diff --git a/ntbcd.h b/ntbcd.h index 2815a0e..e0b40ab 100644 --- a/ntbcd.h +++ b/ntbcd.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Boot Configuration Data (BCD) support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTBCD_H @@ -14,47 +9,49 @@ #ifndef PHNT_INLINE_BCD_GUIDS // 5189B25C-5558-4BF2-BCA4-289B11BD29E2 // {badmemory} -GUID DECLSPEC_SELECTANY GUID_BAD_MEMORY_GROUP = { 0x5189B25C, 0x5558, 0x4BF2, { 0xBC, 0xA4, 0x28, 0x9B, 0x11, 0xBD, 0x29, 0xE2 } }; +DEFINE_GUID(GUID_BAD_MEMORY_GROUP, 0x5189B25C, 0x5558, 0x4BF2, 0xBC, 0xA4, 0x28, 0x9B, 0x11, 0xBD, 0x29, 0xE2); // 6EFB52BF-1766-41DB-A6B3-0EE5EFF72BD7 // {bootloadersettings} -GUID DECLSPEC_SELECTANY GUID_BOOT_LOADER_SETTINGS_GROUP = { 0x6EFB52BF, 0x1766, 0x41DB, { 0xA6, 0xB3, 0x0E, 0xE5, 0xEF, 0xF7, 0x2B, 0xD7 } }; +DEFINE_GUID(GUID_BOOT_LOADER_SETTINGS_GROUP, 0x6EFB52BF, 0x1766, 0x41DB, 0xA6, 0xB3, 0x0E, 0xE5, 0xEF, 0xF7, 0x2B, 0xD7); // FA926493-6F1C-4193-A414-58F0B2456D1E // {current} -GUID DECLSPEC_SELECTANY GUID_CURRENT_BOOT_ENTRY = { 0xFA926493, 0x6F1C, 0x4193, { 0xA4, 0x14, 0x58, 0xF0, 0xB2, 0x45, 0x6D, 0x1E } }; +DEFINE_GUID(GUID_CURRENT_BOOT_ENTRY, 0xFA926493, 0x6F1C, 0x4193, 0xA4, 0x14, 0x58, 0xF0, 0xB2, 0x45, 0x6D, 0x1E); // 4636856E-540F-4170-A130-A84776F4C654 // {eventsettings} {dbgsettings} -GUID DECLSPEC_SELECTANY GUID_DEBUGGER_SETTINGS_GROUP = { 0x4636856E, 0x540F, 0x4170, { 0xA1, 0x30, 0xA8, 0x47, 0x76, 0xF4, 0xC6, 0x54 } }; +DEFINE_GUID(GUID_DEBUGGER_SETTINGS_GROUP, 0x4636856E, 0x540F, 0x4170, 0xA1, 0x30, 0xA8, 0x47, 0x76, 0xF4, 0xC6, 0x54); // 1CAE1EB7-A0DF-4D4D-9851-4860E34EF535 // {default} -GUID DECLSPEC_SELECTANY GUID_DEFAULT_BOOT_ENTRY = { 0x1CAE1EB7, 0xA0DF, 0x4D4D, { 0x98, 0x51, 0x48, 0x60, 0xE3, 0x4E, 0xF5, 0x35 } }; +DEFINE_GUID(GUID_DEFAULT_BOOT_ENTRY, 0x1CAE1EB7, 0xA0DF, 0x4D4D, 0x98, 0x51, 0x48, 0x60, 0xE3, 0x4E, 0xF5, 0x35); // 0CE4991B-E6B3-4B16-B23C-5E0D9250E5D9 // {emssettings} -GUID DECLSPEC_SELECTANY GUID_EMS_SETTINGS_GROUP = { 0x0CE4991B, 0xE6B3, 0x4B16, { 0xB2, 0x3C, 0x5E, 0x0D, 0x92, 0x50, 0xE5, 0xD9 } }; +DEFINE_GUID(GUID_EMS_SETTINGS_GROUP, 0x0CE4991B, 0xE6B3, 0x4B16, 0xB2, 0x3C, 0x5E, 0x0D, 0x92, 0x50, 0xE5, 0xD9); // A5A30FA2-3D06-4E9F-B5F4-A01DF9D1FCBA // {fwbootmgr} -GUID DECLSPEC_SELECTANY GUID_FIRMWARE_BOOTMGR = { 0xA5A30FA2, 0x3D06, 0x4E9F, { 0xB5, 0xF4, 0xA0, 0x1D, 0xF9, 0xD1, 0xFC, 0xBA } }; +DEFINE_GUID(GUID_FIRMWARE_BOOTMGR, 0xA5A30FA2, 0x3D06, 0x4E9F, 0xB5, 0xF4, 0xA0, 0x1D, 0xF9, 0xD1, 0xFC, 0xBA); // 7EA2E1AC-2E61-4728-AAA3-896D9D0A9F0E // {globalsettings} -GUID DECLSPEC_SELECTANY GUID_GLOBAL_SETTINGS_GROUP = { 0x7EA2E1AC, 0x2E61, 0x4728, { 0xAA, 0xA3, 0x89, 0x6D, 0x9D, 0x0A, 0x9F, 0x0E } }; +DEFINE_GUID(GUID_GLOBAL_SETTINGS_GROUP, 0x7EA2E1AC, 0x2E61, 0x4728, 0xAA, 0xA3, 0x89, 0x6D, 0x9D, 0x0A, 0x9F, 0x0E); // 7FF607E0-4395-11DB-B0DE-0800200C9A66 // {hypervisorsettings} -GUID DECLSPEC_SELECTANY GUID_HYPERVISOR_SETTINGS_GROUP = { 0x7FF607E0, 0x4395, 0x11DB, { 0xB0, 0xDE, 0x08, 0x00, 0x20, 0x0C, 0x9A, 0x66 } }; +DEFINE_GUID(GUID_HYPERVISOR_SETTINGS_GROUP, 0x7FF607E0, 0x4395, 0x11DB, 0xB0, 0xDE, 0x08, 0x00, 0x20, 0x0C, 0x9A, 0x66); // 313E8EED-7098-4586-A9BF-309C61F8D449 // {kerneldbgsettings} -GUID DECLSPEC_SELECTANY GUID_KERNEL_DEBUGGER_SETTINGS_GROUP = { 0x313E8EED, 0x7098, 0x4586, { 0xA9, 0xBF, 0x30, 0x9C, 0x61, 0xF8, 0xD4, 0x49 } }; +DEFINE_GUID(GUID_KERNEL_DEBUGGER_SETTINGS_GROUP, 0x313E8EED, 0x7098, 0x4586, 0xA9, 0xBF, 0x30, 0x9C, 0x61, 0xF8, 0xD4, 0x49); // 1AFA9C49-16AB-4A5C-4A90-212802DA9460 // {resumeloadersettings} -GUID DECLSPEC_SELECTANY GUID_RESUME_LOADER_SETTINGS_GROUP = { 0x1AFA9C49, 0x16AB, 0x4A5C, { 0x4A, 0x90, 0x21, 0x28, 0x02, 0xDA, 0x94, 0x60 } }; +DEFINE_GUID(GUID_RESUME_LOADER_SETTINGS_GROUP, 0x1AFA9C49, 0x16AB, 0x4A5C, 0x4A, 0x90, 0x21, 0x28, 0x02, 0xDA, 0x94, 0x60); // 9DEA862C-5CDD-4E70-ACC1-F32B344D4795 // {bootmgr} -GUID DECLSPEC_SELECTANY GUID_WINDOWS_BOOTMGR = { 0x9DEA862C, 0x5CDD, 0x4E70, { 0xAC, 0xC1, 0xF3, 0x2B, 0x34, 0x4D, 0x47, 0x95 } }; +DEFINE_GUID(GUID_WINDOWS_BOOTMGR, 0x9DEA862C, 0x5CDD, 0x4E70, 0xAC, 0xC1, 0xF3, 0x2B, 0x34, 0x4D, 0x47, 0x95); // 466F5A88-0AF2-4F76-9038-095B170DC21C // {ntldr} {legacy} -GUID DECLSPEC_SELECTANY GUID_WINDOWS_LEGACY_NTLDR = { 0x466F5A88, 0x0AF2, 0x4F76, { 0x90, 0x38, 0x09, 0x5B, 0x17, 0x0D, 0xC2, 0x1C } }; +DEFINE_GUID(GUID_WINDOWS_LEGACY_NTLDR, 0x466F5A88, 0x0AF2, 0x4F76, 0x90, 0x38, 0x09, 0x5B, 0x17, 0x0D, 0xC2, 0x1C); // B2721D73-1DB4-4C62-BF78-C548A880142D // {memdiag} -GUID DECLSPEC_SELECTANY GUID_WINDOWS_MEMORY_TESTER = { 0xB2721D73, 0x1DB4, 0x4C62, { 0xBF, 0x78, 0xC5, 0x48, 0xA8, 0x80, 0x14, 0x2D } }; +DEFINE_GUID(GUID_WINDOWS_MEMORY_TESTER, 0xB2721D73, 0x1DB4, 0x4C62, 0xBF, 0x78, 0xC5, 0x48, 0xA8, 0x80, 0x14, 0x2D); // B012B84D-C47C-4ED5-B722-C0C42163E569 -GUID DECLSPEC_SELECTANY GUID_WINDOWS_OS_TARGET_TEMPLATE_EFI = { 0xB012B84D, 0xC47C, 0x4ED5, { 0xB7, 0x22, 0xC0, 0xC4, 0x21, 0x63, 0xE5, 0x69 } }; +DEFINE_GUID(GUID_WINDOWS_OS_TARGET_TEMPLATE_EFI, 0xB012B84D, 0xC47C, 0x4ED5, 0xB7, 0x22, 0xC0, 0xC4, 0x21, 0x63, 0xE5, 0x69); // A1943BBC-EA85-487C-97C7-C9EDE908A38A -GUID DECLSPEC_SELECTANY GUID_WINDOWS_OS_TARGET_TEMPLATE_PCAT = { 0xA1943BBC, 0xEA85, 0x487C, { 0x97, 0xC7, 0xC9, 0xED, 0xE9, 0x08, 0xA3, 0x8A } }; +DEFINE_GUID(GUID_WINDOWS_OS_TARGET_TEMPLATE_PCAT, 0xA1943BBC, 0xEA85, 0x487C, 0x97, 0xC7, 0xC9, 0xED, 0xE9, 0x08, 0xA3, 0x8A); // {0C334284-9A41-4DE1-99B3-A7E87E8FF07E} -GUID DECLSPEC_SELECTANY GUID_WINDOWS_RESUME_TARGET_TEMPLATE_EFI = { 0x0C334284, 0x9A41, 0x4DE1, { 0x99, 0xB3, 0xA7, 0xE8, 0x7E, 0x8F, 0xF0, 0x7E } }; +DEFINE_GUID(GUID_WINDOWS_RESUME_TARGET_TEMPLATE_EFI, 0x0C334284, 0x9A41, 0x4DE1, 0x99, 0xB3, 0xA7, 0xE8, 0x7E, 0x8F, 0xF0, 0x7E); // {98B02A23-0674-4CE7-BDAD-E0A15A8FF97B} -GUID DECLSPEC_SELECTANY GUID_WINDOWS_RESUME_TARGET_TEMPLATE_PCAT = { 0x98B02A23, 0x0674, 0x4CE7, { 0xBD, 0xAD, 0xE0, 0xA1, 0x5A, 0x8F, 0xF9, 0x7B } }; +DEFINE_GUID(GUID_WINDOWS_RESUME_TARGET_TEMPLATE_PCAT, 0x98B02A23, 0x0674, 0x4CE7, 0xBD, 0xAD, 0xE0, 0xA1, 0x5A, 0x8F, 0xF9, 0x7B); // A1943BBC-EA85-487C-97C7-C9EDE908A38A -GUID DECLSPEC_SELECTANY GUID_WINDOWS_SETUP_EFI = { 0x7254A080, 0x1510, 0x4E85, { 0xAC, 0x0F, 0xE7, 0xFB, 0x3D, 0x44, 0x47, 0x36 } }; +DEFINE_GUID(GUID_WINDOWS_SETUP_EFI, 0x7254A080, 0x1510, 0x4E85, 0xAC, 0x0F, 0xE7, 0xFB, 0x3D, 0x44, 0x47, 0x36); // CBD971BF-B7B8-4885-951A-FA03044F5D71 -GUID DECLSPEC_SELECTANY GUID_WINDOWS_SETUP_PCAT = { 0xCBD971BF, 0xB7B8, 0x4885, { 0x95, 0x1A, 0xFA, 0x03, 0x04, 0x4F, 0x5D, 0x71 } }; +DEFINE_GUID(GUID_WINDOWS_SETUP_PCAT, 0xCBD971BF, 0xB7B8, 0x4885, 0x95, 0x1A, 0xFA, 0x03, 0x04, 0x4F, 0x5D, 0x71); // AE5534E0-A924-466C-B836-758539A3EE3A // {ramdiskoptions} -GUID DECLSPEC_SELECTANY GUID_WINDOWS_SETUP_RAMDISK_OPTIONS = { 0xAE5534E0, 0xA924, 0x466C, { 0xB8, 0x36, 0x75, 0x85, 0x39, 0xA3, 0xEE, 0x3A } }; +DEFINE_GUID(GUID_WINDOWS_SETUP_RAMDISK_OPTIONS, 0xAE5534E0, 0xA924, 0x466C, 0xB8, 0x36, 0x75, 0x85, 0x39, 0xA3, 0xEE, 0x3A); +// {7619dcc9-fafe-11d9-b411-000476eba25f} +DEFINE_GUID(GUID_WINDOWS_SETUP_BOOT_ENTRY, 0x7619dcc9, 0xfafe, 0x11d9, 0xb4, 0x11, 0x00, 0x04, 0x76, 0xeb, 0xa2, 0x5f); #else NTSYSAPI GUID GUID_BAD_MEMORY_GROUP; // {badmemory} NTSYSAPI GUID GUID_BOOT_LOADER_SETTINGS_GROUP; // {bootloadersettings} @@ -153,6 +150,7 @@ BcdExportStore( _In_ UNICODE_STRING BcdFilePath ); +#if (PHNT_VERSION > PHNT_WIN11) NTSYSAPI NTSTATUS NTAPI @@ -161,6 +159,7 @@ BcdExportStoreEx( _In_ ULONG Flags, _In_ UNICODE_STRING BcdFilePath ); +#endif NTSYSAPI NTSTATUS @@ -245,34 +244,34 @@ BcdMarkAsSystemStore( typedef enum _BCD_OBJECT_TYPE { BCD_OBJECT_TYPE_NONE, - BCD_OBJECT_TYPE_APPLICATION, - BCD_OBJECT_TYPE_INHERITED, - BCD_OBJECT_TYPE_DEVICE + BCD_OBJECT_TYPE_APPLICATION, // 0x10000000 + BCD_OBJECT_TYPE_INHERITED, // 0x20000000 + BCD_OBJECT_TYPE_DEVICE, // 0x30000000 } BCD_OBJECT_TYPE; typedef enum _BCD_APPLICATION_OBJECT_TYPE { BCD_APPLICATION_OBJECT_NONE = 0, - BCD_APPLICATION_OBJECT_FIRMWARE_BOOT_MANAGER = 1, - BCD_APPLICATION_OBJECT_WINDOWS_BOOT_MANAGER = 2, - BCD_APPLICATION_OBJECT_WINDOWS_BOOT_LOADER = 3, - BCD_APPLICATION_OBJECT_WINDOWS_RESUME_APPLICATION = 4, - BCD_APPLICATION_OBJECT_MEMORY_TESTER = 5, - BCD_APPLICATION_OBJECT_LEGACY_NTLDR = 6, - BCD_APPLICATION_OBJECT_LEGACY_SETUPLDR = 7, - BCD_APPLICATION_OBJECT_BOOT_SECTOR = 8, - BCD_APPLICATION_OBJECT_STARTUP_MODULE = 9, - BCD_APPLICATION_OBJECT_GENERIC_APPLICATION = 10, - BCD_APPLICATION_OBJECT_RESERVED = 0xFFFFF + BCD_APPLICATION_OBJECT_FIRMWARE_BOOT_MANAGER = 1, // 0x00000001 + BCD_APPLICATION_OBJECT_WINDOWS_BOOT_MANAGER = 2, // 0x00000002 + BCD_APPLICATION_OBJECT_WINDOWS_BOOT_LOADER = 3, // 0x00000003 + BCD_APPLICATION_OBJECT_WINDOWS_RESUME_APPLICATION = 4, // 0x00000004 + BCD_APPLICATION_OBJECT_MEMORY_TESTER = 5, // 0x00000005 + BCD_APPLICATION_OBJECT_LEGACY_NTLDR = 6, // 0x00000006 + BCD_APPLICATION_OBJECT_LEGACY_SETUPLDR = 7, // 0x00000007 + BCD_APPLICATION_OBJECT_BOOT_SECTOR = 8, // 0x00000008 + BCD_APPLICATION_OBJECT_STARTUP_MODULE = 9, // 0x00000009 + BCD_APPLICATION_OBJECT_GENERIC_APPLICATION = 10, // 0x0000000a + BCD_APPLICATION_OBJECT_RESERVED = 0xFFFFF // 0x000fffff } BCD_APPLICATION_OBJECT_TYPE; typedef enum _BCD_APPLICATION_IMAGE_TYPE { BCD_APPLICATION_IMAGE_NONE, - BCD_APPLICATION_IMAGE_FIRMWARE_APPLICATION, - BCD_APPLICATION_IMAGE_BOOT_APPLICATION, - BCD_APPLICATION_IMAGE_LEGACY_LOADER, - BCD_APPLICATION_IMAGE_REALMODE_CODE + BCD_APPLICATION_IMAGE_FIRMWARE_APPLICATION, // 0x00100000 + BCD_APPLICATION_IMAGE_BOOT_APPLICATION, // 0x00200000 + BCD_APPLICATION_IMAGE_LEGACY_LOADER, // 0x00300000 + BCD_APPLICATION_IMAGE_REALMODE_CODE, // 0x00400000 } BCD_APPLICATION_IMAGE_TYPE; typedef enum _BCD_INHERITED_CLASS_TYPE @@ -333,6 +332,8 @@ typedef union _BCD_OBJECT_DATATYPE }; } BCD_OBJECT_DATATYPE, *PBCD_OBJECT_DATATYPE; +static_assert(sizeof(BCD_OBJECT_DATATYPE) == sizeof(ULONG), "sizeof(BCD_OBJECT_DATATYPE) is invalid."); + #define BCD_OBJECT_DESCRIPTION_VERSION 0x1 typedef struct _BCD_OBJECT_DESCRIPTION @@ -363,7 +364,7 @@ NTSTATUS NTAPI BcdOpenObject( _In_ HANDLE BcdStoreHandle, - _In_ PGUID Identifier, + _In_ const GUID* Identifier, _Out_ PHANDLE BcdObjectHandle ); @@ -410,7 +411,7 @@ BcdCopyObject( _In_ HANDLE BcdObjectHandle, _In_ BCD_COPY_FLAGS BcdCopyFlags, _In_ HANDLE TargetStoreHandle, - _Out_ PHANDLE TargetHandleOut + _Out_ PHANDLE TargetObjectHandle ); NTSYSAPI @@ -422,7 +423,7 @@ BcdCopyObjectEx( _In_ BCD_COPY_FLAGS BcdCopyFlags, _In_ HANDLE TargetStoreHandle, _In_ PGUID TargetObjectId, - _Out_ PHANDLE TargetHandleOut + _Out_ PHANDLE TargetObjectHandle ); NTSYSAPI @@ -470,11 +471,11 @@ typedef enum _BCD_ELEMENT_DATATYPE_FORMAT typedef enum _BCD_ELEMENT_DATATYPE_CLASS { BCD_ELEMENT_DATATYPE_CLASS_NONE, - BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, - BCD_ELEMENT_DATATYPE_CLASS_APPLICATION, - BCD_ELEMENT_DATATYPE_CLASS_DEVICE, - BCD_ELEMENT_DATATYPE_CLASS_SETUPTEMPLATE, - BCD_ELEMENT_DATATYPE_CLASS_OEM + BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, // 0x10000000 + BCD_ELEMENT_DATATYPE_CLASS_APPLICATION, // 0x20000000 + BCD_ELEMENT_DATATYPE_CLASS_DEVICE, // 0x30000000 + BCD_ELEMENT_DATATYPE_CLASS_SETUPTEMPLATE, // 0x40000000 + BCD_ELEMENT_DATATYPE_CLASS_OEM // 0x50000000 } BCD_ELEMENT_DATATYPE_CLASS; typedef enum _BCD_ELEMENT_DEVICE_TYPE @@ -513,6 +514,8 @@ typedef union _BCD_ELEMENT_DATATYPE }; } BCD_ELEMENT_DATATYPE, *PBCD_ELEMENT_DATATYPE; +static_assert(sizeof(BCD_ELEMENT_DATATYPE) == sizeof(ULONG), "sizeof(BCD_ELEMENT_DATATYPE) is invalid."); + NTSYSAPI NTSTATUS NTAPI diff --git a/ntdbg.h b/ntdbg.h index 3c96cdd..1ecc3fc 100644 --- a/ntdbg.h +++ b/ntdbg.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Debugger support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTDBG_H @@ -358,7 +353,7 @@ DbgUiConvertStateChangeStructureEx( _Out_ LPDEBUG_EVENT DebugEvent ); -struct _EVENT_FILTER_DESCRIPTOR; +typedef struct _EVENT_FILTER_DESCRIPTOR *PEVENT_FILTER_DESCRIPTOR; typedef VOID (NTAPI *PENABLECALLBACK)( _In_ LPCGUID SourceId, @@ -366,7 +361,7 @@ typedef VOID (NTAPI *PENABLECALLBACK)( _In_ UCHAR Level, _In_ ULONGLONG MatchAnyKeyword, _In_ ULONGLONG MatchAllKeyword, - _In_opt_ struct _EVENT_FILTER_DESCRIPTOR *FilterData, + _In_opt_ PEVENT_FILTER_DESCRIPTOR FilterData, _Inout_opt_ PVOID CallbackContext ); diff --git a/ntexapi.h b/ntexapi.h index 8123613..2ba17d5 100644 --- a/ntexapi.h +++ b/ntexapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Executive support library functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTEXAPI_H @@ -23,7 +18,7 @@ NTSTATUS NTAPI NtDelayExecution( _In_ BOOLEAN Alertable, - _In_opt_ PLARGE_INTEGER DelayInterval + _In_ PLARGE_INTEGER DelayInterval ); // Environment values @@ -60,7 +55,7 @@ NTSTATUS NTAPI NtQuerySystemEnvironmentValueEx( _In_ PUNICODE_STRING VariableName, - _In_ PGUID VendorGuid, + _In_ PCGUID VendorGuid, _Out_writes_bytes_opt_(*ValueLength) PVOID Value, _Inout_ PULONG ValueLength, _Out_opt_ PULONG Attributes // EFI_VARIABLE_* @@ -71,7 +66,7 @@ NTSTATUS NTAPI NtSetSystemEnvironmentValueEx( _In_ PUNICODE_STRING VariableName, - _In_ PGUID VendorGuid, + _In_ PCGUID VendorGuid, _In_reads_bytes_opt_(ValueLength) PVOID Value, _In_ ULONG ValueLength, // 0 = delete variable _In_ ULONG Attributes // EFI_VARIABLE_* @@ -123,7 +118,7 @@ typedef struct _BOOT_ENTRY ULONG FriendlyNameOffset; ULONG BootFilePathOffset; ULONG OsOptionsLength; - UCHAR OsOptions[1]; + _Field_size_bytes_(OsOptionsLength) UCHAR OsOptions[1]; } BOOT_ENTRY, *PBOOT_ENTRY; // private @@ -150,7 +145,7 @@ typedef struct _FILE_PATH ULONG Version; ULONG Length; ULONG Type; - UCHAR FilePath[1]; + _Field_size_bytes_(Length) UCHAR FilePath[1]; } FILE_PATH, *PFILE_PATH; // private @@ -642,14 +637,14 @@ typedef enum _TIMER_SET_INFORMATION_CLASS } TIMER_SET_INFORMATION_CLASS; #if (PHNT_VERSION >= PHNT_WIN7) -struct _COUNTED_REASON_CONTEXT; +typedef struct _COUNTED_REASON_CONTEXT *PCOUNTED_REASON_CONTEXT; typedef struct _TIMER_SET_COALESCABLE_TIMER_INFO { _In_ LARGE_INTEGER DueTime; _In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine; _In_opt_ PVOID TimerContext; - _In_opt_ struct _COUNTED_REASON_CONTEXT *WakeContext; + _In_opt_ PCOUNTED_REASON_CONTEXT WakeContext; _In_opt_ ULONG Period; _In_ ULONG TolerableDelay; _Out_opt_ PBOOLEAN PreviousState; @@ -739,6 +734,21 @@ NtSetIRTimer( #endif +#if (PHNT_VERSION >= PHNT_THRESHOLD) + +NTSYSCALLAPI +NTSTATUS +NTAPI +NtCreateTimer2( + _Out_ PHANDLE TimerHandle, + _In_opt_ PVOID Reserved1, + _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, + _In_ ULONG Attributes, // TIMER_TYPE + _In_ ACCESS_MASK DesiredAccess + ); + +#endif + typedef struct _T2_SET_PARAMETERS_V0 { ULONG Version; @@ -750,17 +760,6 @@ typedef PVOID PT2_CANCEL_PARAMETERS; #if (PHNT_VERSION >= PHNT_THRESHOLD) -NTSYSCALLAPI -NTSTATUS -NTAPI -NtCreateTimer2( - _Out_ PHANDLE TimerHandle, - _In_opt_ PVOID Reserved1, - _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, - _In_ ULONG Attributes, - _In_ ACCESS_MASK DesiredAccess - ); - NTSYSCALLAPI NTSTATUS NTAPI @@ -863,7 +862,7 @@ NtCreateKeyedEvent( _Out_ PHANDLE KeyedEventHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, - _In_ ULONG Flags + _Reserved_ ULONG Flags ); NTSYSCALLAPI @@ -879,7 +878,7 @@ NTSYSCALLAPI NTSTATUS NTAPI NtReleaseKeyedEvent( - _In_ HANDLE KeyedEventHandle, + _In_opt_ HANDLE KeyedEventHandle, _In_ PVOID KeyValue, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout @@ -889,7 +888,7 @@ NTSYSCALLAPI NTSTATUS NTAPI NtWaitForKeyedEvent( - _In_ HANDLE KeyedEventHandle, + _In_opt_ HANDLE KeyedEventHandle, _In_ PVOID KeyValue, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout @@ -992,10 +991,10 @@ NTSTATUS NTAPI NtUpdateWnfStateData( _In_ PCWNF_STATE_NAME StateName, - _In_reads_bytes_opt_(Length) const VOID *Buffer, + _In_reads_bytes_opt_(Length) const VOID* Buffer, _In_opt_ ULONG Length, _In_opt_ PCWNF_TYPE_ID TypeId, - _In_opt_ const VOID *ExplicitScope, + _In_opt_ const VOID* ExplicitScope, _In_ WNF_CHANGE_STAMP MatchingChangeStamp, _In_ LOGICAL CheckStamp ); @@ -1005,7 +1004,7 @@ NTSTATUS NTAPI NtDeleteWnfStateData( _In_ PCWNF_STATE_NAME StateName, - _In_opt_ const VOID *ExplicitScope + _In_opt_ const VOID* ExplicitScope ); NTSYSCALLAPI @@ -1014,9 +1013,9 @@ NTAPI NtQueryWnfStateData( _In_ PCWNF_STATE_NAME StateName, _In_opt_ PCWNF_TYPE_ID TypeId, - _In_opt_ const VOID *ExplicitScope, + _In_opt_ const VOID* ExplicitScope, _Out_ PWNF_CHANGE_STAMP ChangeStamp, - _Out_writes_bytes_to_opt_(*BufferSize, *BufferSize) PVOID Buffer, + _Out_writes_bytes_opt_(*BufferSize) PVOID Buffer, _Inout_ PULONG BufferSize ); @@ -1026,7 +1025,7 @@ NTAPI NtQueryWnfStateNameInformation( _In_ PCWNF_STATE_NAME StateName, _In_ WNF_STATE_NAME_INFORMATION NameInfoClass, - _In_opt_ const VOID *ExplicitScope, + _In_opt_ const VOID* ExplicitScope, _Out_writes_bytes_(InfoBufferSize) PVOID InfoBuffer, _In_ ULONG InfoBufferSize ); @@ -1210,13 +1209,14 @@ NtWorkerFactoryWorkerReady( _In_ HANDLE WorkerFactoryHandle ); -struct _FILE_IO_COMPLETION_INFORMATION; - #if (PHNT_VERSION >= PHNT_WIN8) +typedef struct _FILE_IO_COMPLETION_INFORMATION *PFILE_IO_COMPLETION_INFORMATION; +typedef struct _PORT_MESSAGE *PPORT_MESSAGE; + typedef struct _WORKER_FACTORY_DEFERRED_WORK { - struct _PORT_MESSAGE *AlpcSendMessage; + PPORT_MESSAGE AlpcSendMessage; PVOID AlpcSendMessagePort; ULONG AlpcSendMessageFlags; ULONG Flags; @@ -1227,10 +1227,10 @@ NTSTATUS NTAPI NtWaitForWorkViaWorkerFactory( _In_ HANDLE WorkerFactoryHandle, - _Out_writes_to_(Count, *PacketsReturned) struct _FILE_IO_COMPLETION_INFORMATION *MiniPackets, + _Out_writes_to_(Count, *PacketsReturned) PFILE_IO_COMPLETION_INFORMATION MiniPackets, _In_ ULONG Count, _Out_ PULONG PacketsReturned, - _In_ struct _WORKER_FACTORY_DEFERRED_WORK* DeferredWork + _In_ PWORKER_FACTORY_DEFERRED_WORK DeferredWork ); #else @@ -1240,7 +1240,7 @@ NTSTATUS NTAPI NtWaitForWorkViaWorkerFactory( _In_ HANDLE WorkerFactoryHandle, - _Out_ struct _FILE_IO_COMPLETION_INFORMATION *MiniPacket + _Out_ PFILE_IO_COMPLETION_INFORMATION MiniPacket ); #endif @@ -1292,6 +1292,27 @@ NtQueryPerformanceCounter( _Out_opt_ PLARGE_INTEGER PerformanceFrequency ); +#if (PHNT_VERSION >= PHNT_REDSTONE2) +// rev +NTSYSCALLAPI +NTSTATUS +NTAPI +NtQueryAuxiliaryCounterFrequency( + _Out_ PLARGE_INTEGER AuxiliaryCounterFrequency + ); + +// rev +NTSYSCALLAPI +NTSTATUS +NTAPI +NtConvertBetweenAuxiliaryCounterAndPerformanceCounter( + _In_ BOOLEAN ConvertAuxiliaryToPerformanceCounter, + _In_ PLARGE_INTEGER PerformanceOrAuxiliaryCounterValue, + _Out_ PLARGE_INTEGER ConvertedValue, + _Out_opt_ PLARGE_INTEGER ConversionError + ); +#endif + // LUIDs NTSYSCALLAPI @@ -1456,13 +1477,13 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemSessionBigPoolInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION // since WIN8 SystemBootGraphicsInformation, // q; s: SYSTEM_BOOT_GRAPHICS_INFORMATION (kernel-mode only) SystemScrubPhysicalMemoryInformation, // q; s: MEMORY_SCRUB_INFORMATION - SystemBadPageInformation, + SystemBadPageInformation, // SYSTEM_BAD_PAGE_INFORMATION SystemProcessorProfileControlArea, // q; s: SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA SystemCombinePhysicalMemoryInformation, // s: MEMORY_COMBINE_INFORMATION, MEMORY_COMBINE_INFORMATION_EX, MEMORY_COMBINE_INFORMATION_EX2 // 130 SystemEntropyInterruptTimingInformation, // q; s: SYSTEM_ENTROPY_TIMING_INFORMATION SystemConsoleInformation, // q; s: SYSTEM_CONSOLE_INFORMATION SystemPlatformBinaryInformation, // q: SYSTEM_PLATFORM_BINARY_INFORMATION (requires SeTcbPrivilege) - SystemPolicyInformation, // q: SYSTEM_POLICY_INFORMATION + SystemPolicyInformation, // q: SYSTEM_POLICY_INFORMATION (Warbird/Encrypt/Decrypt/Execute) SystemHypervisorProcessorCountInformation, // q: SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION SystemDeviceDataInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION SystemDeviceDataEnumerationInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION @@ -1492,11 +1513,11 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemVmGenerationCountInformation, SystemTrustedPlatformModuleInformation, // q: SYSTEM_TPM_INFORMATION SystemKernelDebuggerFlags, // SYSTEM_KERNEL_DEBUGGER_FLAGS - SystemCodeIntegrityPolicyInformation, // q: SYSTEM_CODEINTEGRITYPOLICY_INFORMATION + SystemCodeIntegrityPolicyInformation, // q; s: SYSTEM_CODEINTEGRITYPOLICY_INFORMATION SystemIsolatedUserModeInformation, // q: SYSTEM_ISOLATED_USER_MODE_INFORMATION SystemHardwareSecurityTestInterfaceResultsInformation, SystemSingleModuleInformation, // q: SYSTEM_SINGLE_MODULE_INFORMATION - SystemAllowedCpuSetsInformation, + SystemAllowedCpuSetsInformation, // s: SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION SystemVsmProtectionInformation, // q: SYSTEM_VSM_PROTECTION_INFORMATION (previously SystemDmaProtectionInformation) SystemInterruptCpuSetsInformation, // q: SYSTEM_INTERRUPT_CPU_SET_INFORMATION // 170 SystemSecureBootPolicyFullInformation, // q: SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION @@ -1508,12 +1529,12 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemWin32WerStartCallout, SystemSecureKernelProfileInformation, // q: SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION SystemCodeIntegrityPlatformManifestInformation, // q: SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION // since REDSTONE - SystemInterruptSteeringInformation, // SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT // 180 + SystemInterruptSteeringInformation, // q: in: SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT, out: SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT // NtQuerySystemInformationEx // 180 SystemSupportedProcessorArchitectures, // p: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx SystemMemoryUsageInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION SystemCodeIntegrityCertificateInformation, // q: SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION SystemPhysicalMemoryInformation, // q: SYSTEM_PHYSICAL_MEMORY_INFORMATION // since REDSTONE2 - SystemControlFlowTransition, + SystemControlFlowTransition, // (Warbird/Encrypt/Decrypt/Execute) SystemKernelDebuggingAllowed, // s: ULONG SystemActivityModerationExeState, // SYSTEM_ACTIVITY_MODERATION_EXE_STATE SystemActivityModerationUserSettings, // SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS @@ -1533,7 +1554,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemDmaGuardPolicyInformation, // SYSTEM_DMA_GUARD_POLICY_INFORMATION SystemEnclaveLaunchControlInformation, // SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION SystemWorkloadAllowedCpuSetsInformation, // SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION // since REDSTONE5 - SystemCodeIntegrityUnlockModeInformation, + SystemCodeIntegrityUnlockModeInformation, // SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION SystemLeapSecondInformation, // SYSTEM_LEAP_SECOND_INFORMATION SystemFlags2Information, // q: SYSTEM_FLAGS_INFORMATION SystemSecurityModelInformation, // SYSTEM_SECURITY_MODEL_INFORMATION // since 19H1 @@ -1545,28 +1566,37 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemSpacesBootInformation, // since 20H2 SystemFwRamdiskInformation, // SYSTEM_FIRMWARE_RAMDISK_INFORMATION SystemWheaIpmiHardwareInformation, - SystemDifSetRuleClassInformation, + SystemDifSetRuleClassInformation, // SYSTEM_DIF_VOLATILE_INFORMATION SystemDifClearRuleClassInformation, - SystemDifApplyPluginVerificationOnDriver, - SystemDifRemovePluginVerificationOnDriver, // 220 + SystemDifApplyPluginVerificationOnDriver, // SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION + SystemDifRemovePluginVerificationOnDriver, // SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION // 220 SystemShadowStackInformation, // SYSTEM_SHADOW_STACK_INFORMATION - SystemBuildVersionInformation, // SYSTEM_BUILD_VERSION_INFORMATION - SystemPoolLimitInformation, // SYSTEM_POOL_LIMIT_INFORMATION + SystemBuildVersionInformation, // q: in: ULONG (LayerNumber), out: SYSTEM_BUILD_VERSION_INFORMATION // NtQuerySystemInformationEx // 222 + SystemPoolLimitInformation, // SYSTEM_POOL_LIMIT_INFORMATION (requires SeIncreaseQuotaPrivilege) SystemCodeIntegrityAddDynamicStore, SystemCodeIntegrityClearDynamicStores, SystemDifPoolTrackingInformation, - SystemPoolZeroingInformation, // SYSTEM_POOL_ZEROING_INFORMATION - SystemDpcWatchdogInformation, - SystemDpcWatchdogInformation2, - SystemSupportedProcessorArchitectures2, // q: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx // 230 + SystemPoolZeroingInformation, // q: SYSTEM_POOL_ZEROING_INFORMATION + SystemDpcWatchdogInformation, // q; s: SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION + SystemDpcWatchdogInformation2, // q; s: SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION_V2 + SystemSupportedProcessorArchitectures2, // q: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx // 230 SystemSingleProcessorRelationshipInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // (EX in: PROCESSOR_NUMBER Processor) - SystemXfgCheckFailureInformation, + SystemXfgCheckFailureInformation, // q: SYSTEM_XFG_FAILURE_INFORMATION SystemIommuStateInformation, // SYSTEM_IOMMU_STATE_INFORMATION // since 22H1 SystemHypervisorMinrootInformation, // SYSTEM_HYPERVISOR_MINROOT_INFORMATION SystemHypervisorBootPagesInformation, // SYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION SystemPointerAuthInformation, // SYSTEM_POINTER_AUTH_INFORMATION SystemSecureKernelDebuggerInformation, - SystemOriginalImageFeatureInformation, + SystemOriginalImageFeatureInformation, // q: in: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT, out: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT // NtQuerySystemInformationEx + SystemMemoryNumaInformation, + SystemMemoryNumaPerformanceInformation, // SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT // since 24H2 // 240 + SystemCodeIntegritySignedPoliciesFullInformation, + SystemSecureSecretsInformation, + SystemTrustedAppsRuntimeInformation, // SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION + SystemBadPageInformationEx, // SYSTEM_BAD_PAGE_INFORMATION + SystemResourceDeadlockTimeout, + SystemBreakOnContextUnwindFailureInformation, + SystemOslRamdiskInformation, // SYSTEM_OSL_RAMDISK_INFORMATION MaxSystemInfoClass } SYSTEM_INFORMATION_CLASS; @@ -1594,6 +1624,26 @@ typedef struct _SYSTEM_PROCESSOR_INFORMATION ULONG ProcessorFeatureBits; } SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION; +// ProcessorFeatureBits // ksamd64 +#define KF_RDTSC 0x0000000000000002 +#define KF_CR4 0x0000000000000004 +#define KF_GLOBAL_PAGE 0x0000000000000010 +#define KF_LARGE_PAGE 0x0000000000000020 +#define KF_CMPXCHG8B 0x0000000000000080 +#define KF_FAST_SYSCALL 0x0000000000001000 +#define KF_BRANCH 0x0000000000020000 +#define KF_XSTATE 0x0000000000800000 +#define KF_RDTSCP 0x0000000400000000 +#define KF_CET_SS 0x0000400000000000 +#define KF_XFD 0x0080000000000000 +#define KF_XSAVEOPT_BIT 0x0F +#define KF_XSTATE_BIT 0x17 +#define KF_RDWRFSGSBASE_BIT 0x1C +#define KF_XSAVES_BIT 0x26 +#define KF_FPU_LEAKAGE_BIT 0x29 +#define KF_CAT_BIT 0x2C +#define KF_XFD_BIT 0x37 + typedef struct _SYSTEM_PERFORMANCE_INFORMATION { LARGE_INTEGER IdleProcessTime; @@ -1693,7 +1743,7 @@ typedef struct _SYSTEM_THREAD_INFORMATION LARGE_INTEGER UserTime; LARGE_INTEGER CreateTime; ULONG WaitTime; - PVOID StartAddress; + ULONG_PTR StartAddress; CLIENT_ID ClientId; KPRIORITY Priority; KPRIORITY BasePriority; @@ -1710,7 +1760,7 @@ typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION SYSTEM_THREAD_INFORMATION ThreadInfo; PVOID StackBase; PVOID StackLimit; - PVOID Win32StartAddress; + ULONG_PTR Win32StartAddress; PTEB TebBase; // since VISTA ULONG_PTR Reserved2; ULONG_PTR Reserved3; @@ -1816,7 +1866,7 @@ typedef struct _RTL_PROCESS_LOCK_INFORMATION typedef struct _RTL_PROCESS_LOCKS { ULONG NumberOfLocks; - RTL_PROCESS_LOCK_INFORMATION Locks[1]; + _Field_size_(NumberOfLocks) RTL_PROCESS_LOCK_INFORMATION Locks[1]; } RTL_PROCESS_LOCKS, *PRTL_PROCESS_LOCKS; // private @@ -1836,7 +1886,7 @@ typedef struct _RTL_PROCESS_BACKTRACES ULONG ReservedMemory; ULONG NumberOfBackTraceLookups; ULONG NumberOfBackTraces; - RTL_PROCESS_BACKTRACE_INFORMATION BackTraces[1]; + _Field_size_(NumberOfBackTraces) RTL_PROCESS_BACKTRACE_INFORMATION BackTraces[1]; } RTL_PROCESS_BACKTRACES, *PRTL_PROCESS_BACKTRACES; typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO @@ -1853,7 +1903,7 @@ typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO typedef struct _SYSTEM_HANDLE_INFORMATION { ULONG NumberOfHandles; - SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1]; + _Field_size_(NumberOfHandles) SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1]; } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; typedef struct _SYSTEM_OBJECTTYPE_INFORMATION @@ -1978,7 +2028,7 @@ typedef struct _SYSTEM_POOLTAG typedef struct _SYSTEM_POOLTAG_INFORMATION { ULONG Count; - SYSTEM_POOLTAG TagInfo[1]; + _Field_size_(Count) SYSTEM_POOLTAG TagInfo[1]; } SYSTEM_POOLTAG_INFORMATION, *PSYSTEM_POOLTAG_INFORMATION; typedef struct _SYSTEM_INTERRUPT_INFORMATION @@ -2026,1212 +2076,6 @@ typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE BOOLEAN Enable; } SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE, *PSYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE; -#ifndef _TRACEHANDLE_DEFINED -#define _TRACEHANDLE_DEFINED -typedef ULONG64 TRACEHANDLE, *PTRACEHANDLE; -#endif - -typedef enum _EVENT_TRACE_INFORMATION_CLASS -{ - EventTraceKernelVersionInformation, // EVENT_TRACE_VERSION_INFORMATION - EventTraceGroupMaskInformation, // EVENT_TRACE_GROUPMASK_INFORMATION - EventTracePerformanceInformation, // EVENT_TRACE_PERFORMANCE_INFORMATION - EventTraceTimeProfileInformation, // EVENT_TRACE_TIME_PROFILE_INFORMATION - EventTraceSessionSecurityInformation, // EVENT_TRACE_SESSION_SECURITY_INFORMATION - EventTraceSpinlockInformation, // EVENT_TRACE_SPINLOCK_INFORMATION - EventTraceStackTracingInformation, // EVENT_TRACE_SYSTEM_EVENT_INFORMATION - EventTraceExecutiveResourceInformation, // EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION - EventTraceHeapTracingInformation, // EVENT_TRACE_HEAP_TRACING_INFORMATION - EventTraceHeapSummaryTracingInformation, // EVENT_TRACE_HEAP_TRACING_INFORMATION - EventTracePoolTagFilterInformation, // EVENT_TRACE_TAG_FILTER_INFORMATION - EventTracePebsTracingInformation, // EVENT_TRACE_SYSTEM_EVENT_INFORMATION - EventTraceProfileConfigInformation, // EVENT_TRACE_PROFILE_COUNTER_INFORMATION - EventTraceProfileSourceListInformation, // EVENT_TRACE_PROFILE_LIST_INFORMATION - EventTraceProfileEventListInformation, // EVENT_TRACE_SYSTEM_EVENT_INFORMATION - EventTraceProfileCounterListInformation, // EVENT_TRACE_PROFILE_COUNTER_INFORMATION - EventTraceStackCachingInformation, // EVENT_TRACE_STACK_CACHING_INFORMATION - EventTraceObjectTypeFilterInformation, // EVENT_TRACE_TAG_FILTER_INFORMATION - EventTraceSoftRestartInformation, // EVENT_TRACE_SOFT_RESTART_INFORMATION - EventTraceLastBranchConfigurationInformation, // REDSTONE3 - EventTraceLastBranchEventListInformation, - EventTraceProfileSourceAddInformation, // EVENT_TRACE_PROFILE_ADD_INFORMATION // REDSTONE4 - EventTraceProfileSourceRemoveInformation, // EVENT_TRACE_PROFILE_REMOVE_INFORMATION - EventTraceProcessorTraceConfigurationInformation, - EventTraceProcessorTraceEventListInformation, - EventTraceCoverageSamplerInformation, // EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION - EventTraceUnifiedStackCachingInformation, // sicne 21H1 - MaxEventTraceInfoClass -} EVENT_TRACE_INFORMATION_CLASS; - -typedef struct _EVENT_TRACE_VERSION_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - ULONG EventTraceKernelVersion; -} EVENT_TRACE_VERSION_INFORMATION, *PEVENT_TRACE_VERSION_INFORMATION; - -typedef struct _TRACE_ENABLE_FLAG_EXTENSION -{ - USHORT Offset; // Offset to the flag array in structure - UCHAR Length; // Length of flag array in ULONGs - UCHAR Flag; // Must be set to EVENT_TRACE_FLAG_EXTENSION -} TRACE_ENABLE_FLAG_EXTENSION, *PTRACE_ENABLE_FLAG_EXTENSION; - -typedef struct _TRACE_ENABLE_FLAG_EXT_HEADER -{ - USHORT Length; // Length in ULONGs - USHORT Items; // # of items -} TRACE_ENABLE_FLAG_EXT_HEADER, *PTRACE_ENABLE_FLAG_EXT_HEADER; - -typedef struct _TRACE_ENABLE_FLAG_EXT_ITEM -{ - USHORT Offset; // Offset to the next block - USHORT Type; // Extension type -} TRACE_ENABLE_FLAG_EXT_ITEM, *PTRACE_ENABLE_FLAG_EXT_ITEM; - -#define EVENT_TRACE_FLAG_EXT_ITEMS 0x80FF0000 // New extension structure -#define EVENT_TRACE_FLAG_EXT_LEN_NEW_STRUCT 0xFF // Pseudo length to denote new struct format - -#define ETW_MINIMUM_CACHED_STACK_LENGTH 4 -#define ETW_SW_ARRAY_SIZE 256 // Frame Count allocated in lookaside list -#define ETW_STACK_SW_ARRAY_SIZE 192 // Frame Count allocated in stack -#define ETW_MAX_STACKWALK_FILTER 256 // Max number of HookId's -#define ETW_MAX_TAG_FILTER 4 -#define ETW_MAX_POOLTAG_FILTER ETW_MAX_TAG_FILTER - -#define ETW_EXT_ENABLE_FLAGS 0x0001 -#define ETW_EXT_PIDS 0x0002 -#define ETW_EXT_STACKWALK_FILTER 0x0003 -#define ETW_EXT_POOLTAG_FILTER 0x0004 -#define ETW_EXT_STACK_CACHING 0x0005 - -// Extended item for configuring stack caching. -typedef struct _ETW_STACK_CACHING_CONFIG -{ - ULONG CacheSize; - ULONG BucketCount; -} ETW_STACK_CACHING_CONFIG, *PETW_STACK_CACHING_CONFIG; - -// The second bit is set if the trace is used by PM & CP (fixed headers) -// If not, the data block is used by for finer data for performance analysis -// -#define TRACE_HEADER_EVENT_TRACE 0x40000000 -// -// If set, the data block is SYSTEM_TRACE_HEADER -// -#define TRACE_HEADER_ENUM_MASK 0x00FF0000 - -#define PERF_MASK_INDEX (0xe0000000) -#define PERF_MASK_GROUP (~PERF_MASK_INDEX) -#define PERF_NUM_MASKS 8 - -#define PERF_GET_MASK_INDEX(GM) (((GM) & PERF_MASK_INDEX) >> 29) -#define PERF_GET_MASK_GROUP(GM) ((GM) & PERF_MASK_GROUP) -#define PERFINFO_OR_GROUP_WITH_GROUPMASK(Group, pGroupMask) \ - (pGroupMask)->Masks[PERF_GET_MASK_INDEX(Group)] |= PERF_GET_MASK_GROUP(Group); - -// Masks[0] -#define PERF_PROCESS EVENT_TRACE_FLAG_PROCESS -#define PERF_THREAD EVENT_TRACE_FLAG_THREAD -#define PERF_PROC_THREAD EVENT_TRACE_FLAG_PROCESS | EVENT_TRACE_FLAG_THREAD -#define PERF_LOADER EVENT_TRACE_FLAG_IMAGE_LOAD -#define PERF_PERF_COUNTER EVENT_TRACE_FLAG_PROCESS_COUNTERS -#define PERF_FILENAME EVENT_TRACE_FLAG_DISK_FILE_IO -#define PERF_DISK_IO EVENT_TRACE_FLAG_DISK_FILE_IO | EVENT_TRACE_FLAG_DISK_IO -#define PERF_DISK_IO_INIT EVENT_TRACE_FLAG_DISK_IO_INIT -#define PERF_ALL_FAULTS EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS -#define PERF_HARD_FAULTS EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS -#define PERF_VAMAP EVENT_TRACE_FLAG_VAMAP -#define PERF_NETWORK EVENT_TRACE_FLAG_NETWORK_TCPIP -#define PERF_REGISTRY EVENT_TRACE_FLAG_REGISTRY -#define PERF_DBGPRINT EVENT_TRACE_FLAG_DBGPRINT -#define PERF_JOB EVENT_TRACE_FLAG_JOB -#define PERF_ALPC EVENT_TRACE_FLAG_ALPC -#define PERF_SPLIT_IO EVENT_TRACE_FLAG_SPLIT_IO -#define PERF_DEBUG_EVENTS EVENT_TRACE_FLAG_DEBUG_EVENTS -#define PERF_FILE_IO EVENT_TRACE_FLAG_FILE_IO -#define PERF_FILE_IO_INIT EVENT_TRACE_FLAG_FILE_IO_INIT -#define PERF_NO_SYSCONFIG EVENT_TRACE_FLAG_NO_SYSCONFIG - -// Masks[1] -#define PERF_MEMORY 0x20000001 -#define PERF_PROFILE 0x20000002 // equivalent to EVENT_TRACE_FLAG_PROFILE -#define PERF_CONTEXT_SWITCH 0x20000004 // equivalent to EVENT_TRACE_FLAG_CSWITCH -#define PERF_FOOTPRINT 0x20000008 -#define PERF_DRIVERS 0x20000010 // equivalent to EVENT_TRACE_FLAG_DRIVER -#define PERF_REFSET 0x20000020 -#define PERF_POOL 0x20000040 -#define PERF_POOLTRACE 0x20000041 -#define PERF_DPC 0x20000080 // equivalent to EVENT_TRACE_FLAG_DPC -#define PERF_COMPACT_CSWITCH 0x20000100 -#define PERF_DISPATCHER 0x20000200 // equivalent to EVENT_TRACE_FLAG_DISPATCHER -#define PERF_PMC_PROFILE 0x20000400 -#define PERF_PROFILING 0x20000402 -#define PERF_PROCESS_INSWAP 0x20000800 -#define PERF_AFFINITY 0x20001000 -#define PERF_PRIORITY 0x20002000 -#define PERF_INTERRUPT 0x20004000 // equivalent to EVENT_TRACE_FLAG_INTERRUPT -#define PERF_VIRTUAL_ALLOC 0x20008000 // equivalent to EVENT_TRACE_FLAG_VIRTUAL_ALLOC -#define PERF_SPINLOCK 0x20010000 -#define PERF_SYNC_OBJECTS 0x20020000 -#define PERF_DPC_QUEUE 0x20040000 -#define PERF_MEMINFO 0x20080000 -#define PERF_CONTMEM_GEN 0x20100000 -#define PERF_SPINLOCK_CNTRS 0x20200000 -#define PERF_SPININSTR 0x20210000 -#define PERF_SESSION 0x20400000 -#define PERF_PFSECTION 0x20400000 -#define PERF_MEMINFO_WS 0x20800000 -#define PERF_KERNEL_QUEUE 0x21000000 -#define PERF_INTERRUPT_STEER 0x22000000 -#define PERF_SHOULD_YIELD 0x24000000 -#define PERF_WS 0x28000000 -//#define PERF_POOLTRACE (PERF_MEMORY | PERF_POOL) -//#define PERF_PROFILING (PERF_PROFILE | PERF_PMC_PROFILE) -//#define PERF_SPININSTR (PERF_SPINLOCK | PERF_SPINLOCK_CNTRS) - -// Masks[2] -#define PERF_ANTI_STARVATION 0x40000001 -#define PERF_PROCESS_FREEZE 0x40000002 -#define PERF_PFN_LIST 0x40000004 -#define PERF_WS_DETAIL 0x40000008 -#define PERF_WS_ENTRY 0x40000010 -#define PERF_HEAP 0x40000020 -#define PERF_SYSCALL 0x40000040 // equivalent to EVENT_TRACE_FLAG_SYSTEMCALL -#define PERF_UMS 0x40000080 -#define PERF_BACKTRACE 0x40000100 -#define PERF_VULCAN 0x40000200 -#define PERF_OBJECTS 0x40000400 -#define PERF_EVENTS 0x40000800 -#define PERF_FULLTRACE 0x40001000 -#define PERF_DFSS 0x40002000 -#define PERF_PREFETCH 0x40004000 -#define PERF_PROCESSOR_IDLE 0x40008000 -#define PERF_CPU_CONFIG 0x40010000 -#define PERF_TIMER 0x40020000 -#define PERF_CLOCK_INTERRUPT 0x40040000 -#define PERF_LOAD_BALANCER 0x40080000 -#define PERF_CLOCK_TIMER 0x40100000 -#define PERF_IDLE_SELECTION 0x40200000 -#define PERF_IPI 0x40400000 -#define PERF_IO_TIMER 0x40800000 -#define PERF_REG_HIVE 0x41000000 -#define PERF_REG_NOTIF 0x42000000 -#define PERF_PPM_EXIT_LATENCY 0x44000000 -#define PERF_WORKER_THREAD 0x48000000 - -// Masks[4] -#define PERF_OPTICAL_IO 0x80000001 -#define PERF_OPTICAL_IO_INIT 0x80000002 -// Reserved 0x80000004 -#define PERF_DLL_INFO 0x80000008 -#define PERF_DLL_FLUSH_WS 0x80000010 -// Reserved 0x80000020 -#define PERF_OB_HANDLE 0x80000040 -#define PERF_OB_OBJECT 0x80000080 -// Reserved 0x80000100 -#define PERF_WAKE_DROP 0x80000200 -#define PERF_WAKE_EVENT 0x80000400 -#define PERF_DEBUGGER 0x80000800 -#define PERF_PROC_ATTACH 0x80001000 -#define PERF_WAKE_COUNTER 0x80002000 -// Reserved 0x80004000 -#define PERF_POWER 0x80008000 -#define PERF_SOFT_TRIM 0x80010000 -#define PERF_CC 0x80020000 -// Reserved 0x80040000 -#define PERF_FLT_IO_INIT 0x80080000 -#define PERF_FLT_IO 0x80100000 -#define PERF_FLT_FASTIO 0x80200000 -#define PERF_FLT_IO_FAILURE 0x80400000 -#define PERF_HV_PROFILE 0x80800000 -#define PERF_WDF_DPC 0x81000000 -#define PERF_WDF_INTERRUPT 0x82000000 -#define PERF_CACHE_FLUSH 0x84000000 - -// Masks[5] -#define PERF_HIBER_RUNDOWN 0xA0000001 - -// Masks[6] -#define PERF_SYSCFG_SYSTEM 0xC0000001 -#define PERF_SYSCFG_GRAPHICS 0xC0000002 -#define PERF_SYSCFG_STORAGE 0xC0000004 -#define PERF_SYSCFG_NETWORK 0xC0000008 -#define PERF_SYSCFG_SERVICES 0xC0000010 -#define PERF_SYSCFG_PNP 0xC0000020 -#define PERF_SYSCFG_OPTICAL 0xC0000040 -#define PERF_SYSCFG_ALL 0xDFFFFFFF - -// Masks[7] - Control Mask. All flags that change system behavior go here. -#define PERF_CLUSTER_OFF 0xE0000001 -#define PERF_MEMORY_CONTROL 0xE0000002 - -// The predefined event groups or families for NT subsystems -#define EVENT_TRACE_GROUP_HEADER 0x0000 -#define EVENT_TRACE_GROUP_IO 0x0100 -#define EVENT_TRACE_GROUP_MEMORY 0x0200 -#define EVENT_TRACE_GROUP_PROCESS 0x0300 -#define EVENT_TRACE_GROUP_FILE 0x0400 -#define EVENT_TRACE_GROUP_THREAD 0x0500 -#define EVENT_TRACE_GROUP_TCPIP 0x0600 -#define EVENT_TRACE_GROUP_JOB 0x0700 -#define EVENT_TRACE_GROUP_UDPIP 0x0800 -#define EVENT_TRACE_GROUP_REGISTRY 0x0900 -#define EVENT_TRACE_GROUP_DBGPRINT 0x0A00 -#define EVENT_TRACE_GROUP_CONFIG 0x0B00 -#define EVENT_TRACE_GROUP_SPARE1 0x0C00 // Spare1 -#define EVENT_TRACE_GROUP_WNF 0x0D00 -#define EVENT_TRACE_GROUP_POOL 0x0E00 -#define EVENT_TRACE_GROUP_PERFINFO 0x0F00 -#define EVENT_TRACE_GROUP_HEAP 0x1000 -#define EVENT_TRACE_GROUP_OBJECT 0x1100 -#define EVENT_TRACE_GROUP_POWER 0x1200 -#define EVENT_TRACE_GROUP_MODBOUND 0x1300 -#define EVENT_TRACE_GROUP_IMAGE 0x1400 -#define EVENT_TRACE_GROUP_DPC 0x1500 -#define EVENT_TRACE_GROUP_CC 0x1600 -#define EVENT_TRACE_GROUP_CRITSEC 0x1700 -#define EVENT_TRACE_GROUP_STACKWALK 0x1800 -#define EVENT_TRACE_GROUP_UMS 0x1900 -#define EVENT_TRACE_GROUP_ALPC 0x1A00 -#define EVENT_TRACE_GROUP_SPLITIO 0x1B00 -#define EVENT_TRACE_GROUP_THREAD_POOL 0x1C00 -#define EVENT_TRACE_GROUP_HYPERVISOR 0x1D00 -#define EVENT_TRACE_GROUP_HYPERVISORX 0x1E00 - -// -// Event for header -// -#define WMI_LOG_TYPE_HEADER (EVENT_TRACE_GROUP_HEADER | EVENT_TRACE_TYPE_INFO) -#define WMI_LOG_TYPE_HEADER_EXTENSION (EVENT_TRACE_GROUP_HEADER | EVENT_TRACE_TYPE_EXTENSION) -#define WMI_LOG_TYPE_RUNDOWN_COMPLETE (EVENT_TRACE_GROUP_HEADER | EVENT_TRACE_TYPE_CHECKPOINT) -#define WMI_LOG_TYPE_GROUP_MASKS_END (EVENT_TRACE_GROUP_HEADER | 0x20) -#define WMI_LOG_TYPE_RUNDOWN_BEGIN (EVENT_TRACE_GROUP_HEADER | 0x30) -#define WMI_LOG_TYPE_RUNDOWN_END (EVENT_TRACE_GROUP_HEADER | 0x31) -#define WMI_LOG_TYPE_DBGID_RSDS (EVENT_TRACE_GROUP_HEADER | EVENT_TRACE_TYPE_DBGID_RSDS) -#define WMI_LOG_TYPE_DBGID_NB10 (EVENT_TRACE_GROUP_HEADER | 0x41) -#define WMI_LOG_TYPE_BUILD_LAB (EVENT_TRACE_GROUP_HEADER | 0x42) -#define WMI_LOG_TYPE_BINARY_PATH (EVENT_TRACE_GROUP_HEADER | 0x43) - -// -// Event for system config -// -#define WMI_LOG_TYPE_CONFIG_CPU (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_CPU) -#define WMI_LOG_TYPE_CONFIG_PHYSICALDISK (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PHYSICALDISK) -#define WMI_LOG_TYPE_CONFIG_LOGICALDISK (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_LOGICALDISK) -#define WMI_LOG_TYPE_CONFIG_OPTICALMEDIA (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_OPTICALMEDIA) -#define WMI_LOG_TYPE_CONFIG_NIC (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_NIC) -#define WMI_LOG_TYPE_CONFIG_VIDEO (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_VIDEO) -#define WMI_LOG_TYPE_CONFIG_SERVICES (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_SERVICES) -#define WMI_LOG_TYPE_CONFIG_POWER (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_POWER) -#define WMI_LOG_TYPE_CONFIG_OSVERSION (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_OSVERSION) -#define WMI_LOG_TYPE_CONFIG_VISUALTHEME (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_VISUALTHEME) -#define WMI_LOG_TYPE_CONFIG_SYSTEMRANGE (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_SYSTEMRANGE) -#define WMI_LOG_TYPE_CONFIG_SYSDLLINFO (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_SYSDLLINFO) -#define WMI_LOG_TYPE_CONFIG_IRQ (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_IRQ) -#define WMI_LOG_TYPE_CONFIG_PNP (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PNP) -#define WMI_LOG_TYPE_CONFIG_IDECHANNEL (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_IDECHANNEL) -#define WMI_LOG_TYPE_CONFIG_NUMANODE (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_NUMANODE) -#define WMI_LOG_TYPE_CONFIG_PLATFORM (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PLATFORM) -#define WMI_LOG_TYPE_CONFIG_PROCESSORGROUP (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PROCESSORGROUP) -#define WMI_LOG_TYPE_CONFIG_PROCESSORNUMBER (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PROCESSORNUMBER) -#define WMI_LOG_TYPE_CONFIG_DPI (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_DPI) -#define WMI_LOG_TYPE_CONFIG_CODEINTEGRITY (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_CI_INFO) -#define WMI_LOG_TYPE_CONFIG_MACHINEID (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_MACHINEID) - -// -// Event for Image and File Name -// -#define PERFINFO_LOG_TYPE_FILENAME (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_INFO) -#define PERFINFO_LOG_TYPE_FILENAME_CREATE (EVENT_TRACE_GROUP_FILE | 0x20) -#define PERFINFO_LOG_TYPE_FILENAME_SAME (EVENT_TRACE_GROUP_FILE | 0x21) -#define PERFINFO_LOG_TYPE_FILENAME_NULL (EVENT_TRACE_GROUP_FILE | 0x22) -#define PERFINFO_LOG_TYPE_FILENAME_DELETE (EVENT_TRACE_GROUP_FILE | 0x23) -#define PERFINFO_LOG_TYPE_FILENAME_RUNDOWN (EVENT_TRACE_GROUP_FILE | 0x24) - -#define PERFINFO_LOG_TYPE_MAPFILE (EVENT_TRACE_GROUP_FILE | 0x25) -#define PERFINFO_LOG_TYPE_UNMAPFILE (EVENT_TRACE_GROUP_FILE | 0x26) -#define PERFINFO_LOG_TYPE_MAPFILE_DC_START (EVENT_TRACE_GROUP_FILE | 0x27) -#define PERFINFO_LOG_TYPE_MAPFILE_DC_END (EVENT_TRACE_GROUP_FILE | 0x28) - -#define PERFINFO_LOG_TYPE_FILE_IO_CREATE (EVENT_TRACE_GROUP_FILE | 0x40) -#define PERFINFO_LOG_TYPE_FILE_IO_CLEANUP (EVENT_TRACE_GROUP_FILE | 0x41) -#define PERFINFO_LOG_TYPE_FILE_IO_CLOSE (EVENT_TRACE_GROUP_FILE | 0x42) -#define PERFINFO_LOG_TYPE_FILE_IO_READ (EVENT_TRACE_GROUP_FILE | 0x43) -#define PERFINFO_LOG_TYPE_FILE_IO_WRITE (EVENT_TRACE_GROUP_FILE | 0x44) -#define PERFINFO_LOG_TYPE_FILE_IO_SET_INFORMATION (EVENT_TRACE_GROUP_FILE | 0x45) -#define PERFINFO_LOG_TYPE_FILE_IO_DELETE (EVENT_TRACE_GROUP_FILE | 0x46) -#define PERFINFO_LOG_TYPE_FILE_IO_RENAME (EVENT_TRACE_GROUP_FILE | 0x47) -#define PERFINFO_LOG_TYPE_FILE_IO_DIRENUM (EVENT_TRACE_GROUP_FILE | 0x48) -#define PERFINFO_LOG_TYPE_FILE_IO_FLUSH (EVENT_TRACE_GROUP_FILE | 0x49) -#define PERFINFO_LOG_TYPE_FILE_IO_QUERY_INFORMATION (EVENT_TRACE_GROUP_FILE | 0x4A) -#define PERFINFO_LOG_TYPE_FILE_IO_FS_CONTROL (EVENT_TRACE_GROUP_FILE | 0x4B) -#define PERFINFO_LOG_TYPE_FILE_IO_OPERATION_END (EVENT_TRACE_GROUP_FILE | 0x4C) -#define PERFINFO_LOG_TYPE_FILE_IO_DIRNOTIFY (EVENT_TRACE_GROUP_FILE | 0x4D) -#define PERFINFO_LOG_TYPE_FILE_IO_CREATE_NEW (EVENT_TRACE_GROUP_FILE | 0x4E) -#define PERFINFO_LOG_TYPE_FILE_IO_DELETE_PATH (EVENT_TRACE_GROUP_FILE | 0x4F) -#define PERFINFO_LOG_TYPE_FILE_IO_RENAME_PATH (EVENT_TRACE_GROUP_FILE | 0x50) -#define PERFINFO_LOG_TYPE_FILE_IO_SETLINK_PATH (EVENT_TRACE_GROUP_FILE | 0x51) -#define PERFINFO_LOG_TYPE_FILE_IO_SETLINK (EVENT_TRACE_GROUP_FILE | 0x52) - -// -// Event types for minifilter callbacks -// - -#define PERFINFO_LOG_TYPE_FLT_PREOP_INIT (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_PREOP_INIT) -#define PERFINFO_LOG_TYPE_FLT_POSTOP_INIT (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_POSTOP_INIT) -#define PERFINFO_LOG_TYPE_FLT_PREOP_COMPLETION (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_PREOP_COMPLETION) -#define PERFINFO_LOG_TYPE_FLT_POSTOP_COMPLETION (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_POSTOP_COMPLETION) -#define PERFINFO_LOG_TYPE_FLT_PREOP_FAILURE (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_PREOP_FAILURE) -#define PERFINFO_LOG_TYPE_FLT_POSTOP_FAILURE (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_POSTOP_FAILURE) - -// -// Event types for Job -// - -#define WMI_LOG_TYPE_JOB_CREATE (EVENT_TRACE_GROUP_JOB | 0x20) -#define WMI_LOG_TYPE_JOB_TERMINATE (EVENT_TRACE_GROUP_JOB | 0x21) -#define WMI_LOG_TYPE_JOB_OPEN (EVENT_TRACE_GROUP_JOB | 0x22) -#define WMI_LOG_TYPE_JOB_ASSIGN_PROCESS (EVENT_TRACE_GROUP_JOB | 0x23) -#define WMI_LOG_TYPE_JOB_REMOVE_PROCESS (EVENT_TRACE_GROUP_JOB | 0x24) -#define WMI_LOG_TYPE_JOB_SET (EVENT_TRACE_GROUP_JOB | 0x25) -#define WMI_LOG_TYPE_JOB_QUERY (EVENT_TRACE_GROUP_JOB | 0x26) -#define WMI_LOG_TYPE_JOB_SET_FAILED (EVENT_TRACE_GROUP_JOB | 0x27) -#define WMI_LOG_TYPE_JOB_QUERY_FAILED (EVENT_TRACE_GROUP_JOB | 0x28) -#define WMI_LOG_TYPE_JOB_SET_NOTIFICATION (EVENT_TRACE_GROUP_JOB | 0x29) -#define WMI_LOG_TYPE_JOB_SEND_NOTIFICATION (EVENT_TRACE_GROUP_JOB | 0x2A) -#define WMI_LOG_TYPE_JOB_QUERY_VIOLATION (EVENT_TRACE_GROUP_JOB | 0x2B) -#define WMI_LOG_TYPE_JOB_SET_CPU_RATE (EVENT_TRACE_GROUP_JOB | 0x2C) -#define WMI_LOG_TYPE_JOB_SET_NET_RATE (EVENT_TRACE_GROUP_JOB | 0x2D) - -// -// Event types for Process -// - -#define WMI_LOG_TYPE_PROCESS_CREATE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_START) -#define WMI_LOG_TYPE_PROCESS_DELETE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_END) -#define WMI_LOG_TYPE_PROCESS_DC_START (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_DC_START) -#define WMI_LOG_TYPE_PROCESS_DC_END (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_DC_END) -#define WMI_LOG_TYPE_PROCESS_LOAD_IMAGE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_LOAD) -#define WMI_LOG_TYPE_PROCESS_TERMINATE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_TERMINATE) - -#define PERFINFO_LOG_TYPE_PROCESS_PERFCTR_END (EVENT_TRACE_GROUP_PROCESS | 0x20) -#define PERFINFO_LOG_TYPE_PROCESS_PERFCTR_RD (EVENT_TRACE_GROUP_PROCESS | 0x21) -// Reserved (EVENT_TRACE_GROUP_PROCESS | 0x22) -#define PERFINFO_LOG_TYPE_INSWAPPROCESS (EVENT_TRACE_GROUP_PROCESS | 0x23) -#define PERFINFO_LOG_TYPE_PROCESS_FREEZE (EVENT_TRACE_GROUP_PROCESS | 0x24) -#define PERFINFO_LOG_TYPE_PROCESS_THAW (EVENT_TRACE_GROUP_PROCESS | 0x25) -#define PERFINFO_LOG_TYPE_BOOT_PHASE_START (EVENT_TRACE_GROUP_PROCESS | 0x26) -#define PERFINFO_LOG_TYPE_ZOMBIE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x27) -#define PERFINFO_LOG_TYPE_PROCESS_SET_AFFINITY (EVENT_TRACE_GROUP_PROCESS | 0x28) - -#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_USER (EVENT_TRACE_GROUP_PROCESS | 0x30) -#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_EXECUTION (EVENT_TRACE_GROUP_PROCESS | 0x31) -#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_KERNEL (EVENT_TRACE_GROUP_PROCESS | 0x32) -#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_INSTRUMENTATION (EVENT_TRACE_GROUP_PROCESS | 0x33) -#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_PRESERVE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x34) - -#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_USER (EVENT_TRACE_GROUP_PROCESS | 0x40) -#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_EXECUTION (EVENT_TRACE_GROUP_PROCESS | 0x41) -#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_KERNEL (EVENT_TRACE_GROUP_PROCESS | 0x42) -#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_INSTRUMENTATION (EVENT_TRACE_GROUP_PROCESS | 0x43) -#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_PRESERVE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x44) - -#define PERFINFO_LOG_TYPE_WAKE_DROP_USER (EVENT_TRACE_GROUP_PROCESS | 0x50) -#define PERFINFO_LOG_TYPE_WAKE_DROP_EXECUTION (EVENT_TRACE_GROUP_PROCESS | 0x51) -#define PERFINFO_LOG_TYPE_WAKE_DROP_KERNEL (EVENT_TRACE_GROUP_PROCESS | 0x52) -#define PERFINFO_LOG_TYPE_WAKE_DROP_INSTRUMENTATION (EVENT_TRACE_GROUP_PROCESS | 0x53) -#define PERFINFO_LOG_TYPE_WAKE_DROP_PRESERVE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x54) - -#define PERFINFO_LOG_TYPE_WAKE_EVENT_USER (EVENT_TRACE_GROUP_PROCESS | 0x60) -#define PERFINFO_LOG_TYPE_WAKE_EVENT_EXECUTION (EVENT_TRACE_GROUP_PROCESS | 0x61) -#define PERFINFO_LOG_TYPE_WAKE_EVENT_KERNEL (EVENT_TRACE_GROUP_PROCESS | 0x62) -#define PERFINFO_LOG_TYPE_WAKE_EVENT_INSTRUMENTATION (EVENT_TRACE_GROUP_PROCESS | 0x63) -#define PERFINFO_LOG_TYPE_WAKE_EVENT_PRESERVE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x64) - -#define PERFINFO_LOG_TYPE_DEBUG_EVENT (EVENT_TRACE_GROUP_PROCESS | 0x70) - -// -// Event types for Image and Library Loader -// - -#define WMI_LOG_TYPE_IMAGE_LOAD (EVENT_TRACE_GROUP_IMAGE | EVENT_TRACE_TYPE_START) // reserved for future -#define WMI_LOG_TYPE_IMAGE_UNLOAD (EVENT_TRACE_GROUP_IMAGE | EVENT_TRACE_TYPE_END) -#define WMI_LOG_TYPE_IMAGE_DC_START (EVENT_TRACE_GROUP_IMAGE | EVENT_TRACE_TYPE_DC_START) -#define WMI_LOG_TYPE_IMAGE_DC_END (EVENT_TRACE_GROUP_IMAGE | EVENT_TRACE_TYPE_DC_END) -#define WMI_LOG_TYPE_IMAGE_RELOCATION (EVENT_TRACE_GROUP_IMAGE | 0x20) -#define WMI_LOG_TYPE_IMAGE_KERNEL_BASE (EVENT_TRACE_GROUP_IMAGE | 0x21) -#define WMI_LOG_TYPE_IMAGE_HYPERCALL_PAGE (EVENT_TRACE_GROUP_IMAGE | 0x22) - -#define PERFINFO_LOG_TYPE_LDR_LOCK_ACQUIRE_ATTEMPT (EVENT_TRACE_GROUP_IMAGE | 0x80) // 128 -#define PERFINFO_LOG_TYPE_LDR_LOCK_ACQUIRE_SUCCESS (EVENT_TRACE_GROUP_IMAGE | 0x81) -#define PERFINFO_LOG_TYPE_LDR_LOCK_ACQUIRE_FAIL (EVENT_TRACE_GROUP_IMAGE | 0x82) -#define PERFINFO_LOG_TYPE_LDR_LOCK_ACQUIRE_WAIT (EVENT_TRACE_GROUP_IMAGE | 0x83) -#define PERFINFO_LOG_TYPE_LDR_PROC_INIT_DONE (EVENT_TRACE_GROUP_IMAGE | 0x84) // 132 -#define PERFINFO_LOG_TYPE_LDR_CREATE_SECTION (EVENT_TRACE_GROUP_IMAGE | 0x85) -#define PERFINFO_LOG_TYPE_LDR_SECTION_CREATED (EVENT_TRACE_GROUP_IMAGE | 0x86) -#define PERFINFO_LOG_TYPE_LDR_MAP_VIEW (EVENT_TRACE_GROUP_IMAGE | 0x87) - -#define PERFINFO_LOG_TYPE_LDR_RELOCATE_IMAGE (EVENT_TRACE_GROUP_IMAGE | 0x90) // 144 -#define PERFINFO_LOG_TYPE_LDR_IMAGE_RELOCATED (EVENT_TRACE_GROUP_IMAGE | 0x91) -#define PERFINFO_LOG_TYPE_LDR_HANDLE_OLD_DESCRIPTORS (EVENT_TRACE_GROUP_IMAGE | 0x92) -#define PERFINFO_LOG_TYPE_LDR_OLD_DESCRIPTORS_HANDLED (EVENT_TRACE_GROUP_IMAGE | 0x93) -#define PERFINFO_LOG_TYPE_LDR_HANDLE_NEW_DESCRIPTORS (EVENT_TRACE_GROUP_IMAGE | 0x94) // 148 -#define PERFINFO_LOG_TYPE_LDR_NEW_DESCRIPTORS_HANDLED (EVENT_TRACE_GROUP_IMAGE | 0x95) -#define PERFINFO_LOG_TYPE_LDR_DLLMAIN_EXIT (EVENT_TRACE_GROUP_IMAGE | 0x96) - -#define PERFINFO_LOG_TYPE_LDR_FIND_DLL (EVENT_TRACE_GROUP_IMAGE | 0xA0) // 160 -#define PERFINFO_LOG_TYPE_LDR_VIEW_MAPPED (EVENT_TRACE_GROUP_IMAGE | 0xA1) -#define PERFINFO_LOG_TYPE_LDR_LOCK_RELEASE (EVENT_TRACE_GROUP_IMAGE | 0xA2) -#define PERFINFO_LOG_TYPE_LDR_DLLMAIN_ENTER (EVENT_TRACE_GROUP_IMAGE | 0xA3) -#define PERFINFO_LOG_TYPE_LDR_ERROR (EVENT_TRACE_GROUP_IMAGE | 0xA4) // 164 - -#define PERFINFO_LOG_TYPE_LDR_VIEW_MAPPING (EVENT_TRACE_GROUP_IMAGE | 0xA5) // 165 -#define PERFINFO_LOG_TYPE_LDR_SNAPPING (EVENT_TRACE_GROUP_IMAGE | 0xA6) -#define PERFINFO_LOG_TYPE_LDR_SNAPPED (EVENT_TRACE_GROUP_IMAGE | 0xA7) -#define PERFINFO_LOG_TYPE_LDR_LOADING (EVENT_TRACE_GROUP_IMAGE | 0xA8) -#define PERFINFO_LOG_TYPE_LDR_LOADED (EVENT_TRACE_GROUP_IMAGE | 0xA9) -#define PERFINFO_LOG_TYPE_LDR_FOUND_KNOWN_DLL (EVENT_TRACE_GROUP_IMAGE | 0xAA) // 170 -#define PERFINFO_LOG_TYPE_LDR_ABNORMAL (EVENT_TRACE_GROUP_IMAGE | 0xAB) -#define PERFINFO_LOG_TYPE_LDR_PLACEHOLDER (EVENT_TRACE_GROUP_IMAGE | 0xAC) -#define PERFINFO_LOG_TYPE_LDR_RDY_TO_INIT (EVENT_TRACE_GROUP_IMAGE | 0xAD) -#define PERFINFO_LOG_TYPE_LDR_RDY_TO_RUN (EVENT_TRACE_GROUP_IMAGE | 0xAE) // 174 - - -#define PERFINFO_LOG_TYPE_LDR_NEW_DLL_LOAD (EVENT_TRACE_GROUP_IMAGE | 0xB0) // 176 -#define PERFINFO_LOG_TYPE_LDR_NEW_DLL_AS_DATA (EVENT_TRACE_GROUP_IMAGE | 0xB1) // 177 - -#define PERFINFO_LOG_TYPE_LDR_EXTERNAL_PATH (EVENT_TRACE_GROUP_IMAGE | 0xC0) // 192 -#define PERFINFO_LOG_TYPE_LDR_GENERATED_PATH (EVENT_TRACE_GROUP_IMAGE | 0xC1) - -#define PERFINFO_LOG_TYPE_LDR_APISET_RESOLVING (EVENT_TRACE_GROUP_IMAGE | 0xD0) // 208 -#define PERFINFO_LOG_TYPE_LDR_APISET_HOSTED (EVENT_TRACE_GROUP_IMAGE | 0xD1) // 209 -#define PERFINFO_LOG_TYPE_LDR_APISET_UNHOSTED (EVENT_TRACE_GROUP_IMAGE | 0xD2) // 210 -#define PERFINFO_LOG_TYPE_LDR_APISET_UNRESOLVED (EVENT_TRACE_GROUP_IMAGE | 0xD3) // 211 - -#define PERFINFO_LOG_TYPE_LDR_SEARCH_SECURITY (EVENT_TRACE_GROUP_IMAGE | 0xD4) // 212 -#define PERFINFO_LOG_TYPE_LDR_SEARCH_PATH_SECURITY (EVENT_TRACE_GROUP_IMAGE | 0xD5) // 213 - -// -// Event types for Thread -// - -#define WMI_LOG_TYPE_THREAD_CREATE (EVENT_TRACE_GROUP_THREAD | EVENT_TRACE_TYPE_START) -#define WMI_LOG_TYPE_THREAD_DELETE (EVENT_TRACE_GROUP_THREAD | EVENT_TRACE_TYPE_END) -#define WMI_LOG_TYPE_THREAD_DC_START (EVENT_TRACE_GROUP_THREAD | EVENT_TRACE_TYPE_DC_START) -#define WMI_LOG_TYPE_THREAD_DC_END (EVENT_TRACE_GROUP_THREAD | EVENT_TRACE_TYPE_DC_END) - -// Reserved (EVENT_TRACE_GROUP_THREAD | 0x20) -// Reserved (EVENT_TRACE_GROUP_THREAD | 0x21) -// Reserved (EVENT_TRACE_GROUP_THREAD | 0x22) -// Reserved (EVENT_TRACE_GROUP_THREAD | 0x23) -#define PERFINFO_LOG_TYPE_CONTEXTSWAP (EVENT_TRACE_GROUP_THREAD | 0x24) -#define PERFINFO_LOG_TYPE_CONTEXTSWAP_BATCH (EVENT_TRACE_GROUP_THREAD | 0x25) -// Reserved (EVENT_TRACE_GROUP_THREAD | 0x26) -// Reserved (EVENT_TRACE_GROUP_THREAD | 0x27) -// Reserved (EVENT_TRACE_GROUP_THREAD | 0x28) -#define PERFINFO_LOG_TYPE_SPINLOCK (EVENT_TRACE_GROUP_THREAD | 0x29) -#define PERFINFO_LOG_TYPE_QUEUE (EVENT_TRACE_GROUP_THREAD | 0x2A) -#define PERFINFO_LOG_TYPE_RESOURCE (EVENT_TRACE_GROUP_THREAD | 0x2B) -#define PERFINFO_LOG_TYPE_PUSHLOCK (EVENT_TRACE_GROUP_THREAD | 0x2C) -#define PERFINFO_LOG_TYPE_WAIT_SINGLE (EVENT_TRACE_GROUP_THREAD | 0x2D) -#define PERFINFO_LOG_TYPE_WAIT_MULTIPLE (EVENT_TRACE_GROUP_THREAD | 0x2E) -#define PERFINFO_LOG_TYPE_DELAY_EXECUTION (EVENT_TRACE_GROUP_THREAD | 0x2F) -#define PERFINFO_LOG_TYPE_THREAD_SET_PRIORITY (EVENT_TRACE_GROUP_THREAD | 0x30) -#define PERFINFO_LOT_TYPE_THREAD_SET_BASE_PRIORITY (EVENT_TRACE_GROUP_THREAD | 0x31) -#define PERFINFO_LOG_TYPE_THREAD_SET_BASE_PRIORITY (EVENT_TRACE_GROUP_THREAD | 0x31) -#define PERFINFO_LOG_TYPE_READY_THREAD (EVENT_TRACE_GROUP_THREAD | 0x32) -#define PERFINFO_LOG_TYPE_THREAD_SET_PAGE_PRIORITY (EVENT_TRACE_GROUP_THREAD | 0x33) -#define PERFINFO_LOG_TYPE_THREAD_SET_IO_PRIORITY (EVENT_TRACE_GROUP_THREAD | 0x34) -#define PERFINFO_LOG_TYPE_THREAD_SET_AFFINITY (EVENT_TRACE_GROUP_THREAD | 0x35) -#define PERFINFO_LOG_TYPE_WORKER_THREAD_ITEM (EVENT_TRACE_GROUP_THREAD | 0x39) -#define PERFINFO_LOG_TYPE_DFSS_START_NEW_INTERVAL (EVENT_TRACE_GROUP_THREAD | 0x3A) -#define PERFINFO_LOG_TYPE_DFSS_PROCESS_IDLE_ONLY_QUEUE (EVENT_TRACE_GROUP_THREAD | 0x3B) -#define PERFINFO_LOG_TYPE_ANTI_STARVATION_BOOST (EVENT_TRACE_GROUP_THREAD | 0x3C) -#define PERFINFO_LOG_TYPE_THREAD_MIGRATION (EVENT_TRACE_GROUP_THREAD | 0x3D) -#define PERFINFO_LOG_TYPE_KQUEUE_ENQUEUE (EVENT_TRACE_GROUP_THREAD | 0x3E) -#define PERFINFO_LOG_TYPE_KQUEUE_DEQUEUE (EVENT_TRACE_GROUP_THREAD | 0x3F) -#define PERFINFO_LOG_TYPE_WORKER_THREAD_ITEM_START (EVENT_TRACE_GROUP_THREAD | 0x40) -#define PERFINFO_LOG_TYPE_WORKER_THREAD_ITEM_END (EVENT_TRACE_GROUP_THREAD | 0x41) -#define PERFINFO_LOG_TYPE_AUTO_BOOST_SET_FLOOR (EVENT_TRACE_GROUP_THREAD | 0x42) -#define PERFINFO_LOG_TYPE_AUTO_BOOST_CLEAR_FLOOR (EVENT_TRACE_GROUP_THREAD | 0x43) -#define PERFINFO_LOG_TYPE_AUTO_BOOST_NO_ENTRIES (EVENT_TRACE_GROUP_THREAD | 0x44) -#define PERFINFO_LOG_TYPE_THREAD_SUBPROCESSTAG_CHANGED (EVENT_TRACE_GROUP_THREAD | 0x45) - -// -// Event types for Network subsystem (TCPIP/UDPIP) -// - -#define WMI_LOG_TYPE_TCPIP_SEND (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_SEND) -#define WMI_LOG_TYPE_TCPIP_RECEIVE (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_RECEIVE) -#define WMI_LOG_TYPE_TCPIP_CONNECT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_CONNECT) -#define WMI_LOG_TYPE_TCPIP_DISCONNECT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_DISCONNECT) -#define WMI_LOG_TYPE_TCPIP_RETRANSMIT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_RETRANSMIT) -#define WMI_LOG_TYPE_TCPIP_ACCEPT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_ACCEPT) -#define WMI_LOG_TYPE_TCPIP_RECONNECT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_RECONNECT) -#define WMI_LOG_TYPE_TCPIP_FAIL (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_CONNFAIL) -#define WMI_LOG_TYPE_TCPIP_TCPCOPY (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_COPY_TCP) -#define WMI_LOG_TYPE_TCPIP_ARPCOPY (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_COPY_ARP) -#define WMI_LOG_TYPE_TCPIP_FULLACK (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_ACKFULL) -#define WMI_LOG_TYPE_TCPIP_PARTACK (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_ACKPART) -#define WMI_LOG_TYPE_TCPIP_DUPACK (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_ACKDUP) - -#define WMI_LOG_TYPE_UDP_SEND (EVENT_TRACE_GROUP_UDPIP | EVENT_TRACE_TYPE_SEND) -#define WMI_LOG_TYPE_UDP_RECEIVE (EVENT_TRACE_GROUP_UDPIP | EVENT_TRACE_TYPE_RECEIVE) -#define WMI_LOG_TYPE_UDP_FAIL (EVENT_TRACE_GROUP_UDPIP | EVENT_TRACE_TYPE_CONNFAIL) - -// -// Netowrk events with IPV6 -// -#define WMI_LOG_TYPE_TCPIP_SEND_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x1A) -#define WMI_LOG_TYPE_TCPIP_RECEIVE_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x1B) -#define WMI_LOG_TYPE_TCPIP_CONNECT_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x1C) -#define WMI_LOG_TYPE_TCPIP_DISCONNECT_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x1D) -#define WMI_LOG_TYPE_TCPIP_RETRANSMIT_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x1E) -#define WMI_LOG_TYPE_TCPIP_ACCEPT_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x1F) -#define WMI_LOG_TYPE_TCPIP_RECONNECT_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x20) -#define WMI_LOG_TYPE_TCPIP_FAIL_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x21) -#define WMI_LOG_TYPE_TCPIP_TCPCOPY_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x22) -#define WMI_LOG_TYPE_TCPIP_ARPCOPY_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x23) -#define WMI_LOG_TYPE_TCPIP_FULLACK_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x24) -#define WMI_LOG_TYPE_TCPIP_PARTACK_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x25) -#define WMI_LOG_TYPE_TCPIP_DUPACK_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x26) - -#define WMI_LOG_TYPE_UDP_SEND_IPV6 (EVENT_TRACE_GROUP_UDPIP | 0x1A) -#define WMI_LOG_TYPE_UDP_RECEIVE_IPV6 (EVENT_TRACE_GROUP_UDPIP | 0x1B) - -// -// Event types for IO subsystem -// - -#define WMI_LOG_TYPE_IO_READ (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_READ) -#define WMI_LOG_TYPE_IO_WRITE (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_WRITE) -#define WMI_LOG_TYPE_IO_READ_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_READ_INIT) -#define WMI_LOG_TYPE_IO_WRITE_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_WRITE_INIT) -#define WMI_LOG_TYPE_IO_FLUSH (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_FLUSH) -#define WMI_LOG_TYPE_IO_FLUSH_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_FLUSH_INIT) -#define WMI_LOG_TYPE_IO_REDIRECTED_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_REDIRECTED_INIT) - -#define PERFINFO_LOG_TYPE_DRIVER_INIT (EVENT_TRACE_GROUP_IO | 0x20) -#define PERFINFO_LOG_TYPE_DRIVER_INIT_COMPLETE (EVENT_TRACE_GROUP_IO | 0x21) -#define PERFINFO_LOG_TYPE_DRIVER_MAJORFUNCTION_CALL (EVENT_TRACE_GROUP_IO | 0x22) -#define PERFINFO_LOG_TYPE_DRIVER_MAJORFUNCTION_RETURN (EVENT_TRACE_GROUP_IO | 0x23) -#define PERFINFO_LOG_TYPE_DRIVER_COMPLETIONROUTINE_CALL (EVENT_TRACE_GROUP_IO | 0x24) -#define PERFINFO_LOG_TYPE_DRIVER_COMPLETIONROUTINE_RETURN (EVENT_TRACE_GROUP_IO | 0x25) -#define PERFINFO_LOG_TYPE_DRIVER_ADD_DEVICE_CALL (EVENT_TRACE_GROUP_IO | 0x26) -#define PERFINFO_LOG_TYPE_DRIVER_ADD_DEVICE_RETURN (EVENT_TRACE_GROUP_IO | 0x27) -#define PERFINFO_LOG_TYPE_DRIVER_STARTIO_CALL (EVENT_TRACE_GROUP_IO | 0x28) -#define PERFINFO_LOG_TYPE_DRIVER_STARTIO_RETURN (EVENT_TRACE_GROUP_IO | 0x29) -// Reserved (EVENT_TRACE_GROUP_IO | 0x2a) -// Reserved (EVENT_TRACE_GROUP_IO | 0x2b) -// Reserved (EVENT_TRACE_GROUP_IO | 0x2c) -// Reserved (EVENT_TRACE_GROUP_IO | 0x2d) -// Reserved (EVENT_TRACE_GROUP_IO | 0x2e) -// Reserved (EVENT_TRACE_GROUP_IO | 0x2f) -#define PERFINFO_LOG_TYPE_PREFETCH_ACTION (EVENT_TRACE_GROUP_IO | 0x30) -#define PERFINFO_LOG_TYPE_PREFETCH_REQUEST (EVENT_TRACE_GROUP_IO | 0x31) -#define PERFINFO_LOG_TYPE_PREFETCH_READLIST (EVENT_TRACE_GROUP_IO | 0x32) -#define PERFINFO_LOG_TYPE_PREFETCH_READ (EVENT_TRACE_GROUP_IO | 0x33) -#define PERFINFO_LOG_TYPE_DRIVER_COMPLETE_REQUEST (EVENT_TRACE_GROUP_IO | 0x34) -#define PERFINFO_LOG_TYPE_DRIVER_COMPLETE_REQUEST_RETURN (EVENT_TRACE_GROUP_IO | 0x35) -#define PERFINFO_LOG_TYPE_BOOT_PREFETCH_INFORMATION (EVENT_TRACE_GROUP_IO | 0x36) -#define PERFINFO_LOG_TYPE_OPTICAL_IO_READ (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_OPTICAL_IO_READ) -#define PERFINFO_LOG_TYPE_OPTICAL_IO_WRITE (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_OPTICAL_IO_WRITE) -#define PERFINFO_LOG_TYPE_OPTICAL_IO_FLUSH (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_OPTICAL_IO_FLUSH) -#define PERFINFO_LOG_TYPE_OPTICAL_IO_READ_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_OPTICAL_IO_READ_INIT) -#define PERFINFO_LOG_TYPE_OPTICAL_IO_WRITE_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_OPTICAL_IO_WRITE_INIT) -#define PERFINFO_LOG_TYPE_OPTICAL_IO_FLUSH_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_OPTICAL_IO_FLUSH_INIT) - -// -// Event types for Memory subsystem -// -#define WMI_LOG_TYPE_PAGE_FAULT_TRANSITION (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_TF) -#define WMI_LOG_TYPE_PAGE_FAULT_DEMAND_ZERO (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_DZF) -#define WMI_LOG_TYPE_PAGE_FAULT_COPY_ON_WRITE (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_COW) -#define WMI_LOG_TYPE_PAGE_FAULT_GUARD_PAGE (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_GPF) -#define WMI_LOG_TYPE_PAGE_FAULT_HARD_PAGE_FAULT (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_HPF) -#define WMI_LOG_TYPE_PAGE_FAULT_ACCESS_VIOLATION (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_AV) - -#define PERFINFO_LOG_TYPE_HARDFAULT (EVENT_TRACE_GROUP_MEMORY | 0x20) -#define PERFINFO_LOG_TYPE_REMOVEPAGEBYCOLOR (EVENT_TRACE_GROUP_MEMORY | 0x21) -#define PERFINFO_LOG_TYPE_REMOVEPAGEFROMLIST (EVENT_TRACE_GROUP_MEMORY | 0x22) -#define PERFINFO_LOG_TYPE_PAGEINMEMORY (EVENT_TRACE_GROUP_MEMORY | 0x23) -#define PERFINFO_LOG_TYPE_INSERTINFREELIST (EVENT_TRACE_GROUP_MEMORY | 0x24) -#define PERFINFO_LOG_TYPE_INSERTINMODIFIEDLIST (EVENT_TRACE_GROUP_MEMORY | 0x25) -#define PERFINFO_LOG_TYPE_INSERTINLIST (EVENT_TRACE_GROUP_MEMORY | 0x26) -#define PERFINFO_LOG_TYPE_INSERTATFRONT (EVENT_TRACE_GROUP_MEMORY | 0x28) -#define PERFINFO_LOG_TYPE_UNLINKFROMSTANDBY (EVENT_TRACE_GROUP_MEMORY | 0x29) -#define PERFINFO_LOG_TYPE_UNLINKFFREEORZERO (EVENT_TRACE_GROUP_MEMORY | 0x2a) -#define PERFINFO_LOG_TYPE_WORKINGSETMANAGER (EVENT_TRACE_GROUP_MEMORY | 0x2b) -#define PERFINFO_LOG_TYPE_TRIMPROCESS (EVENT_TRACE_GROUP_MEMORY | 0x2c) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x2d) -#define PERFINFO_LOG_TYPE_ZEROSHARECOUNT (EVENT_TRACE_GROUP_MEMORY | 0x2e) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x2f) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x30) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x31) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x32) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x33) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x34) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x35) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x36) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x37) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x38) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x39) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x3a) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x3b) -#define PERFINFO_LOG_TYPE_WSINFOPROCESS (EVENT_TRACE_GROUP_MEMORY | 0x3c) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x3d) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x3e) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x3f) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x40) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x41) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x42) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x43) -// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x44) -#define PERFINFO_LOG_TYPE_FAULTADDR_WITH_IP (EVENT_TRACE_GROUP_MEMORY | 0x45) -#define PERFINFO_LOG_TYPE_TRIMSESSION (EVENT_TRACE_GROUP_MEMORY | 0x46) -#define PERFINFO_LOG_TYPE_MEMORYSNAPLITE (EVENT_TRACE_GROUP_MEMORY | 0x47) -#define PERFINFO_LOG_TYPE_PFMAPPED_SECTION_RUNDOWN (EVENT_TRACE_GROUP_MEMORY | 0x48) -#define PERFINFO_LOG_TYPE_PFMAPPED_SECTION_CREATE (EVENT_TRACE_GROUP_MEMORY | 0x49) -#define PERFINFO_LOG_TYPE_WSINFOSESSION (EVENT_TRACE_GROUP_MEMORY | 0x4a) -#define PERFINFO_LOG_TYPE_CREATE_SESSION (EVENT_TRACE_GROUP_MEMORY | 0x4b) -#define PERFINFO_LOG_TYPE_SESSION_RUNDOWN_DC_END (EVENT_TRACE_GROUP_MEMORY | 0x4c) -#define PERFINFO_LOG_TYPE_SESSION_RUNDOWN_DC_START (EVENT_TRACE_GROUP_MEMORY | 0x4d) -#define PERFINFO_LOG_TYPE_SESSION_DELETE (EVENT_TRACE_GROUP_MEMORY | 0x4e) -#define PERFINFO_LOG_TYPE_PFMAPPED_SECTION_DELETE (EVENT_TRACE_GROUP_MEMORY | 0x4f) - -#define PERFINFO_LOG_TYPE_VIRTUAL_ALLOC (EVENT_TRACE_GROUP_MEMORY | 0x62) -#define PERFINFO_LOG_TYPE_VIRTUAL_FREE (EVENT_TRACE_GROUP_MEMORY | 0x63) -#define PERFINFO_LOG_TYPE_HEAP_RANGE_RUNDOWN (EVENT_TRACE_GROUP_MEMORY | 0x64) -#define PERFINFO_LOG_TYPE_HEAP_RANGE_CREATE (EVENT_TRACE_GROUP_MEMORY | 0x65) -#define PERFINFO_LOG_TYPE_HEAP_RANGE_RESERVE (EVENT_TRACE_GROUP_MEMORY | 0x66) -#define PERFINFO_LOG_TYPE_HEAP_RANGE_RELEASE (EVENT_TRACE_GROUP_MEMORY | 0x67) -#define PERFINFO_LOG_TYPE_HEAP_RANGE_DESTROY (EVENT_TRACE_GROUP_MEMORY | 0x68) - -#define PERFINFO_LOG_TYPE_PAGEFILE_BACK (EVENT_TRACE_GROUP_MEMORY | 0x69) -#define PERFINFO_LOG_TYPE_MEMINFO (EVENT_TRACE_GROUP_MEMORY | 0x70) -#define PERFINFO_LOG_TYPE_CONTMEM_GENERATE (EVENT_TRACE_GROUP_MEMORY | 0x71) -#define PERFINFO_LOG_TYPE_FILE_STORE_FAULT (EVENT_TRACE_GROUP_MEMORY | 0x72) -#define PERFINFO_LOG_TYPE_INMEMORY_STORE_FAULT (EVENT_TRACE_GROUP_MEMORY | 0x73) -#define PERFINFO_LOG_TYPE_COMPRESSED_PAGE (EVENT_TRACE_GROUP_MEMORY | 0x74) -#define PERFINFO_LOG_TYPE_PAGEINMEMORY_ACTIVE (EVENT_TRACE_GROUP_MEMORY | 0x75) -#define PERFINFO_LOG_TYPE_PAGE_ACCESS (EVENT_TRACE_GROUP_MEMORY | 0x76) -#define PERFINFO_LOG_TYPE_PAGE_RELEASE (EVENT_TRACE_GROUP_MEMORY | 0x77) -#define PERFINFO_LOG_TYPE_PAGE_RANGE_ACCESS (EVENT_TRACE_GROUP_MEMORY | 0x78) -#define PERFINFO_LOG_TYPE_PAGE_RANGE_RELEASE (EVENT_TRACE_GROUP_MEMORY | 0x79) -#define PERFINFO_LOG_TYPE_PAGE_COMBINE (EVENT_TRACE_GROUP_MEMORY | 0x7a) -#define PERFINFO_LOG_TYPE_KERNEL_MEMUSAGE (EVENT_TRACE_GROUP_MEMORY | 0x7b) -#define PERFINFO_LOG_TYPE_MM_STATS (EVENT_TRACE_GROUP_MEMORY | 0x7c) -#define PERFINFO_LOG_TYPE_MEMINFOEX_WS (EVENT_TRACE_GROUP_MEMORY | 0x7d) -#define PERFINFO_LOG_TYPE_MEMINFOEX_SESSIONWS (EVENT_TRACE_GROUP_MEMORY | 0x7e) - -#define PERFINFO_LOG_TYPE_VIRTUAL_ROTATE (EVENT_TRACE_GROUP_MEMORY | 0x7f) -#define PERFINFO_LOG_TYPE_VIRTUAL_ALLOC_DC_START (EVENT_TRACE_GROUP_MEMORY | 0x80) -#define PERFINFO_LOG_TYPE_VIRTUAL_ALLOC_DC_END (EVENT_TRACE_GROUP_MEMORY | 0x81) - -#define PERFINFO_LOG_TYPE_PAGE_ACCESS_EX (EVENT_TRACE_GROUP_MEMORY | 0x82) -#define PERFINFO_LOG_TYPE_REMOVEFROMWS (EVENT_TRACE_GROUP_MEMORY | 0x83) -#define PERFINFO_LOG_TYPE_WSSHAREABLE_RUNDOWN (EVENT_TRACE_GROUP_MEMORY | 0x84) -#define PERFINFO_LOG_TYPE_INMEMORYACTIVE_RUNDOWN (EVENT_TRACE_GROUP_MEMORY | 0x85) - -#define PERFINFO_LOG_TYPE_MEM_RESET_INFO (EVENT_TRACE_GROUP_MEMORY | 0x86) -#define PERFINFO_LOG_TYPE_PFMAPPED_SECTION_OBJECT_CREATE (EVENT_TRACE_GROUP_MEMORY | 0x87) -#define PERFINFO_LOG_TYPE_PFMAPPED_SECTION_OBJECT_DELETE (EVENT_TRACE_GROUP_MEMORY | 0x88) - -// -// -// Event types for Registry subsystem -// -#define WMI_LOG_TYPE_REG_RUNDOWNBEGIN (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGKCBRUNDOWNBEGIN) -#define WMI_LOG_TYPE_REG_RUNDOWNEND (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGKCBRUNDOWNEND) - -#define PERFINFO_LOG_TYPE_CMCELLREFERRED (EVENT_TRACE_GROUP_REGISTRY | 0x20) -#define PERFINFO_LOG_TYPE_REG_SET_VALUE (EVENT_TRACE_GROUP_REGISTRY | 0x21) -#define PERFINFO_LOG_TYPE_REG_COUNTERS (EVENT_TRACE_GROUP_REGISTRY | 0x22) -#define PERFINFO_LOG_TYPE_REG_CONFIG (EVENT_TRACE_GROUP_REGISTRY | 0x23) -#define PERFINFO_LOG_TYPE_REG_HIVE_INITIALIZE (EVENT_TRACE_GROUP_REGISTRY | 0x24) -#define PERFINFO_LOG_TYPE_REG_HIVE_DESTROY (EVENT_TRACE_GROUP_REGISTRY | 0x25) -#define PERFINFO_LOG_TYPE_REG_HIVE_LINK (EVENT_TRACE_GROUP_REGISTRY | 0x26) -#define PERFINFO_LOG_TYPE_REG_HIVE_RUNDOWN_DC_END (EVENT_TRACE_GROUP_REGISTRY | 0x27) -#define PERFINFO_LOG_TYPE_REG_HIVE_DIRTY (EVENT_TRACE_GROUP_REGISTRY | 0x28) -// Reserved -#define PERFINFO_LOG_TYPE_REG_NOTIF_REGISTER (EVENT_TRACE_GROUP_REGISTRY | 0x30) -#define PERFINFO_LOG_TYPE_REG_NOTIF_DELIVER (EVENT_TRACE_GROUP_REGISTRY | 0x31) - -// -// Event types for PERF tracing specific subsystem -// -#define PERFINFO_LOG_TYPE_RUNDOWN_CHECKPOINT (EVENT_TRACE_GROUP_PERFINFO | 0x20) -// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x21) -#define PERFINFO_LOG_TYPE_MARK (EVENT_TRACE_GROUP_PERFINFO | 0x22) -// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x23) -#define PERFINFO_LOG_TYPE_ASYNCMARK (EVENT_TRACE_GROUP_PERFINFO | 0x24) -// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x25) -#define PERFINFO_LOG_TYPE_IMAGENAME (EVENT_TRACE_GROUP_PERFINFO | 0x26) -#define PERFINFO_LOG_TYPE_DELAYS_CC_CAN_I_WRITE (EVENT_TRACE_GROUP_PERFINFO | 0x27) -// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x28) -// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x29) -// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x2a) -// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x2b) -// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x2c) -// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x2d) -#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE (EVENT_TRACE_GROUP_PERFINFO | 0x2e) -#define PERFINFO_LOG_TYPE_PMC_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x2f) -#define PERFINFO_LOG_TYPE_PMC_CONFIG (EVENT_TRACE_GROUP_PERFINFO | 0x30) -// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x31) -#define PERFINFO_LOG_TYPE_MSI_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x32) -#define PERFINFO_LOG_TYPE_SYSCALL_ENTER (EVENT_TRACE_GROUP_PERFINFO | 0x33) -#define PERFINFO_LOG_TYPE_SYSCALL_EXIT (EVENT_TRACE_GROUP_PERFINFO | 0x34) -#define PERFINFO_LOG_TYPE_BACKTRACE (EVENT_TRACE_GROUP_PERFINFO | 0x35) -#define PERFINFO_LOG_TYPE_BACKTRACE_USERSTACK (EVENT_TRACE_GROUP_PERFINFO | 0x36) -#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE_CACHE (EVENT_TRACE_GROUP_PERFINFO | 0x37) -#define PERFINFO_LOG_TYPE_EXCEPTION_STACK (EVENT_TRACE_GROUP_PERFINFO | 0x38) -#define PERFINFO_LOG_TYPE_BRANCH_TRACE (EVENT_TRACE_GROUP_PERFINFO | 0x39) -#define PERFINFO_LOG_TYPE_DEBUGGER_ENABLED (EVENT_TRACE_GROUP_PERFINFO | 0x3a) -#define PERFINFO_LOG_TYPE_DEBUGGER_EXIT (EVENT_TRACE_GROUP_PERFINFO | 0x3b) -#define PERFINFO_LOG_TYPE_BRANCH_TRACE_DEBUG (EVENT_TRACE_GROUP_PERFINFO | 0x40) -#define PERFINFO_LOG_TYPE_BRANCH_ADDRESS_DEBUG (EVENT_TRACE_GROUP_PERFINFO | 0x41) -#define PERFINFO_LOG_TYPE_THREADED_DPC (EVENT_TRACE_GROUP_PERFINFO | 0x42) -#define PERFINFO_LOG_TYPE_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x43) -#define PERFINFO_LOG_TYPE_DPC (EVENT_TRACE_GROUP_PERFINFO | 0x44) -#define PERFINFO_LOG_TYPE_TIMERDPC (EVENT_TRACE_GROUP_PERFINFO | 0x45) -#define PERFINFO_LOG_TYPE_IOTIMER_EXPIRATION (EVENT_TRACE_GROUP_PERFINFO | 0x46) -#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE_NMI (EVENT_TRACE_GROUP_PERFINFO | 0x47) -#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE_SET_INTERVAL (EVENT_TRACE_GROUP_PERFINFO | 0x48) -#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE_DC_START (EVENT_TRACE_GROUP_PERFINFO | 0x49) -#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE_DC_END (EVENT_TRACE_GROUP_PERFINFO | 0x4a) -#define PERFINFO_LOG_TYPE_SPINLOCK_DC_START (EVENT_TRACE_GROUP_PERFINFO | 0x4b) -#define PERFINFO_LOG_TYPE_SPINLOCK_DC_END (EVENT_TRACE_GROUP_PERFINFO | 0x4c) -#define PERFINFO_LOG_TYPE_ERESOURCE_DC_START (EVENT_TRACE_GROUP_PERFINFO | 0x4d) -#define PERFINFO_LOG_TYPE_ERESOURCE_DC_END (EVENT_TRACE_GROUP_PERFINFO | 0x4e) -#define PERFINFO_LOG_TYPE_CLOCK_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x4f) -#define PERFINFO_LOG_TYPE_TIMER_EXPIRATION_START (EVENT_TRACE_GROUP_PERFINFO | 0x50) -#define PERFINFO_LOG_TYPE_TIMER_EXPIRATION (EVENT_TRACE_GROUP_PERFINFO | 0x51) -#define PERFINFO_LOG_TYPE_TIMER_SET_PERIODIC (EVENT_TRACE_GROUP_PERFINFO | 0x52) -#define PERFINFO_LOG_TYPE_TIMER_SET_ONE_SHOT (EVENT_TRACE_GROUP_PERFINFO | 0x53) -#define PERFINFO_LOG_TYPE_TIMER_SET_THREAD (EVENT_TRACE_GROUP_PERFINFO | 0x54) -#define PERFINFO_LOG_TYPE_TIMER_CANCEL (EVENT_TRACE_GROUP_PERFINFO | 0x55) -#define PERFINFO_LOG_TYPE_TIME_ADJUSTMENT (EVENT_TRACE_GROUP_PERFINFO | 0x56) -#define PERFINFO_LOG_TYPE_CLOCK_MODE_SWITCH (EVENT_TRACE_GROUP_PERFINFO | 0x57) -#define PERFINFO_LOG_TYPE_CLOCK_TIME_UPDATE (EVENT_TRACE_GROUP_PERFINFO | 0x58) -#define PERFINFO_LOG_TYPE_CLOCK_DYNAMIC_TICK_VETO (EVENT_TRACE_GROUP_PERFINFO | 0x59) -#define PERFINFO_LOG_TYPE_CLOCK_CONFIGURATION (EVENT_TRACE_GROUP_PERFINFO | 0x5a) -#define PERFINFO_LOG_TYPE_IPI (EVENT_TRACE_GROUP_PERFINFO | 0x5b) -#define PERFINFO_LOG_TYPE_UNEXPECTED_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x5c) -#define PERFINFO_LOG_TYPE_IOTIMER_START (EVENT_TRACE_GROUP_PERFINFO | 0x5d) -#define PERFINFO_LOG_TYPE_IOTIMER_STOP (EVENT_TRACE_GROUP_PERFINFO | 0x5e) -#define PERFINFO_LOG_TYPE_PASSIVE_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x5f) -#define PERFINFO_LOG_TYPE_WDF_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x60) -#define PERFINFO_LOG_TYPE_WDF_PASSIVE_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x61) -#define PERFINFO_LOG_TYPE_WDF_DPC (EVENT_TRACE_GROUP_PERFINFO | 0x62) -#define PERFINFO_LOG_TYPE_CPU_CACHE_FLUSH (EVENT_TRACE_GROUP_PERFINFO | 0x63) -#define PERFINFO_LOG_TYPE_DPC_ENQUEUE (EVENT_TRACE_GROUP_PERFINFO | 0x64) -#define PERFINFO_LOG_TYPE_DPC_EXECUTION (EVENT_TRACE_GROUP_PERFINFO | 0x65) -#define PERFINFO_LOG_TYPE_INTERRUPT_STEERING (EVENT_TRACE_GROUP_PERFINFO | 0x66) -#define PERFINFO_LOG_TYPE_WDF_WORK_ITEM (EVENT_TRACE_GROUP_PERFINFO | 0x67) -#define PERFINFO_LOG_TYPE_KTIMER2_SET (EVENT_TRACE_GROUP_PERFINFO | 0x68) -#define PERFINFO_LOG_TYPE_KTIMER2_EXPIRATION (EVENT_TRACE_GROUP_PERFINFO | 0x69) -#define PERFINFO_LOG_TYPE_KTIMER2_CANCEL (EVENT_TRACE_GROUP_PERFINFO | 0x6a) -#define PERFINFO_LOG_TYPE_KTIMER2_DISABLE (EVENT_TRACE_GROUP_PERFINFO | 0x6b) -#define PERFINFO_LOG_TYPE_KTIMER2_FINALIZATION (EVENT_TRACE_GROUP_PERFINFO | 0x6c) -#define PERFINFO_LOG_TYPE_SHOULD_YIELD_PROCESSOR (EVENT_TRACE_GROUP_PERFINFO | 0x6d) - -// -// Event types for ICE. -// - -#define PERFINFO_LOG_TYPE_FUNCTION_CALL (EVENT_TRACE_GROUP_PERFINFO | 0x80) -#define PERFINFO_LOG_TYPE_FUNCTION_RETURN (EVENT_TRACE_GROUP_PERFINFO | 0x81) -#define PERFINFO_LOG_TYPE_FUNCTION_ENTER (EVENT_TRACE_GROUP_PERFINFO | 0x82) -#define PERFINFO_LOG_TYPE_FUNCTION_EXIT (EVENT_TRACE_GROUP_PERFINFO | 0x83) -#define PERFINFO_LOG_TYPE_TAILCALL (EVENT_TRACE_GROUP_PERFINFO | 0x84) -#define PERFINFO_LOG_TYPE_TRAP (EVENT_TRACE_GROUP_PERFINFO | 0x85) -#define PERFINFO_LOG_TYPE_SPINLOCK_ACQUIRE (EVENT_TRACE_GROUP_PERFINFO | 0x86) -#define PERFINFO_LOG_TYPE_SPINLOCK_RELEASE (EVENT_TRACE_GROUP_PERFINFO | 0x87) -#define PERFINFO_LOG_TYPE_CAP_COMMENT (EVENT_TRACE_GROUP_PERFINFO | 0x88) -#define PERFINFO_LOG_TYPE_CAP_RUNDOWN (EVENT_TRACE_GROUP_PERFINFO | 0x89) - -// -// Event types for Debugger subsystem. -// - -#define PERFINFO_LOG_TYPE_DEBUG_PRINT (EVENT_TRACE_GROUP_DBGPRINT | 0x20) - -// -// Event types for WNF facility -// - -#define PERFINFO_LOG_TYPE_WNF_SUBSCRIBE (EVENT_TRACE_GROUP_WNF | 0x20) -#define PERFINFO_LOG_TYPE_WNF_UNSUBSCRIBE (EVENT_TRACE_GROUP_WNF | 0x21) -#define PERFINFO_LOG_TYPE_WNF_CALLBACK (EVENT_TRACE_GROUP_WNF | 0x22) -#define PERFINFO_LOG_TYPE_WNF_PUBLISH (EVENT_TRACE_GROUP_WNF | 0x23) -#define PERFINFO_LOG_TYPE_WNF_NAME_SUB_RUNDOWN (EVENT_TRACE_GROUP_WNF | 0x24) - -// -// Event types for Pool subsystem. -// - -#define PERFINFO_LOG_TYPE_ALLOCATEPOOL (EVENT_TRACE_GROUP_POOL | 0x20) -#define PERFINFO_LOG_TYPE_ALLOCATEPOOL_SESSION (EVENT_TRACE_GROUP_POOL | 0x21) -#define PERFINFO_LOG_TYPE_FREEPOOL (EVENT_TRACE_GROUP_POOL | 0x22) -#define PERFINFO_LOG_TYPE_FREEPOOL_SESSION (EVENT_TRACE_GROUP_POOL | 0x23) -#define PERFINFO_LOG_TYPE_ADDPOOLPAGE (EVENT_TRACE_GROUP_POOL | 0x24) -#define PERFINFO_LOG_TYPE_ADDPOOLPAGE_SESSION (EVENT_TRACE_GROUP_POOL | 0x25) -#define PERFINFO_LOG_TYPE_BIGPOOLPAGE (EVENT_TRACE_GROUP_POOL | 0x26) -#define PERFINFO_LOG_TYPE_BIGPOOLPAGE_SESSION (EVENT_TRACE_GROUP_POOL | 0x27) -#define PERFINFO_LOG_TYPE_POOLSNAP_DC_START (EVENT_TRACE_GROUP_POOL | 0x28) -#define PERFINFO_LOG_TYPE_POOLSNAP_DC_END (EVENT_TRACE_GROUP_POOL | 0x29) -#define PERFINFO_LOG_TYPE_BIGPOOLSNAP_DC_START (EVENT_TRACE_GROUP_POOL | 0x2a) -#define PERFINFO_LOG_TYPE_BIGPOOLSNAP_DC_END (EVENT_TRACE_GROUP_POOL | 0x2b) -#define PERFINFO_LOG_TYPE_POOLSNAP_SESSION_DC_START (EVENT_TRACE_GROUP_POOL | 0x2c) -#define PERFINFO_LOG_TYPE_POOLSNAP_SESSION_DC_END (EVENT_TRACE_GROUP_POOL | 0x2d) -#define PERFINFO_LOG_TYPE_SESSIONBIGPOOLSNAP_DC_START (EVENT_TRACE_GROUP_POOL | 0x2e) -#define PERFINFO_LOG_TYPE_SESSIONBIGPOOLSNAP_DC_END (EVENT_TRACE_GROUP_POOL | 0x2f) - -// -// Event types for Heap subsystem -// -#define PERFINFO_LOG_TYPE_HEAP_CREATE (EVENT_TRACE_GROUP_HEAP | 0x20) -#define PERFINFO_LOG_TYPE_HEAP_ALLOC (EVENT_TRACE_GROUP_HEAP | 0x21) -#define PERFINFO_LOG_TYPE_HEAP_REALLOC (EVENT_TRACE_GROUP_HEAP | 0x22) -#define PERFINFO_LOG_TYPE_HEAP_DESTROY (EVENT_TRACE_GROUP_HEAP | 0x23) -#define PERFINFO_LOG_TYPE_HEAP_FREE (EVENT_TRACE_GROUP_HEAP | 0x24) -#define PERFINFO_LOG_TYPE_HEAP_EXTEND (EVENT_TRACE_GROUP_HEAP | 0x25) -#define PERFINFO_LOG_TYPE_HEAP_SNAPSHOT (EVENT_TRACE_GROUP_HEAP | 0x26) -#define PERFINFO_LOG_TYPE_HEAP_CREATE_SNAPSHOT (EVENT_TRACE_GROUP_HEAP | 0x27) -#define PERFINFO_LOG_TYPE_HEAP_DESTROY_SNAPSHOT (EVENT_TRACE_GROUP_HEAP | 0x28) -#define PERFINFO_LOG_TYPE_HEAP_EXTEND_SNAPSHOT (EVENT_TRACE_GROUP_HEAP | 0x29) -#define PERFINFO_LOG_TYPE_HEAP_CONTRACT (EVENT_TRACE_GROUP_HEAP | 0x2a) -#define PERFINFO_LOG_TYPE_HEAP_LOCK (EVENT_TRACE_GROUP_HEAP | 0x2b) -#define PERFINFO_LOG_TYPE_HEAP_UNLOCK (EVENT_TRACE_GROUP_HEAP | 0x2c) -#define PERFINFO_LOG_TYPE_HEAP_VALIDATE (EVENT_TRACE_GROUP_HEAP | 0x2d) -#define PERFINFO_LOG_TYPE_HEAP_WALK (EVENT_TRACE_GROUP_HEAP | 0x2e) - -#define PERFINFO_LOG_TYPE_HEAP_SUBSEGMENT_ALLOC (EVENT_TRACE_GROUP_HEAP | 0x2f) -#define PERFINFO_LOG_TYPE_HEAP_SUBSEGMENT_FREE (EVENT_TRACE_GROUP_HEAP | 0x30) -#define PERFINFO_LOG_TYPE_HEAP_SUBSEGMENT_ALLOC_CACHE (EVENT_TRACE_GROUP_HEAP | 0x31) -#define PERFINFO_LOG_TYPE_HEAP_SUBSEGMENT_FREE_CACHE (EVENT_TRACE_GROUP_HEAP | 0x32) -#define PERFINFO_LOG_TYPE_HEAP_COMMIT (EVENT_TRACE_GROUP_HEAP | 0x33) -#define PERFINFO_LOG_TYPE_HEAP_DECOMMIT (EVENT_TRACE_GROUP_HEAP | 0x34) -#define PERFINFO_LOG_TYPE_HEAP_SUBSEGMENT_INIT (EVENT_TRACE_GROUP_HEAP | 0x35) -#define PERFINFO_LOG_TYPE_HEAP_AFFINITY_ENABLE (EVENT_TRACE_GROUP_HEAP | 0x36) -//Reserved (EVENT_TRACE_GROUP_HEAP | 0x37) -#define PERFINFO_LOG_TYPE_HEAP_SUBSEGMENT_ACTIVATED (EVENT_TRACE_GROUP_HEAP | 0x38) -#define PERFINFO_LOG_TYPE_HEAP_AFFINITY_ASSIGN (EVENT_TRACE_GROUP_HEAP | 0x39) -#define PERFINFO_LOG_TYPE_HEAP_REUSE_THRESHOLD_ACTIVATED (EVENT_TRACE_GROUP_HEAP | 0x3a) - -// -// Event Types for Critical Section Subsystem -// - -#define PERFINFO_LOG_TYPE_CRITSEC_ENTER (EVENT_TRACE_GROUP_CRITSEC | 0x20) -#define PERFINFO_LOG_TYPE_CRITSEC_LEAVE (EVENT_TRACE_GROUP_CRITSEC | 0x21) -#define PERFINFO_LOG_TYPE_CRITSEC_COLLISION (EVENT_TRACE_GROUP_CRITSEC | 0x22) -#define PERFINFO_LOG_TYPE_CRITSEC_INITIALIZE (EVENT_TRACE_GROUP_CRITSEC | 0x23) - -// -// Event types for Stackwalk subsystem -// - -#define PERFINFO_LOG_TYPE_STACKWALK (EVENT_TRACE_GROUP_STACKWALK | 0x20) -//Reserved (EVENT_TRACE_GROUP_STACKWALK | 0x21) -#define PERFINFO_LOG_TYPE_STACKTRACE_CREATE (EVENT_TRACE_GROUP_STACKWALK | 0x22) -#define PERFINFO_LOG_TYPE_STACKTRACE_DELETE (EVENT_TRACE_GROUP_STACKWALK | 0x23) -#define PERFINFO_LOG_TYPE_STACKTRACE_RUNDOWN (EVENT_TRACE_GROUP_STACKWALK | 0x24) -#define PERFINFO_LOG_TYPE_STACKTRACE_KEY_KERNEL (EVENT_TRACE_GROUP_STACKWALK | 0x25) -#define PERFINFO_LOG_TYPE_STACKTRACE_KEY_USER (EVENT_TRACE_GROUP_STACKWALK | 0x26) - -// -// Event types for ALPC -// - -#define WMI_LOG_TYPE_ALPC_SEND_MESSAGE (EVENT_TRACE_GROUP_ALPC | 0x21) -#define WMI_LOG_TYPE_ALPC_RECEIVE_MESSAGE (EVENT_TRACE_GROUP_ALPC | 0x22) -#define WMI_LOG_TYPE_ALPC_WAIT_FOR_REPLY (EVENT_TRACE_GROUP_ALPC | 0x23) -#define WMI_LOG_TYPE_ALPC_WAIT_FOR_NEW_MESSAGE (EVENT_TRACE_GROUP_ALPC | 0x24) -#define WMI_LOG_TYPE_ALPC_UNWAIT (EVENT_TRACE_GROUP_ALPC | 0x25) -#define WMI_LOG_TYPE_ALPC_CONNECT_REQUEST (EVENT_TRACE_GROUP_ALPC | 0x26) -#define WMI_LOG_TYPE_ALPC_CONNECT_SUCCESS (EVENT_TRACE_GROUP_ALPC | 0x27) -#define WMI_LOG_TYPE_ALPC_CONNECT_FAIL (EVENT_TRACE_GROUP_ALPC | 0x28) -#define WMI_LOG_TYPE_ALPC_CLOSE_PORT (EVENT_TRACE_GROUP_ALPC | 0x29) - - -// -// Event types for Object Manager subsystem -// - -#define PERFINFO_LOG_TYPE_CREATE_HANDLE (EVENT_TRACE_GROUP_OBJECT | 0x20) -#define PERFINFO_LOG_TYPE_CLOSE_HANDLE (EVENT_TRACE_GROUP_OBJECT | 0x21) -#define PERFINFO_LOG_TYPE_DUPLICATE_HANDLE (EVENT_TRACE_GROUP_OBJECT | 0x22) -//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x23) -#define PERFINFO_LOG_TYPE_OBJECT_TYPE_DC_START (EVENT_TRACE_GROUP_OBJECT | 0x24) -#define PERFINFO_LOG_TYPE_OBJECT_TYPE_DC_END (EVENT_TRACE_GROUP_OBJECT | 0x25) -#define PERFINFO_LOG_TYPE_OBJECT_HANDLE_DC_START (EVENT_TRACE_GROUP_OBJECT | 0x26) -#define PERFINFO_LOG_TYPE_OBJECT_HANDLE_DC_END (EVENT_TRACE_GROUP_OBJECT | 0x27) -//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x28) -//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x29) -//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x2a) -//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x2b) -//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x2c) -//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x2d) -//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x2e) -//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x2f) -#define PERFINFO_LOG_TYPE_CREATE_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x30) -#define PERFINFO_LOG_TYPE_DELETE_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x31) -#define PERFINFO_LOG_TYPE_REFERENCE_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x32) -#define PERFINFO_LOG_TYPE_DEREFERENCE_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x33) - -// -// Event types for Power subsystem -// - -#define PERFINFO_LOG_TYPE_BATTERY_LIFE_INFO (EVENT_TRACE_GROUP_POWER | 0x20) -#define PERFINFO_LOG_TYPE_IDLE_STATE_CHANGE (EVENT_TRACE_GROUP_POWER | 0x21) -#define PERFINFO_LOG_TYPE_SET_POWER_ACTION (EVENT_TRACE_GROUP_POWER | 0x22) -#define PERFINFO_LOG_TYPE_SET_POWER_ACTION_RET (EVENT_TRACE_GROUP_POWER | 0x23) -#define PERFINFO_LOG_TYPE_SET_DEVICES_STATE (EVENT_TRACE_GROUP_POWER | 0x24) -#define PERFINFO_LOG_TYPE_SET_DEVICES_STATE_RET (EVENT_TRACE_GROUP_POWER | 0x25) -#define PERFINFO_LOG_TYPE_PO_NOTIFY_DEVICE (EVENT_TRACE_GROUP_POWER | 0x26) -#define PERFINFO_LOG_TYPE_PO_NOTIFY_DEVICE_COMPLETE (EVENT_TRACE_GROUP_POWER | 0x27) -#define PERFINFO_LOG_TYPE_PO_SESSION_CALLOUT (EVENT_TRACE_GROUP_POWER | 0x28) -#define PERFINFO_LOG_TYPE_PO_SESSION_CALLOUT_RET (EVENT_TRACE_GROUP_POWER | 0x29) -#define PERFINFO_LOG_TYPE_PO_PRESLEEP (EVENT_TRACE_GROUP_POWER | 0x30) -#define PERFINFO_LOG_TYPE_PO_POSTSLEEP (EVENT_TRACE_GROUP_POWER | 0x31) -#define PERFINFO_LOG_TYPE_PO_CALIBRATED_PERFCOUNTER (EVENT_TRACE_GROUP_POWER | 0x32) -#define PERFINFO_LOG_TYPE_PPM_PERF_STATE_CHANGE (EVENT_TRACE_GROUP_POWER | 0x33) -#define PERFINFO_LOG_TYPE_PPM_THROTTLE_STATE_CHANGE (EVENT_TRACE_GROUP_POWER | 0x34) -#define PERFINFO_LOG_TYPE_PPM_IDLE_STATE_CHANGE (EVENT_TRACE_GROUP_POWER | 0x35) -#define PERFINFO_LOG_TYPE_PPM_THERMAL_CONSTRAINT (EVENT_TRACE_GROUP_POWER | 0x36) -#define PERFINFO_LOG_TYPE_PO_SIGNAL_RESUME_UI (EVENT_TRACE_GROUP_POWER | 0x37) -#define PERFINFO_LOG_TYPE_PO_SIGNAL_VIDEO_ON (EVENT_TRACE_GROUP_POWER | 0x38) -#define PERFINFO_LOG_TYPE_PPM_IDLE_STATE_ENTER (EVENT_TRACE_GROUP_POWER | 0x39) -#define PERFINFO_LOG_TYPE_PPM_IDLE_STATE_EXIT (EVENT_TRACE_GROUP_POWER | 0x3a) -#define PERFINFO_LOG_TYPE_PPM_PLATFORM_IDLE_STATE_ENTER (EVENT_TRACE_GROUP_POWER | 0x3b) -#define PERFINFO_LOG_TYPE_PPM_IDLE_EXIT_LATENCY (EVENT_TRACE_GROUP_POWER | 0x3c) -#define PERFINFO_LOG_TYPE_PPM_IDLE_PROCESSOR_SELECTION (EVENT_TRACE_GROUP_POWER | 0x3d) -#define PERFINFO_LOG_TYPE_PPM_IDLE_PLATFORM_SELECTION (EVENT_TRACE_GROUP_POWER | 0x3e) -#define PERFINFO_LOG_TYPE_PPM_COORDINATED_IDLE_ENTER (EVENT_TRACE_GROUP_POWER | 0x3f) -#define PERFINFO_LOG_TYPE_PPM_COORDINATED_IDLE_EXIT (EVENT_TRACE_GROUP_POWER | 0x40) - -// -// Event types for MODBound subsystem -// -#define PERFINFO_LOG_TYPE_COWHEADER (EVENT_TRACE_GROUP_MODBOUND | 0x18) -#define PERFINFO_LOG_TYPE_COWBLOB (EVENT_TRACE_GROUP_MODBOUND | 0x19) -#define PERFINFO_LOG_TYPE_COWBLOB_CLOSED (EVENT_TRACE_GROUP_MODBOUND | 0x1a) -#define PERFINFO_LOG_TYPE_MODULEBOUND_ENT (EVENT_TRACE_GROUP_MODBOUND | 0x20) -#define PERFINFO_LOG_TYPE_MODULEBOUND_JUMP (EVENT_TRACE_GROUP_MODBOUND | 0x21) -#define PERFINFO_LOG_TYPE_MODULEBOUND_RET (EVENT_TRACE_GROUP_MODBOUND | 0x22) -#define PERFINFO_LOG_TYPE_MODULEBOUND_CALL (EVENT_TRACE_GROUP_MODBOUND | 0x23) -#define PERFINFO_LOG_TYPE_MODULEBOUND_CALLRET (EVENT_TRACE_GROUP_MODBOUND | 0x24) -#define PERFINFO_LOG_TYPE_MODULEBOUND_INT2E (EVENT_TRACE_GROUP_MODBOUND | 0x25) -#define PERFINFO_LOG_TYPE_MODULEBOUND_INT2B (EVENT_TRACE_GROUP_MODBOUND | 0x26) -#define PERFINFO_LOG_TYPE_MODULEBOUND_FULLTRACE (EVENT_TRACE_GROUP_MODBOUND | 0x27) - -// -// Event types for the thread class scheduler -// -// TODO: Because MMCSS is a DLL it doesn't need to use UMGL. -// -#define PERFINFO_LOG_TYPE_MMCSS_START (0x20) -#define PERFINFO_LOG_TYPE_MMCSS_STOP (0x21) -#define PERFINFO_LOG_TYPE_MMCSS_SCHEDULER_EVENT (0x22) -#define PERFINFO_LOG_TYPE_MMCSS_SCHEDULER_WAKEUP (0x23) -#define PERFINFO_LOG_TYPE_MMCSS_SCHEDULER_SLEEP (0x24) -#define PERFINFO_LOG_TYPE_MMCSS_SCHEDULER_SLEEP_RESP (0x25) - - -// -// Event types for SplitIo -// - -#define PERFINFO_LOG_TYPE_SPLITIO_VOLMGR (EVENT_TRACE_GROUP_SPLITIO | 0x20) - -// Event types for ThreadPool -#define PERFINFO_LOG_TYPE_TP_CALLBACK_ENQUEUE (EVENT_TRACE_GROUP_THREAD_POOL | 0x20) -#define PERFINFO_LOG_TYPE_TP_CALLBACK_DEQUEUE (EVENT_TRACE_GROUP_THREAD_POOL | 0x21) -#define PERFINFO_LOG_TYPE_TP_CALLBACK_START (EVENT_TRACE_GROUP_THREAD_POOL | 0x22) -#define PERFINFO_LOG_TYPE_TP_CALLBACK_STOP (EVENT_TRACE_GROUP_THREAD_POOL | 0x23) -#define PERFINFO_LOG_TYPE_TP_CALLBACK_CANCEL (EVENT_TRACE_GROUP_THREAD_POOL | 0x24) -#define PERFINFO_LOG_TYPE_TP_POOL_CREATE (EVENT_TRACE_GROUP_THREAD_POOL | 0x25) -#define PERFINFO_LOG_TYPE_TP_POOL_CLOSE (EVENT_TRACE_GROUP_THREAD_POOL | 0x26) -#define PERFINFO_LOG_TYPE_TP_POOL_TH_MIN_SET (EVENT_TRACE_GROUP_THREAD_POOL | 0x27) -#define PERFINFO_LOG_TYPE_TP_POOL_TH_MAX_SET (EVENT_TRACE_GROUP_THREAD_POOL | 0x28) -#define PERFINFO_LOG_TYPE_TP_WORKER_NUMANODE_SWITCH (EVENT_TRACE_GROUP_THREAD_POOL | 0x29) -#define PERFINFO_LOG_TYPE_TP_TIMER_SET (EVENT_TRACE_GROUP_THREAD_POOL | 0x2a) -#define PERFINFO_LOG_TYPE_TP_TIMER_CANCELLED (EVENT_TRACE_GROUP_THREAD_POOL | 0x2b) -#define PERFINFO_LOG_TYPE_TP_TIMER_SET_NTTIMER (EVENT_TRACE_GROUP_THREAD_POOL | 0x2c) -#define PERFINFO_LOG_TYPE_TP_TIMER_CANCEL_NTTIMER (EVENT_TRACE_GROUP_THREAD_POOL | 0x2d) -#define PERFINFO_LOG_TYPE_TP_TIMER_EXPIRATION_BEGIN (EVENT_TRACE_GROUP_THREAD_POOL | 0x2e) -#define PERFINFO_LOG_TYPE_TP_TIMER_EXPIRATION_END (EVENT_TRACE_GROUP_THREAD_POOL | 0x2f) -#define PERFINFO_LOG_TYPE_TP_TIMER_EXPIRATION (EVENT_TRACE_GROUP_THREAD_POOL | 0x30) - -// Event types for UMS -#define PERFINFO_LOG_TYPE_UMS_DIRECTED_SWITCH_START (EVENT_TRACE_GROUP_UMS | 0x20) -#define PERFINFO_LOG_TYPE_UMS_DIRECTED_SWITCH_END (EVENT_TRACE_GROUP_UMS | 0x21) -#define PERFINFO_LOG_TYPE_UMS_PARK (EVENT_TRACE_GROUP_UMS | 0x22) -#define PERFINFO_LOG_TYPE_UMS_DISASSOCIATE (EVENT_TRACE_GROUP_UMS | 0x23) -#define PERFINFO_LOG_TYPE_UMS_CONTEXT_SWITCH (EVENT_TRACE_GROUP_UMS | 0x24) - -// Event types for Cache manager -#define PERFINFO_LOG_TYPE_CC_WORKITEM_ENQUEUE (EVENT_TRACE_GROUP_CC | 0x00) -#define PERFINFO_LOG_TYPE_CC_WORKITEM_DEQUEUE (EVENT_TRACE_GROUP_CC | 0x01) -#define PERFINFO_LOG_TYPE_CC_WORKITEM_COMPLETE (EVENT_TRACE_GROUP_CC | 0x02) -#define PERFINFO_LOG_TYPE_CC_READ_AHEAD (EVENT_TRACE_GROUP_CC | 0x03) -#define PERFINFO_LOG_TYPE_CC_WRITE_BEHIND (EVENT_TRACE_GROUP_CC | 0x04) -#define PERFINFO_LOG_TYPE_CC_LAZY_WRITE_SCAN (EVENT_TRACE_GROUP_CC | 0x05) -#define PERFINFO_LOG_TYPE_CC_CAN_I_WRITE_FAIL (EVENT_TRACE_GROUP_CC | 0x06) -//#define PERFINFO_LOG_TYPE_CC_MAP_VIEW (EVENT_TRACE_GROUP_CC | 0x07) -//#define PERFINFO_LOG_TYPE_CC_UNMAP_VIEW (EVENT_TRACE_GROUP_CC | 0x08) -#define PERFINFO_LOG_TYPE_CC_FLUSH_CACHE (EVENT_TRACE_GROUP_CC | 0x09) -#define PERFINFO_LOG_TYPE_CC_FLUSH_SECTION (EVENT_TRACE_GROUP_CC | 0x0a) -#define PERFINFO_LOG_TYPE_CC_READ_AHEAD_PREFETCH (EVENT_TRACE_GROUP_CC | 0x0b) -#define PERFINFO_LOG_TYPE_CC_SCHEDULE_READ_AHEAD (EVENT_TRACE_GROUP_CC | 0x0c) -#define PERFINFO_LOG_TYPE_CC_LOGGED_STREAM_INFO (EVENT_TRACE_GROUP_CC | 0x0d) -#define PERFINFO_LOG_TYPE_CC_EXTRA_WRITEBEHIND_THREAD (EVENT_TRACE_GROUP_CC | 0x0e) - -typedef ULONG PERFINFO_MASK; - -typedef struct _PERFINFO_GROUPMASK -{ - ULONG Masks[PERF_NUM_MASKS]; -} PERFINFO_GROUPMASK, *PPERFINFO_GROUPMASK; - -typedef struct _EVENT_TRACE_GROUPMASK_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - TRACEHANDLE TraceHandle; - PERFINFO_GROUPMASK EventTraceGroupMasks; -} EVENT_TRACE_GROUPMASK_INFORMATION, *PEVENT_TRACE_GROUPMASK_INFORMATION; - -typedef struct _EVENT_TRACE_PERFORMANCE_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - LARGE_INTEGER LogfileBytesWritten; -} EVENT_TRACE_PERFORMANCE_INFORMATION, *PEVENT_TRACE_PERFORMANCE_INFORMATION; - -typedef struct _EVENT_TRACE_TIME_PROFILE_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - ULONG ProfileInterval; -} EVENT_TRACE_TIME_PROFILE_INFORMATION, *PEVENT_TRACE_TIME_PROFILE_INFORMATION; - -typedef struct _EVENT_TRACE_SESSION_SECURITY_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - ULONG SecurityInformation; - TRACEHANDLE TraceHandle; - UCHAR SecurityDescriptor[1]; -} EVENT_TRACE_SESSION_SECURITY_INFORMATION, *PEVENT_TRACE_SESSION_SECURITY_INFORMATION; - -typedef struct _EVENT_TRACE_SPINLOCK_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - ULONG SpinLockSpinThreshold; - ULONG SpinLockAcquireSampleRate; - ULONG SpinLockContentionSampleRate; - ULONG SpinLockHoldThreshold; -} EVENT_TRACE_SPINLOCK_INFORMATION, *PEVENT_TRACE_SPINLOCK_INFORMATION; - -typedef struct _EVENT_TRACE_SYSTEM_EVENT_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - TRACEHANDLE TraceHandle; - ULONG HookId[1]; -} EVENT_TRACE_SYSTEM_EVENT_INFORMATION, *PEVENT_TRACE_SYSTEM_EVENT_INFORMATION; - -typedef struct _EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - ULONG ReleaseSamplingRate; - ULONG ContentionSamplingRate; - ULONG NumberOfExcessiveTimeouts; -} EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION, *PEVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION; - -typedef struct _EVENT_TRACE_HEAP_TRACING_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - ULONG ProcessId[1]; -} EVENT_TRACE_HEAP_TRACING_INFORMATION, *PEVENT_TRACE_HEAP_TRACING_INFORMATION; - -typedef struct _EVENT_TRACE_TAG_FILTER_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - TRACEHANDLE TraceHandle; - ULONG Filter[1]; -} EVENT_TRACE_TAG_FILTER_INFORMATION, *PEVENT_TRACE_TAG_FILTER_INFORMATION; - -typedef struct _EVENT_TRACE_PROFILE_COUNTER_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - TRACEHANDLE TraceHandle; - ULONG ProfileSource[1]; -} EVENT_TRACE_PROFILE_COUNTER_INFORMATION, *PEVENT_TRACE_PROFILE_COUNTER_INFORMATION; - -//typedef struct _PROFILE_SOURCE_INFO -//{ -// ULONG NextEntryOffset; -// ULONG Source; -// ULONG MinInterval; -// ULONG MaxInterval; -// PVOID Reserved; -// WCHAR Description[1]; -//} PROFILE_SOURCE_INFO, *PPROFILE_SOURCE_INFO; - -typedef struct _EVENT_TRACE_PROFILE_LIST_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - ULONG Spare; - struct _PROFILE_SOURCE_INFO* Profile[1]; -} EVENT_TRACE_PROFILE_LIST_INFORMATION, *PEVENT_TRACE_PROFILE_LIST_INFORMATION; - -typedef struct _EVENT_TRACE_STACK_CACHING_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - TRACEHANDLE TraceHandle; - BOOLEAN Enabled; - UCHAR Reserved[3]; - ULONG CacheSize; - ULONG BucketCount; -} EVENT_TRACE_STACK_CACHING_INFORMATION, *PEVENT_TRACE_STACK_CACHING_INFORMATION; - -typedef struct _EVENT_TRACE_SOFT_RESTART_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - TRACEHANDLE TraceHandle; - BOOLEAN PersistTraceBuffers; - WCHAR FileName[1]; -} EVENT_TRACE_SOFT_RESTART_INFORMATION, *PEVENT_TRACE_SOFT_RESTART_INFORMATION; - -typedef struct _EVENT_TRACE_PROFILE_ADD_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - BOOLEAN PerfEvtEventSelect; - BOOLEAN PerfEvtUnitSelect; - ULONG PerfEvtType; - ULONG CpuInfoHierarchy[0x3]; - ULONG InitialInterval; - BOOLEAN AllowsHalt; - BOOLEAN Persist; - WCHAR ProfileSourceDescription[0x1]; -} EVENT_TRACE_PROFILE_ADD_INFORMATION, *PEVENT_TRACE_PROFILE_ADD_INFORMATION; - -typedef struct _EVENT_TRACE_PROFILE_REMOVE_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - KPROFILE_SOURCE ProfileSource; - ULONG CpuInfoHierarchy[0x3]; -} EVENT_TRACE_PROFILE_REMOVE_INFORMATION, *PEVENT_TRACE_PROFILE_REMOVE_INFORMATION; - -typedef struct _EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION -{ - EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass; - BOOLEAN CoverageSamplerInformationClass; - UCHAR MajorVersion; - UCHAR MinorVersion; - UCHAR Reserved; - HANDLE SamplerHandle; -} EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION, *PEVENT_TRACE_COVERAGE_SAMPLER_INFORMATION; - typedef struct _SYSTEM_EXCEPTION_INFORMATION { ULONG AlignmentFixupCount; @@ -3401,6 +2245,9 @@ typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION } SYSTEM_SESSION_PROCESS_INFORMATION, *PSYSTEM_SESSION_PROCESS_INFORMATION; #if (PHNT_MODE != PHNT_MODE_KERNEL) + +typedef struct _IMAGE_EXPORT_DIRECTORY *PIMAGE_EXPORT_DIRECTORY; // from ntrtl.h + // private typedef struct _SYSTEM_GDI_DRIVER_INFORMATION { @@ -3408,7 +2255,7 @@ typedef struct _SYSTEM_GDI_DRIVER_INFORMATION PVOID ImageAddress; PVOID SectionPointer; PVOID EntryPoint; - struct _IMAGE_EXPORT_DIRECTORY* ExportSectionPointer; + PIMAGE_EXPORT_DIRECTORY ExportSectionPointer; ULONG ImageLength; } SYSTEM_GDI_DRIVER_INFORMATION, *PSYSTEM_GDI_DRIVER_INFORMATION; #endif @@ -3473,7 +2320,7 @@ typedef struct _SYSTEM_HANDLE_INFORMATION_EX { ULONG_PTR NumberOfHandles; ULONG_PTR Reserved; - SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1]; + _Field_size_(NumberOfHandles) SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1]; } SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX; typedef struct _SYSTEM_BIGPOOL_ENTRY @@ -3494,7 +2341,7 @@ typedef struct _SYSTEM_BIGPOOL_ENTRY typedef struct _SYSTEM_BIGPOOL_INFORMATION { ULONG Count; - SYSTEM_BIGPOOL_ENTRY AllocatedInfo[1]; + _Field_size_(Count) SYSTEM_BIGPOOL_ENTRY AllocatedInfo[1]; } SYSTEM_BIGPOOL_INFORMATION, *PSYSTEM_BIGPOOL_INFORMATION; typedef struct _SYSTEM_POOL_ENTRY @@ -3519,7 +2366,7 @@ typedef struct _SYSTEM_POOL_INFORMATION BOOLEAN PoolTagPresent; BOOLEAN Spare0; ULONG NumberOfEntries; - SYSTEM_POOL_ENTRY Entries[1]; + _Field_size_(NumberOfEntries) SYSTEM_POOL_ENTRY Entries[1]; } SYSTEM_POOL_INFORMATION, *PSYSTEM_POOL_INFORMATION; typedef struct _SYSTEM_SESSION_POOLTAG_INFORMATION @@ -3527,7 +2374,7 @@ typedef struct _SYSTEM_SESSION_POOLTAG_INFORMATION SIZE_T NextEntryOffset; ULONG SessionId; ULONG Count; - SYSTEM_POOLTAG TagInfo[1]; + _Field_size_(Count) SYSTEM_POOLTAG TagInfo[1]; } SYSTEM_SESSION_POOLTAG_INFORMATION, *PSYSTEM_SESSION_POOLTAG_INFORMATION; typedef struct _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION @@ -3551,7 +2398,7 @@ typedef enum _WATCHDOG_HANDLER_ACTION WdActionQueryState } WATCHDOG_HANDLER_ACTION; -typedef NTSTATUS (*PSYSTEM_WATCHDOG_HANDLER)(_In_ WATCHDOG_HANDLER_ACTION Action, _In_ PVOID Context, _Inout_ PULONG DataValue, _In_ BOOLEAN NoLocks); +typedef NTSTATUS (NTAPI *PSYSTEM_WATCHDOG_HANDLER)(_In_ WATCHDOG_HANDLER_ACTION Action, _In_ PVOID Context, _Inout_ PULONG DataValue, _In_ BOOLEAN NoLocks); // private typedef struct _SYSTEM_WATCHDOG_HANDLER_INFORMATION @@ -3579,7 +2426,7 @@ typedef struct _SYSTEM_WATCHDOG_TIMER_INFORMATION { WATCHDOG_INFORMATION_CLASS WdInfoClass; ULONG DataValue; -} SYSTEM_WATCHDOG_TIMER_INFORMATION, PSYSTEM_WATCHDOG_TIMER_INFORMATION; +} SYSTEM_WATCHDOG_TIMER_INFORMATION, *PSYSTEM_WATCHDOG_TIMER_INFORMATION; #if (PHNT_MODE != PHNT_MODE_KERNEL) // private @@ -3597,7 +2444,7 @@ typedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION SYSTEM_FIRMWARE_TABLE_ACTION Action; ULONG TableID; ULONG TableBufferLength; - UCHAR TableBuffer[1]; + _Field_size_bytes_(TableBufferLength) UCHAR TableBuffer[1]; } SYSTEM_FIRMWARE_TABLE_INFORMATION, *PSYSTEM_FIRMWARE_TABLE_INFORMATION; #endif @@ -3725,6 +2572,9 @@ typedef struct _SYSTEM_BOOT_ENVIRONMENT_INFORMATION ULONGLONG DbgSystemHiveReplace : 1; ULONGLONG DbgMeasuredLaunchSmmProtections : 1; ULONGLONG DbgMeasuredLaunchSmmLevel : 7; // 20H1 + ULONGLONG DbgBugCheckRecovery : 1; // 24H2 + ULONGLONG DbgFASR : 1; + ULONGLONG DbgUseCachedBcd : 1; }; }; } SYSTEM_BOOT_ENVIRONMENT_INFORMATION, *PSYSTEM_BOOT_ENVIRONMENT_INFORMATION; @@ -3842,7 +2692,7 @@ typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION { ULONG ProcessorNumber; ULONG StateCount; - SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT States[1]; + _Field_size_(StateCount) SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT States[1]; } SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION, *PSYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION; // private @@ -4012,7 +2862,7 @@ typedef struct _ST_STATS_SPACE_BITMAP SIZE_T CompressedBytes; ULONG BytesPerBit; UCHAR StoreBitmap[1]; -} ST_STATS_SPACE_BITMAP, PST_STATS_SPACE_BITMAP; +} ST_STATS_SPACE_BITMAP, *PST_STATS_SPACE_BITMAP; // rev typedef struct _ST_STATS @@ -4091,14 +2941,19 @@ typedef struct _SMKM_REGION_EXTENT SIZE_T ByteOffset; } SMKM_REGION_EXTENT, *PSMKM_REGION_EXTENT; +typedef struct _FILE_OBJECT *PFILE_OBJECT; +typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT; +typedef struct _IRP *PIRP; +typedef struct _RTL_BITMAP *PRTL_BITMAP; + typedef struct _SMKM_FILE_INFO { HANDLE FileHandle; - struct _FILE_OBJECT *FileObject; - struct _FILE_OBJECT *VolumeFileObject; - struct _DEVICE_OBJECT *VolumeDeviceObject; + PFILE_OBJECT FileObject; + PFILE_OBJECT VolumeFileObject; + PDEVICE_OBJECT VolumeDeviceObject; HANDLE VolumePnpHandle; - struct _IRP *UsageNotificationIrp; + PIRP UsageNotificationIrp; PSMKM_REGION_EXTENT Extents; ULONG ExtentCount; } SMKM_FILE_INFO, *PSMKM_FILE_INFO; @@ -4110,7 +2965,7 @@ typedef struct _SM_STORE_CACHE_BACKED_PARAMS ULONG EncryptionKeySize; PSMKM_FILE_INFO FileInfo; PVOID EtaContext; - struct _RTL_BITMAP *StoreRegionBitmap; + PRTL_BITMAP StoreRegionBitmap; } SM_STORE_CACHE_BACKED_PARAMS, *PSM_STORE_CACHE_BACKED_PARAMS; typedef struct _SM_STORE_PARAMETERS @@ -4264,7 +3119,7 @@ typedef struct _SMC_CACHE_STATS_REQUEST typedef struct _SM_REGISTRATION_INFO { HANDLE CachesUpdatedEvent; -} SM_REGISTRATION_INFO, PSM_REGISTRATION_INFO; +} SM_REGISTRATION_INFO, *PSM_REGISTRATION_INFO; typedef struct _SM_REGISTRATION_REQUEST { @@ -4273,6 +3128,8 @@ typedef struct _SM_REGISTRATION_REQUEST SM_REGISTRATION_INFO RegInfo; } SM_REGISTRATION_REQUEST, *PSM_REGISTRATION_REQUEST; +typedef struct _RTL_BITMAP *PRTL_BITMAP; + #define SYSTEM_STORE_RESIZE_INFORMATION_VERSION 6 typedef struct _SM_STORE_RESIZE_REQUEST @@ -4282,7 +3139,7 @@ typedef struct _SM_STORE_RESIZE_REQUEST ULONG Spare : 23; ULONG StoreId; ULONG NumberOfRegions; - struct _RTL_BITMAP *RegionBitmap; + PRTL_BITMAP RegionBitmap; } SM_STORE_RESIZE_REQUEST, *PSM_STORE_RESIZE_REQUEST; #define SYSTEM_CACHE_STORE_RESIZE_INFORMATION_VERSION 1 @@ -4532,9 +3389,22 @@ typedef struct _SYSTEM_BOOT_GRAPHICS_INFORMATION typedef struct _MEMORY_SCRUB_INFORMATION { HANDLE Handle; - ULONG PagesScrubbed; + ULONG_PTR PagesScrubbed; } MEMORY_SCRUB_INFORMATION, *PMEMORY_SCRUB_INFORMATION; +// private +typedef union _SYSTEM_BAD_PAGE_INFORMATION +{ +#ifdef _WIN64 + ULONG_PTR PhysicalPageNumber : 52; +#else + ULONG PhysicalPageNumber : 20; +#endif + ULONG_PTR Reserved : 10; + ULONG_PTR Pending : 1; + ULONG_PTR Poisoned : 1; +} SYSTEM_BAD_PAGE_INFORMATION, *PSYSTEM_BAD_PAGE_INFORMATION; + // private typedef struct _PEBS_DS_SAVE_AREA32 { @@ -5002,6 +3872,26 @@ typedef struct _SYSTEM_KERNEL_DEBUGGER_FLAGS BOOLEAN KernelDebuggerIgnoreUmExceptions; } SYSTEM_KERNEL_DEBUGGER_FLAGS, *PSYSTEM_KERNEL_DEBUGGER_FLAGS; +// SYSTEM_CODEINTEGRITYPOLICY_INFORMATION Options +#define CODEINTEGRITYPOLICY_OPTION_ENABLED 0x01 +#define CODEINTEGRITYPOLICY_OPTION_AUDIT 0x02 +#define CODEINTEGRITYPOLICY_OPTION_REQUIRE_WHQL 0x04 +#define CODEINTEGRITYPOLICY_OPTION_DISABLED_FLIGHTSIGNING 0x08 +#define CODEINTEGRITYPOLICY_OPTION_ENABLED_UMCI 0x10 +#define CODEINTEGRITYPOLICY_OPTION_ENABLED_UPDATE_POLICY_NOREBOOT 0x20 +#define CODEINTEGRITYPOLICY_OPTION_ENABLED_SECURE_SETTING_POLICY 0x40 +#define CODEINTEGRITYPOLICY_OPTION_ENABLED_UNSIGNED_SYSTEMINTEGRITY_POLICY 0x80 +#define CODEINTEGRITYPOLICY_OPTION_DYNAMIC_CODE_POLICY_ENABLED 0x100 +#define CODEINTEGRITYPOLICY_OPTION_RELOAD_POLICY_NO_REBOOT 0x10000000 // NtSetSystemInformation reloads SiPolicy.p7b +#define CODEINTEGRITYPOLICY_OPTION_CONDITIONAL_LOCKDOWN 0x20000000 +#define CODEINTEGRITYPOLICY_OPTION_NOLOCKDOWN 0x40000000 +#define CODEINTEGRITYPOLICY_OPTION_LOCKDOWN 0x80000000 + +// SYSTEM_CODEINTEGRITYPOLICY_INFORMATION HVCIOptions +#define CODEINTEGRITYPOLICY_HVCIOPTION_ENABLED 0x01 +#define CODEINTEGRITYPOLICY_HVCIOPTION_STRICT 0x02 +#define CODEINTEGRITYPOLICY_HVCIOPTION_DEBUG 0x04 + // private typedef struct _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION { @@ -5023,7 +3913,12 @@ typedef struct _SYSTEM_ISOLATED_USER_MODE_INFORMATION BOOLEAN SpareFlags : 2; BOOLEAN TrustletRunning : 1; BOOLEAN HvciDisableAllowed : 1; - BOOLEAN SpareFlags2 : 6; + BOOLEAN HardwareEnforcedVbs : 1; + BOOLEAN NoSecrets : 1; + BOOLEAN EncryptionKeyPersistent : 1; + BOOLEAN HardwareEnforcedHvpt : 1; + BOOLEAN HardwareHvptAvailable : 1; + BOOLEAN SpareFlags2 : 1; BOOLEAN Spare0[6]; ULONGLONG Spare1; } SYSTEM_ISOLATED_USER_MODE_INFORMATION, *PSYSTEM_ISOLATED_USER_MODE_INFORMATION; @@ -5111,6 +4006,7 @@ typedef struct _SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT GROUP_AFFINITY TargetAffinity; } SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT, *PSYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT; +// private typedef union _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT { ULONG AsULONG; @@ -5121,7 +4017,7 @@ typedef union _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT }; } SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT, *PSYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT; -#if !defined(NTDDI_WIN10_CO) || (NTDDI_VERSION < NTDDI_WIN10_CO) +#if !defined(NTDDI_WIN10_FE) || (NTDDI_VERSION < NTDDI_WIN10_FE) // private typedef struct _SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION { @@ -5132,7 +4028,7 @@ typedef struct _SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION ULONG Process : 1; ULONG WoW64Container : 1; ULONG ReservedZero0 : 11; -} SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION; +} SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION, *PSYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION; #endif // private @@ -5309,9 +4205,35 @@ typedef struct _SYSTEM_SPECULATION_CONTROL_INFORMATION ULONG MdsHardwareProtected : 1; // since 19H2 ULONG MbClearEnabled : 1; ULONG MbClearReported : 1; - ULONG Reserved : 5; + ULONG ReservedTaa : 4; + ULONG Reserved : 1; }; - }; + } SpeculationControlFlags; + union + { + ULONG Flags; // since 23H2 + struct + { + ULONG SbdrSsdpHardwareProtected : 1; + ULONG FbsdpHardwareProtected : 1; + ULONG PsdpHardwareProtected : 1; + ULONG FbClearEnabled : 1; + ULONG FbClearReported : 1; + ULONG BhbEnabled : 1; + ULONG BhbDisabledSystemPolicy : 1; + ULONG BhbDisabledNoHardwareSupport : 1; + ULONG BranchConfusionStatus : 2; + ULONG BranchConfusionReported : 1; + ULONG RdclHardwareProtectedReported : 1; + ULONG RdclHardwareProtected : 1; + ULONG Reserved3 : 4; + ULONG Reserved4 : 3; + ULONG DivideByZeroReported : 1; + ULONG DivideByZeroStatus : 1; + ULONG Reserved5 : 3; + ULONG Reserved : 7; + }; + } SpeculationControlFlags2; } SYSTEM_SPECULATION_CONTROL_INFORMATION, *PSYSTEM_SPECULATION_CONTROL_INFORMATION; // private @@ -5341,18 +4263,20 @@ typedef struct _SYSTEM_SECURITY_MODEL_INFORMATION ULONG SecurityModelFlags; struct { - ULONG SModeAdminlessEnabled : 1; + ULONG ReservedFlag : 1; // SModeAdminlessEnabled ULONG AllowDeviceOwnerProtectionDowngrade : 1; ULONG Reserved : 30; }; }; } SYSTEM_SECURITY_MODEL_INFORMATION, *PSYSTEM_SECURITY_MODEL_INFORMATION; +typedef struct _RTL_FEATURE_CONFIGURATION *PRTL_FEATURE_CONFIGURATION; // from ntrtl.h + // private typedef struct _SYSTEM_FEATURE_CONFIGURATION_INFORMATION { ULONGLONG ChangeStamp; - struct _RTL_FEATURE_CONFIGURATION* Configuration; // see ntrtl.h for types + PRTL_FEATURE_CONFIGURATION Configuration; } SYSTEM_FEATURE_CONFIGURATION_INFORMATION, *PSYSTEM_FEATURE_CONFIGURATION_INFORMATION; // private @@ -5402,7 +4326,11 @@ typedef union _SECURE_SPECULATION_CONTROL_INFORMATION ULONG SsbdRequired : 1; ULONG BpbKernelToUser : 1; ULONG BpbUserToKernel : 1; - ULONG Reserved : 18; + ULONG ReturnSpeculate : 1; + ULONG BranchConfusionSafe : 1; + ULONG SsbsEnabledAlways : 1; // 24H2 + ULONG SsbsEnabledKernel : 1; + ULONG Reserved : 14; } SECURE_SPECULATION_CONTROL_INFORMATION, *PSECURE_SPECULATION_CONTROL_INFORMATION; // private @@ -5482,7 +4410,7 @@ typedef struct _SYSTEM_POOL_LIMIT_INFORMATION { ULONG Version; ULONG EntryCount; - SYSTEM_POOL_LIMIT_INFO LimitEntries[1]; + _Field_size_(EntryCount) SYSTEM_POOL_LIMIT_INFO LimitEntries[1]; } SYSTEM_POOL_LIMIT_INFORMATION, *PSYSTEM_POOL_LIMIT_INFORMATION; // private @@ -5498,6 +4426,15 @@ typedef struct _HV_MINROOT_NUMA_LPS ULONG_PTR Mask[16]; } HV_MINROOT_NUMA_LPS, *PHV_MINROOT_NUMA_LPS; +// private +typedef struct _SYSTEM_XFG_FAILURE_INFORMATION +{ + PVOID ReturnAddress; + PVOID TargetAddress; + ULONG DispatchMode; + ULONGLONG XfgValue; +} SYSTEM_XFG_FAILURE_INFORMATION, *PSYSTEM_XFG_FAILURE_INFORMATION; + // private typedef enum _SYSTEM_IOMMU_STATE { @@ -5544,7 +4481,8 @@ typedef struct _SYSTEM_POINTER_AUTH_INFORMATION USHORT AddressAuthQarma : 1; USHORT GenericAuthSupported : 1; USHORT GenericAuthQarma : 1; - USHORT SupportedReserved : 12; + USHORT AddressAuthFaulting : 1; + USHORT SupportedReserved : 11; }; }; union @@ -5561,6 +4499,37 @@ typedef struct _SYSTEM_POINTER_AUTH_INFORMATION }; } SYSTEM_POINTER_AUTH_INFORMATION, *PSYSTEM_POINTER_AUTH_INFORMATION; +// private +typedef struct _SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT +{ + ULONG Version; + PWSTR FeatureName; + ULONG BornOnVersion; +} SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT, *PSYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT; + +// private +typedef struct _SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT +{ + ULONG Version; + BOOLEAN FeatureIsEnabled; +} SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT, *PSYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT; + +// private +typedef struct _SYSTEM_OSL_RAMDISK_ENTRY +{ + ULONG BlockSize; + ULONG_PTR BaseAddress; + SIZE_T Size; +} SYSTEM_OSL_RAMDISK_ENTRY, *PSYSTEM_OSL_RAMDISK_ENTRY; + +// private +typedef struct _SYSTEM_OSL_RAMDISK_INFORMATION +{ + ULONG Version; + ULONG Count; + SYSTEM_OSL_RAMDISK_ENTRY Entries[1]; +} SYSTEM_OSL_RAMDISK_INFORMATION, *PSYSTEM_OSL_RAMDISK_INFORMATION; + #if (PHNT_MODE != PHNT_MODE_KERNEL) NTSYSCALLAPI @@ -5755,8 +4724,9 @@ typedef struct _SYSDBG_LIVEDUMP_SELECTIVE_CONTROL ULONGLONG Reserved[4]; } SYSDBG_LIVEDUMP_SELECTIVE_CONTROL, *PSYSDBG_LIVEDUMP_SELECTIVE_CONTROL; -#define SYSDBG_LIVEDUMP_CONTROL_VERSION 1 -#define SYSDBG_LIVEDUMP_CONTROL_VERSION_WIN11 2 +#define SYSDBG_LIVEDUMP_CONTROL_VERSION_1 1 +#define SYSDBG_LIVEDUMP_CONTROL_VERSION_2 2 +#define SYSDBG_LIVEDUMP_CONTROL_VERSION SYSDBG_LIVEDUMP_CONTROL_VERSION_2 // private typedef struct _SYSDBG_LIVEDUMP_CONTROL @@ -5774,9 +4744,6 @@ typedef struct _SYSDBG_LIVEDUMP_CONTROL PSYSDBG_LIVEDUMP_SELECTIVE_CONTROL SelectiveControl; // since WIN11 } SYSDBG_LIVEDUMP_CONTROL, *PSYSDBG_LIVEDUMP_CONTROL; -#define SYSDBG_LIVEDUMP_CONTROL_SIZE RTL_SIZEOF_THROUGH_FIELD(SYSDBG_LIVEDUMP_CONTROL, AddPagesControl) -#define SYSDBG_LIVEDUMP_CONTROL_SIZE_WIN11 sizeof(SYSDBG_LIVEDUMP_CONTROL) - // private typedef struct _SYSDBG_KD_PULL_REMOTE_FILE { @@ -5839,7 +4806,9 @@ NtRaiseHardError( _Out_ PULONG Response ); +// // Kernel-user shared data +// typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE { @@ -5852,62 +4821,279 @@ typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE #define MAX_WOW64_SHARED_ENTRIES 16 -#define NX_SUPPORT_POLICY_ALWAYSOFF 0 -#define NX_SUPPORT_POLICY_ALWAYSON 1 -#define NX_SUPPORT_POLICY_OPTIN 2 -#define NX_SUPPORT_POLICY_OPTOUT 3 +// +// Define NX support policy values. +// + +#define NX_SUPPORT_POLICY_ALWAYSOFF 0 +#define NX_SUPPORT_POLICY_ALWAYSON 1 +#define NX_SUPPORT_POLICY_OPTIN 2 +#define NX_SUPPORT_POLICY_OPTOUT 3 + +// +// SEH chain validation policies. +// + +#define SEH_VALIDATION_POLICY_ON 0 +#define SEH_VALIDATION_POLICY_OFF 1 +#define SEH_VALIDATION_POLICY_TELEMETRY 2 +#define SEH_VALIDATION_POLICY_DEFER 3 + +// +// Global shared data flags and manipulation macros. +// + +#define SHARED_GLOBAL_FLAGS_ERROR_PORT_V 0x0 +#define SHARED_GLOBAL_FLAGS_ERROR_PORT \ + (1UL << SHARED_GLOBAL_FLAGS_ERROR_PORT_V) + +#define SHARED_GLOBAL_FLAGS_ELEVATION_ENABLED_V 0x1 +#define SHARED_GLOBAL_FLAGS_ELEVATION_ENABLED \ + (1UL << SHARED_GLOBAL_FLAGS_ELEVATION_ENABLED_V) + +#define SHARED_GLOBAL_FLAGS_VIRT_ENABLED_V 0x2 +#define SHARED_GLOBAL_FLAGS_VIRT_ENABLED \ + (1UL << SHARED_GLOBAL_FLAGS_VIRT_ENABLED_V) + +#define SHARED_GLOBAL_FLAGS_INSTALLER_DETECT_ENABLED_V 0x3 +#define SHARED_GLOBAL_FLAGS_INSTALLER_DETECT_ENABLED \ + (1UL << SHARED_GLOBAL_FLAGS_INSTALLER_DETECT_ENABLED_V) + +#define SHARED_GLOBAL_FLAGS_LKG_ENABLED_V 0x4 +#define SHARED_GLOBAL_FLAGS_LKG_ENABLED \ + (1UL << SHARED_GLOBAL_FLAGS_LKG_ENABLED_V) + +#define SHARED_GLOBAL_FLAGS_DYNAMIC_PROC_ENABLED_V 0x5 +#define SHARED_GLOBAL_FLAGS_DYNAMIC_PROC_ENABLED \ + (1UL << SHARED_GLOBAL_FLAGS_DYNAMIC_PROC_ENABLED_V) + +#define SHARED_GLOBAL_FLAGS_CONSOLE_BROKER_ENABLED_V 0x6 +#define SHARED_GLOBAL_FLAGS_CONSOLE_BROKER_ENABLED \ + (1UL << SHARED_GLOBAL_FLAGS_CONSOLE_BROKER_ENABLED_V) + +#define SHARED_GLOBAL_FLAGS_SECURE_BOOT_ENABLED_V 0x7 +#define SHARED_GLOBAL_FLAGS_SECURE_BOOT_ENABLED \ + (1UL << SHARED_GLOBAL_FLAGS_SECURE_BOOT_ENABLED_V) + +#define SHARED_GLOBAL_FLAGS_MULTI_SESSION_SKU_V 0x8 +#define SHARED_GLOBAL_FLAGS_MULTI_SESSION_SKU \ + (1UL << SHARED_GLOBAL_FLAGS_MULTI_SESSION_SKU_V) + +#define SHARED_GLOBAL_FLAGS_MULTIUSERS_IN_SESSION_SKU_V 0x9 +#define SHARED_GLOBAL_FLAGS_MULTIUSERS_IN_SESSION_SKU \ + (1UL << SHARED_GLOBAL_FLAGS_MULTIUSERS_IN_SESSION_SKU_V) + +#define SHARED_GLOBAL_FLAGS_STATE_SEPARATION_ENABLED_V 0xA +#define SHARED_GLOBAL_FLAGS_STATE_SEPARATION_ENABLED \ + (1UL << SHARED_GLOBAL_FLAGS_STATE_SEPARATION_ENABLED_V) + +#define SHARED_GLOBAL_FLAGS_SET_GLOBAL_DATA_FLAG 0x40000000 +#define SHARED_GLOBAL_FLAGS_CLEAR_GLOBAL_DATA_FLAG 0x80000000 + +// +// Define legal values for the SystemCall member. +// + +#define SYSTEM_CALL_SYSCALL 0 +#define SYSTEM_CALL_INT_2E 1 + +// +// Define flags for QPC bypass information. None of these flags may be set +// unless bypass is enabled. This is for compat with existing code which +// compares this value to zero to detect bypass enablement. +// + +#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_ENABLED (0x01) +#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_USE_HV_PAGE (0x02) +#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_DISABLE_32BIT (0x04) +#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_USE_MFENCE (0x10) +#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_USE_LFENCE (0x20) +#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_A73_ERRATA (0x40) +#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_USE_RDTSCP (0x80) + -#include typedef struct _KUSER_SHARED_DATA { + // + // Current low 32-bit of tick count and tick count multiplier. + // + // N.B. The tick count is updated each time the clock ticks. + // + ULONG TickCountLowDeprecated; ULONG TickCountMultiplier; + // + // Current 64-bit interrupt time in 100ns units. + // + volatile KSYSTEM_TIME InterruptTime; + + // + // Current 64-bit system time in 100ns units. + // + volatile KSYSTEM_TIME SystemTime; + + // + // Current 64-bit time zone bias. + // + volatile KSYSTEM_TIME TimeZoneBias; + // + // Support image magic number range for the host system. + // + // N.B. This is an inclusive range. + // + USHORT ImageNumberLow; USHORT ImageNumberHigh; + // + // Copy of system root in unicode. + // + // N.B. This field must be accessed via the RtlGetNtSystemRoot API for + // an accurate result. + // + WCHAR NtSystemRoot[260]; + // + // Maximum stack trace depth if tracing enabled. + // + ULONG MaxStackTraceDepth; + // + // Crypto exponent value. + // + ULONG CryptoExponent; + // + // Time zone ID. + // + ULONG TimeZoneId; ULONG LargePageMinimum; + + // + // This value controls the AIT Sampling rate. + // + ULONG AitSamplingValue; + + // + // This value controls switchback processing. + // + ULONG AppCompatFlag; + + // + // Current Kernel Root RNG state seed version + // + ULONGLONG RNGSeedVersion; + + // + // This value controls assertion failure handling. + // + ULONG GlobalValidationRunlevel; - LONG TimeZoneBiasStamp; + + volatile LONG TimeZoneBiasStamp; + + // + // The shared collective build number undecorated with C or F. + // GetVersionEx hides the real number + // ULONG NtBuildNumber; + + // + // Product type. + // + // N.B. This field must be accessed via the RtlGetNtProductType API for + // an accurate result. + // + NT_PRODUCT_TYPE NtProductType; BOOLEAN ProductTypeIsValid; - UCHAR Reserved0[1]; + BOOLEAN Reserved0[1]; USHORT NativeProcessorArchitecture; + // + // The NT Version. + // + // N. B. Note that each process sees a version from its PEB, but if the + // process is running with an altered view of the system version, + // the following two fields are used to correctly identify the + // version + // + ULONG NtMajorVersion; ULONG NtMinorVersion; + // + // Processor features. + // + BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX]; + // + // Reserved fields - do not use. + // + ULONG Reserved1; ULONG Reserved3; + // + // Time slippage while in debugger. + // + volatile ULONG TimeSlip; + // + // Alternative system architecture, e.g., NEC PC98xx on x86. + // + ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture; + + // + // Boot sequence, incremented for each boot attempt by the OS loader. + // + ULONG BootId; + // + // If the system is an evaluation unit, the following field contains the + // date and time that the evaluation unit expires. A value of 0 indicates + // that there is no expiration. A non-zero value is the UTC absolute time + // that the system expires. + // + LARGE_INTEGER SystemExpirationDate; + // + // Suite support. + // + // N.B. This field must be accessed via the RtlGetSuiteMask API for + // an accurate result. + // + ULONG SuiteMask; + // + // TRUE if a kernel debugger is connected/enabled. + // + BOOLEAN KdDebuggerEnabled; + + // + // Mitigation policies. + // + union { UCHAR MitigationPolicies; @@ -5920,74 +5106,165 @@ typedef struct _KUSER_SHARED_DATA }; }; + // + // Measured duration of a single processor yield, in cycles. This is used by + // lock packages to determine how many times to spin waiting for a state + // change before blocking. + // + USHORT CyclesPerYield; + // + // Current console session Id. Always zero on non-TS systems. + // + // N.B. This field must be accessed via the RtlGetActiveConsoleId API for an + // accurate result. + // + volatile ULONG ActiveConsoleId; + // + // Force-dismounts cause handles to become invalid. Rather than always + // probe handles, a serial number of dismounts is maintained that clients + // can use to see if they need to probe handles. + // + volatile ULONG DismountCount; + // + // This field indicates the status of the 64-bit COM+ package on the + // system. It indicates whether the Itermediate Language (IL) COM+ + // images need to use the 64-bit COM+ runtime or the 32-bit COM+ runtime. + // + ULONG ComPlusPackage; + // + // Time in tick count for system-wide last user input across all terminal + // sessions. For MP performance, it is not updated all the time (e.g. once + // a minute per session). It is used for idle detection. + // + ULONG LastSystemRITEventTickCount; + // + // Number of physical pages in the system. This can dynamically change as + // physical memory can be added or removed from a running system. + // + ULONG NumberOfPhysicalPages; + // + // True if the system was booted in safe boot mode. + // + BOOLEAN SafeBootMode; + // + // Virtualization flags. + // + union { UCHAR VirtualizationFlags; + #if defined(_ARM64_) + + // + // N.B. Keep this bitfield in sync with the one in arc.w. + // + struct { UCHAR ArchStartedInEl2 : 1; UCHAR QcSlIsSupported : 1; UCHAR : 6; }; + #endif + }; + // + // Reserved (available for reuse). + // + UCHAR Reserved12[2]; + // + // This is a packed bitfield that contains various flags concerning + // the system state. They must be manipulated using interlocked + // operations. + // + // N.B. DbgMultiSessionSku must be accessed via the RtlIsMultiSessionSku + // API for an accurate result + // + union { ULONG SharedDataFlags; struct { - ULONG DbgErrorPortPresent : 1; - ULONG DbgElevationEnabled : 1; - ULONG DbgVirtEnabled : 1; + // + // The following bit fields are for the debugger only. Do not use. + // Use the bit definitions instead. + // + + ULONG DbgErrorPortPresent : 1; + ULONG DbgElevationEnabled : 1; + ULONG DbgVirtEnabled : 1; ULONG DbgInstallerDetectEnabled : 1; - ULONG DbgLkgEnabled : 1; - ULONG DbgDynProcessorEnabled : 1; - ULONG DbgConsoleBrokerEnabled : 1; - ULONG DbgSecureBootEnabled : 1; - ULONG DbgMultiSessionSku : 1; + ULONG DbgLkgEnabled : 1; + ULONG DbgDynProcessorEnabled : 1; + ULONG DbgConsoleBrokerEnabled : 1; + ULONG DbgSecureBootEnabled : 1; + ULONG DbgMultiSessionSku : 1; ULONG DbgMultiUsersInSessionSku : 1; ULONG DbgStateSeparationEnabled : 1; - ULONG SpareBits : 21; - }; - }; + ULONG SpareBits : 21; + } DUMMYSTRUCTNAME2; + } DUMMYUNIONNAME2; + ULONG DataFlagsPad[1]; + // + // Depending on the processor, the code for fast system call will differ, + // Stub code is provided pointers below to access the appropriate code. + // + // N.B. The following field is only used on 32-bit systems. + // + ULONGLONG TestRetInstruction; LONGLONG QpcFrequency; + // + // On AMD64, this value is initialized to a nonzero value if the system + // operates with an altered view of the system service call mechanism. + // + ULONG SystemCall; - union - { - ULONG AllFlags; - struct - { - ULONG Win32Process : 1; - ULONG Sgx2Enclave : 1; - ULONG VbsBasicEnclave : 1; - ULONG SpareBits : 29; - }; - } UserCetAvailableEnvironments; + // + // Reserved field - do not use. Used to be UserCetAvailableEnvironments. + // - ULONGLONG SystemCallPad[2]; + ULONG Reserved2; + + // + // + // + + ULONGLONG FullNumberOfPhysicalPages; + + // + // Reserved, available for reuse. + // + + ULONGLONG SystemCallPad[1]; + + // + // The 64-bit tick count. + // union { @@ -5997,72 +5274,284 @@ typedef struct _KUSER_SHARED_DATA { ULONG ReservedTickCountOverlay[3]; ULONG TickCountPad[1]; - }; - }; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME3; + + // + // Cookie for encoding pointers system wide. + // ULONG Cookie; ULONG CookiePad[1]; + // + // Client id of the process having the focus in the current + // active console session id. + // + // N.B. This field must be accessed via the + // RtlGetConsoleSessionForegroundProcessId API for an accurate result. + // + LONGLONG ConsoleSessionForegroundProcessId; + + // + // N.B. The following data is used to implement the precise time + // services. It is aligned on a 64-byte cache-line boundary and + // arranged in the order of typical accesses. + // + // Placeholder for the (internal) time update lock. + // + ULONGLONG TimeUpdateLock; + + // + // The performance counter value used to establish the current system time. + // + ULONGLONG BaselineSystemTimeQpc; + + // + // The performance counter value used to compute the last interrupt time. + // + ULONGLONG BaselineInterruptTimeQpc; + + // + // The scaled number of system time seconds represented by a single + // performance count (this value may vary to achieve time synchronization). + // + ULONGLONG QpcSystemTimeIncrement; + + // + // The scaled number of interrupt time seconds represented by a single + // performance count (this value is constant after the system is booted). + // + ULONGLONG QpcInterruptTimeIncrement; + + // + // The scaling shift count applied to the performance counter system time + // increment. + // + UCHAR QpcSystemTimeIncrementShift; + + // + // The scaling shift count applied to the performance counter interrupt time + // increment. + // + UCHAR QpcInterruptTimeIncrementShift; + // + // The count of unparked processors. + // + USHORT UnparkedProcessorCount; + + // + // A bitmask of enclave features supported on this system. + // + // N.B. This field must be accessed via the RtlIsEnclaveFeaturePresent API for an + // accurate result. + // + ULONG EnclaveFeatureMask[4]; + // + // Current coverage round for telemetry based coverage. + // + ULONG TelemetryCoverageRound; + // + // The following field is used for ETW user mode global logging + // (UMGL). + // + USHORT UserModeGlobalLogger[16]; + + // + // Settings that can enable the use of Image File Execution Options + // from HKCU in addition to the original HKLM. + // + ULONG ImageFileExecutionOptions; + // + // Generation of the kernel structure holding system language information + // + ULONG LangGenerationCount; + + // + // Reserved (available for reuse). + // + ULONGLONG Reserved4; - volatile ULONG64 InterruptTimeBias; - volatile ULONG64 QpcBias; + + // + // Current 64-bit interrupt time bias in 100ns units. + // + + volatile ULONGLONG InterruptTimeBias; + + // + // Current 64-bit performance counter bias, in performance counter units + // before the shift is applied. + // + + volatile ULONGLONG QpcBias; + + // + // Number of active processors and groups. + // ULONG ActiveProcessorCount; volatile UCHAR ActiveGroupCount; + + // + // Reserved (available for re-use). + // + UCHAR Reserved9; + union { USHORT QpcData; struct { - volatile UCHAR QpcBypassEnabled : 1; - UCHAR QpcShift : 1; + // + // A boolean indicating whether performance counter queries + // can read the counter directly (bypassing the system call). + // + + volatile UCHAR QpcBypassEnabled; + + // + // Shift applied to the raw counter value to derive the + // QPC count. + // + + UCHAR QpcShift; }; }; LARGE_INTEGER TimeZoneBiasEffectiveStart; LARGE_INTEGER TimeZoneBiasEffectiveEnd; + + // + // Extended processor state configuration + // + XSTATE_CONFIGURATION XState; + KSYSTEM_TIME FeatureConfigurationChangeStamp; ULONG Spare; - ULONG64 UserPointerAuthMask; -} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA; -#include + ULONG64 UserPointerAuthMask; + + ULONG InternsReserved[210]; +} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA; + +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountLowDeprecated) == 0x0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountMultiplier) == 0x4); -C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTime) == 0x8); -C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemTime) == 0x14); -C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBias) == 0x20); -C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtSystemRoot) == 0x30); +C_ASSERT(__alignof(KSYSTEM_TIME) == 4); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTime) == 0x08); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemTime) == 0x014); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBias) == 0x020); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ImageNumberLow) == 0x02c); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ImageNumberHigh) == 0x02e); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtSystemRoot) == 0x030); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, MaxStackTraceDepth) == 0x238); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, CryptoExponent) == 0x23c); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneId) == 0x240); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, LargePageMinimum) == 0x244); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, AitSamplingValue) == 0x248); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, AppCompatFlag) == 0x24c); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, RNGSeedVersion) == 0x250); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, GlobalValidationRunlevel) == 0x258); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBiasStamp) == 0x25c); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtBuildNumber) == 0x260); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtProductType) == 0x264); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ProductTypeIsValid) == 0x268); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NativeProcessorArchitecture) == 0x26a); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtMajorVersion) == 0x26c); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtMinorVersion) == 0x270); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ProcessorFeatures) == 0x274); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved1) == 0x2b4); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved3) == 0x2b8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeSlip) == 0x2bc); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, AlternativeArchitecture) == 0x2c0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemExpirationDate) == 0x2c8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SuiteMask) == 0x2d0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, KdDebuggerEnabled) == 0x2d4); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, MitigationPolicies) == 0x2d5); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, CyclesPerYield) == 0x2d6); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveConsoleId) == 0x2d8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, DismountCount) == 0x2dc); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ComPlusPackage) == 0x2e0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, LastSystemRITEventTickCount) == 0x2e4); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NumberOfPhysicalPages) == 0x2e8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SafeBootMode) == 0x2ec); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, VirtualizationFlags) == 0x2ed); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved12) == 0x2ee); +#if defined(_MSC_EXTENSIONS) +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SharedDataFlags) == 0x2f0); +#endif +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TestRetInstruction) == 0x2f8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcFrequency) == 0x300); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemCall) == 0x308); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved2) == 0x30c); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemCallPad) == 0x318); // previously 0x310 +#if defined(_MSC_EXTENSIONS) C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCount) == 0x320); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountQuad) == 0x320); +#endif +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Cookie) == 0x330); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ConsoleSessionForegroundProcessId) == 0x338); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeUpdateLock) == 0x340); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, BaselineSystemTimeQpc) == 0x348); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, BaselineInterruptTimeQpc) == 0x350); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcSystemTimeIncrement) == 0x358); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcInterruptTimeIncrement) == 0x360); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcSystemTimeIncrementShift) == 0x368); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcInterruptTimeIncrementShift) == 0x369); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, UnparkedProcessorCount) == 0x36a); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, EnclaveFeatureMask) == 0x36c); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TelemetryCoverageRound) == 0x37c); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, UserModeGlobalLogger) == 0x380); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ImageFileExecutionOptions) == 0x3a0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, LangGenerationCount) == 0x3a4); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved4) == 0x3a8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTimeBias) == 0x3b0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcBias) == 0x3b8); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveProcessorCount) == 0x3c0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveGroupCount) == 0x3c4); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved9) == 0x3c5); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcData) == 0x3c6); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcBypassEnabled) == 0x3c6); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcShift) == 0x3c7); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBiasEffectiveStart) == 0x3c8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBiasEffectiveEnd) == 0x3d0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, XState) == 0x3d8); +#if !defined(NTDDI_WIN10_FE) || (NTDDI_VERSION < NTDDI_WIN10_FE) +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, FeatureConfigurationChangeStamp) == 0x710); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, UserPointerAuthMask) == 0x720); +#if !defined(WINDOWS_IGNORE_PACKING_MISMATCH) +C_ASSERT(sizeof(KUSER_SHARED_DATA) == 0x728); +#endif +#else +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, FeatureConfigurationChangeStamp) == 0x720); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, UserPointerAuthMask) == 0x730); +#if !defined(WINDOWS_IGNORE_PACKING_MISMATCH) +C_ASSERT(sizeof(KUSER_SHARED_DATA) == 0xa80); +#endif +#endif #define USER_SHARED_DATA ((KUSER_SHARED_DATA * const)0x7ffe0000) -#if (PHNT_VERSION >= PHNT_WS03) - FORCEINLINE ULONGLONG NtGetTickCount64( @@ -6125,28 +5614,6 @@ NtGetTickCount( #endif } -#else - -FORCEINLINE -ULONGLONG -NtGetTickCount64( - VOID - ) -{ - return GetTickCount(); // pre PHNT_WS03 support (dmex) -} - -FORCEINLINE -ULONG -NtGetTickCount( - VOID - ) -{ - return GetTickCount(); -} - -#endif - // Locale NTSYSCALLAPI @@ -6213,16 +5680,6 @@ NtIsUILanguageComitted( #if (PHNT_VERSION >= PHNT_VISTA) -#if (PHNT_VERSION >= PHNT_WIN7) -NTSYSCALLAPI -NTSTATUS -NTAPI -NtInitializeNlsFiles( - _Out_ PVOID *BaseAddress, - _Out_ PLCID DefaultLocaleId, - _Out_ PLARGE_INTEGER DefaultCasingTableSize - ); -#else NTSYSCALLAPI NTSTATUS NTAPI @@ -6232,7 +5689,6 @@ NtInitializeNlsFiles( _Out_ PLARGE_INTEGER DefaultCasingTableSize, _Out_opt_ PULONG CurrentNLSVersion ); -#endif NTSYSCALLAPI NTSTATUS @@ -6345,13 +5801,13 @@ typedef struct _ATOM_BASIC_INFORMATION USHORT UsageCount; USHORT Flags; USHORT NameLength; - WCHAR Name[1]; + _Field_size_bytes_(NameLength) WCHAR Name[1]; } ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION; typedef struct _ATOM_TABLE_INFORMATION { ULONG NumberOfAtoms; - RTL_ATOM Atoms[1]; + _Field_size_(NumberOfAtoms) RTL_ATOM Atoms[1]; } ATOM_TABLE_INFORMATION, *PATOM_TABLE_INFORMATION; NTSYSCALLAPI diff --git a/ntgdi.h b/ntgdi.h index 6a7e77c..bf70b71 100644 --- a/ntgdi.h +++ b/ntgdi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Graphics device interface support * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTGDI_H diff --git a/ntimage.h b/ntimage.h new file mode 100644 index 0000000..8007a99 --- /dev/null +++ b/ntimage.h @@ -0,0 +1,211 @@ +/* + * PE format support + * + * This file is part of System Informer. + */ + +#ifndef _NTIMAGE_H +#define _NTIMAGE_H + +#include + +#if (PHNT_MODE != PHNT_MODE_KERNEL) +#define IMAGE_FILE_MACHINE_CHPE_X86 0x3A64 +#define IMAGE_FILE_MACHINE_ARM64EC 0xA641 +#define IMAGE_FILE_MACHINE_ARM64X 0xA64E +#endif + +typedef struct _IMAGE_DEBUG_POGO_ENTRY +{ + ULONG Rva; + ULONG Size; + CHAR Name[1]; +} IMAGE_DEBUG_POGO_ENTRY, *PIMAGE_DEBUG_POGO_ENTRY; + +typedef struct _IMAGE_DEBUG_POGO_SIGNATURE +{ + ULONG Signature; +} IMAGE_DEBUG_POGO_SIGNATURE, *PIMAGE_DEBUG_POGO_SIGNATURE; + +#define IMAGE_DEBUG_POGO_SIGNATURE_LTCG 'LTCG' // coffgrp LTCG (0x4C544347) +#define IMAGE_DEBUG_POGO_SIGNATURE_PGU 'PGU\0' // coffgrp PGU (0x50475500) + +typedef struct _IMAGE_RELOCATION_RECORD +{ + USHORT Offset : 12; + USHORT Type : 4; +} IMAGE_RELOCATION_RECORD, *PIMAGE_RELOCATION_RECORD; + +typedef struct _IMAGE_CHPE_METADATA_X86 +{ + ULONG Version; + ULONG CHPECodeAddressRangeOffset; + ULONG CHPECodeAddressRangeCount; + ULONG WowA64ExceptionHandlerFunctionPointer; + ULONG WowA64DispatchCallFunctionPointer; + ULONG WowA64DispatchIndirectCallFunctionPointer; + ULONG WowA64DispatchIndirectCallCfgFunctionPointer; + ULONG WowA64DispatchRetFunctionPointer; + ULONG WowA64DispatchRetLeafFunctionPointer; + ULONG WowA64DispatchJumpFunctionPointer; + ULONG CompilerIATPointer; // Present if Version >= 2 + ULONG WowA64RdtscFunctionPointer; // Present if Version >= 3 +} IMAGE_CHPE_METADATA_X86, *PIMAGE_CHPE_METADATA_X86; + +typedef struct _IMAGE_CHPE_RANGE_ENTRY +{ + union + { + ULONG StartOffset; + struct + { + ULONG NativeCode : 1; + ULONG AddressBits : 31; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; + + ULONG Length; +} IMAGE_CHPE_RANGE_ENTRY, *PIMAGE_CHPE_RANGE_ENTRY; + +typedef struct _IMAGE_ARM64EC_METADATA +{ + ULONG Version; + ULONG CodeMap; + ULONG CodeMapCount; + ULONG CodeRangesToEntryPoints; + ULONG RedirectionMetadata; + ULONG tbd__os_arm64x_dispatch_call_no_redirect; + ULONG tbd__os_arm64x_dispatch_ret; + ULONG tbd__os_arm64x_dispatch_call; + ULONG tbd__os_arm64x_dispatch_icall; + ULONG tbd__os_arm64x_dispatch_icall_cfg; + ULONG AlternateEntryPoint; + ULONG AuxiliaryIAT; + ULONG CodeRangesToEntryPointsCount; + ULONG RedirectionMetadataCount; + ULONG GetX64InformationFunctionPointer; + ULONG SetX64InformationFunctionPointer; + ULONG ExtraRFETable; + ULONG ExtraRFETableSize; + ULONG __os_arm64x_dispatch_fptr; + ULONG AuxiliaryIATCopy; +} IMAGE_ARM64EC_METADATA, *PIMAGE_ARM64EC_METADATA; + +// rev +#define IMAGE_ARM64EC_CODE_MAP_TYPE_ARM64 0 +#define IMAGE_ARM64EC_CODE_MAP_TYPE_ARM64EC 1 +#define IMAGE_ARM64EC_CODE_MAP_TYPE_AMD64 2 + +// rev +typedef struct _IMAGE_ARM64EC_CODE_MAP_ENTRY +{ + union + { + ULONG StartOffset; + struct + { + ULONG Type : 2; + ULONG AddressBits : 30; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; + + ULONG Length; +} IMAGE_ARM64EC_CODE_MAP_ENTRY, *PIMAGE_ARM64EC_CODE_MAP_ENTRY; + +typedef struct _IMAGE_ARM64EC_REDIRECTION_ENTRY +{ + ULONG Source; + ULONG Destination; +} IMAGE_ARM64EC_REDIRECTION_ENTRY, *PIMAGE_ARM64EC_REDIRECTION_ENTRY; + +typedef struct _IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT +{ + ULONG StartRva; + ULONG EndRva; + ULONG EntryPoint; +} IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT, *PIMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT; + +#define IMAGE_DVRT_ARM64X_FIXUP_TYPE_ZEROFILL 0 +#define IMAGE_DVRT_ARM64X_FIXUP_TYPE_VALUE 1 +#define IMAGE_DVRT_ARM64X_FIXUP_TYPE_DELTA 2 + +#define IMAGE_DVRT_ARM64X_FIXUP_SIZE_2BYTES 1 +#define IMAGE_DVRT_ARM64X_FIXUP_SIZE_4BYTES 2 +#define IMAGE_DVRT_ARM64X_FIXUP_SIZE_8BYTES 3 + +typedef struct _IMAGE_DVRT_ARM64X_FIXUP_RECORD +{ + USHORT Offset : 12; + USHORT Type : 2; + USHORT Size : 2; + // Value of variable Size when IMAGE_DVRT_ARM64X_FIXUP_TYPE_VALUE +} IMAGE_DVRT_ARM64X_FIXUP_RECORD, *PIMAGE_DVRT_ARM64X_FIXUP_RECORD; + +typedef struct _IMAGE_DVRT_ARM64X_DELTA_FIXUP_RECORD +{ + USHORT Offset : 12; + USHORT Type : 2; // IMAGE_DVRT_ARM64X_FIXUP_TYPE_DELTA + USHORT Sign : 1; // 1 = -, 0 = + + USHORT Scale : 1; // 1 = 8, 0 = 4 + // USHORT Value; // Delta = Value * Scale * Sign +} IMAGE_DVRT_ARM64X_DELTA_FIXUP_RECORD, *PIMAGE_DVRT_ARM64X_DELTA_FIXUP_RECORD; + +#include + +#define IMAGE_DYNAMIC_RELOCATION_ARM64X 0x00000006 +#define IMAGE_DYNAMIC_RELOCATION_MM_SHARED_USER_DATA_VA 0x7FFE0000 +#define IMAGE_DYNAMIC_RELOCATION_KI_USER_SHARED_DATA64 0xFFFFF78000000000UI64 + +// Note: The Windows SDK defines UNALIGNED for PIMAGE_IMPORT_DESCRIPTOR but +// doesn't include UNALIGNED for PIMAGE_THUNK_DATA (See GH#1694) (dmex) +typedef IMAGE_THUNK_DATA32 UNALIGNED *UNALIGNED_PIMAGE_THUNK_DATA32; +typedef IMAGE_THUNK_DATA64 UNALIGNED *UNALIGNED_PIMAGE_THUNK_DATA64; + +// Note: Required for legacy SDK support (dmex) +#if !defined(NTDDI_WIN10_NI) || (NTDDI_VERSION < NTDDI_WIN10_NI) +#define IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE 0x00000001 +#define IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE 0x00000002 +#define IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER 0x00000003 +#define IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER 0x00000004 +#define IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH 0x00000005 +#define IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE 0x00000007 + +typedef struct _IMAGE_FUNCTION_OVERRIDE_HEADER { + ULONG FuncOverrideSize; + // IMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION FuncOverrideInfo[ANYSIZE_ARRAY]; // FuncOverrideSize bytes in size + // IMAGE_BDD_INFO BDDInfo; // BDD region, size in bytes: DVRTEntrySize - sizeof(IMAGE_FUNCTION_OVERRIDE_HEADER) - FuncOverrideSize +} IMAGE_FUNCTION_OVERRIDE_HEADER; +typedef IMAGE_FUNCTION_OVERRIDE_HEADER UNALIGNED *PIMAGE_FUNCTION_OVERRIDE_HEADER; + +typedef struct _IMAGE_BDD_INFO { + ULONG Version; // decides the semantics of serialized BDD + ULONG BDDSize; + // IMAGE_BDD_DYNAMIC_RELOCATION BDDNodes[ANYSIZE_ARRAY]; // BDDSize size in bytes. +} IMAGE_BDD_INFO, *PIMAGE_BDD_INFO; + +typedef struct _IMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION { + ULONG OriginalRva; // RVA of original function + ULONG BDDOffset; // Offset into the BDD region + ULONG RvaSize; // Size in bytes taken by RVAs. Must be multiple of sizeof(DWORD). + ULONG BaseRelocSize; // Size in bytes taken by BaseRelocs + // DWORD RVAs[RvaSize / sizeof(DWORD)]; // Array containing overriding func RVAs. + // IMAGE_BASE_RELOCATION BaseRelocs[ANYSIZE_ARRAY]; + // ^Base relocations (RVA + Size + TO) + // ^Padded with extra TOs for 4B alignment + // ^BaseRelocSize size in bytes +} IMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION, *PIMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION; + +typedef struct _IMAGE_BDD_DYNAMIC_RELOCATION { + USHORT Left; // Index of FALSE edge in BDD array + USHORT Right; // Index of TRUE edge in BDD array + ULONG Value; // Either FeatureNumber or Index into RVAs array +} IMAGE_BDD_DYNAMIC_RELOCATION, *PIMAGE_BDD_DYNAMIC_RELOCATION; + +// Function override relocation types in DVRT records. +#define IMAGE_FUNCTION_OVERRIDE_INVALID 0 +#define IMAGE_FUNCTION_OVERRIDE_X64_REL32 1 // 32-bit relative address from byte following reloc +#define IMAGE_FUNCTION_OVERRIDE_ARM64_BRANCH26 2 // 26 bit offset << 2 & sign ext. for B & BL +#define IMAGE_FUNCTION_OVERRIDE_ARM64_THUNK 3 +#endif + +#endif diff --git a/ntioapi.h b/ntioapi.h index 23c70f9..1cee2c2 100644 --- a/ntioapi.h +++ b/ntioapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * File management support * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTIOAPI_H @@ -14,151 +9,189 @@ // Create disposition -#define FILE_SUPERSEDE 0x00000000 -#define FILE_OPEN 0x00000001 -#define FILE_CREATE 0x00000002 -#define FILE_OPEN_IF 0x00000003 -#define FILE_OVERWRITE 0x00000004 -#define FILE_OVERWRITE_IF 0x00000005 -#define FILE_MAXIMUM_DISPOSITION 0x00000005 +#define FILE_SUPERSEDE 0x00000000 +#define FILE_OPEN 0x00000001 +#define FILE_CREATE 0x00000002 +#define FILE_OPEN_IF 0x00000003 +#define FILE_OVERWRITE 0x00000004 +#define FILE_OVERWRITE_IF 0x00000005 +#define FILE_MAXIMUM_DISPOSITION 0x00000005 // Create/open flags -#define FILE_DIRECTORY_FILE 0x00000001 -#define FILE_WRITE_THROUGH 0x00000002 -#define FILE_SEQUENTIAL_ONLY 0x00000004 -#define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008 +#define FILE_DIRECTORY_FILE 0x00000001 +#define FILE_WRITE_THROUGH 0x00000002 +#define FILE_SEQUENTIAL_ONLY 0x00000004 +#define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008 -#define FILE_SYNCHRONOUS_IO_ALERT 0x00000010 -#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020 -#define FILE_NON_DIRECTORY_FILE 0x00000040 -#define FILE_CREATE_TREE_CONNECTION 0x00000080 +#define FILE_SYNCHRONOUS_IO_ALERT 0x00000010 +#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020 +#define FILE_NON_DIRECTORY_FILE 0x00000040 +#define FILE_CREATE_TREE_CONNECTION 0x00000080 -#define FILE_COMPLETE_IF_OPLOCKED 0x00000100 -#define FILE_NO_EA_KNOWLEDGE 0x00000200 -#define FILE_OPEN_FOR_RECOVERY 0x00000400 -#define FILE_RANDOM_ACCESS 0x00000800 +#if (PHNT_VERSION >= PHNT_REDSTONE5) +#define TREE_CONNECT_NO_CLIENT_BUFFERING 0x00000008 +#define TREE_CONNECT_WRITE_THROUGH 0x00000002 +#endif + +#define FILE_COMPLETE_IF_OPLOCKED 0x00000100 +#define FILE_NO_EA_KNOWLEDGE 0x00000200 +#define FILE_OPEN_REMOTE_INSTANCE 0x00000400 +#define FILE_RANDOM_ACCESS 0x00000800 + +#define FILE_DELETE_ON_CLOSE 0x00001000 +#define FILE_OPEN_BY_FILE_ID 0x00002000 +#define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000 +#define FILE_NO_COMPRESSION 0x00008000 -#define FILE_DELETE_ON_CLOSE 0x00001000 -#define FILE_OPEN_BY_FILE_ID 0x00002000 -#define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000 -#define FILE_NO_COMPRESSION 0x00008000 #if (PHNT_VERSION >= PHNT_WIN7) -#define FILE_OPEN_REQUIRING_OPLOCK 0x00010000 -#define FILE_DISALLOW_EXCLUSIVE 0x00020000 +#define FILE_OPEN_REQUIRING_OPLOCK 0x00010000 +#define FILE_DISALLOW_EXCLUSIVE 0x00020000 #endif #if (PHNT_VERSION >= PHNT_WIN8) -#define FILE_SESSION_AWARE 0x00040000 +#define FILE_SESSION_AWARE 0x00040000 #endif -#define FILE_RESERVE_OPFILTER 0x00100000 -#define FILE_OPEN_REPARSE_POINT 0x00200000 -#define FILE_OPEN_NO_RECALL 0x00400000 -#define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000 +#define FILE_RESERVE_OPFILTER 0x00100000 +#define FILE_OPEN_REPARSE_POINT 0x00200000 +#define FILE_OPEN_NO_RECALL 0x00400000 +#define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000 -#define FILE_COPY_STRUCTURED_STORAGE 0x00000041 -#define FILE_STRUCTURED_STORAGE 0x00000441 +// Extended create/open flags + +#define FILE_CONTAINS_EXTENDED_CREATE_INFORMATION 0x10000000 +#define FILE_VALID_EXTENDED_OPTION_FLAGS 0x10000000 + +#if (PHNT_VERSION >= PHNT_WIN11) +typedef struct _EXTENDED_CREATE_INFORMATION +{ + LONGLONG ExtendedCreateFlags; + PVOID EaBuffer; + ULONG EaLength; +} EXTENDED_CREATE_INFORMATION, *PEXTENDED_CREATE_INFORMATION; + +typedef struct _EXTENDED_CREATE_INFORMATION_32 +{ + LONGLONG ExtendedCreateFlags; + void* POINTER_32 EaBuffer; + ULONG EaLength; +} EXTENDED_CREATE_INFORMATION_32, *PEXTENDED_CREATE_INFORMATION_32; + +#define EX_CREATE_FLAG_FILE_SOURCE_OPEN_FOR_COPY 0x00000001 +#define EX_CREATE_FLAG_FILE_DEST_OPEN_FOR_COPY 0x00000002 +#endif + +#define FILE_VALID_OPTION_FLAGS 0x00ffffff +#define FILE_VALID_PIPE_OPTION_FLAGS 0x00000032 +#define FILE_VALID_MAILSLOT_OPTION_FLAGS 0x00000032 +#define FILE_VALID_SET_FLAGS 0x00000036 + +#define FILE_COPY_STRUCTURED_STORAGE 0x00000041 +#define FILE_STRUCTURED_STORAGE 0x00000441 // I/O status information values for NtCreateFile/NtOpenFile -#define FILE_SUPERSEDED 0x00000000 -#define FILE_OPENED 0x00000001 -#define FILE_CREATED 0x00000002 -#define FILE_OVERWRITTEN 0x00000003 -#define FILE_EXISTS 0x00000004 -#define FILE_DOES_NOT_EXIST 0x00000005 +#define FILE_SUPERSEDED 0x00000000 +#define FILE_OPENED 0x00000001 +#define FILE_CREATED 0x00000002 +#define FILE_OVERWRITTEN 0x00000003 +#define FILE_EXISTS 0x00000004 +#define FILE_DOES_NOT_EXIST 0x00000005 // Special ByteOffset parameters -#define FILE_WRITE_TO_END_OF_FILE 0xffffffff -#define FILE_USE_FILE_POINTER_POSITION 0xfffffffe +#define FILE_WRITE_TO_END_OF_FILE 0xffffffff +#define FILE_USE_FILE_POINTER_POSITION 0xfffffffe // Alignment requirement values -#define FILE_BYTE_ALIGNMENT 0x00000000 -#define FILE_WORD_ALIGNMENT 0x00000001 -#define FILE_LONG_ALIGNMENT 0x00000003 -#define FILE_QUAD_ALIGNMENT 0x00000007 -#define FILE_OCTA_ALIGNMENT 0x0000000f -#define FILE_32_BYTE_ALIGNMENT 0x0000001f -#define FILE_64_BYTE_ALIGNMENT 0x0000003f -#define FILE_128_BYTE_ALIGNMENT 0x0000007f -#define FILE_256_BYTE_ALIGNMENT 0x000000ff -#define FILE_512_BYTE_ALIGNMENT 0x000001ff +#define FILE_BYTE_ALIGNMENT 0x00000000 +#define FILE_WORD_ALIGNMENT 0x00000001 +#define FILE_LONG_ALIGNMENT 0x00000003 +#define FILE_QUAD_ALIGNMENT 0x00000007 +#define FILE_OCTA_ALIGNMENT 0x0000000f +#define FILE_32_BYTE_ALIGNMENT 0x0000001f +#define FILE_64_BYTE_ALIGNMENT 0x0000003f +#define FILE_128_BYTE_ALIGNMENT 0x0000007f +#define FILE_256_BYTE_ALIGNMENT 0x000000ff +#define FILE_512_BYTE_ALIGNMENT 0x000001ff // Maximum length of a filename string +#define DOS_MAX_COMPONENT_LENGTH 255 +#define DOS_MAX_PATH_LENGTH (DOS_MAX_COMPONENT_LENGTH + 5) + #define MAXIMUM_FILENAME_LENGTH 256 // Extended attributes -#define FILE_NEED_EA 0x00000080 +#define FILE_NEED_EA 0x00000080 -#define FILE_EA_TYPE_BINARY 0xfffe -#define FILE_EA_TYPE_ASCII 0xfffd -#define FILE_EA_TYPE_BITMAP 0xfffb -#define FILE_EA_TYPE_METAFILE 0xfffa -#define FILE_EA_TYPE_ICON 0xfff9 -#define FILE_EA_TYPE_EA 0xffee -#define FILE_EA_TYPE_MVMT 0xffdf -#define FILE_EA_TYPE_MVST 0xffde -#define FILE_EA_TYPE_ASN1 0xffdd -#define FILE_EA_TYPE_FAMILY_IDS 0xff01 +#define FILE_EA_TYPE_BINARY 0xfffe +#define FILE_EA_TYPE_ASCII 0xfffd +#define FILE_EA_TYPE_BITMAP 0xfffb +#define FILE_EA_TYPE_METAFILE 0xfffa +#define FILE_EA_TYPE_ICON 0xfff9 +#define FILE_EA_TYPE_EA 0xffee +#define FILE_EA_TYPE_MVMT 0xffdf +#define FILE_EA_TYPE_MVST 0xffde +#define FILE_EA_TYPE_ASN1 0xffdd +#define FILE_EA_TYPE_FAMILY_IDS 0xff01 // Device characteristics -#define FILE_REMOVABLE_MEDIA 0x00000001 -#define FILE_READ_ONLY_DEVICE 0x00000002 -#define FILE_FLOPPY_DISKETTE 0x00000004 -#define FILE_WRITE_ONCE_MEDIA 0x00000008 -#define FILE_REMOTE_DEVICE 0x00000010 -#define FILE_DEVICE_IS_MOUNTED 0x00000020 -#define FILE_VIRTUAL_VOLUME 0x00000040 -#define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080 -#define FILE_DEVICE_SECURE_OPEN 0x00000100 -#define FILE_CHARACTERISTIC_PNP_DEVICE 0x00000800 -#define FILE_CHARACTERISTIC_TS_DEVICE 0x00001000 -#define FILE_CHARACTERISTIC_WEBDAV_DEVICE 0x00002000 -#define FILE_CHARACTERISTIC_CSV 0x00010000 -#define FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL 0x00020000 -#define FILE_PORTABLE_DEVICE 0x00040000 -#define FILE_REMOTE_DEVICE_VSMB 0x00080000 -#define FILE_DEVICE_REQUIRE_SECURITY_CHECK 0x00100000 +#define FILE_REMOVABLE_MEDIA 0x00000001 +#define FILE_READ_ONLY_DEVICE 0x00000002 +#define FILE_FLOPPY_DISKETTE 0x00000004 +#define FILE_WRITE_ONCE_MEDIA 0x00000008 +#define FILE_REMOTE_DEVICE 0x00000010 +#define FILE_DEVICE_IS_MOUNTED 0x00000020 +#define FILE_VIRTUAL_VOLUME 0x00000040 +#define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080 +#define FILE_DEVICE_SECURE_OPEN 0x00000100 +#define FILE_CHARACTERISTIC_PNP_DEVICE 0x00000800 +#define FILE_CHARACTERISTIC_TS_DEVICE 0x00001000 +#define FILE_CHARACTERISTIC_WEBDAV_DEVICE 0x00002000 +#define FILE_CHARACTERISTIC_CSV 0x00010000 +#define FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL 0x00020000 +#define FILE_PORTABLE_DEVICE 0x00040000 +#define FILE_REMOTE_DEVICE_VSMB 0x00080000 +#define FILE_DEVICE_REQUIRE_SECURITY_CHECK 0x00100000 // Named pipe values // NamedPipeType for NtCreateNamedPipeFile -#define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000 -#define FILE_PIPE_MESSAGE_TYPE 0x00000001 +#define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000 +#define FILE_PIPE_MESSAGE_TYPE 0x00000001 #define FILE_PIPE_ACCEPT_REMOTE_CLIENTS 0x00000000 #define FILE_PIPE_REJECT_REMOTE_CLIENTS 0x00000002 -#define FILE_PIPE_TYPE_VALID_MASK 0x00000003 +#define FILE_PIPE_TYPE_VALID_MASK 0x00000003 // CompletionMode for NtCreateNamedPipeFile -#define FILE_PIPE_QUEUE_OPERATION 0x00000000 -#define FILE_PIPE_COMPLETE_OPERATION 0x00000001 +#define FILE_PIPE_QUEUE_OPERATION 0x00000000 +#define FILE_PIPE_COMPLETE_OPERATION 0x00000001 // ReadMode for NtCreateNamedPipeFile -#define FILE_PIPE_BYTE_STREAM_MODE 0x00000000 -#define FILE_PIPE_MESSAGE_MODE 0x00000001 +#define FILE_PIPE_BYTE_STREAM_MODE 0x00000000 +#define FILE_PIPE_MESSAGE_MODE 0x00000001 // NamedPipeConfiguration for NtQueryInformationFile -#define FILE_PIPE_INBOUND 0x00000000 -#define FILE_PIPE_OUTBOUND 0x00000001 -#define FILE_PIPE_FULL_DUPLEX 0x00000002 +#define FILE_PIPE_INBOUND 0x00000000 +#define FILE_PIPE_OUTBOUND 0x00000001 +#define FILE_PIPE_FULL_DUPLEX 0x00000002 // NamedPipeState for NtQueryInformationFile -#define FILE_PIPE_DISCONNECTED_STATE 0x00000001 -#define FILE_PIPE_LISTENING_STATE 0x00000002 -#define FILE_PIPE_CONNECTED_STATE 0x00000003 -#define FILE_PIPE_CLOSING_STATE 0x00000004 +#define FILE_PIPE_DISCONNECTED_STATE 0x00000001 +#define FILE_PIPE_LISTENING_STATE 0x00000002 +#define FILE_PIPE_CONNECTED_STATE 0x00000003 +#define FILE_PIPE_CLOSING_STATE 0x00000004 // NamedPipeEnd for NtQueryInformationFile -#define FILE_PIPE_CLIENT_END 0x00000000 -#define FILE_PIPE_SERVER_END 0x00000001 +#define FILE_PIPE_CLIENT_END 0x00000000 +#define FILE_PIPE_SERVER_END 0x00000001 // Win32 pipe instance limit (0xff) -#define FILE_PIPE_UNLIMITED_INSTANCES 0xffffffff +#define FILE_PIPE_UNLIMITED_INSTANCES 0xffffffff // Mailslot values @@ -190,82 +223,89 @@ typedef struct _FILE_IO_COMPLETION_INFORMATION typedef enum _FILE_INFORMATION_CLASS { - FileDirectoryInformation = 1, // FILE_DIRECTORY_INFORMATION - FileFullDirectoryInformation, // FILE_FULL_DIR_INFORMATION - FileBothDirectoryInformation, // FILE_BOTH_DIR_INFORMATION - FileBasicInformation, // FILE_BASIC_INFORMATION - FileStandardInformation, // FILE_STANDARD_INFORMATION - FileInternalInformation, // FILE_INTERNAL_INFORMATION - FileEaInformation, // FILE_EA_INFORMATION - FileAccessInformation, // FILE_ACCESS_INFORMATION - FileNameInformation, // FILE_NAME_INFORMATION - FileRenameInformation, // FILE_RENAME_INFORMATION // 10 - FileLinkInformation, // FILE_LINK_INFORMATION - FileNamesInformation, // FILE_NAMES_INFORMATION - FileDispositionInformation, // FILE_DISPOSITION_INFORMATION - FilePositionInformation, // FILE_POSITION_INFORMATION + FileDirectoryInformation = 1, // q: FILE_DIRECTORY_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) + FileFullDirectoryInformation, // q: FILE_FULL_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) + FileBothDirectoryInformation, // q: FILE_BOTH_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) + FileBasicInformation, // q; s: FILE_BASIC_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) + FileStandardInformation, // q: FILE_STANDARD_INFORMATION, FILE_STANDARD_INFORMATION_EX + FileInternalInformation, // q: FILE_INTERNAL_INFORMATION + FileEaInformation, // q: FILE_EA_INFORMATION + FileAccessInformation, // q: FILE_ACCESS_INFORMATION + FileNameInformation, // q: FILE_NAME_INFORMATION + FileRenameInformation, // s: FILE_RENAME_INFORMATION (requires DELETE) // 10 + FileLinkInformation, // s: FILE_LINK_INFORMATION + FileNamesInformation, // q: FILE_NAMES_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) + FileDispositionInformation, // s: FILE_DISPOSITION_INFORMATION (requires DELETE) + FilePositionInformation, // q; s: FILE_POSITION_INFORMATION FileFullEaInformation, // FILE_FULL_EA_INFORMATION - FileModeInformation, // FILE_MODE_INFORMATION - FileAlignmentInformation, // FILE_ALIGNMENT_INFORMATION - FileAllInformation, // FILE_ALL_INFORMATION - FileAllocationInformation, // FILE_ALLOCATION_INFORMATION - FileEndOfFileInformation, // FILE_END_OF_FILE_INFORMATION // 20 - FileAlternateNameInformation, // FILE_NAME_INFORMATION - FileStreamInformation, // FILE_STREAM_INFORMATION - FilePipeInformation, // FILE_PIPE_INFORMATION - FilePipeLocalInformation, // FILE_PIPE_LOCAL_INFORMATION - FilePipeRemoteInformation, // FILE_PIPE_REMOTE_INFORMATION - FileMailslotQueryInformation, // FILE_MAILSLOT_QUERY_INFORMATION - FileMailslotSetInformation, // FILE_MAILSLOT_SET_INFORMATION - FileCompressionInformation, // FILE_COMPRESSION_INFORMATION - FileObjectIdInformation, // FILE_OBJECTID_INFORMATION - FileCompletionInformation, // FILE_COMPLETION_INFORMATION // 30 - FileMoveClusterInformation, // FILE_MOVE_CLUSTER_INFORMATION - FileQuotaInformation, // FILE_QUOTA_INFORMATION - FileReparsePointInformation, // FILE_REPARSE_POINT_INFORMATION - FileNetworkOpenInformation, // FILE_NETWORK_OPEN_INFORMATION - FileAttributeTagInformation, // FILE_ATTRIBUTE_TAG_INFORMATION - FileTrackingInformation, // FILE_TRACKING_INFORMATION - FileIdBothDirectoryInformation, // FILE_ID_BOTH_DIR_INFORMATION - FileIdFullDirectoryInformation, // FILE_ID_FULL_DIR_INFORMATION - FileValidDataLengthInformation, // FILE_VALID_DATA_LENGTH_INFORMATION - FileShortNameInformation, // FILE_NAME_INFORMATION // 40 - FileIoCompletionNotificationInformation, // FILE_IO_COMPLETION_NOTIFICATION_INFORMATION // since VISTA - FileIoStatusBlockRangeInformation, // FILE_IOSTATUSBLOCK_RANGE_INFORMATION - FileIoPriorityHintInformation, // FILE_IO_PRIORITY_HINT_INFORMATION, FILE_IO_PRIORITY_HINT_INFORMATION_EX - FileSfioReserveInformation, // FILE_SFIO_RESERVE_INFORMATION - FileSfioVolumeInformation, // FILE_SFIO_VOLUME_INFORMATION - FileHardLinkInformation, // FILE_LINKS_INFORMATION - FileProcessIdsUsingFileInformation, // FILE_PROCESS_IDS_USING_FILE_INFORMATION - FileNormalizedNameInformation, // FILE_NAME_INFORMATION - FileNetworkPhysicalNameInformation, // FILE_NETWORK_PHYSICAL_NAME_INFORMATION - FileIdGlobalTxDirectoryInformation, // FILE_ID_GLOBAL_TX_DIR_INFORMATION // since WIN7 // 50 - FileIsRemoteDeviceInformation, // FILE_IS_REMOTE_DEVICE_INFORMATION + FileModeInformation, // q; s: FILE_MODE_INFORMATION + FileAlignmentInformation, // q: FILE_ALIGNMENT_INFORMATION + FileAllInformation, // q: FILE_ALL_INFORMATION (requires FILE_READ_ATTRIBUTES) + FileAllocationInformation, // s: FILE_ALLOCATION_INFORMATION (requires FILE_WRITE_DATA) + FileEndOfFileInformation, // s: FILE_END_OF_FILE_INFORMATION (requires FILE_WRITE_DATA) // 20 + FileAlternateNameInformation, // q: FILE_NAME_INFORMATION + FileStreamInformation, // q: FILE_STREAM_INFORMATION + FilePipeInformation, // q; s: FILE_PIPE_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) + FilePipeLocalInformation, // q: FILE_PIPE_LOCAL_INFORMATION (requires FILE_READ_ATTRIBUTES) + FilePipeRemoteInformation, // q; s: FILE_PIPE_REMOTE_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) + FileMailslotQueryInformation, // q: FILE_MAILSLOT_QUERY_INFORMATION + FileMailslotSetInformation, // s: FILE_MAILSLOT_SET_INFORMATION + FileCompressionInformation, // q: FILE_COMPRESSION_INFORMATION + FileObjectIdInformation, // q: FILE_OBJECTID_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) + FileCompletionInformation, // s: FILE_COMPLETION_INFORMATION // 30 + FileMoveClusterInformation, // s: FILE_MOVE_CLUSTER_INFORMATION (requires FILE_WRITE_DATA) + FileQuotaInformation, // q: FILE_QUOTA_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) + FileReparsePointInformation, // q: FILE_REPARSE_POINT_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) + FileNetworkOpenInformation, // q: FILE_NETWORK_OPEN_INFORMATION (requires FILE_READ_ATTRIBUTES) + FileAttributeTagInformation, // q: FILE_ATTRIBUTE_TAG_INFORMATION (requires FILE_READ_ATTRIBUTES) + FileTrackingInformation, // s: FILE_TRACKING_INFORMATION (requires FILE_WRITE_DATA) + FileIdBothDirectoryInformation, // q: FILE_ID_BOTH_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) + FileIdFullDirectoryInformation, // q: FILE_ID_FULL_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) + FileValidDataLengthInformation, // s: FILE_VALID_DATA_LENGTH_INFORMATION (requires FILE_WRITE_DATA and/or SeManageVolumePrivilege) + FileShortNameInformation, // s: FILE_NAME_INFORMATION (requires DELETE) // 40 + FileIoCompletionNotificationInformation, // q; s: FILE_IO_COMPLETION_NOTIFICATION_INFORMATION (q: requires FILE_READ_ATTRIBUTES) // since VISTA + FileIoStatusBlockRangeInformation, // s: FILE_IOSTATUSBLOCK_RANGE_INFORMATION (requires SeLockMemoryPrivilege) + FileIoPriorityHintInformation, // q; s: FILE_IO_PRIORITY_HINT_INFORMATION, FILE_IO_PRIORITY_HINT_INFORMATION_EX (q: requires FILE_READ_DATA) + FileSfioReserveInformation, // q; s: FILE_SFIO_RESERVE_INFORMATION (q: requires FILE_READ_DATA) + FileSfioVolumeInformation, // q: FILE_SFIO_VOLUME_INFORMATION (requires FILE_READ_ATTRIBUTES) + FileHardLinkInformation, // q: FILE_LINKS_INFORMATION + FileProcessIdsUsingFileInformation, // q: FILE_PROCESS_IDS_USING_FILE_INFORMATION (requires FILE_READ_ATTRIBUTES) + FileNormalizedNameInformation, // q: FILE_NAME_INFORMATION + FileNetworkPhysicalNameInformation, // q: FILE_NETWORK_PHYSICAL_NAME_INFORMATION + FileIdGlobalTxDirectoryInformation, // q: FILE_ID_GLOBAL_TX_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) // since WIN7 // 50 + FileIsRemoteDeviceInformation, // q: FILE_IS_REMOTE_DEVICE_INFORMATION (requires FILE_READ_ATTRIBUTES) FileUnusedInformation, - FileNumaNodeInformation, // FILE_NUMA_NODE_INFORMATION - FileStandardLinkInformation, // FILE_STANDARD_LINK_INFORMATION - FileRemoteProtocolInformation, // FILE_REMOTE_PROTOCOL_INFORMATION - FileRenameInformationBypassAccessCheck, // (kernel-mode only); FILE_RENAME_INFORMATION // since WIN8 - FileLinkInformationBypassAccessCheck, // (kernel-mode only); FILE_LINK_INFORMATION - FileVolumeNameInformation, // FILE_VOLUME_NAME_INFORMATION - FileIdInformation, // FILE_ID_INFORMATION - FileIdExtdDirectoryInformation, // FILE_ID_EXTD_DIR_INFORMATION // 60 - FileReplaceCompletionInformation, // FILE_COMPLETION_INFORMATION // since WINBLUE - FileHardLinkFullIdInformation, // FILE_LINK_ENTRY_FULL_ID_INFORMATION // FILE_LINKS_FULL_ID_INFORMATION - FileIdExtdBothDirectoryInformation, // FILE_ID_EXTD_BOTH_DIR_INFORMATION // since THRESHOLD - FileDispositionInformationEx, // FILE_DISPOSITION_INFO_EX // since REDSTONE - FileRenameInformationEx, // FILE_RENAME_INFORMATION_EX - FileRenameInformationExBypassAccessCheck, // (kernel-mode only); FILE_RENAME_INFORMATION_EX - FileDesiredStorageClassInformation, // FILE_DESIRED_STORAGE_CLASS_INFORMATION // since REDSTONE2 - FileStatInformation, // FILE_STAT_INFORMATION - FileMemoryPartitionInformation, // FILE_MEMORY_PARTITION_INFORMATION // since REDSTONE3 - FileStatLxInformation, // FILE_STAT_LX_INFORMATION // since REDSTONE4 // 70 - FileCaseSensitiveInformation, // FILE_CASE_SENSITIVE_INFORMATION - FileLinkInformationEx, // FILE_LINK_INFORMATION_EX // since REDSTONE5 - FileLinkInformationExBypassAccessCheck, // (kernel-mode only); FILE_LINK_INFORMATION_EX - FileStorageReserveIdInformation, // FILE_SET_STORAGE_RESERVE_ID_INFORMATION - FileCaseSensitiveInformationForceAccessCheck, // FILE_CASE_SENSITIVE_INFORMATION - FileKnownFolderInformation, // FILE_KNOWN_FOLDER_INFORMATION // since WIN11 + FileNumaNodeInformation, // q: FILE_NUMA_NODE_INFORMATION + FileStandardLinkInformation, // q: FILE_STANDARD_LINK_INFORMATION + FileRemoteProtocolInformation, // q: FILE_REMOTE_PROTOCOL_INFORMATION + FileRenameInformationBypassAccessCheck, // (kernel-mode only); s: FILE_RENAME_INFORMATION // since WIN8 + FileLinkInformationBypassAccessCheck, // (kernel-mode only); s: FILE_LINK_INFORMATION + FileVolumeNameInformation, // q: FILE_VOLUME_NAME_INFORMATION + FileIdInformation, // q: FILE_ID_INFORMATION + FileIdExtdDirectoryInformation, // q: FILE_ID_EXTD_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) // 60 + FileReplaceCompletionInformation, // s: FILE_COMPLETION_INFORMATION // since WINBLUE + FileHardLinkFullIdInformation, // q: FILE_LINK_ENTRY_FULL_ID_INFORMATION // FILE_LINKS_FULL_ID_INFORMATION + FileIdExtdBothDirectoryInformation, // q: FILE_ID_EXTD_BOTH_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) // since THRESHOLD + FileDispositionInformationEx, // s: FILE_DISPOSITION_INFO_EX (requires DELETE) // since REDSTONE + FileRenameInformationEx, // s: FILE_RENAME_INFORMATION_EX + FileRenameInformationExBypassAccessCheck, // (kernel-mode only); s: FILE_RENAME_INFORMATION_EX + FileDesiredStorageClassInformation, // q; s: FILE_DESIRED_STORAGE_CLASS_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) // since REDSTONE2 + FileStatInformation, // q: FILE_STAT_INFORMATION (requires FILE_READ_ATTRIBUTES) + FileMemoryPartitionInformation, // s: FILE_MEMORY_PARTITION_INFORMATION // since REDSTONE3 + FileStatLxInformation, // q: FILE_STAT_LX_INFORMATION (requires FILE_READ_ATTRIBUTES and FILE_READ_EA) // since REDSTONE4 // 70 + FileCaseSensitiveInformation, // q; s: FILE_CASE_SENSITIVE_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) + FileLinkInformationEx, // s: FILE_LINK_INFORMATION_EX // since REDSTONE5 + FileLinkInformationExBypassAccessCheck, // (kernel-mode only); s: FILE_LINK_INFORMATION_EX + FileStorageReserveIdInformation, // q; s: FILE_STORAGE_RESERVE_ID_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) + FileCaseSensitiveInformationForceAccessCheck, // q; s: FILE_CASE_SENSITIVE_INFORMATION + FileKnownFolderInformation, // q; s: FILE_KNOWN_FOLDER_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) // since WIN11 + FileStatBasicInformation, // since 23H2 + FileId64ExtdDirectoryInformation, + FileId64ExtdBothDirectoryInformation, + FileIdAllExtdDirectoryInformation, + FileIdAllExtdBothDirectoryInformation, + FileStreamReservationInformation, // FILE_STREAM_RESERVATION_INFORMATION // since 24H2 + FileMupProviderInfo, // MUP_PROVIDER_INFORMATION FileMaximumInformation } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS; @@ -289,6 +329,7 @@ typedef struct _FILE_STANDARD_INFORMATION BOOLEAN Directory; } FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION; +//#if (PHNT_VERSION >= PHNT_THRESHOLD) typedef struct _FILE_STANDARD_INFORMATION_EX { LARGE_INTEGER AllocationSize; @@ -299,10 +340,19 @@ typedef struct _FILE_STANDARD_INFORMATION_EX BOOLEAN AlternateStream; BOOLEAN MetadataAttribute; } FILE_STANDARD_INFORMATION_EX, *PFILE_STANDARD_INFORMATION_EX; +//#endif typedef struct _FILE_INTERNAL_INFORMATION { - LARGE_INTEGER IndexNumber; + union + { + LARGE_INTEGER IndexNumber; + struct + { + LONGLONG MftRecordIndex : 48; // rev + LONGLONG SequenceNumber : 16; // rev + }; + }; } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION; typedef struct _FILE_EA_INFORMATION @@ -333,7 +383,7 @@ typedef struct _FILE_ALIGNMENT_INFORMATION typedef struct _FILE_NAME_INFORMATION { ULONG FileNameLength; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION; typedef struct _FILE_ALL_INFORMATION @@ -392,11 +442,11 @@ typedef struct _FILE_END_OF_FILE_INFORMATION } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION; //#if (PHNT_VERSION >= PHNT_REDSTONE5) -#define FLAGS_END_OF_FILE_INFO_EX_EXTEND_PAGING 0x00000001 -#define FLAGS_END_OF_FILE_INFO_EX_NO_EXTRA_PAGING_EXTEND 0x00000002 -#define FLAGS_END_OF_FILE_INFO_EX_TIME_CONSTRAINED 0x00000004 -#define FLAGS_DELAY_REASONS_LOG_FILE_FULL 0x00000001 -#define FLAGS_DELAY_REASONS_BITMAP_SCANNED 0x00000002 +#define FLAGS_END_OF_FILE_INFO_EX_EXTEND_PAGING 0x00000001 +#define FLAGS_END_OF_FILE_INFO_EX_NO_EXTRA_PAGING_EXTEND 0x00000002 +#define FLAGS_END_OF_FILE_INFO_EX_TIME_CONSTRAINED 0x00000004 +#define FLAGS_DELAY_REASONS_LOG_FILE_FULL 0x00000001 +#define FLAGS_DELAY_REASONS_BITMAP_SCANNED 0x00000002 typedef struct _FILE_END_OF_FILE_INFORMATION_EX { @@ -413,23 +463,23 @@ typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION } FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION; #define FILE_LINK_REPLACE_IF_EXISTS 0x00000001 // since RS5 -#define FILE_LINK_POSIX_SEMANTICS 0x00000002 +#define FILE_LINK_POSIX_SEMANTICS 0x00000002 -#define FILE_LINK_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008 -#define FILE_LINK_NO_INCREASE_AVAILABLE_SPACE 0x00000010 -#define FILE_LINK_NO_DECREASE_AVAILABLE_SPACE 0x00000020 -#define FILE_LINK_PRESERVE_AVAILABLE_SPACE 0x00000030 -#define FILE_LINK_IGNORE_READONLY_ATTRIBUTE 0x00000040 -#define FILE_LINK_FORCE_RESIZE_TARGET_SR 0x00000080 // since 19H1 -#define FILE_LINK_FORCE_RESIZE_SOURCE_SR 0x00000100 -#define FILE_LINK_FORCE_RESIZE_SR 0x00000180 +#define FILE_LINK_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008 +#define FILE_LINK_NO_INCREASE_AVAILABLE_SPACE 0x00000010 +#define FILE_LINK_NO_DECREASE_AVAILABLE_SPACE 0x00000020 +#define FILE_LINK_PRESERVE_AVAILABLE_SPACE 0x00000030 +#define FILE_LINK_IGNORE_READONLY_ATTRIBUTE 0x00000040 +#define FILE_LINK_FORCE_RESIZE_TARGET_SR 0x00000080 // since 19H1 +#define FILE_LINK_FORCE_RESIZE_SOURCE_SR 0x00000100 +#define FILE_LINK_FORCE_RESIZE_SR 0x00000180 typedef struct _FILE_LINK_INFORMATION { BOOLEAN ReplaceIfExists; HANDLE RootDirectory; ULONG FileNameLength; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION; typedef struct _FILE_LINK_INFORMATION_EX @@ -437,7 +487,7 @@ typedef struct _FILE_LINK_INFORMATION_EX ULONG Flags; HANDLE RootDirectory; ULONG FileNameLength; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_LINK_INFORMATION_EX, *PFILE_LINK_INFORMATION_EX; typedef struct _FILE_MOVE_CLUSTER_INFORMATION @@ -445,7 +495,7 @@ typedef struct _FILE_MOVE_CLUSTER_INFORMATION ULONG ClusterCount; HANDLE RootDirectory; ULONG FileNameLength; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_MOVE_CLUSTER_INFORMATION, *PFILE_MOVE_CLUSTER_INFORMATION; typedef struct _FILE_RENAME_INFORMATION @@ -453,27 +503,27 @@ typedef struct _FILE_RENAME_INFORMATION BOOLEAN ReplaceIfExists; HANDLE RootDirectory; ULONG FileNameLength; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION; -#define FILE_RENAME_REPLACE_IF_EXISTS 0x00000001 // since REDSTONE -#define FILE_RENAME_POSIX_SEMANTICS 0x00000002 -#define FILE_RENAME_SUPPRESS_PIN_STATE_INHERITANCE 0x00000004 // since REDSTONE3 -#define FILE_RENAME_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008 // since REDSTONE5 -#define FILE_RENAME_NO_INCREASE_AVAILABLE_SPACE 0x00000010 -#define FILE_RENAME_NO_DECREASE_AVAILABLE_SPACE 0x00000020 -#define FILE_RENAME_PRESERVE_AVAILABLE_SPACE 0x00000030 -#define FILE_RENAME_IGNORE_READONLY_ATTRIBUTE 0x00000040 -#define FILE_RENAME_FORCE_RESIZE_TARGET_SR 0x00000080 // since 19H1 -#define FILE_RENAME_FORCE_RESIZE_SOURCE_SR 0x00000100 -#define FILE_RENAME_FORCE_RESIZE_SR 0x00000180 +#define FILE_RENAME_REPLACE_IF_EXISTS 0x00000001 // since REDSTONE +#define FILE_RENAME_POSIX_SEMANTICS 0x00000002 +#define FILE_RENAME_SUPPRESS_PIN_STATE_INHERITANCE 0x00000004 // since REDSTONE3 +#define FILE_RENAME_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008 // since REDSTONE5 +#define FILE_RENAME_NO_INCREASE_AVAILABLE_SPACE 0x00000010 +#define FILE_RENAME_NO_DECREASE_AVAILABLE_SPACE 0x00000020 +#define FILE_RENAME_PRESERVE_AVAILABLE_SPACE 0x00000030 +#define FILE_RENAME_IGNORE_READONLY_ATTRIBUTE 0x00000040 +#define FILE_RENAME_FORCE_RESIZE_TARGET_SR 0x00000080 // since 19H1 +#define FILE_RENAME_FORCE_RESIZE_SOURCE_SR 0x00000100 +#define FILE_RENAME_FORCE_RESIZE_SR 0x00000180 typedef struct _FILE_RENAME_INFORMATION_EX { ULONG Flags; HANDLE RootDirectory; ULONG FileNameLength; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_RENAME_INFORMATION_EX, *PFILE_RENAME_INFORMATION_EX; typedef struct _FILE_STREAM_INFORMATION @@ -482,14 +532,14 @@ typedef struct _FILE_STREAM_INFORMATION ULONG StreamNameLength; LARGE_INTEGER StreamSize; LARGE_INTEGER StreamAllocationSize; - WCHAR StreamName[1]; + _Field_size_bytes_(StreamNameLength) WCHAR StreamName[1]; } FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION; typedef struct _FILE_TRACKING_INFORMATION { HANDLE DestinationFile; ULONG ObjectInformationLength; - CHAR ObjectInformation[1]; + _Field_size_bytes_(ObjectInformationLength) CHAR ObjectInformation[1]; } FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION; typedef struct _FILE_COMPLETION_INFORMATION @@ -549,7 +599,7 @@ typedef struct _FILE_LINK_ENTRY_INFORMATION ULONG NextEntryOffset; LONGLONG ParentFileId; // LARGE_INTEGER ULONG FileNameLength; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_LINK_ENTRY_INFORMATION, *PFILE_LINK_ENTRY_INFORMATION; typedef struct _FILE_LINKS_INFORMATION @@ -562,7 +612,7 @@ typedef struct _FILE_LINKS_INFORMATION typedef struct _FILE_NETWORK_PHYSICAL_NAME_INFORMATION { ULONG FileNameLength; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_NETWORK_PHYSICAL_NAME_INFORMATION, *PFILE_NETWORK_PHYSICAL_NAME_INFORMATION; typedef struct _FILE_STANDARD_LINK_INFORMATION @@ -600,7 +650,7 @@ typedef enum _IO_PRIORITY_HINT MaxIoPriorityTypes } IO_PRIORITY_HINT; -typedef DECLSPEC_ALIGN(8) struct _FILE_IO_PRIORITY_HINT_INFORMATION +typedef struct DECLSPEC_ALIGN(8) _FILE_IO_PRIORITY_HINT_INFORMATION { IO_PRIORITY_HINT PriorityHint; } FILE_IO_PRIORITY_HINT_INFORMATION, *PFILE_IO_PRIORITY_HINT_INFORMATION; @@ -623,7 +673,7 @@ typedef struct _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION typedef struct _FILE_PROCESS_IDS_USING_FILE_INFORMATION { ULONG NumberOfProcessIdsInList; - ULONG_PTR ProcessIdList[1]; + _Field_size_(NumberOfProcessIdsInList) ULONG_PTR ProcessIdList[1]; } FILE_PROCESS_IDS_USING_FILE_INFORMATION, *PFILE_PROCESS_IDS_USING_FILE_INFORMATION; typedef struct _FILE_IS_REMOTE_DEVICE_INFORMATION @@ -668,7 +718,7 @@ typedef struct _FILE_REMOTE_PROTOCOL_INFORMATION // Protocol specific information -#if (_WIN32_WINNT < PHNT_WIN8) +#if (PHNT_VERSION < PHNT_WIN8) struct { ULONG Reserved[16]; @@ -717,13 +767,64 @@ typedef struct _FILE_INTEGRITY_STREAM_INFORMATION typedef struct _FILE_VOLUME_NAME_INFORMATION { ULONG DeviceNameLength; - WCHAR DeviceName[1]; + _Field_size_bytes_(DeviceNameLength) WCHAR DeviceName[1]; } FILE_VOLUME_NAME_INFORMATION, *PFILE_VOLUME_NAME_INFORMATION; +#ifndef FILE_INVALID_FILE_ID +#define FILE_INVALID_FILE_ID ((LONGLONG)-1LL) +#endif + +#define FILE_ID_IS_INVALID(FID) ((FID).QuadPart == FILE_INVALID_FILE_ID) + +#define FILE_ID_128_IS_INVALID(FID128) \ + (((FID128).Identifier[0] == (UCHAR)-1) && \ + ((FID128).Identifier[1] == (UCHAR)-1) && \ + ((FID128).Identifier[2] == (UCHAR)-1) && \ + ((FID128).Identifier[3] == (UCHAR)-1) && \ + ((FID128).Identifier[4] == (UCHAR)-1) && \ + ((FID128).Identifier[5] == (UCHAR)-1) && \ + ((FID128).Identifier[6] == (UCHAR)-1) && \ + ((FID128).Identifier[7] == (UCHAR)-1) && \ + ((FID128).Identifier[8] == (UCHAR)-1) && \ + ((FID128).Identifier[9] == (UCHAR)-1) && \ + ((FID128).Identifier[10] == (UCHAR)-1) && \ + ((FID128).Identifier[11] == (UCHAR)-1) && \ + ((FID128).Identifier[12] == (UCHAR)-1) && \ + ((FID128).Identifier[13] == (UCHAR)-1) && \ + ((FID128).Identifier[14] == (UCHAR)-1) && \ + ((FID128).Identifier[15] == (UCHAR)-1)) + +#define MAKE_INVALID_FILE_ID_128(FID128) { \ + ((FID128).Identifier[0] = (UCHAR)-1); \ + ((FID128).Identifier[1] = (UCHAR)-1); \ + ((FID128).Identifier[2] = (UCHAR)-1); \ + ((FID128).Identifier[3] = (UCHAR)-1); \ + ((FID128).Identifier[4] = (UCHAR)-1); \ + ((FID128).Identifier[5] = (UCHAR)-1); \ + ((FID128).Identifier[6] = (UCHAR)-1); \ + ((FID128).Identifier[7] = (UCHAR)-1); \ + ((FID128).Identifier[8] = (UCHAR)-1); \ + ((FID128).Identifier[9] = (UCHAR)-1); \ + ((FID128).Identifier[10] = (UCHAR)-1); \ + ((FID128).Identifier[11] = (UCHAR)-1); \ + ((FID128).Identifier[12] = (UCHAR)-1); \ + ((FID128).Identifier[13] = (UCHAR)-1); \ + ((FID128).Identifier[14] = (UCHAR)-1); \ + ((FID128).Identifier[15] = (UCHAR)-1); \ +} + typedef struct _FILE_ID_INFORMATION { ULONGLONG VolumeSerialNumber; - FILE_ID_128 FileId; + union + { + FILE_ID_128 FileId; + struct + { + LONGLONG FileIdLowPart : 64; // rev + LONGLONG FileIdHighPart : 64; // rev + }; + }; } FILE_ID_INFORMATION, *PFILE_ID_INFORMATION; typedef struct _FILE_ID_EXTD_DIR_INFORMATION @@ -741,7 +842,7 @@ typedef struct _FILE_ID_EXTD_DIR_INFORMATION ULONG EaSize; ULONG ReparsePointTag; FILE_ID_128 FileId; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_ID_EXTD_DIR_INFORMATION, *PFILE_ID_EXTD_DIR_INFORMATION; typedef struct _FILE_LINK_ENTRY_FULL_ID_INFORMATION @@ -749,7 +850,7 @@ typedef struct _FILE_LINK_ENTRY_FULL_ID_INFORMATION ULONG NextEntryOffset; FILE_ID_128 ParentFileId; ULONG FileNameLength; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_LINK_ENTRY_FULL_ID_INFORMATION, *PFILE_LINK_ENTRY_FULL_ID_INFORMATION; typedef struct _FILE_LINKS_FULL_ID_INFORMATION @@ -776,10 +877,10 @@ typedef struct _FILE_ID_EXTD_BOTH_DIR_INFORMATION FILE_ID_128 FileId; CCHAR ShortNameLength; WCHAR ShortName[12]; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_ID_EXTD_BOTH_DIR_INFORMATION, *PFILE_ID_EXTD_BOTH_DIR_INFORMATION; -// private +#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE) typedef struct _FILE_STAT_INFORMATION { LARGE_INTEGER FileId; @@ -795,7 +896,26 @@ typedef struct _FILE_STAT_INFORMATION ACCESS_MASK EffectiveAccess; } FILE_STAT_INFORMATION, *PFILE_STAT_INFORMATION; -// private +typedef struct _FILE_STAT_BASIC_INFORMATION +{ + LARGE_INTEGER FileId; + LARGE_INTEGER CreationTime; + LARGE_INTEGER LastAccessTime; + LARGE_INTEGER LastWriteTime; + LARGE_INTEGER ChangeTime; + LARGE_INTEGER AllocationSize; + LARGE_INTEGER EndOfFile; + ULONG FileAttributes; + ULONG ReparseTag; + ULONG NumberOfLinks; + ULONG DeviceType; + ULONG DeviceCharacteristics; + ULONG Reserved; + LARGE_INTEGER VolumeSerialNumber; + FILE_ID_128 FileId128; +} FILE_STAT_BASIC_INFORMATION, *PFILE_STAT_BASIC_INFORMATION; +#endif + typedef struct _FILE_MEMORY_PARTITION_INFORMATION { HANDLE OwnerPartitionHandle; @@ -817,7 +937,7 @@ typedef struct _FILE_MEMORY_PARTITION_INFORMATION #define LX_FILE_METADATA_HAS_DEVICE_ID 0x8 #define LX_FILE_CASE_SENSITIVE_DIR 0x10 -// private +#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE) typedef struct _FILE_STAT_LX_INFORMATION { LARGE_INTEGER FileId; @@ -838,16 +958,22 @@ typedef struct _FILE_STAT_LX_INFORMATION ULONG LxDeviceIdMajor; ULONG LxDeviceIdMinor; } FILE_STAT_LX_INFORMATION, *PFILE_STAT_LX_INFORMATION; +#endif + +typedef struct _FILE_STORAGE_RESERVE_ID_INFORMATION +{ + STORAGE_RESERVE_ID StorageReserveId; +} FILE_STORAGE_RESERVE_ID_INFORMATION, *PFILE_STORAGE_RESERVE_ID_INFORMATION; #define FILE_CS_FLAG_CASE_SENSITIVE_DIR 0x00000001 -// private +#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE) typedef struct _FILE_CASE_SENSITIVE_INFORMATION { ULONG Flags; } FILE_CASE_SENSITIVE_INFORMATION, *PFILE_CASE_SENSITIVE_INFORMATION; +#endif -// private typedef enum _FILE_KNOWN_FOLDER_TYPE { KnownFolderNone, @@ -861,12 +987,26 @@ typedef enum _FILE_KNOWN_FOLDER_TYPE KnownFolderMax = 7 } FILE_KNOWN_FOLDER_TYPE; -// private typedef struct _FILE_KNOWN_FOLDER_INFORMATION { FILE_KNOWN_FOLDER_TYPE Type; } FILE_KNOWN_FOLDER_INFORMATION, *PFILE_KNOWN_FOLDER_INFORMATION; +// private +typedef struct _FILE_STREAM_RESERVATION_INFORMATION +{ + ULONG_PTR TrackedReservation; + ULONG_PTR EnforcedReservation; +} FILE_STREAM_RESERVATION_INFORMATION, *PFILE_STREAM_RESERVATION_INFORMATION; + +// private +typedef struct _MUP_PROVIDER_INFORMATION +{ + ULONG Level; + PVOID Buffer; + SIZE_T BufferSize; +} MUP_PROVIDER_INFORMATION, *PMUP_PROVIDER_INFORMATION; + // NtQueryDirectoryFile types typedef struct _FILE_DIRECTORY_INFORMATION @@ -881,7 +1021,7 @@ typedef struct _FILE_DIRECTORY_INFORMATION LARGE_INTEGER AllocationSize; ULONG FileAttributes; ULONG FileNameLength; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION; typedef struct _FILE_FULL_DIR_INFORMATION @@ -897,7 +1037,7 @@ typedef struct _FILE_FULL_DIR_INFORMATION ULONG FileAttributes; ULONG FileNameLength; ULONG EaSize; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION; typedef struct _FILE_ID_FULL_DIR_INFORMATION @@ -914,7 +1054,7 @@ typedef struct _FILE_ID_FULL_DIR_INFORMATION ULONG FileNameLength; ULONG EaSize; LARGE_INTEGER FileId; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION; typedef struct _FILE_BOTH_DIR_INFORMATION @@ -932,7 +1072,7 @@ typedef struct _FILE_BOTH_DIR_INFORMATION ULONG EaSize; CCHAR ShortNameLength; WCHAR ShortName[12]; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION; typedef struct _FILE_ID_BOTH_DIR_INFORMATION @@ -951,7 +1091,7 @@ typedef struct _FILE_ID_BOTH_DIR_INFORMATION CCHAR ShortNameLength; WCHAR ShortName[12]; LARGE_INTEGER FileId; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION; typedef struct _FILE_NAMES_INFORMATION @@ -959,7 +1099,7 @@ typedef struct _FILE_NAMES_INFORMATION ULONG NextEntryOffset; ULONG FileIndex; ULONG FileNameLength; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION; typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION @@ -977,7 +1117,7 @@ typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION LARGE_INTEGER FileId; GUID LockingTransactionId; ULONG TxInfoFlags; - WCHAR FileName[1]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_ID_GLOBAL_TX_DIR_INFORMATION, *PFILE_ID_GLOBAL_TX_DIR_INFORMATION; #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_WRITELOCKED 0x00000001 @@ -1000,6 +1140,11 @@ typedef struct _FILE_OBJECTID_INFORMATION }; } FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION; +typedef struct _FILE_DIRECTORY_NEXT_INFORMATION +{ + ULONG NextEntryOffset; +} FILE_DIRECTORY_NEXT_INFORMATION, *PFILE_DIRECTORY_NEXT_INFORMATION; + // NtQueryEaFile/NtSetEaFile types typedef struct _FILE_FULL_EA_INFORMATION @@ -1008,14 +1153,16 @@ typedef struct _FILE_FULL_EA_INFORMATION UCHAR Flags; UCHAR EaNameLength; USHORT EaValueLength; - CHAR EaName[1]; + _Field_size_bytes_(EaNameLength) CHAR EaName[1]; + // ... + // UCHAR EaValue[1] } FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION; typedef struct _FILE_GET_EA_INFORMATION { ULONG NextEntryOffset; UCHAR EaNameLength; - CHAR EaName[1]; + _Field_size_bytes_(EaNameLength) CHAR EaName[1]; } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION; // NtQueryQuotaInformationFile/NtSetQuotaInformationFile types @@ -1024,7 +1171,7 @@ typedef struct _FILE_GET_QUOTA_INFORMATION { ULONG NextEntryOffset; ULONG SidLength; - SID Sid; + _Field_size_bytes_(SidLength) SID Sid; } FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION; typedef struct _FILE_QUOTA_INFORMATION @@ -1035,48 +1182,47 @@ typedef struct _FILE_QUOTA_INFORMATION LARGE_INTEGER QuotaUsed; LARGE_INTEGER QuotaThreshold; LARGE_INTEGER QuotaLimit; - SID Sid; + _Field_size_bytes_(SidLength) SID Sid; } FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION; typedef enum _FSINFOCLASS { - FileFsVolumeInformation = 1, // FILE_FS_VOLUME_INFORMATION - FileFsLabelInformation, // FILE_FS_LABEL_INFORMATION - FileFsSizeInformation, // FILE_FS_SIZE_INFORMATION - FileFsDeviceInformation, // FILE_FS_DEVICE_INFORMATION - FileFsAttributeInformation, // FILE_FS_ATTRIBUTE_INFORMATION - FileFsControlInformation, // FILE_FS_CONTROL_INFORMATION - FileFsFullSizeInformation, // FILE_FS_FULL_SIZE_INFORMATION - FileFsObjectIdInformation, // FILE_FS_OBJECTID_INFORMATION - FileFsDriverPathInformation, // FILE_FS_DRIVER_PATH_INFORMATION - FileFsVolumeFlagsInformation, // FILE_FS_VOLUME_FLAGS_INFORMATION // 10 - FileFsSectorSizeInformation, // FILE_FS_SECTOR_SIZE_INFORMATION // since WIN8 - FileFsDataCopyInformation, // FILE_FS_DATA_COPY_INFORMATION - FileFsMetadataSizeInformation, // FILE_FS_METADATA_SIZE_INFORMATION // since THRESHOLD - FileFsFullSizeInformationEx, // FILE_FS_FULL_SIZE_INFORMATION_EX // since REDSTONE5 + FileFsVolumeInformation = 1, // q: FILE_FS_VOLUME_INFORMATION + FileFsLabelInformation, // s: FILE_FS_LABEL_INFORMATION (requires FILE_WRITE_DATA to volume) + FileFsSizeInformation, // q: FILE_FS_SIZE_INFORMATION + FileFsDeviceInformation, // q: FILE_FS_DEVICE_INFORMATION + FileFsAttributeInformation, // q: FILE_FS_ATTRIBUTE_INFORMATION + FileFsControlInformation, // q, s: FILE_FS_CONTROL_INFORMATION (q: requires FILE_READ_DATA; s: requires FILE_WRITE_DATA to volume) + FileFsFullSizeInformation, // q: FILE_FS_FULL_SIZE_INFORMATION + FileFsObjectIdInformation, // q; s: FILE_FS_OBJECTID_INFORMATION (s: requires FILE_WRITE_DATA to volume) + FileFsDriverPathInformation, // q: FILE_FS_DRIVER_PATH_INFORMATION + FileFsVolumeFlagsInformation, // q; s: FILE_FS_VOLUME_FLAGS_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES to volume) // 10 + FileFsSectorSizeInformation, // q: FILE_FS_SECTOR_SIZE_INFORMATION // since WIN8 + FileFsDataCopyInformation, // q: FILE_FS_DATA_COPY_INFORMATION + FileFsMetadataSizeInformation, // q: FILE_FS_METADATA_SIZE_INFORMATION // since THRESHOLD + FileFsFullSizeInformationEx, // q: FILE_FS_FULL_SIZE_INFORMATION_EX // since REDSTONE5 + FileFsGuidInformation, // q: FILE_FS_GUID_INFORMATION // since 23H2 FileFsMaximumInformation } FSINFOCLASS, *PFSINFOCLASS; +typedef enum _FSINFOCLASS FS_INFORMATION_CLASS; // NtQueryVolumeInformation/NtSetVolumeInformation types -// private typedef struct _FILE_FS_VOLUME_INFORMATION { LARGE_INTEGER VolumeCreationTime; ULONG VolumeSerialNumber; ULONG VolumeLabelLength; BOOLEAN SupportsObjects; - WCHAR VolumeLabel[1]; + _Field_size_bytes_(VolumeLabelLength) WCHAR VolumeLabel[1]; } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION; -// private typedef struct _FILE_FS_LABEL_INFORMATION { ULONG VolumeLabelLength; - WCHAR VolumeLabel[1]; -} FILE_FS_LABEL_INFORMATION, * PFILE_FS_LABEL_INFORMATION; + _Field_size_bytes_(VolumeLabelLength) WCHAR VolumeLabel[1]; +} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION; -// private typedef struct _FILE_FS_SIZE_INFORMATION { LARGE_INTEGER TotalAllocationUnits; @@ -1099,7 +1245,6 @@ typedef struct _FILE_FS_SIZE_INFORMATION #define FILE_VC_QUOTAS_REBUILDING 0x00000200 #define FILE_VC_VALID_MASK 0x000003ff -// private typedef struct _FILE_FS_CONTROL_INFORMATION { LARGE_INTEGER FreeSpaceStartFiltering; @@ -1107,10 +1252,9 @@ typedef struct _FILE_FS_CONTROL_INFORMATION LARGE_INTEGER FreeSpaceStopFiltering; LARGE_INTEGER DefaultQuotaThreshold; LARGE_INTEGER DefaultQuotaLimit; - ULONG FileSystemControlFlags; + ULONG FileSystemControlFlags; // FILE_VC_* } FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION; -// private typedef struct _FILE_FS_FULL_SIZE_INFORMATION { LARGE_INTEGER TotalAllocationUnits; @@ -1120,38 +1264,42 @@ typedef struct _FILE_FS_FULL_SIZE_INFORMATION ULONG BytesPerSector; } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION; -// private typedef struct _FILE_FS_OBJECTID_INFORMATION { UCHAR ObjectId[16]; - UCHAR ExtendedInfo[48]; + union + { + struct + { + UCHAR BirthVolumeId[16]; + UCHAR BirthObjectId[16]; + UCHAR DomainId[16]; + }; + UCHAR ExtendedInfo[48]; + }; } FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION; -// private typedef struct _FILE_FS_DEVICE_INFORMATION { DEVICE_TYPE DeviceType; ULONG Characteristics; } FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION; -// private typedef struct _FILE_FS_ATTRIBUTE_INFORMATION { ULONG FileSystemAttributes; LONG MaximumComponentNameLength; ULONG FileSystemNameLength; - WCHAR FileSystemName[1]; + _Field_size_bytes_(FileSystemNameLength) WCHAR FileSystemName[1]; } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION; -// private typedef struct _FILE_FS_DRIVER_PATH_INFORMATION { BOOLEAN DriverInPath; ULONG DriverNameLength; - WCHAR DriverName[1]; + _Field_size_bytes_(DriverNameLength) WCHAR DriverName[1]; } FILE_FS_DRIVER_PATH_INFORMATION, *PFILE_FS_DRIVER_PATH_INFORMATION; -// private typedef struct _FILE_FS_VOLUME_FLAGS_INFORMATION { ULONG Flags; @@ -1159,6 +1307,9 @@ typedef struct _FILE_FS_VOLUME_FLAGS_INFORMATION #define SSINFO_FLAGS_ALIGNED_DEVICE 0x00000001 #define SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE 0x00000002 +#define SSINFO_FLAGS_NO_SEEK_PENALTY 0x00000004 +#define SSINFO_FLAGS_TRIM_ENABLED 0x00000008 +#define SSINFO_FLAGS_BYTE_ADDRESSABLE 0x00000010 // since REDSTONE // If set for Sector and Partition fields, alignment is not known. #define SSINFO_OFFSET_UNKNOWN 0xffffffff @@ -1169,18 +1320,16 @@ typedef struct _FILE_FS_SECTOR_SIZE_INFORMATION ULONG PhysicalBytesPerSectorForAtomicity; ULONG PhysicalBytesPerSectorForPerformance; ULONG FileSystemEffectivePhysicalBytesPerSectorForAtomicity; - ULONG Flags; + ULONG Flags; // SSINFO_FLAGS_* ULONG ByteOffsetForSectorAlignment; ULONG ByteOffsetForPartitionAlignment; } FILE_FS_SECTOR_SIZE_INFORMATION, *PFILE_FS_SECTOR_SIZE_INFORMATION; -// private typedef struct _FILE_FS_DATA_COPY_INFORMATION { ULONG NumberOfCopies; } FILE_FS_DATA_COPY_INFORMATION, *PFILE_FS_DATA_COPY_INFORMATION; -// private typedef struct _FILE_FS_METADATA_SIZE_INFORMATION { LARGE_INTEGER TotalMetadataAllocationUnits; @@ -1188,7 +1337,6 @@ typedef struct _FILE_FS_METADATA_SIZE_INFORMATION ULONG BytesPerSector; } FILE_FS_METADATA_SIZE_INFORMATION, *PFILE_FS_METADATA_SIZE_INFORMATION; -// private typedef struct _FILE_FS_FULL_SIZE_INFORMATION_EX { ULONGLONG ActualTotalAllocationUnits; @@ -1206,6 +1354,11 @@ typedef struct _FILE_FS_FULL_SIZE_INFORMATION_EX ULONG BytesPerSector; } FILE_FS_FULL_SIZE_INFORMATION_EX, *PFILE_FS_FULL_SIZE_INFORMATION_EX; +typedef struct _FILE_FS_GUID_INFORMATION +{ + GUID FsGuid; +} FILE_FS_GUID_INFORMATION, *PFILE_FS_GUID_INFORMATION; + // System calls NTSYSCALLAPI @@ -1242,7 +1395,7 @@ NtCreateNamedPipeFile( _In_ ULONG MaximumInstances, _In_ ULONG InboundQuota, _In_ ULONG OutboundQuota, - _In_opt_ PLARGE_INTEGER DefaultTimeout + _In_ PLARGE_INTEGER DefaultTimeout ); NTSYSCALLAPI @@ -1619,6 +1772,33 @@ NtQueryFullAttributesFile( _Out_ PFILE_NETWORK_OPEN_INFORMATION FileInformation ); +#define FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001 // winnt +#define FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002 // winnt +#define FILE_NOTIFY_CHANGE_NAME 0x00000003 +#define FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004 // winnt +#define FILE_NOTIFY_CHANGE_SIZE 0x00000008 // winnt +#define FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010 // winnt +#define FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020 // winnt +#define FILE_NOTIFY_CHANGE_CREATION 0x00000040 // winnt +#define FILE_NOTIFY_CHANGE_EA 0x00000080 +#define FILE_NOTIFY_CHANGE_SECURITY 0x00000100 // winnt +#define FILE_NOTIFY_CHANGE_STREAM_NAME 0x00000200 +#define FILE_NOTIFY_CHANGE_STREAM_SIZE 0x00000400 +#define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800 +#define FILE_NOTIFY_VALID_MASK 0x00000fff + +#define FILE_ACTION_ADDED 0x00000001 // winnt +#define FILE_ACTION_REMOVED 0x00000002 // winnt +#define FILE_ACTION_MODIFIED 0x00000003 // winnt +#define FILE_ACTION_RENAMED_OLD_NAME 0x00000004 // winnt +#define FILE_ACTION_RENAMED_NEW_NAME 0x00000005 // winnt +#define FILE_ACTION_ADDED_STREAM 0x00000006 +#define FILE_ACTION_REMOVED_STREAM 0x00000007 +#define FILE_ACTION_MODIFIED_STREAM 0x00000008 +#define FILE_ACTION_REMOVED_BY_DELETE 0x00000009 +#define FILE_ACTION_ID_NOT_TUNNELLED 0x0000000A +#define FILE_ACTION_TUNNELLED_ID_COLLISION 0x0000000B + NTSYSCALLAPI NTSTATUS NTAPI @@ -1643,6 +1823,70 @@ typedef enum _DIRECTORY_NOTIFY_INFORMATION_CLASS DirectoryNotifyMaximumInformation } DIRECTORY_NOTIFY_INFORMATION_CLASS, *PDIRECTORY_NOTIFY_INFORMATION_CLASS; +//typedef struct _FILE_NOTIFY_INFORMATION +//{ +// ULONG NextEntryOffset; +// ULONG Action; +// ULONG FileNameLength; +// WCHAR FileName[1]; +//} FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION; + +#if !defined(NTDDI_WIN10_RS5) || (NTDDI_VERSION < NTDDI_WIN10_RS5) +typedef struct _FILE_NOTIFY_EXTENDED_INFORMATION +{ + ULONG NextEntryOffset; + ULONG Action; + LARGE_INTEGER CreationTime; + LARGE_INTEGER LastModificationTime; + LARGE_INTEGER LastChangeTime; + LARGE_INTEGER LastAccessTime; + LARGE_INTEGER AllocatedLength; + LARGE_INTEGER FileSize; + ULONG FileAttributes; + union + { + ULONG ReparsePointTag; + ULONG EaSize; + }; + LARGE_INTEGER FileId; + LARGE_INTEGER ParentFileId; + ULONG FileNameLength; + WCHAR FileName[1]; +} FILE_NOTIFY_EXTENDED_INFORMATION, *PFILE_NOTIFY_EXTENDED_INFORMATION; +#endif + +#define FILE_NAME_FLAG_HARDLINK 0 // not part of a name pair +#define FILE_NAME_FLAG_NTFS 0x01 // NTFS name in a name pair +#define FILE_NAME_FLAG_DOS 0x02 // DOS name in a name pair +#define FILE_NAME_FLAG_BOTH 0x03 // NTFS+DOS combined name +#define FILE_NAME_FLAGS_UNSPECIFIED 0x80 // not specified by file system (do not combine with other flags) + +#if !defined(NTDDI_WIN10_NI) || (NTDDI_VERSION < NTDDI_WIN10_NI) +typedef struct _FILE_NOTIFY_FULL_INFORMATION +{ + ULONG NextEntryOffset; + ULONG Action; + LARGE_INTEGER CreationTime; + LARGE_INTEGER LastModificationTime; + LARGE_INTEGER LastChangeTime; + LARGE_INTEGER LastAccessTime; + LARGE_INTEGER AllocatedLength; + LARGE_INTEGER FileSize; + ULONG FileAttributes; + union + { + ULONG ReparsePointTag; + ULONG EaSize; + }; + LARGE_INTEGER FileId; + LARGE_INTEGER ParentFileId; + USHORT FileNameLength; + BYTE FileNameFlags; + BYTE Reserved; + WCHAR FileName[1]; +} FILE_NOTIFY_FULL_INFORMATION, *PFILE_NOTIFY_FULL_INFORMATION; +#endif + #if (PHNT_VERSION >= PHNT_REDSTONE3) NTSYSCALLAPI NTSTATUS @@ -1876,6 +2120,49 @@ NtNotifyChangeSession( ); #endif +// I/O Ring + +#if (PHNT_VERSION >= PHNT_WIN11) +NTSYSCALLAPI +NTSTATUS +NTAPI +NtCreateIoRing( + _Out_ PHANDLE IoRingHandle, + _In_ ULONG CreateParametersLength, + _In_ PVOID CreateParameters, + _In_ ULONG OutputParametersLength, + _Out_ PVOID OutputParameters + ); + +NTSYSCALLAPI +NTSTATUS +NTAPI +NtSubmitIoRing( + _In_ HANDLE IoRingHandle, + _In_ ULONG Flags, + _In_opt_ ULONG WaitOperations, + _In_opt_ PLARGE_INTEGER Timeout + ); + +NTSYSCALLAPI +NTSTATUS +NTAPI +NtQueryIoRingCapabilities( + _In_ SIZE_T IoRingCapabilitiesLength, + _Out_ PVOID IoRingCapabilities + ); + +NTSYSCALLAPI +NTSTATUS +NTAPI +NtSetInformationIoRing( + _In_ HANDLE IoRingHandle, + _In_ ULONG IoRingInformationClass, + _In_ ULONG IoRingInformationLength, + _In_ PVOID IoRingInformation + ); +#endif + // Other types typedef enum _INTERFACE_TYPE @@ -1978,6 +2265,11 @@ typedef struct _REPARSE_DATA_BUFFER WCHAR PathBuffer[1]; } MountPointReparseBuffer; struct + { + ULONG StringCount; + WCHAR StringList[1]; + } AppExecLinkReparseBuffer; + struct { UCHAR DataBuffer[1]; } GenericReparseBuffer; @@ -1986,6 +2278,80 @@ typedef struct _REPARSE_DATA_BUFFER #define REPARSE_DATA_BUFFER_HEADER_SIZE UFIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer) +#if (PHNT_VERSION >= PHNT_REDSTONE) +// Reparse structure for FSCTL_SET_REPARSE_POINT_EX + +typedef struct _REPARSE_DATA_BUFFER_EX +{ + ULONG Flags; + + // + // This is the existing reparse tag on the file if any, if the + // caller wants to replace the reparse tag too. + // + // - To set the reparse data along with the reparse tag that + // could be different, pass the current reparse tag of the + // file. + // + // - To update the reparse data while having the same reparse + // tag, the caller should give the existing reparse tag in + // this ExistingReparseTag field. + // + // - To set the reparse tag along with reparse data on a file + // that doesn't have a reparse tag yet, set this to zero. + // + // If the ExistingReparseTag does not match the reparse tag on + // the file, the FSCTL_SET_REPARSE_POINT_EX would fail with + // STATUS_IO_REPARSE_TAG_MISMATCH. NOTE: If a file doesn't have + // a reparse tag, ExistingReparseTag should be 0. + // + + ULONG ExistingReparseTag; + + // For non-Microsoft reparse tags, this is the existing reparse + // guid on the file if any, if the caller wants to replace the + // reparse tag and / or guid along with the data. + // + // If ExistingReparseTag is 0, the file is not expected to have + // any reparse tags, so ExistingReparseGuid is ignored. And for + // non-Microsoft tags ExistingReparseGuid should match the guid + // in the file if ExistingReparseTag is non zero. + + GUID ExistingReparseGuid; + + // + // Reserved + // + ULONGLONG Reserved; + + // + // Reparse data to set + // + union + { + REPARSE_DATA_BUFFER ReparseDataBuffer; + REPARSE_GUID_DATA_BUFFER ReparseGuidDataBuffer; + }; +} REPARSE_DATA_BUFFER_EX, *PREPARSE_DATA_BUFFER_EX; + +// REPARSE_DATA_BUFFER_EX Flags +// +// REPARSE_DATA_EX_FLAG_GIVEN_TAG_OR_NONE - Forces the FSCTL to set the +// reparse tag if the file has no tag or the tag on the file is same as +// the one in ExistingReparseTag. NOTE: If the ExistingReparseTag is +// not a Microsoft tag then the ExistingReparseGuid should match if the +// file has the ExistingReparseTag. +// +#define REPARSE_DATA_EX_FLAG_GIVEN_TAG_OR_NONE (0x00000001) + +#define REPARSE_GUID_DATA_BUFFER_EX_HEADER_SIZE \ + UFIELD_OFFSET(REPARSE_DATA_BUFFER_EX, ReparseGuidDataBuffer.GenericReparseBuffer) + +#define REPARSE_DATA_BUFFER_EX_HEADER_SIZE \ + UFIELD_OFFSET(REPARSE_DATA_BUFFER_EX, ReparseDataBuffer.GenericReparseBuffer) + +#endif // PHNT_REDSTONE + // Named pipe FS control definitions #define DEVICE_NAMED_PIPE L"\\Device\\NamedPipe\\" @@ -2007,11 +2373,11 @@ typedef struct _REPARSE_DATA_BUFFER #define FSCTL_PIPE_GET_HANDLE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 14, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_PIPE_SET_HANDLE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 15, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_PIPE_FLUSH CTL_CODE(FILE_DEVICE_NAMED_PIPE, 16, METHOD_BUFFERED, FILE_WRITE_DATA) -#define FSCTL_PIPE_DISABLE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 17, METHOD_BUFFERED, FILE_ANY_ACCESS) -#define FSCTL_PIPE_SILO_ARRIVAL CTL_CODE(FILE_DEVICE_NAMED_PIPE, 18, METHOD_BUFFERED, FILE_WRITE_DATA) -#define FSCTL_PIPE_CREATE_SYMLINK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 19, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) +#define FSCTL_PIPE_DISABLE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 17, METHOD_BUFFERED, FILE_ANY_ACCESS) // since REDSTONE +#define FSCTL_PIPE_SILO_ARRIVAL CTL_CODE(FILE_DEVICE_NAMED_PIPE, 18, METHOD_BUFFERED, FILE_WRITE_DATA) // since REDSTONE3 +#define FSCTL_PIPE_CREATE_SYMLINK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 19, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // requires SeTcbPrivilege #define FSCTL_PIPE_DELETE_SYMLINK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 20, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) -#define FSCTL_PIPE_QUERY_CLIENT_PROCESS_V2 CTL_CODE(FILE_DEVICE_NAMED_PIPE, 21, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_PIPE_QUERY_CLIENT_PROCESS_V2 CTL_CODE(FILE_DEVICE_NAMED_PIPE, 21, METHOD_BUFFERED, FILE_ANY_ACCESS) // since 19H1 #define FSCTL_PIPE_INTERNAL_READ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA) #define FSCTL_PIPE_INTERNAL_WRITE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA) @@ -2037,7 +2403,7 @@ typedef struct _FILE_PIPE_PEEK_BUFFER ULONG ReadDataAvailable; ULONG NumberOfMessages; ULONG MessageLength; - CHAR Data[1]; + _Field_size_bytes_(MessageLength) CHAR Data[1]; } FILE_PIPE_PEEK_BUFFER, *PFILE_PIPE_PEEK_BUFFER; // Output for FSCTL_PIPE_QUERY_EVENT @@ -2056,7 +2422,7 @@ typedef struct _FILE_PIPE_WAIT_FOR_BUFFER LARGE_INTEGER Timeout; ULONG NameLength; BOOLEAN TimeoutSpecified; - WCHAR Name[1]; + _Field_size_bytes_(NameLength) WCHAR Name[1]; } FILE_PIPE_WAIT_FOR_BUFFER, *PFILE_PIPE_WAIT_FOR_BUFFER; // Input for FSCTL_PIPE_SET_CLIENT_PROCESS, Output for FSCTL_PIPE_QUERY_CLIENT_PROCESS @@ -2183,6 +2549,14 @@ typedef struct _FILE_MAILSLOT_PEEK_BUFFER #define IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION CTL_CODE(MOUNTMGRCONTROLTYPE, 11, METHOD_BUFFERED, FILE_READ_ACCESS) #define IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH CTL_CODE(MOUNTMGRCONTROLTYPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS) #define IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS CTL_CODE(MOUNTMGRCONTROLTYPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define IOCTL_MOUNTMGR_SCRUB_REGISTRY CTL_CODE(MOUNTMGRCONTROLTYPE, 14, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) +#define IOCTL_MOUNTMGR_QUERY_AUTO_MOUNT CTL_CODE(MOUNTMGRCONTROLTYPE, 15, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define IOCTL_MOUNTMGR_SET_AUTO_MOUNT CTL_CODE(MOUNTMGRCONTROLTYPE, 16, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) +#define IOCTL_MOUNTMGR_BOOT_DL_ASSIGNMENT CTL_CODE(MOUNTMGRCONTROLTYPE, 17, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) // since WIN7 +#define IOCTL_MOUNTMGR_TRACELOG_CACHE CTL_CODE(MOUNTMGRCONTROLTYPE, 18, METHOD_BUFFERED, FILE_READ_ACCESS) +#define IOCTL_MOUNTMGR_PREPARE_VOLUME_DELETE CTL_CODE(MOUNTMGRCONTROLTYPE, 19, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) +#define IOCTL_MOUNTMGR_CANCEL_VOLUME_DELETE CTL_CODE(MOUNTMGRCONTROLTYPE, 20, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) // since WIN8 +#define IOCTL_MOUNTMGR_SILO_ARRIVAL CTL_CODE(MOUNTMGRCONTROLTYPE, 21, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) // since RS1 #define IOCTL_MOUNTDEV_QUERY_DEVICE_NAME CTL_CODE(MOUNTDEVCONTROLTYPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS) @@ -2214,14 +2588,14 @@ typedef struct _MOUNTMGR_MOUNT_POINTS { ULONG Size; ULONG NumberOfMountPoints; - MOUNTMGR_MOUNT_POINT MountPoints[1]; + _Field_size_(NumberOfMountPoints) MOUNTMGR_MOUNT_POINT MountPoints[1]; } MOUNTMGR_MOUNT_POINTS, *PMOUNTMGR_MOUNT_POINTS; // Input structure for IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER. typedef struct _MOUNTMGR_DRIVE_LETTER_TARGET { USHORT DeviceNameLength; - WCHAR DeviceName[1]; + _Field_size_bytes_(DeviceNameLength) WCHAR DeviceName[1]; } MOUNTMGR_DRIVE_LETTER_TARGET, *PMOUNTMGR_DRIVE_LETTER_TARGET; // Output structure for IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER. @@ -2257,8 +2631,33 @@ typedef struct _MOUNTMGR_CHANGE_NOTIFY_INFO typedef struct _MOUNTMGR_TARGET_NAME { USHORT DeviceNameLength; - WCHAR DeviceName[1]; -} MOUNTMGR_TARGET_NAME, * PMOUNTMGR_TARGET_NAME; + _Field_size_bytes_(DeviceNameLength) WCHAR DeviceName[1]; +} MOUNTMGR_TARGET_NAME, *PMOUNTMGR_TARGET_NAME; + +// Input / Output structure for querying / setting the auto-mount setting +typedef enum _MOUNTMGR_AUTO_MOUNT_STATE +{ + Disabled = 0, + Enabled +} MOUNTMGR_AUTO_MOUNT_STATE; + +// IOCTL_MOUNTMGR_QUERY_AUTO_MOUNT +typedef struct _MOUNTMGR_QUERY_AUTO_MOUNT +{ + MOUNTMGR_AUTO_MOUNT_STATE CurrentState; +} MOUNTMGR_QUERY_AUTO_MOUNT, *PMOUNTMGR_QUERY_AUTO_MOUNT; + +// IOCTL_MOUNTMGR_SET_AUTO_MOUNT +typedef struct _MOUNTMGR_SET_AUTO_MOUNT +{ + MOUNTMGR_AUTO_MOUNT_STATE NewState; +} MOUNTMGR_SET_AUTO_MOUNT, *PMOUNTMGR_SET_AUTO_MOUNT; + +// Input structure for IOCTL_MOUNTMGR_SILO_ARRIVAL. +typedef struct _MOUNTMGR_SILO_ARRIVAL_INPUT +{ + HANDLE JobHandle; +} MOUNTMGR_SILO_ARRIVAL_INPUT, *PMOUNTMGR_SILO_ARRIVAL_INPUT; // Macro that defines what a "drive letter" mount point is. This macro can // be used to scan the result from QUERY_POINTS to discover which mount points @@ -2307,14 +2706,14 @@ typedef struct _MOUNTMGR_TARGET_NAME typedef struct _MOUNTDEV_NAME { USHORT NameLength; - WCHAR Name[1]; -} MOUNTDEV_NAME, * PMOUNTDEV_NAME; + _Field_size_bytes_(NameLength) WCHAR Name[1]; +} MOUNTDEV_NAME, *PMOUNTDEV_NAME; // Output structure for IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH and IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS. typedef struct _MOUNTMGR_VOLUME_PATHS { ULONG MultiSzLength; - WCHAR MultiSz[1]; + _Field_size_bytes_(MultiSzLength) WCHAR MultiSz[1]; } MOUNTMGR_VOLUME_PATHS, *PMOUNTMGR_VOLUME_PATHS; #define MOUNTMGR_IS_DOS_VOLUME_NAME(s) ( \ @@ -2337,4 +2736,347 @@ typedef struct _MOUNTMGR_VOLUME_PATHS (s)->Length == 98 && \ (s)->Buffer[1] == '?') +#if (PHNT_MODE != PHNT_MODE_KERNEL) + +// +// Major Function Codes +// +#define IRP_MJ_CREATE 0x00 +#define IRP_MJ_CREATE_NAMED_PIPE 0x01 +#define IRP_MJ_CLOSE 0x02 +#define IRP_MJ_READ 0x03 +#define IRP_MJ_WRITE 0x04 +#define IRP_MJ_QUERY_INFORMATION 0x05 +#define IRP_MJ_SET_INFORMATION 0x06 +#define IRP_MJ_QUERY_EA 0x07 +#define IRP_MJ_SET_EA 0x08 +#define IRP_MJ_FLUSH_BUFFERS 0x09 +#define IRP_MJ_QUERY_VOLUME_INFORMATION 0x0a +#define IRP_MJ_SET_VOLUME_INFORMATION 0x0b +#define IRP_MJ_DIRECTORY_CONTROL 0x0c +#define IRP_MJ_FILE_SYSTEM_CONTROL 0x0d +#define IRP_MJ_DEVICE_CONTROL 0x0e +#define IRP_MJ_INTERNAL_DEVICE_CONTROL 0x0f +#define IRP_MJ_SHUTDOWN 0x10 +#define IRP_MJ_LOCK_CONTROL 0x11 +#define IRP_MJ_CLEANUP 0x12 +#define IRP_MJ_CREATE_MAILSLOT 0x13 +#define IRP_MJ_QUERY_SECURITY 0x14 +#define IRP_MJ_SET_SECURITY 0x15 +#define IRP_MJ_POWER 0x16 +#define IRP_MJ_SYSTEM_CONTROL 0x17 +#define IRP_MJ_DEVICE_CHANGE 0x18 +#define IRP_MJ_QUERY_QUOTA 0x19 +#define IRP_MJ_SET_QUOTA 0x1a +#define IRP_MJ_PNP 0x1b +#define IRP_MJ_PNP_POWER IRP_MJ_PNP // Obsolete.... +#define IRP_MJ_MAXIMUM_FUNCTION 0x1b +#define IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-1) +#define IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION ((UCHAR)-2) +#define IRP_MJ_ACQUIRE_FOR_MOD_WRITE ((UCHAR)-3) +#define IRP_MJ_RELEASE_FOR_MOD_WRITE ((UCHAR)-4) +#define IRP_MJ_ACQUIRE_FOR_CC_FLUSH ((UCHAR)-5) +#define IRP_MJ_RELEASE_FOR_CC_FLUSH ((UCHAR)-6) +#define IRP_MJ_QUERY_OPEN ((UCHAR)-7) +#define IRP_MJ_FAST_IO_CHECK_IF_POSSIBLE ((UCHAR)-13) +#define IRP_MJ_NETWORK_QUERY_OPEN ((UCHAR)-14) +#define IRP_MJ_MDL_READ ((UCHAR)-15) +#define IRP_MJ_MDL_READ_COMPLETE ((UCHAR)-16) +#define IRP_MJ_PREPARE_MDL_WRITE ((UCHAR)-17) +#define IRP_MJ_MDL_WRITE_COMPLETE ((UCHAR)-18) +#define IRP_MJ_VOLUME_MOUNT ((UCHAR)-19) +#define IRP_MJ_VOLUME_DISMOUNT ((UCHAR)-20) +#define FLT_INTERNAL_OPERATION_COUNT 22 + +// +// Minor Function Codes +// +#define IRP_MN_SCSI_CLASS 0x01 +// PNP minor function codes +#define IRP_MN_START_DEVICE 0x00 +#define IRP_MN_QUERY_REMOVE_DEVICE 0x01 +#define IRP_MN_REMOVE_DEVICE 0x02 +#define IRP_MN_CANCEL_REMOVE_DEVICE 0x03 +#define IRP_MN_STOP_DEVICE 0x04 +#define IRP_MN_QUERY_STOP_DEVICE 0x05 +#define IRP_MN_CANCEL_STOP_DEVICE 0x06 +#define IRP_MN_QUERY_DEVICE_RELATIONS 0x07 +#define IRP_MN_QUERY_INTERFACE 0x08 +#define IRP_MN_QUERY_CAPABILITIES 0x09 +#define IRP_MN_QUERY_RESOURCES 0x0A +#define IRP_MN_QUERY_RESOURCE_REQUIREMENTS 0x0B +#define IRP_MN_QUERY_DEVICE_TEXT 0x0C +#define IRP_MN_FILTER_RESOURCE_REQUIREMENTS 0x0D +#define IRP_MN_READ_CONFIG 0x0F +#define IRP_MN_WRITE_CONFIG 0x10 +#define IRP_MN_EJECT 0x11 +#define IRP_MN_SET_LOCK 0x12 +#define IRP_MN_QUERY_ID 0x13 +#define IRP_MN_QUERY_PNP_DEVICE_STATE 0x14 +#define IRP_MN_QUERY_BUS_INFORMATION 0x15 +#define IRP_MN_DEVICE_USAGE_NOTIFICATION 0x16 +#define IRP_MN_SURPRISE_REMOVAL 0x17 +#if (PHNT_VERSION >= PHNT_WIN7) +#define IRP_MN_DEVICE_ENUMERATED 0x19 +#endif +// POWER minor function codes +#define IRP_MN_WAIT_WAKE 0x00 +#define IRP_MN_POWER_SEQUENCE 0x01 +#define IRP_MN_SET_POWER 0x02 +#define IRP_MN_QUERY_POWER 0x03 +// WMI minor function codes under IRP_MJ_SYSTEM_CONTROL +#define IRP_MN_QUERY_ALL_DATA 0x00 +#define IRP_MN_QUERY_SINGLE_INSTANCE 0x01 +#define IRP_MN_CHANGE_SINGLE_INSTANCE 0x02 +#define IRP_MN_CHANGE_SINGLE_ITEM 0x03 +#define IRP_MN_ENABLE_EVENTS 0x04 +#define IRP_MN_DISABLE_EVENTS 0x05 +#define IRP_MN_ENABLE_COLLECTION 0x06 +#define IRP_MN_DISABLE_COLLECTION 0x07 +#define IRP_MN_REGINFO 0x08 +#define IRP_MN_EXECUTE_METHOD 0x09 +// Minor code 0x0a is reserved +#define IRP_MN_REGINFO_EX 0x0b +// Minor code 0x0c is reserved +// Minor code 0x0d is reserved + +// +// Filter Manager Callback Data Flags +// +#define FLTFL_CALLBACK_DATA_REISSUE_MASK 0x0000FFFF +#define FLTFL_CALLBACK_DATA_IRP_OPERATION 0x00000001 // Set for Irp operations +#define FLTFL_CALLBACK_DATA_FAST_IO_OPERATION 0x00000002 // Set for Fast Io operations +#define FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION 0x00000004 // Set for Fs Filter operations +#define FLTFL_CALLBACK_DATA_SYSTEM_BUFFER 0x00000008 // Set if the buffer passed in for the i/o was a system buffer +#define FLTFL_CALLBACK_DATA_GENERATED_IO 0x00010000 // Set if this is I/O generated by a mini-filter +#define FLTFL_CALLBACK_DATA_REISSUED_IO 0x00020000 // Set if this I/O was reissued +#define FLTFL_CALLBACK_DATA_DRAINING_IO 0x00040000 // set if this operation is being drained. If set, +#define FLTFL_CALLBACK_DATA_POST_OPERATION 0x00080000 // Set if this is a POST operation +#define FLTFL_CALLBACK_DATA_NEW_SYSTEM_BUFFER 0x00100000 +#define FLTFL_CALLBACK_DATA_DIRTY 0x80000000 // Set by caller if parameters were changed + +// +// IRP Flags +// +#define IRP_NOCACHE 0x00000001 +#define IRP_PAGING_IO 0x00000002 +#define IRP_MOUNT_COMPLETION 0x00000002 +#define IRP_SYNCHRONOUS_API 0x00000004 +#define IRP_ASSOCIATED_IRP 0x00000008 +#define IRP_BUFFERED_IO 0x00000010 +#define IRP_DEALLOCATE_BUFFER 0x00000020 +#define IRP_INPUT_OPERATION 0x00000040 +#define IRP_SYNCHRONOUS_PAGING_IO 0x00000040 +#define IRP_CREATE_OPERATION 0x00000080 +#define IRP_READ_OPERATION 0x00000100 +#define IRP_WRITE_OPERATION 0x00000200 +#define IRP_CLOSE_OPERATION 0x00000400 +#define IRP_DEFER_IO_COMPLETION 0x00000800 +#define IRP_OB_QUERY_NAME 0x00001000 +#define IRP_HOLD_DEVICE_QUEUE 0x00002000 +#define IRP_UM_DRIVER_INITIATED_IO 0x00400000 + +// +// File Object Flags +// +#define FO_FILE_OPEN 0x00000001 +#define FO_SYNCHRONOUS_IO 0x00000002 +#define FO_ALERTABLE_IO 0x00000004 +#define FO_NO_INTERMEDIATE_BUFFERING 0x00000008 +#define FO_WRITE_THROUGH 0x00000010 +#define FO_SEQUENTIAL_ONLY 0x00000020 +#define FO_CACHE_SUPPORTED 0x00000040 +#define FO_NAMED_PIPE 0x00000080 +#define FO_STREAM_FILE 0x00000100 +#define FO_MAILSLOT 0x00000200 +#define FO_GENERATE_AUDIT_ON_CLOSE 0x00000400 +#define FO_QUEUE_IRP_TO_THREAD FO_GENERATE_AUDIT_ON_CLOSE +#define FO_DIRECT_DEVICE_OPEN 0x00000800 +#define FO_FILE_MODIFIED 0x00001000 +#define FO_FILE_SIZE_CHANGED 0x00002000 +#define FO_CLEANUP_COMPLETE 0x00004000 +#define FO_TEMPORARY_FILE 0x00008000 +#define FO_DELETE_ON_CLOSE 0x00010000 +#define FO_OPENED_CASE_SENSITIVE 0x00020000 +#define FO_HANDLE_CREATED 0x00040000 +#define FO_FILE_FAST_IO_READ 0x00080000 +#define FO_RANDOM_ACCESS 0x00100000 +#define FO_FILE_OPEN_CANCELLED 0x00200000 +#define FO_VOLUME_OPEN 0x00400000 +#define FO_BYPASS_IO_ENABLED 0x00800000 //when set BYPASS IO is enabled on this handle +#define FO_REMOTE_ORIGIN 0x01000000 +#define FO_DISALLOW_EXCLUSIVE 0x02000000 +#define FO_SKIP_COMPLETION_PORT FO_DISALLOW_EXCLUSIVE +#define FO_SKIP_SET_EVENT 0x04000000 +#define FO_SKIP_SET_FAST_IO 0x08000000 +#define FO_INDIRECT_WAIT_OBJECT 0x10000000 +#define FO_SECTION_MINSTORE_TREATMENT 0x20000000 + +// +// Define stack location (IO_STACK_LOCATION) flags +// +#define SL_PENDING_RETURNED 0x01 +#define SL_ERROR_RETURNED 0x02 +#define SL_INVOKE_ON_CANCEL 0x20 +#define SL_INVOKE_ON_SUCCESS 0x40 +#define SL_INVOKE_ON_ERROR 0x80 +// Create / Create Named Pipe (IRP_MJ_CREATE/IRP_MJ_CREATE_NAMED_PIPE) +#define SL_FORCE_ACCESS_CHECK 0x01 +#define SL_OPEN_PAGING_FILE 0x02 +#define SL_OPEN_TARGET_DIRECTORY 0x04 +#define SL_STOP_ON_SYMLINK 0x08 +#define SL_IGNORE_READONLY_ATTRIBUTE 0x40 +#define SL_CASE_SENSITIVE 0x80 +// Read / Write (IRP_MJ_READ/IRP_MJ_WRITE) +#define SL_KEY_SPECIFIED 0x01 +#define SL_OVERRIDE_VERIFY_VOLUME 0x02 +#define SL_WRITE_THROUGH 0x04 +#define SL_FT_SEQUENTIAL_WRITE 0x08 +#define SL_FORCE_DIRECT_WRITE 0x10 +#define SL_REALTIME_STREAM 0x20 // valid only with optical media +#define SL_PERSISTENT_MEMORY_FIXED_MAPPING 0x20 // valid only with persistent memory device and IRP_MJ_WRITE +#define SL_BYPASS_IO 0x40 +// IRP_MJ_FLUSH_BUFFERS +#define SL_FORCE_ASYNCHRONOUS 0x01 +// Device I/O Control +#define SL_READ_ACCESS_GRANTED 0x01 +#define SL_WRITE_ACCESS_GRANTED 0x04 // Gap for SL_OVERRIDE_VERIFY_VOLUME +// Lock (IRP_MJ_LOCK_CONTROL) +#define SL_FAIL_IMMEDIATELY 0x01 +#define SL_EXCLUSIVE_LOCK 0x02 +// QueryDirectory / QueryEa / QueryQuota (IRP_MJ_DIRECTORY_CONTROL/IRP_MJ_QUERY_EA/IRP_MJ_QUERY_QUOTA)) +#define SL_RESTART_SCAN 0x01 +#define SL_RETURN_SINGLE_ENTRY 0x02 +#define SL_INDEX_SPECIFIED 0x04 +#define SL_RETURN_ON_DISK_ENTRIES_ONLY 0x08 +#define SL_NO_CURSOR_UPDATE 0x10 +#define SL_QUERY_DIRECTORY_MASK 0x1b +// NotifyDirectory (IRP_MJ_DIRECTORY_CONTROL) +#define SL_WATCH_TREE 0x01 +// FileSystemControl (IRP_MJ_FILE_SYSTEM_CONTROL) +#define SL_ALLOW_RAW_MOUNT 0x01 +// SetInformationFile (IRP_MJ_SET_INFORMATION) / QueryInformationFile +#define SL_BYPASS_ACCESS_CHECK 0x01 +#define SL_INFO_FORCE_ACCESS_CHECK 0x01 +#define SL_INFO_IGNORE_READONLY_ATTRIBUTE 0x40 // same value as IO_IGNORE_READONLY_ATTRIBUTE + +// +// Device Object (DO) flags +// +#define DO_VERIFY_VOLUME 0x00000002 +#define DO_BUFFERED_IO 0x00000004 +#define DO_EXCLUSIVE 0x00000008 +#define DO_DIRECT_IO 0x00000010 +#define DO_MAP_IO_BUFFER 0x00000020 +#define DO_DEVICE_INITIALIZING 0x00000080 +#define DO_SHUTDOWN_REGISTERED 0x00000800 +#define DO_BUS_ENUMERATED_DEVICE 0x00001000 +#define DO_POWER_PAGABLE 0x00002000 +#define DO_POWER_INRUSH 0x00004000 +#define DO_DEVICE_TO_BE_RESET 0x04000000 +#define DO_DAX_VOLUME 0x10000000 + +// +// KSecDD FS control definitions +// +#define KSEC_DEVICE_NAME L"\\Device\\KSecDD" +#define IOCTL_KSEC_CONNECT_LSA CTL_CODE(FILE_DEVICE_KSEC, 0, METHOD_BUFFERED, FILE_WRITE_ACCESS ) +#define IOCTL_KSEC_RNG CTL_CODE(FILE_DEVICE_KSEC, 1, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_RNG_REKEY CTL_CODE(FILE_DEVICE_KSEC, 2, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_ENCRYPT_MEMORY CTL_CODE(FILE_DEVICE_KSEC, 3, METHOD_OUT_DIRECT, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_DECRYPT_MEMORY CTL_CODE(FILE_DEVICE_KSEC, 4, METHOD_OUT_DIRECT, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_ENCRYPT_MEMORY_CROSS_PROC CTL_CODE(FILE_DEVICE_KSEC, 5, METHOD_OUT_DIRECT, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_DECRYPT_MEMORY_CROSS_PROC CTL_CODE(FILE_DEVICE_KSEC, 6, METHOD_OUT_DIRECT, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_ENCRYPT_MEMORY_SAME_LOGON CTL_CODE(FILE_DEVICE_KSEC, 7, METHOD_OUT_DIRECT, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_DECRYPT_MEMORY_SAME_LOGON CTL_CODE(FILE_DEVICE_KSEC, 8, METHOD_OUT_DIRECT, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_FIPS_GET_FUNCTION_TABLE CTL_CODE(FILE_DEVICE_KSEC, 9, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_ALLOC_POOL CTL_CODE(FILE_DEVICE_KSEC, 10, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_FREE_POOL CTL_CODE(FILE_DEVICE_KSEC, 11, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_COPY_POOL CTL_CODE(FILE_DEVICE_KSEC, 12, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_DUPLICATE_HANDLE CTL_CODE(FILE_DEVICE_KSEC, 13, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_REGISTER_EXTENSION CTL_CODE(FILE_DEVICE_KSEC, 14, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_CLIENT_CALLBACK CTL_CODE(FILE_DEVICE_KSEC, 15, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_GET_BCRYPT_EXTENSION CTL_CODE(FILE_DEVICE_KSEC, 16, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_GET_SSL_EXTENSION CTL_CODE(FILE_DEVICE_KSEC, 17, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_GET_DEVICECONTROL_EXTENSION CTL_CODE(FILE_DEVICE_KSEC, 18, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_ALLOC_VM CTL_CODE(FILE_DEVICE_KSEC, 19, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_FREE_VM CTL_CODE(FILE_DEVICE_KSEC, 20, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_COPY_VM CTL_CODE(FILE_DEVICE_KSEC, 21, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_CLIENT_FREE_VM CTL_CODE(FILE_DEVICE_KSEC, 22, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_INSERT_PROTECTED_PROCESS_ADDRESS CTL_CODE(FILE_DEVICE_KSEC, 23, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_REMOVE_PROTECTED_PROCESS_ADDRESS CTL_CODE(FILE_DEVICE_KSEC, 24, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_GET_BCRYPT_EXTENSION2 CTL_CODE(FILE_DEVICE_KSEC, 25, METHOD_BUFFERED, FILE_ANY_ACCESS ) +#define IOCTL_KSEC_IPC_GET_QUEUED_FUNCTION_CALLS CTL_CODE(FILE_DEVICE_KSEC, 26, METHOD_OUT_DIRECT, FILE_ANY_ACCESS) +#define IOCTL_KSEC_IPC_SET_FUNCTION_RETURN CTL_CODE(FILE_DEVICE_KSEC, 27, METHOD_NEITHER, FILE_ANY_ACCESS) + +// pub +typedef enum _FS_FILTER_SECTION_SYNC_TYPE +{ + SyncTypeOther = 0, + SyncTypeCreateSection +} FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE; + +//pub +typedef enum _CREATE_FILE_TYPE +{ + CreateFileTypeNone, + CreateFileTypeNamedPipe, + CreateFileTypeMailslot +} CREATE_FILE_TYPE; + +// pub +typedef struct _NAMED_PIPE_CREATE_PARAMETERS +{ + ULONG NamedPipeType; + ULONG ReadMode; + ULONG CompletionMode; + ULONG MaximumInstances; + ULONG InboundQuota; + ULONG OutboundQuota; + LARGE_INTEGER DefaultTimeout; + BOOLEAN TimeoutSpecified; +} NAMED_PIPE_CREATE_PARAMETERS, *PNAMED_PIPE_CREATE_PARAMETERS; + +// pub +typedef struct _MAILSLOT_CREATE_PARAMETERS +{ + ULONG MailslotQuota; + ULONG MaximumMessageSize; + LARGE_INTEGER ReadTimeout; + BOOLEAN TimeoutSpecified; +} MAILSLOT_CREATE_PARAMETERS, *PMAILSLOT_CREATE_PARAMETERS; + +#if (PHNT_VERSION >= PHNT_WIN7) + +// pub +typedef struct _OPLOCK_KEY_ECP_CONTEXT +{ + GUID OplockKey; + ULONG Reserved; +} OPLOCK_KEY_ECP_CONTEXT, *POPLOCK_KEY_ECP_CONTEXT; + +#endif + +#if (PHNT_VERSION >= PHNT_WIN8) + +// pub +typedef struct _OPLOCK_KEY_CONTEXT +{ + USHORT Version; // OPLOCK_KEY_VERSION_* + USHORT Flags; // OPLOCK_KEY_FLAG_* + GUID ParentOplockKey; + GUID TargetOplockKey; + ULONG Reserved; +} OPLOCK_KEY_CONTEXT, *POPLOCK_KEY_CONTEXT; + +#define OPLOCK_KEY_VERSION_WIN7 0x0001 +#define OPLOCK_KEY_VERSION_WIN8 0x0002 + +#define OPLOCK_KEY_FLAG_PARENT_KEY 0x0001 +#define OPLOCK_KEY_FLAG_TARGET_KEY 0x0002 + +#endif + +#endif // (PHNT_MODE != PHNT_MODE_KERNEL) + #endif diff --git a/ntkeapi.h b/ntkeapi.h index a80e485..af9c67e 100644 --- a/ntkeapi.h +++ b/ntkeapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Kernel executive support library * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTKEAPI_H @@ -143,7 +138,7 @@ NtCallbackReturn( #if (PHNT_VERSION >= PHNT_VISTA) NTSYSCALLAPI -VOID +NTSTATUS NTAPI NtFlushProcessWriteBuffers( VOID diff --git a/ntldr.h b/ntldr.h index 6892883..b1eddaa 100644 --- a/ntldr.h +++ b/ntldr.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Loader support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTLDR_H @@ -107,6 +102,9 @@ typedef enum _LDR_HOT_PATCH_STATE LdrHotPatchStateMax, } LDR_HOT_PATCH_STATE, *PLDR_HOT_PATCH_STATE; +typedef struct _ACTIVATION_CONTEXT *PACTIVATION_CONTEXT; +typedef struct _LDRP_LOAD_CONTEXT *PLDRP_LOAD_CONTEXT; + // LDR_DATA_TABLE_ENTRY->Flags #define LDRP_PACKAGED_BINARY 0x00000001 #define LDRP_MARKED_FOR_REMOVAL 0x00000002 @@ -145,11 +143,7 @@ typedef struct _LDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; LIST_ENTRY InMemoryOrderLinks; - union - { - LIST_ENTRY InInitializationOrderLinks; - LIST_ENTRY InProgressLinks; - }; + LIST_ENTRY InInitializationOrderLinks; PVOID DllBase; PLDR_INIT_ROUTINE EntryPoint; ULONG SizeOfImage; @@ -196,11 +190,11 @@ typedef struct _LDR_DATA_TABLE_ENTRY USHORT TlsIndex; LIST_ENTRY HashLinks; ULONG TimeDateStamp; - struct _ACTIVATION_CONTEXT *EntryPointActivationContext; + PACTIVATION_CONTEXT EntryPointActivationContext; PVOID Lock; // RtlAcquireSRWLockExclusive PLDR_DDAG_NODE DdagNode; LIST_ENTRY NodeModuleLink; - struct _LDRP_LOAD_CONTEXT *LoadContext; + PLDRP_LOAD_CONTEXT LoadContext; PVOID ParentDllBase; PVOID SwitchBackContext; RTL_BALANCED_NODE BaseAddressIndexNode; @@ -220,11 +214,11 @@ typedef struct _LDR_DATA_TABLE_ENTRY #define LDR_IS_DATAFILE(DllHandle) (((ULONG_PTR)(DllHandle)) & (ULONG_PTR)1) #define LDR_IS_IMAGEMAPPING(DllHandle) (((ULONG_PTR)(DllHandle)) & (ULONG_PTR)2) +#define LDR_IS_RESOURCE(DllHandle) (LDR_IS_IMAGEMAPPING(DllHandle) || LDR_IS_DATAFILE(DllHandle)) #define LDR_MAPPEDVIEW_TO_DATAFILE(BaseAddress) ((PVOID)(((ULONG_PTR)(BaseAddress)) | (ULONG_PTR)1)) #define LDR_MAPPEDVIEW_TO_IMAGEMAPPING(BaseAddress) ((PVOID)(((ULONG_PTR)(BaseAddress)) | (ULONG_PTR)2)) #define LDR_DATAFILE_TO_MAPPEDVIEW(DllHandle) ((PVOID)(((ULONG_PTR)(DllHandle)) & ~(ULONG_PTR)1)) #define LDR_IMAGEMAPPING_TO_MAPPEDVIEW(DllHandle) ((PVOID)(((ULONG_PTR)(DllHandle)) & ~(ULONG_PTR)2)) -#define LDR_IS_RESOURCE(DllHandle) (LDR_IS_IMAGEMAPPING(DllHandle) || LDR_IS_DATAFILE(DllHandle)) #if (PHNT_MODE != PHNT_MODE_KERNEL) @@ -302,6 +296,17 @@ LdrGetDllFullName( _Out_ PUNICODE_STRING FullDllName ); +// rev +NTSYSAPI +NTSTATUS +NTAPI +LdrGetDllPath( + _In_ PCWSTR DllName, + _In_ ULONG Flags, // LOAD_LIBRARY_SEARCH_* + _Out_ PWSTR* DllPath, + _Out_ PWSTR* SearchPaths + ); + // rev NTSYSAPI NTSTATUS @@ -393,7 +398,7 @@ NTAPI LdrLockLoaderLock( _In_ ULONG Flags, _Out_opt_ ULONG *Disposition, - _Out_ PVOID *Cookie + _Out_opt_ PVOID *Cookie ); #define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001 @@ -403,7 +408,7 @@ NTSTATUS NTAPI LdrUnlockLoaderLock( _In_ ULONG Flags, - _Inout_ PVOID Cookie + _In_opt_ PVOID Cookie ); NTSYSAPI @@ -439,6 +444,19 @@ LdrProcessRelocationBlock( _In_ LONG_PTR Diff ); +#if (PHNT_VERSION >= PHNT_WIN8) +NTSYSAPI +PIMAGE_BASE_RELOCATION +NTAPI +LdrProcessRelocationBlockEx( + _In_ ULONG Machine, // IMAGE_FILE_MACHINE_AMD64|IMAGE_FILE_MACHINE_ARM|IMAGE_FILE_MACHINE_THUMB|IMAGE_FILE_MACHINE_ARMNT + _In_ ULONG_PTR VA, + _In_ ULONG SizeOfBlock, + _In_ PUSHORT NextOffset, + _In_ LONG_PTR Diff + ); +#endif + NTSYSAPI BOOLEAN NTAPI @@ -607,6 +625,9 @@ typedef struct _PS_MITIGATION_AUDIT_OPTIONS_MAP ULONG_PTR Map[3]; // 2 < 20H1 } PS_MITIGATION_AUDIT_OPTIONS_MAP, *PPS_MITIGATION_AUDIT_OPTIONS_MAP; +#define PS_SYSTEM_DLL_INIT_BLOCK_V1 0x0F0 +#define PS_SYSTEM_DLL_INIT_BLOCK_V2 0x128 + // private typedef struct _PS_SYSTEM_DLL_INIT_BLOCK { @@ -630,10 +651,17 @@ typedef struct _PS_SYSTEM_DLL_INIT_BLOCK ULONG_PTR Wow64CfgBitMap; ULONG_PTR Wow64CfgBitMapSize; PS_MITIGATION_AUDIT_OPTIONS_MAP MitigationAuditOptionsMap; // REDSTONE3 + ULONG_PTR ScpCfgCheckFunction; // since 24H2 + ULONG_PTR ScpCfgCheckESFunction; + ULONG_PTR ScpCfgDispatchFunction; + ULONG_PTR ScpCfgDispatchESFunction; + ULONG_PTR ScpArm64EcCallCheck; + ULONG_PTR ScpArm64EcCfgCheckFunction; + ULONG_PTR ScpArm64EcCfgCheckESFunction; } PS_SYSTEM_DLL_INIT_BLOCK, *PPS_SYSTEM_DLL_INIT_BLOCK; -#if (PHNT_VERSION >= PHNT_THRESHOLD) // rev +#if (PHNT_VERSION >= PHNT_THRESHOLD) NTSYSAPI PS_SYSTEM_DLL_INIT_BLOCK LdrSystemDllInitBlock; #endif @@ -641,6 +669,8 @@ NTSYSAPI PS_SYSTEM_DLL_INIT_BLOCK LdrSystemDllInitBlock; #if (PHNT_VERSION >= PHNT_VISTA) +typedef struct _ACTIVATION_CONTEXT *PACTIVATION_CONTEXT; + // private NTSYSAPI NTSTATUS @@ -650,7 +680,7 @@ LdrAddLoadAsDataTable( _In_ PWSTR FilePath, _In_ SIZE_T Size, _In_ HANDLE Handle, - _In_opt_ HANDLE ActCtx + _In_opt_ PACTIVATION_CONTEXT ActCtx ); // private @@ -756,7 +786,7 @@ typedef struct _LDR_ENUM_RESOURCE_ENTRY } LDR_ENUM_RESOURCE_ENTRY, *PLDR_ENUM_RESOURCE_ENTRY; #define NAME_FROM_RESOURCE_ENTRY(RootDirectory, Entry) \ - ((Entry)->NameIsString ? (ULONG_PTR)PTR_ADD_OFFSET((RootDirectory), (Entry)->NameOffset) : (Entry)->Id) + ((Entry)->NameIsString ? (ULONG_PTR)((ULONG_PTR)(RootDirectory) + (ULONG_PTR)((Entry)->NameOffset)) : (Entry)->Id) NTSYSAPI NTSTATUS @@ -777,7 +807,7 @@ LdrFindEntryForAddress( _Out_ PLDR_DATA_TABLE_ENTRY *Entry ); -// rev - Win10 type +// rev NTSYSAPI NTSTATUS NTAPI @@ -788,7 +818,7 @@ LdrLoadAlternateResourceModule( _In_ ULONG Flags ); -// rev - Win10 type +// rev NTSYSAPI NTSTATUS NTAPI @@ -800,13 +830,30 @@ LdrLoadAlternateResourceModuleEx( _In_ ULONG Flags ); +// rev +NTSYSAPI +BOOLEAN +NTAPI +LdrUnloadAlternateResourceModule( + _In_ PVOID DllHandle + ); + +// rev +NTSYSAPI +BOOLEAN +NTAPI +LdrUnloadAlternateResourceModuleEx( + _In_ PVOID DllHandle, + _In_ ULONG Flags + ); + #endif // (PHNT_MODE != PHNT_MODE_KERNEL) // Module information typedef struct _RTL_PROCESS_MODULE_INFORMATION { - HANDLE Section; + PVOID Section; PVOID MappedBase; PVOID ImageBase; ULONG ImageSize; @@ -821,14 +868,30 @@ typedef struct _RTL_PROCESS_MODULE_INFORMATION typedef struct _RTL_PROCESS_MODULES { ULONG NumberOfModules; - RTL_PROCESS_MODULE_INFORMATION Modules[1]; + _Field_size_(NumberOfModules) RTL_PROCESS_MODULE_INFORMATION Modules[1]; } RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES; // private typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX { USHORT NextOffset; - RTL_PROCESS_MODULE_INFORMATION BaseInfo; + union + { + RTL_PROCESS_MODULE_INFORMATION BaseInfo; + struct + { + PVOID Section; + PVOID MappedBase; + PVOID ImageBase; + ULONG ImageSize; + ULONG Flags; + USHORT LoadOrderIndex; + USHORT InitOrderIndex; + USHORT LoadCount; + USHORT OffsetToFileName; + UCHAR FullPathName[256]; + }; + }; ULONG ImageChecksum; ULONG TimeDateStamp; PVOID DefaultBase; @@ -939,11 +1002,24 @@ typedef PVOID (NTAPI *PDELAYLOAD_FAILURE_DLL_CALLBACK)( // rev typedef PVOID (NTAPI *PDELAYLOAD_FAILURE_SYSTEM_ROUTINE)( _In_ PCSTR DllName, - _In_ PCSTR ProcName + _In_ PCSTR ProcedureName ); +#if (PHNT_VERSION >= PHNT_THRESHOLD) +// rev from QueryOptionalDelayLoadedAPI +NTSYSAPI +NTSTATUS +NTAPI +LdrQueryOptionalDelayLoadedAPI( + _In_ PVOID ParentModuleBase, + _In_ PCSTR DllName, + _In_ PCSTR ProcedureName, + _Reserved_ ULONG Flags + ); +#endif + #if (PHNT_VERSION >= PHNT_WIN8) -// rev +// rev from ResolveDelayLoadedAPI NTSYSAPI PVOID NTAPI @@ -956,23 +1032,40 @@ LdrResolveDelayLoadedAPI( _Reserved_ ULONG Flags ); -// rev +// rev from ResolveDelayLoadsFromDll NTSYSAPI NTSTATUS NTAPI LdrResolveDelayLoadsFromDll( - _In_ PVOID ParentBase, + _In_ PVOID ParentModuleBase, _In_ PCSTR TargetDllName, _Reserved_ ULONG Flags ); -// rev +// rev from SetDefaultDllDirectories NTSYSAPI NTSTATUS NTAPI LdrSetDefaultDllDirectories( _In_ ULONG DirectoryFlags ); + +// rev from AddDllDirectory +NTSYSAPI +NTSTATUS +NTAPI +LdrAddDllDirectory( + _In_ PUNICODE_STRING NewDirectory, + _Out_ PDLL_DIRECTORY_COOKIE Cookie + ); + +// rev from RemoveDllDirectory +NTSYSAPI +NTSTATUS +NTAPI +LdrRemoveDllDirectory( + _In_ DLL_DIRECTORY_COOKIE Cookie + ); #endif // rev @@ -1021,6 +1114,98 @@ LdrIsModuleSxsRedirected( ); #endif +#if (PHNT_VERSION >= PHNT_THRESHOLD) +// rev +NTSYSAPI +NTSTATUS +NTAPI +LdrUpdatePackageSearchPath( + _In_ PWSTR SearchPath + ); +#endif + +#if (PHNT_VERSION >= PHNT_THRESHOLD) + +// rev +#define ENCLAVE_STATE_CREATED 0x00000000ul // LdrpCreateSoftwareEnclave initial state +#define ENCLAVE_STATE_INITIALIZED 0x00000001ul // ZwInitializeEnclave successful (LdrInitializeEnclave) +#define ENCLAVE_STATE_INITIALIZED_VBS 0x00000002ul // only for ENCLAVE_TYPE_VBS (LdrInitializeEnclave) + +// rev +typedef struct _LDR_SOFTWARE_ENCLAVE +{ + LIST_ENTRY Links; // ntdll!LdrpEnclaveList + RTL_CRITICAL_SECTION CriticalSection; + ULONG EnclaveType; // ENCLAVE_TYPE_* + LONG ReferenceCount; + ULONG EnclaveState; // ENCLAVE_STATE_* + PVOID BaseAddress; + SIZE_T Size; + PVOID PreviousBaseAddress; + LIST_ENTRY Modules; // LDR_DATA_TABLE_ENTRY.InLoadOrderLinks + PLDR_DATA_TABLE_ENTRY PrimaryModule; + PLDR_DATA_TABLE_ENTRY BCryptModule; + PLDR_DATA_TABLE_ENTRY BCryptPrimitivesModule; +} LDR_SOFTWARE_ENCLAVE, *PLDR_SOFTWARE_ENCLAVE; + +// rev from CreateEnclave +NTSYSAPI +NTSTATUS +NTAPI +LdrCreateEnclave( + _In_ HANDLE ProcessHandle, + _Inout_ PVOID* BaseAddress, + _In_ ULONG Reserved, + _In_ SIZE_T Size, + _In_ SIZE_T InitialCommitment, + _In_ ULONG EnclaveType, + _In_reads_bytes_(EnclaveInformationLength) PVOID EnclaveInformation, + _In_ ULONG EnclaveInformationLength, + _Out_ PULONG EnclaveError + ); + +// rev from InitializeEnclave +NTSYSAPI +NTSTATUS +NTAPI +LdrInitializeEnclave( + _In_ HANDLE ProcessHandle, + _In_ PVOID BaseAddress, + _In_reads_bytes_(EnclaveInformationLength) PVOID EnclaveInformation, + _In_ ULONG EnclaveInformationLength, + _Out_ PULONG EnclaveError + ); + +// rev from DeleteEnclave +NTSYSAPI +NTSTATUS +NTAPI +LdrDeleteEnclave( + _In_ PVOID BaseAddress + ); + +// rev from CallEnclave +NTSYSAPI +NTSTATUS +NTAPI +LdrCallEnclave( + _In_ PENCLAVE_ROUTINE Routine, + _In_ ULONG Flags, // ENCLAVE_CALL_FLAG_* + _Inout_ PVOID* RoutineParamReturn + ); + +// rev from LoadEnclaveImage +NTSYSAPI +NTSTATUS +NTAPI +LdrLoadEnclaveModule( + _In_ PVOID BaseAddress, + _In_opt_ PWSTR DllPath, + _In_ PUNICODE_STRING DllName + ); + +#endif + #endif // (PHNT_MODE != PHNT_MODE_KERNEL) #endif diff --git a/ntlpcapi.h b/ntlpcapi.h index 39b8c4c..8bc4702 100644 --- a/ntlpcapi.h +++ b/ntlpcapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Local Inter-process Communication support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTLPCAPI_H @@ -57,7 +52,7 @@ typedef struct _PORT_DATA_ENTRY typedef struct _PORT_DATA_INFORMATION { ULONG CountDataEntries; - PORT_DATA_ENTRY DataEntries[1]; + _Field_size_(CountDataEntries) PORT_DATA_ENTRY DataEntries[1]; } PORT_DATA_INFORMATION, *PPORT_DATA_INFORMATION; #define LPC_REQUEST 1 @@ -70,6 +65,7 @@ typedef struct _PORT_DATA_INFORMATION #define LPC_DEBUG_EVENT 8 #define LPC_ERROR_EVENT 9 #define LPC_CONNECTION_REQUEST 10 +#define LPC_CONTINUATION_REQUIRED 0x2000 #define LPC_KERNELMODE_MESSAGE (CSHORT)0x8000 #define LPC_NO_IMPERSONATE (CSHORT)0x4000 @@ -366,9 +362,37 @@ NtQueryInformationPort( // rev typedef HANDLE ALPC_HANDLE, *PALPC_HANDLE; +#define ALPC_PORFLG_LPC_MODE 0x1000 // kernel only +#define ALPC_PORFLG_ALLOW_IMPERSONATION 0x10000 #define ALPC_PORFLG_ALLOW_LPC_REQUESTS 0x20000 // rev #define ALPC_PORFLG_WAITABLE_PORT 0x40000 // dbg +#define ALPC_PORFLG_ALLOW_DUP_OBJECT 0x80000 #define ALPC_PORFLG_SYSTEM_PROCESS 0x100000 // dbg +#define ALPC_PORFLG_WAKE_POLICY1 0x200000 +#define ALPC_PORFLG_WAKE_POLICY2 0x400000 +#define ALPC_PORFLG_WAKE_POLICY3 0x800000 +#define ALPC_PORFLG_DIRECT_MESSAGE 0x1000000 +#define ALPC_PORFLG_ALLOW_MULTIHANDLE_ATTRIBUTE 0x2000000 + +#define ALPC_PORFLG_OBJECT_TYPE_FILE 0x0001 +#define ALPC_PORFLG_OBJECT_TYPE_INVALID 0x0002 +#define ALPC_PORFLG_OBJECT_TYPE_THREAD 0x0004 +#define ALPC_PORFLG_OBJECT_TYPE_SEMAPHORE 0x0008 +#define ALPC_PORFLG_OBJECT_TYPE_EVENT 0x0010 +#define ALPC_PORFLG_OBJECT_TYPE_PROCESS 0X0020 +#define ALPC_PORFLG_OBJECT_TYPE_MUTEX 0x0040 +#define ALPC_PORFLG_OBJECT_TYPE_SECTION 0x0080 +#define ALPC_PORFLG_OBJECT_TYPE_REGKEY 0x0100 +#define ALPC_PORFLG_OBJECT_TYPE_TOKEN 0x0200 +#define ALPC_PORFLG_OBJECT_TYPE_COMPOSITION 0x0400 +#define ALPC_PORFLG_OBJECT_TYPE_JOB 0x0800 +#define ALPC_PORFLG_OBJECT_TYPE_ALL \ + (ALPC_PORFLG_OBJECT_TYPE_FILE | ALPC_PORFLG_OBJECT_TYPE_THREAD | \ + ALPC_PORFLG_OBJECT_TYPE_SEMAPHORE | ALPC_PORFLG_OBJECT_TYPE_EVENT | \ + ALPC_PORFLG_OBJECT_TYPE_PROCESS | ALPC_PORFLG_OBJECT_TYPE_MUTEX | \ + ALPC_PORFLG_OBJECT_TYPE_SECTION | ALPC_PORFLG_OBJECT_TYPE_REGKEY | \ + ALPC_PORFLG_OBJECT_TYPE_TOKEN | ALPC_PORFLG_OBJECT_TYPE_COMPOSITION | \ + ALPC_PORFLG_OBJECT_TYPE_JOB) // symbols typedef struct _ALPC_PORT_ATTRIBUTES @@ -496,6 +520,7 @@ typedef struct _ALPC_HANDLE_ATTR #define ALPC_SECFLG_CREATE_HANDLE 0x20000 // dbg #define ALPC_SECFLG_NOSECTIONHANDLE 0x40000 + // private typedef struct _ALPC_SECURITY_ATTR { @@ -529,7 +554,7 @@ typedef enum _ALPC_PORT_INFORMATION_CLASS AlpcRegisterCompletionListInformation, // s: in ALPC_PORT_COMPLETION_LIST_INFORMATION AlpcUnregisterCompletionListInformation, // s: VOID AlpcAdjustCompletionListConcurrencyCountInformation, // s: in ULONG - AlpcRegisterCallbackInformation, // kernel-mode only + AlpcRegisterCallbackInformation, // s: ALPC_REGISTER_CALLBACK // kernel-mode only AlpcCompletionListRundownInformation, // s: VOID // 10 AlpcWaitForPortReferences, AlpcServerSessionInformation // q: ALPC_SERVER_SESSION_INFORMATION // since 19H2 @@ -584,6 +609,13 @@ typedef struct _ALPC_PORT_COMPLETION_LIST_INFORMATION ULONG AttributeFlags; } ALPC_PORT_COMPLETION_LIST_INFORMATION, *PALPC_PORT_COMPLETION_LIST_INFORMATION; +// private +typedef struct _ALPC_REGISTER_CALLBACK +{ + PVOID CallbackObject; // PCALLBACK_OBJECT + PVOID CallbackContext; +} ALPC_REGISTER_CALLBACK, *PALPC_REGISTER_CALLBACK; + // private typedef struct _ALPC_SERVER_SESSION_INFORMATION { @@ -654,6 +686,8 @@ NtAlpcSetInformation( _In_ ULONG Length ); +#define ALPC_CREATEPORTSECTIONFLG_SECURE 0x40000 // rev + NTSYSCALLAPI NTSTATUS NTAPI @@ -752,9 +786,10 @@ NtAlpcQueryInformationMessage( ); #define ALPC_MSGFLG_REPLY_MESSAGE 0x1 -#define ALPC_MSGFLG_LPC_MODE 0x2 // ? +#define ALPC_MSGFLG_LPC_MODE 0x2 #define ALPC_MSGFLG_RELEASE_MESSAGE 0x10000 // dbg #define ALPC_MSGFLG_SYNC_REQUEST 0x20000 // dbg +#define ALPC_MSGFLG_TRACK_PORT_REFERENCES 0x40000 #define ALPC_MSGFLG_WAIT_USER_MODE 0x100000 #define ALPC_MSGFLG_WAIT_ALERTABLE 0x200000 #define ALPC_MSGFLG_WOW64_CALL 0x80000000 // dbg @@ -770,7 +805,7 @@ NtAlpcConnectPort( _In_ ULONG Flags, _In_opt_ PSID RequiredServerSid, _Inout_updates_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ConnectionMessage, - _Inout_opt_ PULONG BufferLength, + _Inout_opt_ PSIZE_T BufferLength, _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes, _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes, _In_opt_ PLARGE_INTEGER Timeout @@ -837,6 +872,10 @@ NtAlpcCancelMessage( _In_ PALPC_CONTEXT_ATTR MessageContext ); +#define ALPC_IMPERSONATEFLG_ANONYMOUS 0x1 +#define ALPC_IMPERSONATEFLG_REQUIRE_IMPERSONATE 0x2 +//ALPC_IMPERSONATEFLG 0x3-0x10 (SECURITY_IMPERSONATION_LEVEL) + NTSYSCALLAPI NTSTATUS NTAPI @@ -853,7 +892,7 @@ NTAPI NtAlpcImpersonateClientContainerOfPort( _In_ HANDLE PortHandle, _In_ PPORT_MESSAGE Message, - _In_ ULONG Flags + _Reserved_ ULONG Flags ); #endif @@ -864,7 +903,7 @@ NtAlpcOpenSenderProcess( _Out_ PHANDLE ProcessHandle, _In_ HANDLE PortHandle, _In_ PPORT_MESSAGE PortMessage, - _In_ ULONG Flags, + _Reserved_ ULONG Flags, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes ); @@ -876,7 +915,7 @@ NtAlpcOpenSenderThread( _Out_ PHANDLE ThreadHandle, _In_ HANDLE PortHandle, _In_ PPORT_MESSAGE PortMessage, - _In_ ULONG Flags, + _Reserved_ ULONG Flags, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes ); @@ -907,8 +946,8 @@ NTAPI AlpcInitializeMessageAttribute( _In_ ULONG AttributeFlags, _Out_opt_ PALPC_MESSAGE_ATTRIBUTES Buffer, - _In_ ULONG BufferSize, - _Out_ PULONG RequiredBufferSize + _In_ SIZE_T BufferSize, + _Out_ PSIZE_T RequiredBufferSize ); NTSYSAPI diff --git a/ntmisc.h b/ntmisc.h index b321b1f..db04dba 100644 --- a/ntmisc.h +++ b/ntmisc.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Trace Control support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTMISC_H @@ -47,77 +42,4 @@ NtVdmControl( _Inout_ PVOID ServiceData ); -// WMI/ETW - -NTSYSCALLAPI -NTSTATUS -NTAPI -NtTraceEvent( - _In_ HANDLE TraceHandle, - _In_ ULONG Flags, - _In_ ULONG FieldSize, - _In_ PVOID Fields - ); - -typedef enum _TRACE_CONTROL_INFORMATION_CLASS -{ - TraceControlStartLogger = 1, // inout WMI_LOGGER_INFORMATION - TraceControlStopLogger = 2, // inout WMI_LOGGER_INFORMATION - TraceControlQueryLogger = 3, // inout WMI_LOGGER_INFORMATION - TraceControlUpdateLogger = 4, // inout WMI_LOGGER_INFORMATION - TraceControlFlushLogger = 5, // inout WMI_LOGGER_INFORMATION - TraceControlIncrementLoggerFile = 6, // inout WMI_LOGGER_INFORMATION - TraceControlUnknown = 7, - // unused - TraceControlRealtimeConnect = 11, - TraceControlActivityIdCreate = 12, - TraceControlWdiDispatchControl = 13, - TraceControlRealtimeDisconnectConsumerByHandle = 14, // in HANDLE - TraceControlRegisterGuidsCode = 15, - TraceControlReceiveNotification = 16, - TraceControlSendDataBlock = 17, // ETW_ENABLE_NOTIFICATION_PACKET - TraceControlSendReplyDataBlock = 18, - TraceControlReceiveReplyDataBlock = 19, - TraceControlWdiUpdateSem = 20, - TraceControlEnumTraceGuidList = 21, // out GUID[] - TraceControlGetTraceGuidInfo = 22, // in GUID, out TRACE_GUID_INFO - TraceControlEnumerateTraceGuids = 23, - TraceControlRegisterSecurityProv = 24, - TraceControlQueryReferenceTime = 25, - TraceControlTrackProviderBinary = 26, // in HANDLE - TraceControlAddNotificationEvent = 27, - TraceControlUpdateDisallowList = 28, - TraceControlSetEnableAllKeywordsCode = 29, - TraceControlSetProviderTraitsCode = 30, - TraceControlUseDescriptorTypeCode = 31, - TraceControlEnumTraceGroupList = 32, - TraceControlGetTraceGroupInfo = 33, - TraceControlTraceSetDisallowList = 34, - TraceControlSetCompressionSettings = 35, - TraceControlGetCompressionSettings = 36, - TraceControlUpdatePeriodicCaptureState = 37, - TraceControlGetPrivateSessionTraceHandle = 38, - TraceControlRegisterPrivateSession = 39, - TraceControlQuerySessionDemuxObject = 40, - TraceControlSetProviderBinaryTracking = 41, - TraceControlMaxLoggers = 42, // out ULONG - TraceControlMaxPmcCounter = 43, // out ULONG - TraceControlQueryUsedProcessorCount = 44, // ULONG // since WIN11 - TraceControlGetPmcOwnership = 45, -} TRACE_CONTROL_INFORMATION_CLASS; - -#if (PHNT_VERSION >= PHNT_VISTA) -NTSYSCALLAPI -NTSTATUS -NTAPI -NtTraceControl( - _In_ TRACE_CONTROL_INFORMATION_CLASS TraceInformationClass, - _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, - _In_ ULONG InputBufferLength, - _Out_writes_bytes_opt_(TraceInformationLength) PVOID TraceInformation, - _In_ ULONG TraceInformationLength, - _Out_ PULONG ReturnLength - ); -#endif - #endif diff --git a/ntmmapi.h b/ntmmapi.h index 6823e4b..2f19466 100644 --- a/ntmmapi.h +++ b/ntmmapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Memory Manager Support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTMMAPI_H @@ -67,6 +62,7 @@ #define SEC_HUGE_PAGES 0x00020000 #define SEC_PARTITION_OWNER_HANDLE 0x00040000 #define SEC_64K_PAGES 0x00080000 +#define SEC_DRIVER_IMAGE 0x00100000 // rev #define SEC_BASED 0x00200000 #define SEC_NO_CHANGE 0x00400000 #define SEC_FILE 0x00800000 @@ -84,18 +80,17 @@ #endif #if (PHNT_MODE != PHNT_MODE_KERNEL) -// private typedef enum _MEMORY_INFORMATION_CLASS { - MemoryBasicInformation, // MEMORY_BASIC_INFORMATION - MemoryWorkingSetInformation, // MEMORY_WORKING_SET_INFORMATION - MemoryMappedFilenameInformation, // UNICODE_STRING - MemoryRegionInformation, // MEMORY_REGION_INFORMATION - MemoryWorkingSetExInformation, // MEMORY_WORKING_SET_EX_INFORMATION // since VISTA - MemorySharedCommitInformation, // MEMORY_SHARED_COMMIT_INFORMATION // since WIN8 - MemoryImageInformation, // MEMORY_IMAGE_INFORMATION + MemoryBasicInformation, // q: MEMORY_BASIC_INFORMATION + MemoryWorkingSetInformation, // q: MEMORY_WORKING_SET_INFORMATION + MemoryMappedFilenameInformation, // q: UNICODE_STRING + MemoryRegionInformation, // q: MEMORY_REGION_INFORMATION + MemoryWorkingSetExInformation, // q: MEMORY_WORKING_SET_EX_INFORMATION // since VISTA + MemorySharedCommitInformation, // q: MEMORY_SHARED_COMMIT_INFORMATION // since WIN8 + MemoryImageInformation, // q: MEMORY_IMAGE_INFORMATION MemoryRegionInformationEx, // MEMORY_REGION_INFORMATION - MemoryPrivilegedBasicInformation, + MemoryPrivilegedBasicInformation, // MEMORY_BASIC_INFORMATION MemoryEnclaveImageInformation, // MEMORY_ENCLAVE_IMAGE_INFORMATION // since REDSTONE3 MemoryBasicInformationCapped, // 10 MemoryPhysicalContiguityInformation, // MEMORY_PHYSICAL_CONTIGUITY_INFORMATION // since 20H1 @@ -136,7 +131,7 @@ typedef struct _MEMORY_WORKING_SET_BLOCK typedef struct _MEMORY_WORKING_SET_INFORMATION { ULONG_PTR NumberOfEntries; - MEMORY_WORKING_SET_BLOCK WorkingSetInfo[1]; + _Field_size_(NumberOfEntries) MEMORY_WORKING_SET_BLOCK WorkingSetInfo[1]; } MEMORY_WORKING_SET_INFORMATION, *PMEMORY_WORKING_SET_INFORMATION; // private @@ -253,7 +248,8 @@ typedef struct _MEMORY_IMAGE_INFORMATION ULONG ImagePartialMap : 1; ULONG ImageNotExecutable : 1; ULONG ImageSigningLevel : 4; // REDSTONE3 - ULONG Reserved : 26; + ULONG ImageExtensionPresent : 1; // since 24H2 + ULONG Reserved : 25; }; }; } MEMORY_IMAGE_INFORMATION, *PMEMORY_IMAGE_INFORMATION; @@ -426,8 +422,8 @@ typedef enum _SECTION_INFORMATION_CLASS { SectionBasicInformation, // q; SECTION_BASIC_INFORMATION SectionImageInformation, // q; SECTION_IMAGE_INFORMATION - SectionRelocationInformation, // q; PVOID RelocationAddress // name:wow64:whNtQuerySection_SectionRelocationInformation // since WIN7 - SectionOriginalBaseInformation, // PVOID BaseAddress + SectionRelocationInformation, // q; ULONG_PTR RelocationDelta // name:wow64:whNtQuerySection_SectionRelocationInformation // since WIN7 + SectionOriginalBaseInformation, // q; PVOID BaseAddress // since REDSTONE SectionInternalImageInformation, // SECTION_INTERNAL_IMAGE_INFORMATION // since REDSTONE2 MaxSectionInfoClass } SECTION_INFORMATION_CLASS; @@ -505,7 +501,9 @@ typedef struct _SECTION_INTERNAL_IMAGE_INFORMATION ULONG ImageCetDynamicApisAllowInProc : 1; ULONG ImageCetDowngradeReserved1 : 1; ULONG ImageCetDowngradeReserved2 : 1; - ULONG Reserved : 24; + ULONG ImageExportSuppressionInfoPresent : 1; + ULONG ImageCfgEnabled : 1; + ULONG Reserved : 22; }; }; } SECTION_INTERNAL_IMAGE_INFORMATION, *PSECTION_INTERNAL_IMAGE_INFORMATION; @@ -524,12 +522,15 @@ typedef enum _SECTION_INHERIT #define MEM_EXECUTE_OPTION_PERMANENT 0x8 #define MEM_EXECUTE_OPTION_EXECUTE_DISPATCH_ENABLE 0x10 #define MEM_EXECUTE_OPTION_IMAGE_DISPATCH_ENABLE 0x20 -#define MEM_EXECUTE_OPTION_VALID_FLAGS 0x3f +#define MEM_EXECUTE_OPTION_DISABLE_EXCEPTION_CHAIN_VALIDATION 0x40 +#define MEM_EXECUTE_OPTION_VALID_FLAGS 0x7f // Virtual memory #if (PHNT_MODE != PHNT_MODE_KERNEL) +_Must_inspect_result_ +_When_(return == 0, __drv_allocatesMem(mem)) NTSYSCALLAPI NTSTATUS NTAPI @@ -543,7 +544,10 @@ NtAllocateVirtualMemory( ); #if (PHNT_VERSION >= PHNT_REDSTONE5) -NTSYSAPI + +_Must_inspect_result_ +_When_(return == 0, __drv_allocatesMem(mem)) +NTSYSCALLAPI NTSTATUS NTAPI NtAllocateVirtualMemoryEx( @@ -555,6 +559,7 @@ NtAllocateVirtualMemoryEx( _Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters, _In_ ULONG ExtendedParameterCount ); + #endif NTSYSCALLAPI @@ -580,7 +585,7 @@ NtReadVirtualMemory( #if (PHNT_VERSION >= PHNT_WIN11) // rev -NTSYSAPI +NTSYSCALLAPI NTSTATUS NTAPI NtReadVirtualMemoryEx( @@ -627,6 +632,8 @@ NtQueryVirtualMemory( _Out_opt_ PSIZE_T ReturnLength ); +typedef struct _IO_STATUS_BLOCK* PIO_STATUS_BLOCK; + NTSYSCALLAPI NTSTATUS NTAPI @@ -634,7 +641,7 @@ NtFlushVirtualMemory( _In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, - _Out_ struct _IO_STATUS_BLOCK* IoStatus + _Out_ PIO_STATUS_BLOCK IoStatus ); #endif @@ -653,7 +660,19 @@ typedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS VmRemoveFromWorkingSetInformation, MaxVmInfoClass } VIRTUAL_MEMORY_INFORMATION_CLASS; +#else +#define VmPrefetchInformation 0x0 +#define VmPagePriorityInformation 0x1 +#define VmCfgCallTargetInformation 0x2 +#define VmPageDirtyStateInformation 0x3 +#define VmImageHotPatchInformation 0x4 +#define VmPhysicalContiguityInformation 0x5 +#define VmVirtualMachinePrepopulateInformation 0x6 +#define VmRemoveFromWorkingSetInformation 0x7 +#define MaxVmInfoClass 0x8 +#endif +#if (PHNT_MODE != PHNT_MODE_KERNEL) typedef struct _MEMORY_RANGE_ENTRY { PVOID VirtualAddress; @@ -683,8 +702,8 @@ NtSetInformationVirtualMemory( _In_ HANDLE ProcessHandle, _In_ VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass, _In_ ULONG_PTR NumberOfEntries, - _In_reads_ (NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses, - _In_reads_bytes_ (VmInformationLength) PVOID VmInformation, + _In_reads_(NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses, + _In_reads_bytes_(VmInformationLength) PVOID VmInformation, _In_ ULONG VmInformationLength ); @@ -775,7 +794,7 @@ NtMapViewOfSection( ); #if (PHNT_VERSION >= PHNT_REDSTONE5) -NTSYSAPI +NTSYSCALLAPI NTSTATUS NTAPI NtMapViewOfSectionEx( @@ -786,7 +805,7 @@ NtMapViewOfSectionEx( _Inout_ PSIZE_T ViewSize, _In_ ULONG AllocationType, _In_ ULONG Win32Protect, - _Inout_updates_opt_(ParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters, + _Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters, _In_ ULONG ExtendedParameterCount ); #endif @@ -867,6 +886,7 @@ typedef enum _PARTITION_INFORMATION_CLASS SystemMemoryPartitionMemoryChargeAttributes, SystemMemoryPartitionClearAttributes, SystemMemoryPartitionSetMemoryThresholds, // since WIN11 + SystemMemoryPartitionMemoryListCommand, // since 24H2 SystemMemoryPartitionMax } PARTITION_INFORMATION_CLASS, *PPARTITION_INFORMATION_CLASS; #else @@ -884,7 +904,8 @@ typedef enum _PARTITION_INFORMATION_CLASS #define SystemMemoryPartitionMemoryChargeAttributes 0xB #define SystemMemoryPartitionClearAttributes 0xC #define SystemMemoryPartitionSetMemoryThresholds 0xD -#define SystemMemoryPartitionMax 0xE +#define SystemMemoryPartitionMemoryListCommand 0xE +#define SystemMemoryPartitionMax 0xF #endif // private @@ -979,7 +1000,7 @@ NTSYSCALLAPI NTSTATUS NTAPI NtCreatePartition( - _In_ HANDLE ParentPartitionHandle, + _In_opt_ HANDLE ParentPartitionHandle, _Out_ PHANDLE PartitionHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, @@ -1119,6 +1140,7 @@ NtFlushWriteBuffer( #endif +#if (PHNT_VERSION >= PHNT_THRESHOLD) // Enclave support NTSYSCALLAPI @@ -1162,26 +1184,38 @@ NtInitializeEnclave( _Out_opt_ PULONG EnclaveError ); +// rev +#define TERMINATE_ENCLAVE_VALID_FLAGS 0x00000005ul +#define TERMINATE_ENCLAVE_FLAG_NO_WAIT 0x00000001ul +#define TERMINATE_ENCLAVE_FLAG_WAIT_ERROR 0x00000004ul // STATUS_PENDING -> STATUS_ENCLAVE_NOT_TERMINATED + // rev NTSYSCALLAPI NTSTATUS NTAPI NtTerminateEnclave( _In_ PVOID BaseAddress, - _In_ BOOLEAN WaitForThread + _In_ ULONG Flags // TERMINATE_ENCLAVE_FLAG_* ); #if (PHNT_MODE != PHNT_MODE_KERNEL) + +// rev +#define ENCLAVE_CALL_VALID_FLAGS 0x00000001ul +#define ENCLAVE_CALL_FLAG_NO_WAIT 0x00000001ul + // rev NTSYSCALLAPI NTSTATUS NTAPI NtCallEnclave( _In_ PENCLAVE_ROUTINE Routine, - _In_ PVOID Parameter, - _In_ BOOLEAN WaitForThread, - _Out_opt_ PVOID *ReturnValue + _In_ PVOID Reserved, // reserved for dispatch (RtlEnclaveCallDispatch) + _In_ ULONG Flags, // ENCLAVE_CALL_FLAG_* + _Inout_ PVOID* RoutineParamReturn // input routine parameter, output routine return value ); #endif #endif + +#endif diff --git a/ntnls.h b/ntnls.h index f07f0f1..6babac8 100644 --- a/ntnls.h +++ b/ntnls.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * National Language Support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTNLS_H diff --git a/ntobapi.h b/ntobapi.h index f4c8cd7..b77ce30 100644 --- a/ntobapi.h +++ b/ntobapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Object Manager support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTOBAPI_H @@ -14,7 +9,7 @@ #if (PHNT_MODE != PHNT_MODE_KERNEL) #define OBJECT_TYPE_CREATE 0x0001 -#define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1) +#define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | OBJECT_TYPE_CREATE) #endif #if (PHNT_MODE != PHNT_MODE_KERNEL) @@ -22,13 +17,13 @@ #define DIRECTORY_TRAVERSE 0x0002 #define DIRECTORY_CREATE_OBJECT 0x0004 #define DIRECTORY_CREATE_SUBDIRECTORY 0x0008 -#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xf) +#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | DIRECTORY_QUERY | DIRECTORY_TRAVERSE | DIRECTORY_CREATE_OBJECT | DIRECTORY_CREATE_SUBDIRECTORY) #endif #if (PHNT_MODE != PHNT_MODE_KERNEL) #define SYMBOLIC_LINK_QUERY 0x0001 #define SYMBOLIC_LINK_SET 0x0002 -#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1) +#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYMBOLIC_LINK_QUERY) #define SYMBOLIC_LINK_ALL_ACCESS_EX (STANDARD_RIGHTS_REQUIRED | 0xFFFF) #endif diff --git a/ntpebteb.h b/ntpebteb.h index 44ff6fe..da221e3 100644 --- a/ntpebteb.h +++ b/ntpebteb.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Process and Thread Environment Block support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTPEBTEB_H @@ -14,16 +9,35 @@ typedef struct _RTL_USER_PROCESS_PARAMETERS *PRTL_USER_PROCESS_PARAMETERS; typedef struct _RTL_CRITICAL_SECTION *PRTL_CRITICAL_SECTION; +typedef struct _SILO_USER_SHARED_DATA *PSILO_USER_SHARED_DATA; +typedef struct _LEAP_SECOND_DATA *PLEAP_SECOND_DATA; + +#include // private -typedef struct _ACTIVATION_CONTEXT_STACK -{ - struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME* ActiveFrame; - LIST_ENTRY FrameListCache; - ULONG Flags; - ULONG NextCookieSequenceNumber; - ULONG StackId; -} ACTIVATION_CONTEXT_STACK, *PACTIVATION_CONTEXT_STACK; +#define KACF_OLDGETSHORTPATHNAME 0x00000001 +#define KACF_VERSIONLIE_NOT_USED 0x00000002 +#define KACF_GETDISKFREESPACE 0x00000008 +#define KACF_FTMFROMCURRENTAPT 0x00000020 +#define KACF_DISALLOWORBINDINGCHANGES 0x00000040 +#define KACF_OLE32VALIDATEPTRS 0x00000080 +#define KACF_DISABLECICERO 0x00000100 +#define KACF_OLE32ENABLEASYNCDOCFILE 0x00000200 +#define KACF_OLE32ENABLELEGACYEXCEPTIONHANDLING 0x00000400 +#define KACF_RPCDISABLENDRCLIENTHARDENING 0x00000800 +#define KACF_RPCDISABLENDRMAYBENULL_SIZEIS 0x00001000 +#define KACF_DISABLEALLDDEHACK_NOT_USED 0x00002000 +#define KACF_RPCDISABLENDR61_RANGE 0x00004000 +#define KACF_RPC32ENABLELEGACYEXCEPTIONHANDLING 0x00008000 +#define KACF_OLE32DOCFILEUSELEGACYNTFSFLAGS 0x00010000 +#define KACF_RPCDISABLENDRCONSTIIDCHECK 0x00020000 +#define KACF_USERDISABLEFORWARDERPATCH 0x00040000 +#define KACF_OLE32DISABLENEW_WMPAINT_DISPATCH 0x00100000 +#define KACF_ADDRESTRICTEDSIDINCOINITIALIZESECURITY 0x00200000 +#define KACF_ALLOCDEBUGINFOFORCRITSECTIONS 0x00400000 +#define KACF_OLEAUT32ENABLEUNSAFELOADTYPELIBRELATIVE 0x00800000 +#define KACF_ALLOWMAXIMIZEDWINDOWGAMMA 0x01000000 +#define KACF_DONOTADDTOCACHE 0x80000000 // private typedef struct _API_SET_NAMESPACE @@ -65,6 +79,28 @@ typedef struct _API_SET_VALUE_ENTRY ULONG ValueLength; } API_SET_VALUE_ENTRY, *PAPI_SET_VALUE_ENTRY; +// private +typedef struct _TELEMETRY_COVERAGE_HEADER +{ + UCHAR MajorVersion; + UCHAR MinorVersion; + struct + { + USHORT TracingEnabled : 1; + USHORT Reserved1 : 15; + }; + ULONG HashTableEntries; + ULONG HashIndexMask; + ULONG TableUpdateVersion; + ULONG TableSizeInBytes; + ULONG LastResetTick; + ULONG ResetRound; + ULONG Reserved2; + ULONG RecordedCount; + ULONG Reserved3[4]; + ULONG HashTable[ANYSIZE_ARRAY]; +} TELEMETRY_COVERAGE_HEADER, *PTELEMETRY_COVERAGE_HEADER; + // symbols typedef struct _PEB { @@ -123,11 +159,11 @@ typedef struct _PEB ULONG AtlThunkSListPtr32; PAPI_SET_NAMESPACE ApiSetMap; ULONG TlsExpansionCounter; - PVOID TlsBitmap; - ULONG TlsBitmapBits[2]; + PRTL_BITMAP TlsBitmap; + ULONG TlsBitmapBits[2]; // TLS_MINIMUM_AVAILABLE PVOID ReadOnlySharedMemoryBase; - PVOID SharedData; // HotpatchInformation + PSILO_USER_SHARED_DATA SharedData; // HotpatchInformation PVOID *ReadOnlyStaticServerData; PVOID AnsiCodePageData; // PCPTABLEINFO @@ -147,7 +183,7 @@ typedef struct _PEB ULONG MaximumNumberOfHeaps; PVOID *ProcessHeaps; // PHEAP - PVOID GdiSharedHandleTable; + PVOID GdiSharedHandleTable; // PGDI_SHARED_MEMORY PVOID ProcessStarterHelper; ULONG GdiDCAttributeList; @@ -165,22 +201,22 @@ typedef struct _PEB GDI_HANDLE_BUFFER GdiHandleBuffer; PVOID PostProcessInitRoutine; - PVOID TlsExpansionBitmap; - ULONG TlsExpansionBitmapBits[32]; + PRTL_BITMAP TlsExpansionBitmap; + ULONG TlsExpansionBitmapBits[32]; // TLS_EXPANSION_SLOTS ULONG SessionId; - ULARGE_INTEGER AppCompatFlags; + ULARGE_INTEGER AppCompatFlags; // KACF_* ULARGE_INTEGER AppCompatFlagsUser; PVOID pShimData; PVOID AppCompatInfo; // APPCOMPAT_EXE_DATA UNICODE_STRING CSDVersion; - PVOID ActivationContextData; // ACTIVATION_CONTEXT_DATA - PVOID ProcessAssemblyStorageMap; // ASSEMBLY_STORAGE_MAP - PVOID SystemDefaultActivationContextData; // ACTIVATION_CONTEXT_DATA - PVOID SystemAssemblyStorageMap; // ASSEMBLY_STORAGE_MAP + PACTIVATION_CONTEXT_DATA ActivationContextData; + PASSEMBLY_STORAGE_MAP ProcessAssemblyStorageMap; + PACTIVATION_CONTEXT_DATA SystemDefaultActivationContextData; + PASSEMBLY_STORAGE_MAP SystemAssemblyStorageMap; SIZE_T MinimumStackCommit; @@ -222,12 +258,12 @@ typedef struct _PEB PRTL_CRITICAL_SECTION TppWorkerpListLock; LIST_ENTRY TppWorkerpList; PVOID WaitOnAddressHashTable[128]; - PVOID TelemetryCoverageHeader; // REDSTONE3 + PTELEMETRY_COVERAGE_HEADER TelemetryCoverageHeader; // REDSTONE3 ULONG CloudFileFlags; ULONG CloudFileDiagFlags; // REDSTONE4 CHAR PlaceholderCompatibilityMode; CHAR PlaceholderCompatibilityModeReserved[7]; - struct _LEAP_SECOND_DATA *LeapSecondData; // REDSTONE5 + PLEAP_SECOND_DATA LeapSecondData; // REDSTONE5 union { ULONG LeapSecondFlags; @@ -270,6 +306,12 @@ typedef struct _TEB_ACTIVE_FRAME_CONTEXT PSTR FrameName; } TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT; +typedef struct _TEB_ACTIVE_FRAME_CONTEXT_EX +{ + TEB_ACTIVE_FRAME_CONTEXT BasicContext; + PSTR SourceLocation; +} TEB_ACTIVE_FRAME_CONTEXT_EX, *PTEB_ACTIVE_FRAME_CONTEXT_EX; + typedef struct _TEB_ACTIVE_FRAME { ULONG Flags; @@ -277,6 +319,15 @@ typedef struct _TEB_ACTIVE_FRAME PTEB_ACTIVE_FRAME_CONTEXT Context; } TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME; +typedef struct _TEB_ACTIVE_FRAME_EX +{ + TEB_ACTIVE_FRAME BasicFrame; + PVOID ExtensionIdentifier; +} TEB_ACTIVE_FRAME_EX, *PTEB_ACTIVE_FRAME_EX; + +#define STATIC_UNICODE_BUFFER_LENGTH 261 +#define WIN32_CLIENT_INFO_LENGTH 62 + typedef struct _TEB { NT_TIB NtTib; @@ -298,7 +349,11 @@ typedef struct _TEB ULONG FpSoftwareStatusRegister; PVOID ReservedForDebuggerInstrumentation[16]; #ifdef _WIN64 - PVOID SystemReserved1[30]; + PVOID SystemReserved1[25]; + + PVOID HeapFlsData; + + ULONG_PTR RngState[4]; #else PVOID SystemReserved1[26]; #endif @@ -311,6 +366,7 @@ typedef struct _TEB ACTIVATION_CONTEXT_STACK ActivationStack; UCHAR WorkingOnBehalfTicket[8]; + NTSTATUS ExceptionCode; PACTIVATION_CONTEXT_STACK ActivationContextStackPointer; @@ -335,7 +391,8 @@ typedef struct _TEB ULONG GdiClientPID; ULONG GdiClientTID; PVOID GdiThreadLocalInfo; - ULONG_PTR Win32ClientInfo[62]; + ULONG_PTR Win32ClientInfo[WIN32_CLIENT_INFO_LENGTH]; + PVOID glDispatchTable[233]; ULONG_PTR glReserved1[29]; PVOID glReserved2; @@ -346,11 +403,13 @@ typedef struct _TEB PVOID glContext; NTSTATUS LastStatusValue; + UNICODE_STRING StaticUnicodeString; - WCHAR StaticUnicodeBuffer[261]; + WCHAR StaticUnicodeBuffer[STATIC_UNICODE_BUFFER_LENGTH]; PVOID DeallocationStack; - PVOID TlsSlots[64]; + + PVOID TlsSlots[TLS_MINIMUM_AVAILABLE]; LIST_ENTRY TlsLinks; PVOID Vdm; @@ -386,15 +445,15 @@ typedef struct _TEB ULONG GuaranteedStackBytes; PVOID ReservedForPerf; - PVOID ReservedForOle; + PVOID ReservedForOle; // tagSOleTlsData ULONG WaitingOnLoaderLock; PVOID SavedPriorityState; ULONG_PTR ReservedForCodeCoverage; PVOID ThreadPoolData; PVOID *TlsExpansionSlots; #ifdef _WIN64 - PVOID DeallocationBStore; - PVOID BStoreLimit; + PVOID ChpeV2CpuAreaInfo; // CHPEV2_CPUAREA_INFO // previously DeallocationBStore + PVOID Unused; // previously BStoreLimit #endif ULONG MuiGeneration; ULONG IsImpersonating; @@ -451,6 +510,18 @@ typedef struct _TEB ULONGLONG LastSleepCounter; // Win11 ULONG SpinCallCount; ULONGLONG ExtendedFeatureDisableMask; + PVOID SchedulerSharedDataSlot; // 24H2 + PVOID HeapWalkContext; + GROUP_AFFINITY PrimaryGroupAffinity; + ULONG Rcu[2]; } TEB, *PTEB; +#ifdef _WIN64 +//C_ASSERT(sizeof(TEB) == 0x1850); // WIN11 +C_ASSERT(sizeof(TEB) == 0x1878); // 24H2 +#else +//C_ASSERT(sizeof(TEB) == 0x1018); // WIN11 +C_ASSERT(sizeof(TEB) == 0x1038); // 24H2 +#endif + #endif diff --git a/ntpfapi.h b/ntpfapi.h index dbae732..dc7354f 100644 --- a/ntpfapi.h +++ b/ntpfapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Prefetcher (Superfetch) support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTPFAPI_H @@ -101,6 +96,54 @@ typedef struct _PF_SYSTEM_SUPERFETCH_PARAMETERS ULONG ScenarioPrefetchTimeoutHiberBoot; } PF_SYSTEM_SUPERFETCH_PARAMETERS, *PPF_SYSTEM_SUPERFETCH_PARAMETERS; +// rev +typedef enum _PF_EVENT_TYPE +{ + PfEventTypeImageLoad = 0, + PfEventTypeAppLaunch = 1, + PfEventTypeStartTrace = 2, + PfEventTypeEndTrace = 3, + PfEventTypeTimestamp = 4, + PfEventTypeOperation = 5, + PfEventTypeRepurpose = 6, + PfEventTypeForegroundProcess = 7, + PfEventTypeTimeRange = 8, + PfEventTypeUserInput = 9, + PfEventTypeFileAccess = 10, + PfEventTypeUnmap = 11, + PfEventTypeUtilization = 11, + PfEventTypeMemInfo = 12, + PfEventTypeFileDelete = 13, + PfEventTypeAppExit = 14, + PfEventTypeSystemTime = 15, + PfEventTypePower = 16, + PfEventTypeSessionChange = 17, + PfEventTypeHardFaultTimeStamp = 18, + PfEventTypeVirtualFree = 19, + PfEventTypePerfInfo = 20, + PfEventTypeProcessSnapshot = 21, + PfEventTypeUserSnapshot = 22, + PfEventTypeStreamSequenceNumber = 23, + PfEventTypeFileTruncate = 24, + PfEventTypeFileRename = 25, + PfEventTypeFileCreate = 26, + PfEventTypeAgCxContext = 27, + PfEventTypePowerAction = 28, + PfEventTypeHardFaultTS = 29, + PfEventTypeRobustInfo = 30, + PfEventTypeFileDefrag = 31, + PfEventTypeMax = 32 +} PF_EVENT_TYPE; + +// rev +typedef struct _PF_LOG_EVENT_DATA +{ + ULONG EventType : 5; // PF_EVENT_TYPE + ULONG Flags : 2; + ULONG DataSize : 25; + PVOID EventData; +} PF_LOG_EVENT_DATA, *PPF_LOG_EVENT_DATA; + #define PF_PFN_PRIO_REQUEST_VERSION 1 #define PF_PFN_PRIO_REQUEST_QUERY_MEMORY_LIST 0x1 #define PF_PFN_PRIO_REQUEST_VALID_FLAGS 0x1 @@ -156,8 +199,13 @@ typedef struct _PF_PRIVSOURCE_INFO ULONG Spare : 28; } PF_PRIVSOURCE_INFO, *PPF_PRIVSOURCE_INFO; +// rev #define PF_PRIVSOURCE_QUERY_REQUEST_VERSION 8 +#define PF_PRIVSOURCE_QUERY_REQUEST_FLAGS_QUERYWSPAGES 0x1 +#define PF_PRIVSOURCE_QUERY_REQUEST_FLAGS_QUERYCOMPRESSEDPAGES 0x2 +#define PF_PRIVSOURCE_QUERY_REQUEST_FLAGS_QUERYSKIPPAGES 0x4 // ?? +// rev typedef struct _PF_PRIVSOURCE_QUERY_REQUEST { ULONG Version; @@ -166,6 +214,7 @@ typedef struct _PF_PRIVSOURCE_QUERY_REQUEST PF_PRIVSOURCE_INFO InfoArray[1]; } PF_PRIVSOURCE_QUERY_REQUEST, *PPF_PRIVSOURCE_QUERY_REQUEST; +// rev typedef enum _PF_PHASED_SCENARIO_TYPE { PfScenarioTypeNone, @@ -175,8 +224,10 @@ typedef enum _PF_PHASED_SCENARIO_TYPE PfScenarioTypeMax } PF_PHASED_SCENARIO_TYPE; +// rev #define PF_SCENARIO_PHASE_INFO_VERSION 4 +// rev typedef struct _PF_SCENARIO_PHASE_INFO { ULONG Version; @@ -187,6 +238,7 @@ typedef struct _PF_SCENARIO_PHASE_INFO ULONG FUSUserId; } PF_SCENARIO_PHASE_INFO, *PPF_SCENARIO_PHASE_INFO; +// rev typedef struct _PF_MEMORY_LIST_NODE { ULONGLONG Node : 8; @@ -198,6 +250,52 @@ typedef struct _PF_MEMORY_LIST_NODE ULONGLONG ModifiedPageCount; } PF_MEMORY_LIST_NODE, *PPF_MEMORY_LIST_NODE; +// rev +typedef struct _PF_ROBUST_PROCESS_ENTRY +{ + ULONG ImagePathHash; + ULONG Pid; + ULONG Alignment; +} PF_ROBUST_PROCESS_ENTRY, *PPF_ROBUST_PROCESS_ENTRY; + +// rev +typedef struct _PF_ROBUST_FILE_ENTRY +{ + ULONG FilePathHash; +} PF_ROBUST_FILE_ENTRY, *PPF_ROBUST_FILE_ENTRY; + +// rev +typedef enum _PF_ROBUSTNESS_CONTROL_COMMAND +{ + PfRpControlUpdate = 0, + PfRpControlReset = 1, + PfRpControlRobustAllStart = 2, + PfRpControlRobustAllStop = 3, + PfRpControlCommandMax = 4 +} PF_ROBUSTNESS_CONTROL_COMMAND; + +// rev +#define PF_ROBUSTNESS_CONTROL_VERSION 1 + +// rev +typedef struct _PF_ROBUSTNESS_CONTROL +{ + ULONG Version; + PF_ROBUSTNESS_CONTROL_COMMAND Command; + ULONG DeprioProcessCount; + ULONG ExemptProcessCount; + ULONG DeprioFileCount; + ULONG ExemptFileCount; + PF_ROBUST_PROCESS_ENTRY ProcessEntries[1]; + PF_ROBUST_FILE_ENTRY FileEntries[1]; +} PF_ROBUSTNESS_CONTROL, *PPF_ROBUSTNESS_CONTROL; + +// rev +typedef struct _PF_TIME_CONTROL +{ + LONG TimeAdjustment; +} PF_TIME_CONTROL, *PPF_TIME_CONTROL; + #define PF_MEMORY_LIST_INFO_VERSION 1 typedef struct _PF_MEMORY_LIST_INFO @@ -233,48 +331,111 @@ typedef struct _PF_PHYSICAL_MEMORY_RANGE_INFO_V2 PF_PHYSICAL_MEMORY_RANGE Ranges[ANYSIZE_ARRAY]; } PF_PHYSICAL_MEMORY_RANGE_INFO_V2, *PPF_PHYSICAL_MEMORY_RANGE_INFO_V2; -// begin_rev - +// rev #define PF_REPURPOSED_BY_PREFETCH_INFO_VERSION 1 +// rev typedef struct _PF_REPURPOSED_BY_PREFETCH_INFO { ULONG Version; - ULONG RepurposedByPrefetch; + SIZE_T RepurposedByPrefetch; } PF_REPURPOSED_BY_PREFETCH_INFO, *PPF_REPURPOSED_BY_PREFETCH_INFO; -// end_rev +// rev +#define PF_VIRTUAL_QUERY_VERSION 1 +// rev +typedef struct _PF_VIRTUAL_QUERY +{ + ULONG Version; + union + { + ULONG Flags; + struct + { + ULONG FaultInPageTables : 1; + ULONG ReportPageTables : 1; + ULONG Spare : 30; + }; + }; + PVOID QueryBuffer; // MEMORY_WORKING_SET_EX_INFORMATION[NumberOfPages] (input: VirtualAddress[], output: VirtualAttributes[]) + SIZE_T QueryBufferSize; // NumberOfPages * sizeof(MEMORY_WORKING_SET_EX_INFORMATION) + HANDLE ProcessHandle; +} PF_VIRTUAL_QUERY, *PPF_VIRTUAL_QUERY; + +// rev +#define PF_MIN_WS_AGE_RATE_CONTROL_VERSION 1 + +// rev +typedef struct _PF_MIN_WS_AGE_RATE_CONTROL +{ + ULONG Version; + ULONG SecondsToOldestAge; +} PF_MIN_WS_AGE_RATE_CONTROL, *PPF_MIN_WS_AGE_RATE_CONTROL; + +// rev +#define PF_DEPRIORITIZE_OLD_PAGES_VERSION 3 + +// rev +typedef struct _PF_DEPRIORITIZE_OLD_PAGES +{ + ULONG Version; + HANDLE ProcessHandle; + union + { + ULONG Flags; + struct + { + ULONG TargetPriority : 4; + ULONG TrimPages : 2; + ULONG Spare : 26; + }; + }; +} PF_DEPRIORITIZE_OLD_PAGES, *PPF_DEPRIORITIZE_OLD_PAGES; + +// rev +#define PF_GPU_UTILIZATION_INFO_VERSION 1 + +// rev +typedef struct _PF_GPU_UTILIZATION_INFO +{ + ULONG Version; + ULONG SessionId; + ULONGLONG GpuTime; +} PF_GPU_UTILIZATION_INFO, *PPF_GPU_UTILIZATION_INFO; + +// rev typedef enum _SUPERFETCH_INFORMATION_CLASS { SuperfetchRetrieveTrace = 1, // q: CHAR[] SuperfetchSystemParameters, // q: PF_SYSTEM_SUPERFETCH_PARAMETERS - SuperfetchLogEvent, - SuperfetchGenerateTrace, + SuperfetchLogEvent, // s: PF_LOG_EVENT_DATA + SuperfetchGenerateTrace, // s: NULL SuperfetchPrefetch, SuperfetchPfnQuery, // q: PF_PFN_PRIO_REQUEST SuperfetchPfnSetPriority, SuperfetchPrivSourceQuery, // q: PF_PRIVSOURCE_QUERY_REQUEST SuperfetchSequenceNumberQuery, // q: ULONG SuperfetchScenarioPhase, // 10 - SuperfetchWorkerPriority, + SuperfetchWorkerPriority, // s: KPRIORITY SuperfetchScenarioQuery, // q: PF_SCENARIO_PHASE_INFO SuperfetchScenarioPrefetch, - SuperfetchRobustnessControl, - SuperfetchTimeControl, + SuperfetchRobustnessControl, // s: PF_ROBUSTNESS_CONTROL + SuperfetchTimeControl, // s: PF_TIME_CONTROL SuperfetchMemoryListQuery, // q: PF_MEMORY_LIST_INFO SuperfetchMemoryRangesQuery, // q: PF_PHYSICAL_MEMORY_RANGE_INFO SuperfetchTracingControl, SuperfetchTrimWhileAgingControl, - SuperfetchRepurposedByPrefetch, // q: PF_REPURPOSED_BY_PREFETCH_INFO // rev + SuperfetchRepurposedByPrefetch, // q: PF_REPURPOSED_BY_PREFETCH_INFO // 20 SuperfetchChannelPowerRequest, SuperfetchMovePages, - SuperfetchVirtualQuery, + SuperfetchVirtualQuery, // q: PF_VIRTUAL_QUERY SuperfetchCombineStatsQuery, - SuperfetchSetMinWsAgeRate, - SuperfetchDeprioritizeOldPagesInWs, - SuperfetchFileExtentsQuery, - SuperfetchGpuUtilizationQuery, // PF_GPU_UTILIZATION_INFO + SuperfetchSetMinWsAgeRate, // s: PF_MIN_WS_AGE_RATE_CONTROL + SuperfetchDeprioritizeOldPagesInWs, // s: PF_DEPRIORITIZE_OLD_PAGES + SuperfetchFileExtentsQuery, // q: PF_FILE_EXTENTS_INFO + SuperfetchGpuUtilizationQuery, // q: PF_GPU_UTILIZATION_INFO + SuperfetchPfnSet, // s: PF_PFN_PRIO_REQUEST // since WIN11 SuperfetchInformationMax } SUPERFETCH_INFORMATION_CLASS; diff --git a/ntpnpapi.h b/ntpnpapi.h index b73eed7..dd1147e 100644 --- a/ntpnpapi.h +++ b/ntpnpapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Plug and Play support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTPNPAPI_H @@ -110,6 +105,48 @@ typedef enum _PLUGPLAY_CONTROL_CLASS MaxPlugPlayControl } PLUGPLAY_CONTROL_CLASS, *PPLUGPLAY_CONTROL_CLASS; +// pub +typedef enum _DEVICE_RELATION_TYPE +{ + BusRelations, + EjectionRelations, + PowerRelations, + RemovalRelations, + TargetDeviceRelation, + SingleBusRelations, + TransportRelations +} DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE; + +// pub +typedef enum _BUS_QUERY_ID_TYPE +{ + BusQueryDeviceID = 0, // \ + BusQueryHardwareIDs = 1, // Hardware ids + BusQueryCompatibleIDs = 2, // compatible device ids + BusQueryInstanceID = 3, // persistent id for this instance of the device + BusQueryDeviceSerialNumber = 4, // serial number for this device + BusQueryContainerID = 5 // unique id of the device's physical container +} BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE; + +// pub +typedef enum _DEVICE_TEXT_TYPE +{ + DeviceTextDescription = 0, // DeviceDesc property + DeviceTextLocationInformation = 1 // DeviceLocation property +} DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE; + +// pub +typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE +{ + DeviceUsageTypeUndefined, + DeviceUsageTypePaging, + DeviceUsageTypeHibernation, + DeviceUsageTypeDumpFile, + DeviceUsageTypeBoot, + DeviceUsageTypePostDisplay, + DeviceUsageTypeGuestAssigned +} DEVICE_USAGE_NOTIFICATION_TYPE, *PDEVICE_USAGE_NOTIFICATION_TYPE; + #if (PHNT_VERSION < PHNT_WIN8) NTSYSCALLAPI NTSTATUS diff --git a/ntpoapi.h b/ntpoapi.h index 3e04b6e..daafb75 100644 --- a/ntpoapi.h +++ b/ntpoapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Power Management support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTPOAPI_H @@ -48,12 +43,12 @@ #define TraceApplicationPowerMessage 30 // (kernel-mode only) #define TraceApplicationPowerMessageEnd 31 // (kernel-mode only) #define ProcessorPerfStates 32 // (kernel-mode only) -#define ProcessorIdleStates 33 // (kernel-mode only) -#define ProcessorCap 34 // (kernel-mode only) -#define SystemWakeSource 35 -#define SystemHiberFileInformation 36 // q: SYSTEM_HIBERFILE_INFORMATION +#define ProcessorIdleStates 33 // PROCESSOR_IDLE_STATES // (kernel-mode only) +#define ProcessorCap 34 // PROCESSOR_CAP // (kernel-mode only) +#define SystemWakeSource 35 // out: POWER_WAKE_SOURCE_INFO +#define SystemHiberFileInformation 36 // out: SYSTEM_HIBERFILE_INFORMATION #define TraceServicePowerMessage 37 -#define ProcessorLoad 38 +#define ProcessorLoad 38 // in: PROCESSOR_LOAD (sets), in: PPROCESSOR_NUMBER (clears) #define PowerShutdownNotification 39 // (kernel-mode only) #define MonitorCapabilities 40 // (kernel-mode only) #define SessionPowerInit 41 // (kernel-mode only) @@ -65,11 +60,11 @@ #define NotifyUserModeLegacyPowerEvent 47 // (kernel-mode only) #define GroupPark 48 // (debug-mode boot only) #define ProcessorIdleDomains 49 // (kernel-mode only) -#define WakeTimerList 50 // powercfg.exe /waketimers +#define WakeTimerList 50 // out: WAKE_TIMER_INFO[] #define SystemHiberFileSize 51 // ULONG #define ProcessorIdleStatesHv 52 // (kernel-mode only) #define ProcessorPerfStatesHv 53 // (kernel-mode only) -#define ProcessorPerfCapHv 54 // (kernel-mode only) +#define ProcessorPerfCapHv 54 // PROCESSOR_PERF_CAP_HV // (kernel-mode only) #define ProcessorSetIdle 55 // (debug-mode boot only) #define LogicalProcessorIdling 56 // (kernel-mode only) #define UserPresence 57 // POWER_USER_PRESENCE // not implemented @@ -112,7 +107,8 @@ #define UpdateBlackBoxRecorder 94 #define SessionAllowExternalDmaDevices 95 #define SendSuspendResumeNotification 96 // since WIN11 -#define PowerInformationLevelMaximum 97 +#define BlackBoxRecorderDirectAccessBuffer 97 +#define PowerInformationLevelMaximum 98 #endif typedef struct _PROCESSOR_POWER_INFORMATION @@ -206,7 +202,9 @@ typedef struct _SYSTEM_POWER_STATE_CONTEXT ULONG CurrentSystemState : 4; ULONG IgnoreHibernationPath : 1; ULONG PseudoTransition : 1; - ULONG Reserved2 : 10; + ULONG KernelSoftReboot : 1; + ULONG DirectedDripsTransition : 1; + ULONG Reserved2 : 8; }; ULONG ContextAsUlong; }; @@ -226,13 +224,13 @@ typedef struct _COUNTED_REASON_CONTEXT_RELATIVE { struct { - ULONG_PTR ResourceFileNameOffset; + SIZE_T ResourceFileNameOffset; USHORT ResourceReasonId; ULONG StringCount; - ULONG_PTR SubstitutionStringsOffset; - }; - ULONG_PTR SimpleStringOffset; - }; + SIZE_T SubstitutionStringsOffset; + } DUMMYSTRUCTNAME; + SIZE_T SimpleStringOffset; + } DUMMYUNIONNAME; } COUNTED_REASON_CONTEXT_RELATIVE, *PCOUNTED_REASON_CONTEXT_RELATIVE; typedef struct _DIAGNOSTIC_BUFFER @@ -243,19 +241,164 @@ typedef struct _DIAGNOSTIC_BUFFER { struct { - ULONG_PTR ProcessImageNameOffset; // PWSTR + SIZE_T ProcessImageNameOffset; // PWSTR ULONG ProcessId; ULONG ServiceTag; - }; + } DUMMYSTRUCTNAME; struct { - ULONG_PTR DeviceDescriptionOffset; // PWSTR - ULONG_PTR DevicePathOffset; // PWSTR - }; - }; - ULONG_PTR ReasonOffset; // PCOUNTED_REASON_CONTEXT_RELATIVE + SIZE_T DeviceDescriptionOffset; // PWSTR + SIZE_T DevicePathOffset; // PWSTR + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; + SIZE_T ReasonOffset; // PCOUNTED_REASON_CONTEXT_RELATIVE } DIAGNOSTIC_BUFFER, *PDIAGNOSTIC_BUFFER; +typedef struct _WAKE_TIMER_INFO +{ + SIZE_T OffsetToNext; + ULARGE_INTEGER DueTime; + ULONG Period; + DIAGNOSTIC_BUFFER ReasonContext; +} WAKE_TIMER_INFO, *PWAKE_TIMER_INFO; + +// rev +typedef struct _PROCESSOR_PERF_CAP_HV +{ + ULONG Version; + ULONG InitialApicId; + ULONG Ppc; + ULONG Tpc; + ULONG ThermalCap; +} PROCESSOR_PERF_CAP_HV, *PPROCESSOR_PERF_CAP_HV; + +typedef struct PROCESSOR_IDLE_TIMES +{ + ULONG64 StartTime; + ULONG64 EndTime; + ULONG Reserved[4]; +} PROCESSOR_IDLE_TIMES, *PPROCESSOR_IDLE_TIMES; + +_Function_class_(PROCESSOR_IDLE_HANDLER) +typedef NTSTATUS (FASTCALL PROCESSOR_IDLE_HANDLER)( + _In_ ULONG_PTR Context, + _Inout_ PPROCESSOR_IDLE_TIMES IdleTimes + ); + +typedef PROCESSOR_IDLE_HANDLER *PPROCESSOR_IDLE_HANDLER; + +#define PROCESSOR_STATE_TYPE_PERFORMANCE 0x1 +#define PROCESSOR_STATE_TYPE_THROTTLE 0x2 + +#define IDLE_STATE_FLAGS_C1_HLT 0x01 // describes C1 only +#define IDLE_STATE_FLAGS_C1_IO_HLT 0x02 // describes C1 only +#define IDLE_STATE_FLAGS_IO 0x04 // describes C2 and C3 only +#define IDLE_STATE_FLAGS_MWAIT 0x08 // describes C1, C2, C3, C4, ... + +typedef struct _PROCESSOR_IDLE_STATE +{ + UCHAR StateType; + ULONG StateFlags; + ULONG HardwareLatency; + ULONG Power; + ULONG_PTR Context; + PPROCESSOR_IDLE_HANDLER Handler; +} PROCESSOR_IDLE_STATE, *PPROCESSOR_IDLE_STATE; + +typedef struct _PROCESSOR_IDLE_STATES +{ + ULONG Size; + ULONG Revision; + ULONG Count; + ULONG Type; + KAFFINITY TargetProcessors; + PROCESSOR_IDLE_STATE State[ANYSIZE_ARRAY]; +} PROCESSOR_IDLE_STATES, *PPROCESSOR_IDLE_STATES; + +// rev +typedef struct _PROCESSOR_LOAD +{ + PROCESSOR_NUMBER ProcessorNumber; + UCHAR BusyPercentage; + UCHAR FrequencyPercentage; + USHORT Padding; +} PROCESSOR_LOAD, *PPROCESSOR_LOAD; + +// rev +typedef struct _PROCESSOR_CAP +{ + ULONG Version; + PROCESSOR_NUMBER ProcessorNumber; + ULONG PlatformCap; + ULONG ThermalCap; + ULONG LimitReasons; +} PROCESSOR_CAP, *PPROCESSOR_CAP; + +typedef struct _PO_WAKE_SOURCE_INFO +{ + ULONG Count; + ULONG Offsets[ANYSIZE_ARRAY]; // POWER_WAKE_SOURCE_HEADER, POWER_WAKE_SOURCE_INTERNAL, POWER_WAKE_SOURCE_TIMER, POWER_WAKE_SOURCE_FIXED +} PO_WAKE_SOURCE_INFO, *PPO_WAKE_SOURCE_INFO; + +typedef struct _PO_WAKE_SOURCE_HISTORY +{ + ULONG Count; + ULONG Offsets[ANYSIZE_ARRAY]; // POWER_WAKE_SOURCE_HEADER, POWER_WAKE_SOURCE_INTERNAL, POWER_WAKE_SOURCE_TIMER, POWER_WAKE_SOURCE_FIXED +} PO_WAKE_SOURCE_HISTORY, *PPO_WAKE_SOURCE_HISTORY; + +typedef enum _PO_WAKE_SOURCE_TYPE +{ + DeviceWakeSourceType = 0, + FixedWakeSourceType = 1, + TimerWakeSourceType = 2, + TimerPresumedWakeSourceType = 3, + InternalWakeSourceType = 4 +} PO_WAKE_SOURCE_TYPE, *PPO_WAKE_SOURCE_TYPE; + +typedef enum _PO_INTERNAL_WAKE_SOURCE_TYPE +{ + InternalWakeSourceDozeToHibernate = 0, + InternalWakeSourcePredictedUserPresence = 1 +} PO_INTERNAL_WAKE_SOURCE_TYPE; + +typedef enum _PO_FIXED_WAKE_SOURCE_TYPE +{ + FixedWakeSourcePowerButton = 0, + FixedWakeSourceSleepButton = 1, + FixedWakeSourceRtc = 2, + FixedWakeSourceDozeToHibernate = 3 +} PO_FIXED_WAKE_SOURCE_TYPE, *PPO_FIXED_WAKE_SOURCE_TYPE; + +typedef struct _PO_WAKE_SOURCE_HEADER +{ + PO_WAKE_SOURCE_TYPE Type; + ULONG Size; +} PO_WAKE_SOURCE_HEADER, *PPO_WAKE_SOURCE_HEADER; + +typedef struct _PO_WAKE_SOURCE_DEVICE +{ + PO_WAKE_SOURCE_HEADER Header; + WCHAR InstancePath[ANYSIZE_ARRAY]; +} PO_WAKE_SOURCE_DEVICE, *PPO_WAKE_SOURCE_DEVICE; + +typedef struct _PO_WAKE_SOURCE_FIXED +{ + PO_WAKE_SOURCE_HEADER Header; + PO_FIXED_WAKE_SOURCE_TYPE FixedWakeSourceType; +} PO_WAKE_SOURCE_FIXED, *PPO_WAKE_SOURCE_FIXED; + +typedef struct _PO_WAKE_SOURCE_INTERNAL +{ + PO_WAKE_SOURCE_HEADER Header; + PO_INTERNAL_WAKE_SOURCE_TYPE InternalWakeSourceType; +} PO_WAKE_SOURCE_INTERNAL, *PPO_WAKE_SOURCE_INTERNAL; + +typedef struct _PO_WAKE_SOURCE_TIMER +{ + PO_WAKE_SOURCE_HEADER Header; + DIAGNOSTIC_BUFFER Reason; +} PO_WAKE_SOURCE_TIMER, *PPO_WAKE_SOURCE_TIMER; + // The number of supported request types per version #define POWER_REQUEST_SUPPORTED_TYPES_V1 3 // Windows 7 #define POWER_REQUEST_SUPPORTED_TYPES_V2 9 // Windows 8 @@ -365,8 +508,8 @@ typedef enum _POWER_INFORMATION_LEVEL_INTERNAL PowerInternalUserAbsencePrediction, // POWER_USER_ABSENCE_PREDICTION PowerInternalUserAbsencePredictionCapability, // POWER_USER_ABSENCE_PREDICTION_CAPABILITY PowerInternalPoProcessorLatencyHint, // POWER_PROCESSOR_LATENCY_HINT - PowerInternalStandbyNetworkRequest, // POWER_STANDBY_NETWORK_REQUEST - PowerInternalDirtyTransitionInformation, + PowerInternalStandbyNetworkRequest, // POWER_STANDBY_NETWORK_REQUEST (requires PopNetBIServiceSid) + PowerInternalDirtyTransitionInformation, // out: BOOLEAN PowerInternalSetBackgroundTaskState, // POWER_SET_BACKGROUND_TASK_STATE PowerInternalTtmOpenTerminal, PowerInternalTtmCreateTerminal, // 10 @@ -377,8 +520,8 @@ typedef enum _POWER_INFORMATION_LEVEL_INTERNAL PowerInternalTtmAssignDevice, PowerInternalTtmSetDisplayState, PowerInternalTtmSetDisplayTimeouts, - PowerInternalBootSessionStandbyActivationInformation, - PowerInternalSessionPowerState, + PowerInternalBootSessionStandbyActivationInformation, // out: POWER_BOOT_SESSION_STANDBY_ACTIVATION_INFO + PowerInternalSessionPowerState, // in: POWER_SESSION_POWER_STATE PowerInternalSessionTerminalInput, // 20 PowerInternalSetWatchdog, PowerInternalPhysicalPowerButtonPressInfoAtBoot, @@ -389,14 +532,14 @@ typedef enum _POWER_INFORMATION_LEVEL_INTERNAL PowerInternalTransitionCheckpoint, PowerInternalInputControllerState, PowerInternalFirmwareResetReason, - PowerInternalPpmSchedulerQosSupport, // 30 + PowerInternalPpmSchedulerQosSupport, // out: POWER_INTERNAL_PROCESSOR_QOS_SUPPORT // 30 PowerInternalBootStatGet, PowerInternalBootStatSet, PowerInternalCallHasNotReturnedWatchdog, PowerInternalBootStatCheckIntegrity, PowerInternalBootStatRestoreDefaults, // in: void - PowerInternalHostEsStateUpdate, - PowerInternalGetPowerActionState, + PowerInternalHostEsStateUpdate, // in: POWER_INTERNAL_HOST_ENERGY_SAVER_STATE + PowerInternalGetPowerActionState, // out: ULONG PowerInternalBootStatUnlock, PowerInternalWakeOnVoiceState, PowerInternalDeepSleepBlock, // 40 @@ -445,9 +588,17 @@ typedef enum _POWER_INFORMATION_LEVEL_INTERNAL PowerInternalOverrideSystemInitiatedRebootState, PowerInternalFanImpactStats, PowerInternalFanRpmBuckets, - PowerInternalPowerBootAppDiagInfo, + PowerInternalPowerBootAppDiagInfo, // out: POWER_INTERNAL_BOOTAPP_DIAGNOSTIC PowerInternalUnregisterShutdownNotification, // since 22H1 PowerInternalManageTransitionStateRecord, + PowerInternalGetAcpiTimeAndAlarmCapabilities, // since 22H2 + PowerInternalSuspendResumeRequest, + PowerInternalEnergyEstimationInfo, // since 23H2 + PowerInternalProvSocIdentifierOperation, // since 24H2 + PowerInternalGetVmPerfPrioritySupport, + PowerInternalGetVmPerfPriorityConfig, + PowerInternalNotifyWin32kPowerRequestQueued, + PowerInternalNotifyWin32kPowerRequestCompleted, PowerInformationInternalMaximum } POWER_INFORMATION_LEVEL_INTERNAL; @@ -500,36 +651,84 @@ typedef struct _POWER_USER_ABSENCE_PREDICTION_CAPABILITY BOOLEAN AbsencePredictionCapability; } POWER_USER_ABSENCE_PREDICTION_CAPABILITY, *PPOWER_USER_ABSENCE_PREDICTION_CAPABILITY; +// rev typedef struct _POWER_PROCESSOR_LATENCY_HINT { POWER_INFORMATION_INTERNAL_HEADER PowerInformationInternalHeader; ULONG Type; -} POWER_PROCESSOR_LATENCY_HINT, *PPO_PROCESSOR_LATENCY_HINT; +} POWER_PROCESSOR_LATENCY_HINT, *PPOWER_PROCESSOR_LATENCY_HINT; +// rev typedef struct _POWER_STANDBY_NETWORK_REQUEST { POWER_INFORMATION_INTERNAL_HEADER PowerInformationInternalHeader; BOOLEAN Active; } POWER_STANDBY_NETWORK_REQUEST, *PPOWER_STANDBY_NETWORK_REQUEST; +// rev typedef struct _POWER_SET_BACKGROUND_TASK_STATE { POWER_INFORMATION_INTERNAL_HEADER PowerInformationInternalHeader; BOOLEAN Engaged; } POWER_SET_BACKGROUND_TASK_STATE, *PPOWER_SET_BACKGROUND_TASK_STATE; -typedef struct POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_INPUT +// rev +typedef struct _POWER_BOOT_SESSION_STANDBY_ACTIVATION_INFO +{ + ULONG StandbyTotalTime; + ULONG DripsTotalTime; + ULONG ActivatorClientTotalActiveTime; + ULONG PerActivatorClientTotalActiveTime[98]; +} POWER_BOOT_SESSION_STANDBY_ACTIVATION_INFO, *PPOWER_BOOT_SESSION_STANDBY_ACTIVATION_INFO; + +// rev +typedef struct _POWER_SESSION_POWER_STATE +{ + POWER_INFORMATION_INTERNAL_HEADER Header; + ULONG SessionId; + BOOLEAN On; + BOOLEAN IsConsole; + POWER_MONITOR_REQUEST_REASON RequestReason; +} POWER_SESSION_POWER_STATE, *PPOWER_SESSION_POWER_STATE; + +// rev +typedef struct _POWER_INTERNAL_PROCESSOR_QOS_SUPPORT +{ + BOOLEAN QosSupportedAndConfigured; + BOOLEAN SchedulerDirectedPerfStatesSupported; + BOOLEAN QosGroupPolicyDisable; +} POWER_INTERNAL_PROCESSOR_QOS_SUPPORT, *PPOWER_INTERNAL_PROCESSOR_QOS_SUPPORT; + +// rev +typedef struct _POWER_INTERNAL_HOST_ENERGY_SAVER_STATE +{ + POWER_INFORMATION_INTERNAL_HEADER Header; + BOOLEAN EsEnabledOnHost; +} POWER_INTERNAL_HOST_ENERGY_SAVER_STATE, *PPOWER_INTERNAL_HOST_ENERGY_SAVER_STATE; + +// rev +typedef struct _POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_INPUT { POWER_INFORMATION_LEVEL_INTERNAL InternalType; PROCESSOR_NUMBER ProcessorNumber; // ULONG_MAX } POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_INPUT, *PPOWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_INPUT; -typedef struct POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_OUTPUT +// rev +typedef struct _POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_OUTPUT { ULONG Version; ULONG NominalFrequency; // if (Domain) Prcb->PowerState.CheckContext.Domain.NominalFrequency else Prcb->MHz } POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_OUTPUT, *PPOWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_OUTPUT; +// rev +typedef struct _POWER_INTERNAL_BOOTAPP_DIAGNOSTIC +{ + ULONG BootAppErrorDiagCode; // bcdedit last status + ULONG BootAppFailureStatus; // bcdedit last status +} POWER_INTERNAL_BOOTAPP_DIAGNOSTIC, *PPOWER_INTERNAL_BOOTAPP_DIAGNOSTIC; + +#if (PHNT_MODE != PHNT_MODE_KERNEL) + NTSYSCALLAPI NTSTATUS NTAPI @@ -541,6 +740,8 @@ NtPowerInformation( _In_ ULONG OutputBufferLength ); +#endif + NTSYSCALLAPI NTSTATUS NTAPI diff --git a/ntpsapi.h b/ntpsapi.h index 3ee9162..eeb2226 100644 --- a/ntpsapi.h +++ b/ntpsapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Process support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTPSAPI_H @@ -127,7 +122,7 @@ typedef enum _PROCESSINFOCLASS ProcessLdtInformation, // qs: PROCESS_LDT_INFORMATION // 10 ProcessLdtSize, // s: PROCESS_LDT_SIZE ProcessDefaultHardErrorMode, // qs: ULONG - ProcessIoPortHandlers, // (kernel-mode only) // PROCESS_IO_PORT_HANDLER_INFORMATION + ProcessIoPortHandlers, // (kernel-mode only) // s: PROCESS_IO_PORT_HANDLER_INFORMATION ProcessPooledUsageAndLimits, // q: POOLED_USAGE_AND_LIMITS ProcessWorkingSetWatch, // q: PROCESS_WS_WATCH_INFORMATION[]; s: void ProcessUserModeIOPL, // qs: ULONG (requires SeTcbPrivilege) @@ -146,9 +141,9 @@ typedef enum _PROCESSINFOCLASS ProcessBreakOnTermination, // qs: ULONG ProcessDebugObjectHandle, // q: HANDLE // 30 ProcessDebugFlags, // qs: ULONG - ProcessHandleTracing, // q: PROCESS_HANDLE_TRACING_QUERY; s: size 0 disables, otherwise enables + ProcessHandleTracing, // q: PROCESS_HANDLE_TRACING_QUERY; s: PROCESS_HANDLE_TRACING_ENABLE[_EX] or void to disable ProcessIoPriority, // qs: IO_PRIORITY_HINT - ProcessExecuteFlags, // qs: ULONG + ProcessExecuteFlags, // qs: ULONG (MEM_EXECUTE_OPTION_*) ProcessTlsInformation, // PROCESS_TLS_INFORMATION // ProcessResourceManagement ProcessCookie, // q: ULONG ProcessImageInformation, // q: SECTION_IMAGE_INFORMATION @@ -156,35 +151,35 @@ typedef enum _PROCESSINFOCLASS ProcessPagePriority, // qs: PAGE_PRIORITY_INFORMATION ProcessInstrumentationCallback, // s: PVOID or PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION // 40 ProcessThreadStackAllocation, // s: PROCESS_STACK_ALLOCATION_INFORMATION, PROCESS_STACK_ALLOCATION_INFORMATION_EX - ProcessWorkingSetWatchEx, // q: PROCESS_WS_WATCH_INFORMATION_EX[] + ProcessWorkingSetWatchEx, // q: PROCESS_WS_WATCH_INFORMATION_EX[]; s: void ProcessImageFileNameWin32, // q: UNICODE_STRING ProcessImageFileMapping, // q: HANDLE (input) ProcessAffinityUpdateMode, // qs: PROCESS_AFFINITY_UPDATE_MODE ProcessMemoryAllocationMode, // qs: PROCESS_MEMORY_ALLOCATION_MODE ProcessGroupInformation, // q: USHORT[] ProcessTokenVirtualizationEnabled, // s: ULONG - ProcessConsoleHostProcess, // q: ULONG_PTR // ProcessOwnerInformation + ProcessConsoleHostProcess, // qs: ULONG_PTR // ProcessOwnerInformation ProcessWindowInformation, // q: PROCESS_WINDOW_INFORMATION // 50 ProcessHandleInformation, // q: PROCESS_HANDLE_SNAPSHOT_INFORMATION // since WIN8 ProcessMitigationPolicy, // s: PROCESS_MITIGATION_POLICY_INFORMATION - ProcessDynamicFunctionTableInformation, + ProcessDynamicFunctionTableInformation, // s: PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION ProcessHandleCheckingMode, // qs: ULONG; s: 0 disables, otherwise enables ProcessKeepAliveCount, // q: PROCESS_KEEPALIVE_COUNT_INFORMATION ProcessRevokeFileHandles, // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION - ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL + ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL (requires SeDebugPrivilege) ProcessHandleTable, // q: ULONG[] // since WINBLUE ProcessCheckStackExtentsMode, // qs: ULONG // KPROCESS->CheckStackExtents (CFG) ProcessCommandLineInformation, // q: UNICODE_STRING // 60 ProcessProtectionInformation, // q: PS_PROTECTION - ProcessMemoryExhaustion, // PROCESS_MEMORY_EXHAUSTION_INFO // since THRESHOLD - ProcessFaultInformation, // PROCESS_FAULT_INFORMATION + ProcessMemoryExhaustion, // s: PROCESS_MEMORY_EXHAUSTION_INFO // since THRESHOLD + ProcessFaultInformation, // s: PROCESS_FAULT_INFORMATION ProcessTelemetryIdInformation, // q: PROCESS_TELEMETRY_ID_INFORMATION - ProcessCommitReleaseInformation, // PROCESS_COMMIT_RELEASE_INFORMATION - ProcessDefaultCpuSetsInformation, // SYSTEM_CPU_SET_INFORMATION[5] - ProcessAllowedCpuSetsInformation, // SYSTEM_CPU_SET_INFORMATION[5] + ProcessCommitReleaseInformation, // qs: PROCESS_COMMIT_RELEASE_INFORMATION + ProcessDefaultCpuSetsInformation, // qs: SYSTEM_CPU_SET_INFORMATION[5] + ProcessAllowedCpuSetsInformation, // qs: SYSTEM_CPU_SET_INFORMATION[5] ProcessSubsystemProcess, ProcessJobMemoryInformation, // q: PROCESS_JOB_MEMORY_INFO - ProcessInPrivate, // s: void // ETW // since THRESHOLD2 // 70 + ProcessInPrivate, // q: BOOLEAN; s: void // ETW // since THRESHOLD2 // 70 ProcessRaiseUMExceptionOnInvalidHandleClose, // qs: ULONG; s: 0 disables, otherwise enables ProcessIumChallengeResponse, ProcessChildProcessInformation, // q: PROCESS_CHILD_PROCESS_INFORMATION @@ -194,38 +189,42 @@ typedef enum _PROCESSINFOCLASS ProcessPowerThrottlingState, // qs: POWER_THROTTLING_PROCESS_STATE ProcessReserved3Information, // ProcessActivityThrottlePolicy // PROCESS_ACTIVITY_THROTTLE_POLICY ProcessWin32kSyscallFilterInformation, // q: WIN32K_SYSCALL_FILTER - ProcessDisableSystemAllowedCpuSets, // 80 - ProcessWakeInformation, // PROCESS_WAKE_INFORMATION - ProcessEnergyTrackingState, // PROCESS_ENERGY_TRACKING_STATE + ProcessDisableSystemAllowedCpuSets, // s: BOOLEAN // 80 + ProcessWakeInformation, // q: PROCESS_WAKE_INFORMATION + ProcessEnergyTrackingState, // qs: PROCESS_ENERGY_TRACKING_STATE ProcessManageWritesToExecutableMemory, // MANAGE_WRITES_TO_EXECUTABLE_MEMORY // since REDSTONE3 ProcessCaptureTrustletLiveDump, - ProcessTelemetryCoverage, + ProcessTelemetryCoverage, // q: TELEMETRY_COVERAGE_HEADER; s: TELEMETRY_COVERAGE_POINT ProcessEnclaveInformation, - ProcessEnableReadWriteVmLogging, // PROCESS_READWRITEVM_LOGGING_INFORMATION + ProcessEnableReadWriteVmLogging, // qs: PROCESS_READWRITEVM_LOGGING_INFORMATION ProcessUptimeInformation, // q: PROCESS_UPTIME_INFORMATION ProcessImageSection, // q: HANDLE ProcessDebugAuthInformation, // since REDSTONE4 // 90 - ProcessSystemResourceManagement, // PROCESS_SYSTEM_RESOURCE_MANAGEMENT + ProcessSystemResourceManagement, // s: PROCESS_SYSTEM_RESOURCE_MANAGEMENT ProcessSequenceNumber, // q: ULONGLONG ProcessLoaderDetour, // since REDSTONE5 - ProcessSecurityDomainInformation, // PROCESS_SECURITY_DOMAIN_INFORMATION - ProcessCombineSecurityDomainsInformation, // PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION - ProcessEnableLogging, // PROCESS_LOGGING_INFORMATION - ProcessLeapSecondInformation, // PROCESS_LEAP_SECOND_INFORMATION - ProcessFiberShadowStackAllocation, // PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION // since 19H1 - ProcessFreeFiberShadowStackAllocation, // PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION - ProcessAltSystemCallInformation, // qs: BOOLEAN (kernel-mode only) // INT2E // since 20H1 // 100 - ProcessDynamicEHContinuationTargets, // PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION - ProcessDynamicEnforcedCetCompatibleRanges, // PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE_INFORMATION // since 20H2 + ProcessSecurityDomainInformation, // q: PROCESS_SECURITY_DOMAIN_INFORMATION + ProcessCombineSecurityDomainsInformation, // s: PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION + ProcessEnableLogging, // qs: PROCESS_LOGGING_INFORMATION + ProcessLeapSecondInformation, // qs: PROCESS_LEAP_SECOND_INFORMATION + ProcessFiberShadowStackAllocation, // s: PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION // since 19H1 + ProcessFreeFiberShadowStackAllocation, // s: PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION + ProcessAltSystemCallInformation, // s: PROCESS_SYSCALL_PROVIDER_INFORMATION // since 20H1 // 100 + ProcessDynamicEHContinuationTargets, // s: PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION + ProcessDynamicEnforcedCetCompatibleRanges, // s: PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE_INFORMATION // since 20H2 ProcessCreateStateChange, // since WIN11 ProcessApplyStateChange, - ProcessEnableOptionalXStateFeatures, - ProcessAltPrefetchParam, // since 22H1 + ProcessEnableOptionalXStateFeatures, // s: ULONG64 // optional XState feature bitmask + ProcessAltPrefetchParam, // qs: OVERRIDE_PREFETCH_PARAMETER // App Launch Prefetch (ALPF) // since 22H1 ProcessAssignCpuPartitions, ProcessPriorityClassEx, // s: PROCESS_PRIORITY_CLASS_EX - ProcessMembershipInformation, + ProcessMembershipInformation, // q: PROCESS_MEMBERSHIP_INFORMATION ProcessEffectiveIoPriority, // q: IO_PRIORITY_HINT ProcessEffectivePagePriority, // q: ULONG + ProcessSchedulerSharedData, // since 24H2 + ProcessSlistRollbackInformation, + ProcessNetworkIoCounters, // q: PROCESS_NETWORK_COUNTERS + ProcessFindFirstThreadByTebValue, MaxProcessInfoClass } PROCESSINFOCLASS; #endif @@ -248,7 +247,7 @@ typedef enum _THREADINFOCLASS ThreadAmILastThread, // q: ULONG ThreadIdealProcessor, // s: ULONG ThreadPriorityBoost, // qs: ULONG - ThreadSetTlsArrayAddress, // s: ULONG_PTR + ThreadSetTlsArrayAddress, // s: ULONG_PTR // Obsolete ThreadIsIoPending, // q: ULONG ThreadHideFromDebugger, // q: BOOLEAN; s: void ThreadBreakOnTermination, // qs: ULONG @@ -260,11 +259,11 @@ typedef enum _THREADINFOCLASS ThreadPagePriority, // qs: PAGE_PRIORITY_INFORMATION ThreadActualBasePriority, // s: LONG (requires SeIncreaseBasePriorityPrivilege) ThreadTebInformation, // q: THREAD_TEB_INFORMATION (requires THREAD_GET_CONTEXT + THREAD_SET_CONTEXT) - ThreadCSwitchMon, + ThreadCSwitchMon, // Obsolete ThreadCSwitchPmu, - ThreadWow64Context, // qs: WOW64_CONTEXT + ThreadWow64Context, // qs: WOW64_CONTEXT, ARM_NT_CONTEXT since 20H1 ThreadGroupInformation, // qs: GROUP_AFFINITY // 30 - ThreadUmsInformation, // q: THREAD_UMS_INFORMATION + ThreadUmsInformation, // q: THREAD_UMS_INFORMATION // Obsolete ThreadCounterProfiling, // q: BOOLEAN; s: THREAD_PROFILING_INFORMATION? ThreadIdealProcessorEx, // qs: PROCESSOR_NUMBER; s: previous PROCESSOR_NUMBER on return ThreadCpuAccountingInformation, // q: BOOLEAN; s: HANDLE (NtOpenSession) // NtCurrentThread // since WIN8 @@ -282,13 +281,17 @@ typedef enum _THREADINFOCLASS ThreadDbgkWerReportActive, // s: ULONG; s: 0 disables, otherwise enables ThreadAttachContainer, // s: HANDLE (job object) // NtCurrentThread ThreadManageWritesToExecutableMemory, // MANAGE_WRITES_TO_EXECUTABLE_MEMORY // since REDSTONE3 - ThreadPowerThrottlingState, // POWER_THROTTLING_THREAD_STATE + ThreadPowerThrottlingState, // POWER_THROTTLING_THREAD_STATE // since REDSTONE3 (set), WIN11 22H2 (query) ThreadWorkloadClass, // THREAD_WORKLOAD_CLASS // since REDSTONE5 // 50 ThreadCreateStateChange, // since WIN11 ThreadApplyStateChange, ThreadStrongerBadHandleChecks, // since 22H1 ThreadEffectiveIoPriority, // q: IO_PRIORITY_HINT ThreadEffectivePagePriority, // q: ULONG + ThreadUpdateLockOwnership, // since 24H2 + ThreadSchedulerSharedDataSlot, + ThreadTebInformationAtomic, // THREAD_TEB_INFORMATION + ThreadIndexInformation, // THREAD_INDEX_INFORMATION MaxThreadInfoClass } THREADINFOCLASS; #endif @@ -369,7 +372,6 @@ typedef struct _VM_COUNTERS_EX SIZE_T PrivateUsage; } VM_COUNTERS_EX, *PVM_COUNTERS_EX; -// private typedef struct _VM_COUNTERS_EX2 { VM_COUNTERS_EX CountersEx; @@ -483,12 +485,12 @@ typedef struct _PROCESS_DEVICEMAP_INFORMATION { struct { - HANDLE DirectoryHandle; + HANDLE DirectoryHandle; // needs DIRECTORY_TRAVERSE access } Set; struct { - ULONG DriveMap; - UCHAR DriveType[32]; + ULONG DriveMap; // bit mask + UCHAR DriveType[32]; // DRIVE_* WinBase.h } Query; }; } PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION; @@ -501,12 +503,12 @@ typedef struct _PROCESS_DEVICEMAP_INFORMATION_EX { struct { - HANDLE DirectoryHandle; + HANDLE DirectoryHandle; // needs DIRECTORY_TRAVERSE access } Set; struct { - ULONG DriveMap; - UCHAR DriveType[32]; + ULONG DriveMap; // bit mask + UCHAR DriveType[32]; // DRIVE_* WinBase.h } Query; }; ULONG Flags; // PROCESS_LUID_DOSDEVICES_ONLY @@ -551,14 +553,13 @@ typedef struct _PROCESS_HANDLE_TRACING_ENTRY typedef struct _PROCESS_HANDLE_TRACING_QUERY { - HANDLE Handle; - ULONG TotalTraces; - PROCESS_HANDLE_TRACING_ENTRY HandleTrace[1]; + _In_opt_ HANDLE Handle; + _Out_ ULONG TotalTraces; + _Out_ _Field_size_(TotalTraces) PROCESS_HANDLE_TRACING_ENTRY HandleTrace[1]; } PROCESS_HANDLE_TRACING_QUERY, *PPROCESS_HANDLE_TRACING_QUERY; #endif -// private typedef struct _THREAD_TLS_INFORMATION { ULONG Flags; @@ -567,7 +568,6 @@ typedef struct _THREAD_TLS_INFORMATION HANDLE ThreadId; } THREAD_TLS_INFORMATION, *PTHREAD_TLS_INFORMATION; -// private typedef enum _PROCESS_TLS_INFORMATION_TYPE { ProcessTlsReplaceIndex, @@ -575,7 +575,6 @@ typedef enum _PROCESS_TLS_INFORMATION_TYPE MaxProcessTlsOperation } PROCESS_TLS_INFORMATION_TYPE, *PPROCESS_TLS_INFORMATION_TYPE; -// private typedef struct _PROCESS_TLS_INFORMATION { ULONG Flags; @@ -583,10 +582,9 @@ typedef struct _PROCESS_TLS_INFORMATION ULONG ThreadDataCount; ULONG TlsIndex; ULONG PreviousCount; - THREAD_TLS_INFORMATION ThreadData[1]; + _Field_size_(ThreadDataCount) THREAD_TLS_INFORMATION ThreadData[1]; } PROCESS_TLS_INFORMATION, *PPROCESS_TLS_INFORMATION; -// private typedef struct _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION { ULONG Version; @@ -594,7 +592,6 @@ typedef struct _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION PVOID Callback; } PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION, *PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION; -// private typedef struct _PROCESS_STACK_ALLOCATION_INFORMATION { SIZE_T ReserveSize; @@ -602,7 +599,6 @@ typedef struct _PROCESS_STACK_ALLOCATION_INFORMATION PVOID StackBase; } PROCESS_STACK_ALLOCATION_INFORMATION, *PPROCESS_STACK_ALLOCATION_INFORMATION; -// private typedef struct _PROCESS_STACK_ALLOCATION_INFORMATION_EX { ULONG PreferredNode; @@ -612,7 +608,6 @@ typedef struct _PROCESS_STACK_ALLOCATION_INFORMATION_EX PROCESS_STACK_ALLOCATION_INFORMATION AllocInfo; } PROCESS_STACK_ALLOCATION_INFORMATION_EX, *PPROCESS_STACK_ALLOCATION_INFORMATION_EX; -// private typedef union _PROCESS_AFFINITY_UPDATE_MODE { ULONG Flags; @@ -624,7 +619,6 @@ typedef union _PROCESS_AFFINITY_UPDATE_MODE }; } PROCESS_AFFINITY_UPDATE_MODE, *PPROCESS_AFFINITY_UPDATE_MODE; -// private typedef union _PROCESS_MEMORY_ALLOCATION_MODE { ULONG Flags; @@ -635,29 +629,25 @@ typedef union _PROCESS_MEMORY_ALLOCATION_MODE }; } PROCESS_MEMORY_ALLOCATION_MODE, *PPROCESS_MEMORY_ALLOCATION_MODE; -// private typedef struct _PROCESS_HANDLE_INFORMATION { ULONG HandleCount; ULONG HandleCountHighWatermark; } PROCESS_HANDLE_INFORMATION, *PPROCESS_HANDLE_INFORMATION; -// private typedef struct _PROCESS_CYCLE_TIME_INFORMATION { ULONGLONG AccumulatedCycles; ULONGLONG CurrentCycleCount; } PROCESS_CYCLE_TIME_INFORMATION, *PPROCESS_CYCLE_TIME_INFORMATION; -// private typedef struct _PROCESS_WINDOW_INFORMATION { ULONG WindowFlags; USHORT WindowTitleLength; - WCHAR WindowTitle[1]; + _Field_size_bytes_(WindowTitleLength) WCHAR WindowTitle[1]; } PROCESS_WINDOW_INFORMATION, *PPROCESS_WINDOW_INFORMATION; -// private typedef struct _PROCESS_HANDLE_TABLE_ENTRY_INFO { HANDLE HandleValue; @@ -669,12 +659,11 @@ typedef struct _PROCESS_HANDLE_TABLE_ENTRY_INFO ULONG Reserved; } PROCESS_HANDLE_TABLE_ENTRY_INFO, *PPROCESS_HANDLE_TABLE_ENTRY_INFO; -// private typedef struct _PROCESS_HANDLE_SNAPSHOT_INFORMATION { ULONG_PTR NumberOfHandles; ULONG_PTR Reserved; - PROCESS_HANDLE_TABLE_ENTRY_INFO Handles[1]; + _Field_size_(NumberOfHandles) PROCESS_HANDLE_TABLE_ENTRY_INFO Handles[1]; } PROCESS_HANDLE_SNAPSHOT_INFORMATION, *PPROCESS_HANDLE_SNAPSHOT_INFORMATION; #if (PHNT_MODE != PHNT_MODE_KERNEL) @@ -690,10 +679,34 @@ typedef struct _PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY ULONG ReservedFlags : 30; }; }; -} PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY, * PPROCESS_MITIGATION_REDIRECTION_TRUST_POLICY; +} PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY, *PPROCESS_MITIGATION_REDIRECTION_TRUST_POLICY; +#endif + +#if !defined(NTDDI_WIN10_NI) || (NTDDI_VERSION < NTDDI_WIN10_NI) +#define ProcessUserPointerAuthPolicy 17 +#define ProcessSEHOPPolicy 18 + +typedef struct _PROCESS_MITIGATION_USER_POINTER_AUTH_POLICY { + union { + ULONG Flags; + struct { + ULONG EnablePointerAuthUserIp : 1; + ULONG ReservedFlags : 31; + }; + }; +} PROCESS_MITIGATION_USER_POINTER_AUTH_POLICY, *PPROCESS_MITIGATION_USER_POINTER_AUTH_POLICY; + +typedef struct _PROCESS_MITIGATION_SEHOP_POLICY { + union { + ULONG Flags; + struct { + ULONG EnableSehop : 1; + ULONG ReservedFlags : 31; + }; + }; +} PROCESS_MITIGATION_SEHOP_POLICY, *PPROCESS_MITIGATION_SEHOP_POLICY; #endif -// private typedef struct _PROCESS_MITIGATION_POLICY_INFORMATION { PROCESS_MITIGATION_POLICY Policy; @@ -714,9 +727,18 @@ typedef struct _PROCESS_MITIGATION_POLICY_INFORMATION PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY SideChannelIsolationPolicy; PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY UserShadowStackPolicy; PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY RedirectionTrustPolicy; + PROCESS_MITIGATION_USER_POINTER_AUTH_POLICY UserPointerAuthPolicy; + PROCESS_MITIGATION_SEHOP_POLICY SEHOPPolicy; }; } PROCESS_MITIGATION_POLICY_INFORMATION, *PPROCESS_MITIGATION_POLICY_INFORMATION; +// private +typedef struct _PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION +{ + struct _DYNAMIC_FUNCTION_TABLE* DynamicFunctionTable; + BOOLEAN Remove; +} PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION, *PPROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION; + typedef struct _PROCESS_KEEPALIVE_COUNT_INFORMATION { ULONG WakeCount; @@ -730,6 +752,8 @@ typedef struct _PROCESS_REVOKE_FILE_HANDLES_INFORMATION // begin_private +#define PROCESS_WORKING_SET_CONTROL_VERSION 3 + typedef enum _PROCESS_WORKING_SET_OPERATION { ProcessWorkingSetSwap, @@ -873,18 +897,19 @@ typedef struct _POWER_THROTTLING_PROCESS_STATE #define WIN32K_SYSCALL_FILTER_STATE_ENABLE 0x1 #define WIN32K_SYSCALL_FILTER_STATE_AUDIT 0x2 -// private typedef struct _WIN32K_SYSCALL_FILTER { ULONG FilterState; ULONG FilterSet; } WIN32K_SYSCALL_FILTER, *PWIN32K_SYSCALL_FILTER; +typedef struct _JOBOBJECT_WAKE_FILTER *PJOBOBJECT_WAKE_FILTER; // from ntpsapi.h + typedef struct _PROCESS_WAKE_INFORMATION { ULONGLONG NotificationChannel; ULONG WakeCounters[7]; - struct _JOBOBJECT_WAKE_FILTER* WakeFilter; + PJOBOBJECT_WAKE_FILTER WakeFilter; } PROCESS_WAKE_INFORMATION, *PPROCESS_WAKE_INFORMATION; typedef struct _PROCESS_ENERGY_TRACKING_STATE @@ -940,7 +965,7 @@ typedef struct _PROCESS_UPTIME_INFORMATION ULONGLONG TimeSinceCreation; ULONGLONG Uptime; ULONGLONG SuspendedTime; - union + struct { ULONG HangCount : 4; ULONG GhostCount : 4; @@ -959,19 +984,16 @@ typedef union _PROCESS_SYSTEM_RESOURCE_MANAGEMENT }; } PROCESS_SYSTEM_RESOURCE_MANAGEMENT, *PPROCESS_SYSTEM_RESOURCE_MANAGEMENT; -// private typedef struct _PROCESS_SECURITY_DOMAIN_INFORMATION { ULONGLONG SecurityDomain; } PROCESS_SECURITY_DOMAIN_INFORMATION, *PPROCESS_SECURITY_DOMAIN_INFORMATION; -// private typedef struct _PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION { HANDLE ProcessHandle; } PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION, *PPROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION; -// private typedef union _PROCESS_LOGGING_INFORMATION { ULONG Flags; @@ -981,18 +1003,18 @@ typedef union _PROCESS_LOGGING_INFORMATION ULONG EnableWriteVmLogging : 1; ULONG EnableProcessSuspendResumeLogging : 1; ULONG EnableThreadSuspendResumeLogging : 1; - ULONG Reserved : 28; + ULONG EnableLocalExecProtectVmLogging : 1; + ULONG EnableRemoteExecProtectVmLogging : 1; + ULONG Reserved : 26; }; } PROCESS_LOGGING_INFORMATION, *PPROCESS_LOGGING_INFORMATION; -// private typedef struct _PROCESS_LEAP_SECOND_INFORMATION { ULONG Flags; ULONG Reserved; } PROCESS_LEAP_SECOND_INFORMATION, *PPROCESS_LEAP_SECOND_INFORMATION; -// private typedef struct _PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION { ULONGLONG ReserveSize; @@ -1002,13 +1024,17 @@ typedef struct _PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION PVOID Ssp; } PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION, *PPROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION; -// private typedef struct _PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION { PVOID Ssp; } PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION, *PPROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION; -//// private +typedef struct _PROCESS_SYSCALL_PROVIDER_INFORMATION +{ + GUID ProviderId; + UCHAR Level; +} PROCESS_SYSCALL_PROVIDER_INFORMATION, *PPROCESS_SYSCALL_PROVIDER_INFORMATION; + //typedef struct _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE //{ // ULONG_PTR BaseAddress; @@ -1016,7 +1042,6 @@ typedef struct _PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION // ULONG Flags; //} PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE, *PPROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE; // -//// private //typedef struct _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION //{ // USHORT NumberOfRanges; @@ -1025,8 +1050,28 @@ typedef struct _PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION // PPROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE Ranges; //} PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION, *PPROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION; +typedef struct _PROCESS_MEMBERSHIP_INFORMATION +{ + ULONG ServerSiloId; +} PROCESS_MEMBERSHIP_INFORMATION, *PPROCESS_MEMBERSHIP_INFORMATION; + +#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE) +typedef struct _PROCESS_NETWORK_COUNTERS +{ + ULONG_PTR BytesIn; + ULONG_PTR BytesOut; +} PROCESS_NETWORK_COUNTERS, *PPROCESS_NETWORK_COUNTERS; +#endif + // end_private +NTSYSCALLAPI +NTSTATUS +NTAPI +NtQueryPortInformationProcess( + VOID + ); + #endif // Thread information structures @@ -1041,7 +1086,6 @@ typedef struct _THREAD_BASIC_INFORMATION KPRIORITY BasePriority; } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION; -// private typedef struct _THREAD_LAST_SYSCALL_INFORMATION { PVOID FirstArgument; @@ -1054,14 +1098,12 @@ typedef struct _THREAD_LAST_SYSCALL_INFORMATION ULONG64 WaitTime; } THREAD_LAST_SYSCALL_INFORMATION, *PTHREAD_LAST_SYSCALL_INFORMATION; -// private typedef struct _THREAD_CYCLE_TIME_INFORMATION { ULONGLONG AccumulatedCycles; ULONGLONG CurrentCycleCount; } THREAD_CYCLE_TIME_INFORMATION, *PTHREAD_CYCLE_TIME_INFORMATION; -// private typedef struct _THREAD_TEB_INFORMATION { PVOID TebInformation; // buffer to place data in @@ -1093,7 +1135,6 @@ typedef struct _THREAD_PERFORMANCE_DATA COUNTER_READING HwCounters[MAX_HW_COUNTERS]; } THREAD_PERFORMANCE_DATA, *PTHREAD_PERFORMANCE_DATA; -// private typedef struct _THREAD_PROFILING_INFORMATION { ULONG64 HardwareCounters; @@ -1102,7 +1143,6 @@ typedef struct _THREAD_PROFILING_INFORMATION PTHREAD_PERFORMANCE_DATA PerformanceData; } THREAD_PROFILING_INFORMATION, *PTHREAD_PROFILING_INFORMATION; -// private typedef struct _RTL_UMS_CONTEXT { SINGLE_LIST_ENTRY Link; @@ -1127,7 +1167,6 @@ typedef struct _RTL_UMS_CONTEXT ULONG YieldCount; } RTL_UMS_CONTEXT, *PRTL_UMS_CONTEXT; -// private typedef enum _THREAD_UMS_INFORMATION_COMMAND { UmsInformationCommandInvalid, @@ -1136,7 +1175,6 @@ typedef enum _THREAD_UMS_INFORMATION_COMMAND UmsInformationCommandQuery } THREAD_UMS_INFORMATION_COMMAND; -// private typedef struct _RTL_UMS_COMPLETION_LIST { PSINGLE_LIST_ENTRY ThreadListHead; @@ -1145,7 +1183,6 @@ typedef struct _RTL_UMS_COMPLETION_LIST SINGLE_LIST_ENTRY InternalListHead; } RTL_UMS_COMPLETION_LIST, *PRTL_UMS_COMPLETION_LIST; -// private typedef struct _THREAD_UMS_INFORMATION { THREAD_UMS_INFORMATION_COMMAND Command; @@ -1163,20 +1200,17 @@ typedef struct _THREAD_UMS_INFORMATION }; } THREAD_UMS_INFORMATION, *PTHREAD_UMS_INFORMATION; -// private typedef struct _THREAD_NAME_INFORMATION { UNICODE_STRING ThreadName; } THREAD_NAME_INFORMATION, *PTHREAD_NAME_INFORMATION; -// private typedef struct _ALPC_WORK_ON_BEHALF_TICKET { ULONG ThreadId; ULONG ThreadCreationTimeLow; } ALPC_WORK_ON_BEHALF_TICKET, *PALPC_WORK_ON_BEHALF_TICKET; -// private typedef struct _RTL_WORK_ON_BEHALF_TICKET_EX { ALPC_WORK_ON_BEHALF_TICKET Ticket; @@ -1193,7 +1227,7 @@ typedef struct _RTL_WORK_ON_BEHALF_TICKET_EX } RTL_WORK_ON_BEHALF_TICKET_EX, *PRTL_WORK_ON_BEHALF_TICKET_EX; #if (PHNT_MODE != PHNT_MODE_KERNEL) -// private + typedef enum _SUBSYSTEM_INFORMATION_TYPE { SubsystemInformationTypeWin32, @@ -1202,7 +1236,6 @@ typedef enum _SUBSYSTEM_INFORMATION_TYPE } SUBSYSTEM_INFORMATION_TYPE; #endif -// private typedef enum _THREAD_WORKLOAD_CLASS { ThreadWorkloadClassDefault, @@ -1210,6 +1243,96 @@ typedef enum _THREAD_WORKLOAD_CLASS MaxThreadWorkloadClass } THREAD_WORKLOAD_CLASS; +#if defined(_ARM64_) + +#define CONTEXT_ARM 0x00200000L + +#define CONTEXT_ARM_CONTROL (CONTEXT_ARM | 0x1L) +#define CONTEXT_ARM_INTEGER (CONTEXT_ARM | 0x2L) +#define CONTEXT_ARM_FLOATING_POINT (CONTEXT_ARM | 0x4L) +#define CONTEXT_ARM_DEBUG_REGISTERS (CONTEXT_ARM | 0x8L) + +#define CONTEXT_ARM_FULL (CONTEXT_ARM_CONTROL | CONTEXT_ARM_INTEGER | CONTEXT_ARM_FLOATING_POINT) + +#define CONTEXT_ARM_ALL (CONTEXT_ARM_CONTROL | CONTEXT_ARM_INTEGER | CONTEXT_ARM_FLOATING_POINT | CONTEXT_ARM_DEBUG_REGISTERS) + +#define ARM_MAX_BREAKPOINTS 8 +#define ARM_MAX_WATCHPOINTS 1 + +typedef struct _ARM_NT_NEON128 { + ULONGLONG Low; + LONGLONG High; +} ARM_NT_NEON128, *PARM_NT_NEON128; + +typedef struct DECLSPEC_ALIGN(8) DECLSPEC_NOINITALL _ARM_NT_CONTEXT { + + // + // Control flags. + // + + DWORD ContextFlags; + + // + // Integer registers + // + + DWORD R0; + DWORD R1; + DWORD R2; + DWORD R3; + DWORD R4; + DWORD R5; + DWORD R6; + DWORD R7; + DWORD R8; + DWORD R9; + DWORD R10; + DWORD R11; + DWORD R12; + + // + // Control Registers + // + + DWORD Sp; + DWORD Lr; + DWORD Pc; + DWORD Cpsr; + + // + // Floating Point/NEON Registers + // + + DWORD Fpscr; + DWORD Padding; + union { + ARM_NT_NEON128 Q[16]; + ULONGLONG D[32]; + DWORD S[32]; + } DUMMYUNIONNAME; + + // + // Debug registers + // + + DWORD Bvr[ARM_MAX_BREAKPOINTS]; + DWORD Bcr[ARM_MAX_BREAKPOINTS]; + DWORD Wvr[ARM_MAX_WATCHPOINTS]; + DWORD Wcr[ARM_MAX_WATCHPOINTS]; + + DWORD Padding2[2]; + +} ARM_NT_CONTEXT, *PARM_NT_CONTEXT; + +#endif + +// private +typedef struct _THREAD_INDEX_INFORMATION +{ + ULONG Index; + ULONG Sequence; +} THREAD_INDEX_INFORMATION, *PTHREAD_INDEX_INFORMATION; + // Processes #if (PHNT_MODE != PHNT_MODE_KERNEL) @@ -1311,6 +1434,10 @@ NtResumeProcess( #define NtCurrentSilo() ((HANDLE)(LONG_PTR)-1) +// Not NT, but useful. +EXTERN_C IMAGE_DOS_HEADER __ImageBase; +#define NtCurrentImageBase() ((PVOID)&__ImageBase) + // Not NT, but useful. #define NtCurrentProcessId() (NtCurrentTeb()->ClientId.UniqueProcess) #define NtCurrentThreadId() (NtCurrentTeb()->ClientId.UniqueThread) @@ -1618,30 +1745,28 @@ NtQueueApcThread( #if (PHNT_VERSION >= PHNT_WIN7) -#define APC_FORCE_THREAD_SIGNAL ((HANDLE)1) // ReserveHandle +#define QUEUE_USER_APC_SPECIAL_USER_APC ((HANDLE)0x1) NTSYSCALLAPI NTSTATUS NTAPI NtQueueApcThreadEx( _In_ HANDLE ThreadHandle, - _In_opt_ HANDLE ReserveHandle, // NtAllocateReserveObject + _In_opt_ HANDLE ReserveHandle, // NtAllocateReserveObject // SPECIAL_USER_APC _In_ PPS_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcArgument1, _In_opt_ PVOID ApcArgument2, _In_opt_ PVOID ApcArgument3 ); + #endif #if (PHNT_VERSION >= PHNT_WIN11) -#if !defined(NTDDI_WIN10_CO) || (NTDDI_VERSION < NTDDI_WIN10_CO) -typedef enum _QUEUE_USER_APC_FLAGS -{ - QUEUE_USER_APC_FLAGS_NONE = 0x0, - QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC = 0x1, -} QUEUE_USER_APC_FLAGS; -#endif +// QUEUE_USER_APC_FLAGS enum (dmex) +#define QUEUE_USER_APC_FLAGS_NONE 0x0 +#define QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC 0x1 +#define QUEUE_USER_APC_CALLBACK_DATA_CONTEXT 0x00010000 // APC_CALLBACK_DATA NTSYSCALLAPI NTSTATUS @@ -1716,6 +1841,7 @@ NtWaitForAlertByThreadId( #define ProcThreadAttributeEnableOptionalXStateFeatures 27 // in ULONG64 // since WIN11 #define ProcThreadAttributeCreateStore 28 // ULONG // rev (diversenok) #define ProcThreadAttributeTrustedApp 29 +#define ProcThreadAttributeSveVectorLength 30 #ifndef PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS #define PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS \ @@ -1749,6 +1875,10 @@ NtWaitForAlertByThreadId( #define PROC_THREAD_ATTRIBUTE_CREATE_STORE \ ProcThreadAttributeValue(ProcThreadAttributeCreateStore, FALSE, TRUE, FALSE) #endif +#ifndef PROC_THREAD_ATTRIBUTE_TRUSTED_APP +#define PROC_THREAD_ATTRIBUTE_TRUSTED_APP \ + ProcThreadAttributeValue(ProcThreadAttributeTrustedApp, FALSE, TRUE, FALSE) +#endif // private typedef struct _PROC_THREAD_ATTRIBUTE @@ -1766,7 +1896,7 @@ typedef struct _PROC_THREAD_ATTRIBUTE_LIST ULONG LastAttribute; ULONG SpareUlong0; PPROC_THREAD_ATTRIBUTE ExtendedFlagsAttribute; - PROC_THREAD_ATTRIBUTE Attributes[1]; + _Field_size_(AttributeCount) PROC_THREAD_ATTRIBUTE Attributes[1]; } PROC_THREAD_ATTRIBUTE_LIST, *PPROC_THREAD_ATTRIBUTE_LIST; // private @@ -1774,15 +1904,18 @@ typedef struct _PROC_THREAD_ATTRIBUTE_LIST #define EXTENDED_PROCESS_CREATION_FLAG_FORCELUA 0x00000002 #define EXTENDED_PROCESS_CREATION_FLAG_FORCE_BREAKAWAY 0x00000004 // requires SeTcbPrivilege // since WINBLUE -// private -#define PROTECTION_LEVEL_WINTCB_LIGHT 0x00000000 -#define PROTECTION_LEVEL_WINDOWS 0x00000001 -#define PROTECTION_LEVEL_WINDOWS_LIGHT 0x00000002 -#define PROTECTION_LEVEL_ANTIMALWARE_LIGHT 0x00000003 -#define PROTECTION_LEVEL_LSA_LIGHT 0x00000004 -#define PROTECTION_LEVEL_WINTCB 0x00000005 -#define PROTECTION_LEVEL_CODEGEN_LIGHT 0x00000006 -#define PROTECTION_LEVEL_AUTHENTICODE 0x00000007 +#define PROTECTION_LEVEL_WINTCB_LIGHT 0x00000000 +#define PROTECTION_LEVEL_WINDOWS 0x00000001 +#define PROTECTION_LEVEL_WINDOWS_LIGHT 0x00000002 +#define PROTECTION_LEVEL_ANTIMALWARE_LIGHT 0x00000003 +#define PROTECTION_LEVEL_LSA_LIGHT 0x00000004 +#define PROTECTION_LEVEL_WINTCB 0x00000005 +#define PROTECTION_LEVEL_CODEGEN_LIGHT 0x00000006 +#define PROTECTION_LEVEL_AUTHENTICODE 0x00000007 +#define PROTECTION_LEVEL_PPL_APP 0x00000008 + +#define PROTECTION_LEVEL_SAME 0xFFFFFFFF +#define PROTECTION_LEVEL_NONE 0xFFFFFFFE // private typedef enum _SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS @@ -1795,7 +1928,8 @@ typedef enum _SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS SeSafeOpenExperienceUninstaller = 0x10, SeSafeOpenExperienceIgnoreUnknownOrBad = 0x20, SeSafeOpenExperienceDefenderTrustedInstaller = 0x40, - SeSafeOpenExperienceMOTWPresent = 0x80 + SeSafeOpenExperienceMOTWPresent = 0x80, + SeSafeOpenExperienceElevatedNoPropagation = 0x100 } SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS; // private @@ -1820,27 +1954,6 @@ typedef struct _ISOLATION_MANIFEST_PROPERTIES ULONG_PTR Level; } ISOLATION_MANIFEST_PROPERTIES, *PISOLATION_MANIFEST_PROPERTIES; -#ifndef PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS -#define PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS \ - ProcThreadAttributeValue(ProcThreadAttributeExtendedFlags, FALSE, TRUE, TRUE) -#endif -#ifndef PROC_THREAD_ATTRIBUTE_CONSOLE_REFERENCE -#define PROC_THREAD_ATTRIBUTE_CONSOLE_REFERENCE \ - ProcThreadAttributeValue(ProcThreadAttributeConsoleReference, FALSE, TRUE, FALSE) -#endif -#ifndef PROC_THREAD_ATTRIBUTE_OSMAXVERSIONTESTED -#define PROC_THREAD_ATTRIBUTE_OSMAXVERSIONTESTED \ - ProcThreadAttributeValue(ProcThreadAttributeOsMaxVersionTested, FALSE, TRUE, FALSE) -#endif -#ifndef PROC_THREAD_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM -#define PROC_THREAD_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM \ - ProcThreadAttributeValue(ProcThreadAttributeSafeOpenPromptOriginClaim, FALSE, TRUE, FALSE) -#endif -#ifndef PROC_THREAD_ATTRIBUTE_BNO_ISOLATION -#define PROC_THREAD_ATTRIBUTE_BNO_ISOLATION \ - ProcThreadAttributeValue(ProcThreadAttributeBnoIsolation, FALSE, TRUE, FALSE) -#endif - // Attributes (Native) // private @@ -1869,14 +1982,16 @@ typedef enum _PS_ATTRIBUTE_NUM PsAttributeChildProcessPolicy, // 20, in PULONG (PROCESS_CREATION_CHILD_PROCESS_*) // since THRESHOLD2 PsAttributeAllApplicationPackagesPolicy, // in PULONG (PROCESS_CREATION_ALL_APPLICATION_PACKAGES_*) // since REDSTONE PsAttributeWin32kFilter, // in PWIN32K_SYSCALL_FILTER - PsAttributeSafeOpenPromptOriginClaim, // in + PsAttributeSafeOpenPromptOriginClaim, // in SE_SAFE_OPEN_PROMPT_RESULTS PsAttributeBnoIsolation, // in PPS_BNO_ISOLATION_PARAMETERS // since REDSTONE2 PsAttributeDesktopAppPolicy, // in PULONG (PROCESS_CREATION_DESKTOP_APP_*) PsAttributeChpe, // in BOOLEAN // since REDSTONE3 PsAttributeMitigationAuditOptions, // in PPS_MITIGATION_AUDIT_OPTIONS_MAP (PROCESS_CREATION_MITIGATION_AUDIT_POLICY_*) // since 21H1 - PsAttributeMachineType, // in WORD // since 21H2 + PsAttributeMachineType, // in USHORT // since 21H2 PsAttributeComponentFilter, PsAttributeEnableOptionalXStateFeatures, // since WIN11 + PsAttributeSupportedMachines, // since 24H2 + PsAttributeSveVectorLength, PsAttributeMax } PS_ATTRIBUTE_NUM; @@ -2105,6 +2220,8 @@ typedef enum _PS_MITIGATION_OPTION PS_MITIGATION_OPTION_BLOCK_NON_CET_BINARIES, PS_MITIGATION_OPTION_CET_DYNAMIC_APIS_OUT_OF_PROC_ONLY, PS_MITIGATION_OPTION_REDIRECTION_TRUST, // since 22H1 + PS_MITIGATION_OPTION_RESTRICT_CORE_SHARING, + PS_MITIGATION_OPTION_FSCTL_SYSTEM_CALL_DISABLE, // since 24H2 } PS_MITIGATION_OPTION; // windows-internals-book:"Chapter 5" @@ -2217,16 +2334,21 @@ NtCreateUserProcess( #endif // begin_rev +#define THREAD_CREATE_FLAGS_NONE 0x00000000 #define THREAD_CREATE_FLAGS_CREATE_SUSPENDED 0x00000001 // NtCreateUserProcess & NtCreateThreadEx #define THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH 0x00000002 // NtCreateThreadEx only #define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER 0x00000004 // NtCreateThreadEx only #define THREAD_CREATE_FLAGS_LOADER_WORKER 0x00000010 // NtCreateThreadEx only #define THREAD_CREATE_FLAGS_SKIP_LOADER_INIT 0x00000020 // NtCreateThreadEx only #define THREAD_CREATE_FLAGS_BYPASS_PROCESS_FREEZE 0x00000040 // NtCreateThreadEx only -#define THREAD_CREATE_FLAGS_INITIAL_THREAD 0x00000080 // ? // end_rev #if (PHNT_VERSION >= PHNT_VISTA) + +typedef NTSTATUS (NTAPI *PUSER_THREAD_START_ROUTINE)( + _In_ PVOID ThreadParameter + ); + NTSYSCALLAPI NTSTATUS NTAPI @@ -2235,7 +2357,7 @@ NtCreateThreadEx( _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ProcessHandle, - _In_ PVOID StartRoutine, // PUSER_THREAD_START_ROUTINE + _In_ PUSER_THREAD_START_ROUTINE StartRoutine, _In_opt_ PVOID Argument, _In_ ULONG CreateFlags, // THREAD_CREATE_FLAGS_* _In_ SIZE_T ZeroBits, @@ -2243,6 +2365,7 @@ NtCreateThreadEx( _In_ SIZE_T MaximumStackSize, _In_opt_ PPS_ATTRIBUTE_LIST AttributeList ); + #endif #endif @@ -2253,15 +2376,15 @@ NtCreateThreadEx( // JOBOBJECTINFOCLASS // Note: We don't use an enum since it conflicts with the Windows SDK. -#define JobObjectBasicAccountingInformation 1 // JOBOBJECT_BASIC_ACCOUNTING_INFORMATION -#define JobObjectBasicLimitInformation 2 // JOBOBJECT_BASIC_LIMIT_INFORMATION -#define JobObjectBasicProcessIdList 3 // JOBOBJECT_BASIC_PROCESS_ID_LIST -#define JobObjectBasicUIRestrictions 4 // JOBOBJECT_BASIC_UI_RESTRICTIONS +#define JobObjectBasicAccountingInformation 1 // q: JOBOBJECT_BASIC_ACCOUNTING_INFORMATION +#define JobObjectBasicLimitInformation 2 // q; s: JOBOBJECT_BASIC_LIMIT_INFORMATION +#define JobObjectBasicProcessIdList 3 // q: JOBOBJECT_BASIC_PROCESS_ID_LIST +#define JobObjectBasicUIRestrictions 4 // q; s: JOBOBJECT_BASIC_UI_RESTRICTIONS #define JobObjectSecurityLimitInformation 5 // JOBOBJECT_SECURITY_LIMIT_INFORMATION -#define JobObjectEndOfJobTimeInformation 6 // JOBOBJECT_END_OF_JOB_TIME_INFORMATION -#define JobObjectAssociateCompletionPortInformation 7 // JOBOBJECT_ASSOCIATE_COMPLETION_PORT -#define JobObjectBasicAndIoAccountingInformation 8 // JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION -#define JobObjectExtendedLimitInformation 9 // JOBOBJECT_EXTENDED_LIMIT_INFORMATION +#define JobObjectEndOfJobTimeInformation 6 // q; s: JOBOBJECT_END_OF_JOB_TIME_INFORMATION +#define JobObjectAssociateCompletionPortInformation 7 // s: JOBOBJECT_ASSOCIATE_COMPLETION_PORT +#define JobObjectBasicAndIoAccountingInformation 8 // q: JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION +#define JobObjectExtendedLimitInformation 9 // q; s: JOBOBJECT_EXTENDED_LIMIT_INFORMATION[V2] #define JobObjectJobSetInformation 10 // JOBOBJECT_JOBSET_INFORMATION #define JobObjectGroupInformation 11 // USHORT #define JobObjectNotificationLimitInformation 12 // JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION @@ -2282,8 +2405,8 @@ NtCreateThreadEx( #define JobObjectClearPeakJobMemoryUsed 27 #define JobObjectMemoryUsageInformation 28 // JOBOBJECT_MEMORY_USAGE_INFORMATION // JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 #define JobObjectSharedCommit 29 -#define JobObjectContainerId 30 -#define JobObjectIoRateControlInformation 31 +#define JobObjectContainerId 30 // JOBOBJECT_CONTAINER_IDENTIFIER_V2 +#define JobObjectIoRateControlInformation 31 // JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE, JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2, JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3 #define JobObjectNetRateControlInformation 32 // JOBOBJECT_NET_RATE_CONTROL_INFORMATION #define JobObjectNotificationLimitInformation2 33 // JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2 #define JobObjectLimitViolationInformation2 34 // JOBOBJECT_LIMIT_VIOLATION_INFORMATION_2 @@ -2291,18 +2414,35 @@ NtCreateThreadEx( #define JobObjectSiloBasicInformation 36 // SILOOBJECT_BASIC_INFORMATION #define JobObjectSiloRootDirectory 37 // SILOOBJECT_ROOT_DIRECTORY #define JobObjectServerSiloBasicInformation 38 // SERVERSILO_BASIC_INFORMATION -#define JobObjectServerSiloUserSharedData 39 // SILO_USER_SHARED_DATA -#define JobObjectServerSiloInitialize 40 +#define JobObjectServerSiloUserSharedData 39 // SILO_USER_SHARED_DATA // NtQueryInformationJobObject(NULL, 39, Buffer, sizeof(SILO_USER_SHARED_DATA), 0); +#define JobObjectServerSiloInitialize 40 // SERVERSILO_INIT_INFORMATION #define JobObjectServerSiloRunningState 41 -#define JobObjectIoAttribution 42 +#define JobObjectIoAttribution 42 // JOBOBJECT_IO_ATTRIBUTION_INFORMATION #define JobObjectMemoryPartitionInformation 43 #define JobObjectContainerTelemetryId 44 #define JobObjectSiloSystemRoot 45 #define JobObjectEnergyTrackingState 46 // JOBOBJECT_ENERGY_TRACKING_STATE #define JobObjectThreadImpersonationInformation 47 -#define JobObjectIoPriorityLimit 48 -#define JobObjectPagePriorityLimit 49 -#define MaxJobObjectInfoClass 50 +#define JobObjectIoPriorityLimit 48 // JOBOBJECT_IO_PRIORITY_LIMIT +#define JobObjectPagePriorityLimit 49 // JOBOBJECT_PAGE_PRIORITY_LIMIT +#define JobObjectServerSiloDiagnosticInformation 50 // since 24H2 +#define JobObjectNetworkAccountingInformation 51 +#define MaxJobObjectInfoClass 52 + +// rev // extended limit v2 +#define JOB_OBJECT_LIMIT_SILO_READY 0x00400000 + +// private +typedef struct _JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 +{ + JOBOBJECT_BASIC_LIMIT_INFORMATION BasicLimitInformation; + IO_COUNTERS IoInfo; + SIZE_T ProcessMemoryLimit; + SIZE_T JobMemoryLimit; + SIZE_T PeakProcessMemoryUsed; + SIZE_T PeakJobMemoryUsed; + SIZE_T JobTotalMemoryLimit; +} JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2, *PJOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2; // private typedef struct _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION @@ -2363,6 +2503,14 @@ typedef struct _JOBOBJECT_FREEZE_INFORMATION JOBOBJECT_WAKE_FILTER WakeFilter; } JOBOBJECT_FREEZE_INFORMATION, *PJOBOBJECT_FREEZE_INFORMATION; +// private +typedef struct _JOBOBJECT_CONTAINER_IDENTIFIER_V2 +{ + GUID ContainerId; + GUID ContainerTelemetryId; + ULONG JobId; +} JOBOBJECT_CONTAINER_IDENTIFIER_V2, *PJOBOBJECT_CONTAINER_IDENTIFIER_V2; + // private typedef struct _JOBOBJECT_MEMORY_USAGE_INFORMATION { @@ -2381,24 +2529,45 @@ typedef struct _JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 // private typedef struct _SILO_USER_SHARED_DATA { - ULONG64 ServiceSessionId; + ULONG ServiceSessionId; ULONG ActiveConsoleId; LONGLONG ConsoleSessionForegroundProcessId; NT_PRODUCT_TYPE NtProductType; ULONG SuiteMask; - ULONG SharedUserSessionId; + ULONG SharedUserSessionId; // since RS2 BOOLEAN IsMultiSessionSku; + BOOLEAN IsStateSeparationEnabled; WCHAR NtSystemRoot[260]; USHORT UserModeGlobalLogger[16]; + ULONG TimeZoneId; // since 21H2 + LONG TimeZoneBiasStamp; + KSYSTEM_TIME TimeZoneBias; + LARGE_INTEGER TimeZoneBiasEffectiveStart; + LARGE_INTEGER TimeZoneBiasEffectiveEnd; } SILO_USER_SHARED_DATA, *PSILO_USER_SHARED_DATA; +// rev +#define SILO_OBJECT_ROOT_DIRECTORY_SHADOW_ROOT 0x00000001 +#define SILO_OBJECT_ROOT_DIRECTORY_INITIALIZE 0x00000002 +#define SILO_OBJECT_ROOT_DIRECTORY_SHADOW_DOS_DEVICES 0x00000004 + // private typedef struct _SILOOBJECT_ROOT_DIRECTORY { - ULONG ControlFlags; - UNICODE_STRING Path; + union + { + ULONG ControlFlags; // SILO_OBJECT_ROOT_DIRECTORY_* + UNICODE_STRING Path; + }; } SILOOBJECT_ROOT_DIRECTORY, *PSILOOBJECT_ROOT_DIRECTORY; +// private +typedef struct _SERVERSILO_INIT_INFORMATION +{ + HANDLE DeleteEvent; + BOOLEAN IsDownlevelContainer; +} SERVERSILO_INIT_INFORMATION, *PSERVERSILO_INIT_INFORMATION; + // private typedef struct _JOBOBJECT_ENERGY_TRACKING_STATE { @@ -2407,6 +2576,34 @@ typedef struct _JOBOBJECT_ENERGY_TRACKING_STATE ULONG DesiredState; } JOBOBJECT_ENERGY_TRACKING_STATE, *PJOBOBJECT_ENERGY_TRACKING_STATE; +// private +typedef enum _JOBOBJECT_IO_PRIORITY_LIMIT_FLAGS +{ + JOBOBJECT_IO_PRIORITY_LIMIT_ENABLE = 0x1, + JOBOBJECT_IO_PRIORITY_LIMIT_VALID_FLAGS = 0x1, +} JOBOBJECT_IO_PRIORITY_LIMIT_FLAGS; + +// private +typedef struct _JOBOBJECT_IO_PRIORITY_LIMIT +{ + JOBOBJECT_IO_PRIORITY_LIMIT_FLAGS Flags; + ULONG Priority; +} JOBOBJECT_IO_PRIORITY_LIMIT, *PJOBOBJECT_IO_PRIORITY_LIMIT; + +// private +typedef enum _JOBOBJECT_PAGE_PRIORITY_LIMIT_FLAGS +{ + JOBOBJECT_PAGE_PRIORITY_LIMIT_ENABLE = 0x1, + JOBOBJECT_PAGE_PRIORITY_LIMIT_VALID_FLAGS = 0x1, +} JOBOBJECT_PAGE_PRIORITY_LIMIT_FLAGS; + +// private +typedef struct _JOBOBJECT_PAGE_PRIORITY_LIMIT +{ + JOBOBJECT_PAGE_PRIORITY_LIMIT_FLAGS Flags; + ULONG Priority; +} JOBOBJECT_PAGE_PRIORITY_LIMIT, *PJOBOBJECT_PAGE_PRIORITY_LIMIT; + NTSYSCALLAPI NTSTATUS NTAPI @@ -2528,6 +2725,31 @@ PssNtCaptureSnapshot( ); #endif +// rev +#define MEMORY_BULK_INFORMATION_FLAG_BASIC 0x00000001 + +// rev +typedef struct _NTPSS_MEMORY_BULK_INFORMATION +{ + ULONG QueryFlags; + ULONG NumberOfEntries; + PVOID NextValidAddress; +} NTPSS_MEMORY_BULK_INFORMATION, *PNTPSS_MEMORY_BULK_INFORMATION; + +#if (PHNT_VERSION >= PHNT_20H1) +// rev +NTSYSCALLAPI +NTSTATUS +NTAPI +NtPssCaptureVaSpaceBulk( + _In_ HANDLE ProcessHandle, + _In_opt_ PVOID BaseAddress, + _In_ PNTPSS_MEMORY_BULK_INFORMATION BulkInformation, + _In_ SIZE_T BulkInformationLength, + _Out_opt_ PSIZE_T ReturnLength + ); +#endif + #endif #endif diff --git a/ntregapi.h b/ntregapi.h index 2a16fe2..2f46532 100644 --- a/ntregapi.h +++ b/ntregapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Registry support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTREGAPI_H @@ -42,7 +37,7 @@ typedef struct _KEY_BASIC_INFORMATION LARGE_INTEGER LastWriteTime; ULONG TitleIndex; ULONG NameLength; - WCHAR Name[1]; + _Field_size_bytes_(NameLength) WCHAR Name[1]; } KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION; typedef struct _KEY_NODE_INFORMATION @@ -52,7 +47,7 @@ typedef struct _KEY_NODE_INFORMATION ULONG ClassOffset; ULONG ClassLength; ULONG NameLength; - WCHAR Name[1]; + _Field_size_bytes_(NameLength) WCHAR Name[1]; // ... // WCHAR Class[1]; } KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION; @@ -64,18 +59,18 @@ typedef struct _KEY_FULL_INFORMATION ULONG ClassOffset; ULONG ClassLength; ULONG SubKeys; - ULONG MaxNameLen; - ULONG MaxClassLen; + ULONG MaxNameLength; + ULONG MaxClassLength; ULONG Values; - ULONG MaxValueNameLen; - ULONG MaxValueDataLen; + ULONG MaxValueNameLength; + ULONG MaxValueDataLength; WCHAR Class[1]; } KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION; typedef struct _KEY_NAME_INFORMATION { ULONG NameLength; - WCHAR Name[1]; + _Field_size_bytes_(NameLength) WCHAR Name[1]; } KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION; typedef struct _KEY_CACHED_INFORMATION @@ -83,12 +78,12 @@ typedef struct _KEY_CACHED_INFORMATION LARGE_INTEGER LastWriteTime; ULONG TitleIndex; ULONG SubKeys; - ULONG MaxNameLen; + ULONG MaxNameLength; ULONG Values; - ULONG MaxValueNameLen; - ULONG MaxValueDataLen; + ULONG MaxValueNameLength; + ULONG MaxValueDataLength; ULONG NameLength; - WCHAR Name[1]; + _Field_size_bytes_(NameLength) WCHAR Name[1]; } KEY_CACHED_INFORMATION, *PKEY_CACHED_INFORMATION; // rev @@ -200,7 +195,7 @@ typedef struct _KEY_VALUE_BASIC_INFORMATION ULONG TitleIndex; ULONG Type; ULONG NameLength; - WCHAR Name[1]; + _Field_size_bytes_(NameLength) WCHAR Name[1]; } KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION; typedef struct _KEY_VALUE_FULL_INFORMATION @@ -210,7 +205,7 @@ typedef struct _KEY_VALUE_FULL_INFORMATION ULONG DataOffset; ULONG DataLength; ULONG NameLength; - WCHAR Name[1]; + _Field_size_bytes_(NameLength) WCHAR Name[1]; // ... // UCHAR Data[1]; } KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION; @@ -220,14 +215,14 @@ typedef struct _KEY_VALUE_PARTIAL_INFORMATION ULONG TitleIndex; ULONG Type; ULONG DataLength; - UCHAR Data[1]; + _Field_size_bytes_(DataLength) UCHAR Data[1]; } KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION; typedef struct _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 { ULONG Type; ULONG DataLength; - UCHAR Data[1]; + _Field_size_bytes_(DataLength) UCHAR Data[1]; } KEY_VALUE_PARTIAL_INFORMATION_ALIGN64, *PKEY_VALUE_PARTIAL_INFORMATION_ALIGN64; // private @@ -237,24 +232,37 @@ typedef struct _KEY_VALUE_LAYER_INFORMATION ULONG Reserved : 31; } KEY_VALUE_LAYER_INFORMATION, *PKEY_VALUE_LAYER_INFORMATION; -// rev -typedef enum _KEY_LOAD_ENTRY_TYPE +// private +typedef enum _CM_EXTENDED_PARAMETER_TYPE { - KeyLoadTrustClassKey = 1, - KeyLoadEvent, - KeyLoadToken -} KEY_LOAD_ENTRY_TYPE; + CmExtendedParameterInvalidType, + CmExtendedParameterTrustClassKey, + CmExtendedParameterEvent, + CmExtendedParameterFileAccessToken, + CmExtendedParameterMax, +} CM_EXTENDED_PARAMETER_TYPE; -// rev -typedef struct _KEY_LOAD_ENTRY +#define CM_EXTENDED_PARAMETER_TYPE_BITS 8 + +// private +typedef struct DECLSPEC_ALIGN(8) _CM_EXTENDED_PARAMETER { - KEY_LOAD_ENTRY_TYPE EntryType; + struct + { + ULONG64 Type : CM_EXTENDED_PARAMETER_TYPE_BITS; + ULONG64 Reserved : 64 - CM_EXTENDED_PARAMETER_TYPE_BITS; + }; + union { + ULONG64 ULong64; + PVOID Pointer; + SIZE_T Size; HANDLE Handle; - ULONG_PTR Value; + ULONG ULong; + ACCESS_MASK AccessMask; }; -} KEY_LOAD_ENTRY, *PKEY_LOAD_ENTRY; +} CM_EXTENDED_PARAMETER, *PCM_EXTENDED_PARAMETER; typedef struct _KEY_VALUE_ENTRY { @@ -276,7 +284,7 @@ typedef struct _REG_NOTIFY_INFORMATION ULONG NextEntryOffset; REG_ACTION Action; ULONG KeyLength; - WCHAR Key[1]; + _Field_size_bytes_(KeyLength) WCHAR Key[1]; } REG_NOTIFY_INFORMATION, *PREG_NOTIFY_INFORMATION; typedef struct _KEY_PID_ARRAY @@ -291,6 +299,142 @@ typedef struct _KEY_OPEN_SUBKEYS_INFORMATION KEY_PID_ARRAY KeyArray[1]; } KEY_OPEN_SUBKEYS_INFORMATION, *PKEY_OPEN_SUBKEYS_INFORMATION; +// Differencing registry & virtualization // since REDSTONE + +// rev +#define VR_DEVICE_NAME L"\\Device\\VRegDriver" + +// rev +#define IOCTL_VR_INITIALIZE_JOB_FOR_VREG CTL_CODE(FILE_DEVICE_UNKNOWN, 1, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_INITIALIZE_JOB_FOR_VREG +#define IOCTL_VR_LOAD_DIFFERENCING_HIVE CTL_CODE(FILE_DEVICE_UNKNOWN, 2, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_LOAD_DIFFERENCING_HIVE +#define IOCTL_VR_CREATE_NAMESPACE_NODE CTL_CODE(FILE_DEVICE_UNKNOWN, 3, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_CREATE_NAMESPACE_NODE +#define IOCTL_VR_MODIFY_FLAGS CTL_CODE(FILE_DEVICE_UNKNOWN, 4, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_MODIFY_FLAGS +#define IOCTL_VR_CREATE_MULTIPLE_NAMESPACE_NODES CTL_CODE(FILE_DEVICE_UNKNOWN, 5, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_CREATE_MULTIPLE_NAMESPACE_NODES +#define IOCTL_VR_UNLOAD_DYNAMICALLY_LOADED_HIVES CTL_CODE(FILE_DEVICE_UNKNOWN, 6, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_UNLOAD_DYNAMICALLY_LOADED_HIVES +#define IOCTL_VR_GET_VIRTUAL_ROOT_KEY CTL_CODE(FILE_DEVICE_UNKNOWN, 7, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_GET_VIRTUAL_ROOT; out: VR_GET_VIRTUAL_ROOT_RESULT +#define IOCTL_VR_LOAD_DIFFERENCING_HIVE_FOR_HOST CTL_CODE(FILE_DEVICE_UNKNOWN, 8, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_LOAD_DIFFERENCING_HIVE_FOR_HOST +#define IOCTL_VR_UNLOAD_DIFFERENCING_HIVE_FOR_HOST CTL_CODE(FILE_DEVICE_UNKNOWN, 9, METHOD_BUFFERED, FILE_ANY_ACCESS) // in: VR_UNLOAD_DIFFERENCING_HIVE_FOR_HOST + +// private +typedef struct _VR_INITIALIZE_JOB_FOR_VREG +{ + HANDLE Job; +} VR_INITIALIZE_JOB_FOR_VREG, *PVR_INITIALIZE_JOB_FOR_VREG; + +// rev +#define VR_FLAG_INHERIT_TRUST_CLASS 0x00000001 +#define VR_FLAG_WRITE_THROUGH_HIVE 0x00000002 // since REDSTONE2 +#define VR_FLAG_LOCAL_MACHINE_TRUST_CLASS 0x00000004 // since 21H1 + +// rev + private +typedef struct _VR_LOAD_DIFFERENCING_HIVE +{ + HANDLE Job; + ULONG NextLayerIsHost; + ULONG Flags; // VR_FLAG_* + ULONG LoadFlags; // NtLoadKeyEx flags + WORD KeyPathLength; + WORD HivePathLength; + WORD NextLayerKeyPathLength; + HANDLE FileAccessToken; // since 20H1 + WCHAR Strings[ANYSIZE_ARRAY]; + // ... + // WCHAR KeyPath[1]; + // WCHAR HivePath[1]; + // WCHAR NextLayerKeyPath[1]; +} VR_LOAD_DIFFERENCING_HIVE, *PVR_LOAD_DIFFERENCING_HIVE; + +// rev + private +typedef struct _VR_CREATE_NAMESPACE_NODE +{ + HANDLE Job; + WORD ContainerPathLength; + WORD HostPathLength; + ULONG Flags; + ACCESS_MASK AccessMask; // since 20H1 + WCHAR Strings[ANYSIZE_ARRAY]; + // ... + // WCHAR ContainerPath[1]; + // WCHAR HostPath[1]; +} VR_CREATE_NAMESPACE_NODE, *PVR_CREATE_NAMESPACE_NODE; + +// private +typedef struct _VR_MODIFY_FLAGS +{ + HANDLE Job; + ULONG AddFlags; + ULONG RemoveFlags; +} VR_MODIFY_FLAGS, *PVR_MODIFY_FLAGS; + +// private +typedef struct _NAMESPACE_NODE_DATA +{ + ACCESS_MASK AccessMask; + WORD ContainerPathLength; + WORD HostPathLength; + ULONG Flags; + WCHAR Strings[ANYSIZE_ARRAY]; + // ... + // WCHAR ContainerPath[1]; + // WCHAR HostPath[1]; +} NAMESPACE_NODE_DATA, *PNAMESPACE_NODE_DATA; + +// private +typedef struct _VR_CREATE_MULTIPLE_NAMESPACE_NODES +{ + HANDLE Job; + ULONG NumNewKeys; + NAMESPACE_NODE_DATA Keys[1]; +} VR_CREATE_MULTIPLE_NAMESPACE_NODES, *PVR_CREATE_MULTIPLE_NAMESPACE_NODES; + +// private +typedef struct _VR_UNLOAD_DYNAMICALLY_LOADED_HIVES +{ + HANDLE Job; +} VR_UNLOAD_DYNAMICALLY_LOADED_HIVES, *PVR_UNLOAD_DYNAMICALLY_LOADED_HIVES; + +// rev +#define VR_KEY_COMROOT 0 // \Registry\ComRoot\Classes +#define VR_KEY_MACHINE_SOFTWARE 1 // \Registry\Machine\Software // since REDSTONE2 +#define VR_KEY_CONTROL_SET 2 // \Registry\Machine\System\ControlSet001 // since REDSTONE2 + +// rev +typedef struct _VR_GET_VIRTUAL_ROOT +{ + HANDLE Job; + ULONG Index; // VR_KEY_* // since REDSTONE2 +} VR_GET_VIRTUAL_ROOT, *PVR_GET_VIRTUAL_ROOT; + +// rev +typedef struct _VR_GET_VIRTUAL_ROOT_RESULT +{ + HANDLE Key; +} VR_GET_VIRTUAL_ROOT_RESULT, *PVR_GET_VIRTUAL_ROOT_RESULT; + +// rev +typedef struct _VR_LOAD_DIFFERENCING_HIVE_FOR_HOST +{ + ULONG LoadFlags; // NtLoadKeyEx flags + ULONG Flags; // VR_FLAG_* // since REDSTONE2 + WORD KeyPathLength; + WORD HivePathLength; + WORD NextLayerKeyPathLength; + HANDLE FileAccessToken; // since 20H1 + WCHAR Strings[ANYSIZE_ARRAY]; + // ... + // WCHAR KeyPath[1]; + // WCHAR HivePath[1]; + // WCHAR NextLayerKeyPath[1]; +} VR_LOAD_DIFFERENCING_HIVE_FOR_HOST, *PVR_LOAD_DIFFERENCING_HIVE_FOR_HOST; + +// rev +typedef struct _VR_UNLOAD_DIFFERENCING_HIVE_FOR_HOST +{ + ULONG Reserved; + WORD TargetKeyPathLength; + WCHAR TargetKeyPath[ANYSIZE_ARRAY]; +} VR_UNLOAD_DIFFERENCING_HIVE_FOR_HOST, *PVR_UNLOAD_DIFFERENCING_HIVE_FOR_HOST; + // System calls NTSYSCALLAPI @@ -397,7 +541,7 @@ NTAPI NtQueryKey( _In_ HANDLE KeyHandle, _In_ KEY_INFORMATION_CLASS KeyInformationClass, - _Out_writes_bytes_opt_(Length) PVOID KeyInformation, + _Out_writes_bytes_to_opt_(Length, *ResultLength) PVOID KeyInformation, _In_ ULONG Length, _Out_ PULONG ResultLength ); @@ -419,7 +563,7 @@ NtQueryValueKey( _In_ HANDLE KeyHandle, _In_ PUNICODE_STRING ValueName, _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, - _Out_writes_bytes_opt_(Length) PVOID KeyValueInformation, + _Out_writes_bytes_to_opt_(Length, *ResultLength) PVOID KeyValueInformation, _In_ ULONG Length, _Out_ PULONG ResultLength ); @@ -455,7 +599,7 @@ NtEnumerateKey( _In_ HANDLE KeyHandle, _In_ ULONG Index, _In_ KEY_INFORMATION_CLASS KeyInformationClass, - _Out_writes_bytes_opt_(Length) PVOID KeyInformation, + _Out_writes_bytes_to_opt_(Length, *ResultLength) PVOID KeyInformation, _In_ ULONG Length, _Out_ PULONG ResultLength ); @@ -467,7 +611,7 @@ NtEnumerateValueKey( _In_ HANDLE KeyHandle, _In_ ULONG Index, _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, - _Out_writes_bytes_opt_(Length) PVOID KeyValueInformation, + _Out_writes_bytes_to_opt_(Length, *ResultLength) PVOID KeyValueInformation, _In_ ULONG Length, _Out_ PULONG ResultLength ); @@ -491,7 +635,7 @@ NTSYSCALLAPI NTSTATUS NTAPI NtCompressKey( - _In_ HANDLE Key + _In_ HANDLE KeyHandle ); NTSYSCALLAPI @@ -534,8 +678,8 @@ NtLoadKey3( _In_ POBJECT_ATTRIBUTES TargetKey, _In_ POBJECT_ATTRIBUTES SourceFile, _In_ ULONG Flags, - _In_reads_(LoadEntryCount) PKEY_LOAD_ENTRY LoadEntries, - _In_ ULONG LoadEntryCount, + _In_reads_(ExtendedParameterCount) PCM_EXTENDED_PARAMETER ExtendedParameters, + _In_ ULONG ExtendedParameterCount, _In_opt_ ACCESS_MASK DesiredAccess, _Out_opt_ PHANDLE RootHandle, _Reserved_ PVOID Reserved diff --git a/ntrtl.h b/ntrtl.h index c020f5c..b3874d8 100644 --- a/ntrtl.h +++ b/ntrtl.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * RTL support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTRTL_H @@ -15,6 +10,16 @@ #define RtlOffsetToPointer(Base, Offset) ((PCHAR)(((PCHAR)(Base)) + ((ULONG_PTR)(Offset)))) #define RtlPointerToOffset(Base, Pointer) ((ULONG)(((PCHAR)(Pointer)) - ((PCHAR)(Base)))) +#define RTL_PTR_ADD(Pointer, Value) ((PVOID)((ULONG_PTR)(Pointer) + (ULONG_PTR)(Value))) +#define RTL_PTR_SUBTRACT(Pointer, Value) ((PVOID)((ULONG_PTR)(Pointer) - (ULONG_PTR)(Value))) + +#define RTL_MILLISEC_TO_100NANOSEC(m) ((m) * 10000ui64) +#define RTL_SEC_TO_100NANOSEC(s) ((s) * 10000000ui64) +#define RTL_SEC_TO_MILLISEC(s) ((s) * 1000ui64) + +#define RTL_MEG (1024UL * 1024UL) +#define RTL_IMAGE_MAX_DOS_HEADER (256UL * RTL_MEG) + // Linked lists FORCEINLINE VOID InitializeListHead( @@ -571,7 +576,7 @@ typedef struct _RTL_RB_TREE // rev NTSYSAPI -VOID +BOOLEAN NTAPI RtlRbInsertNodeEx( _In_ PRTL_RB_TREE Tree, @@ -582,7 +587,7 @@ RtlRbInsertNodeEx( // rev NTSYSAPI -VOID +BOOLEAN NTAPI RtlRbRemoveNode( _In_ PRTL_RB_TREE Tree, @@ -729,7 +734,7 @@ RtlCreateHashTable( ); NTSYSAPI -VOID +LOGICAL NTAPI RtlDeleteHashTable( _In_ PRTL_DYNAMIC_HASH_TABLE HashTable @@ -887,6 +892,15 @@ RtlInitializeCriticalSectionAndSpinCount( _In_ ULONG SpinCount ); +NTSYSAPI +NTSTATUS +NTAPI +RtlInitializeCriticalSectionEx( + _Out_ PRTL_CRITICAL_SECTION CriticalSection, + _In_ ULONG SpinCount, + _In_ ULONG Flags + ); + NTSYSAPI NTSTATUS NTAPI @@ -894,6 +908,7 @@ RtlDeleteCriticalSection( _Inout_ PRTL_CRITICAL_SECTION CriticalSection ); +_Acquires_exclusive_lock_(*CriticalSection) NTSYSAPI NTSTATUS NTAPI @@ -901,6 +916,7 @@ RtlEnterCriticalSection( _Inout_ PRTL_CRITICAL_SECTION CriticalSection ); +_Releases_exclusive_lock_(*CriticalSection) NTSYSAPI NTSTATUS NTAPI @@ -908,6 +924,7 @@ RtlLeaveCriticalSection( _Inout_ PRTL_CRITICAL_SECTION CriticalSection ); +_When_(return != 0, _Acquires_exclusive_lock_(*CriticalSection)) NTSYSAPI LOGICAL NTAPI @@ -1046,6 +1063,7 @@ RtlInitializeSRWLock( ); // winbase:AcquireSRWLockExclusive +_Acquires_exclusive_lock_(*SRWLock) NTSYSAPI VOID NTAPI @@ -1054,6 +1072,7 @@ RtlAcquireSRWLockExclusive( ); // winbase:AcquireSRWLockShared +_Acquires_shared_lock_(*SRWLock) NTSYSAPI VOID NTAPI @@ -1062,6 +1081,7 @@ RtlAcquireSRWLockShared( ); // winbase:ReleaseSRWLockExclusive +_Releases_exclusive_lock_(*SRWLock) NTSYSAPI VOID NTAPI @@ -1070,6 +1090,7 @@ RtlReleaseSRWLockExclusive( ); // winbase:ReleaseSRWLockShared +_Releases_shared_lock_(*SRWLock) NTSYSAPI VOID NTAPI @@ -1078,6 +1099,7 @@ RtlReleaseSRWLockShared( ); // winbase:TryAcquireSRWLockExclusive +_When_(return != 0, _Acquires_exclusive_lock_(*SRWLock)) NTSYSAPI BOOLEAN NTAPI @@ -1086,6 +1108,7 @@ RtlTryAcquireSRWLockExclusive( ); // winbase:TryAcquireSRWLockShared +_When_(return != 0, _Acquires_shared_lock_(*SRWLock)) NTSYSAPI BOOLEAN NTAPI @@ -1210,8 +1233,8 @@ NTSYSAPI NTSTATUS NTAPI RtlWaitOnAddress( - _In_ volatile VOID *Address, - _In_ PVOID CompareAddress, + _In_reads_bytes_(AddressSize) volatile VOID *Address, + _In_reads_bytes_(AddressSize) PVOID CompareAddress, _In_ SIZE_T AddressSize, _In_opt_ PLARGE_INTEGER Timeout ); @@ -1234,6 +1257,31 @@ RtlWakeAddressSingle( // end_rev +#if (PHNT_VERSION >= PHNT_WIN11_22H2) +FORCEINLINE +VOID +NTAPI +RtlCopyVolatileMemory( + _Out_writes_bytes_(Size) VOID *Destination, + _In_reads_bytes_(Size) volatile const VOID *Source, + _In_ SIZE_T Size + ) +{ + RtlCopyMemory(Destination, (const VOID *)Source, Size); + BarrierAfterRead(); +} +#endif + +FORCEINLINE +HANDLE +NTAPI +RtlReadHandleNoFence( + _In_reads_bytes_(sizeof(HANDLE)) volatile CONST HANDLE *Address + ) +{ + return (HANDLE)ReadPointerNoFence((PVOID *)Address); +} + // Strings FORCEINLINE @@ -1253,7 +1301,7 @@ RtlInitEmptyAnsiString( #ifndef PHNT_NO_INLINE_INIT_STRING FORCEINLINE VOID RtlInitString( _Out_ PSTRING DestinationString, - _In_opt_ PCSTR SourceString + _In_opt_z_ PCSTR SourceString ) { if (SourceString) @@ -1269,7 +1317,7 @@ VOID NTAPI RtlInitString( _Out_ PSTRING DestinationString, - _In_opt_ PCSTR SourceString + _In_opt_z_ PCSTR SourceString ); #endif @@ -1286,7 +1334,7 @@ RtlInitStringEx( #ifndef PHNT_NO_INLINE_INIT_STRING FORCEINLINE VOID RtlInitAnsiString( _Out_ PANSI_STRING DestinationString, - _In_opt_ PCSTR SourceString + _In_opt_z_ PCSTR SourceString ) { if (SourceString) @@ -1302,7 +1350,7 @@ VOID NTAPI RtlInitAnsiString( _Out_ PANSI_STRING DestinationString, - _In_opt_ PCSTR SourceString + _In_opt_z_ PCSTR SourceString ); #endif @@ -1344,7 +1392,7 @@ NTSYSAPI VOID NTAPI RtlFreeUTF8String( - _Inout_ _At_(utf8String->Buffer, _Frees_ptr_opt_) PUTF8_STRING Utf8String + _Inout_ _At_(Utf8String->Buffer, _Frees_ptr_opt_) PUTF8_STRING Utf8String ); #endif @@ -1412,8 +1460,8 @@ NTSYSAPI NTSTATUS NTAPI RtlAppendAsciizToString( - _In_ PSTRING Destination, - _In_opt_ PCSTR Source + _Inout_ PSTRING Destination, + _In_opt_z_ PCSTR Source ); NTSYSAPI @@ -1450,7 +1498,7 @@ RtlInitEmptyUnicodeString( #ifndef PHNT_NO_INLINE_INIT_STRING FORCEINLINE VOID RtlInitUnicodeString( _Out_ PUNICODE_STRING DestinationString, - _In_opt_ PCWSTR SourceString + _In_opt_z_ PCWSTR SourceString ) { if (SourceString) @@ -1470,6 +1518,32 @@ RtlInitUnicodeString( ); #endif +#ifndef PHNT_NO_INLINE_INIT_STRING +FORCEINLINE NTSTATUS RtlInitUnicodeStringEx( + _Out_ PUNICODE_STRING DestinationString, + _In_opt_z_ PCWSTR SourceString + ) +{ + size_t stringLength; + + DestinationString->Length = 0; + DestinationString->Buffer = (PWCH)SourceString; + + if (!SourceString) + return STATUS_SUCCESS; + + stringLength = wcslen(SourceString); + + if (stringLength <= UNICODE_STRING_MAX_CHARS - 1) + { + DestinationString->Length = (USHORT)stringLength * sizeof(WCHAR); + DestinationString->MaximumLength = DestinationString->Length + sizeof(UNICODE_NULL); + return STATUS_SUCCESS; + } + + return STATUS_NAME_TOO_LONG; +} +#else NTSYSAPI NTSTATUS NTAPI @@ -1477,6 +1551,7 @@ RtlInitUnicodeStringEx( _Out_ PUNICODE_STRING DestinationString, _In_opt_z_ PCWSTR SourceString ); +#endif _Success_(return != 0) _Must_inspect_result_ @@ -1493,27 +1568,15 @@ BOOLEAN NTAPI RtlCreateUnicodeStringFromAsciiz( _Out_ PUNICODE_STRING DestinationString, - _In_ PCSTR SourceString + _In_z_ PCSTR SourceString ); -#ifdef PHNT_INLINE_FREE_UNICODE_STRING -FORCEINLINE -VOID -NTAPI -RtlFreeUnicodeString( - _Inout_ _At_(UnicodeString->Buffer, _Frees_ptr_opt_) PUNICODE_STRING UnicodeString - ) -{ - HeapFree(NtCurrentPeb()->ProcessHeap, 0, UnicodeString->Buffer); -} -#else NTSYSAPI VOID NTAPI RtlFreeUnicodeString( _Inout_ _At_(UnicodeString->Buffer, _Frees_ptr_opt_) PUNICODE_STRING UnicodeString ); -#endif #define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE (0x00000001) #define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING (0x00000002) @@ -1657,7 +1720,7 @@ NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString( - _In_ PUNICODE_STRING Destination, + _Inout_ PUNICODE_STRING Destination, _In_ PCUNICODE_STRING Source ); @@ -1665,8 +1728,8 @@ NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeToString( - _In_ PUNICODE_STRING Destination, - _In_opt_ PCWSTR Source + _Inout_ PUNICODE_STRING Destination, + _In_opt_z_ PCWSTR Source ); NTSYSAPI @@ -1712,6 +1775,14 @@ RtlUnicodeStringToAnsiString( _In_ BOOLEAN AllocateDestinationString ); +// rev +NTSYSAPI +ULONG +NTAPI +RtlUnicodeStringToAnsiSize( + _In_ PUNICODE_STRING SourceString + ); + #if (PHNT_VERSION >= PHNT_20H1) NTSYSAPI NTSTATUS @@ -1905,7 +1976,7 @@ NTAPI RtlUTF8ToUnicodeN( _Out_writes_bytes_to_(UnicodeStringMaxByteCount, *UnicodeStringActualByteCount) PWSTR UnicodeStringDestination, _In_ ULONG UnicodeStringMaxByteCount, - _Out_ PULONG UnicodeStringActualByteCount, + _Out_opt_ PULONG UnicodeStringActualByteCount, _In_reads_bytes_(UTF8StringByteCount) PCCH UTF8StringSource, _In_ ULONG UTF8StringByteCount ); @@ -1918,7 +1989,7 @@ NTAPI RtlUnicodeToUTF8N( _Out_writes_bytes_to_(UTF8StringMaxByteCount, *UTF8StringActualByteCount) PCHAR UTF8StringDestination, _In_ ULONG UTF8StringMaxByteCount, - _Out_ PULONG UTF8StringActualByteCount, + _Out_opt_ PULONG UTF8StringActualByteCount, _In_reads_bytes_(UnicodeStringByteCount) PCWCH UnicodeStringSource, _In_ ULONG UnicodeStringByteCount ); @@ -2527,6 +2598,73 @@ RtlCleanUpTEBLangLists( #if (PHNT_VERSION >= PHNT_WIN7) +// rev from GetThreadPreferredUILanguages +NTSYSAPI +NTSTATUS +NTAPI +RtlGetThreadPreferredUILanguages( + _In_ ULONG Flags, // MUI_LANGUAGE_NAME + _Out_ PULONG NumberOfLanguages, + _Out_writes_opt_(*ReturnLength) PZZWSTR Languages, + _Inout_ PULONG ReturnLength + ); + +// rev from GetProcessPreferredUILanguages +NTSYSAPI +NTSTATUS +NTAPI +RtlGetProcessPreferredUILanguages( + _In_ ULONG Flags, // MUI_LANGUAGE_NAME + _Out_ PULONG NumberOfLanguages, + _Out_writes_opt_(*ReturnLength) PZZWSTR Languages, + _Inout_ PULONG ReturnLength + ); + +// rev from GetSystemPreferredUILanguages +NTSYSAPI +NTSTATUS +NTAPI +RtlGetSystemPreferredUILanguages( + _In_ ULONG Flags, // MUI_LANGUAGE_NAME + _In_ PCWSTR LocaleName, + _Out_ PULONG NumberOfLanguages, + _Out_writes_opt_(*ReturnLength) PZZWSTR Languages, + _Inout_ PULONG ReturnLength + ); + +// rev from GetSystemDefaultUILanguage +NTSYSAPI +NTSTATUS +NTAPI +RtlpGetSystemDefaultUILanguage( + _Out_ LANGID DefaultUILanguageId, + _Inout_ PLCID Lcid + ); + +// rev from GetUserPreferredUILanguages +NTSYSAPI +NTSTATUS +NTAPI +RtlGetUserPreferredUILanguages( + _In_ ULONG Flags, // MUI_LANGUAGE_NAME + _In_ PCWSTR LocaleName, + _Out_ PULONG NumberOfLanguages, + _Out_writes_opt_(*ReturnLength) PZZWSTR Languages, + _Inout_ PULONG ReturnLength + ); + +// rev from GetUILanguageInfo +NTSYSAPI +NTSTATUS +NTAPI +RtlGetUILanguageInfo( + _In_ ULONG Flags, + _In_ PCZZWSTR Languages, + _Out_writes_opt_(*NumberOfFallbackLanguages) PZZWSTR FallbackLanguages, + _Inout_opt_ PULONG NumberOfFallbackLanguages, + _Out_ PULONG Attributes + ); + // rev NTSYSAPI NTSTATUS @@ -2534,7 +2672,8 @@ NTAPI RtlGetLocaleFileMappingAddress( _Out_ PVOID *BaseAddress, _Out_ PLCID DefaultLocaleId, - _Out_ PLARGE_INTEGER DefaultCasingTableSize + _Out_ PLARGE_INTEGER DefaultCasingTableSize, + _Out_opt_ PULONG CurrentNLSVersion ); #endif @@ -2549,14 +2688,14 @@ RtlGetCurrentPeb( ); NTSYSAPI -VOID +NTSTATUS NTAPI RtlAcquirePebLock( VOID ); NTSYSAPI -VOID +NTSTATUS NTAPI RtlReleasePebLock( VOID @@ -2572,6 +2711,7 @@ RtlTryAcquirePebLock( ); #endif +#if (PHNT_VERSION < PHNT_VISTA) NTSYSAPI NTSTATUS NTAPI @@ -2587,12 +2727,10 @@ RtlFreeToPeb( _In_ PVOID Block, _In_ ULONG Size ); +#endif // Processes -#define DOS_MAX_COMPONENT_LENGTH 255 -#define DOS_MAX_PATH_LENGTH (DOS_MAX_COMPONENT_LENGTH + 5) - typedef struct _CURDIR { UNICODE_STRING DosPath; @@ -2660,6 +2798,8 @@ typedef struct _RTL_USER_PROCESS_PARAMETERS UNICODE_STRING HeapPartitionName; // 19H1 ULONG_PTR DefaultThreadpoolCpuSetMasks; ULONG DefaultThreadpoolCpuSetMaskCount; + ULONG DefaultThreadpoolThreadMaximum; + ULONG HeapMemoryTypeMask; // WIN11 } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS; #define RTL_USER_PROC_PARAMS_NORMALIZED 0x00000001 @@ -2898,6 +3038,14 @@ RtlSetThreadIsCritical( _In_ BOOLEAN CheckFlag ); +// rev +NTSYSAPI +PVOID +NTAPI +RtlSetThreadSubProcessTag( + _In_ PVOID SubProcessTag + ); + // rev NTSYSAPI BOOLEAN @@ -2943,7 +3091,7 @@ NTSYSAPI NTSTATUS NTAPI RtlCreateUserThread( - _In_ HANDLE Process, + _In_ HANDLE ProcessHandle, _In_opt_ PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, _In_ BOOLEAN CreateSuspended, _In_opt_ ULONG ZeroBits, @@ -2951,7 +3099,7 @@ RtlCreateUserThread( _In_opt_ SIZE_T CommittedStackSize, _In_ PUSER_THREAD_START_ROUTINE StartAddress, _In_opt_ PVOID Parameter, - _Out_opt_ PHANDLE Thread, + _Out_opt_ PHANDLE ThreadHandle, _Out_opt_ PCLIENT_ID ClientId ); @@ -3027,9 +3175,38 @@ typedef struct _CONTEXT_EX CONTEXT_CHUNK All; CONTEXT_CHUNK Legacy; CONTEXT_CHUNK XState; + CONTEXT_CHUNK KernelCet; } CONTEXT_EX, *PCONTEXT_EX; -#define CONTEXT_EX_LENGTH ALIGN_UP_BY(sizeof(CONTEXT_EX), PAGE_SIZE) +#if defined(_AMD64_) || defined(_ARM64_) || defined(_ARM64EC_) +#define CONTEXT_ALIGN 0x10 +#else +#define CONTEXT_ALIGN 0x8 +#endif + +#if defined(_AMD64_) +#define CONTEXT_FRAME_LENGTH 0x4D0 +#define CONTEXT_EX_PADDING 0x10 +#elif defined(_ARM64_) || defined(_ARM64EC_) +#define CONTEXT_FRAME_LENGTH 0x390 +#define CONTEXT_EX_PADDING 0x10 +#elif defined(_M_ARM) +#define CONTEXT_FRAME_LENGTH 0x1a0 +#define CONTEXT_EX_PADDING 0x8 +#else +#define CONTEXT_FRAME_LENGTH 0x2CC +#define CONTEXT_EX_PADDING 0x4 +#endif + +#define CONTEXT_ALIGNMENT(Size, Align) \ + (((ULONG_PTR)(Size) + (Align) - 1) & ~((Align) - 1)) + +#define CONTEXT_EX_LENGTH \ + CONTEXT_ALIGNMENT(sizeof(CONTEXT_EX), CONTEXT_ALIGN) + +C_ASSERT(CONTEXT_FRAME_LENGTH == sizeof(CONTEXT)); +C_ASSERT(CONTEXT_EX_LENGTH == 0x20); + #define RTL_CONTEXT_EX_OFFSET(ContextEx, Chunk) ((ContextEx)->Chunk.Offset) #define RTL_CONTEXT_EX_LENGTH(ContextEx, Chunk) ((ContextEx)->Chunk.Length) #define RTL_CONTEXT_EX_CHUNK(Base, Layout, Chunk) ((PVOID)((PCHAR)(Base) + RTL_CONTEXT_EX_OFFSET(Layout, Chunk))) @@ -3037,19 +3214,34 @@ typedef struct _CONTEXT_EX #define RTL_CONTEXT_LENGTH(Context, Chunk) RTL_CONTEXT_EX_LENGTH((PCONTEXT_EX)(Context + 1), Chunk) #define RTL_CONTEXT_CHUNK(Context, Chunk) RTL_CONTEXT_EX_CHUNK((PCONTEXT_EX)(Context + 1), (PCONTEXT_EX)(Context + 1), Chunk) +#if defined(_M_AMD64) +// returns constant 0xf0e0d0c0a0908070 (dmex) NTSYSAPI -VOID +ULONG64 NTAPI RtlInitializeContext( - _In_ HANDLE Process, + _Reserved_ HANDLE Reserved, _Out_ PCONTEXT Context, _In_opt_ PVOID Parameter, _In_opt_ PVOID InitialPc, _In_opt_ PVOID InitialSp ); +#else +// returns status of NtWriteVirtualMemory (dmex) +NTSYSAPI +NTSTATUS +NTAPI +RtlInitializeContext( + _In_ HANDLE ProcessHandle, + _Out_ PCONTEXT Context, + _In_opt_ PVOID Parameter, + _In_opt_ PVOID InitialPc, + _In_opt_ PVOID InitialSp + ); +#endif NTSYSAPI -ULONG +NTSTATUS NTAPI RtlInitializeExtendedContext( _Out_ PCONTEXT Context, @@ -3057,6 +3249,16 @@ RtlInitializeExtendedContext( _Out_ PCONTEXT_EX* ContextEx ); +NTSYSAPI +NTSTATUS +NTAPI +RtlInitializeExtendedContext2( + _Out_ PCONTEXT Context, + _In_ ULONG ContextFlags, + _Out_ PCONTEXT_EX* ContextEx, + _In_ ULONG64 EnabledExtendedFeatures // RtlGetEnabledExtendedFeatures(-1) + ); + NTSYSAPI NTSTATUS NTAPI @@ -3067,7 +3269,7 @@ RtlCopyContext( ); NTSYSAPI -ULONG +NTSTATUS NTAPI RtlCopyExtendedContext( _Out_ PCONTEXT_EX Destination, @@ -3076,13 +3278,22 @@ RtlCopyExtendedContext( ); NTSYSAPI -ULONG +NTSTATUS NTAPI RtlGetExtendedContextLength( _In_ ULONG ContextFlags, _Out_ PULONG ContextLength ); +NTSYSAPI +NTSTATUS +NTAPI +RtlGetExtendedContextLength2( + _In_ ULONG ContextFlags, + _Out_ PULONG ContextLength, + _In_ ULONG64 EnabledExtendedFeatures // RtlGetEnabledExtendedFeatures(-1) + ); + NTSYSAPI ULONG64 NTAPI @@ -3141,8 +3352,8 @@ NTSYSAPI NTSTATUS NTAPI RtlRemoteCall( - _In_ HANDLE Process, - _In_ HANDLE Thread, + _In_ HANDLE ProcessHandle, + _In_ HANDLE ThreadHandle, _In_ PVOID CallSite, _In_ ULONG ArgumentCount, _In_opt_ PULONG_PTR Arguments, @@ -3261,30 +3472,204 @@ RtlGetFunctionTableListHead( // Activation Contexts -// rev +#define INVALID_ACTIVATION_CONTEXT ((HANDLE)(LONG_PTR)-1) +#define ACTCTX_PROCESS_DEFAULT ((HANDLE)(LONG_PTR)0) +#define ACTCTX_EMPTY ((HANDLE)(LONG_PTR)-3) +#define ACTCTX_SYSTEM_DEFAULT ((HANDLE)(LONG_PTR)-4) +#define IS_SPECIAL_ACTCTX(x) (((((LONG_PTR)(x)) - 1) | 7) == -1) + +// private NTSYSAPI NTSTATUS NTAPI RtlGetActiveActivationContext( - _Out_ HANDLE ActCtx + _Out_ PACTIVATION_CONTEXT ActivationContext ); -// rev +// private NTSYSAPI VOID NTAPI RtlAddRefActivationContext( - _In_ HANDLE ActCtx + _In_ PACTIVATION_CONTEXT ActivationContext ); -// rev +// private NTSYSAPI VOID NTAPI RtlReleaseActivationContext( - _In_ HANDLE ActCtx + _In_ PACTIVATION_CONTEXT ActivationContext ); +// private +NTSYSAPI +NTSTATUS +NTAPI +RtlZombifyActivationContext( + _In_ PACTIVATION_CONTEXT ActivationContext + ); + +// private +NTSYSAPI +BOOLEAN +NTAPI +RtlIsActivationContextActive( + _In_ PACTIVATION_CONTEXT ActivationContext + ); + +// private +NTSYSAPI +NTSTATUS +NTAPI +RtlActivateActivationContext( + _Reserved_ ULONG Flags, + _In_ PACTIVATION_CONTEXT ActivationContext, + _Out_ PULONG_PTR Cookie + ); + +#define RTL_ACTIVATE_ACTIVATION_CONTEXT_EX_FLAG_RELEASE_ON_STACK_DEALLOCATION 0x00000001 + +// private +NTSYSAPI +NTSTATUS +NTAPI +RtlActivateActivationContextEx( + _In_ ULONG Flags, + _In_ PTEB Teb, + _In_ PACTIVATION_CONTEXT ActivationContext, + _Out_ PULONG_PTR Cookie + ); + +#define RTL_DEACTIVATE_ACTIVATION_CONTEXT_FLAG_FORCE_EARLY_DEACTIVATION 0x00000001 + +// private +NTSYSAPI +VOID +NTAPI +RtlDeactivateActivationContext( + _In_ ULONG Flags, + _In_ ULONG_PTR Cookie + ); + +// private +NTSYSAPI +NTSTATUS +NTAPI +RtlCreateActivationContext( + _Reserved_ ULONG Flags, + _In_ PACTIVATION_CONTEXT_DATA ActivationContextData, + _In_opt_ ULONG ExtraBytes, + _In_opt_ PACTIVATION_CONTEXT_NOTIFY_ROUTINE NotificationRoutine, + _In_opt_ PVOID NotificationContext, + _Out_ PACTIVATION_CONTEXT *ActivationContext + ); + +#define FIND_ACTIVATION_CONTEXT_SECTION_KEY_RETURN_ACTIVATION_CONTEXT 0x00000001 +#define FIND_ACTIVATION_CONTEXT_SECTION_KEY_RETURN_FLAGS 0x00000002 +#define FIND_ACTIVATION_CONTEXT_SECTION_KEY_RETURN_ASSEMBLY_METADATA 0x00000004 + +// private +NTSYSAPI +NTSTATUS +NTAPI +RtlFindActivationContextSectionString( + _In_ ULONG Flags, + _In_opt_ PGUID ExtensionGuid, + _In_ ULONG SectionId, // ACTIVATION_CONTEXT_SECTION_* + _In_ PUNICODE_STRING StringToFind, + _Inout_ PACTCTX_SECTION_KEYED_DATA ReturnedData + ); + +// private +NTSYSAPI +NTSTATUS +NTAPI +RtlFindActivationContextSectionGuid( + _In_ ULONG Flags, + _In_opt_ PGUID ExtensionGuid, + _In_ ULONG SectionId, // ACTIVATION_CONTEXT_SECTION_* + _In_ PGUID GuidToFind, + _Inout_ PACTCTX_SECTION_KEYED_DATA ReturnedData + ); + +// rev +NTSYSAPI +NTSTATUS +NTAPI +RtlQueryActivationContextApplicationSettings( + _Reserved_ ULONG Flags, + _In_ PACTIVATION_CONTEXT ActivationContext, + _In_ PWSTR SettingsNameSpace, + _In_ PWSTR SettingName, + _Out_writes_bytes_(BufferLength) PWSTR Buffer, + _In_ SIZE_T BufferLength, + _Out_opt_ PSIZE_T RequiredLength + ); + +// ACTIVATION_CONTEXT_INFO_CLASS +// ActivationContextBasicInformation // q: ACTIVATION_CONTEXT_BASIC_INFORMATION +// ActivationContextDetailedInformation // q: ACTIVATION_CONTEXT_DETAILED_INFORMATION +// AssemblyDetailedInformationInActivationContext // q: ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION +// FileInformationInAssemblyOfAssemblyInActivationContext // q: ASSEMBLY_FILE_DETAILED_INFORMATION +// RunlevelInformationInActivationContext // q: ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION +// CompatibilityInformationInActivationContext // q: ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION[_LEGACY] +// ActivationContextManifestResourceName // q: ULONG + +#define RTL_QUERY_INFORMATION_ACTIVATION_CONTEXT_FLAG_USE_ACTIVE_ACTIVATION_CONTEXT 0x00000001 +#define RTL_QUERY_INFORMATION_ACTIVATION_CONTEXT_FLAG_ACTIVATION_CONTEXT_IS_MODULE 0x00000002 +#define RTL_QUERY_INFORMATION_ACTIVATION_CONTEXT_FLAG_ACTIVATION_CONTEXT_IS_ADDRESS 0x00000004 +#define RTL_QUERY_INFORMATION_ACTIVATION_CONTEXT_FLAG_NO_ADDREF 0x80000000 + +// private +NTSYSAPI +NTSTATUS +NTAPI +RtlQueryInformationActivationContext( + _In_ ULONG Flags, + _In_opt_ PACTIVATION_CONTEXT ActivationContext, + _In_opt_ PACTIVATION_CONTEXT_QUERY_INDEX SubInstanceIndex, + _In_ ACTIVATION_CONTEXT_INFO_CLASS ActivationContextInformationClass, + _Out_writes_bytes_(ActivationContextInformationLength) PVOID ActivationContextInformation, + _In_ SIZE_T ActivationContextInformationLength, + _Out_opt_ PSIZE_T ReturnLength + ); + +#ifdef PHNT_INLINE_ACTIVE_ACTIVATION_CONTEXT +// private +FORCEINLINE +NTSTATUS +NTAPI +RtlQueryInformationActiveActivationContext( + _In_ ACTIVATION_CONTEXT_INFO_CLASS ActivationContextInformationClass, + _Out_writes_bytes_(ActivationContextInformationLength) PVOID ActivationContextInformation, + _In_ SIZE_T ActivationContextInformationLength, + _Out_opt_ PSIZE_T ReturnLength + ) +{ + return RtlQueryInformationActivationContext( + RTL_QUERY_INFORMATION_ACTIVATION_CONTEXT_FLAG_USE_ACTIVE_ACTIVATION_CONTEXT, + NULL, + 0, + ActivationContextInformationClass, + ActivationContextInformation, + ActivationContextInformationLength, + ReturnLength + ); +} +#else +// private +NTSYSAPI +NTSTATUS +NTAPI +RtlQueryInformationActiveActivationContext( + _In_ ACTIVATION_CONTEXT_INFO_CLASS ActivationContextInformationClass, + _Out_writes_bytes_(ActivationContextInformationLength) PVOID ActivationContextInformation, + _In_ SIZE_T ActivationContextInformationLength, + _Out_opt_ PSIZE_T ReturnLength + ); +#endif + // Images NTSYSAPI @@ -3361,7 +3746,7 @@ PVOID NTAPI RtlFindExportedRoutineByName( _In_ PVOID BaseOfImage, - _In_ PCSTR RoutineName + _In_z_ PCSTR RoutineName ); // rev @@ -3376,6 +3761,16 @@ RtlGuardCheckLongJumpTarget( #endif +#if (PHNT_VERSION >= PHNT_WIN11_22H2) +NTSYSAPI +VOID +NTAPI +RtlValidateUserCallTarget( + _In_ PVOID Address, + _Out_ PULONG Flags + ); +#endif + // Memory _Must_inspect_result_ @@ -3462,6 +3857,17 @@ RtlFillMemoryUlonglong( _In_ ULONGLONG Pattern ); #endif + +#if (PHNT_VERSION >= PHNT_19H2) +NTSYSAPI +BOOLEAN +NTAPI +RtlIsZeroMemory( + _In_ PVOID Buffer, + _In_ SIZE_T Length + ); +#endif + // Environment NTSYSAPI @@ -3484,7 +3890,7 @@ NTSYSAPI NTSTATUS NTAPI RtlCreateEnvironmentEx( - _In_ PVOID SourceEnv, + _In_opt_ PVOID SourceEnvironment, _Out_ PVOID *Environment, _In_ ULONG Flags ); @@ -3494,7 +3900,7 @@ NTSYSAPI NTSTATUS NTAPI RtlDestroyEnvironment( - _In_ PVOID Environment + _In_ _Post_invalid_ PVOID Environment ); NTSYSAPI @@ -3515,7 +3921,7 @@ RtlSetEnvironmentVar( _In_reads_(NameLength) PCWSTR Name, _In_ SIZE_T NameLength, _In_reads_(ValueLength) PCWSTR Value, - _In_ SIZE_T ValueLength + _In_opt_ SIZE_T ValueLength ); #endif @@ -3537,8 +3943,8 @@ RtlQueryEnvironmentVariable( _In_opt_ PVOID Environment, _In_reads_(NameLength) PCWSTR Name, _In_ SIZE_T NameLength, - _Out_writes_(ValueLength) PWSTR Value, - _In_ SIZE_T ValueLength, + _Out_writes_opt_(ValueLength) PWSTR Value, + _In_opt_ SIZE_T ValueLength, _Out_ PSIZE_T ReturnLength ); #endif @@ -3559,10 +3965,10 @@ NTSTATUS NTAPI RtlExpandEnvironmentStrings( _In_opt_ PVOID Environment, - _In_reads_(SrcLength) PCWSTR Src, - _In_ SIZE_T SrcLength, - _Out_writes_(DstLength) PWSTR Dst, - _In_ SIZE_T DstLength, + _In_reads_(SourceLength) PCWSTR Source, + _In_ SIZE_T SourceLength, + _Out_writes_(DestinationLength) PWSTR Destination, + _In_ SIZE_T DestinationLength, _Out_opt_ PSIZE_T ReturnLength ); #endif @@ -3624,6 +4030,16 @@ NTSYSAPI UNICODE_STRING RtlNtPathSeperatorString; #define RtlDosPathSeperatorsString ((UNICODE_STRING)RTL_CONSTANT_STRING(L"\\/")) #define RtlAlternateDosPathSeperatorString ((UNICODE_STRING)RTL_CONSTANT_STRING(L"/")) #define RtlNtPathSeperatorString ((UNICODE_STRING)RTL_CONSTANT_STRING(L"\\")) + +#define RtlDosDevicesPrefix ((UNICODE_STRING)RTL_CONSTANT_STRING(L"\\??\\")) +#define RtlDosDevicesUncPrefix ((UNICODE_STRING)RTL_CONSTANT_STRING(L"\\??\\UNC\\")) +#define RtlSlashSlashDot ((UNICODE_STRING)RTL_CONSTANT_STRING(L"\\\\.\\")) +#define RtlNullString ((UNICODE_STRING)RTL_CONSTANT_STRING(L"")) +#define RtlWin32NtRootSlash ((UNICODE_STRING)RTL_CONSTANT_STRING(L"\\\\?\\")) +#define RtlWin32NtRoot ((UNICODE_STRING)RTL_CONSTANT_STRING(L"\\\\?")) +#define RtlWin32NtUncRoot ((UNICODE_STRING)RTL_CONSTANT_STRING(L"\\\\?\\UNC")) +#define RtlWin32NtUncRootSlash ((UNICODE_STRING)RTL_CONSTANT_STRING(L"\\\\?\\UNC\\")) +#define RtlDefaultExtension ((UNICODE_STRING)RTL_CONSTANT_STRING(L".DLL")) #endif // Path functions @@ -3704,6 +4120,34 @@ RtlGetLongestNtPathLength( VOID ); +// rev +typedef struct _RTL_BUFFER +{ + PUCHAR Buffer; + PUCHAR StaticBuffer; + SIZE_T Size; + SIZE_T StaticSize; +} RTL_BUFFER, *PRTL_BUFFER; + +// rev +typedef struct _RTL_UNICODE_STRING_BUFFER +{ + UNICODE_STRING String; + RTL_BUFFER ByteBuffer; + UCHAR MinimumStaticBufferForTerminalNul[2]; +} RTL_UNICODE_STRING_BUFFER, *PRTL_UNICODE_STRING_BUFFER; + +// rev +NTSYSAPI +NTSTATUS +NTAPI +RtlNtPathNameToDosPathName( + _Reserved_ ULONG Flags, + _Inout_ PRTL_UNICODE_STRING_BUFFER Path, + _Out_opt_ PULONG Disposition, // RtlDetermineDosPathNameType_U + _Out_opt_ PWSTR* FilePart + ); + NTSYSAPI BOOLEAN NTAPI @@ -3823,6 +4267,22 @@ RtlDoesFileExists_U( _In_ PCWSTR FileName ); +// ros +NTSYSAPI +NTSTATUS +NTAPI +RtlDosApplyFileIsolationRedirection_Ustr( + _In_ ULONG Flags, + _In_ PUNICODE_STRING OriginalName, + _In_ PUNICODE_STRING Extension, + _In_opt_ PUNICODE_STRING StaticString, + _In_opt_ PUNICODE_STRING DynamicString, + _In_opt_ PUNICODE_STRING* NewName, + _In_ PULONG NewFlags, + _In_ PSIZE_T FileNameSize, + _In_ PSIZE_T RequiredLength + ); + NTSYSAPI NTSTATUS NTAPI @@ -3917,13 +4377,32 @@ ULONG NTAPI RtlReplaceSystemDirectoryInPath( _Inout_ PUNICODE_STRING Destination, - _In_ ULONG Machine, // IMAGE_FILE_MACHINE_I386 - _In_ ULONG TargetMachine, // IMAGE_FILE_MACHINE_TARGET_HOST + _In_ USHORT Machine, // IMAGE_FILE_MACHINE_I386 + _In_ USHORT TargetMachine, // IMAGE_FILE_MACHINE_TARGET_HOST _In_ BOOLEAN IncludePathSeperator ); #endif -#if (PHNT_VERSION >= PHNT_21H2) +#if (PHNT_VERSION >= PHNT_REDSTONE) +// rev from Wow64DetermineEnvironment +NTSYSAPI +USHORT +NTAPI +RtlWow64GetCurrentMachine( + VOID + ); + +// rev from Wow64DetermineEnvironment +NTSYSAPI +NTSTATUS +NTAPI +RtlWow64IsWowGuestMachineSupported( + _In_ USHORT NativeMachine, + _Out_ PBOOLEAN IsWowGuestMachineSupported + ); +#endif + +#if (PHNT_VERSION >= PHNT_WIN10_21H2) // rev NTSYSAPI NTSTATUS @@ -3935,8 +4414,40 @@ RtlWow64GetProcessMachines( ); #endif +#if (PHNT_VERSION >= PHNT_WIN11) +// rev +#define IMAGE_FILE_NATIVE_MACHINE_I386 0x1 +#define IMAGE_FILE_NATIVE_MACHINE_AMD64 0x2 +#define IMAGE_FILE_NATIVE_MACHINE_ARMNT 0x4 +#define IMAGE_FILE_NATIVE_MACHINE_ARM64 0x8 + +// rev +NTSYSAPI +NTSTATUS +NTAPI +RtlGetImageFileMachines( + _In_ PCWSTR FileName, + _Out_ PUSHORT FileMachines + ); +#endif + #if (PHNT_VERSION >= PHNT_REDSTONE2) +#ifdef PHNT_INLINE_SYSTEMROOT +// rev +FORCEINLINE +PWSTR +NTAPI +RtlGetNtSystemRoot( + VOID + ) +{ + if (NtCurrentPeb()->SharedData && NtCurrentPeb()->SharedData->ServiceSessionId) // RtlGetCurrentServiceSessionId + return NtCurrentPeb()->SharedData->NtSystemRoot; + else + return USER_SHARED_DATA->NtSystemRoot; +} +#else // private NTSYSAPI PWSTR @@ -3944,7 +4455,20 @@ NTAPI RtlGetNtSystemRoot( VOID ); +#endif +#ifdef PHNT_INLINE_LONGPATH +// rev +FORCEINLINE +BOOLEAN +NTAPI +RtlAreLongPathsEnabled( + VOID + ) +{ + return NtCurrentPeb()->IsLongPathAwareProcess; +} +#else // rev NTSYSAPI BOOLEAN @@ -3952,6 +4476,7 @@ NTAPI RtlAreLongPathsEnabled( VOID ); +#endif #endif @@ -3998,8 +4523,10 @@ typedef struct _RTL_HEAP_ENTRY #define RTL_HEAP_SETTABLE_FLAG2 (USHORT)0x0040 #define RTL_HEAP_SETTABLE_FLAG3 (USHORT)0x0080 #define RTL_HEAP_SETTABLE_FLAGS (USHORT)0x00e0 -#define RTL_HEAP_UNCOMMITTED_RANGE (USHORT)0x0100 -#define RTL_HEAP_PROTECTED_ENTRY (USHORT)0x0200 +#define RTL_HEAP_UNCOMMITTED_RANGE (USHORT)0x1000 +#define RTL_HEAP_PROTECTED_ENTRY (USHORT)0x2000 +#define RTL_HEAP_LARGE_ALLOC (USHORT)0x4000 +#define RTL_HEAP_LFH_ALLOC (USHORT)0x8000 typedef struct _RTL_HEAP_TAG { @@ -4054,21 +4581,118 @@ typedef struct _RTL_HEAP_INFORMATION_V2 typedef struct _RTL_PROCESS_HEAPS_V1 { ULONG NumberOfHeaps; - RTL_HEAP_INFORMATION_V1 Heaps[1]; + _Field_size_(NumberOfHeaps) RTL_HEAP_INFORMATION_V1 Heaps[1]; } RTL_PROCESS_HEAPS_V1, *PRTL_PROCESS_HEAPS_V1; typedef struct _RTL_PROCESS_HEAPS_V2 { ULONG NumberOfHeaps; - RTL_HEAP_INFORMATION_V2 Heaps[1]; + _Field_size_(NumberOfHeaps) RTL_HEAP_INFORMATION_V2 Heaps[1]; } RTL_PROCESS_HEAPS_V2, *PRTL_PROCESS_HEAPS_V2; -typedef NTSTATUS (NTAPI *PRTL_HEAP_COMMIT_ROUTINE)( +// Segment heap parameters. + +typedef enum _RTL_MEMORY_TYPE +{ + MemoryTypePaged, + MemoryTypeNonPaged, + MemoryType64KPage, + MemoryTypeLargePage, + MemoryTypeHugePage, + MemoryTypeCustom, + MemoryTypeMax +} RTL_MEMORY_TYPE, *PRTL_MEMORY_TYPE; + +typedef enum _HEAP_MEMORY_INFO_CLASS +{ + HeapMemoryBasicInformation +} HEAP_MEMORY_INFO_CLASS; + +typedef NTSTATUS ALLOCATE_VIRTUAL_MEMORY_EX_CALLBACK( + _Inout_ HANDLE CallbackContext, + _In_ HANDLE ProcessHandle, + _Inout_ _At_ (*BaseAddress, _Readable_bytes_ (*RegionSize) _Writable_bytes_ (*RegionSize) _Post_readable_byte_size_ (*RegionSize)) PVOID* BaseAddress, + _Inout_ PSIZE_T RegionSize, + _In_ ULONG AllocationType, + _In_ ULONG PageProtection, + _Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters, + _In_ ULONG ExtendedParameterCount + ); + +typedef ALLOCATE_VIRTUAL_MEMORY_EX_CALLBACK *PALLOCATE_VIRTUAL_MEMORY_EX_CALLBACK; + +typedef NTSTATUS FREE_VIRTUAL_MEMORY_EX_CALLBACK( + _Inout_ HANDLE CallbackContext, + _In_ HANDLE ProcessHandle, + _Inout_ __drv_freesMem(Mem) PVOID *BaseAddress, + _Inout_ PSIZE_T RegionSize, + _In_ ULONG FreeType + ); + +typedef FREE_VIRTUAL_MEMORY_EX_CALLBACK *PFREE_VIRTUAL_MEMORY_EX_CALLBACK; + +typedef NTSTATUS QUERY_VIRTUAL_MEMORY_CALLBACK( + _Inout_ HANDLE CallbackContext, + _In_ HANDLE ProcessHandle, + _In_opt_ PVOID BaseAddress, + _In_ HEAP_MEMORY_INFO_CLASS MemoryInformationClass, + _Out_writes_bytes_(MemoryInformationLength) PVOID MemoryInformation, + _In_ SIZE_T MemoryInformationLength, + _Out_opt_ PSIZE_T ReturnLength + ); + +typedef QUERY_VIRTUAL_MEMORY_CALLBACK *PQUERY_VIRTUAL_MEMORY_CALLBACK; + +typedef struct _RTL_SEGMENT_HEAP_VA_CALLBACKS +{ + HANDLE CallbackContext; + PALLOCATE_VIRTUAL_MEMORY_EX_CALLBACK AllocateVirtualMemory; + PFREE_VIRTUAL_MEMORY_EX_CALLBACK FreeVirtualMemory; + PQUERY_VIRTUAL_MEMORY_CALLBACK QueryVirtualMemory; +} RTL_SEGMENT_HEAP_VA_CALLBACKS, *PRTL_SEGMENT_HEAP_VA_CALLBACKS; + +#define RTL_SEGHEAP_MEM_SOURCE_ANY_NODE ((ULONG)-1) + +typedef struct _RTL_SEGMENT_HEAP_MEMORY_SOURCE +{ + ULONG Flags; + ULONG MemoryTypeMask; // Mask of RTL_MEMORY_TYPE members. + ULONG NumaNode; + union + { + HANDLE PartitionHandle; + RTL_SEGMENT_HEAP_VA_CALLBACKS *Callbacks; + }; + SIZE_T Reserved[2]; +} RTL_SEGMENT_HEAP_MEMORY_SOURCE, *PRTL_SEGMENT_HEAP_MEMORY_SOURCE; + +#define SEGMENT_HEAP_PARAMETERS_VERSION 3 +#define SEGMENT_HEAP_FLG_USE_PAGE_HEAP 0x1 +#define SEGMENT_HEAP_PARAMS_VALID_FLAGS SEGMENT_HEAP_FLG_USE_PAGE_HEAP + +typedef struct _RTL_SEGMENT_HEAP_PARAMETERS +{ + USHORT Version; + USHORT Size; + ULONG Flags; + RTL_SEGMENT_HEAP_MEMORY_SOURCE MemorySource; + SIZE_T Reserved[4]; +} RTL_SEGMENT_HEAP_PARAMETERS, *PRTL_SEGMENT_HEAP_PARAMETERS; + +// Heap parameters. + +typedef +_Function_class_(RTL_HEAP_COMMIT_ROUTINE) +NTSTATUS +NTAPI +RTL_HEAP_COMMIT_ROUTINE( _In_ PVOID Base, - _Inout_ PVOID *CommitAddress, + _Inout_ PVOID* CommitAddress, _Inout_ PSIZE_T CommitSize ); +typedef RTL_HEAP_COMMIT_ROUTINE* PRTL_HEAP_COMMIT_ROUTINE; + typedef struct _RTL_HEAP_PARAMETERS { ULONG Length; @@ -4111,7 +4735,9 @@ RtlCreateHeap( _In_opt_ SIZE_T ReserveSize, _In_opt_ SIZE_T CommitSize, _In_opt_ PVOID Lock, - _In_opt_ PRTL_HEAP_PARAMETERS Parameters + _When_((Flags & HEAP_CREATE_SEGMENT_HEAP) != 0, _In_reads_bytes_opt_(sizeof(RTL_SEGMENT_HEAP_PARAMETERS))) + _When_((Flags & HEAP_CREATE_SEGMENT_HEAP) == 0, _In_reads_bytes_opt_(sizeof(RTL_HEAP_PARAMETERS))) + _In_opt_ PVOID Parameters ); NTSYSAPI @@ -4121,10 +4747,13 @@ RtlDestroyHeap( _In_ _Post_invalid_ PVOID HeapHandle ); +NTSYSAPI +_Success_(return != 0) _Must_inspect_result_ _Ret_maybenull_ _Post_writable_byte_size_(Size) -NTSYSAPI +__drv_allocatesMem(Mem) +DECLSPEC_ALLOCATOR PVOID NTAPI RtlAllocateHeap( @@ -4197,6 +4826,12 @@ RtlUnlockHeap( ); NTSYSAPI +_Success_(return != 0) +_Must_inspect_result_ +_Ret_maybenull_ +_Post_writable_byte_size_(Size) +_When_(Size > 0, __drv_allocatesMem(Mem)) +DECLSPEC_ALLOCATOR PVOID NTAPI RtlReAllocateHeap( @@ -4292,7 +4927,7 @@ NTAPI RtlValidateHeap( _In_opt_ PVOID HeapHandle, _In_ ULONG Flags, - _In_ PVOID BaseAddress + _In_opt_ PVOID BaseAddress ); NTSYSAPI @@ -4310,10 +4945,12 @@ RtlGetProcessHeaps( _Out_ PVOID *ProcessHeaps ); -typedef NTSTATUS (NTAPI *PRTL_ENUM_HEAPS_ROUTINE)( +_Function_class_(RTL_ENUM_HEAPS_ROUTINE) +typedef NTSTATUS (NTAPI RTL_ENUM_HEAPS_ROUTINE)( _In_ PVOID HeapHandle, _In_ PVOID Parameter ); +typedef RTL_ENUM_HEAPS_ROUTINE *PRTL_ENUM_HEAPS_ROUTINE; NTSYSAPI NTSTATUS @@ -4524,7 +5161,7 @@ typedef struct _HEAP_INFORMATION_ITEM typedef NTSTATUS (NTAPI *PRTL_HEAP_EXTENDED_ENUMERATION_ROUTINE)( _In_ PHEAP_INFORMATION_ITEM Information, - _In_ PVOID Context + _In_opt_ PVOID Context ); // HEAP_EXTENDED_INFORMATION Level @@ -4553,7 +5190,7 @@ typedef struct _HEAP_EXTENDED_INFORMATION typedef NTSTATUS (NTAPI *RTL_HEAP_STACK_WRITE_ROUTINE)( _In_ PVOID Information, // TODO: 3 missing structures (dmex) _In_ ULONG Size, - _In_ PVOID Context + _In_opt_ PVOID Context ); // rev @@ -4769,12 +5406,8 @@ RtlUnlockMemoryZone( #endif -// end_private - // Memory block lookaside lists -// begin_private - #if (PHNT_VERSION >= PHNT_VISTA) NTSYSAPI @@ -4885,7 +5518,10 @@ FORCEINLINE BOOLEAN RtlIsZeroLuid( return (L1->LowPart | L1->HighPart) == 0; } -FORCEINLINE LUID RtlConvertLongToLuid( +FORCEINLINE +LUID +NTAPI_INLINE +RtlConvertLongToLuid( _In_ LONG Long ) { @@ -4899,7 +5535,10 @@ FORCEINLINE LUID RtlConvertLongToLuid( return tempLuid; } -FORCEINLINE LUID RtlConvertUlongToLuid( +FORCEINLINE +LUID +NTAPI_INLINE +RtlConvertUlongToLuid( _In_ ULONG Ulong ) { @@ -4961,6 +5600,11 @@ RtlUlonglongByteSwap( // Debugging // private +typedef struct _RTL_PROCESS_MODULES *PRTL_PROCESS_MODULES; +typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX *PRTL_PROCESS_MODULE_INFORMATION_EX; +typedef struct _RTL_PROCESS_BACKTRACES *PRTL_PROCESS_BACKTRACES; +typedef struct _RTL_PROCESS_LOCKS *PRTL_PROCESS_LOCKS; + typedef struct _RTL_PROCESS_VERIFIER_OPTIONS { ULONG SizeStruct; @@ -4985,12 +5629,12 @@ typedef struct _RTL_DEBUG_INFORMATION SIZE_T ViewSize; union { - struct _RTL_PROCESS_MODULES *Modules; - struct _RTL_PROCESS_MODULE_INFORMATION_EX *ModulesEx; + PRTL_PROCESS_MODULES Modules; + PRTL_PROCESS_MODULE_INFORMATION_EX ModulesEx; }; - struct _RTL_PROCESS_BACKTRACES *BackTraces; + PRTL_PROCESS_BACKTRACES BackTraces; PVOID Heaps; - struct _RTL_PROCESS_LOCKS *Locks; + PRTL_PROCESS_LOCKS Locks; PVOID SpecificHeap; HANDLE TargetProcessHandle; PRTL_PROCESS_VERIFIER_OPTIONS VerifierOptions; @@ -5050,6 +5694,7 @@ RtlDeCommitDebugInfo( #define RTL_QUERY_PROCESS_HEAP_SEGMENTS 0x00000200 #define RTL_QUERY_PROCESS_CS_OWNER 0x00000400 // rev #define RTL_QUERY_PROCESS_NONINVASIVE 0x80000000 +#define RTL_QUERY_PROCESS_NONINVASIVE_CS_OWNER 0x80000800 // WIN11 NTSYSAPI NTSTATUS @@ -5070,6 +5715,24 @@ RtlSetProcessDebugInformation( _Inout_ PRTL_DEBUG_INFORMATION Buffer ); +// rev +FORCEINLINE +BOOLEAN +NTAPI +RtlIsAnyDebuggerPresent( + VOID + ) +{ + BOOLEAN result; + + result = NtCurrentPeb()->BeingDebugged; + + if (!result) + return USER_SHARED_DATA->KdDebuggerEnabled; + + return result; +} + // Messages NTSYSAPI @@ -5330,7 +5993,7 @@ NTSYSAPI NTSTATUS NTAPI RtlCharToInteger( - _In_ PCSTR String, + _In_z_ PCSTR String, _In_opt_ ULONG Base, _Out_ PULONG Value ); @@ -5380,14 +6043,16 @@ RtlUnicodeStringToInteger( // IPv4/6 conversion -struct in_addr; -struct in6_addr; +typedef struct in_addr IN_ADDR, *PIN_ADDR; +typedef struct in6_addr IN6_ADDR, *PIN6_ADDR; +typedef IN_ADDR const *PCIN_ADDR; +typedef IN6_ADDR const *PCIN6_ADDR; NTSYSAPI PWSTR NTAPI RtlIpv4AddressToStringW( - _In_ const struct in_addr *Address, + _In_ PCIN_ADDR Address, _Out_writes_(16) PWSTR AddressString ); @@ -5395,7 +6060,7 @@ NTSYSAPI NTSTATUS NTAPI RtlIpv4AddressToStringExW( - _In_ const struct in_addr *Address, + _In_ PCIN_ADDR Address, _In_ USHORT Port, _Out_writes_to_(*AddressStringLength, *AddressStringLength) PWSTR AddressString, _Inout_ PULONG AddressStringLength @@ -5405,7 +6070,7 @@ NTSYSAPI PWSTR NTAPI RtlIpv6AddressToStringW( - _In_ const struct in6_addr *Address, + _In_ PCIN6_ADDR Address, _Out_writes_(46) PWSTR AddressString ); @@ -5413,7 +6078,7 @@ NTSYSAPI NTSTATUS NTAPI RtlIpv6AddressToStringExW( - _In_ const struct in6_addr *Address, + _In_ PCIN6_ADDR Address, _In_ ULONG ScopeId, _In_ USHORT Port, _Out_writes_to_(*AddressStringLength, *AddressStringLength) PWSTR AddressString, @@ -5427,7 +6092,7 @@ RtlIpv4StringToAddressW( _In_ PCWSTR AddressString, _In_ BOOLEAN Strict, _Out_ LPCWSTR *Terminator, - _Out_ struct in_addr *Address + _Out_ PIN_ADDR Address ); NTSYSAPI @@ -5436,7 +6101,7 @@ NTAPI RtlIpv4StringToAddressExW( _In_ PCWSTR AddressString, _In_ BOOLEAN Strict, - _Out_ struct in_addr *Address, + _Out_ PIN_ADDR Address, _Out_ PUSHORT Port ); @@ -5446,7 +6111,7 @@ NTAPI RtlIpv6StringToAddressW( _In_ PCWSTR AddressString, _Out_ PCWSTR *Terminator, - _Out_ struct in6_addr *Address + _Out_ PIN6_ADDR Address ); NTSYSAPI @@ -5454,7 +6119,7 @@ NTSTATUS NTAPI RtlIpv6StringToAddressExW( _In_ PCWSTR AddressString, - _Out_ struct in6_addr *Address, + _Out_ PIN6_ADDR Address, _Out_ PULONG ScopeId, _Out_ PUSHORT Port ); @@ -5532,6 +6197,9 @@ RtlTimeFieldsToTime( _Out_ PLARGE_INTEGER Time ); +#define SecondsToStartOf1980 11960006400 +#define SecondsToStartOf1970 11644473600 + NTSYSAPI BOOLEAN NTAPI @@ -5566,14 +6234,14 @@ RtlSecondsSince1970ToTime( #if (PHNT_VERSION >= PHNT_WIN8) NTSYSAPI -ULONGLONG +LARGE_INTEGER NTAPI RtlGetSystemTimePrecise( VOID ); #endif -#if (PHNT_VERSION >= PHNT_21H2) +#if (PHNT_VERSION >= PHNT_WIN10_21H2) NTSYSAPI KSYSTEM_TIME NTAPI @@ -5629,6 +6297,29 @@ RtlSetTimeZoneInformation( _In_ PRTL_TIME_ZONE_INFORMATION TimeZoneInformation ); +// Interlocked bit manipulation interfaces + +#define RtlInterlockedSetBits(Flags, Flag) \ + InterlockedOr((PLONG)(Flags), Flag) + +#define RtlInterlockedAndBits(Flags, Flag) \ + InterlockedAnd((PLONG)(Flags), Flag) + +#define RtlInterlockedClearBits(Flags, Flag) \ + RtlInterlockedAndBits(Flags, ~(Flag)) + +#define RtlInterlockedXorBits(Flags, Flag) \ + InterlockedXor(Flags, Flag) + +#define RtlInterlockedSetBitsDiscardReturn(Flags, Flag) \ + (VOID) RtlInterlockedSetBits(Flags, Flag) + +#define RtlInterlockedAndBitsDiscardReturn(Flags, Flag) \ + (VOID) RtlInterlockedAndBits(Flags, Flag) + +#define RtlInterlockedClearBitsDiscardReturn(Flags, Flag) \ + RtlInterlockedAndBitsDiscardReturn(Flags, ~(Flag)) + // Bitmaps typedef struct _RTL_BITMAP @@ -5938,7 +6629,6 @@ RtlNumberOfSetBitsInRange( #endif - #if (PHNT_VERSION >= PHNT_THRESHOLD) // private @@ -5968,7 +6658,6 @@ RtlTestBitEx( _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG64 BitNumber ); -#if (PHNT_MODE == PHNT_MODE_KERNEL) // rev NTSYSAPI VOID @@ -6013,7 +6702,6 @@ RtlFindSetBitsAndClearEx( _In_ ULONG64 NumberToFind, _In_ ULONG64 HintIndex ); -#endif #endif @@ -6673,6 +7361,20 @@ RtlSelfRelativeToAbsoluteSD2( _Inout_ PULONG BufferSize ); +#if (PHNT_VERSION >= PHNT_19H2) +__drv_maxIRQL(APC_LEVEL) +NTSYSAPI +BOOLEAN +NTAPI +RtlNormalizeSecurityDescriptor( + _Inout_ PSECURITY_DESCRIPTOR *SecurityDescriptor, + _In_ ULONG SecurityDescriptorLength, + _Out_opt_ PSECURITY_DESCRIPTOR *NewSecurityDescriptor, + _Out_opt_ PULONG NewSecurityDescriptorLength, + _In_ BOOLEAN CheckOnly + ); +#endif + // Access masks #ifndef PHNT_NO_INLINE_ACCESSES_GRANTED @@ -6927,13 +7629,27 @@ RtlAddAuditAccessObjectAce( _In_ BOOLEAN AuditFailure ); +// private +#define COMPOUND_ACE_IMPERSONATION 1 + +// private +typedef struct _COMPOUND_ACCESS_ALLOWED_ACE +{ + ACE_HEADER Header; + ACCESS_MASK Mask; + USHORT CompoundAceType; // COMPOUND_ACE_* + USHORT Reserved; + ULONG SidStart; // Server SID + // Client SID follows +} COMPOUND_ACCESS_ALLOWED_ACE, *PCOMPOUND_ACCESS_ALLOWED_ACE; + NTSYSAPI NTSTATUS NTAPI RtlAddCompoundAce( _Inout_ PACL Acl, _In_ ULONG AceRevision, - _In_ UCHAR AceType, + _In_ UCHAR AceType, // COMPOUND_ACE_* _In_ ACCESS_MASK AccessMask, _In_ PSID ServerSid, _In_ PSID ClientSid @@ -6978,6 +7694,19 @@ RtlAddScopedPolicyIDAce( _In_ ULONG AccessMask, _In_ PSID Sid ); + +// rev +NTSYSAPI +NTSTATUS +NTAPI +RtlAddProcessTrustLabelAce( + _Inout_ PACL Acl, + _In_ ULONG AceRevision, + _In_ ULONG AceFlags, + _In_ PSID ProcessTrustLabelSid, + _In_ UCHAR AceType, // SYSTEM_PROCESS_TRUST_LABEL_ACE_TYPE + _In_ ACCESS_MASK AccessMask + ); #endif // Named pipes @@ -7058,7 +7787,7 @@ RtlSetSecurityObject( _In_ PSECURITY_DESCRIPTOR ModificationDescriptor, _Inout_ PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, _In_ PGENERIC_MAPPING GenericMapping, - _In_opt_ HANDLE Token + _In_opt_ HANDLE TokenHandle ); NTSYSAPI @@ -7070,7 +7799,7 @@ RtlSetSecurityObjectEx( _Inout_ PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, _In_ ULONG AutoInheritFlags, // SEF_* _In_ PGENERIC_MAPPING GenericMapping, - _In_opt_ HANDLE Token + _In_opt_ HANDLE TokenHandle ); NTSYSAPI @@ -7097,7 +7826,7 @@ RtlNewInstanceSecurityObject( _In_opt_ PSECURITY_DESCRIPTOR CreatorDescriptor, _Out_ PSECURITY_DESCRIPTOR *NewDescriptor, _In_ BOOLEAN IsDirectoryObject, - _In_ HANDLE Token, + _In_ HANDLE TokenHandle, _In_ PGENERIC_MAPPING GenericMapping ); @@ -7357,7 +8086,7 @@ RtlRegisterWait( _Out_ PHANDLE WaitHandle, _In_ HANDLE Handle, _In_ WAITORTIMERCALLBACKFUNC Function, - _In_ PVOID Context, + _In_opt_ PVOID Context, _In_ ULONG Milliseconds, _In_ ULONG Flags ); @@ -7376,7 +8105,7 @@ NTSTATUS NTAPI RtlDeregisterWaitEx( _In_ HANDLE WaitHandle, - _In_opt_ HANDLE Event // optional: RTL_WAITER_DEREGISTER_WAIT_FOR_COMPLETION + _In_opt_ HANDLE CompletionEvent // optional: RTL_WAITER_DEREGISTER_WAIT_FOR_COMPLETION ); NTSYSAPI @@ -7384,7 +8113,7 @@ NTSTATUS NTAPI RtlQueueWorkItem( _In_ WORKERCALLBACKFUNC Function, - _In_ PVOID Context, + _In_opt_ PVOID Context, _In_ ULONG Flags ); @@ -7397,15 +8126,19 @@ RtlSetIoCompletionCallback( _In_ ULONG Flags ); -typedef NTSTATUS (NTAPI *PRTL_START_POOL_THREAD)( +_Function_class_(RTL_START_POOL_THREAD) +typedef NTSTATUS (NTAPI RTL_START_POOL_THREAD)( _In_ PTHREAD_START_ROUTINE Function, _In_ PVOID Parameter, _Out_ PHANDLE ThreadHandle ); +typedef RTL_START_POOL_THREAD *PRTL_START_POOL_THREAD; -typedef NTSTATUS (NTAPI *PRTL_EXIT_POOL_THREAD)( +_Function_class_(RTL_EXIT_POOL_THREAD) +typedef NTSTATUS (NTAPI RTL_EXIT_POOL_THREAD)( _In_ NTSTATUS ExitStatus ); +typedef RTL_EXIT_POOL_THREAD *PRTL_EXIT_POOL_THREAD; NTSYSAPI NTSTATUS @@ -7463,6 +8196,19 @@ RtlCreateTimer( _In_ ULONG Flags ); +NTSYSAPI +NTSTATUS +NTAPI +RtlSetTimer( + _In_ HANDLE TimerQueueHandle, + _Out_ PHANDLE Handle, + _In_ WAITORTIMERCALLBACKFUNC Function, + _In_opt_ PVOID Context, + _In_ ULONG DueTime, + _In_ ULONG Period, + _In_ ULONG Flags + ); + NTSYSAPI NTSTATUS NTAPI @@ -7542,14 +8288,16 @@ RtlCheckRegistryKey( _In_ PWSTR Path ); -typedef NTSTATUS (NTAPI *PRTL_QUERY_REGISTRY_ROUTINE)( +_Function_class_(RTL_QUERY_REGISTRY_ROUTINE) +typedef NTSTATUS (NTAPI RTL_QUERY_REGISTRY_ROUTINE)( _In_ PWSTR ValueName, _In_ ULONG ValueType, _In_ PVOID ValueData, _In_ ULONG ValueLength, - _In_ PVOID Context, - _In_ PVOID EntryContext + _In_opt_ PVOID Context, + _In_opt_ PVOID EntryContext ); +typedef RTL_QUERY_REGISTRY_ROUTINE *PRTL_QUERY_REGISTRY_ROUTINE; typedef struct _RTL_QUERY_REGISTRY_TABLE { @@ -7576,22 +8324,38 @@ NTAPI RtlQueryRegistryValues( _In_ ULONG RelativeTo, _In_ PCWSTR Path, - _In_ PRTL_QUERY_REGISTRY_TABLE QueryTable, - _In_ PVOID Context, + _Inout_ _At_(*(*QueryTable).EntryContext, _Pre_unknown_) PRTL_QUERY_REGISTRY_TABLE QueryTable, + _In_opt_ PVOID Context, _In_opt_ PVOID Environment ); -// rev +#if (PHNT_VERSION >= PHNT_WIN8) NTSYSAPI NTSTATUS NTAPI RtlQueryRegistryValuesEx( _In_ ULONG RelativeTo, _In_ PCWSTR Path, - _In_ PRTL_QUERY_REGISTRY_TABLE QueryTable, - _In_ PVOID Context, + _Inout_ _At_(*(*QueryTable).EntryContext, _Pre_unknown_) PRTL_QUERY_REGISTRY_TABLE QueryTable, + _In_opt_ PVOID Context, _In_opt_ PVOID Environment ); +#endif + +#if (PHNT_VERSION >= PHNT_REDSTONE4) +NTSYSAPI +NTSTATUS +NTAPI +RtlQueryRegistryValueWithFallback( + _In_opt_ HANDLE PrimaryHandle, + _In_opt_ HANDLE FallbackHandle, + _In_ PUNICODE_STRING ValueName, + _In_ ULONG ValueLength, + _Out_opt_ PULONG ValueType, + _Out_writes_bytes_to_(ValueLength, *ResultLength) PVOID ValueData, + _Out_range_(<= , ValueLength) PULONG ResultLength + ); +#endif NTSYSAPI NTSTATUS @@ -7757,6 +8521,8 @@ RtlDecodeRemotePointer( ); #endif +#if (PHNT_VERSION >= PHNT_THRESHOLD) + // rev NTSYSAPI BOOLEAN @@ -7765,6 +8531,8 @@ RtlIsProcessorFeaturePresent( _In_ ULONG ProcessorFeature ); +#endif + // rev NTSYSAPI ULONG @@ -8006,9 +8774,7 @@ NTAPI RtlQueryPerformanceCounter( _Out_ PLARGE_INTEGER PerformanceCounter ); -#endif -#if (PHNT_VERSION >= PHNT_WIN7) // rev NTSYSAPI LOGICAL @@ -8039,6 +8805,8 @@ typedef enum _IMAGE_MITIGATION_POLICY ImageSehopPolicy, // RTL_IMAGE_MITIGATION_SEHOP_POLICY ImageHeapPolicy, // RTL_IMAGE_MITIGATION_HEAP_POLICY ImageUserShadowStackPolicy, // RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY + ImageRedirectionTrustPolicy, // RTL_IMAGE_MITIGATION_REDIRECTION_TRUST_POLICY + ImageUserPointerAuthPolicy, // RTL_IMAGE_MITIGATION_USER_POINTER_AUTH_POLICY MaxImageMitigationPolicy } IMAGE_MITIGATION_POLICY; @@ -8165,6 +8933,19 @@ typedef struct _RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY RTL_IMAGE_MITIGATION_POLICY BlockNonCetBinaries; } RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY, *PRTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY; +// rev +typedef struct _RTL_IMAGE_MITIGATION_REDIRECTION_TRUST_POLICY +{ + RTL_IMAGE_MITIGATION_POLICY BlockUntrustedRedirections; +} RTL_IMAGE_MITIGATION_REDIRECTION_TRUST_POLICY, *PRTL_IMAGE_MITIGATION_REDIRECTION_TRUST_POLICY; + +// rev +typedef struct _RTL_IMAGE_MITIGATION_USER_POINTER_AUTH_POLICY +{ + RTL_IMAGE_MITIGATION_POLICY PointerAuthUserIp; +} RTL_IMAGE_MITIGATION_USER_POINTER_AUTH_POLICY, *PRTL_IMAGE_MITIGATION_USER_POINTER_AUTH_POLICY; + +// rev typedef enum _RTL_IMAGE_MITIGATION_OPTION_STATE { RtlMitigationOptionStateNotConfigured, @@ -8248,7 +9029,7 @@ NTSYSAPI NTSTATUS NTAPI RtlGetTokenNamedObjectPath( - _In_ HANDLE Token, + _In_ HANDLE TokenHandle, _In_opt_ PSID Sid, _Out_ PUNICODE_STRING ObjectPath // RtlFreeUnicodeString ); @@ -8260,7 +9041,7 @@ NTSYSAPI NTSTATUS NTAPI RtlGetAppContainerNamedObjectPath( - _In_opt_ HANDLE Token, + _In_opt_ HANDLE TokenHandle, _In_opt_ PSID AppContainerSid, _In_ BOOLEAN RelativePath, _Out_ PUNICODE_STRING ObjectPath // RtlFreeUnicodeString @@ -8364,7 +9145,7 @@ NTSYSAPI NTSTATUS NTAPI RtlIsApiSetImplemented( - _In_ PCSTR Namespace + _In_z_ PCSTR ApiSetName ); #endif @@ -8396,15 +9177,6 @@ RtlIsValidProcessTrustLabelSid( ); #endif -#if (PHNT_VERSION >= PHNT_REDSTONE3) -NTSYSAPI -BOOLEAN -NTAPI -RtlIsStateSeparationEnabled( - VOID - ); -#endif - typedef enum _APPCONTAINER_SID_TYPE { NotAppContainerSidType, @@ -8443,7 +9215,7 @@ RtlFlsFree( #if (PHNT_VERSION >= PHNT_20H1) NTSYSAPI NTSTATUS -WINAPI +NTAPI RtlFlsGetValue( _In_ ULONG FlsIndex, _Out_ PVOID* FlsData @@ -8451,13 +9223,15 @@ RtlFlsGetValue( NTSYSAPI NTSTATUS -WINAPI +NTAPI RtlFlsSetValue( _In_ ULONG FlsIndex, _In_ PVOID FlsData ); #endif +// State isolation + typedef enum _STATE_LOCATION_TYPE { LocationTypeRegistry, @@ -8466,6 +9240,14 @@ typedef enum _STATE_LOCATION_TYPE } STATE_LOCATION_TYPE; #if (PHNT_VERSION >= PHNT_REDSTONE3) +// private +NTSYSAPI +BOOLEAN +NTAPI +RtlIsStateSeparationEnabled( + VOID + ); + // private NTSYSAPI NTSTATUS @@ -8479,7 +9261,11 @@ RtlGetPersistedStateLocation( _In_ ULONG BufferLengthIn, _Out_opt_ PULONG BufferLengthOut ); +#endif +// Cloud Filters + +#if (PHNT_VERSION >= PHNT_REDSTONE3) // msdn NTSYSAPI BOOLEAN @@ -8539,7 +9325,6 @@ NTAPI RtlSetThreadPlaceholderCompatibilityMode( _In_ CHAR Mode ); - #endif #if (PHNT_VERSION >= PHNT_REDSTONE4) @@ -8592,13 +9377,28 @@ RtlAppxIsFileOwnedByTrustedInstaller( #define PSM_ACTIVATION_TOKEN_FULL_TRUST 0x4 #define PSM_ACTIVATION_TOKEN_NATIVE_SERVICE 0x8 #define PSM_ACTIVATION_TOKEN_DEVELOPMENT_APP 0x10 -#define BREAKAWAY_INHIBITED 0x20 +#define PSM_ACTIVATION_TOKEN_BREAKAWAY_INHIBITED 0x20 +#define PSM_ACTIVATION_TOKEN_RUNTIME_BROKER 0x40 // rev +#define PSM_ACTIVATION_TOKEN_UNIVERSAL_CONSOLE 0x200 // rev +#define PSM_ACTIVATION_TOKEN_WIN32ALACARTE_PROCESS 0x10000 // rev + +// PackageOrigin appmodel.h +//#define PackageOrigin_Unknown 0 +//#define PackageOrigin_Unsigned 1 +//#define PackageOrigin_Inbox 2 +//#define PackageOrigin_Store 3 +//#define PackageOrigin_DeveloperUnsigned 4 +//#define PackageOrigin_DeveloperSigned 5 +//#define PackageOrigin_LineOfBusiness 6 + +#define PSMP_MINIMUM_SYSAPP_CLAIM_VALUES 2 +#define PSMP_MAXIMUM_SYSAPP_CLAIM_VALUES 4 // private typedef struct _PS_PKG_CLAIM { ULONG Flags; // PSM_ACTIVATION_TOKEN_* - ULONG Origin; // PackageOrigin from appmodel.h + ULONG Origin; // PackageOrigin } PS_PKG_CLAIM, *PPS_PKG_CLAIM; #if (PHNT_VERSION >= PHNT_THRESHOLD) @@ -8617,6 +9417,35 @@ RtlQueryPackageClaims( ); #endif +#if (PHNT_VERSION >= PHNT_WIN8) +NTSYSAPI +NTSTATUS +NTAPI +RtlQueryPackageIdentity( + _In_ HANDLE TokenHandle, + _Out_writes_bytes_to_(*PackageSize, *PackageSize) PWSTR PackageFullName, + _Inout_ PSIZE_T PackageSize, + _Out_writes_bytes_to_opt_(*AppIdSize, *AppIdSize) PWSTR AppId, + _Inout_opt_ PSIZE_T AppIdSize, + _Out_opt_ PBOOLEAN Packaged + ); +#endif + +#if (PHNT_VERSION >= PHNT_WINBLUE) +NTSYSAPI +NTSTATUS +NTAPI +RtlQueryPackageIdentityEx( + _In_ HANDLE TokenHandle, + _Out_writes_bytes_to_(*PackageSize, *PackageSize) PWSTR PackageFullName, + _Inout_ PSIZE_T PackageSize, + _Out_writes_bytes_to_opt_(*AppIdSize, *AppIdSize) PWSTR AppId, + _Inout_opt_ PSIZE_T AppIdSize, + _Out_opt_ PGUID DynamicId, + _Out_opt_ PULONG64 Flags + ); +#endif + // Protected policies #if (PHNT_VERSION >= PHNT_WINBLUE) @@ -8640,6 +9469,16 @@ RtlSetProtectedPolicy( ); #endif +#if (PHNT_VERSION >= PHNT_REDSTONE) +// rev +NTSYSAPI +BOOLEAN +NTAPI +RtlIsEnclaveFeaturePresent( + _In_ ULONG FeatureMask + ); +#endif + #if (PHNT_VERSION >= PHNT_THRESHOLD) // private NTSYSAPI @@ -8660,6 +9499,17 @@ RtlIsMultiUsersInSessionSku( ); #endif +#if (PHNT_VERSION >= PHNT_WIN11) +// rev +NTSYSAPI +NTSTATUS +NTAPI +RtlGetSessionProperties( + _In_ ULONG SessionId, + _Out_ PULONG SharedUserSessionId + ); +#endif + // private typedef enum _RTL_BSD_ITEM_TYPE { @@ -8849,6 +9699,14 @@ NTAPI RtlSetPortableOperatingSystem( _In_ BOOLEAN IsPortable ); + +// rev +NTSYSAPI +ULONG +NTAPI +RtlSetProxiedProcessId( + _In_ ULONG ProxiedProcessId + ); #endif #if (PHNT_VERSION >= PHNT_VISTA) @@ -8865,10 +9723,12 @@ RtlFindClosestEncodableLength( // Memory cache -typedef NTSTATUS (NTAPI *PRTL_SECURE_MEMORY_CACHE_CALLBACK)( +_Function_class_(RTL_SECURE_MEMORY_CACHE_CALLBACK) +typedef NTSTATUS (NTAPI RTL_SECURE_MEMORY_CACHE_CALLBACK)( _In_ PVOID Address, _In_ SIZE_T Length ); +typedef RTL_SECURE_MEMORY_CACHE_CALLBACK *PRTL_SECURE_MEMORY_CACHE_CALLBACK; // ros NTSYSAPI @@ -8991,9 +9851,11 @@ RtlQueryFeatureUsageNotificationSubscriptions( _Inout_ PULONG FeatureConfigurationCount ); -typedef VOID (NTAPI *PRTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION)( +_Function_class_(RTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION) +typedef VOID (NTAPI RTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION)( _In_opt_ PVOID Context ); +typedef RTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION *PRTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION; // rev NTSYSAPI @@ -9033,4 +9895,376 @@ RtlUnsubscribeFromFeatureUsageNotifications( ); #endif +#if (PHNT_VERSION >= PHNT_VISTA) + +#ifndef _RTL_RUN_ONCE_DEF +#define _RTL_RUN_ONCE_DEF +// +// Run once initializer +// +#define RTL_RUN_ONCE_INIT {0} +// +// Run once flags +// +#define RTL_RUN_ONCE_CHECK_ONLY 0x00000001UL +#define RTL_RUN_ONCE_ASYNC 0x00000002UL +#define RTL_RUN_ONCE_INIT_FAILED 0x00000004UL +// +// The context stored in the run once structure must +// leave the following number of low order bits unused. +// +#define RTL_RUN_ONCE_CTX_RESERVED_BITS 2 + +typedef union _RTL_RUN_ONCE +{ + PVOID Ptr; +} RTL_RUN_ONCE, *PRTL_RUN_ONCE; #endif + +NTSYSAPI +VOID +NTAPI +RtlRunOnceInitialize( + _Out_ PRTL_RUN_ONCE RunOnce + ); + +typedef _Function_class_(RTL_RUN_ONCE_INIT_FN) +LOGICAL NTAPI RTL_RUN_ONCE_INIT_FN( + _Inout_ PRTL_RUN_ONCE RunOnce, + _Inout_opt_ PVOID Parameter, + _Inout_opt_ PVOID *Context + ); +typedef RTL_RUN_ONCE_INIT_FN *PRTL_RUN_ONCE_INIT_FN; + +_Maybe_raises_SEH_exception_ +NTSYSAPI +NTSTATUS +NTAPI +RtlRunOnceExecuteOnce( + _Inout_ PRTL_RUN_ONCE RunOnce, + _In_ __callback PRTL_RUN_ONCE_INIT_FN InitFn, + _Inout_opt_ PVOID Parameter, + _Outptr_opt_result_maybenull_ PVOID *Context + ); + +_Must_inspect_result_ +NTSYSAPI +NTSTATUS +NTAPI +RtlRunOnceBeginInitialize( + _Inout_ PRTL_RUN_ONCE RunOnce, + _In_ ULONG Flags, + _Outptr_opt_result_maybenull_ PVOID *Context + ); + +NTSYSAPI +NTSTATUS +NTAPI +RtlRunOnceComplete( + _Inout_ PRTL_RUN_ONCE RunOnce, + _In_ ULONG Flags, + _In_opt_ PVOID Context + ); + +#endif + +#if (PHNT_VERSION >= PHNT_THRESHOLD) + +#define WNF_STATE_KEY 0x41C64E6DA3BC0074 + +_Must_inspect_result_ +NTSYSAPI +BOOLEAN +NTAPI +RtlEqualWnfChangeStamps( + _In_ WNF_CHANGE_STAMP ChangeStamp1, + _In_ WNF_CHANGE_STAMP ChangeStamp2 + ); + +_Always_(_Post_satisfies_(return == STATUS_NO_MEMORY || return == STATUS_RETRY || return == STATUS_SUCCESS)) +typedef _Function_class_(WNF_USER_CALLBACK) +NTSTATUS NTAPI WNF_USER_CALLBACK( + _In_ WNF_STATE_NAME StateName, + _In_ WNF_CHANGE_STAMP ChangeStamp, + _In_opt_ PWNF_TYPE_ID TypeId, + _In_opt_ PVOID CallbackContext, + _In_reads_bytes_opt_(Length) const VOID* Buffer, + _In_ ULONG Length + ); +typedef WNF_USER_CALLBACK *PWNF_USER_CALLBACK; + +NTSYSAPI +NTSTATUS +NTAPI +RtlQueryWnfStateData( + _Out_ PWNF_CHANGE_STAMP ChangeStamp, + _In_ WNF_STATE_NAME StateName, + _In_ PWNF_USER_CALLBACK Callback, + _In_opt_ PVOID CallbackContext, + _In_opt_ PWNF_TYPE_ID TypeId + ); + +NTSYSAPI +NTSTATUS +NTAPI +RtlPublishWnfStateData( + _In_ WNF_STATE_NAME StateName, + _In_opt_ PCWNF_TYPE_ID TypeId, + _In_reads_bytes_opt_(Length) const VOID* Buffer, + _In_opt_ ULONG Length, + _In_opt_ const VOID* ExplicitScope + ); + +NTSYSAPI +NTSTATUS +NTAPI +RtlSubscribeWnfStateChangeNotification( + _Outptr_ PVOID* SubscriptionHandle, // PWNF_USER_SUBSCRIPTION + _In_ WNF_STATE_NAME StateName, + _In_ WNF_CHANGE_STAMP ChangeStamp, + _In_ PWNF_USER_CALLBACK Callback, + _In_opt_ PVOID CallbackContext, + _In_opt_ PCWNF_TYPE_ID TypeId, + _In_opt_ ULONG SerializationGroup, + _Reserved_ ULONG Flags + ); + +NTSYSAPI +NTSTATUS +NTAPI +RtlUnsubscribeWnfStateChangeNotification( + _In_ PWNF_USER_CALLBACK Callback + ); + +#endif + +#if (PHNT_VERSION >= PHNT_WIN11) + +NTSYSCALLAPI +NTSTATUS +NTAPI +NtCopyFileChunk( + _In_ HANDLE SourceHandle, + _In_ HANDLE DestinationHandle, + _In_opt_ HANDLE EventHandle, + _Out_ PIO_STATUS_BLOCK IoStatusBlock, + _In_ ULONG Length, + _In_ PLARGE_INTEGER SourceOffset, + _In_ PLARGE_INTEGER DestOffset, + _In_opt_ PULONG SourceKey, + _In_opt_ PULONG DestKey, + _In_ ULONG Flags + ); + +#endif + +#if (PHNT_VERSION >= PHNT_WIN11) +// rev +NTSYSAPI +NTSTATUS +NTAPI +RtlQueryPropertyStore( + _In_ ULONG_PTR Key, + _Out_ PULONG_PTR Context + ); + +// rev +NTSYSAPI +NTSTATUS +NTAPI +RtlRemovePropertyStore( + _In_ ULONG_PTR Key, + _Out_ PULONG_PTR Context + ); + +// rev +NTSYSAPI +NTSTATUS +NTAPI +RtlCompareExchangePropertyStore( + _In_ ULONG_PTR Key, + _In_ PULONG_PTR Comperand, + _In_opt_ PULONG_PTR Exchange, + _Out_ PULONG_PTR Context + ); +#endif + +#if (PHNT_VERSION >= PHNT_WIN11) +typedef enum _THREAD_STATE_CHANGE_TYPE THREAD_STATE_CHANGE_TYPE, *PTHREAD_STATE_CHANGE_TYPE; + +// rev +NTSYSAPI +NTSTATUS +NTAPI +RtlWow64ChangeThreadState( + _In_ HANDLE ThreadStateChangeHandle, + _In_ HANDLE ThreadHandle, + _In_ THREAD_STATE_CHANGE_TYPE StateChangeType, + _In_opt_ PVOID ExtendedInformation, + _In_opt_ SIZE_T ExtendedInformationLength, + _In_opt_ ULONG64 Reserved + ); +#endif + +#endif // _NTRTL_H + +/* + * RTL forward symbol typedefs + * + * This file is part of System Informer. + */ +#ifndef _NTRTL_FWD_H +#define _NTRTL_FWD_H + +// begin_forwarders +#ifndef PHNT_INLINE_NAME_FORWARDERS +#define RtlGetNativeSystemInformation NtQuerySystemInformation +#define RtlGetTickCount NtGetTickCount +#define RtlGuardRestoreContext RtlRestoreContext +#define RtlRandom RtlRandomEx +#define RtlOpenImageFileOptionsKey LdrOpenImageFileOptionsKey +#define RtlQueryImageFileExecutionOptions LdrQueryImageFileExecutionOptionsEx +#define RtlQueryImageFileKeyOption LdrQueryImageFileKeyOption +#define RtlSetTimer RtlCreateTimer +#define RtlRestoreLastWin32Error RtlSetLastWin32Error +#endif + +#ifndef PHNT_INLINE_PEB_FORWARDERS +FORCEINLINE +PPEB +NTAPI +RtlGetCurrentPeb( + VOID + ) +{ + return NtCurrentPeb(); +} + +FORCEINLINE +NTSTATUS +NTAPI +RtlAcquirePebLock( + VOID + ) +{ + return RtlEnterCriticalSection(NtCurrentPeb()->FastPebLock); +} + +FORCEINLINE +NTSTATUS +NTAPI +RtlReleasePebLock( + VOID + ) +{ + return RtlLeaveCriticalSection(NtCurrentPeb()->FastPebLock); +} +#endif + +#ifndef PHNT_INLINE_FREE_FORWARDERS +//#define RtlFreeUnicodeString(UnicodeString) {if ((UnicodeString)->Buffer) RtlFreeHeap(RtlProcessHeap(), 0, (UnicodeString)->Buffer); memset(UnicodeString, 0, sizeof(UNICODE_STRING));} +FORCEINLINE +VOID +NTAPI +RtlFreeUnicodeString( + _Inout_ _At_(UnicodeString->Buffer, _Frees_ptr_opt_) PUNICODE_STRING UnicodeString + ) +{ + if (UnicodeString->Buffer) + { + RtlFreeHeap(RtlProcessHeap(), 0, UnicodeString->Buffer); + memset(UnicodeString, 0, sizeof(UNICODE_STRING)); + } +} + +//#define RtlFreeAnsiString(UnicodeString) {if ((AnsiString)->Buffer) RtlFreeHeap(RtlProcessHeap(), 0, (AnsiString)->Buffer); memset(AnsiString, 0, sizeof(ANSI_STRING));} +FORCEINLINE +VOID +NTAPI +RtlFreeAnsiString( + _Inout_ _At_(AnsiString->Buffer, _Frees_ptr_opt_) PANSI_STRING AnsiString + ) +{ + if (AnsiString->Buffer) + { + RtlFreeHeap(RtlProcessHeap(), 0, AnsiString->Buffer); + memset(AnsiString, 0, sizeof(ANSI_STRING)); + } +} + +//#define RtlFreeUTF8String(Utf8String) {if ((Utf8String)->Buffer) RtlFreeHeap(RtlProcessHeap(), 0, (Utf8String)->Buffer); memset(Utf8String, 0, sizeof(UTF8_STRING));} +FORCEINLINE +VOID +NTAPI +RtlFreeUTF8String( + _Inout_ _At_(Utf8String->Buffer, _Frees_ptr_opt_) PUTF8_STRING Utf8String + ) +{ + if (Utf8String->Buffer) + { + RtlFreeHeap(RtlProcessHeap(), 0, Utf8String->Buffer); + memset(Utf8String, 0, sizeof(UTF8_STRING)); + } +} + +//#define RtlFreeSid(Sid) RtlFreeHeap(RtlProcessHeap(), 0, (Sid)) +FORCEINLINE +PVOID +NTAPI +RtlFreeSid( + _In_ _Post_invalid_ PSID Sid + ) +{ + RtlFreeHeap(RtlProcessHeap(), 0, Sid); + return NULL; +} + +//#define RtlDeleteBoundaryDescriptor(BoundaryDescriptor) RtlFreeHeap(RtlProcessHeap(), 0, (BoundaryDescriptor)) +FORCEINLINE +VOID +NTAPI +RtlDeleteBoundaryDescriptor( + _In_ _Post_invalid_ POBJECT_BOUNDARY_DESCRIPTOR BoundaryDescriptor + ) +{ + RtlFreeHeap(RtlProcessHeap(), 0, BoundaryDescriptor); +} + +//#define RtlDeleteSecurityObject(ObjectDescriptor) RtlFreeHeap(RtlProcessHeap(), 0, *(ObjectDescriptor)) +//FORCEINLINE +//NTSTATUS +//RtlDeleteSecurityObject( +// _Inout_ PSECURITY_DESCRIPTOR *ObjectDescriptor +// ) +//{ +// RtlFreeHeap(RtlProcessHeap(), 0, *ObjectDescriptor); +// return STATUS_SUCCESS; +//} + +//#define RtlDestroyEnvironment(Environment) RtlFreeHeap(RtlProcessHeap(), 0, (Environment)) +FORCEINLINE +NTSTATUS +NTAPI +RtlDestroyEnvironment( + _In_ _Post_invalid_ PVOID Environment + ) +{ + RtlFreeHeap(RtlProcessHeap(), 0, Environment); + return STATUS_SUCCESS; +} + +//#define RtlDestroyProcessParameters(ProcessParameters) RtlFreeHeap(RtlProcessHeap(), 0, (ProcessParameters)) +FORCEINLINE +NTSTATUS +NTAPI +RtlDestroyProcessParameters( + _In_ _Post_invalid_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters + ) +{ + RtlFreeHeap(RtlProcessHeap(), 0, ProcessParameters); + return STATUS_SUCCESS; +} +#endif +// end_forwarders + +#endif // _NTRTL_FWD_H diff --git a/ntsam.h b/ntsam.h index 4b6d21b..7d32476 100644 --- a/ntsam.h +++ b/ntsam.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Security Account Manager support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTSAM_H @@ -115,6 +110,8 @@ SamRidToSid( #define SAM_SERVER_EXECUTE (STANDARD_RIGHTS_EXECUTE | \ SAM_SERVER_CONNECT | \ SAM_SERVER_LOOKUP_DOMAIN) + +typedef struct _RPC_AUTH_IDENTITY_HANDLE *PRPC_AUTH_IDENTITY_HANDLE; // Functions @@ -136,7 +133,7 @@ SamConnectWithCreds( _Out_ PSAM_HANDLE ServerHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, - _In_ struct _RPC_AUTH_IDENTITY_HANDLE* Creds, + _In_ PRPC_AUTH_IDENTITY_HANDLE Creds, _In_ PWCHAR Spn, _Out_ BOOL* pfDstIsW2K ); @@ -721,7 +718,7 @@ typedef struct _ALIAS_GENERAL_INFORMATION UNICODE_STRING Name; ULONG MemberCount; UNICODE_STRING AdminComment; -} ALIAS_GENERAL_INFORMATION, *PALIAS_GENERAL_INFORMATION; +} ALIAS_GENERAL_INFORMATION, *PALIAS_GENERAL_INFORMATION; typedef struct _ALIAS_NAME_INFORMATION { @@ -1064,13 +1061,13 @@ typedef struct _USER_LOGON_INFORMATION USHORT BadPasswordCount; USHORT LogonCount; ULONG UserAccountControl; -} USER_LOGON_INFORMATION, * PUSER_LOGON_INFORMATION; +} USER_LOGON_INFORMATION, *PUSER_LOGON_INFORMATION; #include typedef struct _USER_LOGON_HOURS_INFORMATION { LOGON_HOURS LogonHours; -} USER_LOGON_HOURS_INFORMATION, * PUSER_LOGON_HOURS_INFORMATION; +} USER_LOGON_HOURS_INFORMATION, *PUSER_LOGON_HOURS_INFORMATION; #include typedef struct _USER_ACCOUNT_INFORMATION @@ -1093,7 +1090,7 @@ typedef struct _USER_ACCOUNT_INFORMATION LARGE_INTEGER PasswordLastSet; LARGE_INTEGER AccountExpires; ULONG UserAccountControl; -} USER_ACCOUNT_INFORMATION, * PUSER_ACCOUNT_INFORMATION; +} USER_ACCOUNT_INFORMATION, *PUSER_ACCOUNT_INFORMATION; #include typedef struct _USER_NAME_INFORMATION @@ -1501,7 +1498,7 @@ typedef struct _USER_PWD_CHANGE_FAILURE_INFORMATION { ULONG ExtendedFailureReason; UNICODE_STRING FilterModuleName; -} USER_PWD_CHANGE_FAILURE_INFORMATION,*PUSER_PWD_CHANGE_FAILURE_INFORMATION; +} USER_PWD_CHANGE_FAILURE_INFORMATION, *PUSER_PWD_CHANGE_FAILURE_INFORMATION; // ExtendedFailureReason values @@ -1828,7 +1825,7 @@ typedef struct _SAM_VALIDATE_PASSWORD_RESET_INPUT_ARG SAM_VALIDATE_PASSWORD_HASH HashedPassword; BOOLEAN PasswordMustChangeAtNextLogon; // looked at only for password reset BOOLEAN ClearLockout; // can be used clear user account lockout -}SAM_VALIDATE_PASSWORD_RESET_INPUT_ARG, *PSAM_VALIDATE_PASSWORD_RESET_INPUT_ARG; +} SAM_VALIDATE_PASSWORD_RESET_INPUT_ARG, *PSAM_VALIDATE_PASSWORD_RESET_INPUT_ARG; typedef union _SAM_VALIDATE_INPUT_ARG { diff --git a/ntseapi.h b/ntseapi.h index f484601..a572d8a 100644 --- a/ntseapi.h +++ b/ntseapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Authorization functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTSEAPI_H @@ -60,7 +55,7 @@ #if (PHNT_MODE == PHNT_MODE_KERNEL) typedef enum _TOKEN_INFORMATION_CLASS { - TokenUser = 1, // q: TOKEN_USER + TokenUser = 1, // q: TOKEN_USER, SE_TOKEN_USER TokenGroups, // q: TOKEN_GROUPS TokenPrivileges, // q: TOKEN_PRIVILEGES TokenOwner, // q; s: TOKEN_OWNER @@ -85,10 +80,10 @@ typedef enum _TOKEN_INFORMATION_CLASS TokenVirtualizationAllowed, // q; s: ULONG (requires SeCreateTokenPrivilege) TokenVirtualizationEnabled, // q; s: ULONG TokenIntegrityLevel, // q; s: TOKEN_MANDATORY_LABEL - TokenUIAccess, // q; s: ULONG + TokenUIAccess, // q; s: ULONG (requires SeTcbPrivilege) TokenMandatoryPolicy, // q; s: TOKEN_MANDATORY_POLICY (requires SeTcbPrivilege) TokenLogonSid, // q: TOKEN_GROUPS - TokenIsAppContainer, // q: ULONG + TokenIsAppContainer, // q: ULONG // since WIN8 TokenCapabilities, // q: TOKEN_GROUPS // 30 TokenAppContainerSid, // q: TOKEN_APPCONTAINER_INFORMATION TokenAppContainerNumber, // q: ULONG @@ -98,16 +93,16 @@ typedef enum _TOKEN_INFORMATION_CLASS TokenRestrictedDeviceClaimAttributes, // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION TokenDeviceGroups, // q: TOKEN_GROUPS TokenRestrictedDeviceGroups, // q: TOKEN_GROUPS - TokenSecurityAttributes, // q; s: TOKEN_SECURITY_ATTRIBUTES_[AND_OPERATION_]INFORMATION + TokenSecurityAttributes, // q; s: TOKEN_SECURITY_ATTRIBUTES_[AND_OPERATION_]INFORMATION (requires SeTcbPrivilege) TokenIsRestricted, // q: ULONG // 40 - TokenProcessTrustLevel, // q: TOKEN_PROCESS_TRUST_LEVEL - TokenPrivateNameSpace, // q; s: ULONG - TokenSingletonAttributes, // q: TOKEN_SECURITY_ATTRIBUTES_INFORMATION - TokenBnoIsolation, // q: TOKEN_BNO_ISOLATION_INFORMATION - TokenChildProcessFlags, // s: ULONG - TokenIsLessPrivilegedAppContainer, // q: ULONG - TokenIsSandboxed, // q: ULONG - TokenIsAppSilo, // TokenOriginatingProcessTrustLevel // q: TOKEN_PROCESS_TRUST_LEVEL + TokenProcessTrustLevel, // q: TOKEN_PROCESS_TRUST_LEVEL // since WINBLUE + TokenPrivateNameSpace, // q; s: ULONG (requires SeTcbPrivilege) // since THRESHOLD + TokenSingletonAttributes, // q: TOKEN_SECURITY_ATTRIBUTES_INFORMATION // since REDSTONE + TokenBnoIsolation, // q: TOKEN_BNO_ISOLATION_INFORMATION // since REDSTONE2 + TokenChildProcessFlags, // s: ULONG (requires SeTcbPrivilege) // since REDSTONE3 + TokenIsLessPrivilegedAppContainer, // q: ULONG // since REDSTONE5 + TokenIsSandboxed, // q: ULONG // since 19H1 + TokenIsAppSilo, // q: ULONG // since WIN11 22H2 // previously TokenOriginatingProcessTrustLevel // q: TOKEN_PROCESS_TRUST_LEVEL MaxTokenInfoClass } TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS; #endif @@ -527,7 +522,7 @@ NtAccessCheckByTypeResultList( // Signing -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WIN8) NTSYSCALLAPI NTSTATUS @@ -552,6 +547,42 @@ NtGetCachedSigningLevel( _Out_opt_ PULONG ThumbprintAlgorithm ); +#endif + +#if (PHNT_VERSION >= PHNT_REDSTONE) + +// rev +typedef struct _SE_FILE_CACHE_CLAIM_INFORMATION +{ + ULONG Size; + PVOID Claim; +} SE_FILE_CACHE_CLAIM_INFORMATION, *PSE_FILE_CACHE_CLAIM_INFORMATION; + +// rev +typedef struct _SE_SET_FILE_CACHE_INFORMATION +{ + ULONG Size; + UNICODE_STRING CatalogDirectoryPath; + SE_FILE_CACHE_CLAIM_INFORMATION OriginClaimInfo; +} SE_SET_FILE_CACHE_INFORMATION, *PSE_SET_FILE_CACHE_INFORMATION; + +// rev +NTSYSCALLAPI +NTSTATUS +NTAPI +NtSetCachedSigningLevel2( + _In_ ULONG Flags, + _In_ SE_SIGNING_LEVEL InputSigningLevel, + _In_reads_(SourceFileCount) PHANDLE SourceFiles, + _In_ ULONG SourceFileCount, + _In_opt_ HANDLE TargetFile, + _In_opt_ SE_SET_FILE_CACHE_INFORMATION* CacheInformation + ); + +#endif + +#if (PHNT_VERSION >= PHNT_REDSTONE2) + // rev NTSYSCALLAPI NTSTATUS diff --git a/ntsmss.h b/ntsmss.h index 3731e88..7fc1752 100644 --- a/ntsmss.h +++ b/ntsmss.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Windows Session Manager support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTSMSS_H diff --git a/ntsxs.h b/ntsxs.h new file mode 100644 index 0000000..4d12150 --- /dev/null +++ b/ntsxs.h @@ -0,0 +1,515 @@ +/* + * Side-by-side assembly support definitions. + * + * This file is part of System Informer. + */ + +#ifndef _NTSXS_H +#define _NTSXS_H + +#define ACTIVATION_CONTEXT_DATA_MAGIC ('xtcA') +#define ACTIVATION_CONTEXT_DATA_FORMAT_WHISTLER 1 + +#define ACTIVATION_CONTEXT_FLAG_NO_INHERIT 0x00000001 + +#if (PHNT_MODE == PHNT_MODE_KERNEL) +typedef enum _ACTCTX_REQUESTED_RUN_LEVEL +{ + ACTCTX_RUN_LEVEL_UNSPECIFIED = 0, + ACTCTX_RUN_LEVEL_AS_INVOKER, + ACTCTX_RUN_LEVEL_HIGHEST_AVAILABLE, + ACTCTX_RUN_LEVEL_REQUIRE_ADMIN, + ACTCTX_RUN_LEVEL_NUMBERS +} ACTCTX_REQUESTED_RUN_LEVEL; + +typedef enum _ACTCTX_COMPATIBILITY_ELEMENT_TYPE +{ + ACTCTX_COMPATIBILITY_ELEMENT_TYPE_UNKNOWN = 0, + ACTCTX_COMPATIBILITY_ELEMENT_TYPE_OS, + ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MITIGATION, + ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MAXVERSIONTESTED +} ACTCTX_COMPATIBILITY_ELEMENT_TYPE; +#endif + +#include + +typedef struct _ACTIVATION_CONTEXT_DATA +{ + ULONG Magic; + ULONG HeaderSize; + ULONG FormatVersion; + ULONG TotalSize; + ULONG DefaultTocOffset; // to ACTIVATION_CONTEXT_DATA_TOC_HEADER + ULONG ExtendedTocOffset; // to ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_HEADER + ULONG AssemblyRosterOffset; // to ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_HEADER + ULONG Flags; // ACTIVATION_CONTEXT_FLAG_* +} ACTIVATION_CONTEXT_DATA, *PACTIVATION_CONTEXT_DATA; + +#define ACTIVATION_CONTEXT_DATA_TOC_HEADER_DENSE 0x00000001 +#define ACTIVATION_CONTEXT_DATA_TOC_HEADER_INORDER 0x00000002 + +typedef struct _ACTIVATION_CONTEXT_DATA_TOC_HEADER +{ + ULONG HeaderSize; + ULONG EntryCount; + ULONG FirstEntryOffset; // to ACTIVATION_CONTEXT_DATA_TOC_ENTRY[], from ACTIVATION_CONTEXT_DATA base + ULONG Flags; // ACTIVATION_CONTEXT_DATA_TOC_HEADER_* +} ACTIVATION_CONTEXT_DATA_TOC_HEADER, *PACTIVATION_CONTEXT_DATA_TOC_HEADER; + +typedef struct _ACTIVATION_CONTEXT_DATA_TOC_ENTRY +{ + ULONG Id; // ACTIVATION_CONTEXT_SECTION_* + ULONG Offset; // to ACTIVATION_CONTEXT_*_SECTION_HEADER, from ACTIVATION_CONTEXT_DATA base + ULONG Length; + ULONG Format; // ACTIVATION_CONTEXT_SECTION_FORMAT_* +} ACTIVATION_CONTEXT_DATA_TOC_ENTRY, *PACTIVATION_CONTEXT_DATA_TOC_ENTRY; + +typedef struct _ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_HEADER +{ + ULONG HeaderSize; + ULONG EntryCount; + ULONG FirstEntryOffset; // to ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_ENTRY[], from ACTIVATION_CONTEXT_DATA base + ULONG Flags; +} ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_HEADER, *PACTIVATION_CONTEXT_DATA_EXTENDED_TOC_HEADER; + +typedef struct _ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_ENTRY +{ + GUID ExtensionGuid; + ULONG TocOffset; // to ACTIVATION_CONTEXT_DATA_TOC_HEADER, from ACTIVATION_CONTEXT_DATA base + ULONG Length; +} ACTIVATION_CONTEXT_DATA_EXTENDED_TOC_ENTRY, *PACTIVATION_CONTEXT_DATA_EXTENDED_TOC_ENTRY; + +#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY_INVALID 0x00000001 +#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY_ROOT 0x00000002 + +typedef struct _ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_HEADER +{ + ULONG HeaderSize; + ULONG HashAlgorithm; // HASH_STRING_ALGORITHM_* + ULONG EntryCount; + ULONG FirstEntryOffset; // to ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY[], from ACTIVATION_CONTEXT_DATA base + ULONG AssemblyInformationSectionOffset; // to resolve section-relative offsets +} ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_HEADER, *PACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_HEADER; + +typedef struct _ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY +{ + ULONG Flags; + ULONG PseudoKey; + ULONG AssemblyNameOffset; // to WCHAR[], from ACTIVATION_CONTEXT_DATA base + ULONG AssemblyNameLength; + ULONG AssemblyInformationOffset; // to ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION, from ACTIVATION_CONTEXT_DATA base + ULONG AssemblyInformationLength; +} ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY, *PACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY; + +#define ACTIVATION_CONTEXT_SECTION_FORMAT_UNKNOWN 0 +#define ACTIVATION_CONTEXT_SECTION_FORMAT_STRING_TABLE 1 // ACTIVATION_CONTEXT_STRING_SECTION_HEADER +#define ACTIVATION_CONTEXT_SECTION_FORMAT_GUID_TABLE 2 // ACTIVATION_CONTEXT_GUID_SECTION_HEADER + +#define ACTIVATION_CONTEXT_STRING_SECTION_MAGIC ('dHsS') +#define ACTIVATION_CONTEXT_STRING_SECTION_FORMAT_WHISTLER 1 + +#define ACTIVATION_CONTEXT_STRING_SECTION_CASE_INSENSITIVE 0x00000001 +#define ACTIVATION_CONTEXT_STRING_SECTION_ENTRIES_IN_PSEUDOKEY_ORDER 0x00000002 + +typedef struct _ACTIVATION_CONTEXT_STRING_SECTION_HEADER +{ + ULONG Magic; + ULONG HeaderSize; + ULONG FormatVersion; + ULONG DataFormatVersion; + ULONG Flags; // ACTIVATION_CONTEXT_STRING_SECTION_* + ULONG ElementCount; + ULONG ElementListOffset; // to ACTIVATION_CONTEXT_STRING_SECTION_ENTRY[], from this struct base + ULONG HashAlgorithm; // HASH_STRING_ALGORITHM_* + ULONG SearchStructureOffset; // to ACTIVATION_CONTEXT_STRING_SECTION_HASH_TABLE, from this struct base + ULONG UserDataOffset; // to data depending on section Id, from this struct base + ULONG UserDataSize; +} ACTIVATION_CONTEXT_STRING_SECTION_HEADER, *PACTIVATION_CONTEXT_STRING_SECTION_HEADER; + +typedef struct _ACTIVATION_CONTEXT_STRING_SECTION_ENTRY +{ + ULONG PseudoKey; + ULONG KeyOffset; // to WCHAR[], from section header + ULONG KeyLength; + ULONG Offset; // to data depending on section Id, from section header + ULONG Length; + ULONG AssemblyRosterIndex; +} ACTIVATION_CONTEXT_STRING_SECTION_ENTRY, *PACTIVATION_CONTEXT_STRING_SECTION_ENTRY; + +typedef struct _ACTIVATION_CONTEXT_STRING_SECTION_HASH_TABLE +{ + ULONG BucketTableEntryCount; + ULONG BucketTableOffset; // to ACTIVATION_CONTEXT_STRING_SECTION_HASH_BUCKET[], from section header +} ACTIVATION_CONTEXT_STRING_SECTION_HASH_TABLE, *PACTIVATION_CONTEXT_STRING_SECTION_HASH_TABLE; + +typedef struct _ACTIVATION_CONTEXT_STRING_SECTION_HASH_BUCKET +{ + ULONG ChainCount; + ULONG ChainOffset; // to LONG[], from section header +} ACTIVATION_CONTEXT_STRING_SECTION_HASH_BUCKET, *PACTIVATION_CONTEXT_STRING_SECTION_HASH_BUCKET; + +#define ACTIVATION_CONTEXT_GUID_SECTION_MAGIC ('dHsG') +#define ACTIVATION_CONTEXT_GUID_SECTION_FORMAT_WHISTLER 1 + +#define ACTIVATION_CONTEXT_GUID_SECTION_ENTRIES_IN_ORDER 0x00000001 + +typedef struct _ACTIVATION_CONTEXT_GUID_SECTION_HEADER +{ + ULONG Magic; + ULONG HeaderSize; + ULONG FormatVersion; + ULONG DataFormatVersion; + ULONG Flags; // ACTIVATION_CONTEXT_GUID_SECTION_* + ULONG ElementCount; + ULONG ElementListOffset; // to ACTIVATION_CONTEXT_GUID_SECTION_ENTRY[], from this struct base + ULONG SearchStructureOffset; // to ACTIVATION_CONTEXT_GUID_SECTION_HASH_TABLE, from this struct base + ULONG UserDataOffset; // to data depending on section Id, from this struct base + ULONG UserDataSize; +} ACTIVATION_CONTEXT_GUID_SECTION_HEADER, *PACTIVATION_CONTEXT_GUID_SECTION_HEADER; + +typedef struct _ACTIVATION_CONTEXT_GUID_SECTION_ENTRY +{ + GUID Guid; + ULONG Offset; // to data depending on section Id, from section header + ULONG Length; + ULONG AssemblyRosterIndex; +} ACTIVATION_CONTEXT_GUID_SECTION_ENTRY, *PACTIVATION_CONTEXT_GUID_SECTION_ENTRY; + +typedef struct _ACTIVATION_CONTEXT_GUID_SECTION_HASH_TABLE +{ + ULONG BucketTableEntryCount; + ULONG BucketTableOffset; // to ACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET, from section header +} ACTIVATION_CONTEXT_GUID_SECTION_HASH_TABLE, *PACTIVATION_CONTEXT_GUID_SECTION_HASH_TABLE; + +typedef struct _ACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET +{ + ULONG ChainCount; + ULONG ChainOffset; // to LONG[], from section header +} ACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET, *PACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET; + +// winnt.h - known section IDs +// #define ACTIVATION_CONTEXT_SECTION_ASSEMBLY_INFORMATION (1) // ACTIVATION_CONTEXT_SECTION_ASSEMBLY_INFORMATION + ACTIVATION_CONTEXT_DATA_ASSEMBLY_GLOBAL_INFORMATION +// #define ACTIVATION_CONTEXT_SECTION_DLL_REDIRECTION (2) // ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION +// #define ACTIVATION_CONTEXT_SECTION_WINDOW_CLASS_REDIRECTION (3) // ACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION +// #define ACTIVATION_CONTEXT_SECTION_COM_SERVER_REDIRECTION (4) // ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION +// #define ACTIVATION_CONTEXT_SECTION_COM_INTERFACE_REDIRECTION (5) // ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION +// #define ACTIVATION_CONTEXT_SECTION_COM_TYPE_LIBRARY_REDIRECTION (6) // ACTIVATION_CONTEXT_DATA_COM_TYPE_LIBRARY_REDIRECTION +// #define ACTIVATION_CONTEXT_SECTION_COM_PROGID_REDIRECTION (7) // ACTIVATION_CONTEXT_DATA_COM_PROGID_REDIRECTION +// #define ACTIVATION_CONTEXT_SECTION_GLOBAL_OBJECT_RENAME_TABLE (8) +// #define ACTIVATION_CONTEXT_SECTION_CLR_SURROGATES (9) // ACTIVATION_CONTEXT_DATA_CLR_SURROGATE +// #define ACTIVATION_CONTEXT_SECTION_APPLICATION_SETTINGS (10) // ACTIVATION_CONTEXT_DATA_APPLICATION_SETTINGS +// #define ACTIVATION_CONTEXT_SECTION_COMPATIBILITY_INFO (11) // ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION[_LEGACY] +// #define ACTIVATION_CONTEXT_SECTION_WINRT_ACTIVATABLE_CLASSES (12) // since 19H1 + +#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_FORMAT_WHISTLER 1 + +#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_ROOT_ASSEMBLY 0x00000001 +#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_POLICY_APPLIED 0x00000002 +#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_ASSEMBLY_POLICY_APPLIED 0x00000004 +#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_ROOT_POLICY_APPLIED 0x00000008 +#define ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_PRIVATE_ASSEMBLY 0x00000010 + +typedef struct _ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION +{ + ULONG Size; + ULONG Flags; // ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_* + ULONG EncodedAssemblyIdentityLength; + ULONG EncodedAssemblyIdentityOffset; // to WCHAR[], from section header + ULONG ManifestPathType; // ACTIVATION_CONTEXT_PATH_TYPE_* + ULONG ManifestPathLength; + ULONG ManifestPathOffset; // to WCHAR[], from section header + LARGE_INTEGER ManifestLastWriteTime; + ULONG PolicyPathType; // ACTIVATION_CONTEXT_PATH_TYPE_* + ULONG PolicyPathLength; + ULONG PolicyPathOffset; // to WCHAR[], from section header + LARGE_INTEGER PolicyLastWriteTime; + ULONG MetadataSatelliteRosterIndex; + ULONG Unused2; + ULONG ManifestVersionMajor; + ULONG ManifestVersionMinor; + ULONG PolicyVersionMajor; + ULONG PolicyVersionMinor; + ULONG AssemblyDirectoryNameLength; + ULONG AssemblyDirectoryNameOffset; // to WCHAR[], from section header + ULONG NumOfFilesInAssembly; + ULONG LanguageLength; + ULONG LanguageOffset; // to WCHAR[], from section header + ACTCTX_REQUESTED_RUN_LEVEL RunLevel; + ULONG UiAccess; +} ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION, *PACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION; + +// via UserData +typedef struct _ACTIVATION_CONTEXT_DATA_ASSEMBLY_GLOBAL_INFORMATION +{ + ULONG Size; + ULONG Flags; + GUID PolicyCoherencyGuid; + GUID PolicyOverrideGuid; + ULONG ApplicationDirectoryPathType; // ACTIVATION_CONTEXT_PATH_TYPE_* + ULONG ApplicationDirectoryLength; + ULONG ApplicationDirectoryOffset; // to WCHAR[], from this struct base + ULONG ResourceName; +} ACTIVATION_CONTEXT_DATA_ASSEMBLY_GLOBAL_INFORMATION, *PACTIVATION_CONTEXT_DATA_ASSEMBLY_GLOBAL_INFORMATION; + +#define ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_FORMAT_WHISTLER 1 + +#define ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_INCLUDES_BASE_NAME 0x00000001 +#define ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_OMITS_ASSEMBLY_ROOT 0x00000002 +#define ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_EXPAND 0x00000004 +#define ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_SYSTEM_DEFAULT_REDIRECTED_SYSTEM32_DLL 0x00000008 + +typedef struct _ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION +{ + ULONG Size; + ULONG Flags; // ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_* + ULONG TotalPathLength; + ULONG PathSegmentCount; + ULONG PathSegmentOffset; // to ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_SEGMENT[], from section header +} ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION, *PACTIVATION_CONTEXT_DATA_DLL_REDIRECTION; + +typedef struct _ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_SEGMENT +{ + ULONG Length; + ULONG Offset; // to WCHAR[], from section header +} ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_SEGMENT, *PACTIVATION_CONTEXT_DATA_DLL_REDIRECTION_PATH_SEGMENT; + +#define ACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION_FORMAT_WHISTLER 1 + +typedef struct _ACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION +{ + ULONG Size; + ULONG Flags; + ULONG VersionSpecificClassNameLength; + ULONG VersionSpecificClassNameOffset; // to WHCAR[], from this struct base + ULONG DllNameLength; + ULONG DllNameOffset; // to WCHAR[], from section header +} ACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION, *PACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION; + +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_FORMAT_WHISTLER 1 + +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_INVALID 0 +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_APARTMENT 1 +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_FREE 2 +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_SINGLE 3 +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_BOTH 4 +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_NEUTRAL 5 + +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_FLAG_OFFSET 8 +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_HAS_DEFAULT (0x01 << ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_FLAG_OFFSET) +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_HAS_ICON (0x02 << ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_FLAG_OFFSET) +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_HAS_CONTENT (0x04 << ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_FLAG_OFFSET) +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_HAS_THUMBNAIL (0x08 << ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_FLAG_OFFSET) +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_HAS_DOCPRINT (0x10 << ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_FLAG_OFFSET) + +typedef struct _ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION +{ + ULONG Size; + ULONG Flags; + ULONG ThreadingModel; // ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_* + GUID ReferenceClsid; + GUID ConfiguredClsid; + GUID ImplementedClsid; + GUID TypeLibraryId; + ULONG ModuleLength; + ULONG ModuleOffset; // to WCHAR[], from section header + ULONG ProgIdLength; + ULONG ProgIdOffset; // to WCHAR[], from this struct base + ULONG ShimDataLength; + ULONG ShimDataOffset; // to ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM, from this struct base + ULONG MiscStatusDefault; + ULONG MiscStatusContent; + ULONG MiscStatusThumbnail; + ULONG MiscStatusIcon; + ULONG MiscStatusDocPrint; +} ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION, *PACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION; + +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM_TYPE_OTHER 1 +#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM_TYPE_CLR_CLASS 2 + +typedef struct _ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM +{ + ULONG Size; + ULONG Flags; + ULONG Type; // ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM_TYPE_* + ULONG ModuleLength; + ULONG ModuleOffset; // to WCHAR[], from section header + ULONG TypeLength; + ULONG TypeOffset; // to WCHAR[], from this struct base + ULONG ShimVersionLength; + ULONG ShimVersionOffset; // to WCHAR[], from this struct base + ULONG DataLength; + ULONG DataOffset; // from this struct base +} ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM, *PACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM; + +#define ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION_FORMAT_WHISTLER 1 + +#define ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION_FLAG_NUM_METHODS_VALID 0x00000001 +#define ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION_FLAG_BASE_INTERFACE_VALID 0x00000002 + +typedef struct _ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION +{ + ULONG Size; + ULONG Flags; // ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION_FLAG_* + GUID ProxyStubClsid32; + ULONG NumMethods; + GUID TypeLibraryId; + GUID BaseInterface; + ULONG NameLength; + ULONG NameOffset; // to WCHAR[], from this struct base +} ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION, *PACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION; + +#define ACTIVATION_CONTEXT_DATA_COM_TYPE_LIBRARY_REDIRECTION_FORMAT_WHISTLER 1 + +typedef struct _ACTIVATION_CONTEXT_DATA_TYPE_LIBRARY_VERSION +{ + USHORT Major; + USHORT Minor; +} ACTIVATION_CONTEXT_DATA_TYPE_LIBRARY_VERSION, *PACTIVATION_CONTEXT_DATA_TYPE_LIBRARY_VERSION; + +typedef struct _ACTIVATION_CONTEXT_DATA_COM_TYPE_LIBRARY_REDIRECTION +{ + ULONG Size; + ULONG Flags; + ULONG NameLength; + ULONG NameOffset; // to WCHAR[], from section header + USHORT ResourceId; + USHORT LibraryFlags; // LIBFLAG_* oaidl.h + ULONG HelpDirLength; + ULONG HelpDirOffset; // to WCHAR[], from this struct base + ACTIVATION_CONTEXT_DATA_TYPE_LIBRARY_VERSION Version; +} ACTIVATION_CONTEXT_DATA_COM_TYPE_LIBRARY_REDIRECTION, *PACTIVATION_CONTEXT_DATA_COM_TYPE_LIBRARY_REDIRECTION; + +#define ACTIVATION_CONTEXT_DATA_COM_PROGID_REDIRECTION_FORMAT_WHISTLER 1 + +typedef struct _ACTIVATION_CONTEXT_DATA_COM_PROGID_REDIRECTION +{ + ULONG Size; + ULONG Flags; + ULONG ConfiguredClsidOffset; // to CLSID, from section header +} ACTIVATION_CONTEXT_DATA_COM_PROGID_REDIRECTION, *PACTIVATION_CONTEXT_DATA_COM_PROGID_REDIRECTION; + +#define ACTIVATION_CONTEXT_DATA_CLR_SURROGATE_FORMAT_WHISTLER 1 + +typedef struct _ACTIVATION_CONTEXT_DATA_CLR_SURROGATE +{ + ULONG Size; + ULONG Flags; + GUID SurrogateIdent; + ULONG VersionOffset; + ULONG VersionLength; + ULONG TypeNameOffset; + ULONG TypeNameLength; // to WCHAR[], from this struct base +} ACTIVATION_CONTEXT_DATA_CLR_SURROGATE, *PACTIVATION_CONTEXT_DATA_CLR_SURROGATE; + +#define ACTIVATION_CONTEXT_DATA_APPLICATION_SETTINGS_FORMAT_LONGHORN 1 + +#define SXS_WINDOWS_SETTINGS_NAMESPACE L"http://schemas.microsoft.com/SMI/2005/WindowsSettings" +#define SXS_WINDOWS_SETTINGS_2011_NAMESPACE L"http://schemas.microsoft.com/SMI/2011/WindowsSettings" +#define SXS_WINDOWS_SETTINGS_2013_NAMESPACE L"http://schemas.microsoft.com/SMI/2013/WindowsSettings" +#define SXS_WINDOWS_SETTINGS_2014_NAMESPACE L"http://schemas.microsoft.com/SMI/2014/WindowsSettings" +#define SXS_WINDOWS_SETTINGS_2016_NAMESPACE L"http://schemas.microsoft.com/SMI/2016/WindowsSettings" +#define SXS_WINDOWS_SETTINGS_2017_NAMESPACE L"http://schemas.microsoft.com/SMI/2017/WindowsSettings" +#define SXS_WINDOWS_SETTINGS_2019_NAMESPACE L"http://schemas.microsoft.com/SMI/2019/WindowsSettings" +#define SXS_WINDOWS_SETTINGS_2020_NAMESPACE L"http://schemas.microsoft.com/SMI/2020/WindowsSettings" + +typedef struct _ACTIVATION_CONTEXT_DATA_APPLICATION_SETTINGS +{ + ULONG Size; + ULONG Flags; + ULONG SettingNamespaceLength; + ULONG SettingNamespaceOffset; // to WCHAR[], from this struct base + ULONG SettingNameLength; + ULONG SettingNameOffset; // to WCHAR[], from this struct base + ULONG SettingValueLength; + ULONG SettingValueOffset; // to WCHAR[], from this struct base +} ACTIVATION_CONTEXT_DATA_APPLICATION_SETTINGS, *PACTIVATION_CONTEXT_DATA_APPLICATION_SETTINGS; + +// COMPATIBILITY_CONTEXT_ELEMENT from winnt.h before 19H1 +typedef struct _COMPATIBILITY_CONTEXT_ELEMENT_LEGACY +{ + GUID Id; + ACTCTX_COMPATIBILITY_ELEMENT_TYPE Type; +} COMPATIBILITY_CONTEXT_ELEMENT_LEGACY, *PCOMPATIBILITY_CONTEXT_ELEMENT_LEGACY; + +// ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION from winnt.h before 19H1 +typedef struct _ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION_LEGACY +{ + DWORD ElementCount; + COMPATIBILITY_CONTEXT_ELEMENT_LEGACY Elements[ANYSIZE_ARRAY]; +} ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION_LEGACY, *PACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION_LEGACY; + +#include + +// begin_private + +typedef struct _ASSEMBLY_STORAGE_MAP_ENTRY +{ + ULONG Flags; + UNICODE_STRING DosPath; + HANDLE Handle; +} ASSEMBLY_STORAGE_MAP_ENTRY, *PASSEMBLY_STORAGE_MAP_ENTRY; + +#define ASSEMBLY_STORAGE_MAP_ASSEMBLY_ARRAY_IS_HEAP_ALLOCATED 0x00000001 + +typedef struct _ASSEMBLY_STORAGE_MAP +{ + ULONG Flags; + ULONG AssemblyCount; + PASSEMBLY_STORAGE_MAP_ENTRY *AssemblyArray; +} ASSEMBLY_STORAGE_MAP, *PASSEMBLY_STORAGE_MAP; + +typedef struct _ACTIVATION_CONTEXT *PACTIVATION_CONTEXT; + +#define ACTIVATION_CONTEXT_NOTIFICATION_DESTROY 1 +#define ACTIVATION_CONTEXT_NOTIFICATION_ZOMBIFY 2 +#define ACTIVATION_CONTEXT_NOTIFICATION_USED 3 + +typedef VOID (NTAPI *PACTIVATION_CONTEXT_NOTIFY_ROUTINE)( + _In_ ULONG NotificationType, // ACTIVATION_CONTEXT_NOTIFICATION_* + _In_ PACTIVATION_CONTEXT ActivationContext, + _In_ PACTIVATION_CONTEXT_DATA ActivationContextData, + _In_opt_ PVOID NotificationContext, + _In_opt_ PVOID NotificationData, + _Inout_ PBOOLEAN DisableThisNotification + ); + +typedef struct _ACTIVATION_CONTEXT +{ + LONG RefCount; + ULONG Flags; + PACTIVATION_CONTEXT_DATA ActivationContextData; + PACTIVATION_CONTEXT_NOTIFY_ROUTINE NotificationRoutine; + PVOID NotificationContext; + ULONG SentNotifications[8]; + ULONG DisabledNotifications[8]; + ASSEMBLY_STORAGE_MAP StorageMap; + PASSEMBLY_STORAGE_MAP_ENTRY InlineStorageMapEntries[32]; +} ACTIVATION_CONTEXT, *PACTIVATION_CONTEXT; + +#define RTL_ACTIVATION_CONTEXT_STACK_FRAME_FLAG_RELEASE_ON_DEACTIVATION 0x00000001 +#define RTL_ACTIVATION_CONTEXT_STACK_FRAME_FLAG_NO_DEACTIVATE 0x00000002 +#define RTL_ACTIVATION_CONTEXT_STACK_FRAME_FLAG_ON_FREE_LIST 0x00000004 +#define RTL_ACTIVATION_CONTEXT_STACK_FRAME_FLAG_HEAP_ALLOCATED 0x00000008 +#define RTL_ACTIVATION_CONTEXT_STACK_FRAME_FLAG_NOT_REALLY_ACTIVATED 0x00000010 + +typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME +{ + struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME *Previous; + PACTIVATION_CONTEXT ActivationContext; + ULONG Flags; // RTL_ACTIVATION_CONTEXT_STACK_FRAME_FLAG_* +} RTL_ACTIVATION_CONTEXT_STACK_FRAME, *PRTL_ACTIVATION_CONTEXT_STACK_FRAME; + +#define ACTIVATION_CONTEXT_STACK_FLAG_QUERIES_DISABLED 0x00000001 + +typedef struct _ACTIVATION_CONTEXT_STACK +{ + PRTL_ACTIVATION_CONTEXT_STACK_FRAME ActiveFrame; + LIST_ENTRY FrameListCache; + ULONG Flags; // ACTIVATION_CONTEXT_STACK_FLAG_* + ULONG NextCookieSequenceNumber; + ULONG StackId; +} ACTIVATION_CONTEXT_STACK, *PACTIVATION_CONTEXT_STACK; + +// end_private + +#endif diff --git a/nttmapi.h b/nttmapi.h index eff74c2..4e9e8ad 100644 --- a/nttmapi.h +++ b/nttmapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Transaction Manager support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTTMAPI_H @@ -133,7 +128,7 @@ NtOpenTransaction( _Out_ PHANDLE TransactionHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, - _In_opt_ LPGUID Uow, + _In_ LPGUID Uow, _In_opt_ HANDLE TmHandle ); #endif diff --git a/nttp.h b/nttp.h index 7954015..e4bd6ea 100644 --- a/nttp.h +++ b/nttp.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Thread Pool support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTTP_H @@ -33,8 +28,7 @@ typedef VOID (NTAPI *PTP_ALPC_CALLBACK_EX)( #if (PHNT_VERSION >= PHNT_VISTA) -// private -_Check_return_ +// winbase:CreateThreadpool NTSYSAPI NTSTATUS NTAPI @@ -60,7 +54,7 @@ TpSetPoolMaxThreads( _In_ ULONG MaxThreads ); -// private +// winbase:SetThreadpoolThreadMinimum NTSYSAPI NTSTATUS NTAPI @@ -70,7 +64,7 @@ TpSetPoolMinThreads( ); #if (PHNT_VERSION >= PHNT_WIN7) -// rev +// winbase:QueryThreadpoolStackInformation NTSYSAPI NTSTATUS NTAPI @@ -78,10 +72,8 @@ TpQueryPoolStackInformation( _In_ PTP_POOL Pool, _Out_ PTP_POOL_STACK_INFORMATION PoolStackInformation ); -#endif -#if (PHNT_VERSION >= PHNT_WIN7) -// rev +// winbase:SetThreadpoolStackInformation NTSYSAPI NTSTATUS NTAPI @@ -89,10 +81,18 @@ TpSetPoolStackInformation( _Inout_ PTP_POOL Pool, _In_ PTP_POOL_STACK_INFORMATION PoolStackInformation ); + +// rev +NTSYSAPI +NTSTATUS +NTAPI +TpSetPoolThreadBasePriority( + _Inout_ PTP_POOL Pool, + _In_ ULONG BasePriority + ); #endif -// private -_Check_return_ +// winbase:CreateThreadpoolCleanupGroup NTSYSAPI NTSTATUS NTAPI @@ -181,7 +181,6 @@ TpDisassociateCallback( ); // winbase:TrySubmitThreadpoolCallback -_Check_return_ NTSYSAPI NTSTATUS NTAPI @@ -191,8 +190,7 @@ TpSimpleTryPost( _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron ); -// private -_Check_return_ +// winbase:CreateThreadpoolWork NTSYSAPI NTSTATUS NTAPI @@ -228,8 +226,7 @@ TpWaitForWork( _In_ LOGICAL CancelPendingCallbacks ); -// private -_Check_return_ +// winbase:CreateThreadpoolTimer NTSYSAPI NTSTATUS NTAPI @@ -289,8 +286,7 @@ TpWaitForTimer( _In_ LOGICAL CancelPendingCallbacks ); -// private -_Check_return_ +// winbase:CreateThreadpoolWait NTSYSAPI NTSTATUS NTAPI @@ -350,8 +346,7 @@ typedef VOID (NTAPI *PTP_IO_CALLBACK)( _In_ PTP_IO Io ); -// private -_Check_return_ +// winbase:CreateThreadpoolIo NTSYSAPI NTSTATUS NTAPI diff --git a/ntwmi.h b/ntwmi.h new file mode 100644 index 0000000..f743940 --- /dev/null +++ b/ntwmi.h @@ -0,0 +1,5928 @@ +/* + * Trace Control support functions + * + * This file is part of System Informer. + */ + +#ifndef _NTWMI_H +#define _NTWMI_H + +EXTERN_C_START + +#ifndef _TRACEHANDLE_DEFINED +#define _TRACEHANDLE_DEFINED +typedef ULONG64 TRACEHANDLE, *PTRACEHANDLE; +#endif + +// +// Maximum supported buffer size in KB - Win8 (16MB) +// +// N.B. Prior to Win8 the value was 1MB (1024KB). +#define MIN_ETW_BUFFER_SIZE 1 // in KBytes +#define MAX_ETW_BUFFER_SIZE (16 * 1024) // in KBytes +#define MAX_ETW_BUFFER_SIZE_WIN7 (1 * 1024) // in KBytes +#define MAX_ETW_EVENT_SIZE 0xFFFF // MAX_USHORT + +// SystemTraceControlGuid +#define ETW_KERNEL_RUNDOWN_START 0x00000001 +#define ETW_KERNEL_RUNDOWN_STOP 0x00000002 +#define ETW_CKCL_RUNDOWN_START 0x00000004 +#define ETW_CKCL_RUNDOWN_STOP 0x00000008 +#define ETW_FILENAME_RUNDOWN 0x00000010 + +// +// Alignment macros +// +#define DEFAULT_TRACE_ALIGNMENT 8 // 8 byte alignment +#define ALIGN_TO_POWER2( x, n ) (((ULONG)(x) + ((n)-1)) & ~((ULONG)(n)-1)) + +// +// The predefined event groups or families for NT subsystems +// +#define EVENT_TRACE_GROUP_HEADER 0x0000 +#define EVENT_TRACE_GROUP_IO 0x0100 +#define EVENT_TRACE_GROUP_MEMORY 0x0200 +#define EVENT_TRACE_GROUP_PROCESS 0x0300 +#define EVENT_TRACE_GROUP_FILE 0x0400 +#define EVENT_TRACE_GROUP_THREAD 0x0500 +#define EVENT_TRACE_GROUP_TCPIP 0x0600 +#define EVENT_TRACE_GROUP_JOB 0x0700 +#define EVENT_TRACE_GROUP_UDPIP 0x0800 +#define EVENT_TRACE_GROUP_REGISTRY 0x0900 +#define EVENT_TRACE_GROUP_DBGPRINT 0x0A00 +#define EVENT_TRACE_GROUP_CONFIG 0x0B00 +#define EVENT_TRACE_GROUP_SPARE1 0x0C00 // Spare1 +#define EVENT_TRACE_GROUP_WNF 0x0D00 +#define EVENT_TRACE_GROUP_POOL 0x0E00 +#define EVENT_TRACE_GROUP_PERFINFO 0x0F00 +#define EVENT_TRACE_GROUP_HEAP 0x1000 +#define EVENT_TRACE_GROUP_OBJECT 0x1100 +#define EVENT_TRACE_GROUP_POWER 0x1200 +#define EVENT_TRACE_GROUP_MODBOUND 0x1300 +#define EVENT_TRACE_GROUP_IMAGE 0x1400 +#define EVENT_TRACE_GROUP_DPC 0x1500 +#define EVENT_TRACE_GROUP_CC 0x1600 +#define EVENT_TRACE_GROUP_CRITSEC 0x1700 +#define EVENT_TRACE_GROUP_STACKWALK 0x1800 +#define EVENT_TRACE_GROUP_UMS 0x1900 +#define EVENT_TRACE_GROUP_ALPC 0x1A00 +#define EVENT_TRACE_GROUP_SPLITIO 0x1B00 +#define EVENT_TRACE_GROUP_THREAD_POOL 0x1C00 +#define EVENT_TRACE_GROUP_HYPERVISOR 0x1D00 +#define EVENT_TRACE_GROUP_HYPERVISORX 0x1E00 + +// +// If you add any new groups, you must bump up MAX_KERNEL_TRACE_EVENTS +// and make sure post processing is fixed up. +// +#define MAX_KERNEL_TRACE_EVENTS 0x1F + +// +// The highest order bit of a data block is set if trace, WNODE otherwise +// +#define TRACE_HEADER_FLAG 0x80000000 + +// Header type for tracing messages +// | Marker(8) | Reserved(8) | Size(16) | MessageNumber(16) | Flags(16) +#define TRACE_MESSAGE 0x10000000 + +// | MARKER(16) | SIZE (16) | ULONG 32 | TIME_STAMP ... +#define TRACE_HEADER_ULONG32_TIME 0xB0000000 + +// +// The second bit is set if the trace is used by PM & CP (fixed headers) +// If not, the data block is used by for finer data for performance analysis +// +#define TRACE_HEADER_EVENT_TRACE 0x40000000 +// +// If set, the data block is SYSTEM_TRACE_HEADER +// +#define TRACE_HEADER_ENUM_MASK 0x00FF0000 + +// +// The following are various header type +// +#define TRACE_HEADER_TYPE_SYSTEM32 1 +#define TRACE_HEADER_TYPE_SYSTEM64 2 +#define TRACE_HEADER_TYPE_COMPACT32 3 +#define TRACE_HEADER_TYPE_COMPACT64 4 +#define TRACE_HEADER_TYPE_FULL_HEADER32 10 +#define TRACE_HEADER_TYPE_INSTANCE32 11 +#define TRACE_HEADER_TYPE_TIMED 12 // Not used +#define TRACE_HEADER_TYPE_ERROR 13 // Error while logging event +#define TRACE_HEADER_TYPE_WNODE_HEADER 14 // Not used +#define TRACE_HEADER_TYPE_MESSAGE 15 +#define TRACE_HEADER_TYPE_PERFINFO32 16 +#define TRACE_HEADER_TYPE_PERFINFO64 17 +#define TRACE_HEADER_TYPE_EVENT_HEADER32 18 +#define TRACE_HEADER_TYPE_EVENT_HEADER64 19 +#define TRACE_HEADER_TYPE_FULL_HEADER64 20 +#define TRACE_HEADER_TYPE_INSTANCE64 21 + +#define EVENT_HEADER_SIZE_MASK 0x0000FFFF + +#define SYSTEM_TRACE_VERSION 2 + +// +// The following two are used for defining LogFile layout version. +// +// 1.2 -- Add per-processor event streams. +// 1.3 -- Remove rundown and context/switch streams. +// 1.4 -- Add header stream. +// 1.5 -- Include QPC and Platform clock source in the header. +// +// 2.0 -- Larger Buffers (over 1MB) / 256+ Processors / Compression (Win8). +// + +#define TRACE_VERSION_MAJOR_WIN7 1 +#define TRACE_VERSION_MINOR_WIN7 5 + +#define TRACE_VERSION_MAJOR 2 +#define TRACE_VERSION_MINOR 0 + +#define SYSTEM_TRACE_MARKER32 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_SYSTEM32 << 16)) +#define SYSTEM_TRACE_MARKER64 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_SYSTEM64 << 16)) + +#define COMPACT_TRACE_MARKER32 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_COMPACT32 << 16)) +#define COMPACT_TRACE_MARKER64 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_COMPACT64 << 16)) + +#define PERFINFO_TRACE_MARKER32 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_PERFINFO32 << 16)) +#define PERFINFO_TRACE_MARKER64 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_PERFINFO64 << 16)) + +#define TRACE_HEADER_PEBS_INDEX_FLAG 0x00008000 +#define TRACE_HEADER_SPARE_FLAG1 0x00004000 +#define TRACE_HEADER_SPARE_FLAG2 0x00002000 +#define TRACE_HEADER_SPARE_FLAG3 0x00001000 +#define TRACE_HEADER_SPARE_FLAG4 0x00000800 +#define TRACE_HEADER_PMC_COUNTERS_MASK 0x00000700 +#define TRACE_HEADER_PMC_COUNTERS_SHIFT 8 + +#define TRACE_HEADER_EXT_ITEMS_MASK (TRACE_HEADER_PEBS_INDEX_FLAG | TRACE_HEADER_PMC_COUNTERS_MASK) + +#ifdef _WIN64 +#define SYSTEM_TRACE_MARKER SYSTEM_TRACE_MARKER64 +#define COMPACT_TRACE_MARKER COMPACT_TRACE_MARKER64 +#define PERFINFO_TRACE_MARKER PERFINFO_TRACE_MARKER64 +#else +#define SYSTEM_TRACE_MARKER SYSTEM_TRACE_MARKER32 +#define COMPACT_TRACE_MARKER COMPACT_TRACE_MARKER32 +#define PERFINFO_TRACE_MARKER PERFINFO_TRACE_MARKER32 +#endif + +// +// Support a maximum of 64 logger instances. +// +#define MAXLOGGERS 64 + +// +// Set of Internal Flags passed to the Logger via ClientContext during StartTrace +// +#define EVENT_TRACE_CLOCK_RAW 0 // Use Raw timestamp +#define EVENT_TRACE_CLOCK_PERFCOUNTER 1 // Use HighPerfClock (Default) +#define EVENT_TRACE_CLOCK_SYSTEMTIME 2 // Use SystemTime +#define EVENT_TRACE_CLOCK_CPUCYCLE 3 // Use CPU cycle counter +#define EVENT_TRACE_CLOCK_MAX 4 // Max number of clock types + +// +// NOTE: The following should not overlap with other bits in the LogFileMode +// or LoggerMode defined in evntrace.h. Placed here since it is for internal +// use only. +// +#define EVENT_TRACE_KD_FILTER_MODE 0x00080000 // KD_FILTER +#define EVENT_TRACE_BUFFER_INTERFACE_MODE 0x00040000 + +// +// LoggerMode flags on Win7 and above. +// +#define EVENT_TRACE_USE_MS_FLUSH_TIMER 0x00000010 // FlushTimer value in milliseconds +#define EVENT_TRACE_BLOCKING_MODE 0x20000000 // Private loggers wait for buffers + +// +// LoggerMode flags on Win8 and above. +// +#define EVENT_TRACE_REALTIME_RELOG_MODE 0x00100000 // Private logger, relogging real-time events + // This is same as EVENT_TRACE_MODE_RESERVED + +#define EVENT_TRACE_LOST_EVENTS_DEBUG_MODE 0x00200000 // Break on lost events +#define EVENT_TRACE_COMPRESSED_MODE 0x04000000 // Compress relogged file + +// +// see evntrace.h for pre-defined generic event types (0-10) +// +typedef struct _WMI_TRACE_PACKET +{ + USHORT Size; + union + { + USHORT HookId; + struct + { + UCHAR Type; + UCHAR Group; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; +} WMI_TRACE_PACKET, *PWMI_TRACE_PACKET; + +static_assert(sizeof(WMI_TRACE_PACKET) == sizeof(ULONG), "WMI_TRACE_PACKET must equal sizeof(ULONG)"); + +// New struct that replaces EVENT_INSTANCE_GUID_HEADER. It is basically +// EVENT_TRACE_HEADER + 2 Guids. +// For XP, we will not publish this struct and hide it from users. +// TRACE_VERSION in LOG_FILE_HEADER will tell the consumer APIs to use +// this struct instead of EVENT_TRACE_HEADER. + +typedef struct _EVENT_INSTANCE_GUID_HEADER +{ + USHORT Size; // Size of entire record + union + { + USHORT FieldTypeFlags; // Indicates valid fields + struct + { + UCHAR HeaderType; // Header type - internal use only + UCHAR MarkerFlags; // Marker - internal use only + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; + union + { + ULONG Version; + struct + { + UCHAR Type; // event type + UCHAR Level; // trace instrumentation level + USHORT Version; // version of trace record + } Class; + } DUMMYUNIONNAME2; + ULONG ThreadId; // Thread Id + ULONG ProcessId; // Process Id + LARGE_INTEGER TimeStamp; // time when event happens + union + { + GUID Guid; // Guid that identifies event + ULONGLONG GuidPtr; // use with WNODE_FLAG_USE_GUID_PTR + } DUMMYUNIONNAME3; + union + { + struct + { + ULONG ClientContext; // Reserved + ULONG Flags; // Flags for header + } DUMMYSTRUCTNAME; + struct + { + ULONG KernelTime; // Kernel Mode CPU ticks + ULONG UserTime; // User mode CPU ticks + } DUMMYSTRUCTNAME2; + ULONG64 ProcessorTime; // Processor Clock + } DUMMYUNIONNAME4; + ULONG InstanceId; + ULONG ParentInstanceId; + GUID ParentGuid; // Guid that identifies event +} EVENT_INSTANCE_GUID_HEADER, *PEVENT_INSTANCE_GUID_HEADER; + +typedef ULONGLONG PERFINFO_TIMESTAMP; +typedef struct _PERFINFO_TRACE_HEADER PERFINFO_TRACE_ENTRY, *PPERFINFO_TRACE_ENTRY; + +// +// 64-bit Trace header for NTPERF events +// +// Note. The field "Version" will temporary be used to log CPU Id when log to PerfMem. +// This will be removed after we change the buffer management to be the same as WMI. +// i.e., Each CPU will allocate a block of memory for logging and CPU id is in the header +// of each block. +// +typedef struct _PERFINFO_TRACE_HEADER +{ + union + { + ULONG Marker; + struct + { + USHORT Version; + UCHAR HeaderType; + UCHAR Flags; //WMI uses this flag to identify event types + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; + union + { + ULONG Header; // both sizes must be the same! + WMI_TRACE_PACKET Packet; + } DUMMYUNIONNAME2; + union + { + PERFINFO_TIMESTAMP TS; + LARGE_INTEGER SystemTime; + } DUMMYUNIONNAME3; + UCHAR Data[1]; +} PERFINFO_TRACE_HEADER, *PPERFINFO_TRACE_HEADER; + +// +// 64-bit Trace header for kernel events +// +typedef struct _SYSTEM_TRACE_HEADER +{ + union + { + ULONG Marker; + struct + { + USHORT Version; + UCHAR HeaderType; + UCHAR Flags; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; + union + { + ULONG Header; // both sizes must be the same! + WMI_TRACE_PACKET Packet; + } DUMMYUNIONNAME2; + ULONG ThreadId; + ULONG ProcessId; + LARGE_INTEGER SystemTime; + ULONG KernelTime; + ULONG UserTime; +} SYSTEM_TRACE_HEADER, *PSYSTEM_TRACE_HEADER; + +// +// System header with no User/Kernel time. +// +#define COMPACT_HEADER_SIZE (RTL_SIZEOF_THROUGH_FIELD(SYSTEM_TRACE_HEADER, SystemTime)) + +// +// 64-bit Trace Header for Tracing Messages +// +typedef struct _WMI_TRACE_MESSAGE_PACKET +{ + USHORT MessageNumber; // The message Number, index of messages by GUID + // Or ComponentID + USHORT OptionFlags ; // Flags associated with the message +} WMI_TRACE_MESSAGE_PACKET, *PWMI_TRACE_MESSAGE_PACKET; + +static_assert(sizeof(WMI_TRACE_MESSAGE_PACKET) == sizeof(ULONG), "WMI_TRACE_MESSAGE_PACKET must equal sizeof(ULONG)"); + +typedef struct _MESSAGE_TRACE_HEADER +{ + union + { + ULONG Marker; + struct + { + USHORT Size; // Total Size of the message including header + UCHAR Reserved; // Unused and reserved + UCHAR Version; // The message structure type (TRACE_MESSAGE_FLAG) + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; + union + { + ULONG Header; // both sizes must be the same! + WMI_TRACE_MESSAGE_PACKET Packet; + } DUMMYUNIONNAME2; +} MESSAGE_TRACE_HEADER, *PMESSAGE_TRACE_HEADER; + +typedef struct _MESSAGE_TRACE +{ + MESSAGE_TRACE_HEADER MessageHeader; + UCHAR Data; +} MESSAGE_TRACE, *PMESSAGE_TRACE; + +#define TRACE_MESSAGE_USERMODE 0x40 // flag indicating message came from user mode +#define TRACE_MESSAGE_WOW 0x80 +// +// Structure used to pass user log messages to the kernel +// +typedef struct DECLSPEC_ALIGN(8) _MESSAGE_TRACE_USER +{ + MESSAGE_TRACE_HEADER MessageHeader; + GUID MessageGuid; + ULONG MessageFlags; + ULONG DataSize; + ULONG64 Data; +} MESSAGE_TRACE_USER, *PMESSAGE_TRACE_USER; + +// +// N.B. ETW_REF_CLOCK needs to be available for WOW64, thus the trick with defines for ETW_WOW64. +// +typedef struct _ETW_REF_CLOCK +{ + LARGE_INTEGER StartTime; + LARGE_INTEGER StartPerfClock; +} ETW_REF_CLOCK, *PETW_REF_CLOCK; + +#ifndef ETW_WOW6432 + +typedef enum _ETW_BUFFER_STATE +{ + EtwBufferStateFree, + EtwBufferStateGeneralLogging, + EtwBufferStateCSwitch, + EtwBufferStateFlush, + EtwBufferStateMaximum //MaxState should always be the last enum +} ETW_BUFFER_STATE, *PETW_BUFFER_STATE; + +#define ETW_BUFFER_TYPE_GENERIC 0 +#define ETW_BUFFER_TYPE_RUNDOWN 1 +#define ETW_BUFFER_TYPE_CTX_SWAP 2 +#define ETW_BUFFER_TYPE_REFTIME 3 +#define ETW_BUFFER_TYPE_HEADER 4 +#define ETW_BUFFER_TYPE_BATCHED 5 +#define ETW_BUFFER_TYPE_EMPTY_MARKER 6 +#define ETW_BUFFER_TYPE_DBG_INFO 7 +#define ETW_BUFFER_TYPE_MAXIMUM 8 + +#define ETW_BUFFER_FLAG_NORMAL 0x0000 +#define ETW_BUFFER_FLAG_FLUSH_MARKER 0x0001 +#define ETW_BUFFER_FLAG_EVENTS_LOST 0x0002 +#define ETW_BUFFER_FLAG_BUFFER_LOST 0x0004 +#define ETW_BUFFER_FLAG_RTBACKUP_CORRUPT 0x0008 +#define ETW_BUFFER_FLAG_RTBACKUP 0x0010 +#define ETW_BUFFER_FLAG_PROC_INDEX 0x0020 +#define ETW_BUFFER_FLAG_COMPRESSED 0x0040 + +#define ETW_PROCESSOR_INDEX_MASK 0x07FF + +// +// The following constants for real time event loss reasons should be +// in sync with the messages in admin\wmi\events\service\eventlog.man. +// +#define ETW_RT_LOSS_EVENT 0x20 +#define ETW_RT_LOSS_BUFFER 0x21 +#define ETW_RT_LOSS_BACKUP 0x22 + +typedef enum _ETW_RT_EVENT_LOSS +{ + EtwRtEventNoLoss, + EtwRtEventLost, + EtwRtBufferLost, + EtwRtBackupLost, + EtwRtEventLossMax +} ETW_RT_EVENT_LOSS, *PETW_RT_EVENT_LOSS; + +typedef struct _WMI_BUFFER_HEADER *PWMI_BUFFER_HEADER; + +typedef struct _WMI_BUFFER_HEADER +{ + ULONG BufferSize; // BufferSize + ULONG SavedOffset; // Temp saved offset + volatile ULONG CurrentOffset; // Current offset + volatile LONG ReferenceCount; // Reference count + LARGE_INTEGER TimeStamp; // Flush time stamp + LONGLONG SequenceNumber; // Buffer sequence number + + union + { + struct + { // DBG_INFO buffers send to debugger + ULONGLONG ClockType : 3; + ULONGLONG Frequency : 61; + } DUMMYSTRUCTNAME; + SINGLE_LIST_ENTRY SlistEntry; // Local list when flushing + PWMI_BUFFER_HEADER NextBuffer; // FlushList + } DUMMYUNIONNAME; + + ETW_BUFFER_CONTEXT ClientContext; // LoggerId/ProcessorIndex + ETW_BUFFER_STATE State; // (Free/GeneralLogging/Flush) + + ULONG Offset; // Offset when flushing (can overlap SavedOffset) + USHORT BufferFlag; // (flush marker, events lost) + USHORT BufferType; // (generic/rundown/cswitch/reftime) + union + { + ULONG Padding1[4]; + ETW_REF_CLOCK ReferenceTime; // persistent real-time + LIST_ENTRY GlobalEntry; // Global list entry + struct + { + PVOID Pointer0; + PVOID Pointer1; + } DUMMYSTRUCTNAME2; + } DUMMYUNIONNAME2; +} WMI_BUFFER_HEADER, *PWMI_BUFFER_HEADER; + +static_assert(sizeof(WMI_BUFFER_HEADER) == 0x48, "WMI_BUFFER_HEADER must equal 0x48"); +C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, BufferSize) == 0x0); +C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, SavedOffset) == 0x4); +C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, CurrentOffset) == 0x8); +C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, TimeStamp) == 0x10); +C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, SlistEntry) == 0x20); +C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, ClientContext) == 0x28); +C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, State) == 0x2c); // Compression +C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, Offset) == 0x30); +C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, BufferFlag) == 0x34); +C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, BufferType) == 0x36); + +typedef struct _TRACE_ENABLE_FLAG_EXTENSION +{ + USHORT Offset; // Offset to the flag array in structure + UCHAR Length; // Length of flag array in ULONGs + UCHAR Flag; // Must be set to EVENT_TRACE_FLAG_EXTENSION +} TRACE_ENABLE_FLAG_EXTENSION, *PTRACE_ENABLE_FLAG_EXTENSION; + +typedef struct _TRACE_ENABLE_FLAG_EXT_HEADER +{ + USHORT Length; // Length in ULONGs + USHORT Items; // # of items +} TRACE_ENABLE_FLAG_EXT_HEADER, *PTRACE_ENABLE_FLAG_EXT_HEADER; + +typedef struct _TRACE_ENABLE_FLAG_EXT_ITEM +{ + USHORT Offset; // Offset to the next block + USHORT Type; // Extension type +} TRACE_ENABLE_FLAG_EXT_ITEM, *PTRACE_ENABLE_FLAG_EXT_ITEM; + +#define EVENT_TRACE_FLAG_EXT_ITEMS 0x80FF0000 // New extension structure +#define EVENT_TRACE_FLAG_EXT_LEN_NEW_STRUCT 0xFF // Pseudo length to denote new struct format + +#define ETW_MINIMUM_CACHED_STACK_LENGTH 4 +#define ETW_SW_ARRAY_SIZE 256 // Frame Count allocated in lookaside list +#define ETW_STACK_SW_ARRAY_SIZE 192 // Frame Count allocated in stack +#define ETW_MAX_STACKWALK_FILTER 256 // Max number of HookId's +#define ETW_MAX_TAG_FILTER 4 +#define ETW_MAX_POOLTAG_FILTER ETW_MAX_TAG_FILTER + +#define ETW_EXT_ENABLE_FLAGS 0x0001 +#define ETW_EXT_PIDS 0x0002 +#define ETW_EXT_STACKWALK_FILTER 0x0003 +#define ETW_EXT_POOLTAG_FILTER 0x0004 +#define ETW_EXT_STACK_CACHING 0x0005 + +// +// Extended item for configuring stack caching. +// +typedef struct _ETW_STACK_CACHING_CONFIG +{ + ULONG CacheSize; + ULONG BucketCount; +} ETW_STACK_CACHING_CONFIG, *PETW_STACK_CACHING_CONFIG; + +#endif // ifndef ETW_WOW6432 + +#define PERFINFO_APPLY_OFFSET_GIVING_TYPE(_Base, _Offset, _Type) ((_Type) (((PPERF_BYTE) (_Base)) + (_Offset))) +#define PERFINFO_ROUND_UP(Size, Amount) (((ULONG)(Size) + ((Amount) - 1)) & ~((Amount) - 1)) + +// +// Enable flags, hook id's, etc... +// +#define PERF_MASK_INDEX (0xe0000000) +#define PERF_MASK_GROUP (~PERF_MASK_INDEX) +#define PERF_NUM_MASKS 8 + +typedef ULONG PERFINFO_MASK; + +// +// This structure holds a group mask for all the PERF_NUM_MASKS sets (see PERF_MASK_INDEX above). +// +typedef struct _PERFINFO_GROUPMASK +{ + ULONG Masks[PERF_NUM_MASKS]; +} PERFINFO_GROUPMASK, *PPERFINFO_GROUPMASK; + +#define PERF_GET_MASK_INDEX(GM) (((GM) & PERF_MASK_INDEX) >> 29) +#define PERF_GET_MASK_GROUP(GM) ((GM) & PERF_MASK_GROUP) + +#define PERFINFO_CLEAR_GROUPMASK(GroupMask) RtlZeroMemory((GroupMask), sizeof(PERFINFO_GROUPMASK)) +#define PERFINFO_OR_GROUP_WITH_GROUPMASK(Group, GroupMask) (GroupMask)->Masks[PERF_GET_MASK_INDEX(Group)] |= PERF_GET_MASK_GROUP(Group) +#define PERFINFO_CLEAR_GROUP_IN_GROUPMASK(Group, GroupMask) (GroupMask)->Masks[PERF_GET_MASK_INDEX(Group)] &= (~PERF_GET_MASK_GROUP(Group)) + +/*++ + +Routine Description: + + Determines whether any group is on in a group mask + +Arguments: + + Group - Group index to check. + + GroupMask - pointer to group mask to check. + +Return Value: + + Boolean indicating whether it is set or not. + +Environment: + + User mode. + +--*/ +FORCEINLINE +BOOLEAN +PerfIsGroupOnInGroupMask( + _In_ ULONG Group, + _In_ PPERFINFO_GROUPMASK GroupMask + ) +{ + PPERFINFO_GROUPMASK TestMask = GroupMask; + + return (BOOLEAN)(((TestMask) != NULL) && (((TestMask)->Masks[PERF_GET_MASK_INDEX((Group))] & PERF_GET_MASK_GROUP((Group))) != 0)); +} + +// Group Masks (enabling flags) are used to determine the type of +// events to be logged. Each hook type is controlled by one bit in the +// Group masks. +// +// Currently we have 8 sets of global masks available. Each set is a ULONG with +// the highest 3 bits reserved for PERF_MASK_INDEX, which is used to index to +// the particular set of masks. For example, +// +// #define PERF_GROUP1 0x0XXXXXXX in the 0th set (0x10000000 is the last bit in this set) +// #define PERF_GROUP2 0x2XXXXXXX in the 1st set (0x30000000 is the last bit in this set) +// #define PERF_GROUP3 0x4XXXXXXX in the 2nd set (0x50000000 is the last bit in this set) +// ... +// #define PERF_GROUP7 0xeXXXXXXX in the 7th set (0xf0000000 is the last bit in this set) +// +// See ntperf.h for the manipulations of flags. +// +// Externally published group masks (only in the 0th set) are defined in envtrace.h. +// This section contains extended group masks which are private. +// +// The highest set of GROUP_MASK (0xeXXXXXXX) is currently reserved for +// modifying system behaviors (e.g., turn off page fault clustering, limit +// process working set when BigFoot is turned on, etc.) when trace is +// turned on. +// +// +// +// NOTE: In LongHorn we decided to expose some of the flags outside of group 0. +// We did that by adding the following flags which are treated as aliases: +// +// EVENT_TRACE_FLAG_CSWITCH +// EVENT_TRACE_FLAG_DPC +// EVENT_TRACE_FLAG_INTERRUPT +// EVENT_TRACE_FLAG_SYSTEMCALL +// EVENT_TRACE_FLAG_DRIVER +// EVENT_TRACE_FLAG_PROFILE +// +// +// GlobalMask 0 (Masks[0]) +// +#define PERF_REGISTRY EVENT_TRACE_FLAG_REGISTRY +#define PERF_HARD_FAULTS EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS +#define PERF_JOB EVENT_TRACE_FLAG_JOB +#define PERF_PROC_THREAD EVENT_TRACE_FLAG_PROCESS | EVENT_TRACE_FLAG_THREAD +#define PERF_PROCESS EVENT_TRACE_FLAG_PROCESS +#define PERF_THREAD EVENT_TRACE_FLAG_THREAD +#define PERF_DISK_IO EVENT_TRACE_FLAG_DISK_FILE_IO | EVENT_TRACE_FLAG_DISK_IO +#define PERF_DISK_IO_INIT EVENT_TRACE_FLAG_DISK_IO_INIT +#define PERF_LOADER EVENT_TRACE_FLAG_IMAGE_LOAD +#define PERF_ALL_FAULTS EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS +#define PERF_FILENAME EVENT_TRACE_FLAG_DISK_FILE_IO +#define PERF_NETWORK EVENT_TRACE_FLAG_NETWORK_TCPIP +#define PERF_ALPC EVENT_TRACE_FLAG_ALPC +#define PERF_SPLIT_IO EVENT_TRACE_FLAG_SPLIT_IO +#define PERF_PERF_COUNTER EVENT_TRACE_FLAG_PROCESS_COUNTERS +#define PERF_FILE_IO EVENT_TRACE_FLAG_FILE_IO +#define PERF_FILE_IO_INIT EVENT_TRACE_FLAG_FILE_IO_INIT +#define PERF_DBGPRINT EVENT_TRACE_FLAG_DBGPRINT +#define PERF_NO_SYSCONFIG EVENT_TRACE_FLAG_NO_SYSCONFIG +#define PERF_VAMAP EVENT_TRACE_FLAG_VAMAP +#define PERF_DEBUG_EVENTS EVENT_TRACE_FLAG_DEBUG_EVENTS + +// +// GlobalMask 1 (Masks[1]) +// +#define PERF_MEMORY 0x20000001 // High level WS manager activities, PFN changes +#define PERF_PROFILE 0x20000002 // Sysprof // equivalent to EVENT_TRACE_FLAG_PROFILE +#define PERF_CONTEXT_SWITCH 0x20000004 // Context Switch // equivalent to EVENT_TRACE_FLAG_CSWITCH +#define PERF_FOOTPRINT 0x20000008 // Flush WS on every mark_with_flush +#define PERF_DRIVERS 0x20000010 // equivalent to EVENT_TRACE_FLAG_DRIVER +#define PERF_REFSET 0x20000020 // PERF_FOOTPRINT + log AutoMark on trace start/stop. +#define PERF_POOL 0x20000040 +#define PERF_POOLTRACE 0x20000041 +#define PERF_DPC 0x20000080 // equivalent to EVENT_TRACE_FLAG_DPC +#define PERF_COMPACT_CSWITCH 0x20000100 +#define PERF_DISPATCHER 0x20000200 // equivalent to EVENT_TRACE_FLAG_DISPATCHER +#define PERF_PMC_PROFILE 0x20000400 +#define PERF_PROFILING 0x20000402 +#define PERF_PROCESS_INSWAP 0x20000800 +#define PERF_AFFINITY 0x20001000 +#define PERF_PRIORITY 0x20002000 +#define PERF_INTERRUPT 0x20004000 // equivalent to EVENT_TRACE_FLAG_INTERRUPT +#define PERF_VIRTUAL_ALLOC 0x20008000 // equivalent to EVENT_TRACE_FLAG_VIRTUAL_ALLOC +#define PERF_SPINLOCK 0x20010000 +#define PERF_SYNC_OBJECTS 0x20020000 +#define PERF_DPC_QUEUE 0x20040000 +#define PERF_MEMINFO 0x20080000 +#define PERF_CONTMEM_GEN 0x20100000 +#define PERF_SPINLOCK_CNTRS 0x20200000 +#define PERF_SPININSTR 0x20210000 +#define PERF_SESSION 0x20400000 +#define PERF_PFSECTION PERF_SESSION // Bits in this group are scarce and so use SESSION for PFSECTION events. +#define PERF_MEMINFO_WS 0x20800000 // Logs Workingset/Commit information on MemInfo DPC +#define PERF_KERNEL_QUEUE 0x21000000 +#define PERF_INTERRUPT_STEER 0x22000000 +#define PERF_SHOULD_YIELD 0x24000000 +#define PERF_WS 0x28000000 +//#define PERF_POOLTRACE (PERF_MEMORY | PERF_POOL) +//#define PERF_PROFILING (PERF_PROFILE | PERF_PMC_PROFILE) +//#define PERF_SPININSTR (PERF_SPINLOCK | PERF_SPINLOCK_CNTRS) + +// +// GlobalMask 2 (Masks[2]) +// +#define PERF_ANTI_STARVATION 0x40000001 +#define PERF_PROCESS_FREEZE 0x40000002 +#define PERF_PFN_LIST 0x40000004 +#define PERF_WS_DETAIL 0x40000008 +#define PERF_WS_ENTRY 0x40000010 +#define PERF_HEAP 0x40000020 +#define PERF_SYSCALL 0x40000040 +#define PERF_UMS 0x40000080 +#define PERF_BACKTRACE 0x40000100 +#define PERF_VULCAN 0x40000200 +#define PERF_OBJECTS 0x40000400 +#define PERF_EVENTS 0x40000800 +#define PERF_FULLTRACE 0x40001000 +#define PERF_DFSS 0x40002000 // spare +#define PERF_PREFETCH 0x40004000 +#define PERF_PROCESSOR_IDLE 0x40008000 +#define PERF_CPU_CONFIG 0x40010000 +#define PERF_TIMER 0x40020000 +#define PERF_CLOCK_INTERRUPT 0x40040000 +#define PERF_LOAD_BALANCER 0x40080000 // spare +#define PERF_CLOCK_TIMER 0x40100000 +#define PERF_IDLE_SELECTION 0x40200000 +#define PERF_IPI 0x40400000 +#define PERF_IO_TIMER 0x40800000 +#define PERF_REG_HIVE 0x41000000 +#define PERF_REG_NOTIF 0x42000000 +#define PERF_PPM_EXIT_LATENCY 0x44000000 +#define PERF_WORKER_THREAD 0x48000000 + +// +// GlobalMask 3 (Masks[3]) +// + +// Reserved 0x60000001 +// Reserved 0x60000002 +// Reserved 0x60000004 +// Reserved 0x60000008 +// ... + +// +// GlobalMask 4 (Masks[4]) +// + +#define PERF_OPTICAL_IO 0x80000001 +#define PERF_OPTICAL_IO_INIT 0x80000002 +// Reserved 0x80000004 +#define PERF_DLL_INFO 0x80000008 +#define PERF_DLL_FLUSH_WS 0x80000010 +// Reserved 0x80000020 +#define PERF_OB_HANDLE 0x80000040 +#define PERF_OB_OBJECT 0x80000080 +// Reserved 0x80000100 +#define PERF_WAKE_DROP 0x80000200 +#define PERF_WAKE_EVENT 0x80000400 +#define PERF_DEBUGGER 0x80000800 +#define PERF_PROC_ATTACH 0x80001000 +#define PERF_WAKE_COUNTER 0x80002000 +// Reserved 0x80004000 +#define PERF_POWER 0x80008000 +#define PERF_SOFT_TRIM 0x80010000 +#define PERF_CC 0x80020000 +// Reserved 0x80040000 +#define PERF_FLT_IO_INIT 0x80080000 +#define PERF_FLT_IO 0x80100000 +#define PERF_FLT_FASTIO 0x80200000 +#define PERF_FLT_IO_FAILURE 0x80400000 +#define PERF_HV_PROFILE 0x80800000 +#define PERF_WDF_DPC 0x81000000 +#define PERF_WDF_INTERRUPT 0x82000000 +#define PERF_CACHE_FLUSH 0x84000000 + +// +// GlobalMask 5: +// + +#define PERF_HIBER_RUNDOWN 0xA0000001 + +// Reserved 0xA0000002 +// Reserved 0xA0000004 +// Reserved 0xA0000008 +// ... + +// +// GlobalMask 6: +// + +#define PERF_SYSCFG_SYSTEM 0xC0000001 +#define PERF_SYSCFG_GRAPHICS 0xC0000002 +#define PERF_SYSCFG_STORAGE 0xC0000004 +#define PERF_SYSCFG_NETWORK 0xC0000008 +#define PERF_SYSCFG_SERVICES 0xC0000010 +#define PERF_SYSCFG_PNP 0xC0000020 +#define PERF_SYSCFG_OPTICAL 0xC0000040 +// Reserved 0xC0000080 +// Reserved 0xC0000100 +#define PERF_SYSCFG_ALL 0xDFFFFFFF + +// +// GlobalMask 7: The mark is a control mask. All flags that changes system +// behaviors go here. +// + +#define PERF_CLUSTER_OFF 0xe0000001 +#define PERF_MEMORY_CONTROL 0xe0000002 + +// +// Converting old PERF hooks into WMI format. More clean up to be done. +// +// WHEN YOU ADD NEW TYPES UPDATE THE NAME TABLE in perfgroups.c: +// PerfLogTypeNames ALSO UPDATE VERIFICATION TABLE IN PERFPOSTTBLS.C +// + +// +// Event for header +// +#define WMI_LOG_TYPE_HEADER (EVENT_TRACE_GROUP_HEADER | EVENT_TRACE_TYPE_INFO) +#define WMI_LOG_TYPE_HEADER_EXTENSION (EVENT_TRACE_GROUP_HEADER | EVENT_TRACE_TYPE_EXTENSION) +#define WMI_LOG_TYPE_RUNDOWN_COMPLETE (EVENT_TRACE_GROUP_HEADER | EVENT_TRACE_TYPE_CHECKPOINT) +#define WMI_LOG_TYPE_GROUP_MASKS_END (EVENT_TRACE_GROUP_HEADER | 0x20) +#define WMI_LOG_TYPE_RUNDOWN_BEGIN (EVENT_TRACE_GROUP_HEADER | 0x30) +#define WMI_LOG_TYPE_RUNDOWN_END (EVENT_TRACE_GROUP_HEADER | 0x31) +#define WMI_LOG_TYPE_DBGID_RSDS (EVENT_TRACE_GROUP_HEADER | EVENT_TRACE_TYPE_DBGID_RSDS) +#define WMI_LOG_TYPE_DBGID_NB10 (EVENT_TRACE_GROUP_HEADER | 0x41) +#define WMI_LOG_TYPE_BUILD_LAB (EVENT_TRACE_GROUP_HEADER | 0x42) +#define WMI_LOG_TYPE_BINARY_PATH (EVENT_TRACE_GROUP_HEADER | 0x43) + +// +// Event for system config +// + +#define WMI_LOG_TYPE_CONFIG_CPU (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_CPU) +#define WMI_LOG_TYPE_CONFIG_PHYSICALDISK (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PHYSICALDISK) +#define WMI_LOG_TYPE_CONFIG_LOGICALDISK (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_LOGICALDISK) +#define WMI_LOG_TYPE_CONFIG_OPTICALMEDIA (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_OPTICALMEDIA) +#define WMI_LOG_TYPE_CONFIG_NIC (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_NIC) +#define WMI_LOG_TYPE_CONFIG_VIDEO (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_VIDEO) +#define WMI_LOG_TYPE_CONFIG_SERVICES (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_SERVICES) +#define WMI_LOG_TYPE_CONFIG_POWER (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_POWER) +//#define WMI_LOG_TYPE_CONFIG_OSVERSION (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_OSVERSION) +//#define WMI_LOG_TYPE_CONFIG_VISUALTHEME (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_VISUALTHEME) +//#define WMI_LOG_TYPE_CONFIG_SYSTEMRANGE (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_SYSTEMRANGE) +//#define WMI_LOG_TYPE_CONFIG_SYSDLLINFO (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_SYSDLLINFO) +#define WMI_LOG_TYPE_CONFIG_IRQ (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_IRQ) +#define WMI_LOG_TYPE_CONFIG_PNP (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PNP) +#define WMI_LOG_TYPE_CONFIG_IDECHANNEL (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_IDECHANNEL) +#define WMI_LOG_TYPE_CONFIG_NUMANODE (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_NUMANODE) +#define WMI_LOG_TYPE_CONFIG_PLATFORM (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PLATFORM) +#define WMI_LOG_TYPE_CONFIG_PROCESSORGROUP (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PROCESSORGROUP) +#define WMI_LOG_TYPE_CONFIG_PROCESSORNUMBER (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PROCESSORNUMBER) +#define WMI_LOG_TYPE_CONFIG_DPI (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_DPI) +#define WMI_LOG_TYPE_CONFIG_CODEINTEGRITY (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_CI_INFO) +#define WMI_LOG_TYPE_CONFIG_MACHINEID (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_MACHINEID) + +// +// Event for Image and File Name +// +#define PERFINFO_LOG_TYPE_FILENAME (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_INFO) +#define PERFINFO_LOG_TYPE_FILENAME_CREATE (EVENT_TRACE_GROUP_FILE | 0x20) +#define PERFINFO_LOG_TYPE_FILENAME_SAME (EVENT_TRACE_GROUP_FILE | 0x21) +#define PERFINFO_LOG_TYPE_FILENAME_NULL (EVENT_TRACE_GROUP_FILE | 0x22) +#define PERFINFO_LOG_TYPE_FILENAME_DELETE (EVENT_TRACE_GROUP_FILE | 0x23) +#define PERFINFO_LOG_TYPE_FILENAME_RUNDOWN (EVENT_TRACE_GROUP_FILE | 0x24) + +#define PERFINFO_LOG_TYPE_MAPFILE (EVENT_TRACE_GROUP_FILE | 0x25) +#define PERFINFO_LOG_TYPE_UNMAPFILE (EVENT_TRACE_GROUP_FILE | 0x26) +#define PERFINFO_LOG_TYPE_MAPFILE_DC_START (EVENT_TRACE_GROUP_FILE | 0x27) +#define PERFINFO_LOG_TYPE_MAPFILE_DC_END (EVENT_TRACE_GROUP_FILE | 0x28) + +#define PERFINFO_LOG_TYPE_FILE_IO_CREATE (EVENT_TRACE_GROUP_FILE | 0x40) +#define PERFINFO_LOG_TYPE_FILE_IO_CLEANUP (EVENT_TRACE_GROUP_FILE | 0x41) +#define PERFINFO_LOG_TYPE_FILE_IO_CLOSE (EVENT_TRACE_GROUP_FILE | 0x42) +#define PERFINFO_LOG_TYPE_FILE_IO_READ (EVENT_TRACE_GROUP_FILE | 0x43) +#define PERFINFO_LOG_TYPE_FILE_IO_WRITE (EVENT_TRACE_GROUP_FILE | 0x44) +#define PERFINFO_LOG_TYPE_FILE_IO_SET_INFORMATION (EVENT_TRACE_GROUP_FILE | 0x45) +#define PERFINFO_LOG_TYPE_FILE_IO_DELETE (EVENT_TRACE_GROUP_FILE | 0x46) +#define PERFINFO_LOG_TYPE_FILE_IO_RENAME (EVENT_TRACE_GROUP_FILE | 0x47) +#define PERFINFO_LOG_TYPE_FILE_IO_DIRENUM (EVENT_TRACE_GROUP_FILE | 0x48) +#define PERFINFO_LOG_TYPE_FILE_IO_FLUSH (EVENT_TRACE_GROUP_FILE | 0x49) +#define PERFINFO_LOG_TYPE_FILE_IO_QUERY_INFORMATION (EVENT_TRACE_GROUP_FILE | 0x4A) +#define PERFINFO_LOG_TYPE_FILE_IO_FS_CONTROL (EVENT_TRACE_GROUP_FILE | 0x4B) +#define PERFINFO_LOG_TYPE_FILE_IO_OPERATION_END (EVENT_TRACE_GROUP_FILE | 0x4C) +#define PERFINFO_LOG_TYPE_FILE_IO_DIRNOTIFY (EVENT_TRACE_GROUP_FILE | 0x4D) +#define PERFINFO_LOG_TYPE_FILE_IO_CREATE_NEW (EVENT_TRACE_GROUP_FILE | 0x4E) +#define PERFINFO_LOG_TYPE_FILE_IO_DELETE_PATH (EVENT_TRACE_GROUP_FILE | 0x4F) +#define PERFINFO_LOG_TYPE_FILE_IO_RENAME_PATH (EVENT_TRACE_GROUP_FILE | 0x50) +#define PERFINFO_LOG_TYPE_FILE_IO_SETLINK_PATH (EVENT_TRACE_GROUP_FILE | 0x51) +#define PERFINFO_LOG_TYPE_FILE_IO_SETLINK (EVENT_TRACE_GROUP_FILE | 0x52) + +// +// Event types for minifilter callbacks +// + +#define PERFINFO_LOG_TYPE_FLT_PREOP_INIT (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_PREOP_INIT) +#define PERFINFO_LOG_TYPE_FLT_POSTOP_INIT (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_POSTOP_INIT) +#define PERFINFO_LOG_TYPE_FLT_PREOP_COMPLETION (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_PREOP_COMPLETION) +#define PERFINFO_LOG_TYPE_FLT_POSTOP_COMPLETION (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_POSTOP_COMPLETION) +#define PERFINFO_LOG_TYPE_FLT_PREOP_FAILURE (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_PREOP_FAILURE) +#define PERFINFO_LOG_TYPE_FLT_POSTOP_FAILURE (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_POSTOP_FAILURE) + +// +// Event types for Job +// + +#define WMI_LOG_TYPE_JOB_CREATE (EVENT_TRACE_GROUP_JOB | 0x20) +#define WMI_LOG_TYPE_JOB_TERMINATE (EVENT_TRACE_GROUP_JOB | 0x21) +#define WMI_LOG_TYPE_JOB_OPEN (EVENT_TRACE_GROUP_JOB | 0x22) +#define WMI_LOG_TYPE_JOB_ASSIGN_PROCESS (EVENT_TRACE_GROUP_JOB | 0x23) +#define WMI_LOG_TYPE_JOB_REMOVE_PROCESS (EVENT_TRACE_GROUP_JOB | 0x24) +#define WMI_LOG_TYPE_JOB_SET (EVENT_TRACE_GROUP_JOB | 0x25) +#define WMI_LOG_TYPE_JOB_QUERY (EVENT_TRACE_GROUP_JOB | 0x26) +#define WMI_LOG_TYPE_JOB_SET_FAILED (EVENT_TRACE_GROUP_JOB | 0x27) +#define WMI_LOG_TYPE_JOB_QUERY_FAILED (EVENT_TRACE_GROUP_JOB | 0x28) +#define WMI_LOG_TYPE_JOB_SET_NOTIFICATION (EVENT_TRACE_GROUP_JOB | 0x29) +#define WMI_LOG_TYPE_JOB_SEND_NOTIFICATION (EVENT_TRACE_GROUP_JOB | 0x2A) +#define WMI_LOG_TYPE_JOB_QUERY_VIOLATION (EVENT_TRACE_GROUP_JOB | 0x2B) +#define WMI_LOG_TYPE_JOB_SET_CPU_RATE (EVENT_TRACE_GROUP_JOB | 0x2C) +#define WMI_LOG_TYPE_JOB_SET_NET_RATE (EVENT_TRACE_GROUP_JOB | 0x2D) + +// +// Event types for Process +// + +#define WMI_LOG_TYPE_PROCESS_CREATE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_START) +#define WMI_LOG_TYPE_PROCESS_DELETE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_END) +#define WMI_LOG_TYPE_PROCESS_DC_START (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_DC_START) +#define WMI_LOG_TYPE_PROCESS_DC_END (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_DC_END) +#define WMI_LOG_TYPE_PROCESS_LOAD_IMAGE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_LOAD) +#define WMI_LOG_TYPE_PROCESS_TERMINATE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_TERMINATE) + +#define PERFINFO_LOG_TYPE_PROCESS_PERFCTR_END (EVENT_TRACE_GROUP_PROCESS | 0x20) +#define PERFINFO_LOG_TYPE_PROCESS_PERFCTR_RD (EVENT_TRACE_GROUP_PROCESS | 0x21) +// Reserved (EVENT_TRACE_GROUP_PROCESS | 0x22) +#define PERFINFO_LOG_TYPE_INSWAPPROCESS (EVENT_TRACE_GROUP_PROCESS | 0x23) +#define PERFINFO_LOG_TYPE_PROCESS_FREEZE (EVENT_TRACE_GROUP_PROCESS | 0x24) +#define PERFINFO_LOG_TYPE_PROCESS_THAW (EVENT_TRACE_GROUP_PROCESS | 0x25) +#define PERFINFO_LOG_TYPE_BOOT_PHASE_START (EVENT_TRACE_GROUP_PROCESS | 0x26) +#define PERFINFO_LOG_TYPE_ZOMBIE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x27) +#define PERFINFO_LOG_TYPE_PROCESS_SET_AFFINITY (EVENT_TRACE_GROUP_PROCESS | 0x28) + +#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_USER (EVENT_TRACE_GROUP_PROCESS | 0x30) +#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_EXECUTION (EVENT_TRACE_GROUP_PROCESS | 0x31) +#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_KERNEL (EVENT_TRACE_GROUP_PROCESS | 0x32) +#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_INSTRUMENTATION (EVENT_TRACE_GROUP_PROCESS | 0x33) +#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_PRESERVE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x34) + +#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_USER (EVENT_TRACE_GROUP_PROCESS | 0x40) +#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_EXECUTION (EVENT_TRACE_GROUP_PROCESS | 0x41) +#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_KERNEL (EVENT_TRACE_GROUP_PROCESS | 0x42) +#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_INSTRUMENTATION (EVENT_TRACE_GROUP_PROCESS | 0x43) +#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_PRESERVE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x44) + +#define PERFINFO_LOG_TYPE_WAKE_DROP_USER (EVENT_TRACE_GROUP_PROCESS | 0x50) +#define PERFINFO_LOG_TYPE_WAKE_DROP_EXECUTION (EVENT_TRACE_GROUP_PROCESS | 0x51) +#define PERFINFO_LOG_TYPE_WAKE_DROP_KERNEL (EVENT_TRACE_GROUP_PROCESS | 0x52) +#define PERFINFO_LOG_TYPE_WAKE_DROP_INSTRUMENTATION (EVENT_TRACE_GROUP_PROCESS | 0x53) +#define PERFINFO_LOG_TYPE_WAKE_DROP_PRESERVE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x54) + +#define PERFINFO_LOG_TYPE_WAKE_EVENT_USER (EVENT_TRACE_GROUP_PROCESS | 0x60) +#define PERFINFO_LOG_TYPE_WAKE_EVENT_EXECUTION (EVENT_TRACE_GROUP_PROCESS | 0x61) +#define PERFINFO_LOG_TYPE_WAKE_EVENT_KERNEL (EVENT_TRACE_GROUP_PROCESS | 0x62) +#define PERFINFO_LOG_TYPE_WAKE_EVENT_INSTRUMENTATION (EVENT_TRACE_GROUP_PROCESS | 0x63) +#define PERFINFO_LOG_TYPE_WAKE_EVENT_PRESERVE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x64) + +#define PERFINFO_LOG_TYPE_DEBUG_EVENT (EVENT_TRACE_GROUP_PROCESS | 0x70) + +// +// Event types for Image and Library Loader +// + +#define WMI_LOG_TYPE_IMAGE_LOAD (EVENT_TRACE_GROUP_IMAGE | EVENT_TRACE_TYPE_START) // reserved for future +#define WMI_LOG_TYPE_IMAGE_UNLOAD (EVENT_TRACE_GROUP_IMAGE | EVENT_TRACE_TYPE_END) +#define WMI_LOG_TYPE_IMAGE_DC_START (EVENT_TRACE_GROUP_IMAGE | EVENT_TRACE_TYPE_DC_START) +#define WMI_LOG_TYPE_IMAGE_DC_END (EVENT_TRACE_GROUP_IMAGE | EVENT_TRACE_TYPE_DC_END) +#define WMI_LOG_TYPE_IMAGE_RELOCATION (EVENT_TRACE_GROUP_IMAGE | 0x20) +#define WMI_LOG_TYPE_IMAGE_KERNEL_BASE (EVENT_TRACE_GROUP_IMAGE | 0x21) +#define WMI_LOG_TYPE_IMAGE_HYPERCALL_PAGE (EVENT_TRACE_GROUP_IMAGE | 0x22) + +#define PERFINFO_LOG_TYPE_LDR_LOCK_ACQUIRE_ATTEMPT (EVENT_TRACE_GROUP_IMAGE | 0x80) // 128 +#define PERFINFO_LOG_TYPE_LDR_LOCK_ACQUIRE_SUCCESS (EVENT_TRACE_GROUP_IMAGE | 0x81) +#define PERFINFO_LOG_TYPE_LDR_LOCK_ACQUIRE_FAIL (EVENT_TRACE_GROUP_IMAGE | 0x82) +#define PERFINFO_LOG_TYPE_LDR_LOCK_ACQUIRE_WAIT (EVENT_TRACE_GROUP_IMAGE | 0x83) +#define PERFINFO_LOG_TYPE_LDR_PROC_INIT_DONE (EVENT_TRACE_GROUP_IMAGE | 0x84) // 132 +#define PERFINFO_LOG_TYPE_LDR_CREATE_SECTION (EVENT_TRACE_GROUP_IMAGE | 0x85) +#define PERFINFO_LOG_TYPE_LDR_SECTION_CREATED (EVENT_TRACE_GROUP_IMAGE | 0x86) +#define PERFINFO_LOG_TYPE_LDR_MAP_VIEW (EVENT_TRACE_GROUP_IMAGE | 0x87) + +#define PERFINFO_LOG_TYPE_LDR_RELOCATE_IMAGE (EVENT_TRACE_GROUP_IMAGE | 0x90) // 144 +#define PERFINFO_LOG_TYPE_LDR_IMAGE_RELOCATED (EVENT_TRACE_GROUP_IMAGE | 0x91) +#define PERFINFO_LOG_TYPE_LDR_HANDLE_OLD_DESCRIPTORS (EVENT_TRACE_GROUP_IMAGE | 0x92) +#define PERFINFO_LOG_TYPE_LDR_OLD_DESCRIPTORS_HANDLED (EVENT_TRACE_GROUP_IMAGE | 0x93) +#define PERFINFO_LOG_TYPE_LDR_HANDLE_NEW_DESCRIPTORS (EVENT_TRACE_GROUP_IMAGE | 0x94) // 148 +#define PERFINFO_LOG_TYPE_LDR_NEW_DESCRIPTORS_HANDLED (EVENT_TRACE_GROUP_IMAGE | 0x95) +#define PERFINFO_LOG_TYPE_LDR_DLLMAIN_EXIT (EVENT_TRACE_GROUP_IMAGE | 0x96) + +#define PERFINFO_LOG_TYPE_LDR_FIND_DLL (EVENT_TRACE_GROUP_IMAGE | 0xA0) // 160 +#define PERFINFO_LOG_TYPE_LDR_VIEW_MAPPED (EVENT_TRACE_GROUP_IMAGE | 0xA1) +#define PERFINFO_LOG_TYPE_LDR_LOCK_RELEASE (EVENT_TRACE_GROUP_IMAGE | 0xA2) +#define PERFINFO_LOG_TYPE_LDR_DLLMAIN_ENTER (EVENT_TRACE_GROUP_IMAGE | 0xA3) +#define PERFINFO_LOG_TYPE_LDR_ERROR (EVENT_TRACE_GROUP_IMAGE | 0xA4) // 164 + +#define PERFINFO_LOG_TYPE_LDR_VIEW_MAPPING (EVENT_TRACE_GROUP_IMAGE | 0xA5) // 165 +#define PERFINFO_LOG_TYPE_LDR_SNAPPING (EVENT_TRACE_GROUP_IMAGE | 0xA6) +#define PERFINFO_LOG_TYPE_LDR_SNAPPED (EVENT_TRACE_GROUP_IMAGE | 0xA7) +#define PERFINFO_LOG_TYPE_LDR_LOADING (EVENT_TRACE_GROUP_IMAGE | 0xA8) +#define PERFINFO_LOG_TYPE_LDR_LOADED (EVENT_TRACE_GROUP_IMAGE | 0xA9) +#define PERFINFO_LOG_TYPE_LDR_FOUND_KNOWN_DLL (EVENT_TRACE_GROUP_IMAGE | 0xAA) // 170 +#define PERFINFO_LOG_TYPE_LDR_ABNORMAL (EVENT_TRACE_GROUP_IMAGE | 0xAB) +#define PERFINFO_LOG_TYPE_LDR_PLACEHOLDER (EVENT_TRACE_GROUP_IMAGE | 0xAC) +#define PERFINFO_LOG_TYPE_LDR_RDY_TO_INIT (EVENT_TRACE_GROUP_IMAGE | 0xAD) +#define PERFINFO_LOG_TYPE_LDR_RDY_TO_RUN (EVENT_TRACE_GROUP_IMAGE | 0xAE) // 174 + + +#define PERFINFO_LOG_TYPE_LDR_NEW_DLL_LOAD (EVENT_TRACE_GROUP_IMAGE | 0xB0) // 176 +#define PERFINFO_LOG_TYPE_LDR_NEW_DLL_AS_DATA (EVENT_TRACE_GROUP_IMAGE | 0xB1) // 177 + +#define PERFINFO_LOG_TYPE_LDR_EXTERNAL_PATH (EVENT_TRACE_GROUP_IMAGE | 0xC0) // 192 +#define PERFINFO_LOG_TYPE_LDR_GENERATED_PATH (EVENT_TRACE_GROUP_IMAGE | 0xC1) + +#define PERFINFO_LOG_TYPE_LDR_APISET_RESOLVING (EVENT_TRACE_GROUP_IMAGE | 0xD0) // 208 +#define PERFINFO_LOG_TYPE_LDR_APISET_HOSTED (EVENT_TRACE_GROUP_IMAGE | 0xD1) // 209 +#define PERFINFO_LOG_TYPE_LDR_APISET_UNHOSTED (EVENT_TRACE_GROUP_IMAGE | 0xD2) // 210 +#define PERFINFO_LOG_TYPE_LDR_APISET_UNRESOLVED (EVENT_TRACE_GROUP_IMAGE | 0xD3) // 211 + +#define PERFINFO_LOG_TYPE_LDR_SEARCH_SECURITY (EVENT_TRACE_GROUP_IMAGE | 0xD4) // 212 +#define PERFINFO_LOG_TYPE_LDR_SEARCH_PATH_SECURITY (EVENT_TRACE_GROUP_IMAGE | 0xD5) // 213 + +// +// Event types for Thread +// + +#define WMI_LOG_TYPE_THREAD_CREATE (EVENT_TRACE_GROUP_THREAD | EVENT_TRACE_TYPE_START) +#define WMI_LOG_TYPE_THREAD_DELETE (EVENT_TRACE_GROUP_THREAD | EVENT_TRACE_TYPE_END) +#define WMI_LOG_TYPE_THREAD_DC_START (EVENT_TRACE_GROUP_THREAD | EVENT_TRACE_TYPE_DC_START) +#define WMI_LOG_TYPE_THREAD_DC_END (EVENT_TRACE_GROUP_THREAD | EVENT_TRACE_TYPE_DC_END) + +// Reserved (EVENT_TRACE_GROUP_THREAD | 0x20) +// Reserved (EVENT_TRACE_GROUP_THREAD | 0x21) +// Reserved (EVENT_TRACE_GROUP_THREAD | 0x22) +// Reserved (EVENT_TRACE_GROUP_THREAD | 0x23) +#define PERFINFO_LOG_TYPE_CONTEXTSWAP (EVENT_TRACE_GROUP_THREAD | 0x24) +#define PERFINFO_LOG_TYPE_CONTEXTSWAP_BATCH (EVENT_TRACE_GROUP_THREAD | 0x25) +// Reserved (EVENT_TRACE_GROUP_THREAD | 0x26) +// Reserved (EVENT_TRACE_GROUP_THREAD | 0x27) +// Reserved (EVENT_TRACE_GROUP_THREAD | 0x28) +#define PERFINFO_LOG_TYPE_SPINLOCK (EVENT_TRACE_GROUP_THREAD | 0x29) +#define PERFINFO_LOG_TYPE_QUEUE (EVENT_TRACE_GROUP_THREAD | 0x2A) +#define PERFINFO_LOG_TYPE_RESOURCE (EVENT_TRACE_GROUP_THREAD | 0x2B) +#define PERFINFO_LOG_TYPE_PUSHLOCK (EVENT_TRACE_GROUP_THREAD | 0x2C) +#define PERFINFO_LOG_TYPE_WAIT_SINGLE (EVENT_TRACE_GROUP_THREAD | 0x2D) +#define PERFINFO_LOG_TYPE_WAIT_MULTIPLE (EVENT_TRACE_GROUP_THREAD | 0x2E) +#define PERFINFO_LOG_TYPE_DELAY_EXECUTION (EVENT_TRACE_GROUP_THREAD | 0x2F) +#define PERFINFO_LOG_TYPE_THREAD_SET_PRIORITY (EVENT_TRACE_GROUP_THREAD | 0x30) +#define PERFINFO_LOT_TYPE_THREAD_SET_BASE_PRIORITY (EVENT_TRACE_GROUP_THREAD | 0x31) +#define PERFINFO_LOG_TYPE_THREAD_SET_BASE_PRIORITY (EVENT_TRACE_GROUP_THREAD | 0x31) +#define PERFINFO_LOG_TYPE_READY_THREAD (EVENT_TRACE_GROUP_THREAD | 0x32) +#define PERFINFO_LOG_TYPE_THREAD_SET_PAGE_PRIORITY (EVENT_TRACE_GROUP_THREAD | 0x33) +#define PERFINFO_LOG_TYPE_THREAD_SET_IO_PRIORITY (EVENT_TRACE_GROUP_THREAD | 0x34) +#define PERFINFO_LOG_TYPE_THREAD_SET_AFFINITY (EVENT_TRACE_GROUP_THREAD | 0x35) +#define PERFINFO_LOG_TYPE_WORKER_THREAD_ITEM (EVENT_TRACE_GROUP_THREAD | 0x39) +#define PERFINFO_LOG_TYPE_DFSS_START_NEW_INTERVAL (EVENT_TRACE_GROUP_THREAD | 0x3A) +#define PERFINFO_LOG_TYPE_DFSS_PROCESS_IDLE_ONLY_QUEUE (EVENT_TRACE_GROUP_THREAD | 0x3B) +#define PERFINFO_LOG_TYPE_ANTI_STARVATION_BOOST (EVENT_TRACE_GROUP_THREAD | 0x3C) +#define PERFINFO_LOG_TYPE_THREAD_MIGRATION (EVENT_TRACE_GROUP_THREAD | 0x3D) +#define PERFINFO_LOG_TYPE_KQUEUE_ENQUEUE (EVENT_TRACE_GROUP_THREAD | 0x3E) +#define PERFINFO_LOG_TYPE_KQUEUE_DEQUEUE (EVENT_TRACE_GROUP_THREAD | 0x3F) +#define PERFINFO_LOG_TYPE_WORKER_THREAD_ITEM_START (EVENT_TRACE_GROUP_THREAD | 0x40) +#define PERFINFO_LOG_TYPE_WORKER_THREAD_ITEM_END (EVENT_TRACE_GROUP_THREAD | 0x41) +#define PERFINFO_LOG_TYPE_AUTO_BOOST_SET_FLOOR (EVENT_TRACE_GROUP_THREAD | 0x42) +#define PERFINFO_LOG_TYPE_AUTO_BOOST_CLEAR_FLOOR (EVENT_TRACE_GROUP_THREAD | 0x43) +#define PERFINFO_LOG_TYPE_AUTO_BOOST_NO_ENTRIES (EVENT_TRACE_GROUP_THREAD | 0x44) +#define PERFINFO_LOG_TYPE_THREAD_SUBPROCESSTAG_CHANGED (EVENT_TRACE_GROUP_THREAD | 0x45) + +// +// Event types for Network subsystem (TCPIP/UDPIP) +// + +#define WMI_LOG_TYPE_TCPIP_SEND (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_SEND) +#define WMI_LOG_TYPE_TCPIP_RECEIVE (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_RECEIVE) +#define WMI_LOG_TYPE_TCPIP_CONNECT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_CONNECT) +#define WMI_LOG_TYPE_TCPIP_DISCONNECT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_DISCONNECT) +#define WMI_LOG_TYPE_TCPIP_RETRANSMIT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_RETRANSMIT) +#define WMI_LOG_TYPE_TCPIP_ACCEPT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_ACCEPT) +#define WMI_LOG_TYPE_TCPIP_RECONNECT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_RECONNECT) +#define WMI_LOG_TYPE_TCPIP_FAIL (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_CONNFAIL) +#define WMI_LOG_TYPE_TCPIP_TCPCOPY (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_COPY_TCP) +#define WMI_LOG_TYPE_TCPIP_ARPCOPY (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_COPY_ARP) +#define WMI_LOG_TYPE_TCPIP_FULLACK (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_ACKFULL) +#define WMI_LOG_TYPE_TCPIP_PARTACK (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_ACKPART) +#define WMI_LOG_TYPE_TCPIP_DUPACK (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_ACKDUP) + +#define WMI_LOG_TYPE_UDP_SEND (EVENT_TRACE_GROUP_UDPIP | EVENT_TRACE_TYPE_SEND) +#define WMI_LOG_TYPE_UDP_RECEIVE (EVENT_TRACE_GROUP_UDPIP | EVENT_TRACE_TYPE_RECEIVE) +#define WMI_LOG_TYPE_UDP_FAIL (EVENT_TRACE_GROUP_UDPIP | EVENT_TRACE_TYPE_CONNFAIL) + +// +// Network events with IPV6 +// +#define WMI_LOG_TYPE_TCPIP_SEND_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x1A) +#define WMI_LOG_TYPE_TCPIP_RECEIVE_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x1B) +#define WMI_LOG_TYPE_TCPIP_CONNECT_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x1C) +#define WMI_LOG_TYPE_TCPIP_DISCONNECT_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x1D) +#define WMI_LOG_TYPE_TCPIP_RETRANSMIT_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x1E) +#define WMI_LOG_TYPE_TCPIP_ACCEPT_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x1F) +#define WMI_LOG_TYPE_TCPIP_RECONNECT_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x20) +#define WMI_LOG_TYPE_TCPIP_FAIL_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x21) +#define WMI_LOG_TYPE_TCPIP_TCPCOPY_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x22) +#define WMI_LOG_TYPE_TCPIP_ARPCOPY_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x23) +#define WMI_LOG_TYPE_TCPIP_FULLACK_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x24) +#define WMI_LOG_TYPE_TCPIP_PARTACK_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x25) +#define WMI_LOG_TYPE_TCPIP_DUPACK_IPV6 (EVENT_TRACE_GROUP_TCPIP | 0x26) + +#define WMI_LOG_TYPE_UDP_SEND_IPV6 (EVENT_TRACE_GROUP_UDPIP | 0x1A) +#define WMI_LOG_TYPE_UDP_RECEIVE_IPV6 (EVENT_TRACE_GROUP_UDPIP | 0x1B) + +// +// Event types for IO subsystem +// + +#define WMI_LOG_TYPE_IO_READ (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_READ) +#define WMI_LOG_TYPE_IO_WRITE (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_WRITE) +#define WMI_LOG_TYPE_IO_READ_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_READ_INIT) +#define WMI_LOG_TYPE_IO_WRITE_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_WRITE_INIT) +#define WMI_LOG_TYPE_IO_FLUSH (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_FLUSH) +#define WMI_LOG_TYPE_IO_FLUSH_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_FLUSH_INIT) +#define WMI_LOG_TYPE_IO_REDIRECTED_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_REDIRECTED_INIT) + +#define PERFINFO_LOG_TYPE_DRIVER_INIT (EVENT_TRACE_GROUP_IO | 0x20) +#define PERFINFO_LOG_TYPE_DRIVER_INIT_COMPLETE (EVENT_TRACE_GROUP_IO | 0x21) +#define PERFINFO_LOG_TYPE_DRIVER_MAJORFUNCTION_CALL (EVENT_TRACE_GROUP_IO | 0x22) +#define PERFINFO_LOG_TYPE_DRIVER_MAJORFUNCTION_RETURN (EVENT_TRACE_GROUP_IO | 0x23) +#define PERFINFO_LOG_TYPE_DRIVER_COMPLETIONROUTINE_CALL (EVENT_TRACE_GROUP_IO | 0x24) +#define PERFINFO_LOG_TYPE_DRIVER_COMPLETIONROUTINE_RETURN (EVENT_TRACE_GROUP_IO | 0x25) +#define PERFINFO_LOG_TYPE_DRIVER_ADD_DEVICE_CALL (EVENT_TRACE_GROUP_IO | 0x26) +#define PERFINFO_LOG_TYPE_DRIVER_ADD_DEVICE_RETURN (EVENT_TRACE_GROUP_IO | 0x27) +#define PERFINFO_LOG_TYPE_DRIVER_STARTIO_CALL (EVENT_TRACE_GROUP_IO | 0x28) +#define PERFINFO_LOG_TYPE_DRIVER_STARTIO_RETURN (EVENT_TRACE_GROUP_IO | 0x29) +// Reserved (EVENT_TRACE_GROUP_IO | 0x2a) +// Reserved (EVENT_TRACE_GROUP_IO | 0x2b) +// Reserved (EVENT_TRACE_GROUP_IO | 0x2c) +// Reserved (EVENT_TRACE_GROUP_IO | 0x2d) +// Reserved (EVENT_TRACE_GROUP_IO | 0x2e) +// Reserved (EVENT_TRACE_GROUP_IO | 0x2f) +#define PERFINFO_LOG_TYPE_PREFETCH_ACTION (EVENT_TRACE_GROUP_IO | 0x30) +#define PERFINFO_LOG_TYPE_PREFETCH_REQUEST (EVENT_TRACE_GROUP_IO | 0x31) +#define PERFINFO_LOG_TYPE_PREFETCH_READLIST (EVENT_TRACE_GROUP_IO | 0x32) +#define PERFINFO_LOG_TYPE_PREFETCH_READ (EVENT_TRACE_GROUP_IO | 0x33) +#define PERFINFO_LOG_TYPE_DRIVER_COMPLETE_REQUEST (EVENT_TRACE_GROUP_IO | 0x34) +#define PERFINFO_LOG_TYPE_DRIVER_COMPLETE_REQUEST_RETURN (EVENT_TRACE_GROUP_IO | 0x35) +#define PERFINFO_LOG_TYPE_BOOT_PREFETCH_INFORMATION (EVENT_TRACE_GROUP_IO | 0x36) +#define PERFINFO_LOG_TYPE_OPTICAL_IO_READ (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_OPTICAL_IO_READ) +#define PERFINFO_LOG_TYPE_OPTICAL_IO_WRITE (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_OPTICAL_IO_WRITE) +#define PERFINFO_LOG_TYPE_OPTICAL_IO_FLUSH (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_OPTICAL_IO_FLUSH) +#define PERFINFO_LOG_TYPE_OPTICAL_IO_READ_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_OPTICAL_IO_READ_INIT) +#define PERFINFO_LOG_TYPE_OPTICAL_IO_WRITE_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_OPTICAL_IO_WRITE_INIT) +#define PERFINFO_LOG_TYPE_OPTICAL_IO_FLUSH_INIT (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_OPTICAL_IO_FLUSH_INIT) + +// +// Event types for Memory subsystem +// +#define WMI_LOG_TYPE_PAGE_FAULT_TRANSITION (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_TF) +#define WMI_LOG_TYPE_PAGE_FAULT_DEMAND_ZERO (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_DZF) +#define WMI_LOG_TYPE_PAGE_FAULT_COPY_ON_WRITE (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_COW) +#define WMI_LOG_TYPE_PAGE_FAULT_GUARD_PAGE (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_GPF) +#define WMI_LOG_TYPE_PAGE_FAULT_HARD_PAGE_FAULT (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_HPF) +#define WMI_LOG_TYPE_PAGE_FAULT_ACCESS_VIOLATION (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_AV) + +#define PERFINFO_LOG_TYPE_HARDFAULT (EVENT_TRACE_GROUP_MEMORY | 0x20) +#define PERFINFO_LOG_TYPE_REMOVEPAGEBYCOLOR (EVENT_TRACE_GROUP_MEMORY | 0x21) +#define PERFINFO_LOG_TYPE_REMOVEPAGEFROMLIST (EVENT_TRACE_GROUP_MEMORY | 0x22) +#define PERFINFO_LOG_TYPE_PAGEINMEMORY (EVENT_TRACE_GROUP_MEMORY | 0x23) +#define PERFINFO_LOG_TYPE_INSERTINFREELIST (EVENT_TRACE_GROUP_MEMORY | 0x24) +#define PERFINFO_LOG_TYPE_INSERTINMODIFIEDLIST (EVENT_TRACE_GROUP_MEMORY | 0x25) +#define PERFINFO_LOG_TYPE_INSERTINLIST (EVENT_TRACE_GROUP_MEMORY | 0x26) +#define PERFINFO_LOG_TYPE_INSERTATFRONT (EVENT_TRACE_GROUP_MEMORY | 0x28) +#define PERFINFO_LOG_TYPE_UNLINKFROMSTANDBY (EVENT_TRACE_GROUP_MEMORY | 0x29) +#define PERFINFO_LOG_TYPE_UNLINKFFREEORZERO (EVENT_TRACE_GROUP_MEMORY | 0x2a) +#define PERFINFO_LOG_TYPE_WORKINGSETMANAGER (EVENT_TRACE_GROUP_MEMORY | 0x2b) +#define PERFINFO_LOG_TYPE_TRIMPROCESS (EVENT_TRACE_GROUP_MEMORY | 0x2c) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x2d) +#define PERFINFO_LOG_TYPE_ZEROSHARECOUNT (EVENT_TRACE_GROUP_MEMORY | 0x2e) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x2f) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x30) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x31) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x32) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x33) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x34) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x35) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x36) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x37) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x38) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x39) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x3a) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x3b) +#define PERFINFO_LOG_TYPE_WSINFOPROCESS (EVENT_TRACE_GROUP_MEMORY | 0x3c) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x3d) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x3e) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x3f) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x40) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x41) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x42) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x43) +// Reserved (EVENT_TRACE_GROUP_MEMORY | 0x44) +#define PERFINFO_LOG_TYPE_FAULTADDR_WITH_IP (EVENT_TRACE_GROUP_MEMORY | 0x45) +#define PERFINFO_LOG_TYPE_TRIMSESSION (EVENT_TRACE_GROUP_MEMORY | 0x46) +#define PERFINFO_LOG_TYPE_MEMORYSNAPLITE (EVENT_TRACE_GROUP_MEMORY | 0x47) +#define PERFINFO_LOG_TYPE_PFMAPPED_SECTION_RUNDOWN (EVENT_TRACE_GROUP_MEMORY | 0x48) +#define PERFINFO_LOG_TYPE_PFMAPPED_SECTION_CREATE (EVENT_TRACE_GROUP_MEMORY | 0x49) +#define PERFINFO_LOG_TYPE_WSINFOSESSION (EVENT_TRACE_GROUP_MEMORY | 0x4a) +#define PERFINFO_LOG_TYPE_CREATE_SESSION (EVENT_TRACE_GROUP_MEMORY | 0x4b) +#define PERFINFO_LOG_TYPE_SESSION_RUNDOWN_DC_END (EVENT_TRACE_GROUP_MEMORY | 0x4c) +#define PERFINFO_LOG_TYPE_SESSION_RUNDOWN_DC_START (EVENT_TRACE_GROUP_MEMORY | 0x4d) +#define PERFINFO_LOG_TYPE_SESSION_DELETE (EVENT_TRACE_GROUP_MEMORY | 0x4e) +#define PERFINFO_LOG_TYPE_PFMAPPED_SECTION_DELETE (EVENT_TRACE_GROUP_MEMORY | 0x4f) + +#define PERFINFO_LOG_TYPE_VIRTUAL_ALLOC (EVENT_TRACE_GROUP_MEMORY | 0x62) +#define PERFINFO_LOG_TYPE_VIRTUAL_FREE (EVENT_TRACE_GROUP_MEMORY | 0x63) +#define PERFINFO_LOG_TYPE_HEAP_RANGE_RUNDOWN (EVENT_TRACE_GROUP_MEMORY | 0x64) +#define PERFINFO_LOG_TYPE_HEAP_RANGE_CREATE (EVENT_TRACE_GROUP_MEMORY | 0x65) +#define PERFINFO_LOG_TYPE_HEAP_RANGE_RESERVE (EVENT_TRACE_GROUP_MEMORY | 0x66) +#define PERFINFO_LOG_TYPE_HEAP_RANGE_RELEASE (EVENT_TRACE_GROUP_MEMORY | 0x67) +#define PERFINFO_LOG_TYPE_HEAP_RANGE_DESTROY (EVENT_TRACE_GROUP_MEMORY | 0x68) + +#define PERFINFO_LOG_TYPE_PAGEFILE_BACK (EVENT_TRACE_GROUP_MEMORY | 0x69) +#define PERFINFO_LOG_TYPE_MEMINFO (EVENT_TRACE_GROUP_MEMORY | 0x70) +#define PERFINFO_LOG_TYPE_CONTMEM_GENERATE (EVENT_TRACE_GROUP_MEMORY | 0x71) +#define PERFINFO_LOG_TYPE_FILE_STORE_FAULT (EVENT_TRACE_GROUP_MEMORY | 0x72) +#define PERFINFO_LOG_TYPE_INMEMORY_STORE_FAULT (EVENT_TRACE_GROUP_MEMORY | 0x73) +#define PERFINFO_LOG_TYPE_COMPRESSED_PAGE (EVENT_TRACE_GROUP_MEMORY | 0x74) +#define PERFINFO_LOG_TYPE_PAGEINMEMORY_ACTIVE (EVENT_TRACE_GROUP_MEMORY | 0x75) +#define PERFINFO_LOG_TYPE_PAGE_ACCESS (EVENT_TRACE_GROUP_MEMORY | 0x76) +#define PERFINFO_LOG_TYPE_PAGE_RELEASE (EVENT_TRACE_GROUP_MEMORY | 0x77) +#define PERFINFO_LOG_TYPE_PAGE_RANGE_ACCESS (EVENT_TRACE_GROUP_MEMORY | 0x78) +#define PERFINFO_LOG_TYPE_PAGE_RANGE_RELEASE (EVENT_TRACE_GROUP_MEMORY | 0x79) +#define PERFINFO_LOG_TYPE_PAGE_COMBINE (EVENT_TRACE_GROUP_MEMORY | 0x7a) +#define PERFINFO_LOG_TYPE_KERNEL_MEMUSAGE (EVENT_TRACE_GROUP_MEMORY | 0x7b) +#define PERFINFO_LOG_TYPE_MM_STATS (EVENT_TRACE_GROUP_MEMORY | 0x7c) +#define PERFINFO_LOG_TYPE_MEMINFOEX_WS (EVENT_TRACE_GROUP_MEMORY | 0x7d) +#define PERFINFO_LOG_TYPE_MEMINFOEX_SESSIONWS (EVENT_TRACE_GROUP_MEMORY | 0x7e) + +#define PERFINFO_LOG_TYPE_VIRTUAL_ROTATE (EVENT_TRACE_GROUP_MEMORY | 0x7f) +#define PERFINFO_LOG_TYPE_VIRTUAL_ALLOC_DC_START (EVENT_TRACE_GROUP_MEMORY | 0x80) +#define PERFINFO_LOG_TYPE_VIRTUAL_ALLOC_DC_END (EVENT_TRACE_GROUP_MEMORY | 0x81) + +#define PERFINFO_LOG_TYPE_PAGE_ACCESS_EX (EVENT_TRACE_GROUP_MEMORY | 0x82) +#define PERFINFO_LOG_TYPE_REMOVEFROMWS (EVENT_TRACE_GROUP_MEMORY | 0x83) +#define PERFINFO_LOG_TYPE_WSSHAREABLE_RUNDOWN (EVENT_TRACE_GROUP_MEMORY | 0x84) +#define PERFINFO_LOG_TYPE_INMEMORYACTIVE_RUNDOWN (EVENT_TRACE_GROUP_MEMORY | 0x85) + +#define PERFINFO_LOG_TYPE_MEM_RESET_INFO (EVENT_TRACE_GROUP_MEMORY | 0x86) +#define PERFINFO_LOG_TYPE_PFMAPPED_SECTION_OBJECT_CREATE (EVENT_TRACE_GROUP_MEMORY | 0x87) +#define PERFINFO_LOG_TYPE_PFMAPPED_SECTION_OBJECT_DELETE (EVENT_TRACE_GROUP_MEMORY | 0x88) + +// +// +// Event types for Registry subsystem +// +#define WMI_LOG_TYPE_REG_RUNDOWNBEGIN (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGKCBRUNDOWNBEGIN) +#define WMI_LOG_TYPE_REG_RUNDOWNEND (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGKCBRUNDOWNEND) + +#define PERFINFO_LOG_TYPE_CMCELLREFERRED (EVENT_TRACE_GROUP_REGISTRY | 0x20) +#define PERFINFO_LOG_TYPE_REG_SET_VALUE (EVENT_TRACE_GROUP_REGISTRY | 0x21) +#define PERFINFO_LOG_TYPE_REG_COUNTERS (EVENT_TRACE_GROUP_REGISTRY | 0x22) +#define PERFINFO_LOG_TYPE_REG_CONFIG (EVENT_TRACE_GROUP_REGISTRY | 0x23) +#define PERFINFO_LOG_TYPE_REG_HIVE_INITIALIZE (EVENT_TRACE_GROUP_REGISTRY | 0x24) +#define PERFINFO_LOG_TYPE_REG_HIVE_DESTROY (EVENT_TRACE_GROUP_REGISTRY | 0x25) +#define PERFINFO_LOG_TYPE_REG_HIVE_LINK (EVENT_TRACE_GROUP_REGISTRY | 0x26) +#define PERFINFO_LOG_TYPE_REG_HIVE_RUNDOWN_DC_END (EVENT_TRACE_GROUP_REGISTRY | 0x27) +#define PERFINFO_LOG_TYPE_REG_HIVE_DIRTY (EVENT_TRACE_GROUP_REGISTRY | 0x28) +// Reserved +#define PERFINFO_LOG_TYPE_REG_NOTIF_REGISTER (EVENT_TRACE_GROUP_REGISTRY | 0x30) +#define PERFINFO_LOG_TYPE_REG_NOTIF_DELIVER (EVENT_TRACE_GROUP_REGISTRY | 0x31) + +// +// Event types for PERF tracing specific subsystem +// +#define PERFINFO_LOG_TYPE_RUNDOWN_CHECKPOINT (EVENT_TRACE_GROUP_PERFINFO | 0x20) +// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x21) +#define PERFINFO_LOG_TYPE_MARK (EVENT_TRACE_GROUP_PERFINFO | 0x22) +// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x23) +#define PERFINFO_LOG_TYPE_ASYNCMARK (EVENT_TRACE_GROUP_PERFINFO | 0x24) +// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x25) +#define PERFINFO_LOG_TYPE_IMAGENAME (EVENT_TRACE_GROUP_PERFINFO | 0x26) +#define PERFINFO_LOG_TYPE_DELAYS_CC_CAN_I_WRITE (EVENT_TRACE_GROUP_PERFINFO | 0x27) +// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x28) +// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x29) +// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x2a) +// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x2b) +// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x2c) +// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x2d) +#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE (EVENT_TRACE_GROUP_PERFINFO | 0x2e) +#define PERFINFO_LOG_TYPE_PMC_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x2f) +#define PERFINFO_LOG_TYPE_PMC_CONFIG (EVENT_TRACE_GROUP_PERFINFO | 0x30) +// Reserved (EVENT_TRACE_GROUP_PERFINFO | 0x31) +#define PERFINFO_LOG_TYPE_MSI_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x32) +#define PERFINFO_LOG_TYPE_SYSCALL_ENTER (EVENT_TRACE_GROUP_PERFINFO | 0x33) +#define PERFINFO_LOG_TYPE_SYSCALL_EXIT (EVENT_TRACE_GROUP_PERFINFO | 0x34) +#define PERFINFO_LOG_TYPE_BACKTRACE (EVENT_TRACE_GROUP_PERFINFO | 0x35) +#define PERFINFO_LOG_TYPE_BACKTRACE_USERSTACK (EVENT_TRACE_GROUP_PERFINFO | 0x36) +#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE_CACHE (EVENT_TRACE_GROUP_PERFINFO | 0x37) +#define PERFINFO_LOG_TYPE_EXCEPTION_STACK (EVENT_TRACE_GROUP_PERFINFO | 0x38) +#define PERFINFO_LOG_TYPE_BRANCH_TRACE (EVENT_TRACE_GROUP_PERFINFO | 0x39) +#define PERFINFO_LOG_TYPE_DEBUGGER_ENABLED (EVENT_TRACE_GROUP_PERFINFO | 0x3a) +#define PERFINFO_LOG_TYPE_DEBUGGER_EXIT (EVENT_TRACE_GROUP_PERFINFO | 0x3b) +#define PERFINFO_LOG_TYPE_BRANCH_TRACE_DEBUG (EVENT_TRACE_GROUP_PERFINFO | 0x40) +#define PERFINFO_LOG_TYPE_BRANCH_ADDRESS_DEBUG (EVENT_TRACE_GROUP_PERFINFO | 0x41) +#define PERFINFO_LOG_TYPE_THREADED_DPC (EVENT_TRACE_GROUP_PERFINFO | 0x42) +#define PERFINFO_LOG_TYPE_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x43) +#define PERFINFO_LOG_TYPE_DPC (EVENT_TRACE_GROUP_PERFINFO | 0x44) +#define PERFINFO_LOG_TYPE_TIMERDPC (EVENT_TRACE_GROUP_PERFINFO | 0x45) +#define PERFINFO_LOG_TYPE_IOTIMER_EXPIRATION (EVENT_TRACE_GROUP_PERFINFO | 0x46) +#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE_NMI (EVENT_TRACE_GROUP_PERFINFO | 0x47) +#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE_SET_INTERVAL (EVENT_TRACE_GROUP_PERFINFO | 0x48) +#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE_DC_START (EVENT_TRACE_GROUP_PERFINFO | 0x49) +#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE_DC_END (EVENT_TRACE_GROUP_PERFINFO | 0x4a) +#define PERFINFO_LOG_TYPE_SPINLOCK_DC_START (EVENT_TRACE_GROUP_PERFINFO | 0x4b) +#define PERFINFO_LOG_TYPE_SPINLOCK_DC_END (EVENT_TRACE_GROUP_PERFINFO | 0x4c) +#define PERFINFO_LOG_TYPE_ERESOURCE_DC_START (EVENT_TRACE_GROUP_PERFINFO | 0x4d) +#define PERFINFO_LOG_TYPE_ERESOURCE_DC_END (EVENT_TRACE_GROUP_PERFINFO | 0x4e) +#define PERFINFO_LOG_TYPE_CLOCK_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x4f) +#define PERFINFO_LOG_TYPE_TIMER_EXPIRATION_START (EVENT_TRACE_GROUP_PERFINFO | 0x50) +#define PERFINFO_LOG_TYPE_TIMER_EXPIRATION (EVENT_TRACE_GROUP_PERFINFO | 0x51) +#define PERFINFO_LOG_TYPE_TIMER_SET_PERIODIC (EVENT_TRACE_GROUP_PERFINFO | 0x52) +#define PERFINFO_LOG_TYPE_TIMER_SET_ONE_SHOT (EVENT_TRACE_GROUP_PERFINFO | 0x53) +#define PERFINFO_LOG_TYPE_TIMER_SET_THREAD (EVENT_TRACE_GROUP_PERFINFO | 0x54) +#define PERFINFO_LOG_TYPE_TIMER_CANCEL (EVENT_TRACE_GROUP_PERFINFO | 0x55) +#define PERFINFO_LOG_TYPE_TIME_ADJUSTMENT (EVENT_TRACE_GROUP_PERFINFO | 0x56) +#define PERFINFO_LOG_TYPE_CLOCK_MODE_SWITCH (EVENT_TRACE_GROUP_PERFINFO | 0x57) +#define PERFINFO_LOG_TYPE_CLOCK_TIME_UPDATE (EVENT_TRACE_GROUP_PERFINFO | 0x58) +#define PERFINFO_LOG_TYPE_CLOCK_DYNAMIC_TICK_VETO (EVENT_TRACE_GROUP_PERFINFO | 0x59) +#define PERFINFO_LOG_TYPE_CLOCK_CONFIGURATION (EVENT_TRACE_GROUP_PERFINFO | 0x5a) +#define PERFINFO_LOG_TYPE_IPI (EVENT_TRACE_GROUP_PERFINFO | 0x5b) +#define PERFINFO_LOG_TYPE_UNEXPECTED_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x5c) +#define PERFINFO_LOG_TYPE_IOTIMER_START (EVENT_TRACE_GROUP_PERFINFO | 0x5d) +#define PERFINFO_LOG_TYPE_IOTIMER_STOP (EVENT_TRACE_GROUP_PERFINFO | 0x5e) +#define PERFINFO_LOG_TYPE_PASSIVE_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x5f) +#define PERFINFO_LOG_TYPE_WDF_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x60) +#define PERFINFO_LOG_TYPE_WDF_PASSIVE_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x61) +#define PERFINFO_LOG_TYPE_WDF_DPC (EVENT_TRACE_GROUP_PERFINFO | 0x62) +#define PERFINFO_LOG_TYPE_CPU_CACHE_FLUSH (EVENT_TRACE_GROUP_PERFINFO | 0x63) +#define PERFINFO_LOG_TYPE_DPC_ENQUEUE (EVENT_TRACE_GROUP_PERFINFO | 0x64) +#define PERFINFO_LOG_TYPE_DPC_EXECUTION (EVENT_TRACE_GROUP_PERFINFO | 0x65) +#define PERFINFO_LOG_TYPE_INTERRUPT_STEERING (EVENT_TRACE_GROUP_PERFINFO | 0x66) +#define PERFINFO_LOG_TYPE_WDF_WORK_ITEM (EVENT_TRACE_GROUP_PERFINFO | 0x67) +#define PERFINFO_LOG_TYPE_KTIMER2_SET (EVENT_TRACE_GROUP_PERFINFO | 0x68) +#define PERFINFO_LOG_TYPE_KTIMER2_EXPIRATION (EVENT_TRACE_GROUP_PERFINFO | 0x69) +#define PERFINFO_LOG_TYPE_KTIMER2_CANCEL (EVENT_TRACE_GROUP_PERFINFO | 0x6a) +#define PERFINFO_LOG_TYPE_KTIMER2_DISABLE (EVENT_TRACE_GROUP_PERFINFO | 0x6b) +#define PERFINFO_LOG_TYPE_KTIMER2_FINALIZATION (EVENT_TRACE_GROUP_PERFINFO | 0x6c) +#define PERFINFO_LOG_TYPE_SHOULD_YIELD_PROCESSOR (EVENT_TRACE_GROUP_PERFINFO | 0x6d) + +// +// Event types for ICE. +// + +#define PERFINFO_LOG_TYPE_FUNCTION_CALL (EVENT_TRACE_GROUP_PERFINFO | 0x80) +#define PERFINFO_LOG_TYPE_FUNCTION_RETURN (EVENT_TRACE_GROUP_PERFINFO | 0x81) +#define PERFINFO_LOG_TYPE_FUNCTION_ENTER (EVENT_TRACE_GROUP_PERFINFO | 0x82) +#define PERFINFO_LOG_TYPE_FUNCTION_EXIT (EVENT_TRACE_GROUP_PERFINFO | 0x83) +#define PERFINFO_LOG_TYPE_TAILCALL (EVENT_TRACE_GROUP_PERFINFO | 0x84) +#define PERFINFO_LOG_TYPE_TRAP (EVENT_TRACE_GROUP_PERFINFO | 0x85) +#define PERFINFO_LOG_TYPE_SPINLOCK_ACQUIRE (EVENT_TRACE_GROUP_PERFINFO | 0x86) +#define PERFINFO_LOG_TYPE_SPINLOCK_RELEASE (EVENT_TRACE_GROUP_PERFINFO | 0x87) +#define PERFINFO_LOG_TYPE_CAP_COMMENT (EVENT_TRACE_GROUP_PERFINFO | 0x88) +#define PERFINFO_LOG_TYPE_CAP_RUNDOWN (EVENT_TRACE_GROUP_PERFINFO | 0x89) + +// +// Event types for Debugger subsystem. +// + +#define PERFINFO_LOG_TYPE_DEBUG_PRINT (EVENT_TRACE_GROUP_DBGPRINT | 0x20) + +// +// Event types for WNF facility +// + +#define PERFINFO_LOG_TYPE_WNF_SUBSCRIBE (EVENT_TRACE_GROUP_WNF | 0x20) +#define PERFINFO_LOG_TYPE_WNF_UNSUBSCRIBE (EVENT_TRACE_GROUP_WNF | 0x21) +#define PERFINFO_LOG_TYPE_WNF_CALLBACK (EVENT_TRACE_GROUP_WNF | 0x22) +#define PERFINFO_LOG_TYPE_WNF_PUBLISH (EVENT_TRACE_GROUP_WNF | 0x23) +#define PERFINFO_LOG_TYPE_WNF_NAME_SUB_RUNDOWN (EVENT_TRACE_GROUP_WNF | 0x24) + +// +// Event types for Pool subsystem. +// + +#define PERFINFO_LOG_TYPE_ALLOCATEPOOL (EVENT_TRACE_GROUP_POOL | 0x20) +#define PERFINFO_LOG_TYPE_ALLOCATEPOOL_SESSION (EVENT_TRACE_GROUP_POOL | 0x21) +#define PERFINFO_LOG_TYPE_FREEPOOL (EVENT_TRACE_GROUP_POOL | 0x22) +#define PERFINFO_LOG_TYPE_FREEPOOL_SESSION (EVENT_TRACE_GROUP_POOL | 0x23) +#define PERFINFO_LOG_TYPE_ADDPOOLPAGE (EVENT_TRACE_GROUP_POOL | 0x24) +#define PERFINFO_LOG_TYPE_ADDPOOLPAGE_SESSION (EVENT_TRACE_GROUP_POOL | 0x25) +#define PERFINFO_LOG_TYPE_BIGPOOLPAGE (EVENT_TRACE_GROUP_POOL | 0x26) +#define PERFINFO_LOG_TYPE_BIGPOOLPAGE_SESSION (EVENT_TRACE_GROUP_POOL | 0x27) +#define PERFINFO_LOG_TYPE_POOLSNAP_DC_START (EVENT_TRACE_GROUP_POOL | 0x28) +#define PERFINFO_LOG_TYPE_POOLSNAP_DC_END (EVENT_TRACE_GROUP_POOL | 0x29) +#define PERFINFO_LOG_TYPE_BIGPOOLSNAP_DC_START (EVENT_TRACE_GROUP_POOL | 0x2a) +#define PERFINFO_LOG_TYPE_BIGPOOLSNAP_DC_END (EVENT_TRACE_GROUP_POOL | 0x2b) +#define PERFINFO_LOG_TYPE_POOLSNAP_SESSION_DC_START (EVENT_TRACE_GROUP_POOL | 0x2c) +#define PERFINFO_LOG_TYPE_POOLSNAP_SESSION_DC_END (EVENT_TRACE_GROUP_POOL | 0x2d) +#define PERFINFO_LOG_TYPE_SESSIONBIGPOOLSNAP_DC_START (EVENT_TRACE_GROUP_POOL | 0x2e) +#define PERFINFO_LOG_TYPE_SESSIONBIGPOOLSNAP_DC_END (EVENT_TRACE_GROUP_POOL | 0x2f) + +// +// Event types for Heap subsystem +// +#define PERFINFO_LOG_TYPE_HEAP_CREATE (EVENT_TRACE_GROUP_HEAP | 0x20) +#define PERFINFO_LOG_TYPE_HEAP_ALLOC (EVENT_TRACE_GROUP_HEAP | 0x21) +#define PERFINFO_LOG_TYPE_HEAP_REALLOC (EVENT_TRACE_GROUP_HEAP | 0x22) +#define PERFINFO_LOG_TYPE_HEAP_DESTROY (EVENT_TRACE_GROUP_HEAP | 0x23) +#define PERFINFO_LOG_TYPE_HEAP_FREE (EVENT_TRACE_GROUP_HEAP | 0x24) +#define PERFINFO_LOG_TYPE_HEAP_EXTEND (EVENT_TRACE_GROUP_HEAP | 0x25) +#define PERFINFO_LOG_TYPE_HEAP_SNAPSHOT (EVENT_TRACE_GROUP_HEAP | 0x26) +#define PERFINFO_LOG_TYPE_HEAP_CREATE_SNAPSHOT (EVENT_TRACE_GROUP_HEAP | 0x27) +#define PERFINFO_LOG_TYPE_HEAP_DESTROY_SNAPSHOT (EVENT_TRACE_GROUP_HEAP | 0x28) +#define PERFINFO_LOG_TYPE_HEAP_EXTEND_SNAPSHOT (EVENT_TRACE_GROUP_HEAP | 0x29) +#define PERFINFO_LOG_TYPE_HEAP_CONTRACT (EVENT_TRACE_GROUP_HEAP | 0x2a) +#define PERFINFO_LOG_TYPE_HEAP_LOCK (EVENT_TRACE_GROUP_HEAP | 0x2b) +#define PERFINFO_LOG_TYPE_HEAP_UNLOCK (EVENT_TRACE_GROUP_HEAP | 0x2c) +#define PERFINFO_LOG_TYPE_HEAP_VALIDATE (EVENT_TRACE_GROUP_HEAP | 0x2d) +#define PERFINFO_LOG_TYPE_HEAP_WALK (EVENT_TRACE_GROUP_HEAP | 0x2e) + +#define PERFINFO_LOG_TYPE_HEAP_SUBSEGMENT_ALLOC (EVENT_TRACE_GROUP_HEAP | 0x2f) +#define PERFINFO_LOG_TYPE_HEAP_SUBSEGMENT_FREE (EVENT_TRACE_GROUP_HEAP | 0x30) +#define PERFINFO_LOG_TYPE_HEAP_SUBSEGMENT_ALLOC_CACHE (EVENT_TRACE_GROUP_HEAP | 0x31) +#define PERFINFO_LOG_TYPE_HEAP_SUBSEGMENT_FREE_CACHE (EVENT_TRACE_GROUP_HEAP | 0x32) +#define PERFINFO_LOG_TYPE_HEAP_COMMIT (EVENT_TRACE_GROUP_HEAP | 0x33) +#define PERFINFO_LOG_TYPE_HEAP_DECOMMIT (EVENT_TRACE_GROUP_HEAP | 0x34) +#define PERFINFO_LOG_TYPE_HEAP_SUBSEGMENT_INIT (EVENT_TRACE_GROUP_HEAP | 0x35) +#define PERFINFO_LOG_TYPE_HEAP_AFFINITY_ENABLE (EVENT_TRACE_GROUP_HEAP | 0x36) +//Reserved (EVENT_TRACE_GROUP_HEAP | 0x37) +#define PERFINFO_LOG_TYPE_HEAP_SUBSEGMENT_ACTIVATED (EVENT_TRACE_GROUP_HEAP | 0x38) +#define PERFINFO_LOG_TYPE_HEAP_AFFINITY_ASSIGN (EVENT_TRACE_GROUP_HEAP | 0x39) +#define PERFINFO_LOG_TYPE_HEAP_REUSE_THRESHOLD_ACTIVATED (EVENT_TRACE_GROUP_HEAP | 0x3a) + +// +// Event Types for Critical Section Subsystem +// + +#define PERFINFO_LOG_TYPE_CRITSEC_ENTER (EVENT_TRACE_GROUP_CRITSEC | 0x20) +#define PERFINFO_LOG_TYPE_CRITSEC_LEAVE (EVENT_TRACE_GROUP_CRITSEC | 0x21) +#define PERFINFO_LOG_TYPE_CRITSEC_COLLISION (EVENT_TRACE_GROUP_CRITSEC | 0x22) +#define PERFINFO_LOG_TYPE_CRITSEC_INITIALIZE (EVENT_TRACE_GROUP_CRITSEC | 0x23) + +// +// Event types for Stackwalk subsystem +// + +#define PERFINFO_LOG_TYPE_STACKWALK (EVENT_TRACE_GROUP_STACKWALK | 0x20) +//Reserved (EVENT_TRACE_GROUP_STACKWALK | 0x21) +#define PERFINFO_LOG_TYPE_STACKTRACE_CREATE (EVENT_TRACE_GROUP_STACKWALK | 0x22) +#define PERFINFO_LOG_TYPE_STACKTRACE_DELETE (EVENT_TRACE_GROUP_STACKWALK | 0x23) +#define PERFINFO_LOG_TYPE_STACKTRACE_RUNDOWN (EVENT_TRACE_GROUP_STACKWALK | 0x24) +#define PERFINFO_LOG_TYPE_STACKTRACE_KEY_KERNEL (EVENT_TRACE_GROUP_STACKWALK | 0x25) +#define PERFINFO_LOG_TYPE_STACKTRACE_KEY_USER (EVENT_TRACE_GROUP_STACKWALK | 0x26) + +// +// Event types for ALPC +// + +#define WMI_LOG_TYPE_ALPC_SEND_MESSAGE (EVENT_TRACE_GROUP_ALPC | 0x21) +#define WMI_LOG_TYPE_ALPC_RECEIVE_MESSAGE (EVENT_TRACE_GROUP_ALPC | 0x22) +#define WMI_LOG_TYPE_ALPC_WAIT_FOR_REPLY (EVENT_TRACE_GROUP_ALPC | 0x23) +#define WMI_LOG_TYPE_ALPC_WAIT_FOR_NEW_MESSAGE (EVENT_TRACE_GROUP_ALPC | 0x24) +#define WMI_LOG_TYPE_ALPC_UNWAIT (EVENT_TRACE_GROUP_ALPC | 0x25) +#define WMI_LOG_TYPE_ALPC_CONNECT_REQUEST (EVENT_TRACE_GROUP_ALPC | 0x26) +#define WMI_LOG_TYPE_ALPC_CONNECT_SUCCESS (EVENT_TRACE_GROUP_ALPC | 0x27) +#define WMI_LOG_TYPE_ALPC_CONNECT_FAIL (EVENT_TRACE_GROUP_ALPC | 0x28) +#define WMI_LOG_TYPE_ALPC_CLOSE_PORT (EVENT_TRACE_GROUP_ALPC | 0x29) + + +// +// Event types for Object Manager subsystem +// + +#define PERFINFO_LOG_TYPE_CREATE_HANDLE (EVENT_TRACE_GROUP_OBJECT | 0x20) +#define PERFINFO_LOG_TYPE_CLOSE_HANDLE (EVENT_TRACE_GROUP_OBJECT | 0x21) +#define PERFINFO_LOG_TYPE_DUPLICATE_HANDLE (EVENT_TRACE_GROUP_OBJECT | 0x22) +//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x23) +#define PERFINFO_LOG_TYPE_OBJECT_TYPE_DC_START (EVENT_TRACE_GROUP_OBJECT | 0x24) +#define PERFINFO_LOG_TYPE_OBJECT_TYPE_DC_END (EVENT_TRACE_GROUP_OBJECT | 0x25) +#define PERFINFO_LOG_TYPE_OBJECT_HANDLE_DC_START (EVENT_TRACE_GROUP_OBJECT | 0x26) +#define PERFINFO_LOG_TYPE_OBJECT_HANDLE_DC_END (EVENT_TRACE_GROUP_OBJECT | 0x27) +//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x28) +//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x29) +//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x2a) +//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x2b) +//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x2c) +//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x2d) +//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x2e) +//Reserved (EVENT_TRACE_GROUP_OBJECT | 0x2f) +#define PERFINFO_LOG_TYPE_CREATE_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x30) +#define PERFINFO_LOG_TYPE_DELETE_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x31) +#define PERFINFO_LOG_TYPE_REFERENCE_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x32) +#define PERFINFO_LOG_TYPE_DEREFERENCE_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x33) + +// +// Event types for Power subsystem +// + +#define PERFINFO_LOG_TYPE_BATTERY_LIFE_INFO (EVENT_TRACE_GROUP_POWER | 0x20) +#define PERFINFO_LOG_TYPE_IDLE_STATE_CHANGE (EVENT_TRACE_GROUP_POWER | 0x21) +#define PERFINFO_LOG_TYPE_SET_POWER_ACTION (EVENT_TRACE_GROUP_POWER | 0x22) +#define PERFINFO_LOG_TYPE_SET_POWER_ACTION_RET (EVENT_TRACE_GROUP_POWER | 0x23) +#define PERFINFO_LOG_TYPE_SET_DEVICES_STATE (EVENT_TRACE_GROUP_POWER | 0x24) +#define PERFINFO_LOG_TYPE_SET_DEVICES_STATE_RET (EVENT_TRACE_GROUP_POWER | 0x25) +#define PERFINFO_LOG_TYPE_PO_NOTIFY_DEVICE (EVENT_TRACE_GROUP_POWER | 0x26) +#define PERFINFO_LOG_TYPE_PO_NOTIFY_DEVICE_COMPLETE (EVENT_TRACE_GROUP_POWER | 0x27) +#define PERFINFO_LOG_TYPE_PO_SESSION_CALLOUT (EVENT_TRACE_GROUP_POWER | 0x28) +#define PERFINFO_LOG_TYPE_PO_SESSION_CALLOUT_RET (EVENT_TRACE_GROUP_POWER | 0x29) +#define PERFINFO_LOG_TYPE_PO_PRESLEEP (EVENT_TRACE_GROUP_POWER | 0x30) +#define PERFINFO_LOG_TYPE_PO_POSTSLEEP (EVENT_TRACE_GROUP_POWER | 0x31) +#define PERFINFO_LOG_TYPE_PO_CALIBRATED_PERFCOUNTER (EVENT_TRACE_GROUP_POWER | 0x32) +#define PERFINFO_LOG_TYPE_PPM_PERF_STATE_CHANGE (EVENT_TRACE_GROUP_POWER | 0x33) +#define PERFINFO_LOG_TYPE_PPM_THROTTLE_STATE_CHANGE (EVENT_TRACE_GROUP_POWER | 0x34) +#define PERFINFO_LOG_TYPE_PPM_IDLE_STATE_CHANGE (EVENT_TRACE_GROUP_POWER | 0x35) +#define PERFINFO_LOG_TYPE_PPM_THERMAL_CONSTRAINT (EVENT_TRACE_GROUP_POWER | 0x36) +#define PERFINFO_LOG_TYPE_PO_SIGNAL_RESUME_UI (EVENT_TRACE_GROUP_POWER | 0x37) +#define PERFINFO_LOG_TYPE_PO_SIGNAL_VIDEO_ON (EVENT_TRACE_GROUP_POWER | 0x38) +#define PERFINFO_LOG_TYPE_PPM_IDLE_STATE_ENTER (EVENT_TRACE_GROUP_POWER | 0x39) +#define PERFINFO_LOG_TYPE_PPM_IDLE_STATE_EXIT (EVENT_TRACE_GROUP_POWER | 0x3a) +#define PERFINFO_LOG_TYPE_PPM_PLATFORM_IDLE_STATE_ENTER (EVENT_TRACE_GROUP_POWER | 0x3b) +#define PERFINFO_LOG_TYPE_PPM_IDLE_EXIT_LATENCY (EVENT_TRACE_GROUP_POWER | 0x3c) +#define PERFINFO_LOG_TYPE_PPM_IDLE_PROCESSOR_SELECTION (EVENT_TRACE_GROUP_POWER | 0x3d) +#define PERFINFO_LOG_TYPE_PPM_IDLE_PLATFORM_SELECTION (EVENT_TRACE_GROUP_POWER | 0x3e) +#define PERFINFO_LOG_TYPE_PPM_COORDINATED_IDLE_ENTER (EVENT_TRACE_GROUP_POWER | 0x3f) +#define PERFINFO_LOG_TYPE_PPM_COORDINATED_IDLE_EXIT (EVENT_TRACE_GROUP_POWER | 0x40) + +// +// Event types for MODBound subsystem +// +#define PERFINFO_LOG_TYPE_COWHEADER (EVENT_TRACE_GROUP_MODBOUND | 0x18) +#define PERFINFO_LOG_TYPE_COWBLOB (EVENT_TRACE_GROUP_MODBOUND | 0x19) +#define PERFINFO_LOG_TYPE_COWBLOB_CLOSED (EVENT_TRACE_GROUP_MODBOUND | 0x1a) +#define PERFINFO_LOG_TYPE_MODULEBOUND_ENT (EVENT_TRACE_GROUP_MODBOUND | 0x20) +#define PERFINFO_LOG_TYPE_MODULEBOUND_JUMP (EVENT_TRACE_GROUP_MODBOUND | 0x21) +#define PERFINFO_LOG_TYPE_MODULEBOUND_RET (EVENT_TRACE_GROUP_MODBOUND | 0x22) +#define PERFINFO_LOG_TYPE_MODULEBOUND_CALL (EVENT_TRACE_GROUP_MODBOUND | 0x23) +#define PERFINFO_LOG_TYPE_MODULEBOUND_CALLRET (EVENT_TRACE_GROUP_MODBOUND | 0x24) +#define PERFINFO_LOG_TYPE_MODULEBOUND_INT2E (EVENT_TRACE_GROUP_MODBOUND | 0x25) +#define PERFINFO_LOG_TYPE_MODULEBOUND_INT2B (EVENT_TRACE_GROUP_MODBOUND | 0x26) +#define PERFINFO_LOG_TYPE_MODULEBOUND_FULLTRACE (EVENT_TRACE_GROUP_MODBOUND | 0x27) + +// +// Event types for the thread class scheduler +// +// TODO: Because MMCSS is a DLL it doesn't need to use UMGL. +// +#define PERFINFO_LOG_TYPE_MMCSS_START (0x20) +#define PERFINFO_LOG_TYPE_MMCSS_STOP (0x21) +#define PERFINFO_LOG_TYPE_MMCSS_SCHEDULER_EVENT (0x22) +#define PERFINFO_LOG_TYPE_MMCSS_SCHEDULER_WAKEUP (0x23) +#define PERFINFO_LOG_TYPE_MMCSS_SCHEDULER_SLEEP (0x24) +#define PERFINFO_LOG_TYPE_MMCSS_SCHEDULER_SLEEP_RESP (0x25) + +// +// Event types To be Decided if they are still needed? +// + +#define PERFINFO_LOG_TYPE_DISPATCHMSG (EVENT_TRACE_GROUP_TBD | 0x00) +#define PERFINFO_LOG_TYPE_GLYPHCACHE (EVENT_TRACE_GROUP_TBD | 0x01) +#define PERFINFO_LOG_TYPE_GLYPHS (EVENT_TRACE_GROUP_TBD | 0x02) +#define PERFINFO_LOG_TYPE_READWRITE (EVENT_TRACE_GROUP_TBD | 0x03) +#define PERFINFO_LOG_TYPE_EXPLICIT_LOAD (EVENT_TRACE_GROUP_TBD | 0x04) +#define PERFINFO_LOG_TYPE_IMPLICIT_LOAD (EVENT_TRACE_GROUP_TBD | 0x05) +#define PERFINFO_LOG_TYPE_CHECKSUM (EVENT_TRACE_GROUP_TBD | 0x06) +#define PERFINFO_LOG_TYPE_DLL_INIT (EVENT_TRACE_GROUP_TBD | 0x07) +#define PERFINFO_LOG_TYPE_SERVICE_DD_START_INIT (EVENT_TRACE_GROUP_TBD | 0x08) +#define PERFINFO_LOG_TYPE_SERVICE_DD_DONE_INIT (EVENT_TRACE_GROUP_TBD | 0x09) +#define PERFINFO_LOG_TYPE_SERVICE_START_INIT (EVENT_TRACE_GROUP_TBD | 0x0a) +#define PERFINFO_LOG_TYPE_SERVICE_DONE_INIT (EVENT_TRACE_GROUP_TBD | 0x0b) +#define PERFINFO_LOG_TYPE_SERVICE_NAME (EVENT_TRACE_GROUP_TBD | 0x0c) +// Reserved (EVENT_TRACE_GROUP_TBD | 0x0d) +#define PERFINFO_LOG_TIMED_ENTER_ROUTINE (EVENT_TRACE_GROUP_TBD | 0x0e) +#define PERFINFO_LOG_TIMED_EXIT_ROUTINE (EVENT_TRACE_GROUP_TBD | 0x0f) +#define PERFINFO_LOG_TYPE_CTIME_STATS (EVENT_TRACE_GROUP_TBD | 0x10) +#define PERFINFO_LOG_TYPE_MARKED_DIRTY (EVENT_TRACE_GROUP_TBD | 0x11) +#define PERFINFO_LOG_TYPE_MARKED_CELL_DIRTY (EVENT_TRACE_GROUP_TBD | 0x12) +#define PERFINFO_LOG_TYPE_HIVE_WRITE_DIRTY (EVENT_TRACE_GROUP_TBD | 0x13) +#define PERFINFO_LOG_TYPE_DUMP_HIVECELL (EVENT_TRACE_GROUP_TBD | 0x14) +#define PERFINFO_LOG_TYPE_HIVE_STAT (EVENT_TRACE_GROUP_TBD | 0x16) +#define PERFINFO_LOG_TYPE_CLOCKREF (EVENT_TRACE_GROUP_TBD | 0x17) +// Reserved (EVENT_TRACE_GROUP_TBD | 0x18) +// Reserved (EVENT_TRACE_GROUP_TBD | 0x19) +// Reserved (EVENT_TRACE_GROUP_TBD | 0x1a) +#define PERFINFO_LOG_TYPE_WMIPERFFREQUENCY (EVENT_TRACE_GROUP_TBD | 0x1d) +#define PERFINFO_LOG_TYPE_CDROM_READ (EVENT_TRACE_GROUP_TBD | 0x1e) +#define PERFINFO_LOG_TYPE_CDROM_READ_COMPLETE (EVENT_TRACE_GROUP_TBD | 0x1f) +#define PERFINFO_LOG_TYPE_KE_SET_EVENT (EVENT_TRACE_GROUP_TBD | 0x20) +#define PERFINFO_LOG_TYPE_REG_PARSEKEY (EVENT_TRACE_GROUP_TBD | 0x21) +#define PERFINFO_LOG_TYPE_REG_PARSEKEYEND (EVENT_TRACE_GROUP_TBD | 0x22) +#define PERFINFO_LOG_TYPE_ATTACH_PROCESS (EVENT_TRACE_GROUP_TBD | 0x24) +#define PERFINFO_LOG_TYPE_DETACH_PROCESS (EVENT_TRACE_GROUP_TBD | 0x25) +// Reserved (EVENT_TRACE_GROUP_TBD | 0x26) +#define PERFINFO_LOG_TYPE_KDHELP (EVENT_TRACE_GROUP_TBD | 0x27) +// Reserved (EVENT_TRACE_GROUP_TBD | 0x28) +// Reserved (EVENT_TRACE_GROUP_TBD | 0x29) +// Reserved (EVENT_TRACE_GROUP_TBD | 0x2a) +// Reserved (EVENT_TRACE_GROUP_TBD | 0x2b) +#define PERFINFO_LOG_TYPE_FAILED_STKDUMP (EVENT_TRACE_GROUP_TBD | 0x2c) +// Reserved (EVENT_TRACE_GROUP_TBD | 0x2d) +// Reserved (EVENT_TRACE_GROUP_TBD | 0x2e) +#define PERFINFO_LOG_TYPE_SYSTEM_TIME (EVENT_TRACE_GROUP_TBD | 0x2f) +#define PERFINFO_LOG_TYPE_READYQUEUE (EVENT_TRACE_GROUP_TBD | 0x30) + +// +// Event types for SplitIo +// + +#define PERFINFO_LOG_TYPE_SPLITIO_VOLMGR (EVENT_TRACE_GROUP_SPLITIO | 0x20) + +// +// Event types for ThreadPool +// +#define PERFINFO_LOG_TYPE_TP_CALLBACK_ENQUEUE (EVENT_TRACE_GROUP_THREAD_POOL | 0x20) +#define PERFINFO_LOG_TYPE_TP_CALLBACK_DEQUEUE (EVENT_TRACE_GROUP_THREAD_POOL | 0x21) +#define PERFINFO_LOG_TYPE_TP_CALLBACK_START (EVENT_TRACE_GROUP_THREAD_POOL | 0x22) +#define PERFINFO_LOG_TYPE_TP_CALLBACK_STOP (EVENT_TRACE_GROUP_THREAD_POOL | 0x23) +#define PERFINFO_LOG_TYPE_TP_CALLBACK_CANCEL (EVENT_TRACE_GROUP_THREAD_POOL | 0x24) +#define PERFINFO_LOG_TYPE_TP_POOL_CREATE (EVENT_TRACE_GROUP_THREAD_POOL | 0x25) +#define PERFINFO_LOG_TYPE_TP_POOL_CLOSE (EVENT_TRACE_GROUP_THREAD_POOL | 0x26) +#define PERFINFO_LOG_TYPE_TP_POOL_TH_MIN_SET (EVENT_TRACE_GROUP_THREAD_POOL | 0x27) +#define PERFINFO_LOG_TYPE_TP_POOL_TH_MAX_SET (EVENT_TRACE_GROUP_THREAD_POOL | 0x28) +#define PERFINFO_LOG_TYPE_TP_WORKER_NUMANODE_SWITCH (EVENT_TRACE_GROUP_THREAD_POOL | 0x29) +#define PERFINFO_LOG_TYPE_TP_TIMER_SET (EVENT_TRACE_GROUP_THREAD_POOL | 0x2a) +#define PERFINFO_LOG_TYPE_TP_TIMER_CANCELLED (EVENT_TRACE_GROUP_THREAD_POOL | 0x2b) +#define PERFINFO_LOG_TYPE_TP_TIMER_SET_NTTIMER (EVENT_TRACE_GROUP_THREAD_POOL | 0x2c) +#define PERFINFO_LOG_TYPE_TP_TIMER_CANCEL_NTTIMER (EVENT_TRACE_GROUP_THREAD_POOL | 0x2d) +#define PERFINFO_LOG_TYPE_TP_TIMER_EXPIRATION_BEGIN (EVENT_TRACE_GROUP_THREAD_POOL | 0x2e) +#define PERFINFO_LOG_TYPE_TP_TIMER_EXPIRATION_END (EVENT_TRACE_GROUP_THREAD_POOL | 0x2f) +#define PERFINFO_LOG_TYPE_TP_TIMER_EXPIRATION (EVENT_TRACE_GROUP_THREAD_POOL | 0x30) + +// +// Event types for UMS +// + +#define PERFINFO_LOG_TYPE_UMS_DIRECTED_SWITCH_START (EVENT_TRACE_GROUP_UMS | 0x20) +#define PERFINFO_LOG_TYPE_UMS_DIRECTED_SWITCH_END (EVENT_TRACE_GROUP_UMS | 0x21) +#define PERFINFO_LOG_TYPE_UMS_PARK (EVENT_TRACE_GROUP_UMS | 0x22) +#define PERFINFO_LOG_TYPE_UMS_DISASSOCIATE (EVENT_TRACE_GROUP_UMS | 0x23) +#define PERFINFO_LOG_TYPE_UMS_CONTEXT_SWITCH (EVENT_TRACE_GROUP_UMS | 0x24) + +// +// Event types for Cache manager +// + +#define PERFINFO_LOG_TYPE_CC_WORKITEM_ENQUEUE (EVENT_TRACE_GROUP_CC | 0x00) +#define PERFINFO_LOG_TYPE_CC_WORKITEM_DEQUEUE (EVENT_TRACE_GROUP_CC | 0x01) +#define PERFINFO_LOG_TYPE_CC_WORKITEM_COMPLETE (EVENT_TRACE_GROUP_CC | 0x02) +#define PERFINFO_LOG_TYPE_CC_READ_AHEAD (EVENT_TRACE_GROUP_CC | 0x03) +#define PERFINFO_LOG_TYPE_CC_WRITE_BEHIND (EVENT_TRACE_GROUP_CC | 0x04) +#define PERFINFO_LOG_TYPE_CC_LAZY_WRITE_SCAN (EVENT_TRACE_GROUP_CC | 0x05) +#define PERFINFO_LOG_TYPE_CC_CAN_I_WRITE_FAIL (EVENT_TRACE_GROUP_CC | 0x06) +//#define PERFINFO_LOG_TYPE_CC_MAP_VIEW (EVENT_TRACE_GROUP_CC | 0x07) +//#define PERFINFO_LOG_TYPE_CC_UNMAP_VIEW (EVENT_TRACE_GROUP_CC | 0x08) +#define PERFINFO_LOG_TYPE_CC_FLUSH_CACHE (EVENT_TRACE_GROUP_CC | 0x09) +#define PERFINFO_LOG_TYPE_CC_FLUSH_SECTION (EVENT_TRACE_GROUP_CC | 0x0a) +#define PERFINFO_LOG_TYPE_CC_READ_AHEAD_PREFETCH (EVENT_TRACE_GROUP_CC | 0x0b) +#define PERFINFO_LOG_TYPE_CC_SCHEDULE_READ_AHEAD (EVENT_TRACE_GROUP_CC | 0x0c) +#define PERFINFO_LOG_TYPE_CC_LOGGED_STREAM_INFO (EVENT_TRACE_GROUP_CC | 0x0d) +#define PERFINFO_LOG_TYPE_CC_EXTRA_WRITEBEHIND_THREAD (EVENT_TRACE_GROUP_CC | 0x0e) + +// +// Data structure used for WMI Kernel Events +// +// **NB** the hardware events are described in software traceing, if they +// change in layout please update sdktools\trace\tracefmt\default.tmf + + +#define MAX_DEVICE_ID_LENGTH 256 +#define CONFIG_MAX_DOMAIN_NAME_LEN 134 + +typedef struct _CPU_CONFIG_RECORD +{ + ULONG ProcessorSpeed; + ULONG NumberOfProcessors; + ULONG MemorySize; // in MBytes + ULONG PageSize; // in Bytes + ULONG AllocationGranularity; // in Bytes + WCHAR ComputerName[MAX_DEVICE_ID_LENGTH]; + WCHAR DomainName[CONFIG_MAX_DOMAIN_NAME_LEN]; + ULONG_PTR HyperThreadingFlag; + ULONG_PTR HighestUserAddress; + USHORT ProcessorArchitecture; + USHORT ProcessorLevel; + USHORT ProcessorRevision; + BOOLEAN NxEnabled; + BOOLEAN PaeEnabled; + ULONG MemorySpeed; +} CPU_CONFIG_RECORD, *PCPU_CONFIG_RECORD; + +#define CONFIG_WRITE_CACHE_ENABLED 0x00000001 +#define CONFIG_FS_NAME_LEN 16 +#define CONFIG_BOOT_DRIVE_LEN 3 + +typedef struct _PHYSICAL_DISK_RECORD +{ + ULONG DiskNumber; + ULONG BytesPerSector; + ULONG SectorsPerTrack; + ULONG TracksPerCylinder; + ULONGLONG Cylinders; + ULONG SCSIPortNumber; + ULONG SCSIPathId; + ULONG SCSITargetId; + ULONG SCSILun; + WCHAR Manufacturer[MAX_DEVICE_ID_LENGTH]; + + ULONG PartitionCount; + BOOLEAN WriteCacheEnabled; + WCHAR BootDriveLetter[CONFIG_BOOT_DRIVE_LEN]; +} PHYSICAL_DISK_RECORD, *PPHYSICAL_DISK_RECORD; + +// +// Types of logical drive +// +#define CONFIG_DRIVE_PARTITION 0x00000001 +#define CONFIG_DRIVE_VOLUME 0x00000002 +#define CONFIG_DRIVE_EXTENT 0x00000004 +#define CONFIG_DRIVE_LETTER_LEN 4 + +typedef struct _LOGICAL_DISK_EXTENTS +{ + ULONGLONG StartingOffset; + ULONGLONG PartitionSize; + ULONG DiskNumber; // The physical disk number where the logical drive resides + ULONG Size; // The size in bytes of the structure. + ULONG DriveType; // Logical drive type partition/volume/extend-partition + WCHAR DriveLetterString[CONFIG_DRIVE_LETTER_LEN]; + ULONG Pad; + ULONG PartitionNumber; // The partition number where the logical drive resides + ULONG SectorsPerCluster; + ULONG BytesPerSector; + LONGLONG NumberOfFreeClusters; + LONGLONG TotalNumberOfClusters; + WCHAR FileSystemType[CONFIG_FS_NAME_LEN]; + ULONG VolumeExt; // Offset to VOLUME_DISK_EXTENTS structure +} LOGICAL_DISK_EXTENTS, *PLOGICAL_DISK_EXTENTS; + +typedef struct _OPTICAL_MEDIA_RECORD +{ + USHORT DiskNumber; + USHORT BusType; + USHORT DeviceType; + USHORT MediaType; + ULONGLONG StartingOffset; + ULONGLONG Size; + ULONGLONG NumberOfFreeBlocks; + ULONGLONG TotalNumberOfBlocks; + ULONGLONG NextWritableAddress; + ULONG NumberOfSessions; + ULONG NumberOfTracks; + ULONG BytesPerSector; + USHORT DiscStatus; + USHORT LastSessionStatus; + WCHAR Data[1]; +} OPTICAL_MEDIA_RECORD, *POPTICAL_MEDIA_RECORD; + +#define CONFIG_MAX_DNS_SERVER 4 +#define CONFIG_MAX_ADAPTER_ADDRESS_LENGTH 8 + +// +// Note: Data is an array of structures of type IP_ADDRESS_STRING defined in iptypes.h +// +typedef struct _NIC_RECORD +{ + WCHAR NICName[MAX_DEVICE_ID_LENGTH]; + ULONG Index; + ULONG PhysicalAddrLen; + WCHAR PhysicalAddr[CONFIG_MAX_ADAPTER_ADDRESS_LENGTH]; + ULONG Size; // Size of the Data + LONG IpAddress; // IP Address offset. Copy bytes = sizeof(IP_ADDRESS_STRING) + LONG SubnetMask; // subnet mask offset. Copy bytes = sizeof(IP_ADDRESS_STRING) + LONG DhcpServer; // dhcp server offset. Copy bytes = sizeof(IP_ADDRESS_STRING) + LONG Gateway; // gateway offset. Copy bytes = sizeof(IP_ADDRESS_STRING) + LONG PrimaryWinsServer; // primary wins server offset. Copy bytes = sizeof(IP_ADDRESS_STRING) + LONG SecondaryWinsServer;// secondary wins server offset. Copy bytes = sizeof(IP_ADDRESS_STRING) + LONG DnsServer[CONFIG_MAX_DNS_SERVER]; // dns server offset. Copy bytes = sizeof(IP_ADDRESS_STRING) + ULONG Data; // Offset to an array of IP_ADDRESS_STRING +} NIC_RECORD, *PNIC_RECORD; + +typedef struct _VIDEO_RECORD +{ + ULONG MemorySize; + ULONG XResolution; + ULONG YResolution; + ULONG BitsPerPixel; + ULONG VRefresh; + WCHAR ChipType[MAX_DEVICE_ID_LENGTH]; + WCHAR DACType[MAX_DEVICE_ID_LENGTH]; + WCHAR AdapterString[MAX_DEVICE_ID_LENGTH]; + WCHAR BiosString[MAX_DEVICE_ID_LENGTH]; + WCHAR DeviceId[MAX_DEVICE_ID_LENGTH]; + ULONG StateFlags; +} VIDEO_RECORD, *PVIDEO_RECORD; + +typedef struct _WMI_DPI_RECORD +{ + ULONG MachineDPI; + ULONG UserDPI; +} WMI_DPI_RECORD, *PWMI_DPI_RECORD; + +// +// Stores the ACPI Power Information +// +typedef struct _WMI_POWER_RECORD +{ + BOOLEAN SystemS1; + BOOLEAN SystemS2; + BOOLEAN SystemS3; + BOOLEAN SystemS4; // hibernate + BOOLEAN SystemS5; // off + BOOLEAN AoAc; + CHAR Pad2; + CHAR Pad3; +} WMI_POWER_RECORD, *PWMI_POWER_RECORD; + +// +// Store the IRQ assigned to devices +// +typedef struct _WMI_IRQ_RECORD +{ + // Bit 0 indicates CPU0, Bit 1 indicates CPU1, and so on + ULONG64 IRQAffinity; + USHORT IRQGroup; + USHORT Reserved; + ULONG IRQNum; + ULONG DeviceDescriptionLen; + WCHAR DeviceDescription[1]; +} WMI_IRQ_RECORD, *PWMI_IRQ_RECORD; + +typedef struct _WMI_PNP_RECORD_V3 +{ + ULONG IDLength; + ULONG DescriptionLength; + ULONG FriendlyNameLength; + WCHAR Strings[1]; // DeviceID, Description, Friendly, each NULL-terminated +} WMI_PNP_RECORD_V3, *PWMI_PNP_RECORD_V3; + +typedef struct _WMI_PNP_RECORD_V4 +{ + GUID ClassGuid; + ULONG UpperFilterCount; + ULONG LowerFilterCount; + WCHAR Strings[ANYSIZE_ARRAY]; + // DeviceID (unicode string) + // Description (unicode string) + // FriendlyName (unicode string) + // PdoName (unicode string) + // ServiceName (unicode string) + // UpperFilters (unicode string) + // LowerFilters (unicode string) +} WMI_PNP_RECORD_V4, *PWMI_PNP_RECORD_V4; + +typedef struct _WMI_PNP_RECORD_V5 +{ + GUID ClassGuid; + ULONG UpperFilterCount; + ULONG LowerFilterCount; + ULONG DevStatus; + ULONG DevProblem; + WCHAR Strings[ANYSIZE_ARRAY]; + // DeviceID (unicode string) + // Description (unicode string) + // FriendlyName (unicode string) + // PdoName (unicode string) + // ServiceName (unicode string) + // UpperFilters (unicode string) + // LowerFilters (unicode string) +} WMI_PNP_RECORD_V5, *PWMI_PNP_RECORD_V5; + +typedef WMI_PNP_RECORD_V5 WMI_PNP_RECORD, *PWMI_PNP_RECORD; + +// +// Store the IDE Channel (Primary/Secondary) info +// +typedef struct _WMI_IDE_CHANNEL_RECORD +{ + ULONG TargetId; + ULONG DeviceType; + ULONG DeviceTimingMode; + ULONG LocationInformationLen; + WCHAR LocationInformation[1]; +} WMI_IDE_CHANNEL_RECORD, *PWMI_IDE_CHANNEL_RECORD; + +typedef struct _WMI_JOB_INFORMATION +{ + GUID JobId; + ULONG JobHandle; + ULONG Flags; + NTSTATUS Status; +} WMI_JOB_INFORMATION, *PWMI_JOB_INFORMATION; + +typedef struct _WMI_JOB_ASSIGN_PROCESS +{ + GUID JobId; + ULONG JobHandle; + ULONG UniqueProcessId; + NTSTATUS Status; +} WMI_JOB_ASSIGN_PROCESS, *PWMI_JOB_ASSIGN_PROCESS; + +typedef struct _WMI_JOB_REMOVE_PROCESS +{ + GUID JobId; + ULONG UniqueProcessId; + ULONG RemovalFlags; + NTSTATUS ExitStatus; +} WMI_JOB_REMOVE_PROCESS, *PWMI_JOB_REMOVE_PROCESS; + +typedef struct _WMI_JOB_SET_QUERY_CPU_RATE +{ + ULONG AllFlags; + ULONG Value; +} WMI_JOB_SET_QUERY_CPU_RATE, *PWMI_JOB_SET_QUERY_CPU_RATE; + +typedef struct _WMI_JOB_SET_QUERY_NET_RATE +{ + ULONG Flags; + ULONG64 MaxBandwidth; + UCHAR DscpTag; +} WMI_JOB_SET_QUERY_NET_RATE, *PWMI_JOB_SET_QUERY_NET_RATE; + +typedef struct _WMI_JOB_SET_QUERY_INFORMATION +{ + GUID JobId; + ULONG JobHandle; + ULONG JobObjectInformationClass; +} WMI_JOB_SET_QUERY_INFORMATION, *PWMI_JOB_SET_QUERY_INFORMATION; + +typedef struct _WMI_JOB_SEND_NOTIFICATION_INFORMATION +{ + GUID JobId; + ULONG NotificationId; +} WMI_JOB_SEND_NOTIFICATION_INFORMATION, *PWMI_JOB_SEND_NOTIFICATION_INFORMATION; + +#define ETW_PROCESS_EVENT_FLAG_APPLICATION_ID 0x00000001 +#define ETW_PROCESS_EVENT_FLAG_WOW64 0x00000002 +#define ETW_PROCESS_EVENT_FLAG_PROTECTED 0x00000004 +#define ETW_PROCESS_EVENT_FLAG_PACKAGED 0x00000008 + +typedef struct _WMI_PROCESS_INFORMATION +{ + ULONG_PTR UniqueProcessKey; + ULONG ProcessId; + ULONG ParentId; + ULONG SessionId; + NTSTATUS ExitStatus; + ULONG_PTR DirectoryTableBase; + ULONG Flags; + ULONG Sid; + // Variable length sid + // FileName (ansi string) + // CommandLine (unicode string) + // PackageFullName (unicode string) + // PRAID (unicode string) +} WMI_PROCESS_INFORMATION, *PWMI_PROCESS_INFORMATION; + +typedef struct _WMI_PROCESS_INFORMATION64 +{ + ULONG64 UniqueProcessKey64; + ULONG ProcessId; + ULONG ParentId; + ULONG SessionId; + NTSTATUS ExitStatus; + ULONG64 DirectoryTableBase; + ULONG Flags; + ULONG Sid; + // Variable length data +} WMI_PROCESS_INFORMATION64, *PWMI_PROCESS_INFORMATION64; + +typedef struct _WMI_THREAD_INFORMATION +{ + ULONG ProcessId; + ULONG ThreadId; +} WMI_THREAD_INFORMATION, *PWMI_THREAD_INFORMATION; + +typedef signed char SCHAR; + +#define ETW_THREAD_FLAG_REGISTRY_NOTIFICATION 0x00000001 + +typedef struct _WMI_EXTENDED_THREAD_INFORMATION +{ + ULONG ProcessId; + ULONG ThreadId; + PVOID StackBase; + PVOID StackLimit; + PVOID UserStackBase; + PVOID UserStackLimit; + union + { + PVOID StartAddress; + KAFFINITY Affinity; + } DUMMYUNIONNAME; + PVOID Win32StartAddress; + PVOID TebBase; + ULONG SubProcessTag; + SCHAR BasePriority; + UCHAR PagePriority; + UCHAR IoPriority; + UCHAR Flags; +} WMI_EXTENDED_THREAD_INFORMATION, *PWMI_EXTENDED_THREAD_INFORMATION; + +typedef struct _WMI_EXTENDED_THREAD_INFORMATION64 +{ + ULONG ProcessId; + ULONG ThreadId; + ULONG64 StackBase64; + ULONG64 StackLimit64; + ULONG64 UserStackBase64; + ULONG64 UserStackLimit64; + union + { + ULONG64 StartAddress64; + ULONG64 Affinity; + } DUMMYUNIONNAME; + ULONG64 Win32StartAddress64; + ULONG64 TebBase64; + ULONG SubProcessTag; + SCHAR BasePriority; + UCHAR PagePriority; + UCHAR IoPriority; + UCHAR Flags; +} WMI_EXTENDED_THREAD_INFORMATION64, *PWMI_EXTENDED_THREAD_INFORMATION64; + +// +// SignatureLevel flags indicating if the image is embedded or catalog signed. +// + +#define ETW_IMAGE_CATALOG_SIGNED 0x10 +#define ETW_IMAGE_EMBEDDED_SIGNED 0x20 + +typedef struct _WMI_IMAGELOAD_INFORMATION +{ + PVOID ImageBase; + SIZE_T ImageSize; + ULONG ProcessId; + ULONG ImageChecksum; + ULONG TimeDateStamp; + UCHAR SignatureLevel; + UCHAR SignatureType; + USHORT Reserved0; + PVOID DefaultBase; + ULONG Reserved1; + ULONG Reserved2; + ULONG Reserved3; + ULONG Reserved4; + WCHAR FileName[1]; +} WMI_IMAGELOAD_INFORMATION, *PWMI_IMAGELOAD_INFORMATION; + +typedef struct _WMI_IMAGELOAD_INFORMATION32 +{ + ULONG32 ImageBase32; + ULONG32 ImageSize32; + ULONG ProcessId; + ULONG ImageChecksum; + ULONG TimeDateStamp; + UCHAR SignatureLevel; + UCHAR SignatureType; + USHORT Reserved0; + ULONG32 DefaultBase32; + ULONG Reserved1; + ULONG Reserved2; + ULONG Reserved3; + ULONG Reserved4; + WCHAR FileName[1]; +} WMI_IMAGELOAD_INFORMATION32, *PWMI_IMAGELOAD_INFORMATION32; + +typedef struct _WMI_IMAGELOAD_INFORMATION64 +{ + ULONG64 ImageBase64; + ULONG64 ImageSize64; + ULONG ProcessId; + ULONG ImageChecksum; + ULONG TimeDateStamp; + UCHAR SignatureLevel; + UCHAR SignatureType; + USHORT Reserved0; + ULONG64 DefaultBase64; + ULONG Reserved1; + ULONG Reserved2; + ULONG Reserved3; + ULONG Reserved4; + WCHAR FileName[1]; +} WMI_IMAGELOAD_INFORMATION64, *PWMI_IMAGELOAD_INFORMATION64; + +#include +typedef struct _WMI_IMAGEID_INFORMATION +{ + PVOID ImageBase; + SIZE_T ImageSize; + ULONG ProcessId; + ULONG TimeDateStamp; + WCHAR OriginalFileName[1]; +} WMI_IMAGEID_INFORMATION, *PWMI_IMAGEID_INFORMATION; + +typedef struct _WMI_IMAGEID_INFORMATION32 +{ + ULONG32 ImageBase32; + ULONG32 ImageSize32; + ULONG ProcessId; + ULONG TimeDateStamp; + WCHAR OriginalFileName[1]; +} WMI_IMAGEID_INFORMATION32, *PWMI_IMAGEID_INFORMATION32; + +typedef struct _WMI_IMAGEID_INFORMATION64 +{ + ULONG64 ImageBase64; + ULONG64 ImageSize64; + ULONG ProcessId; + ULONG TimeDateStamp; + WCHAR OriginalFileName[1]; +} WMI_IMAGEID_INFORMATION64, *PWMI_IMAGEID_INFORMATION64; +#include + +#define ETW_IO_FLAG_BACKUP 0x00000001 +#define ETW_IO_FLAG_PREFETCH 0x00000002 +#define ETW_IO_FLAG_WRITE_AGGREGATION 0x00000004 + +typedef struct _ETW_DISKIO_READWRITE_V2 +{ + ULONG DiskNumber; + ULONG IrpFlags; + ULONG Size; + ULONG Reserved; + ULONGLONG ByteOffset; + PVOID FileObject; + PVOID IrpAddress; + ULONGLONG HighResResponseTime; +} ETW_DISKIO_READWRITE_V2, *PETW_DISKIO_READWRITE_V2; + +typedef struct _ETW_DISKIO_READWRITE_V3 +{ + ULONG DiskNumber; + ULONG IrpFlags; + ULONG Size; + ULONG Reserved; + ULONGLONG ByteOffset; + PVOID FileObject; + PVOID IrpAddress; + ULONGLONG HighResResponseTime; + ULONG IssuingThreadId; +} ETW_DISKIO_READWRITE_V3, *PETW_DISKIO_READWRITE_V3; + +typedef struct _ETW_DISKIO_FLUSH_BUFFERS_V2 +{ + ULONG DiskNumber; + ULONG IrpFlags; + ULONGLONG HighResResponseTime; + PVOID IrpAddress; +} ETW_DISKIO_FLUSH_BUFFERS_V2, *PETW_DISKIO_FLUSH_BUFFERS_V2; + +typedef struct _ETW_DISKIO_FLUSH_BUFFERS_V3 +{ + ULONG DiskNumber; + ULONG IrpFlags; + ULONGLONG HighResResponseTime; + PVOID IrpAddress; + ULONG IssuingThreadId; +} ETW_DISKIO_FLUSH_BUFFERS_V3, *PETW_DISKIO_FLUSH_BUFFERS_V3; + +typedef struct _ETW_DISKIO_READWRITE_V3 WMI_DISKIO_READWRITE, *PWMI_DISKIO_READWRITE; +typedef struct _ETW_DISKIO_FLUSH_BUFFERS_V3 WMI_DISKIO_FLUSH_BUFFERS, *PWMI_DISKIO_FLUSH_BUFFERS; + +typedef struct _WMI_DISKIO_READWRITE_INIT +{ + PVOID Irp; + ULONG IssuingThreadId; +} WMI_DISKIO_READWRITE_INIT, *PWMI_DISKIO_READWRITE_INIT; + +typedef struct _WMI_DISKIO_IO_REDIRECTED_INIT +{ + PVOID Irp; + PVOID FileKey; +} WMI_DISKIO_IO_REDIRECTED_INIT, *PWMI_DISKIO_IO_REDIRECTED_INIT; + +typedef struct _ETW_OPTICALIO_READWRITE +{ + ULONG DiskNumber; + ULONG IrpFlags; + ULONG Size; + ULONG Reserved; + ULONGLONG ByteOffset; + PVOID FileObject; + PVOID IrpAddress; + ULONGLONG HighResResponseTime; + ULONG IssuingThreadId; +} ETW_OPTICALIO_READWRITE, *PETW_OPTICALIO_READWRITE; + +typedef struct _ETW_OPTICALIO_FLUSH_BUFFERS +{ + ULONG DiskNumber; + ULONG IrpFlags; + ULONGLONG HighResResponseTime; + PVOID IrpAddress; + ULONG IssuingThreadId; +} ETW_OPTICALIO_FLUSH_BUFFERS, *PETW_OPTICALIO_FLUSH_BUFFERS; + +typedef struct _ETW_OPTICALIO_INIT +{ + PVOID Irp; + ULONG IssuingThreadId; +} ETW_OPTICALIO_INIT, *PETW_OPTICALIO_INIT; + +typedef struct _WMI_REGISTRY +{ + LONGLONG InitialTime; + ULONG Status; + union + { + ULONG Index; + ULONG InfoClass; + } DUMMYUNIONNAME; + PVOID Kcb; + WCHAR Name[1]; +} WMI_REGISTRY, *PWMI_REGISTRY; + +typedef struct _WMI_TXR +{ + LONGLONG InitialTime; + GUID TxRGUID; + ULONG Status; + ULONG UowCount; + WCHAR Hive[1]; +} WMI_TXR, *PWMI_TXR; + +typedef struct _ETW_REGNOTIF_REGISTER +{ + PVOID Notification; + PVOID Kcb; + UCHAR Type; + BOOLEAN WatchTree; + BOOLEAN Primary; +} ETW_REGNOTIF_REGISTER, *PETW_REGNOTIF_REGISTER; + +typedef struct _WMI_FILE_IO +{ + PVOID FileObject; + WCHAR FileName[1]; +} WMI_FILE_IO, *PWMI_FILE_IO; + +typedef struct _WMI_TCPIP_V4 +{ + ULONG ProcessId; + ULONG TransferSize; + UCHAR DestinationAddress[4]; + UCHAR SourceAddress[4]; + USHORT DestinationPort; + USHORT SourcePort; +} WMI_TCPIP_V4, *PWMI_TCPIP_V4; + +typedef struct _WMI_TCPIP_V6 +{ + ULONG ProcessId; + ULONG TransferSize; + UCHAR DestinationAddress[16]; + UCHAR SourceAddress[16]; + USHORT DestinationPort; + USHORT SourcePort; +} WMI_TCPIP_V6, *PWMI_TCPIP_V6; + +typedef struct _WMI_UDP_V4 +{ + ULONG ProcessId; + USHORT TransferSize; + UCHAR DestinationAddress[4]; + UCHAR SourceAddress[4]; + USHORT DestinationPort; + USHORT SourcePort; +} WMI_UDP_V4, *PWMI_UDP_V4; + +typedef struct _WMI_UDP_V6 +{ + ULONG ProcessId; + USHORT TransferSize; + UCHAR DestinationAddress[16]; + UCHAR SourceAddress[16]; + USHORT DestinationPort; + USHORT SourcePort; +} WMI_UDP_V6, *PWMI_UDP_V6; + +typedef struct _WMI_PAGE_FAULT +{ + PVOID VirtualAddress; + PVOID ProgramCounter; +} WMI_PAGE_FAULT, *PWMI_PAGE_FAULT; + +typedef struct _WMI_CONTEXTSWAP +{ + ULONG NewThreadId; + ULONG OldThreadId; + + CHAR NewThreadPriority; + CHAR OldThreadPriority; + union + { + UCHAR PreviousCState; + UCHAR OldThreadRank; + } DUMMYUNIONNAME; + union + { + CHAR NewThreadPriorityDecrement; + CHAR SpareByte; + } DUMMYUNIONNAME2; + UCHAR OldThreadWaitReason; + CHAR OldThreadWaitMode; + UCHAR OldThreadState; + UCHAR OldThreadIdealProcessor; + + ULONG NewThreadWaitTime; + LONG OldThreadRemainingQuantum; +} WMI_CONTEXTSWAP, *PWMI_CONTEXTSWAP; + +#define WMI_SPINLOCK_EVENT_EXECUTE_DPC_BIT 6 +#define WMI_SPINLOCK_EVENT_EXECUTE_ISR_BIT 7 +#define WMI_SPINLOCK_ACQUIRE_MODE_MASK 0x3F + +#include +typedef struct _WMI_SPINLOCK +{ + PVOID SpinLockAddress; + PVOID CallerAddress; + ULONG64 AcquireTime; + ULONG64 ReleaseTime; + ULONG WaitTimeInCycles; + ULONG SpinCount; + ULONG ThreadId; + ULONG InterruptCount; + UCHAR Irql; + UCHAR AcquireDepth; + + union + { + struct + { + UCHAR AcquireMode : 6; + UCHAR ExecuteDpc : 1; + UCHAR ExecuteIsr : 1; + }; + + UCHAR Flags; + }; + + UCHAR Reserved[5]; +} WMI_SPINLOCK, *PWMI_SPINLOCK; +#include + +// +// Logging every action on every instance of ERESOURCE is almost impossible. +// Especially for highly contented or highly frequently used instances. +// +// Thus logging an event is done on complete release operations +// or on excessive waits with filtering as follows: +// +// 1) For contention cases where the releasing thread either: +// 1.a) Has a wait time, e.g. it was blocked before the acquire. +// 1.b) Caused one or more other acquire attempts to be blocked. +// In such a case every N-th sample is logged. + +// 2) For a complete release (with or without contention). +// In this case every N-th sample is logged. +// +// 3) Excessive waits. +// +// Exact mapping and publishing WMI_RESOURCE_ACTIONs as values used +// internally in ..\minkernel\ntos\inc\etw.h. +// + +#define WMI_RESOURCE_ACTION_COMPLETE_RELEASE_EXCLUSIVE 0x00010022 +#define WMI_RESOURCE_ACTION_COMPLETE_RELEASE_SHARED 0x00010042 +#define WMI_RESOURCE_ACTION_WAIT_EXCESSIVE_FOR_EXCLUSIVE 0x00010224 +#define WMI_RESOURCE_ACTION_WAIT_EXCESSIVE_FOR_SHARED 0x00010244 + +typedef struct _WMI_RESOURCE +{ + ULONG64 AcquireTime; + ULONG64 HoldTime; + ULONG64 WaitTime; + ULONG MaxRecursionDepth; + ULONG ThreadId; + PVOID Resource; + ULONG Action; + ULONG ContentionDelta; +} WMI_RESOURCE, *PWMI_RESOURCE; + +// +// Only log wait-events for KQUEUE and PUSHLOCK objects. Full tracing generates +// way too much data and also significantly affects performance. +// +// Also note that full tracing for PUSHLOCK objects is impossible as some routines +// are defined inline in ex.h and are already compiled into drivers. +// + +#define WMI_QUEUE_ACTION_WAIT_FOR_ITEM 1 + +typedef struct _WMI_QUEUE { + PVOID Queue; + ULONG ThreadId; + UCHAR Action; +} WMI_QUEUE, *PWMI_QUEUE; + +#define WMI_PUSHLOCK_ACTION_WAIT_FOR_EXCLUSIVE 1 +#define WMI_PUSHLOCK_ACTION_WAIT_FOR_SHARED 2 + +typedef struct _WMI_PUSHLOCK +{ + PVOID PushLock; + ULONG ThreadId; + UCHAR Action; +} WMI_PUSHLOCK, *PWMI_PUSHLOCK; + +typedef struct _WMI_WAIT_SINGLE +{ + ULONG ThreadId; + PVOID Object; + UCHAR ObjectType; +} WMI_WAIT_SINGLE, *PWMI_WAIT_SINGLE; + +typedef struct _WMI_WAIT_OBJECT_RECORD +{ + PVOID Object; + UCHAR ObjectType; +} WMI_WAIT_OBJECT_RECORD, *PWMI_WAIT_OBJECT_RECORD; + +#define WMI_WAIT_MULTIPLE_MAX_OBJECTS 64 + +#define WMI_WAIT_MULTIPLE_WAIT_ANY 1 +#define WMI_WAIT_MULTIPLE_WAIT_ALL 2 + +typedef struct _WMI_WAIT_MULTIPLE +{ + ULONG ThreadId; + UCHAR WaitType; + UCHAR ObjectCount; + WMI_WAIT_OBJECT_RECORD ObjectRecord[WMI_WAIT_MULTIPLE_MAX_OBJECTS]; +} WMI_WAIT_MULTIPLE, *PWMI_WAIT_MULTIPLE; + +#define WMI_WAIT_MULTIPLE_HEADER_SIZE (sizeof(PVOID) + sizeof(UCHAR)) + +typedef struct _WMI_DELAY_EXECUTION +{ + ULONG ThreadId; + ULONGLONG Delta; +} WMI_DELAY_EXECUTION, *PWMI_DELAY_EXECUTION; + +// +// Scheduler events. +// +typedef struct _ETW_READY_THREAD_EVENT +{ + ULONG ThreadId; + UCHAR AdjustReason; + SCHAR AdjustIncrement; + union + { + struct + { + UCHAR ExecutingDpc : 1; + UCHAR KernelStackNotResident : 1; + UCHAR ProcessOutOfMemory : 1; + UCHAR DirectSwitchAttempt : 1; + UCHAR Reserved : 4; + } DUMMYSTRUCTNAME; + UCHAR Flags; + } DUMMYUNIONNAME; + UCHAR SpareByte; +} ETW_READY_THREAD_EVENT, *PETW_READY_THREAD_EVENT; + +// +// Kernel Queue events. +// +typedef struct _ETW_KQUEUE_ENQUEUE_EVENT +{ + PVOID Entry; + ULONG ThreadId; +} ETW_KQUEUE_ENQUEUE_EVENT, *PETW_KQUEUE_ENQUEUE_EVENT; + +typedef struct _ETW_KQUEUE_DEQUEUE_EVENT +{ + ULONG ThreadId; + ULONG EntryCount; + PVOID Entries[ANYSIZE_ARRAY]; +} ETW_KQUEUE_DEQUEUE_EVENT, *PETW_KQUEUE_DEQUEUE_EVENT; + +// +// Anti-starvation boost by BalanceSetmanager event. +// + +typedef struct _ETW_ANTI_STARVATION_BOOST_EVENT +{ + ULONG ThreadId; + USHORT ProcessorIndex; + SCHAR OldPriority; + UCHAR SpareByte; +} ETW_ANTI_STARVATION_BOOST_EVENT, *PETW_ANTI_STARVATION_BOOST_EVENT; + +// +// AutoBoost priority-inversion avoidance events. +// +typedef struct _ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT +{ + PVOID Lock; + ULONG ThreadId; + SCHAR NewCpuPriorityFloor; + SCHAR OldCpuPriority; + union + { + struct + { + SCHAR NewIoPriorityFloor : 4; + SCHAR OldIoPriority : 4; + }; + SCHAR IoPriorities; + }; + + union + { + struct + { + UCHAR ExecutingDpc : 1; + UCHAR WakeupBoost : 1; + UCHAR BoostedOutstandingIrps : 1; + UCHAR Reserved : 5; + }; + UCHAR Flags; + }; +} ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT, *PETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT; + +typedef struct _ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT +{ + PVOID Lock; + ULONG ThreadId; + union + { + // + // The order of bits in this field must be the same as the bitmap field + // in KLOCK_ENTRY. + // + struct + { + USHORT IoBoost : 1; + USHORT CpuBoostsBitmap : 15; + }; + USHORT BoostBitmap; + }; + USHORT Reserved; +} ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT, *PETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT; + +typedef struct _ETW_AUTOBOOST_NO_ENTRIES_EVENT +{ + PVOID Lock; + ULONG ThreadId; +} ETW_AUTOBOOST_NO_ENTRIES_EVENT, *PETW_AUTOBOOST_NO_ENTRIES_EVENT; + +// +// Priority and affinity change events. +// +typedef struct _ETW_PRIORITY_EVENT +{ + ULONG ThreadId; + SCHAR OldPriority; + SCHAR NewPriority; + SCHAR DynamicPriority; // SetBasePriority events only + SCHAR Reserved; +} ETW_PRIORITY_EVENT, *PETW_PRIORITY_EVENT; + +typedef struct _ETW_THREAD_AFFINITY_EVENT +{ + KAFFINITY Mask; + ULONG ThreadId; + USHORT Group; + USHORT Reserved; +} ETW_THREAD_AFFINITY_EVENT, *PETW_THREAD_AFFINITY_EVENT; + +typedef struct _ETW_DEBUG_PRINT_EVENT +{ + ULONG Component; + ULONG Level; + CHAR Message[1]; +} ETW_DEBUG_PRINT_EVENT, *PETW_DEBUG_PRINT_EVENT; + +// +// Note that BIGPOOL mask is carefully chosen to avoid conflict, and +// this is only for instrumentation. So, there is possibility that +// mask is used by pool component at future. +// + +#define ETW_POOLTRACE_BIGPOOL_MASK 0x10000000 + +typedef struct _ETW_POOL_EVENT +{ + ULONG PoolType; + ULONG Tag; + SIZE_T NumberOfBytes; + PVOID Entry; +} ETW_POOL_EVENT, *PETW_POOL_EVENT; + +// +// Object Manager events +// + +#define ETW_KERNEL_HANDLE_MASK 0x80000000 + +typedef struct _ETW_CREATE_HANDLE_EVENT +{ + PVOID Object; + ULONG Handle; + USHORT ObjectType; +} ETW_CREATE_HANDLE_EVENT, *PETW_CREATE_HANDLE_EVENT; + +typedef ETW_CREATE_HANDLE_EVENT ETW_CLOSE_HANDLE_EVENT, *PETW_CLOSE_HANDLE_EVENT; + +#include +typedef struct _ETW_DUPLICATE_HANDLE_EVENT +{ + PVOID Object; + ULONG SourceHandle; + ULONG TargetHandle; + ULONG TargetProcessId; + USHORT ObjectType; + ULONG SourceProcessId; +} ETW_DUPLICATE_HANDLE_EVENT, *PETW_DUPLICATE_HANDLE_EVENT; +#include + +typedef struct _ETW_OBJECT_TYPE_EVENT +{ + USHORT ObjectType; + USHORT Reserved; + WCHAR Name[ANYSIZE_ARRAY]; +} ETW_OBJECT_TYPE_EVENT, *PETW_OBJECT_TYPE_EVENT; + +typedef struct _ETW_OBJECT_HANDLE_EVENT +{ + PVOID Object; + ULONG ProcessId; + ULONG Handle; + USHORT ObjectType; +} ETW_OBJECT_HANDLE_EVENT, *PETW_OBJECT_HANDLE_EVENT; + +typedef struct _ETW_REFDEREF_OBJECT_EVENT +{ + PVOID Object; + ULONG Tag; + ULONG Count; +} ETW_REFDEREF_OBJECT_EVENT, *PETW_REFDEREF_OBJECT_EVENT; + +typedef struct _ETW_CREATEDELETE_OBJECT_EVENT +{ + PVOID Object; + USHORT ObjectType; +} ETW_CREATEDELETE_OBJECT_EVENT, *PETW_CREATEDELETE_OBJECT_EVENT; + +// +// Wake Counter events +// +typedef struct _ETW_WAKE_COUNTER_EVENT +{ + PVOID Object; + ULONG_PTR Tag; + ULONG ProcessId; + LONG Count; +} ETW_WAKE_COUNTER_EVENT, *PETW_WAKE_COUNTER_EVENT; + +// +// Heap events +// + +#include +typedef struct _ETW_HEAP_EVENT_COMMON +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID Handle; // Handle of Heap +} ETW_HEAP_EVENT_COMMON, *PETW_HEAP_EVENT_COMMON; +#include + +#include +typedef struct _ETW_HEAP_EVENT_ALLOC +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID HeapHandle; // Handle of Heap + SIZE_T Size; // Size of allocation in bytes + PVOID Address; // Address of Allocation + ULONG Source; // Type ie Lookaside, Lowfrag or main path + +} ETW_HEAP_EVENT_ALLOC, *PETW_HEAP_EVENT_ALLOC; +#include + +#include +typedef struct _ETW_HEAP_EVENT_FREE +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID HeapHandle; // Handle of Heap + PVOID Address; // Address to free + ULONG Source; // Type ie Lookaside, Lowfrag or main path + +} ETW_HEAP_EVENT_FREE, *PETW_HEAP_EVENT_FREE; +#include + +#include +typedef struct _ETW_HEAP_EVENT_REALLOC +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID HeapHandle; // Handle of Heap + PVOID NewAddress; // New Address returned to user + PVOID OldAddress; // Old Address got from user + SIZE_T NewSize; // New Size in bytes + SIZE_T OldSize; // Old Size in bytes + ULONG Source; // Type ie Lookaside, Lowfrag or main path +} ETW_HEAP_EVENT_REALLOC, *PETW_HEAP_EVENT_REALLOC; +#include + +#include +typedef struct _ETW_HEAP_EVENT_EXPANSION +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID HeapHandle; // Handle of Heap + SIZE_T CommittedSize; // Memory Size in bytes actually committed + PVOID Address; // Address of free block or segment + SIZE_T FreeSpace; // Total free Space in Heap + SIZE_T CommittedSpace; // Memory Committed + SIZE_T ReservedSpace; // Memory reserved + ULONG NoOfUCRs; // Number of uncommitted ranges + SIZE_T AllocatedSpace; // Memory allocated +} ETW_HEAP_EVENT_EXPANSION, *PETW_HEAP_EVENT_EXPANSION; +#include + +#include +typedef struct _ETW_HEAP_EVENT_CONTRACTION +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID HeapHandle; // Handle of Heap + SIZE_T DeCommitSize; // The size of DeCommitted Block + PVOID DeCommitAddress; // Address of the Decommitted block + SIZE_T FreeSpace; // Total free Space in Heap in bytes + SIZE_T CommittedSpace; // Memory Committed in bytes + SIZE_T ReservedSpace; // Memory reserved in bytes + ULONG NoOfUCRs; // Number of UnCommitted Ranges + SIZE_T AllocatedSpace; // Memory allocated + +} ETW_HEAP_EVENT_CONTRACTION, *PETW_HEAP_EVENT_CONTRACTION; +#include + +#include +typedef struct _ETW_HEAP_EVENT_CREATE +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID HeapHandle; // Handle of Heap + ULONG Flags; // Flags passed while creating heap. + SIZE_T ReserveSize; + SIZE_T CommitSize; + SIZE_T AllocatedSize; +} ETW_HEAP_EVENT_CREATE, *PETW_HEAP_EVENT_CREATE; +#include + +#define HEAP_LOG_CREATE_HEAP 1 +#define HEAP_LOG_FIND_AND_COMMIT_PAGES 2 +#define HEAP_LOG_INITIALIZE_SEGMENT 3 +#define HEAP_LOG_EXTEND_HEAP 4 +#define HEAP_LOG_DECOMMIT_FREE_BLOCK 5 +#define HEAP_LOG_DECOMMIT_FREE_BLOCK2 6 +#define HEAP_LOG_DECOMMIT_BLOCK 7 +#define HEAP_LOG_COMMIT_BLOCK 8 +#define HEAP_LOG_ALLOCATE_HEAP 9 +#define HEAP_LOG_COMMIT_AND_INITIALIZE_PAGES 10 +#define HEAP_LOG_ALLOCATE_SEGMENT_HEAP 11 +#define HEAP_LOG_ALLOCATE_NEW_SEGMENT 12 +#define HEAP_LOG_DECOMMIT_PAGE_RANGE 13 + +typedef struct _HEAP_EVENT_COMMIT_DECOMMIT +{ + PVOID HeapHandle; + PVOID Block; + SIZE_T Size; + ULONG Caller; +} HEAP_EVENT_COMMIT_DECOMMIT, *PHEAP_EVENT_COMMIT_DECOMMIT; + +typedef struct _HEAP_COMMIT_DECOMMIT +{ + SYSTEM_TRACE_HEADER Header; + HEAP_EVENT_COMMIT_DECOMMIT Event; +} HEAP_COMMIT_DECOMMIT, *PHEAP_COMMIT_DECOMMIT; + +typedef struct _HEAP_EVENT_SUBSEGMENT_ALLOC_FREE +{ + PVOID HeapHandle; + PVOID SubSegment; + SIZE_T SubSegmentSize; + SIZE_T BlockSize; +} HEAP_EVENT_SUBSEGMENT_ALLOC_FREE, *PHEAP_EVENT_SUBSEGMENT_ALLOC_FREE; + +typedef struct _HEAP_SUBSEGMENT_FREE +{ + SYSTEM_TRACE_HEADER Header; + HEAP_EVENT_SUBSEGMENT_ALLOC_FREE Event; +} HEAP_SUBSEGMENT_FREE, *PHEAP_SUBSEGMENT_FREE; + +typedef struct _HEAP_SUBSEGMENT_ALLOC +{ + SYSTEM_TRACE_HEADER Header; + HEAP_EVENT_SUBSEGMENT_ALLOC_FREE Event; +} HEAP_SUBSEGMENT_ALLOC, *PHEAP_SUBSEGMENT_ALLOC; + +#include +typedef struct _HEAP_SUBSEGMENT_INIT +{ + SYSTEM_TRACE_HEADER Header; + PVOID HeapHandle; + PVOID SubSegment; + SIZE_T BlockSize; + SIZE_T BlockCount; + ULONG AffinityIndex; +} HEAP_SUBSEGMENT_INIT, *PHEAP_SUBSEGMENT_INIT; +#include + +#include +typedef struct _HEAP_AFINITY_MANAGER_ENABLE +{ + SYSTEM_TRACE_HEADER Header; + PVOID HeapHandle; + ULONG BucketIndex; +} HEAP_AFFINITY_MANAGER_ENABLE, *PHEAP_AFFINITY_MANAGER_ENABLE; +#include + +#include +typedef struct _HEAP_AFFINITY_SLOT_ASSIGN +{ + SYSTEM_TRACE_HEADER Header; + PVOID HeapHandle; + PVOID SubSegment; + ULONG SlotIndex; +} HEAP_AFFINITY_SLOT_ASSIGN, *PHEAP_AFFINITY_SLOT_ASSIGN; +#include + +#include +typedef struct _HEAP_REUSE_THRESHOLD_ACTIVATED +{ + SYSTEM_TRACE_HEADER Header; + PVOID HeapHandle; + PVOID SubSegment; + ULONG BucketIndex; +} HEAP_REUSE_THRESHOLD_ACTIVATED, *PHEAP_REUSE_THRESHOLD_ACTIVATED; +#include + +#include +typedef struct _HEAP_SUBSEGMENT_ACTIVATED +{ + SYSTEM_TRACE_HEADER Header; + PVOID HeapHandle; + PVOID SubSegment; +} HEAP_SUBSEGMENT_ACTIVATED, *PHEAP_SUBSEGMENT_ACTIVATED; +#include + +#include +typedef struct _ETW_HEAP_EVENT_SNAPSHOT +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID HeapHandle; // Handle of Heap + SIZE_T FreeSpace; // Total free Space in Heap in bytes + SIZE_T CommittedSpace; // Memory Committed in bytes + SIZE_T ReservedSpace; // Memory reserved in bytes + ULONG Flags; // Flags passed while creating heap. + ULONG ProcessId; + SIZE_T LargeUCRSpace; + ULONG FreeListLength; + ULONG UCRLength; + SIZE_T AllocatedSpace; // Total allocated space in heap, in bytes +} ETW_HEAP_EVENT_SNAPSHOT, *PETW_HEAP_EVENT_SNAPSHOT; +#include + +#include +typedef struct _ETW_HEAP_EVENT_RUNDOWN_RANGE +{ + PVOID Address; + SIZE_T Size; +} ETW_HEAP_EVENT_RUNDOWN_RANGE, *PETW_HEAP_EVENT_RUNDOWN_RANGE; +#include + +#include +typedef struct _ETW_HEAP_EVENT_RUNDOWN +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID HeapHandle; + ULONG Flags; + ULONG ProcessId; + ULONG RangeCount; + ULONG Reserved; // for padding + ETW_HEAP_EVENT_RUNDOWN_RANGE Ranges[1]; +} ETW_HEAP_EVENT_RUNDOWN, *PETW_HEAP_EVENT_RUNDOWN; +#include + +typedef struct _HEAP_EVENT_RANGE_CREATE +{ + PVOID HeapHandle; + SIZE_T FirstRangeSize; + ULONG Flags; +} HEAP_EVENT_RANGE_CREATE, *PHEAP_EVENT_RANGE_CREATE; + +typedef struct _HEAP_EVENT_RANGE +{ + PVOID HeapHandle; + PVOID Address; + SIZE_T Size; +} HEAP_EVENT_RANGE, *PHEAP_EVENT_RANGE; + +typedef struct _HEAP_RANGE_CREATE +{ + SYSTEM_TRACE_HEADER Header; + HEAP_EVENT_RANGE_CREATE Event; +} HEAP_RANGE_CREATE, *PHEAP_RANGE_CREATE; + +typedef struct _HEAP_RANGE_DESTROY +{ + SYSTEM_TRACE_HEADER Header; + PVOID HeapHandle; +} HEAP_RANGE_DESTROY, *PHEAP_RANGE_DESTROY; + +typedef struct _HEAP_RANGE_LOG +{ + SYSTEM_TRACE_HEADER Header; + HEAP_EVENT_RANGE Range; +} HEAP_RANGE_LOG, *PHEAP_RANGE_LOG; + +typedef struct _ETW_CRITSEC_EVENT_COLLISION +{ + SYSTEM_TRACE_HEADER Header; // Header + ULONG LockCount; // Lock Count + ULONG SpinCount; // Spin Count + PVOID OwningThread; // Thread having Lock + PVOID Address; // Address of Critical Section +} ETW_CRITSEC_EVENT_COLLISION, *PETW_CRITSEC_EVENT_COLLISION; + +typedef struct _ETW_CRITSEC_EVENT_INIT +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID SpinCount; // Spin Count + PVOID Address; // Address of Critical Section +} ETW_CRITSEC_EVENT_INIT, *PETW_CRITSEC_EVENT_INIT; + +typedef struct _STACK_WALK_EVENT_DATA +{ + ULONGLONG TimeStamp; + ULONG ProcessId; + ULONG ThreadId; + PVOID Addresses[1]; //Address of captured Stack address +} STACK_WALK_EVENT_DATA, *PSTACK_WALK_EVENT_DATA; + +typedef struct _LOAD_DLL_EVENT_DATA +{ + WCHAR ImageName[1]; +} LOAD_DLL_EVENT_DATA, *PLOAD_DLL_EVENT_DATA; + +typedef struct _CM_PERF_COUNTERS +{ + ULONGLONG OpenedKeys; // number of kcbs in the system + ULONGLONG DelayCloseKCBs; // number of kcbs in delay close + ULONGLONG PrivateAllocPages; // number of pages used by the private allocator for kcbs + ULONGLONG PrivateAllocFree; // number of fixed size allocations which are currently free + ULONGLONG PrivateAllocUsed; // number of fixed size allocations which are currently in use + ULONGLONG LookupCacheHit; // cache hit + ULONGLONG LookupCacheMissFound; // cache miss but key was opened from the hive + ULONGLONG LookupCacheMissNotFound; // cache miss; key does not exist + ULONGLONG ViewMap; // number of times we mapped a view + ULONGLONG ViewUnMap; // number of times we mapped a view + ULONGLONG HiveShrink; // number of times we have shrunk a hive +} CM_PERF_COUNTERS, *PCM_PERF_COUNTERS; + +// +// The class scheduler events +// +typedef struct _CI_LOG_SCHEDULER_EVENT +{ + EVENT_TRACE_HEADER Header; // Header + ULONG ProcessId; // Process id of the the thread being scheduled + ULONG ThreadId; // Thread id of the thread being scheduled + ULONG Priority; // Scheduling priority + ULONG TaskIndex; // Task index the thread being scheduled linked to. +} CI_LOG_SCHEDULER_EVENT, *PCI_LOG_SCHEDULER_EVENT; + +typedef struct _CI_LOG_SCHEDULER_WAKEUP +{ + EVENT_TRACE_HEADER Header; // Header + ULONG Reason; +} CI_LOG_SCHEDULER_WAKEUP, *PCI_LOG_SCHEDULER_WAKEUP; + +typedef struct _CI_LOG_SCHEDULER_SLEEP +{ + EVENT_TRACE_HEADER Header; // Header +} CI_LOG_SCHEDULER_SLEEP, *PCI_LOG_SCHEDULER_SLEEP; + +typedef struct _CI_LOG_SCHEDULER_SLEEP_RESPONSE +{ + EVENT_TRACE_HEADER Header; // Header +} CI_LOG_SCHEDULER_SLEEP_RESPONSE, *PCI_LOG_SCHEDULER_SLEEP_RESPONSE; + +typedef struct _CI_LOG_MMCSS_START +{ + EVENT_TRACE_HEADER Header; // Header +} CI_LOG_MMCSS_START, *PCI_LOG_MMCSS_START; + +typedef struct _CI_LOG_MMCSS_STOP +{ + EVENT_TRACE_HEADER Header; // Header +} CI_LOG_MMCSS_STOP, *PCI_LOG_MMCSS_STOP; + +// +// UMS events. +// +#define UMS_ETW_DIRECTED_SWITCH_START_VOLATILE (0x1) + +typedef struct _ETW_UMS_EVENT_DIRECTED_SWITCH_START +{ + ULONG ProcessId; + ULONG ScheduledThreadId; + ULONG PrimaryThreadId; + ULONG SwitchFlags; +} ETW_UMS_EVENT_DIRECTED_SWITCH_START, *PETW_UMS_EVENT_DIRECTED_SWITCH_START; + +#define UMS_ETW_DIRECTED_SWITCH_END_FAST (0x1) + +typedef struct _ETW_UMS_EVENT_DIRECTED_SWITCH_END +{ + ULONG ProcessId; + ULONG ScheduledThreadId; + ULONG PrimaryThreadId; + ULONG SwitchFlags; +} ETW_UMS_EVENT_DIRECTED_SWITCH_END, *PETW_UMS_EVENT_DIRECTED_SWITCH_END; + +#define UMS_ETW_PARK_VOLATILE (0x1) +#define UMS_ETW_PARK_PRIMARY_PRESENT (0x2) +#define UMS_ETW_PARK_PRIMARY_DELIVERED_CONTEXT (0x4) + +typedef struct _ETW_UMS_EVENT_PARK +{ + ULONG ProcessId; + ULONG ScheduledThreadId; + ULONG ParkFlags; +} ETW_UMS_EVENT_PARK, *PETW_UMS_EVENT_PARK; + +typedef struct _ETW_UMS_EVENT_DISASSOCIATE +{ + ULONG ProcessId; + ULONG ScheduledThreadId; + ULONG PrimaryThreadId; + ULONG UmsApcControlFlags; + NTSTATUS Status; +} ETW_UMS_EVENT_DISASSOCIATE, *PETW_UMS_EVENT_DISASSOCIATE; + +typedef struct _ETW_UMS_EVENT_CONTEXT_SWITCH +{ + SYSTEM_TRACE_HEADER Header; + ULONG ScheduledThreadId; + ULONG SwitchCount; + ULONG KernelYieldCount; + ULONG MixedYieldCount; + ULONG YieldCount; // Used to determine event size; needs to be the last field. +} ETW_UMS_EVENT_CONTEXT_SWITCH, *PETW_UMS_EVENT_CONTEXT_SWITCH; + +// +// For ETW_SET_TIMER_EVENT, Period must always be defined as the last member as +// the same structure is used for periodic and one-shot timers. In the latter +// case, the payload size is truncated to ignore the period field. +// +typedef struct _ETW_SET_TIMER_EVENT +{ + ULONG64 ExpectedDueTime; + ULONG_PTR TimerAddress; + USHORT TargetProcessorGroup; + UCHAR TargetProcessorIndex; + UCHAR Flags; + ULONG Period; + UCHAR EncodedDelay; + UCHAR Reserved0; + USHORT Reserved1; +} ETW_SET_TIMER_EVENT, *PETW_SET_TIMER_EVENT; + +typedef struct _ETW_CANCEL_TIMER_EVENT +{ + ULONG_PTR TimerAddress; +} ETW_CANCEL_TIMER_EVENT, *PETW_CANCEL_TIMER_EVENT; + +typedef struct _ETW_TIMER_EXPIRATION_EVENT +{ + ULONG64 ExpectedDueTime; + ULONG_PTR TimerAddress; + ULONG_PTR DeferredRoutine; + UCHAR EncodedDelay; +} ETW_TIMER_EXPIRATION_EVENT, *PETW_TIMER_EXPIRATION_EVENT; + +typedef struct _ETW_TIMER_EXPIRATION_START_EVENT +{ + ULONG64 InterruptTime; +} ETW_TIMER_EXPIRATION_START_EVENT, *PETW_TIMER_EXPIRATION_START_EVENT; + +#define ETW_KTIMER2_HAS_CALLBACK 0x01 +#define ETW_KTIMER2_PERIODIC 0x02 +#define ETW_KTIMER2_IDLE_RESILIENT 0x04 +#define ETW_KTIMER2_HIGH_RESOLUTION 0x08 +#define ETW_KTIMER2_NO_WAKE 0x10 +#define ETW_KTIMER2_NO_WAKE_FINITE 0x20 + +// +// Define timer events. +// + +#define ETW_TIMER_COALESCABLE 0x01 +#define ETW_TIMER_DPC 0x02 +#define ETW_TIMER_IDLE_RESILIENT ETW_KTIMER2_IDLE_RESILIENT +#define ETW_TIMER_HIGH_RESOLUTION ETW_KTIMER2_HIGH_RESOLUTION +#define ETW_TIMER_NO_WAKE ETW_KTIMER2_NO_WAKE + +typedef struct _ETW_SET_KTIMER2_EVENT +{ + ULONG64 DueTime; + ULONG64 MaximumDueTime; + ULONG64 Period; + ULONG_PTR TimerKey; + ULONG_PTR Callback; + ULONG_PTR CallbackContextKey; + UCHAR Flags; +} ETW_SET_KTIMER2_EVENT, *PETW_SET_KTIMER2_EVENT; + +typedef ETW_SET_KTIMER2_EVENT ETW_KTIMER2_EXPIRATION_EVENT, *PETW_KTIMER2_EXPIRATION_EVENT; + +typedef struct _ETW_CANCEL_KTIMER2_EVENT +{ + ULONG_PTR TimerKey; +} ETW_CANCEL_KTIMER2_EVENT, *PETW_CANCEL_KTIMER2_EVENT; + +#define ETW_DISABLE_KTIMER2_CANCEL 0x1 +#define ETW_DISABLE_KTIMER2_WAIT 0x2 +#define ETW_DISABLE_KTIMER2_DELAYED 0x4 +#define ETW_DISABLE_KTIMER2_HAS_DISABLE_CALLBACK 0x8 + +typedef struct _ETW_DISABLE_KTIMER2_EVENT +{ + ULONG_PTR TimerKey; + ULONG_PTR DisableCallback; + ULONG_PTR DisableContextKey; + UCHAR Flags; +} ETW_DISABLE_KTIMER2_EVENT, *PETW_DISABLE_KTIMER2_EVENT; + +typedef struct _ETW_FINALIZE_KTIMER2_EVENT +{ + ULONG_PTR TimerKey; + ULONG_PTR DisableCallback; + ULONG_PTR DisableContextKey; +} ETW_FINALIZE_KTIMER2_EVENT, *PETW_FINALIZE_KTIMER2_EVENT; + +// +// Clock event definitions. +// +typedef enum _PERFINFO_DYNAMIC_TICK_VETO_REASON +{ + DynamicTickVetoNone = 0, + DynamicTickVetoProcBusy, + DynamicTickVetoSoftwareTimer, + DynamicTickVetoClockConstraint, + DynamicTickVetoClockOutOfSync, + DynamicTickVetoClockUpdateFailed, + DynamicTickVetoMax +} PERFINFO_DYNAMIC_TICK_VETO_REASON, *PPERFINFO_DYNAMIC_TICK_VETO_REASON; + +typedef enum _PERFINFO_DYNAMIC_TICK_DISABLE_REASON +{ + DynamicTickDisableReasonNone = 0, + DynamicTickDisableReasonBcdOverride, + DynamicTickDisableReasonNoHwSupport, + DynamicTickDisableReasonEmOverride, + DynamicTickDisableReasonMax +} PERFINFO_DYNAMIC_TICK_DISABLE_REASON, *PPERFINFO_DYNAMIC_TICK_DISABLE_REASON; + +typedef struct _ETW_CLOCK_CONFIGURATION_EVENT +{ + ULONG KnownType; + ULONG Capabilities; + PERFINFO_DYNAMIC_TICK_DISABLE_REASON DisableReason; +} ETW_CLOCK_CONFIGURATION_EVENT, *PETW_CLOCK_CONFIGURATION_EVENT; + +typedef struct _ETW_CLOCK_TIME_UPDATE +{ + ULONG64 InterruptTime; + ULONG ClockOwner; +} ETW_CLOCK_TIME_UPDATE, *PETW_CLOCK_TIME_UPDATE; + +typedef struct _ETW_CLOCK_STATE_CHANGE_EVENT +{ + UCHAR NewState; + UCHAR PrevState; + UCHAR Reserved[6]; + union + { + struct + { + ULONG64 DeliveredIncrement; + ULONG64 RequestedIncrement; + }; + ULONG64 NextClockUpdateTime; + }; +} ETW_CLOCK_STATE_CHANGE_EVENT, *PETW_CLOCK_STATE_CHANGE_EVENT; + +// +// DFSS Events +// +typedef struct _ETW_PER_SESSION_QUOTA +{ + ULONG SessionId; + ULONG CpuShareWeight; + LONGLONG CapturedWeightData; + ULONG64 CyclesAccumulated; +} ETW_PER_SESSION_QUOTA, *PETW_PER_SESSION_QUOTA; + +typedef struct _ETW_DFSS_START_NEW_INTERVAL +{ + ULONG CurrentGeneration; + ULONG SessionCount; + ULONG64 TotalCycleCredit; + ULONG64 TotalCyclesAccumulated; + ETW_PER_SESSION_QUOTA SessionQuota[1]; +} ETW_DFSS_START_NEW_INTERVAL, *PETW_DFSS_START_NEW_INTERVAL; + +typedef struct _ETW_DFSS_RELEASE_THREAD_ON_IDLE +{ + ULONG CurrentGeneration; + ULONG SessionSelectedToRun; + ULONG64 CycleBaseAllowance; + LONG64 CyclesRemaining; +} ETW_DFSS_RELEASE_THREAD_ON_IDLE, *PETW_DFSS_RELEASE_THREAD_ON_IDLE; + +typedef struct _ETW_CPU_CACHE_FLUSH_EVENT +{ + PVOID Address; + SIZE_T Bytes; + BOOLEAN Clean; + BOOLEAN FullFlush; + BOOLEAN Rectangle; + BOOLEAN Reserved0; + ULONG Reserved1; +} ETW_CPU_CACHE_FLUSH_EVENT, *PETW_CPU_CACHE_FLUSH_EVENT; + +DEFINE_GUID( /* 2b88b710-1c93-4f7c-b06c-655ecc50decc */ + EtwSecondaryDumpDataGuid, + 0x2b88b710, + 0x1c93, + 0x4f7c, + 0xb0, 0x6c, 0x65, 0x5e, 0xcc, 0x50, 0xde, 0xcc + ); + +// +// CKCL Name and Guid +// +#define CKCL_NAMEW L"Circular Kernel Context Logger" +#define CKCL_NAMEA "Circular Kernel Context Logger" + +DEFINE_GUID( /* 54dea73a-ed1f-42a4-af71-3e63d056f174 */ + CKCLGuid, + 0x54dea73a, + 0xed1f, + 0x42a4, + 0xaf, 0x71, 0x3e, 0x63, 0xd0, 0x56, 0xf1, 0x74 + ); + +// +// Audit Session Name and Guid +// +#define AUDIT_LOGGER_NAMEW L"Eventlog-Security" +#define AUDIT_LOGGER_NAMEA "Eventlog-Security" + +DEFINE_GUID( /* 0e66e20b-b802-ba6a-9272-31199d0ed295 */ + AuditLoggerGuid, + 0x0e66e20b, + 0xb802, + 0xba6a, + 0x92, 0x72, 0x31, 0x19, 0x9d, 0x0e, 0xd2, 0x95 + ); + +// +// Security Provider (LSASS) Guid +// +DEFINE_GUID( /* 54849625-5478-4994-a5ba-3e3b0328c30d */ + SecurityProviderGuid, + 0x54849625, + 0x5478, + 0x4994, + 0xa5, 0xba, 0x3e, 0x3b, 0x03, 0x28, 0xc3, 0x0d + ); + +DEFINE_GUID( /* 472496cf-0daf-4f7c-ac2e-3f8457ecc6bb */ + PrivateLoggerSecurityGuid, + 0x472496cf, + 0x0daf, + 0x4f7c, + 0xac, 0x2e, 0x3f, 0x84, 0x57, 0xec, 0xc6, 0xbb + ); + +// +// Spare guids for Perf/System events. +// + +DEFINE_GUID( /* 3282fc76-feed-498e-8aa7-e70f459d430e */ + JobGuid, + 0x3282fc76, + 0xfeed, + 0x498e, + 0x8a, 0xa7, 0xe7, 0x0f, 0x45, 0x9d, 0x43, 0x0e + ); + +DEFINE_GUID( /* 99134383-5248-43fc-834b-529454e75df3 */ + EventTraceSpare1, + 0x99134383, + 0x5248, + 0x43fc, + 0x83, 0x4b, 0x52, 0x94, 0x54, 0xe7, 0x5d, 0xf3 + ); + +DEFINE_GUID( /* 42695762-ea50-497a-9068-5cbbb35e0b95 */ + WnfGuid, + 0x42695762, + 0xea50, + 0x497a, + 0x90, 0x68, 0x5c, 0xbb, 0xb3, 0x5e, 0x0b, 0x95 + ); + +DEFINE_GUID( /* 3BEEF58A-6E0F-445D-B2A4-37AB737BD47E */ + UmglThreadGuid, + 0x3beef58a, + 0x6e0f, + 0x445d, 0xb2, 0xa4, 0x37, 0xab, 0x73, 0x7b, 0xd4, 0x7e + ); + +//// +//// DefaultTraceSecurityGuid. Specifies the default event tracing security +//// +//DEFINE_GUID( /* 0811c1af-7a07-4a06-82ed-869455cdf713 */ +// DefaultTraceSecurityGuid, +// 0x0811c1af, +// 0x7a07, +// 0x4a06, +// 0x82, 0xed, 0x86, 0x94, 0x55, 0xcd, 0xf7, 0x13 +// ); + +DEFINE_GUID( /* 3d6fa8d4-fe05-11d0-9dda-00c04fd7ba7c */ + DiskIoGuid, + 0x3d6fa8d4, + 0xfe05, + 0x11d0, + 0x9d, 0xda, 0x00, 0xc0, 0x4f, 0xd7, 0xba, 0x7c + ); + +DEFINE_GUID( /* B3E675D7-2554-4f18-830B-2762732560DE */ + ImageIdGuid, + 0xb3e675d7, + 0x2554, + 0x4f18, + 0x83, 0xb, 0x27, 0x62, 0x73, 0x25, 0x60, 0xde + ); + +DEFINE_GUID( /* 0268a8b6-74fd-4302-9dd0-6e8f1795c0cf */ + PoolGuid, + 0x0268a8b6, + 0x74fd, + 0x4302, + 0x9d, 0xd0, 0x6e, 0x8f, 0x17, 0x95, 0xc0, 0xcf + ); + +DEFINE_GUID( /* ce1dbfb4-137e-4da6-87b0-3f59aa102cbc */ + PerfinfoGuid, + 0xce1dbfb4, + 0x137e, + 0x4da6, + 0x87, 0xb0, 0x3f, 0x59, 0xaa, 0x10, 0x2c, 0xbc + ); + +DEFINE_GUID( /* 222962ab-6180-4b88-a825-346b75f2a24a */ + HeapGuid, + 0x222962ab, + 0x6180, + 0x4b88, + 0xa8, 0x25, 0x34, 0x6b, 0x75, 0xf2, 0xa2, 0x4a + ); + +DEFINE_GUID( /* d781ca11-61c0-4387-b83d-af52d3d2dd6a */ + HeapRangeGuid, + 0xd781ca11, + 0x61c0, + 0x4387, + 0xb8, 0x3d, 0xaf, 0x52, 0xd3, 0xd2, 0xdd, 0x6a + ); + +DEFINE_GUID( /* 05867806-c246-43ef-a147-e17d2bdb1496 */ + HeapSummaryGuid, + 0x05867806, + 0xc246, + 0x43ef, + 0xa1, 0x47, 0xe1, 0x7d, 0x2b, 0xdb, 0x14, 0x96 + ); + +DEFINE_GUID( /* 3AC66736-CC59-4cff-8115-8DF50E39816B */ + CritSecGuid, + 0x3ac66736, + 0xcc59, + 0x4cff, + 0x81, 0x15, 0x8d, 0xf5, 0xe, 0x39, 0x81, 0x6b + ); + +DEFINE_GUID( /* DEF2FE46-7BD6-4b80-bd94-F57FE20D0CE3 */ + StackWalkGuid, + 0xdef2fe46, + 0x7bd6, + 0x4b80, + 0xbd, 0x94, 0xf5, 0x7f, 0xe2, 0xd, 0xc, 0xe3 + ); + +DEFINE_GUID( /* 45d8cccd-539f-4b72-a8b7-5c683142609a */ + ALPCGuid, + 0x45d8cccd, + 0x539f, + 0x4b72, + 0xa8, 0xb7, 0x5c, 0x68, 0x31, 0x42, 0x60, 0x9a + ); + +DEFINE_GUID( /* 6A399AE0-4BC6-4DE9-870B-3657F8947E7E */ + RTLostEventsGuid, + 0x6a399ae0, + 0x4bc6, + 0x4de9, + 0x87, 0x0b, 0x36, 0x57, 0xf8, 0x94, 0x7e, 0x7e + ); + +DEFINE_GUID( /* E21D2142-DF90-4d93-BBD9-30E63D5A4AD6 */ + NtdllTraceGuid, + 0xe21d2142, + 0xdf90, + 0x4d93, + 0xbb, 0xd9, 0x30, 0xe6, 0x3d, 0x5a, 0x4a, 0xd6 + ); + +DEFINE_GUID( /* d3de60b2-a663-45d5-9826-a0a5949d2cb0 */ + LoadMUIDllGuid, + 0xd3de60b2, + 0xa663, + 0x45d5, + 0x98, 0x26, 0xa0, 0xa5, 0x94, 0x9d, 0x2c, 0xb0 + ); + +DEFINE_GUID( /* 89497f50-effe-4440-8cf2-ce6b1cdcaca7 */ + ObjectGuid, + 0x89497f50, + 0xeffe, + 0x4440, + 0x8c, 0xf2, 0xce, 0x6b, 0x1c, 0xdc, 0xac, 0xa7 + ); + +DEFINE_GUID( /* a9152f00-3f58-4bee-92a1-70c7d079d5dd */ + ModBoundGuid, + 0xa9152f00, + 0x3f58, + 0x4bee, + 0x92, 0xa1, 0x70, 0xc7, 0xd0, 0x79, 0xd5, 0xdd + ); + +DEFINE_GUID( /* 3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c */ + ProcessGuid, + 0x3d6fa8d0, + 0xfe05, + 0x11d0, + 0x9d, 0xda, 0x00, 0xc0, 0x4f, 0xd7, 0xba, 0x7c + ); + +DEFINE_GUID( /* E43445E0-0903-48c3-B878-FF0FCCEBDD04 */ + PowerGuid, + 0xe43445e0, + 0x903, + 0x48c3, + 0xb8, 0x78, 0xff, 0xf, 0xcc, 0xeb, 0xdd, 0x4 + ); + +DEFINE_GUID( /* F8F10121-B617-4A56-868B-9dF1B27FE32C */ + MmcssGuid, + 0xf8f10121, + 0xb617, + 0x4a56, + 0x86, 0x8b, 0x9d, 0xf1, 0xb2, 0x7f, 0xe3, 0x2c + ); + +DEFINE_GUID( /* b2d14872-7c5b-463d-8419-ee9bf7d23e04 */ + DpcGuid, + 0xb2d14872, + 0x7c5b, + 0x463d, + 0x84, 0x19, 0xee, 0x9b, 0xf7, 0xd2, 0x3e, 0x04 + ); + +DEFINE_GUID( /* d837ca92-12b9-44a5-ad6a-3a65b3578aa8 */ + SplitIoGuid, + 0xd837ca92, + 0x12b9, + 0x44a5, + 0xad, 0x6a, 0x3a, 0x65, 0xb3, 0x57, 0x8a, 0xa8 + ); + +DEFINE_GUID( /* c861d0e2-a2c1-4d36-9f9c-970bab943a12 */ + ThreadPoolGuid, + 0xc861d0e2, + 0xa2c1, + 0x4d36, + 0x9f, 0x9c, 0x97, 0x0b, 0xab, 0x94, 0x3a, 0x12 + ); + +DEFINE_GUID( /* bddad2c1-52d1-4aea-94d6-b3ca9236f62e */ + UmsTraceGuid, + 0xbddad2c1, + 0x52d1, + 0x4aea, + 0x94, 0xd6, 0xb3, 0xca, 0x92, 0x36, 0xf6, 0x2e + ); + +DEFINE_GUID( /* 9aec974b-5b8e-4118-9b92-3186d8002ce5 */ + UmsEventGuid, + 0x9aec974b, + 0x5b8e, + 0x4118, + 0x9b, 0x92, 0x31, 0x86, 0xd8, 0x00, 0x2c, 0xe5 + ); + +DEFINE_GUID( /* 7f2a405c-69b5-4bf9-a1f5-30e8f1afab5e */ + HypervisorTraceGuid, + 0x7f2a405c, + 0x69b5, + 0x4bf9, + 0xa1, 0xf5, 0x30, 0xe8, 0xf1, 0xaf, 0xab, 0x5e + ); + +DEFINE_GUID( /* 2ce9a149-effe-42f0-a635-a1d39e26c8f2 */ + HypervisorXTraceGuid, + 0x2ce9a149, + 0xeffe, + 0x42f0, + 0xa6, 0x35, 0xa1, 0xd3, 0x9e, 0x26, 0xc8, 0xf2 + ); + +DEFINE_GUID( /* 2d9f3a42-01d4-4733-97f7-041e8021dc84 */ + LegacyEventLogGuid, + 0x2d9f3a42, + 0x01d4, + 0x4733, + 0x97, 0xf7, 0x04, 0x1e, 0x80, 0x21, 0xdc, 0x84 + ); + +DEFINE_GUID( /* 3b9c9951-3480-4220-9377-9c8e5184f5cd */ + KernelRundownGuid, + 0x3b9c9951, + 0x3480, + 0x4220, + 0x93, 0x77, 0x9c, 0x8e, 0x51, 0x84, 0xf5, 0xcd + ); + +DEFINE_GUID( /* 2a6e185b-90de-4fc5-826c-9f44e608a427 */ + SessionNotificationGuid, + 0x2a6e185b, + 0x90de, + 0x4fc5, + 0x82, 0x6c, 0x9f, 0x44, 0xe6, 0x08, 0xa4, 0x27 + ); + +DEFINE_GUID( /* 7687a439-f752-45b8-b741-321aec0f8df9 */ + CcGuid, + 0x7687a439, + 0xf752, + 0x45b8, + 0xb7, 0x41, 0x32, 0x1a, 0xec, 0x0f, 0x8d, 0xf9 + ); + +DEFINE_GUID( /* 00000000-0000-0000-0000-000000000000 */ + NullGuid, + 0x00000000, + 0x0000, + 0x0000, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + ); + +/// +// EventTraceGuid is used to identify a event tracing session +// +//DEFINE_GUID( /* 68fdd900-4a3e-11d1-84f4-0000f80464e3 */ +// EventTraceGuid, +// 0x68fdd900, +// 0x4a3e, +// 0x11d1, +// 0x84, 0xf4, 0x00, 0x00, 0xf8, 0x04, 0x64, 0xe3 +// ); +// +// +// EventTraceConfigGuid. Used to report system configuration records +// +//DEFINE_GUID( /* 01853a65-418f-4f36-aefc-dc0f1d2fd235 */ +// EventTraceConfigGuid, +// 0x01853a65, +// 0x418f, +// 0x4f36, +// 0xae, 0xfc, 0xdc, 0x0f, 0x1d, 0x2f, 0xd2, 0x35 +// ); + +DEFINE_GUID( /* 90cbdc39-4a3e-11d1-84f4-0000f80464e3 */ + FileIoGuid, + 0x90cbdc39, + 0x4a3e, + 0x11d1, + 0x84, 0xf4, 0x00, 0x00, 0xf8, 0x04, 0x64, 0xe3 + ); + +DEFINE_GUID( /* 2cb15d1d-5fc1-11d2-abe1-00a0c911f518 */ + ImageLoadGuid, + 0x2cb15d1d, + 0x5fc1, + 0x11d2, + 0xab, 0xe1, 0x00, 0xa0, 0xc9, 0x11, 0xf5, 0x18 + ); + +DEFINE_GUID( /* 3d6fa8d3-fe05-11d0-9dda-00c04fd7ba7c */ + PageFaultGuid, + 0x3d6fa8d3, + 0xfe05, + 0x11d0, + 0x9d, 0xda, 0x00, 0xc0, 0x4f, 0xd7, 0xba, 0x7c + ); + +DEFINE_GUID( /* AE53722E-C863-11d2-8659-00C04FA321A1 */ + RegistryGuid, + 0xae53722e, + 0xc863, + 0x11d2, + 0x86, 0x59, 0x0, 0xc0, 0x4f, 0xa3, 0x21, 0xa1 + ); + +DEFINE_GUID( /* 9a280ac0-c8e0-11d1-84e2-00c04fb998a2 */ + TcpIpGuid, + 0x9a280ac0, + 0xc8e0, + 0x11d1, + 0x84, 0xe2, 0x00, 0xc0, 0x4f, 0xb9, 0x98, 0xa2 + ); + +DEFINE_GUID( /* 3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c */ + ThreadGuid, + 0x3d6fa8d1, + 0xfe05, + 0x11d0, + 0x9d, 0xda, 0x00, 0xc0, 0x4f, 0xd7, 0xba, 0x7c + ); + +DEFINE_GUID( /* bf3a50c5-a9c9-4988-a005-2df0b7c80f80 */ + UdpIpGuid, + 0xbf3a50c5, + 0xa9c9, + 0x4988, + 0xa0, 0x05, 0x2d, 0xf0, 0xb7, 0xc8, 0x0f, 0x80 + ); + +// +// ThreadPool Events +// If you change these structures, may need to update some users of these +// structures. +// Avoid inner structure padding +// + +typedef struct _ETW_TP_EVENT_CALLBACK_ENQUEUE +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID PoolId; // Pool Identifier + PVOID TaskId; // Task Identifier + PVOID Callback; // Callback Function + PVOID Context; // Callback Context + PVOID SubProcessTag; // Sub-components in a process + // SubProcessTag must be the last field or update users +} ETW_TP_EVENT_CALLBACK_ENQUEUE, *PETW_TP_EVENT_CALLBACK_ENQUEUE; + +// +// Use the same struct for Enqueue and Dequeue +// + +typedef ETW_TP_EVENT_CALLBACK_ENQUEUE ETW_TP_EVENT_CALLBACK_DEQUEUE, *PETW_TP_EVENT_CALLBACK_DEQUEUE; + +typedef struct _ETW_TP_EVENT_CALLBACK_START +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID PoolId; // Pool Identifier + PVOID TaskId; // Task Identifier + PVOID Callback; // Callback Function + PVOID Context; // Callback Context + PVOID SubProcessTag; // Sub-components in a process + // SubProcessTag must be the last field or update users + +} ETW_TP_EVENT_CALLBACK_START, *PETW_TP_EVENT_CALLBACK_START; + +// +// Use the same struct for Start and Stop +// + +typedef ETW_TP_EVENT_CALLBACK_START ETW_TP_EVENT_CALLBACK_STOP, *PETW_TP_EVENT_CALLBACK_STOP; + +typedef struct _ETW_TP_EVENT_CALLBACK_CANCEL +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID PoolId; // Pool Identifier + PVOID TaskId; // Task Identifier + PVOID Callback; // Callback Function + PVOID Context; // Callback Context + PVOID SubProcessTag; // Sub-components in a process + ULONG CancelCount; // Number of callbacks cancelled + // CancelCount must be the last field or update users + +} ETW_TP_EVENT_CALLBACK_CANCEL, *PETW_TP_EVENT_CALLBACK_CANCEL; + +typedef struct _ETW_TP_EVENT_POOL_CREATE +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID PoolId; // Pool Identifier + // PoolId must be the last field or update users + +} ETW_TP_EVENT_POOL_CREATE, *PETW_TP_EVENT_POOL_CREATE; + +typedef struct _ETW_TP_EVENT_POOL_CLOSE +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID PoolId; // Pool Identifier + // PoolId must be the last field or update users + +} ETW_TP_EVENT_POOL_CLOSE, *PETW_TP_EVENT_POOL_CLOSE; + +typedef struct _ETW_TP_EVENT_POOL_TH_MIN_SET +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID PoolId; // Pool Identifier + ULONG ThreadNum; // New limit on number of threads + // ThreadNum must be the last field or update users + +} ETW_TP_EVENT_POOL_TH_MIN_SET, *PETW_TP_EVENT_POOL_TH_MIN_SET; + +typedef struct _ETW_TP_EVENT_POOL_TH_MAX_SET +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID PoolId; // Pool Identifier + ULONG ThreadNum; // New limit on number of threads + // ThreadNum must be the last field or update users + +} ETW_TP_EVENT_POOL_TH_MAX_SET, *PETW_TP_EVENT_POOL_TH_MAX_SET; + +typedef struct _ETW_TP_EVENT_WORKER_NUMANODE_SWITCH +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID PoolId; // Pool Identifier + ULONG CurrentNode; // Thread's current numa node + ULONG NextNode; // The node the thread is moving to + USHORT CurrentGroup; // Thread's current group + USHORT NextGroup; // The group the thread is moving to + ULONG CurrentWorkerCount; // Current node's worker count + ULONG NextWorkerCount; // Next node's worker count + // NextWorkerCount must be the last field or update users + +} ETW_TP_EVENT_WORKER_NUMANODE_SWITCH, *PETW_TP_EVENT_WORKER_NUMANODE_SWITCH; + +#include +typedef struct _ETW_TP_EVENT_TIMER_SET +{ + SYSTEM_TRACE_HEADER Header; // Header + LONG64 DueTime; // Due time + PVOID SubQueue; // Sub Queue to be inserted + PVOID Timer; // Timer to be set + ULONG Period; // period of the timer + ULONG WindowLength; // Tolerate period + ULONG Absolute; // An absolute timer or relative timer +} ETW_TP_EVENT_TIMER_SET, *PETW_TP_EVENT_TIMER_SET; + +typedef struct _ETW_TP_EVENT_TIMER_CANCELLED +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID SubQueue; // Sub Queue containing the timer + PVOID Timer; // Timer to be cancelled +} ETW_TP_EVENT_TIMER_CANCELLED, *PETW_TP_EVENT_TIMER_CANCELLED; + +typedef struct _ETW_TP_EVENT_TIMER_SET_NTTIMER +{ + SYSTEM_TRACE_HEADER Header; // Header + LONG64 DueTime; // Due time + PVOID SubQueue; // Sub Queue to be inserted + ULONG TolerableDelay; // Tolerance +} ETW_TP_EVENT_TIMER_SET_NTTIMER, *PETW_TP_EVENT_TIMER_SET_NTTIMER; + +typedef struct _ETW_TP_EVENT_TIMER_CANCEL_NTTIMER +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID SubQueue; // Sub Queue to be cancelled +} ETW_TP_EVENT_TIMER_CANCEL_NTTIMER, *PETW_TP_EVENT_TIMER_CANCEL_NTTIMER; + +typedef struct _ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID SubQueue; // Sub Queue to be expired +} ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN, *PETW_TP_EVENT_TIMER_EXPIRATION_BEGIN; + +typedef struct _ETW_TP_EVENT_TIMER_EXPIRATION_END +{ + SYSTEM_TRACE_HEADER Header; // Header + PVOID SubQueue; // Sub Queue to be expired +} ETW_TP_EVENT_TIMER_EXPIRATION_END, *PETW_TP_EVENT_TIMER_EXPIRATION_END; + +typedef struct _ETW_TP_EVENT_TIMER_EXPIRATION +{ + SYSTEM_TRACE_HEADER Header; // Header + LONG64 DueTime; // Due time + PVOID SubQueue; // Sub Queue containing the timer + PVOID Timer; // Timer to be expired + ULONG Period; // period of the timer + ULONG WindowLength; // Tolerate period +} ETW_TP_EVENT_TIMER_EXPIRATION, *PETW_TP_EVENT_TIMER_EXPIRATION; +#include + +// +// Thread SubProcessTag Changed Event +// + +typedef struct _ETW_THREAD_EVENT_SUBPROCESSTAG +{ + SYSTEM_TRACE_HEADER Header; // Header + ULONG OldTag; + ULONG NewTag; +} ETW_THREAD_EVENT_SUBPROCESSTAG, *PETW_THREAD_EVENT_SUBPROCESSTAG; + +// +// WNF Events +// +typedef struct _ETW_WNF_EVENT_SUBSCRIBE +{ + SYSTEM_TRACE_HEADER Header; // Header + LARGE_INTEGER StateName; // State name + PVOID Subscription; // User Subscription + PVOID NameSub; // Name Subscription + PVOID Callback; // Callback function + ULONG RefCount; // Name Subscription Refcount + ULONG DeliveryFlags; // Requested Deliveries +} ETW_WNF_EVENT_SUBSCRIBE, *PETW_WNF_EVENT_SUBSCRIBE; + +typedef ETW_WNF_EVENT_SUBSCRIBE ETW_WNF_EVENT_UNSUBSCRIBE, *PETW_WNF_EVENT_UNSUBSCRIBE; + +typedef struct _ETW_WNF_EVENT_CALLBACK +{ + SYSTEM_TRACE_HEADER Header; // Header + LARGE_INTEGER StateName; // State name + PVOID Subscription; // User Subscription + PVOID NameSub; // Name Subscription + PVOID Callback; // Callback function + ULONG ChangeStamp; // Change Stamp + ULONG DeliveryFlags; // Delivery types + ULONG Return; // Return status from callback +} ETW_WNF_EVENT_CALLBACK, *PETW_WNF_EVENT_CALLBACK; + +typedef struct _ETW_WNF_EVENT_PUBLISH +{ + SYSTEM_TRACE_HEADER Header; // Header + LARGE_INTEGER StateName; // State name + ULONG DataLength; // Length of State Data +} ETW_WNF_EVENT_PUBLISH, *PETW_WNF_EVENT_PUBLISH; + +typedef struct _ETW_WNF_EVENT_NAME_SUB_RUNDOWN +{ + SYSTEM_TRACE_HEADER Header; // Header + LARGE_INTEGER StateName; // State name + PVOID NameSub; // Name Subscription +} ETW_WNF_EVENT_NAME_SUB_RUNDOWN, *PETW_WNF_EVENT_NAME_SUB_RUNDOWN; + +// +// Data structures of events +// +#define PERFINFO_THREAD_SWAPABLE 0 +#define PERFINFO_THREAD_NONSWAPABLE 1 + +typedef struct _PERFINFO_MARK_EVENT +{ + ULONG TranId; + UCHAR Level; + UCHAR AppId; + USHORT OpId; + WCHAR Text[1]; +} PERFINFO_MARK_EVENT, *PPERFINFO_MARK_EVENT; + +// +// Structures for Driver hooks +// + +#include +typedef struct _PERFINFO_DRIVER_MAJORFUNCTION +{ + ULONG MajorFunction; + ULONG MinorFunction; + PVOID RoutineAddr; + PVOID FileNamePointer; + PVOID Irp; + ULONG UniqMatchId; +} PERFINFO_DRIVER_MAJORFUNCTION, *PPERFINFO_DRIVER_MAJORFUNCTION; +#include + +#include +typedef struct _PERFINFO_DRIVER_MAJORFUNCTION_RET +{ + PVOID Irp; + ULONG UniqMatchId; +} PERFINFO_DRIVER_MAJORFUNCTION_RET, *PPERFINFO_DRIVER_MAJORFUNCTION_RET; +#include + +#include +typedef struct _PERFINFO_DRIVER_COMPLETE_REQUEST +{ + // + // Driver major function routine address for the "current" stack location + // on the IRP when it was completed. It is used to identify which driver + // was processing the IRP when the IRP got completed. + // + + PVOID RoutineAddr; + + // + // Irp field and UniqMatchId is used to match COMPLETE_REQUEST + // and COMPLETE_REQUEST_RET logged for an IRP completion. + // + + PVOID Irp; + ULONG UniqMatchId; + +} PERFINFO_DRIVER_COMPLETE_REQUEST, *PPERFINFO_DRIVER_COMPLETE_REQUEST; +#include + +#include +typedef struct _PERFINFO_DRIVER_COMPLETE_REQUEST_RET +{ + // + // Irp field and UniqMatchId is used to match COMPLETE_REQUEST + // and COMPLETE_REQUEST_RET logged for an IRP completion. + // + PVOID Irp; + ULONG UniqMatchId; +} PERFINFO_DRIVER_COMPLETE_REQUEST_RET, *PPERFINFO_DRIVER_COMPLETE_REQUEST_RET; +#include + +#include +typedef struct _PERFINFO_DRIVER_COMPLETIONROUTINE +{ + PVOID Routine; + PVOID IrpPtr; + ULONG UniqMatchId; +} PERFINFO_DRIVER_COMPLETIONROUTINE, *PPERFINFO_DRIVER_COMPLETIONROUTINE; +#include + +// +// Power hooks +// +typedef struct _PERFINFO_BATTERY_LIFE_INFO +{ + ULONG RemainingCapacity; + ULONG Rate; +} PERFINFO_BATTERY_LIFE_INFO, *PPERFINFO_BATTERY_LIFE_INFO; + +typedef struct _PERFINFO_IDLE_STATE_CHANGE +{ + ULONG State; + ULONG Throttle; + ULONG Direction; +} PERFINFO_IDLE_STATE_CHANGE, *PPERFINFO_IDLE_STATE_CHANGE; + +// +// This structure is logged when PopSetPowerAction is called to start +// propagating a new power action (e.g. standby/hibernate/shutdown) +// +typedef struct _PERFINFO_SET_POWER_ACTION +{ + // + // This field is used to match SET_POWER_ACTION_RET entry. + // + PVOID Trigger; + ULONG PowerAction; + ULONG LightestState; +} PERFINFO_SET_POWER_ACTION, *PPERFINFO_SET_POWER_ACTION; + +// +// This structure is logged when PopSetPowerAction completes. +// +typedef struct _PERFINFO_SET_POWER_ACTION_RET +{ + PVOID Trigger; + NTSTATUS Status; +} PERFINFO_SET_POWER_ACTION_RET, *PPERFINFO_SET_POWER_ACTION_RET; + +// +// This structure is logged when PopSetDevicesSystemState is called to +// propagate a system state to all devices. +// +typedef struct _PERFINFO_SET_DEVICES_STATE +{ + ULONG SystemState; + BOOLEAN Waking; + BOOLEAN Shutdown; + UCHAR IrpMinor; +} PERFINFO_SET_DEVICES_STATE, *PPERFINFO_SET_DEVICES_STATE; + +// +// This structure is logged when PopSetDevicesSystemState is done. +// +typedef struct _PERFINFO_SET_DEVICES_STATE_RET +{ + NTSTATUS Status; +} PERFINFO_SET_DEVICES_STATE_RET, *PPERFINFO_SET_DEVICES_STATE_RET; + +// +// This structure is logged when PopNotifyDevice calls into a driver +// to set the power state of a device. +// +typedef struct _PERFINFO_PO_NOTIFY_DEVICE +{ + // + // This field is used to match notification and completion log + // entries for a device. + // + + PVOID Irp; + + // + // Base address of the driver that owns this device. + // + + PVOID DriverStart; + + // + // Device node properties. + // + + UCHAR OrderLevel; + + // + // Major and minor IRP codes for the request made to the driver. + // + + UCHAR MajorFunction; + UCHAR MinorFunction; + + // + // Type of power irp + // + POWER_STATE_TYPE Type; + POWER_STATE State; + + // + // Length of the device name in characters excluding terminating NUL, + // and the device name itself. Depending on how much fits into our + // stack buffer, this is the *last* part of the device name. + // + + ULONG DeviceNameLength; + WCHAR DeviceName[1]; + +} PERFINFO_PO_NOTIFY_DEVICE, *PPERFINFO_PO_NOTIFY_DEVICE; + +// +// This structure is logged when a PopNotifyDevice processing for a +// particular device completes. +// + +typedef struct _PERFINFO_PO_NOTIFY_DEVICE_COMPLETE +{ + // + // This field is used to match notification and completion log + // entries for a device. + // + + PVOID Irp; + + // + // Status with which the notify power IRP was completed. + // + + NTSTATUS Status; + +} PERFINFO_PO_NOTIFY_DEVICE_COMPLETE, *PPERFINFO_PO_NOTIFY_DEVICE_COMPLETE; + +// +// This structure is logged around every win32 state callout +// +typedef struct _PERFINFO_PO_SESSION_CALLOUT +{ + POWER_ACTION SystemAction; + SYSTEM_POWER_STATE MinSystemState; + ULONG Flags; + ULONG PowerStateTask; +} PERFINFO_PO_SESSION_CALLOUT, *PPERFINFO_PO_SESSION_CALLOUT; + +typedef struct _PERFINFO_PO_PRESLEEP +{ + LARGE_INTEGER PerformanceCounter; + LARGE_INTEGER PerformanceFrequency; +} PERFINFO_PO_PRESLEEP, *PPERFINFO_PO_PRESLEEP; + +typedef struct _PERFINFO_PO_POSTSLEEP +{ + LARGE_INTEGER PerformanceCounter; +} PERFINFO_PO_POSTSLEEP, *PPERFINFO_PO_POSTSLEEP; + +typedef struct _PERFINFO_PO_CALIBRATED_PERFCOUNTER +{ + LARGE_INTEGER PerformanceCounter; +} PERFINFO_PO_CALIBRATED_PERFCOUNTER, *PPERFINFO_PO_CALIBRATED_PERFCOUNTER; + +typedef struct _PERFINFO_BOOT_PHASE_START +{ + LONG Phase; +} PERFINFO_BOOT_PHASE_START, *PPERFINFO_BOOT_PHASE_START; + +typedef struct _PERFINFO_BOOT_PREFETCH_INFORMATION +{ + LONG Action; + NTSTATUS Status; + LONG Pages; +} PERFINFO_BOOT_PREFETCH_INFORMATION, *PPERFINFO_BOOT_PREFETCH_INFORMATION; + +typedef struct _PERFINFO_PO_SESSION_CALLOUT_RET +{ + NTSTATUS Status; +} PERFINFO_PO_SESSION_CALLOUT_RET, *PPERFINFO_PO_SESSION_CALLOUT_RET; + +typedef struct _PERFINFO_PPM_IDLE_STATE_CHANGE +{ + ULONG NewState; + ULONG OldState; + ULONG64 Processors; +} PERFINFO_PPM_IDLE_STATE_CHANGE, *PPERFINFO_PPM_IDLE_STATE_CHANGE; + +// +// Flags related to each processor idle entry. +// +// DUE_INTERRUPT: Idle duration hint is based on next expected h/w interrupt. +// When not set, it indicates the the idle duration hint was based on the next +// due s/w timer. +// +// IR_RETRY: The idle transition follows a failed previous attempt to pick the +// optimal idle state with an IR based hint. +// +// IR_ENABLED: Idle-resiliency was enabled during the idle transition. +// +// PLATFORM_ENTER: The idle entry was part of a platform idle transition. +// +// LOCK_PROCESSORS: The idle transition required locking at least one other +// processor. +// +// CONSTRAINT_PLATFORM: The idle entry was capable of a platform idle +// transition. +// +// CONSTRAINT_NI: The idle transition is capable of entering a non-interruptible +// idle state. +// +// OVERRIDE_ENABLED: The idle transition had force-idle override enabled. +// +// MEASURING_EXIT_LATENCY: Exit latency measurement is engaged during the idle +// transition. +// +// WAKE_REQUESTED: Idle transition was accompanied with a request to wake +// another processor. +// +// IPI_CLOCK_OWNER: Idle transition was on non clock owner and observed to be +// the last processor to be going idle. It send an IPI to clock owner to wake +// it up. +// +// PLATFORM_HINT_OVERRIDE: Idle duration hint is based on global platform idle +// hint. +// + +#define PERFINFO_PPM_IDLE_FLAG_DUE_INTERRUPT (1 << 0) +#define PERFINFO_PPM_IDLE_FLAG_IR_RETRY (1 << 1) +#define PERFINFO_PPM_IDLE_FLAG_IR_ENABLED (1 << 2) +#define PERFINFO_PPM_IDLE_FLAG_CLOCK_OWNER (1 << 3) +#define PERFINFO_PPM_IDLE_FLAG_PLATFORM_ENTER (1 << 4) +#define PERFINFO_PPM_IDLE_FLAG_LOCK_PROCESSORS (1 << 5) +#define PERFINFO_PPM_IDLE_FLAG_CONSTRAINT_NI (1 << 6) +#define PERFINFO_PPM_IDLE_FLAG_CONSTRAINT_PLATFORM (1 << 7) +#define PERFINFO_PPM_IDLE_FLAG_OVERRIDE_ENABLED (1 << 8) +#define PERFINFO_PPM_IDLE_FLAG_MEASURING_EXIT_LATENCY (1 << 9) +#define PERFINFO_PPM_IDLE_FLAG_WAKE_REQUESTED (1 << 10) +#define PERFINFO_PPM_IDLE_FLAG_IPI_CLOCK_OWNER (1 << 11) +#define PERFINFO_PPM_IDLE_FLAG_PLATFORM_HINT_OVERRIDE (1 << 12) +#define PERFINFO_PPM_IDLE_FLAG_DURATION_EXPIRATION (1 << 13) + +typedef struct _PERFINFO_PPM_IDLE_STATE_ENTER +{ + ULONG State; + union + { + struct + { + USHORT Properties; + UCHAR ExpectedWakeReason; + UCHAR Reserved; + }; + ULONG Flags; + }; + + ULONG64 ExpectedDuration; +} PERFINFO_PPM_IDLE_STATE_ENTER, *PPERFINFO_PPM_IDLE_STATE_ENTER; + +typedef struct _PERFINFO_PPM_IDLE_STATE_EXIT +{ + ULONG State; + ULONG Status; +} PERFINFO_PPM_IDLE_STATE_EXIT, *PPERFINFO_PPM_IDLE_STATE_EXIT; + +typedef struct _PERFINFO_PPM_STATE_SELECTION +{ + ULONG SelectedState; + ULONG VetoedStates; + _Field_size_(VetoedStates) ULONG VetoReason[ANYSIZE_ARRAY]; +} PERFINFO_PPM_STATE_SELECTION, *PPERFINFO_PPM_STATE_SELECTION; + +#define PERFINFO_PPM_IDLE_VETO_PREREGISTERED_VETO (0x80000000) +#define PERFINFO_PPM_IDLE_VETO_WRONG_INITIATOR (0x80000001) +#define PERFINFO_PPM_IDLE_VETO_SYSTEM_LATENCY (0x80000002) +#define PERFINFO_PPM_IDLE_VETO_IDLE_DURATION (0x80000003) +#define PERFINFO_PPM_IDLE_VETO_DEVICE_DEPENDENCY (0x80000004) +#define PERFINFO_PPM_IDLE_VETO_PROCESSOR_DEPENDENCY (0x80000005) +#define PERFINFO_PPM_IDLE_VETO_PLATFORM_ONLY (0x80000006) +#define PERFINFO_PPM_IDLE_VETO_INTERRUPTIBLE (0x80000007) +#define PERFINFO_PPM_IDLE_VETO_LEGACY_OVEERIDE (0x80000008) +#define PERFINFO_PPM_IDLE_VETO_C_STATE_CHECK (0x80000009) +#define PERFINFO_PPM_IDLE_VETO_NO_C_STATE (0x8000000a) +#define PERFINFO_PPM_IDLE_VETO_COORDINATED_DEPENDENCY (0x8000000b) +#define PERFINFO_PPM_IDLE_VETO_DISABLED_IN_MENU (0xfffffffe) +#define PERFINFO_PPM_IDLE_VETO_ACTIVE_PROCESSOR (0xffffffff) + +#define PERFINFO_PPM_IDLE_NON_INTERRUPTIBLE (1 << 0) +#define PERFINFO_PPM_IDLE_ALL_PROC_LOCKED (1 << 1) +#define PERFINFO_PPM_IDLE_EXIT_SAMPLE_INVALID (1 << 2) + +typedef struct _PERFINFO_PPM_IDLE_EXIT_LATENCY +{ + ULONG Flags; + ULONG PlatformState; + ULONG ProcessorState; + ULONG ReturnLatency; + ULONG TotalLatency; +} PERFINFO_PPM_IDLE_EXIT_LATENCY, *PPERFINFO_PPM_IDLE_EXIT_LATENCY; + +#define PERFINFO_PPM_FREQUENCY_VOLTAGE_STATE 1 +#define PERFINFO_PPM_STOPCLOCK_THROTTLE_STATE 2 + +typedef struct _PERFINFO_PPM_PERF_STATE_CHANGE +{ + ULONG Type; + ULONG NewState; + ULONG OldState; + NTSTATUS Result; + ULONG64 Processors; +} PERFINFO_PPM_PERF_STATE_CHANGE, *PPERFINFO_PPM_PERF_STATE_CHANGE; + +typedef struct _PERFINFO_PPM_THERMAL_CONSTRAINT{ + ULONG Constraint; + ULONG64 Processors; +} PERFINFO_PPM_THERMAL_CONSTRAINT, *PPERFINFO_PPM_THERMAL_CONSTRAINT; + +// +// File Name related hooks +// + +typedef struct _PERFINFO_FILEOBJECT_INFORMATION +{ + PVOID FileObject; +} PERFINFO_FILEOBJECT_INFORMATION, *PPERFINFO_FILEOBJECT_INFORMATION; + +typedef struct _PERFINFO_FILENAME_SAME_INFORMATION +{ + PVOID OldFile; + PVOID NewFile; +} PERFINFO_FILENAME_SAME_INFORMATION, *PPERFINFO_FILENAME_SAME_INFORMATION; + +typedef struct _PERFINFO_PFMAPPED_SECTION_INFORMATION +{ + PVOID RangeBase; + PVOID RangeEnd; + ULONG CreatingProcessId; +} PERFINFO_PFMAPPED_SECTION_INFORMATION, *PPERFINFO_PFMAPPED_SECTION_INFORMATION; + +typedef struct _PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION +{ + PVOID SectionObject; + PVOID RangeBase; +} PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION, *PPERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION; + +// +// Sample profile +// +typedef struct _PERFINFO_SAMPLED_PROFILE_INFORMATION +{ + PVOID InstructionPointer; + ULONG ThreadId; + USHORT Count; + union { + struct { + UCHAR ExecutingDpc : 1; + UCHAR ExecutingIsr : 1; + UCHAR Reserved : 1; + UCHAR Priority : 5; + } DUMMYSTRUCTNAME; + UCHAR Flags; + } DUMMYUNIONNAME; + UCHAR Rank; +} PERFINFO_SAMPLED_PROFILE_INFORMATION, *PPERFINFO_SAMPLED_PROFILE_INFORMATION; + +#define PERFINFO_SAMPLED_PROFILE_CACHE_MAX 20 +typedef struct _PERFINFO_SAMPLED_PROFILE_CACHE +{ + ULONG Entries; + PERFINFO_SAMPLED_PROFILE_INFORMATION Sample[PERFINFO_SAMPLED_PROFILE_CACHE_MAX]; +} PERFINFO_SAMPLED_PROFILE_CACHE, *PPERFINFO_SAMPLED_PROFILE_CACHE; + +typedef struct _PERFINFO_SAMPLED_PROFILE_CONFIG +{ + ULONG Source; + ULONG NewInterval; + ULONG OldInterval; +} PERFINFO_SAMPLED_PROFILE_CONFIG, *PPERFINFO_SAMPLED_PROFILE_CONFIG; + +typedef struct _PERFINFO_PMC_SAMPLE_INFORMATION +{ + PVOID InstructionPointer; + ULONG ThreadId; + USHORT ProfileSource; + USHORT Reserved; +} PERFINFO_PMC_SAMPLE_INFORMATION, *PPERFINFO_PMC_SAMPLE_INFORMATION; + +typedef struct _PERFINFO_DPC_INFORMATION +{ + ULONGLONG InitialTime; + PVOID DpcRoutine; +} PERFINFO_DPC_INFORMATION, *PPERFINFO_DPC_INFORMATION; + +typedef struct _PERFINFO_DPC_ENQUEUE_INFORMATION +{ + ULONG_PTR Key; + LONG DpcQueueDepth; + ULONG DpcCount; + ULONG TargetProcessorIndex; + UCHAR Importance; + UCHAR Reserved[3]; +} PERFINFO_DPC_ENQUEUE_INFORMATION, *PPERFINFO_DPC_ENQUEUE_INFORMATION; + +typedef struct _PERFINFO_DPC_EXECUTION_INFORMATION +{ + PVOID DpcRoutine; + ULONG_PTR Key; +} PERFINFO_DPC_EXECUTION_INFORMATION, *PPERFINFO_DPC_EXECUTION_INFORMATION; + +typedef struct _PERFINFO_YIELD_PROCESSOR_INFORMATION +{ + ULONG YieldReason; + ULONG DpcWatchdogCount; + ULONG DpcTimeCount; +} PERFINFO_YIELD_PROCESSOR_INFORMATION, *PPERFINFO_YIELD_PROCESSOR_INFORMATION; + +#include +typedef struct _PERFINFO_INTERRUPT_INFORMATION +{ + ULONGLONG InitialTime; + PVOID ServiceRoutine; + UCHAR ReturnValue; + USHORT Vector; + UCHAR Reserved; +} PERFINFO_INTERRUPT_INFORMATION, *PPERFINFO_INTERRUPT_INFORMATION; +#include + +#define PERFINFO_CLOCK_INTERRUPT_CLOCK_OWNER 0x0001 +#define PERFINFO_CLOCK_INTERRUPT_TIMER_PENDING 0x0008 + +typedef struct _PERFINFO_CLOCK_INTERRUPT_INFORMATION +{ + ULONG64 InterruptTime; + SHORT Flags; +} PERFINFO_CLOCK_INTERRUPT_INFORMATION, *PPERFINFO_CLOCK_INTERRUPT_INFORMATION; + +#define PERFINFO_IPI_APC_REQUEST 0x1 +#define PERFINFO_IPI_DPC_REQUEST 0x2 + +// +// Spinlock +// +#include +typedef struct _PERFINFO_SPINLOCK_CONFIG +{ + ULONG SpinLockSpinThreshold; + ULONG SpinLockContentionSampleRate; + ULONG SpinLockAcquireSampleRate; + ULONG SpinLockHoldThreshold; +} PERFINFO_SPINLOCK_CONFIG, *PPERFINFO_SPINLOCK_CONFIG; +#include + +// +// Stores Executive Resource sampling parameters. +// +// Note: NumberOfExcessiveTimeouts uses counting units of 4 (four) seconds. +// It inherits the granularity of ExResourceTimeoutCount used in +// ...\ntos\ex\resource.c. +// The later, takes a reg-key settable timeout with a default value of +// 30 days used to trigger a debug spew for excessive waits on the checked +// builds: 648000 * 4 seconds = 2592000 seconds = 30 days. +// +// HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\ +// ResourceTimeoutCount (REG_DWORD), Default: 0x9E340 (648000) +// +typedef struct _PERFINFO_EXECUTIVE_RESOURCE_CONFIG +{ + ULONG ReleaseSamplingRate; + ULONG ContentionSamplingRate; + ULONG NumberOfExcessiveTimeouts; +} PERFINFO_EXECUTIVE_RESOURCE_CONFIG, *PPERFINFO_EXECUTIVE_RESOURCE_CONFIG; + +// +// MM related hooks +// + +#define NTWMI_BITSIZE(type) (sizeof(type) * 8) + +typedef struct _PERFINFO_SESSIONCREATE_INFORMATION +{ + ULONG_PTR UniqueSessionId; + ULONG SessionId; +} PERFINFO_SESSIONCREATE_INFORMATION, *PPERFINFO_SESSIONCREATE_INFORMATION; + +typedef struct _PERFINFO_PAGE_RANGE_IDENTITY +{ + struct + { + ULONGLONG UseDescription : 4; // MMPFNUSE_* + ULONGLONG UniqueKey : 48; // Used for SessionVAs/AWE/LargePages. + ULONGLONG Reserved : 12; + }; + union + { + PVOID ProtoPteAddress; // Used for large page PFMapped sections. + ULONG_PTR PageFrameIndex; // Used for DriverLocked/UserPhysical Mdls. + PVOID VirtualAddress; // Used otherwise. + }; + ULONG_PTR PageCount; // Number of pages. +} PERFINFO_PAGE_RANGE_IDENTITY, *PPERFINFO_PAGE_RANGE_IDENTITY; + +#define PERFINFO_MM_KERNELMEMORY_USAGE_TYPE_BITS 5 + +typedef enum _PERFINFO_KERNELMEMORY_USAGE_TYPE +{ + PerfInfoMemUsagePfnMetadata, + PerfInfoMemUsageMax +} PERFINFO_KERNELMEMORY_USAGE_TYPE, *PPERFINFO_KERNELMEMORY_USAGE_TYPE; + +C_ASSERT(PerfInfoMemUsageMax <= (1 << PERFINFO_MM_KERNELMEMORY_USAGE_TYPE_BITS)); + +typedef struct _PERFINFO_KERNELMEMORY_RANGE_USAGE +{ + ULONG UsageType : PERFINFO_MM_KERNELMEMORY_USAGE_TYPE_BITS; + ULONG Spare: (NTWMI_BITSIZE (ULONG) - PERFINFO_MM_KERNELMEMORY_USAGE_TYPE_BITS); + PVOID VirtualAddress; // Starting VA (where meaningful). + ULONG_PTR PageCount; // Number of pages. +} PERFINFO_KERNELMEMORY_RANGE_USAGE, *PPERFINFO_KERNELMEMORY_RANGE_USAGE; + +#define PERFINFO_MM_STAT_TYPE_BITS 6 + +typedef enum _PERFINFO_MM_STAT +{ + PerfInfoMMStatNotUsed, + PerfInfoMMStatAggregatePageCombine, + PerfInfoMMStatIterationPageCombine, + PerfInfoMMStatMax +} PERFINFO_MM_STAT, *PPERFINFO_MM_STAT; + +C_ASSERT(PerfInfoMMStatMax <= (1 << PERFINFO_MM_STAT_TYPE_BITS)); + +// +// This is logged as part of the end rundown. +// PerfTrack traces can be mined for this low-overhead information logged with +// MemInfo classic. +// + +typedef struct _PERFINFO_PAGECOMBINE_AGGREGATE_STAT +{ + ULONG StatType : PERFINFO_MM_STAT_TYPE_BITS; // Value one of PERFINFO_MM_STATS + ULONG Spare: (NTWMI_BITSIZE (ULONG) - PERFINFO_MM_STAT_TYPE_BITS); + + // + // The following provide average stats for a scan. + // + + ULONG CombineScanCount; + ULONGLONG PagesScanned; + ULONGLONG PagesCombined; + + // + // These help compute the memory saved. + // + + LONG CombinedBlocksInUse; // Count of CombinedPTEs in use. + LONG SumCombinedBlocksReferenceCount; // Sum of the referencecounts of combined PTEs. +} PERFINFO_PAGECOMBINE_AGGREGATE_STAT, *PPERFINFO_PAGECOMBINE_AGGREGATE_STAT; + +// +// This is logged subsequent to each combine scan. Logged with MemInfo classic. +// + +typedef struct _PERFINFO_PAGECOMBINE_ITERATION_STAT +{ + ULONG StatType : PERFINFO_MM_STAT_TYPE_BITS; // Value of type PERFINFO_MM_STATS + ULONG Spare : (NTWMI_BITSIZE (ULONG) - PERFINFO_MM_STAT_TYPE_BITS); + + ULONG PagesScanned; + ULONG PagesCombined; +} PERFINFO_PAGECOMBINE_ITERATION_STAT, *PPERFINFO_PAGECOMBINE_ITERATION_STAT; + +// +// NOTE: Hard Fault event starts with InitialTime (LARGE_INTEGER) +// not shown in the structure. +// + +typedef struct _PERFINFO_HARDPAGEFAULT_INFORMATION +{ + LARGE_INTEGER ReadOffset; + PVOID VirtualAddress; + PVOID FileObject; + ULONG ThreadId; + ULONG ByteCount; +} PERFINFO_HARDPAGEFAULT_INFORMATION, *PPERFINFO_HARDPAGEFAULT_INFORMATION; + +// +// The first four fields of this data structure mirror PROCESS_VIRTUAL_ALLOC_INFO. +// + +typedef struct _PERFINFO_VIRTUAL_ALLOC +{ + PVOID CapturedBase; + SIZE_T CapturedRegionSize; + ULONG ProcessId; + ULONG Flags; +} PERFINFO_VIRTUAL_ALLOC, *PPERFINFO_VIRTUAL_ALLOC; + +typedef struct _PERFINFO_VAD_ROTATE_INFO +{ + PVOID BaseAddress; + SIZE_T SizeInBytes; + union + { + struct + { + ULONG Direction : 4; + ULONG Spare : (NTWMI_BITSIZE (ULONG) - 4); + }; + ULONG Flags; + }; +} PERFINFO_VAD_ROTATE_INFO, *PPERFINFO_VAD_ROTATE_INFO; + +typedef enum _PERFINFO_MEM_RESET_INFO_TYPE +{ + PerfInfoMemReset, + PerfInfoMemResetUndo, + PerfInfoMemResetUndoFailed, + PerfInfoMemResetMax +} PERFINFO_MEM_RESET_INFO_TYPE, *PPERFINFO_MEM_RESET_INFO_TYPE; + +typedef struct _PERFINFO_MEM_RESET_INFO +{ + PVOID BaseAddress; + SIZE_T SizeInBytes; + union + { + struct + { + ULONG TypeInfo : 2; + ULONG Spare : (NTWMI_BITSIZE (ULONG) - 2); + }; + ULONG Flags; + }; +} PERFINFO_MEM_RESET_INFO, *PPERFINFO_MEM_RESET_INFO; + +// +// Cache manager +// + +#define PERFINFO_CC_WORKQUEUE_FAST_TEARDOWN 0x000000001 +#define PERFINFO_CC_WORKQUEUE_EXPRESS 0x000000002 +#define PERFINFO_CC_WORKQUEUE_REGULAR 0x000000003 +#define PERFINFO_CC_WORKQUEUE_POST_TICK 0x000000004 +#define PERFINFO_CC_WORKQUEUE_ASYNC_READ 0x000000005 +#define PERFINFO_CC_WORKQUEUE_COMP_ASYNC_READ 0x000000006 + +typedef struct _PERFINFO_CC_WORKITEM_ENQUEUE +{ + ULONG_PTR WorkItemKey; + ULONG_PTR FileObjectKey; + UCHAR QueueType; + UCHAR WorkItemType; + BOOLEAN Requeue; + UCHAR Reserved; +} PERFINFO_CC_WORKITEM_ENQUEUE, *PPERFINFO_CC_WORKITEM_ENQUEUE; + +typedef struct _PERFINFO_CC_WORKITEM_DEQUEUE +{ + ULONG_PTR WorkItemKey; +} PERFINFO_CC_WORKITEM_DEQUEUE, *PPERFINFO_CC_WORKITEM_DEQUEUE; + +typedef struct _PERFINFO_CC_WORKITEM_COMPLETE +{ + ULONG_PTR WorkItemKey; +} PERFINFO_CC_WORKITEM_COMPLETE, *PPERFINFO_CC_WORKITEM_COMPLETE; + +#define PERFINFO_CC_WORKITEM_TYPE_READAHEAD 0x000000001 +#define PERFINFO_CC_WORKITEM_TYPE_WRITEBEHIND 0x000000002 +#define PERFINFO_CC_WORKITEM_TYPE_LAZYWRITESCAN 0x000000003 +#define PERFINFO_CC_WORKITEM_TYPE_EVENT_SET 0x000000004 + +typedef struct _PERFINFO_CC_READ_AHEAD +{ + ULONG_PTR WorkItemKey; + ULONGLONG FileOffset; + ULONG Size; + ULONG PagePriority; + ULONG DetectedPattern; + ULONG Reserved; +} PERFINFO_CC_READ_AHEAD_COMPLETE, *PPERFINFO_CC_READ_AHEAD_COMPLETE; + +typedef struct _PERFINFO_CC_SCHEDULE_READ_AHEAD +{ + ULONG_PTR WorkItemKey; + ULONG_PTR FileObjectKey; + ULONGLONG FileOffset; //app read offset + ULONG Length; //app read length + + ULONG ReadAheadUnit; + ULONG ReadAheadLength; + ULONGLONG ReadAheadOffset; + ULONGLONG ReadAheadBeyondLastByte; //high water mark + UCHAR ReadPattern; + ULONG SequentialReadCount; + ULONG SharedCacheMapFlags; + ULONG ReadAheadSettingsChanged : 1; + ULONG ReadAheadActive : 1; +} PERFINFO_CC_SCHEDULE_READ_AHEAD, *PPERFINFO_CC_SCHEDULE_READ_AHEAD; + +typedef struct _PERFINFO_CC_LAZY_WRITE_SCAN +{ + ULONG_PTR WorkItemKey; + ULONG ReasonForFlush; + ULONG PagesToWrite; + SIZE_T TotalDirtyPages; + SIZE_T AvailablePages; + SIZE_T DirtyPageThreshold; + SIZE_T NumberOfMappedVacbs; + SIZE_T TopDirtyPageThreshold; + SIZE_T BottomDirtyPageThreshold; + SIZE_T AverageAvailablePages; + SIZE_T AverageDirtyPages; + SIZE_T ConsecutiveWorklessLazywriteScans; +} PERFINFO_CC_LAZY_WRITE_SCAN, *PPERFINFO_CC_LAZY_WRITE_SCAN; + +typedef struct _PERFINFO_CC_CAN_WRITE_FAIL +{ + ULONG_PTR FileObjectKey; + SIZE_T TotalDirtyPages; + SIZE_T DirtyPageThreshold; + ULONG BytesToWrite; +} PERFINFO_CC_CAN_WRITE_FAIL, *PPERFINFO_CC_CAN_WRITE_FAIL; + +typedef struct _PERFINFO_CC_FLUSH_SECTION +{ + ULONG_PTR WorkItemKey; + ULONG_PTR FileObjectKey; + ULONGLONG Offset; + ULONG Length; + ULONG MmFlushFlags; +} PERFINFO_CC_FLUSH_SECTION, *PPERFINFO_CC_FLUSH_SECTION; + +#define PERFINFO_CC_FLUSH_DATA_IS_LAZY_WRITER 0x000000001 +#define PERFINFO_CC_FLUSH_DATA_FAST_LAZY_WRITE 0x000000002 +#define PERFINFO_CC_FLUSH_DATA_FORCE_FULL_FLUSH 0x000000004 + +// +// Reason for lazy write scan +// Note: These SHOULD be the same values as Cc's corresponding +// reason codes in minkernel/ntos/inc/cache.h file. +// + +#define PERFINFO_CC_NOTIFY_LOW_MEMORY 0x000000001 +#define PERFINFO_CC_NOTIFY_POWER 0x000000002 +#define PERFINFO_CC_NOTIFY_PERIODIC_SCAN 0x000000004 +#define PERFINFO_CC_NOTIFY_WAITING_TEARDOWN 0x000000008 +#define PERFINFO_CC_NOTIFY_FLUSH_DURING_COALESCING 0x000000010 + +typedef struct _PERFINFO_CC_FLUSH_CACHE +{ + ULONG_PTR WorkItemKey; + ULONG_PTR FileObjectKey; + ULONGLONG Offset; + ULONG Length; + ULONG SharedCacheMapFlags; + ULONG Flags; + ULONG Reserved; +} PERFINFO_CC_FLUSH_CACHE, *PPERFINFO_CC_FLUSH_CACHE; + +typedef struct _PERFINFO_CC_LOGGED_STREAM_INFO +{ + ULONG_PTR FileObjectKey; + ULONG ReasonForFlush; + ULONG PagesToWrite; + SIZE_T DirtyLoggedPages; + SIZE_T DirtyLoggedPageThreshold; + LARGE_INTEGER LargestLsnForLWS; +} PERFINFO_CC_LOGGED_STREAM_INFO, *PPERFINFO_CC_LOGGED_STREAM_INFO; + +// +// Thread Action being logged +// + +#define PERFINFO_CC_EXTRA_WB_THREAD_ADD 0x000000001 +#define PERFINFO_CC_EXTRA_WB_THREAD_REMOVE 0x000000002 + +typedef struct _PERFINFO_CC_EXTRA_WB_THREAD_INFO +{ + ULONG ThreadAction; + ULONG ActiveExtraWBThreads; + SIZE_T TotalDirtyPages; + SIZE_T DirtyPageThreshold; + SIZE_T AvailablePages; +} PERFINFO_CC_EXTRA_WB_THREAD_INFO, *PPERFINFO_CC_EXTRA_WB_THREAD_INFO; + +// +// Image backed by pagefile event. +// + +typedef struct _PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO +{ + PVOID FileObject; + ULONG DeviceCharacteristics; + USHORT FileCharacteristics; + union { + USHORT Flags; + struct { + USHORT ActiveDataReference : 1; + USHORT DeviceEjectable : 1; + USHORT WritableHandles : 1; + } DUMMYSTRUCTNAME; + } Flags; +} PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO, *PPERFINFO_IMAGELOAD_IN_PAGEFILE_INFO; + +// +// System call events +// +typedef struct _PERFINFO_SYSCALL_ENTER_DATA +{ + PVOID SysCallAddr; +} PERFINFO_SYSCALL_ENTER_DATA, *PPERFINFO_SYSCALL_ENTER_DATA; + +typedef struct _PERFINFO_SYSCALL_EXIT_DATA +{ + NTSTATUS ReturnValue; +} PERFINFO_SYSCALL_EXIT_DATA, *PPERFINFO_SYSCALL_EXIT_DATA; + +// +// SetMark +// +typedef struct _PERFINFO_MARK_INFORMATION +{ + char Name[1]; +} PERFINFO_MARK_INFORMATION, *PPERFINFO_MARK_INFORMATION; + +// +// File system operations. +// +// Since these are also logged using event descriptors, it is important to +// watch padding in the structure due to alignment or specify the appropriate +// pack pragma. +// + +typedef struct _PERFINFO_FILE_CREATE +{ + ULONG_PTR Irp; + ULONG_PTR FileObject; + ULONG IssuingThreadId; + ULONG Options; + ULONG Attributes; + ULONG ShareAccess; + WCHAR OpenPath[1]; +} PERFINFO_FILE_CREATE, *PPERFINFO_FILE_CREATE; + +typedef struct _PERFINFO_FILE_INFORMATION +{ + ULONG_PTR Irp; + ULONG_PTR FileObject; + ULONG_PTR FileKey; + ULONG_PTR ExtraInformation; + ULONG IssuingThreadId; + ULONG InfoClass; +} PERFINFO_FILE_INFORMATION, *PPERFINFO_FILE_INFORMATION; + +typedef struct _PERFINFO_FILE_DIRENUM +{ + ULONG_PTR Irp; + ULONG_PTR FileObject; + ULONG_PTR FileKey; + ULONG IssuingThreadId; + ULONG Length; + ULONG InfoClass; + ULONG FileIndex; + WCHAR FileName[1]; +} PERFINFO_FILE_DIRENUM, *PPERFINFO_FILE_DIRENUM; + +typedef struct _PERFINFO_FILE_PATH_OPERATION +{ + ULONG_PTR Irp; + ULONG_PTR FileObject; + ULONG_PTR FileKey; + ULONG_PTR ExtraInformation; + ULONG IssuingThreadId; + ULONG InfoClass; + WCHAR Path[1]; +} PERFINFO_FILE_PATH_OPERATION, *PPERFINFO_FILE_PATH_OPERATION; + +#include + +#define PERFINFO_FILE_READ_WRITE_FLAG_MDL 0x1 + +typedef struct _PERFINFO_FILE_READ_WRITE +{ + ULONGLONG Offset; + ULONG_PTR Irp; + ULONG_PTR FileObject; + ULONG_PTR FileKey; + ULONG IssuingThreadId; + ULONG Size; + ULONG Flags; + ULONG ExtraFlags; +} PERFINFO_FILE_READ_WRITE, *PPERFINFO_FILE_READ_WRITE; + +typedef struct _PERFINFO_FILE_SIMPLE_OPERATION +{ + ULONG_PTR Irp; + ULONG_PTR FileObject; + ULONG_PTR FileKey; + ULONG IssuingThreadId; +} PERFINFO_FILE_SIMPLE_OPERATION, *PPERFINFO_FILE_SIMPLE_OPERATION; + +typedef struct _PERFINFO_FILE_OPERATION_END +{ + ULONG_PTR Irp; + ULONG_PTR ExtraInformation; + NTSTATUS Status; +} PERFINFO_FILE_OPERATION_END, *PPERFINFO_FILE_OPERATION_END; + +typedef struct _PERFINFO_FLT_OPERATION +{ + PVOID RoutineAddr; + PVOID FileObject; + PVOID FsContext; + PVOID IrpPtr; + PVOID CbdPtr; + LONG MajorFunction; +} PERFINFO_FLT_OPERATION, *PPERFINFO_FLT_OPERATION; + +typedef struct _PERFINFO_FLT_OPERATION_STATUS +{ + PVOID RoutineAddr; + PVOID FileObject; + PVOID FsContext; + PVOID IrpPtr; + PVOID CbdPtr; + LONG MajorFunction; + NTSTATUS Status; +} PERFINFO_FLT_OPERATION_STATUS, *PPERFINFO_FLT_OPERATION_STATUS; + +#include +// +// MemInfo event. This structure should parallel SYSTEM_MEMORY_LIST_INFORMATION. +// + +#define PERFINFO_PAGE_PRIORITY_LEVELS 8 + +typedef struct _PERFINFO_MEMORY_INFORMATION +{ + ULONG_PTR ZeroPageCount; + ULONG_PTR FreePageCount; + ULONG_PTR ModifiedPageCount; + ULONG_PTR ModifiedNoWritePageCount; + ULONG_PTR BadPageCount; + ULONG_PTR PageCountByPriority[PERFINFO_PAGE_PRIORITY_LEVELS]; + ULONG_PTR RepurposedPagesByPriority[PERFINFO_PAGE_PRIORITY_LEVELS]; + ULONG_PTR ModifiedPageCountPageFile; +} PERFINFO_MEMORY_INFORMATION, *PPERFINFO_MEMORY_INFORMATION; + +typedef struct _PERFINFO_SYSTEM_MEMORY_INFORMATION +{ + ULONG_PTR PagedPoolCommitPageCount; + ULONG_PTR NonPagedPoolPageCount; + ULONG_PTR MdlPageCount; + ULONG_PTR CommitPageCount; +} PERFINFO_SYSTEM_MEMORY_INFORMATION, *PPERFINFO_SYSTEM_MEMORY_INFORMATION; + +// +// Used for MemInfoWS/MemInfoSessionWs event. +// + +#include +typedef struct _PERFINFO_WORKINGSET_ENTRY +{ + union + { + ULONG UniqueProcessId; + ULONG SessionId; + }; + ULONG_PTR WorkingSetPageCount; + ULONG_PTR CommitPageCount; + union + { + ULONG_PTR PagedPoolPageCount; // Used for SessionWs. + ULONG_PTR VirtualSizeInPages; // Used for ProcessWs. + }; + ULONG_PTR PrivateWorkingSetPageCount; + ULONG_PTR StoreSizeInPages; + ULONG_PTR StoredPageCount; + ULONG_PTR CommitDebtInPages; + ULONG_PTR SharedCommitInPages; +} PERFINFO_WORKINGSET_ENTRY, *PPERFINFO_WORKINGSET_ENTRY; + +typedef struct _PERFINFO_WORKINGSET_INFORMATION +{ + ULONG Count; + PERFINFO_WORKINGSET_ENTRY WsEntry[1]; +} PERFINFO_WORKINGSET_INFORMATION, *PPERFINFO_WORKINGSET_INFORMATION; +#include + +// +// Contiguous page generation event. +// +typedef struct _PERFINFO_CONTIGUOUS_PAGE_GENERATE +{ + ULONGLONG ThreadId; + ULONGLONG NumberOfBytes; +} PERFINFO_CONTIGUOUS_PAGE_GENERATE, *PPERFINFO_CONTIGUOUS_PAGE_GENERATE; + +// +// Debugger (debug event) events +// +typedef enum _PERFINFO_DEBUG_EVENT_REASON +{ + PerfInfoDebugEventReceived = 1, + PerfInfoDebugEventContinued, + PerfInfoDebugEventMax +} PERFINFO_DEBUG_EVENT_REASON, *PPERFINFO_DEBUG_EVENT_REASON; + +typedef struct _PERFINFO_DEBUG_EVENT +{ + ULONG ProcessId; + ULONG ThreadId; + PERFINFO_DEBUG_EVENT_REASON Reason; +} PERFINFO_DEBUG_EVENT, *PPERFINFO_DEBUG_EVENT; + +// +// Compressed Context Swap events +// + +/* + + 1) packets of 2- 4- and 8-byte are used to store context switch event + according to the content of the event. (cf. ccswap.c) + 2) a local cache of thread ids and the base priorities are stored in each + buffer so that a short index can be used to log the thread id of the + switching-out thread. + +*/ + +// +// Number of bits allocated for the necessary fields: +// +#define PERFINFO_CCSWAP_BIT_TYPE 2 // packet type +#define PERFINFO_CCSWAP_BIT_TID 4 // size of the tid table +#define PERFINFO_CCSWAP_BIT_STATE_WR 6 // store state+wait reason +#define PERFINFO_CCSWAP_BIT_PRIORITY 5 // full priority in 'full' packet +#define PERFINFO_CCSWAP_BIT_PRI_INC 3 // priority increment in 'lite' packet + +// +// The following are the number of bits left after allocating bits for +// the necessary fields. These bits are used to store time deltas. If the +// value of a time delta is too big for a short format, the longer format +// is used. +// + +#define PERFINFO_CCSWAP_BIT_FULL_TS 30 +C_ASSERT (PERFINFO_CCSWAP_BIT_FULL_TS == (32 - PERFINFO_CCSWAP_BIT_TYPE)); + +#define PERFINFO_CCSWAP_BIT_SHORT_TS 14 +C_ASSERT(PERFINFO_CCSWAP_BIT_SHORT_TS == (16 - PERFINFO_CCSWAP_BIT_TYPE)); + +#define PERFINFO_CCSWAP_BIT_SMALL_TS 17 +C_ASSERT (PERFINFO_CCSWAP_BIT_SMALL_TS == + (32 - PERFINFO_CCSWAP_BIT_TYPE - PERFINFO_CCSWAP_BIT_TID - PERFINFO_CCSWAP_BIT_PRI_INC - PERFINFO_CCSWAP_BIT_STATE_WR)); + +#define PERFINFO_CCSWAP_BIT_WAIT_TIME 17 +C_ASSERT (PERFINFO_CCSWAP_BIT_WAIT_TIME == + (32 - PERFINFO_CCSWAP_BIT_TID - PERFINFO_CCSWAP_BIT_STATE_WR - PERFINFO_CCSWAP_BIT_PRIORITY)); + +// +// size of the tid table: +// +#define PERFINFO_CCSWAP_MAX_TID (1<UserModeGlobalLogger[Index]))->LoggerId) +#define UMGL_LOGGER_FLAGS(Index) (((PETW_UMGL_KEY)(&USER_SHARED_DATA->UserModeGlobalLogger[Index]))->Flags) +#define IS_UMGL_LOGGING_ENABLED(Index) (UMGL_LOGGER_ID(Index) != 0) +#define IS_UMGL_FLAG_ENABLED(Index, Flag) ((UMGL_LOGGER_FLAGS(Index) & Flag) != 0) + +#define IS_HEAP_LOGGING_ENABLED() (IS_UMGL_LOGGING_ENABLED(ETW_UMGL_INDEX_HEAP) && (NtCurrentPeb()->HeapTracingEnabled != FALSE)) +#define IS_HEAP_RANGE_LOGGING_ENABLED() (IS_UMGL_LOGGING_ENABLED(ETW_UMGL_INDEX_HEAPRANGE)) +#define HEAP_LOGGER_ID (UMGL_LOGGER_ID(ETW_UMGL_INDEX_HEAP)) + +#define IS_CRITSEC_LOGGING_ENABLED() (IS_UMGL_LOGGING_ENABLED(ETW_UMGL_INDEX_CRITSEC) && (NtCurrentPeb()->CritSecTracingEnabled != FALSE)) +#define CRITSEC_LOGGER_ID (UMGL_LOGGER_ID(ETW_UMGL_INDEX_CRITSEC)) +#define IS_LOADER_LOGGING_ENABLED_FLAG(Flag) (IS_UMGL_LOGGING_ENABLED(ETW_UMGL_INDEX_LDR) && ((UMGL_LOGGER_FLAGS(ETW_UMGL_INDEX_LDR) & Flag) != 0) ) +#define IS_PER_PROCESS_LOADER_LOGGING_ENABLED_FLAG(Flag) (IS_UMGL_LOGGING_ENABLED(ETW_UMGL_INDEX_LDR) && (NtCurrentPeb()->LibLoaderTracingEnabled != FALSE) && ((UMGL_LOGGER_FLAGS(ETW_UMGL_INDEX_LDR) & Flag) != 0) ) +#define IS_GLOBAL_LOADER_LOGGING_ENABLED() (IS_UMGL_LOGGING_ENABLED(ETW_UMGL_INDEX_LDR)) +#define LOADER_LOGGER_ID (UMGL_LOGGER_ID(ETW_UMGL_INDEX_LDR)) +#define HEAPRANGE_LOGGER_ID (UMGL_LOGGER_ID(ETW_UMGL_INDEX_HEAPRANGE)) +#define IS_THREAD_POOL_LOGGING_ENABLED() (IS_UMGL_LOGGING_ENABLED(ETW_UMGL_INDEX_THREAD_POOL)) +#define THREAD_POOL_LOGGER_ID (UMGL_LOGGER_ID(ETW_UMGL_INDEX_THREAD_POOL)) +#define IS_UMS_LOGGING_ENABLED() (IS_UMGL_LOGGING_ENABLED(ETW_UMGL_INDEX_UMS)) +#define UMS_LOGGER_ID (UMGL_LOGGER_ID(ETW_UMGL_INDEX_UMS)) +#define HEAPSUMMARY_LOGGER_ID (UMGL_LOGGER_ID(ETW_UMGL_INDEX_HEAPSUMMARY)) +#define IS_HEAPSUMMARY_LOGGING_ENABLED() (IS_UMGL_LOGGING_ENABLED(ETW_UMGL_INDEX_HEAPSUMMARY)) +#define WNF_LOGGER_ID (UMGL_LOGGER_ID(ETW_UMGL_INDEX_WNF)) +#define IS_WNF_LOGGING_ENABLED() (IS_UMGL_LOGGING_ENABLED(ETW_UMGL_INDEX_WNF)) +#define UMGL_THREAD_LOGGER_ID (UMGL_LOGGER_ID(ETW_UMGL_INDEX_THREAD)) +#define IS_UMGL_THREAD_LOGGING_ENABLED() (IS_UMGL_LOGGING_ENABLED(ETW_UMGL_INDEX_THREAD)) + +// +// Flags used by user mode loader logging to UMGL. +// +#define ETW_UMGL_LDR_MUI_VERBOSE_FLAG 0x0001 +#define ETW_UMGL_LDR_MUI_TEST_FLAG 0x0002 +#define ETW_UMGL_LDR_RELOCATION_FLAG 0x0004 +#define ETW_UMGL_LDR_NEW_DLL_FLAG 0x0010 +#define ETW_UMGL_LDR_TEST_FLAG 0x0020 +#define ETW_UMGL_LDR_SECURITY_FLAG 0x0040 + +// +// Constants for heap log +// +#define MEMORY_FROM_LOOKASIDE 1 //Activity from LookAside +#define MEMORY_FROM_LOWFRAG 2 //Activity from Low Frag Heap +#define MEMORY_FROM_MAINPATH 3 //Activity from Main Code Path +#define MEMORY_FROM_SLOWPATH 4 //Activity from Slow C +#define MEMORY_FROM_INVALID 5 +#define MEMORY_FROM_SEGMENT_HEAP 6 //Activity from segment heap. + +// +// Header preparation macro for UMGL +// +#define TRACE_HEADER_TYPE_SYSTEM32 1 +#define TRACE_HEADER_TYPE_SYSTEM64 2 +#define TRACE_HEADER_TYPE_COMPACT32 3 +#define TRACE_HEADER_TYPE_COMPACT64 4 +#define TRACE_HEADER_TYPE_FULL_HEADER32 10 +#define TRACE_HEADER_TYPE_INSTANCE32 11 +#define TRACE_HEADER_TYPE_TIMED 12 // Not used +#define TRACE_HEADER_TYPE_ERROR 13 // Error while logging event +#define TRACE_HEADER_TYPE_WNODE_HEADER 14 // Not used +#define TRACE_HEADER_TYPE_MESSAGE 15 +#define TRACE_HEADER_TYPE_PERFINFO32 16 +#define TRACE_HEADER_TYPE_PERFINFO64 17 +#define TRACE_HEADER_TYPE_EVENT_HEADER32 18 +#define TRACE_HEADER_TYPE_EVENT_HEADER64 19 +#define TRACE_HEADER_TYPE_FULL_HEADER64 20 +#define TRACE_HEADER_TYPE_INSTANCE64 21 + +#define EVENT_HEADER_SIZE_MASK 0x0000FFFF + +#define SYSTEM_TRACE_VERSION 2 + +#define TRACE_HEADER_FLAG 0x80000000 + +#define EVENT_HEADER_EVENT64 ((USHORT)(((TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE) >> 16) | TRACE_HEADER_TYPE_EVENT_HEADER64)) +#define EVENT_HEADER_EVENT32 ((USHORT)(((TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE) >> 16) | TRACE_HEADER_TYPE_EVENT_HEADER32)) +#define EVENT_HEADER_ERROR ((USHORT)(((TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE) >> 16) | TRACE_HEADER_TYPE_ERROR)) +#define TRACE_HEADER_FULL32 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_FULL_HEADER32 << 16)) +#define TRACE_HEADER_FULL64 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_FULL_HEADER64 << 16)) +#define TRACE_HEADER_INSTANCE32 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_INSTANCE32 << 16)) +#define TRACE_HEADER_INSTANCE64 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_INSTANCE64 << 16)) + +#ifdef _WIN64 +#define EVENT_HEADER_EVENT EVENT_HEADER_EVENT64 +#define TRACE_HEADER_FULL TRACE_HEADER_FULL64 +#define TRACE_HEADER_INSTANCE TRACE_HEADER_INSTANCE64 +#else +#define EVENT_HEADER_EVENT EVENT_HEADER_EVENT32 +#define TRACE_HEADER_FULL TRACE_HEADER_FULL32 +#define TRACE_HEADER_INSTANCE TRACE_HEADER_INSTANCE32 +#endif + +#define PREPARE_ETW_TRACE_HEADER_GUID(Header, EventStruct, EventType, EventGuid, LoggerId) \ + (Header)->Size = sizeof(EventStruct); \ + (Header)->Class.Type = (EventType); \ + RtlCopyMemory(&((Header)->Guid), (EventGuid), sizeof(*(EventGuid))); \ + +// Used with OpenTrace(), prevents conversion of TimeStamps to UTC +#define EVENT_TRACE_USE_RAWTIMESTAMP 0x00000002 +// Used with OpenTrace(), retrieves event from file as is. +#define EVENT_TRACE_GET_RAWEVENT 0x00000100 +// Used with OpenTrace() to ReadBehind a live logger session +#define EVENT_TRACE_READ_BEHIND 0x00000200 +// Used in EventCallbacks to indicate that the InstanceId field is a sequence number. +#define EVENT_TRACE_USE_SEQUENCE 0x0004 +// Kernel Event Version is used to indicate if any kernel event has changed. +#define ETW_KERNEL_EVENT_VERSION 60 + +typedef struct _ETW_KERNEL_HEADER_EXTENSION +{ + PERFINFO_GROUPMASK GroupMasks; + ULONG Version; +} ETW_KERNEL_HEADER_EXTENSION, *PETW_KERNEL_HEADER_EXTENSION; + +#define ETW_SET_MARK_WITH_FLUSH 0x00000001 + +typedef struct _ETW_SET_MARK_INFORMATION +{ + ULONG Flag; + WCHAR Mark[1]; +} ETW_SET_MARK_INFORMATION, *PETW_SET_MARK_INFORMATION; + +// +// Data Block structure for ETW notification +// +typedef enum _ETW_NOTIFICATION_TYPE +{ + EtwNotificationTypeNoReply = 1, // No data block reply + EtwNotificationTypeLegacyEnable, // Enable notification for RegisterTraceGuids + EtwNotificationTypeEnable, // Enable notification for EventRegister + EtwNotificationTypePrivateLogger, // Private logger notification for ETW + EtwNotificationTypePerflib, // PERFLIB V2 counter data request/delivery block + EtwNotificationTypeAudio, // Private notification for audio policy + EtwNotificationTypeSession, // Session related ETW notifications + EtwNotificationTypeReserved, // For internal use (test) + EtwNotificationTypeCredentialUI, // Private notification for media center elevation detection + EtwNotificationTypeInProcSession, // Private in-proc session related ETW notifications + EtwNotificationTypeMax +} ETW_NOTIFICATION_TYPE; + +#define ETW_MAX_DATA_BLOCK_BUFFER_SIZE (65536) + +typedef struct _ETW_NOTIFICATION_HEADER +{ + ETW_NOTIFICATION_TYPE NotificationType; // Notification type + ULONG NotificationSize; // Notification size in bytes + ULONG Offset; // Offset to the next notification + BOOLEAN ReplyRequested; // Reply Requested + ULONG Timeout; // Timeout in milliseconds when requesting reply + union + { + ULONG ReplyCount; // Out to sender: the number of notifications sent + ULONG NotifyeeCount; // Out to notifyee: the order during notification + }; + ULONGLONG Reserved2; + ULONG TargetPID; + ULONG SourcePID; + GUID DestinationGuid; // Destination GUID + GUID SourceGuid; // Source GUID +} ETW_NOTIFICATION_HEADER, *PETW_NOTIFICATION_HEADER; + +typedef ULONG (NTAPI *PETW_NOTIFICATION_CALLBACK)( + _In_ PETW_NOTIFICATION_HEADER NotificationHeader, + _In_ PVOID Context + ); + +typedef enum _ETW_SESSION_NOTIFICATION_TYPE +{ + EtwSessionNotificationMediaChanged = 1, + EtwSessionNotificationSessionTerminated, + EtwSessionNotificationLogfileError, + EtwSessionNotificationRealtimeError, + EtwSessionNotificationSessionStarted, + EtwSessionNotificationMax +} ETW_SESSION_NOTIFICATION_TYPE; + +typedef struct _ETW_SESSION_NOTIFICATION_PACKET +{ + ETW_NOTIFICATION_HEADER NotificationHeader; + ETW_SESSION_NOTIFICATION_TYPE Type; + NTSTATUS Status; + TRACEHANDLE TraceHandle; + ULONG Reserved[2]; +} ETW_SESSION_NOTIFICATION_PACKET, *PETW_SESSION_NOTIFICATION_PACKET; + +#if (PHNT_MODE != PHNT_MODE_KERNEL) + +#ifndef EVENT_DESCRIPTOR_DEF +#define EVENT_DESCRIPTOR_DEF +typedef struct _EVENT_DESCRIPTOR +{ + USHORT Id; + UCHAR Version; + UCHAR Channel; + UCHAR Level; + UCHAR Opcode; + USHORT Task; + ULONGLONG Keyword; +} EVENT_DESCRIPTOR, *PEVENT_DESCRIPTOR; +typedef const EVENT_DESCRIPTOR* PCEVENT_DESCRIPTOR; +#endif + +NTSYSAPI +ULONG +NTAPI +EtwSetMark( + _In_opt_ TRACEHANDLE TraceHandle, + _In_ PETW_SET_MARK_INFORMATION MarkInfo, + _In_ ULONG Size + ); + +typedef struct _EVENT_DATA_DESCRIPTOR EVENT_DATA_DESCRIPTOR, *PEVENT_DATA_DESCRIPTOR; + +NTSYSAPI +ULONG +NTAPI +EtwEventWriteFull( + _In_ REGHANDLE RegHandle, + _In_ PCEVENT_DESCRIPTOR EventDescriptor, + _In_ USHORT EventProperty, + _In_opt_ LPCGUID ActivityId, + _In_opt_ LPCGUID RelatedActivityId, + _In_ ULONG UserDataCount, + _In_reads_opt_(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData + ); + +//NTSYSAPI +//ULONG +//NTAPI +//EtwEventRegister( +// _In_ LPCGUID ProviderId, +// _In_opt_ PENABLECALLBACK EnableCallback, +// _In_opt_ PVOID CallbackContext, +// _Out_ PREGHANDLE RegHandle +// ); + +NTSYSAPI +ULONG +NTAPI +EtwEventUnregister( + _In_ REGHANDLE RegHandle + ); + +typedef enum _EVENT_INFO_CLASS EVENT_INFO_CLASS; + +NTSYSAPI +ULONG +NTAPI +EtwEventSetInformation( + _In_ REGHANDLE RegHandle, + _In_ EVENT_INFO_CLASS InformationClass, + _In_reads_bytes_(InformationLength) PVOID EventInformation, + _In_ ULONG InformationLength + ); + +NTSYSAPI +ULONG +NTAPI +EtwRegisterSecurityProvider( + VOID + ); + +NTSYSAPI +BOOLEAN +NTAPI +EtwEventProviderEnabled( + _In_ REGHANDLE RegHandle, + _In_ UCHAR Level, + _In_ ULONGLONG Keyword + ); + +NTSYSAPI +BOOLEAN +NTAPI +EtwEventEnabled( + _In_ REGHANDLE RegHandle, + _In_ PCEVENT_DESCRIPTOR EventDescriptor + ); + +NTSYSAPI +ULONG +NTAPI +EtwEventWrite( + _In_ REGHANDLE RegHandle, + _In_ PCEVENT_DESCRIPTOR EventDescriptor, + _In_ ULONG UserDataCount, + _In_reads_opt_(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData + ); + +NTSYSAPI +ULONG +NTAPI +EtwEventWriteTransfer( + _In_ REGHANDLE RegHandle, + _In_ PCEVENT_DESCRIPTOR EventDescriptor, + _In_opt_ LPCGUID ActivityId, + _In_opt_ LPCGUID RelatedActivityId, + _In_ ULONG UserDataCount, + _In_reads_opt_(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData + ); + +NTSYSAPI +ULONG +NTAPI +EtwEventWriteString( + _In_ REGHANDLE RegHandle, + _In_ UCHAR Level, + _In_ ULONGLONG Keyword, + _In_ PCWSTR String + ); + +ULONG +NTAPI +EtwEventWriteEx( + _In_ REGHANDLE RegHandle, + _In_ PCEVENT_DESCRIPTOR EventDescriptor, + _In_ ULONG64 Filter, + _In_ ULONG Flags, + _In_opt_ LPCGUID ActivityId, + _In_opt_ LPCGUID RelatedActivityId, + _In_ ULONG UserDataCount, + _In_reads_opt_(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData + ); + +NTSYSAPI +ULONG +NTAPI +EtwEventWriteStartScenario( + _In_ REGHANDLE RegHandle, + _In_ PCEVENT_DESCRIPTOR EventDescriptor, + _In_ ULONG UserDataCount, + _In_reads_opt_(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData + ); + +NTSYSAPI +ULONG +NTAPI +EtwEventWriteEndScenario( + _In_ REGHANDLE RegHandle, + _In_ PCEVENT_DESCRIPTOR EventDescriptor, + _In_ ULONG UserDataCount, + _In_reads_opt_(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData + ); + +NTSYSAPI +ULONG +NTAPI +EtwWriteUMSecurityEvent( + _In_ PCEVENT_DESCRIPTOR EventDescriptor, + _In_ USHORT EventProperty, + _In_ ULONG UserDataCount, + _In_opt_ PEVENT_DATA_DESCRIPTOR UserData + ); + +ULONG +NTAPI +EtwEventWriteNoRegistration( + _In_ LPCGUID ProviderId, + _In_ PCEVENT_DESCRIPTOR EventDescriptor, + _In_ ULONG UserDataCount, + _In_reads_opt_(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData + ); + +NTSYSAPI +ULONG +NTAPI +EtwEventActivityIdControl( + _In_ ULONG ControlCode, + _Inout_ LPGUID ActivityId + ); + +NTSYSAPI +ULONG +NTAPI +EtwNotificationRegister( + _In_ LPCGUID Guid, + _In_ ULONG Type, + _In_ PETW_NOTIFICATION_CALLBACK Callback, + _In_opt_ PVOID Context, + _Out_ PREGHANDLE RegHandle + ); + +NTSYSAPI +ULONG +NTAPI +EtwNotificationUnregister( + _In_ REGHANDLE RegHandle, + _Out_opt_ PVOID * Context + ); + +NTSYSAPI +ULONG +NTAPI +EtwSendNotification( + _In_ PETW_NOTIFICATION_HEADER DataBlock, + _In_ ULONG ReceiveDataBlockSize, + _Inout_ PVOID ReceiveDataBlock, + _Out_ PULONG ReplyReceived, + _Out_ PULONG ReplySizeNeeded + ); + +NTSYSAPI +ULONG +NTAPI +EtwReplyNotification( + _In_ PETW_NOTIFICATION_HEADER Notification + ); + +NTSYSAPI +ULONG +NTAPI +EtwEnumerateProcessRegGuids( + _Out_writes_bytes_opt_(OutBufferSize) PVOID OutBuffer, + _In_ ULONG OutBufferSize, + _Out_ PULONG ReturnLength + ); + +NTSYSAPI +ULONG +NTAPI +EtwQueryRealtimeConsumer( + _In_ TRACEHANDLE TraceHandle, + _Out_ PULONG EventsLostCount, + _Out_ PULONG BuffersLostCount + ); +#endif + +// public TRACE_PROVIDER_INSTANCE_INFO +typedef struct _ETW_TRACE_PROVIDER_INSTANCE_INFO +{ + ULONG NextOffset; + ULONG EnableCount; + ULONG Pid; + ULONG Flags; +} ETW_TRACE_PROVIDER_INSTANCE_INFO, *PETW_TRACE_PROVIDER_INSTANCE_INFO; + +// public TRACE_GUID_INFO +typedef struct _ETW_TRACE_GUID_INFO +{ + ULONG InstanceCount; + ULONG Reserved; + //ETW_TRACE_PROVIDER_INSTANCE_INFO Instances[1]; +} ETW_TRACE_GUID_INFO, *PETW_TRACE_GUID_INFO; + +// rev +typedef enum _ETWTRACECONTROLCODE +{ + EtwStartLoggerCode = 1, // inout WMI_LOGGER_INFORMATION + EtwStopLoggerCode = 2, // inout WMI_LOGGER_INFORMATION + EtwQueryLoggerCode = 3, // inout WMI_LOGGER_INFORMATION + EtwUpdateLoggerCode = 4, // inout WMI_LOGGER_INFORMATION + EtwFlushLoggerCode = 5, // inout WMI_LOGGER_INFORMATION + EtwIncrementLoggerFile = 6, // inout WMI_LOGGER_INFORMATION + EtwRealtimeTransition = 7, // inout WMI_LOGGER_INFORMATION + // reserved + EtwRealtimeConnectCode = 11, + EtwActivityIdCreate = 12, + EtwWdiScenarioCode = 13, + EtwRealtimeDisconnectCode = 14, // in HANDLE + EtwRegisterGuidsCode = 15, + EtwReceiveNotification = 16, + EtwSendDataBlock = 17, // ETW_ENABLE_NOTIFICATION_PACKET // ETW_SESSION_NOTIFICATION_PACKET + EtwSendReplyDataBlock = 18, + EtwReceiveReplyDataBlock = 19, + EtwWdiSemUpdate = 20, + EtwEnumTraceGuidList = 21, // out GUID[] + EtwGetTraceGuidInfo = 22, // in GUID, out ETW_TRACE_GUID_INFO + EtwEnumerateTraceGuids = 23, + EtwRegisterSecurityProv = 24, + EtwReferenceTimeCode = 25, // in ULONG LoggerId, out ETW_REF_CLOCK + EtwTrackBinaryCode = 26, // in HANDLE + EtwAddNotificationEvent = 27, + EtwUpdateDisallowList = 28, + EtwSetEnableAllKeywordsCode = 29, + EtwSetProviderTraitsCode = 30, + EtwUseDescriptorTypeCode = 31, + EtwEnumTraceGroupList = 32, + EtwGetTraceGroupInfo = 33, + EtwGetDisallowList = 34, + EtwSetCompressionSettings = 35, + EtwGetCompressionSettings = 36, + EtwUpdatePeriodicCaptureState = 37, + EtwGetPrivateSessionTraceHandle = 38, + EtwRegisterPrivateSession = 39, + EtwQuerySessionDemuxObject = 40, + EtwSetProviderBinaryTracking = 41, + EtwMaxLoggers = 42, // out ULONG + EtwMaxPmcCounter = 43, // out ULONG + EtwQueryUsedProcessorCount = 44, // ULONG // since WIN11 + EtwGetPmcOwnership = 45, + EtwGetPmcSessions = 46, +} ETWTRACECONTROLCODE; + +#if (PHNT_VERSION >= PHNT_VISTA) +NTSYSCALLAPI +NTSTATUS +NTAPI +NtTraceControl( + _In_ ETWTRACECONTROLCODE FunctionCode, + _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, + _In_ ULONG InputBufferLength, + _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer, + _In_ ULONG OutputBufferLength, + _Out_ PULONG ReturnLength + ); +#endif + +#if (PHNT_VERSION >= PHNT_WINXP) +NTSYSCALLAPI +NTSTATUS +NTAPI +NtTraceEvent( + _In_opt_ HANDLE TraceHandle, + _In_ ULONG Flags, + _In_ ULONG FieldSize, + _In_ PVOID Fields + ); +#endif + +// private +typedef struct _TELEMETRY_COVERAGE_POINT +{ + PWSTR Name; + ULONG Hash; + ULONG LastCoveredRound; + ULONG Flags; +} TELEMETRY_COVERAGE_POINT, *PTELEMETRY_COVERAGE_POINT; + +#if (PHNT_VERSION >= PHNT_REDSTONE3) +// rev +NTSYSAPI +BOOLEAN +NTAPI +EtwCheckCoverage( + _Inout_ PTELEMETRY_COVERAGE_POINT CoveragePoint + ); +#endif + +EXTERN_C_END + +#endif diff --git a/ntwow64.h b/ntwow64.h index 63b80f1..c118bb9 100644 --- a/ntwow64.h +++ b/ntwow64.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Windows on Windows support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTWOW64_H @@ -108,6 +103,8 @@ typedef struct _LDR_DDAG_NODE32 #define LDR_DATA_TABLE_ENTRY_SIZE_WINXP_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, DdagNode) #define LDR_DATA_TABLE_ENTRY_SIZE_WIN7_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, BaseNameHashValue) #define LDR_DATA_TABLE_ENTRY_SIZE_WIN8_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, ImplicitPathOptions) +#define LDR_DATA_TABLE_ENTRY_SIZE_WIN10_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, SigningLevel) +#define LDR_DATA_TABLE_ENTRY_SIZE_WIN11_32 sizeof(LDR_DATA_TABLE_ENTRY32) typedef struct _LDR_DATA_TABLE_ENTRY32 { @@ -180,6 +177,9 @@ typedef struct _LDR_DATA_TABLE_ENTRY32 ULONG ReferenceCount; ULONG DependentLoadFlags; UCHAR SigningLevel; // since REDSTONE2 + ULONG CheckSum; // since 22H1 + WOW64_POINTER(PVOID) ActivePatchImageBase; + LDR_HOT_PATCH_STATE HotPatchState; } LDR_DATA_TABLE_ENTRY32, *PLDR_DATA_TABLE_ENTRY32; typedef struct _CURDIR32 @@ -242,8 +242,11 @@ typedef struct _RTL_USER_PROCESS_PARAMETERS32 UNICODE_STRING32 HeapPartitionName; // 19H1 WOW64_POINTER(ULONG_PTR) DefaultThreadpoolCpuSetMasks; ULONG DefaultThreadpoolCpuSetMaskCount; + ULONG DefaultThreadpoolThreadMaximum; } RTL_USER_PROCESS_PARAMETERS32, *PRTL_USER_PROCESS_PARAMETERS32; +typedef struct _LEAP_SECOND_DATA *PLEAP_SECOND_DATA; + typedef struct _PEB32 { BOOLEAN InheritedAddressSpace; @@ -299,7 +302,7 @@ typedef struct _PEB32 WOW64_POINTER(PVOID) TlsBitmap; ULONG TlsBitmapBits[2]; WOW64_POINTER(PVOID) ReadOnlySharedMemoryBase; - WOW64_POINTER(PVOID) HotpatchInformation; + WOW64_POINTER(PVOID) SharedData; WOW64_POINTER(PVOID *) ReadOnlyStaticServerData; WOW64_POINTER(PVOID) AnsiCodePageData; WOW64_POINTER(PVOID) OemCodePageData; @@ -348,24 +351,35 @@ typedef struct _PEB32 UNICODE_STRING32 CSDVersion; - WOW64_POINTER(PVOID) ActivationContextData; + WOW64_POINTER(PACTIVATION_CONTEXT_DATA) ActivationContextData; WOW64_POINTER(PVOID) ProcessAssemblyStorageMap; - WOW64_POINTER(PVOID) SystemDefaultActivationContextData; + WOW64_POINTER(PACTIVATION_CONTEXT_DATA) SystemDefaultActivationContextData; WOW64_POINTER(PVOID) SystemAssemblyStorageMap; WOW64_POINTER(SIZE_T) MinimumStackCommit; - WOW64_POINTER(PVOID) SparePointers[4]; - ULONG SpareUlongs[5]; - //WOW64_POINTER(PVOID *) FlsCallback; - //LIST_ENTRY32 FlsListHead; - //WOW64_POINTER(PVOID) FlsBitmap; - //ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)]; - //ULONG FlsHighIndex; + WOW64_POINTER(PVOID) SparePointers[2]; // 19H1 (previously FlsCallback to FlsHighIndex) + WOW64_POINTER(PVOID) PatchLoaderData; + WOW64_POINTER(PVOID) ChpeV2ProcessInfo; // _CHPEV2_PROCESS_INFO + + ULONG AppModelFeatureState; + ULONG SpareUlongs[2]; + + USHORT ActiveCodePage; + USHORT OemCodePage; + USHORT UseCaseMapping; + USHORT UnusedNlsField; WOW64_POINTER(PVOID) WerRegistrationData; WOW64_POINTER(PVOID) WerShipAssertPtr; - WOW64_POINTER(PVOID) pContextData; + + union + { + WOW64_POINTER(PVOID) pContextData; // WIN7 + WOW64_POINTER(PVOID) pUnused; // WIN10 + WOW64_POINTER(PVOID) EcCodeBitMap; // WIN11 + }; + WOW64_POINTER(PVOID) pImageHeaderHash; union { @@ -387,15 +401,23 @@ typedef struct _PEB32 ULONG CloudFileDiagFlags; // REDSTONE4 CHAR PlaceholderCompatibilityMode; CHAR PlaceholderCompatibilityModeReserved[7]; + WOW64_POINTER(PLEAP_SECOND_DATA) LeapSecondData; // REDSTONE5 + union + { + ULONG LeapSecondFlags; + struct + { + ULONG SixtySecondEnabled : 1; + ULONG Reserved : 31; + }; + }; + ULONG NtGlobalFlag2; + ULONGLONG ExtendedFeatureDisableMask; // since WIN11 } PEB32, *PPEB32; -C_ASSERT(FIELD_OFFSET(PEB32, IFEOKey) == 0x024); -C_ASSERT(FIELD_OFFSET(PEB32, UnicodeCaseTableData) == 0x060); -C_ASSERT(FIELD_OFFSET(PEB32, SystemAssemblyStorageMap) == 0x204); -C_ASSERT(FIELD_OFFSET(PEB32, pImageHeaderHash) == 0x23c); -C_ASSERT(FIELD_OFFSET(PEB32, WaitOnAddressHashTable) == 0x25c); //C_ASSERT(sizeof(PEB32) == 0x460); // REDSTONE3 -C_ASSERT(sizeof(PEB32) == 0x470); +//C_ASSERT(sizeof(PEB32) == 0x470); // REDSTONE5 +C_ASSERT(sizeof(PEB32) == 0x488); // WIN11 // Note: Use PhGetProcessPeb32 instead. (dmex) //#define WOW64_GET_PEB32(peb64) ((PPEB32)PTR_ADD_OFFSET((peb64), ALIGN_UP_BY(sizeof(PEB), PAGE_SIZE))) @@ -571,11 +593,6 @@ C_ASSERT(FIELD_OFFSET(TEB32, ReservedForCrt) == 0xfe8); C_ASSERT(FIELD_OFFSET(TEB32, EffectiveContainerId) == 0xff0); C_ASSERT(sizeof(TEB32) == 0x1000); -// Get the 32-bit TEB without doing a memory reference -// modified from public SDK /10.0.10240.0/um/minwin/wow64t.h (dmex) -#define WOW64_GET_TEB32(teb64) ((PTEB32)PTR_ADD_OFFSET((teb64), ALIGN_UP_BY(sizeof(TEB), PAGE_SIZE))) -#define WOW64_TEB32_POINTER_ADDRESS(teb64) (PVOID)&((teb64)->NtTib.ExceptionList) - // Conversion FORCEINLINE VOID UStr32ToUStr( @@ -598,4 +615,168 @@ FORCEINLINE VOID UStrToUStr32( Destination->Buffer = PtrToUlong(Source->Buffer); } +// The Wow64Info structure follows the PEB32/TEB32 structures and is shared between 32-bit and 64-bit modules inside a Wow64 process. +// from SDK/10.0.10240.0/um/minwin/wow64t.h (dmex) +// +// Page size on x86 NT +// +#define PAGE_SIZE_X86NT 0x1000 +#define PAGE_SHIFT_X86NT 12L +#define WOW64_SPLITS_PER_PAGE (PAGE_SIZE_X86NT / PAGE_SIZE_X86NT) + +// +// Convert the number of native pages to sub x86-pages +// +#define Wow64GetNumberOfX86Pages(NativePages) \ + (NativePages * (PAGE_SIZE_X86NT >> PAGE_SHIFT_X86NT)) + +// +// Macro to round to the nearest page size +// +#define WOW64_ROUND_TO_PAGES(Size) \ + (((ULONG_PTR)(Size) + PAGE_SIZE_X86NT - 1) & ~(PAGE_SIZE_X86NT - 1)) + +// +// Get number of native pages +// +#define WOW64_BYTES_TO_PAGES(Size) \ + (((ULONG)(Size) >> WOW64_ROUND_TO_PAGES) + (((ULONG)(Size) & (PAGE_SIZE_X86NT - 1)) != 0)) + +// +// Get the 32-bit TEB without doing a memory reference. +// +#define WOW64_GET_TEB32(teb64) ((PTEB32)(PVOID)RtlOffsetToPointer((teb64), WOW64_ROUND_TO_PAGES(sizeof(TEB)))) +#define WOW64_TEB32_POINTER_ADDRESS(teb64) (PVOID)&((teb64)->NtTib.ExceptionList) + +typedef union _WOW64_EXECUTE_OPTIONS +{ + ULONG Flags; + struct + { + ULONG StackReserveSize : 8; + ULONG StackCommitSize : 4; + ULONG Deprecated0 : 1; + ULONG DisableWowAssert : 1; + ULONG DisableTurboDispatch : 1; + ULONG Unused : 13; + ULONG Reserved0 : 1; + ULONG Reserved1 : 1; + ULONG Reserved2 : 1; + ULONG Reserved3 : 1; + }; +} WOW64_EXECUTE_OPTIONS, *PWOW64_EXECUTE_OPTIONS; + +#define WOW64_CPUFLAGS_MSFT64 0x00000001 +#define WOW64_CPUFLAGS_SOFTWARE 0x00000002 +#define WOW64_CPUFLAGS_IA64 0x00000004 + +typedef struct _WOW64INFO +{ + ULONG NativeSystemPageSize; + ULONG CpuFlags; + WOW64_EXECUTE_OPTIONS Wow64ExecuteFlags; + ULONG InstrumentationCallback; +} WOW64INFO, *PWOW64INFO; + +typedef struct _PEB32_WITH_WOW64INFO +{ + PEB32 Peb32; + WOW64INFO Wow64Info; +} PEB32_WITH_WOW64INFO, *PPEB32_WITH_WOW64INFO; + +#if (PHNT_MODE != PHNT_MODE_KERNEL) +#ifdef _M_X64 + +FORCEINLINE +TEB32* +POINTER_UNSIGNED +Wow64CurrentGuestTeb( + VOID + ) +{ + TEB* POINTER_UNSIGNED Teb; + TEB32* POINTER_UNSIGNED Teb32; + + Teb = NtCurrentTeb(); + + if (Teb->WowTebOffset == 0) + { + // + // Not running under or over WoW, so there is no "guest teb" + // + + return NULL; + } + + if (Teb->WowTebOffset < 0) + { + // + // Was called while running under WoW. The current teb is the guest + // teb. + // + + Teb32 = (PTEB32)Teb; + + RTL_ASSERT(&Teb32->WowTebOffset == &Teb->WowTebOffset); + } + else + { + // + // Called by the WoW Host, so calculate the position of the guest teb + // relative to the current (host) teb. + // + + Teb32 = (PTEB32)RtlOffsetToPointer(Teb, Teb->WowTebOffset); + } + + RTL_ASSERT(Teb32->NtTib.Self == PtrToUlong(Teb32)); + + return Teb32; +} + +FORCEINLINE +VOID* +POINTER_UNSIGNED +Wow64CurrentNativeTeb( + VOID + ) +{ + TEB* POINTER_UNSIGNED Teb; + VOID* POINTER_UNSIGNED HostTeb; + + Teb = NtCurrentTeb(); + + if (Teb->WowTebOffset >= 0) + { + // + // Not running under WoW, so it it either not running on WoW at all, or + // it is the host. Return the current teb as native teb. + // + + HostTeb = (PVOID)Teb; + } + else + { + // + // Called while runnign under WoW Host, so calculate the position of the + // host teb relative to the current (guest) teb. + // + + HostTeb = (PVOID)RtlOffsetToPointer(Teb, Teb->WowTebOffset); + } + + RTL_ASSERT((((PTEB32)HostTeb)->NtTib.Self == PtrToUlong(HostTeb)) || ((ULONG_PTR)((PTEB)HostTeb)->NtTib.Self == (ULONG_PTR)HostTeb)); + + return HostTeb; +} + +#define NtCurrentTeb32() (Wow64CurrentGuestTeb()) +#define NtCurrentPeb32() ((PPEB32)(UlongToPtr((NtCurrentTeb32()->ProcessEnvironmentBlock)))) + +#define Wow64GetNativeTebField(teb, field) (((ULONG)(teb) == ((PTEB32)(teb))->NtTib.Self) ? (((PTEB32)(teb))->##field) : (((PTEB)(teb))->##field) ) +#define Wow64SetNativeTebField(teb, field, value) { if ((ULONG)(teb) == ((PTEB32)(teb))->NtTib.Self) {(((PTEB32)(teb))->##field) = (value);} else {(((PTEB)(teb))->##field) = (value);} } + +#endif +#endif + #endif diff --git a/ntxcapi.h b/ntxcapi.h index 73b531f..52265e2 100644 --- a/ntxcapi.h +++ b/ntxcapi.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Exception support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _NTXCAPI_H @@ -35,6 +30,26 @@ RtlRaiseException( _In_ PEXCEPTION_RECORD ExceptionRecord ); +#if (PHNT_VERSION >= PHNT_20H1) +// rev +NTSYSAPI +VOID +NTAPI +RtlRaiseExceptionForReturnAddressHijack( + VOID + ); + +// rev +NTSYSAPI +DECLSPEC_NORETURN +VOID +NTAPI +RtlRaiseNoncontinuableException( + _In_ PEXCEPTION_RECORD ExceptionRecord, + _In_ PCONTEXT ContextRecord + ); +#endif + NTSYSCALLAPI NTSTATUS NTAPI @@ -91,8 +106,8 @@ NtRaiseException( _In_ BOOLEAN FirstChance ); -__analysis_noreturn NTSYSCALLAPI +DECLSPEC_NORETURN VOID NTAPI RtlAssert( diff --git a/ntzwapi.h b/ntzwapi.h index 34d1049..949384e 100644 --- a/ntzwapi.h +++ b/ntzwapi.h @@ -1,14 +1,3 @@ -/* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ - * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. - */ - #ifndef _NTZWAPI_H #define _NTZWAPI_H @@ -328,6 +317,19 @@ ZwAllocateVirtualMemory( _In_ ULONG Protect ); +NTSYSCALLAPI +NTSTATUS +NTAPI +ZwAllocateVirtualMemoryEx( + _In_ HANDLE ProcessHandle, + _Inout_ _At_(*BaseAddress, _Readable_bytes_(*RegionSize) _Writable_bytes_(*RegionSize) _Post_readable_byte_size_(*RegionSize)) PVOID *BaseAddress, + _Inout_ PSIZE_T RegionSize, + _In_ ULONG AllocationType, + _In_ ULONG PageProtection, + _Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters, + _In_ ULONG ExtendedParameterCount + ); + NTSYSCALLAPI NTSTATUS NTAPI @@ -363,7 +365,7 @@ ZwAlpcConnectPort( _In_ ULONG Flags, _In_opt_ PSID RequiredServerSid, _Inout_updates_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ConnectionMessage, - _Inout_opt_ PULONG BufferLength, + _Inout_opt_ PSIZE_T BufferLength, _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes, _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes, _In_opt_ PLARGE_INTEGER Timeout @@ -485,7 +487,7 @@ NTAPI ZwAlpcImpersonateClientContainerOfPort( _In_ HANDLE PortHandle, _In_ PPORT_MESSAGE Message, - _In_ ULONG Flags + _Reserved_ ULONG Flags ); NTSYSCALLAPI @@ -504,7 +506,7 @@ ZwAlpcOpenSenderProcess( _Out_ PHANDLE ProcessHandle, _In_ HANDLE PortHandle, _In_ PPORT_MESSAGE PortMessage, - _In_ ULONG Flags, + _Reserved_ ULONG Flags, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes ); @@ -516,7 +518,7 @@ ZwAlpcOpenSenderThread( _Out_ PHANDLE ThreadHandle, _In_ HANDLE PortHandle, _In_ PPORT_MESSAGE PortMessage, - _In_ ULONG Flags, + _Reserved_ ULONG Flags, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes ); @@ -621,9 +623,9 @@ NTSTATUS NTAPI ZwCallEnclave( _In_ PENCLAVE_ROUTINE Routine, - _In_ PVOID Parameter, - _In_ BOOLEAN WaitForThread, - _Out_opt_ PVOID *ReturnValue + _In_ PVOID Reserved, // reserved for dispatch (RtlEnclaveCallDispatch) + _In_ ULONG Flags, // ENCLAVE_CALL_FLAG_* + _Inout_ PVOID* RoutineParamReturn // input routine parameter, output routine return value ); NTSYSCALLAPI @@ -791,7 +793,7 @@ NTSYSCALLAPI NTSTATUS NTAPI ZwCompressKey( - _In_ HANDLE Key + _In_ HANDLE KeyHandle ); NTSYSCALLAPI @@ -824,6 +826,32 @@ ZwContinueEx( _In_ PVOID ContinueArgument // PKCONTINUE_ARGUMENT and BOOLEAN are valid ); +NTSYSCALLAPI +NTSTATUS +NTAPI +ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter( + _In_ BOOLEAN ConvertAuxiliaryToPerformanceCounter, + _In_ PLARGE_INTEGER PerformanceOrAuxiliaryCounterValue, + _Out_ PLARGE_INTEGER ConvertedValue, + _Out_opt_ PLARGE_INTEGER ConversionError + ); + +NTSYSCALLAPI +NTSTATUS +NTAPI +ZwCopyFileChunk( + _In_ HANDLE SourceHandle, + _In_ HANDLE DestinationHandle, + _In_opt_ HANDLE EventHandle, + _Out_ PIO_STATUS_BLOCK IoStatusBlock, + _In_ ULONG Length, + _In_ PLARGE_INTEGER SourceOffset, + _In_ PLARGE_INTEGER DestOffset, + _In_opt_ PULONG SourceKey, + _In_opt_ PULONG DestKey, + _In_ ULONG Flags + ); + NTSYSCALLAPI NTSTATUS NTAPI @@ -930,6 +958,17 @@ ZwCreateIoCompletion( _In_opt_ ULONG Count ); +NTSYSCALLAPI +NTSTATUS +NTAPI +ZwCreateIoRing( + _Out_ PHANDLE IoRingHandle, + _In_ ULONG CreateParametersLength, + _In_ PVOID CreateParameters, + _In_ ULONG OutputParametersLength, + _Out_ PVOID OutputParameters + ); + NTSYSCALLAPI NTSTATUS NTAPI @@ -976,7 +1015,7 @@ ZwCreateKeyedEvent( _Out_ PHANDLE KeyedEventHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, - _In_ ULONG Flags + _Reserved_ ULONG Flags ); NTSYSCALLAPI @@ -1049,7 +1088,7 @@ ZwCreateNamedPipeFile( _In_ ULONG MaximumInstances, _In_ ULONG InboundQuota, _In_ ULONG OutboundQuota, - _In_opt_ PLARGE_INTEGER DefaultTimeout + _In_ PLARGE_INTEGER DefaultTimeout ); NTSYSCALLAPI @@ -1066,7 +1105,7 @@ NTSYSCALLAPI NTSTATUS NTAPI ZwCreatePartition( - _In_ HANDLE ParentPartitionHandle, + _In_opt_ HANDLE ParentPartitionHandle, _Out_ PHANDLE PartitionHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, @@ -1249,7 +1288,7 @@ ZwCreateThreadEx( _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ProcessHandle, - _In_ PVOID StartRoutine, // PUSER_THREAD_START_ROUTINE + _In_ PUSER_THREAD_START_ROUTINE StartRoutine, _In_opt_ PVOID Argument, _In_ ULONG CreateFlags, // THREAD_CREATE_FLAGS_* _In_ SIZE_T ZeroBits, @@ -1448,7 +1487,7 @@ NTSTATUS NTAPI ZwDelayExecution( _In_ BOOLEAN Alertable, - _In_opt_ PLARGE_INTEGER DelayInterval + _In_ PLARGE_INTEGER DelayInterval ); NTSYSCALLAPI @@ -1515,7 +1554,7 @@ NTSTATUS NTAPI ZwDeleteWnfStateData( _In_ PCWNF_STATE_NAME StateName, - _In_opt_ const VOID *ExplicitScope + _In_opt_ const VOID* ExplicitScope ); NTSYSCALLAPI @@ -1758,7 +1797,7 @@ ZwFlushKey( ); NTSYSCALLAPI -VOID +NTSTATUS NTAPI ZwFlushProcessWriteBuffers( VOID @@ -1771,7 +1810,7 @@ ZwFlushVirtualMemory( _In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, - _Out_ struct _IO_STATUS_BLOCK* IoStatus + _Out_ PIO_STATUS_BLOCK IoStatus ); NTSYSCALLAPI @@ -2005,7 +2044,8 @@ NTAPI ZwInitializeNlsFiles( _Out_ PVOID *BaseAddress, _Out_ PLCID DefaultLocaleId, - _Out_ PLARGE_INTEGER DefaultCasingTableSize + _Out_ PLARGE_INTEGER DefaultCasingTableSize, + _Out_opt_ PULONG CurrentNLSVersion ); NTSYSCALLAPI @@ -2101,8 +2141,8 @@ ZwLoadKey3( _In_ POBJECT_ATTRIBUTES TargetKey, _In_ POBJECT_ATTRIBUTES SourceFile, _In_ ULONG Flags, - _In_reads_(LoadEntryCount) PKEY_LOAD_ENTRY LoadEntries, - _In_ ULONG LoadEntryCount, + _In_reads_(ExtendedParameterCount) PCM_EXTENDED_PARAMETER ExtendedParameters, + _In_ ULONG ExtendedParameterCount, _In_opt_ ACCESS_MASK DesiredAccess, _Out_opt_ PHANDLE RootHandle, _Reserved_ PVOID Reserved @@ -2234,6 +2274,21 @@ ZwMapViewOfSection( _In_ ULONG Win32Protect ); +NTSYSCALLAPI +NTSTATUS +NTAPI +ZwMapViewOfSectionEx( + _In_ HANDLE SectionHandle, + _In_ HANDLE ProcessHandle, + _Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID *BaseAddress, + _Inout_opt_ PLARGE_INTEGER SectionOffset, + _Inout_ PSIZE_T ViewSize, + _In_ ULONG AllocationType, + _In_ ULONG Win32Protect, + _Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters, + _In_ ULONG ExtendedParameterCount + ); + NTSYSCALLAPI NTSTATUS NTAPI @@ -2613,7 +2668,7 @@ ZwOpenTransaction( _Out_ PHANDLE TransactionHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, - _In_opt_ LPGUID Uow, + _In_ LPGUID Uow, _In_opt_ HANDLE TmHandle ); @@ -2743,6 +2798,17 @@ ZwProtectVirtualMemory( _Out_ PULONG OldProtect ); +NTSYSCALLAPI +NTSTATUS +NTAPI +ZwPssCaptureVaSpaceBulk( + _In_ HANDLE ProcessHandle, + _In_opt_ PVOID BaseAddress, + _In_ PNTPSS_MEMORY_BULK_INFORMATION BulkInformation, + _In_ SIZE_T BulkInformationLength, + _Out_opt_ PSIZE_T ReturnLength + ); + NTSYSCALLAPI NTSTATUS NTAPI @@ -2759,6 +2825,13 @@ ZwQueryAttributesFile( _Out_ PFILE_BASIC_INFORMATION FileInformation ); +NTSYSCALLAPI +NTSTATUS +NTAPI +ZwQueryAuxiliaryCounterFrequency( + _Out_ PLARGE_INTEGER AuxiliaryCounterFrequency + ); + NTSYSCALLAPI NTSTATUS NTAPI @@ -3055,6 +3128,14 @@ ZwQueryIoCompletion( _Out_opt_ PULONG ReturnLength ); +NTSYSCALLAPI +NTSTATUS +NTAPI +ZwQueryIoRingCapabilities( + _In_ SIZE_T IoRingCapabilitiesLength, + _Out_ PVOID IoRingCapabilities + ); + NTSYSCALLAPI NTSTATUS NTAPI @@ -3137,6 +3218,13 @@ ZwQueryPerformanceCounter( _Out_opt_ PLARGE_INTEGER PerformanceFrequency ); +NTSYSCALLAPI +NTSTATUS +NTAPI +ZwQueryPortInformationProcess( + VOID + ); + NTSYSCALLAPI NTSTATUS NTAPI @@ -3221,7 +3309,7 @@ NTSTATUS NTAPI ZwQuerySystemEnvironmentValueEx( _In_ PUNICODE_STRING VariableName, - _In_ PGUID VendorGuid, + _In_ PCGUID VendorGuid, _Out_writes_bytes_opt_(*ValueLength) PVOID Value, _Inout_ PULONG ValueLength, _Out_opt_ PULONG Attributes // EFI_VARIABLE_* @@ -3317,9 +3405,9 @@ NTAPI ZwQueryWnfStateData( _In_ PCWNF_STATE_NAME StateName, _In_opt_ PCWNF_TYPE_ID TypeId, - _In_opt_ const VOID *ExplicitScope, + _In_opt_ const VOID* ExplicitScope, _Out_ PWNF_CHANGE_STAMP ChangeStamp, - _Out_writes_bytes_to_opt_(*BufferSize, *BufferSize) PVOID Buffer, + _Out_writes_bytes_opt_(*BufferSize) PVOID Buffer, _Inout_ PULONG BufferSize ); @@ -3329,7 +3417,7 @@ NTAPI ZwQueryWnfStateNameInformation( _In_ PCWNF_STATE_NAME StateName, _In_ WNF_STATE_NAME_INFORMATION NameInfoClass, - _In_opt_ const VOID *ExplicitScope, + _In_opt_ const VOID* ExplicitScope, _Out_writes_bytes_(InfoBufferSize) PVOID InfoBuffer, _In_ ULONG InfoBufferSize ); @@ -3350,7 +3438,7 @@ NTSTATUS NTAPI ZwQueueApcThreadEx( _In_ HANDLE ThreadHandle, - _In_opt_ HANDLE ReserveHandle, // NtAllocateReserveObject + _In_opt_ HANDLE ReserveHandle, // NtAllocateReserveObject // SPECIAL_USER_APC _In_ PPS_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcArgument1, _In_opt_ PVOID ApcArgument2, @@ -3452,6 +3540,18 @@ ZwReadVirtualMemory( _Out_opt_ PSIZE_T NumberOfBytesRead ); +NTSYSCALLAPI +NTSTATUS +NTAPI +ZwReadVirtualMemoryEx( + _In_ HANDLE ProcessHandle, + _In_opt_ PVOID BaseAddress, + _Out_writes_bytes_(BufferSize) PVOID Buffer, + _In_ SIZE_T BufferSize, + _Out_opt_ PSIZE_T NumberOfBytesRead, + _In_ ULONG Flags + ); + NTSYSCALLAPI NTSTATUS NTAPI @@ -3503,7 +3603,7 @@ NTSYSCALLAPI NTSTATUS NTAPI ZwReleaseKeyedEvent( - _In_ HANDLE KeyedEventHandle, + _In_opt_ HANDLE KeyedEventHandle, _In_ PVOID KeyValue, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout @@ -3932,6 +4032,16 @@ ZwSetInformationFile( _In_ FILE_INFORMATION_CLASS FileInformationClass ); +NTSYSCALLAPI +NTSTATUS +NTAPI +ZwSetInformationIoRing( + _In_ HANDLE IoRingHandle, + _In_ ULONG IoRingInformationClass, + _In_ ULONG IoRingInformationLength, + _In_ PVOID IoRingInformation + ); + NTSYSCALLAPI NTSTATUS NTAPI @@ -4039,8 +4149,8 @@ ZwSetInformationVirtualMemory( _In_ HANDLE ProcessHandle, _In_ VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass, _In_ ULONG_PTR NumberOfEntries, - _In_reads_ (NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses, - _In_reads_bytes_ (VmInformationLength) PVOID VmInformation, + _In_reads_(NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses, + _In_reads_bytes_(VmInformationLength) PVOID VmInformation, _In_ ULONG VmInformationLength ); @@ -4151,7 +4261,7 @@ NTSTATUS NTAPI ZwSetSystemEnvironmentValueEx( _In_ PUNICODE_STRING VariableName, - _In_ PGUID VendorGuid, + _In_ PCGUID VendorGuid, _In_reads_bytes_opt_(ValueLength) PVOID Value, _In_ ULONG ValueLength, // 0 = delete variable _In_ ULONG Attributes // EFI_VARIABLE_* @@ -4317,6 +4427,16 @@ ZwStopProfile( _In_ HANDLE ProfileHandle ); +NTSYSCALLAPI +NTSTATUS +NTAPI +ZwSubmitIoRing( + _In_ HANDLE IoRingHandle, + _In_ ULONG Flags, + _In_opt_ ULONG WaitOperations, + _In_opt_ PLARGE_INTEGER Timeout + ); + NTSYSCALLAPI NTSTATUS NTAPI @@ -4359,7 +4479,7 @@ NTSTATUS NTAPI ZwTerminateEnclave( _In_ PVOID BaseAddress, - _In_ BOOLEAN WaitForThread + _In_ ULONG Flags // TERMINATE_ENCLAVE_FLAG_* ); NTSYSCALLAPI @@ -4411,11 +4531,11 @@ NTSYSCALLAPI NTSTATUS NTAPI ZwTraceControl( - _In_ TRACE_CONTROL_INFORMATION_CLASS TraceInformationClass, + _In_ ETWTRACECONTROLCODE TraceControlCode, _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, - _Out_writes_bytes_opt_(TraceInformationLength) PVOID TraceInformation, - _In_ ULONG TraceInformationLength, + _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer, + _In_ ULONG OutputBufferLength, _Out_ PULONG ReturnLength ); @@ -4526,10 +4646,10 @@ NTSTATUS NTAPI ZwUpdateWnfStateData( _In_ PCWNF_STATE_NAME StateName, - _In_reads_bytes_opt_(Length) const VOID *Buffer, + _In_reads_bytes_opt_(Length) const VOID* Buffer, _In_opt_ ULONG Length, _In_opt_ PCWNF_TYPE_ID TypeId, - _In_opt_ const VOID *ExplicitScope, + _In_opt_ const VOID* ExplicitScope, _In_ WNF_CHANGE_STAMP MatchingChangeStamp, _In_ LOGICAL CheckStamp ); @@ -4564,7 +4684,7 @@ NTSYSCALLAPI NTSTATUS NTAPI ZwWaitForKeyedEvent( - _In_ HANDLE KeyedEventHandle, + _In_opt_ HANDLE KeyedEventHandle, _In_ PVOID KeyValue, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout @@ -4606,10 +4726,10 @@ NTSTATUS NTAPI ZwWaitForWorkViaWorkerFactory( _In_ HANDLE WorkerFactoryHandle, - _Out_writes_to_(Count, *PacketsReturned) struct _FILE_IO_COMPLETION_INFORMATION *MiniPackets, + _Out_writes_to_(Count, *PacketsReturned) PFILE_IO_COMPLETION_INFORMATION MiniPackets, _In_ ULONG Count, _Out_ PULONG PacketsReturned, - _In_ struct _WORKER_FACTORY_DEFERRED_WORK* DeferredWork + _In_ PWORKER_FACTORY_DEFERRED_WORK DeferredWork ); NTSYSCALLAPI diff --git a/phnt.h b/phnt.h index 05dc6ad..e07ce83 100644 --- a/phnt.h +++ b/phnt.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * NT Header annotations * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _PHNT_H @@ -54,16 +49,19 @@ #define PHNT_20H1 109 #define PHNT_20H2 110 #define PHNT_21H1 111 -#define PHNT_21H2 112 -#define PHNT_WIN11 113 -#define PHNT_WIN11_22H2 114 +#define PHNT_WIN10_21H2 112 +#define PHNT_WIN10_22H2 113 +#define PHNT_WIN11 114 +#define PHNT_WIN11_22H2 115 +#define PHNT_WIN11_23H2 116 +#define PHNT_WIN11_24H2 117 #ifndef PHNT_MODE #define PHNT_MODE PHNT_MODE_USER #endif #ifndef PHNT_VERSION -#define PHNT_VERSION PHNT_WIN7 +#define PHNT_VERSION PHNT_WIN11 #endif // Options @@ -77,9 +75,9 @@ extern "C" { #if (PHNT_MODE != PHNT_MODE_KERNEL) #include #include -#include #endif +#include #include #include @@ -98,6 +96,7 @@ extern "C" { #include #include #include +#include #endif #if (PHNT_MODE != PHNT_MODE_KERNEL) @@ -113,6 +112,7 @@ extern "C" { #include #include +#include #include diff --git a/phnt_ntdef.h b/phnt_ntdef.h index 21e236d..9166d1a 100644 --- a/phnt_ntdef.h +++ b/phnt_ntdef.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Native definition support * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _PHNT_NTDEF_H @@ -58,6 +53,8 @@ typedef CLONG *PCLONG; typedef PCSTR PCSZ; +typedef PVOID* PPVOID; + // Specific typedef UCHAR KIRQL, *PKIRQL; @@ -78,6 +75,9 @@ typedef struct _LARGE_INTEGER_128 #define NT_WARNING(Status) ((((ULONG)(Status)) >> 30) == 2) #define NT_ERROR(Status) ((((ULONG)(Status)) >> 30) == 3) +#define NT_CUSTOMER_SHIFT 29 +#define NT_CUSTOMER(Status) ((((ULONG)(Status)) >> NT_CUSTOMER_SHIFT) & 1) + #define NT_FACILITY_MASK 0xfff #define NT_FACILITY_SHIFT 16 #define NT_FACILITY(Status) ((((ULONG)(Status)) >> NT_FACILITY_SHIFT) & NT_FACILITY_MASK) @@ -134,13 +134,24 @@ typedef struct _UNICODE_STRING { USHORT Length; USHORT MaximumLength; - _Field_size_bytes_part_(MaximumLength, Length) PWCH Buffer; + _Field_size_bytes_part_opt_(MaximumLength, Length) PWCH Buffer; } UNICODE_STRING, *PUNICODE_STRING; typedef const UNICODE_STRING *PCUNICODE_STRING; #define RTL_CONSTANT_STRING(s) { sizeof(s) - sizeof((s)[0]), sizeof(s), s } +#define DECLARE_CONST_UNICODE_STRING(_var, _str) \ +const WCHAR _var ## _buffer[] = _str; \ +const UNICODE_STRING _var = { sizeof(_str) - sizeof(WCHAR), sizeof(_str), (PWCH) _var ## _buffer } + +#define DECLARE_GLOBAL_CONST_UNICODE_STRING(_var, _str) \ +extern const DECLSPEC_SELECTANY UNICODE_STRING _var = RTL_CONSTANT_STRING(_str) + +#define DECLARE_UNICODE_STRING_SIZE(_var, _size) \ +WCHAR _var ## _buffer[_size]; \ +UNICODE_STRING _var = { 0, (_size) * sizeof(WCHAR) , _var ## _buffer } + // Balanced tree node #define RTL_BALANCED_NODE_RESERVED_PARENT_MASK 3 @@ -196,19 +207,20 @@ typedef STRING64 ANSI_STRING64, *PANSI_STRING64; // Object attributes -#define OBJ_PROTECT_CLOSE 0x00000001 -#define OBJ_INHERIT 0x00000002 -#define OBJ_AUDIT_OBJECT_CLOSE 0x00000004 -#define OBJ_PERMANENT 0x00000010 -#define OBJ_EXCLUSIVE 0x00000020 -#define OBJ_CASE_INSENSITIVE 0x00000040 -#define OBJ_OPENIF 0x00000080 -#define OBJ_OPENLINK 0x00000100 -#define OBJ_KERNEL_HANDLE 0x00000200 -#define OBJ_FORCE_ACCESS_CHECK 0x00000400 -#define OBJ_IGNORE_IMPERSONATED_DEVICEMAP 0x00000800 -#define OBJ_DONT_REPARSE 0x00001000 -#define OBJ_VALID_ATTRIBUTES 0x00001ff2 +#define OBJ_PROTECT_CLOSE 0x00000001L +#define OBJ_INHERIT 0x00000002L +#define OBJ_AUDIT_OBJECT_CLOSE 0x00000004L +#define OBJ_NO_RIGHTS_UPGRADE 0x00000008L +#define OBJ_PERMANENT 0x00000010L +#define OBJ_EXCLUSIVE 0x00000020L +#define OBJ_CASE_INSENSITIVE 0x00000040L +#define OBJ_OPENIF 0x00000080L +#define OBJ_OPENLINK 0x00000100L +#define OBJ_KERNEL_HANDLE 0x00000200L +#define OBJ_FORCE_ACCESS_CHECK 0x00000400L +#define OBJ_IGNORE_IMPERSONATED_DEVICEMAP 0x00000800L +#define OBJ_DONT_REPARSE 0x00001000L +#define OBJ_VALID_ATTRIBUTES 0x00001FF2L typedef struct _OBJECT_ATTRIBUTES { @@ -325,7 +337,10 @@ typedef struct _KSYSTEM_TIME #include -// NT macros used to test, set and clear flags +#ifndef AFFINITY_MASK +#define AFFINITY_MASK(n) ((KAFFINITY)1 << (n)) +#endif + #ifndef FlagOn #define FlagOn(_F, _SF) ((_F) & (_SF)) #endif @@ -341,4 +356,10 @@ typedef struct _KSYSTEM_TIME #endif +#if defined(_WIN64) +#define POINTER_ALIGNMENT DECLSPEC_ALIGN(8) +#else +#define POINTER_ALIGNMENT +#endif + #endif diff --git a/phnt_windows.h b/phnt_windows.h index 3c57772..c1bd932 100644 --- a/phnt_windows.h +++ b/phnt_windows.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Win32 definition support * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _PHNT_WINDOWS_H @@ -24,6 +19,30 @@ #endif #endif +#ifndef NOMINMAX +#define NOMINMAX +#endif + +#ifndef INT_ERROR +#define INT_ERROR (-1) +#endif + +#ifndef ULONG64_MAX +#define ULONG64_MAX 0xffffffffffffffffui64 +#endif + +#ifndef SIZE_T_MAX +#ifdef _WIN64 +#define SIZE_T_MAX 0xffffffffffffffffui64 +#else +#define SIZE_T_MAX 0xffffffffUL +#endif +#endif + +#ifndef ENABLE_RTL_NUMBER_OF_V2 +#define ENABLE_RTL_NUMBER_OF_V2 +#endif + #ifndef INITGUID #define INITGUID #endif @@ -89,4 +108,20 @@ typedef GUID *PGUID; TRACELOG_ACCESS_REALTIME | TRACELOG_REGISTER_GUIDS | \ STANDARD_RIGHTS_EXECUTE) +// Note: Some parts of the Windows Runtime, COM or third party hooks are returning +// S_FALSE and null pointers on errors when S_FALSE is a success code. (dmex) +#define HR_SUCCESS(hr) (((HRESULT)(hr)) == S_OK) +#define HR_FAILED(hr) (((HRESULT)(hr)) != S_OK) + +// Note: The CONTAINING_RECORD macro doesn't support UBSan and generates false positives, +// we redefine the macro with FIELD_OFFSET as a workaround until the WinSDK is fixed (dmex) +#undef CONTAINING_RECORD +#define CONTAINING_RECORD(address, type, field) \ + ((type *)((ULONG_PTR)(address) - UFIELD_OFFSET(type, field))) + +#ifndef __PCGUID_DEFINED__ +#define __PCGUID_DEFINED__ +typedef const GUID* PCGUID; +#endif + #endif diff --git a/subprocesstag.h b/subprocesstag.h index beb5406..6f2ee53 100644 --- a/subprocesstag.h +++ b/subprocesstag.h @@ -1,12 +1,7 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Subprocess tag information * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _SUBPROCESSTAG_H diff --git a/usermgr.h b/usermgr.h new file mode 100644 index 0000000..a8d4005 --- /dev/null +++ b/usermgr.h @@ -0,0 +1,223 @@ +/* + * User Manager service API definitions. + * + * This file is part of System Informer. + */ + +#ifndef _USERMGR_H +#define _USERMGR_H + +// private +typedef struct _SESSION_USER_CONTEXT +{ + ULONGLONG ContextToken; + ULONG SessionId; + ULONG Reserved; +} SESSION_USER_CONTEXT, *PSESSION_USER_CONTEXT; + +// private +typedef struct _CRED_PROV_CREDENTIAL +{ + ULONG Flags; + ULONG AuthenticationPackage; + ULONG Size; + PVOID Information; +} CRED_PROV_CREDENTIAL, *PCRED_PROV_CREDENTIAL; + +#define USERMGRAPI DECLSPEC_IMPORT + +// Contexts + +#if (PHNT_VERSION >= PHNT_THRESHOLD) + +// rev +USERMGRAPI +VOID +WINAPI +UMgrFreeSessionUsers( + _In_ _Post_invalid_ PSESSION_USER_CONTEXT SessionUsers + ); + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrEnumerateSessionUsers( + _Out_ PULONG Count, + _Outptr_ PSESSION_USER_CONTEXT *SessionUsers + ); + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrQueryUserContext( + _In_ HANDLE TokenHandle, + _Out_ PULONGLONG ContextToken + ); + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrQueryUserContextFromSid( + _In_ PWSTR SidString, + _Out_ PULONGLONG ContextToken + ); + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrQueryUserContextFromName( + _In_ PWSTR UserName, + _Out_ PULONGLONG ContextToken + ); + +#endif + +// Tokens + +#if (PHNT_VERSION >= PHNT_THRESHOLD) + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrQueryDefaultAccountToken( + _Out_ PHANDLE TokenHandle + ); + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrQuerySessionUserToken( + _In_ ULONG SessionId, + _Out_ PHANDLE TokenHandle + ); + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrQueryUserToken( + _In_ ULONGLONG Context, + _Out_ PHANDLE TokenHandle + ); + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrQueryUserTokenFromSid( + _In_ PWSTR SidString, + _Out_ PHANDLE TokenHandle + ); + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrQueryUserTokenFromName( + _In_ PWSTR UserName, + _Out_ PHANDLE TokenHandle + ); + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrGetConstrainedUserToken( + _In_opt_ HANDLE InputTokenHandle, + _In_ ULONGLONG Context, + _In_opt_ PSECURITY_CAPABILITIES Capabilities, + _Out_ _Ret_maybenull_ PHANDLE OutputTokenHandle + ); + +#endif + +#if (PHNT_VERSION >= PHNT_THRESHOLD2) + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrChangeSessionUserToken( + _In_ HANDLE TokenHandle + ); + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrGetImpersonationTokenForContext( + _In_ HANDLE InputTokenHandle, + _In_ ULONGLONG Context, + _Out_ PHANDLE OutputTokenHandle + ); + +#endif + +#if (PHNT_VERSION >= PHNT_REDSTONE) + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrGetSessionActiveShellUserToken( + _In_ ULONG SessionId, + _Out_ PHANDLE TokenHandle + ); + +#endif + +// Single-session SKU + +#if (PHNT_VERSION >= PHNT_THRESHOLD) + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrOpenProcessTokenForQuery( + _In_ ULONG ProcessId, + _Out_ PHANDLE TokenHandle + ); + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrOpenProcessHandleForAccess( + _In_ ACCESS_MASK DesiredAccess, + _In_ ULONG ProcessId, + _Out_ PHANDLE ProcessHandle + ); + +#endif + +// Credentials + +#if (PHNT_VERSION >= PHNT_THRESHOLD) + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrFreeUserCredentials( + _In_ PCRED_PROV_CREDENTIAL Credentials + ); + +// rev +USERMGRAPI +HRESULT +WINAPI +UMgrGetCachedCredentials( + _In_ PSID Sid, + _Outptr_ PCRED_PROV_CREDENTIAL *Credentials + ); + +#endif + +#endif diff --git a/winsta.h b/winsta.h index 45abc91..f009fc3 100644 --- a/winsta.h +++ b/winsta.h @@ -1,17 +1,23 @@ /* - * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/ + * Window Station Support functions * - * You can redistribute this file and/or modify it under the terms of the - * Attribution 4.0 International (CC BY 4.0) license. - * - * You must give appropriate credit, provide a link to the license, and - * indicate if changes were made. You may do so in any reasonable manner, but - * not in any way that suggests the licensor endorses you or your use. + * This file is part of System Informer. */ #ifndef _WINSTA_H #define _WINSTA_H +// Specifies the current server. +#define WINSTATION_CURRENT_SERVER ((HANDLE)NULL) +#define WINSTATION_CURRENT_SERVER_HANDLE ((HANDLE)NULL) +#define WINSTATION_CURRENT_SERVER_NAME (NULL) + +// Specifies the current session (SessionId) +#define WINSTATION_CURRENT_SESSION ((ULONG)-1) + +// Specifies any-session (SessionId) +#define WINSTATION_ANY_SESSION ((ULONG)-2) + // Access rights #define WINSTATION_QUERY 0x00000001 // WinStationQueryInformation @@ -61,7 +67,6 @@ #define CLIENTNAME_LENGTH 20 #define CLIENTADDRESS_LENGTH 30 #define IMEFILENAME_LENGTH 32 -#define DIRECTORY_LENGTH 256 #define CLIENTLICENSE_LENGTH 32 #define CLIENTMODEM_LENGTH 40 #define CLIENT_PRODUCT_ID_LENGTH 32 @@ -133,11 +138,11 @@ typedef enum _WINSTATIONINFOCLASS WinStationBeep, WinStationEncryptionOff, WinStationEncryptionPerm, - WinStationNtSecurity, + WinStationNtSecurity, // s; (open secure desktop ctrl+alt+del) WinStationUserToken, // WINSTATIONUSERTOKEN WinStationUnused1, WinStationVideoData, // WINSTATIONVIDEODATA - WinStationInitialProgram, + WinStationInitialProgram, // s; (set current process as initial program) WinStationCd, // CDCONFIG WinStationSystemTrace, WinStationVirtualData, @@ -154,9 +159,9 @@ typedef enum _WINSTATIONINFOCLASS WinStationLastReconnectType, // ULONG WinStationDisallowAutoReconnect, // BOOLEAN WinStationMprNotifyInfo, - WinStationExecSrvSystemPipe, - WinStationSmartCardAutoLogon, - WinStationIsAdminLoggedOn, + WinStationExecSrvSystemPipe, // WCHAR[48] + WinStationSmartCardAutoLogon, // BOOLEAN + WinStationIsAdminLoggedOn, // BOOLEAN WinStationReconnectedFromId, // ULONG WinStationEffectsPolicy, // ULONG WinStationType, // ULONG @@ -821,52 +826,59 @@ typedef struct _TS_COUNTER #define SERVERNAME_CURRENT ((PWSTR)NULL) // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationFreeMemory( _In_ PVOID Buffer ); // rev +NTSYSAPI HANDLE -WINAPI +NTAPI WinStationOpenServerW( _In_opt_ PWSTR ServerName ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationCloseServer( _In_ HANDLE ServerHandle ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationServerPing( _In_opt_ HANDLE ServerHandle ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationGetTermSrvCountersValue( _In_opt_ HANDLE ServerHandle, _In_ ULONG Count, _Inout_ PTS_COUNTER Counters // set counter IDs before calling ); +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationShutdownSystem( _In_opt_ HANDLE ServerHandle, _In_ ULONG ShutdownFlags // WSD_* ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationWaitSystemEvent( _In_opt_ HANDLE ServerHandle, _In_ ULONG EventMask, // WEVENT_* @@ -874,8 +886,9 @@ WinStationWaitSystemEvent( ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationRegisterConsoleNotification( _In_opt_ HANDLE ServerHandle, _In_ HWND WindowHandle, @@ -883,8 +896,9 @@ WinStationRegisterConsoleNotification( ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationUnRegisterConsoleNotification( _In_opt_ HANDLE ServerHandle, _In_ HWND WindowHandle @@ -893,16 +907,18 @@ WinStationUnRegisterConsoleNotification( // Sessions // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationEnumerateW( _In_opt_ HANDLE ServerHandle, _Out_ PSESSIONIDW *SessionIds, _Out_ PULONG Count ); +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationQueryInformationW( _In_opt_ HANDLE ServerHandle, _In_ ULONG SessionId, @@ -913,8 +929,9 @@ WinStationQueryInformationW( ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationSetInformationW( _In_opt_ HANDLE ServerHandle, _In_ ULONG SessionId, @@ -923,8 +940,9 @@ WinStationSetInformationW( _In_ ULONG WinStationInformationLength ); +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationNameFromLogonIdW( _In_opt_ HANDLE ServerHandle, _In_ ULONG SessionId, @@ -932,8 +950,19 @@ WinStationNameFromLogonIdW( ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI +LogonIdFromWinStationNameW( + _In_opt_ HANDLE ServerHandle, + _In_ PWSTR pWinStationName, + _Out_ PULONG SessionId + ); + +// rev +NTSYSAPI +BOOLEAN +NTAPI WinStationSendMessageW( _In_opt_ HANDLE ServerHandle, _In_ ULONG SessionId, @@ -947,8 +976,9 @@ WinStationSendMessageW( _In_ BOOLEAN DoNotWait ); +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationConnectW( _In_opt_ HANDLE ServerHandle, _In_ ULONG SessionId, @@ -957,8 +987,9 @@ WinStationConnectW( _In_ BOOLEAN bWait ); +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationDisconnect( _In_opt_ HANDLE ServerHandle, _In_ ULONG SessionId, @@ -966,8 +997,9 @@ WinStationDisconnect( ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationReset( _In_opt_ HANDLE ServerHandle, _In_ ULONG SessionId, @@ -975,8 +1007,9 @@ WinStationReset( ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationShadow( _In_opt_ HANDLE ServerHandle, _In_ PWSTR TargetServerName, @@ -986,8 +1019,9 @@ WinStationShadow( ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationShadowStop( _In_opt_ HANDLE ServerHandle, _In_ ULONG SessionId, @@ -997,16 +1031,18 @@ WinStationShadowStop( // Processes // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationEnumerateProcesses( _In_opt_ HANDLE ServerHandle, _Out_ PVOID *Processes ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationGetAllProcesses( _In_opt_ HANDLE ServerHandle, _In_ ULONG Level, @@ -1015,8 +1051,9 @@ WinStationGetAllProcesses( ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationFreeGAPMemory( _In_ ULONG Level, _In_ PTS_ALL_PROCESSES_INFO Processes, @@ -1024,16 +1061,18 @@ WinStationFreeGAPMemory( ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationTerminateProcess( _In_opt_ HANDLE ServerHandle, _In_ ULONG ProcessId, _In_ ULONG ExitCode ); +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationGetProcessSid( _In_opt_ HANDLE ServerHandle, _In_ ULONG ProcessId, @@ -1047,15 +1086,17 @@ WinStationGetProcessSid( #if (PHNT_VERSION >= PHNT_VISTA) // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationSwitchToServicesSession( VOID ); // rev +NTSYSAPI BOOLEAN -WINAPI +NTAPI WinStationRevertFromServicesSession( VOID ); @@ -1063,11 +1104,77 @@ WinStationRevertFromServicesSession( #endif // Misc. - +NTSYSAPI BOOLEAN -WINAPI +NTAPI _WinStationWaitForConnect( VOID ); +// rev +NTSYSAPI +HANDLE +NTAPI +WinStationVirtualOpen( + _In_opt_ HANDLE ServerHandle, + _In_ ULONG SessionId, + _In_ PCSTR Name + ); + +// rev +NTSYSAPI +HANDLE +NTAPI +WinStationVirtualOpenEx( + _In_opt_ HANDLE ServerHandle, + _In_ ULONG SessionId, + _In_ PCSTR Name, + _In_ ULONG Flags + ); + +// rev +NTSYSAPI +BOOLEAN +NTAPI +WinStationIsCurrentSessionRemoteable( + _Out_ PBOOLEAN IsRemoteable + ); + +EXTERN_C DECLSPEC_SELECTANY CONST GUID PROPERTY_TYPE_GET_MONITOR_CONFIG = { 0x865D5285, 0xF70A, 0x4ECF, { 0x8B, 0x28, 0x51, 0x2F, 0xE0, 0xAA, 0x2D, 0x53 } }; +EXTERN_C DECLSPEC_SELECTANY CONST GUID PROPERTY_TYPE_CORRELATIONID_GUID = { 0x9A363F8E, 0x1902, 0x40DA, { 0xA2, 0xCC, 0x56, 0x4F, 0x09, 0x40, 0xAD, 0xE3 } }; + +typedef struct _TS_PROPERTY_INFORMATION +{ + ULONG Length; + PVOID Buffer; +} TS_PROPERTY_INFORMATION, *PTS_PROPERTY_INFORMATION; + +// rev +NTSYSAPI +BOOLEAN +NTAPI +WinStationGetConnectionProperty( + _In_ ULONG SessionId, + _In_ PCGUID PropertyType, + _Out_ PTS_PROPERTY_INFORMATION PropertyBuffer + ); + +// rev +NTSYSAPI +BOOLEAN +NTAPI +WinStationFreePropertyValue( + _In_ PVOID PropertyBuffer + ); + +// rev +NTSYSAPI +BOOLEAN +NTAPI +WinStationIsSessionRemoteable( + _In_opt_ HANDLE ServerHandle, + _In_ ULONG SessionId, + _Out_ PBOOLEAN IsRemote + ); + #endif