admin/processhacker-phnt
1
0
Fork 0
mirror of https://github.com/processhacker/phnt synced 2026-06-08 16:49:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update to 24H2

Browse Source
This commit is contained in:
dmex
2024-06-24 08:21:38 +10:00
parent 4889215a26
commit 2b70847be7
36 changed files with 12418 additions and 2628 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ntbcd.h
+57 -54
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Boot Configuration Data (BCD) support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTBCD_H
@@ -14,47 +9,49 @@
#ifndef PHNT_INLINE_BCD_GUIDS
// 5189B25C-5558-4BF2-BCA4-289B11BD29E2 // {badmemory}
GUID DECLSPEC_SELECTANY GUID_BAD_MEMORY_GROUP = { 0x5189B25C, 0x5558, 0x4BF2, { 0xBC, 0xA4, 0x28, 0x9B, 0x11, 0xBD, 0x29, 0xE2 } };
DEFINE_GUID(GUID_BAD_MEMORY_GROUP, 0x5189B25C, 0x5558, 0x4BF2, 0xBC, 0xA4, 0x28, 0x9B, 0x11, 0xBD, 0x29, 0xE2);
// 6EFB52BF-1766-41DB-A6B3-0EE5EFF72BD7 // {bootloadersettings}
GUID DECLSPEC_SELECTANY GUID_BOOT_LOADER_SETTINGS_GROUP = { 0x6EFB52BF, 0x1766, 0x41DB, { 0xA6, 0xB3, 0x0E, 0xE5, 0xEF, 0xF7, 0x2B, 0xD7 } };
DEFINE_GUID(GUID_BOOT_LOADER_SETTINGS_GROUP, 0x6EFB52BF, 0x1766, 0x41DB, 0xA6, 0xB3, 0x0E, 0xE5, 0xEF, 0xF7, 0x2B, 0xD7);
// FA926493-6F1C-4193-A414-58F0B2456D1E // {current}
GUID DECLSPEC_SELECTANY GUID_CURRENT_BOOT_ENTRY = { 0xFA926493, 0x6F1C, 0x4193, { 0xA4, 0x14, 0x58, 0xF0, 0xB2, 0x45, 0x6D, 0x1E } };
DEFINE_GUID(GUID_CURRENT_BOOT_ENTRY, 0xFA926493, 0x6F1C, 0x4193, 0xA4, 0x14, 0x58, 0xF0, 0xB2, 0x45, 0x6D, 0x1E);
// 4636856E-540F-4170-A130-A84776F4C654 // {eventsettings} {dbgsettings}
GUID DECLSPEC_SELECTANY GUID_DEBUGGER_SETTINGS_GROUP = { 0x4636856E, 0x540F, 0x4170, { 0xA1, 0x30, 0xA8, 0x47, 0x76, 0xF4, 0xC6, 0x54 } };
DEFINE_GUID(GUID_DEBUGGER_SETTINGS_GROUP, 0x4636856E, 0x540F, 0x4170, 0xA1, 0x30, 0xA8, 0x47, 0x76, 0xF4, 0xC6, 0x54);
// 1CAE1EB7-A0DF-4D4D-9851-4860E34EF535 // {default}
GUID DECLSPEC_SELECTANY GUID_DEFAULT_BOOT_ENTRY = { 0x1CAE1EB7, 0xA0DF, 0x4D4D, { 0x98, 0x51, 0x48, 0x60, 0xE3, 0x4E, 0xF5, 0x35 } };
DEFINE_GUID(GUID_DEFAULT_BOOT_ENTRY, 0x1CAE1EB7, 0xA0DF, 0x4D4D, 0x98, 0x51, 0x48, 0x60, 0xE3, 0x4E, 0xF5, 0x35);
// 0CE4991B-E6B3-4B16-B23C-5E0D9250E5D9 // {emssettings}
GUID DECLSPEC_SELECTANY GUID_EMS_SETTINGS_GROUP = { 0x0CE4991B, 0xE6B3, 0x4B16, { 0xB2, 0x3C, 0x5E, 0x0D, 0x92, 0x50, 0xE5, 0xD9 } };
DEFINE_GUID(GUID_EMS_SETTINGS_GROUP, 0x0CE4991B, 0xE6B3, 0x4B16, 0xB2, 0x3C, 0x5E, 0x0D, 0x92, 0x50, 0xE5, 0xD9);
// A5A30FA2-3D06-4E9F-B5F4-A01DF9D1FCBA // {fwbootmgr}
GUID DECLSPEC_SELECTANY GUID_FIRMWARE_BOOTMGR = { 0xA5A30FA2, 0x3D06, 0x4E9F, { 0xB5, 0xF4, 0xA0, 0x1D, 0xF9, 0xD1, 0xFC, 0xBA } };
DEFINE_GUID(GUID_FIRMWARE_BOOTMGR, 0xA5A30FA2, 0x3D06, 0x4E9F, 0xB5, 0xF4, 0xA0, 0x1D, 0xF9, 0xD1, 0xFC, 0xBA);
// 7EA2E1AC-2E61-4728-AAA3-896D9D0A9F0E // {globalsettings}
GUID DECLSPEC_SELECTANY GUID_GLOBAL_SETTINGS_GROUP = { 0x7EA2E1AC, 0x2E61, 0x4728, { 0xAA, 0xA3, 0x89, 0x6D, 0x9D, 0x0A, 0x9F, 0x0E } };
DEFINE_GUID(GUID_GLOBAL_SETTINGS_GROUP, 0x7EA2E1AC, 0x2E61, 0x4728, 0xAA, 0xA3, 0x89, 0x6D, 0x9D, 0x0A, 0x9F, 0x0E);
// 7FF607E0-4395-11DB-B0DE-0800200C9A66 // {hypervisorsettings}
GUID DECLSPEC_SELECTANY GUID_HYPERVISOR_SETTINGS_GROUP = { 0x7FF607E0, 0x4395, 0x11DB, { 0xB0, 0xDE, 0x08, 0x00, 0x20, 0x0C, 0x9A, 0x66 } };
DEFINE_GUID(GUID_HYPERVISOR_SETTINGS_GROUP, 0x7FF607E0, 0x4395, 0x11DB, 0xB0, 0xDE, 0x08, 0x00, 0x20, 0x0C, 0x9A, 0x66);
// 313E8EED-7098-4586-A9BF-309C61F8D449 // {kerneldbgsettings}
GUID DECLSPEC_SELECTANY GUID_KERNEL_DEBUGGER_SETTINGS_GROUP = { 0x313E8EED, 0x7098, 0x4586, { 0xA9, 0xBF, 0x30, 0x9C, 0x61, 0xF8, 0xD4, 0x49 } };
DEFINE_GUID(GUID_KERNEL_DEBUGGER_SETTINGS_GROUP, 0x313E8EED, 0x7098, 0x4586, 0xA9, 0xBF, 0x30, 0x9C, 0x61, 0xF8, 0xD4, 0x49);
// 1AFA9C49-16AB-4A5C-4A90-212802DA9460 // {resumeloadersettings}
GUID DECLSPEC_SELECTANY GUID_RESUME_LOADER_SETTINGS_GROUP = { 0x1AFA9C49, 0x16AB, 0x4A5C, { 0x4A, 0x90, 0x21, 0x28, 0x02, 0xDA, 0x94, 0x60 } };
DEFINE_GUID(GUID_RESUME_LOADER_SETTINGS_GROUP, 0x1AFA9C49, 0x16AB, 0x4A5C, 0x4A, 0x90, 0x21, 0x28, 0x02, 0xDA, 0x94, 0x60);
// 9DEA862C-5CDD-4E70-ACC1-F32B344D4795 // {bootmgr}
GUID DECLSPEC_SELECTANY GUID_WINDOWS_BOOTMGR = { 0x9DEA862C, 0x5CDD, 0x4E70, { 0xAC, 0xC1, 0xF3, 0x2B, 0x34, 0x4D, 0x47, 0x95 } };
DEFINE_GUID(GUID_WINDOWS_BOOTMGR, 0x9DEA862C, 0x5CDD, 0x4E70, 0xAC, 0xC1, 0xF3, 0x2B, 0x34, 0x4D, 0x47, 0x95);
// 466F5A88-0AF2-4F76-9038-095B170DC21C // {ntldr} {legacy}
GUID DECLSPEC_SELECTANY GUID_WINDOWS_LEGACY_NTLDR = { 0x466F5A88, 0x0AF2, 0x4F76, { 0x90, 0x38, 0x09, 0x5B, 0x17, 0x0D, 0xC2, 0x1C } };
DEFINE_GUID(GUID_WINDOWS_LEGACY_NTLDR, 0x466F5A88, 0x0AF2, 0x4F76, 0x90, 0x38, 0x09, 0x5B, 0x17, 0x0D, 0xC2, 0x1C);
// B2721D73-1DB4-4C62-BF78-C548A880142D // {memdiag}
GUID DECLSPEC_SELECTANY GUID_WINDOWS_MEMORY_TESTER = { 0xB2721D73, 0x1DB4, 0x4C62, { 0xBF, 0x78, 0xC5, 0x48, 0xA8, 0x80, 0x14, 0x2D } };
DEFINE_GUID(GUID_WINDOWS_MEMORY_TESTER, 0xB2721D73, 0x1DB4, 0x4C62, 0xBF, 0x78, 0xC5, 0x48, 0xA8, 0x80, 0x14, 0x2D);
// B012B84D-C47C-4ED5-B722-C0C42163E569
GUID DECLSPEC_SELECTANY GUID_WINDOWS_OS_TARGET_TEMPLATE_EFI = { 0xB012B84D, 0xC47C, 0x4ED5, { 0xB7, 0x22, 0xC0, 0xC4, 0x21, 0x63, 0xE5, 0x69 } };
DEFINE_GUID(GUID_WINDOWS_OS_TARGET_TEMPLATE_EFI, 0xB012B84D, 0xC47C, 0x4ED5, 0xB7, 0x22, 0xC0, 0xC4, 0x21, 0x63, 0xE5, 0x69);
// A1943BBC-EA85-487C-97C7-C9EDE908A38A
GUID DECLSPEC_SELECTANY GUID_WINDOWS_OS_TARGET_TEMPLATE_PCAT = { 0xA1943BBC, 0xEA85, 0x487C, { 0x97, 0xC7, 0xC9, 0xED, 0xE9, 0x08, 0xA3, 0x8A } };
DEFINE_GUID(GUID_WINDOWS_OS_TARGET_TEMPLATE_PCAT, 0xA1943BBC, 0xEA85, 0x487C, 0x97, 0xC7, 0xC9, 0xED, 0xE9, 0x08, 0xA3, 0x8A);
// {0C334284-9A41-4DE1-99B3-A7E87E8FF07E}
GUID DECLSPEC_SELECTANY GUID_WINDOWS_RESUME_TARGET_TEMPLATE_EFI = { 0x0C334284, 0x9A41, 0x4DE1, { 0x99, 0xB3, 0xA7, 0xE8, 0x7E, 0x8F, 0xF0, 0x7E } };
DEFINE_GUID(GUID_WINDOWS_RESUME_TARGET_TEMPLATE_EFI, 0x0C334284, 0x9A41, 0x4DE1, 0x99, 0xB3, 0xA7, 0xE8, 0x7E, 0x8F, 0xF0, 0x7E);
// {98B02A23-0674-4CE7-BDAD-E0A15A8FF97B}
GUID DECLSPEC_SELECTANY GUID_WINDOWS_RESUME_TARGET_TEMPLATE_PCAT = { 0x98B02A23, 0x0674, 0x4CE7, { 0xBD, 0xAD, 0xE0, 0xA1, 0x5A, 0x8F, 0xF9, 0x7B } };
DEFINE_GUID(GUID_WINDOWS_RESUME_TARGET_TEMPLATE_PCAT, 0x98B02A23, 0x0674, 0x4CE7, 0xBD, 0xAD, 0xE0, 0xA1, 0x5A, 0x8F, 0xF9, 0x7B);
// A1943BBC-EA85-487C-97C7-C9EDE908A38A
GUID DECLSPEC_SELECTANY GUID_WINDOWS_SETUP_EFI = { 0x7254A080, 0x1510, 0x4E85, { 0xAC, 0x0F, 0xE7, 0xFB, 0x3D, 0x44, 0x47, 0x36 } };
DEFINE_GUID(GUID_WINDOWS_SETUP_EFI, 0x7254A080, 0x1510, 0x4E85, 0xAC, 0x0F, 0xE7, 0xFB, 0x3D, 0x44, 0x47, 0x36);
// CBD971BF-B7B8-4885-951A-FA03044F5D71
GUID DECLSPEC_SELECTANY GUID_WINDOWS_SETUP_PCAT = { 0xCBD971BF, 0xB7B8, 0x4885, { 0x95, 0x1A, 0xFA, 0x03, 0x04, 0x4F, 0x5D, 0x71 } };
DEFINE_GUID(GUID_WINDOWS_SETUP_PCAT, 0xCBD971BF, 0xB7B8, 0x4885, 0x95, 0x1A, 0xFA, 0x03, 0x04, 0x4F, 0x5D, 0x71);
// AE5534E0-A924-466C-B836-758539A3EE3A // {ramdiskoptions}
GUID DECLSPEC_SELECTANY GUID_WINDOWS_SETUP_RAMDISK_OPTIONS = { 0xAE5534E0, 0xA924, 0x466C, { 0xB8, 0x36, 0x75, 0x85, 0x39, 0xA3, 0xEE, 0x3A } };
DEFINE_GUID(GUID_WINDOWS_SETUP_RAMDISK_OPTIONS, 0xAE5534E0, 0xA924, 0x466C, 0xB8, 0x36, 0x75, 0x85, 0x39, 0xA3, 0xEE, 0x3A);
// {7619dcc9-fafe-11d9-b411-000476eba25f}
DEFINE_GUID(GUID_WINDOWS_SETUP_BOOT_ENTRY, 0x7619dcc9, 0xfafe, 0x11d9, 0xb4, 0x11, 0x00, 0x04, 0x76, 0xeb, 0xa2, 0x5f);
#else
NTSYSAPI GUID GUID_BAD_MEMORY_GROUP; // {badmemory}
NTSYSAPI GUID GUID_BOOT_LOADER_SETTINGS_GROUP; // {bootloadersettings}
@@ -153,6 +150,7 @@ BcdExportStore(
_In_ UNICODE_STRING BcdFilePath
);
#if (PHNT_VERSION > PHNT_WIN11)
NTSYSAPI
NTSTATUS
NTAPI
@@ -161,6 +159,7 @@ BcdExportStoreEx(
_In_ ULONG Flags,
_In_ UNICODE_STRING BcdFilePath
);
#endif
NTSYSAPI
NTSTATUS
@@ -245,34 +244,34 @@ BcdMarkAsSystemStore(
typedef enum _BCD_OBJECT_TYPE
{
BCD_OBJECT_TYPE_NONE,
BCD_OBJECT_TYPE_APPLICATION,
BCD_OBJECT_TYPE_INHERITED,
BCD_OBJECT_TYPE_DEVICE
BCD_OBJECT_TYPE_APPLICATION, // 0x10000000
BCD_OBJECT_TYPE_INHERITED, // 0x20000000
BCD_OBJECT_TYPE_DEVICE, // 0x30000000
} BCD_OBJECT_TYPE;
typedef enum _BCD_APPLICATION_OBJECT_TYPE
{
BCD_APPLICATION_OBJECT_NONE = 0,
BCD_APPLICATION_OBJECT_FIRMWARE_BOOT_MANAGER = 1,
BCD_APPLICATION_OBJECT_WINDOWS_BOOT_MANAGER = 2,
BCD_APPLICATION_OBJECT_WINDOWS_BOOT_LOADER = 3,
BCD_APPLICATION_OBJECT_WINDOWS_RESUME_APPLICATION = 4,
BCD_APPLICATION_OBJECT_MEMORY_TESTER = 5,
BCD_APPLICATION_OBJECT_LEGACY_NTLDR = 6,
BCD_APPLICATION_OBJECT_LEGACY_SETUPLDR = 7,
BCD_APPLICATION_OBJECT_BOOT_SECTOR = 8,
BCD_APPLICATION_OBJECT_STARTUP_MODULE = 9,
BCD_APPLICATION_OBJECT_GENERIC_APPLICATION = 10,
BCD_APPLICATION_OBJECT_RESERVED = 0xFFFFF
BCD_APPLICATION_OBJECT_FIRMWARE_BOOT_MANAGER = 1, // 0x00000001
BCD_APPLICATION_OBJECT_WINDOWS_BOOT_MANAGER = 2, // 0x00000002
BCD_APPLICATION_OBJECT_WINDOWS_BOOT_LOADER = 3, // 0x00000003
BCD_APPLICATION_OBJECT_WINDOWS_RESUME_APPLICATION = 4, // 0x00000004
BCD_APPLICATION_OBJECT_MEMORY_TESTER = 5, // 0x00000005
BCD_APPLICATION_OBJECT_LEGACY_NTLDR = 6, // 0x00000006
BCD_APPLICATION_OBJECT_LEGACY_SETUPLDR = 7, // 0x00000007
BCD_APPLICATION_OBJECT_BOOT_SECTOR = 8, // 0x00000008
BCD_APPLICATION_OBJECT_STARTUP_MODULE = 9, // 0x00000009
BCD_APPLICATION_OBJECT_GENERIC_APPLICATION = 10, // 0x0000000a
BCD_APPLICATION_OBJECT_RESERVED = 0xFFFFF // 0x000fffff
} BCD_APPLICATION_OBJECT_TYPE;
typedef enum _BCD_APPLICATION_IMAGE_TYPE
{
BCD_APPLICATION_IMAGE_NONE,
BCD_APPLICATION_IMAGE_FIRMWARE_APPLICATION,
BCD_APPLICATION_IMAGE_BOOT_APPLICATION,
BCD_APPLICATION_IMAGE_LEGACY_LOADER,
BCD_APPLICATION_IMAGE_REALMODE_CODE
BCD_APPLICATION_IMAGE_FIRMWARE_APPLICATION, // 0x00100000
BCD_APPLICATION_IMAGE_BOOT_APPLICATION, // 0x00200000
BCD_APPLICATION_IMAGE_LEGACY_LOADER, // 0x00300000
BCD_APPLICATION_IMAGE_REALMODE_CODE, // 0x00400000
} BCD_APPLICATION_IMAGE_TYPE;
typedef enum _BCD_INHERITED_CLASS_TYPE
@@ -333,6 +332,8 @@ typedef union _BCD_OBJECT_DATATYPE
};
} BCD_OBJECT_DATATYPE, *PBCD_OBJECT_DATATYPE;
static_assert(sizeof(BCD_OBJECT_DATATYPE) == sizeof(ULONG), "sizeof(BCD_OBJECT_DATATYPE) is invalid.");
#define BCD_OBJECT_DESCRIPTION_VERSION 0x1
typedef struct _BCD_OBJECT_DESCRIPTION
@@ -363,7 +364,7 @@ NTSTATUS
NTAPI
BcdOpenObject(
_In_ HANDLE BcdStoreHandle,
_In_ PGUID Identifier,
_In_ const GUID* Identifier,
_Out_ PHANDLE BcdObjectHandle
);
@@ -410,7 +411,7 @@ BcdCopyObject(
_In_ HANDLE BcdObjectHandle,
_In_ BCD_COPY_FLAGS BcdCopyFlags,
_In_ HANDLE TargetStoreHandle,
_Out_ PHANDLE TargetHandleOut
_Out_ PHANDLE TargetObjectHandle
);
NTSYSAPI
@@ -422,7 +423,7 @@ BcdCopyObjectEx(
_In_ BCD_COPY_FLAGS BcdCopyFlags,
_In_ HANDLE TargetStoreHandle,
_In_ PGUID TargetObjectId,
_Out_ PHANDLE TargetHandleOut
_Out_ PHANDLE TargetObjectHandle
);
NTSYSAPI
@@ -470,11 +471,11 @@ typedef enum _BCD_ELEMENT_DATATYPE_FORMAT
typedef enum _BCD_ELEMENT_DATATYPE_CLASS
{
BCD_ELEMENT_DATATYPE_CLASS_NONE,
BCD_ELEMENT_DATATYPE_CLASS_LIBRARY,
BCD_ELEMENT_DATATYPE_CLASS_APPLICATION,
BCD_ELEMENT_DATATYPE_CLASS_DEVICE,
BCD_ELEMENT_DATATYPE_CLASS_SETUPTEMPLATE,
BCD_ELEMENT_DATATYPE_CLASS_OEM
BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, // 0x10000000
BCD_ELEMENT_DATATYPE_CLASS_APPLICATION, // 0x20000000
BCD_ELEMENT_DATATYPE_CLASS_DEVICE, // 0x30000000
BCD_ELEMENT_DATATYPE_CLASS_SETUPTEMPLATE, // 0x40000000
BCD_ELEMENT_DATATYPE_CLASS_OEM // 0x50000000
} BCD_ELEMENT_DATATYPE_CLASS;
typedef enum _BCD_ELEMENT_DEVICE_TYPE
@@ -513,6 +514,8 @@ typedef union _BCD_ELEMENT_DATATYPE
};
} BCD_ELEMENT_DATATYPE, *PBCD_ELEMENT_DATATYPE;
static_assert(sizeof(BCD_ELEMENT_DATATYPE) == sizeof(ULONG), "sizeof(BCD_ELEMENT_DATATYPE) is invalid.");
NTSYSAPI
NTSTATUS
NTAPI
ntdbg.h
+4 -9
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Debugger support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTDBG_H
@@ -358,7 +353,7 @@ DbgUiConvertStateChangeStructureEx(
_Out_ LPDEBUG_EVENT DebugEvent
);
struct _EVENT_FILTER_DESCRIPTOR;
typedef struct _EVENT_FILTER_DESCRIPTOR *PEVENT_FILTER_DESCRIPTOR;
typedef VOID (NTAPI *PENABLECALLBACK)(
_In_ LPCGUID SourceId,
@@ -366,7 +361,7 @@ typedef VOID (NTAPI *PENABLECALLBACK)(
_In_ UCHAR Level,
_In_ ULONGLONG MatchAnyKeyword,
_In_ ULONGLONG MatchAllKeyword,
_In_opt_ struct _EVENT_FILTER_DESCRIPTOR *FilterData,
_In_opt_ PEVENT_FILTER_DESCRIPTOR FilterData,
_Inout_opt_ PVOID CallbackContext
);
ntexapi.h
+839 -1383
View File
File diff suppressed because it is too large Load Diff
ntgdi.h
+2 -7
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Graphics device interface support
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTGDI_H
ntimage.h
+211
View File
@@ -0,0 +1,211 @@
/*
* PE format support
*
* This file is part of System Informer.
*/
#ifndef _NTIMAGE_H
#define _NTIMAGE_H
#include <pshpack4.h>
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#define IMAGE_FILE_MACHINE_CHPE_X86 0x3A64
#define IMAGE_FILE_MACHINE_ARM64EC 0xA641
#define IMAGE_FILE_MACHINE_ARM64X 0xA64E
#endif
typedef struct _IMAGE_DEBUG_POGO_ENTRY
{
ULONG Rva;
ULONG Size;
CHAR Name[1];
} IMAGE_DEBUG_POGO_ENTRY, *PIMAGE_DEBUG_POGO_ENTRY;
typedef struct _IMAGE_DEBUG_POGO_SIGNATURE
{
ULONG Signature;
} IMAGE_DEBUG_POGO_SIGNATURE, *PIMAGE_DEBUG_POGO_SIGNATURE;
#define IMAGE_DEBUG_POGO_SIGNATURE_LTCG 'LTCG' // coffgrp LTCG (0x4C544347)
#define IMAGE_DEBUG_POGO_SIGNATURE_PGU 'PGU\0' // coffgrp PGU (0x50475500)
typedef struct _IMAGE_RELOCATION_RECORD
{
USHORT Offset : 12;
USHORT Type : 4;
} IMAGE_RELOCATION_RECORD, *PIMAGE_RELOCATION_RECORD;
typedef struct _IMAGE_CHPE_METADATA_X86
{
ULONG Version;
ULONG CHPECodeAddressRangeOffset;
ULONG CHPECodeAddressRangeCount;
ULONG WowA64ExceptionHandlerFunctionPointer;
ULONG WowA64DispatchCallFunctionPointer;
ULONG WowA64DispatchIndirectCallFunctionPointer;
ULONG WowA64DispatchIndirectCallCfgFunctionPointer;
ULONG WowA64DispatchRetFunctionPointer;
ULONG WowA64DispatchRetLeafFunctionPointer;
ULONG WowA64DispatchJumpFunctionPointer;
ULONG CompilerIATPointer; // Present if Version >= 2
ULONG WowA64RdtscFunctionPointer; // Present if Version >= 3
} IMAGE_CHPE_METADATA_X86, *PIMAGE_CHPE_METADATA_X86;
typedef struct _IMAGE_CHPE_RANGE_ENTRY
{
union
{
ULONG StartOffset;
struct
{
ULONG NativeCode : 1;
ULONG AddressBits : 31;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
ULONG Length;
} IMAGE_CHPE_RANGE_ENTRY, *PIMAGE_CHPE_RANGE_ENTRY;
typedef struct _IMAGE_ARM64EC_METADATA
{
ULONG Version;
ULONG CodeMap;
ULONG CodeMapCount;
ULONG CodeRangesToEntryPoints;
ULONG RedirectionMetadata;
ULONG tbd__os_arm64x_dispatch_call_no_redirect;
ULONG tbd__os_arm64x_dispatch_ret;
ULONG tbd__os_arm64x_dispatch_call;
ULONG tbd__os_arm64x_dispatch_icall;
ULONG tbd__os_arm64x_dispatch_icall_cfg;
ULONG AlternateEntryPoint;
ULONG AuxiliaryIAT;
ULONG CodeRangesToEntryPointsCount;
ULONG RedirectionMetadataCount;
ULONG GetX64InformationFunctionPointer;
ULONG SetX64InformationFunctionPointer;
ULONG ExtraRFETable;
ULONG ExtraRFETableSize;
ULONG __os_arm64x_dispatch_fptr;
ULONG AuxiliaryIATCopy;
} IMAGE_ARM64EC_METADATA, *PIMAGE_ARM64EC_METADATA;
// rev
#define IMAGE_ARM64EC_CODE_MAP_TYPE_ARM64 0
#define IMAGE_ARM64EC_CODE_MAP_TYPE_ARM64EC 1
#define IMAGE_ARM64EC_CODE_MAP_TYPE_AMD64 2
// rev
typedef struct _IMAGE_ARM64EC_CODE_MAP_ENTRY
{
union
{
ULONG StartOffset;
struct
{
ULONG Type : 2;
ULONG AddressBits : 30;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
ULONG Length;
} IMAGE_ARM64EC_CODE_MAP_ENTRY, *PIMAGE_ARM64EC_CODE_MAP_ENTRY;
typedef struct _IMAGE_ARM64EC_REDIRECTION_ENTRY
{
ULONG Source;
ULONG Destination;
} IMAGE_ARM64EC_REDIRECTION_ENTRY, *PIMAGE_ARM64EC_REDIRECTION_ENTRY;
typedef struct _IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT
{
ULONG StartRva;
ULONG EndRva;
ULONG EntryPoint;
} IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT, *PIMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT;
#define IMAGE_DVRT_ARM64X_FIXUP_TYPE_ZEROFILL 0
#define IMAGE_DVRT_ARM64X_FIXUP_TYPE_VALUE 1
#define IMAGE_DVRT_ARM64X_FIXUP_TYPE_DELTA 2
#define IMAGE_DVRT_ARM64X_FIXUP_SIZE_2BYTES 1
#define IMAGE_DVRT_ARM64X_FIXUP_SIZE_4BYTES 2
#define IMAGE_DVRT_ARM64X_FIXUP_SIZE_8BYTES 3
typedef struct _IMAGE_DVRT_ARM64X_FIXUP_RECORD
{
USHORT Offset : 12;
USHORT Type : 2;
USHORT Size : 2;
// Value of variable Size when IMAGE_DVRT_ARM64X_FIXUP_TYPE_VALUE
} IMAGE_DVRT_ARM64X_FIXUP_RECORD, *PIMAGE_DVRT_ARM64X_FIXUP_RECORD;
typedef struct _IMAGE_DVRT_ARM64X_DELTA_FIXUP_RECORD
{
USHORT Offset : 12;
USHORT Type : 2; // IMAGE_DVRT_ARM64X_FIXUP_TYPE_DELTA
USHORT Sign : 1; // 1 = -, 0 = +
USHORT Scale : 1; // 1 = 8, 0 = 4
// USHORT Value; // Delta = Value * Scale * Sign
} IMAGE_DVRT_ARM64X_DELTA_FIXUP_RECORD, *PIMAGE_DVRT_ARM64X_DELTA_FIXUP_RECORD;
#include <poppack.h>
#define IMAGE_DYNAMIC_RELOCATION_ARM64X 0x00000006
#define IMAGE_DYNAMIC_RELOCATION_MM_SHARED_USER_DATA_VA 0x7FFE0000
#define IMAGE_DYNAMIC_RELOCATION_KI_USER_SHARED_DATA64 0xFFFFF78000000000UI64
// Note: The Windows SDK defines UNALIGNED for PIMAGE_IMPORT_DESCRIPTOR but
// doesn't include UNALIGNED for PIMAGE_THUNK_DATA (See GH#1694) (dmex)
typedef IMAGE_THUNK_DATA32 UNALIGNED *UNALIGNED_PIMAGE_THUNK_DATA32;
typedef IMAGE_THUNK_DATA64 UNALIGNED *UNALIGNED_PIMAGE_THUNK_DATA64;
// Note: Required for legacy SDK support (dmex)
#if !defined(NTDDI_WIN10_NI) || (NTDDI_VERSION < NTDDI_WIN10_NI)
#define IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE 0x00000001
#define IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE 0x00000002
#define IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER 0x00000003
#define IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER 0x00000004
#define IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH 0x00000005
#define IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE 0x00000007
typedef struct _IMAGE_FUNCTION_OVERRIDE_HEADER {
ULONG FuncOverrideSize;
// IMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION FuncOverrideInfo[ANYSIZE_ARRAY]; // FuncOverrideSize bytes in size
// IMAGE_BDD_INFO BDDInfo; // BDD region, size in bytes: DVRTEntrySize - sizeof(IMAGE_FUNCTION_OVERRIDE_HEADER) - FuncOverrideSize
} IMAGE_FUNCTION_OVERRIDE_HEADER;
typedef IMAGE_FUNCTION_OVERRIDE_HEADER UNALIGNED *PIMAGE_FUNCTION_OVERRIDE_HEADER;
typedef struct _IMAGE_BDD_INFO {
ULONG Version; // decides the semantics of serialized BDD
ULONG BDDSize;
// IMAGE_BDD_DYNAMIC_RELOCATION BDDNodes[ANYSIZE_ARRAY]; // BDDSize size in bytes.
} IMAGE_BDD_INFO, *PIMAGE_BDD_INFO;
typedef struct _IMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION {
ULONG OriginalRva; // RVA of original function
ULONG BDDOffset; // Offset into the BDD region
ULONG RvaSize; // Size in bytes taken by RVAs. Must be multiple of sizeof(DWORD).
ULONG BaseRelocSize; // Size in bytes taken by BaseRelocs
// DWORD RVAs[RvaSize / sizeof(DWORD)]; // Array containing overriding func RVAs.
// IMAGE_BASE_RELOCATION BaseRelocs[ANYSIZE_ARRAY];
// ^Base relocations (RVA + Size + TO)
// ^Padded with extra TOs for 4B alignment
// ^BaseRelocSize size in bytes
} IMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION, *PIMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION;
typedef struct _IMAGE_BDD_DYNAMIC_RELOCATION {
USHORT Left; // Index of FALSE edge in BDD array
USHORT Right; // Index of TRUE edge in BDD array
ULONG Value; // Either FeatureNumber or Index into RVAs array
} IMAGE_BDD_DYNAMIC_RELOCATION, *PIMAGE_BDD_DYNAMIC_RELOCATION;
// Function override relocation types in DVRT records.
#define IMAGE_FUNCTION_OVERRIDE_INVALID 0
#define IMAGE_FUNCTION_OVERRIDE_X64_REL32 1 // 32-bit relative address from byte following reloc
#define IMAGE_FUNCTION_OVERRIDE_ARM64_BRANCH26 2 // 26 bit offset << 2 & sign ext. for B & BL
#define IMAGE_FUNCTION_OVERRIDE_ARM64_THUNK 3
#endif
#endif
ntioapi.h
+1028 -286
View File
File diff suppressed because it is too large Load Diff
ntkeapi.h
+3 -8
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Kernel executive support library
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTKEAPI_H
@@ -143,7 +138,7 @@ NtCallbackReturn(
#if (PHNT_VERSION >= PHNT_VISTA)
NTSYSCALLAPI
VOID
NTSTATUS
NTAPI
NtFlushProcessWriteBuffers(
VOID
ntldr.h
+215 -30
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Loader support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTLDR_H
@@ -107,6 +102,9 @@ typedef enum _LDR_HOT_PATCH_STATE
LdrHotPatchStateMax,
} LDR_HOT_PATCH_STATE, *PLDR_HOT_PATCH_STATE;
typedef struct _ACTIVATION_CONTEXT *PACTIVATION_CONTEXT;
typedef struct _LDRP_LOAD_CONTEXT *PLDRP_LOAD_CONTEXT;
// LDR_DATA_TABLE_ENTRY->Flags
#define LDRP_PACKAGED_BINARY 0x00000001
#define LDRP_MARKED_FOR_REMOVAL 0x00000002
@@ -145,11 +143,7 @@ typedef struct _LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
union
{
LIST_ENTRY InInitializationOrderLinks;
LIST_ENTRY InProgressLinks;
};
LIST_ENTRY InInitializationOrderLinks;
PVOID DllBase;
PLDR_INIT_ROUTINE EntryPoint;
ULONG SizeOfImage;
@@ -196,11 +190,11 @@ typedef struct _LDR_DATA_TABLE_ENTRY
USHORT TlsIndex;
LIST_ENTRY HashLinks;
ULONG TimeDateStamp;
struct _ACTIVATION_CONTEXT *EntryPointActivationContext;
PACTIVATION_CONTEXT EntryPointActivationContext;
PVOID Lock; // RtlAcquireSRWLockExclusive
PLDR_DDAG_NODE DdagNode;
LIST_ENTRY NodeModuleLink;
struct _LDRP_LOAD_CONTEXT *LoadContext;
PLDRP_LOAD_CONTEXT LoadContext;
PVOID ParentDllBase;
PVOID SwitchBackContext;
RTL_BALANCED_NODE BaseAddressIndexNode;
@@ -220,11 +214,11 @@ typedef struct _LDR_DATA_TABLE_ENTRY
#define LDR_IS_DATAFILE(DllHandle) (((ULONG_PTR)(DllHandle)) & (ULONG_PTR)1)
#define LDR_IS_IMAGEMAPPING(DllHandle) (((ULONG_PTR)(DllHandle)) & (ULONG_PTR)2)
#define LDR_IS_RESOURCE(DllHandle) (LDR_IS_IMAGEMAPPING(DllHandle) || LDR_IS_DATAFILE(DllHandle))
#define LDR_MAPPEDVIEW_TO_DATAFILE(BaseAddress) ((PVOID)(((ULONG_PTR)(BaseAddress)) | (ULONG_PTR)1))
#define LDR_MAPPEDVIEW_TO_IMAGEMAPPING(BaseAddress) ((PVOID)(((ULONG_PTR)(BaseAddress)) | (ULONG_PTR)2))
#define LDR_DATAFILE_TO_MAPPEDVIEW(DllHandle) ((PVOID)(((ULONG_PTR)(DllHandle)) & ~(ULONG_PTR)1))
#define LDR_IMAGEMAPPING_TO_MAPPEDVIEW(DllHandle) ((PVOID)(((ULONG_PTR)(DllHandle)) & ~(ULONG_PTR)2))
#define LDR_IS_RESOURCE(DllHandle) (LDR_IS_IMAGEMAPPING(DllHandle) || LDR_IS_DATAFILE(DllHandle))
#if (PHNT_MODE != PHNT_MODE_KERNEL)
@@ -302,6 +296,17 @@ LdrGetDllFullName(
_Out_ PUNICODE_STRING FullDllName
);
// rev
NTSYSAPI
NTSTATUS
NTAPI
LdrGetDllPath(
_In_ PCWSTR DllName,
_In_ ULONG Flags, // LOAD_LIBRARY_SEARCH_*
_Out_ PWSTR* DllPath,
_Out_ PWSTR* SearchPaths
);
// rev
NTSYSAPI
NTSTATUS
@@ -393,7 +398,7 @@ NTAPI
LdrLockLoaderLock(
_In_ ULONG Flags,
_Out_opt_ ULONG *Disposition,
_Out_ PVOID *Cookie
_Out_opt_ PVOID *Cookie
);
#define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001
@@ -403,7 +408,7 @@ NTSTATUS
NTAPI
LdrUnlockLoaderLock(
_In_ ULONG Flags,
_Inout_ PVOID Cookie
_In_opt_ PVOID Cookie
);
NTSYSAPI
@@ -439,6 +444,19 @@ LdrProcessRelocationBlock(
_In_ LONG_PTR Diff
);
#if (PHNT_VERSION >= PHNT_WIN8)
NTSYSAPI
PIMAGE_BASE_RELOCATION
NTAPI
LdrProcessRelocationBlockEx(
_In_ ULONG Machine, // IMAGE_FILE_MACHINE_AMD64|IMAGE_FILE_MACHINE_ARM|IMAGE_FILE_MACHINE_THUMB|IMAGE_FILE_MACHINE_ARMNT
_In_ ULONG_PTR VA,
_In_ ULONG SizeOfBlock,
_In_ PUSHORT NextOffset,
_In_ LONG_PTR Diff
);
#endif
NTSYSAPI
BOOLEAN
NTAPI
@@ -607,6 +625,9 @@ typedef struct _PS_MITIGATION_AUDIT_OPTIONS_MAP
ULONG_PTR Map[3]; // 2 < 20H1
} PS_MITIGATION_AUDIT_OPTIONS_MAP, *PPS_MITIGATION_AUDIT_OPTIONS_MAP;
#define PS_SYSTEM_DLL_INIT_BLOCK_V1 0x0F0
#define PS_SYSTEM_DLL_INIT_BLOCK_V2 0x128
// private
typedef struct _PS_SYSTEM_DLL_INIT_BLOCK
{
@@ -630,10 +651,17 @@ typedef struct _PS_SYSTEM_DLL_INIT_BLOCK
ULONG_PTR Wow64CfgBitMap;
ULONG_PTR Wow64CfgBitMapSize;
PS_MITIGATION_AUDIT_OPTIONS_MAP MitigationAuditOptionsMap; // REDSTONE3
ULONG_PTR ScpCfgCheckFunction; // since 24H2
ULONG_PTR ScpCfgCheckESFunction;
ULONG_PTR ScpCfgDispatchFunction;
ULONG_PTR ScpCfgDispatchESFunction;
ULONG_PTR ScpArm64EcCallCheck;
ULONG_PTR ScpArm64EcCfgCheckFunction;
ULONG_PTR ScpArm64EcCfgCheckESFunction;
} PS_SYSTEM_DLL_INIT_BLOCK, *PPS_SYSTEM_DLL_INIT_BLOCK;
#if (PHNT_VERSION >= PHNT_THRESHOLD)
// rev
#if (PHNT_VERSION >= PHNT_THRESHOLD)
NTSYSAPI PS_SYSTEM_DLL_INIT_BLOCK LdrSystemDllInitBlock;
#endif
@@ -641,6 +669,8 @@ NTSYSAPI PS_SYSTEM_DLL_INIT_BLOCK LdrSystemDllInitBlock;
#if (PHNT_VERSION >= PHNT_VISTA)
typedef struct _ACTIVATION_CONTEXT *PACTIVATION_CONTEXT;
// private
NTSYSAPI
NTSTATUS
@@ -650,7 +680,7 @@ LdrAddLoadAsDataTable(
_In_ PWSTR FilePath,
_In_ SIZE_T Size,
_In_ HANDLE Handle,
_In_opt_ HANDLE ActCtx
_In_opt_ PACTIVATION_CONTEXT ActCtx
);
// private
@@ -756,7 +786,7 @@ typedef struct _LDR_ENUM_RESOURCE_ENTRY
} LDR_ENUM_RESOURCE_ENTRY, *PLDR_ENUM_RESOURCE_ENTRY;
#define NAME_FROM_RESOURCE_ENTRY(RootDirectory, Entry) \
((Entry)->NameIsString ? (ULONG_PTR)PTR_ADD_OFFSET((RootDirectory), (Entry)->NameOffset) : (Entry)->Id)
((Entry)->NameIsString ? (ULONG_PTR)((ULONG_PTR)(RootDirectory) + (ULONG_PTR)((Entry)->NameOffset)) : (Entry)->Id)
NTSYSAPI
NTSTATUS
@@ -777,7 +807,7 @@ LdrFindEntryForAddress(
_Out_ PLDR_DATA_TABLE_ENTRY *Entry
);
// rev - Win10 type
// rev
NTSYSAPI
NTSTATUS
NTAPI
@@ -788,7 +818,7 @@ LdrLoadAlternateResourceModule(
_In_ ULONG Flags
);
// rev - Win10 type
// rev
NTSYSAPI
NTSTATUS
NTAPI
@@ -800,13 +830,30 @@ LdrLoadAlternateResourceModuleEx(
_In_ ULONG Flags
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
LdrUnloadAlternateResourceModule(
_In_ PVOID DllHandle
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
LdrUnloadAlternateResourceModuleEx(
_In_ PVOID DllHandle,
_In_ ULONG Flags
);
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
// Module information
typedef struct _RTL_PROCESS_MODULE_INFORMATION
{
HANDLE Section;
PVOID Section;
PVOID MappedBase;
PVOID ImageBase;
ULONG ImageSize;
@@ -821,14 +868,30 @@ typedef struct _RTL_PROCESS_MODULE_INFORMATION
typedef struct _RTL_PROCESS_MODULES
{
ULONG NumberOfModules;
RTL_PROCESS_MODULE_INFORMATION Modules[1];
_Field_size_(NumberOfModules) RTL_PROCESS_MODULE_INFORMATION Modules[1];
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;
// private
typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX
{
USHORT NextOffset;
RTL_PROCESS_MODULE_INFORMATION BaseInfo;
union
{
RTL_PROCESS_MODULE_INFORMATION BaseInfo;
struct
{
PVOID Section;
PVOID MappedBase;
PVOID ImageBase;
ULONG ImageSize;
ULONG Flags;
USHORT LoadOrderIndex;
USHORT InitOrderIndex;
USHORT LoadCount;
USHORT OffsetToFileName;
UCHAR FullPathName[256];
};
};
ULONG ImageChecksum;
ULONG TimeDateStamp;
PVOID DefaultBase;
@@ -939,11 +1002,24 @@ typedef PVOID (NTAPI *PDELAYLOAD_FAILURE_DLL_CALLBACK)(
// rev
typedef PVOID (NTAPI *PDELAYLOAD_FAILURE_SYSTEM_ROUTINE)(
_In_ PCSTR DllName,
_In_ PCSTR ProcName
_In_ PCSTR ProcedureName
);
#if (PHNT_VERSION >= PHNT_THRESHOLD)
// rev from QueryOptionalDelayLoadedAPI
NTSYSAPI
NTSTATUS
NTAPI
LdrQueryOptionalDelayLoadedAPI(
_In_ PVOID ParentModuleBase,
_In_ PCSTR DllName,
_In_ PCSTR ProcedureName,
_Reserved_ ULONG Flags
);
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
// rev
// rev from ResolveDelayLoadedAPI
NTSYSAPI
PVOID
NTAPI
@@ -956,23 +1032,40 @@ LdrResolveDelayLoadedAPI(
_Reserved_ ULONG Flags
);
// rev
// rev from ResolveDelayLoadsFromDll
NTSYSAPI
NTSTATUS
NTAPI
LdrResolveDelayLoadsFromDll(
_In_ PVOID ParentBase,
_In_ PVOID ParentModuleBase,
_In_ PCSTR TargetDllName,
_Reserved_ ULONG Flags
);
// rev
// rev from SetDefaultDllDirectories
NTSYSAPI
NTSTATUS
NTAPI
LdrSetDefaultDllDirectories(
_In_ ULONG DirectoryFlags
);
// rev from AddDllDirectory
NTSYSAPI
NTSTATUS
NTAPI
LdrAddDllDirectory(
_In_ PUNICODE_STRING NewDirectory,
_Out_ PDLL_DIRECTORY_COOKIE Cookie
);
// rev from RemoveDllDirectory
NTSYSAPI
NTSTATUS
NTAPI
LdrRemoveDllDirectory(
_In_ DLL_DIRECTORY_COOKIE Cookie
);
#endif
// rev
@@ -1021,6 +1114,98 @@ LdrIsModuleSxsRedirected(
);
#endif
#if (PHNT_VERSION >= PHNT_THRESHOLD)
// rev
NTSYSAPI
NTSTATUS
NTAPI
LdrUpdatePackageSearchPath(
_In_ PWSTR SearchPath
);
#endif
#if (PHNT_VERSION >= PHNT_THRESHOLD)
// rev
#define ENCLAVE_STATE_CREATED 0x00000000ul // LdrpCreateSoftwareEnclave initial state
#define ENCLAVE_STATE_INITIALIZED 0x00000001ul // ZwInitializeEnclave successful (LdrInitializeEnclave)
#define ENCLAVE_STATE_INITIALIZED_VBS 0x00000002ul // only for ENCLAVE_TYPE_VBS (LdrInitializeEnclave)
// rev
typedef struct _LDR_SOFTWARE_ENCLAVE
{
LIST_ENTRY Links; // ntdll!LdrpEnclaveList
RTL_CRITICAL_SECTION CriticalSection;
ULONG EnclaveType; // ENCLAVE_TYPE_*
LONG ReferenceCount;
ULONG EnclaveState; // ENCLAVE_STATE_*
PVOID BaseAddress;
SIZE_T Size;
PVOID PreviousBaseAddress;
LIST_ENTRY Modules; // LDR_DATA_TABLE_ENTRY.InLoadOrderLinks
PLDR_DATA_TABLE_ENTRY PrimaryModule;
PLDR_DATA_TABLE_ENTRY BCryptModule;
PLDR_DATA_TABLE_ENTRY BCryptPrimitivesModule;
} LDR_SOFTWARE_ENCLAVE, *PLDR_SOFTWARE_ENCLAVE;
// rev from CreateEnclave
NTSYSAPI
NTSTATUS
NTAPI
LdrCreateEnclave(
_In_ HANDLE ProcessHandle,
_Inout_ PVOID* BaseAddress,
_In_ ULONG Reserved,
_In_ SIZE_T Size,
_In_ SIZE_T InitialCommitment,
_In_ ULONG EnclaveType,
_In_reads_bytes_(EnclaveInformationLength) PVOID EnclaveInformation,
_In_ ULONG EnclaveInformationLength,
_Out_ PULONG EnclaveError
);
// rev from InitializeEnclave
NTSYSAPI
NTSTATUS
NTAPI
LdrInitializeEnclave(
_In_ HANDLE ProcessHandle,
_In_ PVOID BaseAddress,
_In_reads_bytes_(EnclaveInformationLength) PVOID EnclaveInformation,
_In_ ULONG EnclaveInformationLength,
_Out_ PULONG EnclaveError
);
// rev from DeleteEnclave
NTSYSAPI
NTSTATUS
NTAPI
LdrDeleteEnclave(
_In_ PVOID BaseAddress
);
// rev from CallEnclave
NTSYSAPI
NTSTATUS
NTAPI
LdrCallEnclave(
_In_ PENCLAVE_ROUTINE Routine,
_In_ ULONG Flags, // ENCLAVE_CALL_FLAG_*
_Inout_ PVOID* RoutineParamReturn
);
// rev from LoadEnclaveImage
NTSYSAPI
NTSTATUS
NTAPI
LdrLoadEnclaveModule(
_In_ PVOID BaseAddress,
_In_opt_ PWSTR DllPath,
_In_ PUNICODE_STRING DllName
);
#endif
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#endif
ntlpcapi.h
+55 -16
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Local Inter-process Communication support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTLPCAPI_H
@@ -57,7 +52,7 @@ typedef struct _PORT_DATA_ENTRY
typedef struct _PORT_DATA_INFORMATION
{
ULONG CountDataEntries;
PORT_DATA_ENTRY DataEntries[1];
_Field_size_(CountDataEntries) PORT_DATA_ENTRY DataEntries[1];
} PORT_DATA_INFORMATION, *PPORT_DATA_INFORMATION;
#define LPC_REQUEST 1
@@ -70,6 +65,7 @@ typedef struct _PORT_DATA_INFORMATION
#define LPC_DEBUG_EVENT 8
#define LPC_ERROR_EVENT 9
#define LPC_CONNECTION_REQUEST 10
#define LPC_CONTINUATION_REQUIRED 0x2000
#define LPC_KERNELMODE_MESSAGE (CSHORT)0x8000
#define LPC_NO_IMPERSONATE (CSHORT)0x4000
@@ -366,9 +362,37 @@ NtQueryInformationPort(
// rev
typedef HANDLE ALPC_HANDLE, *PALPC_HANDLE;
#define ALPC_PORFLG_LPC_MODE 0x1000 // kernel only
#define ALPC_PORFLG_ALLOW_IMPERSONATION 0x10000
#define ALPC_PORFLG_ALLOW_LPC_REQUESTS 0x20000 // rev
#define ALPC_PORFLG_WAITABLE_PORT 0x40000 // dbg
#define ALPC_PORFLG_ALLOW_DUP_OBJECT 0x80000
#define ALPC_PORFLG_SYSTEM_PROCESS 0x100000 // dbg
#define ALPC_PORFLG_WAKE_POLICY1 0x200000
#define ALPC_PORFLG_WAKE_POLICY2 0x400000
#define ALPC_PORFLG_WAKE_POLICY3 0x800000
#define ALPC_PORFLG_DIRECT_MESSAGE 0x1000000
#define ALPC_PORFLG_ALLOW_MULTIHANDLE_ATTRIBUTE 0x2000000
#define ALPC_PORFLG_OBJECT_TYPE_FILE 0x0001
#define ALPC_PORFLG_OBJECT_TYPE_INVALID 0x0002
#define ALPC_PORFLG_OBJECT_TYPE_THREAD 0x0004
#define ALPC_PORFLG_OBJECT_TYPE_SEMAPHORE 0x0008
#define ALPC_PORFLG_OBJECT_TYPE_EVENT 0x0010
#define ALPC_PORFLG_OBJECT_TYPE_PROCESS 0X0020
#define ALPC_PORFLG_OBJECT_TYPE_MUTEX 0x0040
#define ALPC_PORFLG_OBJECT_TYPE_SECTION 0x0080
#define ALPC_PORFLG_OBJECT_TYPE_REGKEY 0x0100
#define ALPC_PORFLG_OBJECT_TYPE_TOKEN 0x0200
#define ALPC_PORFLG_OBJECT_TYPE_COMPOSITION 0x0400
#define ALPC_PORFLG_OBJECT_TYPE_JOB 0x0800
#define ALPC_PORFLG_OBJECT_TYPE_ALL \
(ALPC_PORFLG_OBJECT_TYPE_FILE | ALPC_PORFLG_OBJECT_TYPE_THREAD | \
ALPC_PORFLG_OBJECT_TYPE_SEMAPHORE | ALPC_PORFLG_OBJECT_TYPE_EVENT | \
ALPC_PORFLG_OBJECT_TYPE_PROCESS | ALPC_PORFLG_OBJECT_TYPE_MUTEX | \
ALPC_PORFLG_OBJECT_TYPE_SECTION | ALPC_PORFLG_OBJECT_TYPE_REGKEY | \
ALPC_PORFLG_OBJECT_TYPE_TOKEN | ALPC_PORFLG_OBJECT_TYPE_COMPOSITION | \
ALPC_PORFLG_OBJECT_TYPE_JOB)
// symbols
typedef struct _ALPC_PORT_ATTRIBUTES
@@ -496,6 +520,7 @@ typedef struct _ALPC_HANDLE_ATTR
#define ALPC_SECFLG_CREATE_HANDLE 0x20000 // dbg
#define ALPC_SECFLG_NOSECTIONHANDLE 0x40000
// private
typedef struct _ALPC_SECURITY_ATTR
{
@@ -529,7 +554,7 @@ typedef enum _ALPC_PORT_INFORMATION_CLASS
AlpcRegisterCompletionListInformation, // s: in ALPC_PORT_COMPLETION_LIST_INFORMATION
AlpcUnregisterCompletionListInformation, // s: VOID
AlpcAdjustCompletionListConcurrencyCountInformation, // s: in ULONG
AlpcRegisterCallbackInformation, // kernel-mode only
AlpcRegisterCallbackInformation, // s: ALPC_REGISTER_CALLBACK // kernel-mode only
AlpcCompletionListRundownInformation, // s: VOID // 10
AlpcWaitForPortReferences,
AlpcServerSessionInformation // q: ALPC_SERVER_SESSION_INFORMATION // since 19H2
@@ -584,6 +609,13 @@ typedef struct _ALPC_PORT_COMPLETION_LIST_INFORMATION
ULONG AttributeFlags;
} ALPC_PORT_COMPLETION_LIST_INFORMATION, *PALPC_PORT_COMPLETION_LIST_INFORMATION;
// private
typedef struct _ALPC_REGISTER_CALLBACK
{
PVOID CallbackObject; // PCALLBACK_OBJECT
PVOID CallbackContext;
} ALPC_REGISTER_CALLBACK, *PALPC_REGISTER_CALLBACK;
// private
typedef struct _ALPC_SERVER_SESSION_INFORMATION
{
@@ -654,6 +686,8 @@ NtAlpcSetInformation(
_In_ ULONG Length
);
#define ALPC_CREATEPORTSECTIONFLG_SECURE 0x40000 // rev
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -752,9 +786,10 @@ NtAlpcQueryInformationMessage(
);
#define ALPC_MSGFLG_REPLY_MESSAGE 0x1
#define ALPC_MSGFLG_LPC_MODE 0x2 // ?
#define ALPC_MSGFLG_LPC_MODE 0x2
#define ALPC_MSGFLG_RELEASE_MESSAGE 0x10000 // dbg
#define ALPC_MSGFLG_SYNC_REQUEST 0x20000 // dbg
#define ALPC_MSGFLG_TRACK_PORT_REFERENCES 0x40000
#define ALPC_MSGFLG_WAIT_USER_MODE 0x100000
#define ALPC_MSGFLG_WAIT_ALERTABLE 0x200000
#define ALPC_MSGFLG_WOW64_CALL 0x80000000 // dbg
@@ -770,7 +805,7 @@ NtAlpcConnectPort(
_In_ ULONG Flags,
_In_opt_ PSID RequiredServerSid,
_Inout_updates_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ConnectionMessage,
_Inout_opt_ PULONG BufferLength,
_Inout_opt_ PSIZE_T BufferLength,
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
_In_opt_ PLARGE_INTEGER Timeout
@@ -837,6 +872,10 @@ NtAlpcCancelMessage(
_In_ PALPC_CONTEXT_ATTR MessageContext
);
#define ALPC_IMPERSONATEFLG_ANONYMOUS 0x1
#define ALPC_IMPERSONATEFLG_REQUIRE_IMPERSONATE 0x2
//ALPC_IMPERSONATEFLG 0x3-0x10 (SECURITY_IMPERSONATION_LEVEL)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -853,7 +892,7 @@ NTAPI
NtAlpcImpersonateClientContainerOfPort(
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE Message,
_In_ ULONG Flags
_Reserved_ ULONG Flags
);
#endif
@@ -864,7 +903,7 @@ NtAlpcOpenSenderProcess(
_Out_ PHANDLE ProcessHandle,
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE PortMessage,
_In_ ULONG Flags,
_Reserved_ ULONG Flags,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
@@ -876,7 +915,7 @@ NtAlpcOpenSenderThread(
_Out_ PHANDLE ThreadHandle,
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE PortMessage,
_In_ ULONG Flags,
_Reserved_ ULONG Flags,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
@@ -907,8 +946,8 @@ NTAPI
AlpcInitializeMessageAttribute(
_In_ ULONG AttributeFlags,
_Out_opt_ PALPC_MESSAGE_ATTRIBUTES Buffer,
_In_ ULONG BufferSize,
_Out_ PULONG RequiredBufferSize
_In_ SIZE_T BufferSize,
_Out_ PSIZE_T RequiredBufferSize
);
NTSYSAPI
ntmisc.h
+2 -80
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Trace Control support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTMISC_H
@@ -47,77 +42,4 @@ NtVdmControl(
_Inout_ PVOID ServiceData
);
// WMI/ETW
NTSYSCALLAPI
NTSTATUS
NTAPI
NtTraceEvent(
_In_ HANDLE TraceHandle,
_In_ ULONG Flags,
_In_ ULONG FieldSize,
_In_ PVOID Fields
);
typedef enum _TRACE_CONTROL_INFORMATION_CLASS
{
TraceControlStartLogger = 1, // inout WMI_LOGGER_INFORMATION
TraceControlStopLogger = 2, // inout WMI_LOGGER_INFORMATION
TraceControlQueryLogger = 3, // inout WMI_LOGGER_INFORMATION
TraceControlUpdateLogger = 4, // inout WMI_LOGGER_INFORMATION
TraceControlFlushLogger = 5, // inout WMI_LOGGER_INFORMATION
TraceControlIncrementLoggerFile = 6, // inout WMI_LOGGER_INFORMATION
TraceControlUnknown = 7,
// unused
TraceControlRealtimeConnect = 11,
TraceControlActivityIdCreate = 12,
TraceControlWdiDispatchControl = 13,
TraceControlRealtimeDisconnectConsumerByHandle = 14, // in HANDLE
TraceControlRegisterGuidsCode = 15,
TraceControlReceiveNotification = 16,
TraceControlSendDataBlock = 17, // ETW_ENABLE_NOTIFICATION_PACKET
TraceControlSendReplyDataBlock = 18,
TraceControlReceiveReplyDataBlock = 19,
TraceControlWdiUpdateSem = 20,
TraceControlEnumTraceGuidList = 21, // out GUID[]
TraceControlGetTraceGuidInfo = 22, // in GUID, out TRACE_GUID_INFO
TraceControlEnumerateTraceGuids = 23,
TraceControlRegisterSecurityProv = 24,
TraceControlQueryReferenceTime = 25,
TraceControlTrackProviderBinary = 26, // in HANDLE
TraceControlAddNotificationEvent = 27,
TraceControlUpdateDisallowList = 28,
TraceControlSetEnableAllKeywordsCode = 29,
TraceControlSetProviderTraitsCode = 30,
TraceControlUseDescriptorTypeCode = 31,
TraceControlEnumTraceGroupList = 32,
TraceControlGetTraceGroupInfo = 33,
TraceControlTraceSetDisallowList = 34,
TraceControlSetCompressionSettings = 35,
TraceControlGetCompressionSettings = 36,
TraceControlUpdatePeriodicCaptureState = 37,
TraceControlGetPrivateSessionTraceHandle = 38,
TraceControlRegisterPrivateSession = 39,
TraceControlQuerySessionDemuxObject = 40,
TraceControlSetProviderBinaryTracking = 41,
TraceControlMaxLoggers = 42, // out ULONG
TraceControlMaxPmcCounter = 43, // out ULONG
TraceControlQueryUsedProcessorCount = 44, // ULONG // since WIN11
TraceControlGetPmcOwnership = 45,
} TRACE_CONTROL_INFORMATION_CLASS;
#if (PHNT_VERSION >= PHNT_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtTraceControl(
_In_ TRACE_CONTROL_INFORMATION_CLASS TraceInformationClass,
_In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
_In_ ULONG InputBufferLength,
_Out_writes_bytes_opt_(TraceInformationLength) PVOID TraceInformation,
_In_ ULONG TraceInformationLength,
_Out_ PULONG ReturnLength
);
#endif
#endif
ntmmapi.h
+69 -35
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Memory Manager Support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTMMAPI_H
@@ -67,6 +62,7 @@
#define SEC_HUGE_PAGES 0x00020000
#define SEC_PARTITION_OWNER_HANDLE 0x00040000
#define SEC_64K_PAGES 0x00080000
#define SEC_DRIVER_IMAGE 0x00100000 // rev
#define SEC_BASED 0x00200000
#define SEC_NO_CHANGE 0x00400000
#define SEC_FILE 0x00800000
@@ -84,18 +80,17 @@
#endif
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// private
typedef enum _MEMORY_INFORMATION_CLASS
{
MemoryBasicInformation, // MEMORY_BASIC_INFORMATION
MemoryWorkingSetInformation, // MEMORY_WORKING_SET_INFORMATION
MemoryMappedFilenameInformation, // UNICODE_STRING
MemoryRegionInformation, // MEMORY_REGION_INFORMATION
MemoryWorkingSetExInformation, // MEMORY_WORKING_SET_EX_INFORMATION // since VISTA
MemorySharedCommitInformation, // MEMORY_SHARED_COMMIT_INFORMATION // since WIN8
MemoryImageInformation, // MEMORY_IMAGE_INFORMATION
MemoryBasicInformation, // q: MEMORY_BASIC_INFORMATION
MemoryWorkingSetInformation, // q: MEMORY_WORKING_SET_INFORMATION
MemoryMappedFilenameInformation, // q: UNICODE_STRING
MemoryRegionInformation, // q: MEMORY_REGION_INFORMATION
MemoryWorkingSetExInformation, // q: MEMORY_WORKING_SET_EX_INFORMATION // since VISTA
MemorySharedCommitInformation, // q: MEMORY_SHARED_COMMIT_INFORMATION // since WIN8
MemoryImageInformation, // q: MEMORY_IMAGE_INFORMATION
MemoryRegionInformationEx, // MEMORY_REGION_INFORMATION
MemoryPrivilegedBasicInformation,
MemoryPrivilegedBasicInformation, // MEMORY_BASIC_INFORMATION
MemoryEnclaveImageInformation, // MEMORY_ENCLAVE_IMAGE_INFORMATION // since REDSTONE3
MemoryBasicInformationCapped, // 10
MemoryPhysicalContiguityInformation, // MEMORY_PHYSICAL_CONTIGUITY_INFORMATION // since 20H1
@@ -136,7 +131,7 @@ typedef struct _MEMORY_WORKING_SET_BLOCK
typedef struct _MEMORY_WORKING_SET_INFORMATION
{
ULONG_PTR NumberOfEntries;
MEMORY_WORKING_SET_BLOCK WorkingSetInfo[1];
_Field_size_(NumberOfEntries) MEMORY_WORKING_SET_BLOCK WorkingSetInfo[1];
} MEMORY_WORKING_SET_INFORMATION, *PMEMORY_WORKING_SET_INFORMATION;
// private
@@ -253,7 +248,8 @@ typedef struct _MEMORY_IMAGE_INFORMATION
ULONG ImagePartialMap : 1;
ULONG ImageNotExecutable : 1;
ULONG ImageSigningLevel : 4; // REDSTONE3
ULONG Reserved : 26;
ULONG ImageExtensionPresent : 1; // since 24H2
ULONG Reserved : 25;
};
};
} MEMORY_IMAGE_INFORMATION, *PMEMORY_IMAGE_INFORMATION;
@@ -426,8 +422,8 @@ typedef enum _SECTION_INFORMATION_CLASS
{
SectionBasicInformation, // q; SECTION_BASIC_INFORMATION
SectionImageInformation, // q; SECTION_IMAGE_INFORMATION
SectionRelocationInformation, // q; PVOID RelocationAddress // name:wow64:whNtQuerySection_SectionRelocationInformation // since WIN7
SectionOriginalBaseInformation, // PVOID BaseAddress
SectionRelocationInformation, // q; ULONG_PTR RelocationDelta // name:wow64:whNtQuerySection_SectionRelocationInformation // since WIN7
SectionOriginalBaseInformation, // q; PVOID BaseAddress // since REDSTONE
SectionInternalImageInformation, // SECTION_INTERNAL_IMAGE_INFORMATION // since REDSTONE2
MaxSectionInfoClass
} SECTION_INFORMATION_CLASS;
@@ -505,7 +501,9 @@ typedef struct _SECTION_INTERNAL_IMAGE_INFORMATION
ULONG ImageCetDynamicApisAllowInProc : 1;
ULONG ImageCetDowngradeReserved1 : 1;
ULONG ImageCetDowngradeReserved2 : 1;
ULONG Reserved : 24;
ULONG ImageExportSuppressionInfoPresent : 1;
ULONG ImageCfgEnabled : 1;
ULONG Reserved : 22;
};
};
} SECTION_INTERNAL_IMAGE_INFORMATION, *PSECTION_INTERNAL_IMAGE_INFORMATION;
@@ -524,12 +522,15 @@ typedef enum _SECTION_INHERIT
#define MEM_EXECUTE_OPTION_PERMANENT 0x8
#define MEM_EXECUTE_OPTION_EXECUTE_DISPATCH_ENABLE 0x10
#define MEM_EXECUTE_OPTION_IMAGE_DISPATCH_ENABLE 0x20
#define MEM_EXECUTE_OPTION_VALID_FLAGS 0x3f
#define MEM_EXECUTE_OPTION_DISABLE_EXCEPTION_CHAIN_VALIDATION 0x40
#define MEM_EXECUTE_OPTION_VALID_FLAGS 0x7f
// Virtual memory
#if (PHNT_MODE != PHNT_MODE_KERNEL)
_Must_inspect_result_
_When_(return == 0, __drv_allocatesMem(mem))
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -543,7 +544,10 @@ NtAllocateVirtualMemory(
);
#if (PHNT_VERSION >= PHNT_REDSTONE5)
NTSYSAPI
_Must_inspect_result_
_When_(return == 0, __drv_allocatesMem(mem))
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAllocateVirtualMemoryEx(
@@ -555,6 +559,7 @@ NtAllocateVirtualMemoryEx(
_Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters,
_In_ ULONG ExtendedParameterCount
);
#endif
NTSYSCALLAPI
@@ -580,7 +585,7 @@ NtReadVirtualMemory(
#if (PHNT_VERSION >= PHNT_WIN11)
// rev
NTSYSAPI
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReadVirtualMemoryEx(
@@ -627,6 +632,8 @@ NtQueryVirtualMemory(
_Out_opt_ PSIZE_T ReturnLength
);
typedef struct _IO_STATUS_BLOCK* PIO_STATUS_BLOCK;
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -634,7 +641,7 @@ NtFlushVirtualMemory(
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_Inout_ PSIZE_T RegionSize,
_Out_ struct _IO_STATUS_BLOCK* IoStatus
_Out_ PIO_STATUS_BLOCK IoStatus
);
#endif
@@ -653,7 +660,19 @@ typedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS
VmRemoveFromWorkingSetInformation,
MaxVmInfoClass
} VIRTUAL_MEMORY_INFORMATION_CLASS;
#else
#define VmPrefetchInformation 0x0
#define VmPagePriorityInformation 0x1
#define VmCfgCallTargetInformation 0x2
#define VmPageDirtyStateInformation 0x3
#define VmImageHotPatchInformation 0x4
#define VmPhysicalContiguityInformation 0x5
#define VmVirtualMachinePrepopulateInformation 0x6
#define VmRemoveFromWorkingSetInformation 0x7
#define MaxVmInfoClass 0x8
#endif
#if (PHNT_MODE != PHNT_MODE_KERNEL)
typedef struct _MEMORY_RANGE_ENTRY
{
PVOID VirtualAddress;
@@ -683,8 +702,8 @@ NtSetInformationVirtualMemory(
_In_ HANDLE ProcessHandle,
_In_ VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass,
_In_ ULONG_PTR NumberOfEntries,
_In_reads_ (NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses,
_In_reads_bytes_ (VmInformationLength) PVOID VmInformation,
_In_reads_(NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses,
_In_reads_bytes_(VmInformationLength) PVOID VmInformation,
_In_ ULONG VmInformationLength
);
@@ -775,7 +794,7 @@ NtMapViewOfSection(
);
#if (PHNT_VERSION >= PHNT_REDSTONE5)
NTSYSAPI
NTSYSCALLAPI
NTSTATUS
NTAPI
NtMapViewOfSectionEx(
@@ -786,7 +805,7 @@ NtMapViewOfSectionEx(
_Inout_ PSIZE_T ViewSize,
_In_ ULONG AllocationType,
_In_ ULONG Win32Protect,
_Inout_updates_opt_(ParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters,
_Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters,
_In_ ULONG ExtendedParameterCount
);
#endif
@@ -867,6 +886,7 @@ typedef enum _PARTITION_INFORMATION_CLASS
SystemMemoryPartitionMemoryChargeAttributes,
SystemMemoryPartitionClearAttributes,
SystemMemoryPartitionSetMemoryThresholds, // since WIN11
SystemMemoryPartitionMemoryListCommand, // since 24H2
SystemMemoryPartitionMax
} PARTITION_INFORMATION_CLASS, *PPARTITION_INFORMATION_CLASS;
#else
@@ -884,7 +904,8 @@ typedef enum _PARTITION_INFORMATION_CLASS
#define SystemMemoryPartitionMemoryChargeAttributes 0xB
#define SystemMemoryPartitionClearAttributes 0xC
#define SystemMemoryPartitionSetMemoryThresholds 0xD
#define SystemMemoryPartitionMax 0xE
#define SystemMemoryPartitionMemoryListCommand 0xE
#define SystemMemoryPartitionMax 0xF
#endif
// private
@@ -979,7 +1000,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreatePartition(
_In_ HANDLE ParentPartitionHandle,
_In_opt_ HANDLE ParentPartitionHandle,
_Out_ PHANDLE PartitionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
@@ -1119,6 +1140,7 @@ NtFlushWriteBuffer(
#endif
#if (PHNT_VERSION >= PHNT_THRESHOLD)
// Enclave support
NTSYSCALLAPI
@@ -1162,26 +1184,38 @@ NtInitializeEnclave(
_Out_opt_ PULONG EnclaveError
);
// rev
#define TERMINATE_ENCLAVE_VALID_FLAGS 0x00000005ul
#define TERMINATE_ENCLAVE_FLAG_NO_WAIT 0x00000001ul
#define TERMINATE_ENCLAVE_FLAG_WAIT_ERROR 0x00000004ul // STATUS_PENDING -> STATUS_ENCLAVE_NOT_TERMINATED
// rev
NTSYSCALLAPI
NTSTATUS
NTAPI
NtTerminateEnclave(
_In_ PVOID BaseAddress,
_In_ BOOLEAN WaitForThread
_In_ ULONG Flags // TERMINATE_ENCLAVE_FLAG_*
);
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// rev
#define ENCLAVE_CALL_VALID_FLAGS 0x00000001ul
#define ENCLAVE_CALL_FLAG_NO_WAIT 0x00000001ul
// rev
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCallEnclave(
_In_ PENCLAVE_ROUTINE Routine,
_In_ PVOID Parameter,
_In_ BOOLEAN WaitForThread,
_Out_opt_ PVOID *ReturnValue
_In_ PVOID Reserved, // reserved for dispatch (RtlEnclaveCallDispatch)
_In_ ULONG Flags, // ENCLAVE_CALL_FLAG_*
_Inout_ PVOID* RoutineParamReturn // input routine parameter, output routine return value
);
#endif
#endif
#endif
ntnls.h
+2 -7
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* National Language Support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTNLS_H
ntobapi.h
+5 -10
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Object Manager support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTOBAPI_H
@@ -14,7 +9,7 @@
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#define OBJECT_TYPE_CREATE 0x0001
#define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
#define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | OBJECT_TYPE_CREATE)
#endif
#if (PHNT_MODE != PHNT_MODE_KERNEL)
@@ -22,13 +17,13 @@
#define DIRECTORY_TRAVERSE 0x0002
#define DIRECTORY_CREATE_OBJECT 0x0004
#define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xf)
#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | DIRECTORY_QUERY | DIRECTORY_TRAVERSE | DIRECTORY_CREATE_OBJECT | DIRECTORY_CREATE_SUBDIRECTORY)
#endif
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#define SYMBOLIC_LINK_QUERY 0x0001
#define SYMBOLIC_LINK_SET 0x0002
#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYMBOLIC_LINK_QUERY)
#define SYMBOLIC_LINK_ALL_ACCESS_EX (STANDARD_RIGHTS_REQUIRED | 0xFFFF)
#endif
ntpebteb.h
+106 -35
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Process and Thread Environment Block support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTPEBTEB_H
@@ -14,16 +9,35 @@
typedef struct _RTL_USER_PROCESS_PARAMETERS *PRTL_USER_PROCESS_PARAMETERS;
typedef struct _RTL_CRITICAL_SECTION *PRTL_CRITICAL_SECTION;
typedef struct _SILO_USER_SHARED_DATA *PSILO_USER_SHARED_DATA;
typedef struct _LEAP_SECOND_DATA *PLEAP_SECOND_DATA;
#include <ntsxs.h>
// private
typedef struct _ACTIVATION_CONTEXT_STACK
{
struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME* ActiveFrame;
LIST_ENTRY FrameListCache;
ULONG Flags;
ULONG NextCookieSequenceNumber;
ULONG StackId;
} ACTIVATION_CONTEXT_STACK, *PACTIVATION_CONTEXT_STACK;
#define KACF_OLDGETSHORTPATHNAME 0x00000001
#define KACF_VERSIONLIE_NOT_USED 0x00000002
#define KACF_GETDISKFREESPACE 0x00000008
#define KACF_FTMFROMCURRENTAPT 0x00000020
#define KACF_DISALLOWORBINDINGCHANGES 0x00000040
#define KACF_OLE32VALIDATEPTRS 0x00000080
#define KACF_DISABLECICERO 0x00000100
#define KACF_OLE32ENABLEASYNCDOCFILE 0x00000200
#define KACF_OLE32ENABLELEGACYEXCEPTIONHANDLING 0x00000400
#define KACF_RPCDISABLENDRCLIENTHARDENING 0x00000800
#define KACF_RPCDISABLENDRMAYBENULL_SIZEIS 0x00001000
#define KACF_DISABLEALLDDEHACK_NOT_USED 0x00002000
#define KACF_RPCDISABLENDR61_RANGE 0x00004000
#define KACF_RPC32ENABLELEGACYEXCEPTIONHANDLING 0x00008000
#define KACF_OLE32DOCFILEUSELEGACYNTFSFLAGS 0x00010000
#define KACF_RPCDISABLENDRCONSTIIDCHECK 0x00020000
#define KACF_USERDISABLEFORWARDERPATCH 0x00040000
#define KACF_OLE32DISABLENEW_WMPAINT_DISPATCH 0x00100000
#define KACF_ADDRESTRICTEDSIDINCOINITIALIZESECURITY 0x00200000
#define KACF_ALLOCDEBUGINFOFORCRITSECTIONS 0x00400000
#define KACF_OLEAUT32ENABLEUNSAFELOADTYPELIBRELATIVE 0x00800000
#define KACF_ALLOWMAXIMIZEDWINDOWGAMMA 0x01000000
#define KACF_DONOTADDTOCACHE 0x80000000
// private
typedef struct _API_SET_NAMESPACE
@@ -65,6 +79,28 @@ typedef struct _API_SET_VALUE_ENTRY
ULONG ValueLength;
} API_SET_VALUE_ENTRY, *PAPI_SET_VALUE_ENTRY;
// private
typedef struct _TELEMETRY_COVERAGE_HEADER
{
UCHAR MajorVersion;
UCHAR MinorVersion;
struct
{
USHORT TracingEnabled : 1;
USHORT Reserved1 : 15;
};
ULONG HashTableEntries;
ULONG HashIndexMask;
ULONG TableUpdateVersion;
ULONG TableSizeInBytes;
ULONG LastResetTick;
ULONG ResetRound;
ULONG Reserved2;
ULONG RecordedCount;
ULONG Reserved3[4];
ULONG HashTable[ANYSIZE_ARRAY];
} TELEMETRY_COVERAGE_HEADER, *PTELEMETRY_COVERAGE_HEADER;
// symbols
typedef struct _PEB
{
@@ -123,11 +159,11 @@ typedef struct _PEB
ULONG AtlThunkSListPtr32;
PAPI_SET_NAMESPACE ApiSetMap;
ULONG TlsExpansionCounter;
PVOID TlsBitmap;
ULONG TlsBitmapBits[2];
PRTL_BITMAP TlsBitmap;
ULONG TlsBitmapBits[2]; // TLS_MINIMUM_AVAILABLE
PVOID ReadOnlySharedMemoryBase;
PVOID SharedData; // HotpatchInformation
PSILO_USER_SHARED_DATA SharedData; // HotpatchInformation
PVOID *ReadOnlyStaticServerData;
PVOID AnsiCodePageData; // PCPTABLEINFO
@@ -147,7 +183,7 @@ typedef struct _PEB
ULONG MaximumNumberOfHeaps;
PVOID *ProcessHeaps; // PHEAP
PVOID GdiSharedHandleTable;
PVOID GdiSharedHandleTable; // PGDI_SHARED_MEMORY
PVOID ProcessStarterHelper;
ULONG GdiDCAttributeList;
@@ -165,22 +201,22 @@ typedef struct _PEB
GDI_HANDLE_BUFFER GdiHandleBuffer;
PVOID PostProcessInitRoutine;
PVOID TlsExpansionBitmap;
ULONG TlsExpansionBitmapBits[32];
PRTL_BITMAP TlsExpansionBitmap;
ULONG TlsExpansionBitmapBits[32]; // TLS_EXPANSION_SLOTS
ULONG SessionId;
ULARGE_INTEGER AppCompatFlags;
ULARGE_INTEGER AppCompatFlags; // KACF_*
ULARGE_INTEGER AppCompatFlagsUser;
PVOID pShimData;
PVOID AppCompatInfo; // APPCOMPAT_EXE_DATA
UNICODE_STRING CSDVersion;
PVOID ActivationContextData; // ACTIVATION_CONTEXT_DATA
PVOID ProcessAssemblyStorageMap; // ASSEMBLY_STORAGE_MAP
PVOID SystemDefaultActivationContextData; // ACTIVATION_CONTEXT_DATA
PVOID SystemAssemblyStorageMap; // ASSEMBLY_STORAGE_MAP
PACTIVATION_CONTEXT_DATA ActivationContextData;
PASSEMBLY_STORAGE_MAP ProcessAssemblyStorageMap;
PACTIVATION_CONTEXT_DATA SystemDefaultActivationContextData;
PASSEMBLY_STORAGE_MAP SystemAssemblyStorageMap;
SIZE_T MinimumStackCommit;
@@ -222,12 +258,12 @@ typedef struct _PEB
PRTL_CRITICAL_SECTION TppWorkerpListLock;
LIST_ENTRY TppWorkerpList;
PVOID WaitOnAddressHashTable[128];
PVOID TelemetryCoverageHeader; // REDSTONE3
PTELEMETRY_COVERAGE_HEADER TelemetryCoverageHeader; // REDSTONE3
ULONG CloudFileFlags;
ULONG CloudFileDiagFlags; // REDSTONE4
CHAR PlaceholderCompatibilityMode;
CHAR PlaceholderCompatibilityModeReserved[7];
struct _LEAP_SECOND_DATA *LeapSecondData; // REDSTONE5
PLEAP_SECOND_DATA LeapSecondData; // REDSTONE5
union
{
ULONG LeapSecondFlags;
@@ -270,6 +306,12 @@ typedef struct _TEB_ACTIVE_FRAME_CONTEXT
PSTR FrameName;
} TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;
typedef struct _TEB_ACTIVE_FRAME_CONTEXT_EX
{
TEB_ACTIVE_FRAME_CONTEXT BasicContext;
PSTR SourceLocation;
} TEB_ACTIVE_FRAME_CONTEXT_EX, *PTEB_ACTIVE_FRAME_CONTEXT_EX;
typedef struct _TEB_ACTIVE_FRAME
{
ULONG Flags;
@@ -277,6 +319,15 @@ typedef struct _TEB_ACTIVE_FRAME
PTEB_ACTIVE_FRAME_CONTEXT Context;
} TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
typedef struct _TEB_ACTIVE_FRAME_EX
{
TEB_ACTIVE_FRAME BasicFrame;
PVOID ExtensionIdentifier;
} TEB_ACTIVE_FRAME_EX, *PTEB_ACTIVE_FRAME_EX;
#define STATIC_UNICODE_BUFFER_LENGTH 261
#define WIN32_CLIENT_INFO_LENGTH 62
typedef struct _TEB
{
NT_TIB NtTib;
@@ -298,7 +349,11 @@ typedef struct _TEB
ULONG FpSoftwareStatusRegister;
PVOID ReservedForDebuggerInstrumentation[16];
#ifdef _WIN64
PVOID SystemReserved1[30];
PVOID SystemReserved1[25];
PVOID HeapFlsData;
ULONG_PTR RngState[4];
#else
PVOID SystemReserved1[26];
#endif
@@ -311,6 +366,7 @@ typedef struct _TEB
ACTIVATION_CONTEXT_STACK ActivationStack;
UCHAR WorkingOnBehalfTicket[8];
NTSTATUS ExceptionCode;
PACTIVATION_CONTEXT_STACK ActivationContextStackPointer;
@@ -335,7 +391,8 @@ typedef struct _TEB
ULONG GdiClientPID;
ULONG GdiClientTID;
PVOID GdiThreadLocalInfo;
ULONG_PTR Win32ClientInfo[62];
ULONG_PTR Win32ClientInfo[WIN32_CLIENT_INFO_LENGTH];
PVOID glDispatchTable[233];
ULONG_PTR glReserved1[29];
PVOID glReserved2;
@@ -346,11 +403,13 @@ typedef struct _TEB
PVOID glContext;
NTSTATUS LastStatusValue;
UNICODE_STRING StaticUnicodeString;
WCHAR StaticUnicodeBuffer[261];
WCHAR StaticUnicodeBuffer[STATIC_UNICODE_BUFFER_LENGTH];
PVOID DeallocationStack;
PVOID TlsSlots[64];
PVOID TlsSlots[TLS_MINIMUM_AVAILABLE];
LIST_ENTRY TlsLinks;
PVOID Vdm;
@@ -386,15 +445,15 @@ typedef struct _TEB
ULONG GuaranteedStackBytes;
PVOID ReservedForPerf;
PVOID ReservedForOle;
PVOID ReservedForOle; // tagSOleTlsData
ULONG WaitingOnLoaderLock;
PVOID SavedPriorityState;
ULONG_PTR ReservedForCodeCoverage;
PVOID ThreadPoolData;
PVOID *TlsExpansionSlots;
#ifdef _WIN64
PVOID DeallocationBStore;
PVOID BStoreLimit;
PVOID ChpeV2CpuAreaInfo; // CHPEV2_CPUAREA_INFO // previously DeallocationBStore
PVOID Unused; // previously BStoreLimit
#endif
ULONG MuiGeneration;
ULONG IsImpersonating;
@@ -451,6 +510,18 @@ typedef struct _TEB
ULONGLONG LastSleepCounter; // Win11
ULONG SpinCallCount;
ULONGLONG ExtendedFeatureDisableMask;
PVOID SchedulerSharedDataSlot; // 24H2
PVOID HeapWalkContext;
GROUP_AFFINITY PrimaryGroupAffinity;
ULONG Rcu[2];
} TEB, *PTEB;
#ifdef _WIN64
//C_ASSERT(sizeof(TEB) == 0x1850); // WIN11
C_ASSERT(sizeof(TEB) == 0x1878); // 24H2
#else
//C_ASSERT(sizeof(TEB) == 0x1018); // WIN11
C_ASSERT(sizeof(TEB) == 0x1038); // 24H2
#endif
#endif
ntpfapi.h
+183 -22
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Prefetcher (Superfetch) support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTPFAPI_H
@@ -101,6 +96,54 @@ typedef struct _PF_SYSTEM_SUPERFETCH_PARAMETERS
ULONG ScenarioPrefetchTimeoutHiberBoot;
} PF_SYSTEM_SUPERFETCH_PARAMETERS, *PPF_SYSTEM_SUPERFETCH_PARAMETERS;
// rev
typedef enum _PF_EVENT_TYPE
{
PfEventTypeImageLoad = 0,
PfEventTypeAppLaunch = 1,
PfEventTypeStartTrace = 2,
PfEventTypeEndTrace = 3,
PfEventTypeTimestamp = 4,
PfEventTypeOperation = 5,
PfEventTypeRepurpose = 6,
PfEventTypeForegroundProcess = 7,
PfEventTypeTimeRange = 8,
PfEventTypeUserInput = 9,
PfEventTypeFileAccess = 10,
PfEventTypeUnmap = 11,
PfEventTypeUtilization = 11,
PfEventTypeMemInfo = 12,
PfEventTypeFileDelete = 13,
PfEventTypeAppExit = 14,
PfEventTypeSystemTime = 15,
PfEventTypePower = 16,
PfEventTypeSessionChange = 17,
PfEventTypeHardFaultTimeStamp = 18,
PfEventTypeVirtualFree = 19,
PfEventTypePerfInfo = 20,
PfEventTypeProcessSnapshot = 21,
PfEventTypeUserSnapshot = 22,
PfEventTypeStreamSequenceNumber = 23,
PfEventTypeFileTruncate = 24,
PfEventTypeFileRename = 25,
PfEventTypeFileCreate = 26,
PfEventTypeAgCxContext = 27,
PfEventTypePowerAction = 28,
PfEventTypeHardFaultTS = 29,
PfEventTypeRobustInfo = 30,
PfEventTypeFileDefrag = 31,
PfEventTypeMax = 32
} PF_EVENT_TYPE;
// rev
typedef struct _PF_LOG_EVENT_DATA
{
ULONG EventType : 5; // PF_EVENT_TYPE
ULONG Flags : 2;
ULONG DataSize : 25;
PVOID EventData;
} PF_LOG_EVENT_DATA, *PPF_LOG_EVENT_DATA;
#define PF_PFN_PRIO_REQUEST_VERSION 1
#define PF_PFN_PRIO_REQUEST_QUERY_MEMORY_LIST 0x1
#define PF_PFN_PRIO_REQUEST_VALID_FLAGS 0x1
@@ -156,8 +199,13 @@ typedef struct _PF_PRIVSOURCE_INFO
ULONG Spare : 28;
} PF_PRIVSOURCE_INFO, *PPF_PRIVSOURCE_INFO;
// rev
#define PF_PRIVSOURCE_QUERY_REQUEST_VERSION 8
#define PF_PRIVSOURCE_QUERY_REQUEST_FLAGS_QUERYWSPAGES 0x1
#define PF_PRIVSOURCE_QUERY_REQUEST_FLAGS_QUERYCOMPRESSEDPAGES 0x2
#define PF_PRIVSOURCE_QUERY_REQUEST_FLAGS_QUERYSKIPPAGES 0x4 // ??
// rev
typedef struct _PF_PRIVSOURCE_QUERY_REQUEST
{
ULONG Version;
@@ -166,6 +214,7 @@ typedef struct _PF_PRIVSOURCE_QUERY_REQUEST
PF_PRIVSOURCE_INFO InfoArray[1];
} PF_PRIVSOURCE_QUERY_REQUEST, *PPF_PRIVSOURCE_QUERY_REQUEST;
// rev
typedef enum _PF_PHASED_SCENARIO_TYPE
{
PfScenarioTypeNone,
@@ -175,8 +224,10 @@ typedef enum _PF_PHASED_SCENARIO_TYPE
PfScenarioTypeMax
} PF_PHASED_SCENARIO_TYPE;
// rev
#define PF_SCENARIO_PHASE_INFO_VERSION 4
// rev
typedef struct _PF_SCENARIO_PHASE_INFO
{
ULONG Version;
@@ -187,6 +238,7 @@ typedef struct _PF_SCENARIO_PHASE_INFO
ULONG FUSUserId;
} PF_SCENARIO_PHASE_INFO, *PPF_SCENARIO_PHASE_INFO;
// rev
typedef struct _PF_MEMORY_LIST_NODE
{
ULONGLONG Node : 8;
@@ -198,6 +250,52 @@ typedef struct _PF_MEMORY_LIST_NODE
ULONGLONG ModifiedPageCount;
} PF_MEMORY_LIST_NODE, *PPF_MEMORY_LIST_NODE;
// rev
typedef struct _PF_ROBUST_PROCESS_ENTRY
{
ULONG ImagePathHash;
ULONG Pid;
ULONG Alignment;
} PF_ROBUST_PROCESS_ENTRY, *PPF_ROBUST_PROCESS_ENTRY;
// rev
typedef struct _PF_ROBUST_FILE_ENTRY
{
ULONG FilePathHash;
} PF_ROBUST_FILE_ENTRY, *PPF_ROBUST_FILE_ENTRY;
// rev
typedef enum _PF_ROBUSTNESS_CONTROL_COMMAND
{
PfRpControlUpdate = 0,
PfRpControlReset = 1,
PfRpControlRobustAllStart = 2,
PfRpControlRobustAllStop = 3,
PfRpControlCommandMax = 4
} PF_ROBUSTNESS_CONTROL_COMMAND;
// rev
#define PF_ROBUSTNESS_CONTROL_VERSION 1
// rev
typedef struct _PF_ROBUSTNESS_CONTROL
{
ULONG Version;
PF_ROBUSTNESS_CONTROL_COMMAND Command;
ULONG DeprioProcessCount;
ULONG ExemptProcessCount;
ULONG DeprioFileCount;
ULONG ExemptFileCount;
PF_ROBUST_PROCESS_ENTRY ProcessEntries[1];
PF_ROBUST_FILE_ENTRY FileEntries[1];
} PF_ROBUSTNESS_CONTROL, *PPF_ROBUSTNESS_CONTROL;
// rev
typedef struct _PF_TIME_CONTROL
{
LONG TimeAdjustment;
} PF_TIME_CONTROL, *PPF_TIME_CONTROL;
#define PF_MEMORY_LIST_INFO_VERSION 1
typedef struct _PF_MEMORY_LIST_INFO
@@ -233,48 +331,111 @@ typedef struct _PF_PHYSICAL_MEMORY_RANGE_INFO_V2
PF_PHYSICAL_MEMORY_RANGE Ranges[ANYSIZE_ARRAY];
} PF_PHYSICAL_MEMORY_RANGE_INFO_V2, *PPF_PHYSICAL_MEMORY_RANGE_INFO_V2;
// begin_rev
// rev
#define PF_REPURPOSED_BY_PREFETCH_INFO_VERSION 1
// rev
typedef struct _PF_REPURPOSED_BY_PREFETCH_INFO
{
ULONG Version;
ULONG RepurposedByPrefetch;
SIZE_T RepurposedByPrefetch;
} PF_REPURPOSED_BY_PREFETCH_INFO, *PPF_REPURPOSED_BY_PREFETCH_INFO;
// end_rev
// rev
#define PF_VIRTUAL_QUERY_VERSION 1
// rev
typedef struct _PF_VIRTUAL_QUERY
{
ULONG Version;
union
{
ULONG Flags;
struct
{
ULONG FaultInPageTables : 1;
ULONG ReportPageTables : 1;
ULONG Spare : 30;
};
};
PVOID QueryBuffer; // MEMORY_WORKING_SET_EX_INFORMATION[NumberOfPages] (input: VirtualAddress[], output: VirtualAttributes[])
SIZE_T QueryBufferSize; // NumberOfPages * sizeof(MEMORY_WORKING_SET_EX_INFORMATION)
HANDLE ProcessHandle;
} PF_VIRTUAL_QUERY, *PPF_VIRTUAL_QUERY;
// rev
#define PF_MIN_WS_AGE_RATE_CONTROL_VERSION 1
// rev
typedef struct _PF_MIN_WS_AGE_RATE_CONTROL
{
ULONG Version;
ULONG SecondsToOldestAge;
} PF_MIN_WS_AGE_RATE_CONTROL, *PPF_MIN_WS_AGE_RATE_CONTROL;
// rev
#define PF_DEPRIORITIZE_OLD_PAGES_VERSION 3
// rev
typedef struct _PF_DEPRIORITIZE_OLD_PAGES
{
ULONG Version;
HANDLE ProcessHandle;
union
{
ULONG Flags;
struct
{
ULONG TargetPriority : 4;
ULONG TrimPages : 2;
ULONG Spare : 26;
};
};
} PF_DEPRIORITIZE_OLD_PAGES, *PPF_DEPRIORITIZE_OLD_PAGES;
// rev
#define PF_GPU_UTILIZATION_INFO_VERSION 1
// rev
typedef struct _PF_GPU_UTILIZATION_INFO
{
ULONG Version;
ULONG SessionId;
ULONGLONG GpuTime;
} PF_GPU_UTILIZATION_INFO, *PPF_GPU_UTILIZATION_INFO;
// rev
typedef enum _SUPERFETCH_INFORMATION_CLASS
{
SuperfetchRetrieveTrace = 1, // q: CHAR[]
SuperfetchSystemParameters, // q: PF_SYSTEM_SUPERFETCH_PARAMETERS
SuperfetchLogEvent,
SuperfetchGenerateTrace,
SuperfetchLogEvent, // s: PF_LOG_EVENT_DATA
SuperfetchGenerateTrace, // s: NULL
SuperfetchPrefetch,
SuperfetchPfnQuery, // q: PF_PFN_PRIO_REQUEST
SuperfetchPfnSetPriority,
SuperfetchPrivSourceQuery, // q: PF_PRIVSOURCE_QUERY_REQUEST
SuperfetchSequenceNumberQuery, // q: ULONG
SuperfetchScenarioPhase, // 10
SuperfetchWorkerPriority,
SuperfetchWorkerPriority, // s: KPRIORITY
SuperfetchScenarioQuery, // q: PF_SCENARIO_PHASE_INFO
SuperfetchScenarioPrefetch,
SuperfetchRobustnessControl,
SuperfetchTimeControl,
SuperfetchRobustnessControl, // s: PF_ROBUSTNESS_CONTROL
SuperfetchTimeControl, // s: PF_TIME_CONTROL
SuperfetchMemoryListQuery, // q: PF_MEMORY_LIST_INFO
SuperfetchMemoryRangesQuery, // q: PF_PHYSICAL_MEMORY_RANGE_INFO
SuperfetchTracingControl,
SuperfetchTrimWhileAgingControl,
SuperfetchRepurposedByPrefetch, // q: PF_REPURPOSED_BY_PREFETCH_INFO // rev
SuperfetchRepurposedByPrefetch, // q: PF_REPURPOSED_BY_PREFETCH_INFO // 20
SuperfetchChannelPowerRequest,
SuperfetchMovePages,
SuperfetchVirtualQuery,
SuperfetchVirtualQuery, // q: PF_VIRTUAL_QUERY
SuperfetchCombineStatsQuery,
SuperfetchSetMinWsAgeRate,
SuperfetchDeprioritizeOldPagesInWs,
SuperfetchFileExtentsQuery,
SuperfetchGpuUtilizationQuery, // PF_GPU_UTILIZATION_INFO
SuperfetchSetMinWsAgeRate, // s: PF_MIN_WS_AGE_RATE_CONTROL
SuperfetchDeprioritizeOldPagesInWs, // s: PF_DEPRIORITIZE_OLD_PAGES
SuperfetchFileExtentsQuery, // q: PF_FILE_EXTENTS_INFO
SuperfetchGpuUtilizationQuery, // q: PF_GPU_UTILIZATION_INFO
SuperfetchPfnSet, // s: PF_PFN_PRIO_REQUEST // since WIN11
SuperfetchInformationMax
} SUPERFETCH_INFORMATION_CLASS;
ntpnpapi.h
+44 -7
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Plug and Play support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTPNPAPI_H
@@ -110,6 +105,48 @@ typedef enum _PLUGPLAY_CONTROL_CLASS
MaxPlugPlayControl
} PLUGPLAY_CONTROL_CLASS, *PPLUGPLAY_CONTROL_CLASS;
// pub
typedef enum _DEVICE_RELATION_TYPE
{
BusRelations,
EjectionRelations,
PowerRelations,
RemovalRelations,
TargetDeviceRelation,
SingleBusRelations,
TransportRelations
} DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE;
// pub
typedef enum _BUS_QUERY_ID_TYPE
{
BusQueryDeviceID = 0, // <Enumerator>\<Enumerator-specific device id>
BusQueryHardwareIDs = 1, // Hardware ids
BusQueryCompatibleIDs = 2, // compatible device ids
BusQueryInstanceID = 3, // persistent id for this instance of the device
BusQueryDeviceSerialNumber = 4, // serial number for this device
BusQueryContainerID = 5 // unique id of the device's physical container
} BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE;
// pub
typedef enum _DEVICE_TEXT_TYPE
{
DeviceTextDescription = 0, // DeviceDesc property
DeviceTextLocationInformation = 1 // DeviceLocation property
} DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE;
// pub
typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE
{
DeviceUsageTypeUndefined,
DeviceUsageTypePaging,
DeviceUsageTypeHibernation,
DeviceUsageTypeDumpFile,
DeviceUsageTypeBoot,
DeviceUsageTypePostDisplay,
DeviceUsageTypeGuestAssigned
} DEVICE_USAGE_NOTIFICATION_TYPE, *PDEVICE_USAGE_NOTIFICATION_TYPE;
#if (PHNT_VERSION < PHNT_WIN8)
NTSYSCALLAPI
NTSTATUS
ntpoapi.h
+240 -39
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Power Management support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTPOAPI_H
@@ -48,12 +43,12 @@
#define TraceApplicationPowerMessage 30 // (kernel-mode only)
#define TraceApplicationPowerMessageEnd 31 // (kernel-mode only)
#define ProcessorPerfStates 32 // (kernel-mode only)
#define ProcessorIdleStates 33 // (kernel-mode only)
#define ProcessorCap 34 // (kernel-mode only)
#define SystemWakeSource 35
#define SystemHiberFileInformation 36 // q: SYSTEM_HIBERFILE_INFORMATION
#define ProcessorIdleStates 33 // PROCESSOR_IDLE_STATES // (kernel-mode only)
#define ProcessorCap 34 // PROCESSOR_CAP // (kernel-mode only)
#define SystemWakeSource 35 // out: POWER_WAKE_SOURCE_INFO
#define SystemHiberFileInformation 36 // out: SYSTEM_HIBERFILE_INFORMATION
#define TraceServicePowerMessage 37
#define ProcessorLoad 38
#define ProcessorLoad 38 // in: PROCESSOR_LOAD (sets), in: PPROCESSOR_NUMBER (clears)
#define PowerShutdownNotification 39 // (kernel-mode only)
#define MonitorCapabilities 40 // (kernel-mode only)
#define SessionPowerInit 41 // (kernel-mode only)
@@ -65,11 +60,11 @@
#define NotifyUserModeLegacyPowerEvent 47 // (kernel-mode only)
#define GroupPark 48 // (debug-mode boot only)
#define ProcessorIdleDomains 49 // (kernel-mode only)
#define WakeTimerList 50 // powercfg.exe /waketimers
#define WakeTimerList 50 // out: WAKE_TIMER_INFO[]
#define SystemHiberFileSize 51 // ULONG
#define ProcessorIdleStatesHv 52 // (kernel-mode only)
#define ProcessorPerfStatesHv 53 // (kernel-mode only)
#define ProcessorPerfCapHv 54 // (kernel-mode only)
#define ProcessorPerfCapHv 54 // PROCESSOR_PERF_CAP_HV // (kernel-mode only)
#define ProcessorSetIdle 55 // (debug-mode boot only)
#define LogicalProcessorIdling 56 // (kernel-mode only)
#define UserPresence 57 // POWER_USER_PRESENCE // not implemented
@@ -112,7 +107,8 @@
#define UpdateBlackBoxRecorder 94
#define SessionAllowExternalDmaDevices 95
#define SendSuspendResumeNotification 96 // since WIN11
#define PowerInformationLevelMaximum 97
#define BlackBoxRecorderDirectAccessBuffer 97
#define PowerInformationLevelMaximum 98
#endif
typedef struct _PROCESSOR_POWER_INFORMATION
@@ -206,7 +202,9 @@ typedef struct _SYSTEM_POWER_STATE_CONTEXT
ULONG CurrentSystemState : 4;
ULONG IgnoreHibernationPath : 1;
ULONG PseudoTransition : 1;
ULONG Reserved2 : 10;
ULONG KernelSoftReboot : 1;
ULONG DirectedDripsTransition : 1;
ULONG Reserved2 : 8;
};
ULONG ContextAsUlong;
};
@@ -226,13 +224,13 @@ typedef struct _COUNTED_REASON_CONTEXT_RELATIVE
{
struct
{
ULONG_PTR ResourceFileNameOffset;
SIZE_T ResourceFileNameOffset;
USHORT ResourceReasonId;
ULONG StringCount;
ULONG_PTR SubstitutionStringsOffset;
};
ULONG_PTR SimpleStringOffset;
};
SIZE_T SubstitutionStringsOffset;
} DUMMYSTRUCTNAME;
SIZE_T SimpleStringOffset;
} DUMMYUNIONNAME;
} COUNTED_REASON_CONTEXT_RELATIVE, *PCOUNTED_REASON_CONTEXT_RELATIVE;
typedef struct _DIAGNOSTIC_BUFFER
@@ -243,19 +241,164 @@ typedef struct _DIAGNOSTIC_BUFFER
{
struct
{
ULONG_PTR ProcessImageNameOffset; // PWSTR
SIZE_T ProcessImageNameOffset; // PWSTR
ULONG ProcessId;
ULONG ServiceTag;
};
} DUMMYSTRUCTNAME;
struct
{
ULONG_PTR DeviceDescriptionOffset; // PWSTR
ULONG_PTR DevicePathOffset; // PWSTR
};
};
ULONG_PTR ReasonOffset; // PCOUNTED_REASON_CONTEXT_RELATIVE
SIZE_T DeviceDescriptionOffset; // PWSTR
SIZE_T DevicePathOffset; // PWSTR
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
SIZE_T ReasonOffset; // PCOUNTED_REASON_CONTEXT_RELATIVE
} DIAGNOSTIC_BUFFER, *PDIAGNOSTIC_BUFFER;
typedef struct _WAKE_TIMER_INFO
{
SIZE_T OffsetToNext;
ULARGE_INTEGER DueTime;
ULONG Period;
DIAGNOSTIC_BUFFER ReasonContext;
} WAKE_TIMER_INFO, *PWAKE_TIMER_INFO;
// rev
typedef struct _PROCESSOR_PERF_CAP_HV
{
ULONG Version;
ULONG InitialApicId;
ULONG Ppc;
ULONG Tpc;
ULONG ThermalCap;
} PROCESSOR_PERF_CAP_HV, *PPROCESSOR_PERF_CAP_HV;
typedef struct PROCESSOR_IDLE_TIMES
{
ULONG64 StartTime;
ULONG64 EndTime;
ULONG Reserved[4];
} PROCESSOR_IDLE_TIMES, *PPROCESSOR_IDLE_TIMES;
_Function_class_(PROCESSOR_IDLE_HANDLER)
typedef NTSTATUS (FASTCALL PROCESSOR_IDLE_HANDLER)(
_In_ ULONG_PTR Context,
_Inout_ PPROCESSOR_IDLE_TIMES IdleTimes
);
typedef PROCESSOR_IDLE_HANDLER *PPROCESSOR_IDLE_HANDLER;
#define PROCESSOR_STATE_TYPE_PERFORMANCE 0x1
#define PROCESSOR_STATE_TYPE_THROTTLE 0x2
#define IDLE_STATE_FLAGS_C1_HLT 0x01 // describes C1 only
#define IDLE_STATE_FLAGS_C1_IO_HLT 0x02 // describes C1 only
#define IDLE_STATE_FLAGS_IO 0x04 // describes C2 and C3 only
#define IDLE_STATE_FLAGS_MWAIT 0x08 // describes C1, C2, C3, C4, ...
typedef struct _PROCESSOR_IDLE_STATE
{
UCHAR StateType;
ULONG StateFlags;
ULONG HardwareLatency;
ULONG Power;
ULONG_PTR Context;
PPROCESSOR_IDLE_HANDLER Handler;
} PROCESSOR_IDLE_STATE, *PPROCESSOR_IDLE_STATE;
typedef struct _PROCESSOR_IDLE_STATES
{
ULONG Size;
ULONG Revision;
ULONG Count;
ULONG Type;
KAFFINITY TargetProcessors;
PROCESSOR_IDLE_STATE State[ANYSIZE_ARRAY];
} PROCESSOR_IDLE_STATES, *PPROCESSOR_IDLE_STATES;
// rev
typedef struct _PROCESSOR_LOAD
{
PROCESSOR_NUMBER ProcessorNumber;
UCHAR BusyPercentage;
UCHAR FrequencyPercentage;
USHORT Padding;
} PROCESSOR_LOAD, *PPROCESSOR_LOAD;
// rev
typedef struct _PROCESSOR_CAP
{
ULONG Version;
PROCESSOR_NUMBER ProcessorNumber;
ULONG PlatformCap;
ULONG ThermalCap;
ULONG LimitReasons;
} PROCESSOR_CAP, *PPROCESSOR_CAP;
typedef struct _PO_WAKE_SOURCE_INFO
{
ULONG Count;
ULONG Offsets[ANYSIZE_ARRAY]; // POWER_WAKE_SOURCE_HEADER, POWER_WAKE_SOURCE_INTERNAL, POWER_WAKE_SOURCE_TIMER, POWER_WAKE_SOURCE_FIXED
} PO_WAKE_SOURCE_INFO, *PPO_WAKE_SOURCE_INFO;
typedef struct _PO_WAKE_SOURCE_HISTORY
{
ULONG Count;
ULONG Offsets[ANYSIZE_ARRAY]; // POWER_WAKE_SOURCE_HEADER, POWER_WAKE_SOURCE_INTERNAL, POWER_WAKE_SOURCE_TIMER, POWER_WAKE_SOURCE_FIXED
} PO_WAKE_SOURCE_HISTORY, *PPO_WAKE_SOURCE_HISTORY;
typedef enum _PO_WAKE_SOURCE_TYPE
{
DeviceWakeSourceType = 0,
FixedWakeSourceType = 1,
TimerWakeSourceType = 2,
TimerPresumedWakeSourceType = 3,
InternalWakeSourceType = 4
} PO_WAKE_SOURCE_TYPE, *PPO_WAKE_SOURCE_TYPE;
typedef enum _PO_INTERNAL_WAKE_SOURCE_TYPE
{
InternalWakeSourceDozeToHibernate = 0,
InternalWakeSourcePredictedUserPresence = 1
} PO_INTERNAL_WAKE_SOURCE_TYPE;
typedef enum _PO_FIXED_WAKE_SOURCE_TYPE
{
FixedWakeSourcePowerButton = 0,
FixedWakeSourceSleepButton = 1,
FixedWakeSourceRtc = 2,
FixedWakeSourceDozeToHibernate = 3
} PO_FIXED_WAKE_SOURCE_TYPE, *PPO_FIXED_WAKE_SOURCE_TYPE;
typedef struct _PO_WAKE_SOURCE_HEADER
{
PO_WAKE_SOURCE_TYPE Type;
ULONG Size;
} PO_WAKE_SOURCE_HEADER, *PPO_WAKE_SOURCE_HEADER;
typedef struct _PO_WAKE_SOURCE_DEVICE
{
PO_WAKE_SOURCE_HEADER Header;
WCHAR InstancePath[ANYSIZE_ARRAY];
} PO_WAKE_SOURCE_DEVICE, *PPO_WAKE_SOURCE_DEVICE;
typedef struct _PO_WAKE_SOURCE_FIXED
{
PO_WAKE_SOURCE_HEADER Header;
PO_FIXED_WAKE_SOURCE_TYPE FixedWakeSourceType;
} PO_WAKE_SOURCE_FIXED, *PPO_WAKE_SOURCE_FIXED;
typedef struct _PO_WAKE_SOURCE_INTERNAL
{
PO_WAKE_SOURCE_HEADER Header;
PO_INTERNAL_WAKE_SOURCE_TYPE InternalWakeSourceType;
} PO_WAKE_SOURCE_INTERNAL, *PPO_WAKE_SOURCE_INTERNAL;
typedef struct _PO_WAKE_SOURCE_TIMER
{
PO_WAKE_SOURCE_HEADER Header;
DIAGNOSTIC_BUFFER Reason;
} PO_WAKE_SOURCE_TIMER, *PPO_WAKE_SOURCE_TIMER;
// The number of supported request types per version
#define POWER_REQUEST_SUPPORTED_TYPES_V1 3 // Windows 7
#define POWER_REQUEST_SUPPORTED_TYPES_V2 9 // Windows 8
@@ -365,8 +508,8 @@ typedef enum _POWER_INFORMATION_LEVEL_INTERNAL
PowerInternalUserAbsencePrediction, // POWER_USER_ABSENCE_PREDICTION
PowerInternalUserAbsencePredictionCapability, // POWER_USER_ABSENCE_PREDICTION_CAPABILITY
PowerInternalPoProcessorLatencyHint, // POWER_PROCESSOR_LATENCY_HINT
PowerInternalStandbyNetworkRequest, // POWER_STANDBY_NETWORK_REQUEST
PowerInternalDirtyTransitionInformation,
PowerInternalStandbyNetworkRequest, // POWER_STANDBY_NETWORK_REQUEST (requires PopNetBIServiceSid)
PowerInternalDirtyTransitionInformation, // out: BOOLEAN
PowerInternalSetBackgroundTaskState, // POWER_SET_BACKGROUND_TASK_STATE
PowerInternalTtmOpenTerminal,
PowerInternalTtmCreateTerminal, // 10
@@ -377,8 +520,8 @@ typedef enum _POWER_INFORMATION_LEVEL_INTERNAL
PowerInternalTtmAssignDevice,
PowerInternalTtmSetDisplayState,
PowerInternalTtmSetDisplayTimeouts,
PowerInternalBootSessionStandbyActivationInformation,
PowerInternalSessionPowerState,
PowerInternalBootSessionStandbyActivationInformation, // out: POWER_BOOT_SESSION_STANDBY_ACTIVATION_INFO
PowerInternalSessionPowerState, // in: POWER_SESSION_POWER_STATE
PowerInternalSessionTerminalInput, // 20
PowerInternalSetWatchdog,
PowerInternalPhysicalPowerButtonPressInfoAtBoot,
@@ -389,14 +532,14 @@ typedef enum _POWER_INFORMATION_LEVEL_INTERNAL
PowerInternalTransitionCheckpoint,
PowerInternalInputControllerState,
PowerInternalFirmwareResetReason,
PowerInternalPpmSchedulerQosSupport, // 30
PowerInternalPpmSchedulerQosSupport, // out: POWER_INTERNAL_PROCESSOR_QOS_SUPPORT // 30
PowerInternalBootStatGet,
PowerInternalBootStatSet,
PowerInternalCallHasNotReturnedWatchdog,
PowerInternalBootStatCheckIntegrity,
PowerInternalBootStatRestoreDefaults, // in: void
PowerInternalHostEsStateUpdate,
PowerInternalGetPowerActionState,
PowerInternalHostEsStateUpdate, // in: POWER_INTERNAL_HOST_ENERGY_SAVER_STATE
PowerInternalGetPowerActionState, // out: ULONG
PowerInternalBootStatUnlock,
PowerInternalWakeOnVoiceState,
PowerInternalDeepSleepBlock, // 40
@@ -445,9 +588,17 @@ typedef enum _POWER_INFORMATION_LEVEL_INTERNAL
PowerInternalOverrideSystemInitiatedRebootState,
PowerInternalFanImpactStats,
PowerInternalFanRpmBuckets,
PowerInternalPowerBootAppDiagInfo,
PowerInternalPowerBootAppDiagInfo, // out: POWER_INTERNAL_BOOTAPP_DIAGNOSTIC
PowerInternalUnregisterShutdownNotification, // since 22H1
PowerInternalManageTransitionStateRecord,
PowerInternalGetAcpiTimeAndAlarmCapabilities, // since 22H2
PowerInternalSuspendResumeRequest,
PowerInternalEnergyEstimationInfo, // since 23H2
PowerInternalProvSocIdentifierOperation, // since 24H2
PowerInternalGetVmPerfPrioritySupport,
PowerInternalGetVmPerfPriorityConfig,
PowerInternalNotifyWin32kPowerRequestQueued,
PowerInternalNotifyWin32kPowerRequestCompleted,
PowerInformationInternalMaximum
} POWER_INFORMATION_LEVEL_INTERNAL;
@@ -500,36 +651,84 @@ typedef struct _POWER_USER_ABSENCE_PREDICTION_CAPABILITY
BOOLEAN AbsencePredictionCapability;
} POWER_USER_ABSENCE_PREDICTION_CAPABILITY, *PPOWER_USER_ABSENCE_PREDICTION_CAPABILITY;
// rev
typedef struct _POWER_PROCESSOR_LATENCY_HINT
{
POWER_INFORMATION_INTERNAL_HEADER PowerInformationInternalHeader;
ULONG Type;
} POWER_PROCESSOR_LATENCY_HINT, *PPO_PROCESSOR_LATENCY_HINT;
} POWER_PROCESSOR_LATENCY_HINT, *PPOWER_PROCESSOR_LATENCY_HINT;
// rev
typedef struct _POWER_STANDBY_NETWORK_REQUEST
{
POWER_INFORMATION_INTERNAL_HEADER PowerInformationInternalHeader;
BOOLEAN Active;
} POWER_STANDBY_NETWORK_REQUEST, *PPOWER_STANDBY_NETWORK_REQUEST;
// rev
typedef struct _POWER_SET_BACKGROUND_TASK_STATE
{
POWER_INFORMATION_INTERNAL_HEADER PowerInformationInternalHeader;
BOOLEAN Engaged;
} POWER_SET_BACKGROUND_TASK_STATE, *PPOWER_SET_BACKGROUND_TASK_STATE;
typedef struct POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_INPUT
// rev
typedef struct _POWER_BOOT_SESSION_STANDBY_ACTIVATION_INFO
{
ULONG StandbyTotalTime;
ULONG DripsTotalTime;
ULONG ActivatorClientTotalActiveTime;
ULONG PerActivatorClientTotalActiveTime[98];
} POWER_BOOT_SESSION_STANDBY_ACTIVATION_INFO, *PPOWER_BOOT_SESSION_STANDBY_ACTIVATION_INFO;
// rev
typedef struct _POWER_SESSION_POWER_STATE
{
POWER_INFORMATION_INTERNAL_HEADER Header;
ULONG SessionId;
BOOLEAN On;
BOOLEAN IsConsole;
POWER_MONITOR_REQUEST_REASON RequestReason;
} POWER_SESSION_POWER_STATE, *PPOWER_SESSION_POWER_STATE;
// rev
typedef struct _POWER_INTERNAL_PROCESSOR_QOS_SUPPORT
{
BOOLEAN QosSupportedAndConfigured;
BOOLEAN SchedulerDirectedPerfStatesSupported;
BOOLEAN QosGroupPolicyDisable;
} POWER_INTERNAL_PROCESSOR_QOS_SUPPORT, *PPOWER_INTERNAL_PROCESSOR_QOS_SUPPORT;
// rev
typedef struct _POWER_INTERNAL_HOST_ENERGY_SAVER_STATE
{
POWER_INFORMATION_INTERNAL_HEADER Header;
BOOLEAN EsEnabledOnHost;
} POWER_INTERNAL_HOST_ENERGY_SAVER_STATE, *PPOWER_INTERNAL_HOST_ENERGY_SAVER_STATE;
// rev
typedef struct _POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_INPUT
{
POWER_INFORMATION_LEVEL_INTERNAL InternalType;
PROCESSOR_NUMBER ProcessorNumber; // ULONG_MAX
} POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_INPUT, *PPOWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_INPUT;
typedef struct POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_OUTPUT
// rev
typedef struct _POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_OUTPUT
{
ULONG Version;
ULONG NominalFrequency; // if (Domain) Prcb->PowerState.CheckContext.Domain.NominalFrequency else Prcb->MHz
} POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_OUTPUT, *PPOWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_OUTPUT;
// rev
typedef struct _POWER_INTERNAL_BOOTAPP_DIAGNOSTIC
{
ULONG BootAppErrorDiagCode; // bcdedit last status
ULONG BootAppFailureStatus; // bcdedit last status
} POWER_INTERNAL_BOOTAPP_DIAGNOSTIC, *PPOWER_INTERNAL_BOOTAPP_DIAGNOSTIC;
#if (PHNT_MODE != PHNT_MODE_KERNEL)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -541,6 +740,8 @@ NtPowerInformation(
_In_ ULONG OutputBufferLength
);
#endif
NTSYSCALLAPI
NTSTATUS
NTAPI
ntpsapi.h
+383 -161
View File
File diff suppressed because it is too large Load Diff
ntregapi.h
+185 -41
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Registry support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTREGAPI_H
@@ -42,7 +37,7 @@ typedef struct _KEY_BASIC_INFORMATION
LARGE_INTEGER LastWriteTime;
ULONG TitleIndex;
ULONG NameLength;
WCHAR Name[1];
_Field_size_bytes_(NameLength) WCHAR Name[1];
} KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;
typedef struct _KEY_NODE_INFORMATION
@@ -52,7 +47,7 @@ typedef struct _KEY_NODE_INFORMATION
ULONG ClassOffset;
ULONG ClassLength;
ULONG NameLength;
WCHAR Name[1];
_Field_size_bytes_(NameLength) WCHAR Name[1];
// ...
// WCHAR Class[1];
} KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION;
@@ -64,18 +59,18 @@ typedef struct _KEY_FULL_INFORMATION
ULONG ClassOffset;
ULONG ClassLength;
ULONG SubKeys;
ULONG MaxNameLen;
ULONG MaxClassLen;
ULONG MaxNameLength;
ULONG MaxClassLength;
ULONG Values;
ULONG MaxValueNameLen;
ULONG MaxValueDataLen;
ULONG MaxValueNameLength;
ULONG MaxValueDataLength;
WCHAR Class[1];
} KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION;
typedef struct _KEY_NAME_INFORMATION
{
ULONG NameLength;
WCHAR Name[1];
_Field_size_bytes_(NameLength) WCHAR Name[1];
} KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;
typedef struct _KEY_CACHED_INFORMATION
@@ -83,12 +78,12 @@ typedef struct _KEY_CACHED_INFORMATION
LARGE_INTEGER LastWriteTime;
ULONG TitleIndex;
ULONG SubKeys;
ULONG MaxNameLen;
ULONG MaxNameLength;
ULONG Values;
ULONG MaxValueNameLen;
ULONG MaxValueDataLen;
ULONG MaxValueNameLength;
ULONG MaxValueDataLength;
ULONG NameLength;
WCHAR Name[1];
_Field_size_bytes_(NameLength) WCHAR Name[1];
} KEY_CACHED_INFORMATION, *PKEY_CACHED_INFORMATION;
// rev
@@ -200,7 +195,7 @@ typedef struct _KEY_VALUE_BASIC_INFORMATION
ULONG TitleIndex;
ULONG Type;
ULONG NameLength;
WCHAR Name[1];
_Field_size_bytes_(NameLength) WCHAR Name[1];
} KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION;
typedef struct _KEY_VALUE_FULL_INFORMATION
@@ -210,7 +205,7 @@ typedef struct _KEY_VALUE_FULL_INFORMATION
ULONG DataOffset;
ULONG DataLength;
ULONG NameLength;
WCHAR Name[1];
_Field_size_bytes_(NameLength) WCHAR Name[1];
// ...
// UCHAR Data[1];
} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;
@@ -220,14 +215,14 @@ typedef struct _KEY_VALUE_PARTIAL_INFORMATION
ULONG TitleIndex;
ULONG Type;
ULONG DataLength;
UCHAR Data[1];
_Field_size_bytes_(DataLength) UCHAR Data[1];
} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;
typedef struct _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64
{
ULONG Type;
ULONG DataLength;
UCHAR Data[1];
_Field_size_bytes_(DataLength) UCHAR Data[1];
} KEY_VALUE_PARTIAL_INFORMATION_ALIGN64, *PKEY_VALUE_PARTIAL_INFORMATION_ALIGN64;
// private
@@ -237,24 +232,37 @@ typedef struct _KEY_VALUE_LAYER_INFORMATION
ULONG Reserved : 31;
} KEY_VALUE_LAYER_INFORMATION, *PKEY_VALUE_LAYER_INFORMATION;
// rev
typedef enum _KEY_LOAD_ENTRY_TYPE
// private
typedef enum _CM_EXTENDED_PARAMETER_TYPE
{
KeyLoadTrustClassKey = 1,
KeyLoadEvent,
KeyLoadToken
} KEY_LOAD_ENTRY_TYPE;
CmExtendedParameterInvalidType,
CmExtendedParameterTrustClassKey,
CmExtendedParameterEvent,
CmExtendedParameterFileAccessToken,
CmExtendedParameterMax,
} CM_EXTENDED_PARAMETER_TYPE;
// rev
typedef struct _KEY_LOAD_ENTRY
#define CM_EXTENDED_PARAMETER_TYPE_BITS 8
// private
typedef struct DECLSPEC_ALIGN(8) _CM_EXTENDED_PARAMETER
{
KEY_LOAD_ENTRY_TYPE EntryType;
struct
{
ULONG64 Type : CM_EXTENDED_PARAMETER_TYPE_BITS;
ULONG64 Reserved : 64 - CM_EXTENDED_PARAMETER_TYPE_BITS;
};
union
{
ULONG64 ULong64;
PVOID Pointer;
SIZE_T Size;
HANDLE Handle;
ULONG_PTR Value;
ULONG ULong;
ACCESS_MASK AccessMask;
};
} KEY_LOAD_ENTRY, *PKEY_LOAD_ENTRY;
} CM_EXTENDED_PARAMETER, *PCM_EXTENDED_PARAMETER;
typedef struct _KEY_VALUE_ENTRY
{
@@ -276,7 +284,7 @@ typedef struct _REG_NOTIFY_INFORMATION
ULONG NextEntryOffset;
REG_ACTION Action;
ULONG KeyLength;
WCHAR Key[1];
_Field_size_bytes_(KeyLength) WCHAR Key[1];
} REG_NOTIFY_INFORMATION, *PREG_NOTIFY_INFORMATION;
typedef struct _KEY_PID_ARRAY
@@ -291,6 +299,142 @@ typedef struct _KEY_OPEN_SUBKEYS_INFORMATION
KEY_PID_ARRAY KeyArray[1];
} KEY_OPEN_SUBKEYS_INFORMATION, *PKEY_OPEN_SUBKEYS_INFORMATION;
// Differencing registry & virtualization // since REDSTONE
// rev
#define VR_DEVICE_NAME L"\\Device\\VRegDriver"
// rev
#define IOCTL_VR_INITIALIZE_JOB_FOR_VREG CTL_CODE(FILE_DEVICE_UNKNOWN, 1, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_INITIALIZE_JOB_FOR_VREG
#define IOCTL_VR_LOAD_DIFFERENCING_HIVE CTL_CODE(FILE_DEVICE_UNKNOWN, 2, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_LOAD_DIFFERENCING_HIVE
#define IOCTL_VR_CREATE_NAMESPACE_NODE CTL_CODE(FILE_DEVICE_UNKNOWN, 3, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_CREATE_NAMESPACE_NODE
#define IOCTL_VR_MODIFY_FLAGS CTL_CODE(FILE_DEVICE_UNKNOWN, 4, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_MODIFY_FLAGS
#define IOCTL_VR_CREATE_MULTIPLE_NAMESPACE_NODES CTL_CODE(FILE_DEVICE_UNKNOWN, 5, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_CREATE_MULTIPLE_NAMESPACE_NODES
#define IOCTL_VR_UNLOAD_DYNAMICALLY_LOADED_HIVES CTL_CODE(FILE_DEVICE_UNKNOWN, 6, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_UNLOAD_DYNAMICALLY_LOADED_HIVES
#define IOCTL_VR_GET_VIRTUAL_ROOT_KEY CTL_CODE(FILE_DEVICE_UNKNOWN, 7, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_GET_VIRTUAL_ROOT; out: VR_GET_VIRTUAL_ROOT_RESULT
#define IOCTL_VR_LOAD_DIFFERENCING_HIVE_FOR_HOST CTL_CODE(FILE_DEVICE_UNKNOWN, 8, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_LOAD_DIFFERENCING_HIVE_FOR_HOST
#define IOCTL_VR_UNLOAD_DIFFERENCING_HIVE_FOR_HOST CTL_CODE(FILE_DEVICE_UNKNOWN, 9, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_UNLOAD_DIFFERENCING_HIVE_FOR_HOST
// private
typedef struct _VR_INITIALIZE_JOB_FOR_VREG
{
HANDLE Job;
} VR_INITIALIZE_JOB_FOR_VREG, *PVR_INITIALIZE_JOB_FOR_VREG;
// rev
#define VR_FLAG_INHERIT_TRUST_CLASS 0x00000001
#define VR_FLAG_WRITE_THROUGH_HIVE 0x00000002 // since REDSTONE2
#define VR_FLAG_LOCAL_MACHINE_TRUST_CLASS 0x00000004 // since 21H1
// rev + private
typedef struct _VR_LOAD_DIFFERENCING_HIVE
{
HANDLE Job;
ULONG NextLayerIsHost;
ULONG Flags; // VR_FLAG_*
ULONG LoadFlags; // NtLoadKeyEx flags
WORD KeyPathLength;
WORD HivePathLength;
WORD NextLayerKeyPathLength;
HANDLE FileAccessToken; // since 20H1
WCHAR Strings[ANYSIZE_ARRAY];
// ...
// WCHAR KeyPath[1];
// WCHAR HivePath[1];
// WCHAR NextLayerKeyPath[1];
} VR_LOAD_DIFFERENCING_HIVE, *PVR_LOAD_DIFFERENCING_HIVE;
// rev + private
typedef struct _VR_CREATE_NAMESPACE_NODE
{
HANDLE Job;
WORD ContainerPathLength;
WORD HostPathLength;
ULONG Flags;
ACCESS_MASK AccessMask; // since 20H1
WCHAR Strings[ANYSIZE_ARRAY];
// ...
// WCHAR ContainerPath[1];
// WCHAR HostPath[1];
} VR_CREATE_NAMESPACE_NODE, *PVR_CREATE_NAMESPACE_NODE;
// private
typedef struct _VR_MODIFY_FLAGS
{
HANDLE Job;
ULONG AddFlags;
ULONG RemoveFlags;
} VR_MODIFY_FLAGS, *PVR_MODIFY_FLAGS;
// private
typedef struct _NAMESPACE_NODE_DATA
{
ACCESS_MASK AccessMask;
WORD ContainerPathLength;
WORD HostPathLength;
ULONG Flags;
WCHAR Strings[ANYSIZE_ARRAY];
// ...
// WCHAR ContainerPath[1];
// WCHAR HostPath[1];
} NAMESPACE_NODE_DATA, *PNAMESPACE_NODE_DATA;
// private
typedef struct _VR_CREATE_MULTIPLE_NAMESPACE_NODES
{
HANDLE Job;
ULONG NumNewKeys;
NAMESPACE_NODE_DATA Keys[1];
} VR_CREATE_MULTIPLE_NAMESPACE_NODES, *PVR_CREATE_MULTIPLE_NAMESPACE_NODES;
// private
typedef struct _VR_UNLOAD_DYNAMICALLY_LOADED_HIVES
{
HANDLE Job;
} VR_UNLOAD_DYNAMICALLY_LOADED_HIVES, *PVR_UNLOAD_DYNAMICALLY_LOADED_HIVES;
// rev
#define VR_KEY_COMROOT 0 // \Registry\ComRoot\Classes
#define VR_KEY_MACHINE_SOFTWARE 1 // \Registry\Machine\Software // since REDSTONE2
#define VR_KEY_CONTROL_SET 2 // \Registry\Machine\System\ControlSet001 // since REDSTONE2
// rev
typedef struct _VR_GET_VIRTUAL_ROOT
{
HANDLE Job;
ULONG Index; // VR_KEY_* // since REDSTONE2
} VR_GET_VIRTUAL_ROOT, *PVR_GET_VIRTUAL_ROOT;
// rev
typedef struct _VR_GET_VIRTUAL_ROOT_RESULT
{
HANDLE Key;
} VR_GET_VIRTUAL_ROOT_RESULT, *PVR_GET_VIRTUAL_ROOT_RESULT;
// rev
typedef struct _VR_LOAD_DIFFERENCING_HIVE_FOR_HOST
{
ULONG LoadFlags; // NtLoadKeyEx flags
ULONG Flags; // VR_FLAG_* // since REDSTONE2
WORD KeyPathLength;
WORD HivePathLength;
WORD NextLayerKeyPathLength;
HANDLE FileAccessToken; // since 20H1
WCHAR Strings[ANYSIZE_ARRAY];
// ...
// WCHAR KeyPath[1];
// WCHAR HivePath[1];
// WCHAR NextLayerKeyPath[1];
} VR_LOAD_DIFFERENCING_HIVE_FOR_HOST, *PVR_LOAD_DIFFERENCING_HIVE_FOR_HOST;
// rev
typedef struct _VR_UNLOAD_DIFFERENCING_HIVE_FOR_HOST
{
ULONG Reserved;
WORD TargetKeyPathLength;
WCHAR TargetKeyPath[ANYSIZE_ARRAY];
} VR_UNLOAD_DIFFERENCING_HIVE_FOR_HOST, *PVR_UNLOAD_DIFFERENCING_HIVE_FOR_HOST;
// System calls
NTSYSCALLAPI
@@ -397,7 +541,7 @@ NTAPI
NtQueryKey(
_In_ HANDLE KeyHandle,
_In_ KEY_INFORMATION_CLASS KeyInformationClass,
_Out_writes_bytes_opt_(Length) PVOID KeyInformation,
_Out_writes_bytes_to_opt_(Length, *ResultLength) PVOID KeyInformation,
_In_ ULONG Length,
_Out_ PULONG ResultLength
);
@@ -419,7 +563,7 @@ NtQueryValueKey(
_In_ HANDLE KeyHandle,
_In_ PUNICODE_STRING ValueName,
_In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
_Out_writes_bytes_opt_(Length) PVOID KeyValueInformation,
_Out_writes_bytes_to_opt_(Length, *ResultLength) PVOID KeyValueInformation,
_In_ ULONG Length,
_Out_ PULONG ResultLength
);
@@ -455,7 +599,7 @@ NtEnumerateKey(
_In_ HANDLE KeyHandle,
_In_ ULONG Index,
_In_ KEY_INFORMATION_CLASS KeyInformationClass,
_Out_writes_bytes_opt_(Length) PVOID KeyInformation,
_Out_writes_bytes_to_opt_(Length, *ResultLength) PVOID KeyInformation,
_In_ ULONG Length,
_Out_ PULONG ResultLength
);
@@ -467,7 +611,7 @@ NtEnumerateValueKey(
_In_ HANDLE KeyHandle,
_In_ ULONG Index,
_In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
_Out_writes_bytes_opt_(Length) PVOID KeyValueInformation,
_Out_writes_bytes_to_opt_(Length, *ResultLength) PVOID KeyValueInformation,
_In_ ULONG Length,
_Out_ PULONG ResultLength
);
@@ -491,7 +635,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtCompressKey(
_In_ HANDLE Key
_In_ HANDLE KeyHandle
);
NTSYSCALLAPI
@@ -534,8 +678,8 @@ NtLoadKey3(
_In_ POBJECT_ATTRIBUTES TargetKey,
_In_ POBJECT_ATTRIBUTES SourceFile,
_In_ ULONG Flags,
_In_reads_(LoadEntryCount) PKEY_LOAD_ENTRY LoadEntries,
_In_ ULONG LoadEntryCount,
_In_reads_(ExtendedParameterCount) PCM_EXTENDED_PARAMETER ExtendedParameters,
_In_ ULONG ExtendedParameterCount,
_In_opt_ ACCESS_MASK DesiredAccess,
_Out_opt_ PHANDLE RootHandle,
_Reserved_ PVOID Reserved
ntrtl.h
+1383 -149
View File
File diff suppressed because it is too large Load Diff
ntsam.h
+11 -14
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Security Account Manager support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTSAM_H
@@ -115,6 +110,8 @@ SamRidToSid(
#define SAM_SERVER_EXECUTE (STANDARD_RIGHTS_EXECUTE | \
SAM_SERVER_CONNECT | \
SAM_SERVER_LOOKUP_DOMAIN)
typedef struct _RPC_AUTH_IDENTITY_HANDLE *PRPC_AUTH_IDENTITY_HANDLE;
// Functions
@@ -136,7 +133,7 @@ SamConnectWithCreds(
_Out_ PSAM_HANDLE ServerHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ struct _RPC_AUTH_IDENTITY_HANDLE* Creds,
_In_ PRPC_AUTH_IDENTITY_HANDLE Creds,
_In_ PWCHAR Spn,
_Out_ BOOL* pfDstIsW2K
);
@@ -721,7 +718,7 @@ typedef struct _ALIAS_GENERAL_INFORMATION
UNICODE_STRING Name;
ULONG MemberCount;
UNICODE_STRING AdminComment;
} ALIAS_GENERAL_INFORMATION, *PALIAS_GENERAL_INFORMATION;
} ALIAS_GENERAL_INFORMATION, *PALIAS_GENERAL_INFORMATION;
typedef struct _ALIAS_NAME_INFORMATION
{
@@ -1064,13 +1061,13 @@ typedef struct _USER_LOGON_INFORMATION
USHORT BadPasswordCount;
USHORT LogonCount;
ULONG UserAccountControl;
} USER_LOGON_INFORMATION, * PUSER_LOGON_INFORMATION;
} USER_LOGON_INFORMATION, *PUSER_LOGON_INFORMATION;
#include <poppack.h>
typedef struct _USER_LOGON_HOURS_INFORMATION
{
LOGON_HOURS LogonHours;
} USER_LOGON_HOURS_INFORMATION, * PUSER_LOGON_HOURS_INFORMATION;
} USER_LOGON_HOURS_INFORMATION, *PUSER_LOGON_HOURS_INFORMATION;
#include <pshpack4.h>
typedef struct _USER_ACCOUNT_INFORMATION
@@ -1093,7 +1090,7 @@ typedef struct _USER_ACCOUNT_INFORMATION
LARGE_INTEGER PasswordLastSet;
LARGE_INTEGER AccountExpires;
ULONG UserAccountControl;
} USER_ACCOUNT_INFORMATION, * PUSER_ACCOUNT_INFORMATION;
} USER_ACCOUNT_INFORMATION, *PUSER_ACCOUNT_INFORMATION;
#include <poppack.h>
typedef struct _USER_NAME_INFORMATION
@@ -1501,7 +1498,7 @@ typedef struct _USER_PWD_CHANGE_FAILURE_INFORMATION
{
ULONG ExtendedFailureReason;
UNICODE_STRING FilterModuleName;
} USER_PWD_CHANGE_FAILURE_INFORMATION,*PUSER_PWD_CHANGE_FAILURE_INFORMATION;
} USER_PWD_CHANGE_FAILURE_INFORMATION, *PUSER_PWD_CHANGE_FAILURE_INFORMATION;
// ExtendedFailureReason values
@@ -1828,7 +1825,7 @@ typedef struct _SAM_VALIDATE_PASSWORD_RESET_INPUT_ARG
SAM_VALIDATE_PASSWORD_HASH HashedPassword;
BOOLEAN PasswordMustChangeAtNextLogon; // looked at only for password reset
BOOLEAN ClearLockout; // can be used clear user account lockout
}SAM_VALIDATE_PASSWORD_RESET_INPUT_ARG, *PSAM_VALIDATE_PASSWORD_RESET_INPUT_ARG;
} SAM_VALIDATE_PASSWORD_RESET_INPUT_ARG, *PSAM_VALIDATE_PASSWORD_RESET_INPUT_ARG;
typedef union _SAM_VALIDATE_INPUT_ARG
{
ntseapi.h
+51 -20
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Authorization functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTSEAPI_H
@@ -60,7 +55,7 @@
#if (PHNT_MODE == PHNT_MODE_KERNEL)
typedef enum _TOKEN_INFORMATION_CLASS
{
TokenUser = 1, // q: TOKEN_USER
TokenUser = 1, // q: TOKEN_USER, SE_TOKEN_USER
TokenGroups, // q: TOKEN_GROUPS
TokenPrivileges, // q: TOKEN_PRIVILEGES
TokenOwner, // q; s: TOKEN_OWNER
@@ -85,10 +80,10 @@ typedef enum _TOKEN_INFORMATION_CLASS
TokenVirtualizationAllowed, // q; s: ULONG (requires SeCreateTokenPrivilege)
TokenVirtualizationEnabled, // q; s: ULONG
TokenIntegrityLevel, // q; s: TOKEN_MANDATORY_LABEL
TokenUIAccess, // q; s: ULONG
TokenUIAccess, // q; s: ULONG (requires SeTcbPrivilege)
TokenMandatoryPolicy, // q; s: TOKEN_MANDATORY_POLICY (requires SeTcbPrivilege)
TokenLogonSid, // q: TOKEN_GROUPS
TokenIsAppContainer, // q: ULONG
TokenIsAppContainer, // q: ULONG // since WIN8
TokenCapabilities, // q: TOKEN_GROUPS // 30
TokenAppContainerSid, // q: TOKEN_APPCONTAINER_INFORMATION
TokenAppContainerNumber, // q: ULONG
@@ -98,16 +93,16 @@ typedef enum _TOKEN_INFORMATION_CLASS
TokenRestrictedDeviceClaimAttributes, // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION
TokenDeviceGroups, // q: TOKEN_GROUPS
TokenRestrictedDeviceGroups, // q: TOKEN_GROUPS
TokenSecurityAttributes, // q; s: TOKEN_SECURITY_ATTRIBUTES_[AND_OPERATION_]INFORMATION
TokenSecurityAttributes, // q; s: TOKEN_SECURITY_ATTRIBUTES_[AND_OPERATION_]INFORMATION (requires SeTcbPrivilege)
TokenIsRestricted, // q: ULONG // 40
TokenProcessTrustLevel, // q: TOKEN_PROCESS_TRUST_LEVEL
TokenPrivateNameSpace, // q; s: ULONG
TokenSingletonAttributes, // q: TOKEN_SECURITY_ATTRIBUTES_INFORMATION
TokenBnoIsolation, // q: TOKEN_BNO_ISOLATION_INFORMATION
TokenChildProcessFlags, // s: ULONG
TokenIsLessPrivilegedAppContainer, // q: ULONG
TokenIsSandboxed, // q: ULONG
TokenIsAppSilo, // TokenOriginatingProcessTrustLevel // q: TOKEN_PROCESS_TRUST_LEVEL
TokenProcessTrustLevel, // q: TOKEN_PROCESS_TRUST_LEVEL // since WINBLUE
TokenPrivateNameSpace, // q; s: ULONG (requires SeTcbPrivilege) // since THRESHOLD
TokenSingletonAttributes, // q: TOKEN_SECURITY_ATTRIBUTES_INFORMATION // since REDSTONE
TokenBnoIsolation, // q: TOKEN_BNO_ISOLATION_INFORMATION // since REDSTONE2
TokenChildProcessFlags, // s: ULONG (requires SeTcbPrivilege) // since REDSTONE3
TokenIsLessPrivilegedAppContainer, // q: ULONG // since REDSTONE5
TokenIsSandboxed, // q: ULONG // since 19H1
TokenIsAppSilo, // q: ULONG // since WIN11 22H2 // previously TokenOriginatingProcessTrustLevel // q: TOKEN_PROCESS_TRUST_LEVEL
MaxTokenInfoClass
} TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;
#endif
@@ -527,7 +522,7 @@ NtAccessCheckByTypeResultList(
// Signing
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WIN8)
NTSYSCALLAPI
NTSTATUS
@@ -552,6 +547,42 @@ NtGetCachedSigningLevel(
_Out_opt_ PULONG ThumbprintAlgorithm
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE)
// rev
typedef struct _SE_FILE_CACHE_CLAIM_INFORMATION
{
ULONG Size;
PVOID Claim;
} SE_FILE_CACHE_CLAIM_INFORMATION, *PSE_FILE_CACHE_CLAIM_INFORMATION;
// rev
typedef struct _SE_SET_FILE_CACHE_INFORMATION
{
ULONG Size;
UNICODE_STRING CatalogDirectoryPath;
SE_FILE_CACHE_CLAIM_INFORMATION OriginClaimInfo;
} SE_SET_FILE_CACHE_INFORMATION, *PSE_SET_FILE_CACHE_INFORMATION;
// rev
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetCachedSigningLevel2(
_In_ ULONG Flags,
_In_ SE_SIGNING_LEVEL InputSigningLevel,
_In_reads_(SourceFileCount) PHANDLE SourceFiles,
_In_ ULONG SourceFileCount,
_In_opt_ HANDLE TargetFile,
_In_opt_ SE_SET_FILE_CACHE_INFORMATION* CacheInformation
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE2)
// rev
NTSYSCALLAPI
NTSTATUS
ntsmss.h
+2 -7
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Windows Session Manager support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTSMSS_H
ntsxs.h
+515
View File
@@ -0,0 +1,515 @@
/*
* Side-by-side assembly support definitions.
*
* This file is part of System Informer.
*/
#ifndef _NTSXS_H
#define _NTSXS_H
#define ACTIVATION_CONTEXT_DATA_MAGIC ('xtcA')
#define ACTIVATION_CONTEXT_DATA_FORMAT_WHISTLER 1
#define ACTIVATION_CONTEXT_FLAG_NO_INHERIT 0x00000001
#if (PHNT_MODE == PHNT_MODE_KERNEL)
typedef enum _ACTCTX_REQUESTED_RUN_LEVEL
{
ACTCTX_RUN_LEVEL_UNSPECIFIED = 0,
ACTCTX_RUN_LEVEL_AS_INVOKER,
ACTCTX_RUN_LEVEL_HIGHEST_AVAILABLE,
ACTCTX_RUN_LEVEL_REQUIRE_ADMIN,
ACTCTX_RUN_LEVEL_NUMBERS
} ACTCTX_REQUESTED_RUN_LEVEL;
typedef enum _ACTCTX_COMPATIBILITY_ELEMENT_TYPE
{
ACTCTX_COMPATIBILITY_ELEMENT_TYPE_UNKNOWN = 0,
ACTCTX_COMPATIBILITY_ELEMENT_TYPE_OS,
ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MITIGATION,
ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MAXVERSIONTESTED
} ACTCTX_COMPATIBILITY_ELEMENT_TYPE;
#endif
#include <pshpack4.h>
typedef struct _ACTIVATION_CONTEXT_DATA
{
ULONG Magic;
ULONG HeaderSize;
ULONG FormatVersion;
ULONG TotalSize;
ULONG DefaultTocOffset; // to ACTIVATION_CONTEXT_DATA_TOC_HEADER
ULONG ExtendedTocOffset; // to ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_HEADER
ULONG AssemblyRosterOffset; // to ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_HEADER
ULONG Flags; // ACTIVATION_CONTEXT_FLAG_*
} ACTIVATION_CONTEXT_DATA, *PACTIVATION_CONTEXT_DATA;
#define ACTIVATION_CONTEXT_DATA_TOC_HEADER_DENSE 0x00000001
#define ACTIVATION_CONTEXT_DATA_TOC_HEADER_INORDER 0x00000002
typedef struct _ACTIVATION_CONTEXT_DATA_TOC_HEADER
{
ULONG HeaderSize;
ULONG EntryCount;
ULONG FirstEntryOffset; // to ACTIVATION_CONTEXT_DATA_TOC_ENTRY[], from ACTIVATION_CONTEXT_DATA base
ULONG Flags; // ACTIVATION_CONTEXT_DATA_TOC_HEADER_*
} ACTIVATION_CONTEXT_DATA_TOC_HEADER, *PACTIVATION_CONTEXT_DATA_TOC_HEADER;
typedef struct _ACTIVATION_CONTEXT_DATA_TOC_ENTRY
{
ULONG Id; // ACTIVATION_CONTEXT_SECTION_*
ULONG Offset; // to ACTIVATION_CONTEXT_*_SECTION_HEADER, from ACTIVATION_CONTEXT_DATA base
ULONG Length;
ULONG Format; // ACTIVATION_CONTEXT_SECTION_FORMAT_*
} ACTIVATION_CONTEXT_DATA_TOC_ENTRY, *PACTIVATION_CONTEXT_DATA_TOC_ENTRY;
typedef struct _ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_HEADER
{
ULONG HeaderSize;
ULONG EntryCount;
ULONG FirstEntryOffset; // to ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_ENTRY[], from ACTIVATION_CONTEXT_DATA base
ULONG Flags;
} ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_HEADER, *PACTIVATION_CONTEXT_DATA_EXTENDED_TOC_HEADER;
typedef struct _ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_ENTRY
{
GUID ExtensionGuid;
ULONG TocOffset; // to ACTIVATION_CONTEXT_DATA_TOC_HEADER, from ACTIVATION_CONTEXT_DATA base
ULONG Length;
} ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_ENTRY, *PACTIVATION_CONTEXT_DATA_EXTENDED_TOC_ENTRY;
#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY_INVALID 0x00000001
#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY_ROOT 0x00000002
typedef struct _ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_HEADER
{
ULONG HeaderSize;
ULONG HashAlgorithm; // HASH_STRING_ALGORITHM_*
ULONG EntryCount;
ULONG FirstEntryOffset; // to ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY[], from ACTIVATION_CONTEXT_DATA base
ULONG AssemblyInformationSectionOffset; // to resolve section-relative offsets
} ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_HEADER, *PACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_HEADER;
typedef struct _ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY
{
ULONG Flags;
ULONG PseudoKey;
ULONG AssemblyNameOffset; // to WCHAR[], from ACTIVATION_CONTEXT_DATA base
ULONG AssemblyNameLength;
ULONG AssemblyInformationOffset; // to ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION, from ACTIVATION_CONTEXT_DATA base
ULONG AssemblyInformationLength;
} ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY, *PACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY;
#define ACTIVATION_CONTEXT_SECTION_FORMAT_UNKNOWN 0
#define ACTIVATION_CONTEXT_SECTION_FORMAT_STRING_TABLE 1 // ACTIVATION_CONTEXT_STRING_SECTION_HEADER
#define ACTIVATION_CONTEXT_SECTION_FORMAT_GUID_TABLE 2 // ACTIVATION_CONTEXT_GUID_SECTION_HEADER
#define ACTIVATION_CONTEXT_STRING_SECTION_MAGIC ('dHsS')
#define ACTIVATION_CONTEXT_STRING_SECTION_FORMAT_WHISTLER 1
#define ACTIVATION_CONTEXT_STRING_SECTION_CASE_INSENSITIVE 0x00000001
#define ACTIVATION_CONTEXT_STRING_SECTION_ENTRIES_IN_PSEUDOKEY_ORDER 0x00000002
typedef struct _ACTIVATION_CONTEXT_STRING_SECTION_HEADER
{
ULONG Magic;
ULONG HeaderSize;
ULONG FormatVersion;
ULONG DataFormatVersion;
ULONG Flags; // ACTIVATION_CONTEXT_STRING_SECTION_*
ULONG ElementCount;
ULONG ElementListOffset; // to ACTIVATION_CONTEXT_STRING_SECTION_ENTRY[], from this struct base
ULONG HashAlgorithm; // HASH_STRING_ALGORITHM_*
ULONG SearchStructureOffset; // to ACTIVATION_CONTEXT_STRING_SECTION_HASH_TABLE, from this struct base
ULONG UserDataOffset; // to data depending on section Id, from this struct base
ULONG UserDataSize;
} ACTIVATION_CONTEXT_STRING_SECTION_HEADER, *PACTIVATION_CONTEXT_STRING_SECTION_HEADER;
typedef struct _ACTIVATION_CONTEXT_STRING_SECTION_ENTRY
{
ULONG PseudoKey;
ULONG KeyOffset; // to WCHAR[], from section header
ULONG KeyLength;
ULONG Offset; // to data depending on section Id, from section header
ULONG Length;
ULONG AssemblyRosterIndex;
} ACTIVATION_CONTEXT_STRING_SECTION_ENTRY, *PACTIVATION_CONTEXT_STRING_SECTION_ENTRY;
typedef struct _ACTIVATION_CONTEXT_STRING_SECTION_HASH_TABLE
{
ULONG BucketTableEntryCount;
ULONG BucketTableOffset; // to ACTIVATION_CONTEXT_STRING_SECTION_HASH_BUCKET[], from section header
} ACTIVATION_CONTEXT_STRING_SECTION_HASH_TABLE, *PACTIVATION_CONTEXT_STRING_SECTION_HASH_TABLE;
typedef struct _ACTIVATION_CONTEXT_STRING_SECTION_HASH_BUCKET
{
ULONG ChainCount;
ULONG ChainOffset; // to LONG[], from section header
} ACTIVATION_CONTEXT_STRING_SECTION_HASH_BUCKET, *PACTIVATION_CONTEXT_STRING_SECTION_HASH_BUCKET;
#define ACTIVATION_CONTEXT_GUID_SECTION_MAGIC ('dHsG')
#define ACTIVATION_CONTEXT_GUID_SECTION_FORMAT_WHISTLER 1
#define ACTIVATION_CONTEXT_GUID_SECTION_ENTRIES_IN_ORDER 0x00000001
typedef struct _ACTIVATION_CONTEXT_GUID_SECTION_HEADER
{
ULONG Magic;
ULONG HeaderSize;
ULONG FormatVersion;
ULONG DataFormatVersion;
ULONG Flags; // ACTIVATION_CONTEXT_GUID_SECTION_*
ULONG ElementCount;
ULONG ElementListOffset; // to ACTIVATION_CONTEXT_GUID_SECTION_ENTRY[], from this struct base
ULONG SearchStructureOffset; // to ACTIVATION_CONTEXT_GUID_SECTION_HASH_TABLE, from this struct base
ULONG UserDataOffset; // to data depending on section Id, from this struct base
ULONG UserDataSize;
} ACTIVATION_CONTEXT_GUID_SECTION_HEADER, *PACTIVATION_CONTEXT_GUID_SECTION_HEADER;
typedef struct _ACTIVATION_CONTEXT_GUID_SECTION_ENTRY
{
GUID Guid;
ULONG Offset; // to data depending on section Id, from section header
ULONG Length;
ULONG AssemblyRosterIndex;
} ACTIVATION_CONTEXT_GUID_SECTION_ENTRY, *PACTIVATION_CONTEXT_GUID_SECTION_ENTRY;
typedef struct _ACTIVATION_CONTEXT_GUID_SECTION_HASH_TABLE
{
ULONG BucketTableEntryCount;
ULONG BucketTableOffset; // to ACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET, from section header
} ACTIVATION_CONTEXT_GUID_SECTION_HASH_TABLE, *PACTIVATION_CONTEXT_GUID_SECTION_HASH_TABLE;
typedef struct _ACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET
{
ULONG ChainCount;
ULONG ChainOffset; // to LONG[], from section header
} ACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET, *PACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET;
// winnt.h - known section IDs
// #define ACTIVATION_CONTEXT_SECTION_ASSEMBLY_INFORMATION (1) // ACTIVATION_CONTEXT_SECTION_ASSEMBLY_INFORMATION + ACTIVATION_CONTEXT_DATA_ASSEMBLY_GLOBAL_INFORMATION
// #define ACTIVATION_CONTEXT_SECTION_DLL_REDIRECTION (2) // ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION
// #define ACTIVATION_CONTEXT_SECTION_WINDOW_CLASS_REDIRECTION (3) // ACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION
// #define ACTIVATION_CONTEXT_SECTION_COM_SERVER_REDIRECTION (4) // ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION
// #define ACTIVATION_CONTEXT_SECTION_COM_INTERFACE_REDIRECTION (5) // ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION
// #define ACTIVATION_CONTEXT_SECTION_COM_TYPE_LIBRARY_REDIRECTION (6) // ACTIVATION_CONTEXT_DATA_COM_TYPE_LIBRARY_REDIRECTION
// #define ACTIVATION_CONTEXT_SECTION_COM_PROGID_REDIRECTION (7) // ACTIVATION_CONTEXT_DATA_COM_PROGID_REDIRECTION
// #define ACTIVATION_CONTEXT_SECTION_GLOBAL_OBJECT_RENAME_TABLE (8)
// #define ACTIVATION_CONTEXT_SECTION_CLR_SURROGATES (9) // ACTIVATION_CONTEXT_DATA_CLR_SURROGATE
// #define ACTIVATION_CONTEXT_SECTION_APPLICATION_SETTINGS (10) // ACTIVATION_CONTEXT_DATA_APPLICATION_SETTINGS
// #define ACTIVATION_CONTEXT_SECTION_COMPATIBILITY_INFO (11) // ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION[_LEGACY]
// #define ACTIVATION_CONTEXT_SECTION_WINRT_ACTIVATABLE_CLASSES (12) // since 19H1
#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_FORMAT_WHISTLER 1
#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_ROOT_ASSEMBLY 0x00000001
#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_POLICY_APPLIED 0x00000002
#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_ASSEMBLY_POLICY_APPLIED 0x00000004
#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_ROOT_POLICY_APPLIED 0x00000008
#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_PRIVATE_ASSEMBLY 0x00000010
typedef struct _ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION
{
ULONG Size;
ULONG Flags; // ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_*
ULONG EncodedAssemblyIdentityLength;
ULONG EncodedAssemblyIdentityOffset; // to WCHAR[], from section header
ULONG ManifestPathType; // ACTIVATION_CONTEXT_PATH_TYPE_*
ULONG ManifestPathLength;
ULONG ManifestPathOffset; // to WCHAR[], from section header
LARGE_INTEGER ManifestLastWriteTime;
ULONG PolicyPathType; // ACTIVATION_CONTEXT_PATH_TYPE_*
ULONG PolicyPathLength;
ULONG PolicyPathOffset; // to WCHAR[], from section header
LARGE_INTEGER PolicyLastWriteTime;
ULONG MetadataSatelliteRosterIndex;
ULONG Unused2;
ULONG ManifestVersionMajor;
ULONG ManifestVersionMinor;
ULONG PolicyVersionMajor;
ULONG PolicyVersionMinor;
ULONG AssemblyDirectoryNameLength;
ULONG AssemblyDirectoryNameOffset; // to WCHAR[], from section header
ULONG NumOfFilesInAssembly;
ULONG LanguageLength;
ULONG LanguageOffset; // to WCHAR[], from section header
ACTCTX_REQUESTED_RUN_LEVEL RunLevel;
ULONG UiAccess;
} ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION, *PACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION;
// via UserData
typedef struct _ACTIVATION_CONTEXT_DATA_ASSEMBLY_GLOBAL_INFORMATION
{
ULONG Size;
ULONG Flags;
GUID PolicyCoherencyGuid;
GUID PolicyOverrideGuid;
ULONG ApplicationDirectoryPathType; // ACTIVATION_CONTEXT_PATH_TYPE_*
ULONG ApplicationDirectoryLength;
ULONG ApplicationDirectoryOffset; // to WCHAR[], from this struct base
ULONG ResourceName;
} ACTIVATION_CONTEXT_DATA_ASSEMBLY_GLOBAL_INFORMATION, *PACTIVATION_CONTEXT_DATA_ASSEMBLY_GLOBAL_INFORMATION;
#define ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_FORMAT_WHISTLER 1
#define ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_INCLUDES_BASE_NAME 0x00000001
#define ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_OMITS_ASSEMBLY_ROOT 0x00000002
#define ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_EXPAND 0x00000004
#define ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_SYSTEM_DEFAULT_REDIRECTED_SYSTEM32_DLL 0x00000008
typedef struct _ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION
{
ULONG Size;
ULONG Flags; // ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_*
ULONG TotalPathLength;
ULONG PathSegmentCount;
ULONG PathSegmentOffset; // to ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_SEGMENT[], from section header
} ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION, *PACTIVATION_CONTEXT_DATA_DLL_REDIRECTION;
typedef struct _ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_SEGMENT
{
ULONG Length;
ULONG Offset; // to WCHAR[], from section header
} ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_SEGMENT, *PACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_SEGMENT;
#define ACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION_FORMAT_WHISTLER 1
typedef struct _ACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION
{
ULONG Size;
ULONG Flags;
ULONG VersionSpecificClassNameLength;
ULONG VersionSpecificClassNameOffset; // to WHCAR[], from this struct base
ULONG DllNameLength;
ULONG DllNameOffset; // to WCHAR[], from section header
} ACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION, *PACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION;
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_FORMAT_WHISTLER 1
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_INVALID 0
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_APARTMENT 1
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_FREE 2
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_SINGLE 3
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_BOTH 4
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_NEUTRAL 5
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_FLAG_OFFSET 8
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_HAS_DEFAULT (0x01 << ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_FLAG_OFFSET)
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_HAS_ICON (0x02 << ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_FLAG_OFFSET)
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_HAS_CONTENT (0x04 << ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_FLAG_OFFSET)
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_HAS_THUMBNAIL (0x08 << ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_FLAG_OFFSET)
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_HAS_DOCPRINT (0x10 << ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_FLAG_OFFSET)
typedef struct _ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION
{
ULONG Size;
ULONG Flags;
ULONG ThreadingModel; // ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_*
GUID ReferenceClsid;
GUID ConfiguredClsid;
GUID ImplementedClsid;
GUID TypeLibraryId;
ULONG ModuleLength;
ULONG ModuleOffset; // to WCHAR[], from section header
ULONG ProgIdLength;
ULONG ProgIdOffset; // to WCHAR[], from this struct base
ULONG ShimDataLength;
ULONG ShimDataOffset; // to ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM, from this struct base
ULONG MiscStatusDefault;
ULONG MiscStatusContent;
ULONG MiscStatusThumbnail;
ULONG MiscStatusIcon;
ULONG MiscStatusDocPrint;
} ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION, *PACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION;
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM_TYPE_OTHER 1
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM_TYPE_CLR_CLASS 2
typedef struct _ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM
{
ULONG Size;
ULONG Flags;
ULONG Type; // ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM_TYPE_*
ULONG ModuleLength;
ULONG ModuleOffset; // to WCHAR[], from section header
ULONG TypeLength;
ULONG TypeOffset; // to WCHAR[], from this struct base
ULONG ShimVersionLength;
ULONG ShimVersionOffset; // to WCHAR[], from this struct base
ULONG DataLength;
ULONG DataOffset; // from this struct base
} ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM, *PACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM;
#define ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION_FORMAT_WHISTLER 1
#define ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION_FLAG_NUM_METHODS_VALID 0x00000001
#define ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION_FLAG_BASE_INTERFACE_VALID 0x00000002
typedef struct _ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION
{
ULONG Size;
ULONG Flags; // ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION_FLAG_*
GUID ProxyStubClsid32;
ULONG NumMethods;
GUID TypeLibraryId;
GUID BaseInterface;
ULONG NameLength;
ULONG NameOffset; // to WCHAR[], from this struct base
} ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION, *PACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION;
#define ACTIVATION_CONTEXT_DATA_COM_TYPE_LIBRARY_REDIRECTION_FORMAT_WHISTLER 1
typedef struct _ACTIVATION_CONTEXT_DATA_TYPE_LIBRARY_VERSION
{
USHORT Major;
USHORT Minor;
} ACTIVATION_CONTEXT_DATA_TYPE_LIBRARY_VERSION, *PACTIVATION_CONTEXT_DATA_TYPE_LIBRARY_VERSION;
typedef struct _ACTIVATION_CONTEXT_DATA_COM_TYPE_LIBRARY_REDIRECTION
{
ULONG Size;
ULONG Flags;
ULONG NameLength;
ULONG NameOffset; // to WCHAR[], from section header
USHORT ResourceId;
USHORT LibraryFlags; // LIBFLAG_* oaidl.h
ULONG HelpDirLength;
ULONG HelpDirOffset; // to WCHAR[], from this struct base
ACTIVATION_CONTEXT_DATA_TYPE_LIBRARY_VERSION Version;
} ACTIVATION_CONTEXT_DATA_COM_TYPE_LIBRARY_REDIRECTION, *PACTIVATION_CONTEXT_DATA_COM_TYPE_LIBRARY_REDIRECTION;
#define ACTIVATION_CONTEXT_DATA_COM_PROGID_REDIRECTION_FORMAT_WHISTLER 1
typedef struct _ACTIVATION_CONTEXT_DATA_COM_PROGID_REDIRECTION
{
ULONG Size;
ULONG Flags;
ULONG ConfiguredClsidOffset; // to CLSID, from section header
} ACTIVATION_CONTEXT_DATA_COM_PROGID_REDIRECTION, *PACTIVATION_CONTEXT_DATA_COM_PROGID_REDIRECTION;
#define ACTIVATION_CONTEXT_DATA_CLR_SURROGATE_FORMAT_WHISTLER 1
typedef struct _ACTIVATION_CONTEXT_DATA_CLR_SURROGATE
{
ULONG Size;
ULONG Flags;
GUID SurrogateIdent;
ULONG VersionOffset;
ULONG VersionLength;
ULONG TypeNameOffset;
ULONG TypeNameLength; // to WCHAR[], from this struct base
} ACTIVATION_CONTEXT_DATA_CLR_SURROGATE, *PACTIVATION_CONTEXT_DATA_CLR_SURROGATE;
#define ACTIVATION_CONTEXT_DATA_APPLICATION_SETTINGS_FORMAT_LONGHORN 1
#define SXS_WINDOWS_SETTINGS_NAMESPACE L"http://schemas.microsoft.com/SMI/2005/WindowsSettings"
#define SXS_WINDOWS_SETTINGS_2011_NAMESPACE L"http://schemas.microsoft.com/SMI/2011/WindowsSettings"
#define SXS_WINDOWS_SETTINGS_2013_NAMESPACE L"http://schemas.microsoft.com/SMI/2013/WindowsSettings"
#define SXS_WINDOWS_SETTINGS_2014_NAMESPACE L"http://schemas.microsoft.com/SMI/2014/WindowsSettings"
#define SXS_WINDOWS_SETTINGS_2016_NAMESPACE L"http://schemas.microsoft.com/SMI/2016/WindowsSettings"
#define SXS_WINDOWS_SETTINGS_2017_NAMESPACE L"http://schemas.microsoft.com/SMI/2017/WindowsSettings"
#define SXS_WINDOWS_SETTINGS_2019_NAMESPACE L"http://schemas.microsoft.com/SMI/2019/WindowsSettings"
#define SXS_WINDOWS_SETTINGS_2020_NAMESPACE L"http://schemas.microsoft.com/SMI/2020/WindowsSettings"
typedef struct _ACTIVATION_CONTEXT_DATA_APPLICATION_SETTINGS
{
ULONG Size;
ULONG Flags;
ULONG SettingNamespaceLength;
ULONG SettingNamespaceOffset; // to WCHAR[], from this struct base
ULONG SettingNameLength;
ULONG SettingNameOffset; // to WCHAR[], from this struct base
ULONG SettingValueLength;
ULONG SettingValueOffset; // to WCHAR[], from this struct base
} ACTIVATION_CONTEXT_DATA_APPLICATION_SETTINGS, *PACTIVATION_CONTEXT_DATA_APPLICATION_SETTINGS;
// COMPATIBILITY_CONTEXT_ELEMENT from winnt.h before 19H1
typedef struct _COMPATIBILITY_CONTEXT_ELEMENT_LEGACY
{
GUID Id;
ACTCTX_COMPATIBILITY_ELEMENT_TYPE Type;
} COMPATIBILITY_CONTEXT_ELEMENT_LEGACY, *PCOMPATIBILITY_CONTEXT_ELEMENT_LEGACY;
// ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION from winnt.h before 19H1
typedef struct _ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION_LEGACY
{
DWORD ElementCount;
COMPATIBILITY_CONTEXT_ELEMENT_LEGACY Elements[ANYSIZE_ARRAY];
} ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION_LEGACY, *PACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION_LEGACY;
#include <poppack.h>
// begin_private
typedef struct _ASSEMBLY_STORAGE_MAP_ENTRY
{
ULONG Flags;
UNICODE_STRING DosPath;
HANDLE Handle;
} ASSEMBLY_STORAGE_MAP_ENTRY, *PASSEMBLY_STORAGE_MAP_ENTRY;
#define ASSEMBLY_STORAGE_MAP_ASSEMBLY_ARRAY_IS_HEAP_ALLOCATED 0x00000001
typedef struct _ASSEMBLY_STORAGE_MAP
{
ULONG Flags;
ULONG AssemblyCount;
PASSEMBLY_STORAGE_MAP_ENTRY *AssemblyArray;
} ASSEMBLY_STORAGE_MAP, *PASSEMBLY_STORAGE_MAP;
typedef struct _ACTIVATION_CONTEXT *PACTIVATION_CONTEXT;
#define ACTIVATION_CONTEXT_NOTIFICATION_DESTROY 1
#define ACTIVATION_CONTEXT_NOTIFICATION_ZOMBIFY 2
#define ACTIVATION_CONTEXT_NOTIFICATION_USED 3
typedef VOID (NTAPI *PACTIVATION_CONTEXT_NOTIFY_ROUTINE)(
_In_ ULONG NotificationType, // ACTIVATION_CONTEXT_NOTIFICATION_*
_In_ PACTIVATION_CONTEXT ActivationContext,
_In_ PACTIVATION_CONTEXT_DATA ActivationContextData,
_In_opt_ PVOID NotificationContext,
_In_opt_ PVOID NotificationData,
_Inout_ PBOOLEAN DisableThisNotification
);
typedef struct _ACTIVATION_CONTEXT
{
LONG RefCount;
ULONG Flags;
PACTIVATION_CONTEXT_DATA ActivationContextData;
PACTIVATION_CONTEXT_NOTIFY_ROUTINE NotificationRoutine;
PVOID NotificationContext;
ULONG SentNotifications[8];
ULONG DisabledNotifications[8];
ASSEMBLY_STORAGE_MAP StorageMap;
PASSEMBLY_STORAGE_MAP_ENTRY InlineStorageMapEntries[32];
} ACTIVATION_CONTEXT, *PACTIVATION_CONTEXT;
#define RTL_ACTIVATION_CONTEXT_STACK_FRAME_FLAG_RELEASE_ON_DEACTIVATION 0x00000001
#define RTL_ACTIVATION_CONTEXT_STACK_FRAME_FLAG_NO_DEACTIVATE 0x00000002
#define RTL_ACTIVATION_CONTEXT_STACK_FRAME_FLAG_ON_FREE_LIST 0x00000004
#define RTL_ACTIVATION_CONTEXT_STACK_FRAME_FLAG_HEAP_ALLOCATED 0x00000008
#define RTL_ACTIVATION_CONTEXT_STACK_FRAME_FLAG_NOT_REALLY_ACTIVATED 0x00000010
typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME
{
struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME *Previous;
PACTIVATION_CONTEXT ActivationContext;
ULONG Flags; // RTL_ACTIVATION_CONTEXT_STACK_FRAME_FLAG_*
} RTL_ACTIVATION_CONTEXT_STACK_FRAME, *PRTL_ACTIVATION_CONTEXT_STACK_FRAME;
#define ACTIVATION_CONTEXT_STACK_FLAG_QUERIES_DISABLED 0x00000001
typedef struct _ACTIVATION_CONTEXT_STACK
{
PRTL_ACTIVATION_CONTEXT_STACK_FRAME ActiveFrame;
LIST_ENTRY FrameListCache;
ULONG Flags; // ACTIVATION_CONTEXT_STACK_FLAG_*
ULONG NextCookieSequenceNumber;
ULONG StackId;
} ACTIVATION_CONTEXT_STACK, *PACTIVATION_CONTEXT_STACK;
// end_private
#endif
nttmapi.h
+3 -8
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Transaction Manager support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTTMAPI_H
@@ -133,7 +128,7 @@ NtOpenTransaction(
_Out_ PHANDLE TransactionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ LPGUID Uow,
_In_ LPGUID Uow,
_In_opt_ HANDLE TmHandle
);
#endif
nttp.h
+20 -25
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Thread Pool support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTTP_H
@@ -33,8 +28,7 @@ typedef VOID (NTAPI *PTP_ALPC_CALLBACK_EX)(
#if (PHNT_VERSION >= PHNT_VISTA)
// private
_Check_return_
// winbase:CreateThreadpool
NTSYSAPI
NTSTATUS
NTAPI
@@ -60,7 +54,7 @@ TpSetPoolMaxThreads(
_In_ ULONG MaxThreads
);
// private
// winbase:SetThreadpoolThreadMinimum
NTSYSAPI
NTSTATUS
NTAPI
@@ -70,7 +64,7 @@ TpSetPoolMinThreads(
);
#if (PHNT_VERSION >= PHNT_WIN7)
// rev
// winbase:QueryThreadpoolStackInformation
NTSYSAPI
NTSTATUS
NTAPI
@@ -78,10 +72,8 @@ TpQueryPoolStackInformation(
_In_ PTP_POOL Pool,
_Out_ PTP_POOL_STACK_INFORMATION PoolStackInformation
);
#endif
#if (PHNT_VERSION >= PHNT_WIN7)
// rev
// winbase:SetThreadpoolStackInformation
NTSYSAPI
NTSTATUS
NTAPI
@@ -89,10 +81,18 @@ TpSetPoolStackInformation(
_Inout_ PTP_POOL Pool,
_In_ PTP_POOL_STACK_INFORMATION PoolStackInformation
);
// rev
NTSYSAPI
NTSTATUS
NTAPI
TpSetPoolThreadBasePriority(
_Inout_ PTP_POOL Pool,
_In_ ULONG BasePriority
);
#endif
// private
_Check_return_
// winbase:CreateThreadpoolCleanupGroup
NTSYSAPI
NTSTATUS
NTAPI
@@ -181,7 +181,6 @@ TpDisassociateCallback(
);
// winbase:TrySubmitThreadpoolCallback
_Check_return_
NTSYSAPI
NTSTATUS
NTAPI
@@ -191,8 +190,7 @@ TpSimpleTryPost(
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
);
// private
_Check_return_
// winbase:CreateThreadpoolWork
NTSYSAPI
NTSTATUS
NTAPI
@@ -228,8 +226,7 @@ TpWaitForWork(
_In_ LOGICAL CancelPendingCallbacks
);
// private
_Check_return_
// winbase:CreateThreadpoolTimer
NTSYSAPI
NTSTATUS
NTAPI
@@ -289,8 +286,7 @@ TpWaitForTimer(
_In_ LOGICAL CancelPendingCallbacks
);
// private
_Check_return_
// winbase:CreateThreadpoolWait
NTSYSAPI
NTSTATUS
NTAPI
@@ -350,8 +346,7 @@ typedef VOID (NTAPI *PTP_IO_CALLBACK)(
_In_ PTP_IO Io
);
// private
_Check_return_
// winbase:CreateThreadpoolIo
NTSYSAPI
NTSTATUS
NTAPI
ntwmi.h
+5928
View File
File diff suppressed because it is too large Load Diff
ntwow64.h
+210 -29
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Windows on Windows support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTWOW64_H
@@ -108,6 +103,8 @@ typedef struct _LDR_DDAG_NODE32
#define LDR_DATA_TABLE_ENTRY_SIZE_WINXP_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, DdagNode)
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN7_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, BaseNameHashValue)
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN8_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, ImplicitPathOptions)
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN10_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, SigningLevel)
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN11_32 sizeof(LDR_DATA_TABLE_ENTRY32)
typedef struct _LDR_DATA_TABLE_ENTRY32
{
@@ -180,6 +177,9 @@ typedef struct _LDR_DATA_TABLE_ENTRY32
ULONG ReferenceCount;
ULONG DependentLoadFlags;
UCHAR SigningLevel; // since REDSTONE2
ULONG CheckSum; // since 22H1
WOW64_POINTER(PVOID) ActivePatchImageBase;
LDR_HOT_PATCH_STATE HotPatchState;
} LDR_DATA_TABLE_ENTRY32, *PLDR_DATA_TABLE_ENTRY32;
typedef struct _CURDIR32
@@ -242,8 +242,11 @@ typedef struct _RTL_USER_PROCESS_PARAMETERS32
UNICODE_STRING32 HeapPartitionName; // 19H1
WOW64_POINTER(ULONG_PTR) DefaultThreadpoolCpuSetMasks;
ULONG DefaultThreadpoolCpuSetMaskCount;
ULONG DefaultThreadpoolThreadMaximum;
} RTL_USER_PROCESS_PARAMETERS32, *PRTL_USER_PROCESS_PARAMETERS32;
typedef struct _LEAP_SECOND_DATA *PLEAP_SECOND_DATA;
typedef struct _PEB32
{
BOOLEAN InheritedAddressSpace;
@@ -299,7 +302,7 @@ typedef struct _PEB32
WOW64_POINTER(PVOID) TlsBitmap;
ULONG TlsBitmapBits[2];
WOW64_POINTER(PVOID) ReadOnlySharedMemoryBase;
WOW64_POINTER(PVOID) HotpatchInformation;
WOW64_POINTER(PVOID) SharedData;
WOW64_POINTER(PVOID *) ReadOnlyStaticServerData;
WOW64_POINTER(PVOID) AnsiCodePageData;
WOW64_POINTER(PVOID) OemCodePageData;
@@ -348,24 +351,35 @@ typedef struct _PEB32
UNICODE_STRING32 CSDVersion;
WOW64_POINTER(PVOID) ActivationContextData;
WOW64_POINTER(PACTIVATION_CONTEXT_DATA) ActivationContextData;
WOW64_POINTER(PVOID) ProcessAssemblyStorageMap;
WOW64_POINTER(PVOID) SystemDefaultActivationContextData;
WOW64_POINTER(PACTIVATION_CONTEXT_DATA) SystemDefaultActivationContextData;
WOW64_POINTER(PVOID) SystemAssemblyStorageMap;
WOW64_POINTER(SIZE_T) MinimumStackCommit;
WOW64_POINTER(PVOID) SparePointers[4];
ULONG SpareUlongs[5];
//WOW64_POINTER(PVOID *) FlsCallback;
//LIST_ENTRY32 FlsListHead;
//WOW64_POINTER(PVOID) FlsBitmap;
//ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)];
//ULONG FlsHighIndex;
WOW64_POINTER(PVOID) SparePointers[2]; // 19H1 (previously FlsCallback to FlsHighIndex)
WOW64_POINTER(PVOID) PatchLoaderData;
WOW64_POINTER(PVOID) ChpeV2ProcessInfo; // _CHPEV2_PROCESS_INFO
ULONG AppModelFeatureState;
ULONG SpareUlongs[2];
USHORT ActiveCodePage;
USHORT OemCodePage;
USHORT UseCaseMapping;
USHORT UnusedNlsField;
WOW64_POINTER(PVOID) WerRegistrationData;
WOW64_POINTER(PVOID) WerShipAssertPtr;
WOW64_POINTER(PVOID) pContextData;
union
{
WOW64_POINTER(PVOID) pContextData; // WIN7
WOW64_POINTER(PVOID) pUnused; // WIN10
WOW64_POINTER(PVOID) EcCodeBitMap; // WIN11
};
WOW64_POINTER(PVOID) pImageHeaderHash;
union
{
@@ -387,15 +401,23 @@ typedef struct _PEB32
ULONG CloudFileDiagFlags; // REDSTONE4
CHAR PlaceholderCompatibilityMode;
CHAR PlaceholderCompatibilityModeReserved[7];
WOW64_POINTER(PLEAP_SECOND_DATA) LeapSecondData; // REDSTONE5
union
{
ULONG LeapSecondFlags;
struct
{
ULONG SixtySecondEnabled : 1;
ULONG Reserved : 31;
};
};
ULONG NtGlobalFlag2;
ULONGLONG ExtendedFeatureDisableMask; // since WIN11
} PEB32, *PPEB32;
C_ASSERT(FIELD_OFFSET(PEB32, IFEOKey) == 0x024);
C_ASSERT(FIELD_OFFSET(PEB32, UnicodeCaseTableData) == 0x060);
C_ASSERT(FIELD_OFFSET(PEB32, SystemAssemblyStorageMap) == 0x204);
C_ASSERT(FIELD_OFFSET(PEB32, pImageHeaderHash) == 0x23c);
C_ASSERT(FIELD_OFFSET(PEB32, WaitOnAddressHashTable) == 0x25c);
//C_ASSERT(sizeof(PEB32) == 0x460); // REDSTONE3
C_ASSERT(sizeof(PEB32) == 0x470);
//C_ASSERT(sizeof(PEB32) == 0x470); // REDSTONE5
C_ASSERT(sizeof(PEB32) == 0x488); // WIN11
// Note: Use PhGetProcessPeb32 instead. (dmex)
//#define WOW64_GET_PEB32(peb64) ((PPEB32)PTR_ADD_OFFSET((peb64), ALIGN_UP_BY(sizeof(PEB), PAGE_SIZE)))
@@ -571,11 +593,6 @@ C_ASSERT(FIELD_OFFSET(TEB32, ReservedForCrt) == 0xfe8);
C_ASSERT(FIELD_OFFSET(TEB32, EffectiveContainerId) == 0xff0);
C_ASSERT(sizeof(TEB32) == 0x1000);
// Get the 32-bit TEB without doing a memory reference
// modified from public SDK /10.0.10240.0/um/minwin/wow64t.h (dmex)
#define WOW64_GET_TEB32(teb64) ((PTEB32)PTR_ADD_OFFSET((teb64), ALIGN_UP_BY(sizeof(TEB), PAGE_SIZE)))
#define WOW64_TEB32_POINTER_ADDRESS(teb64) (PVOID)&((teb64)->NtTib.ExceptionList)
// Conversion
FORCEINLINE VOID UStr32ToUStr(
@@ -598,4 +615,168 @@ FORCEINLINE VOID UStrToUStr32(
Destination->Buffer = PtrToUlong(Source->Buffer);
}
// The Wow64Info structure follows the PEB32/TEB32 structures and is shared between 32-bit and 64-bit modules inside a Wow64 process.
// from SDK/10.0.10240.0/um/minwin/wow64t.h (dmex)
//
// Page size on x86 NT
//
#define PAGE_SIZE_X86NT 0x1000
#define PAGE_SHIFT_X86NT 12L
#define WOW64_SPLITS_PER_PAGE (PAGE_SIZE_X86NT / PAGE_SIZE_X86NT)
//
// Convert the number of native pages to sub x86-pages
//
#define Wow64GetNumberOfX86Pages(NativePages) \
(NativePages * (PAGE_SIZE_X86NT >> PAGE_SHIFT_X86NT))
//
// Macro to round to the nearest page size
//
#define WOW64_ROUND_TO_PAGES(Size) \
(((ULONG_PTR)(Size) + PAGE_SIZE_X86NT - 1) & ~(PAGE_SIZE_X86NT - 1))
//
// Get number of native pages
//
#define WOW64_BYTES_TO_PAGES(Size) \
(((ULONG)(Size) >> WOW64_ROUND_TO_PAGES) + (((ULONG)(Size) & (PAGE_SIZE_X86NT - 1)) != 0))
//
// Get the 32-bit TEB without doing a memory reference.
//
#define WOW64_GET_TEB32(teb64) ((PTEB32)(PVOID)RtlOffsetToPointer((teb64), WOW64_ROUND_TO_PAGES(sizeof(TEB))))
#define WOW64_TEB32_POINTER_ADDRESS(teb64) (PVOID)&((teb64)->NtTib.ExceptionList)
typedef union _WOW64_EXECUTE_OPTIONS
{
ULONG Flags;
struct
{
ULONG StackReserveSize : 8;
ULONG StackCommitSize : 4;
ULONG Deprecated0 : 1;
ULONG DisableWowAssert : 1;
ULONG DisableTurboDispatch : 1;
ULONG Unused : 13;
ULONG Reserved0 : 1;
ULONG Reserved1 : 1;
ULONG Reserved2 : 1;
ULONG Reserved3 : 1;
};
} WOW64_EXECUTE_OPTIONS, *PWOW64_EXECUTE_OPTIONS;
#define WOW64_CPUFLAGS_MSFT64 0x00000001
#define WOW64_CPUFLAGS_SOFTWARE 0x00000002
#define WOW64_CPUFLAGS_IA64 0x00000004
typedef struct _WOW64INFO
{
ULONG NativeSystemPageSize;
ULONG CpuFlags;
WOW64_EXECUTE_OPTIONS Wow64ExecuteFlags;
ULONG InstrumentationCallback;
} WOW64INFO, *PWOW64INFO;
typedef struct _PEB32_WITH_WOW64INFO
{
PEB32 Peb32;
WOW64INFO Wow64Info;
} PEB32_WITH_WOW64INFO, *PPEB32_WITH_WOW64INFO;
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#ifdef _M_X64
FORCEINLINE
TEB32*
POINTER_UNSIGNED
Wow64CurrentGuestTeb(
VOID
)
{
TEB* POINTER_UNSIGNED Teb;
TEB32* POINTER_UNSIGNED Teb32;
Teb = NtCurrentTeb();
if (Teb->WowTebOffset == 0)
{
//
// Not running under or over WoW, so there is no "guest teb"
//
return NULL;
}
if (Teb->WowTebOffset < 0)
{
//
// Was called while running under WoW. The current teb is the guest
// teb.
//
Teb32 = (PTEB32)Teb;
RTL_ASSERT(&Teb32->WowTebOffset == &Teb->WowTebOffset);
}
else
{
//
// Called by the WoW Host, so calculate the position of the guest teb
// relative to the current (host) teb.
//
Teb32 = (PTEB32)RtlOffsetToPointer(Teb, Teb->WowTebOffset);
}
RTL_ASSERT(Teb32->NtTib.Self == PtrToUlong(Teb32));
return Teb32;
}
FORCEINLINE
VOID*
POINTER_UNSIGNED
Wow64CurrentNativeTeb(
VOID
)
{
TEB* POINTER_UNSIGNED Teb;
VOID* POINTER_UNSIGNED HostTeb;
Teb = NtCurrentTeb();
if (Teb->WowTebOffset >= 0)
{
//
// Not running under WoW, so it it either not running on WoW at all, or
// it is the host. Return the current teb as native teb.
//
HostTeb = (PVOID)Teb;
}
else
{
//
// Called while runnign under WoW Host, so calculate the position of the
// host teb relative to the current (guest) teb.
//
HostTeb = (PVOID)RtlOffsetToPointer(Teb, Teb->WowTebOffset);
}
RTL_ASSERT((((PTEB32)HostTeb)->NtTib.Self == PtrToUlong(HostTeb)) || ((ULONG_PTR)((PTEB)HostTeb)->NtTib.Self == (ULONG_PTR)HostTeb));
return HostTeb;
}
#define NtCurrentTeb32() (Wow64CurrentGuestTeb())
#define NtCurrentPeb32() ((PPEB32)(UlongToPtr((NtCurrentTeb32()->ProcessEnvironmentBlock))))
#define Wow64GetNativeTebField(teb, field) (((ULONG)(teb) == ((PTEB32)(teb))->NtTib.Self) ? (((PTEB32)(teb))->##field) : (((PTEB)(teb))->##field) )
#define Wow64SetNativeTebField(teb, field, value) { if ((ULONG)(teb) == ((PTEB32)(teb))->NtTib.Self) {(((PTEB32)(teb))->##field) = (value);} else {(((PTEB)(teb))->##field) = (value);} }
#endif
#endif
#endif
ntxcapi.h
+23 -8
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Exception support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _NTXCAPI_H
@@ -35,6 +30,26 @@ RtlRaiseException(
_In_ PEXCEPTION_RECORD ExceptionRecord
);
#if (PHNT_VERSION >= PHNT_20H1)
// rev
NTSYSAPI
VOID
NTAPI
RtlRaiseExceptionForReturnAddressHijack(
VOID
);
// rev
NTSYSAPI
DECLSPEC_NORETURN
VOID
NTAPI
RtlRaiseNoncontinuableException(
_In_ PEXCEPTION_RECORD ExceptionRecord,
_In_ PCONTEXT ContextRecord
);
#endif
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -91,8 +106,8 @@ NtRaiseException(
_In_ BOOLEAN FirstChance
);
__analysis_noreturn
NTSYSCALLAPI
DECLSPEC_NORETURN
VOID
NTAPI
RtlAssert(
ntzwapi.h
+169 -49
View File
@@ -1,14 +1,3 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
*/
#ifndef _NTZWAPI_H
#define _NTZWAPI_H
@@ -328,6 +317,19 @@ ZwAllocateVirtualMemory(
_In_ ULONG Protect
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwAllocateVirtualMemoryEx(
_In_ HANDLE ProcessHandle,
_Inout_ _At_(*BaseAddress, _Readable_bytes_(*RegionSize) _Writable_bytes_(*RegionSize) _Post_readable_byte_size_(*RegionSize)) PVOID *BaseAddress,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG AllocationType,
_In_ ULONG PageProtection,
_Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters,
_In_ ULONG ExtendedParameterCount
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -363,7 +365,7 @@ ZwAlpcConnectPort(
_In_ ULONG Flags,
_In_opt_ PSID RequiredServerSid,
_Inout_updates_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ConnectionMessage,
_Inout_opt_ PULONG BufferLength,
_Inout_opt_ PSIZE_T BufferLength,
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
_In_opt_ PLARGE_INTEGER Timeout
@@ -485,7 +487,7 @@ NTAPI
ZwAlpcImpersonateClientContainerOfPort(
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE Message,
_In_ ULONG Flags
_Reserved_ ULONG Flags
);
NTSYSCALLAPI
@@ -504,7 +506,7 @@ ZwAlpcOpenSenderProcess(
_Out_ PHANDLE ProcessHandle,
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE PortMessage,
_In_ ULONG Flags,
_Reserved_ ULONG Flags,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
@@ -516,7 +518,7 @@ ZwAlpcOpenSenderThread(
_Out_ PHANDLE ThreadHandle,
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE PortMessage,
_In_ ULONG Flags,
_Reserved_ ULONG Flags,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
@@ -621,9 +623,9 @@ NTSTATUS
NTAPI
ZwCallEnclave(
_In_ PENCLAVE_ROUTINE Routine,
_In_ PVOID Parameter,
_In_ BOOLEAN WaitForThread,
_Out_opt_ PVOID *ReturnValue
_In_ PVOID Reserved, // reserved for dispatch (RtlEnclaveCallDispatch)
_In_ ULONG Flags, // ENCLAVE_CALL_FLAG_*
_Inout_ PVOID* RoutineParamReturn // input routine parameter, output routine return value
);
NTSYSCALLAPI
@@ -791,7 +793,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCompressKey(
_In_ HANDLE Key
_In_ HANDLE KeyHandle
);
NTSYSCALLAPI
@@ -824,6 +826,32 @@ ZwContinueEx(
_In_ PVOID ContinueArgument // PKCONTINUE_ARGUMENT and BOOLEAN are valid
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter(
_In_ BOOLEAN ConvertAuxiliaryToPerformanceCounter,
_In_ PLARGE_INTEGER PerformanceOrAuxiliaryCounterValue,
_Out_ PLARGE_INTEGER ConvertedValue,
_Out_opt_ PLARGE_INTEGER ConversionError
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCopyFileChunk(
_In_ HANDLE SourceHandle,
_In_ HANDLE DestinationHandle,
_In_opt_ HANDLE EventHandle,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_ ULONG Length,
_In_ PLARGE_INTEGER SourceOffset,
_In_ PLARGE_INTEGER DestOffset,
_In_opt_ PULONG SourceKey,
_In_opt_ PULONG DestKey,
_In_ ULONG Flags
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -930,6 +958,17 @@ ZwCreateIoCompletion(
_In_opt_ ULONG Count
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCreateIoRing(
_Out_ PHANDLE IoRingHandle,
_In_ ULONG CreateParametersLength,
_In_ PVOID CreateParameters,
_In_ ULONG OutputParametersLength,
_Out_ PVOID OutputParameters
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -976,7 +1015,7 @@ ZwCreateKeyedEvent(
_Out_ PHANDLE KeyedEventHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG Flags
_Reserved_ ULONG Flags
);
NTSYSCALLAPI
@@ -1049,7 +1088,7 @@ ZwCreateNamedPipeFile(
_In_ ULONG MaximumInstances,
_In_ ULONG InboundQuota,
_In_ ULONG OutboundQuota,
_In_opt_ PLARGE_INTEGER DefaultTimeout
_In_ PLARGE_INTEGER DefaultTimeout
);
NTSYSCALLAPI
@@ -1066,7 +1105,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCreatePartition(
_In_ HANDLE ParentPartitionHandle,
_In_opt_ HANDLE ParentPartitionHandle,
_Out_ PHANDLE PartitionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
@@ -1249,7 +1288,7 @@ ZwCreateThreadEx(
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ HANDLE ProcessHandle,
_In_ PVOID StartRoutine, // PUSER_THREAD_START_ROUTINE
_In_ PUSER_THREAD_START_ROUTINE StartRoutine,
_In_opt_ PVOID Argument,
_In_ ULONG CreateFlags, // THREAD_CREATE_FLAGS_*
_In_ SIZE_T ZeroBits,
@@ -1448,7 +1487,7 @@ NTSTATUS
NTAPI
ZwDelayExecution(
_In_ BOOLEAN Alertable,
_In_opt_ PLARGE_INTEGER DelayInterval
_In_ PLARGE_INTEGER DelayInterval
);
NTSYSCALLAPI
@@ -1515,7 +1554,7 @@ NTSTATUS
NTAPI
ZwDeleteWnfStateData(
_In_ PCWNF_STATE_NAME StateName,
_In_opt_ const VOID *ExplicitScope
_In_opt_ const VOID* ExplicitScope
);
NTSYSCALLAPI
@@ -1758,7 +1797,7 @@ ZwFlushKey(
);
NTSYSCALLAPI
VOID
NTSTATUS
NTAPI
ZwFlushProcessWriteBuffers(
VOID
@@ -1771,7 +1810,7 @@ ZwFlushVirtualMemory(
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_Inout_ PSIZE_T RegionSize,
_Out_ struct _IO_STATUS_BLOCK* IoStatus
_Out_ PIO_STATUS_BLOCK IoStatus
);
NTSYSCALLAPI
@@ -2005,7 +2044,8 @@ NTAPI
ZwInitializeNlsFiles(
_Out_ PVOID *BaseAddress,
_Out_ PLCID DefaultLocaleId,
_Out_ PLARGE_INTEGER DefaultCasingTableSize
_Out_ PLARGE_INTEGER DefaultCasingTableSize,
_Out_opt_ PULONG CurrentNLSVersion
);
NTSYSCALLAPI
@@ -2101,8 +2141,8 @@ ZwLoadKey3(
_In_ POBJECT_ATTRIBUTES TargetKey,
_In_ POBJECT_ATTRIBUTES SourceFile,
_In_ ULONG Flags,
_In_reads_(LoadEntryCount) PKEY_LOAD_ENTRY LoadEntries,
_In_ ULONG LoadEntryCount,
_In_reads_(ExtendedParameterCount) PCM_EXTENDED_PARAMETER ExtendedParameters,
_In_ ULONG ExtendedParameterCount,
_In_opt_ ACCESS_MASK DesiredAccess,
_Out_opt_ PHANDLE RootHandle,
_Reserved_ PVOID Reserved
@@ -2234,6 +2274,21 @@ ZwMapViewOfSection(
_In_ ULONG Win32Protect
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwMapViewOfSectionEx(
_In_ HANDLE SectionHandle,
_In_ HANDLE ProcessHandle,
_Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID *BaseAddress,
_Inout_opt_ PLARGE_INTEGER SectionOffset,
_Inout_ PSIZE_T ViewSize,
_In_ ULONG AllocationType,
_In_ ULONG Win32Protect,
_Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters,
_In_ ULONG ExtendedParameterCount
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -2613,7 +2668,7 @@ ZwOpenTransaction(
_Out_ PHANDLE TransactionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ LPGUID Uow,
_In_ LPGUID Uow,
_In_opt_ HANDLE TmHandle
);
@@ -2743,6 +2798,17 @@ ZwProtectVirtualMemory(
_Out_ PULONG OldProtect
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwPssCaptureVaSpaceBulk(
_In_ HANDLE ProcessHandle,
_In_opt_ PVOID BaseAddress,
_In_ PNTPSS_MEMORY_BULK_INFORMATION BulkInformation,
_In_ SIZE_T BulkInformationLength,
_Out_opt_ PSIZE_T ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -2759,6 +2825,13 @@ ZwQueryAttributesFile(
_Out_ PFILE_BASIC_INFORMATION FileInformation
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryAuxiliaryCounterFrequency(
_Out_ PLARGE_INTEGER AuxiliaryCounterFrequency
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -3055,6 +3128,14 @@ ZwQueryIoCompletion(
_Out_opt_ PULONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryIoRingCapabilities(
_In_ SIZE_T IoRingCapabilitiesLength,
_Out_ PVOID IoRingCapabilities
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -3137,6 +3218,13 @@ ZwQueryPerformanceCounter(
_Out_opt_ PLARGE_INTEGER PerformanceFrequency
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryPortInformationProcess(
VOID
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -3221,7 +3309,7 @@ NTSTATUS
NTAPI
ZwQuerySystemEnvironmentValueEx(
_In_ PUNICODE_STRING VariableName,
_In_ PGUID VendorGuid,
_In_ PCGUID VendorGuid,
_Out_writes_bytes_opt_(*ValueLength) PVOID Value,
_Inout_ PULONG ValueLength,
_Out_opt_ PULONG Attributes // EFI_VARIABLE_*
@@ -3317,9 +3405,9 @@ NTAPI
ZwQueryWnfStateData(
_In_ PCWNF_STATE_NAME StateName,
_In_opt_ PCWNF_TYPE_ID TypeId,
_In_opt_ const VOID *ExplicitScope,
_In_opt_ const VOID* ExplicitScope,
_Out_ PWNF_CHANGE_STAMP ChangeStamp,
_Out_writes_bytes_to_opt_(*BufferSize, *BufferSize) PVOID Buffer,
_Out_writes_bytes_opt_(*BufferSize) PVOID Buffer,
_Inout_ PULONG BufferSize
);
@@ -3329,7 +3417,7 @@ NTAPI
ZwQueryWnfStateNameInformation(
_In_ PCWNF_STATE_NAME StateName,
_In_ WNF_STATE_NAME_INFORMATION NameInfoClass,
_In_opt_ const VOID *ExplicitScope,
_In_opt_ const VOID* ExplicitScope,
_Out_writes_bytes_(InfoBufferSize) PVOID InfoBuffer,
_In_ ULONG InfoBufferSize
);
@@ -3350,7 +3438,7 @@ NTSTATUS
NTAPI
ZwQueueApcThreadEx(
_In_ HANDLE ThreadHandle,
_In_opt_ HANDLE ReserveHandle, // NtAllocateReserveObject
_In_opt_ HANDLE ReserveHandle, // NtAllocateReserveObject // SPECIAL_USER_APC
_In_ PPS_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcArgument1,
_In_opt_ PVOID ApcArgument2,
@@ -3452,6 +3540,18 @@ ZwReadVirtualMemory(
_Out_opt_ PSIZE_T NumberOfBytesRead
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwReadVirtualMemoryEx(
_In_ HANDLE ProcessHandle,
_In_opt_ PVOID BaseAddress,
_Out_writes_bytes_(BufferSize) PVOID Buffer,
_In_ SIZE_T BufferSize,
_Out_opt_ PSIZE_T NumberOfBytesRead,
_In_ ULONG Flags
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -3503,7 +3603,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwReleaseKeyedEvent(
_In_ HANDLE KeyedEventHandle,
_In_opt_ HANDLE KeyedEventHandle,
_In_ PVOID KeyValue,
_In_ BOOLEAN Alertable,
_In_opt_ PLARGE_INTEGER Timeout
@@ -3932,6 +4032,16 @@ ZwSetInformationFile(
_In_ FILE_INFORMATION_CLASS FileInformationClass
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwSetInformationIoRing(
_In_ HANDLE IoRingHandle,
_In_ ULONG IoRingInformationClass,
_In_ ULONG IoRingInformationLength,
_In_ PVOID IoRingInformation
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -4039,8 +4149,8 @@ ZwSetInformationVirtualMemory(
_In_ HANDLE ProcessHandle,
_In_ VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass,
_In_ ULONG_PTR NumberOfEntries,
_In_reads_ (NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses,
_In_reads_bytes_ (VmInformationLength) PVOID VmInformation,
_In_reads_(NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses,
_In_reads_bytes_(VmInformationLength) PVOID VmInformation,
_In_ ULONG VmInformationLength
);
@@ -4151,7 +4261,7 @@ NTSTATUS
NTAPI
ZwSetSystemEnvironmentValueEx(
_In_ PUNICODE_STRING VariableName,
_In_ PGUID VendorGuid,
_In_ PCGUID VendorGuid,
_In_reads_bytes_opt_(ValueLength) PVOID Value,
_In_ ULONG ValueLength, // 0 = delete variable
_In_ ULONG Attributes // EFI_VARIABLE_*
@@ -4317,6 +4427,16 @@ ZwStopProfile(
_In_ HANDLE ProfileHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwSubmitIoRing(
_In_ HANDLE IoRingHandle,
_In_ ULONG Flags,
_In_opt_ ULONG WaitOperations,
_In_opt_ PLARGE_INTEGER Timeout
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -4359,7 +4479,7 @@ NTSTATUS
NTAPI
ZwTerminateEnclave(
_In_ PVOID BaseAddress,
_In_ BOOLEAN WaitForThread
_In_ ULONG Flags // TERMINATE_ENCLAVE_FLAG_*
);
NTSYSCALLAPI
@@ -4411,11 +4531,11 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwTraceControl(
_In_ TRACE_CONTROL_INFORMATION_CLASS TraceInformationClass,
_In_ ETWTRACECONTROLCODE TraceControlCode,
_In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
_In_ ULONG InputBufferLength,
_Out_writes_bytes_opt_(TraceInformationLength) PVOID TraceInformation,
_In_ ULONG TraceInformationLength,
_Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
_In_ ULONG OutputBufferLength,
_Out_ PULONG ReturnLength
);
@@ -4526,10 +4646,10 @@ NTSTATUS
NTAPI
ZwUpdateWnfStateData(
_In_ PCWNF_STATE_NAME StateName,
_In_reads_bytes_opt_(Length) const VOID *Buffer,
_In_reads_bytes_opt_(Length) const VOID* Buffer,
_In_opt_ ULONG Length,
_In_opt_ PCWNF_TYPE_ID TypeId,
_In_opt_ const VOID *ExplicitScope,
_In_opt_ const VOID* ExplicitScope,
_In_ WNF_CHANGE_STAMP MatchingChangeStamp,
_In_ LOGICAL CheckStamp
);
@@ -4564,7 +4684,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwWaitForKeyedEvent(
_In_ HANDLE KeyedEventHandle,
_In_opt_ HANDLE KeyedEventHandle,
_In_ PVOID KeyValue,
_In_ BOOLEAN Alertable,
_In_opt_ PLARGE_INTEGER Timeout
@@ -4606,10 +4726,10 @@ NTSTATUS
NTAPI
ZwWaitForWorkViaWorkerFactory(
_In_ HANDLE WorkerFactoryHandle,
_Out_writes_to_(Count, *PacketsReturned) struct _FILE_IO_COMPLETION_INFORMATION *MiniPackets,
_Out_writes_to_(Count, *PacketsReturned) PFILE_IO_COMPLETION_INFORMATION MiniPackets,
_In_ ULONG Count,
_Out_ PULONG PacketsReturned,
_In_ struct _WORKER_FACTORY_DEFERRED_WORK* DeferredWork
_In_ PWORKER_FACTORY_DEFERRED_WORK DeferredWork
);
NTSYSCALLAPI
phnt.h
+12 -12
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* NT Header annotations
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _PHNT_H
@@ -54,16 +49,19 @@
#define PHNT_20H1 109
#define PHNT_20H2 110
#define PHNT_21H1 111
#define PHNT_21H2 112
#define PHNT_WIN11 113
#define PHNT_WIN11_22H2 114
#define PHNT_WIN10_21H2 112
#define PHNT_WIN10_22H2 113
#define PHNT_WIN11 114
#define PHNT_WIN11_22H2 115
#define PHNT_WIN11_23H2 116
#define PHNT_WIN11_24H2 117
#ifndef PHNT_MODE
#define PHNT_MODE PHNT_MODE_USER
#endif
#ifndef PHNT_VERSION
#define PHNT_VERSION PHNT_WIN7
#define PHNT_VERSION PHNT_WIN11
#endif
// Options
@@ -77,9 +75,9 @@ extern "C" {
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#include <phnt_ntdef.h>
#include <ntnls.h>
#include <ntkeapi.h>
#endif
#include <ntkeapi.h>
#include <ntldr.h>
#include <ntexapi.h>
@@ -98,6 +96,7 @@ extern "C" {
#include <ntpoapi.h>
#include <ntregapi.h>
#include <ntrtl.h>
#include <ntimage.h>
#endif
#if (PHNT_MODE != PHNT_MODE_KERNEL)
@@ -113,6 +112,7 @@ extern "C" {
#include <ntsam.h>
#include <ntmisc.h>
#include <ntwmi.h>
#include <ntzwapi.h>
phnt_ntdef.h
+43 -22
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Native definition support
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _PHNT_NTDEF_H
@@ -58,6 +53,8 @@ typedef CLONG *PCLONG;
typedef PCSTR PCSZ;
typedef PVOID* PPVOID;
// Specific
typedef UCHAR KIRQL, *PKIRQL;
@@ -78,6 +75,9 @@ typedef struct _LARGE_INTEGER_128
#define NT_WARNING(Status) ((((ULONG)(Status)) >> 30) == 2)
#define NT_ERROR(Status) ((((ULONG)(Status)) >> 30) == 3)
#define NT_CUSTOMER_SHIFT 29
#define NT_CUSTOMER(Status) ((((ULONG)(Status)) >> NT_CUSTOMER_SHIFT) & 1)
#define NT_FACILITY_MASK 0xfff
#define NT_FACILITY_SHIFT 16
#define NT_FACILITY(Status) ((((ULONG)(Status)) >> NT_FACILITY_SHIFT) & NT_FACILITY_MASK)
@@ -134,13 +134,24 @@ typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
_Field_size_bytes_part_(MaximumLength, Length) PWCH Buffer;
_Field_size_bytes_part_opt_(MaximumLength, Length) PWCH Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef const UNICODE_STRING *PCUNICODE_STRING;
#define RTL_CONSTANT_STRING(s) { sizeof(s) - sizeof((s)[0]), sizeof(s), s }
#define DECLARE_CONST_UNICODE_STRING(_var, _str) \
const WCHAR _var ## _buffer[] = _str; \
const UNICODE_STRING _var = { sizeof(_str) - sizeof(WCHAR), sizeof(_str), (PWCH) _var ## _buffer }
#define DECLARE_GLOBAL_CONST_UNICODE_STRING(_var, _str) \
extern const DECLSPEC_SELECTANY UNICODE_STRING _var = RTL_CONSTANT_STRING(_str)
#define DECLARE_UNICODE_STRING_SIZE(_var, _size) \
WCHAR _var ## _buffer[_size]; \
UNICODE_STRING _var = { 0, (_size) * sizeof(WCHAR) , _var ## _buffer }
// Balanced tree node
#define RTL_BALANCED_NODE_RESERVED_PARENT_MASK 3
@@ -196,19 +207,20 @@ typedef STRING64 ANSI_STRING64, *PANSI_STRING64;
// Object attributes
#define OBJ_PROTECT_CLOSE 0x00000001
#define OBJ_INHERIT 0x00000002
#define OBJ_AUDIT_OBJECT_CLOSE 0x00000004
#define OBJ_PERMANENT 0x00000010
#define OBJ_EXCLUSIVE 0x00000020
#define OBJ_CASE_INSENSITIVE 0x00000040
#define OBJ_OPENIF 0x00000080
#define OBJ_OPENLINK 0x00000100
#define OBJ_KERNEL_HANDLE 0x00000200
#define OBJ_FORCE_ACCESS_CHECK 0x00000400
#define OBJ_IGNORE_IMPERSONATED_DEVICEMAP 0x00000800
#define OBJ_DONT_REPARSE 0x00001000
#define OBJ_VALID_ATTRIBUTES 0x00001ff2
#define OBJ_PROTECT_CLOSE 0x00000001L
#define OBJ_INHERIT 0x00000002L
#define OBJ_AUDIT_OBJECT_CLOSE 0x00000004L
#define OBJ_NO_RIGHTS_UPGRADE 0x00000008L
#define OBJ_PERMANENT 0x00000010L
#define OBJ_EXCLUSIVE 0x00000020L
#define OBJ_CASE_INSENSITIVE 0x00000040L
#define OBJ_OPENIF 0x00000080L
#define OBJ_OPENLINK 0x00000100L
#define OBJ_KERNEL_HANDLE 0x00000200L
#define OBJ_FORCE_ACCESS_CHECK 0x00000400L
#define OBJ_IGNORE_IMPERSONATED_DEVICEMAP 0x00000800L
#define OBJ_DONT_REPARSE 0x00001000L
#define OBJ_VALID_ATTRIBUTES 0x00001FF2L
typedef struct _OBJECT_ATTRIBUTES
{
@@ -325,7 +337,10 @@ typedef struct _KSYSTEM_TIME
#include <poppack.h>
// NT macros used to test, set and clear flags
#ifndef AFFINITY_MASK
#define AFFINITY_MASK(n) ((KAFFINITY)1 << (n))
#endif
#ifndef FlagOn
#define FlagOn(_F, _SF) ((_F) & (_SF))
#endif
@@ -341,4 +356,10 @@ typedef struct _KSYSTEM_TIME
#endif
#if defined(_WIN64)
#define POINTER_ALIGNMENT DECLSPEC_ALIGN(8)
#else
#define POINTER_ALIGNMENT
#endif
#endif
phnt_windows.h
+42 -7
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Win32 definition support
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _PHNT_WINDOWS_H
@@ -24,6 +19,30 @@
#endif
#endif
#ifndef NOMINMAX
#define NOMINMAX
#endif
#ifndef INT_ERROR
#define INT_ERROR (-1)
#endif
#ifndef ULONG64_MAX
#define ULONG64_MAX 0xffffffffffffffffui64
#endif
#ifndef SIZE_T_MAX
#ifdef _WIN64
#define SIZE_T_MAX 0xffffffffffffffffui64
#else
#define SIZE_T_MAX 0xffffffffUL
#endif
#endif
#ifndef ENABLE_RTL_NUMBER_OF_V2
#define ENABLE_RTL_NUMBER_OF_V2
#endif
#ifndef INITGUID
#define INITGUID
#endif
@@ -89,4 +108,20 @@ typedef GUID *PGUID;
TRACELOG_ACCESS_REALTIME | TRACELOG_REGISTER_GUIDS | \
STANDARD_RIGHTS_EXECUTE)
// Note: Some parts of the Windows Runtime, COM or third party hooks are returning
// S_FALSE and null pointers on errors when S_FALSE is a success code. (dmex)
#define HR_SUCCESS(hr) (((HRESULT)(hr)) == S_OK)
#define HR_FAILED(hr) (((HRESULT)(hr)) != S_OK)
// Note: The CONTAINING_RECORD macro doesn't support UBSan and generates false positives,
// we redefine the macro with FIELD_OFFSET as a workaround until the WinSDK is fixed (dmex)
#undef CONTAINING_RECORD
#define CONTAINING_RECORD(address, type, field) \
((type *)((ULONG_PTR)(address) - UFIELD_OFFSET(type, field)))
#ifndef __PCGUID_DEFINED__
#define __PCGUID_DEFINED__
typedef const GUID* PCGUID;
#endif
#endif
subprocesstag.h
+2 -7
View File
@@ -1,12 +1,7 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Subprocess tag information
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _SUBPROCESSTAG_H
usermgr.h
+223
View File
@@ -0,0 +1,223 @@
/*
* User Manager service API definitions.
*
* This file is part of System Informer.
*/
#ifndef _USERMGR_H
#define _USERMGR_H
// private
typedef struct _SESSION_USER_CONTEXT
{
ULONGLONG ContextToken;
ULONG SessionId;
ULONG Reserved;
} SESSION_USER_CONTEXT, *PSESSION_USER_CONTEXT;
// private
typedef struct _CRED_PROV_CREDENTIAL
{
ULONG Flags;
ULONG AuthenticationPackage;
ULONG Size;
PVOID Information;
} CRED_PROV_CREDENTIAL, *PCRED_PROV_CREDENTIAL;
#define USERMGRAPI DECLSPEC_IMPORT
// Contexts
#if (PHNT_VERSION >= PHNT_THRESHOLD)
// rev
USERMGRAPI
VOID
WINAPI
UMgrFreeSessionUsers(
_In_ _Post_invalid_ PSESSION_USER_CONTEXT SessionUsers
);
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrEnumerateSessionUsers(
_Out_ PULONG Count,
_Outptr_ PSESSION_USER_CONTEXT *SessionUsers
);
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrQueryUserContext(
_In_ HANDLE TokenHandle,
_Out_ PULONGLONG ContextToken
);
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrQueryUserContextFromSid(
_In_ PWSTR SidString,
_Out_ PULONGLONG ContextToken
);
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrQueryUserContextFromName(
_In_ PWSTR UserName,
_Out_ PULONGLONG ContextToken
);
#endif
// Tokens
#if (PHNT_VERSION >= PHNT_THRESHOLD)
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrQueryDefaultAccountToken(
_Out_ PHANDLE TokenHandle
);
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrQuerySessionUserToken(
_In_ ULONG SessionId,
_Out_ PHANDLE TokenHandle
);
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrQueryUserToken(
_In_ ULONGLONG Context,
_Out_ PHANDLE TokenHandle
);
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrQueryUserTokenFromSid(
_In_ PWSTR SidString,
_Out_ PHANDLE TokenHandle
);
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrQueryUserTokenFromName(
_In_ PWSTR UserName,
_Out_ PHANDLE TokenHandle
);
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrGetConstrainedUserToken(
_In_opt_ HANDLE InputTokenHandle,
_In_ ULONGLONG Context,
_In_opt_ PSECURITY_CAPABILITIES Capabilities,
_Out_ _Ret_maybenull_ PHANDLE OutputTokenHandle
);
#endif
#if (PHNT_VERSION >= PHNT_THRESHOLD2)
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrChangeSessionUserToken(
_In_ HANDLE TokenHandle
);
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrGetImpersonationTokenForContext(
_In_ HANDLE InputTokenHandle,
_In_ ULONGLONG Context,
_Out_ PHANDLE OutputTokenHandle
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE)
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrGetSessionActiveShellUserToken(
_In_ ULONG SessionId,
_Out_ PHANDLE TokenHandle
);
#endif
// Single-session SKU
#if (PHNT_VERSION >= PHNT_THRESHOLD)
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrOpenProcessTokenForQuery(
_In_ ULONG ProcessId,
_Out_ PHANDLE TokenHandle
);
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrOpenProcessHandleForAccess(
_In_ ACCESS_MASK DesiredAccess,
_In_ ULONG ProcessId,
_Out_ PHANDLE ProcessHandle
);
#endif
// Credentials
#if (PHNT_VERSION >= PHNT_THRESHOLD)
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrFreeUserCredentials(
_In_ PCRED_PROV_CREDENTIAL Credentials
);
// rev
USERMGRAPI
HRESULT
WINAPI
UMgrGetCachedCredentials(
_In_ PSID Sid,
_Outptr_ PCRED_PROV_CREDENTIAL *Credentials
);
#endif
#endif
winsta.h
+148 -41
View File
@@ -1,17 +1,23 @@
/*
* This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
* Window Station Support functions
*
* You can redistribute this file and/or modify it under the terms of the
* Attribution 4.0 International (CC BY 4.0) license.
*
* You must give appropriate credit, provide a link to the license, and
* indicate if changes were made. You may do so in any reasonable manner, but
* not in any way that suggests the licensor endorses you or your use.
* This file is part of System Informer.
*/
#ifndef _WINSTA_H
#define _WINSTA_H
// Specifies the current server.
#define WINSTATION_CURRENT_SERVER ((HANDLE)NULL)
#define WINSTATION_CURRENT_SERVER_HANDLE ((HANDLE)NULL)
#define WINSTATION_CURRENT_SERVER_NAME (NULL)
// Specifies the current session (SessionId)
#define WINSTATION_CURRENT_SESSION ((ULONG)-1)
// Specifies any-session (SessionId)
#define WINSTATION_ANY_SESSION ((ULONG)-2)
// Access rights
#define WINSTATION_QUERY 0x00000001 // WinStationQueryInformation
@@ -61,7 +67,6 @@
#define CLIENTNAME_LENGTH 20
#define CLIENTADDRESS_LENGTH 30
#define IMEFILENAME_LENGTH 32
#define DIRECTORY_LENGTH 256
#define CLIENTLICENSE_LENGTH 32
#define CLIENTMODEM_LENGTH 40
#define CLIENT_PRODUCT_ID_LENGTH 32
@@ -133,11 +138,11 @@ typedef enum _WINSTATIONINFOCLASS
WinStationBeep,
WinStationEncryptionOff,
WinStationEncryptionPerm,
WinStationNtSecurity,
WinStationNtSecurity, // s; (open secure desktop ctrl+alt+del)
WinStationUserToken, // WINSTATIONUSERTOKEN
WinStationUnused1,
WinStationVideoData, // WINSTATIONVIDEODATA
WinStationInitialProgram,
WinStationInitialProgram, // s; (set current process as initial program)
WinStationCd, // CDCONFIG
WinStationSystemTrace,
WinStationVirtualData,
@@ -154,9 +159,9 @@ typedef enum _WINSTATIONINFOCLASS
WinStationLastReconnectType, // ULONG
WinStationDisallowAutoReconnect, // BOOLEAN
WinStationMprNotifyInfo,
WinStationExecSrvSystemPipe,
WinStationSmartCardAutoLogon,
WinStationIsAdminLoggedOn,
WinStationExecSrvSystemPipe, // WCHAR[48]
WinStationSmartCardAutoLogon, // BOOLEAN
WinStationIsAdminLoggedOn, // BOOLEAN
WinStationReconnectedFromId, // ULONG
WinStationEffectsPolicy, // ULONG
WinStationType, // ULONG
@@ -821,52 +826,59 @@ typedef struct _TS_COUNTER
#define SERVERNAME_CURRENT ((PWSTR)NULL)
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationFreeMemory(
_In_ PVOID Buffer
);
// rev
NTSYSAPI
HANDLE
WINAPI
NTAPI
WinStationOpenServerW(
_In_opt_ PWSTR ServerName
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationCloseServer(
_In_ HANDLE ServerHandle
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationServerPing(
_In_opt_ HANDLE ServerHandle
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationGetTermSrvCountersValue(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG Count,
_Inout_ PTS_COUNTER Counters // set counter IDs before calling
);
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationShutdownSystem(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG ShutdownFlags // WSD_*
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationWaitSystemEvent(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG EventMask, // WEVENT_*
@@ -874,8 +886,9 @@ WinStationWaitSystemEvent(
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationRegisterConsoleNotification(
_In_opt_ HANDLE ServerHandle,
_In_ HWND WindowHandle,
@@ -883,8 +896,9 @@ WinStationRegisterConsoleNotification(
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationUnRegisterConsoleNotification(
_In_opt_ HANDLE ServerHandle,
_In_ HWND WindowHandle
@@ -893,16 +907,18 @@ WinStationUnRegisterConsoleNotification(
// Sessions
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationEnumerateW(
_In_opt_ HANDLE ServerHandle,
_Out_ PSESSIONIDW *SessionIds,
_Out_ PULONG Count
);
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationQueryInformationW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
@@ -913,8 +929,9 @@ WinStationQueryInformationW(
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationSetInformationW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
@@ -923,8 +940,9 @@ WinStationSetInformationW(
_In_ ULONG WinStationInformationLength
);
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationNameFromLogonIdW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
@@ -932,8 +950,19 @@ WinStationNameFromLogonIdW(
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
LogonIdFromWinStationNameW(
_In_opt_ HANDLE ServerHandle,
_In_ PWSTR pWinStationName,
_Out_ PULONG SessionId
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationSendMessageW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
@@ -947,8 +976,9 @@ WinStationSendMessageW(
_In_ BOOLEAN DoNotWait
);
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationConnectW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
@@ -957,8 +987,9 @@ WinStationConnectW(
_In_ BOOLEAN bWait
);
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationDisconnect(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
@@ -966,8 +997,9 @@ WinStationDisconnect(
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationReset(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
@@ -975,8 +1007,9 @@ WinStationReset(
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationShadow(
_In_opt_ HANDLE ServerHandle,
_In_ PWSTR TargetServerName,
@@ -986,8 +1019,9 @@ WinStationShadow(
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationShadowStop(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
@@ -997,16 +1031,18 @@ WinStationShadowStop(
// Processes
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationEnumerateProcesses(
_In_opt_ HANDLE ServerHandle,
_Out_ PVOID *Processes
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationGetAllProcesses(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG Level,
@@ -1015,8 +1051,9 @@ WinStationGetAllProcesses(
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationFreeGAPMemory(
_In_ ULONG Level,
_In_ PTS_ALL_PROCESSES_INFO Processes,
@@ -1024,16 +1061,18 @@ WinStationFreeGAPMemory(
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationTerminateProcess(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG ProcessId,
_In_ ULONG ExitCode
);
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationGetProcessSid(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG ProcessId,
@@ -1047,15 +1086,17 @@ WinStationGetProcessSid(
#if (PHNT_VERSION >= PHNT_VISTA)
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationSwitchToServicesSession(
VOID
);
// rev
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
WinStationRevertFromServicesSession(
VOID
);
@@ -1063,11 +1104,77 @@ WinStationRevertFromServicesSession(
#endif
// Misc.
NTSYSAPI
BOOLEAN
WINAPI
NTAPI
_WinStationWaitForConnect(
VOID
);
// rev
NTSYSAPI
HANDLE
NTAPI
WinStationVirtualOpen(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ PCSTR Name
);
// rev
NTSYSAPI
HANDLE
NTAPI
WinStationVirtualOpenEx(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ PCSTR Name,
_In_ ULONG Flags
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationIsCurrentSessionRemoteable(
_Out_ PBOOLEAN IsRemoteable
);
EXTERN_C DECLSPEC_SELECTANY CONST GUID PROPERTY_TYPE_GET_MONITOR_CONFIG = { 0x865D5285, 0xF70A, 0x4ECF, { 0x8B, 0x28, 0x51, 0x2F, 0xE0, 0xAA, 0x2D, 0x53 } };
EXTERN_C DECLSPEC_SELECTANY CONST GUID PROPERTY_TYPE_CORRELATIONID_GUID = { 0x9A363F8E, 0x1902, 0x40DA, { 0xA2, 0xCC, 0x56, 0x4F, 0x09, 0x40, 0xAD, 0xE3 } };
typedef struct _TS_PROPERTY_INFORMATION
{
ULONG Length;
PVOID Buffer;
} TS_PROPERTY_INFORMATION, *PTS_PROPERTY_INFORMATION;
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationGetConnectionProperty(
_In_ ULONG SessionId,
_In_ PCGUID PropertyType,
_Out_ PTS_PROPERTY_INFORMATION PropertyBuffer
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationFreePropertyValue(
_In_ PVOID PropertyBuffer
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationIsSessionRemoteable(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_Out_ PBOOLEAN IsRemote
);
#endif