RTL_PROCESS_REFLECTION_FLAGS_NO_SYNCHRONIZE 0x8
#define RTL_PROCESS_REFLECTION_FLAGS_NO_CLOSE_EVENT 0x10
// private
typedef struct _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION
{
@@ -2848,7 +2856,7 @@ NTSTATUS
NTAPI
RtlCreateProcessReflection(
_In_ HANDLE ProcessHandle,
_In_ ULONG Flags, // RTL_CLONE_PROCESS_FLAGS
_In_ ULONG Flags, // RTL_PROCESS_REFLECTION_FLAGS_*
_In_opt_ PVOID StartRoutine,
_In_opt_ PVOID StartContext,
_In_opt_ HANDLE EventHandle,
@@ -3237,6 +3245,32 @@ RtlGetFunctionTableListHead(
#endif
// Activation Contexts
// rev
NTSYSAPI
NTSTATUS
NTAPI
RtlGetActiveActivationContext(
_Out_ HANDLE ActCtx
);
// rev
NTSYSAPI
VOID
NTAPI
RtlAddRefActivationContext(
_In_ HANDLE ActCtx
);
// rev
NTSYSAPI
VOID
NTAPI
RtlReleaseActivationContext(
_In_ HANDLE ActCtx
);
// Images
NTSYSAPI
@@ -3305,7 +3339,7 @@ RtlImageRvaToVa(
_Out_opt_ PIMAGE_SECTION_HEADER *LastRvaSection
);
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_REDSTONE)
// rev
NTSYSAPI
@@ -3316,10 +3350,6 @@ RtlFindExportedRoutineByName(
_In_ PCSTR RoutineName
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE)
// rev
NTSYSAPI
NTSTATUS
@@ -3880,7 +3910,7 @@ RtlReleasePath(
#endif
#if (PHNT_VERSION >= PHNT_20H1)
#if (PHNT_VERSION >= PHNT_REDSTONE)
// rev
NTSYSAPI
ULONG
@@ -4897,6 +4927,21 @@ RtlGetFileMUIPath(
_Inout_ PULONGLONG Enumerator
);
// private
NTSYSAPI
NTSTATUS
NTAPI
RtlLoadString(
_In_ PVOID DllHandle,
_In_ ULONG StringId,
_In_opt_ PCWSTR StringLanguage,
_In_ ULONG Flags,
_Out_ PCWSTR *ReturnString,
_Out_opt_ PUSHORT ReturnStringLen,
_Out_writes_(ReturnLanguageLen) PWSTR ReturnLanguageName,
_Inout_opt_ PULONG ReturnLanguageLen
);
// Errors
NTSYSAPI
@@ -5313,7 +5358,7 @@ RtlGetSystemTimePrecise(
);
#endif
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_21H2)
NTSYSAPI
KSYSTEM_TIME
NTAPI
@@ -5322,14 +5367,18 @@ RtlGetSystemTimeAndBias(
_Out_opt_ PLARGE_INTEGER TimeZoneBiasEffectiveStart,
_Out_opt_ PLARGE_INTEGER TimeZoneBiasEffectiveEnd
);
#endif
#if (PHNT_VERSION >= PHNT_THRESHOLD)
NTSYSAPI
LARGE_INTEGER
NTAPI
RtlGetInterruptTimePrecise(
_Out_ PLARGE_INTEGER PerformanceCounter
);
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
NTSYSAPI
BOOLEAN
NTAPI
@@ -5974,7 +6023,7 @@ RtlAllocateAndInitializeSid(
_Outptr_ PSID *Sid
);
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINBLUE)
_Must_inspect_result_
NTSYSAPI
NTSTATUS
@@ -6199,7 +6248,7 @@ RtlIsElevatedRid(
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE2)
#if (PHNT_VERSION >= PHNT_THRESHOLD)
// rev
NTSYSAPI
NTSTATUS
@@ -7509,7 +7558,7 @@ RtlGetCurrentProcessorNumber(
VOID
);
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WIN7)
// rev
NTSYSAPI
@@ -7978,6 +8027,7 @@ RtlGetConsoleSessionForegroundProcessId(
// Appcontainer
#if (PHNT_VERSION >= PHNT_REDSTONE2)
// rev
NTSYSAPI
NTSTATUS
@@ -7987,7 +8037,9 @@ RtlGetTokenNamedObjectPath(
_In_opt_ PSID Sid,
_Out_ PUNICODE_STRING ObjectPath // RtlFreeUnicodeString
);
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
// rev
NTSYSAPI
NTSTATUS
@@ -7998,7 +8050,9 @@ RtlGetAppContainerNamedObjectPath(
_In_ BOOLEAN RelativePath,
_Out_ PUNICODE_STRING ObjectPath // RtlFreeUnicodeString
);
#endif
#if (PHNT_VERSION >= PHNT_WINBLUE)
// rev
NTSYSAPI
NTSTATUS
@@ -8007,7 +8061,9 @@ RtlGetAppContainerParent(
_In_ PSID AppContainerSid,
_Out_ PSID* AppContainerSidParent // RtlFreeSid
);
#endif
#if (PHNT_VERSION >= PHNT_THRESHOLD)
// rev
NTSYSAPI
NTSTATUS
@@ -8016,7 +8072,9 @@ RtlCheckSandboxedToken(
_In_opt_ HANDLE TokenHandle,
_Out_ PBOOLEAN IsSandboxed
);
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
// rev
NTSYSAPI
NTSTATUS
@@ -8026,7 +8084,9 @@ RtlCheckTokenCapability(
_In_ PSID CapabilitySidToCheck,
_Out_ PBOOLEAN HasCapability
);
#endif
#if (PHNT_VERSION >= PHNT_THRESHOLD)
// rev
NTSYSAPI
NTSTATUS
@@ -8036,7 +8096,9 @@ RtlCapabilityCheck(
_In_ PUNICODE_STRING CapabilityName,
_Out_ PBOOLEAN HasCapability
);
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
// rev
NTSYSAPI
NTSTATUS
@@ -8057,7 +8119,9 @@ RtlCheckTokenMembershipEx(
_In_ ULONG Flags, // CTMF_VALID_FLAGS
_Out_ PBOOLEAN IsMember
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE4)
// rev
NTSYSAPI
NTSTATUS
@@ -8066,7 +8130,9 @@ RtlQueryTokenHostIdAsUlong64(
_In_ HANDLE TokenHandle,
_Out_ PULONG64 HostId // (WIN://PKGHOSTID)
);
#endif
#if (PHNT_VERSION >= PHNT_WINBLUE)
// rev
NTSYSAPI
BOOLEAN
@@ -8075,7 +8141,9 @@ RtlIsParentOfChildAppContainer(
_In_ PSID ParentAppContainerSid,
_In_ PSID ChildAppContainerSid
);
#endif
#if (PHNT_VERSION >= PHNT_WIN11)
// rev
NTSYSAPI
NTSTATUS
@@ -8083,7 +8151,9 @@ NTAPI
RtlIsApiSetImplemented(
_In_ PCSTR Namespace
);
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
// rev
NTSYSAPI
BOOLEAN
@@ -8099,7 +8169,9 @@ NTAPI
RtlIsPackageSid(
_In_ PSID Sid
);
#endif
#if (PHNT_VERSION >= PHNT_WINBLUE)
// rev
NTSYSAPI
BOOLEAN
@@ -8107,13 +8179,16 @@ NTAPI
RtlIsValidProcessTrustLabelSid(
_In_ PSID Sid
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE3)
NTSYSAPI
BOOLEAN
NTAPI
RtlIsStateSeparationEnabled(
VOID
);
#endif
typedef enum _APPCONTAINER_SID_TYPE
{
@@ -8124,6 +8199,7 @@ typedef enum _APPCONTAINER_SID_TYPE
MaxAppContainerSidType
} APPCONTAINER_SID_TYPE, *PAPPCONTAINER_SID_TYPE;
#if (PHNT_VERSION >= PHNT_WINBLUE)
// rev
NTSYSAPI
NTSTATUS
@@ -8132,6 +8208,7 @@ RtlGetAppContainerSidType(
_In_ PSID AppContainerSid,
_Out_ PAPPCONTAINER_SID_TYPE AppContainerSidType
);
#endif
NTSYSAPI
NTSTATUS
@@ -8155,6 +8232,7 @@ typedef enum _STATE_LOCATION_TYPE
LocationTypeMaximum
} STATE_LOCATION_TYPE;
#if (PHNT_VERSION >= PHNT_REDSTONE3)
// private
NTSYSAPI
NTSTATUS
@@ -8206,8 +8284,6 @@ RtlIsPartialPlaceholderFileInfo(
_Out_ PBOOLEAN IsPartialPlaceholder
);
#if (PHNT_VERSION >= PHNT_REDSTONE3)
#undef PHCM_MAX
#define PHCM_APPLICATION_DEFAULT ((CHAR)0)
#define PHCM_DISGUISE_PLACEHOLDERS ((CHAR)1)
@@ -8256,6 +8332,7 @@ RtlSetProcessPlaceholderCompatibilityMode(
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE2)
// rev
NTSYSAPI
BOOLEAN
@@ -8263,7 +8340,9 @@ NTAPI
RtlIsNonEmptyDirectoryReparsePointAllowed(
_In_ ULONG ReparseTag
);
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
// rev
NTSYSAPI
NTSTATUS
@@ -8272,14 +8351,24 @@ RtlAppxIsFileOwnedByTrustedInstaller(
_In_ HANDLE FileHandle,
_Out_ PBOOLEAN IsFileOwnedByTrustedInstaller
);
#endif
// rev
// Windows Internals book
#define PSM_ACTIVATION_TOKEN_PACKAGED_APPLICATION 0x1
#define PSM_ACTIVATION_TOKEN_SHARED_ENTITY 0x2
#define PSM_ACTIVATION_TOKEN_FULL_TRUST 0x4
#define PSM_ACTIVATION_TOKEN_NATIVE_SERVICE 0x8
#define PSM_ACTIVATION_TOKEN_DEVELOPMENT_APP 0x10
#define BREAKAWAY_INHIBITED 0x20
// private
typedef struct _PS_PKG_CLAIM
{
ULONGLONG Flags;
ULONGLONG Origin;
ULONG Flags; // PSM_ACTIVATION_TOKEN_*
ULONG Origin; // PackageOrigin from appmodel.h
} PS_PKG_CLAIM, *PPS_PKG_CLAIM;
#if (PHNT_VERSION >= PHNT_THRESHOLD)
NTSYSAPI
NTSTATUS
NTAPI
@@ -8293,9 +8382,11 @@ RtlQueryPackageClaims(
_Out_opt_ PPS_PKG_CLAIM PkgClaim,
_Out_opt_ PULONG64 AttributesPresent
);
#endif
// Protected policies
#if (PHNT_VERSION >= PHNT_WINBLUE)
// rev
NTSYSAPI
NTSTATUS
@@ -8314,8 +8405,9 @@ RtlSetProtectedPolicy(
_In_ ULONG_PTR PolicyValue,
_Out_ PULONG_PTR OldPolicyValue
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE)
#if (PHNT_VERSION >= PHNT_THRESHOLD)
// private
NTSYSAPI
BOOLEAN
@@ -8457,6 +8549,7 @@ RtlGetSetBootStatusData(
_Out_opt_ PULONG ReturnLength
);
#if (PHNT_VERSION >= PHNT_REDSTONE)
// rev
NTSYSAPI
NTSTATUS
@@ -8473,7 +8566,9 @@ NTAPI
RtlRestoreBootStatusDefaults(
_In_ HANDLE FileHandle
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE3)
// rev
NTSYSAPI
NTSTATUS
@@ -8482,7 +8577,6 @@ RtlRestoreSystemBootStatusDefaults(
VOID
);
#if (PHNT_VERSION >= PHNT_REDSTONE3)
// rev
NTSYSAPI
NTSTATUS
@@ -8506,6 +8600,7 @@ RtlSetSystemBootStatus(
);
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
// rev
NTSYSAPI
NTSTATUS
@@ -8521,6 +8616,7 @@ NTAPI
RtlSetPortableOperatingSystem(
_In_ BOOLEAN IsPortable
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
@@ -8565,7 +8661,7 @@ RtlFlushSecureMemoryCache(
_In_opt_ SIZE_T MemoryLength
);
#if (PHNT_VERSION >= PHNT_REDSTONE3)
#if (PHNT_VERSION >= PHNT_20H1)
// Feature configuration
phnt_ntdef.h
+15 -1
View File
@@ -61,7 +61,7 @@ typedef PCSTR PCSZ;
// Specific
typedef UCHAR KIRQL, *PKIRQL;
typedef LONG KPRIORITY;
typedef LONG KPRIORITY, *PKPRIORITY;
typedef USHORT RTL_ATOM, *PRTL_ATOM;
typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;
@@ -324,6 +324,20 @@ typedef struct _KSYSTEM_TIME
#include <poppack.h>
// NT macros used to test, set and clear flags
#ifndef FlagOn
#define FlagOn(_F, _SF) ((_F) & (_SF))
#endif
#ifndef BooleanFlagOn
#define BooleanFlagOn(F, SF) ((BOOLEAN)(((F) & (SF)) != 0))
#endif
#ifndef SetFlag
#define SetFlag(_F, _SF) ((_F) |= (_SF))
#endif
#ifndef ClearFlag
#define ClearFlag(_F, _SF) ((_F) &= ~(_SF))
#endif
#endif
#endif
winsta.h
+1 -1
View File
@@ -743,7 +743,7 @@ typedef struct _TS_SYS_PROCESS_INFORMATION
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ImageName;
LONG BasePriority;
KPRIORITY BasePriority;
ULONG UniqueProcessId;
ULONG InheritedFromUniqueProcessId;
ULONG HandleCount;