From 0f32b6e51337b0527344e9c280a6bc6e2b333db0 Mon Sep 17 00:00:00 2001 From: dmex Date: Fri, 13 May 2022 11:50:17 +1000 Subject: [PATCH] Sync latest fixes and updates (contributions thanks to @diversenok and @JustasMasiulis) Co-Authored-By: Justas Masiulis Co-Authored-By: diversenok --- ntbcd.h | 32 ++-- ntexapi.h | 516 ++++++++++++++++++++++++++++++++++++++++++++++----- ntioapi.h | 4 +- ntldr.h | 39 ++-- ntmmapi.h | 6 +- ntpebteb.h | 2 +- ntpsapi.h | 316 +++++++++++++++++++++++++------ ntrtl.h | 140 +++++++++++--- phnt_ntdef.h | 16 +- winsta.h | 2 +- 10 files changed, 907 insertions(+), 166 deletions(-) diff --git a/ntbcd.h b/ntbcd.h index 1907844..3ccead1 100644 --- a/ntbcd.h +++ b/ntbcd.h @@ -153,6 +153,15 @@ BcdExportStore( _In_ UNICODE_STRING BcdFilePath ); +NTSYSAPI +NTSTATUS +NTAPI +BcdExportStoreEx( + _In_ HANDLE BcdStoreHandle, + _In_ ULONG Flags, + _In_ UNICODE_STRING BcdFilePath + ); + NTSYSAPI NTSTATUS NTAPI @@ -290,7 +299,7 @@ typedef enum _BCD_INHERITED_CLASS_TYPE ((BCD_APPLICATION_OBJECT_TYPE)((((ULONG)DataType)) & 0xFFFFF)) #define BCD_OBJECT_OSLOADER_TYPE \ - MAKE_BCD_APPLICATION_OBJECT(BCD_APPLICATION_IMAGE_BOOT_APPLICATION, BCD_APPLICATION_OBJECT_WINDOWS_BOOT_LOADER); + MAKE_BCD_APPLICATION_OBJECT(BCD_APPLICATION_IMAGE_BOOT_APPLICATION, BCD_APPLICATION_OBJECT_WINDOWS_BOOT_LOADER) typedef union _BCD_OBJECT_DATATYPE { @@ -307,19 +316,19 @@ typedef union _BCD_OBJECT_DATATYPE BCD_APPLICATION_OBJECT_TYPE ApplicationType : 20; BCD_APPLICATION_IMAGE_TYPE ImageType : 4; ULONG Reserved : 4; - ULONG ObjectType : 4; + BCD_OBJECT_TYPE ObjectType : 4; } Application; struct { ULONG Value : 20; BCD_INHERITED_CLASS_TYPE Class : 4; ULONG Reserved : 4; - ULONG ObjectType : 4; + BCD_OBJECT_TYPE ObjectType : 4; } Inherit; struct { ULONG Reserved : 28; - ULONG ObjectType : 4; + BCD_OBJECT_TYPE ObjectType : 4; } Device; }; } BCD_OBJECT_DATATYPE, *PBCD_OBJECT_DATATYPE; @@ -493,17 +502,14 @@ typedef enum _BCD_ELEMENT_DEVICE_TYPE #define GET_BCDE_DATA_SUBTYPE(DataType) \ ((ULONG)((((ULONG)DataType)) & 0x00FFFFFF)) -typedef struct _BCD_ELEMENT_DATATYPE +typedef union _BCD_ELEMENT_DATATYPE { - union + ULONG PackedValue; + struct { - ULONG PackedValue; - struct - { - ULONG SubType : 24; - BCD_ELEMENT_DATATYPE_FORMAT Format : 4; - BCD_ELEMENT_DATATYPE_CLASS Class : 4; - }; + ULONG SubType : 24; + BCD_ELEMENT_DATATYPE_FORMAT Format : 4; + BCD_ELEMENT_DATATYPE_CLASS Class : 4; }; } BCD_ELEMENT_DATATYPE, *PBCD_ELEMENT_DATATYPE; diff --git a/ntexapi.h b/ntexapi.h index 22d9c57..9bfad99 100644 --- a/ntexapi.h +++ b/ntexapi.h @@ -1187,6 +1187,29 @@ NtWorkerFactoryWorkerReady( struct _FILE_IO_COMPLETION_INFORMATION; +#if (PHNT_VERSION >= PHNT_WIN8) + +typedef struct _WORKER_FACTORY_DEFERRED_WORK +{ + struct _PORT_MESSAGE *AlpcSendMessage; + PVOID AlpcSendMessagePort; + ULONG AlpcSendMessageFlags; + ULONG Flags; +} WORKER_FACTORY_DEFERRED_WORK, *PWORKER_FACTORY_DEFERRED_WORK; + +NTSYSCALLAPI +NTSTATUS +NTAPI +NtWaitForWorkViaWorkerFactory( + _In_ HANDLE WorkerFactoryHandle, + _Out_writes_to_(Count, *PacketsReturned) struct _FILE_IO_COMPLETION_INFORMATION *MiniPackets, + _In_ ULONG Count, + _Out_ PULONG PacketsReturned, + _In_ PWORKER_FACTORY_DEFERRED_WORK DeferredWork + ); + +#else + NTSYSCALLAPI NTSTATUS NTAPI @@ -1197,6 +1220,8 @@ NtWaitForWorkViaWorkerFactory( #endif +#endif + // Time NTSYSCALLAPI @@ -1301,7 +1326,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemVdmBopInformation, // not implemented // 20 SystemFileCacheInformation, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemCache) SystemPoolTagInformation, // q: SYSTEM_POOLTAG_INFORMATION - SystemInterruptInformation, // q: SYSTEM_INTERRUPT_INFORMATION + SystemInterruptInformation, // q: SYSTEM_INTERRUPT_INFORMATION (EX in: USHORT ProcessorGroup) SystemDpcBehaviorInformation, // q: SYSTEM_DPC_BEHAVIOR_INFORMATION; s: SYSTEM_DPC_BEHAVIOR_INFORMATION (requires SeLoadDriverPrivilege) SystemFullMemoryInformation, // not implemented // SYSTEM_MEMORY_USAGE_INFORMATION SystemLoadGdiDriverInformation, // s (kernel-mode only) @@ -1320,7 +1345,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemPrioritySeperation, // s (requires SeTcbPrivilege) SystemVerifierAddDriverInformation, // s (requires SeDebugPrivilege) // 40 SystemVerifierRemoveDriverInformation, // s (requires SeDebugPrivilege) - SystemProcessorIdleInformation, // q: SYSTEM_PROCESSOR_IDLE_INFORMATION + SystemProcessorIdleInformation, // q: SYSTEM_PROCESSOR_IDLE_INFORMATION (EX in: USHORT ProcessorGroup) SystemLegacyDriverInformation, // q: SYSTEM_LEGACY_DRIVER_INFORMATION SystemCurrentTimeZoneInformation, // q; s: RTL_TIME_ZONE_INFORMATION SystemLookasideInformation, // q: SYSTEM_LOOKASIDE_INFORMATION @@ -1339,7 +1364,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemRecommendedSharedDataAlignment, // q: ULONG // KeGetRecommendedSharedDataAlignment SystemComPlusPackage, // q; s: ULONG SystemNumaAvailableMemory, // q: SYSTEM_NUMA_INFORMATION // 60 - SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION + SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION (EX in: USHORT ProcessorGroup) SystemEmulationBasicInformation, // q: SYSTEM_BASIC_INFORMATION SystemEmulationProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION SystemExtendedHandleInformation, // q: SYSTEM_HANDLE_INFORMATION_EX @@ -1378,14 +1403,14 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemVerifierFaultsInformation, // s: SYSTEM_VERIFIER_FAULTS_INFORMATION (requires SeDebugPrivilege) SystemSystemPartitionInformation, // q: SYSTEM_SYSTEM_PARTITION_INFORMATION SystemSystemDiskInformation, // q: SYSTEM_SYSTEM_DISK_INFORMATION - SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION // 100 + SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION (EX in: USHORT ProcessorGroup) // 100 SystemNumaProximityNodeInformation, // q; s: SYSTEM_NUMA_PROXIMITY_MAP SystemDynamicTimeZoneInformation, // q; s: RTL_DYNAMIC_TIME_ZONE_INFORMATION (requires SeTimeZonePrivilege) SystemCodeIntegrityInformation, // q: SYSTEM_CODEINTEGRITY_INFORMATION // SeCodeIntegrityQueryInformation SystemProcessorMicrocodeUpdateInformation, // s: SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION SystemProcessorBrandString, // q: CHAR[] // HaliQuerySystemInformation -> HalpGetProcessorBrandString, info class 23 SystemVirtualAddressInformation, // q: SYSTEM_VA_LIST_INFORMATION[]; s: SYSTEM_VA_LIST_INFORMATION[] (requires SeIncreaseQuotaPrivilege) // MmQuerySystemVaInformation - SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // since WIN7 // KeQueryLogicalProcessorRelationship + SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX (EX in: LOGICAL_PROCESSOR_RELATIONSHIP RelationshipType) // since WIN7 // KeQueryLogicalProcessorRelationship SystemProcessorCycleTimeInformation, // q: SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[] (EX in: USHORT ProcessorGroup) SystemStoreInformation, // q; s: SYSTEM_STORE_INFORMATION (requires SeProfileSingleProcessPrivilege) // SmQueryStoreInformation SystemRegistryAppendString, // s: SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // 110 @@ -1399,7 +1424,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemVerifierCountersInformation, // q: SYSTEM_VERIFIER_COUNTERS_INFORMATION SystemPagedPoolInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypePagedPool) SystemSystemPtesInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemPtes) // 120 - SystemNodeDistanceInformation, + SystemNodeDistanceInformation, // q: USHORT[4*NumaNodes] // (EX in: USHORT NodeNumber) SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26 SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1 @@ -1419,7 +1444,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemMemoryTopologyInformation, // q: SYSTEM_MEMORY_TOPOLOGY_INFORMATION SystemMemoryChannelInformation, // q: SYSTEM_MEMORY_CHANNEL_INFORMATION SystemBootLogoInformation, // q: SYSTEM_BOOT_LOGO_INFORMATION // 140 - SystemProcessorPerformanceInformationEx, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // since WINBLUE + SystemProcessorPerformanceInformationEx, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // (EX in: USHORT ProcessorGroup) // since WINBLUE SystemCriticalProcessErrorLogInformation, SystemSecureBootPolicyInformation, // q: SYSTEM_SECUREBOOT_POLICY_INFORMATION SystemPageFileInformationEx, // q: SYSTEM_PAGEFILE_INFORMATION_EX @@ -1438,7 +1463,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemManufacturingInformation, // q: SYSTEM_MANUFACTURING_INFORMATION // since THRESHOLD SystemEnergyEstimationConfigInformation, // q: SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION SystemHypervisorDetailInformation, // q: SYSTEM_HYPERVISOR_DETAIL_INFORMATION - SystemProcessorCycleStatsInformation, // q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION // 160 + SystemProcessorCycleStatsInformation, // q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION (EX in: USHORT ProcessorGroup) // 160 SystemVmGenerationCountInformation, SystemTrustedPlatformModuleInformation, // q: SYSTEM_TPM_INFORMATION SystemKernelDebuggerFlags, // SYSTEM_KERNEL_DEBUGGER_FLAGS @@ -1471,7 +1496,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemCodeIntegrityUnlockInformation, // SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION // 190 SystemIntegrityQuotaInformation, SystemFlushInformation, // q: SYSTEM_FLUSH_INFORMATION - SystemProcessorIdleMaskInformation, // q: ULONG_PTR // since REDSTONE3 + SystemProcessorIdleMaskInformation, // q: ULONG_PTR[ActiveGroupCount] // since REDSTONE3 SystemSecureDumpEncryptionInformation, SystemWriteConstraintInformation, // SYSTEM_WRITE_CONSTRAINT_INFORMATION SystemKernelVaShadowInformation, // SYSTEM_KERNEL_VA_SHADOW_INFORMATION @@ -1509,7 +1534,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemDpcWatchdogInformation, SystemDpcWatchdogInformation2, SystemSupportedProcessorArchitectures2, // q: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx // 230 - SystemSingleProcessorRelationshipInformation, + SystemSingleProcessorRelationshipInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // (EX in: PROCESSOR_NUMBER Processor) SystemXfgCheckFailureInformation, SystemIommuStateInformation, // SYSTEM_IOMMU_STATE_INFORMATION // since 22H1 SystemHypervisorMinrootInformation, // SYSTEM_HYPERVISOR_MINROOT_INFORMATION @@ -1531,7 +1556,7 @@ typedef struct _SYSTEM_BASIC_INFORMATION ULONG AllocationGranularity; ULONG_PTR MinimumUserModeAddress; ULONG_PTR MaximumUserModeAddress; - ULONG_PTR ActiveProcessorsAffinityMask; + KAFFINITY ActiveProcessorsAffinityMask; CCHAR NumberOfProcessors; } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION; @@ -1646,7 +1671,7 @@ typedef struct _SYSTEM_THREAD_INFORMATION PVOID StartAddress; CLIENT_ID ClientId; KPRIORITY Priority; - LONG BasePriority; + KPRIORITY BasePriority; ULONG ContextSwitches; KTHREAD_STATE ThreadState; KWAIT_REASON WaitReason; @@ -2019,9 +2044,9 @@ typedef struct _EVENT_TRACE_VERSION_INFORMATION ULONG EventTraceKernelVersion; } EVENT_TRACE_VERSION_INFORMATION, *PEVENT_TRACE_VERSION_INFORMATION; -#define PERF_MASK_INDEX (0xe0000000) -#define PERF_MASK_GROUP (~PERF_MASK_INDEX) -#define PERF_NUM_MASKS 8 +#define PERF_MASK_INDEX (0xe0000000) +#define PERF_MASK_GROUP (~PERF_MASK_INDEX) +#define PERF_NUM_MASKS 8 #define PERF_GET_MASK_INDEX(GM) (((GM) & PERF_MASK_INDEX) >> 29) #define PERF_GET_MASK_GROUP(GM) ((GM) & PERF_MASK_GROUP) @@ -2972,26 +2997,26 @@ typedef struct _SYSTEM_VA_LIST_INFORMATION typedef enum _STORE_INFORMATION_CLASS { StorePageRequest = 1, - StoreStatsRequest = 2, // (requires SeProfileSingleProcessPrivilege) // SmProcessStatsRequest - StoreCreateRequest = 3, - StoreDeleteRequest = 4, - StoreListRequest = 5, // SmProcessListRequest + StoreStatsRequest = 2, // q: SM_STATS_REQUEST // SmProcessStatsRequest + StoreCreateRequest = 3, // s: SM_CREATE_REQUEST (requires SeProfileSingleProcessPrivilege) + StoreDeleteRequest = 4, // s: SM_DELETE_REQUEST (requires SeProfileSingleProcessPrivilege) + StoreListRequest = 5, // q: SM_STORE_LIST_REQUEST / SM_STORE_LIST_REQUEST_EX // SmProcessListRequest Available1 = 6, StoreEmptyRequest = 7, - CacheListRequest = 8, // SmcProcessListRequest - CacheCreateRequest = 9, - CacheDeleteRequest = 10, - CacheStoreCreateRequest = 11, - CacheStoreDeleteRequest = 12, - CacheStatsRequest = 13, // SmcProcessStatsRequest + CacheListRequest = 8, // q: SMC_CACHE_LIST_REQUEST // SmcProcessListRequest + CacheCreateRequest = 9, // s: SMC_CACHE_CREATE_REQUEST (requires SeProfileSingleProcessPrivilege) + CacheDeleteRequest = 10, // s: SMC_CACHE_DELETE_REQUEST (requires SeProfileSingleProcessPrivilege) + CacheStoreCreateRequest = 11, // s: SMC_STORE_CREATE_REQUEST (requires SeProfileSingleProcessPrivilege) + CacheStoreDeleteRequest = 12, // s: SMC_STORE_DELETE_REQUEST (requires SeProfileSingleProcessPrivilege) + CacheStatsRequest = 13, // q: SMC_CACHE_STATS_REQUEST // SmcProcessStatsRequest Available2 = 14, - RegistrationRequest = 15, // SmProcessRegistrationRequest + RegistrationRequest = 15, // q: SM_REGISTRATION_REQUEST (requires SeProfileSingleProcessPrivilege) // SmProcessRegistrationRequest GlobalCacheStatsRequest = 16, - StoreResizeRequest = 17, - CacheStoreResizeRequest = 18, - SmConfigRequest = 19, - StoreHighMemoryPriorityRequest = 20, // SM_STORE_HIGH_MEM_PRIORITY_REQUEST - SystemStoreTrimRequest = 21, // SM_SYSTEM_STORE_TRIM_REQUEST + StoreResizeRequest = 17, // s: SM_STORE_RESIZE_REQUEST (requires SeProfileSingleProcessPrivilege) + CacheStoreResizeRequest = 18, // s: SMC_STORE_RESIZE_REQUEST (requires SeProfileSingleProcessPrivilege) + SmConfigRequest = 19, // s: SM_CONFIG_REQUEST (requires SeProfileSingleProcessPrivilege) + StoreHighMemoryPriorityRequest = 20, // s: SM_STORE_HIGH_MEM_PRIORITY_REQUEST (requires SeProfileSingleProcessPrivilege) + SystemStoreTrimRequest = 21, // s: SM_SYSTEM_STORE_TRIM_REQUEST (requires SeProfileSingleProcessPrivilege) MemCompressionInfoRequest = 22, // q: SM_MEM_COMPRESSION_INFO_REQUEST // SmProcessCompressionInfoRequest ProcessStoreInfoRequest = 23, // SmProcessProcessStoreInfoRequest StoreInformationMax @@ -3001,27 +3026,403 @@ typedef enum _STORE_INFORMATION_CLASS #define SYSTEM_STORE_INFORMATION_VERSION 1 // rev -typedef struct _STORE_INFORMATION +typedef struct _SYSTEM_STORE_INFORMATION { _In_ ULONG Version; _In_ STORE_INFORMATION_CLASS StoreInformationClass; _Inout_ PVOID Data; _Inout_ ULONG Length; -} STORE_INFORMATION, *PSTORE_INFORMATION; +} SYSTEM_STORE_INFORMATION, *PSYSTEM_STORE_INFORMATION; + +#define SYSTEM_STORE_STATS_INFORMATION_VERSION 2 + +typedef enum _ST_STATS_LEVEL +{ + StStatsLevelBasic = 0, + StStatsLevelIoStats = 1, + StStatsLevelRegionSpace = 2, // requires SeProfileSingleProcessPrivilege + StStatsLevelSpaceBitmap = 3, // requires SeProfileSingleProcessPrivilege + StStatsLevelMax = 4 +} ST_STATS_LEVEL; + +typedef struct _SM_STATS_REQUEST +{ + ULONG Version : 8; // SYSTEM_STORE_STATS_INFORMATION_VERSION + ULONG DetailLevel : 8; // ST_STATS_LEVEL + ULONG StoreId : 16; + ULONG BufferSize; + PVOID Buffer; // PST_STATS +} SM_STATS_REQUEST, *PSM_STATS_REQUEST; + +typedef struct _ST_DATA_MGR_STATS +{ + ULONG RegionCount; + ULONG PagesStored; + ULONG UniquePagesStored; + ULONG LazyCleanupRegionCount; + struct { + ULONG RegionsInUse; + ULONG SpaceUsed; + } Space[8]; +} ST_DATA_MGR_STATS, *PST_DATA_MGR_STATS; + +typedef struct _ST_IO_STATS_PERIOD +{ + ULONG PageCounts[5]; +} ST_IO_STATS_PERIOD, *PST_IO_STATS_PERIOD; + +typedef struct _ST_IO_STATS +{ + ULONG PeriodCount; + ST_IO_STATS_PERIOD Periods[64]; +} ST_IO_STATS, *PST_IO_STATS; + +typedef struct _ST_READ_LATENCY_BUCKET +{ + ULONG LatencyUs; + ULONG Count; +} ST_READ_LATENCY_BUCKET, *PST_READ_LATENCY_BUCKET; + +typedef struct _ST_READ_LATENCY_STATS +{ + ST_READ_LATENCY_BUCKET Buckets[8]; +} ST_READ_LATENCY_STATS, *PST_READ_LATENCY_STATS; + +// rev +typedef struct _ST_STATS_REGION_INFO +{ + USHORT SpaceUsed; + UCHAR Priority; + UCHAR Spare; +} ST_STATS_REGION_INFO, *PST_STATS_REGION_INFO; + +// rev +typedef struct _ST_STATS_SPACE_BITMAP +{ + SIZE_T CompressedBytes; + ULONG BytesPerBit; + UCHAR StoreBitmap[1]; +} ST_STATS_SPACE_BITMAP, PST_STATS_SPACE_BITMAP; + +// rev +typedef struct _ST_STATS +{ + ULONG Version : 8; + ULONG Level : 4; + ULONG StoreType : 4; + ULONG NoDuplication : 1; + ULONG NoCompression : 1; + ULONG EncryptionStrength : 12; + ULONG VirtualRegions : 1; + ULONG Spare0 : 1; + ULONG Size; + USHORT CompressionFormat; + USHORT Spare; + + struct + { + ULONG RegionSize; + ULONG RegionCount; + ULONG RegionCountMax; + ULONG Granularity; + ST_DATA_MGR_STATS UserData; + ST_DATA_MGR_STATS Metadata; + } Basic; + + struct + { + ST_IO_STATS IoStats; + ST_READ_LATENCY_STATS ReadLatencyStats; + } Io; + + // ST_STATS_REGION_INFO[RegionCountMax] + // ST_STATS_SPACE_BITMAP +} ST_STATS, *PST_STATS; + +#define SYSTEM_STORE_CREATE_INFORMATION_VERSION 6 + +typedef enum _SM_STORE_TYPE +{ + StoreTypeInMemory=0, + StoreTypeFile=1, + StoreTypeMax=2 +} SM_STORE_TYPE; + +typedef struct _SM_STORE_BASIC_PARAMS +{ + union + { + struct + { + ULONG StoreType : 8; // SM_STORE_TYPE + ULONG NoDuplication : 1; + ULONG FailNoCompression : 1; + ULONG NoCompression : 1 ; + ULONG NoEncryption : 1; + ULONG NoEvictOnAdd : 1; + ULONG PerformsFileIo : 1; + ULONG VdlNotSet : 1 ; + ULONG UseIntermediateAddBuffer : 1; + ULONG CompressNoHuff : 1; + ULONG LockActiveRegions : 1; + ULONG VirtualRegions : 1; + ULONG Spare : 13; + }; + ULONG StoreFlags; + }; + ULONG Granularity; + ULONG RegionSize; + ULONG RegionCountMax; +} SM_STORE_BASIC_PARAMS, *PSM_STORE_BASIC_PARAMS; + +typedef struct _SMKM_REGION_EXTENT +{ + ULONG RegionCount; + SIZE_T ByteOffset; +} SMKM_REGION_EXTENT, *PSMKM_REGION_EXTENT; + +typedef struct _SMKM_FILE_INFO +{ + HANDLE FileHandle; + struct _FILE_OBJECT *FileObject; + struct _FILE_OBJECT *VolumeFileObject; + struct _DEVICE_OBJECT *VolumeDeviceObject; + HANDLE VolumePnpHandle; + struct _IRP *UsageNotificationIrp; + PSMKM_REGION_EXTENT Extents; + ULONG ExtentCount; +} SMKM_FILE_INFO, *PSMKM_FILE_INFO; + +typedef struct _SM_STORE_CACHE_BACKED_PARAMS +{ + ULONG SectorSize; + PCHAR EncryptionKey; + ULONG EncryptionKeySize; + PSMKM_FILE_INFO FileInfo; + PVOID EtaContext; + struct _RTL_BITMAP *StoreRegionBitmap; +} SM_STORE_CACHE_BACKED_PARAMS, *PSM_STORE_CACHE_BACKED_PARAMS; + +typedef struct _SM_STORE_PARAMETERS +{ + SM_STORE_BASIC_PARAMS Store; + ULONG Priority; + ULONG Flags; + SM_STORE_CACHE_BACKED_PARAMS CacheBacked; +} SM_STORE_PARAMETERS, *PSM_STORE_PARAMETERS; + +typedef struct _SM_CREATE_REQUEST +{ + ULONG Version : 8; // SYSTEM_STORE_CREATE_INFORMATION_VERSION + ULONG AcquireReference : 1; + ULONG KeyedStore : 1; + ULONG Spare : 22; + SM_STORE_PARAMETERS Params; + ULONG StoreId; +} SM_CREATE_REQUEST, *PSM_CREATE_REQUEST; + +#define SYSTEM_STORE_DELETE_INFORMATION_VERSION 1 + +typedef struct _SM_DELETE_REQUEST +{ + ULONG Version : 8; // SYSTEM_STORE_DELETE_INFORMATION_VERSION + ULONG Spare : 24; + ULONG StoreId; +} SM_DELETE_REQUEST, *PSM_DELETE_REQUEST; + +#define SYSTEM_STORE_LIST_INFORMATION_VERSION 2 + +typedef struct _SM_STORE_LIST_REQUEST +{ + ULONG Version : 8; // SYSTEM_STORE_LIST_INFORMATION_VERSION + ULONG StoreCount : 8; // = 0 + ULONG ExtendedRequest : 1; // SM_STORE_LIST_REQUEST_EX if set + ULONG Spare : 15; + ULONG StoreId[32]; +} SM_STORE_LIST_REQUEST, *PSM_STORE_LIST_REQUEST; + +typedef struct _SM_STORE_LIST_REQUEST_EX +{ + SM_STORE_LIST_REQUEST Request; + WCHAR NameBuffer[32][64]; +} SM_STORE_LIST_REQUEST_EX, *PSM_STORE_LIST_REQUEST_EX; + +#define SYSTEM_CACHE_LIST_INFORMATION_VERSION 2 + +typedef struct _SMC_CACHE_LIST_REQUEST +{ + ULONG Version : 8; // SYSTEM_CACHE_LIST_INFORMATION_VERSION + ULONG CacheCount : 8; // = 0 + ULONG Spare : 16; + ULONG CacheId[16]; +} SMC_CACHE_LIST_REQUEST, *PSMC_CACHE_LIST_REQUEST; + +#define SYSTEM_CACHE_CREATE_INFORMATION_VERSION 3 + +typedef struct _SMC_CACHE_PARAMETERS +{ + SIZE_T CacheFileSize; + ULONG StoreAlignment; + ULONG PerformsFileIo : 1; + ULONG VdlNotSet : 1; + ULONG Spare : 30; + ULONG CacheFlags; + ULONG Priority; +} SMC_CACHE_PARAMETERS, *PSMC_CACHE_PARAMETERS; + +typedef struct _SMC_CACHE_CREATE_PARAMETERS +{ + SMC_CACHE_PARAMETERS CacheParameters; + WCHAR TemplateFilePath[512]; +} SMC_CACHE_CREATE_PARAMETERS, *PSMC_CACHE_CREATE_PARAMETERS; + +typedef struct _SMC_CACHE_CREATE_REQUEST +{ + ULONG Version : 8; // SYSTEM_CACHE_CREATE_INFORMATION_VERSION + ULONG Spare : 24; + ULONG CacheId; + SMC_CACHE_CREATE_PARAMETERS CacheCreateParams; +} SMC_CACHE_CREATE_REQUEST, *PSMC_CACHE_CREATE_REQUEST; + +#define SYSTEM_CACHE_DELETE_INFORMATION_VERSION 1 + +typedef struct _SMC_CACHE_DELETE_REQUEST +{ + ULONG Version : 8; // SYSTEM_CACHE_DELETE_INFORMATION_VERSION + ULONG Spare : 24; + ULONG CacheId; +} SMC_CACHE_DELETE_REQUEST, *PSMC_CACHE_DELETE_REQUEST; + +#define SYSTEM_CACHE_STORE_CREATE_INFORMATION_VERSION 2 + +typedef enum _SM_STORE_MANAGER_TYPE +{ + SmStoreManagerTypePhysical=0, + SmStoreManagerTypeVirtual=1, + SmStoreManagerTypeMax=2 +} SM_STORE_MANAGER_TYPE; + +typedef struct _SMC_STORE_CREATE_REQUEST +{ + ULONG Version : 8; // SYSTEM_CACHE_STORE_CREATE_INFORMATION_VERSION + ULONG Spare : 24; + SM_STORE_BASIC_PARAMS StoreParams; + ULONG CacheId; + SM_STORE_MANAGER_TYPE StoreManagerType; + ULONG StoreId; +} SMC_STORE_CREATE_REQUEST, *PSMC_STORE_CREATE_REQUEST; + +#define SYSTEM_CACHE_STORE_DELETE_INFORMATION_VERSION 1 + +typedef struct _SMC_STORE_DELETE_REQUEST +{ + ULONG Version : 8; // SYSTEM_CACHE_STORE_DELETE_INFORMATION_VERSION + ULONG Spare : 24; + ULONG CacheId; + SM_STORE_MANAGER_TYPE StoreManagerType; + ULONG StoreId; +} SMC_STORE_DELETE_REQUEST, *PSMC_STORE_DELETE_REQUEST; + +#define SYSTEM_CACHE_STATS_INFORMATION_VERSION 3 + +typedef struct _SMC_CACHE_STATS +{ + SIZE_T TotalFileSize; + ULONG StoreCount; + ULONG RegionCount; + ULONG RegionSizeBytes; + ULONG FileCount : 6; + ULONG PerformsFileIo : 1; + ULONG Spare : 25; + ULONG StoreIds[16]; + ULONG PhysicalStoreBitmap; + ULONG Priority; + WCHAR TemplateFilePath[512]; +} SMC_CACHE_STATS, *PSMC_CACHE_STATS; + +typedef struct _SMC_CACHE_STATS_REQUEST +{ + ULONG Version : 8; // SYSTEM_CACHE_STATS_INFORMATION_VERSION + ULONG NoFilePath : 1; + ULONG Spare : 23; + ULONG CacheId; + SMC_CACHE_STATS CacheStats; +} SMC_CACHE_STATS_REQUEST, *PSMC_CACHE_STATS_REQUEST; + +#define SYSTEM_STORE_REGISTRATION_INFORMATION_VERSION 2 + +typedef struct _SM_REGISTRATION_INFO +{ + HANDLE CachesUpdatedEvent; +} SM_REGISTRATION_INFO, PSM_REGISTRATION_INFO; + +typedef struct _SM_REGISTRATION_REQUEST +{ + ULONG Version : 8; // SYSTEM_STORE_REGISTRATION_INFORMATION_VERSION + ULONG Spare : 24; + SM_REGISTRATION_INFO RegInfo; +} SM_REGISTRATION_REQUEST, *PSM_REGISTRATION_REQUEST; + +#define SYSTEM_STORE_RESIZE_INFORMATION_VERSION 6 + +typedef struct _SM_STORE_RESIZE_REQUEST +{ + ULONG Version : 8; // SYSTEM_STORE_RESIZE_INFORMATION_VERSION + ULONG AddRegions : 1; + ULONG Spare : 23; + ULONG StoreId; + ULONG NumberOfRegions; + struct _RTL_BITMAP *RegionBitmap; +} SM_STORE_RESIZE_REQUEST, *PSM_STORE_RESIZE_REQUEST; + +#define SYSTEM_CACHE_STORE_RESIZE_INFORMATION_VERSION 1 + +typedef struct _SMC_STORE_RESIZE_REQUEST +{ + ULONG Version : 8; // SYSTEM_CACHE_STORE_RESIZE_INFORMATION_VERSION + ULONG AddRegions : 1; + ULONG Spare : 23; + ULONG CacheId; + ULONG StoreId; + SM_STORE_MANAGER_TYPE StoreManagerType; + ULONG RegionCount; +} SMC_STORE_RESIZE_REQUEST, *PSMC_STORE_RESIZE_REQUEST; + +#define SYSTEM_STORE_CONFIG_INFORMATION_VERSION 4 + +typedef enum _SM_CONFIG_TYPE +{ + SmConfigDirtyPageCompression = 0, + SmConfigAsyncInswap = 1, + SmConfigPrefetchSeekThreshold = 2, + SmConfigTypeMax = 3 +} SM_CONFIG_TYPE; + +typedef struct _SM_CONFIG_REQUEST +{ + ULONG Version : 8; // SYSTEM_STORE_CONFIG_INFORMATION_VERSION + ULONG Spare : 16; + ULONG ConfigType : 8; // SM_CONFIG_TYPE + ULONG ConfigValue; +} SM_CONFIG_REQUEST, *PSM_CONFIG_REQUEST; + +#define SYSTEM_STORE_HIGH_MEM_PRIORITY_INFORMATION_VERSION 1 // rev typedef struct _SM_STORE_HIGH_MEM_PRIORITY_REQUEST { - ULONG Version : 8; + ULONG Version : 8; // SYSTEM_STORE_HIGH_MEM_PRIORITY_INFORMATION_VERSION ULONG SetHighMemoryPriority : 1; ULONG Spare : 23; HANDLE ProcessHandle; } SM_STORE_HIGH_MEM_PRIORITY_REQUEST, *PSM_STORE_HIGH_MEM_PRIORITY_REQUEST; +#define SYSTEM_STORE_TRIM_INFORMATION_VERSION 1 + // rev typedef struct _SM_SYSTEM_STORE_TRIM_REQUEST { - ULONG Version : 8; + ULONG Version : 8; // SYSTEM_STORE_TRIM_INFORMATION_VERSION ULONG Spare : 24; SIZE_T PagesToTrim; // ULONG? } SM_SYSTEM_STORE_TRIM_REQUEST, *PSM_SYSTEM_STORE_TRIM_REQUEST; @@ -3032,13 +3433,13 @@ typedef struct _SM_SYSTEM_STORE_TRIM_REQUEST // rev typedef struct _SM_MEM_COMPRESSION_INFO_REQUEST { - ULONG Version : 8; + ULONG Version : 8; // SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION ULONG Spare : 24; ULONG CompressionPid; - ULONG WorkingSetSize; // ULONGLONG? - ULONGLONG TotalDataCompressed; - ULONGLONG TotalCompressedSize; - ULONGLONG TotalUniqueDataCompressed; + ULONG WorkingSetSize; + SIZE_T TotalDataCompressed; + SIZE_T TotalCompressedSize; + SIZE_T TotalUniqueDataCompressed; } SM_MEM_COMPRESSION_INFO_REQUEST, *PSM_MEM_COMPRESSION_INFO_REQUEST; // private @@ -3061,7 +3462,7 @@ typedef struct _SYSTEM_VHD_BOOT_INFORMATION { BOOLEAN OsDiskIsVhd; ULONG OsVhdFilePathOffset; - WCHAR OsVhdParentVolume[ANYSIZE_ARRAY]; + WCHAR OsVhdParentVolume[1]; } SYSTEM_VHD_BOOT_INFORMATION, *PSYSTEM_VHD_BOOT_INFORMATION; // private @@ -3667,7 +4068,7 @@ typedef struct _SYSTEM_HYPERVISOR_DETAIL_INFORMATION // private typedef struct _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION { - ULONGLONG Cycles[2][4]; + ULONGLONG Cycles[4][2]; } SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION, *PSYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION; // private @@ -4407,7 +4808,8 @@ typedef union _SYSDBG_LIVEDUMP_CONTROL_FLAGS ULONG CompressMemoryPagesData : 1; ULONG IncludeUserSpaceMemoryPages : 1; ULONG AbortIfMemoryPressure : 1; // REDSTONE4 - ULONG Reserved : 28; + ULONG SelectiveDump : 1; // WIN11 + ULONG Reserved : 27; }; ULONG AsUlong; } SYSDBG_LIVEDUMP_CONTROL_FLAGS, *PSYSDBG_LIVEDUMP_CONTROL_FLAGS; @@ -4418,12 +4820,31 @@ typedef union _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES struct { ULONG HypervisorPages : 1; - ULONG Reserved : 31; + ULONG NonEssentialHypervisorPages : 1; // WIN11 + ULONG Reserved : 30; }; ULONG AsUlong; } SYSDBG_LIVEDUMP_CONTROL_ADDPAGES, *PSYSDBG_LIVEDUMP_CONTROL_ADDPAGES; +// rev +typedef struct _SYSDBG_LIVEDUMP_SELECTIVE_CONTROL +{ + ULONG Version; + ULONG Size; + union + { + ULONGLONG Flags; + struct + { + ULONGLONG ThreadKernelStacks : 1; + ULONGLONG ReservedFlags : 63; + }; + }; + ULONGLONG Reserved[4]; +} SYSDBG_LIVEDUMP_SELECTIVE_CONTROL, *PSYSDBG_LIVEDUMP_SELECTIVE_CONTROL; + #define SYSDBG_LIVEDUMP_CONTROL_VERSION 1 +#define SYSDBG_LIVEDUMP_CONTROL_VERSION_WIN11 2 // private typedef struct _SYSDBG_LIVEDUMP_CONTROL @@ -4438,6 +4859,7 @@ typedef struct _SYSDBG_LIVEDUMP_CONTROL HANDLE CancelEventHandle; SYSDBG_LIVEDUMP_CONTROL_FLAGS Flags; SYSDBG_LIVEDUMP_CONTROL_ADDPAGES AddPagesControl; + PSYSDBG_LIVEDUMP_SELECTIVE_CONTROL SelectiveControl; // WIN11 } SYSDBG_LIVEDUMP_CONTROL, *PSYSDBG_LIVEDUMP_CONTROL; // private @@ -5019,6 +5441,7 @@ NtQueryInformationAtom( #define FLG_HEAP_VALIDATE_ALL 0x00000080 // u #define FLG_APPLICATION_VERIFIER 0x00000100 // u +#define FLG_MONITOR_SILENT_PROCESS_EXIT 0x00000200 // uk #define FLG_POOL_ENABLE_TAGGING 0x00000400 // k #define FLG_HEAP_ENABLE_TAGGING 0x00000800 // u @@ -5043,7 +5466,7 @@ NtQueryInformationAtom( #define FLG_DISABLE_DBGPRINT 0x08000000 // k #define FLG_CRITSEC_EVENT_CREATION 0x10000000 // u -#define FLG_LDR_TOP_DOWN 0x20000000 // u,64 +#define FLG_STOP_ON_UNHANDLED_EXCEPTION 0x20000000 // u,64 #define FLG_ENABLE_HANDLE_EXCEPTIONS 0x40000000 // k #define FLG_DISABLE_PROTDLLS 0x80000000 // u @@ -5111,7 +5534,8 @@ typedef enum _SHUTDOWN_ACTION { ShutdownNoReboot, ShutdownReboot, - ShutdownPowerOff + ShutdownPowerOff, + ShutdownRebootForRecovery // since WIN11 } SHUTDOWN_ACTION; NTSYSCALLAPI diff --git a/ntioapi.h b/ntioapi.h index 048125e..e127597 100644 --- a/ntioapi.h +++ b/ntioapi.h @@ -1662,7 +1662,9 @@ NtNotifyChangeDirectoryFile( typedef enum _DIRECTORY_NOTIFY_INFORMATION_CLASS { DirectoryNotifyInformation = 1, // FILE_NOTIFY_INFORMATION - DirectoryNotifyExtendedInformation = 2 // FILE_NOTIFY_EXTENDED_INFORMATION + DirectoryNotifyExtendedInformation, // FILE_NOTIFY_EXTENDED_INFORMATION + DirectoryNotifyFullInformation, // since 22H2 + DirectoryNotifyMaximumInformation } DIRECTORY_NOTIFY_INFORMATION_CLASS, *PDIRECTORY_NOTIFY_INFORMATION_CLASS; #if (PHNT_VERSION >= PHNT_REDSTONE3) diff --git a/ntldr.h b/ntldr.h index fb859c7..afb3612 100644 --- a/ntldr.h +++ b/ntldr.h @@ -109,28 +109,31 @@ typedef enum _LDR_HOT_PATCH_STATE LdrHotPatchStateMax, } LDR_HOT_PATCH_STATE, *PLDR_HOT_PATCH_STATE; +// LDR_DATA_TABLE_ENTRY->Flags #define LDRP_PACKAGED_BINARY 0x00000001 -#define LDRP_STATIC_LINK 0x00000002 +#define LDRP_MARKED_FOR_REMOVAL 0x00000002 #define LDRP_IMAGE_DLL 0x00000004 +#define LDRP_LOAD_NOTIFICATIONS_SENT 0x00000008 +#define LDRP_TELEMETRY_ENTRY_PROCESSED 0x00000010 +#define LDRP_PROCESS_STATIC_IMPORT 0x00000020 +#define LDRP_IN_LEGACY_LISTS 0x00000040 +#define LDRP_IN_INDEXES 0x00000080 +#define LDRP_SHIM_DLL 0x00000100 +#define LDRP_IN_EXCEPTION_TABLE 0x00000200 #define LDRP_LOAD_IN_PROGRESS 0x00001000 -#define LDRP_UNLOAD_IN_PROGRESS 0x00002000 +#define LDRP_LOAD_CONFIG_PROCESSED 0x00002000 #define LDRP_ENTRY_PROCESSED 0x00004000 -#define LDRP_ENTRY_INSERTED 0x00008000 -#define LDRP_CURRENT_LOAD 0x00010000 -#define LDRP_FAILED_BUILTIN_LOAD 0x00020000 +#define LDRP_PROTECT_DELAY_LOAD 0x00008000 #define LDRP_DONT_CALL_FOR_THREADS 0x00040000 #define LDRP_PROCESS_ATTACH_CALLED 0x00080000 -#define LDRP_DEBUG_SYMBOLS_LOADED 0x00100000 -#define LDRP_IMAGE_NOT_AT_BASE 0x00200000 // Vista and below +#define LDRP_PROCESS_ATTACH_FAILED 0x00100000 +#define LDRP_COR_DEFERRED_VALIDATE 0x00200000 #define LDRP_COR_IMAGE 0x00400000 -#define LDRP_DONT_RELOCATE 0x00800000 // LDR_COR_OWNS_UNMAP -#define LDRP_SYSTEM_MAPPED 0x01000000 -#define LDRP_IMAGE_VERIFYING 0x02000000 -#define LDRP_DRIVER_DEPENDENT_DLL 0x04000000 -#define LDRP_ENTRY_NATIVE 0x08000000 +#define LDRP_DONT_RELOCATE 0x00800000 +#define LDRP_COR_IL_ONLY 0x01000000 +#define LDRP_CHPE_IMAGE 0x02000000 +#define LDRP_CHPE_EMULATOR_IMAGE 0x04000000 #define LDRP_REDIRECTED 0x10000000 -#define LDRP_NON_PAGED_DEBUG_INFO 0x20000000 -#define LDRP_MM_LOADED 0x40000000 #define LDRP_COMPAT_DATABASE_PROCESSED 0x80000000 #define LDR_DATA_TABLE_ENTRY_SIZE_WINXP FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, DdagNode) @@ -207,9 +210,9 @@ typedef struct _LDR_DATA_TABLE_ENTRY ULONG_PTR OriginalBase; LARGE_INTEGER LoadTime; ULONG BaseNameHashValue; - LDR_DLL_LOAD_REASON LoadReason; + LDR_DLL_LOAD_REASON LoadReason; // since WIN8 ULONG ImplicitPathOptions; - ULONG ReferenceCount; + ULONG ReferenceCount; // since WIN10 ULONG DependentLoadFlags; UCHAR SigningLevel; // since REDSTONE2 ULONG CheckSum; // since 22H1 @@ -610,7 +613,7 @@ typedef struct _PS_SYSTEM_DLL_INIT_BLOCK ULONG Size; ULONG_PTR SystemDllWowRelocation; ULONG_PTR SystemDllNativeRelocation; - ULONG_PTR Wow64SharedInformation[16]; + ULONG_PTR Wow64SharedInformation[16]; // use WOW64_SHARED_INFORMATION as index ULONG RngData; union { @@ -647,7 +650,7 @@ LdrAddLoadAsDataTable( _In_ PWSTR FilePath, _In_ SIZE_T Size, _In_ HANDLE Handle, - _In_ HANDLE ActCtx // param added on Win10 + _In_opt_ HANDLE ActCtx ); // private diff --git a/ntmmapi.h b/ntmmapi.h index 6ee3d84..7388484 100644 --- a/ntmmapi.h +++ b/ntmmapi.h @@ -91,8 +91,8 @@ typedef enum _MEMORY_INFORMATION_CLASS MemoryWorkingSetInformation, // MEMORY_WORKING_SET_INFORMATION MemoryMappedFilenameInformation, // UNICODE_STRING MemoryRegionInformation, // MEMORY_REGION_INFORMATION - MemoryWorkingSetExInformation, // MEMORY_WORKING_SET_EX_INFORMATION - MemorySharedCommitInformation, // MEMORY_SHARED_COMMIT_INFORMATION + MemoryWorkingSetExInformation, // MEMORY_WORKING_SET_EX_INFORMATION // since VISTA + MemorySharedCommitInformation, // MEMORY_SHARED_COMMIT_INFORMATION // since WIN8 MemoryImageInformation, // MEMORY_IMAGE_INFORMATION MemoryRegionInformationEx, // MEMORY_REGION_INFORMATION MemoryPrivilegedBasicInformation, @@ -426,7 +426,7 @@ typedef enum _SECTION_INFORMATION_CLASS { SectionBasicInformation, // q; SECTION_BASIC_INFORMATION SectionImageInformation, // q; SECTION_IMAGE_INFORMATION - SectionRelocationInformation, // q; PVOID RelocationAddress // name:wow64:whNtQuerySection_SectionRelocationInformation + SectionRelocationInformation, // q; PVOID RelocationAddress // name:wow64:whNtQuerySection_SectionRelocationInformation // since WIN7 SectionOriginalBaseInformation, // PVOID BaseAddress SectionInternalImageInformation, // SECTION_INTERNAL_IMAGE_INFORMATION // since REDSTONE2 MaxSectionInfoClass diff --git a/ntpebteb.h b/ntpebteb.h index f545ca1..188037f 100644 --- a/ntpebteb.h +++ b/ntpebteb.h @@ -161,7 +161,7 @@ typedef struct _PEB ULONG ImageSubsystem; ULONG ImageSubsystemMajorVersion; ULONG ImageSubsystemMinorVersion; - ULONG_PTR ActiveProcessAffinityMask; + KAFFINITY ActiveProcessAffinityMask; GDI_HANDLE_BUFFER GdiHandleBuffer; PVOID PostProcessInitRoutine; diff --git a/ntpsapi.h b/ntpsapi.h index 9db72a3..3d84e59 100644 --- a/ntpsapi.h +++ b/ntpsapi.h @@ -134,7 +134,7 @@ typedef enum _PROCESSINFOCLASS ProcessPriorityClass, // qs: PROCESS_PRIORITY_CLASS ProcessWx86Information, // qs: ULONG (requires SeTcbPrivilege) (VdmAllowed) ProcessHandleCount, // q: ULONG, PROCESS_HANDLE_INFORMATION // 20 - ProcessAffinityMask, // s: KAFFINITY + ProcessAffinityMask, // qs: KAFFINITY, qs: GROUP_AFFINITY ProcessPriorityBoost, // qs: ULONG ProcessDeviceMap, // qs: PROCESS_DEVICEMAP_INFORMATION, PROCESS_DEVICEMAP_INFORMATION_EX ProcessSessionInformation, // q: PROCESS_SESSION_INFORMATION @@ -179,8 +179,8 @@ typedef enum _PROCESSINFOCLASS ProcessFaultInformation, // PROCESS_FAULT_INFORMATION ProcessTelemetryIdInformation, // q: PROCESS_TELEMETRY_ID_INFORMATION ProcessCommitReleaseInformation, // PROCESS_COMMIT_RELEASE_INFORMATION - ProcessDefaultCpuSetsInformation, - ProcessAllowedCpuSetsInformation, + ProcessDefaultCpuSetsInformation, // SYSTEM_CPU_SET_INFORMATION[5] + ProcessAllowedCpuSetsInformation, // SYSTEM_CPU_SET_INFORMATION[5] ProcessSubsystemProcess, ProcessJobMemoryInformation, // q: PROCESS_JOB_MEMORY_INFO ProcessInPrivate, // s: void // ETW // since THRESHOLD2 // 70 @@ -235,7 +235,7 @@ typedef enum _THREADINFOCLASS ThreadBasicInformation, // q: THREAD_BASIC_INFORMATION ThreadTimes, // q: KERNEL_USER_TIMES ThreadPriority, // s: KPRIORITY (requires SeIncreaseBasePriorityPrivilege) - ThreadBasePriority, // s: LONG + ThreadBasePriority, // s: KPRIORITY ThreadAffinityMask, // s: KAFFINITY ThreadImpersonationToken, // s: HANDLE ThreadDescriptorTableEntry, // q: DESCRIPTOR_TABLE_ENTRY (or WOW64_DESCRIPTOR_TABLE_ENTRY) @@ -262,10 +262,10 @@ typedef enum _THREADINFOCLASS ThreadCSwitchMon, ThreadCSwitchPmu, ThreadWow64Context, // qs: WOW64_CONTEXT - ThreadGroupInformation, // q: GROUP_AFFINITY // 30 + ThreadGroupInformation, // qs: GROUP_AFFINITY // 30 ThreadUmsInformation, // q: THREAD_UMS_INFORMATION ThreadCounterProfiling, // q: BOOLEAN; s: THREAD_PROFILING_INFORMATION? - ThreadIdealProcessorEx, // q: PROCESSOR_NUMBER + ThreadIdealProcessorEx, // qs: PROCESSOR_NUMBER; s: previous PROCESSOR_NUMBER on return ThreadCpuAccountingInformation, // q: BOOLEAN; s: HANDLE (NtOpenSession) // NtCurrentThread // since WIN8 ThreadSuspendCount, // q: ULONG // since WINBLUE ThreadHeterogeneousCpuPolicy, // q: KHETERO_CPU_POLICY // since THRESHOLD @@ -308,7 +308,7 @@ typedef struct _PROCESS_BASIC_INFORMATION { NTSTATUS ExitStatus; PPEB PebBaseAddress; - ULONG_PTR AffinityMask; + KAFFINITY AffinityMask; KPRIORITY BasePriority; HANDLE UniqueProcessId; HANDLE InheritedFromUniqueProcessId; @@ -663,6 +663,20 @@ typedef struct _PROCESS_HANDLE_SNAPSHOT_INFORMATION #if (PHNT_MODE != PHNT_MODE_KERNEL) +#if !defined(NTDDI_WIN10_CO) || (NTDDI_VERSION < NTDDI_WIN10_CO) +typedef struct _PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY +{ + union { + ULONG Flags; + struct { + ULONG EnforceRedirectionTrust : 1; + ULONG AuditRedirectionTrust : 1; + ULONG ReservedFlags : 30; + }; + }; +} PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY, * PPROCESS_MITIGATION_REDIRECTION_TRUST_POLICY; +#endif + // private typedef struct _PROCESS_MITIGATION_POLICY_INFORMATION { @@ -838,6 +852,11 @@ typedef struct _POWER_THROTTLING_PROCESS_STATE ULONG StateMask; } POWER_THROTTLING_PROCESS_STATE, *PPOWER_THROTTLING_PROCESS_STATE; +// rev (tyranid) +#define WIN32K_SYSCALL_FILTER_STATE_ENABLE 0x1 +#define WIN32K_SYSCALL_FILTER_STATE_AUDIT 0x2 + +// private typedef struct _WIN32K_SYSCALL_FILTER { ULONG FilterState; @@ -1000,9 +1019,9 @@ typedef struct _THREAD_BASIC_INFORMATION NTSTATUS ExitStatus; PTEB TebBaseAddress; CLIENT_ID ClientId; - ULONG_PTR AffinityMask; + KAFFINITY AffinityMask; KPRIORITY Priority; - LONG BasePriority; + KPRIORITY BasePriority; } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION; // private @@ -1206,7 +1225,11 @@ NtCreateProcess( #define PROCESS_CREATE_FLAGS_FORCE_BREAKAWAY 0x00000400 // NtCreateProcessEx & NtCreateUserProcess, requires SeTcb #define PROCESS_CREATE_FLAGS_MINIMAL_PROCESS 0x00000800 // NtCreateProcessEx only #define PROCESS_CREATE_FLAGS_RELEASE_SECTION 0x00001000 // NtCreateProcessEx & NtCreateUserProcess +#define PROCESS_CREATE_FLAGS_CLONE_MINIMAL 0x00002000 // NtCreateProcessEx only +#define PROCESS_CREATE_FLAGS_CLONE_MINIMAL_REDUCED_COMMIT 0x00004000 // #define PROCESS_CREATE_FLAGS_AUXILIARY_PROCESS 0x00008000 // NtCreateProcessEx & NtCreateUserProcess, requires SeTcb +#define PROCESS_CREATE_FLAGS_CREATE_STORE 0x00020000 // NtCreateProcessEx & NtCreateUserProcess +#define PROCESS_CREATE_FLAGS_USE_PROTECTED_ENVIRONMENT 0x00040000 // NtCreateProcessEx & NtCreateUserProcess // end_rev NTSYSCALLAPI @@ -1559,6 +1582,12 @@ typedef VOID (*PPS_APC_ROUTINE)( _In_opt_ PVOID ApcArgument3 ); +#define Wow64EncodeApcRoutine(ApcRoutine) \ + ((PVOID)((0 - ((LONG_PTR)(ApcRoutine))) << 2)) + +#define Wow64DecodeApcRoutine(ApcRoutine) \ + ((PVOID)(0 - (((LONG_PTR)(ApcRoutine)) >> 2))) + NTSYSCALLAPI NTSTATUS NTAPI @@ -1588,6 +1617,15 @@ NtQueueApcThreadEx( #endif #if (PHNT_VERSION >= PHNT_WIN11) + +#if !defined(NTDDI_WIN10_CO) || (NTDDI_VERSION < NTDDI_WIN10_CO) +typedef enum _QUEUE_USER_APC_FLAGS +{ + QUEUE_USER_APC_FLAGS_NONE = 0x0, + QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC = 0x1, +} QUEUE_USER_APC_FLAGS; +#endif + NTSYSCALLAPI NTSTATUS NTAPI @@ -1600,6 +1638,7 @@ NtQueueApcThreadEx2( _In_opt_ PVOID ApcArgument2, _In_opt_ PVOID ApcArgument3 ); + #endif #if (PHNT_VERSION >= PHNT_WIN8) @@ -1629,52 +1668,120 @@ NtWaitForAlertByThreadId( #if (PHNT_MODE != PHNT_MODE_KERNEL) -// Attributes +// Attributes (Win32 CreateProcess) -// private -#define PS_ATTRIBUTE_NUMBER_MASK 0x0000ffff -#define PS_ATTRIBUTE_THREAD 0x00010000 // may be used with thread creation -#define PS_ATTRIBUTE_INPUT 0x00020000 // input only -#define PS_ATTRIBUTE_ADDITIVE 0x00040000 // "accumulated" e.g. bitmasks, counters, etc. - -// PROC_THREAD_ATTRIBUTE_NUM (Win32 CreateProcess) (dmex) +// PROC_THREAD_ATTRIBUTE_NUM (dmex) #define ProcThreadAttributeParentProcess 0 // in HANDLE -#define ProcThreadAttributeExtendedFlags 1 // in ULONG (PROC_EXTENDED_FLAG) +#define ProcThreadAttributeExtendedFlags 1 // in ULONG (EXTENDED_PROCESS_CREATION_FLAG_*) #define ProcThreadAttributeHandleList 2 // in HANDLE[] #define ProcThreadAttributeGroupAffinity 3 // in GROUP_AFFINITY // since WIN7 #define ProcThreadAttributePreferredNode 4 // in USHORT -#define ProcThreadAttributeIdealProcessor 5// in PROCESSOR_NUMBER +#define ProcThreadAttributeIdealProcessor 5 // in PROCESSOR_NUMBER #define ProcThreadAttributeUmsThread 6 // in UMS_CREATE_THREAD_ATTRIBUTES -#define ProcThreadAttributeMitigationPolicy 7 // in ULONG[] or ULONG64[] -#define ProcThreadAttributePackageName 8 // in WCHAR[] // since WIN8 +#define ProcThreadAttributeMitigationPolicy 7 // in ULONG, ULONG64, or ULONG64[2] +#define ProcThreadAttributePackageFullName 8 // in WCHAR[] // since WIN8 #define ProcThreadAttributeSecurityCapabilities 9 // in SECURITY_CAPABILITIES #define ProcThreadAttributeConsoleReference 10 // BaseGetConsoleReference (kernelbase.dll) -#define ProcThreadAttributeProtectionLevel 11 // in ULONG -#define ProcThreadAttributeJobList 13 // in HANDLE[] // since WIN10 -#define ProcThreadAttributeChildProcessPolicy 14 // in ULONG -#define ProcThreadAttributeAllApplicationPackagesPolicy 15 // in ULONG -#define ProcThreadAttributeWin32kFilter 16 // in PROC_THREAD_WIN32KFILTER_ATTRIBUTE -#define ProcThreadAttributeSafeOpenPromptOriginClaim 17 // since RS1 -#define ProcThreadAttributeDesktopAppPolicy 18 // in ULONG // since RS2 +#define ProcThreadAttributeProtectionLevel 11 // in ULONG (PROTECTION_LEVEL_*) // since WINBLUE +#define ProcThreadAttributeOsMaxVersionTested 12 // in MAXVERSIONTESTED_INFO // since THRESHOLD // (from exe.manifest) +#define ProcThreadAttributeJobList 13 // in HANDLE[] +#define ProcThreadAttributeChildProcessPolicy 14 // in ULONG (PROCESS_CREATION_CHILD_PROCESS_*) // since THRESHOLD2 +#define ProcThreadAttributeAllApplicationPackagesPolicy 15 // in ULONG (PROCESS_CREATION_ALL_APPLICATION_PACKAGES_*) // since REDSTONE +#define ProcThreadAttributeWin32kFilter 16 // in WIN32K_SYSCALL_FILTER +#define ProcThreadAttributeSafeOpenPromptOriginClaim 17 // in SE_SAFE_OPEN_PROMPT_RESULTS +#define ProcThreadAttributeDesktopAppPolicy 18 // in ULONG (PROCESS_CREATION_DESKTOP_APP_*) // since RS2 #define ProcThreadAttributeBnoIsolation 19 // in PROC_THREAD_BNOISOLATION_ATTRIBUTE #define ProcThreadAttributePseudoConsole 22 // in HANDLE (HPCON) // since RS5 -#define ProcThreadAttributeMitigationAuditPolicy 24 // in ULONG[] or ULONG64[] // since 20H1 -#define ProcThreadAttributeMachineType 25 // in ULONG +#define ProcThreadAttributeIsolationManifest 23 // in ISOLATION_MANIFEST_PROPERTIES // rev (diversenok) // since 19H2+ +#define ProcThreadAttributeMitigationAuditPolicy 24 // in ULONG, ULONG64, or ULONG64[2] // since 21H1 +#define ProcThreadAttributeMachineType 25 // in USHORT // since 21H2 #define ProcThreadAttributeComponentFilter 26 // in ULONG -#define ProcThreadAttributeEnableOptionalXStateFeatures 27 // in ULONG // since 20H2 +#define ProcThreadAttributeEnableOptionalXStateFeatures 27 // in ULONG64 // since WIN11 +#define ProcThreadAttributeCreateStore 28 // ULONG // rev (diversenok) -#define PROC_EXTENDED_FLAG_LOG_ELEVATION_FAILURE 0x1 -#define PROC_EXTENDED_FLAG_IGNORE_ELEVATION 0x2 -#define PROC_EXTENDED_FLAG_FORCE_JOB_BREAKAWAY 0x4 // (requires SeTcbPrivilege) +#ifndef PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS +#define PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS \ + ProcThreadAttributeValue(ProcThreadAttributeExtendedFlags, FALSE, TRUE, TRUE) +#endif +#ifndef PROC_THREAD_ATTRIBUTE_PACKAGE_FULL_NAME +#define PROC_THREAD_ATTRIBUTE_PACKAGE_FULL_NAME \ + ProcThreadAttributeValue(ProcThreadAttributePackageFullName, FALSE, TRUE, FALSE) +#endif +#ifndef PROC_THREAD_ATTRIBUTE_CONSOLE_REFERENCE +#define PROC_THREAD_ATTRIBUTE_CONSOLE_REFERENCE \ + ProcThreadAttributeValue(ProcThreadAttributeConsoleReference, FALSE, TRUE, FALSE) +#endif +#ifndef PROC_THREAD_ATTRIBUTE_OSMAXVERSIONTESTED +#define PROC_THREAD_ATTRIBUTE_OSMAXVERSIONTESTED \ + ProcThreadAttributeValue(ProcThreadAttributeOsMaxVersionTested, FALSE, TRUE, FALSE) +#endif +#ifndef PROC_THREAD_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM +#define PROC_THREAD_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM \ + ProcThreadAttributeValue(ProcThreadAttributeSafeOpenPromptOriginClaim, FALSE, TRUE, FALSE) +#endif +#ifndef PROC_THREAD_ATTRIBUTE_BNO_ISOLATION +#define PROC_THREAD_ATTRIBUTE_BNO_ISOLATION \ + ProcThreadAttributeValue(ProcThreadAttributeBnoIsolation, FALSE, TRUE, FALSE) +#endif +#ifndef PROC_THREAD_ATTRIBUTE_ISOLATION_MANIFEST +#define PROC_THREAD_ATTRIBUTE_ISOLATION_MANIFEST \ + ProcThreadAttributeValue(ProcThreadAttributeIsolationManifest, FALSE, TRUE, FALSE) +#endif +#ifndef PROC_THREAD_ATTRIBUTE_CREATE_STORE +#define PROC_THREAD_ATTRIBUTE_CREATE_STORE \ + ProcThreadAttributeValue(ProcThreadAttributeCreateStore, FALSE, TRUE, FALSE) +#endif -#define WIN32KFILTER_FLAG_ENABLE 0x1 -#define WIN32KFILTER_FLAG_AUDIT 0x2 +// private +typedef struct _PROC_THREAD_ATTRIBUTE { + ULONG_PTR Attribute; + SIZE_T Size; + ULONG_PTR Value; +} PROC_THREAD_ATTRIBUTE, *PPROC_THREAD_ATTRIBUTE; -typedef struct _PROC_THREAD_WIN32KFILTER_ATTRIBUTE -{ - ULONG Flags; - ULONG FilterLevel; -} PROC_THREAD_WIN32KFILTER_ATTRIBUTE, *PPROC_THREAD_WIN32KFILTER_ATTRIBUTE; +// private +typedef struct _PROC_THREAD_ATTRIBUTE_LIST { + ULONG PresentFlags; + ULONG AttributeCount; + ULONG LastAttribute; + ULONG SpareUlong0; + PPROC_THREAD_ATTRIBUTE ExtendedFlagsAttribute; + PROC_THREAD_ATTRIBUTE Attributes[1]; +} PROC_THREAD_ATTRIBUTE_LIST; + +// private +#define EXTENDED_PROCESS_CREATION_FLAG_ELEVATION_HANDLED 0x00000001 +#define EXTENDED_PROCESS_CREATION_FLAG_FORCELUA 0x00000002 +#define EXTENDED_PROCESS_CREATION_FLAG_FORCE_BREAKAWAY 0x00000004 // requires SeTcbPrivilege // since WINBLUE + +// private +#define PROTECTION_LEVEL_WINTCB_LIGHT 0x00000000 +#define PROTECTION_LEVEL_WINDOWS 0x00000001 +#define PROTECTION_LEVEL_WINDOWS_LIGHT 0x00000002 +#define PROTECTION_LEVEL_ANTIMALWARE_LIGHT 0x00000003 +#define PROTECTION_LEVEL_LSA_LIGHT 0x00000004 +#define PROTECTION_LEVEL_WINTCB 0x00000005 +#define PROTECTION_LEVEL_CODEGEN_LIGHT 0x00000006 +#define PROTECTION_LEVEL_AUTHENTICODE 0x00000007 + +// private +typedef enum _SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS { + SeSafeOpenExperienceNone = 0x00, + SeSafeOpenExperienceCalled = 0x01, + SeSafeOpenExperienceAppRepCalled = 0x02, + SeSafeOpenExperiencePromptDisplayed = 0x04, + SeSafeOpenExperienceUAC = 0x08, + SeSafeOpenExperienceUninstaller = 0x10, + SeSafeOpenExperienceIgnoreUnknownOrBad = 0x20, + SeSafeOpenExperienceDefenderTrustedInstaller = 0x40, + SeSafeOpenExperienceMOTWPresent = 0x80 +} SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS; + +// private +typedef struct _SE_SAFE_OPEN_PROMPT_RESULTS { + SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS Results; + WCHAR Path[MAX_PATH]; +} SE_SAFE_OPEN_PROMPT_RESULTS, *PSE_SAFE_OPEN_PROMPT_RESULTS; typedef struct _PROC_THREAD_BNOISOLATION_ATTRIBUTE { @@ -1682,6 +1789,14 @@ typedef struct _PROC_THREAD_BNOISOLATION_ATTRIBUTE WCHAR IsolationPrefix[0x88]; } PROC_THREAD_BNOISOLATION_ATTRIBUTE, *PPROC_THREAD_BNOISOLATION_ATTRIBUTE; +// private +typedef struct _ISOLATION_MANIFEST_PROPERTIES { + UNICODE_STRING InstancePath; + UNICODE_STRING FriendlyName; + UNICODE_STRING Description; + ULONG_PTR Level; +} ISOLATION_MANIFEST_PROPERTIES, *PISOLATION_MANIFEST_PROPERTIES; + #ifndef PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS #define PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS \ ProcThreadAttributeValue(ProcThreadAttributeExtendedFlags, FALSE, TRUE, TRUE) @@ -1690,6 +1805,10 @@ typedef struct _PROC_THREAD_BNOISOLATION_ATTRIBUTE #define PROC_THREAD_ATTRIBUTE_CONSOLE_REFERENCE \ ProcThreadAttributeValue(ProcThreadAttributeConsoleReference, FALSE, TRUE, FALSE) #endif +#ifndef PROC_THREAD_ATTRIBUTE_OSMAXVERSIONTESTED +#define PROC_THREAD_ATTRIBUTE_OSMAXVERSIONTESTED \ + ProcThreadAttributeValue(ProcThreadAttributeOsMaxVersionTested, FALSE, TRUE, FALSE) +#endif #ifndef PROC_THREAD_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM #define PROC_THREAD_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM \ ProcThreadAttributeValue(ProcThreadAttributeSafeOpenPromptOriginClaim, FALSE, TRUE, FALSE) @@ -1699,11 +1818,13 @@ typedef struct _PROC_THREAD_BNOISOLATION_ATTRIBUTE ProcThreadAttributeValue(ProcThreadAttributeBnoIsolation, FALSE, TRUE, FALSE) #endif +// Attributes (Native) + // private typedef enum _PS_ATTRIBUTE_NUM { PsAttributeParentProcess, // in HANDLE - PsAttributeDebugPort, // in HANDLE + PsAttributeDebugObject, // in HANDLE PsAttributeToken, // in HANDLE PsAttributeClientId, // out PCLIENT_ID PsAttributeTebAddress, // out PTEB * @@ -1713,29 +1834,35 @@ typedef enum _PS_ATTRIBUTE_NUM PsAttributePriorityClass, // in UCHAR PsAttributeErrorMode, // in ULONG PsAttributeStdHandleInfo, // 10, in PPS_STD_HANDLE_INFO - PsAttributeHandleList, // in PHANDLE + PsAttributeHandleList, // in HANDLE[] PsAttributeGroupAffinity, // in PGROUP_AFFINITY PsAttributePreferredNode, // in PUSHORT PsAttributeIdealProcessor, // in PPROCESSOR_NUMBER PsAttributeUmsThread, // ? in PUMS_CREATE_THREAD_ATTRIBUTES - PsAttributeMitigationOptions, // in UCHAR - PsAttributeProtectionLevel, // in ULONG - PsAttributeSecureProcess, // since THRESHOLD - PsAttributeJobList, - PsAttributeChildProcessPolicy, // since THRESHOLD2 - PsAttributeAllApplicationPackagesPolicy, // since REDSTONE - PsAttributeWin32kFilter, - PsAttributeSafeOpenPromptOriginClaim, - PsAttributeBnoIsolation, // PS_BNO_ISOLATION_PARAMETERS - PsAttributeDesktopAppPolicy, // in ULONG - PsAttributeChpe, // since REDSTONE3 - PsAttributeMitigationAuditOptions, // since 21H1 - PsAttributeMachineType, // since WIN11 + PsAttributeMitigationOptions, // in PPS_MITIGATION_OPTIONS_MAP (PROCESS_CREATION_MITIGATION_POLICY_*) // since WIN8 + PsAttributeProtectionLevel, // in PS_PROTECTION // since WINBLUE + PsAttributeSecureProcess, // in PPS_TRUSTLET_CREATE_ATTRIBUTES, since THRESHOLD + PsAttributeJobList, // in HANDLE[] + PsAttributeChildProcessPolicy, // 20, in PULONG (PROCESS_CREATION_CHILD_PROCESS_*) // since THRESHOLD2 + PsAttributeAllApplicationPackagesPolicy, // in PULONG (PROCESS_CREATION_ALL_APPLICATION_PACKAGES_*) // since REDSTONE + PsAttributeWin32kFilter, // in PWIN32K_SYSCALL_FILTER + PsAttributeSafeOpenPromptOriginClaim, // in + PsAttributeBnoIsolation, // in PPS_BNO_ISOLATION_PARAMETERS // since REDSTONE2 + PsAttributeDesktopAppPolicy, // in PULONG (PROCESS_CREATION_DESKTOP_APP_*) + PsAttributeChpe, // in BOOLEAN // since REDSTONE3 + PsAttributeMitigationAuditOptions, // in PPS_MITIGATION_AUDIT_OPTIONS_MAP (PROCESS_CREATION_MITIGATION_AUDIT_POLICY_*) // since 21H1 + PsAttributeMachineType, // in WORD // since 21H2 PsAttributeComponentFilter, - PsAttributeEnableOptionalXStateFeatures, + PsAttributeEnableOptionalXStateFeatures, // since WIN11 PsAttributeMax } PS_ATTRIBUTE_NUM; +// private +#define PS_ATTRIBUTE_NUMBER_MASK 0x0000ffff +#define PS_ATTRIBUTE_THREAD 0x00010000 // may be used with thread creation +#define PS_ATTRIBUTE_INPUT 0x00020000 // input only +#define PS_ATTRIBUTE_ADDITIVE 0x00040000 // "accumulated" e.g. bitmasks, counters, etc. + // begin_rev #define PsAttributeValue(Number, Thread, Input, Additive) \ @@ -1746,8 +1873,8 @@ typedef enum _PS_ATTRIBUTE_NUM #define PS_ATTRIBUTE_PARENT_PROCESS \ PsAttributeValue(PsAttributeParentProcess, FALSE, TRUE, TRUE) -#define PS_ATTRIBUTE_DEBUG_PORT \ - PsAttributeValue(PsAttributeDebugPort, FALSE, TRUE, TRUE) +#define PS_ATTRIBUTE_DEBUG_OBJECT \ + PsAttributeValue(PsAttributeDebugObject, FALSE, TRUE, TRUE) #define PS_ATTRIBUTE_TOKEN \ PsAttributeValue(PsAttributeToken, FALSE, TRUE, TRUE) #define PS_ATTRIBUTE_CLIENT_ID \ @@ -1777,7 +1904,7 @@ typedef enum _PS_ATTRIBUTE_NUM #define PS_ATTRIBUTE_UMS_THREAD \ PsAttributeValue(PsAttributeUmsThread, TRUE, TRUE, FALSE) #define PS_ATTRIBUTE_MITIGATION_OPTIONS \ - PsAttributeValue(PsAttributeMitigationOptions, FALSE, TRUE, TRUE) + PsAttributeValue(PsAttributeMitigationOptions, FALSE, TRUE, FALSE) #define PS_ATTRIBUTE_PROTECTION_LEVEL \ PsAttributeValue(PsAttributeProtectionLevel, FALSE, TRUE, TRUE) #define PS_ATTRIBUTE_SECURE_PROCESS \ @@ -1796,6 +1923,16 @@ typedef enum _PS_ATTRIBUTE_NUM PsAttributeValue(PsAttributeBnoIsolation, FALSE, TRUE, FALSE) #define PS_ATTRIBUTE_DESKTOP_APP_POLICY \ PsAttributeValue(PsAttributeDesktopAppPolicy, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_CHPE \ + PsAttributeValue(PsAttributeChpe, FALSE, TRUE, TRUE) +#define PS_ATTRIBUTE_MITIGATION_AUDIT_OPTIONS \ + PsAttributeValue(PsAttributeMitigationAuditOptions, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_MACHINE_TYPE \ + PsAttributeValue(PsAttributeMachineType, FALSE, TRUE, TRUE) +#define PS_ATTRIBUTE_COMPONENT_FILTER \ + PsAttributeValue(PsAttributeComponentFilter, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES \ + PsAttributeValue(PsAttributeEnableOptionalXStateFeatures, TRUE, TRUE, FALSE) // end_rev @@ -1853,6 +1990,50 @@ typedef struct _PS_STD_HANDLE_INFO ULONG StdHandleSubsystemType; } PS_STD_HANDLE_INFO, *PPS_STD_HANDLE_INFO; +typedef union _PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS +{ + UCHAR Trustlet : 1; + UCHAR Ntos : 1; + UCHAR WriteHandle : 1; + UCHAR ReadHandle : 1; + UCHAR Reserved : 4; + UCHAR AccessRights; +} PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS, *PPS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS; + +typedef struct _PS_TRUSTLET_ATTRIBUTE_TYPE +{ + union + { + struct + { + UCHAR Version; + UCHAR DataCount; + UCHAR SemanticType; + PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS AccessRights; + }; + ULONG AttributeType; + }; +} PS_TRUSTLET_ATTRIBUTE_TYPE, *PPS_TRUSTLET_ATTRIBUTE_TYPE; + +typedef struct _PS_TRUSTLET_ATTRIBUTE_HEADER +{ + PS_TRUSTLET_ATTRIBUTE_TYPE AttributeType; + ULONG InstanceNumber : 8; + ULONG Reserved : 24; +} PS_TRUSTLET_ATTRIBUTE_HEADER, *PPS_TRUSTLET_ATTRIBUTE_HEADER; + +typedef struct _PS_TRUSTLET_ATTRIBUTE_DATA +{ + PS_TRUSTLET_ATTRIBUTE_HEADER Header; + ULONGLONG Data[1]; +} PS_TRUSTLET_ATTRIBUTE_DATA, *PPS_TRUSTLET_ATTRIBUTE_DATA; + +typedef struct _PS_TRUSTLET_CREATE_ATTRIBUTES +{ + ULONGLONG TrustletIdentity; + PS_TRUSTLET_ATTRIBUTE_DATA Attributes[1]; +} PS_TRUSTLET_CREATE_ATTRIBUTES, *PPS_TRUSTLET_CREATE_ATTRIBUTES; + // private typedef struct _PS_BNO_ISOLATION_PARAMETERS { @@ -2309,6 +2490,21 @@ NtAllocateReserveObject( ); #endif +// Process snapshotting + +#if (PHNT_VERSION >= PHNT_WINBLUE) +// rev +NTSYSCALLAPI +NTSTATUS +NTAPI +PssNtCaptureSnapshot( + _Out_ PHANDLE SnapshotHandle, + _In_ HANDLE ProcessHandle, + _In_ ULONG CaptureFlags, + _In_ ULONG ThreadContextFlags + ); +#endif + #endif #endif diff --git a/ntrtl.h b/ntrtl.h index 0f844a1..469b65d 100644 --- a/ntrtl.h +++ b/ntrtl.h @@ -1323,7 +1323,7 @@ RtlFreeAnsiString( _Inout_ _At_(AnsiString->Buffer, _Frees_ptr_opt_) PANSI_STRING AnsiString ); -#if (PHNT_VERSION >= PHNT_19H2) +#if (PHNT_VERSION >= PHNT_20H1) NTSYSAPI VOID NTAPI @@ -1603,7 +1603,7 @@ RtlPrefixUnicodeString( _In_ BOOLEAN CaseInSensitive ); -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_MODE == PHNT_MODE_KERNEL && PHNT_VERSION >= PHNT_THRESHOLD) _Must_inspect_result_ NTSYSAPI BOOLEAN @@ -1700,7 +1700,7 @@ RtlUnicodeStringToAnsiString( _In_ BOOLEAN AllocateDestinationString ); -#if (PHNT_VERSION >= PHNT_19H2) +#if (PHNT_VERSION >= PHNT_20H1) NTSYSAPI NTSTATUS NTAPI @@ -2049,12 +2049,14 @@ RtlIsNameInUnUpcasedExpression( ); #endif +#if (PHNT_VERSION >= PHNT_19H1) NTSYSAPI BOOLEAN NTAPI RtlDoesNameContainWildCards( _In_ PUNICODE_STRING Expression ); +#endif NTSYSAPI BOOLEAN @@ -2833,6 +2835,12 @@ RtlUpdateClonedSRWLock( _In_ LOGICAL Shared // TRUE to set to shared acquire ); +// rev +#define RTL_PROCESS_REFLECTION_FLAGS_INHERIT_HANDLES 0x2 +#define RTL_PROCESS_REFLECTION_FLAGS_NO_SUSPEND 0x4 +#define RTL_PROCESS_REFLECTION_FLAGS_NO_SYNCHRONIZE 0x8 +#define RTL_PROCESS_REFLECTION_FLAGS_NO_CLOSE_EVENT 0x10 + // private typedef struct _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION { @@ -2848,7 +2856,7 @@ NTSTATUS NTAPI RtlCreateProcessReflection( _In_ HANDLE ProcessHandle, - _In_ ULONG Flags, // RTL_CLONE_PROCESS_FLAGS + _In_ ULONG Flags, // RTL_PROCESS_REFLECTION_FLAGS_* _In_opt_ PVOID StartRoutine, _In_opt_ PVOID StartContext, _In_opt_ HANDLE EventHandle, @@ -3237,6 +3245,32 @@ RtlGetFunctionTableListHead( #endif +// Activation Contexts + +// rev +NTSYSAPI +NTSTATUS +NTAPI +RtlGetActiveActivationContext( + _Out_ HANDLE ActCtx + ); + +// rev +NTSYSAPI +VOID +NTAPI +RtlAddRefActivationContext( + _In_ HANDLE ActCtx + ); + +// rev +NTSYSAPI +VOID +NTAPI +RtlReleaseActivationContext( + _In_ HANDLE ActCtx + ); + // Images NTSYSAPI @@ -3305,7 +3339,7 @@ RtlImageRvaToVa( _Out_opt_ PIMAGE_SECTION_HEADER *LastRvaSection ); -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_REDSTONE) // rev NTSYSAPI @@ -3316,10 +3350,6 @@ RtlFindExportedRoutineByName( _In_ PCSTR RoutineName ); -#endif - -#if (PHNT_VERSION >= PHNT_REDSTONE) - // rev NTSYSAPI NTSTATUS @@ -3880,7 +3910,7 @@ RtlReleasePath( #endif -#if (PHNT_VERSION >= PHNT_20H1) +#if (PHNT_VERSION >= PHNT_REDSTONE) // rev NTSYSAPI ULONG @@ -4897,6 +4927,21 @@ RtlGetFileMUIPath( _Inout_ PULONGLONG Enumerator ); +// private +NTSYSAPI +NTSTATUS +NTAPI +RtlLoadString( + _In_ PVOID DllHandle, + _In_ ULONG StringId, + _In_opt_ PCWSTR StringLanguage, + _In_ ULONG Flags, + _Out_ PCWSTR *ReturnString, + _Out_opt_ PUSHORT ReturnStringLen, + _Out_writes_(ReturnLanguageLen) PWSTR ReturnLanguageName, + _Inout_opt_ PULONG ReturnLanguageLen + ); + // Errors NTSYSAPI @@ -5313,7 +5358,7 @@ RtlGetSystemTimePrecise( ); #endif -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_21H2) NTSYSAPI KSYSTEM_TIME NTAPI @@ -5322,14 +5367,18 @@ RtlGetSystemTimeAndBias( _Out_opt_ PLARGE_INTEGER TimeZoneBiasEffectiveStart, _Out_opt_ PLARGE_INTEGER TimeZoneBiasEffectiveEnd ); +#endif +#if (PHNT_VERSION >= PHNT_THRESHOLD) NTSYSAPI LARGE_INTEGER NTAPI RtlGetInterruptTimePrecise( _Out_ PLARGE_INTEGER PerformanceCounter ); +#endif +#if (PHNT_VERSION >= PHNT_WIN8) NTSYSAPI BOOLEAN NTAPI @@ -5974,7 +6023,7 @@ RtlAllocateAndInitializeSid( _Outptr_ PSID *Sid ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINBLUE) _Must_inspect_result_ NTSYSAPI NTSTATUS @@ -6199,7 +6248,7 @@ RtlIsElevatedRid( ); #endif -#if (PHNT_VERSION >= PHNT_REDSTONE2) +#if (PHNT_VERSION >= PHNT_THRESHOLD) // rev NTSYSAPI NTSTATUS @@ -7509,7 +7558,7 @@ RtlGetCurrentProcessorNumber( VOID ); -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WIN7) // rev NTSYSAPI @@ -7978,6 +8027,7 @@ RtlGetConsoleSessionForegroundProcessId( // Appcontainer +#if (PHNT_VERSION >= PHNT_REDSTONE2) // rev NTSYSAPI NTSTATUS @@ -7987,7 +8037,9 @@ RtlGetTokenNamedObjectPath( _In_opt_ PSID Sid, _Out_ PUNICODE_STRING ObjectPath // RtlFreeUnicodeString ); +#endif +#if (PHNT_VERSION >= PHNT_WIN8) // rev NTSYSAPI NTSTATUS @@ -7998,7 +8050,9 @@ RtlGetAppContainerNamedObjectPath( _In_ BOOLEAN RelativePath, _Out_ PUNICODE_STRING ObjectPath // RtlFreeUnicodeString ); +#endif +#if (PHNT_VERSION >= PHNT_WINBLUE) // rev NTSYSAPI NTSTATUS @@ -8007,7 +8061,9 @@ RtlGetAppContainerParent( _In_ PSID AppContainerSid, _Out_ PSID* AppContainerSidParent // RtlFreeSid ); +#endif +#if (PHNT_VERSION >= PHNT_THRESHOLD) // rev NTSYSAPI NTSTATUS @@ -8016,7 +8072,9 @@ RtlCheckSandboxedToken( _In_opt_ HANDLE TokenHandle, _Out_ PBOOLEAN IsSandboxed ); +#endif +#if (PHNT_VERSION >= PHNT_WIN8) // rev NTSYSAPI NTSTATUS @@ -8026,7 +8084,9 @@ RtlCheckTokenCapability( _In_ PSID CapabilitySidToCheck, _Out_ PBOOLEAN HasCapability ); +#endif +#if (PHNT_VERSION >= PHNT_THRESHOLD) // rev NTSYSAPI NTSTATUS @@ -8036,7 +8096,9 @@ RtlCapabilityCheck( _In_ PUNICODE_STRING CapabilityName, _Out_ PBOOLEAN HasCapability ); +#endif +#if (PHNT_VERSION >= PHNT_WIN8) // rev NTSYSAPI NTSTATUS @@ -8057,7 +8119,9 @@ RtlCheckTokenMembershipEx( _In_ ULONG Flags, // CTMF_VALID_FLAGS _Out_ PBOOLEAN IsMember ); +#endif +#if (PHNT_VERSION >= PHNT_REDSTONE4) // rev NTSYSAPI NTSTATUS @@ -8066,7 +8130,9 @@ RtlQueryTokenHostIdAsUlong64( _In_ HANDLE TokenHandle, _Out_ PULONG64 HostId // (WIN://PKGHOSTID) ); +#endif +#if (PHNT_VERSION >= PHNT_WINBLUE) // rev NTSYSAPI BOOLEAN @@ -8075,7 +8141,9 @@ RtlIsParentOfChildAppContainer( _In_ PSID ParentAppContainerSid, _In_ PSID ChildAppContainerSid ); +#endif +#if (PHNT_VERSION >= PHNT_WIN11) // rev NTSYSAPI NTSTATUS @@ -8083,7 +8151,9 @@ NTAPI RtlIsApiSetImplemented( _In_ PCSTR Namespace ); +#endif +#if (PHNT_VERSION >= PHNT_WIN8) // rev NTSYSAPI BOOLEAN @@ -8099,7 +8169,9 @@ NTAPI RtlIsPackageSid( _In_ PSID Sid ); +#endif +#if (PHNT_VERSION >= PHNT_WINBLUE) // rev NTSYSAPI BOOLEAN @@ -8107,13 +8179,16 @@ NTAPI RtlIsValidProcessTrustLabelSid( _In_ PSID Sid ); +#endif +#if (PHNT_VERSION >= PHNT_REDSTONE3) NTSYSAPI BOOLEAN NTAPI RtlIsStateSeparationEnabled( VOID ); +#endif typedef enum _APPCONTAINER_SID_TYPE { @@ -8124,6 +8199,7 @@ typedef enum _APPCONTAINER_SID_TYPE MaxAppContainerSidType } APPCONTAINER_SID_TYPE, *PAPPCONTAINER_SID_TYPE; +#if (PHNT_VERSION >= PHNT_WINBLUE) // rev NTSYSAPI NTSTATUS @@ -8132,6 +8208,7 @@ RtlGetAppContainerSidType( _In_ PSID AppContainerSid, _Out_ PAPPCONTAINER_SID_TYPE AppContainerSidType ); +#endif NTSYSAPI NTSTATUS @@ -8155,6 +8232,7 @@ typedef enum _STATE_LOCATION_TYPE LocationTypeMaximum } STATE_LOCATION_TYPE; +#if (PHNT_VERSION >= PHNT_REDSTONE3) // private NTSYSAPI NTSTATUS @@ -8206,8 +8284,6 @@ RtlIsPartialPlaceholderFileInfo( _Out_ PBOOLEAN IsPartialPlaceholder ); -#if (PHNT_VERSION >= PHNT_REDSTONE3) - #undef PHCM_MAX #define PHCM_APPLICATION_DEFAULT ((CHAR)0) #define PHCM_DISGUISE_PLACEHOLDERS ((CHAR)1) @@ -8256,6 +8332,7 @@ RtlSetProcessPlaceholderCompatibilityMode( #endif +#if (PHNT_VERSION >= PHNT_REDSTONE2) // rev NTSYSAPI BOOLEAN @@ -8263,7 +8340,9 @@ NTAPI RtlIsNonEmptyDirectoryReparsePointAllowed( _In_ ULONG ReparseTag ); +#endif +#if (PHNT_VERSION >= PHNT_WIN8) // rev NTSYSAPI NTSTATUS @@ -8272,14 +8351,24 @@ RtlAppxIsFileOwnedByTrustedInstaller( _In_ HANDLE FileHandle, _Out_ PBOOLEAN IsFileOwnedByTrustedInstaller ); +#endif -// rev +// Windows Internals book +#define PSM_ACTIVATION_TOKEN_PACKAGED_APPLICATION 0x1 +#define PSM_ACTIVATION_TOKEN_SHARED_ENTITY 0x2 +#define PSM_ACTIVATION_TOKEN_FULL_TRUST 0x4 +#define PSM_ACTIVATION_TOKEN_NATIVE_SERVICE 0x8 +#define PSM_ACTIVATION_TOKEN_DEVELOPMENT_APP 0x10 +#define BREAKAWAY_INHIBITED 0x20 + +// private typedef struct _PS_PKG_CLAIM { - ULONGLONG Flags; - ULONGLONG Origin; + ULONG Flags; // PSM_ACTIVATION_TOKEN_* + ULONG Origin; // PackageOrigin from appmodel.h } PS_PKG_CLAIM, *PPS_PKG_CLAIM; +#if (PHNT_VERSION >= PHNT_THRESHOLD) NTSYSAPI NTSTATUS NTAPI @@ -8293,9 +8382,11 @@ RtlQueryPackageClaims( _Out_opt_ PPS_PKG_CLAIM PkgClaim, _Out_opt_ PULONG64 AttributesPresent ); +#endif // Protected policies +#if (PHNT_VERSION >= PHNT_WINBLUE) // rev NTSYSAPI NTSTATUS @@ -8314,8 +8405,9 @@ RtlSetProtectedPolicy( _In_ ULONG_PTR PolicyValue, _Out_ PULONG_PTR OldPolicyValue ); +#endif -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_THRESHOLD) // private NTSYSAPI BOOLEAN @@ -8457,6 +8549,7 @@ RtlGetSetBootStatusData( _Out_opt_ PULONG ReturnLength ); +#if (PHNT_VERSION >= PHNT_REDSTONE) // rev NTSYSAPI NTSTATUS @@ -8473,7 +8566,9 @@ NTAPI RtlRestoreBootStatusDefaults( _In_ HANDLE FileHandle ); +#endif +#if (PHNT_VERSION >= PHNT_REDSTONE3) // rev NTSYSAPI NTSTATUS @@ -8482,7 +8577,6 @@ RtlRestoreSystemBootStatusDefaults( VOID ); -#if (PHNT_VERSION >= PHNT_REDSTONE3) // rev NTSYSAPI NTSTATUS @@ -8506,6 +8600,7 @@ RtlSetSystemBootStatus( ); #endif +#if (PHNT_VERSION >= PHNT_WIN8) // rev NTSYSAPI NTSTATUS @@ -8521,6 +8616,7 @@ NTAPI RtlSetPortableOperatingSystem( _In_ BOOLEAN IsPortable ); +#endif #if (PHNT_VERSION >= PHNT_VISTA) @@ -8565,7 +8661,7 @@ RtlFlushSecureMemoryCache( _In_opt_ SIZE_T MemoryLength ); -#if (PHNT_VERSION >= PHNT_REDSTONE3) +#if (PHNT_VERSION >= PHNT_20H1) // Feature configuration diff --git a/phnt_ntdef.h b/phnt_ntdef.h index 2030c36..223e7fd 100644 --- a/phnt_ntdef.h +++ b/phnt_ntdef.h @@ -61,7 +61,7 @@ typedef PCSTR PCSZ; // Specific typedef UCHAR KIRQL, *PKIRQL; -typedef LONG KPRIORITY; +typedef LONG KPRIORITY, *PKPRIORITY; typedef USHORT RTL_ATOM, *PRTL_ATOM; typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS; @@ -324,6 +324,20 @@ typedef struct _KSYSTEM_TIME #include +// NT macros used to test, set and clear flags +#ifndef FlagOn +#define FlagOn(_F, _SF) ((_F) & (_SF)) +#endif +#ifndef BooleanFlagOn +#define BooleanFlagOn(F, SF) ((BOOLEAN)(((F) & (SF)) != 0)) +#endif +#ifndef SetFlag +#define SetFlag(_F, _SF) ((_F) |= (_SF)) +#endif +#ifndef ClearFlag +#define ClearFlag(_F, _SF) ((_F) &= ~(_SF)) +#endif + #endif #endif diff --git a/winsta.h b/winsta.h index f807f5a..2e2bef3 100644 --- a/winsta.h +++ b/winsta.h @@ -743,7 +743,7 @@ typedef struct _TS_SYS_PROCESS_INFORMATION LARGE_INTEGER UserTime; LARGE_INTEGER KernelTime; UNICODE_STRING ImageName; - LONG BasePriority; + KPRIORITY BasePriority; ULONG UniqueProcessId; ULONG InheritedFromUniqueProcessId; ULONG HandleCount;