admin/processhacker-phnt
1
0
Fork 0
mirror of https://github.com/processhacker/phnt synced 2026-06-08 16:49:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

sync latest

Browse Source
This commit is contained in:
Johnny Shaw
2026-03-25 18:14:46 -06:00
parent fc1f96ee97
commit 53fbbdc5b5
42 changed files with 21779 additions and 6443 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ntafd.h
+1169
View File
File diff suppressed because it is too large Load Diff
ntbcd.h
+760 -294
View File
File diff suppressed because it is too large Load Diff
ntd3dkmt.h
+107
View File
@@ -0,0 +1,107 @@
/*
* Direct3D Kernel Mode Thunk (D3DKMT)
*
* This file is part of System Informer.
*/
#ifndef _NTD3DKMT_H
#define _NTD3DKMT_H
#include <dxmini.h>
//#include <d3dkmddi.h>
#include <d3dkmthk.h>
#include <devpropdef.h>
DEFINE_DEVPROPKEY(DEVPKEY_Gpu_Luid, 0x60b193cb, 0x5276, 0x4d0f, 0x96, 0xfc, 0xf1, 0x73, 0xab, 0xad, 0x3e, 0xc6, 2); // DEVPROP_TYPE_UINT64
DEFINE_DEVPROPKEY(DEVPKEY_Gpu_PhysicalAdapterIndex, 0x60b193cb, 0x5276, 0x4d0f, 0x96, 0xfc, 0xf1, 0x73, 0xab, 0xad, 0x3e, 0xc6, 3); // DEVPROP_TYPE_UINT32
DEFINE_GUID(GUID_COMPUTE_DEVICE_ARRIVAL, 0x1024e4c9, 0x47c9, 0x48d3, 0xb4, 0xa8, 0xf9, 0xdf, 0x78, 0x52, 0x3b, 0x53);
typedef D3DKMT_HANDLE* PD3DKMT_HANDLE;
typedef struct _D3DKMT_QUERYSTATISTICS_SEGMENT_INFORMATION_V1
{
ULONG CommitLimit;
ULONG BytesCommitted;
ULONG BytesResident;
D3DKMT_QUERYSTATISTICS_MEMORY Memory;
ULONG Aperture; // boolean
ULONGLONG TotalBytesEvictedByPriority[D3DKMT_MaxAllocationPriorityClass];
ULONG64 SystemMemoryEndAddress;
struct
{
ULONG64 PreservedDuringStandby : 1;
ULONG64 PreservedDuringHibernate : 1;
ULONG64 PartiallyPreservedDuringHibernate : 1;
ULONG64 Reserved : 61;
} PowerFlags;
ULONG64 Reserved[7];
} D3DKMT_QUERYSTATISTICS_SEGMENT_INFORMATION_V1, *PD3DKMT_QUERYSTATISTICS_SEGMENT_INFORMATION_V1;
/**
* The D3DKMT_GET_PROCESS_LIST structure is used for retrieving a list of process handles using a graphics adapter.
* \remarks The caller is responsible for closing the returned process handles.
*/
// rev
typedef struct _D3DKMT_GET_PROCESS_LIST
{
LUID AdapterLuid; // [in] The locally unique identifier (LUID) for the graphics adapter.
ULONG DesiredAccess; // [in] The access rights to request for the process handles. This must be `PROCESS_QUERY_INFORMATION` (0x400).
ULONG ProcessHandleCount; // [in, out] On input, specifies the number of handles the `ProcessHandle` member can hold. On output, receives the number of handles returned.
HANDLE ProcessHandle; // [out] The first element of an array that receives the process handles.
} D3DKMT_GET_PROCESS_LIST, *PD3DKMT_GET_PROCESS_LIST;
// rev
/**
* The D3DKMTGetProcessList function retrieves a list of processes that are using a specific graphics adapter.
*
* \param[in,out] GetProcessList A pointer to a \ref D3DKMT_GET_PROCESS_LIST structure that contains the processes using the graphics adapter.
* \return NTSTATUS Successful or errant status.
*/
EXTERN_C
NTSTATUS
NTAPI
D3DKMTGetProcessList(
_Inout_ PD3DKMT_GET_PROCESS_LIST GetProcessList
);
// rev
/**
* The D3DKMT_ENUM_PROCESS_LIST structure is used for retrieving a list of process identifiers using a graphics adapter.
*/
typedef struct _D3DKMT_ENUM_PROCESS_LIST
{
LUID AdapterLuid; // [in] The locally unique identifier (LUID) for the graphics adapter.
PULONG ProcessIdBuffer; // [out] A pointer to a buffer that receives the list of process identifiers (PIDs).
SIZE_T ProcessIdCount; // [in, out] On input, specifies the number of elements the `ProcessIdBuffer` can hold. On output, receives the number of process IDs returned.
} D3DKMT_ENUM_PROCESS_LIST, *PD3DKMT_ENUM_PROCESS_LIST;
// rev
/**
* The D3DKMTEnumProcesses function provides a list of process IDs (PIDs) rather than handles that are using a specific graphics adapter,
* which can be more efficient for monitoring purposes.
*
* \param[in,out] EnumProcessList A pointer to a \ref D3DKMT_ENUM_PROCESS_LIST structure that contains the processes using the graphics adapter.
* \return NTSTATUS Successful or errant status.
*/
EXTERN_C
NTSTATUS
NTAPI
D3DKMTEnumProcesses(
_Inout_ PD3DKMT_ENUM_PROCESS_LIST EnumProcessList
);
#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1)
// rev
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDirectGraphicsCall(
_In_ ULONG InputBufferLength,
_In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
_In_ ULONG OutputBufferLength,
_Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
_Out_ PULONG ReturnLength
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_10_20H1)
#endif // _NTD3DKMT_H
ntdbg.h
+252 -2
View File
@@ -7,8 +7,13 @@
#ifndef _NTDBG_H
#define _NTDBG_H
//
// Debugging
//
/**
* Causes a user-mode breakpoint to occur.
*/
NTSYSAPI
VOID
NTAPI
@@ -16,6 +21,9 @@ DbgUserBreakPoint(
VOID
);
/**
* Causes a breakpoint to occur.
*/
NTSYSAPI
VOID
NTAPI
@@ -23,6 +31,11 @@ DbgBreakPoint(
VOID
);
/**
* Causes a breakpoint to occur with a specific status.
*
* \param Status The status code to be associated with the breakpoint.
*/
NTSYSAPI
VOID
NTAPI
@@ -38,6 +51,13 @@ DbgBreakPointWithStatus(
#define DBG_STATUS_DEBUG_CONTROL 6
#define DBG_STATUS_WORKER 7
/**
* Sends a message to the kernel debugger.
*
* \param Format A pointer to a printf-style format string.
* \param ... Arguments for the format string.
* \return ULONG The number of characters printed.
*/
NTSYSAPI
ULONG
STDAPIVCALLTYPE
@@ -46,6 +66,15 @@ DbgPrint(
...
);
/**
* Sends a message to the kernel debugger with a component ID and level.
*
* \param ComponentId The ID of the component that is sending the message.
* \param Level The importance level of the message.
* \param Format A pointer to a printf-style format string.
* \param ... Arguments for the format string.
* \return ULONG The number of characters printed.
*/
NTSYSAPI
ULONG
STDAPIVCALLTYPE
@@ -56,6 +85,15 @@ DbgPrintEx(
...
);
/**
* Sends a message to the kernel debugger with a component ID and level (va_list version).
*
* \param ComponentId The ID of the component that is sending the message.
* \param Level The importance level of the message.
* \param Format A pointer to a printf-style format string.
* \param arglist A list of arguments for the format string.
* \return ULONG The number of characters printed.
*/
NTSYSAPI
ULONG
NTAPI
@@ -66,6 +104,16 @@ vDbgPrintEx(
_In_ va_list arglist
);
/**
* Sends a message to the kernel debugger with a prefix, component ID, and level.
*
* \param Prefix A pointer to a string to be prefixed to the message.
* \param ComponentId The ID of the component that is sending the message.
* \param Level The importance level of the message.
* \param Format A pointer to a printf-style format string.
* \param arglist A list of arguments for the format string.
* \return ULONG The number of characters printed.
*/
NTSYSAPI
ULONG
NTAPI
@@ -77,6 +125,13 @@ vDbgPrintExWithPrefix(
_In_ va_list arglist
);
/**
* Sends a message to the kernel debugger and returns Control-C status.
*
* \param Format A pointer to a printf-style format string.
* \param ... Arguments for the format string.
* \return ULONG The number of characters printed.
*/
NTSYSAPI
ULONG
STDAPIVCALLTYPE
@@ -85,6 +140,13 @@ DbgPrintReturnControlC(
...
);
/**
* Queries the debug filter state for a component.
*
* \param ComponentId The ID of the component.
* \param Level The importance level.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -93,6 +155,14 @@ DbgQueryDebugFilterState(
_In_ ULONG Level
);
/**
* Sets the debug filter state for a component.
*
* \param ComponentId The ID of the component.
* \param Level The importance level.
* \param State The new state for the filter.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -102,6 +172,14 @@ DbgSetDebugFilterState(
_In_ BOOLEAN State
);
/**
* Prompts the user for input.
*
* \param Prompt A pointer to the prompt string.
* \param Response A pointer to the buffer that receives the user response.
* \param Length The length of the response buffer, in bytes.
* \return ULONG The number of characters in the response.
*/
NTSYSAPI
ULONG
NTAPI
@@ -111,20 +189,31 @@ DbgPrompt(
_In_ ULONG Length
);
//
// Definitions
//
/**
* The DBGKM_EXCEPTION structure contains exception information for a debug event.
*/
typedef struct _DBGKM_EXCEPTION
{
EXCEPTION_RECORD ExceptionRecord;
ULONG FirstChance;
} DBGKM_EXCEPTION, *PDBGKM_EXCEPTION;
/**
* The DBGKM_CREATE_THREAD structure contains information about a newly created thread.
*/
typedef struct _DBGKM_CREATE_THREAD
{
ULONG SubSystemKey;
PVOID StartAddress;
} DBGKM_CREATE_THREAD, *PDBGKM_CREATE_THREAD;
/**
* The DBGKM_CREATE_PROCESS structure contains information about a newly created process.
*/
typedef struct _DBGKM_CREATE_PROCESS
{
ULONG SubSystemKey;
@@ -135,16 +224,25 @@ typedef struct _DBGKM_CREATE_PROCESS
DBGKM_CREATE_THREAD InitialThread;
} DBGKM_CREATE_PROCESS, *PDBGKM_CREATE_PROCESS;
/**
* The DBGKM_EXIT_THREAD structure contains the exit status of a thread.
*/
typedef struct _DBGKM_EXIT_THREAD
{
NTSTATUS ExitStatus;
} DBGKM_EXIT_THREAD, *PDBGKM_EXIT_THREAD;
/**
* The DBGKM_EXIT_PROCESS structure contains the exit status of a process.
*/
typedef struct _DBGKM_EXIT_PROCESS
{
NTSTATUS ExitStatus;
} DBGKM_EXIT_PROCESS, *PDBGKM_EXIT_PROCESS;
/**
* The DBGKM_LOAD_DLL structure contains information about a loaded DLL.
*/
typedef struct _DBGKM_LOAD_DLL
{
HANDLE FileHandle;
@@ -154,11 +252,17 @@ typedef struct _DBGKM_LOAD_DLL
PVOID NamePointer;
} DBGKM_LOAD_DLL, *PDBGKM_LOAD_DLL;
/**
* The DBGKM_UNLOAD_DLL structure contains the base address of an unloaded DLL.
*/
typedef struct _DBGKM_UNLOAD_DLL
{
PVOID BaseAddress;
} DBGKM_UNLOAD_DLL, *PDBGKM_UNLOAD_DLL;
/**
* The DBG_STATE enumeration defines the state of a debug object.
*/
typedef enum _DBG_STATE
{
DbgIdle,
@@ -174,12 +278,18 @@ typedef enum _DBG_STATE
DbgUnloadDllStateChange
} DBG_STATE, *PDBG_STATE;
/**
* The DBGUI_CREATE_THREAD structure contains UI-level information about a newly created thread.
*/
typedef struct _DBGUI_CREATE_THREAD
{
HANDLE HandleToThread;
DBGKM_CREATE_THREAD NewThread;
} DBGUI_CREATE_THREAD, *PDBGUI_CREATE_THREAD;
/**
* The DBGUI_CREATE_PROCESS structure contains UI-level information about a newly created process.
*/
typedef struct _DBGUI_CREATE_PROCESS
{
HANDLE HandleToProcess;
@@ -187,6 +297,9 @@ typedef struct _DBGUI_CREATE_PROCESS
DBGKM_CREATE_PROCESS NewProcess;
} DBGUI_CREATE_PROCESS, *PDBGUI_CREATE_PROCESS;
/**
* The DBGUI_WAIT_STATE_CHANGE structure contains information about a debug state change.
*/
typedef struct _DBGUI_WAIT_STATE_CHANGE
{
DBG_STATE NewState;
@@ -213,6 +326,9 @@ typedef struct _DBGUI_WAIT_STATE_CHANGE
#define DEBUG_KILL_ON_CLOSE 0x1
/**
* The DEBUGOBJECTINFOCLASS enumeration defines the information classes for debug objects.
*/
typedef enum _DEBUGOBJECTINFOCLASS
{
DebugObjectUnusedInformation,
@@ -220,8 +336,19 @@ typedef enum _DEBUGOBJECTINFOCLASS
MaxDebugObjectInfoClass
} DEBUGOBJECTINFOCLASS, *PDEBUGOBJECTINFOCLASS;
//
// System calls
//
/**
* Creates a debug object.
*
* \param DebugObjectHandle A pointer to a variable that receives the debug object handle.
* \param DesiredAccess The access rights desired for the debug object.
* \param ObjectAttributes Optional. A pointer to an OBJECT_ATTRIBUTES structure that specifies the attributes of the debug object.
* \param Flags Flags for the debug object creation. (DEBUG_KILL_ON_CLOSE)
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -232,6 +359,13 @@ NtCreateDebugObject(
_In_ ULONG Flags
);
/**
* Attaches a debugger to an active process.
*
* \param ProcessHandle A handle to the process to be debugged.
* \param DebugObjectHandle A handle to the debug object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -240,6 +374,14 @@ NtDebugActiveProcess(
_In_ HANDLE DebugObjectHandle
);
/**
* Continues a thread that was stopped by a debug event.
*
* \param DebugObjectHandle A handle to the debug object.
* \param ClientId A pointer to a CLIENT_ID structure that identifies the thread to be continued.
* \param ContinueStatus The status code to use when continuing the thread.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -249,6 +391,13 @@ NtDebugContinue(
_In_ NTSTATUS ContinueStatus
);
/**
* Stops debugging a process.
*
* \param ProcessHandle A handle to the process.
* \param DebugObjectHandle A handle to the debug object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -257,6 +406,16 @@ NtRemoveProcessDebug(
_In_ HANDLE DebugObjectHandle
);
/**
* Sets information for a debug object.
*
* \param DebugObjectHandle A handle to the debug object.
* \param DebugObjectInformationClass The information class to be set.
* \param DebugInformation A pointer to the buffer that contains the information.
* \param DebugInformationLength The length of the information buffer, in bytes.
* \param ReturnLength Optional. A pointer to a variable that receives the number of bytes returned.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -268,6 +427,15 @@ NtSetInformationDebugObject(
_Out_opt_ PULONG ReturnLength
);
/**
* Waits for a debug event to occur.
*
* \param DebugObjectHandle A handle to the debug object.
* \param Alertable Specifies whether the wait is alertable.
* \param Timeout Optional. A pointer to a LARGE_INTEGER structure that specifies the timeout.
* \param WaitStateChange A pointer to a DBGUI_WAIT_STATE_CHANGE structure that receives information about the debug event.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -278,8 +446,15 @@ NtWaitForDebugEvent(
_Out_ PDBGUI_WAIT_STATE_CHANGE WaitStateChange
);
//
// Debugging UI
//
/**
* Connects the current thread to the debugger.
*
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -287,6 +462,11 @@ DbgUiConnectToDbg(
VOID
);
/**
* Retrieves the debug object handle for the current thread.
*
* \return HANDLE The debug object handle.
*/
NTSYSAPI
HANDLE
NTAPI
@@ -294,6 +474,11 @@ DbgUiGetThreadDebugObject(
VOID
);
/**
* Sets the debug object handle for the current thread.
*
* \param DebugObject The debug object handle.
*/
NTSYSAPI
VOID
NTAPI
@@ -301,6 +486,13 @@ DbgUiSetThreadDebugObject(
_In_ HANDLE DebugObject
);
/**
* Waits for a debug state change.
*
* \param StateChange A pointer to a DBGUI_WAIT_STATE_CHANGE structure that receives the state change information.
* \param Timeout Optional. A pointer to a LARGE_INTEGER structure that specifies the timeout.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -309,6 +501,13 @@ DbgUiWaitStateChange(
_In_opt_ PLARGE_INTEGER Timeout
);
/**
* Continues a debug state change.
*
* \param AppClientId A pointer to a CLIENT_ID structure that identifies the thread to be continued.
* \param ContinueStatus The status code to use when continuing the thread.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -317,6 +516,12 @@ DbgUiContinue(
_In_ NTSTATUS ContinueStatus
);
/**
* Stops debugging a process.
*
* \param Process A handle to the process.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -324,6 +529,12 @@ DbgUiStopDebugging(
_In_ HANDLE Process
);
/**
* Attaches a debugger to an active process.
*
* \param Process A handle to the process.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -331,6 +542,11 @@ DbgUiDebugActiveProcess(
_In_ HANDLE Process
);
/**
* Remotely triggers a breakpoint in a process.
*
* \param Context A pointer to the context for the breakpoint.
*/
NTSYSAPI
VOID
NTAPI
@@ -338,6 +554,12 @@ DbgUiRemoteBreakin(
_In_ PVOID Context
);
/**
* Issues a remote breakpoint in a process.
*
* \param Process A handle to the process.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -345,6 +567,13 @@ DbgUiIssueRemoteBreakin(
_In_ HANDLE Process
);
/**
* Converts a state change structure to a debug event structure.
*
* \param StateChange A pointer to a DBGUI_WAIT_STATE_CHANGE structure.
* \param DebugEvent A pointer to a DEBUG_EVENT structure that receives the converted information.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -353,6 +582,13 @@ DbgUiConvertStateChangeStructure(
_Out_ LPDEBUG_EVENT DebugEvent
);
/**
* Converts a state change structure to a debug event structure (extended).
*
* \param StateChange A pointer to a DBGUI_WAIT_STATE_CHANGE structure.
* \param DebugEvent A pointer to a DEBUG_EVENT structure that receives the converted information.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -363,7 +599,11 @@ DbgUiConvertStateChangeStructureEx(
typedef struct _EVENT_FILTER_DESCRIPTOR *PEVENT_FILTER_DESCRIPTOR;
typedef VOID (NTAPI *PENABLECALLBACK)(
/**
* A callback function that receives event enabled notifications.
*/
typedef _Function_class_(ENABLECALLBACK)
VOID NTAPI ENABLECALLBACK(
_In_ LPCGUID SourceId,
_In_ ULONG IsEnabled,
_In_ UCHAR Level,
@@ -372,9 +612,19 @@ typedef VOID (NTAPI *PENABLECALLBACK)(
_In_opt_ PEVENT_FILTER_DESCRIPTOR FilterData,
_Inout_opt_ PVOID CallbackContext
);
typedef ENABLECALLBACK* PENABLECALLBACK;
typedef ULONGLONG REGHANDLE, *PREGHANDLE;
/**
* Registers an ETW event provider.
*
* \param ProviderId A pointer to the provider ID.
* \param EnableCallback Optional. A pointer to the enable callback function.
* \param CallbackContext Optional. A pointer to the callback context.
* \param RegHandle A pointer to a variable that receives the registration handle.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -385,4 +635,4 @@ EtwEventRegister(
_Out_ PREGHANDLE RegHandle
);
#endif
#endif // _NTDBG_H
ntexapi.h
+3789 -1122
View File
File diff suppressed because it is too large Load Diff
ntgdi.h
+5 -1
View File
@@ -36,7 +36,9 @@
#define GDI_MAKE_HANDLE(Index, Unique) ((ULONG)(((ULONG)(Unique) << GDI_HANDLE_INDEX_BITS) | (ULONG)(Index)))
//
// GDI server-side types
//
#define GDI_DEF_TYPE 0 // invalid handle
#define GDI_DC_TYPE 1
@@ -70,7 +72,9 @@
#define GDI_DCIOBJ_TYPE 29 // unused
#define GDI_SPOOL_TYPE 30
//
// GDI client-side types
//
#define GDI_CLIENT_TYPE_FROM_HANDLE(Handle) ((ULONG)(Handle) & ((GDI_HANDLE_ALTTYPE_MASK << GDI_HANDLE_ALTTYPE_SHIFT) | \
(GDI_HANDLE_TYPE_MASK << GDI_HANDLE_TYPE_SHIFT)))
@@ -124,4 +128,4 @@ typedef struct _GDI_SHARED_MEMORY
GDI_HANDLE_ENTRY Handles[GDI_MAX_HANDLE_COUNT];
} GDI_SHARED_MEMORY, *PGDI_SHARED_MEMORY;
#endif
#endif // _NTGDI_H
ntimage.h
+109 -13
View File
@@ -7,14 +7,15 @@
#ifndef _NTIMAGE_H
#define _NTIMAGE_H
#include <pshpack4.h>
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#define IMAGE_FILE_MACHINE_CHPE_X86 0x3A64
#define IMAGE_FILE_MACHINE_ARM64EC 0xA641
#define IMAGE_FILE_MACHINE_ARM64X 0xA64E
#endif
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* The IMAGE_DEBUG_POGO_ENTRY structure represents a POGO (Profile Guided Optimization) entry.
*/
typedef struct _IMAGE_DEBUG_POGO_ENTRY
{
ULONG Rva;
@@ -22,20 +23,32 @@ typedef struct _IMAGE_DEBUG_POGO_ENTRY
CHAR Name[1];
} IMAGE_DEBUG_POGO_ENTRY, *PIMAGE_DEBUG_POGO_ENTRY;
/**
* The IMAGE_DEBUG_POGO_SIGNATURE structure represents a POGO signature.
*/
typedef struct _IMAGE_DEBUG_POGO_SIGNATURE
{
ULONG Signature;
} IMAGE_DEBUG_POGO_SIGNATURE, *PIMAGE_DEBUG_POGO_SIGNATURE;
#define IMAGE_DEBUG_POGO_SIGNATURE_LTCG 'LTCG' // coffgrp LTCG (0x4C544347)
#define IMAGE_DEBUG_POGO_SIGNATURE_PGI 'PGI\0' // coffgrp PGI (0x50474900)
#define IMAGE_DEBUG_POGO_SIGNATURE_PGO 'PGO\0' // coffgrp PGO (0x50474F00)
#define IMAGE_DEBUG_POGO_SIGNATURE_PGU 'PGU\0' // coffgrp PGU (0x50475500)
#define IMAGE_DEBUG_POGO_SIGNATURE_SPGO 'SPGO' // coffgrp SPGO (0x5350474F)
/**
* The IMAGE_RELOCATION_RECORD structure represents a relocation record.
*/
typedef struct _IMAGE_RELOCATION_RECORD
{
USHORT Offset : 12;
USHORT Type : 4;
} IMAGE_RELOCATION_RECORD, *PIMAGE_RELOCATION_RECORD;
/**
* The IMAGE_CHPE_METADATA_X86 structure represents CHPE (Compiled Hybrid Portable Executable) metadata for x86.
*/
typedef struct _IMAGE_CHPE_METADATA_X86
{
ULONG Version;
@@ -52,6 +65,9 @@ typedef struct _IMAGE_CHPE_METADATA_X86
ULONG WowA64RdtscFunctionPointer; // Present if Version >= 3
} IMAGE_CHPE_METADATA_X86, *PIMAGE_CHPE_METADATA_X86;
/**
* The IMAGE_CHPE_RANGE_ENTRY structure represents a CHPE range entry.
*/
typedef struct _IMAGE_CHPE_RANGE_ENTRY
{
union
@@ -67,6 +83,9 @@ typedef struct _IMAGE_CHPE_RANGE_ENTRY
ULONG Length;
} IMAGE_CHPE_RANGE_ENTRY, *PIMAGE_CHPE_RANGE_ENTRY;
/**
* The IMAGE_ARM64EC_METADATA structure represents ARM64EC metadata.
*/
typedef struct _IMAGE_ARM64EC_METADATA
{
ULONG Version;
@@ -97,6 +116,9 @@ typedef struct _IMAGE_ARM64EC_METADATA
#define IMAGE_ARM64EC_CODE_MAP_TYPE_AMD64 2
// rev
/**
* The IMAGE_ARM64EC_CODE_MAP_ENTRY structure represents an ARM64EC code map entry.
*/
typedef struct _IMAGE_ARM64EC_CODE_MAP_ENTRY
{
union
@@ -112,12 +134,18 @@ typedef struct _IMAGE_ARM64EC_CODE_MAP_ENTRY
ULONG Length;
} IMAGE_ARM64EC_CODE_MAP_ENTRY, *PIMAGE_ARM64EC_CODE_MAP_ENTRY;
/**
* The IMAGE_ARM64EC_REDIRECTION_ENTRY structure represents an ARM64EC redirection entry.
*/
typedef struct _IMAGE_ARM64EC_REDIRECTION_ENTRY
{
ULONG Source;
ULONG Destination;
} IMAGE_ARM64EC_REDIRECTION_ENTRY, *PIMAGE_ARM64EC_REDIRECTION_ENTRY;
/**
* The IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT structure represents an ARM64EC code range entry point.
*/
typedef struct _IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT
{
ULONG StartRva;
@@ -133,6 +161,9 @@ typedef struct _IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT
#define IMAGE_DVRT_ARM64X_FIXUP_SIZE_4BYTES 2
#define IMAGE_DVRT_ARM64X_FIXUP_SIZE_8BYTES 3
/**
* The IMAGE_DVRT_ARM64X_FIXUP_RECORD structure represents an ARM64X fixup record.
*/
typedef struct _IMAGE_DVRT_ARM64X_FIXUP_RECORD
{
USHORT Offset : 12;
@@ -141,6 +172,9 @@ typedef struct _IMAGE_DVRT_ARM64X_FIXUP_RECORD
// Value of variable Size when IMAGE_DVRT_ARM64X_FIXUP_TYPE_VALUE
} IMAGE_DVRT_ARM64X_FIXUP_RECORD, *PIMAGE_DVRT_ARM64X_FIXUP_RECORD;
/**
* The IMAGE_DVRT_ARM64X_DELTA_FIXUP_RECORD structure represents an ARM64X delta fixup record.
*/
typedef struct _IMAGE_DVRT_ARM64X_DELTA_FIXUP_RECORD
{
USHORT Offset : 12;
@@ -150,9 +184,55 @@ typedef struct _IMAGE_DVRT_ARM64X_DELTA_FIXUP_RECORD
// USHORT Value; // Delta = Value * Scale * Sign
} IMAGE_DVRT_ARM64X_DELTA_FIXUP_RECORD, *PIMAGE_DVRT_ARM64X_DELTA_FIXUP_RECORD;
#include <poppack.h>
/**
* The IMAGE_IMPORT_CONTROL_TRANSFER_ARM64_RELOCATION structure represents an ARM64 import control transfer relocation.
*
* \remarks On ARM64, optimized imported functions use this structure for import control transfer relocations.
* This is used with IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER.
*/
//typedef struct _IMAGE_IMPORT_CONTROL_TRANSFER_ARM64_RELOCATION
//{
// ULONG PageRelativeOffset : 10; ///< Offset to the call instruction shifted right by 2 (4-byte aligned instruction)
// ULONG IndirectCall : 1; ///< 0 if target instruction is a BR, 1 if BLR
// ULONG RegisterIndex : 5; ///< Register index used for the indirect call/jump
// ULONG ImportType : 1; ///< 0 if this refers to a static import, 1 for delayload import
// ULONG IATIndex : 15; ///< IAT index of the corresponding import (0x7FFF indicates no index)
//} IMAGE_IMPORT_CONTROL_TRANSFER_ARM64_RELOCATION, *PIMAGE_IMPORT_CONTROL_TRANSFER_ARM64_RELOCATION;
/**
* The IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER structure represents a prologue dynamic relocation header.
*
* \remarks This structure is followed by PrologueByteCount bytes containing the prologue code.
* Used with IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE.
*/
//#include <pshpack1.h>
//typedef struct _IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER
//{
// UCHAR PrologueByteCount;
// // UCHAR PrologueBytes[PrologueByteCount];
//} IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER, UNALIGNED *PIMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER;
//#include <poppack.h>
/**
* The IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER structure represents an epilogue dynamic relocation header.
*
* \remarks This structure is followed by variable-length branch descriptor data.
* Used with IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE.
*/
//#include <pshpack1.h>
//typedef struct _IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER
//{
// ULONG EpilogueCount;
// UCHAR EpilogueByteCount;
// UCHAR BranchDescriptorElementSize;
// USHORT BranchDescriptorCount;
// // UCHAR BranchDescriptors[...];
// // UCHAR BranchDescriptorBitMap[...];
//} IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER, UNALIGNED *PIMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER;
//#include <poppack.h>
#define IMAGE_DYNAMIC_RELOCATION_ARM64X 0x00000006
#define IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER 0x00000008
#define IMAGE_DYNAMIC_RELOCATION_MM_SHARED_USER_DATA_VA 0x7FFE0000
#define IMAGE_DYNAMIC_RELOCATION_KI_USER_SHARED_DATA64 0xFFFFF78000000000UI64
@@ -172,32 +252,48 @@ typedef IMAGE_THUNK_DATA64 UNALIGNED* UNALIGNED_PIMAGE_THUNK_DATA64;
#define IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH 0x00000005
#define IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE 0x00000007
typedef struct _IMAGE_FUNCTION_OVERRIDE_HEADER {
/**
* The IMAGE_FUNCTION_OVERRIDE_HEADER structure represents a function override header.
*/
typedef struct _IMAGE_FUNCTION_OVERRIDE_HEADER
{
ULONG FuncOverrideSize;
// IMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION FuncOverrideInfo[ANYSIZE_ARRAY]; // FuncOverrideSize bytes in size
// IMAGE_BDD_INFO BDDInfo; // BDD region, size in bytes: DVRTEntrySize - sizeof(IMAGE_FUNCTION_OVERRIDE_HEADER) - FuncOverrideSize
} IMAGE_FUNCTION_OVERRIDE_HEADER;
typedef IMAGE_FUNCTION_OVERRIDE_HEADER UNALIGNED *PIMAGE_FUNCTION_OVERRIDE_HEADER;
typedef struct _IMAGE_BDD_INFO {
/**
* The IMAGE_BDD_INFO structure represents BDD (Binary Decision Diagram) information.
*/
typedef struct _IMAGE_BDD_INFO
{
ULONG Version; // decides the semantics of serialized BDD
ULONG BDDSize;
// IMAGE_BDD_DYNAMIC_RELOCATION BDDNodes[ANYSIZE_ARRAY]; // BDDSize size in bytes.
} IMAGE_BDD_INFO, *PIMAGE_BDD_INFO;
typedef struct _IMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION {
/**
* The IMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION structure represents a function override dynamic relocation.
*/
typedef struct _IMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION
{
ULONG OriginalRva; // RVA of original function
ULONG BDDOffset; // Offset into the BDD region
ULONG RvaSize; // Size in bytes taken by RVAs. Must be multiple of sizeof(DWORD).
ULONG RvaSize; // Size in bytes taken by RVAs. Must be multiple of sizeof(ULONG).
ULONG BaseRelocSize; // Size in bytes taken by BaseRelocs
// DWORD RVAs[RvaSize / sizeof(DWORD)]; // Array containing overriding func RVAs.
// ULONG RVAs[RvaSize / sizeof(ULONG)]; // Array containing overriding func RVAs.
// IMAGE_BASE_RELOCATION BaseRelocs[ANYSIZE_ARRAY];
// ^Base relocations (RVA + Size + TO)
// ^Padded with extra TOs for 4B alignment
// ^BaseRelocSize size in bytes
} IMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION, *PIMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION;
typedef struct _IMAGE_BDD_DYNAMIC_RELOCATION {
/**
* The IMAGE_BDD_DYNAMIC_RELOCATION structure represents a BDD dynamic relocation.
*/
typedef struct _IMAGE_BDD_DYNAMIC_RELOCATION
{
USHORT Left; // Index of FALSE edge in BDD array
USHORT Right; // Index of TRUE edge in BDD array
ULONG Value; // Either FeatureNumber or Index into RVAs array
@@ -208,11 +304,11 @@ typedef struct _IMAGE_BDD_DYNAMIC_RELOCATION {
#define IMAGE_FUNCTION_OVERRIDE_X64_REL32 1 // 32-bit relative address from byte following reloc
#define IMAGE_FUNCTION_OVERRIDE_ARM64_BRANCH26 2 // 26 bit offset << 2 & sign ext. for B & BL
#define IMAGE_FUNCTION_OVERRIDE_ARM64_THUNK 3
#endif
#endif // !defined(NTDDI_WIN10_NI) || (NTDDI_VERSION < NTDDI_WIN10_NI)
#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE)
#define IMAGE_DLLCHARACTERISTICS_EX_FORWARD_CFI_COMPAT 0x40
#define IMAGE_DLLCHARACTERISTICS_EX_HOTPATCH_COMPATIBLE 0x80
#endif
#endif // !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE)
#endif
#endif // _NTIMAGE_H
ntintsafe.h
+3 -2
View File
@@ -7,6 +7,7 @@
* Copyright (c) Microsoft Corp. All rights reserved. *
* *
******************************************************************/
#ifndef _NTINTSAFE_H_INCLUDED_
#define _NTINTSAFE_H_INCLUDED_
@@ -120,7 +121,7 @@ ULONG64
UnsignedMultiply128(
_In_ ULONGLONG ullMultiplicand,
_In_ ULONGLONG ullMultiplier,
_Out_ _Deref_out_range_(==, ullMultiplicand * ullMultiplier) ULONGLONG* pullResultHigh);
_Out_ ULONGLONG* pullResultHigh); // _Deref_out_range_(==, ullMultiplicand * ullMultiplier)
#if !defined(_ARM64EC_)
#pragma intrinsic(_umul128)
@@ -6914,7 +6915,7 @@ RtlUShortAdd(
#define RtlUInt16Add RtlUShortAdd
//
// WORD addtition
// WORD addition
//
#define RtlWordAdd RtlUShortAdd
ntioapi.h
+730 -219
View File
File diff suppressed because it is too large Load Diff
ntkeapi.h
+11 -26
View File
@@ -12,7 +12,7 @@
#define LOW_REALTIME_PRIORITY 16 // Lowest realtime priority level
#define HIGH_PRIORITY 31 // Highest thread priority level
#define MAXIMUM_PRIORITY 32 // Number of thread priority levels
#endif
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
typedef enum _KTHREAD_STATE
{
@@ -61,17 +61,17 @@ typedef enum _KWAIT_REASON
WrExecutive, // Waiting for an executive event.
WrFreePage, // Waiting for a free page.
WrPageIn, // Waiting for a page to be read in.
WrPoolAllocation, // Waiting for a pool allocation.
WrPoolAllocation, // Waiting for a pool allocation. // 10
WrDelayExecution, // Waiting due to a delay execution.
WrSuspended, // Waiting because the thread is suspended.
WrUserRequest, // Waiting due to a user request.
WrEventPair, // Waiting for an event pair. // NtCreateEventPair
WrQueue, // Waiting for a queue. // NtRemoveIoCompletion
WrLpcReceive, // Waiting for an LPC receive.
WrLpcReply, // Waiting for an LPC reply.
WrLpcReceive, // Waiting for an LPC receive. // NtReplyWaitReceivePort
WrLpcReply, // Waiting for an LPC reply. // NtRequestWaitReplyPort
WrVirtualMemory, // Waiting for virtual memory.
WrPageOut, // Waiting for a page to be written out.
WrRendezvous, // Waiting for a rendezvous.
WrPageOut, // Waiting for a page to be written out. // NtFlushVirtualMemory
WrRendezvous, // Waiting for a rendezvous. // 20
WrKeyedEvent, // Waiting for a keyed event. // NtCreateKeyedEvent
WrTerminated, // Waiting for thread termination.
WrProcessInSwap, // Waiting for a process to be swapped in.
@@ -81,7 +81,7 @@ typedef enum _KWAIT_REASON
WrResource, // Waiting for a resource.
WrPushLock, // Waiting for a push lock.
WrMutex, // Waiting for a mutex.
WrQuantumEnd, // Waiting for the end of a quantum.
WrQuantumEnd, // Waiting for the end of a quantum. // 30
WrDispatchInt, // Waiting for a dispatch interrupt.
WrPreempted, // Waiting because the thread was preempted.
WrYieldExecution, // Waiting to yield execution.
@@ -91,7 +91,7 @@ typedef enum _KWAIT_REASON
WrAlertByThreadId, // Waiting for an alert by thread ID.
WrDeferredPreempt, // Waiting for a deferred preemption.
WrPhysicalFault, // Waiting for a physical fault.
WrIoRing, // Waiting for an I/O ring.
WrIoRing, // Waiting for an I/O ring. // 40
WrMdlCache, // Waiting for an MDL cache.
WrRcu, // Waiting for read-copy-update (RCU) synchronization.
MaximumWaitReason
@@ -126,7 +126,7 @@ typedef enum _KPROFILE_SOURCE
ProfileMaximum
} KPROFILE_SOURCE;
#endif
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#if (PHNT_MODE != PHNT_MODE_KERNEL)
@@ -139,21 +139,6 @@ NtCallbackReturn(
_In_ NTSTATUS Status
);
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
/**
* The NtFlushProcessWriteBuffers routine flushes the write queue of each processor that is running a thread of the current process.
*
* @return NTSTATUS Successful or errant status.
* @see https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-flushprocesswritebuffers
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtFlushProcessWriteBuffers(
VOID
);
#endif
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -178,6 +163,6 @@ NtYieldExecution(
VOID
);
#endif
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#endif
#endif // _NTKEAPI_H
ntldr.h
+742 -388
View File
File diff suppressed because it is too large Load Diff
ntlpcapi.h
+49 -25
View File
@@ -7,9 +7,17 @@
#ifndef _NTLPCAPI_H
#define _NTLPCAPI_H
//
// ALPC Object Specific Access Rights
//
#define PORT_CONNECT 0x0001
#define PORT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1)
//
// ALPC information structures
//
typedef struct _PORT_MESSAGE
{
union
@@ -70,6 +78,17 @@ typedef struct _PORT_DATA_INFORMATION
#define LPC_NO_IMPERSONATE 0x4000
#define LPC_KERNELMODE_MESSAGE 0x8000
#define ALPC_REQUEST (LPC_CONTINUATION_REQUIRED | LPC_REQUEST)
#define ALPC_REPLY (LPC_CONTINUATION_REQUIRED | LPC_REPLY)
#define ALPC_DATAGRAM (LPC_CONTINUATION_REQUIRED | LPC_DATAGRAM)
#define ALPC_LOST_REPLY (LPC_CONTINUATION_REQUIRED | LPC_LOST_REPLY)
#define ALPC_PORT_CLOSED (LPC_CONTINUATION_REQUIRED | LPC_PORT_CLOSED)
#define ALPC_CLIENT_DIED (LPC_CONTINUATION_REQUIRED | LPC_CLIENT_DIED)
#define ALPC_EXCEPTION (LPC_CONTINUATION_REQUIRED | LPC_EXCEPTION)
#define ALPC_DEBUG_EVENT (LPC_CONTINUATION_REQUIRED | LPC_DEBUG_EVENT)
#define ALPC_ERROR_EVENT (LPC_CONTINUATION_REQUIRED | LPC_ERROR_EVENT)
#define ALPC_CONNECTION_REQUEST (LPC_CONTINUATION_REQUIRED | LPC_CONNECTION_REQUEST)
#define PORT_VALID_OBJECT_ATTRIBUTES OBJ_CASE_INSENSITIVE
#ifdef _WIN64
@@ -203,7 +222,7 @@ NTSTATUS
NTAPI
NtConnectPort(
_Out_ PHANDLE PortHandle,
_In_ PUNICODE_STRING PortName,
_In_ PCUNICODE_STRING PortName,
_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
_Inout_opt_ PPORT_VIEW ClientView,
_Inout_opt_ PREMOTE_PORT_VIEW ServerView,
@@ -217,7 +236,7 @@ NTSTATUS
NTAPI
NtSecureConnectPort(
_Out_ PHANDLE PortHandle,
_In_ PUNICODE_STRING PortName,
_In_ PCUNICODE_STRING PortName,
_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
_Inout_opt_ PPORT_VIEW ClientView,
_In_opt_ PSID RequiredServerSid,
@@ -365,22 +384,25 @@ NtQueryInformationPort(
_Out_opt_ PULONG ReturnLength
);
//
// Asynchronous Local Inter-process Communication
//
// rev
typedef HANDLE ALPC_HANDLE, *PALPC_HANDLE;
#define ALPC_PORFLG_LPC_MODE 0x1000 // kernel only
#define ALPC_PORFLG_ALLOW_IMPERSONATION 0x10000
#define ALPC_PORFLG_ALLOW_LPC_REQUESTS 0x20000 // rev
#define ALPC_PORFLG_WAITABLE_PORT 0x40000 // dbg
#define ALPC_PORFLG_ALLOW_DUP_OBJECT 0x80000
#define ALPC_PORFLG_SYSTEM_PROCESS 0x100000 // dbg
#define ALPC_PORFLG_WAKE_POLICY1 0x200000
#define ALPC_PORFLG_WAKE_POLICY2 0x400000
#define ALPC_PORFLG_WAKE_POLICY3 0x800000
#define ALPC_PORFLG_DIRECT_MESSAGE 0x1000000
#define ALPC_PORFLG_ALLOW_MULTIHANDLE_ATTRIBUTE 0x2000000
#define ALPC_PORFLG_NONE 0x0
#define ALPC_PORFLG_LPC_MODE 0x1000 // kernel only
#define ALPC_PORFLG_ALLOW_IMPERSONATION 0x10000
#define ALPC_PORFLG_ALLOW_LPC_REQUESTS 0x20000 // rev
#define ALPC_PORFLG_WAITABLE_PORT 0x40000 // dbg
#define ALPC_PORFLG_ALLOW_DUP_OBJECT 0x80000
#define ALPC_PORFLG_SYSTEM_PROCESS 0x100000 // dbg
#define ALPC_PORFLG_WAKE_POLICY1 0x200000
#define ALPC_PORFLG_WAKE_POLICY2 0x400000
#define ALPC_PORFLG_WAKE_POLICY3 0x800000
#define ALPC_PORFLG_DIRECT_MESSAGE 0x1000000
#define ALPC_PORFLG_ALLOW_MULTIHANDLE_ATTRIBUTE 0x2000000
#define ALPC_PORFLG_OBJECT_TYPE_FILE 0x0001
#define ALPC_PORFLG_OBJECT_TYPE_INVALID 0x0002
@@ -424,6 +446,13 @@ typedef struct _ALPC_PORT_ATTRIBUTES
#define ALPC_MESSAGE_CONTEXT_ATTRIBUTE 0x20000000
#define ALPC_MESSAGE_VIEW_ATTRIBUTE 0x40000000
#define ALPC_MESSAGE_SECURITY_ATTRIBUTE 0x80000000
// Convenience macro for all message attributes
#define ALPC_MESSAGE_ATTRIBUTES_ALL \
(ALPC_MESSAGE_HANDLE_ATTRIBUTE | \
ALPC_MESSAGE_CONTEXT_ATTRIBUTE | \
ALPC_MESSAGE_VIEW_ATTRIBUTE | \
ALPC_MESSAGE_SECURITY_ATTRIBUTE)
// end_rev
// symbols
@@ -654,8 +683,6 @@ typedef struct _ALPC_MESSAGE_HANDLE_INFORMATION
// begin_private
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
//
// System calls
//
@@ -728,7 +755,7 @@ NtAlpcCreateResourceReserve(
_In_ HANDLE PortHandle,
_Reserved_ ULONG Flags,
_In_ SIZE_T MessageSize,
_Out_ PALPC_HANDLE ResourceId
_Out_ PULONG ResourceId
);
NTSYSCALLAPI
@@ -737,7 +764,7 @@ NTAPI
NtAlpcDeleteResourceReserve(
_In_ HANDLE PortHandle,
_Reserved_ ULONG Flags,
_In_ ALPC_HANDLE ResourceId
_In_ ULONG ResourceId
);
NTSYSCALLAPI
@@ -811,7 +838,7 @@ NTSTATUS
NTAPI
NtAlpcConnectPort(
_Out_ PHANDLE PortHandle,
_In_ PUNICODE_STRING PortName,
_In_ PCUNICODE_STRING PortName,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
_In_ ULONG Flags,
@@ -943,9 +970,10 @@ AlpcMaxAllowedMessageLength(
VOID
);
#define ALPC_ATTRFLG_ALLOCATEDATTR 0x20000000
#define ALPC_ATTRFLG_VALIDATTR 0x40000000
#define ALPC_ATTRFLG_KEEPRUNNINGATTR 0x60000000
// ALPC message attribute flags (internal state)
#define ALPC_ATTRFLG_ALLOCATEDATTR 0x20000000 // Attribute buffer was allocated
#define ALPC_ATTRFLG_VALIDATTR 0x40000000 // Attribute buffer is valid
#define ALPC_ATTRFLG_KEEPRUNNINGATTR 0x60000000 // Keep running attribute
NTSYSAPI
ULONG
@@ -990,7 +1018,6 @@ AlpcUnregisterCompletionList(
_In_ HANDLE PortHandle
);
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
// rev
NTSYSAPI
NTSTATUS
@@ -998,7 +1025,6 @@ NTAPI
AlpcRundownCompletionList(
_In_ HANDLE PortHandle
);
#endif
NTSYSAPI
NTSTATUS
@@ -1062,8 +1088,6 @@ AlpcGetCompletionListMessageAttributes(
_In_ PPORT_MESSAGE Message
);
#endif
// end_private
#endif
ntmisc.h
+582 -19
View File
@@ -7,6 +7,258 @@
#ifndef _NTMISC_H
#define _NTMISC_H
//
// Apphelp
//
_Enum_is_bitflag_
typedef enum _AHC_INFO_CLASS
{
AhcInfoClassSdbQueryResult = 0x00000001,
AhcInfoClassSdbSxsOverrideManifest = 0x00000002,
AhcInfoClassSdbRunlevelFlags = 0x00000004,
AhcInfoClassSdbFusionFlags = 0x00000008,
AhcInfoClassSdbInstallerFlags = 0x00000010,
AhcInfoClassFusionFlags = 0x00000020,
AhcInfoClassTelemetryFlags = 0x00000040,
AhcInfoClassInstallDetect = 0x00000080,
AhcInfoClassRacEventSent = 0x00000100,
AhcInfoClassIsSystemFile = 0x00000200,
AhcInfoClassMonitoringFlags = 0x00000400,
AhcInfoClassExeType = 0x00000800,
} AHC_INFO_CLASS, *PAHC_INFO_CLASS;
#define AHC_INFO_CLASS_FILTER_ON_FILETIME_CHANGE \
(AHC_INFO_CLASS)(AhcInfoClassSdbQueryResult | \
AhcInfoClassSdbSxsOverrideManifest | \
AhcInfoClassSdbRunlevelFlags | \
AhcInfoClassSdbFusionFlags | \
AhcInfoClassSdbInstallerFlags | \
AhcInfoClassFusionFlags | \
AhcInfoClassRacEventSent)
#define AHC_INFO_CLASS_FILTER_ON_SDB_CHANGE \
(AHC_INFO_CLASS)(AhcInfoClassSdbQueryResult | \
AhcInfoClassSdbSxsOverrideManifest | \
AhcInfoClassSdbRunlevelFlags | \
AhcInfoClassSdbFusionFlags | \
AhcInfoClassSdbInstallerFlags | \
AhcInfoClassInstallDetect)
#define AHC_INFO_CLASS_ALL \
(AHC_INFO_CLASS)(AhcInfoClassSdbQueryResult | \
AhcInfoClassSdbSxsOverrideManifest | \
AhcInfoClassSdbRunlevelFlags | \
AhcInfoClassSdbFusionFlags | \
AhcInfoClassSdbInstallerFlags | \
AhcInfoClassFusionFlags | \
AhcInfoClassTelemetryFlags | \
AhcInfoClassInstallDetect | \
AhcInfoClassRacEventSent | \
AhcInfoClassIsSystemFile | \
AhcInfoClassMonitoringFlags | \
AhcInfoClassExeType)
#define AHC_INFO_CLASS_INTERNALLY_COMPUTED \
(AHC_INFO_CLASS)(AhcInfoClassSdbQueryResult | \
AhcInfoClassSdbSxsOverrideManifest | \
AhcInfoClassSdbRunlevelFlags | \
AhcInfoClassSdbFusionFlags | \
AhcInfoClassSdbInstallerFlags | \
AhcInfoClassTelemetryFlags | \
AhcInfoClassIsSystemFile | \
AhcInfoClassMonitoringFlags | \
AhcInfoClassExeType)
#define AHC_INFO_CLASS_SAFE_FOR_UNPRIVILEGED_UPDATE \
(AHC_INFO_CLASS)(AhcInfoClassInstallDetect | \
AhcInfoClassRacEventSent | \
AhcInfoClassTelemetryFlags | \
AhcInfoClassMonitoringFlags)
//
// Cache structures and APIs.
//
typedef enum _AHC_SERVICE_CLASS
{
ApphelpCacheServiceLookup = 0,
ApphelpCacheServiceRemove = 1,
ApphelpCacheServiceUpdate = 2,
ApphelpCacheServiceClear = 3,
ApphelpCacheServiceSnapStatistics = 4,
ApphelpCacheServiceSnapCache = 5,
ApphelpCacheServiceLookupCdb = 6,
ApphelpCacheServiceRefreshCdb = 7,
ApphelpCacheServiceMapQuirks = 8,
ApphelpCacheServiceHwIdQuery = 9,
ApphelpCacheServiceInitProcessData = 10,
ApphelpCacheServiceLookupAndWriteToProcess = 11,
ApphelpCacheServiceMax
} AHC_SERVICE_CLASS;
typedef struct _AHC_SERVICE_LOOKUP
{
AHC_INFO_CLASS InfoClass; // Information to lookup.
UINT HintFlags; // Hint flags about cache query.
UNICODE_STRING PackageAlias; // Aliased package moniker in a packed string.
HANDLE FileHandle; // User space handle to file.
HANDLE ProcessHandle; // User space process handle.
USHORT ExeType; // Executable bitness.
USHORT Padding; // Padding to even USHORTs.
UNICODE_STRING ExeSignature; // Executable file signature.
PCZZWSTR Environment; // Environment block.
UINT EnvironmentSize; // Size of environment block in bytes.
} AHC_SERVICE_LOOKUP, *PAHC_SERVICE_LOOKUP;
typedef struct _AHC_SERVICE_REMOVE
{
AHC_INFO_CLASS InfoClass;
UNICODE_STRING PackageAlias;
HANDLE FileHandle;
UNICODE_STRING ExeSignature;
} AHC_SERVICE_REMOVE, *PAHC_SERVICE_REMOVE;
typedef struct _AHC_SERVICE_UPDATE
{
AHC_INFO_CLASS InfoClass;
UNICODE_STRING PackageAlias;
HANDLE FileHandle;
UNICODE_STRING ExeSignature;
PVOID Data;
ULONG DataSize;
} AHC_SERVICE_UPDATE, *PAHC_SERVICE_UPDATE;
typedef struct _AHC_SERVICE_CLEAR
{
AHC_INFO_CLASS InfoClass;
} AHC_SERVICE_CLEAR, *PAHC_SERVICE_CLEAR;
typedef struct _AHC_SERVICE_LOOKUP_CDB
{
UNICODE_STRING Name;
} AHC_SERVICE_LOOKUP_CDB, *PAHC_SERVICE_LOOKUP_CDB;
//
// AHC_HINT_* flags are used in the HintFlags variable.
//
#define AHC_HINT_FORCE_BYPASS 0x00000001
#define AHC_HINT_REMOVABLE_MEDIA 0x00000002
#define AHC_HINT_TEMPORARY_DIRECTORY 0x00000004
#define AHC_HINT_USER_PERM_LAYER 0x00000008
#define AHC_HINT_CREATE_PROCESS 0x00000010
#define AHC_HINT_NATIVE_EXE 0x00000020
#define SHIM_CACHE_MAIN_DATABASE_PATH32 L"\\AppPatch\\sysmain.sdb"
#define SHIM_CACHE_MAIN_DATABASE_PATH64 L"\\AppPatch\\AppPatch64\\sysmain.sdb"
//
// Flag definitions for various flag-type information in cache.
//
#define AHC_CACHE_FLAG_MONITORING_IS_CANDIDATE 0x00000001 // Candidate for monitoring.
#define AHC_CACHE_FLAG_MONITORING_IS_COMPLETE 0x00000002 // Monitoring has completed.
#define AHC_CACHE_FLAG_MONITORING_VALID_MASK (AHC_CACHE_FLAG_MONITORING_IS_CANDIDATE | \
AHC_CACHE_FLAG_MONITORING_IS_COMPLETE)
#define AHC_CACHE_FLAG_TELEMETRY_IS_CANDIDATE 0x00000001 // Candidate for telemetry.
#define AHC_CACHE_FLAG_TELEMETRY_HAS_SAMPLED 0x00000002 // Telemetry has run.
#define AHC_CACHE_FLAG_TELEMETRY_VALID_MASK (AHC_CACHE_FLAG_TELEMETRY_IS_CANDIDATE | \
AHC_CACHE_FLAG_TELEMETRY_HAS_SAMPLED)
#define AHC_CACHE_FLAG_FUSION_HASDOTLOCAL 0x00000001 // Dot local file exists.
#define AHC_CACHE_FLAG_FUSION_HASMANIFESTFILE 0x00000002 // Fusion manifest exists.
#define AHC_CACHE_FLAG_FUSION_HASMANIFESTRESOURCE 0x00000004 // Fusion manifest resource exists.
#define AHC_CACHE_FLAG_FUSION_VALID_MASK (AHC_CACHE_FLAG_FUSION_HASDOTLOCAL | \
AHC_CACHE_FLAG_FUSION_HASMANIFESTFILE | \
AHC_CACHE_FLAG_FUSION_HASMANIFESTRESOURCE)
#define AHC_CACHE_FLAG_RAC_EVENTSENT 0x00000001 // Rac event has been sent.
#define AHC_CACHE_FLAG_RAC_VALID_MASK (AHC_CACHE_FLAG_RAC_EVENTSENT)
#define AHC_CACHE_FLAG_INSTALLDETECT_CLAIMED 0x00000001 // InstallDetect claimed.
#define AHC_CACHE_FLAG_INSTALLDETECT_VALID_MASK (AHC_CACHE_FLAG_RAC_EVENTSENT)
//
// Statistics.
//
typedef struct _AHC_MAIN_STATISTICS
{
ULONG Lookup; // Count of lookup calls.
ULONG Remove; // Count of remove calls.
ULONG Update; // Count of update calls.
ULONG Clear; // Count of clear calls.
ULONG SnapStatistics; // Count of snap statistics calls.
ULONG SnapCache; // Count of snap store calls.
} AHC_MAIN_STATISTICS, *PAHC_MAIN_STATISTICS;
typedef struct _AHC_STORE_STATISTICS
{
ULONG LookupHits; // Count of lookup hits.
ULONG LookupMisses; // Count of lookup misses.
ULONG Inserted; // Count of inserted.
ULONG Replaced; // Count of replaced.
ULONG Updated; // Count of updates.
} AHC_STORE_STATISTICS, *PAHC_STORE_STATISTICS;
typedef struct _AHC_STATISTICS
{
ULONG Size; // Size of the structure.
AHC_MAIN_STATISTICS Main; // Main statistics.
AHC_STORE_STATISTICS Store; // Store statistics.
} AHC_STATISTICS, *PAHC_STATISTICS;
typedef struct _AHC_SERVICE_DATAQUERY
{
AHC_STATISTICS Stats; // Statistics.
ULONG DataSize; // Size of data.
PBYTE Data; // Data.
} AHC_SERVICE_DATAQUERY, *PAHC_SERVICE_DATAQUERY;
typedef struct _AHC_SERVICE_DATACACHE
{
HANDLE FileHandle; // User space handle to file.
USHORT ExeType; // Executable bitness.
USHORT Padding; // Padding to even USHORTs.
UINT HintFlags; // Metadata flags about cache query.
HANDLE ProcessHandle; // User space process handle.
UNICODE_STRING FileName; // Executable file name.
UNICODE_STRING Environment; // Environment block.
UNICODE_STRING PackageAlias; // Aliased package moniker in a packed string.
ULONG CustomDataSize; // Size of the custom data to cache.
PBYTE CustomData; // Pointer to the custom data.
} AHC_SERVICE_DATACACHE, *PAHC_SERVICE_DATACACHE;
typedef struct _AHC_SERVICE_HWID_QUERY
{
BOOLEAN QueryResult; // Query result
UNICODE_STRING HwId; // Query HwId; can contain wildcards
} AHC_SERVICE_HWID_QUERY, *PAHC_SERVICE_HWID_QUERY;
typedef struct _AHC_SERVICE_DATA
{
AHC_SERVICE_LOOKUP Lookup; // Lookup EXE/Package.
AHC_SERVICE_UPDATE Update; // Updating flags for a given exe/package.
AHC_SERVICE_DATACACHE Cache; // For cache operations.
AHC_SERVICE_LOOKUP_CDB LookupCdb; // Lookup cdb.
AHC_SERVICE_CLEAR Clear; // Clear flags for all exes/packages.
AHC_SERVICE_REMOVE Remove; // Remove EXE/Package.
AHC_SERVICE_HWID_QUERY HwIdQuery; // For HWID cache queries.
NTSTATUS DriverStatus; // Receive the status from the cache driver. Set error code in IoStatus block causes driver verifier violation.
PVOID ParamsOut; // Parameters out data.
ULONG ParamsOutSize; // Parameters out size.
} AHC_SERVICE_DATA, *PAHC_SERVICE_DATA;
NTSYSCALLAPI
NTSTATUS
NTAPI
NtApphelpCacheControl(
_In_ AHC_SERVICE_CLASS ServiceClass,
_Inout_opt_ PVOID ServiceContext // AHC_SERVICE_DATA
);
//
// VDM
//
@@ -70,7 +322,6 @@ typedef enum _IO_SESSION_STATE
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -79,11 +330,7 @@ NtOpenSession(
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -97,7 +344,8 @@ NtNotifyChangeSession(
_In_reads_bytes_opt_(PayloadSize) PVOID Payload,
_In_ ULONG PayloadSize
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_7)
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
//
// ApiSet
@@ -142,7 +390,7 @@ NtQuerySecurityPolicy(
_Out_writes_bytes_opt_(*ValueSize) PVOID Value,
_Inout_ PULONG ValueSize
);
#endif
#endif // (PHNT_VERSION >= PHNT_WINDOWS_10_RS1)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1)
// rev
@@ -179,7 +427,9 @@ NtAcquireCrossVmMutant(
_In_ HANDLE CrossVmMutant,
_In_ PLARGE_INTEGER Timeout
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_10_20H1)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1)
// rev
NTSYSCALLAPI
NTSTATUS
@@ -227,7 +477,20 @@ NtSetInformationCpuPartition(
_Reserved_ ULONG,
_Reserved_ ULONG
);
#endif
// rev
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationCpuPartition(
_In_ HANDLE CpuPartitionHandle,
_In_ ULONG CpuPartitionInformationClass,
_Out_writes_bytes_opt_(CpuPartitionInformationLength) PVOID CpuPartitionInformation,
_In_ ULONG CpuPartitionInformationLength,
_Out_opt_ PULONG ReturnLength
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_11_22H2)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS2)
//
@@ -247,9 +510,8 @@ NTAPI
NtAcquireProcessActivityReference(
_Out_ PHANDLE ActivityReferenceHandle,
_In_ HANDLE ParentProcessHandle,
_Reserved_ PROCESS_ACTIVITY_TYPE Reserved
_In_ ULONG ProcessActivityType // PROCESS_ACTIVITY_TYPE
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_10_RS2)
//
@@ -501,7 +763,7 @@ WINAPI
GetCurrentPackageApplicationResourcesContext(
_In_ ULONG Index,
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_APPLICATION_CONTEXT_REFERENCE *PackageResourcesContext
_Out_ PACKAGE_RESOURCES_CONTEXT_REFERENCE *PackageResourcesContext
);
// rev
@@ -512,7 +774,7 @@ GetPackageApplicationResourcesContext(
_In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE
_In_ ULONG Index,
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_APPLICATION_CONTEXT_REFERENCE *PackageResourcesContext
_Out_ PACKAGE_RESOURCES_CONTEXT_REFERENCE *PackageResourcesContext
);
// rev
@@ -520,10 +782,11 @@ WINBASEAPI
LONG
WINAPI
GetPackageResourcesProperty(
_In_ PACKAGE_APPLICATION_CONTEXT_REFERENCE PackageResourcesContext,
_In_ PACKAGE_RESOURCES_CONTEXT_REFERENCE PackageResourcesContext,
_In_ PackageResourcesProperty PropertyId,
_Inout_ PULONG BufferSize,
_Out_writes_bytes_(BufferSize) PVOID Buffer
_Out_writes_bytes_(BufferSize) PVOID Buffer,
_Out_opt_ PULONG Flags
);
//
@@ -606,11 +869,11 @@ WINBASEAPI
HRESULT
WINAPI
GetCurrentPackageInfo3(
_In_ ULONG flags,
_In_ ULONG packagePathType, // PackagePathType
_Inout_ PULONG bufferLength,
_Out_writes_bytes_opt_(*bufferLength) PVOID buffer,
_Out_opt_ PULONG count
_In_ ULONG Flags,
_In_ ULONG PackagePathType, // PackagePathType
_Inout_ PULONG BufferLength,
_Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
_Out_opt_ PULONG ReturnLength
);
//
@@ -651,4 +914,304 @@ GetPackageGlobalizationProperty(
#endif // PHNT_VERSION >= PHNT_WINDOWS_10_20H1
//
// COM
//
// private
_Enum_is_bitflag_
typedef enum _MTA_HOST_USAGE_FLAGS
{
MTA_HOST_USAGE_NONE = 0x0,
MTA_HOST_USAGE_MTAINITIALIZED = 0x1,
MTA_HOST_USAGE_ACTIVATORINITIALIZED = 0x2,
MTA_HOST_USAGE_UNLOADCALLED = 0x4,
} MTA_HOST_USAGE_FLAGS, *PMTA_HOST_USAGE_FLAGS;
DEFINE_ENUM_FLAG_OPERATORS(MTA_HOST_USAGE_FLAGS);
// private
typedef struct _MTA_USAGE_GLOBALS
{
_Reserved_ ULONG StackCapture;
PULONG MTAInits; // A pointer to the total number of MTA inits
PULONG MTAIncInits; // A pointer to the number of MTA inits from CoIncrementMTAUsage
PULONG MTAWaiters; // A pointer to the number of callers waiting inside CoWaitMTACompletion
PULONG MTAIncrementorSize; // A pointer to the size of the cookie returned by CoIncrementMTAUsage
ULONG CompletionTimeOut; // A timeout for CoWaitMTACompletion in milliseconds
_Reserved_ PLIST_ENTRY ListEntryHeadMTAUsageIncrementor;
_Reserved_ PULONG MTAIncrementorCompleted;
_Reserved_ PVOID* MTAUsageCompletedIncrementorHead;
PMTA_HOST_USAGE_FLAGS MTAHostUsageFlags; // A pointer to the MTA usage flags // since THRESHOLD
} MTA_USAGE_GLOBALS, *PMTA_USAGE_GLOBALS;
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
// private // combase.dll, ordinal 70
_Success_(return != 0)
_Must_inspect_result_
WINBASEAPI
PMTA_USAGE_GLOBALS
WINAPI
CoGetMTAUsageInfo(
VOID
);
#endif
//
// COM/OLE
//
// OLETLSFLAGS
#define OLETLS_LOCALTID 0x01 // This TID is in the current process.
#define OLETLS_UUIDINITIALIZED 0x02 // This Logical thread is init'd.
#define OLETLS_INTHREADDETACH 0x04 // This is in thread detach.
#define OLETLS_CHANNELTHREADINITIALZED 0x08// This channel has been init'd
#define OLETLS_WOWTHREAD 0x10 // This thread is a 16-bit WOW thread.
#define OLETLS_THREADUNINITIALIZING 0x20 // This thread is in CoUninitialize.
#define OLETLS_DISABLE_OLE1DDE 0x40 // This thread can't use a DDE window.
#define OLETLS_APARTMENTTHREADED 0x80 // This is an STA apartment thread
#define OLETLS_MULTITHREADED 0x100 // This is an MTA apartment thread
#define OLETLS_IMPERSONATING 0x200 // This thread is impersonating
#define OLETLS_DISABLE_EVENTLOGGER 0x400 // Prevent recursion in event logger
#define OLETLS_INNEUTRALAPT 0x800 // This thread is in the NTA
#define OLETLS_DISPATCHTHREAD 0x1000 // This is a dispatch thread
#define OLETLS_HOSTTHREAD 0x2000 // This is a host thread
#define OLETLS_ALLOWCOINIT 0x4000 // This thread allows inits
#define OLETLS_PENDINGUNINIT 0x8000 // This thread has pending uninit
#define OLETLS_FIRSTMTAINIT 0x10000// First thread to attempt an MTA init
#define OLETLS_FIRSTNTAINIT 0x20000// First thread to attempt an NTA init
#define OLETLS_APTINITIALIZING 0x40000 // Apartment Object is initializing
#define OLETLS_UIMSGSINMODALLOOP 0x80000
#define OLETLS_MARSHALING_ERROR_OBJECT 0x100000 // since WIN8
#define OLETLS_WINRT_INITIALIZE 0x200000 // This thread called RoInitialize
#define OLETLS_APPLICATION_STA 0x400000
#define OLETLS_IN_SHUTDOWN_CALLBACKS 0x800000
#define OLETLS_POINTER_INPUT_BLOCKED 0x1000000
#define OLETLS_IN_ACTIVATION_FILTER 0x2000000 // since WINBLUE
#define OLETLS_ASTATOASTAEXEMPT_QUIRK 0x4000000
#define OLETLS_ASTATOASTAEXEMPT_PROXY 0x8000000
#define OLETLS_ASTATOASTAEXEMPT_INDOUBT 0x10000000
#define OLETLS_DETECTED_USER_INITIALIZED 0x20000000 // since RS3
#define OLETLS_BRIDGE_STA 0x40000000 // since RS5
#define OLETLS_NAINITIALIZING 0x80000000UL // since 19H1
// private
typedef struct tagSOleTlsData
{
PVOID ThreadBase;
PVOID SmAllocator;
ULONG ApartmentID;
ULONG Flags; // OLETLSFLAGS
LONG TlsMapIndex;
PVOID *TlsSlot;
ULONG ComInits;
ULONG OleInits;
ULONG Calls;
PVOID ServerCall; // previously CallInfo (before TH1)
PVOID CallObjectCache; // previously FreeAsyncCall (before TH1)
PVOID ContextStack; // previously FreeClientCall (before TH1)
PVOID ObjServer;
ULONG TIDCaller;
// ... (other fields are version-dependant)
} SOleTlsData, *PSOleTlsData;
// private // ole32.dll
WINBASEAPI
VOID
WINAPI
UpdateDCOMSettings(
VOID
);
//
// AppCompat
//
typedef struct tagSDBQUERYRESULT
{
ULONG Exes[16];
ULONG ExeFlags[16];
ULONG Layers[8];
ULONG LayerFlags;
ULONG AppHelp;
ULONG ExeCount;
ULONG LayerCount;
GUID ID;
ULONG ExtraFlags;
ULONG CustomSDBMap;
GUID DB[16];
} SDBQUERYRESULT, *PSDBQUERYRESULT;
static_assert(sizeof(SDBQUERYRESULT) == 0x1c8, "SDBQUERYRESULT size mismatch");
typedef struct tagSWITCH_CONTEXT_ATTRIBUTE
{
ULONG_PTR ContextUpdateCounter;
BOOL AllowContextUpdate;
BOOL EnableTrace;
HANDLE EtwHandle;
} SWITCH_CONTEXT_ATTRIBUTE, *PSWITCH_CONTEXT_ATTRIBUTE;
#ifdef _WIN64
static_assert(sizeof(SWITCH_CONTEXT_ATTRIBUTE) == 0x18, "SWITCH_CONTEXT_ATTRIBUTE size mismatch");
#else
static_assert(sizeof(SWITCH_CONTEXT_ATTRIBUTE) == 0x10, "SWITCH_CONTEXT_ATTRIBUTE size mismatch");
#endif
typedef struct tagSWITCH_CONTEXT_DATA
{
ULONGLONG OsMaxVersionTested;
ULONG TargetPlatform;
ULONGLONG ContextMinimum;
GUID Platform;
GUID MinPlatform;
ULONG ContextSource;
ULONG ElementCount;
GUID Elements[48];
} SWITCH_CONTEXT_DATA, * PSWITCH_CONTEXT_DATA;
static_assert(sizeof(SWITCH_CONTEXT_DATA) == 0x340, "SWITCH_CONTEXT_DATA size mismatch");
typedef struct tagSWITCH_CONTEXT
{
SWITCH_CONTEXT_ATTRIBUTE Attribute;
SWITCH_CONTEXT_DATA Data;
} SWITCH_CONTEXT, *PSWITCH_CONTEXT;
#ifdef _WIN64
static_assert(sizeof(SWITCH_CONTEXT) == 0x358, "SWITCH_CONTEXT size mismatch");
#else
static_assert(sizeof(SWITCH_CONTEXT) == 0x350, "SWITCH_CONTEXT size mismatch");
#endif
typedef struct _SDB_CSTRUCT_COBALT_PROCFLAG
{
KAFFINITY AffinityMask;
ULONG CPUIDEcxOverride;
ULONG CPUIDEdxOverride;
USHORT ProcessorGroup;
USHORT FastSelfModThreshold;
USHORT Reserved1;
UCHAR Reserved2;
UCHAR BackgroundWork : 5;
UCHAR CPUIDBrand : 4;
UCHAR Reserved3 : 4;
UCHAR RdtscScaling : 3;
UCHAR Reserved4 : 2;
UCHAR UnalignedAtomicApproach : 2;
UCHAR Win11Atomics : 2;
UCHAR RunOnSingleCore : 1;
UCHAR X64CPUID : 1;
UCHAR PatchUnaligned : 1;
UCHAR InterpreterOrJitter : 1;
UCHAR ForceSegmentHeap : 1;
UCHAR Reserved5 : 1;
UCHAR Reserved6 : 1;
union
{
ULONGLONG Group1AsUINT64;
struct _SDB_CSTRUCT_COBALT_PROCFLAG* Specified;
};
} SDB_CSTRUCT_COBALT_PROCFLAG, *PSDB_CSTRUCT_COBALT_PROCFLAG;
#ifdef _WIN64
static_assert(sizeof(SDB_CSTRUCT_COBALT_PROCFLAG) == 0x28, "SDB_CSTRUCT_COBALT_PROCFLAG size mismatch");
#else
static_assert(sizeof(SDB_CSTRUCT_COBALT_PROCFLAG) == 0x20, "SDB_CSTRUCT_COBALT_PROCFLAG size mismatch");
#endif
typedef struct _APPCOMPAT_EXE_DATA
{
ULONG_PTR Reserved[65];
ULONG Size;
ULONG Magic;
BOOL LoadShimEngine;
USHORT ExeType;
SDBQUERYRESULT SdbQueryResult;
ULONG_PTR DbgLogChannels[128];
SWITCH_CONTEXT SwitchContext;
ULONG ParentProcessId;
WCHAR ParentImageName[260];
WCHAR ParentCompatLayers[256];
WCHAR ActiveCompatLayers[256];
ULONG ImageFileSize;
ULONG ImageCheckSum;
BOOL LatestOs;
BOOL PackageId;
BOOL SwitchBackManifest;
BOOL UacManifest;
BOOL LegacyInstaller;
ULONG RunLevel;
ULONG_PTR WinRTFlags;
PVOID HookCOM;
PVOID ComponentOnDemandEvent;
PVOID Quirks;
ULONG QuirksSize;
SDB_CSTRUCT_COBALT_PROCFLAG CobaltProcFlags;
ULONG FullMatchDbSizeCb;
ULONG FullMatchDbOffset;
} APPCOMPAT_EXE_DATA;
#ifdef _WIN64
static_assert(sizeof(APPCOMPAT_EXE_DATA) == 0x11C0, "APPCOMPAT_EXE_DATA size mismatch");
#else
static_assert(sizeof(APPCOMPAT_EXE_DATA) == 0xE98, "APPCOMPAT_EXE_DATA size mismatch");
#endif
//
// Direct3D Kernel Mode Thunk (D3DKMT)
//
/**
* The D3DKMT_GET_PROCESS_LIST structure is used for retrieving a list of process handles using a graphics adapter.
* \remarks The caller is responsible for closing the returned process handles.
*/
// rev
typedef struct _D3DKMT_GET_PROCESS_LIST
{
LUID AdapterLuid; // [in] The locally unique identifier (LUID) for the graphics adapter.
ULONG DesiredAccess; // [in] The access rights to request for the process handles. This must be `PROCESS_QUERY_INFORMATION` (0x400).
ULONG ProcessHandleCount; // [in, out] On input, specifies the number of handles the `ProcessHandle` member can hold. On output, receives the number of handles returned.
HANDLE ProcessHandle; // [out] The first element of an array that receives the process handles.
} D3DKMT_GET_PROCESS_LIST, *PD3DKMT_GET_PROCESS_LIST;
// rev
/**
* The D3DKMTGetProcessList function retrieves a list of processes that are using a specific graphics adapter.
*
* \param[in,out] GetProcessList A pointer to a \ref D3DKMT_GET_PROCESS_LIST structure that contains the processes using the graphics adapter.
* \return NTSTATUS Successful or errant status.
*/
EXTERN_C
NTSTATUS
NTAPI
D3DKMTGetProcessList(
_Inout_ PD3DKMT_GET_PROCESS_LIST GetProcessList
);
// rev
/**
* The D3DKMT_ENUM_PROCESS_LIST structure is used for retrieving a list of process identifiers using a graphics adapter.
*/
typedef struct _D3DKMT_ENUM_PROCESS_LIST
{
LUID AdapterLuid; // [in] The locally unique identifier (LUID) for the graphics adapter.
PULONG ProcessIdBuffer; // [out] A pointer to a buffer that receives the list of process identifiers (PIDs).
SIZE_T ProcessIdCount; // [in, out] On input, specifies the number of elements the `ProcessIdBuffer` can hold. On output, receives the number of process IDs returned.
} D3DKMT_ENUM_PROCESS_LIST, *PD3DKMT_ENUM_PROCESS_LIST;
// rev
/**
* The D3DKMTEnumProcesses function provides a list of process IDs (PIDs) rather than handles that are using a specific graphics adapter,
* which can be more efficient for monitoring purposes.
*
* \param[in,out] EnumProcessList A pointer to a \ref D3DKMT_ENUM_PROCESS_LIST structure that contains the processes using the graphics adapter.
* \return NTSTATUS Successful or errant status.
*/
EXTERN_C
NTSTATUS
NTAPI
D3DKMTEnumProcesses(
_Inout_ PD3DKMT_ENUM_PROCESS_LIST EnumProcessList
);
#endif // _NTMISC_H
ntmmapi.h
+785 -366
View File
File diff suppressed because it is too large Load Diff
ntnls.h
+32 -18
View File
@@ -9,34 +9,48 @@
#define MAXIMUM_LEADBYTES 12
/**
* Stores the NLS file formats.
*
* \sa https://learn.microsoft.com/en-us/previous-versions/mt791523(v=vs.85)
*/
typedef struct _CPTABLEINFO
{
USHORT CodePage;
USHORT MaximumCharacterSize;
USHORT DefaultChar;
USHORT UniDefaultChar;
USHORT TransDefaultChar;
USHORT TransUniDefaultChar;
USHORT DBCSCodePage;
UCHAR LeadByte[MAXIMUM_LEADBYTES];
PUSHORT MultiByteTable;
PVOID WideCharTable;
PUSHORT DBCSRanges;
PUSHORT DBCSOffsets;
USHORT CodePage; // Specifies the code page number.
USHORT MaximumCharacterSize; // Specifies the maximum length in bytes of a character.
USHORT DefaultChar; // Specifies the default character (MB).
USHORT UniDefaultChar; // Specifies the default character (Unicode).
USHORT TransDefaultChar; // Specifies the translation of the default character (Unicode).
USHORT TransUniDefaultChar; // Specifies the translation of the Unicode default character (MB).
USHORT DBCSCodePage; // Specifies non-zero for DBCS code pages.
UCHAR LeadByte[MAXIMUM_LEADBYTES]; // Specifies the lead byte ranges.
PUSHORT MultiByteTable; // Specifies a pointer to a MB translation table.
PVOID WideCharTable; // Specifies a pointer to a WC translation table.
PUSHORT DBCSRanges; // Specifies a pointer to DBCS ranges.
PUSHORT DBCSOffsets; // Specifies a pointer to DBCS offsets.
} CPTABLEINFO, *PCPTABLEINFO;
/**
* Stores the NLS file formats.
*
* \sa https://learn.microsoft.com/en-us/previous-versions/mt791531(v=vs.85)
*/
typedef struct _NLSTABLEINFO
{
CPTABLEINFO OemTableInfo;
CPTABLEINFO AnsiTableInfo;
PUSHORT UpperCaseTable;
PUSHORT LowerCaseTable;
CPTABLEINFO OemTableInfo; // Specifies OEM table.
CPTABLEINFO AnsiTableInfo; // Specifies an ANSI table.
PUSHORT UpperCaseTable; // Specifies an 844 format uppercase table.
PUSHORT LowerCaseTable; // Specifies an 844 format lowercase table.
} NLSTABLEINFO, *PNLSTABLEINFO;
//
// Data exports (ntdll.lib/ntdllp.lib)
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
NTSYSAPI USHORT NlsAnsiCodePage;
NTSYSAPI BOOLEAN NlsMbCodePageTag;
NTSYSAPI BOOLEAN NlsMbOemCodePageTag;
#endif
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#endif
#endif // _NTNLS_H
ntobapi.h
+267 -35
View File
@@ -7,36 +7,82 @@
#ifndef _NTOBAPI_H
#define _NTOBAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
//
// Object Specific Access Rights
//
#ifndef OBJECT_TYPE_CREATE
#define OBJECT_TYPE_CREATE 0x0001
#endif
#ifndef OBJECT_TYPE_ALL_ACCESS
#define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | OBJECT_TYPE_CREATE)
#endif
#if (PHNT_MODE != PHNT_MODE_KERNEL)
//
// Directory Object Specific Access Rights
//
#ifndef DIRECTORY_QUERY
#define DIRECTORY_QUERY 0x0001
#endif
#ifndef DIRECTORY_TRAVERSE
#define DIRECTORY_TRAVERSE 0x0002
#endif
#ifndef DIRECTORY_CREATE_OBJECT
#define DIRECTORY_CREATE_OBJECT 0x0004
#endif
#ifndef DIRECTORY_CREATE_SUBDIRECTORY
#define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
#endif
#ifndef DIRECTORY_ALL_ACCESS
#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | DIRECTORY_QUERY | DIRECTORY_TRAVERSE | DIRECTORY_CREATE_OBJECT | DIRECTORY_CREATE_SUBDIRECTORY)
#endif
#if (PHNT_MODE != PHNT_MODE_KERNEL)
//
// Symbolic Link Specific Access Rights
//
#ifndef SYMBOLIC_LINK_QUERY
#define SYMBOLIC_LINK_QUERY 0x0001
#endif
#ifndef SYMBOLIC_LINK_SET
#define SYMBOLIC_LINK_SET 0x0002
#endif
#ifndef SYMBOLIC_LINK_ALL_ACCESS
#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYMBOLIC_LINK_QUERY)
#endif
#ifndef SYMBOLIC_LINK_ALL_ACCESS_EX
#define SYMBOLIC_LINK_ALL_ACCESS_EX (STANDARD_RIGHTS_REQUIRED | SPECIFIC_RIGHTS_ALL)
#endif
//
// Object Attribute Flags
//
#ifndef OBJ_PROTECT_CLOSE
#define OBJ_PROTECT_CLOSE 0x00000001
#endif
#ifndef OBJ_INHERIT
#define OBJ_INHERIT 0x00000002
#endif
#ifndef OBJ_AUDIT_OBJECT_CLOSE
#define OBJ_AUDIT_OBJECT_CLOSE 0x00000004
#endif
//
// Object Information
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
typedef enum _OBJECT_INFORMATION_CLASS
{
@@ -47,6 +93,7 @@ typedef enum _OBJECT_INFORMATION_CLASS
ObjectHandleFlagInformation, // qs: OBJECT_HANDLE_FLAG_INFORMATION
ObjectSessionInformation, // s: void // change object session // (requires SeTcbPrivilege)
ObjectSessionObjectInformation, // s: void // change object session // (requires SeTcbPrivilege)
ObjectSetRefTraceInformation, // since 25H2
MaxObjectInfoClass
} OBJECT_INFORMATION_CLASS;
#else
@@ -57,7 +104,9 @@ typedef enum _OBJECT_INFORMATION_CLASS
#define ObjectHandleFlagInformation 4
#define ObjectSessionInformation 5
#define ObjectSessionObjectInformation 6
#endif
#define ObjectSetRefTraceInformation 7
#define MaxObjectInfoClass 8
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* The OBJECT_BASIC_INFORMATION structure contains basic information about an object.
@@ -85,7 +134,7 @@ typedef struct _OBJECT_NAME_INFORMATION
{
UNICODE_STRING Name; // The object name (when present) includes a NULL-terminator and all path separators "\" in the name.
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
#endif
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* The OBJECT_NAME_INFORMATION structure contains various statistics and properties about an object type.
@@ -128,10 +177,23 @@ typedef struct _OBJECT_HANDLE_FLAG_INFORMATION
BOOLEAN ProtectFromClose;
} OBJECT_HANDLE_FLAG_INFORMATION, *POBJECT_HANDLE_FLAG_INFORMATION;
//
// Objects, handles
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* The NtQueryObject routine retrieves various kinds of object information.
*
* \param Handle The handle of the object for which information is being queried.
* \param ObjectInformationClass The information class indicating the kind of object information to be retrieved.
* \param ObjectInformation An optional pointer to a buffer where the requested information is to be returned.
* \param ObjectInformationLength The size of the buffer pointed to by the ObjectInformation parameter, in bytes.
* \param ReturnLength An optional pointer to a location where the function writes the actual size of the information requested.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntqueryobject
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -143,6 +205,15 @@ NtQueryObject(
_Out_opt_ PULONG ReturnLength
);
/**
* The NtSetInformationObject routine changes various kinds of information about a object.
*
* \param Handle The handle of the object for which information is being changed.
* \param ObjectInformationClass The type of information, supplied in the buffer pointed to by ObjectInformation, to set for the object.
* \param ObjectInformation Pointer to a buffer that contains the information to set for the object.
* \param ObjectInformationLength The size of the buffer pointed to by the ObjectInformation parameter, in bytes.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -153,10 +224,23 @@ NtSetInformationObject(
_In_ ULONG ObjectInformationLength
);
#define DUPLICATE_CLOSE_SOURCE 0x00000001
#define DUPLICATE_SAME_ACCESS 0x00000002
#define DUPLICATE_SAME_ATTRIBUTES 0x00000004
#define DUPLICATE_CLOSE_SOURCE 0x00000001 // Close the source handle.
#define DUPLICATE_SAME_ACCESS 0x00000002 // Instead of using the DesiredAccess parameter, copy the access rights from the source handle to the target handle.
#define DUPLICATE_SAME_ATTRIBUTES 0x00000004 // Instead of using the HandleAttributes parameter, copy the attributes from the source handle to the target handle.
/**
* The NtDuplicateObject routine creates a handle that is a duplicate of the specified source handle.
*
* \param SourceProcessHandle A handle to the source process for the handle being duplicated.
* \param SourceHandle The handle to duplicate.
* \param TargetProcessHandle A handle to the target process that is to receive the new handle. This parameter is optional and can be specified as NULL if the DUPLICATE_CLOSE_SOURCE flag is set in Options.
* \param TargetHandle A pointer to a HANDLE variable into which the routine writes the new duplicated handle. The duplicated handle is valid in the specified target process. This parameter is optional and can be specified as NULL if no duplicate handle is to be created.
* \param DesiredAccess An ACCESS_MASK value that specifies the desired access for the new handle.
* \param HandleAttributes A ULONG that specifies the desired attributes for the new handle.
* \param Options A set of flags to control the behavior of the duplication operation.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-zwduplicateobject
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -170,6 +254,13 @@ NtDuplicateObject(
_In_ ULONG Options
);
/**
* The NtMakeTemporaryObject routine changes the attributes of an object to make it temporary.
*
* \param Handle Handle to an object of any type.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwmaketemporaryobject
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -177,6 +268,13 @@ NtMakeTemporaryObject(
_In_ HANDLE Handle
);
/**
* The NtMakePermanentObject routine changes the attributes of an object to make it permanent.
*
* \param Handle Handle to an object of any type.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwmaketemporaryobject
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -184,6 +282,17 @@ NtMakePermanentObject(
_In_ HANDLE Handle
);
/**
* The NtSignalAndWaitForSingleObject routine signals one object and waits on another object as a single operation.
*
* \param SignalHandle A handle to the object to be signaled.
* \param WaitHandle A handle to the object to wait on. The SYNCHRONIZE access right is required.
* \param Alertable If this parameter is TRUE, the function returns when the system queues an I/O completion routine or APC function, and the thread calls the function.
* \param Timeout The time-out interval. The function returns if the interval elapses, even if the object's state is nonsignaled and no completion or APC objects are queued.
* If zero, the function tests the object's state, checks for queued completion routines or APCs, and returns immediately.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-signalobjectandwait
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -194,6 +303,17 @@ NtSignalAndWaitForSingleObject(
_In_opt_ PLARGE_INTEGER Timeout
);
/**
* The NtWaitForSingleObject routine waits until the specified object is in the signaled state or the time-out interval elapses.
*
* \param Handle The handle to the wait object.
* \param Alertable The function returns when either the time-out period has elapsed or when the APC function is called.
* \param Timeout A pointer to an absolute or relative time over which the wait is to occur. Can be null. If a timeout is specified,
* and the object has not attained a state of signaled when the timeout expires, then the wait is automatically satisfied.
* If an explicit timeout value of zero is specified, then no wait occurs if the wait cannot be satisfied immediately.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntwaitforsingleobject
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -203,6 +323,19 @@ NtWaitForSingleObject(
_In_opt_ PLARGE_INTEGER Timeout
);
/**
* The NtWaitForMultipleObjects routine waits until one or all of the specified objects are in the signaled state, an I/O completion routine or asynchronous procedure call (APC) is queued to the thread, or the time-out interval elapses.
*
* \param Count The number of object handles to wait for in the array pointed to by lpHandles. The maximum number of object handles is MAXIMUM_WAIT_OBJECTS. This parameter cannot be zero.
* \param Handles An array of object handles. The array can contain handles of objects of different types. It may not contain multiple copies of the same handle.
* \param WaitType If this parameter is WaitAll, the function returns when the state of all objects in the Handles array is set to signaled.
* \param Alertable f this parameter is TRUE and the thread is in the waiting state, the function returns when the system queues an I/O completion routine or APC, and the thread runs the routine or function.
* \param Timeout A pointer to an absolute or relative time over which the wait is to occur. Can be null. If a timeout is specified,
* and the object has not attained a state of signaled when the timeout expires, then the wait is automatically satisfied.
* If an explicit timeout value of zero is specified, then no wait occurs if the wait cannot be satisfied immediately.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-waitformultipleobjectsex
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -214,7 +347,6 @@ NtWaitForMultipleObjects(
_In_opt_ PLARGE_INTEGER Timeout
);
#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -225,8 +357,16 @@ NtWaitForMultipleObjects32(
_In_ BOOLEAN Alertable,
_In_opt_ PLARGE_INTEGER Timeout
);
#endif
/**
* The NtSetSecurityObject routine sets an object's security state.
*
* \param Handle Handle for the object whose security state is to be set.
* \param SecurityInformation A SECURITY_INFORMATION value specifying the information to be set.
* \param SecurityDescriptor Pointer to the security descriptor to be set for the object.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-zwsetsecurityobject
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -236,6 +376,17 @@ NtSetSecurityObject(
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor
);
/**
* The NtQuerySecurityObject routine retrieves a copy of an object's security descriptor.
*
* \param Handle Handle for the object whose security descriptor is to be queried.
* \param SecurityInformation A SECURITY_INFORMATION value specifying the information to be queried.
* \param SecurityDescriptor Caller-allocated buffer that NtQuerySecurityObject fills with a copy of the specified security descriptor.
* \param Length Size, in bytes, of the buffer pointed to by SecurityDescriptor.
* \param LengthNeeded Pointer to a caller-allocated variable that receives the number of bytes required to store the copied security descriptor.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntquerysecurityobject
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -247,6 +398,13 @@ NtQuerySecurityObject(
_Out_ PULONG LengthNeeded
);
/**
* The NtClose routine closes the specified handle.
*
* \param Handle The handle being closed.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwclose
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -255,6 +413,14 @@ NtClose(
);
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
/**
* Compares two object handles to determine if they refer to the same underlying kernel object.
*
* \param FirstObjectHandle The first object handle to compare.
* \param SecondObjectHandle The second object handle to compare.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-compareobjecthandles
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -262,14 +428,25 @@ NtCompareObjects(
_In_ HANDLE FirstObjectHandle,
_In_ HANDLE SecondObjectHandle
);
#endif
#endif // (PHNT_VERSION >= PHNT_WINDOWS_10)
#endif
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
//
// Directory objects
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* The NtCreateDirectoryObject routine creates or opens an object-directory object.
*
* \param DirectoryHandle Pointer to a HANDLE variable that receives a handle to the object directory.
* \param DesiredAccess An ACCESS_MASK that specifies the requested access to the directory object.
* \param ObjectAttributes The attributes for the directory object.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwcreatedirectoryobject
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -290,8 +467,17 @@ NtCreateDirectoryObjectEx(
_In_ HANDLE ShadowDirectoryHandle,
_In_ ULONG Flags
);
#endif
#endif // (PHNT_VERSION >= PHNT_WINDOWS_8)
/**
* Opens an existing directory object.
*
* \param DirectoryHandle A handle to the newly opened directory object.
* \param DesiredAccess An ACCESS_MASK that specifies the requested access to the directory object.
* \param ObjectAttributes The attributes for the directory object.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/devnotes/ntopendirectoryobject
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -301,12 +487,28 @@ NtOpenDirectoryObject(
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
/**
* The OBJECT_DIRECTORY_INFORMATION structure contains information about the directory object.
*/
typedef struct _OBJECT_DIRECTORY_INFORMATION
{
UNICODE_STRING Name;
UNICODE_STRING TypeName;
} OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION;
/**
* Retrieves information about the specified directory object.
*
* \param DirectoryHandle A handle to the directory object. This handle must have been opened with the appropriate access rights.
* \param Buffer A pointer to a buffer that receives the directory information.
* \param Length The size, in bytes, of the buffer pointed to by the Buffer parameter.
* \param ReturnSingleEntry A BOOLEAN value that specifies whether to return a single entry or multiple entries.
* \param RestartScan A BOOLEAN value that specifies whether to restart the scan from the beginning of the directory.
* \param Context A pointer to a variable that maintains the context of the directory enumeration.
* \param ReturnLength An optional pointer to a variable that receives the number of bytes returned in the buffer.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/devnotes/ntquerydirectoryobject
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -320,32 +522,37 @@ NtQueryDirectoryObject(
_Out_opt_ PULONG ReturnLength
);
#endif
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
//
// Private namespaces
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// private
typedef enum _BOUNDARY_ENTRY_TYPE
{
OBNS_Invalid,
OBNS_Name,
OBNS_SID,
OBNS_IL
BOUNDARY_ENTRY_TYPE_INVALID,
BOUNDARY_ENTRY_TYPE_NAME,
BOUNDARY_ENTRY_TYPE_SID,
BOUNDARY_ENTRY_TYPE_IL
} BOUNDARY_ENTRY_TYPE;
// private
typedef union _OBJECT_BOUNDARY_VALUE
{
WCHAR Name[1];
PSID Sid;
PSID IntegrityLabel;
} OBJECT_BOUNDARY_VALUE, *POBJECT_BOUNDARY_VALUE;
// private
typedef struct _OBJECT_BOUNDARY_ENTRY
{
BOUNDARY_ENTRY_TYPE EntryType;
ULONG EntrySize;
//union
//{
// WCHAR Name[1];
// PSID Sid;
// PSID IntegrityLabel;
//};
BOUNDARY_ENTRY_TYPE Type;
ULONG Size;
// OBJECT_BOUNDARY_VALUE Value;
} OBJECT_BOUNDARY_ENTRY, *POBJECT_BOUNDARY_ENTRY;
// rev
@@ -369,8 +576,16 @@ typedef struct _OBJECT_BOUNDARY_DESCRIPTOR
//OBJECT_BOUNDARY_ENTRY Entries[1];
} OBJECT_BOUNDARY_DESCRIPTOR, *POBJECT_BOUNDARY_DESCRIPTOR;
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
/**
* Creates a private namespace.
*
* \param NamespaceHandle A handle to the newly created private namespace.
* \param DesiredAccess An ACCESS_MASK that specifies the requested access to the private namespace.
* \param ObjectAttributes The attributes for the private namespace.
* \param BoundaryDescriptor A descriptor that defines how the namespace is to be isolated. The RtlCreateBoundaryDescriptor function creates a boundary descriptor.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprivatenamespacea
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -381,6 +596,16 @@ NtCreatePrivateNamespace(
_In_ POBJECT_BOUNDARY_DESCRIPTOR BoundaryDescriptor
);
/**
* Opens a private namespace.
*
* \param NamespaceHandle A handle to the newly opened private namespace.
* \param DesiredAccess An ACCESS_MASK that specifies the requested access to the private namespace.
* \param ObjectAttributes The attributes for the private namespace.
* \param BoundaryDescriptor A descriptor that defines how the namespace is to be isolated. The RtlCreateBoundaryDescriptor function creates a boundary descriptor.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-openprivatenamespacea
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -391,6 +616,13 @@ NtOpenPrivateNamespace(
_In_ POBJECT_BOUNDARY_DESCRIPTOR BoundaryDescriptor
);
/**
* Deletes an open namespace handle.
*
* \param NamespaceHandle A handle to the private namespace.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/namespaceapi/nf-namespaceapi-closeprivatenamespace
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -398,11 +630,11 @@ NtDeletePrivateNamespace(
_In_ HANDLE NamespaceHandle
);
#endif
#endif
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
//
// Symbolic links
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
@@ -413,7 +645,7 @@ NtCreateSymbolicLinkObject(
_Out_ PHANDLE LinkHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PUNICODE_STRING LinkTarget
_In_ PCUNICODE_STRING LinkTarget
);
NTSYSCALLAPI
@@ -451,8 +683,8 @@ NtSetInformationSymbolicLink(
_In_reads_bytes_(SymbolicLinkInformationLength) PVOID SymbolicLinkInformation,
_In_ ULONG SymbolicLinkInformationLength
);
#endif
#endif // (PHNT_VERSION >= PHNT_WINDOWS_10)
#endif
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#endif
#endif // _NTOBAPI_H
ntpebteb.h
+425 -116
View File
@@ -7,51 +7,179 @@
#ifndef _NTPEBTEB_H
#define _NTPEBTEB_H
#ifdef __has_include
#if __has_include (<ntgdi.h>)
#include <ntgdi.h>
#endif // __has_include
#if __has_include (<ntsxs.h>)
#include <ntsxs.h>
#endif // __has_include
#endif // __has_include
typedef struct _APPCOMPAT_EXE_DATA APPCOMPAT_EXE_DATA, *PAPPCOMPAT_EXE_DATA;
typedef struct _RTL_USER_PROCESS_PARAMETERS *PRTL_USER_PROCESS_PARAMETERS;
typedef struct _RTL_CRITICAL_SECTION *PRTL_CRITICAL_SECTION;
typedef struct _SILO_USER_SHARED_DATA *PSILO_USER_SHARED_DATA;
typedef struct _LDR_RESLOADER_RET LDR_RESLOADER_RET, *PLDR_RESLOADER_RET;
typedef struct _LEAP_SECOND_DATA *PLEAP_SECOND_DATA;
typedef struct _PEB_LDR_DATA PEB_LDR_DATA, *PPEB_LDR_DATA;
typedef struct tagSOleTlsData SOleTlsData, *PSOleTlsData;
typedef struct _KERNEL_CALLBACK_TABLE KERNEL_CALLBACK_TABLE, *PKERNEL_CALLBACK_TABLE;
typedef struct _GDI_HANDLE_ENTRY GDI_HANDLE_ENTRY, *PGDI_HANDLE_ENTRY;
typedef struct _SHIM_PROCESS_CONTEXT SHIM_PROCESS_CONTEXT, *PSHIM_PROCESS_CONTEXT;
typedef struct _HEAP HEAP, *PHEAP;
// PEB->AppCompatFlags
#define KACF_OLDGETSHORTPATHNAME 0x00000001
#define KACF_VERSIONLIE_NOT_USED 0x00000002
#define KACF_GETTEMPPATH_NOT_USED 0x00000004
#define KACF_GETDISKFREESPACE 0x00000008
#define KACF_FTMFROMCURRENTAPT 0x00000020
#define KACF_DISALLOWORBINDINGCHANGES 0x00000040
#define KACF_OLE32VALIDATEPTRS 0x00000080
#define KACF_DISABLECICERO 0x00000100
#define KACF_OLE32ENABLEASYNCDOCFILE 0x00000200
#define KACF_OLE32ENABLELEGACYEXCEPTIONHANDLING 0x00000400
#define KACF_RPCDISABLENDRCLIENTHARDENING 0x00000800
#define KACF_RPCDISABLENDRMAYBENULL_SIZEIS 0x00001000
#define KACF_DISABLEALLDDEHACK_NOT_USED 0x00002000
#define KACF_RPCDISABLENDR61_RANGE 0x00004000
#define KACF_RPC32ENABLELEGACYEXCEPTIONHANDLING 0x00008000
#define KACF_OLE32DOCFILEUSELEGACYNTFSFLAGS 0x00010000
#define KACF_RPCDISABLENDRCONSTIIDCHECK 0x00020000
#define KACF_USERDISABLEFORWARDERPATCH 0x00040000
#define KACF_OLE32DISABLENEW_WMPAINT_DISPATCH 0x00100000
#define KACF_ADDRESTRICTEDSIDINCOINITIALIZESECURITY 0x00200000
#define KACF_ALLOCDEBUGINFOFORCRITSECTIONS 0x00400000
#define KACF_OLEAUT32ENABLEUNSAFELOADTYPELIBRELATIVE 0x00800000
#define KACF_ALLOWMAXIMIZEDWINDOWGAMMA 0x01000000
#define KACF_DONOTADDTOCACHE 0x80000000
#define KACF_OLDGETSHORTPATHNAME 0x00000001
#define KACF_VERSIONLIE_NOT_USED 0x00000002
#define KACF_GETTEMPPATH_NOT_USED 0x00000004
#define KACF_GETDISKFREESPACE 0x00000008
#define KACF_APPCOMPATFLAG_BIT4 0x00000010
#define KACF_FTMFROMCURRENTAPT 0x00000020
#define KACF_DISALLOWORBINDINGCHANGES 0x00000040
#define KACF_OLE32VALIDATEPTRS 0x00000080
#define KACF_DISABLECICERO 0x00000100
#define KACF_OLE32ENABLEASYNCDOCFILE 0x00000200
#define KACF_OLE32ENABLELEGACYEXCEPTIONHANDLING 0x00000400
#define KACF_RPCDISABLENDRCLIENTHARDENING 0x00000800
#define KACF_RPCDISABLENDRMAYBENULL_SIZEIS 0x00001000
#define KACF_DISABLEALLDDEHACK_NOT_USED 0x00002000
#define KACF_RPCDISABLENDR61_RANGE 0x00004000
#define KACF_RPC32ENABLELEGACYEXCEPTIONHANDLING 0x00008000
#define KACF_OLE32DOCFILEUSELEGACYNTFSFLAGS 0x00010000
#define KACF_RPCDISABLENDRCONSTIIDCHECK 0x00020000
#define KACF_USERDISABLEFORWARDERPATCH 0x00040000
#define KACF_APPCOMPATFLAG_BIT19 0x00080000
#define KACF_OLE32DISABLENEW_WMPAINT_DISPATCH 0x00100000
#define KACF_ADDRESTRICTEDSIDINCOINITIALIZESECURITY 0x00200000
#define KACF_ALLOCDEBUGINFOFORCRITSECTIONS 0x00400000
#define KACF_OLEAUT32ENABLEUNSAFELOADTYPELIBRELATIVE 0x00800000
#define KACF_ALLOWMAXIMIZEDWINDOWGAMMA 0x01000000
#define KACF_DONOTADDTOCACHE 0x80000000
#define KACF_DISABLEPOSIXDELETEFILE 0x100000000 // rev KernelBase!InternalDeleteFileW
#define KACF_ENABLE_PROCESS_SYSTEMDPIAWARENESS 0x20000000000000 // rev // Enable Per-Process System DPI Awareness and Opt-in to Per-Process System DPI mode.
#define KACF_DISABLE_PROCESS_SYSTEMDPIAWARENESS 0x40000000000000 // rev // Disable Per-Process System DPI Awareness and force legacy DPI behavior.
#define KACF_ENABLE_GDI_DPI_SCALING 0x800000000000000
#define KACF_FORCE_DISABLE_GDI_SCALING 0x4000000000000000
// PEB->ApiSetMap
typedef struct _API_SET_NAMESPACE
// PEB->CrossProcessFlags
#define PEB_FLAG_PROCESS_IN_JOB 0x00000001 // Process is part of a job
#define PEB_FLAG_PROCESS_INITIALIZING 0x00000002 // Process is initializing
#define PEB_FLAG_PROCESS_USING_VEH 0x00000004 // Process is using VEH
#define PEB_FLAG_PROCESS_USING_VCH 0x00000008 // Process is using VCH
#define PEB_FLAG_PROCESS_USING_FTH 0x00000010 // Process is using FTH
#define PEB_FLAG_PROCESS_PREVIOUSLY_THROTTLED 0x00000020 // Process was previously throttled
#define PEB_FLAG_PROCESS_CURRENTLY_THROTTLED 0x00000040 // Process is currently throttled
#define PEB_FLAG_PROCESS_IMAGES_HOT_PATCHED 0x00000080 // Process images are hot patched (RS5+)
// private
#define API_SET_SECTION_NAME ".apiset"
// private
#define API_SET_SCHEMA_VERSION_V2 0x00000002 // WIN7, WIN8
#define API_SET_SCHEMA_VERSION_V4 0x00000004 // WINBLUE
#define API_SET_SCHEMA_VERSION_V6 0x00000006 // since THRESHOLD
#define API_SET_SCHEMA_VERSION API_SET_SCHEMA_VERSION_V6
// private
#define API_SET_SCHEMA_FLAGS_SEALED 0x00000001
#define API_SET_SCHEMA_FLAGS_HOST_EXTENSION 0x00000002
// private
#define API_SET_SCHEMA_ENTRY_FLAGS_SEALED 0x00000001
#define API_SET_SCHEMA_ENTRY_FLAGS_EXTENSION 0x00000002
// private
typedef struct _API_SET_VALUE_ENTRY_V2
{
ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base
ULONG NameLength;
ULONG ValueOffset; // to WCHAR[ValueLength / sizeof(WCHAR)], from schema base
ULONG ValueLength;
} API_SET_VALUE_ENTRY_V2, *PAPI_SET_VALUE_ENTRY_V2;
// private
typedef struct _API_SET_VALUE_ARRAY_V2
{
ULONG Count;
_Field_size_full_(Count) API_SET_VALUE_ENTRY_V2 Array[ANYSIZE_ARRAY];
} API_SET_VALUE_ARRAY_V2, *PAPI_SET_VALUE_ARRAY_V2;
// private
typedef struct _API_SET_NAMESPACE_ENTRY_V2
{
ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base
ULONG NameLength;
ULONG DataOffset; // to API_SET_VALUE_ARRAY_V2, from schema base
} API_SET_NAMESPACE_ENTRY_V2, *PAPI_SET_NAMESPACE_ENTRY_V2;
// private // PEB->ApiSetMap on WIN7, WIN8
typedef struct _API_SET_NAMESPACE_ARRAY_V2
{
ULONG Version; // API_SET_SCHEMA_VERSION_V2
ULONG Count;
_Field_size_full_(Count) API_SET_NAMESPACE_ENTRY_V2 Array[ANYSIZE_ARRAY];
} API_SET_NAMESPACE_ARRAY_V2, *PAPI_SET_NAMESPACE_ARRAY_V2;
// private
typedef struct _API_SET_VALUE_ENTRY_V4
{
ULONG Flags;
ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base
ULONG NameLength;
ULONG ValueOffset; // to WCHAR[ValueLength / sizeof(WCHAR)], from schema base
ULONG ValueLength;
} API_SET_VALUE_ENTRY_V4, *PAPI_SET_VALUE_ENTRY_V4;
// private
typedef struct _API_SET_VALUE_ARRAY_V4
{
ULONG Version;
ULONG Size;
ULONG Flags;
ULONG Count;
ULONG EntryOffset;
ULONG HashOffset;
ULONG HashFactor;
} API_SET_NAMESPACE, *PAPI_SET_NAMESPACE;
_Field_size_full_(Count) API_SET_VALUE_ENTRY_V4 Array[ANYSIZE_ARRAY];
} API_SET_VALUE_ARRAY_V4, *PAPI_SET_VALUE_ARRAY_V4;
// private
typedef struct _API_SET_NAMESPACE_ENTRY_V4
{
ULONG Flags; // API_SET_SCHEMA_ENTRY_FLAGS_*
ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base
ULONG NameLength;
ULONG AliasOffset; // to WCHAR[AliasLength / sizeof(WCHAR)], from schema base
ULONG AliasLength;
ULONG DataOffset; // to API_SET_VALUE_ARRAY_V4, from schema base
} API_SET_NAMESPACE_ENTRY_V4, *PAPI_SET_NAMESPACE_ENTRY_V4;
// private // PEB->ApiSetMap on WINBLUE
typedef struct _API_SET_NAMESPACE_ARRAY_V4
{
ULONG Version; // API_SET_SCHEMA_VERSION_V4
ULONG Size;
ULONG Flags; // API_SET_SCHEMA_FLAGS_*
ULONG Count;
_Field_size_full_(Count) API_SET_NAMESPACE_ENTRY_V4 Array[ANYSIZE_ARRAY];
} API_SET_NAMESPACE_ARRAY_V4, *PAPI_SET_NAMESPACE_ARRAY_V4;
// private
typedef struct _API_SET_VALUE_ENTRY
{
ULONG Flags;
ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base
ULONG NameLength;
ULONG ValueOffset; // to WCHAR[ValueLength / sizeof(WCHAR)], from schema base
ULONG ValueLength;
} API_SET_VALUE_ENTRY, *PAPI_SET_VALUE_ENTRY;
// private
typedef struct _API_SET_NAMESPACE_ENTRY
{
ULONG Flags; // API_SET_SCHEMA_ENTRY_FLAGS_*
ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base
ULONG NameLength;
ULONG HashedLength;
ULONG ValueOffset; // to API_SET_VALUE_ENTRY[ValueCount], from schema base
ULONG ValueCount;
} API_SET_NAMESPACE_ENTRY, *PAPI_SET_NAMESPACE_ENTRY;
// private
typedef struct _API_SET_HASH_ENTRY
@@ -60,26 +188,17 @@ typedef struct _API_SET_HASH_ENTRY
ULONG Index;
} API_SET_HASH_ENTRY, *PAPI_SET_HASH_ENTRY;
// private
typedef struct _API_SET_NAMESPACE_ENTRY
// private // PEB->ApiSetMap since THRESHOLD
typedef struct _API_SET_NAMESPACE
{
ULONG Flags;
ULONG NameOffset;
ULONG NameLength;
ULONG HashedLength;
ULONG ValueOffset;
ULONG ValueCount;
} API_SET_NAMESPACE_ENTRY, *PAPI_SET_NAMESPACE_ENTRY;
// private
typedef struct _API_SET_VALUE_ENTRY
{
ULONG Flags;
ULONG NameOffset;
ULONG NameLength;
ULONG ValueOffset;
ULONG ValueLength;
} API_SET_VALUE_ENTRY, *PAPI_SET_VALUE_ENTRY;
ULONG Version; // API_SET_SCHEMA_VERSION_V6
ULONG Size;
ULONG Flags; // API_SET_SCHEMA_FLAGS_*
ULONG Count;
ULONG EntryOffset; // to API_SET_NAMESPACE_ENTRY[Count], from this struct base
ULONG HashOffset; // to API_SET_HASH_ENTRY[Count], from this struct base
ULONG HashFactor;
} API_SET_NAMESPACE, *PAPI_SET_NAMESPACE;
// PEB->TelemetryCoverageHeader
typedef struct _TELEMETRY_COVERAGE_HEADER
@@ -208,12 +327,17 @@ typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE];
typedef ULONG GDI_HANDLE_BUFFER32[GDI_HANDLE_BUFFER_SIZE32];
typedef ULONG GDI_HANDLE_BUFFER64[GDI_HANDLE_BUFFER_SIZE64];
typedef VOID (NTAPI* PPS_POST_PROCESS_INIT_ROUTINE)(
typedef _Function_class_(PS_POST_PROCESS_INIT_ROUTINE)
VOID NTAPI PS_POST_PROCESS_INIT_ROUTINE(
VOID
);
typedef PS_POST_PROCESS_INIT_ROUTINE* PPS_POST_PROCESS_INIT_ROUTINE;
#ifndef RTL_FLS_MAXIMUM_AVAILABLE
#define RTL_FLS_MAXIMUM_AVAILABLE 128
#endif
#ifndef FLS_MAXIMUM_AVAILABLE
#define FLS_MAXIMUM_AVAILABLE 128
#define FLS_MAXIMUM_AVAILABLE 4080
#endif
#ifndef TLS_MINIMUM_AVAILABLE
#define TLS_MINIMUM_AVAILABLE 64
@@ -225,7 +349,7 @@ typedef VOID (NTAPI* PPS_POST_PROCESS_INIT_ROUTINE)(
/**
* Process Environment Block (PEB) structure.
*
* \remarks https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb
* \sa https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb
*/
typedef struct _PEB
{
@@ -254,7 +378,7 @@ typedef struct _PEB
BOOLEAN IsImageDynamicallyRelocated : 1; // The process image base address was relocated.
BOOLEAN SkipPatchingUser32Forwarders : 1; // The process skipped forwarders for User32.dll functions. 1 for 64-bit, 0 for 32-bit.
BOOLEAN IsPackagedProcess : 1; // The process is a packaged store process (APPX/MSIX).
BOOLEAN IsAppContainer : 1; // The process has an AppContainer token.
BOOLEAN IsAppContainerProcess : 1; // The process has an AppContainer token.
BOOLEAN IsProtectedProcessLight : 1; // The process is a protected process (light).
BOOLEAN IsLongPathAwareProcess : 1; // The process is long path aware.
};
@@ -288,7 +412,7 @@ typedef struct _PEB
//
// Pointer to the process default heap.
//
PVOID ProcessHeap;
PHEAP ProcessHeap;
//
// Pointer to a critical section used to synchronize access to the PEB.
@@ -301,9 +425,9 @@ typedef struct _PEB
PSLIST_HEADER AtlThunkSListPtr;
//
// Pointer to the Image File Execution Options key.
// Handle to the Image File Execution Options key.
//
PVOID IFEOKey;
HANDLE IFEOKey;
//
// Cross process flags.
@@ -330,7 +454,7 @@ typedef struct _PEB
//
union
{
PVOID KernelCallbackTable;
PKERNEL_CALLBACK_TABLE KernelCallbackTable;
PVOID UserSharedInfoPtr;
};
@@ -380,19 +504,19 @@ typedef struct _PEB
PVOID* ReadOnlyStaticServerData;
//
// Pointer to the ANSI code page data. (PCPTABLEINFO)
// Pointer to the ANSI code page data.
//
PVOID AnsiCodePageData;
PCPTABLEINFO AnsiCodePageData;
//
// Pointer to the OEM code page data. (PCPTABLEINFO)
// Pointer to the OEM code page data.
//
PVOID OemCodePageData;
PCPTABLEINFO OemCodePageData;
//
// Pointer to the Unicode case table data. (PNLSTABLEINFO)
// Pointer to the Unicode case table data.
//
PVOID UnicodeCaseTableData;
PNLSTABLEINFO UnicodeCaseTableData;
//
// The total number of system processors.
@@ -488,7 +612,7 @@ typedef struct _PEB
//
// Pointer to the system GDI shared handle table.
//
PVOID GdiSharedHandleTable;
PGDI_HANDLE_ENTRY GdiSharedHandleTable;
//
// Pointer to the process starter helper.
@@ -588,12 +712,12 @@ typedef struct _PEB
//
// Pointer to the Application SwitchBack Compatibility Engine.
//
PVOID pShimData;
PSHIM_PROCESS_CONTEXT pShimData;
//
// Pointer to the Application Compatibility Engine. // APPCOMPAT_EXE_DATA
// Pointer to the Application Compatibility Engine.
//
PVOID AppCompatInfo;
PAPPCOMPAT_EXE_DATA AppCompatInfo;
//
// CSD version string of the operating system.
@@ -643,15 +767,7 @@ typedef struct _PEB
//
// Packaged process feature state.
//
union
{
ULONG AppModelFeatureState;
struct
{
ULONG ForegroundBoostProcesses : 1;
ULONG AppModelFeatureStateReserved : 31;
};
};
ULONG AppModelFeatureState;
//
// SpareUlongs
@@ -700,7 +816,7 @@ typedef struct _PEB
//
// Reserved.
//
PVOID pImageHeaderHash;
PVOID ImageHeaderHash;
//
// ETW tracing flags.
@@ -789,19 +905,13 @@ typedef struct _PEB
// Extended feature disable mask (AVX). // since WIN11
//
ULONGLONG ExtendedFeatureDisableMask;
} PEB, * PPEB;
} PEB, *PPEB;
#ifdef _WIN64
static_assert(FIELD_OFFSET(PEB, SessionId) == 0x2C0, "FIELD_OFFSET(PEB, SessionId) is incorrect");
//static_assert(sizeof(PEB) == 0x7B0, "Size of PEB is incorrect"); // REDSTONE3
//static_assert(sizeof(PEB) == 0x7B8, "Size of PEB is incorrect"); // REDSTONE4
//static_assert(sizeof(PEB) == 0x7C8, "Size of PEB is incorrect"); // REDSTONE5 // 19H1
static_assert(sizeof(PEB) == 0x7d0, "Size of PEB is incorrect"); // WIN11
#else
static_assert(FIELD_OFFSET(PEB, SessionId) == 0x1D4, "FIELD_OFFSET(PEB, SessionId) is incorrect");
//static_assert(sizeof(PEB) == 0x468, "Size of PEB is incorrect"); // REDSTONE3
//static_assert(sizeof(PEB) == 0x470, "Size of PEB is incorrect"); // REDSTONE4
//static_assert(sizeof(PEB) == 0x480, "Size of PEB is incorrect"); // REDSTONE5 // 19H1
static_assert(sizeof(PEB) == 0x488, "Size of PEB is incorrect"); // WIN11
#endif
@@ -861,10 +971,68 @@ typedef struct _TEB_ACTIVE_FRAME_EX
#define STATIC_UNICODE_BUFFER_LENGTH 261
#define WIN32_CLIENT_INFO_LENGTH 62
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// private
typedef struct _CALLBACKWND
{
HWND hwnd;
ULONG_PTR pwnd;
PACTIVATION_CONTEXT ActCtx;
} CALLBACKWND, *PCALLBACKWND;
// private
typedef struct tagDPICONTEXTINFO
{
ULONG dpiContext;
LOGICAL Dirty;
} DPICONTEXTINFO, *PDPICONTEXTINFO;
// private + rev
typedef struct tagCLIENTINFO
{
ULONG_PTR CI_flags;
ULONG_PTR Spins;
ULONG ExpWinVer;
ULONG CompatFlags;
ULONG CompatFlags2;
ULONG TIFlags;
struct tagDESKTOPINFO* DeskInfo;
PVOID DesktopBase; // ClientDelta before RS2
HHOOK hkCurrent;
ULONG Hooks;
CALLBACKWND CallbackWnd;
ULONG HookCurrent;
LONG InDDEMLCallback;
struct tagCLIENTTHREADINFO* ClientThreadInfo;
ULONG_PTR HookData;
ULONG KeyCache;
UCHAR KeyState[8];
ULONG AsyncKeyCache;
UCHAR AsyncKeyState[8];
UCHAR AsyncKeyStateRecentDown[8];
HKL hKL;
USHORT CodePage;
UCHAR DbcsCFOld[2];
UCHAR DbcsCFNew[2];
MSG msgDbcsCB;
PULONG RegisteredClasses;
HANDLE mmcssHandle;
ULONG_PTR CI_exflags;
DPICONTEXTINFO dci;
} CLIENTINFO, *PCLIENTINFO;
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
// rev - xor key for ReservedForNtRpc
#ifdef _WIN64
#define RPC_THREAD_POINTER_KEY 0xABABABABDEDEDEDEui64
#else
#define RPC_THREAD_POINTER_KEY 0xABABABAB
#endif
/**
* Thread Environment Block (TEB) structure.
*
* \remarks https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-teb
* \sa https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-teb
*/
typedef struct _TEB
{
@@ -914,17 +1082,17 @@ typedef struct _TEB
PVOID CsrClientThread;
//
// Reserved.
// Reserved for win32k.sys
//
PVOID Win32ThreadInfo;
//
// Reserved.
// Reserved for user32.dll
//
ULONG User32Reserved[26];
//
// Reserved.
// Reserved for winsrv.dll
//
ULONG UserReserved[5];
@@ -950,7 +1118,7 @@ typedef struct _TEB
#ifdef _WIN64
//
// Reserved.
// Reserved for floating-point emulation.
//
PVOID SystemReserved1[25];
@@ -981,7 +1149,7 @@ typedef struct _TEB
BOOLEAN PlaceholderHydrationAlwaysExplicit;
//
// Reserved.
// ProjFs and Cloud Files (reparse point) file virtualization.
//
CHAR PlaceholderReserved[10];
@@ -1057,7 +1225,7 @@ typedef struct _TEB
#endif
//
// Reserved for GDI.
// Reserved for GDI (Win32k).
//
GDI_TEB_BATCH GdiTebBatch;
CLIENT_ID RealClientId;
@@ -1066,10 +1234,18 @@ typedef struct _TEB
ULONG GdiClientTID;
PVOID GdiThreadLocalInfo;
//
// Reserved for User32.
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
union
{
//
// User32 (Win32k) thread information.
//
CLIENTINFO Win32ClientInfo;
ULONG_PTR Win32ClientInfoArea[WIN32_CLIENT_INFO_LENGTH];
};
#else
ULONG_PTR Win32ClientInfo[WIN32_CLIENT_INFO_LENGTH];
#endif
//
// Reserved for opengl32.dll
@@ -1109,7 +1285,7 @@ typedef struct _TEB
PVOID TlsSlots[TLS_MINIMUM_AVAILABLE];
//
// Reserved.
// Reserved for TLS.
//
LIST_ENTRY TlsLinks;
@@ -1119,12 +1295,12 @@ typedef struct _TEB
PVOID Vdm;
//
// Reserved.
// Reserved for RPC. The pointer is XOR'ed with RPC_THREAD_POINTER_KEY.
//
PVOID ReservedForNtRpc;
//
// Reserved.
// Reserved for Debugging (DebugActiveProcess).
//
PVOID DbgSsReserved[2];
@@ -1148,7 +1324,7 @@ typedef struct _TEB
GUID ActivityId;
//
// The service creating the thread (svchost).
// The identifier of the service that created the thread. (svchost)
//
PVOID SubProcessTag;
@@ -1173,7 +1349,7 @@ typedef struct _TEB
ULONG GdiBatchCount;
//
// The preferred processor for the curremt thread. (SetThreadIdealProcessor/SetThreadIdealProcessorEx)
// The preferred processor for the current thread. (SetThreadIdealProcessor/SetThreadIdealProcessorEx)
//
union
{
@@ -1199,25 +1375,73 @@ typedef struct _TEB
PVOID ReservedForPerf;
//
// tagSOleTlsData.
// Reserved for Object Linking and Embedding (OLE)
//
PVOID ReservedForOle;
PSOleTlsData ReservedForOle;
//
// Indicates whether the thread is waiting on the loader lock.
//
ULONG WaitingOnLoaderLock;
//
// The saved priority state for the thread.
//
PVOID SavedPriorityState;
//
// Reserved.
//
ULONG_PTR ReservedForCodeCoverage;
//
// Reserved.
//
PVOID ThreadPoolData;
//
// Pointer to the TLS (Thread Local Storage) expansion slots for the thread.
//
PVOID *TlsExpansionSlots;
#ifdef _WIN64
PVOID ChpeV2CpuAreaInfo; // CHPEV2_CPUAREA_INFO // previously DeallocationBStore
PVOID Unused; // previously BStoreLimit
#endif
//
// The generation of the MUI (Multilingual User Interface) data.
//
ULONG MuiGeneration;
//
// Indicates whether the thread is impersonating another security context.
//
ULONG IsImpersonating;
//
// Pointer to the NLS (National Language Support) cache.
//
PVOID NlsCache;
//
// Pointer to the AppCompat/Shim Engine data.
//
PVOID pShimData;
//
// Reserved.
//
ULONG HeapData;
//
// Handle to the current transaction associated with the thread.
//
HANDLE CurrentTransactionHandle;
//
// Pointer to the active frame for the thread.
//
PTEB_ACTIVE_FRAME ActiveFrame;
//
@@ -1225,63 +1449,148 @@ typedef struct _TEB
//
PVOID FlsData;
//
// Pointer to the preferred languages for the current thread. (GetThreadPreferredUILanguages)
//
PVOID PreferredLanguages;
//
// Pointer to the user-preferred languages for the current thread. (GetUserPreferredUILanguages)
//
PVOID UserPrefLanguages;
//
// Pointer to the merged preferred languages for the current thread. (MUI_MERGE_USER_FALLBACK)
//
PVOID MergedPrefLanguages;
//
// Indicates whether the thread is impersonating another user's language settings.
//
ULONG MuiImpersonation;
//
// Reserved.
//
union
{
USHORT CrossTebFlags;
USHORT SpareCrossTebBits : 16;
};
//
// SameTebFlags modify the state and behavior of the current thread.
//
union
{
USHORT SameTebFlags;
struct
{
USHORT SafeThunkCall : 1;
USHORT InDebugPrint : 1;
USHORT HasFiberData : 1;
USHORT SkipThreadAttach : 1;
USHORT InDebugPrint : 1; // Indicates if the thread is currently in a debug print routine.
USHORT HasFiberData : 1; // Indicates if the thread has local fiber-local storage (FLS).
USHORT SkipThreadAttach : 1; // Indicates if the thread should suppress DLL_THREAD_ATTACH notifications.
USHORT WerInShipAssertCode : 1;
USHORT RanProcessInit : 1;
USHORT ClonedThread : 1;
USHORT SuppressDebugMsg : 1;
USHORT RanProcessInit : 1; // Indicates if the thread has run process initialization code.
USHORT ClonedThread : 1; // Indicates if the thread is a clone of a different thread.
USHORT SuppressDebugMsg : 1; // Indicates if the thread should suppress LOAD_DLL_DEBUG_INFO notifications.
USHORT DisableUserStackWalk : 1;
USHORT RtlExceptionAttached : 1;
USHORT InitialThread : 1;
USHORT InitialThread : 1; // Indicates if the thread is the initial thread of the process.
USHORT SessionAware : 1;
USHORT LoadOwner : 1;
USHORT LoadOwner : 1; // Indicates if the thread is the owner of the process loader lock.
USHORT LoaderWorker : 1;
USHORT SkipLoaderInit : 1;
USHORT SkipFileAPIBrokering : 1;
};
};
//
// Pointer to the callback function that is called when a KTM transaction scope is entered.
//
PVOID TxnScopeEnterCallback;
//
// Pointer to the callback function that is called when a KTM transaction scope is exited.
///
PVOID TxnScopeExitCallback;
//
// Pointer to optional context data for use by the application when a KTM transaction scope callback is called.
//
PVOID TxnScopeContext;
//
// The lock count of critical sections for the current thread.
//
ULONG LockCount;
//
// The offset to the WOW64 (Windows on Windows) TEB for the current thread.
//
LONG WowTebOffset;
PVOID ResourceRetValue;
//
// Pointer to the DLL containing the resource (valid after LdrFindResource_U/LdrResFindResource/etc... returns).
//
PLDR_RESLOADER_RET ResourceRetValue;
//
// Reserved for Windows Driver Framework (WDF).
//
PVOID ReservedForWdf;
//
// Reserved for the Microsoft C runtime (CRT).
//
ULONGLONG ReservedForCrt;
//
// The Host Compute Service (HCS) container identifier.
//
GUID EffectiveContainerId;
ULONGLONG LastSleepCounter; // Win11
//
// Reserved for Kernel32!Sleep (SpinWait).
//
ULONGLONG LastSleepCounter; // since Win11
//
// Reserved for Kernel32!Sleep (SpinWait).
//
ULONG SpinCallCount;
//
// Extended feature disable mask (AVX).
//
ULONGLONG ExtendedFeatureDisableMask;
PVOID SchedulerSharedDataSlot; // 24H2
//
// Reserved.
//
PVOID SchedulerSharedDataSlot; // since 24H2
//
// Reserved.
//
PVOID HeapWalkContext;
//
// The primary processor group affinity of the thread.
//
GROUP_AFFINITY PrimaryGroupAffinity;
//
// Read-copy-update (RCU) synchronization context.
//
ULONG Rcu[2];
} TEB, *PTEB;
#ifdef _WIN64
//static_assert(sizeof(TEB) == 0x1850, "Size of TEB is incorrect"); // WIN11
static_assert(FIELD_OFFSET(TEB, SchedulerSharedDataSlot) == 0x1850, "Size of TEB is incorrect"); // WIN11
static_assert(sizeof(TEB) == 0x1878, "Size of TEB is incorrect"); // 24H2
#else
//static_assert(sizeof(TEB) == 0x1018, "Size of TEB is incorrect"); // WIN11
static_assert(FIELD_OFFSET(TEB, SchedulerSharedDataSlot) == 0x1018, "Size of TEB is incorrect"); // WIN11
static_assert(sizeof(TEB) == 0x1038, "Size of TEB is incorrect"); // 24H2
#endif
ntpfapi.h
+360 -120
View File
@@ -9,65 +9,20 @@
// begin_private
//
// Prefetch
typedef enum _PF_BOOT_PHASE_ID
{
PfKernelInitPhase = 0,
PfBootDriverInitPhase = 90,
PfSystemDriverInitPhase = 120,
PfSessionManagerInitPhase = 150,
PfSMRegistryInitPhase = 180,
PfVideoInitPhase = 210,
PfPostVideoInitPhase = 240,
PfBootAcceptedRegistryInitPhase = 270,
PfUserShellReadyPhase = 300,
PfMaxBootPhaseId = 900
} PF_BOOT_PHASE_ID;
typedef enum _PF_ENABLE_STATUS
{
PfSvNotSpecified,
PfSvEnabled,
PfSvDisabled,
PfSvMaxEnableStatus
} PF_ENABLE_STATUS;
typedef struct _PF_TRACE_LIMITS
{
ULONG MaxNumPages;
ULONG MaxNumSections;
LONGLONG TimerPeriod;
} PF_TRACE_LIMITS, *PPF_TRACE_LIMITS;
typedef struct _PF_SYSTEM_PREFETCH_PARAMETERS
{
PF_ENABLE_STATUS EnableStatus[2];
PF_TRACE_LIMITS TraceLimits[2];
ULONG MaxNumActiveTraces;
ULONG MaxNumSavedTraces;
WCHAR RootDirPath[32];
WCHAR HostingApplicationList[128];
} PF_SYSTEM_PREFETCH_PARAMETERS, *PPF_SYSTEM_PREFETCH_PARAMETERS;
#define PF_BOOT_CONTROL_VERSION 1
typedef struct _PF_BOOT_CONTROL
{
ULONG Version;
ULONG DisableBootPrefetching;
} PF_BOOT_CONTROL, *PPF_BOOT_CONTROL;
//
typedef enum _PREFETCHER_INFORMATION_CLASS
{
PrefetcherRetrieveTrace = 1, // q: CHAR[]
PrefetcherSystemParameters, // q: PF_SYSTEM_PREFETCH_PARAMETERS
PrefetcherBootPhase, // s: PF_BOOT_PHASE_ID
PrefetcherSpare1, // PrefetcherRetrieveBootLoaderTrace // q: CHAR[]
PrefetcherBootControl, // s: PF_BOOT_CONTROL
PrefetcherScenarioPolicyControl,
PrefetcherRetrieveTrace = 1, // q: PF_RETRIEVE_TRACE
PrefetcherSystemParameters, // q: PF_SYSTEM_PREFETCH_PARAMETERS
PrefetcherBootPhase, // s: PF_BOOT_PHASE_ID
PrefetcherSpare1, // q: PrefetcherRetrieveBootLoaderTrace
PrefetcherOperationProcess, // s: PF_OPERATION_PROCESS
PrefetcherCacheEntryUpdate, // s: PF_CACHE_ENTRY_UPDATE
PrefetcherSpare2,
PrefetcherAppLaunchScenarioControl,
PrefetcherAppLaunchScenarioControl, // s: PF_APP_LAUNCH_SCENARIO_CONTROL
PrefetcherInformationMax
} PREFETCHER_INFORMATION_CLASS;
@@ -83,8 +38,174 @@ typedef struct _PREFETCHER_INFORMATION
_Inout_ ULONG PrefetcherInformationLength;
} PREFETCHER_INFORMATION, *PPREFETCHER_INFORMATION;
// Superfetch
// rev
typedef struct _PF_RETRIEVE_TRACE
{
UCHAR Buffer[1];
} PF_RETRIEVE_TRACE, *PPF_RETRIEVE_TRACE;
typedef enum _PF_ENABLE_STATUS
{
PfSvNotSpecified,
PfSvEnabled,
PfSvDisabled,
PfSvMaxEnableStatus
} PF_ENABLE_STATUS;
// rev
typedef struct _PF_TRACE_LIMITS
{
ULONG MaxNumPages;
ULONG MaxNumSections;
LONGLONG TimerPeriod;
} PF_TRACE_LIMITS, *PPF_TRACE_LIMITS;
// rev
typedef struct _PF_SYSTEM_PREFETCH_PARAMETERS
{
PF_ENABLE_STATUS EnableStatus[2];
PF_TRACE_LIMITS TraceLimits[2];
ULONG MaxNumActiveTraces;
ULONG MaxNumSavedTraces;
WCHAR RootDirPath[32];
WCHAR HostingApplicationList[128];
} PF_SYSTEM_PREFETCH_PARAMETERS, *PPF_SYSTEM_PREFETCH_PARAMETERS;
typedef enum _PF_BOOT_PHASE_ID
{
PfKernelInitPhase = 0,
PfBootDriverInitPhase = 90,
PfSystemDriverInitPhase = 120,
PfSessionManagerInitPhase = 150,
PfSMRegistryInitPhase = 180,
PfVideoInitPhase = 210,
PfPostVideoInitPhase = 240,
PfBootAcceptedRegistryInitPhase = 270,
PfUserShellReadyPhase = 300,
PfMaxBootPhaseId = 900
} PF_BOOT_PHASE_ID;
#define PF_SN_OPERATION_PROCESS_VERSION 1
typedef enum _PF_OPERATION_PROCESS_ACTION
{
PfSnOpProcessBegin = 0,
PfSnOpProcessEnd = 1,
PfSnOpProcessMax = 2
} PF_OPERATION_PROCESS_ACTION;
typedef struct _PF_OPERATION_PROCESS
{
UCHAR Version;
UCHAR Action; // PF_SYSTEM_OPERATION_PROCESS_ACTION
USHORT Reserved;
ULONG OpFlags;
ULONG Value;
} PF_OPERATION_PROCESS, *PPF_OPERATION_PROCESS;
#define PF_BOOT_CONTROL_VERSION 1
typedef struct _PF_BOOT_CONTROL
{
ULONG Version;
ULONG DisableBootPrefetching;
} PF_BOOT_CONTROL, *PPF_BOOT_CONTROL;
#define PF_CACHE_ENTRY_UPDATE_VERSION 2
typedef struct _PF_CACHE_ENTRY_UPDATE
{
ULONG Version;
UCHAR Name[64];
ULONG NewValue;
} PF_CACHE_ENTRY_UPDATE, *PPF_CACHE_ENTRY_UPDATE;
#define PF_APP_LAUNCH_SCENARIO_CONTROL_VERSION 1
typedef struct _PF_APP_LAUNCH_SCENARIO_CONTROL
{
ULONG Version;
ULONG Enable; // must be non-zero
HANDLE ProcessHandle;
} PF_APP_LAUNCH_SCENARIO_CONTROL, *PPF_APP_LAUNCH_SCENARIO_CONTROL;
//
// Superfetch
//
// rev
typedef enum _SUPERFETCH_INFORMATION_CLASS
{
SuperfetchRetrieveTrace = 1, // q: PF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE // PfGetCompletedTrace
SuperfetchSystemParameters, // q: PF_SYSTEM_SUPERFETCH_PARAMETERS
SuperfetchLogEvent, // s: PF_LOG_EVENT_DATA
SuperfetchGenerateTrace, // s: PF_GENERATE_TRACE_CONTROL
SuperfetchPrefetch,
SuperfetchPfnQuery, // q: PF_PFN_PRIO_REQUEST
SuperfetchPfnSetPriority, // s: PF_PFN_PRIO_REQUEST // MmSetPfnListInfo
SuperfetchPrivSourceQuery, // q: PF_PRIVSOURCE_QUERY_REQUEST
SuperfetchSequenceNumberQuery, // q: ULONG
SuperfetchScenarioPhase, // s: PF_SCENARIO_PHASE_INFO // 10
SuperfetchWorkerPriority, // s: PF_WORKER_PRIORITY_CONTROL
SuperfetchScenarioQuery, // q: PF_SCENARIO_QUERY_INFO
SuperfetchScenarioPrefetch, // s: PF_SCENARIO_PREFETCH_INFO
SuperfetchRobustnessControl, // s: PF_ROBUSTNESS_CONTROL
SuperfetchTimeControl, // s: PF_TIME_CONTROL
SuperfetchMemoryListQuery, // q: PF_MEMORY_LIST_INFO
SuperfetchMemoryRangesQuery, // q: PF_PHYSICAL_MEMORY_RANGE_INFO_V1/V2
SuperfetchTracingControl, // s: PF_ACCESS_TRACING_CONTROL
SuperfetchTrimWhileAgingControl, // s: PF_TRIM_WHILE_AGING_CONTROL
SuperfetchRepurposedByPrefetch, // q: PF_REPURPOSED_BY_PREFETCH_INFO // 20
SuperfetchChannelPowerRequest,
SuperfetchMovePages, // s: PF_PFN_PRIO_REQUEST // MmRelocatePfnList
SuperfetchVirtualQuery, // q: PF_VIRTUAL_QUERY
SuperfetchCombineStatsQuery, // q: PF_PAGECOMBINE_AGGREGATE_STAT
SuperfetchSetMinWsAgeRate, // s: PF_MIN_WS_AGE_RATE_CONTROL
SuperfetchDeprioritizeOldPagesInWs, // s: PF_DEPRIORITIZE_OLD_PAGES
SuperfetchFileExtentsQuery, // q: PF_FILE_EXTENTS_INFO
SuperfetchGpuUtilizationQuery, // q: PF_GPU_UTILIZATION_INFO
SuperfetchPfnSet, // s: PF_PFN_PRIO_REQUEST // since WIN11
SuperfetchInformationMax
} SUPERFETCH_INFORMATION_CLASS;
#define SUPERFETCH_INFORMATION_VERSION 45 // rev
#define SUPERFETCH_INFORMATION_MAGIC ('kuhC') // rev
typedef struct _SUPERFETCH_INFORMATION
{
_In_ ULONG Version;
_In_ ULONG Magic;
_In_ SUPERFETCH_INFORMATION_CLASS SuperfetchInformationClass;
_Inout_ PVOID SuperfetchInformation;
_Inout_ ULONG SuperfetchInformationLength;
} SUPERFETCH_INFORMATION, *PSUPERFETCH_INFORMATION;
// rev
typedef struct _PF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE
{
union
{
struct
{
ULONGLONG RequestType; // Must be 2 for "get completed trace"
ULONGLONG Reserved; // Ignored on input
HANDLE PartitionHandle;
} Input;
struct
{
ULONGLONG TypeFlags; // 0x0000000000180002 on success
ULONGLONG Timestamp; // Scaled TSC value
HANDLE PartitionHandle;
} Output;
//
// Raw view of the buffer for opaque access
//
UCHAR Buffer[ANYSIZE_ARRAY];
};
} PF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE, *PPF_SYSTEM_SUPERFETCH_RETRIEVE_TRACE;
// rev
typedef struct _PF_SYSTEM_SUPERFETCH_PARAMETERS
{
ULONG EnabledComponents;
@@ -135,14 +256,31 @@ typedef enum _PF_EVENT_TYPE
PfEventTypeMax = 32
} PF_EVENT_TYPE;
// rev
#define PF_LOG_EVENT_DATA_VERSION 1
typedef struct _PF_LOG_EVENT_DATA
{
ULONG EventType : 5; // PF_EVENT_TYPE
ULONG Flags : 2;
ULONG DataSize : 25;
ULONG Version; // PF_LOG_EVENT_DATA_VERSION
union
{
ULONG Packed; // [31:7]=DataSize, [6:5]=Flags, [4:0]=EventType (PF_EVENT_TYPE)
struct
{
ULONG DataSize : 25; // in bytes
ULONG Flags : 2;
ULONG EventType: 5; // 2,3,5,27 accepted by the handler // PF_EVENT_TYPE
};
};
PVOID EventData;
} PF_LOG_EVENT_DATA, *PPF_LOG_EVENT_DATA;
HANDLE PartitionHandle;
} PF_LOG_EVENT_DATA , *PPF_LOG_EVENT_DATA ;
typedef struct _PFN_TRIPLET
{
ULONGLONG MaskOrKey; // Compared against identity with 0x1FFFFFFFFFFFE00 mask
ULONGLONG Pfn; // Page frame number
ULONGLONG Flags; // Request/result flags
} PFN_TRIPLET, *PPFN_TRIPLET;
#define PF_PFN_PRIO_REQUEST_VERSION 1
#define PF_PFN_PRIO_REQUEST_QUERY_MEMORY_LIST 0x1
@@ -152,9 +290,15 @@ typedef struct _PF_PFN_PRIO_REQUEST
{
ULONG Version;
ULONG RequestFlags;
ULONG_PTR PfnCount;
SIZE_T PfnCount;
SYSTEM_MEMORY_LIST_INFORMATION MemInfo;
MMPFN_IDENTITY PageData[256];
union
{
// Input: (class 6/16) MmQueryPfnList fills identities here
MMPFN_IDENTITY PageIdentities[256]; // ANYSIZE_ARRAY
// Output: (class 7/29/1D) caller supplies PFN_TRIPLETs here
PFN_TRIPLET Entries[256]; // ANYSIZE_ARRAY
};
} PF_PFN_PRIO_REQUEST, *PPF_PFN_PRIO_REQUEST;
typedef enum _PFS_PRIVATE_PAGE_SOURCE_TYPE
@@ -184,13 +328,14 @@ typedef struct _PF_PRIVSOURCE_INFO
SIZE_T WsPrivatePages;
SIZE_T TotalPrivatePages;
ULONG SessionID;
CHAR ImageName[16];
union {
ULONG_PTR WsSwapPages; // process only PF_PRIVSOURCE_QUERY_WS_SWAP_PAGES.
ULONG_PTR SessionPagedPoolPages; // session only.
ULONG_PTR StoreSizePages; // process only PF_PRIVSOURCE_QUERY_STORE_INFO.
UCHAR ImageName[16];
union
{
SIZE_T WsSwapPages; // process only PF_PRIVSOURCE_QUERY_WS_SWAP_PAGES.
SIZE_T SessionPagedPoolPages; // session only.
SIZE_T StoreSizePages; // process only PF_PRIVSOURCE_QUERY_STORE_INFO.
};
ULONG_PTR WsTotalPages; // process/session only.
SIZE_T WsTotalPages; // process/session only.
ULONG DeepFreezeTimeMs; // process only.
ULONG ModernApp : 1; // process only.
ULONG DeepFrozen : 1; // process only. If set, DeepFreezeTimeMs contains the time at which the freeze occurred
@@ -236,8 +381,30 @@ typedef struct _PF_SCENARIO_PHASE_INFO
ULONG SequenceNumber;
ULONG Flags;
ULONG FUSUserId;
ULONG Reserved0; // pad to 32 bytes (handler expects 32)
ULONG Reserved1;
} PF_SCENARIO_PHASE_INFO, *PPF_SCENARIO_PHASE_INFO;
// rev
typedef struct _PF_WORKER_PRIORITY_CONTROL
{
ULONG Version;
KPRIORITY Priority; // 0..31 (STATUS_INVALID_PARAMETER if >31)
HANDLE PartitionHandle;
} PF_WORKER_PRIORITY_CONTROL, *PPF_WORKER_PRIORITY_CONTROL;
// rev
#define PF_SCENARIO_QUERY_INFO_VERSION 4
// rev
typedef struct _PF_SCENARIO_QUERY_INFO
{
ULONG_PTR Version;
ULONG_PTR Field1;
ULONG_PTR Field2;
ULONG_PTR Field3;
} PF_SCENARIO_QUERY_INFO , *PPF_SCENARIO_QUERY_INFO;
// rev
typedef struct _PF_MEMORY_LIST_NODE
{
@@ -290,6 +457,49 @@ typedef struct _PF_ROBUSTNESS_CONTROL
PF_ROBUST_FILE_ENTRY FileEntries[1];
} PF_ROBUSTNESS_CONTROL, *PPF_ROBUSTNESS_CONTROL;
// rev
typedef struct _PF_SCENARIO_PREFETCH_INFO
{
ULONG Version;
ULONG State;
} PF_SCENARIO_PREFETCH_INFO, *PPF_SCENARIO_PREFETCH_INFO;
// rev
#define PF_TRIM_WHILE_AGING_CONTROL_VERSION_1 1
// rev
typedef enum _PF_TRIM_WHILE_AGING_STATE
{
PfTrimWhileAgingOff = 0,
PfTrimWhileAgingLowPriority = 1,
PfTrimWhileAgingPassive = 2,
PfTrimWhileAgingNormal = 3,
PfTrimWhileAgingAggressive = 4,
PfTrimWhileAgingMax = 5,
} PF_TRIM_WHILE_AGING_STATE, *PPF_TRIM_WHILE_AGING_STATE;
// rev
typedef struct _PF_TRIM_WHILE_AGING_CONTROL_1
{
ULONG Version;
PF_TRIM_WHILE_AGING_STATE TrimWhileAgingState;
BOOLEAN PrivatePageTrimAge;
BOOLEAN SharedPageTrimAge;
USHORT Spare;
} PF_TRIM_WHILE_AGING_CONTROL_1, *PPF_TRIM_WHILE_AGING_CONTROL_1;
#define PF_TRIM_WHILE_AGING_CONTROL_VERSION_2 2
// rev
typedef struct _PF_TRIM_WHILE_AGING_CONTROL_2
{
ULONG Version;
PF_TRIM_WHILE_AGING_STATE TrimWhileAgingState;
UCHAR PrivatePageTrimAge; // 0..7
UCHAR SharedPageTrimAge; // 0..7
USHORT Spare; // must be 0
} PF_TRIM_WHILE_AGING_CONTROL_2, *PPF_TRIM_WHILE_AGING_CONTROL_2;
// rev
typedef struct _PF_TIME_CONTROL
{
@@ -327,17 +537,46 @@ typedef struct _PF_PHYSICAL_MEMORY_RANGE_INFO_V2
{
ULONG Version;
ULONG Flags;
ULONG RangeCount;
PF_PHYSICAL_MEMORY_RANGE Ranges[ANYSIZE_ARRAY];
SIZE_T RangeCount;
PF_PHYSICAL_MEMORY_RANGE Ranges[1];
} PF_PHYSICAL_MEMORY_RANGE_INFO_V2, *PPF_PHYSICAL_MEMORY_RANGE_INFO_V2;
// rev
typedef struct _PF_START_TRACE_CONTROL
{
struct
{
ULONG Type;
ULONG Mode;
ULONG Flags;
ULONG Restart;
};
struct
{
HANDLE PartitionHandle; // in
HANDLE TraceHandleOut; // out when Restart == 0
};
} PF_START_TRACE_CONTROL, *PPF_START_TRACE_CONTROL;
// rev
#define PF_ACCESS_TRACING_CONTROL_VERSION 1
// rev
typedef struct _PF_ACCESS_TRACING_CONTROL
{
ULONG Version;
ULONG Command;
ULONG ComponentMask;
} PF_ACCESS_TRACING_CONTROL, *PPF_ACCESS_TRACING_CONTROL;
// rev
#define PF_REPURPOSED_BY_PREFETCH_INFO_VERSION 1
// rev
typedef struct _PF_REPURPOSED_BY_PREFETCH_INFO
{
ULONG Version;
ULONG Version; // PF_REPURPOSED_BY_PREFETCH_INFO_VERSION
ULONG Reserved;
SIZE_T RepurposedByPrefetch;
} PF_REPURPOSED_BY_PREFETCH_INFO, *PPF_REPURPOSED_BY_PREFETCH_INFO;
@@ -363,6 +602,18 @@ typedef struct _PF_VIRTUAL_QUERY
HANDLE ProcessHandle;
} PF_VIRTUAL_QUERY, *PPF_VIRTUAL_QUERY;
// rev
#define PF_PAGECOMBINE_AGGREGATE_STAT_VERSION 1
// rev
typedef struct _PF_PAGECOMBINE_AGGREGATE_STAT
{
ULONG Version;
ULONG CombineScanCount;
ULONG CombinedBlocksInUse;
ULONG SumCombinedBlocksReferenceCount;
} PF_PAGECOMBINE_AGGREGATE_STAT, *PPF_PAGECOMBINE_AGGREGATE_STAT;
// rev
#define PF_MIN_WS_AGE_RATE_CONTROL_VERSION 1
@@ -370,7 +621,7 @@ typedef struct _PF_VIRTUAL_QUERY
typedef struct _PF_MIN_WS_AGE_RATE_CONTROL
{
ULONG Version;
ULONG SecondsToOldestAge;
ULONG SecondsToOldestAgeRate;
} PF_MIN_WS_AGE_RATE_CONTROL, *PPF_MIN_WS_AGE_RATE_CONTROL;
// rev
@@ -393,6 +644,42 @@ typedef struct _PF_DEPRIORITIZE_OLD_PAGES
};
} PF_DEPRIORITIZE_OLD_PAGES, *PPF_DEPRIORITIZE_OLD_PAGES;
// rev
#define PF_FILE_EXTENTS_INFO_VERSION 1
// rev
typedef struct _PF_FILE_EXTENTS_INFO
{
ULONG Version;
PWSTR FilePath;
ULONG FilePathSize;
ULONG VolumePathSize;
LARGE_INTEGER FileIndexNumber;
ULONG VolumeSerialNumber;
RETRIEVAL_POINTERS_BUFFER ExtentsBuffer;
ULONGLONG ExtentsBufferSize;
} PF_FILE_EXTENTS_INFO, *PPF_FILE_EXTENTS_INFO;
// rev
#define PF_FILE_EXTENTS_INFO_VERSION2 2
typedef struct _PF_FILE_EXTENTS_INFO_V2
{
ULONG Version; // must be 2
ULONG Reserved0;
PWSTR PathUtf16;
ULONG PathBytes; // must be even, within bounds
ULONG PathMeta; // used to compute an index (>>1) tested for '\\'
ULONG ParamA; // must be nonzero and < PathBytes (per checks)
ULONG Reserved1;
PVOID OutMeta0;
PVOID OutBuffer;
ULONG OutBufferBytesRequested;
ULONG Reserved2;
} PF_FILE_EXTENTS_INFO_V2, *PPF_FILE_EXTENTS_INFO_V2;
// rev
#define PF_GPU_UTILIZATION_INFO_VERSION 1
@@ -404,53 +691,6 @@ typedef struct _PF_GPU_UTILIZATION_INFO
ULONGLONG GpuTime;
} PF_GPU_UTILIZATION_INFO, *PPF_GPU_UTILIZATION_INFO;
// rev
typedef enum _SUPERFETCH_INFORMATION_CLASS
{
SuperfetchRetrieveTrace = 1, // q: CHAR[]
SuperfetchSystemParameters, // q: PF_SYSTEM_SUPERFETCH_PARAMETERS
SuperfetchLogEvent, // s: PF_LOG_EVENT_DATA
SuperfetchGenerateTrace, // s: NULL
SuperfetchPrefetch,
SuperfetchPfnQuery, // q: PF_PFN_PRIO_REQUEST
SuperfetchPfnSetPriority,
SuperfetchPrivSourceQuery, // q: PF_PRIVSOURCE_QUERY_REQUEST
SuperfetchSequenceNumberQuery, // q: ULONG
SuperfetchScenarioPhase, // 10
SuperfetchWorkerPriority, // s: KPRIORITY
SuperfetchScenarioQuery, // q: PF_SCENARIO_PHASE_INFO
SuperfetchScenarioPrefetch,
SuperfetchRobustnessControl, // s: PF_ROBUSTNESS_CONTROL
SuperfetchTimeControl, // s: PF_TIME_CONTROL
SuperfetchMemoryListQuery, // q: PF_MEMORY_LIST_INFO
SuperfetchMemoryRangesQuery, // q: PF_PHYSICAL_MEMORY_RANGE_INFO
SuperfetchTracingControl,
SuperfetchTrimWhileAgingControl,
SuperfetchRepurposedByPrefetch, // q: PF_REPURPOSED_BY_PREFETCH_INFO // 20
SuperfetchChannelPowerRequest,
SuperfetchMovePages,
SuperfetchVirtualQuery, // q: PF_VIRTUAL_QUERY
SuperfetchCombineStatsQuery,
SuperfetchSetMinWsAgeRate, // s: PF_MIN_WS_AGE_RATE_CONTROL
SuperfetchDeprioritizeOldPagesInWs, // s: PF_DEPRIORITIZE_OLD_PAGES
SuperfetchFileExtentsQuery, // q: PF_FILE_EXTENTS_INFO
SuperfetchGpuUtilizationQuery, // q: PF_GPU_UTILIZATION_INFO
SuperfetchPfnSet, // s: PF_PFN_PRIO_REQUEST // since WIN11
SuperfetchInformationMax
} SUPERFETCH_INFORMATION_CLASS;
#define SUPERFETCH_INFORMATION_VERSION 45 // rev
#define SUPERFETCH_INFORMATION_MAGIC ('kuhC') // rev
typedef struct _SUPERFETCH_INFORMATION
{
_In_ ULONG Version;
_In_ ULONG Magic;
_In_ SUPERFETCH_INFORMATION_CLASS SuperfetchInformationClass;
_Inout_ PVOID SuperfetchInformation;
_Inout_ ULONG SuperfetchInformationLength;
} SUPERFETCH_INFORMATION, *PSUPERFETCH_INFORMATION;
// end_private
#endif
#endif // _NTPFAPI_H
ntpnpapi.h
+8 -14
View File
@@ -107,7 +107,7 @@ typedef enum _PLUGPLAY_CONTROL_CLASS
MaxPlugPlayControl
} PLUGPLAY_CONTROL_CLASS, *PPLUGPLAY_CONTROL_CLASS;
// pub
// private
typedef enum _DEVICE_RELATION_TYPE
{
BusRelations,
@@ -119,7 +119,7 @@ typedef enum _DEVICE_RELATION_TYPE
TransportRelations
} DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE;
// pub
// private
typedef enum _BUS_QUERY_ID_TYPE
{
BusQueryDeviceID = 0, // <Enumerator>\<Enumerator-specific device id>
@@ -130,14 +130,14 @@ typedef enum _BUS_QUERY_ID_TYPE
BusQueryContainerID = 5 // unique id of the device's physical container
} BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE;
// pub
// private
typedef enum _DEVICE_TEXT_TYPE
{
DeviceTextDescription = 0, // DeviceDesc property
DeviceTextLocationInformation = 1 // DeviceLocation property
} DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE;
// pub
// private
typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE
{
DeviceUsageTypeUndefined,
@@ -159,7 +159,7 @@ NtGetPlugPlayEvent(
_Out_writes_bytes_(EventBufferSize) PPLUGPLAY_EVENT_BLOCK EventBlock,
_In_ ULONG EventBufferSize
);
#endif
#endif // (PHNT_VERSION < PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
@@ -170,8 +170,6 @@ NtPlugPlayControl(
_In_ ULONG PnPControlDataLength
);
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -193,17 +191,13 @@ NtDisableLastKnownGood(
VOID
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReplacePartitionUnit(
_In_ PUNICODE_STRING TargetInstancePath,
_In_ PUNICODE_STRING SpareInstancePath,
_In_ PCUNICODE_STRING TargetInstancePath,
_In_ PCUNICODE_STRING SpareInstancePath,
_In_ ULONG Flags
);
#endif
#endif
#endif // _NTPNPAPI_H
ntpoapi.h
+1205 -242
View File
File diff suppressed because it is too large Load Diff
ntpsapi.h
+1277 -819
View File
File diff suppressed because it is too large Load Diff
ntregapi.h
+393 -274
View File
File diff suppressed because it is too large Load Diff
ntrtl.h
+2707 -1116
View File
File diff suppressed because it is too large Load Diff
ntsam.h
+390 -162
View File
File diff suppressed because it is too large Load Diff
ntseapi.h
+734 -215
View File
File diff suppressed because it is too large Load Diff
ntsmss.h
+5 -5
View File
@@ -138,10 +138,10 @@ typedef struct _SBFOREIGNSESSIONCOMPLETE
// private
typedef struct _SBCREATEPROCESSIN
{
_In_ PUNICODE_STRING ImageFileName;
_In_ PUNICODE_STRING CurrentDirectory;
_In_ PUNICODE_STRING CommandLine;
_In_opt_ PUNICODE_STRING DefaultLibPath;
_In_ PCUNICODE_STRING ImageFileName;
_In_ PCUNICODE_STRING CurrentDirectory;
_In_ PCUNICODE_STRING CommandLine;
_In_opt_ PCUNICODE_STRING DefaultLibPath;
_In_ ULONG Flags; // SMP_*
_In_ ULONG DefaultDebugFlags;
} SBCREATEPROCESSIN, *PSBCREATEPROCESSIN;
@@ -193,7 +193,7 @@ NTSYSAPI
NTSTATUS
NTAPI
RtlConnectToSm(
_In_opt_ PUNICODE_STRING ApiPortName,
_In_opt_ PCUNICODE_STRING ApiPortName,
_In_opt_ HANDLE ApiPortHandle,
_In_ ULONG ProcessImageType,
_Out_ PHANDLE SmssConnection
ntstrsafe.h
+1
View File
@@ -9,6 +9,7 @@
* Copyright (c) Microsoft Corp. All rights reserved. *
* *
******************************************************************/
#ifndef _NTSTRSAFE_H_INCLUDED_
#define _NTSTRSAFE_H_INCLUDED_
#if (_MSC_VER > 1000)
ntsxs.h
+40 -34
View File
@@ -29,9 +29,7 @@ typedef enum _ACTCTX_COMPATIBILITY_ELEMENT_TYPE
ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MITIGATION,
ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MAXVERSIONTESTED
} ACTCTX_COMPATIBILITY_ELEMENT_TYPE;
#endif
#include <pshpack4.h>
#endif // (PHNT_MODE == PHNT_MODE_KERNEL)
typedef struct _ACTIVATION_CONTEXT_DATA
{
@@ -93,7 +91,7 @@ typedef struct _ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_HEADER
typedef struct _ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY
{
ULONG Flags;
ULONG Flags; // ACTIVATION_CONTEXT_DATA_ASSEMBLY_ROSTER_ENTRY_*
ULONG PseudoKey;
ULONG AssemblyNameOffset; // to WCHAR[], from ACTIVATION_CONTEXT_DATA base
ULONG AssemblyNameLength;
@@ -178,7 +176,7 @@ typedef struct _ACTIVATION_CONTEXT_GUID_SECTION_ENTRY
typedef struct _ACTIVATION_CONTEXT_GUID_SECTION_HASH_TABLE
{
ULONG BucketTableEntryCount;
ULONG BucketTableOffset; // to ACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET, from section header
ULONG BucketTableOffset; // to ACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET[], from section header
} ACTIVATION_CONTEXT_GUID_SECTION_HASH_TABLE, *PACTIVATION_CONTEXT_GUID_SECTION_HASH_TABLE;
typedef struct _ACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET
@@ -188,7 +186,7 @@ typedef struct _ACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET
} ACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET, *PACTIVATION_CONTEXT_GUID_SECTION_HASH_BUCKET;
// winnt.h - known section IDs
// #define ACTIVATION_CONTEXT_SECTION_ASSEMBLY_INFORMATION (1) // ACTIVATION_CONTEXT_SECTION_ASSEMBLY_INFORMATION + ACTIVATION_CONTEXT_DATA_ASSEMBLY_GLOBAL_INFORMATION
// #define ACTIVATION_CONTEXT_SECTION_ASSEMBLY_INFORMATION (1) // ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION + ACTIVATION_CONTEXT_DATA_ASSEMBLY_GLOBAL_INFORMATION
// #define ACTIVATION_CONTEXT_SECTION_DLL_REDIRECTION (2) // ACTIVATION_CONTEXT_DATA_DLL_REDIRECTION
// #define ACTIVATION_CONTEXT_SECTION_WINDOW_CLASS_REDIRECTION (3) // ACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION
// #define ACTIVATION_CONTEXT_SECTION_COM_SERVER_REDIRECTION (4) // ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION
@@ -218,11 +216,19 @@ typedef struct _ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION
ULONG ManifestPathType; // ACTIVATION_CONTEXT_PATH_TYPE_*
ULONG ManifestPathLength;
ULONG ManifestPathOffset; // to WCHAR[], from section header
LARGE_INTEGER ManifestLastWriteTime;
struct
{
ULONG LowPart;
LONG HighPart;
} ManifestLastWriteTime;
ULONG PolicyPathType; // ACTIVATION_CONTEXT_PATH_TYPE_*
ULONG PolicyPathLength;
ULONG PolicyPathOffset; // to WCHAR[], from section header
LARGE_INTEGER PolicyLastWriteTime;
struct
{
ULONG LowPart;
LONG HighPart;
} PolicyLastWriteTime;
ULONG MetadataSatelliteRosterIndex;
ULONG Unused2;
ULONG ManifestVersionMajor;
@@ -280,7 +286,7 @@ typedef struct _ACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION
ULONG Size;
ULONG Flags;
ULONG VersionSpecificClassNameLength;
ULONG VersionSpecificClassNameOffset; // to WHCAR[], from this struct base
ULONG VersionSpecificClassNameOffset; // to WCHAR[], from this struct base
ULONG DllNameLength;
ULONG DllNameOffset; // to WCHAR[], from section header
} ACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION, *PACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION;
@@ -304,7 +310,7 @@ typedef struct _ACTIVATION_CONTEXT_DATA_WINDOW_CLASS_REDIRECTION
typedef struct _ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION
{
ULONG Size;
ULONG Flags;
ULONG Flags; // ACTIVATION_CONTEXT_DATA_COM_SERVER_MISCSTATUS_HAS_*
ULONG ThreadingModel; // ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_THREADING_MODEL_*
GUID ReferenceClsid;
GUID ConfiguredClsid;
@@ -316,11 +322,11 @@ typedef struct _ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION
ULONG ProgIdOffset; // to WCHAR[], from this struct base
ULONG ShimDataLength;
ULONG ShimDataOffset; // to ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM, from this struct base
ULONG MiscStatusDefault;
ULONG MiscStatusContent;
ULONG MiscStatusThumbnail;
ULONG MiscStatusIcon;
ULONG MiscStatusDocPrint;
ULONG MiscStatusDefault; // OLEMISC_* oleidl.h
ULONG MiscStatusContent; // OLEMISC_* oleidl.h
ULONG MiscStatusThumbnail; // OLEMISC_* oleidl.h
ULONG MiscStatusIcon; // OLEMISC_* oleidl.h
ULONG MiscStatusDocPrint; // OLEMISC_* oleidl.h
} ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION, *PACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION;
#define ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION_SHIM_TYPE_OTHER 1
@@ -368,14 +374,14 @@ typedef struct _ACTIVATION_CONTEXT_DATA_TYPE_LIBRARY_VERSION
typedef struct _ACTIVATION_CONTEXT_DATA_COM_TYPE_LIBRARY_REDIRECTION
{
ULONG Size;
ULONG Flags;
ULONG NameLength;
ULONG NameOffset; // to WCHAR[], from section header
USHORT ResourceId;
USHORT LibraryFlags; // LIBFLAG_* oaidl.h
ULONG HelpDirLength;
ULONG HelpDirOffset; // to WCHAR[], from this struct base
ULONG Size;
ULONG Flags;
ULONG NameLength;
ULONG NameOffset; // to WCHAR[], from section header
USHORT ResourceId;
USHORT LibraryFlags; // LIBFLAG_* oaidl.h
ULONG HelpDirLength;
ULONG HelpDirOffset; // to WCHAR[], from this struct base
ACTIVATION_CONTEXT_DATA_TYPE_LIBRARY_VERSION Version;
} ACTIVATION_CONTEXT_DATA_COM_TYPE_LIBRARY_REDIRECTION, *PACTIVATION_CONTEXT_DATA_COM_TYPE_LIBRARY_REDIRECTION;
@@ -392,13 +398,13 @@ typedef struct _ACTIVATION_CONTEXT_DATA_COM_PROGID_REDIRECTION
typedef struct _ACTIVATION_CONTEXT_DATA_CLR_SURROGATE
{
ULONG Size;
ULONG Flags;
GUID SurrogateIdent;
ULONG VersionOffset;
ULONG VersionLength;
ULONG TypeNameOffset;
ULONG TypeNameLength; // to WCHAR[], from this struct base
ULONG Size;
ULONG Flags;
GUID SurrogateIdent;
ULONG VersionOffset; // to WCHAR[], from this struct base
ULONG VersionLength;
ULONG TypeNameOffset; // to WCHAR[], from this struct base
ULONG TypeNameLength;
} ACTIVATION_CONTEXT_DATA_CLR_SURROGATE, *PACTIVATION_CONTEXT_DATA_CLR_SURROGATE;
#define ACTIVATION_CONTEXT_DATA_APPLICATION_SETTINGS_FORMAT_LONGHORN 1
@@ -438,8 +444,6 @@ typedef struct _ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION_LEGACY
COMPATIBILITY_CONTEXT_ELEMENT_LEGACY Elements[ANYSIZE_ARRAY];
} ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION_LEGACY, *PACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION_LEGACY;
#include <poppack.h>
// begin_private
typedef struct _ASSEMBLY_STORAGE_MAP_ENTRY
@@ -464,7 +468,8 @@ typedef struct _ACTIVATION_CONTEXT *PACTIVATION_CONTEXT;
#define ACTIVATION_CONTEXT_NOTIFICATION_ZOMBIFY 2
#define ACTIVATION_CONTEXT_NOTIFICATION_USED 3
typedef VOID (NTAPI *PACTIVATION_CONTEXT_NOTIFY_ROUTINE)(
typedef _Function_class_(ACTIVATION_CONTEXT_NOTIFY_ROUTINE)
VOID NTAPI ACTIVATION_CONTEXT_NOTIFY_ROUTINE(
_In_ ULONG NotificationType, // ACTIVATION_CONTEXT_NOTIFICATION_*
_In_ PACTIVATION_CONTEXT ActivationContext,
_In_ PACTIVATION_CONTEXT_DATA ActivationContextData,
@@ -472,6 +477,7 @@ typedef VOID (NTAPI *PACTIVATION_CONTEXT_NOTIFY_ROUTINE)(
_In_opt_ PVOID NotificationData,
_Inout_ PBOOLEAN DisableThisNotification
);
typedef ACTIVATION_CONTEXT_NOTIFY_ROUTINE* PACTIVATION_CONTEXT_NOTIFY_ROUTINE;
typedef struct _ACTIVATION_CONTEXT
{
@@ -512,4 +518,4 @@ typedef struct _ACTIVATION_CONTEXT_STACK
// end_private
#endif
#endif // _NTSXS_H
nttmapi.h
+6 -88
View File
@@ -7,7 +7,6 @@
#ifndef _NTTMAPI_H
#define _NTTMAPI_H
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -15,13 +14,11 @@ NtCreateTransactionManager(
_Out_ PHANDLE TmHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PUNICODE_STRING LogFileName,
_In_opt_ PCUNICODE_STRING LogFileName,
_In_opt_ ULONG CreateOptions,
_In_opt_ ULONG CommitStrength
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -29,23 +26,19 @@ NtOpenTransactionManager(
_Out_ PHANDLE TmHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PUNICODE_STRING LogFileName,
_In_opt_ PCUNICODE_STRING LogFileName,
_In_opt_ LPGUID TmIdentity,
_In_opt_ ULONG OpenOptions
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRenameTransactionManager(
_In_ PUNICODE_STRING LogFileName,
_In_ PCUNICODE_STRING LogFileName,
_In_ LPGUID ExistingTransactionManagerGuid
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -53,18 +46,14 @@ NtRollforwardTransactionManager(
_In_ HANDLE TransactionManagerHandle,
_In_opt_ PLARGE_INTEGER TmVirtualClock
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRecoverTransactionManager(
_In_ HANDLE TransactionManagerHandle
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -75,9 +64,7 @@ NtQueryInformationTransactionManager(
_In_ ULONG TransactionManagerInformationLength,
_Out_opt_ PULONG ReturnLength
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -87,9 +74,7 @@ NtSetInformationTransactionManager(
_In_reads_bytes_(TransactionManagerInformationLength) PVOID TransactionManagerInformation,
_In_ ULONG TransactionManagerInformationLength
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -100,9 +85,7 @@ NtEnumerateTransactionObject(
_In_ ULONG ObjectCursorLength,
_Out_ PULONG ReturnLength
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -116,11 +99,9 @@ NtCreateTransaction(
_In_opt_ ULONG IsolationLevel,
_In_opt_ ULONG IsolationFlags,
_In_opt_ PLARGE_INTEGER Timeout,
_In_opt_ PUNICODE_STRING Description
_In_opt_ PCUNICODE_STRING Description
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -131,9 +112,7 @@ NtOpenTransaction(
_In_ LPGUID Uow,
_In_opt_ HANDLE TmHandle
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -144,9 +123,7 @@ NtQueryInformationTransaction(
_In_ ULONG TransactionInformationLength,
_Out_opt_ PULONG ReturnLength
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -156,9 +133,7 @@ NtSetInformationTransaction(
_In_reads_bytes_(TransactionInformationLength) PVOID TransactionInformation,
_In_ ULONG TransactionInformationLength
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -166,9 +141,7 @@ NtCommitTransaction(
_In_ HANDLE TransactionHandle,
_In_ BOOLEAN Wait
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -176,9 +149,7 @@ NtRollbackTransaction(
_In_ HANDLE TransactionHandle,
_In_ BOOLEAN Wait
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -192,9 +163,7 @@ NtCreateEnlistment(
_In_ NOTIFICATION_MASK NotificationMask,
_In_opt_ PVOID EnlistmentKey
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -205,9 +174,7 @@ NtOpenEnlistment(
_In_ LPGUID EnlistmentGuid,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -218,9 +185,7 @@ NtQueryInformationEnlistment(
_In_ ULONG EnlistmentInformationLength,
_Out_opt_ PULONG ReturnLength
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -230,9 +195,7 @@ NtSetInformationEnlistment(
_In_reads_bytes_(EnlistmentInformationLength) PVOID EnlistmentInformation,
_In_ ULONG EnlistmentInformationLength
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -240,9 +203,7 @@ NtRecoverEnlistment(
_In_ HANDLE EnlistmentHandle,
_In_opt_ PVOID EnlistmentKey
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -250,9 +211,7 @@ NtPrePrepareEnlistment(
_In_ HANDLE EnlistmentHandle,
_In_opt_ PLARGE_INTEGER TmVirtualClock
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -260,9 +219,7 @@ NtPrepareEnlistment(
_In_ HANDLE EnlistmentHandle,
_In_opt_ PLARGE_INTEGER TmVirtualClock
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -270,9 +227,7 @@ NtCommitEnlistment(
_In_ HANDLE EnlistmentHandle,
_In_opt_ PLARGE_INTEGER TmVirtualClock
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -280,9 +235,7 @@ NtRollbackEnlistment(
_In_ HANDLE EnlistmentHandle,
_In_opt_ PLARGE_INTEGER TmVirtualClock
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -290,9 +243,7 @@ NtPrePrepareComplete(
_In_ HANDLE EnlistmentHandle,
_In_opt_ PLARGE_INTEGER TmVirtualClock
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -300,9 +251,7 @@ NtPrepareComplete(
_In_ HANDLE EnlistmentHandle,
_In_opt_ PLARGE_INTEGER TmVirtualClock
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -310,9 +259,7 @@ NtCommitComplete(
_In_ HANDLE EnlistmentHandle,
_In_opt_ PLARGE_INTEGER TmVirtualClock
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -320,9 +267,7 @@ NtReadOnlyEnlistment(
_In_ HANDLE EnlistmentHandle,
_In_opt_ PLARGE_INTEGER TmVirtualClock
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -330,9 +275,7 @@ NtRollbackComplete(
_In_ HANDLE EnlistmentHandle,
_In_opt_ PLARGE_INTEGER TmVirtualClock
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -340,9 +283,7 @@ NtSinglePhaseReject(
_In_ HANDLE EnlistmentHandle,
_In_opt_ PLARGE_INTEGER TmVirtualClock
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -353,11 +294,9 @@ NtCreateResourceManager(
_In_ LPGUID RmGuid,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ ULONG CreateOptions,
_In_opt_ PUNICODE_STRING Description
_In_opt_ PCUNICODE_STRING Description
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -368,18 +307,14 @@ NtOpenResourceManager(
_In_opt_ LPGUID ResourceManagerGuid,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRecoverResourceManager(
_In_ HANDLE ResourceManagerHandle
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -392,9 +327,7 @@ NtGetNotificationResourceManager(
_In_ ULONG Asynchronous,
_In_opt_ ULONG_PTR AsynchronousContext
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -405,9 +338,7 @@ NtQueryInformationResourceManager(
_In_ ULONG ResourceManagerInformationLength,
_Out_opt_ PULONG ReturnLength
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -417,9 +348,7 @@ NtSetInformationResourceManager(
_In_reads_bytes_(ResourceManagerInformationLength) PVOID ResourceManagerInformation,
_In_ ULONG ResourceManagerInformationLength
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -430,9 +359,7 @@ NtRegisterProtocolAddressInformation(
_In_ PVOID ProtocolInformation,
_In_opt_ ULONG CreateOptions
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -442,9 +369,7 @@ NtPropagationComplete(
_In_ ULONG BufferLength,
_In_ PVOID Buffer
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -453,10 +378,7 @@ NtPropagationFailed(
_In_ ULONG RequestCookie,
_In_ NTSTATUS PropStatus
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
// private
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -464,16 +386,12 @@ NtFreezeTransactions(
_In_ PLARGE_INTEGER FreezeTimeout,
_In_ PLARGE_INTEGER ThawTimeout
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
// private
NTSYSCALLAPI
NTSTATUS
NTAPI
NtThawTransactions(
VOID
);
#endif
#endif
#endif // _NTTMAPI_H
nttp.h
+397 -14
View File
@@ -12,23 +12,48 @@
typedef struct _TP_ALPC TP_ALPC, *PTP_ALPC;
// private
typedef VOID (NTAPI *PTP_ALPC_CALLBACK)(
/**
* Defines the callback function for ALPC completion notifications.
*
* \param[in,out] Instance A pointer to a TP_CALLBACK_INSTANCE structure that defines the callback instance.
* \param[in,out] Context Optional application-defined data specified when the ALPC completion object was created.
* \param[in] Alpc A pointer to the ALPC completion object.
*/
typedef _Function_class_(TP_ALPC_CALLBACK)
VOID NTAPI TP_ALPC_CALLBACK(
_Inout_ PTP_CALLBACK_INSTANCE Instance,
_Inout_opt_ PVOID Context,
_In_ PTP_ALPC Alpc
);
typedef TP_ALPC_CALLBACK *PTP_ALPC_CALLBACK;
// rev
typedef VOID (NTAPI *PTP_ALPC_CALLBACK_EX)(
/**
* Defines the extended callback function for ALPC completion notifications.
*
* \param[in,out] Instance A pointer to a TP_CALLBACK_INSTANCE structure that defines the callback instance.
* \param[in,out] Context Optional application-defined data specified when the ALPC completion object was created.
* \param[in] Alpc A pointer to the ALPC completion object.
* \param[in] ApcContext A pointer to additional APC context data for the completion callback.
*/
typedef _Function_class_(TP_ALPC_CALLBACK_EX)
VOID NTAPI TP_ALPC_CALLBACK_EX(
_Inout_ PTP_CALLBACK_INSTANCE Instance,
_Inout_opt_ PVOID Context,
_In_ PTP_ALPC Alpc,
_In_ PVOID ApcContext
);
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
typedef TP_ALPC_CALLBACK_EX *PTP_ALPC_CALLBACK_EX;
// winbase:CreateThreadpool
/**
* Allocates a new pool of threads to execute callbacks.
*
* \param[out] PoolReturn Pointer to a variable that receives the address of the newly allocated thread pool.
* \param[in] Reserved Reserved for future use. Must be NULL.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-createthreadpool
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -38,6 +63,13 @@ TpAllocPool(
);
// winbase:CloseThreadpool
/**
* Closes the specified thread pool.
*
* \param[in,out] Pool A pointer to a TP_POOL structure that defines the thread pool.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-closethreadpool
*/
NTSYSAPI
VOID
NTAPI
@@ -46,6 +78,14 @@ TpReleasePool(
);
// winbase:SetThreadpoolThreadMaximum
/**
* Sets the maximum number of threads that the specified thread pool can allocate to process callbacks.
*
* \param[in,out] Pool A pointer to a TP_POOL structure that defines the thread pool.
* \param[in] MaxThreads The maximum number of threads.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-setthreadpoolthreadmaximum
*/
NTSYSAPI
VOID
NTAPI
@@ -55,6 +95,14 @@ TpSetPoolMaxThreads(
);
// winbase:SetThreadpoolThreadMinimum
/**
* Sets the minimum number of threads that the specified thread pool must make available to process callbacks.
*
* \param[in,out] Pool A pointer to a TP_POOL structure that defines the thread pool.
* \param[in] MinThreads The minimum number of threads.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-setthreadpoolthreadminimum
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -63,8 +111,15 @@ TpSetPoolMinThreads(
_In_ ULONG MinThreads
);
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
// winbase:QueryThreadpoolStackInformation
/**
* Retrieves the stack reserve and commit sizes for threads in the specified thread pool.
*
* \param[in] Pool A pointer to a TP_POOL structure that defines the thread pool.
* \param[out] PoolStackInformation A pointer to a TP_POOL_STACK_INFORMATION structure that receives the stack reserve and commit size.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-querythreadpoolstackinformation
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -74,6 +129,14 @@ TpQueryPoolStackInformation(
);
// winbase:SetThreadpoolStackInformation
/**
* Sets the stack reserve and commit sizes for threads in the specified thread pool.
*
* \param[in,out] Pool A pointer to a TP_POOL structure that defines the thread pool.
* \param[in] PoolStackInformation A pointer to a TP_POOL_STACK_INFORMATION structure that specifies stack reserve and commit sizes.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-setthreadpoolstackinformation
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -83,6 +146,13 @@ TpSetPoolStackInformation(
);
// rev
/**
* Sets the base priority for worker threads in the specified thread pool.
*
* \param[in,out] Pool A pointer to a TP_POOL structure that defines the thread pool.
* \param[in] BasePriority The new base priority value for worker threads.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -90,17 +160,29 @@ TpSetPoolThreadBasePriority(
_Inout_ PTP_POOL Pool,
_In_ ULONG BasePriority
);
#endif
// winbase:CreateThreadpoolCleanupGroup
/**
* Creates a cleanup group that applications can use to track one or more thread pool callbacks.
*
* \param[out] CleanupGroup A pointer to a TP_CLEANUP_GROUP structure of the newly allocated cleanup group.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-createthreadpoolcleanupgroup
*/
NTSYSAPI
NTSTATUS
NTAPI
TpAllocCleanupGroup(
_Out_ PTP_CLEANUP_GROUP *CleanupGroupReturn
_Out_ PTP_CLEANUP_GROUP *CleanupGroup
);
// winbase:CloseThreadpoolCleanupGroup
/**
* Closes the specified cleanup group.
*
* \param[in,out] CleanupGroup A pointer to a TP_CLEANUP_GROUP structure that defines the cleanup group.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-closethreadpoolcleanupgroup
*/
NTSYSAPI
VOID
NTAPI
@@ -109,6 +191,14 @@ TpReleaseCleanupGroup(
);
// winbase:CloseThreadpoolCleanupGroupMembers
/**
* Releases the members of the specified cleanup group.
*
* \param[in,out] CleanupGroup A pointer to a TP_CLEANUP_GROUP structure that defines the cleanup group.
* \param[in] CancelPendingCallbacks If TRUE, pending callbacks that have not started are canceled.
* \param[in,out] CleanupParameter Optional application-defined context to pass to cleanup callbacks.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-closethreadpoolcleanupgroupmembers
*/
NTSYSAPI
VOID
NTAPI
@@ -119,6 +209,13 @@ TpReleaseCleanupGroupMembers(
);
// winbase:SetEventWhenCallbackReturns
/**
* Sets an event object when the current callback function returns.
*
* \param[in,out] Instance A pointer to a TP_CALLBACK_INSTANCE structure that defines the callback instance.
* \param[in] Event A handle to an event object.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-seteventwhencallbackreturns
*/
NTSYSAPI
VOID
NTAPI
@@ -128,6 +225,14 @@ TpCallbackSetEventOnCompletion(
);
// winbase:ReleaseSemaphoreWhenCallbackReturns
/**
* Releases a semaphore when the current callback function returns.
*
* \param[in,out] Instance A pointer to a TP_CALLBACK_INSTANCE structure that defines the callback instance.
* \param[in] Semaphore A handle to a semaphore object.
* \param[in] ReleaseCount The amount by which to increment the semaphore's current count.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-releasesemaphorewhencallbackreturns
*/
NTSYSAPI
VOID
NTAPI
@@ -138,6 +243,13 @@ TpCallbackReleaseSemaphoreOnCompletion(
);
// winbase:ReleaseMutexWhenCallbackReturns
/**
* Releases a mutex when the current callback function returns.
*
* \param[in,out] Instance A pointer to a TP_CALLBACK_INSTANCE structure that defines the callback instance.
* \param[in] Mutex A handle to a mutex object.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-releasemutexwhencallbackreturns
*/
NTSYSAPI
VOID
NTAPI
@@ -147,6 +259,13 @@ TpCallbackReleaseMutexOnCompletion(
);
// winbase:LeaveCriticalSectionWhenCallbackReturns
/**
* Leaves a critical section when the current callback function returns.
*
* \param[in,out] Instance A pointer to a TP_CALLBACK_INSTANCE structure that defines the callback instance.
* \param[in,out] CriticalSection A pointer to a critical section object.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-leavecriticalsectionwhencallbackreturns
*/
NTSYSAPI
VOID
NTAPI
@@ -156,6 +275,13 @@ TpCallbackLeaveCriticalSectionOnCompletion(
);
// winbase:FreeLibraryWhenCallbackReturns
/**
* Frees the specified DLL when the current callback function returns.
*
* \param[in,out] Instance A pointer to a TP_CALLBACK_INSTANCE structure that defines the callback instance.
* \param[in] DllHandle A module handle for the DLL to unload.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-freelibrarywhencallbackreturns
*/
NTSYSAPI
VOID
NTAPI
@@ -165,6 +291,13 @@ TpCallbackUnloadDllOnCompletion(
);
// winbase:CallbackMayRunLong
/**
* Indicates that the callback may not return quickly.
*
* \param[in,out] Instance A pointer to a TP_CALLBACK_INSTANCE structure that defines the callback instance.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-callbackmayrunlong
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -173,6 +306,12 @@ TpCallbackMayRunLong(
);
// winbase:DisassociateCurrentThreadFromCallback
/**
* Removes the association between the current thread and the callback instance.
*
* \param[in,out] Instance A pointer to a TP_CALLBACK_INSTANCE structure that defines the callback instance.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-disassociatecurrentthreadfromcallback
*/
NTSYSAPI
VOID
NTAPI
@@ -180,17 +319,51 @@ TpDisassociateCallback(
_Inout_ PTP_CALLBACK_INSTANCE Instance
);
/**
* Defines the callback function that is executed by a thread pool worker thread.
*
* \param[in,out] Instance A pointer to a TP_CALLBACK_INSTANCE structure that defines the callback instance.
* \param[in,out] Context Optional application-defined data passed to the callback.
* \return None.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nc-threadpoolapiset-ptp_simple_callback
*/
typedef _Function_class_(TP_CALLBACK_ROUTINE)
VOID NTAPI TP_CALLBACK_ROUTINE(
_Inout_ PTP_CALLBACK_INSTANCE Instance,
_Inout_opt_ PVOID Context
);
typedef TP_CALLBACK_ROUTINE* PTP_CALLBACK_ROUTINE;
// winbase:TrySubmitThreadpoolCallback
/**
* Requests that a thread pool worker thread call the specified callback function.
*
* \param[in] Callback The callback function.
* \param[in,out] Context Optional application-defined data to pass to the callback function.
* \param[in] CallbackEnviron A pointer to a TP_CALLBACK_ENVIRON structure that defines the environment in which to execute the callback function.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-trysubmitthreadpoolcallback
*/
NTSYSAPI
NTSTATUS
NTAPI
TpSimpleTryPost(
_In_ PTP_SIMPLE_CALLBACK Callback,
_In_ PTP_CALLBACK_ROUTINE Callback,
_Inout_opt_ PVOID Context,
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
);
// winbase:CreateThreadpoolWork
/**
* Allocates a work object.
*
* \param[out] WorkReturn A pointer to a variable that receives the new work object.
* \param[in] Callback The callback function to execute.
* \param[in,out] Context Optional application-defined data to pass to the callback function.
* \param[in] CallbackEnviron Optional callback environment for the callback.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-createthreadpoolwork
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -202,6 +375,13 @@ TpAllocWork(
);
// winbase:CloseThreadpoolWork
/**
* Closes the specified work object.
*
* \param[in,out] Work A pointer to a TP_WORK structure that defines the work object.
* \return None.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-closethreadpoolwork
*/
NTSYSAPI
VOID
NTAPI
@@ -210,6 +390,13 @@ TpReleaseWork(
);
// winbase:SubmitThreadpoolWork
/**
* Submits a work object to the thread pool.
*
* \param[in,out] Work A pointer to a TP_WORK structure that defines the work object.
* \return None.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-submitthreadpoolwork
*/
NTSYSAPI
VOID
NTAPI
@@ -218,6 +405,14 @@ TpPostWork(
);
// winbase:WaitForThreadpoolWorkCallbacks
/**
* Waits for outstanding work callbacks to complete and optionally cancels pending callbacks.
*
* \param[in,out] Work A pointer to a TP_WORK structure that defines the work object.
* \param[in] CancelPendingCallbacks If TRUE, pending callbacks that have not started are canceled.
* \return None.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-waitforthreadpoolworkcallbacks
*/
NTSYSAPI
VOID
NTAPI
@@ -227,6 +422,16 @@ TpWaitForWork(
);
// winbase:CreateThreadpoolTimer
/**
* Allocates a timer object.
*
* \param[out] Timer A pointer to a variable that receives the new timer object.
* \param[in] Callback The callback function to execute when the timer expires.
* \param[in,out] Context Optional application-defined data to pass to the callback function.
* \param[in] CallbackEnviron Optional callback environment for the callback.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-createthreadpooltimer
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -238,6 +443,12 @@ TpAllocTimer(
);
// winbase:CloseThreadpoolTimer
/**
* Closes the specified timer object.
*
* \param[in,out] Timer A pointer to a TP_TIMER structure that defines the timer object.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-closethreadpooltimer
*/
NTSYSAPI
VOID
NTAPI
@@ -246,6 +457,16 @@ TpReleaseTimer(
);
// winbase:SetThreadpoolTimer
/**
* Sets the due time and periodic interval for the specified timer object.
*
* \param[in,out] Timer A pointer to a TP_TIMER structure that defines the timer object.
* \param[in] DueTime A pointer to a FILETIME-based value that specifies when the timer expires.
* \param[in] Period The period, in milliseconds, for periodic timer callbacks.
* \param[in] WindowLength The maximum amount of time, in milliseconds, that can elapse before the timer callback is invoked.
* \return None.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-setthreadpooltimer
*/
NTSYSAPI
VOID
NTAPI
@@ -258,6 +479,16 @@ TpSetTimer(
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
// winbase:SetThreadpoolTimerEx
/**
* Sets the due time and periodic interval for the specified timer object and returns status.
*
* \param[in,out] Timer A pointer to a TP_TIMER structure that defines the timer object.
* \param[in] DueTime A pointer to a FILETIME-based value that specifies when the timer expires.
* \param[in] Period The period, in milliseconds, for periodic timer callbacks.
* \param[in] WindowLength The maximum amount of time, in milliseconds, that can elapse before the timer callback is invoked.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-setthreadpooltimerex
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -270,6 +501,13 @@ TpSetTimerEx(
#endif
// winbase:IsThreadpoolTimerSet
/**
* Determines whether a timer object is currently set.
*
* \param[in] Timer A pointer to a TP_TIMER structure that defines the timer object.
* \return LOGICAL TRUE if the timer is set; otherwise FALSE.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-isthreadpooltimerset
*/
NTSYSAPI
LOGICAL
NTAPI
@@ -278,6 +516,13 @@ TpIsTimerSet(
);
// winbase:WaitForThreadpoolTimerCallbacks
/**
* Waits for outstanding timer callbacks to complete and optionally cancels pending callbacks.
*
* \param[in,out] Timer A pointer to a TP_TIMER structure that defines the timer object.
* \param[in] CancelPendingCallbacks If TRUE, pending callbacks that have not started are canceled.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-waitforthreadpooltimercallbacks
*/
NTSYSAPI
VOID
NTAPI
@@ -287,6 +532,16 @@ TpWaitForTimer(
);
// winbase:CreateThreadpoolWait
/**
* Allocates a wait object.
*
* \param[out] WaitReturn A pointer to a variable that receives the new wait object.
* \param[in] Callback The callback function to execute when the wait is satisfied or times out.
* \param[in,out] Context Optional application-defined data to pass to the callback function.
* \param[in] CallbackEnviron Optional callback environment for the callback.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-createthreadpoolwait
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -298,6 +553,12 @@ TpAllocWait(
);
// winbase:CloseThreadpoolWait
/**
* Closes the specified wait object.
*
* \param[in,out] Wait A pointer to a TP_WAIT structure that defines the wait object.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-closethreadpoolwait
*/
NTSYSAPI
VOID
NTAPI
@@ -306,6 +567,14 @@ TpReleaseWait(
);
// winbase:SetThreadpoolWait
/**
* Sets the object to wait on and optional timeout for a wait object.
*
* \param[in,out] Wait A pointer to a TP_WAIT structure that defines the wait object.
* \param[in] Handle A handle to the object to wait on.
* \param[in] Timeout A pointer to a FILETIME-based timeout value.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-setthreadpoolwait
*/
NTSYSAPI
VOID
NTAPI
@@ -317,6 +586,16 @@ TpSetWait(
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
// winbase:SetThreadpoolWaitEx
/**
* Sets the object to wait on and optional timeout for a wait object and returns status.
*
* \param[in,out] Wait A pointer to a TP_WAIT structure that defines the wait object.
* \param[in] Handle A handle to the object to wait on.
* \param[in] Timeout A pointer to a FILETIME-based timeout value.
* \param[in] Reserved Reserved for future use.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-setthreadpoolwaitex
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -329,6 +608,13 @@ TpSetWaitEx(
#endif
// winbase:WaitForThreadpoolWaitCallbacks
/**
* Waits for outstanding wait callbacks to complete and optionally cancels pending callbacks.
*
* \param[in,out] Wait A pointer to a TP_WAIT structure that defines the wait object.
* \param[in] CancelPendingCallbacks If TRUE, pending callbacks that have not started are canceled.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-waitforthreadpoolwaitcallbacks
*/
NTSYSAPI
VOID
NTAPI
@@ -338,15 +624,38 @@ TpWaitForWait(
);
// private
typedef VOID (NTAPI *PTP_IO_CALLBACK)(
/**
* Defines the callback function for asynchronous I/O completion callbacks.
*
* \param[in,out] Instance A pointer to a TP_CALLBACK_INSTANCE structure that defines the callback instance.
* \param[in,out] Context Optional application-defined data passed to the callback.
* \param[in] ApcContext A pointer to the asynchronous procedure call (APC) context.
* \param[in] IoSB A pointer to an IO_STATUS_BLOCK structure that contains the final I/O status.
* \param[in] Io A pointer to the I/O completion object.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nc-threadpoolapiset-ptp_win32_io_callback
*/
typedef _Function_class_(TP_IO_CALLBACK)
VOID NTAPI TP_IO_CALLBACK(
_Inout_ PTP_CALLBACK_INSTANCE Instance,
_Inout_opt_ PVOID Context,
_In_ PVOID ApcContext,
_In_ PIO_STATUS_BLOCK IoSB,
_In_ PTP_IO Io
);
typedef TP_IO_CALLBACK *PTP_IO_CALLBACK;
// winbase:CreateThreadpoolIo
/**
* Allocates an I/O completion object associated with a file handle.
*
* \param[out] IoReturn A pointer to a variable that receives the new I/O completion object.
* \param[in] File A file handle associated with an I/O completion port.
* \param[in] Callback The callback function to execute when asynchronous I/O completes.
* \param[in,out] Context Optional application-defined data to pass to the callback function.
* \param[in] CallbackEnviron Optional callback environment for the callback.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-createthreadpoolio
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -359,6 +668,12 @@ TpAllocIoCompletion(
);
// winbase:CloseThreadpoolIo
/**
* Closes the specified I/O completion object.
*
* \param[in,out] Io A pointer to a TP_IO structure that defines the I/O completion object.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-closethreadpoolio
*/
NTSYSAPI
VOID
NTAPI
@@ -367,6 +682,12 @@ TpReleaseIoCompletion(
);
// winbase:StartThreadpoolIo
/**
* Marks the start of one or more asynchronous I/O operations on the I/O completion object.
*
* \param[in,out] Io A pointer to a TP_IO structure that defines the I/O completion object.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-startthreadpoolio
*/
NTSYSAPI
VOID
NTAPI
@@ -375,6 +696,12 @@ TpStartAsyncIoOperation(
);
// winbase:CancelThreadpoolIo
/**
* Cancels callbacks for outstanding asynchronous I/O operations.
*
* \param[in,out] Io A pointer to a TP_IO structure that defines the I/O completion object.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-cancelthreadpoolio
*/
NTSYSAPI
VOID
NTAPI
@@ -383,6 +710,13 @@ TpCancelAsyncIoOperation(
);
// winbase:WaitForThreadpoolIoCallbacks
/**
* Waits for outstanding I/O callbacks to complete and optionally cancels pending callbacks.
*
* \param[in,out] Io A pointer to a TP_IO structure that defines the I/O completion object.
* \param[in] CancelPendingCallbacks If TRUE, pending callbacks that have not started are canceled.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-waitforthreadpooliocallbacks
*/
NTSYSAPI
VOID
NTAPI
@@ -392,6 +726,16 @@ TpWaitForIoCompletion(
);
// private
/**
* Allocates an ALPC completion object.
*
* \param[out] AlpcReturn A pointer to a variable that receives the new ALPC completion object.
* \param[in] AlpcPort A handle to an ALPC port.
* \param[in] Callback The callback function to execute for ALPC completions.
* \param[in,out] Context Optional application-defined data to pass to the callback function.
* \param[in] CallbackEnviron Optional callback environment for the callback.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -403,8 +747,17 @@ TpAllocAlpcCompletion(
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
);
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
// rev
/**
* Allocates an ALPC completion object with extended callback context.
*
* \param[out] AlpcReturn A pointer to a variable that receives the new ALPC completion object.
* \param[in] AlpcPort A handle to an ALPC port.
* \param[in] Callback The extended callback function to execute for ALPC completions.
* \param[in,out] Context Optional application-defined data to pass to the callback function.
* \param[in] CallbackEnviron Optional callback environment for the callback.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
@@ -415,9 +768,13 @@ TpAllocAlpcCompletionEx(
_Inout_opt_ PVOID Context,
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
);
#endif
// private
/**
* Releases an ALPC completion object.
*
* \param[in,out] Alpc A pointer to a TP_ALPC structure that defines the ALPC completion object.
*/
NTSYSAPI
VOID
NTAPI
@@ -426,6 +783,11 @@ TpReleaseAlpcCompletion(
);
// private
/**
* Waits for ALPC completion processing to finish.
*
* \param[in,out] Alpc A pointer to a TP_ALPC structure that defines the ALPC completion object.
*/
NTSYSAPI
VOID
NTAPI
@@ -434,6 +796,11 @@ TpWaitForAlpcCompletion(
);
// rev
/**
* Registers the ALPC completion list for the specified ALPC completion object.
*
* \param[in,out] Alpc A pointer to a TP_ALPC structure that defines the ALPC completion object.
*/
NTSYSAPI
VOID
NTAPI
@@ -442,6 +809,12 @@ TpAlpcRegisterCompletionList(
);
// rev
/**
* Unregisters the ALPC completion list for the specified ALPC completion object.
*
* \param[in,out] Alpc A pointer to a TP_ALPC structure that defines the ALPC completion object.
* \return None.
*/
NTSYSAPI
VOID
NTAPI
@@ -458,6 +831,12 @@ typedef enum _TP_TRACE_TYPE
} TP_TRACE_TYPE;
// private
/**
* Captures caller context for thread pool tracing.
*
* \param[in] Type The trace operation type.
* \return None.
*/
NTSYSAPI
VOID
NTAPI
@@ -466,6 +845,12 @@ TpCaptureCaller(
);
// private
/**
* Checks whether a worker thread should terminate.
*
* \param[in] Thread A handle to the worker thread.
* \return None.
*/
NTSYSAPI
VOID
NTAPI
@@ -473,6 +858,4 @@ TpCheckTerminateWorker(
_In_ HANDLE Thread
);
#endif
#endif
#endif // _NTTP_H
nttypesafe.h
+566
View File
@@ -0,0 +1,566 @@
/*
* Integer literal/constant support macros for typesafe integer types.
*
* This file is part of System Informer.
*/
//
// Typed integer literal macros with MSVC compiler extensions and C99 portable fallbacks.
//
// MSVC: Employs Microsoft integer literal suffixes (i8/ui8, i16/ui16, i32/ui32,
// i64/ui64, i128/ui128) to enforce type correctness at compile time.
// Example: UINT16_C(42) produces a uint16_t constant.
//
// Non-MSVC: Standard typed literal syntax unavailable. Macros are pass-through for
// smaller types (relying on type inference) or use standard C suffixes
// (U, ULL, LL) for larger types. Trade-off: reduced type checking; casts
// may suppress compile-time diagnostics for overflow/truncation.
//
// Naming: "_C" suffix conforms to C99 conventions (INT32_C, UINT64_C, etc.)
//
// Organization (sorted by size, then logical grouping):
//
// 1. Boolean type - (1 byte) (C89/C99)
// 2. Character types - (1-2 bytes) (C89/C99)
// 3. Short types - (2 bytes) (C89/C99)
// 4. Half-pointer types - (2-4 bytes) (Windows-specific)
// 5. Int types - (4 bytes) (C89/C99)
// 6. Long types - (4-8 bytes) (C89/C99)
// 7. Floating-point types - (4-8 bytes) (C89/C99)
// 8. NT cardinal types - (2-4 bytes) (Windows NT-specific)
// 9. Pointer-sized types - (4-8 bytes) (C99 + platform-dependent)
// 10. Standard C99 fixed-width types - (1-8 bytes) (C99 core)
// 11. Windows-specific types - (1-8 bytes) (Windows API)
// 12. 128-bit integer types - (16 bytes) (MSVC extension)
#ifndef _NTTYPESAFE_H_INCLUDED_
#define _NTTYPESAFE_H_INCLUDED_
#include <stdint.h>
//
// Boolean type - (1 byte) (C89/C99)
//
#ifndef BOOLEAN_C
#if defined(_MSC_VER)
#define BOOLEAN_C(x) (x##ui8)
#else
#define BOOLEAN_C(x) (x)
#endif
#endif
//
// Character types - (1-2 bytes) (C89/C99)
//
#ifndef CHAR_C
#if defined(_MSC_VER)
#define CHAR_C(x) (x##i8)
#else
#define CHAR_C(x) (x)
#endif
#endif
#ifndef CCHAR_C
#if defined(_MSC_VER)
#define CCHAR_C(x) (x##i8)
#else
#define CCHAR_C(x) (x)
#endif
#endif
#ifndef UCHAR_C
#if defined(_MSC_VER)
#define UCHAR_C(x) (x##ui8)
#else
#define UCHAR_C(x) (x)
#endif
#endif
#ifndef WCHAR_C
#if defined(_MSC_VER)
#define WCHAR_C(x) (x##ui16)
#else
#define WCHAR_C(x) (x)
#endif
#endif
//
// Short types - (2 bytes) (C89/C99)
//
#ifndef SHORT_C
#if defined(_MSC_VER)
#define SHORT_C(x) (x##i16)
#else
#define SHORT_C(x) (x)
#endif
#endif
#ifndef USHORT_C
#if defined(_MSC_VER)
#define USHORT_C(x) (x##ui16)
#else
#define USHORT_C(x) (x)
#endif
#endif
#ifndef WORD_C
#if defined(_MSC_VER)
#define WORD_C(x) (x##ui16)
#else
#define WORD_C(x) (x)
#endif
#endif
//
// Half-pointer types - (2-4 bytes) (Windows-specific)
// 32-bit on 64-bit platforms, 16-bit on 32-bit platforms
//
#ifndef HALF_PTR_C
#ifdef _WIN64
#if defined(_MSC_VER)
#define HALF_PTR_C(x) (x##i32)
#else
#define HALF_PTR_C(x) (x)
#endif
#else
#if defined(_MSC_VER)
#define HALF_PTR_C(x) (x##i16)
#else
#define HALF_PTR_C(x) (x)
#endif
#endif
#endif
#ifndef UHALF_PTR_C
#ifdef _WIN64
#if defined(_MSC_VER)
#define UHALF_PTR_C(x) (x##ui32)
#else
#define UHALF_PTR_C(x) (x##U)
#endif
#else
#if defined(_MSC_VER)
#define UHALF_PTR_C(x) (x##ui16)
#else
#define UHALF_PTR_C(x) (x)
#endif
#endif
#endif
#ifndef PHALF_PTR_C
#ifdef _WIN64
#if defined(_MSC_VER)
#define PHALF_PTR_C(x) (x##i32)
#else
#define PHALF_PTR_C(x) (x)
#endif
#else
#if defined(_MSC_VER)
#define PHALF_PTR_C(x) (x##i16)
#else
#define PHALF_PTR_C(x) (x)
#endif
#endif
#endif
#ifndef PUHALF_PTR_C
#ifdef _WIN64
#if defined(_MSC_VER)
#define PUHALF_PTR_C(x) (x##ui32)
#else
#define PUHALF_PTR_C(x) (x##U)
#endif
#else
#if defined(_MSC_VER)
#define PUHALF_PTR_C(x) (x##ui16)
#else
#define PUHALF_PTR_C(x) (x)
#endif
#endif
#endif
//
// Int types - (4 bytes) (C89/C99)
//
#ifndef INT_C
#if defined(_MSC_VER)
#define INT_C(x) (x##i32)
#else
#define INT_C(x) (x)
#endif
#endif
#ifndef UINT_C
#if defined(_MSC_VER)
#define UINT_C(x) (x##ui32)
#else
#define UINT_C(x) (x##U)
#endif
#endif
//
// Long types - (4-8 bytes) (C89/C99)
//
#ifndef LONG_C
#if defined(_MSC_VER)
#define LONG_C(x) (x##i32)
#else
#define LONG_C(x) (x)
#endif
#endif
#ifndef LONG32_C
#if defined(_MSC_VER)
#define LONG32_C(x) (x##i32)
#else
#define LONG32_C(x) (x)
#endif
#endif
#ifndef LONG64_C
#if defined(_MSC_VER)
#define LONG64_C(x) (x##i64)
#else
#define LONG64_C(x) (x##LL)
#endif
#endif
#ifndef LONGLONG_C
#if defined(_MSC_VER)
#define LONGLONG_C(x) (x##i64)
#else
#define LONGLONG_C(x) (x##LL)
#endif
#endif
#ifndef ULONG_C
#if defined(_MSC_VER)
#define ULONG_C(x) (x##ui32)
#else
#define ULONG_C(x) (x##U)
#endif
#endif
#ifndef ULONG32_C
#if defined(_MSC_VER)
#define ULONG32_C(x) (x##ui32)
#else
#define ULONG32_C(x) (x##U)
#endif
#endif
#ifndef ULONG64_C
#if defined(_MSC_VER)
#define ULONG64_C(x) (x##ui64)
#else
#define ULONG64_C(x) (x##ULL)
#endif
#endif
#ifndef ULONGLONG_C
#if defined(_MSC_VER)
#define ULONGLONG_C(x) (x##ui64)
#else
#define ULONGLONG_C(x) (x##ULL)
#endif
#endif
//
// Floating-point types - (4-8 bytes) (C89/C99)
//
#ifndef FLOAT_C
#define FLOAT_C(x) (x##f)
#endif
#ifndef DOUBLE_C
#if defined(_MSC_VER)
#define DOUBLE_C(x) (x##.0)
#else
#define DOUBLE_C(x) (x)
#endif
#endif
//
// NT cardinal types - (2-4 bytes) (Windows NT-specific)
// Counted/cardinal types from NT native subsystem with 'C' prefix
//
#ifndef CSHORT_C
#if defined(_MSC_VER)
#define CSHORT_C(x) (x##i16)
#else
#define CSHORT_C(x) (x)
#endif
#endif
#ifndef CLONG_C
#if defined(_MSC_VER)
#define CLONG_C(x) (x##ui32)
#else
#define CLONG_C(x) (x##U)
#endif
#endif
#ifndef LOGICAL_C
#if defined(_MSC_VER)
#define LOGICAL_C(x) (x##ui32)
#else
#define LOGICAL_C(x) (x##U)
#endif
#endif
//
// Pointer-sized types - (4-8 bytes) (C99 + platform-dependent)
// Vary between 32-bit and 64-bit platforms
//
#ifndef INT_PTR_C
#ifdef _WIN64
#if defined(_MSC_VER)
#define INT_PTR_C(x) (x##i64)
#else
#define INT_PTR_C(x) (x##LL)
#endif
#else
#if defined(_MSC_VER)
#define INT_PTR_C(x) (x##i32)
#else
#define INT_PTR_C(x) (x)
#endif
#endif
#endif
#ifndef UINT_PTR_C
#ifdef _WIN64
#if defined(_MSC_VER)
#define UINT_PTR_C(x) (x##ui64)
#else
#define UINT_PTR_C(x) (x##ULL)
#endif
#else
#if defined(_MSC_VER)
#define UINT_PTR_C(x) (x##ui32)
#else
#define UINT_PTR_C(x) (x##U)
#endif
#endif
#endif
#ifndef LONG_PTR_C
#ifdef _WIN64
#if defined(_MSC_VER)
#define LONG_PTR_C(x) (x##i64)
#else
#define LONG_PTR_C(x) (x##LL)
#endif
#else
#if defined(_MSC_VER)
#define LONG_PTR_C(x) (x##i32)
#else
#define LONG_PTR_C(x) (x)
#endif
#endif
#endif
#ifndef ULONG_PTR_C
#ifdef _WIN64
#if defined(_MSC_VER)
#define ULONG_PTR_C(x) (x##ui64)
#else
#define ULONG_PTR_C(x) (x##ULL)
#endif
#else
#if defined(_MSC_VER)
#define ULONG_PTR_C(x) (x##ui32)
#else
#define ULONG_PTR_C(x) (x##U)
#endif
#endif
#endif
#ifndef SIZE_T_C
#ifdef _WIN64
#if defined(_MSC_VER)
#define SIZE_T_C(x) (x##ui64)
#else
#define SIZE_T_C(x) (x##ULL)
#endif
#else
#if defined(_MSC_VER)
#define SIZE_T_C(x) (x##ui32)
#else
#define SIZE_T_C(x) (x##U)
#endif
#endif
#endif
#ifndef SSIZE_T_C
#ifdef _WIN64
#if defined(_MSC_VER)
#define SSIZE_T_C(x) (x##i64)
#else
#define SSIZE_T_C(x) (x##LL)
#endif
#else
#if defined(_MSC_VER)
#define SSIZE_T_C(x) (x##i32)
#else
#define SSIZE_T_C(x) (x)
#endif
#endif
#endif
#ifndef PTRDIFF_T_C
#ifdef _WIN64
#if defined(_MSC_VER)
#define PTRDIFF_T_C(x) (x##i64)
#else
#define PTRDIFF_T_C(x) (x##LL)
#endif
#else
#if defined(_MSC_VER)
#define PTRDIFF_T_C(x) (x##i32)
#else
#define PTRDIFF_T_C(x) (x)
#endif
#endif
#endif
//
// Standard C99 fixed-width integer types - (1-8 bytes) (C99 core)
// Redefine with MSVC extensions for better type safety
//
#undef INT8_C
#undef UINT8_C
#undef INT16_C
#undef UINT16_C
#undef INT32_C
#undef UINT32_C
#undef INT64_C
#undef UINT64_C
#undef INTMAX_C
#undef UINTMAX_C
#if defined(_MSC_VER)
#define INT8_C(x) (x##i8)
#define UINT8_C(x) (x##ui8)
#define INT16_C(x) (x##i16)
#define UINT16_C(x) (x##ui16)
#define INT32_C(x) (x##i32)
#define UINT32_C(x) (x##ui32)
#define INT64_C(x) (x##i64)
#define UINT64_C(x) (x##ui64)
#define INTMAX_C(x) (x##i64)
#define UINTMAX_C(x) (x##ui64)
#else
#define INT8_C(x) (x)
#define UINT8_C(x) (x)
#define INT16_C(x) (x)
#define UINT16_C(x) (x)
#define INT32_C(x) (x)
#define UINT32_C(x) (x##U)
#define INT64_C(x) (x##LL)
#define UINT64_C(x) (x##ULL)
#define INTMAX_C(x) (x##LL)
#define UINTMAX_C(x) (x##ULL)
#endif
//
// Windows-specific types - (1-8 bytes) (Windows API)
//
#ifndef BYTE_C
#if defined(_MSC_VER)
#define BYTE_C(x) (x##ui8)
#else
#define BYTE_C(x) (x)
#endif
#endif
#ifndef DWORD_C
#if defined(_MSC_VER)
#define DWORD_C(x) (x##ui32)
#else
#define DWORD_C(x) (x##U)
#endif
#endif
#ifndef DWORD32_C
#if defined(_MSC_VER)
#define DWORD32_C(x) (x##ui32)
#else
#define DWORD32_C(x) (x##U)
#endif
#endif
#ifndef DWORD64_C
#if defined(_MSC_VER)
#define DWORD64_C(x) (x##ui64)
#else
#define DWORD64_C(x) (x##ULL)
#endif
#endif
#ifndef DWORDLONG_C
#if defined(_MSC_VER)
#define DWORDLONG_C(x) (x##ui64)
#else
#define DWORDLONG_C(x) (x##ULL)
#endif
#endif
#ifndef DWORD_PTR_C
#ifdef _WIN64
#if defined(_MSC_VER)
#define DWORD_PTR_C(x) (x##ui64)
#else
#define DWORD_PTR_C(x) (x##ULL)
#endif
#else
#if defined(_MSC_VER)
#define DWORD_PTR_C(x) (x##ui32)
#else
#define DWORD_PTR_C(x) (x##U)
#endif
#endif
#endif
#ifndef QWORD_C
#if defined(_MSC_VER)
#define QWORD_C(x) (x##ui64)
#else
#define QWORD_C(x) (x##ULL)
#endif
#endif
//
// 128-bit integer types - (16 bytes) (MSVC extension)
//
#ifndef INT128_C
#if defined(_MSC_VER)
#define INT128_C(x) (x##i128)
#else
// 128-bit literals not supported on non-MSVC, use cast as fallback
#define INT128_C(x) ((__int128)(x##LL))
#endif
#endif
#ifndef UINT128_C
#if defined(_MSC_VER)
#define UINT128_C(x) (x##ui128)
#else
// 128-bit literals not supported on non-MSVC, use cast as fallback
#define UINT128_C(x) ((unsigned __int128)(x##ULL))
#endif
#endif
#endif /* _NTTYPESAFE_H_INCLUDED_ */
ntuser.h
+2090 -240
View File
File diff suppressed because it is too large Load Diff
ntwmi.h
+400 -135
View File
@@ -7,8 +7,6 @@
#ifndef _NTWMI_H
#define _NTWMI_H
EXTERN_C_START
#ifndef _TRACEHANDLE_DEFINED
#define _TRACEHANDLE_DEFINED
// Obsolete - prefer PROCESSTRACE_HANDLE or CONTROLTRACE_ID.
@@ -472,6 +470,23 @@ typedef enum _ETW_RT_EVENT_LOSS
EtwRtEventLossMax
} ETW_RT_EVENT_LOSS, *PETW_RT_EVENT_LOSS;
//
// Processor and logger ID context embedded in every ETW buffer.
//
//typedef struct _ETW_BUFFER_CONTEXT
//{
// union
// {
// struct
// {
// UCHAR ProcessorNumber;
// UCHAR Alignment;
// };
// USHORT ProcessorIndex;
// };
// USHORT LoggerId;
//} ETW_BUFFER_CONTEXT, *PETW_BUFFER_CONTEXT;
typedef struct _WMI_BUFFER_HEADER *PWMI_BUFFER_HEADER;
typedef struct _WMI_BUFFER_HEADER
@@ -514,16 +529,16 @@ typedef struct _WMI_BUFFER_HEADER
} WMI_BUFFER_HEADER, *PWMI_BUFFER_HEADER;
static_assert(sizeof(WMI_BUFFER_HEADER) == 0x48, "WMI_BUFFER_HEADER must equal 0x48");
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, BufferSize) == 0x0);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, SavedOffset) == 0x4);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, CurrentOffset) == 0x8);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, TimeStamp) == 0x10);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, SlistEntry) == 0x20);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, ClientContext) == 0x28);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, State) == 0x2c); // Compression
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, Offset) == 0x30);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, BufferFlag) == 0x34);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, BufferType) == 0x36);
static_assert(FIELD_OFFSET(WMI_BUFFER_HEADER, BufferSize) == 0x0);
static_assert(FIELD_OFFSET(WMI_BUFFER_HEADER, SavedOffset) == 0x4);
static_assert(FIELD_OFFSET(WMI_BUFFER_HEADER, CurrentOffset) == 0x8);
static_assert(FIELD_OFFSET(WMI_BUFFER_HEADER, TimeStamp) == 0x10);
static_assert(FIELD_OFFSET(WMI_BUFFER_HEADER, SlistEntry) == 0x20);
static_assert(FIELD_OFFSET(WMI_BUFFER_HEADER, ClientContext) == 0x28);
static_assert(FIELD_OFFSET(WMI_BUFFER_HEADER, State) == 0x2c); // Compression
static_assert(FIELD_OFFSET(WMI_BUFFER_HEADER, Offset) == 0x30);
static_assert(FIELD_OFFSET(WMI_BUFFER_HEADER, BufferFlag) == 0x34);
static_assert(FIELD_OFFSET(WMI_BUFFER_HEADER, BufferType) == 0x36);
typedef struct _TRACE_ENABLE_FLAG_EXTENSION
{
@@ -569,6 +584,26 @@ typedef struct _ETW_STACK_CACHING_CONFIG
ULONG BucketCount;
} ETW_STACK_CACHING_CONFIG, *PETW_STACK_CACHING_CONFIG;
//
// Compact record of the last enable notification sent to a provider.
//
typedef struct _ETW_LAST_ENABLE_INFO
{
ULONGLONG EnableFlags; // MatchAnyKeyword (combined enable keyword mask)
USHORT LoggerId;
UCHAR Level;
union
{
struct
{
UCHAR Enabled : 1;
UCHAR InternalFlag : 7;
};
UCHAR AllFlags;
};
ULONG Reserved;
} ETW_LAST_ENABLE_INFO, *PETW_LAST_ENABLE_INFO;
#endif // ifndef ETW_WOW6432
#define PERFINFO_APPLY_OFFSET_GIVING_TYPE(_Base, _Offset, _Type) ((_Type) (((PPERF_BYTE) (_Base)) + (_Offset)))
@@ -594,6 +629,15 @@ typedef struct _PERFINFO_GROUPMASK
#define PERF_GET_MASK_INDEX(GM) (((GM) & PERF_MASK_INDEX) >> 29)
#define PERF_GET_MASK_GROUP(GM) ((GM) & PERF_MASK_GROUP)
// Event id packing in kernel system events is Group (bits 8..12) + Type (bits 0..7).
// Disassembly evidence: EtwpLogKernelEvent indexes per-event state with (EventId & 0x1FFF).
#define PERF_EVENT_TYPE_MASK 0x00FF
#define PERF_EVENT_GROUP_MASK 0x1F00
#define PERF_EVENT_ID_MASK 0x1FFF
#define PERF_GET_EVENT_TYPE(x) ((x) & PERF_EVENT_TYPE_MASK)
#define PERF_GET_EVENT_GROUP(x) ((x) & PERF_EVENT_GROUP_MASK)
#define PERFINFO_CLEAR_GROUPMASK(GroupMask) RtlZeroMemory((GroupMask), sizeof(PERFINFO_GROUPMASK))
#define PERFINFO_OR_GROUP_WITH_GROUPMASK(Group, GroupMask) (GroupMask)->Masks[PERF_GET_MASK_INDEX(Group)] |= PERF_GET_MASK_GROUP(Group)
#define PERFINFO_CLEAR_GROUP_IN_GROUPMASK(Group, GroupMask) (GroupMask)->Masks[PERF_GET_MASK_INDEX(Group)] &= (~PERF_GET_MASK_GROUP(Group))
@@ -2669,13 +2713,16 @@ typedef struct _ETW_OBJECT_TYPE_EVENT
WCHAR Name[ANYSIZE_ARRAY];
} ETW_OBJECT_TYPE_EVENT, *PETW_OBJECT_TYPE_EVENT;
#include <pshpack1.h>
typedef struct _ETW_OBJECT_HANDLE_EVENT
{
PVOID Object;
ULONG ProcessId;
ULONG Handle;
USHORT ObjectType;
WCHAR ObjectName[ANYSIZE_ARRAY];
} ETW_OBJECT_HANDLE_EVENT, *PETW_OBJECT_HANDLE_EVENT;
#include <poppack.h>
typedef struct _ETW_REFDEREF_OBJECT_EVENT
{
@@ -2711,9 +2758,7 @@ typedef struct _ETW_HEAP_EVENT_COMMON
SYSTEM_TRACE_HEADER Header; // Header
PVOID Handle; // Handle of Heap
} ETW_HEAP_EVENT_COMMON, *PETW_HEAP_EVENT_COMMON;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _ETW_HEAP_EVENT_ALLOC
{
SYSTEM_TRACE_HEADER Header; // Header
@@ -2723,9 +2768,7 @@ typedef struct _ETW_HEAP_EVENT_ALLOC
ULONG Source; // Type ie Lookaside, Lowfrag or main path
} ETW_HEAP_EVENT_ALLOC, *PETW_HEAP_EVENT_ALLOC;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _ETW_HEAP_EVENT_FREE
{
SYSTEM_TRACE_HEADER Header; // Header
@@ -2734,9 +2777,7 @@ typedef struct _ETW_HEAP_EVENT_FREE
ULONG Source; // Type ie Lookaside, Lowfrag or main path
} ETW_HEAP_EVENT_FREE, *PETW_HEAP_EVENT_FREE;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _ETW_HEAP_EVENT_REALLOC
{
SYSTEM_TRACE_HEADER Header; // Header
@@ -2747,9 +2788,7 @@ typedef struct _ETW_HEAP_EVENT_REALLOC
SIZE_T OldSize; // Old Size in bytes
ULONG Source; // Type ie Lookaside, Lowfrag or main path
} ETW_HEAP_EVENT_REALLOC, *PETW_HEAP_EVENT_REALLOC;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _ETW_HEAP_EVENT_EXPANSION
{
SYSTEM_TRACE_HEADER Header; // Header
@@ -2762,9 +2801,7 @@ typedef struct _ETW_HEAP_EVENT_EXPANSION
ULONG NoOfUCRs; // Number of uncommitted ranges
SIZE_T AllocatedSpace; // Memory allocated
} ETW_HEAP_EVENT_EXPANSION, *PETW_HEAP_EVENT_EXPANSION;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _ETW_HEAP_EVENT_CONTRACTION
{
SYSTEM_TRACE_HEADER Header; // Header
@@ -2778,9 +2815,7 @@ typedef struct _ETW_HEAP_EVENT_CONTRACTION
SIZE_T AllocatedSpace; // Memory allocated
} ETW_HEAP_EVENT_CONTRACTION, *PETW_HEAP_EVENT_CONTRACTION;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _ETW_HEAP_EVENT_CREATE
{
SYSTEM_TRACE_HEADER Header; // Header
@@ -2850,18 +2885,14 @@ typedef struct _HEAP_SUBSEGMENT_INIT
SIZE_T BlockCount;
ULONG AffinityIndex;
} HEAP_SUBSEGMENT_INIT, *PHEAP_SUBSEGMENT_INIT;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _HEAP_AFFINITY_MANAGER_ENABLE
{
SYSTEM_TRACE_HEADER Header;
PVOID HeapHandle;
ULONG BucketIndex;
} HEAP_AFFINITY_MANAGER_ENABLE, *PHEAP_AFFINITY_MANAGER_ENABLE;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _HEAP_AFFINITY_SLOT_ASSIGN
{
SYSTEM_TRACE_HEADER Header;
@@ -2869,9 +2900,7 @@ typedef struct _HEAP_AFFINITY_SLOT_ASSIGN
PVOID SubSegment;
ULONG SlotIndex;
} HEAP_AFFINITY_SLOT_ASSIGN, *PHEAP_AFFINITY_SLOT_ASSIGN;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _HEAP_REUSE_THRESHOLD_ACTIVATED
{
SYSTEM_TRACE_HEADER Header;
@@ -2879,18 +2908,14 @@ typedef struct _HEAP_REUSE_THRESHOLD_ACTIVATED
PVOID SubSegment;
ULONG BucketIndex;
} HEAP_REUSE_THRESHOLD_ACTIVATED, *PHEAP_REUSE_THRESHOLD_ACTIVATED;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _HEAP_SUBSEGMENT_ACTIVATED
{
SYSTEM_TRACE_HEADER Header;
PVOID HeapHandle;
PVOID SubSegment;
} HEAP_SUBSEGMENT_ACTIVATED, *PHEAP_SUBSEGMENT_ACTIVATED;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _ETW_HEAP_EVENT_SNAPSHOT
{
SYSTEM_TRACE_HEADER Header; // Header
@@ -2905,17 +2930,13 @@ typedef struct _ETW_HEAP_EVENT_SNAPSHOT
ULONG UCRLength;
SIZE_T AllocatedSpace; // Total allocated space in heap, in bytes
} ETW_HEAP_EVENT_SNAPSHOT, *PETW_HEAP_EVENT_SNAPSHOT;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _ETW_HEAP_EVENT_RUNDOWN_RANGE
{
PVOID Address;
SIZE_T Size;
} ETW_HEAP_EVENT_RUNDOWN_RANGE, *PETW_HEAP_EVENT_RUNDOWN_RANGE;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _ETW_HEAP_EVENT_RUNDOWN
{
SYSTEM_TRACE_HEADER Header; // Header
@@ -3733,6 +3754,10 @@ DEFINE_GUID( /* e46eead8-0c54-4489-9898-8fa79d059e0e */
// 0xae, 0xfc, 0xdc, 0x0f, 0x1d, 0x2f, 0xd2, 0x35
// );
/**
* The ETW class GUID for file I/O events.
* \sa https://learn.microsoft.com/en-us/windows/win32/etw/fileio
*/
DEFINE_GUID( /* 90cbdc39-4a3e-11d1-84f4-0000f80464e3 */
FileIoGuid,
0x90cbdc39,
@@ -3741,6 +3766,10 @@ DEFINE_GUID( /* 90cbdc39-4a3e-11d1-84f4-0000f80464e3 */
0x84, 0xf4, 0x00, 0x00, 0xf8, 0x04, 0x64, 0xe3
);
/**
* The ETW class GUID for image load events.
* \sa https://learn.microsoft.com/en-us/windows/win32/etw/image
*/
DEFINE_GUID( /* 2cb15d1d-5fc1-11d2-abe1-00a0c911f518 */
ImageLoadGuid,
0x2cb15d1d,
@@ -3749,6 +3778,10 @@ DEFINE_GUID( /* 2cb15d1d-5fc1-11d2-abe1-00a0c911f518 */
0xab, 0xe1, 0x00, 0xa0, 0xc9, 0x11, 0xf5, 0x18
);
/**
* The ETW class GUID for page fault events.
* \sa https://learn.microsoft.com/en-us/windows/win32/etw/pagefault-v2
*/
DEFINE_GUID( /* 3d6fa8d3-fe05-11d0-9dda-00c04fd7ba7c */
PageFaultGuid,
0x3d6fa8d3,
@@ -3757,6 +3790,10 @@ DEFINE_GUID( /* 3d6fa8d3-fe05-11d0-9dda-00c04fd7ba7c */
0x9d, 0xda, 0x00, 0xc0, 0x4f, 0xd7, 0xba, 0x7c
);
/**
* The ETW class GUID for registry events.
* \sa https://learn.microsoft.com/en-us/windows/win32/etw/registry
*/
DEFINE_GUID( /* AE53722E-C863-11d2-8659-00C04FA321A1 */
RegistryGuid,
0xae53722e,
@@ -3765,6 +3802,10 @@ DEFINE_GUID( /* AE53722E-C863-11d2-8659-00C04FA321A1 */
0x86, 0x59, 0x0, 0xc0, 0x4f, 0xa3, 0x21, 0xa1
);
/**
* The ETW class GUID for TCP/IP events.
* \sa https://learn.microsoft.com/en-us/windows/win32/etw/tcpip
*/
DEFINE_GUID( /* 9a280ac0-c8e0-11d1-84e2-00c04fb998a2 */
TcpIpGuid,
0x9a280ac0,
@@ -3773,6 +3814,10 @@ DEFINE_GUID( /* 9a280ac0-c8e0-11d1-84e2-00c04fb998a2 */
0x84, 0xe2, 0x00, 0xc0, 0x4f, 0xb9, 0x98, 0xa2
);
/**
* The ETW class GUID for thread events.
* \sa https://learn.microsoft.com/en-us/windows/win32/etw/thread
*/
DEFINE_GUID( /* 3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c */
ThreadGuid,
0x3d6fa8d1,
@@ -3781,6 +3826,10 @@ DEFINE_GUID( /* 3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c */
0x9d, 0xda, 0x00, 0xc0, 0x4f, 0xd7, 0xba, 0x7c
);
/**
* The ETW class GUID for UDP/IP events.
* \sa https://learn.microsoft.com/en-us/windows/win32/etw/udpip
*/
DEFINE_GUID( /* bf3a50c5-a9c9-4988-a005-2df0b7c80f80 */
UdpIpGuid,
0xbf3a50c5,
@@ -3789,6 +3838,17 @@ DEFINE_GUID( /* bf3a50c5-a9c9-4988-a005-2df0b7c80f80 */
0xa0, 0x05, 0x2d, 0xf0, 0xb7, 0xc8, 0x0f, 0x80
);
/**
* The ETW class GUID for Intel Processor Trace (IPT) events.
*/
DEFINE_GUID( /* ff1fd2fd-6008-42bb-9e75-00a20051f3be */
IptGuid,
0xff1fd2fd,
0x6008,
0x42bb,
0x9e, 0x75, 0x00, 0xa2, 0x00, 0x51, 0xf3, 0xbe
);
//
// ThreadPool Events
// If you change these structures, may need to update some users of these
@@ -4030,17 +4090,13 @@ typedef struct _PERFINFO_DRIVER_MAJORFUNCTION
PVOID Irp;
ULONG UniqMatchId;
} PERFINFO_DRIVER_MAJORFUNCTION, *PPERFINFO_DRIVER_MAJORFUNCTION;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _PERFINFO_DRIVER_MAJORFUNCTION_RET
{
PVOID Irp;
ULONG UniqMatchId;
} PERFINFO_DRIVER_MAJORFUNCTION_RET, *PPERFINFO_DRIVER_MAJORFUNCTION_RET;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _PERFINFO_DRIVER_COMPLETE_REQUEST
{
//
@@ -4060,9 +4116,7 @@ typedef struct _PERFINFO_DRIVER_COMPLETE_REQUEST
ULONG UniqMatchId;
} PERFINFO_DRIVER_COMPLETE_REQUEST, *PPERFINFO_DRIVER_COMPLETE_REQUEST;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _PERFINFO_DRIVER_COMPLETE_REQUEST_RET
{
//
@@ -4072,9 +4126,7 @@ typedef struct _PERFINFO_DRIVER_COMPLETE_REQUEST_RET
PVOID Irp;
ULONG UniqMatchId;
} PERFINFO_DRIVER_COMPLETE_REQUEST_RET, *PPERFINFO_DRIVER_COMPLETE_REQUEST_RET;
#include <poppack.h>
#include <pshpack1.h>
typedef struct _PERFINFO_DRIVER_COMPLETIONROUTINE
{
PVOID Routine;
@@ -4381,16 +4433,17 @@ typedef struct _PERFINFO_PPM_IDLE_EXIT_LATENCY
typedef struct _PERFINFO_PPM_PERF_STATE_CHANGE
{
ULONG Type;
ULONG NewState;
ULONG OldState;
NTSTATUS Result;
ULONG64 Processors;
ULONG Type;
ULONG NewState;
ULONG OldState;
NTSTATUS Result;
ULONG64 Processors;
} PERFINFO_PPM_PERF_STATE_CHANGE, *PPERFINFO_PPM_PERF_STATE_CHANGE;
typedef struct _PERFINFO_PPM_THERMAL_CONSTRAINT{
ULONG Constraint;
ULONG64 Processors;
typedef struct _PERFINFO_PPM_THERMAL_CONSTRAINT
{
ULONG Constraint;
ULONG64 Processors;
} PERFINFO_PPM_THERMAL_CONSTRAINT, *PPERFINFO_PPM_THERMAL_CONSTRAINT;
//
@@ -4585,7 +4638,7 @@ typedef enum _PERFINFO_KERNELMEMORY_USAGE_TYPE
PerfInfoMemUsageMax
} PERFINFO_KERNELMEMORY_USAGE_TYPE, *PPERFINFO_KERNELMEMORY_USAGE_TYPE;
C_ASSERT(PerfInfoMemUsageMax <= (1 << PERFINFO_MM_KERNELMEMORY_USAGE_TYPE_BITS));
static_assert(PerfInfoMemUsageMax <= (1 << PERFINFO_MM_KERNELMEMORY_USAGE_TYPE_BITS));
typedef struct _PERFINFO_KERNELMEMORY_RANGE_USAGE
{
@@ -4605,7 +4658,7 @@ typedef enum _PERFINFO_MM_STAT
PerfInfoMMStatMax
} PERFINFO_MM_STAT, *PPERFINFO_MM_STAT;
C_ASSERT(PerfInfoMMStatMax <= (1 << PERFINFO_MM_STAT_TYPE_BITS));
static_assert(PerfInfoMMStatMax <= (1 << PERFINFO_MM_STAT_TYPE_BITS));
//
// This is logged as part of the end rundown.
@@ -5122,17 +5175,17 @@ typedef struct _PERFINFO_DEBUG_EVENT
//
#define PERFINFO_CCSWAP_BIT_FULL_TS 30
C_ASSERT (PERFINFO_CCSWAP_BIT_FULL_TS == (32 - PERFINFO_CCSWAP_BIT_TYPE));
static_assert (PERFINFO_CCSWAP_BIT_FULL_TS == (32 - PERFINFO_CCSWAP_BIT_TYPE));
#define PERFINFO_CCSWAP_BIT_SHORT_TS 14
C_ASSERT(PERFINFO_CCSWAP_BIT_SHORT_TS == (16 - PERFINFO_CCSWAP_BIT_TYPE));
static_assert(PERFINFO_CCSWAP_BIT_SHORT_TS == (16 - PERFINFO_CCSWAP_BIT_TYPE));
#define PERFINFO_CCSWAP_BIT_SMALL_TS 17
C_ASSERT (PERFINFO_CCSWAP_BIT_SMALL_TS ==
static_assert(PERFINFO_CCSWAP_BIT_SMALL_TS ==
(32 - PERFINFO_CCSWAP_BIT_TYPE - PERFINFO_CCSWAP_BIT_TID - PERFINFO_CCSWAP_BIT_PRI_INC - PERFINFO_CCSWAP_BIT_STATE_WR));
#define PERFINFO_CCSWAP_BIT_WAIT_TIME 17
C_ASSERT (PERFINFO_CCSWAP_BIT_WAIT_TIME ==
static_assert(PERFINFO_CCSWAP_BIT_WAIT_TIME ==
(32 - PERFINFO_CCSWAP_BIT_TID - PERFINFO_CCSWAP_BIT_STATE_WR - PERFINFO_CCSWAP_BIT_PRIORITY));
//
@@ -5342,7 +5395,7 @@ typedef struct _PERFINFO_IO_TIMER
#define TLG_KERNEL_PSPROV_KEYWORD_UTC 0x00000002
//
// Logger configuration and running statistics. This structure is used
// Logger configuration and statistics.
//
typedef struct _WMI_LOGGER_INFORMATION
@@ -5355,68 +5408,158 @@ typedef struct _WMI_LOGGER_INFORMATION
ULONG LogFileMode; // sequential, circular
ULONG FlushTimer; // buffer flush timer, in seconds
ULONG EnableFlags; // trace enable flags
union
{
LONG AgeLimit; // aging decay time, in minutes
LONG AgeLimit; // aging decay time, in minutes
LONG FlushThreshold; // Number of buffers to fill before flushing
} DUMMYUNIONNAME;
ULONG Wow; // TRUE if the logger started under WOW64
union
{
HANDLE LogFileHandle; // handle to logfile
ULONG64 LogFileHandle64;
struct
{
ULONG Wow : 1; // TRUE if the logger started under WOW64
ULONG QpcDeltaTracking : 1;
ULONG LargeMdlPages : 1;
ULONG ExcludeKernelStack : 1;
};
ULONG64 V2Options;
} DUMMYUNIONNAME2;
union
{
HANDLE LogFileHandle; // Handle to logfile
ULONG64 LogFileHandle64;
} DUMMYUNIONNAME3;
union
{
ULONG NumberOfBuffers; // no of buffers in use
ULONG InstanceCount; // Number of Provider Instances
} DUMMYUNIONNAME3;
} DUMMYUNIONNAME4;
union
{
ULONG FreeBuffers; // no of buffers free
ULONG InstanceId; // Current Provider's Id for UmLogger
} DUMMYUNIONNAME4;
} DUMMYUNIONNAME5;
union
{
ULONG EventsLost; // event records lost
ULONG NumberOfProcessors; // Passed on to UmLogger
} DUMMYUNIONNAME5;
} DUMMYUNIONNAME6;
ULONG BuffersWritten; // no of buffers written to file
union
{
ULONG LogBuffersLost; // no of logfile write failures
ULONG Flags; // internal flags
} DUMMYUNIONNAME6;
} DUMMYUNIONNAME7;
ULONG RealTimeBuffersLost; // no of rt delivery failures
union
{
HANDLE LoggerThreadId; // thread id of Logger
ULONG64 LoggerThreadId64; // thread is of Logger
} DUMMYUNIONNAME7;
} DUMMYUNIONNAME8;
union
{
UNICODE_STRING LogFileName; // used only in WIN64
UNICODE_STRING64 LogFileName64; // Logfile name: only in WIN32
} DUMMYUNIONNAME8;
} DUMMYUNIONNAME9;
// mandatory data provided by caller
union
{
UNICODE_STRING LoggerName; // Logger instance name in WIN64
UNICODE_STRING64 LoggerName64; // Logger Instance name in WIN32
} DUMMYUNIONNAME9;
};
ULONG RealTimeConsumerCount; // Number of rt consumers
ULONG SpareUlong;
ULONG SequenceNumber;
union
{
PVOID LoggerExtension;
ULONG64 LoggerExtension64;
} DUMMYUNIONNAME10;
};
} WMI_LOGGER_INFORMATION, *PWMI_LOGGER_INFORMATION;
//
// ETW time structure (kernel-internal variant of SYSTEMTIME).
//
typedef struct _ETW_SYSTEMTIME
{
USHORT Year;
USHORT Month;
USHORT DayOfWeek;
USHORT Day;
USHORT Hour;
USHORT Minute;
USHORT Second;
USHORT Milliseconds;
} ETW_SYSTEMTIME, *PETW_SYSTEMTIME;
//
// ETW system logger slot (one entry per kernel session slot).
//
typedef struct _ETW_SYSTEM_LOGGER
{
UCHAR LoggerId;
UCHAR ClockType;
} ETW_SYSTEM_LOGGER, *PETW_SYSTEM_LOGGER;
//
// ETW system-wide logger settings (silo-aware). Size = 372 bytes.
//
typedef struct _ETW_SYSTEM_LOGGER_SETTINGS
{
ETW_SYSTEM_LOGGER EtwpSystemLogger[8]; // +0x000 (16 bytes)
volatile ULONG EtwpActiveSystemLoggers; // +0x010
PERFINFO_GROUPMASK SiloGlobalGroupMask; // +0x014 (32 bytes)
PERFINFO_GROUPMASK EtwpGroupMasks[10]; // +0x034 (320 bytes)
} ETW_SYSTEM_LOGGER_SETTINGS, *PETW_SYSTEM_LOGGER_SETTINGS;
//
// ETW boot logger configuration.
//
typedef struct _ETW_BOOT_CONFIG
{
ULONG MaxLoggers;
ULONG Reserved;
LIST_ENTRY BootLoggersList;
} ETW_BOOT_CONFIG, *PETW_BOOT_CONFIG;
//
// ETW global performance counters.
//
typedef struct _ETW_PERF_COUNTERS
{
LONG TotalActiveSessions;
LONG TotalBufferMemoryNonPagedPool;
LONG TotalBufferMemoryPagedPool;
LONG TotalGuidsEnabled;
LONG TotalGuidsNotEnabled;
LONG TotalGuidsPreEnabled;
} ETW_PERF_COUNTERS, *PETW_PERF_COUNTERS;
//
// ETW per-session performance counters.
//
typedef struct _ETW_SESSION_PERF_COUNTERS
{
LONG BufferMemoryPagedPool;
LONG BufferMemoryNonPagedPool;
ULONGLONG EventsLoggedCount;
LONG EventsLost;
LONG NumConsumers;
} ETW_SESSION_PERF_COUNTERS, *PETW_SESSION_PERF_COUNTERS;
#define ETW_SYSTEM_EVENT_VERSION_MASK 0x000000FF
#define ETW_GET_SYSTEM_EVENT_VERSION(X) ((X) & ETW_SYSTEM_EVENT_VERSION_MASK)
@@ -5444,6 +5587,12 @@ typedef struct _WMI_LOGGER_INFORMATION
#define ETW_NT_FLAGS_USE_NATIVE_HEADER 0x40000000 // Use native header for WOW64
#define ETW_NT_FLAGS_WOW64_CALL 0x80000000 // For use by WOW (Internal)
#define ETW_NT_FLAGS_TRACE_SYSTEM_V1 (ETW_NT_FLAGS_TRACE_SYSTEM | ETW_SYSTEM_EVENT_V1)
#define ETW_NT_FLAGS_TRACE_SYSTEM_V2 (ETW_NT_FLAGS_TRACE_SYSTEM | ETW_SYSTEM_EVENT_V2)
#define ETW_NT_FLAGS_TRACE_SYSTEM_V3 (ETW_NT_FLAGS_TRACE_SYSTEM | ETW_SYSTEM_EVENT_V3)
#define ETW_NT_FLAGS_TRACE_SYSTEM_V4 (ETW_NT_FLAGS_TRACE_SYSTEM | ETW_SYSTEM_EVENT_V4)
#define ETW_NT_FLAGS_TRACE_SYSTEM_V5 (ETW_NT_FLAGS_TRACE_SYSTEM | ETW_SYSTEM_EVENT_V5)
#define ETW_NT_FLAGS_TRACE_RUNDOWN_V2 (ETW_NT_FLAGS_TRACE_SYSTEM_V2 | ETW_NT_FLAGS_USE_NATIVE_HEADER) // Rundown and SysConfig events
#define ETW_NT_FLAGS_TRACE_RUNDOWN_V3 (ETW_NT_FLAGS_TRACE_SYSTEM_V3 | ETW_NT_FLAGS_USE_NATIVE_HEADER) // Rundown and SysConfig events
#define ETW_NT_FLAGS_TRACE_RUNDOWN_V4 (ETW_NT_FLAGS_TRACE_SYSTEM_V4 | ETW_NT_FLAGS_USE_NATIVE_HEADER) // Rundown and SysConfig events
@@ -5461,12 +5610,6 @@ typedef struct _WMI_LOGGER_INFORMATION
#define ETW_SKIP_USER_FRAMES(X) ((X) << ETW_USER_FRAMES_TO_SKIP_SHIFT)
#define ETW_USER_EVENT_WITH_STACKWALK(X) (ETW_NT_FLAGS_TRACE_SYSTEM_V2| ETW_SKIP_USER_FRAMES(X))
#define ETW_NT_FLAGS_TRACE_SYSTEM_V1 (ETW_NT_FLAGS_TRACE_SYSTEM | ETW_SYSTEM_EVENT_V1)
#define ETW_NT_FLAGS_TRACE_SYSTEM_V2 (ETW_NT_FLAGS_TRACE_SYSTEM | ETW_SYSTEM_EVENT_V2)
#define ETW_NT_FLAGS_TRACE_SYSTEM_V3 (ETW_NT_FLAGS_TRACE_SYSTEM | ETW_SYSTEM_EVENT_V3)
#define ETW_NT_FLAGS_TRACE_SYSTEM_V4 (ETW_NT_FLAGS_TRACE_SYSTEM | ETW_SYSTEM_EVENT_V4)
#define ETW_NT_FLAGS_TRACE_SYSTEM_V5 (ETW_NT_FLAGS_TRACE_SYSTEM | ETW_SYSTEM_EVENT_V5)
// Constants for UMGL (User Mode Global Logging).
//
// N.B. There is enough space reserved in UserSharedData
@@ -5634,10 +5777,12 @@ typedef struct _ETW_NOTIFICATION_HEADER
GUID SourceGuid; // Source GUID
} ETW_NOTIFICATION_HEADER, *PETW_NOTIFICATION_HEADER;
typedef ULONG (NTAPI *PETW_NOTIFICATION_CALLBACK)(
typedef _Function_class_(ETW_NOTIFICATION_CALLBACK)
ULONG NTAPI ETW_NOTIFICATION_CALLBACK(
_In_ PETW_NOTIFICATION_HEADER NotificationHeader,
_In_ PVOID Context
);
typedef ETW_NOTIFICATION_CALLBACK *PETW_NOTIFICATION_CALLBACK;
typedef enum _ETW_SESSION_NOTIFICATION_TYPE
{
@@ -5919,56 +6064,181 @@ typedef struct _ETW_TRACE_GUID_INFO
//ETW_TRACE_PROVIDER_INSTANCE_INFO Instances[1];
} ETW_TRACE_GUID_INFO, *PETW_TRACE_GUID_INFO;
// rev
typedef struct _ETW_UPDATE_DISALLOW_LIST_INFORMATION
{
ULONG LoggerId;
ULONG GuidCount;
GUID GuidList[ANYSIZE_ARRAY];
} ETW_UPDATE_DISALLOW_LIST_INFORMATION, *PETW_UPDATE_DISALLOW_LIST_INFORMATION;
// rev
typedef struct _ETW_GET_DISALLOW_LIST_INFORMATION
{
ULONG LoggerId;
ULONG Reserved;
} ETW_GET_DISALLOW_LIST_INFORMATION, *PETW_GET_DISALLOW_LIST_INFORMATION;
// rev
typedef struct _ETW_SET_COMPRESSION_SETTINGS_INFORMATION
{
ULONG LoggerId;
ULONG Field4;
ULONG Field8;
ULONG FieldC;
} ETW_SET_COMPRESSION_SETTINGS_INFORMATION, *PETW_SET_COMPRESSION_SETTINGS_INFORMATION;
// rev
typedef struct _ETW_GET_COMPRESSION_SETTINGS_INFORMATION
{
USHORT LoggerId;
USHORT Reserved0;
ULONG Reserved4;
} ETW_GET_COMPRESSION_SETTINGS_INFORMATION, *PETW_GET_COMPRESSION_SETTINGS_INFORMATION;
// rev
typedef struct _ETW_COMPRESSION_SETTINGS_DATA
{
ULONG LoggerId;
ULONG Field4;
ULONG Field8;
ULONG FieldC;
} ETW_COMPRESSION_SETTINGS_DATA, *PETW_COMPRESSION_SETTINGS_DATA;
// rev
typedef struct _ETW_UPDATE_PERIODIC_CAPTURE_STATE_INFORMATION
{
ULONG LoggerId;
ULONG CaptureInterval;
USHORT GuidCount;
USHORT Reserved;
GUID GuidList[ANYSIZE_ARRAY];
} ETW_UPDATE_PERIODIC_CAPTURE_STATE_INFORMATION, *PETW_UPDATE_PERIODIC_CAPTURE_STATE_INFORMATION;
// rev
typedef struct _ETW_PRIVATE_SESSION_TRACE_REQUEST
{
ULONG ProcessId;
union
{
ULONG Value;
struct
{
USHORT PrivateSessionId;
USHORT PrivateSessionVersion;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
} ETW_PRIVATE_SESSION_TRACE_REQUEST, *PETW_PRIVATE_SESSION_TRACE_REQUEST;
// rev
typedef struct _ETW_GET_PRIVATE_SESSION_TRACE_HANDLE_INFORMATION
{
ETW_PRIVATE_SESSION_TRACE_REQUEST Requests[ANYSIZE_ARRAY];
} ETW_GET_PRIVATE_SESSION_TRACE_HANDLE_INFORMATION, *PETW_GET_PRIVATE_SESSION_TRACE_HANDLE_INFORMATION;
// rev
typedef struct _ETW_REGISTER_PRIVATE_SESSION_INFORMATION
{
union
{
struct
{
USHORT PrivateSessionId;
USHORT Reserved0;
} DUMMYSTRUCTNAME;
ULONG SessionDemuxHandle;
} DUMMYUNIONNAME;
USHORT PrivateSessionHandle;
USHORT Reserved4;
} ETW_REGISTER_PRIVATE_SESSION_INFORMATION, *PETW_REGISTER_PRIVATE_SESSION_INFORMATION;
// rev
typedef struct _ETW_QUERY_SESSION_DEMUX_OBJECT_INFORMATION
{
union
{
HANDLE SessionDemuxHandle;
USHORT PrivateSessionHandle;
} DUMMYUNIONNAME;
} ETW_QUERY_SESSION_DEMUX_OBJECT_INFORMATION, *PETW_QUERY_SESSION_DEMUX_OBJECT_INFORMATION;
// rev
typedef struct _ETW_SET_PROVIDER_BINARY_TRACKING_INFORMATION
{
ULONG LoggerId;
BOOLEAN Enable;
UCHAR Reserved1[3];
} ETW_SET_PROVIDER_BINARY_TRACKING_INFORMATION, *PETW_SET_PROVIDER_BINARY_TRACKING_INFORMATION;
// rev
typedef struct _ETW_QUERY_USED_PROCESSOR_COUNT_INFORMATION
{
USHORT LoggerId;
USHORT Reserved;
ULONG Reserved2;
} ETW_QUERY_USED_PROCESSOR_COUNT_INFORMATION, *PETW_QUERY_USED_PROCESSOR_COUNT_INFORMATION;
static_assert(sizeof(ETW_GET_DISALLOW_LIST_INFORMATION) == 8, "ETW_GET_DISALLOW_LIST_INFORMATION");
static_assert(sizeof(ETW_SET_COMPRESSION_SETTINGS_INFORMATION) == 16, "ETW_SET_COMPRESSION_SETTINGS_INFORMATION");
static_assert(sizeof(ETW_GET_COMPRESSION_SETTINGS_INFORMATION) == 8, "ETW_GET_COMPRESSION_SETTINGS_INFORMATION");
static_assert(sizeof(ETW_COMPRESSION_SETTINGS_DATA) == 16, "ETW_COMPRESSION_SETTINGS_DATA");
static_assert(sizeof(ETW_PRIVATE_SESSION_TRACE_REQUEST) == 8, "ETW_PRIVATE_SESSION_TRACE_REQUEST");
static_assert(sizeof(ETW_GET_PRIVATE_SESSION_TRACE_HANDLE_INFORMATION) == 8, "ETW_GET_PRIVATE_SESSION_TRACE_HANDLE_INFORMATION");
static_assert(sizeof(ETW_REGISTER_PRIVATE_SESSION_INFORMATION) == 8, "ETW_REGISTER_PRIVATE_SESSION_INFORMATION");
static_assert(sizeof(ETW_QUERY_SESSION_DEMUX_OBJECT_INFORMATION) == sizeof(HANDLE), "ETW_QUERY_SESSION_DEMUX_OBJECT_INFORMATION");
static_assert(sizeof(ETW_SET_PROVIDER_BINARY_TRACKING_INFORMATION) == 8, "ETW_SET_PROVIDER_BINARY_TRACKING_INFORMATION");
static_assert(sizeof(ETW_QUERY_USED_PROCESSOR_COUNT_INFORMATION) == 8, "ETW_QUERY_USED_PROCESSOR_COUNT_INFORMATION");
// rev
typedef enum _ETWTRACECONTROLCODE
{
EtwStartLoggerCode = 1, // inout WMI_LOGGER_INFORMATION
EtwStopLoggerCode = 2, // inout WMI_LOGGER_INFORMATION
EtwQueryLoggerCode = 3, // inout WMI_LOGGER_INFORMATION
EtwUpdateLoggerCode = 4, // inout WMI_LOGGER_INFORMATION
EtwFlushLoggerCode = 5, // inout WMI_LOGGER_INFORMATION
EtwIncrementLoggerFile = 6, // inout WMI_LOGGER_INFORMATION
EtwRealtimeTransition = 7, // inout WMI_LOGGER_INFORMATION
EtwStartLoggerCode = 1, // inout WMI_LOGGER_INFORMATION (>= 0xB0)
EtwStopLoggerCode = 2, // inout WMI_LOGGER_INFORMATION (>= 0xB0)
EtwQueryLoggerCode = 3, // inout WMI_LOGGER_INFORMATION (>= 0xB0)
EtwUpdateLoggerCode = 4, // inout WMI_LOGGER_INFORMATION (>= 0xB0)
EtwFlushLoggerCode = 5, // inout WMI_LOGGER_INFORMATION (>= 0xB0)
EtwIncrementLoggerFile = 6, // inout WMI_LOGGER_INFORMATION (>= 0xB0)
EtwRealtimeTransition = 7, // inout WMI_LOGGER_INFORMATION (>= 0xB0)
// reserved
EtwRealtimeConnectCode = 11,
EtwActivityIdCreate = 12,
EtwWdiScenarioCode = 13,
EtwRealtimeDisconnectCode = 14, // in HANDLE
EtwRegisterGuidsCode = 15,
EtwReceiveNotification = 16,
EtwSendDataBlock = 17, // ETW_ENABLE_NOTIFICATION_PACKET // ETW_SESSION_NOTIFICATION_PACKET
EtwSendReplyDataBlock = 18,
EtwReceiveReplyDataBlock = 19,
EtwWdiSemUpdate = 20,
EtwEnumTraceGuidList = 21, // out GUID[]
EtwGetTraceGuidInfo = 22, // in GUID, out ETW_TRACE_GUID_INFO
EtwEnumerateTraceGuids = 23, // out TRACE_GUID_PROPERTIES[]
EtwRegisterSecurityProv = 24,
EtwReferenceTimeCode = 25, // in ULONG LoggerId, out ETW_REF_CLOCK
EtwTrackBinaryCode = 26, // in HANDLE
EtwAddNotificationEvent = 27,
EtwUpdateDisallowList = 28,
EtwSetEnableAllKeywordsCode = 29,
EtwSetProviderTraitsCode = 30,
EtwUseDescriptorTypeCode = 31,
EtwEnumTraceGroupList = 32,
EtwGetTraceGroupInfo = 33,
EtwGetDisallowList = 34,
EtwSetCompressionSettings = 35,
EtwGetCompressionSettings = 36,
EtwUpdatePeriodicCaptureState = 37,
EtwGetPrivateSessionTraceHandle = 38,
EtwRegisterPrivateSession = 39,
EtwQuerySessionDemuxObject = 40,
EtwSetProviderBinaryTracking = 41,
EtwMaxLoggers = 42, // out ULONG
EtwMaxPmcCounter = 43, // out ULONG
EtwQueryUsedProcessorCount = 44, // ULONG // since WIN11
EtwGetPmcOwnership = 45,
EtwGetPmcSessions = 46,
EtwRealtimeConnectCode = 11, // inout 0x60-byte realtime connect buffer
EtwActivityIdCreate = 12, // out GUID
EtwWdiScenarioCode = 13, // in 0x30-byte WDI control buffer
EtwRealtimeDisconnectCode = 14, // in HANDLE
EtwRegisterGuidsCode = 15, // in 0xA0-byte registration header, out provider reply buffer (>= 0xA0)
EtwReceiveNotification = 16, // out ETW_NOTIFICATION_HEADER + payload (72..65536 bytes)
EtwSendDataBlock = 17, // in ETW_ENABLE_NOTIFICATION_PACKET, out ETW_SESSION_NOTIFICATION_PACKET (0x48)
EtwSendReplyDataBlock = 18, // in ETW_NOTIFICATION_HEADER + payload
EtwReceiveReplyDataBlock = 19, // in HANDLE, out reply data block
EtwWdiSemUpdate = 20, // no input/output buffers
EtwEnumTraceGuidList = 21, // out GUID[]
EtwGetTraceGuidInfo = 22, // in GUID, out ETW_TRACE_GUID_INFO + instances
EtwEnumerateTraceGuids = 23, // out TRACE_GUID_PROPERTIES[]
EtwRegisterSecurityProv = 24, // no input/output buffers
EtwReferenceTimeCode = 25, // in ULONG LoggerId, out ETW_REF_CLOCK
EtwTrackBinaryCode = 26, // in HANDLE
EtwAddNotificationEvent = 27, // in HANDLE
EtwUpdateDisallowList = 28, // in ETW_UPDATE_DISALLOW_LIST_INFORMATION
EtwSetEnableAllKeywordsCode = 29, // reserved/unsupported in current NtTraceControl switch
EtwSetProviderTraitsCode = 30, // in provider traits header (0x18), out traits reply buffer (>= 0x78)
EtwUseDescriptorTypeCode = 31, // in 0x10-byte descriptor-type control
EtwEnumTraceGroupList = 32, // out GUID[]
EtwGetTraceGroupInfo = 33, // in GUID, out group info buffer
EtwGetDisallowList = 34, // in ETW_GET_DISALLOW_LIST_INFORMATION, out variable-size disallow list
EtwSetCompressionSettings = 35, // in ETW_SET_COMPRESSION_SETTINGS_INFORMATION
EtwGetCompressionSettings = 36, // in ETW_GET_COMPRESSION_SETTINGS_INFORMATION, out ETW_COMPRESSION_SETTINGS_DATA
EtwUpdatePeriodicCaptureState = 37, // in ETW_UPDATE_PERIODIC_CAPTURE_STATE_INFORMATION
EtwGetPrivateSessionTraceHandle = 38, // in ETW_GET_PRIVATE_SESSION_TRACE_HANDLE_INFORMATION, out USHORT PrivateSessionHandle
EtwRegisterPrivateSession = 39, // inout ETW_REGISTER_PRIVATE_SESSION_INFORMATION
EtwQuerySessionDemuxObject = 40, // inout ETW_QUERY_SESSION_DEMUX_OBJECT_INFORMATION
EtwSetProviderBinaryTracking = 41, // in ETW_SET_PROVIDER_BINARY_TRACKING_INFORMATION
EtwMaxLoggers = 42, // out ULONG
EtwMaxPmcCounter = 43, // out ULONG
EtwQueryUsedProcessorCount = 44, // in ETW_QUERY_USED_PROCESSOR_COUNT_INFORMATION (LoggerId), out ULONG // since WIN11
EtwGetPmcOwnership = 45, // out variable-size PMC ownership buffer
EtwGetPmcSessions = 46, // out variable-size PMC session buffer
EtwTraceControlMax = 47,
} ETWTRACECONTROLCODE;
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -5980,9 +6250,7 @@ NtTraceControl(
_In_ ULONG OutputBufferLength,
_Out_ PULONG ReturnLength
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_XP)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -5992,12 +6260,11 @@ NtTraceEvent(
_In_ ULONG FieldSize,
_In_ PVOID Fields
);
#endif
// private
typedef struct _TELEMETRY_COVERAGE_POINT
{
PWSTR Name;
PSTR Name;
ULONG Hash;
ULONG LastCoveredRound;
ULONG Flags;
@@ -6199,8 +6466,8 @@ WmiExecuteMethodW(
#define NOTIFICATION_LIGHTWEIGHT_FLAG 0x00000020
// Event notification callback function prototype
_Function_class_(NOTIFICATIONCALLBACK)
typedef void (WINAPI NOTIFICATIONCALLBACK)(
typedef _Function_class_(NOTIFICATIONCALLBACK)
VOID NTAPI NOTIFICATIONCALLBACK(
_In_ PWNODE_HEADER Wnode,
_In_ ULONG_PTR NotificationContext
);
@@ -6396,6 +6663,4 @@ WmiFreeBuffer(
_In_ PVOID Buffer
);
EXTERN_C_END
#endif
#endif // _NTWMI_H
ntwow64.h
+56 -8
View File
@@ -8,8 +8,12 @@
#define _NTWOW64_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#ifdef __has_include
#if __has_include (<ntxcapi.h>)
#include <ntxcapi.h>
#endif
#endif // __has_include
#endif // __has_include
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#define WOW64_SYSTEM_DIRECTORY "SysWOW64"
#define WOW64_SYSTEM_DIRECTORY_U L"SysWOW64"
@@ -33,7 +37,9 @@ typedef enum _WOW64_SHARED_INFORMATION
Wow64SharedPageEntriesCount
} WOW64_SHARED_INFORMATION;
//
// 32-bit definitions
//
#define WOW64_POINTER(Type) ULONG
@@ -186,6 +192,23 @@ typedef struct _LDR_DATA_TABLE_ENTRY32
LDR_HOT_PATCH_STATE HotPatchState;
} LDR_DATA_TABLE_ENTRY32, *PLDR_DATA_TABLE_ENTRY32;
typedef const LDR_DATA_TABLE_ENTRY32* PCLDR_DATA_TABLE_ENTRY32;
static_assert(UFIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, InMemoryOrderLinks) == 0x8, "LDR_DATA_TABLE_ENTRY32.InMemoryOrderLinks offset incorrect");
static_assert(UFIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, InInitializationOrderLinks) == 0x10, "LDR_DATA_TABLE_ENTRY32.InInitializationOrderLinks offset incorrect");
static_assert(UFIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, DllBase) == 0x18, "LDR_DATA_TABLE_ENTRY32.DllBase offset incorrect");
static_assert(UFIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, EntryPoint) == 0x1c, "LDR_DATA_TABLE_ENTRY32.EntryPoint offset incorrect");
static_assert(UFIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, SizeOfImage) == 0x20, "LDR_DATA_TABLE_ENTRY32.SizeOfImage offset incorrect");
static_assert(UFIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, ObsoleteLoadCount) == 0x38, "LDR_DATA_TABLE_ENTRY32.ObsoleteLoadCount offset incorrect");
static_assert(UFIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, TimeDateStamp) == 0x44, "LDR_DATA_TABLE_ENTRY32.TimeDateStamp offset incorrect");
static_assert(UFIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, DdagNode) == 0x50, "LDR_DATA_TABLE_ENTRY32.DdagNode offset incorrect");
static_assert(UFIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, ParentDllBase) == 0x60, "LDR_DATA_TABLE_ENTRY32.ParentDllBase offset incorrect");
static_assert(UFIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, OriginalBase) == 0x80, "LDR_DATA_TABLE_ENTRY32.OriginalBase offset incorrect");
static_assert(UFIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, BaseNameHashValue) == 0x90, "LDR_DATA_TABLE_ENTRY32.BaseNameHashValue offset incorrect");
static_assert(UFIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, LoadReason) == 0x94, "LDR_DATA_TABLE_ENTRY32.LoadReason offset incorrect");
static_assert(UFIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, CheckSum) == 0xA8, "LDR_DATA_TABLE_ENTRY32.CheckSum offset incorrect");
static_assert(sizeof(LDR_DATA_TABLE_ENTRY32) == 0xB8, "LDR_DATA_TABLE_ENTRY32 incorrect size");
typedef struct _CURDIR32
{
UNICODE_STRING32 DosPath;
@@ -291,7 +314,10 @@ typedef struct _PEB32
ULONG ProcessUsingVEH : 1;
ULONG ProcessUsingVCH : 1;
ULONG ProcessUsingFTH : 1;
ULONG ReservedBits0 : 27;
ULONG ProcessPreviouslyThrottled : 1; // The process was previously throttled.
ULONG ProcessCurrentlyThrottled : 1; // The process is currently throttled.
ULONG ProcessImagesHotPatched : 1; // The process images are hot patched. // RS5
ULONG ReservedBits0 : 24;
};
};
union
@@ -419,8 +445,6 @@ typedef struct _PEB32
ULONGLONG ExtendedFeatureDisableMask; // since WIN11
} PEB32, *PPEB32;
//static_assert(sizeof(PEB32) == 0x460, "sizeof(PEB32) is incorrect"); // REDSTONE3
//static_assert(sizeof(PEB32) == 0x470, "sizeof(PEB32) is incorrect"); // REDSTONE5
static_assert(sizeof(PEB32) == 0x488, "sizeof(PEB32) is incorrect"); // WIN11
// Note: Use PhGetProcessPeb32 instead. (dmex)
@@ -436,6 +460,28 @@ typedef struct _GDI_TEB_BATCH32
ULONG Buffer[GDI_BATCH_BUFFER_SIZE];
} GDI_TEB_BATCH32, *PGDI_TEB_BATCH32;
typedef struct tagSOleTlsData32
{
WOW64_POINTER(PVOID) ThreadBase;
WOW64_POINTER(PVOID) SmAllocator;
ULONG ApartmentID;
ULONG Flags; // OLETLSFLAGS
LONG TlsMapIndex;
WOW64_POINTER(PVOID *) TlsSlot;
ULONG ComInits;
ULONG OleInits;
ULONG Calls;
WOW64_POINTER(PVOID) ServerCall; // was CallInfo before TH1
WOW64_POINTER(PVOID) CallObjectCache; // was FreeAsyncCall before TH1
WOW64_POINTER(PVOID) ContextStack; // was FreeClientCall before TH1
WOW64_POINTER(PVOID) ObjServer;
ULONG TIDCaller;
// ... (other fields are version-dependant)
} SOleTlsData32, *PSOleTlsData32;
// rev
#define RPC_THREAD_POINTER_KEY32 0xABABABAB
typedef struct _TEB32
{
NT_TIB32 NtTib;
@@ -521,7 +567,7 @@ typedef struct _TEB32
ULONG GuaranteedStackBytes;
WOW64_POINTER(PVOID) ReservedForPerf;
WOW64_POINTER(PVOID) ReservedForOle;
WOW64_POINTER(PSOleTlsData32) ReservedForOle;
ULONG WaitingOnLoaderLock;
WOW64_POINTER(PVOID) SavedPriorityState;
WOW64_POINTER(ULONG_PTR) ReservedForCodeCoverage;
@@ -592,11 +638,13 @@ static_assert(FIELD_OFFSET(TEB32, MuiImpersonation) == 0xfc4, "FIELD_OFFSET(TEB3
static_assert(FIELD_OFFSET(TEB32, EffectiveContainerId) == 0xff0, "FIELD_OFFSET(TEB32, EffectiveContainerId) is incorrect");
static_assert(sizeof(TEB32) == 0x1000, "sizeof(TEB32) is incorrect");
//
// Conversion
//
FORCEINLINE VOID UStr32ToUStr(
_Out_ PUNICODE_STRING Destination,
_In_ PUNICODE_STRING32 Source
_In_ PCUNICODE_STRING32 Source
)
{
Destination->Length = Source->Length;
@@ -606,7 +654,7 @@ FORCEINLINE VOID UStr32ToUStr(
FORCEINLINE VOID UStrToUStr32(
_Out_ PUNICODE_STRING32 Destination,
_In_ PUNICODE_STRING Source
_In_ PCUNICODE_STRING Source
)
{
Destination->Length = Source->Length;
@@ -786,4 +834,4 @@ Wow64CurrentNativeTeb(
#endif // _M_X64
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#endif
#endif // _NTWOW64_H
ntxcapi.h
+9 -11
View File
@@ -24,6 +24,13 @@ RtlRaiseStatus(
_In_ NTSTATUS Status
);
/**
* Raises an exception in the calling thread.
*
* \param ExceptionRecord A pointer to an EXCEPTION_RECORD structure that contains the exception information. You must specify the ExceptionAddress and ExceptionCode members.
* \return This function does not return a value.
* \see https://learn.microsoft.com/en-us/windows/win32/api/errhandlingapi/nf-errhandlingapi-raiseexception
*/
NTSYSAPI
VOID
NTAPI
@@ -117,16 +124,7 @@ RtlAssert(
_In_ PVOID VoidFailedAssertion,
_In_ PVOID VoidFileName,
_In_ ULONG LineNumber,
_In_opt_ PSTR MutableMessage
_In_opt_ PCSTR MutableMessage
);
#define RTL_ASSERT(exp) \
((!(exp)) ? (RtlAssert((PVOID)#exp, (PVOID)__FILE__, __LINE__, NULL), FALSE) : TRUE)
#define RTL_ASSERTMSG(msg, exp) \
((!(exp)) ? (RtlAssert((PVOID)#exp, (PVOID)__FILE__, __LINE__, msg), FALSE) : TRUE)
#define RTL_SOFT_ASSERT(_exp) \
((!(_exp)) ? (DbgPrint("%s(%d): Soft assertion failed\n Expression: %s\n", __FILE__, __LINE__, #_exp), FALSE) : TRUE)
#define RTL_SOFT_ASSERTMSG(_msg, _exp) \
((!(_exp)) ? (DbgPrint("%s(%d): Soft assertion failed\n Expression: %s\n Message: %s\n", __FILE__, __LINE__, #_exp, (_msg)), FALSE) : TRUE)
#endif
#endif // _NTXCAPI_H
ntzwapi.h
+141 -136
View File
@@ -33,10 +33,10 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwAccessCheckAndAuditAlarm(
_In_ PUNICODE_STRING SubsystemName,
_In_ PCUNICODE_STRING SubsystemName,
_In_opt_ PVOID HandleId,
_In_ PUNICODE_STRING ObjectTypeName,
_In_ PUNICODE_STRING ObjectName,
_In_ PCUNICODE_STRING ObjectTypeName,
_In_ PCUNICODE_STRING ObjectName,
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ ACCESS_MASK DesiredAccess,
_In_ PGENERIC_MAPPING GenericMapping,
@@ -67,10 +67,10 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwAccessCheckByTypeAndAuditAlarm(
_In_ PUNICODE_STRING SubsystemName,
_In_ PCUNICODE_STRING SubsystemName,
_In_opt_ PVOID HandleId,
_In_ PUNICODE_STRING ObjectTypeName,
_In_ PUNICODE_STRING ObjectName,
_In_ PCUNICODE_STRING ObjectTypeName,
_In_ PCUNICODE_STRING ObjectName,
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_opt_ PSID PrincipalSelfSid,
_In_ ACCESS_MASK DesiredAccess,
@@ -106,10 +106,10 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwAccessCheckByTypeResultListAndAuditAlarm(
_In_ PUNICODE_STRING SubsystemName,
_In_ PCUNICODE_STRING SubsystemName,
_In_opt_ PVOID HandleId,
_In_ PUNICODE_STRING ObjectTypeName,
_In_ PUNICODE_STRING ObjectName,
_In_ PCUNICODE_STRING ObjectTypeName,
_In_ PCUNICODE_STRING ObjectName,
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_opt_ PSID PrincipalSelfSid,
_In_ ACCESS_MASK DesiredAccess,
@@ -128,11 +128,11 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle(
_In_ PUNICODE_STRING SubsystemName,
_In_ PCUNICODE_STRING SubsystemName,
_In_opt_ PVOID HandleId,
_In_ HANDLE ClientToken,
_In_ PUNICODE_STRING ObjectTypeName,
_In_ PUNICODE_STRING ObjectName,
_In_ PCUNICODE_STRING ObjectTypeName,
_In_ PCUNICODE_STRING ObjectName,
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_opt_ PSID PrincipalSelfSid,
_In_ ACCESS_MASK DesiredAccess,
@@ -170,7 +170,7 @@ NTAPI
ZwAcquireProcessActivityReference(
_Out_ PHANDLE ActivityReferenceHandle,
_In_ HANDLE ParentProcessHandle,
_Reserved_ PROCESS_ACTIVITY_TYPE Reserved
_In_ ULONG ProcessActivityType // PROCESS_ACTIVITY_TYPE
);
NTSYSCALLAPI
@@ -260,8 +260,8 @@ NTAPI
ZwAlertMultipleThreadByThreadId(
_In_ PHANDLE MultipleThreadId,
_In_ ULONG Count,
_In_ PVOID Boost,
_In_ ULONG BoostCount
_Inout_updates_opt_(ExtendedParameterCount) PPS_ALERT_THREAD_EXTENDED_PARAMETER ExtendedParameters,
_In_ ULONG ExtendedParameterCount
);
NTSYSCALLAPI
@@ -394,7 +394,7 @@ NTSTATUS
NTAPI
ZwAlpcConnectPort(
_Out_ PHANDLE PortHandle,
_In_ PUNICODE_STRING PortName,
_In_ PCUNICODE_STRING PortName,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
_In_ ULONG Flags,
@@ -451,7 +451,7 @@ ZwAlpcCreateResourceReserve(
_In_ HANDLE PortHandle,
_Reserved_ ULONG Flags,
_In_ SIZE_T MessageSize,
_Out_ PALPC_HANDLE ResourceId
_Out_ PULONG ResourceId
);
NTSYSCALLAPI
@@ -487,7 +487,7 @@ NTAPI
ZwAlpcDeleteResourceReserve(
_In_ HANDLE PortHandle,
_Reserved_ ULONG Flags,
_In_ ALPC_HANDLE ResourceId
_In_ ULONG ResourceId
);
NTSYSCALLAPI
@@ -614,6 +614,14 @@ ZwAlpcSetInformation(
_In_ ULONG Length
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwApphelpCacheControl(
_In_ AHC_SERVICE_CLASS ServiceClass,
_Inout_opt_ PVOID ServiceContext // AHC_SERVICE_DATA
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -658,7 +666,7 @@ NTSTATUS
NTAPI
ZwCallEnclave(
_In_ PENCLAVE_ROUTINE Routine,
_In_ PVOID Reserved, // reserved for dispatch (RtlEnclaveCallDispatch)
_In_ PVOID Reserved, // SelectVsmEnclaveByNumber > 0 // reserved for dispatch (RtlEnclaveCallDispatch)
_In_ ULONG Flags, // ENCLAVE_CALL_FLAG_*
_Inout_ PVOID* RoutineParamReturn // input routine parameter, output routine return value
);
@@ -722,7 +730,7 @@ ZwChangeProcessState(
_In_ PROCESS_STATE_CHANGE_TYPE StateChangeType,
_In_opt_ _Reserved_ PVOID ExtendedInformation,
_In_opt_ _Reserved_ SIZE_T ExtendedInformationLength,
_In_opt_ _Reserved_ ULONG64 Reserved
_In_opt_ _Reserved_ ULONG Reserved
);
NTSYSCALLAPI
@@ -734,7 +742,7 @@ ZwChangeThreadState(
_In_ THREAD_STATE_CHANGE_TYPE StateChangeType,
_In_opt_ PVOID ExtendedInformation,
_In_opt_ SIZE_T ExtendedInformationLength,
_In_opt_ ULONG64 Reserved
_In_opt_ ULONG Reserved
);
NTSYSCALLAPI
@@ -755,7 +763,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCloseObjectAuditAlarm(
_In_ PUNICODE_STRING SubsystemName,
_In_ PCUNICODE_STRING SubsystemName,
_In_opt_ PVOID HandleId,
_In_ BOOLEAN GenerateOnClose
);
@@ -776,6 +784,14 @@ ZwCommitEnlistment(
_In_opt_ PLARGE_INTEGER TmVirtualClock
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCommitRegistryTransaction(
_In_ HANDLE RegistryTransactionHandle,
_Reserved_ ULONG Flags
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -836,7 +852,7 @@ NTSTATUS
NTAPI
ZwConnectPort(
_Out_ PHANDLE PortHandle,
_In_ PUNICODE_STRING PortName,
_In_ PCUNICODE_STRING PortName,
_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
_Inout_opt_ PPORT_VIEW ClientView,
_Inout_opt_ PREMOTE_PORT_VIEW ServerView,
@@ -1005,7 +1021,7 @@ NTAPI
ZwCreateFile(
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_opt_ PLARGE_INTEGER AllocationSize,
_In_ ULONG FileAttributes,
@@ -1022,7 +1038,7 @@ NTAPI
ZwCreateIoCompletion(
_Out_ PHANDLE IoCompletionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ ULONG NumberOfConcurrentThreads
);
@@ -1042,7 +1058,7 @@ NTSTATUS
NTAPI
ZwCreateIRTimer(
_Out_ PHANDLE TimerHandle,
_In_ PVOID Reserved,
_In_ PULONG TimerId,
_In_ ACCESS_MASK DesiredAccess
);
@@ -1072,7 +1088,7 @@ ZwCreateKey(
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_Reserved_ ULONG TitleIndex,
_In_opt_ PUNICODE_STRING Class,
_In_opt_ PCUNICODE_STRING Class,
_In_ ULONG CreateOptions,
_Out_opt_ PULONG Disposition
);
@@ -1095,7 +1111,7 @@ ZwCreateKeyTransacted(
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_Reserved_ ULONG TitleIndex,
_In_opt_ PUNICODE_STRING Class,
_In_opt_ PCUNICODE_STRING Class,
_In_ ULONG CreateOptions,
_In_ HANDLE TransactionHandle,
_Out_opt_ PULONG Disposition
@@ -1122,7 +1138,7 @@ NTAPI
ZwCreateMailslotFile(
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_ ULONG CreateOptions,
_In_ ULONG MailslotQuota,
@@ -1146,7 +1162,7 @@ NTAPI
ZwCreateNamedPipeFile(
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_ ULONG ShareAccess,
_In_ ULONG CreateDisposition,
@@ -1164,7 +1180,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCreatePagingFile(
_In_ PUNICODE_STRING PageFileName,
_In_ PCUNICODE_STRING PageFileName,
_In_ PLARGE_INTEGER MinimumSize,
_In_ PLARGE_INTEGER MaximumSize,
_In_ ULONG Priority
@@ -1177,8 +1193,7 @@ ZwCreatePartition(
_In_opt_ HANDLE ParentPartitionHandle,
_Out_ PHANDLE PartitionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG PreferredNode
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSCALLAPI
@@ -1239,7 +1254,7 @@ ZwCreateProcessStateChange(
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_ HANDLE ProcessHandle,
_In_opt_ _Reserved_ ULONG64 Reserved
_In_opt_ _Reserved_ ULONG Reserved
);
NTSYSCALLAPI
@@ -1273,6 +1288,16 @@ ZwCreateProfileEx(
_In_reads_(GroupCount) PGROUP_AFFINITY GroupAffinity
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCreateRegistryTransaction(
_Out_ HANDLE *RegistryTransactionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjAttributes,
_Reserved_ ULONG CreateOptions
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1283,7 +1308,7 @@ ZwCreateResourceManager(
_In_ LPGUID RmGuid,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ ULONG CreateOptions,
_In_opt_ PUNICODE_STRING Description
_In_opt_ PCUNICODE_STRING Description
);
NTSYSCALLAPI
@@ -1332,7 +1357,7 @@ ZwCreateSymbolicLinkObject(
_Out_ PHANDLE LinkHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PUNICODE_STRING LinkTarget
_In_ PCUNICODE_STRING LinkTarget
);
NTSYSCALLAPI
@@ -1374,7 +1399,7 @@ ZwCreateThreadStateChange(
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_ HANDLE ThreadHandle,
_In_opt_ ULONG64 Reserved
_In_opt_ _Reserved_ ULONG Reserved
);
NTSYSCALLAPI
@@ -1392,9 +1417,9 @@ NTSTATUS
NTAPI
ZwCreateTimer2(
_Out_ PHANDLE TimerHandle,
_In_opt_ PVOID Reserved1,
_In_opt_ PULONG TimerId,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG Attributes, // TIMER_TYPE
_In_ ULONG Attributes,
_In_ ACCESS_MASK DesiredAccess
);
@@ -1453,7 +1478,7 @@ ZwCreateTransaction(
_In_opt_ ULONG IsolationLevel,
_In_opt_ ULONG IsolationFlags,
_In_opt_ PLARGE_INTEGER Timeout,
_In_opt_ PUNICODE_STRING Description
_In_opt_ PCUNICODE_STRING Description
);
NTSYSCALLAPI
@@ -1463,7 +1488,7 @@ ZwCreateTransactionManager(
_Out_ PHANDLE TmHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PUNICODE_STRING LogFileName,
_In_opt_ PCUNICODE_STRING LogFileName,
_In_opt_ ULONG CreateOptions,
_In_opt_ ULONG CommitStrength
);
@@ -1502,7 +1527,7 @@ NTAPI
ZwCreateWaitCompletionPacket(
_Out_ PHANDLE WaitCompletionPacketHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSCALLAPI
@@ -1584,7 +1609,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwDeleteFile(
_In_ POBJECT_ATTRIBUTES ObjectAttributes
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSCALLAPI
@@ -1598,7 +1623,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwDeleteObjectAuditAlarm(
_In_ PUNICODE_STRING SubsystemName,
_In_ PCUNICODE_STRING SubsystemName,
_In_opt_ PVOID HandleId,
_In_ BOOLEAN GenerateOnClose
);
@@ -1615,7 +1640,7 @@ NTSTATUS
NTAPI
ZwDeleteValueKey(
_In_ HANDLE KeyHandle,
_In_ PUNICODE_STRING ValueName
_In_ PCUNICODE_STRING ValueName
);
NTSYSCALLAPI
@@ -1623,7 +1648,7 @@ NTSTATUS
NTAPI
ZwDeleteWnfStateData(
_In_ PCWNF_STATE_NAME StateName,
_In_opt_ const VOID* ExplicitScope
_In_opt_ PCSID ExplicitScope
);
NTSYSCALLAPI
@@ -1671,14 +1696,14 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwDisplayString(
_In_ PUNICODE_STRING String
_In_ PCUNICODE_STRING String
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwDrawText(
_In_ PUNICODE_STRING Text
_In_ PCUNICODE_STRING Text
);
NTSYSCALLAPI
@@ -1814,9 +1839,9 @@ ZwFilterTokenEx(
_In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,
_In_opt_ PTOKEN_GROUPS RestrictedSids,
_In_ ULONG DisableUserClaimsCount,
_In_opt_ PUNICODE_STRING UserClaimsToDisable,
_In_opt_ PCUNICODE_STRING UserClaimsToDisable,
_In_ ULONG DisableDeviceClaimsCount,
_In_opt_ PUNICODE_STRING DeviceClaimsToDisable,
_In_opt_ PCUNICODE_STRING DeviceClaimsToDisable,
_In_opt_ PTOKEN_GROUPS DeviceGroupsToDisable,
_In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedUserAttributes,
_In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedDeviceAttributes,
@@ -1866,7 +1891,7 @@ NTAPI
ZwFlushInstructionCache(
_In_ HANDLE ProcessHandle,
_In_opt_ PVOID BaseAddress,
_In_ SIZE_T Length
_In_ SIZE_T RegionSize
);
NTSYSCALLAPI
@@ -1914,7 +1939,7 @@ NTSTATUS
NTAPI
ZwFreeVirtualMemory(
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_Inout_ __drv_freesMem(Mem) PVOID *BaseAddress,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG FreeType
);
@@ -2032,7 +2057,7 @@ ZwGetNextThread(
_In_opt_ HANDLE ThreadHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ ULONG HandleAttributes,
_In_ ULONG Flags,
_In_opt_ _Reserved_ ULONG Flags,
_Out_ PHANDLE NewThreadHandle
);
@@ -2179,7 +2204,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwLoadDriver(
_In_ PUNICODE_STRING DriverServiceName
_In_ PCUNICODE_STRING DriverServiceName
);
NTSYSCALLAPI
@@ -2525,7 +2550,7 @@ NTAPI
ZwOpenFile(
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_ ULONG ShareAccess,
_In_ ULONG OpenOptions
@@ -2537,7 +2562,7 @@ NTAPI
ZwOpenIoCompletion(
_Out_ PHANDLE IoCompletionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSCALLAPI
@@ -2611,10 +2636,10 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwOpenObjectAuditAlarm(
_In_ PUNICODE_STRING SubsystemName,
_In_ PCUNICODE_STRING SubsystemName,
_In_opt_ PVOID HandleId,
_In_ PUNICODE_STRING ObjectTypeName,
_In_ PUNICODE_STRING ObjectName,
_In_ PCUNICODE_STRING ObjectTypeName,
_In_ PCUNICODE_STRING ObjectName,
_In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ HANDLE ClientToken,
_In_ ACCESS_MASK DesiredAccess,
@@ -2673,6 +2698,15 @@ ZwOpenProcessTokenEx(
_Out_ PHANDLE TokenHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwOpenRegistryTransaction(
_Out_ HANDLE *RegistryTransactionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjAttributes
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -2778,7 +2812,7 @@ ZwOpenTransactionManager(
_Out_ PHANDLE TmHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PUNICODE_STRING LogFileName,
_In_opt_ PCUNICODE_STRING LogFileName,
_In_opt_ LPGUID TmIdentity,
_In_opt_ ULONG OpenOptions
);
@@ -2848,8 +2882,8 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwPrivilegedServiceAuditAlarm(
_In_ PUNICODE_STRING SubsystemName,
_In_ PUNICODE_STRING ServiceName,
_In_ PCUNICODE_STRING SubsystemName,
_In_ PCUNICODE_STRING ServiceName,
_In_ HANDLE ClientToken,
_In_ PPRIVILEGE_SET Privileges,
_In_ BOOLEAN AccessGranted
@@ -2859,7 +2893,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwPrivilegeObjectAuditAlarm(
_In_ PUNICODE_STRING SubsystemName,
_In_ PCUNICODE_STRING SubsystemName,
_In_opt_ PVOID HandleId,
_In_ HANDLE ClientToken,
_In_ ACCESS_MASK DesiredAccess,
@@ -2920,7 +2954,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryAttributesFile(
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PFILE_BASIC_INFORMATION FileInformation
);
@@ -2983,7 +3017,7 @@ ZwQueryDirectoryFile(
_In_ ULONG Length,
_In_ FILE_INFORMATION_CLASS FileInformationClass,
_In_ BOOLEAN ReturnSingleEntry,
_In_opt_ PUNICODE_STRING FileName,
_In_opt_ PCUNICODE_STRING FileName,
_In_ BOOLEAN RestartScan
);
@@ -3000,7 +3034,7 @@ ZwQueryDirectoryFileEx(
_In_ ULONG Length,
_In_ FILE_INFORMATION_CLASS FileInformationClass,
_In_ ULONG QueryFlags,
_In_opt_ PUNICODE_STRING FileName
_In_opt_ PCUNICODE_STRING FileName
);
NTSYSCALLAPI
@@ -3054,7 +3088,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryFullAttributesFile(
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PFILE_NETWORK_OPEN_INFORMATION FileInformation
);
@@ -3073,13 +3107,24 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryInformationByName(
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_Out_writes_bytes_(Length) PVOID FileInformation,
_In_ ULONG Length,
_In_ FILE_INFORMATION_CLASS FileInformationClass
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryInformationCpuPartition(
_In_ HANDLE CpuPartitionHandle,
_In_ ULONG CpuPartitionInformationClass,
_Out_writes_bytes_opt_(CpuPartitionInformationLength) PVOID CpuPartitionInformation,
_In_ ULONG CpuPartitionInformationLength,
_Out_opt_ PULONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -3250,7 +3295,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryLicenseValue(
_In_ PUNICODE_STRING ValueName,
_In_ PCUNICODE_STRING ValueName,
_Out_opt_ PULONG Type,
_Out_writes_bytes_to_opt_(DataSize, *ResultDataSize) PVOID Data,
_In_ ULONG DataSize,
@@ -3355,7 +3400,7 @@ NTSTATUS
NTAPI
ZwQuerySecurityAttributesToken(
_In_ HANDLE TokenHandle,
_In_reads_opt_(NumberOfAttributes) PUNICODE_STRING Attributes,
_In_reads_opt_(NumberOfAttributes) PCUNICODE_STRING Attributes,
_In_ ULONG NumberOfAttributes,
_Out_writes_bytes_(Length) PVOID Buffer, // PTOKEN_SECURITY_ATTRIBUTES_INFORMATION
_In_ ULONG Length,
@@ -3409,7 +3454,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQuerySystemEnvironmentValue(
_In_ PUNICODE_STRING VariableName,
_In_ PCUNICODE_STRING VariableName,
_Out_writes_bytes_(ValueLength) PWSTR VariableValue,
_In_ USHORT ValueLength,
_Out_opt_ PUSHORT ReturnLength
@@ -3480,7 +3525,7 @@ NTSTATUS
NTAPI
ZwQueryValueKey(
_In_ HANDLE KeyHandle,
_In_ PUNICODE_STRING ValueName,
_In_ PCUNICODE_STRING ValueName,
_In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
_Out_writes_bytes_to_opt_(Length, *ResultLength) PVOID KeyValueInformation,
_In_ ULONG Length,
@@ -3516,10 +3561,10 @@ NTAPI
ZwQueryWnfStateData(
_In_ PCWNF_STATE_NAME StateName,
_In_opt_ PCWNF_TYPE_ID TypeId,
_In_opt_ const VOID* ExplicitScope,
_In_opt_ PCSID ExplicitScope,
_Out_ PWNF_CHANGE_STAMP ChangeStamp,
_Out_writes_bytes_opt_(*BufferSize) PVOID Buffer,
_Inout_ PULONG BufferSize
_Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
_Inout_ PULONG BufferLength
);
NTSYSCALLAPI
@@ -3528,9 +3573,9 @@ NTAPI
ZwQueryWnfStateNameInformation(
_In_ PCWNF_STATE_NAME StateName,
_In_ WNF_STATE_NAME_INFORMATION NameInfoClass,
_In_opt_ const VOID* ExplicitScope,
_Out_writes_bytes_(InfoBufferSize) PVOID InfoBuffer,
_In_ ULONG InfoBufferSize
_In_opt_ PCSID ExplicitScope,
_Out_writes_bytes_(BufferLength) PVOID Buffer,
_In_ ULONG BufferLength
);
NTSYSCALLAPI
@@ -3780,14 +3825,14 @@ NTSTATUS
NTAPI
ZwRenameKey(
_In_ HANDLE KeyHandle,
_In_ PUNICODE_STRING NewName
_In_ PCUNICODE_STRING NewName
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwRenameTransactionManager(
_In_ PUNICODE_STRING LogFileName,
_In_ PCUNICODE_STRING LogFileName,
_In_ LPGUID ExistingTransactionManagerGuid
);
@@ -3804,8 +3849,8 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwReplacePartitionUnit(
_In_ PUNICODE_STRING TargetInstancePath,
_In_ PUNICODE_STRING SpareInstancePath,
_In_ PCUNICODE_STRING TargetInstancePath,
_In_ PCUNICODE_STRING SpareInstancePath,
_In_ ULONG Flags
);
@@ -3934,6 +3979,14 @@ ZwRollbackEnlistment(
_In_opt_ PLARGE_INTEGER TmVirtualClock
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwRollbackRegistryTransaction(
_In_ HANDLE RegistryTransactionHandle,
_Reserved_ ULONG Flags
);
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -3981,7 +4034,7 @@ NTSTATUS
NTAPI
ZwSecureConnectPort(
_Out_ PHANDLE PortHandle,
_In_ PUNICODE_STRING PortName,
_In_ PCUNICODE_STRING PortName,
_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
_Inout_opt_ PPORT_VIEW ClientView,
_In_opt_ PSID RequiredServerSid,
@@ -4465,7 +4518,7 @@ ZwSetTimer2(
_In_ HANDLE TimerHandle,
_In_ PLARGE_INTEGER DueTime,
_In_opt_ PLARGE_INTEGER Period,
_In_ PT2_SET_PARAMETERS Parameters
_In_opt_ PT2_SET_PARAMETERS Parameters
);
NTSYSCALLAPI
@@ -4499,7 +4552,7 @@ NTSTATUS
NTAPI
ZwSetValueKey(
_In_ HANDLE KeyHandle,
_In_ PUNICODE_STRING ValueName,
_In_ PCUNICODE_STRING ValueName,
_In_opt_ ULONG TitleIndex,
_In_ ULONG Type,
_In_reads_bytes_opt_(DataSize) PVOID Data,
@@ -4714,7 +4767,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwUnloadDriver(
_In_ PUNICODE_STRING DriverServiceName
_In_ PCUNICODE_STRING DriverServiceName
);
NTSYSCALLAPI
@@ -4793,7 +4846,7 @@ ZwUpdateWnfStateData(
_In_reads_bytes_opt_(Length) const VOID* Buffer,
_In_opt_ ULONG Length,
_In_opt_ PCWNF_TYPE_ID TypeId,
_In_opt_ const VOID* ExplicitScope,
_In_opt_ PCSID ExplicitScope,
_In_ WNF_CHANGE_STAMP MatchingChangeStamp,
_In_ LOGICAL CheckStamp
);
@@ -4870,10 +4923,7 @@ NTSTATUS
NTAPI
ZwWaitForWorkViaWorkerFactory(
_In_ HANDLE WorkerFactoryHandle,
_Out_writes_to_(Count, *PacketsReturned) PFILE_IO_COMPLETION_INFORMATION MiniPackets,
_In_ ULONG Count,
_Out_ PULONG PacketsReturned,
_In_ PWORKER_FACTORY_DEFERRED_WORK DeferredWork
_Out_ PFILE_IO_COMPLETION_INFORMATION MiniPacket
);
NTSYSCALLAPI
@@ -4897,51 +4947,6 @@ ZwWorkerFactoryWorkerReady(
_In_ HANDLE WorkerFactoryHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwWow64QueryInformationProcess64(
_In_ HANDLE ProcessHandle,
_In_ PROCESSINFOCLASS ProcessInformationClass,
_Out_writes_bytes_(ProcessInformationLength) PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength,
_Out_opt_ PULONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwWow64QueryVirtualMemory64(
_In_ HANDLE ProcessHandle,
_In_opt_ ULONGLONG BaseAddress,
_In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,
_Out_writes_bytes_(MemoryInformationLength) PVOID MemoryInformation,
_In_ ULONGLONG MemoryInformationLength,
_Out_opt_ PULONGLONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwWow64ReadVirtualMemory64(
_In_ HANDLE ProcessHandle,
_In_opt_ ULONGLONG BaseAddress,
_Out_writes_bytes_to_(NumberOfBytesToRead, *NumberOfBytesRead) PVOID Buffer,
_In_ ULONGLONG NumberOfBytesToRead,
_Out_opt_ PULONGLONG NumberOfBytesRead
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwWow64WriteVirtualMemory64(
_In_ HANDLE ProcessHandle,
_In_opt_ ULONGLONG BaseAddress,
_In_reads_bytes_(NumberOfBytesToWrite) PVOID Buffer,
_In_ ULONGLONG NumberOfBytesToWrite,
_Out_opt_ PULONGLONG NumberOfBytesWritten
);
NTSYSCALLAPI
NTSTATUS
NTAPI
phnt.h
+15 -4
View File
@@ -55,10 +55,16 @@
#define PHNT_WINDOWS_11_22H2 115 // September, 2022 // Build 22621
#define PHNT_WINDOWS_11_23H2 116 // October, 2023 // Build 22631
#define PHNT_WINDOWS_11_24H2 117 // October, 2024 // Build 26100
#define PHNT_WINDOWS_11_25H2 117 // October, 2025 // Build 26200
#define PHNT_WINDOWS_NEW ULONG_MAX
#ifndef PHNT_MODE
#define PHNT_MODE PHNT_MODE_USER
// Auto-detect kernel mode when building with WDK or kernel headers.
#if defined(_NTDDK_) || defined(_NTIFS_) || defined(_NTDRIVER_)
#define PHNT_MODE PHNT_MODE_KERNEL
#else
#define PHNT_MODE PHNT_MODE_USER
#endif
#endif
#ifndef PHNT_VERSION
@@ -78,23 +84,29 @@
#endif // !PHNT_INLINE_TYPEDEFS
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
//
// Headers
//
EXTERN_C_START
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#include <phnt_ntdef.h>
#include <ntnls.h>
#include <ntintsafe.h>
#include <nttypesafe.h>
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#include <ntkeapi.h>
#include <ntldr.h>
#include <ntexapi.h>
#include <ntbcd.h>
#include <ntmmapi.h>
#include <ntobapi.h>
#include <ntpsapi.h>
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#include <ntbcd.h>
#include <ntdbg.h>
#include <ntimage.h>
#include <ntioapi.h>
@@ -114,7 +126,6 @@ EXTERN_C_START
#include <ntwmi.h>
#include <ntwow64.h>
#include <ntxcapi.h>
#include <ntzwapi.h>
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
EXTERN_C_END
@@ -122,4 +133,4 @@ EXTERN_C_END
static_assert(__alignof(LARGE_INTEGER) == 8, "Windows headers require the default packing option. Changing the packing can lead to memory corruption.");
static_assert(__alignof(PROCESS_CYCLE_TIME_INFORMATION) == 8, "PHNT headers require the default packing option. Changing the packing can lead to memory corruption.");
#endif
#endif // _PHNT_H
phnt_ntdef.h
+731 -26
View File
@@ -21,6 +21,13 @@
// Basic types
//
/**
* The QUAD structure is a union used for 64-bit values or double precision.
*
* This structure is used to represent a 64-bit integer or a double value.
* The field `UseThisFieldToCopy` is intended for copying the structure,
* while `DoNotUseThisField` should not be used directly.
*/
typedef struct _QUAD
{
union
@@ -30,16 +37,28 @@ typedef struct _QUAD
};
} QUAD, *PQUAD;
// This isn't in NT, but it's useful.
/**
* The QUAD_PTR structure is a utility structure for pointer-sized fields.
*
* This structure is not part of NT, but is useful.
*/
typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _QUAD_PTR
{
ULONG_PTR DoNotUseThisField1;
ULONG_PTR DoNotUseThisField2;
} QUAD_PTR, *PQUAD_PTR;
/**
* The LOGICAL type is an unsigned long used by the NT API for boolean logic.
*/
typedef ULONG LOGICAL;
typedef ULONG *PLOGICAL;
/**
* The NTSTATUS type is a signed long used for NT API status codes.
*
* Functions returning NTSTATUS indicate success or error conditions.
*/
typedef _Return_type_success_(return >= 0) LONG NTSTATUS;
typedef NTSTATUS *PNTSTATUS;
@@ -55,26 +74,56 @@ typedef CCHAR *PCCHAR;
typedef CSHORT *PCSHORT;
typedef CLONG *PCLONG;
/**
* The PCSZ type is a pointer to a constant string.
*/
typedef PCSTR PCSZ;
/**
* The PPVOID type is a pointer to a pointer to void.
*/
typedef PVOID* PPVOID;
/**
* The PCVOID type is a pointer to a constant void.
*/
typedef CONST VOID *PCVOID;
//
// Specific
//
/**
* The KIRQL type is an unsigned char used by the NT API for kernel IRQL (Interrupt Request Level).
*/
typedef UCHAR KIRQL, *PKIRQL;
/**
* The KPRIORITY type is a signed long used by the NT API for kernel priority values.
*/
typedef LONG KPRIORITY, *PKPRIORITY;
/**
* The RTL_ATOM type is an unsigned short used by the NT API for Atom values.
*/
typedef USHORT RTL_ATOM, *PRTL_ATOM;
/**
* The PHYSICAL_ADDRESS type is a LARGE_INTEGER representing a physical address.
*/
typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;
/**
* The LARGE_INTEGER_128 structure represents a 128-bit signed integer.
*/
typedef struct _LARGE_INTEGER_128
{
LONGLONG QuadPart[2];
} LARGE_INTEGER_128, *PLARGE_INTEGER_128;
/**
* The ULARGE_INTEGER_128 structure represents a 128-bit unsigned integer.
*/
typedef struct _ULARGE_INTEGER_128
{
ULONGLONG QuadPart[2];
@@ -157,18 +206,27 @@ typedef struct _ULARGE_INTEGER_128
// Synchronization enumerations
//
/**
* Event types used with kernel synchronization objects.
*/
typedef enum _EVENT_TYPE
{
NotificationEvent,
SynchronizationEvent
} EVENT_TYPE;
/**
* Timer types used by kernel timer objects.
*/
typedef enum _TIMER_TYPE
{
NotificationTimer,
SynchronizationTimer
} TIMER_TYPE;
/**
* Wait operation types for kernel wait routines.
*/
typedef enum _WAIT_TYPE
{
WaitAll,
@@ -182,6 +240,11 @@ typedef enum _WAIT_TYPE
// Strings
//
/**
* The ANSI_STRING structure defines a counted string used for ANSI strings.
*
* \sa https://learn.microsoft.com/en-us/windows/win32/api/ntdef/ns-ntdef-string
*/
typedef struct _STRING
{
USHORT Length;
@@ -195,7 +258,13 @@ typedef PSTRING PUTF8_STRING;
typedef const STRING *PCSTRING;
typedef const ANSI_STRING *PCANSI_STRING;
typedef const OEM_STRING *PCOEM_STRING;
typedef const STRING *PCUTF8_STRING;
/**
* The UNICODE_STRING structure defines a counted string used for Unicode strings.
*
* \sa https://learn.microsoft.com/en-us/windows/win32/api/ntdef/ns-ntdef-_unicode_string
*/
typedef struct _UNICODE_STRING
{
USHORT Length;
@@ -205,7 +274,28 @@ typedef struct _UNICODE_STRING
typedef const UNICODE_STRING *PCUNICODE_STRING;
#define RTL_CONSTANT_STRING(s) { sizeof((s)) - sizeof((s)[0]), sizeof((s)), (PWCH)(s) }
#ifdef __cplusplus
extern "C++"
{
template <size_t N> char _RTL_CONSTANT_STRING_type_check(const char (&s)[N]);
template <size_t N> char _RTL_CONSTANT_STRING_type_check(const WCHAR (&s)[N]);
// __typeof would be desirable here instead of sizeof.
template <size_t N> class _RTL_CONSTANT_STRING_remove_const_template_class;
template <> class _RTL_CONSTANT_STRING_remove_const_template_class<sizeof(char)> {public: typedef char T; };
template <> class _RTL_CONSTANT_STRING_remove_const_template_class<sizeof(WCHAR)> {public: typedef WCHAR T; };
#define _RTL_CONSTANT_STRING_remove_const_macro(s) \
(const_cast<_RTL_CONSTANT_STRING_remove_const_template_class<sizeof((s)[0])>::T*>(s))
}
#else
char _RTL_CONSTANT_STRING_type_check(const void *s);
#define _RTL_CONSTANT_STRING_remove_const_macro(s) (s)
#endif
#define RTL_CONSTANT_STRING(s) \
{ \
sizeof( s ) - sizeof( (s)[0] ), \
sizeof( s ) / (sizeof(_RTL_CONSTANT_STRING_type_check(s))), \
_RTL_CONSTANT_STRING_remove_const_macro(s) \
}
#define DECLARE_CONST_UNICODE_STRING(_var, _str) \
const WCHAR _var ## _buffer[] = _str; \
@@ -259,6 +349,11 @@ typedef struct _SINGLE_LIST_ENTRY32
ULONG Next;
} SINGLE_LIST_ENTRY32, *PSINGLE_LIST_ENTRY32;
/**
* The STRING32 structure is a 32-bit thunked representation of the `STRING` structure.
*
* \remarks Used for marshaling between 32-bit and 64-bit contexts.
*/
typedef struct _STRING32
{
USHORT Length;
@@ -269,6 +364,14 @@ typedef struct _STRING32
typedef STRING32 UNICODE_STRING32, *PUNICODE_STRING32;
typedef STRING32 ANSI_STRING32, *PANSI_STRING32;
typedef const STRING32 *PCUNICODE_STRING32;
typedef const STRING32 *PCANSI_STRING32;
/**
* The STRING64 structure is a 64-bit thunked representation of the `STRING` structure.
*
* \remarks Used for marshaling between 64-bit and 32-bit contexts.
*/
typedef struct _STRING64
{
USHORT Length;
@@ -279,37 +382,115 @@ typedef struct _STRING64
typedef STRING64 UNICODE_STRING64, *PUNICODE_STRING64;
typedef STRING64 ANSI_STRING64, *PANSI_STRING64;
typedef const STRING64 *PCUNICODE_STRING64;
typedef const STRING64 *PCANSI_STRING64;
//
// Object attributes
//
/**
* Protects the object from being closed by certain APIs (platform specific).
*/
#define OBJ_PROTECT_CLOSE 0x00000001L
/**
* This handle can be inherited by child processes of the current process.
*/
#define OBJ_INHERIT 0x00000002L
/**
* Request auditing when the object is closed.
*/
#define OBJ_AUDIT_OBJECT_CLOSE 0x00000004L
/**
* Prevents automatic rights upgrade on the object.
*/
#define OBJ_NO_RIGHTS_UPGRADE 0x00000008L
/**
* This flag only applies to objects that are named within the object manager.
* By default such objects are deleted when all open handles to them are closed.
* If this flag is specified, the object is not deleted when all open handles are closed.
* The NtMakeTemporaryObject function can be used to delete permanent objects.
*/
#define OBJ_PERMANENT 0x00000010L
/**
* OBJ_EXCLUSIVE 0x00000020L
*
* Only a single handle can be open for this object.
*/
#define OBJ_EXCLUSIVE 0x00000020L
/**
* If this flag is specified, a case-insensitive comparison is used when matching the name
* pointed to by the ObjectName member against the names of existing objects.
* Otherwise, object names are compared using the default system settings.
*/
#define OBJ_CASE_INSENSITIVE 0x00000040L
/**
* If this flag is specified, by using the object handle, to a routine that creates objects
* and if that object already exists, the routine should open that object.
* Otherwise, the routine creating the object returns an NTSTATUS code of STATUS_OBJECT_NAME_COLLISION.
*/
#define OBJ_OPENIF 0x00000080L
/**
* If an object handle, with this flag set, is passed to a routine that opens objects
* and if the object is a symbolic link object, the routine should open the symbolic link
* object itself, rather than the object that the symbolic link refers to (which is the default behavior).
*/
#define OBJ_OPENLINK 0x00000100L
/**
* The handle is created in system process context and can only be accessed from kernel mode.
*/
#define OBJ_KERNEL_HANDLE 0x00000200L
/**
* The routine opening the handle should enforce all access checks for the object,
* even if the handle is being opened in kernel mode.
*/
#define OBJ_FORCE_ACCESS_CHECK 0x00000400L
/**
* Separate device maps exists for each user in the system, and each user can manage
* their own device maps. If this flag is set, the process user's device map is used
* during impersonation instead of the impersonated user's device map.
*/
#define OBJ_IGNORE_IMPERSONATED_DEVICEMAP 0x00000800L
/**
* If this flag is set, no reparse points will be followed when parsing the name of the associated object.
* If any reparses are encountered the attempt will fail and return an STATUS_REPARSE_POINT_ENCOUNTERED result.
* This can be used to determine if there are any reparse points in the object's path, in security scenarios.
*/
#define OBJ_DONT_REPARSE 0x00001000L
/**
* Mask of valid object attribute flags.
*/
#define OBJ_VALID_ATTRIBUTES 0x00001FF2L
/**
* The OBJECT_ATTRIBUTES structure specifies attributes that can be applied
* to objects or object handles by routines that create objects and/or return handles to objects.
*
* \sa https://learn.microsoft.com/en-us/windows/win32/api/ntdef/ns-ntdef-_object_attributes
*/
typedef struct _OBJECT_ATTRIBUTES
{
ULONG Length;
HANDLE RootDirectory;
PCUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor; // PSECURITY_DESCRIPTOR;
PVOID SecurityQualityOfService; // PSECURITY_QUALITY_OF_SERVICE
PSECURITY_DESCRIPTOR SecurityDescriptor;
PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef const OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;
/**
* The InitializeObjectAttributes macro initializes the opaque OBJECT_ATTRIBUTES structure,
* which specifies the properties of an object handle to routines that open handles.
*
* \param p A pointer to the OBJECT_ATTRIBUTES structure to initialize.
* \param n A pointer to a Unicode string that contains a fully qualified object name, or a relative path name for which a handle is to be opened.
* \param a Specifies one or more of the OBJ_* attributes flags.
* \param r A handle to the root object directory for the path name specified in the ObjectName parameter
* \param s A pointer to a security descriptor to apply to an object when it is created or NULL to accept the default security for the object.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/ntdef/ns-ntdef-_object_attributes
*/
#define InitializeObjectAttributes(p, n, a, r, s) { \
(p)->Length = sizeof(OBJECT_ATTRIBUTES); \
(p)->RootDirectory = r; \
@@ -338,6 +519,10 @@ typedef const OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;
// Portability
//
/**
* The OBJECT_ATTRIBUTES64 structure is a 64-bit thunked representation of OBJECT_ATTRIBUTES.
* \remarks Used for marshaling between 64-bit and 32-bit contexts.
*/
typedef struct _OBJECT_ATTRIBUTES64
{
ULONG Length;
@@ -350,6 +535,10 @@ typedef struct _OBJECT_ATTRIBUTES64
typedef const OBJECT_ATTRIBUTES64 *PCOBJECT_ATTRIBUTES64;
/**
* The OBJECT_ATTRIBUTES32 structure is a 32-bit thunked representation of OBJECT_ATTRIBUTES.
* \remarks Used for marshaling between 32-bit and 64-bit contexts.
*/
typedef struct _OBJECT_ATTRIBUTES32
{
ULONG Length;
@@ -366,6 +555,9 @@ typedef const OBJECT_ATTRIBUTES32 *PCOBJECT_ATTRIBUTES32;
// Product types
//
/**
* The NT_PRODUCT_TYPE enum identifies the Windows product family for the operating system.
*/
typedef enum _NT_PRODUCT_TYPE
{
NtProductWinNt = 1,
@@ -373,6 +565,9 @@ typedef enum _NT_PRODUCT_TYPE
NtProductServer
} NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
/**
* The SUITE_TYPE enum represents the installed Windows product suite or feature set.
*/
typedef enum _SUITE_TYPE
{
SmallBusiness,
@@ -399,26 +594,40 @@ typedef enum _SUITE_TYPE
// Specific
//
/**
* The CLIENT_ID structure contains identifiers of a process and a thread.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/a11e7129-685b-4535-8d37-21d4596ac057
*/
typedef struct _CLIENT_ID
{
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
/**
* The CLIENT_ID32 structure is a 32-bit version of CLIENT_ID.
* \remarks Used for marshaling between 32-bit and 64-bit contexts.
*/
typedef struct _CLIENT_ID32
{
ULONG UniqueProcess;
ULONG UniqueThread;
} CLIENT_ID32, *PCLIENT_ID32;
/**
* The CLIENT_ID64 structure is a 64-bit version of CLIENT_ID.
* \remarks Used for marshaling between 64-bit and 32-bit contexts.
*/
typedef struct _CLIENT_ID64
{
ULONGLONG UniqueProcess;
ULONGLONG UniqueThread;
} CLIENT_ID64, *PCLIENT_ID64;
#include <pshpack4.h>
/**
* The KSYSTEM_TIME structure represents interrupt time, system time, and time zone bias.
*/
typedef struct _KSYSTEM_TIME
{
ULONG LowPart;
@@ -426,7 +635,272 @@ typedef struct _KSYSTEM_TIME
LONG High2Time;
} KSYSTEM_TIME, *PKSYSTEM_TIME;
#include <poppack.h>
#if defined(__INTELLISENSE__) || defined(DOXYGEN)
#ifndef AFFINITY_MASK
/**
* The AFFINITY_MASK macro creates a single-bit affinity mask from an index.
*
* \param n Zero-based bit index.
* \return A `KAFFINITY` mask with only bit @p n set.
* \remarks Shifting by a value >= bit-width of `KAFFINITY` is undefined behavior.
*/
#define AFFINITY_MASK(n) ((KAFFINITY)1 << (n))
#endif
#ifndef FlagOn
/**
* The FlagOn macro tests whether any bits in a subset are set in a flag value.
*
* \param _F The flag value to test.
* \param _SF The subset of flags to test for.
* \return Non-zero if any bits in @p _SF are set in @p _F; otherwise zero.
* \remarks This returns the raw AND result (not normalized to BOOLEAN).
*/
#define FlagOn(_F, _SF) ((_F) & (_SF))
#endif
#ifndef BooleanFlagOn
/**
* The BooleanFlagOn macro tests whether any bits in a subset are set and returns a BOOLEAN.
*
* \param F The flag value to test.
* \param SF The subset of flags to test for.
* \return `TRUE` if any bits in @p SF are set in @p F; otherwise `FALSE`.
* \remarks The result is explicitly converted to `BOOLEAN`.
*/
#define BooleanFlagOn(F, SF) ((BOOLEAN)(((F) & (SF)) != 0))
#endif
#ifndef SetFlag
/**
* The SetFlag macro sets bits in a flag value (in-place).
*
* \param _F The flag lvalue to modify.
* \param _SF The bits to set in @p _F.
* \remarks This macro modifies @p _F by OR-ing it with @p _SF.
*/
#define SetFlag(_F, _SF) ((_F) |= (_SF))
#endif
#ifndef ClearFlag
/**
* The ClearFlag macro clears bits in a flag value (in-place).
*
* \param _F The flag lvalue to modify.
* \param _SF The bits to clear from @p _F.
* \remarks This macro modifies @p _F by AND-ing it with the complement of @p _SF.
*/
#define ClearFlag(_F, _SF) ((_F) &= ~(_SF))
#endif
#ifndef Add2Ptr
/**
* The Add2Ptr macro adds a byte offset to a pointer.
*
* \param P The base pointer.
* \param I The byte offset to add.
* \return A pointer equal to @p P advanced by @p I bytes.
* \remarks The addition is performed using `PUCHAR` arithmetic and cast to `PVOID`.
*/
#define Add2Ptr(P,I) ((PVOID)((PUCHAR)(P) + (I)))
#endif
#ifndef PtrOffset
/**
* The PtrOffset macro computes the byte offset between two pointers.
*
* \param B The base pointer.
* \param O The other pointer.
* \return The byte offset from @p B to @p O, cast to `ULONG`.
* \remarks If the true offset does not fit in `ULONG`, truncation may occur.
*/
#define PtrOffset(B,O) ((ULONG)((ULONG_PTR)(O) - (ULONG_PTR)(B)))
#endif
#ifndef ALIGN_DOWN_BY
/**
* The ALIGN_DOWN_BY macro aligns a value down to a specified alignment boundary.
*
* \param Length The value to align.
* \param Alignment The alignment boundary in bytes (typically a power of two).
* \return @p Length rounded down to the nearest multiple of @p Alignment.
* \remarks Non power-of-two alignments may produce unexpected results.
*/
#define ALIGN_DOWN_BY(Length, Alignment) ((ULONG_PTR)(Length) & ~((ULONG_PTR)(Alignment) - 1))
#endif
#ifndef ALIGN_UP_BY
/**
* The ALIGN_UP_BY macro aligns a value up to a specified alignment boundary.
*
* \param Length The value to align.
* \param Alignment The alignment boundary in bytes (typically a power of two).
* \return @p Length rounded up to the nearest multiple of @p Alignment.
* \remarks This uses ALIGN_DOWN_BY after adding (@p Alignment - 1).
*/
#define ALIGN_UP_BY(Length, Alignment) (ALIGN_DOWN_BY(((ULONG_PTR)(Length) + (Alignment) - 1), Alignment))
#endif
#ifndef ALIGN_DOWN_POINTER_BY
/**
* The ALIGN_DOWN_POINTER_BY macro aligns a pointer down to a specified alignment boundary.
*
* \param Address The pointer to align.
* \param Alignment The alignment boundary in bytes (typically a power of two).
* \return A pointer at or below @p Address aligned down to @p Alignment.
* \remarks The pointer is treated as an integer (`ULONG_PTR`) for masking.
*/
#define ALIGN_DOWN_POINTER_BY(Address, Alignment) ((PVOID)ALIGN_DOWN_BY(Address, Alignment))
#endif
#ifndef ALIGN_UP_POINTER_BY
/**
* The ALIGN_UP_POINTER_BY macro aligns a pointer up to a specified alignment boundary.
*
* \param Address The pointer to align.
* \param Alignment The alignment boundary in bytes (typically a power of two).
* \return A pointer at or above @p Address aligned up to @p Alignment.
* \remarks This is a pointer wrapper over ALIGN_UP_BY.
*/
#define ALIGN_UP_POINTER_BY(Address, Alignment) ((PVOID)ALIGN_UP_BY(Address, Alignment))
#endif
#ifndef ALIGN_DOWN
/**
* The ALIGN_DOWN macro aligns a value down using sizeof(Type) as the boundary.
*
* \param Length The value to align.
* \param Type The type whose size is used as the alignment boundary.
* \return @p Length rounded down to the nearest multiple of sizeof(@p Type).
* \remarks This is a convenience wrapper over ALIGN_DOWN_BY.
*/
#define ALIGN_DOWN(Length, Type) ALIGN_DOWN_BY(Length, sizeof(Type))
#endif
#ifndef ALIGN_UP
/**
* The ALIGN_UP macro aligns a value up using sizeof(Type) as the boundary.
*
* \param Length The value to align.
* \param Type The type whose size is used as the alignment boundary.
* \return @p Length rounded up to the nearest multiple of sizeof(@p Type).
* \remarks This is a convenience wrapper over ALIGN_UP_BY.
*/
#define ALIGN_UP(Length, Type) ALIGN_UP_BY(Length, sizeof(Type))
#endif
#ifndef ALIGN_DOWN_POINTER
/**
* The ALIGN_DOWN_POINTER macro aligns a pointer down using sizeof(Type) as the boundary.
*
* \param Address The pointer to align.
* \param Type The type whose size is used as the alignment boundary.
* \return A pointer at or below @p Address aligned down to sizeof(@p Type).
* \remarks This is a convenience wrapper over ALIGN_DOWN_POINTER_BY.
*/
#define ALIGN_DOWN_POINTER(Address, Type) ALIGN_DOWN_POINTER_BY(Address, sizeof(Type))
#endif
#ifndef ALIGN_UP_POINTER
/**
* The ALIGN_UP_POINTER macro aligns a pointer up using sizeof(Type) as the boundary.
*
* \param Address The pointer to align.
* \param Type The type whose size is used as the alignment boundary.
* \return A pointer at or above @p Address aligned up to sizeof(@p Type).
* \remarks This is a convenience wrapper over ALIGN_UP_POINTER_BY.
*/
#define ALIGN_UP_POINTER(Address, Type) ALIGN_UP_POINTER_BY(Address, sizeof(Type))
#endif
#ifndef IS_ALIGNED
/**
* The IS_ALIGNED macro tests whether an address is aligned to a given boundary.
*
* \param Address The address/pointer value to test.
* \param Alignment The alignment boundary in bytes (typically a power of two).
* \return Non-zero if @p Address is aligned to @p Alignment; otherwise zero.
* \remarks The test checks that the low bits masked by (@p Alignment - 1) are zero.
*/
#define IS_ALIGNED(Address, Alignment) ((((ULONG_PTR)(Address)) & ((Alignment) - 1)) == 0)
#endif
#ifndef PAGE_SIZE
/**
* The PAGE_SIZE macro defines the assumed system page size in bytes.
*
* \return The page size in bytes (default 0x1000).
* \remarks This assumes 4 KiB pages.
*/
#define PAGE_SIZE 0x1000
#endif
#ifndef PAGE_MASK
/**
* The PAGE_MASK macro defines the mask for offsets within a page.
*
* \return The page offset mask (default 0xFFF).
* \remarks This is typically PAGE_SIZE - 1 for power-of-two page sizes.
*/
#define PAGE_MASK 0xFFF
#endif
#ifndef PAGE_SHIFT
/**
* The PAGE_SHIFT macro defines the bit shift corresponding to PAGE_SIZE.
*
* \return The shift value (default 0xC, i.e., 12).
* \remarks For 4 KiB pages, PAGE_SHIFT is 12 because 2^12 = 4096.
*/
#define PAGE_SHIFT 0xC
#endif
#ifndef BYTE_OFFSET
/**
* The BYTE_OFFSET macro returns the byte offset of an address within its page.
*
* \param Address The address/pointer value.
* \return The offset in bytes within the containing page.
* \remarks This masks the address with PAGE_MASK.
*/
#define BYTE_OFFSET(Address) ((SIZE_T)((ULONG_PTR)(Address) & PAGE_MASK))
#endif
#ifndef PAGE_ALIGN
/**
* The PAGE_ALIGN macro aligns an address down to the base of its page.
*
* \param Address The address/pointer value.
* \return The page-aligned base address containing @p Address.
* \remarks This clears the low bits specified by PAGE_MASK.
*/
#define PAGE_ALIGN(Address) ((PVOID)((ULONG_PTR)(Address) & ~PAGE_MASK))
#endif
#ifndef PAGE_OFFSET
/**
* The PAGE_OFFSET macro returns the offset of a pointer within its page.
*
* \param p The pointer value.
* \return The offset in bytes within the page (0..PAGE_MASK).
* \remarks This is equivalent to (PAGE_MASK & (ULONG_PTR)p).
*/
#define PAGE_OFFSET(p) ((PAGE_MASK) & (ULONG_PTR)(p))
#endif
#ifndef PAGE_TAILSIZE
/**
* The PAGE_TAILSIZE macro returns the number of bytes from a pointer to the end of its page.
*
* \param p The pointer value.
* \return The remaining bytes in the page starting at @p p.
* \remarks This is computed as PAGE_SIZE - PAGE_OFFSET(p).
*/
#define PAGE_TAILSIZE(p) (PAGE_SIZE - PAGE_OFFSET(p))
#endif
#else
#ifndef AFFINITY_MASK
#define AFFINITY_MASK(n) ((KAFFINITY)1 << (n))
@@ -452,32 +926,32 @@ typedef struct _KSYSTEM_TIME
#define PtrOffset(B,O) ((ULONG)((ULONG_PTR)(O) - (ULONG_PTR)(B)))
#endif
#ifndef ALIGN_UP_BY
#define ALIGN_UP_BY(Address, Align) (((ULONG_PTR)(Address) + (Align) - 1) & ~((Align) - 1))
#endif
#ifndef ALIGN_UP_POINTER_BY
#define ALIGN_UP_POINTER_BY(Pointer, Align) ((PVOID)ALIGN_UP_BY(Pointer, Align))
#endif
#ifndef ALIGN_UP
#define ALIGN_UP(Address, Type) ALIGN_UP_BY(Address, sizeof(Type))
#endif
#ifndef ALIGN_UP_POINTER
#define ALIGN_UP_POINTER(Pointer, Type) ((PVOID)ALIGN_UP(Pointer, Type))
#endif
#ifndef ALIGN_DOWN_BY
#define ALIGN_DOWN_BY(Address, Align) ((ULONG_PTR)(Address) & ~((ULONG_PTR)(Align) - 1))
#define ALIGN_DOWN_BY(Length, Alignment) ((ULONG_PTR)(Length) & ~((ULONG_PTR)(Alignment) - 1))
#endif
#ifndef ALIGN_UP_BY
#define ALIGN_UP_BY(Length, Alignment) (ALIGN_DOWN_BY(((ULONG_PTR)(Length) + (Alignment) - 1), Alignment))
#endif
#ifndef ALIGN_DOWN_POINTER_BY
#define ALIGN_DOWN_POINTER_BY(Pointer, Align) ((PVOID)ALIGN_DOWN_BY(Pointer, Align))
#define ALIGN_DOWN_POINTER_BY(Address, Alignment) ((PVOID)ALIGN_DOWN_BY(Address, Alignment))
#endif
#ifndef ALIGN_UP_POINTER_BY
#define ALIGN_UP_POINTER_BY(Address, Alignment) ((PVOID)ALIGN_UP_BY(Address, Alignment))
#endif
#ifndef ALIGN_DOWN
#define ALIGN_DOWN(Address, Type) ALIGN_DOWN_BY(Address, sizeof(Type))
#define ALIGN_DOWN(Length, Type) ALIGN_DOWN_BY(Length, sizeof(Type))
#endif
#ifndef ALIGN_UP
#define ALIGN_UP(Length, Type) ALIGN_UP_BY(Length, sizeof(Type))
#endif
#ifndef ALIGN_DOWN_POINTER
#define ALIGN_DOWN_POINTER(Pointer, Type) ((PVOID)ALIGN_DOWN(Pointer, Type))
#define ALIGN_DOWN_POINTER(Address, Type) ALIGN_DOWN_POINTER_BY(Address, sizeof(Type))
#endif
#ifndef ALIGN_UP_POINTER
#define ALIGN_UP_POINTER(Address, Type) ALIGN_UP_POINTER_BY(Address, sizeof(Type))
#endif
#ifndef IS_ALIGNED
#define IS_ALIGNED(Pointer, Alignment) ((((ULONG_PTR)(Pointer)) & ((Alignment) - 1)) == 0)
#define IS_ALIGNED(Address, Alignment) ((((ULONG_PTR)(Address)) & ((Alignment) - 1)) == 0)
#endif
#ifndef PAGE_SIZE
@@ -493,18 +967,22 @@ typedef struct _KSYSTEM_TIME
#ifndef BYTE_OFFSET
#define BYTE_OFFSET(Address) ((SIZE_T)((ULONG_PTR)(Address) & PAGE_MASK))
#endif
#ifndef PAGE_ALIGN
#define PAGE_ALIGN(Address) ((PVOID)((ULONG_PTR)(Address) & ~PAGE_MASK))
#endif
#ifndef PAGE_OFFSET
#define PAGE_OFFSET(p) ((PAGE_MASK) & (ULONG_PTR)(p))
#endif
#ifndef PAGE_TAILSIZE
#define PAGE_TAILSIZE(p) (PAGE_SIZE - PAGE_OFFSET(p))
#endif
#ifndef ADDRESS_AND_SIZE_TO_SPAN_PAGES
#define ADDRESS_AND_SIZE_TO_SPAN_PAGES(Address, Size) ((BYTE_OFFSET(Address) + ((SIZE_T)(Size)) + PAGE_MASK) >> PAGE_SHIFT)
#endif
#ifndef ROUND_TO_SIZE
#define ROUND_TO_SIZE(Size, Alignment) ((((ULONG_PTR)(Size))+((Alignment)-1)) & ~(ULONG_PTR)((Alignment)-1))
#define ROUND_TO_SIZE(Size, Alignment) ((((ULONG_PTR)(Size)) + ((Alignment) - 1)) & ~(ULONG_PTR)((Alignment) - 1))
#endif
#ifndef ROUND_TO_PAGES
#define ROUND_TO_PAGES(Size) (((ULONG_PTR)(Size) + PAGE_MASK) & ~PAGE_MASK)
@@ -513,6 +991,233 @@ typedef struct _KSYSTEM_TIME
#define BYTES_TO_PAGES(Size) (((Size) >> PAGE_SHIFT) + (((Size) & PAGE_MASK) != 0))
#endif
#endif // defined(__INTELLISENSE__) || defined(DOXYGEN)
#ifdef _DEBUG
#ifndef ASSERT
#define ASSERT( exp ) \
((!(exp)) ? \
(RtlAssert( (PVOID)#exp, (PVOID)__FILE__, __LINE__, NULL ),FALSE) : \
TRUE)
#endif
#ifndef ASSERTMSG
#define ASSERTMSG( msg, exp ) \
((!(exp)) ? \
(RtlAssert( (PVOID)#exp, (PVOID)__FILE__, __LINE__, (PSTR)msg ),FALSE) : \
TRUE)
#endif
#ifndef RTL_SOFT_ASSERT
#define RTL_SOFT_ASSERT(_exp) \
((!(_exp)) ? \
(DbgPrint("%s(%d): Soft assertion failed\n Expression: %s\n", __FILE__, __LINE__, #_exp),FALSE) : \
TRUE)
#endif
#ifndef RTL_SOFT_ASSERTMSG
#define RTL_SOFT_ASSERTMSG(_msg, _exp) \
((!(_exp)) ? \
(DbgPrint("%s(%d): Soft assertion failed\n Expression: %s\n Message: %s\n", __FILE__, __LINE__, #_exp, (_msg)),FALSE) : \
TRUE)
#endif
#ifndef RTL_VERIFY
#define RTL_VERIFY ASSERT
#endif
#ifndef RTL_VERIFYMSG
#define RTL_VERIFYMSG ASSERTMSG
#endif
#ifndef RTL_SOFT_VERIFY
#define RTL_SOFT_VERIFY RTL_SOFT_ASSERT
#endif
#ifndef RTL_SOFT_VERIFYMSG
#define RTL_SOFT_VERIFYMSG RTL_SOFT_ASSERTMSG
#endif
#else // _DEBUG
#ifndef ASSERT
#define ASSERT( exp ) ((void) 0)
#endif
#ifndef ASSERTMSG
#define ASSERTMSG( msg, exp ) ((void) 0)
#endif
#ifndef RTL_SOFT_ASSERT
#define RTL_SOFT_ASSERT(_exp) ((void) 0)
#endif
#ifndef RTL_SOFT_ASSERTMSG
#define RTL_SOFT_ASSERTMSG(_msg, _exp) ((void) 0)
#endif
#ifndef RTL_VERIFY
#define RTL_VERIFY( exp ) ((exp) ? TRUE : FALSE)
#endif
#ifndef RTL_VERIFYMSG
#define RTL_VERIFYMSG( msg, exp ) ((exp) ? TRUE : FALSE)
#endif
#ifndef RTL_SOFT_VERIFY
#define RTL_SOFT_VERIFY(_exp) ((_exp) ? TRUE : FALSE)
#endif
#ifndef RTL_SOFT_VERIFYMSG
#define RTL_SOFT_VERIFYMSG(msg, _exp) ((_exp) ? TRUE : FALSE)
#endif
#endif // _DEBUG
#ifndef RTL_ASSERT
#define RTL_ASSERT ASSERT
#endif
#ifndef RTL_ASSERTMSG
#define RTL_ASSERTMSG ASSERTMSG
#endif
#ifndef NT_ANALYSIS_ASSUME
#if defined(_PREFAST_)
#define NT_ANALYSIS_ASSUME(_exp) _Analysis_assume_(_exp)
#else // _PREFAST_
#ifdef _DEBUG
#define NT_ANALYSIS_ASSUME(_exp) ((void) 0)
#else // _DEBUG
#define NT_ANALYSIS_ASSUME(_exp) __noop(_exp)
#endif // _DEBUG
#endif // _PREFAST_
#endif // NT_ANALYSIS_ASSUME
#ifndef NT_ASSERT_ACTION
#define NT_ASSERT_ACTION(_exp) \
((!(_exp)) ? \
(__annotation(L"Debug", L"AssertFail", L## #_exp), \
DbgRaiseAssertionFailure(), FALSE) : \
TRUE)
#endif
#ifndef NT_ASSERTMSG_ACTION
#define NT_ASSERTMSG_ACTION(_msg, _exp) \
((!(_exp)) ? \
(__annotation(L"Debug", L"AssertFail", L##_msg), \
DbgRaiseAssertionFailure(), FALSE) : \
TRUE)
#endif
#ifndef NT_ASSERTMSGW_ACTION
#define NT_ASSERTMSGW_ACTION(_msg, _exp) \
((!(_exp)) ? \
(__annotation(L"Debug", L"AssertFail", _msg), \
DbgRaiseAssertionFailure(), FALSE) : \
TRUE)
#endif
#ifdef _DEBUG
#ifndef NT_ASSERT_ASSUME
#define NT_ASSERT_ASSUME(_exp) \
(NT_ANALYSIS_ASSUME(_exp), NT_ASSERT_ACTION(_exp))
#endif
#ifndef NT_ASSERTMSG_ASSUME
#define NT_ASSERTMSG_ASSUME(_msg, _exp) \
(NT_ANALYSIS_ASSUME(_exp), NT_ASSERTMSG_ACTION(_msg, _exp))
#endif
#ifdef NT_ASSERTMSGW_ASSUME
#define NT_ASSERTMSGW_ASSUME(_msg, _exp) \
(NT_ANALYSIS_ASSUME(_exp), NT_ASSERTMSGW_ACTION(_msg, _exp))
#endif
#ifndef NT_ASSERT_NOASSUME
#define NT_ASSERT_NOASSUME NT_ASSERT_ASSUME
#endif
#ifndef NT_ASSERTMSG_NOASSUME
#define NT_ASSERTMSG_NOASSUME NT_ASSERTMSG_ASSUME
#endif
#ifndef NT_ASSERTMSGW_NOASSUME
#define NT_ASSERTMSGW_NOASSUME NT_ASSERTMSGW_ASSUME
#endif
#ifndef NT_VERIFY
#define NT_VERIFY NT_ASSERT
#endif
#ifndef NT_VERIFYMSG
#define NT_VERIFYMSG NT_ASSERTMSG
#endif
#ifndef NT_VERIFYMSGW
#define NT_VERIFYMSGW NT_ASSERTMSGW
#endif
#else // _DEBUG
#ifndef NT_ASSERT_ASSUME
#define NT_ASSERT_ASSUME(_exp) (NT_ANALYSIS_ASSUME(_exp), 0)
#endif
#ifndef NT_ASSERTMSG_ASSUME
#define NT_ASSERTMSG_ASSUME(_msg, _exp) (NT_ANALYSIS_ASSUME(_exp), 0)
#endif
#ifndef NT_ASSERTMSGW_ASSUME
#define NT_ASSERTMSGW_ASSUME(_msg, _exp) (NT_ANALYSIS_ASSUME(_exp), 0)
#endif
#ifndef NT_ASSERT_NOASSUME
#define NT_ASSERT_NOASSUME(_exp) ((void) 0)
#endif
#ifndef NT_ASSERTMSG_NOASSUME
#define NT_ASSERTMSG_NOASSUME(_msg, _exp) ((void) 0)
#endif
#ifndef NT_ASSERTMSGW_NOASSUME
#define NT_ASSERTMSGW_NOASSUME(_msg, _exp) ((void) 0)
#endif
#ifndef NT_VERIFY
#define NT_VERIFY(_exp) (NT_ANALYSIS_ASSUME(_exp), ((_exp) ? TRUE : FALSE))
#endif
#ifndef NT_VERIFYMSG
#define NT_VERIFYMSG(_msg, _exp ) (NT_ANALYSIS_ASSUME(_exp), ((_exp) ? TRUE : FALSE))
#endif
#ifndef NT_VERIFYMSGW
#define NT_VERIFYMSGW(_msg, _exp) (NT_ANALYSIS_ASSUME(_exp), ((_exp) ? TRUE : FALSE))
#endif
#endif // _DEBUG
#ifndef NT_FRE_ASSERT
#define NT_FRE_ASSERT(_exp) (NT_ANALYSIS_ASSUME(_exp), NT_ASSERT_ACTION(_exp))
#endif
#ifndef NT_FRE_ASSERTMSG
#define NT_FRE_ASSERTMSG(_msg, _exp) (NT_ANALYSIS_ASSUME(_exp), NT_ASSERTMSG_ACTION(_msg, _exp))
#endif
#ifndef NT_FRE_ASSERTMSGW
#define NT_FRE_ASSERTMSGW(_msg, _exp) (NT_ANALYSIS_ASSUME(_exp), NT_ASSERTMSGW_ACTION(_msg, _exp))
#endif
#ifdef NT_ASSERT_ALWAYS_ASSUMES
#ifndef NT_ASSERT
#define NT_ASSERT NT_ASSERT_ASSUME
#endif
#ifndef NT_ASSERTMSG
#define NT_ASSERTMSG NT_ASSERTMSG_ASSUME
#endif
#ifndef NT_ASSERTMSGW
#define NT_ASSERTMSGW NT_ASSERTMSGW_ASSUME
#endif
#else // NT_ASSERT_ALWAYS_ASSUMES
#ifndef NT_ASSERT
#define NT_ASSERT NT_ASSERT_NOASSUME
#endif
#ifndef NT_ASSERTMSG
#define NT_ASSERTMSG NT_ASSERTMSG_NOASSUME
#endif
#ifndef NT_ASSERTMSGW
#define NT_ASSERTMSGW NT_ASSERTMSGW_NOASSUME
#endif
#endif // NT_ASSERT_ALWAYS_ASSUMES
#endif // _NTDEF_
#endif
#endif // _PHNT_NTDEF_H
phnt_windows.h
+12 -1
View File
@@ -108,8 +108,8 @@
#include <ole2.h>
#endif
typedef double DOUBLE;
typedef DOUBLE *PDOUBLE;
typedef GUID *PGUID;
// Desktop access rights
#define DESKTOP_ALL_ACCESS \
@@ -159,6 +159,12 @@ typedef GUID *PGUID;
#define CONTAINING_RECORD(address, type, field) \
((type *)((ULONG_PTR)(address) - UFIELD_OFFSET(type, field)))
#ifndef __PGUID_DEFINED__
#define __PGUID_DEFINED__
typedef GUID* PGUID;
#endif
#ifndef __PCGUID_DEFINED__
#define __PCGUID_DEFINED__
typedef const GUID* PCGUID;
@@ -168,4 +174,9 @@ typedef const GUID* PCGUID;
DEFINE_GUID(GUID_NULL, 0x00000000L, 0x0000, 0x0000, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00);
#endif
#ifndef __PCSID_DEFINED__
#define __PCSID_DEFINED__
typedef const SID* PCSID;
#endif
#endif
smbios.h
+1 -1
View File
@@ -744,7 +744,7 @@ C_ASSERT(sizeof(SMBIOS_PROCESSOR_INFORMATION) == 0x33);
#define SMBIOS_PROCESSOR_FAMILY_INTEL_CORE_ULTRA_7 774
#define SMBIOS_PROCESSOR_FAMILY_INTEL_CORE_ULTRA_9 775
// 1024-65533 - Available for assignment
// 65534–65535 - RESERVED
// 65534-65535 - RESERVED
#define SMBIOS_PROCESSOR_STATUS_UNKNOWN 0
#define SMBIOS_PROCESSOR_STATUS_ENABLED 1
usermgr.h
+26 -18
View File
@@ -26,14 +26,16 @@ typedef struct _CRED_PROV_CREDENTIAL
#define USERMGRAPI DECLSPEC_IMPORT
//
// Contexts
//
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
// rev
USERMGRAPI
VOID
WINAPI
NTAPI
UMgrFreeSessionUsers(
_In_ _Post_invalid_ PSESSION_USER_CONTEXT SessionUsers
);
@@ -41,7 +43,7 @@ UMgrFreeSessionUsers(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrEnumerateSessionUsers(
_Out_ PULONG Count,
_Outptr_ PSESSION_USER_CONTEXT *SessionUsers
@@ -50,7 +52,7 @@ UMgrEnumerateSessionUsers(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrQueryUserContext(
_In_ HANDLE TokenHandle,
_Out_ PULONGLONG ContextToken
@@ -59,7 +61,7 @@ UMgrQueryUserContext(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrQueryUserContextFromSid(
_In_ PCWSTR SidString,
_Out_ PULONGLONG ContextToken
@@ -68,7 +70,7 @@ UMgrQueryUserContextFromSid(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrQueryUserContextFromName(
_In_ PCWSTR UserName,
_Out_ PULONGLONG ContextToken
@@ -76,14 +78,16 @@ UMgrQueryUserContextFromName(
#endif
//
// Tokens
//
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrQueryDefaultAccountToken(
_Out_ PHANDLE TokenHandle
);
@@ -91,7 +95,7 @@ UMgrQueryDefaultAccountToken(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrQuerySessionUserToken(
_In_ ULONG SessionId,
_Out_ PHANDLE TokenHandle
@@ -100,7 +104,7 @@ UMgrQuerySessionUserToken(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrQueryUserToken(
_In_ ULONGLONG Context,
_Out_ PHANDLE TokenHandle
@@ -109,7 +113,7 @@ UMgrQueryUserToken(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrQueryUserTokenFromSid(
_In_ PCWSTR SidString,
_Out_ PHANDLE TokenHandle
@@ -118,7 +122,7 @@ UMgrQueryUserTokenFromSid(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrQueryUserTokenFromName(
_In_ PCWSTR UserName,
_Out_ PHANDLE TokenHandle
@@ -127,7 +131,7 @@ UMgrQueryUserTokenFromName(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrGetConstrainedUserToken(
_In_opt_ HANDLE InputTokenHandle,
_In_ ULONGLONG Context,
@@ -142,7 +146,7 @@ UMgrGetConstrainedUserToken(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrChangeSessionUserToken(
_In_ HANDLE TokenHandle
);
@@ -150,7 +154,7 @@ UMgrChangeSessionUserToken(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrGetImpersonationTokenForContext(
_In_ HANDLE InputTokenHandle,
_In_ ULONGLONG Context,
@@ -164,7 +168,7 @@ UMgrGetImpersonationTokenForContext(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrGetSessionActiveShellUserToken(
_In_ ULONG SessionId,
_Out_ PHANDLE TokenHandle
@@ -172,14 +176,16 @@ UMgrGetSessionActiveShellUserToken(
#endif
//
// Single-session SKU
//
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrOpenProcessTokenForQuery(
_In_ ULONG ProcessId,
_Out_ PHANDLE TokenHandle
@@ -188,7 +194,7 @@ UMgrOpenProcessTokenForQuery(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrOpenProcessHandleForAccess(
_In_ ACCESS_MASK DesiredAccess,
_In_ ULONG ProcessId,
@@ -197,14 +203,16 @@ UMgrOpenProcessHandleForAccess(
#endif
//
// Credentials
//
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrFreeUserCredentials(
_In_ PCRED_PROV_CREDENTIAL Credentials
);
@@ -212,7 +220,7 @@ UMgrFreeUserCredentials(
// rev
USERMGRAPI
HRESULT
WINAPI
NTAPI
UMgrGetCachedCredentials(
_In_ PSID Sid,
_Outptr_ PCRED_PROV_CREDENTIAL *Credentials
winsta.h
+392 -114
View File
@@ -7,18 +7,26 @@
#ifndef _WINSTA_H
#define _WINSTA_H
//
// Sessions
//
// Specifies the current server.
#define WINSTATION_CURRENT_SERVER ((HANDLE)NULL)
#define WINSTATION_CURRENT_SERVER_HANDLE ((HANDLE)NULL)
#define WINSTATION_CURRENT_SERVER_NAME (NULL)
#define SERVERNAME_CURRENT ((PWSTR)NULL)
// Specifies the current session (SessionId)
#define WINSTATION_CURRENT_SESSION ((ULONG)-1)
#define LOGONID_CURRENT (-1)
// Specifies any-session (SessionId)
#define WINSTATION_ANY_SESSION ((ULONG)-2)
//
// Access rights
//
#define WINSTATION_QUERY 0x00000001 // WinStationQueryInformation
#define WINSTATION_SET 0x00000002 // WinStationSetInformation
@@ -122,51 +130,59 @@ typedef struct _SESSIONIDW
WINSTATIONSTATECLASS State;
} SESSIONIDW, *PSESSIONIDW;
// private
/**
* The WINSTATIONINFOCLASS enumeration indicates the class of data for which to either query or set on the server.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/f333c223-de8a-46e1-a83e-79cbdab92371
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/1bba9ff2-71d3-49a3-bb26-2e5f6fcab3ee
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/2a5ee131-a1dd-44c7-9880-98df708061ea
*/
typedef enum _WINSTATIONINFOCLASS
{
WinStationCreateData, // q: WINSTATIONCREATE
WinStationConfiguration, // qs: WINSTACONFIGWIRE + USERCONFIG
WinStationPdParams, // qs: PDPARAMS
WinStationWd, // q: WDCONFIG
WinStationPd, // q: PDCONFIG2 + PDPARAMS
WinStationPrinter, // qs: Not supported.
WinStationClient, // q: WINSTATIONCLIENT
WinStationModules, // q:
WinStationInformation, // q: WINSTATIONINFORMATION
WinStationTrace, // qs:
WinStationBeep, // s: // 10
WinStationEncryptionOff, // s:
WinStationEncryptionPerm,
WinStationNtSecurity, // s: (open secure desktop ctrl+alt+del)
WinStationUserToken, // q: WINSTATIONUSERTOKEN
WinStationUnused1,
WinStationVideoData, // q: WINSTATIONVIDEODATA
WinStationInitialProgram, // s: (set current process as initial program)
WinStationCd, // q: CDCONFIG
WinStationSystemTrace, // qs:
WinStationVirtualData, // q: // 20
WinStationClientData, // WINSTATIONCLIENTDATA
WinStationSecureDesktopEnter, // qs:
WinStationSecureDesktopExit, // qs:
WinStationLoadBalanceSessionTarget, // q: ULONG
WinStationLoadIndicator, // q: WINSTATIONLOADINDICATORDATA
WinStationShadowInfo, // qs: WINSTATIONSHADOW
WinStationDigProductId, // WINSTATIONPRODID
WinStationLockedState, // BOOL
WinStationRemoteAddress, // WINSTATIONREMOTEADDRESS
WinStationIdleTime, // ULONG // 30
WinStationLastReconnectType, // ULONG
WinStationDisallowAutoReconnect, // qs: BOOLEAN
WinStationMprNotifyInfo,
WinStationExecSrvSystemPipe, // WCHAR[48]
WinStationSmartCardAutoLogon, // BOOLEAN
WinStationIsAdminLoggedOn, // BOOLEAN
WinStationReconnectedFromId, // ULONG
WinStationEffectsPolicy, // ULONG
WinStationType, // ULONG
WinStationInformationEx, // WINSTATIONINFORMATIONEX // 40
WinStationValidationInfo
WinStationCreateData, // q: WINSTATIONCREATE
WinStationConfiguration, // qs: WINSTACONFIGWIRE + USERCONFIG
WinStationPdParams, // qs: PDPARAMSWIRE + PDPARAMS
WinStationWd, // q: WDCONFIG
WinStationPd, // q: PDCONFIG2 + PDPARAMS
WinStationPrinter, // qs: Not supported.
WinStationClient, // q: VARDATA_WIRE + WINSTATIONCLIENT
WinStationModules, // q:
WinStationInformation, // q: WINSTATIONINFORMATION
WinStationTrace, // s: TS_TRACE
WinStationBeep, // s: BEEPINPUT // 10
WinStationEncryptionOff, // s:
WinStationEncryptionPerm, // s:
WinStationNtSecurity, // s: (open secure desktop ctrl+alt+del)
WinStationUserToken, // q: WINSTATIONUSERTOKEN
WinStationUnused1, // qs: Not supported.
WinStationVideoData, // q: WINSTATIONVIDEODATA
WinStationInitialProgram, // s: (set current process as initial program)
WinStationCd, // q: CDCONFIG
WinStationSystemTrace, // s: TS_TRACE
WinStationVirtualData, // q: PVOID // 20
WinStationClientData, // s: VARDATA_WIRE + WINSTATIONCLIENTDATA
WinStationSecureDesktopEnter, // qs:
WinStationSecureDesktopExit, // qs:
WinStationLoadBalanceSessionTarget, // q: ULONG
WinStationLoadIndicator, // q: WINSTATIONLOADINDICATORDATA
WinStationShadowInfo, // qs: WINSTATIONSHADOW
WinStationDigProductId, // q: WINSTATIONPRODID
WinStationLockedState, // qs: BOOL
WinStationRemoteAddress, // q: WINSTATIONREMOTEADDRESS
WinStationIdleTime, // q: ULONG // 30
WinStationLastReconnectType, // q: ULONG
WinStationDisallowAutoReconnect, // qs: BOOLEAN
WinStationMprNotifyInfo, // q:
WinStationExecSrvSystemPipe, // q: WCHAR[48]
WinStationSmartCardAutoLogon, // q: BOOLEAN
WinStationIsAdminLoggedOn, // q: BOOLEAN
WinStationReconnectedFromId, // q: ULONG
WinStationEffectsPolicy, // q: ULONG
WinStationType, // q: ULONG
WinStationInformationEx, // q: VARDATA_WIRE + WINSTATIONINFORMATIONEX // 40
WinStationValidationInfo, // q:
WinStationActivityId, // q: GUID
MaxWinStationInfoClass
} WINSTATIONINFOCLASS;
/**
@@ -181,7 +197,7 @@ typedef struct _WINSTATIONCREATE
typedef struct _WINSTACONFIGWIRE
{
WCHAR Comment[61]; // The WinStation descriptive comment.
CHAR OEMId[4]; // Value identifying the OEM implementor of the TermService Listener to which this session (WinStation) belongs. This can be any value defined by the implementer (OEM) of the listener.
CHAR OEMId[4]; // Value identifying the OEM implementer of the TermService Listener to which this session (WinStation) belongs. This can be any value defined by the implementer (OEM) of the listener.
VARDATA_WIRE UserConfig; // VARDATA_WIRE structure defining the size and offset of the variable-length user configuration data succeeding it.
VARDATA_WIRE NewFields; // VARDATA_WIRE structure defining the size and offset of the variable-length new data succeeding it. This field is not used and is a placeholder for any new data, if and when added.
} WINSTACONFIGWIRE, *PWINSTACONFIGWIRE;
@@ -193,7 +209,9 @@ typedef enum _CALLBACKCLASS
Callback_Fixed
} CALLBACKCLASS;
// The SHADOWCLASS enumeration is used to indicate the shadow-related settings for a session running on a terminal server.
/**
* The SHADOWCLASS enumeration is used to indicate the shadow-related settings for a session running on a terminal server.
*/
typedef enum _SHADOWCLASS
{
Shadow_Disable, // Shadowing is disabled.
@@ -203,8 +221,11 @@ typedef enum _SHADOWCLASS
Shadow_EnableNoInputNoNotify // Permission is not asked first from the session being shadowed. The shadower is not permitted keyboard and mouse input and MUST observe the shadowed session.
} SHADOWCLASS;
// For a specific terminal server session, the USERCONFIG structure indicates the user and session configuration.
// https://msdn.microsoft.com/en-us/library/cc248610.aspx
/**
* The USERCONFIG structure indicates the user and session configuration for a specific terminal server session.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/dba750b8-cb35-4e88-9811-e2a1f8a10701
*/
typedef struct _USERCONFIG
{
ULONG fInheritAutoLogon : 1;
@@ -379,7 +400,11 @@ typedef struct _OEMTDCONFIG
ULONG Flags;
} OEMTDCONFIG, *POEMTDCONFIG;
// Retrieves transport protocol driver parameters.
/**
* The PDPARAMS structure represents the transport protocol driver parameters.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/ff0e2998-fb8b-4dff-ab64-8427fad556eb
*/
typedef struct _PDPARAMS
{
SDCLASS SdClass; // Stack driver class. Indicates which one of the union's structures is valid.
@@ -392,7 +417,11 @@ typedef struct _PDPARAMS
};
} PDPARAMS, *PPDPARAMS;
// The WinStation (session) driver configuration.
/**
* The WDCONFIG structure represents the WinStation (session) driver configuration.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/d1bf099b-eb54-4ed9-a723-0b1062dbc128
*/
typedef struct _WDCONFIG
{
WDNAME WdName; // The descriptive name of the WinStation driver.
@@ -404,7 +433,11 @@ typedef struct _WDCONFIG
WDPREFIX WdPrefix; // Used as the prefix of the WinStation name generated for the connected sessions with this WinStation driver.
} WDCONFIG, *PWDCONFIG;
// The protocol driver's software configuration.
/**
* The PDCONFIG2 structure represents the protocol driver's software configuration.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/74204022-eb7c-4454-b3d0-24f642c892a4
*/
typedef struct _PDCONFIG2
{
PDNAME PdName;
@@ -419,7 +452,11 @@ typedef struct _PDCONFIG2
ULONG KeepAliveTimeout;
} PDCONFIG2, *PPDCONFIG2;
// WinStationClient
/**
* The WINSTATIONCLIENT structure defines the client-requested configuration when connecting to a session.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/673d8ac0-f557-48cb-98a6-49925160d729
*/
typedef struct _WINSTATIONCLIENT
{
ULONG fTextOnly : 1;
@@ -518,57 +555,109 @@ typedef struct _TSHARE_CACHE
ULONG Reserved;
} TSHARE_CACHE, *PTSHARE_CACHE;
/**
* The CACHE_STATISTICS structure represents the cache statistics on the protocol.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/81203ca2-e58b-4681-affa-924e59671b5c
*/
typedef struct CACHE_STATISTICS
{
USHORT ProtocolType;
USHORT Length;
USHORT ProtocolType; // Protocol type.
USHORT Length; // Length of data in the protocol-specific area. Can be up to 20 * sizeof(ULONG) in size.
union
{
RESERVED_CACHE ReservedCacheStats;
TSHARE_CACHE TShareCacheStats;
ULONG Reserved[20];
RESERVED_CACHE ReservedCacheStats; // Not used.
TSHARE_CACHE TShareCacheStats; // Protocol cache statistics.
ULONG Reserved[20]; // Reserved for future use.
} Specific;
} CACHE_STATISTICS, *PCACHE_STATISTICS;
/**
* The PROTOCOLSTATUS structure represents the status of the protocol used by the session.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/c9066753-acbd-4678-9a72-8fb1b080bd09
*/
typedef struct _PROTOCOLSTATUS
{
PROTOCOLCOUNTERS Output;
PROTOCOLCOUNTERS Input;
CACHE_STATISTICS Cache;
ULONG AsyncSignal;
ULONG AsyncSignalMask;
PROTOCOLCOUNTERS Output; // A PROTOCOLCOUNTERS structure containing the output protocol counters.
PROTOCOLCOUNTERS Input; // A PROTOCOLCOUNTERS structure containing the input protocol counters.
CACHE_STATISTICS Cache; // A CACHE_STATISTICS structure containing statistics for the cache.
ULONG AsyncSignal; // Indicator of async signal, such as MS_CTS_ON, for async protocols.
ULONG AsyncSignalMask; // Mask of async signal events, such as EV_CTS, for async protocols.
} PROTOCOLSTATUS, *PPROTOCOLSTATUS;
// Retrieves information on the session.
/**
* The WINSTATIONINFORMATION structure retrieves the state, connect time, last input time, and so on, for a session.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/c2566d8b-7016-440b-b7e0-0d07c3b2418f
*/
typedef struct _WINSTATIONINFORMATION
{
WINSTATIONSTATECLASS ConnectState;
WINSTATIONNAME WinStationName;
ULONG LogonId;
LARGE_INTEGER ConnectTime;
LARGE_INTEGER DisconnectTime;
LARGE_INTEGER LastInputTime;
LARGE_INTEGER LogonTime;
PROTOCOLSTATUS Status;
WCHAR Domain[DOMAIN_LENGTH + 1];
WCHAR UserName[USERNAME_LENGTH + 1];
LARGE_INTEGER CurrentTime;
WINSTATIONSTATECLASS ConnectState; // The current connect state of the session.
WINSTATIONNAME WinStationName; // The name of the session.
ULONG LogonId; // The session identifier of the session.
LARGE_INTEGER ConnectTime; // The time of the most recent connection to the session.
LARGE_INTEGER DisconnectTime; // The time of the most recent disconnection from the session.
LARGE_INTEGER LastInputTime; // The time the session last received input.
LARGE_INTEGER LogonTime; // The time of the logon to the session.
PROTOCOLSTATUS Status; // The status of the protocol.
WCHAR Domain[DOMAIN_LENGTH + 1]; // The user's domain name.
WCHAR UserName[USERNAME_LENGTH + 1]; // The user's user name.
LARGE_INTEGER CurrentTime; // The current time in the session.
} WINSTATIONINFORMATION, *PWINSTATIONINFORMATION;
// Retrieves the user's token in the session. Caller requires WINSTATION_ALL_ACCESS permission.
/**
* The TS_TRACE structure specifies fields used for configuring tracing operations in TS binaries if they are checked.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/ad349575-5369-4830-a174-1920a7af8d5f
*/
typedef struct _TS_TRACE
{
WCHAR TraceFile[256]; // Specifies the file name, if any, to which to write debug information.
BOOLEAN Debugger; // Specifies whether debugger is attached.
BOOLEAN Timestamp; // Specifies whether to append time stamp to the traces logged.
ULONG TraceClass; // Classes of tracing to log. They enable tracing for the various terminal server binaries/functionalities.
ULONG TraceEnable; // Type of tracing calls log.
WCHAR TraceOption[64]; // Trace option string. This can be an empty string meaning collect trace for all files and lines in those files.
} TS_TRACE, *PTS_TRACE;
/**
* The BEEPINPUT structure performs a beep in the session.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/2faf4c5b-3a79-491a-9d1a-145f46a797d1
*/
typedef struct _BEEPINPUT
{
/**
* If the session ID is 0, this can be any of the values that can be passed to the standard MessageBeep function.
* If the session ID is not 0, a frequency and duration is chosen by the server to send as a beep to the session.
*/
ULONG Type;
} BEEPINPUT, *PBEEPINPUT;
/**
* The WINSTATIONUSERTOKEN structure retrieves the user's token for the session.
*
* \remarks Caller requires WINSTATION_ALL_ACCESS permission.
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/07f9831c-6331-43e5-ba27-d3d58772eb4c
*/
typedef struct _WINSTATIONUSERTOKEN
{
HANDLE ProcessId;
HANDLE ThreadId;
HANDLE UserToken;
HANDLE ProcessId; // Specifies the Process ID.
HANDLE ThreadId; // Specifies the calling thread.
HANDLE UserToken; // Returns the user token that is currently logged on to the session.
} WINSTATIONUSERTOKEN, *PWINSTATIONUSERTOKEN;
// Retrieves resolution and color depth of the session.
/**
* The WINSTATIONVIDEODATA structure defines the resolution and color depth of a session.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/5f95f657-89d2-472d-b4ab-b0595618dbd1
*/
typedef struct _WINSTATIONVIDEODATA
{
USHORT HResolution;
USHORT VResolution;
USHORT fColorDepth;
USHORT HResolution; // Specifies the horizontal resolution, in pixels.
USHORT VResolution; // Specifies the vertical resolution, in pixels.
USHORT ColorDepth; // Specifies the color depth.
} WINSTATIONVIDEODATA, *PWINSTATIONVIDEODATA;
typedef enum _CDCLASS
@@ -578,7 +667,11 @@ typedef enum _CDCLASS
CdClass_Maximum,
} CDCLASS;
// Connection driver configuration. It is used for connecting via modem to a server.
/**
* The CDCONFIG structure defines the configuration used for connecting via modem to a server.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/f88900e1-c159-4f02-b3ae-84f05eec212f
*/
typedef struct _CDCONFIG
{
CDCLASS CdClass; // Connection driver type.
@@ -594,7 +687,7 @@ typedef CHAR* PCLIENTDATANAME;
typedef struct _WINSTATIONCLIENTDATA
{
CLIENTDATANAME DataName; // Identifies the type of data sent in this WINSTATIONCLIENTDATA structure. The definition is dependent on the caller and on the client receiving it. This MUST be a data name following a format similar to that of the CLIENTDATANAME data type.
CLIENTDATANAME DataName; // Identifies the type of data sent in this WINSTATIONCLIENTDATA structure.
BOOLEAN fUnicodeData; // TRUE indicates data is in Unicode format; FALSE otherwise.
} WINSTATIONCLIENTDATA, *PWINSTATIONCLIENTDATA;
@@ -608,19 +701,28 @@ typedef enum _LOADFACTORTYPE
CPUConstraint // CPU usage is the constraint.
} LOADFACTORTYPE;
// The WINSTATIONLOADINDICATORDATA structure defines data used for the load balancing of a server.
/**
* The WINSTATIONLOADINDICATORDATA structure defines data used for the load balancing of a server.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/91459fa1-77e8-4987-a6f0-fe7dd3e62bfc
*/
typedef struct _WINSTATIONLOADINDICATORDATA
{
ULONG RemainingSessionCapacity; // The estimated number of additional sessions that can be supported given the CPU constraint.
LOADFACTORTYPE LoadFactor; // Indicates the most constrained current resource.
ULONG TotalSessions; // The total number of sessions.
ULONG DisconnectedSessions; // The number of disconnected sessions.
LARGE_INTEGER IdleCPU; // This is always set to 0.
LARGE_INTEGER TotalCPU; // This is always set to 0.
ULONG RawSessionCapacity; // The raw number of sessions capacity.
ULONG reserved[9]; // Reserved.
ULONG RemainingSessionCapacity; // The estimated number of additional sessions that can be supported given the CPU constraint.
LOADFACTORTYPE LoadFactor; // Indicates the most constrained current resource.
ULONG TotalSessions; // The total number of sessions.
ULONG DisconnectedSessions; // The number of disconnected sessions.
LARGE_INTEGER IdleCPU; // This is always set to 0.
LARGE_INTEGER TotalCPU; // This is always set to 0.
ULONG RawSessionCapacity; // The raw number of sessions capacity.
ULONG reserved[9]; // Reserved.
} WINSTATIONLOADINDICATORDATA, *PWINSTATIONLOADINDICATORDATA;
/**
* The SHADOWSTATECLASS enumeration specifies WinStation shadow states.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/c55fbd8f-d7e3-4efe-9ca6-d0985dab9602
*/
typedef enum _SHADOWSTATECLASS
{
State_NoShadow, // No shadow operations are currently being performed on this session.
@@ -674,7 +776,9 @@ typedef struct _WINSTATIONREMOTEADDRESS
};
} WINSTATIONREMOTEADDRESS, *PWINSTATIONREMOTEADDRESS;
//
// WinStationInformationEx
//
// private
typedef struct _WINSTATIONINFORMATIONEX_LEVEL1
@@ -739,6 +843,7 @@ typedef struct _TS_PROCESS_INFORMATION_NT4
#define SIZEOF_TS4_SYSTEM_THREAD_INFORMATION 64
#define SIZEOF_TS4_SYSTEM_PROCESS_INFORMATION 136
_Struct_size_bytes_(NextEntryOffset)
typedef struct _TS_SYS_PROCESS_INFORMATION
{
ULONG NextEntryOffset;
@@ -772,21 +877,21 @@ typedef struct _TS_SYS_PROCESS_INFORMATION
typedef struct _TS_ALL_PROCESSES_INFO
{
PTS_SYS_PROCESS_INFORMATION pTsProcessInfo;
PTS_SYS_PROCESS_INFORMATION TsProcessInfo;
ULONG SizeOfSid;
PSID pSid;
PSID Sid;
} TS_ALL_PROCESSES_INFO, *PTS_ALL_PROCESSES_INFO;
typedef struct _TS_COUNTER_HEADER
{
DWORD dwCounterID;
BOOLEAN bResult;
ULONG CounterID;
BOOLEAN Result;
} TS_COUNTER_HEADER, *PTS_COUNTER_HEADER;
typedef struct _TS_COUNTER
{
TS_COUNTER_HEADER CounterHead;
DWORD dwValue;
ULONG Value;
LARGE_INTEGER StartTime;
} TS_COUNTER, *PTS_COUNTER;
@@ -817,6 +922,18 @@ typedef struct _TS_COUNTER
// begin_rev
// Flags for WinStationRegisterConsoleNotification
/**
* WNOTIFY_THIS_SESSION
*
* Specifies that only session notifications involving the session attached
* to by the window identified by the WindowHandle are to be received.
*/
#define WNOTIFY_THIS_SESSION 0x0
/**
* WNOTIFY_ALL_SESSIONS
*
* Specifies that all session notifications are to be received.
*/
#define WNOTIFY_ALL_SESSIONS 0x1
// end_rev
@@ -824,10 +941,13 @@ typedef struct _TS_COUNTER
// server handles to indicate the local server. -1 can be specified for session IDs to indicate the
// current session ID.
#define LOGONID_CURRENT (-1)
#define SERVERNAME_CURRENT ((PWSTR)NULL)
// rev
/**
* The WinStationFreeMemory routine frees memory allocated by a Remote Desktop Services function.
*
* \param Buffer Pointer to the memory to free.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsfreememory
*/
NTSYSAPI
BOOLEAN
NTAPI
@@ -836,6 +956,13 @@ WinStationFreeMemory(
);
// rev
/**
* The WinStationOpenServerW routine opens a handle to the specified Remote Desktop Session Host (RD Session Host) server.
*
* \param ServerName Pointer to a null-terminated string specifying the NetBIOS name of the RD Session Host server.
* \return HANDLE If the function succeeds, the return value is a handle to the specified server.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsopenserverw
*/
NTSYSAPI
HANDLE
NTAPI
@@ -844,6 +971,29 @@ WinStationOpenServerW(
);
// rev
/**
* The WinStationOpenServerExW routine opens a handle to the specified Remote Desktop Session Host (RD Session Host) server
* or Remote Desktop Virtualization Host (RD Virtualization Host) server.
*
* \param ServerName Pointer to a null-terminated string specifying the NetBIOS name of the RD Session Host server.
* \return HANDLE If the function succeeds, the return value is a handle to the specified server.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsopenserverexw
*/
NTSYSAPI
HANDLE
NTAPI
WinStationOpenServerExW(
_In_opt_ PCWSTR ServerName
);
// rev
/**
* The WinStationCloseServer routine closes an open handle to a Remote Desktop Session Host (RD Session Host) server.
*
* \param ServerHandle A handle to an RD Session Host server opened by a call to the WinStationOpenServerW function.
* \return BOOLEAN Nonzero if the function succeeds, or zero otherwise. To get extended error information, call GetLastError.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtscloseserver
*/
NTSYSAPI
BOOLEAN
NTAPI
@@ -869,6 +1019,16 @@ WinStationGetTermSrvCountersValue(
_Inout_ PTS_COUNTER Counters // set counter IDs before calling
);
// rev
/**
* The WinStationShutdownSystem routine shuts down (and optionally restarts) the specified Remote Desktop Session Host (RD Session Host) server.
*
* \param ServerHandle Handle to an RD Session Host server, or specify WINSTATION_CURRENT_SERVER to indicate the server on which your application is running.
* \param ShutdownFlags Indicates the type of shutdown. This parameter can be one of the WSD_* values.
* \return BOOLEAN Nonzero if the function succeeds, or zero otherwise. To get extended error information, call GetLastError.
* \remarks To shut down or restart the system, the calling process must have the SE_SHUTDOWN_NAME privilege enabled.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsshutdownsystem
*/
NTSYSAPI
BOOLEAN
NTAPI
@@ -888,6 +1048,16 @@ WinStationWaitSystemEvent(
);
// rev
/**
* The WinStationRegisterConsoleNotification routine shuts down (and optionally restarts) the specified Remote Desktop Session Host (RD Session Host) server.
*
* \param ServerHandle Handle to an RD Session Host server, or WINSTATION_CURRENT_SERVER .
* \param WindowHandle Handle of the window to receive session change notifications.
* \param Flags Specifies whether to receive notifications for all sessions (WNOTIFY_ALL_SESSIONS) or only for the console session.
* \return BOOLEAN Nonzero if the function succeeds, or zero otherwise. To get extended error information, call GetLastError.
* \remarks To shut down or restart the system, the calling process must have the SE_SHUTDOWN_NAME privilege enabled.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsregistersessionnotificationex
*/
NTSYSAPI
BOOLEAN
NTAPI
@@ -906,8 +1076,6 @@ WinStationUnRegisterConsoleNotification(
_In_ HWND WindowHandle
);
// Sessions
// rev
NTSYSAPI
BOOLEAN
@@ -918,6 +1086,21 @@ WinStationEnumerateW(
_Out_ PULONG Count
);
/**
* The WinStationQueryInformationW routine retrieves information about a window station.
*
* \param ServerHandle A handle to an RD Session Host server. Specify a handle opened by the WinStationOpenServerW function, or specify WINSTATION_CURRENT_SERVER to indicate the server on which your application is running.
* \param SessionId A Remote Desktop Services session identifier.
* To indicate the session in which the calling application is running (or the current session) specify WINSTATION_CURRENT_SESSION.
* Only specify WINSTATION_CURRENT_SESSION when obtaining session information on the local server.
* If WINSTATION_CURRENT_SESSION is specified when querying session information on a remote server, the returned session information will be inconsistent. Do not use the returned data.
* \param WinStationInformationClass A value from the TOKEN_INFORMATION_CLASS enumerated type identifying the type of information to be retrieved.
* \param WinStationInformation Pointer to a caller-allocated buffer that receives the requested information about the token.
* \param WinStationInformationLength Length, in bytes, of the caller-allocated TokenInformation buffer.
* \param ReturnLength Pointer to a caller-allocated variable that receives the actual length, in bytes, of the information returned in the TokenInformation buffer.
* \return BOOLEAN Nonzero if the function succeeds, or zero otherwise. To get extended error information, call GetLastError.
* \sa https://learn.microsoft.com/en-us/previous-versions/aa383827(v=vs.85)
*/
NTSYSAPI
BOOLEAN
NTAPI
@@ -925,9 +1108,9 @@ WinStationQueryInformationW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ WINSTATIONINFOCLASS WinStationInformationClass,
_Out_writes_bytes_(WinStationInformationLength) PVOID pWinStationInformation,
_Out_writes_bytes_(WinStationInformationLength) PVOID WinStationInformation,
_In_ ULONG WinStationInformationLength,
_Out_ PULONG pReturnLength
_Out_ PULONG ReturnLength
);
// rev
@@ -938,7 +1121,7 @@ WinStationSetInformationW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ WINSTATIONINFOCLASS WinStationInformationClass,
_In_reads_bytes_(WinStationInformationLength) PVOID pWinStationInformation,
_In_reads_bytes_(WinStationInformationLength) PVOID WinStationInformation,
_In_ ULONG WinStationInformationLength
);
@@ -948,7 +1131,7 @@ BOOLEAN
NTAPI
WinStationQueryCurrentSessionInformation(
_In_ WINSTATIONINFOCLASS WinStationInformationClass,
_In_reads_bytes_(WinStationInformationLength) PVOID pWinStationInformation,
_In_reads_bytes_(WinStationInformationLength) PVOID WinStationInformation,
_In_ ULONG WinStationInformationLength
);
@@ -958,7 +1141,7 @@ NTAPI
WinStationNameFromLogonIdW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_Out_writes_(WINSTATIONNAME_LENGTH + 1) PWSTR pWinStationName
_Out_writes_(WINSTATIONNAME_LENGTH + 1) PWSTR WinStationName
);
// rev
@@ -967,7 +1150,7 @@ BOOLEAN
NTAPI
LogonIdFromWinStationNameW(
_In_opt_ HANDLE ServerHandle,
_In_ PCWSTR pWinStationName,
_In_ PCWSTR WinStationName,
_Out_ PULONG SessionId
);
@@ -995,7 +1178,7 @@ WinStationConnectW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ ULONG TargetSessionId,
_In_opt_ PCWSTR pPassword,
_In_opt_ PCWSTR Password,
_In_ BOOLEAN bWait
);
@@ -1091,13 +1274,13 @@ WinStationGetProcessSid(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG ProcessId,
_In_ FILETIME ProcessStartTime,
_Out_ PVOID pProcessUserSid,
_Out_ PVOID ProcessUserSid,
_Inout_ PULONG dwSidSize
);
//
// Services isolation
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
//
// rev
NTSYSAPI
@@ -1115,8 +1298,6 @@ WinStationRevertFromServicesSession(
VOID
);
#endif
// Misc.
NTSYSAPI
BOOLEAN
@@ -1200,6 +1381,61 @@ WinStationSetAutologonPassword(
_In_ PCSTR Password
);
// private
typedef struct _EXECENVDATAEX_LEVEL1
{
LONG ExecEnvId;
LONG State;
LONG AbsSessionId;
PWSTR SessionName;
PWSTR HostName;
PWSTR UserName;
PWSTR DomainName;
PWSTR FarmName;
} EXECENVDATAEX_LEVEL1, *PEXECENVDATAEX_LEVEL1;
typedef union _EXECENVDATAEX_PAYLOAD
{
UCHAR Data[1];
EXECENVDATAEX_LEVEL1 Level1;
// define level 2/3/4 here
} EXECENVDATAEX_PAYLOAD;
typedef struct _EXECENVDATAEX
{
ULONG Level;
EXECENVDATAEX_PAYLOAD Payload;
} EXECENVDATAEX, *PEXECENVDATAEX;
// typedef struct _EXECENVDATAEX
// {
// ULONG Level;
// union
// {
// EXECENVDATAEX_LEVEL1 ExecEnvEnum_Level1;
// };
// } EXECENVDATAEX, *PEXECENVDATAEX;
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationGetAllSessionsEx(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG Level, // Must be 1
_Out_ PEXECENVDATAEX *SessionData,
_Out_ PULONG Count
);
// rev
NTSYSAPI
VOID
WINAPI
WinStationFreeEXECENVDATAEX(
_In_opt_ PEXECENVDATAEX SessionData,
_In_ ULONG Count
);
typedef enum _SessionType
{
SESSIONTYPE_UNKNOWN = 0,
@@ -1272,4 +1508,46 @@ WinStationGetLoggedOnCount(
_Out_ PULONG LoggedOnDeviceCount
);
// rev
/**
* The WinStationSetRenderHint routine is used by an application that is displaying content that
* can be optimized for displaying in a remote session to identify the region of a window that is the actual content.
* In the remote session, this content will be encoded, sent to the client, then decoded and displayed.
*
* \param[out] RenderHintID The address of a value that identifies the rendering hint affected by this call.
* If a new hint is being created, this value must contain zero.
* This function will return a unique rendering hint identifier which is used for subsequent calls, such as clearing the hint.
* \param[in] WindowHandle The handle of window linked to lifetime of the rendering hint. This window is used in situations where a hint target is removed without the hint being explicitly cleared.
* \param[in] RenderHintType Specifies the type of hint represented by this call.
* \param[in] HintDataLength The size in bytes, of the HintData buffer.
* \param[in] HintData Additional data for the hint. The format of this data is dependent upon the value passed in the renderHintType parameter.
* \return BOOLEAN Nonzero if the function succeeds, or zero otherwise.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtshintapi/nf-wtshintapi-wtssetrenderhint
*/
NTSYSAPI
BOOLEAN
NTAPI
WinStationSetRenderHint(
_In_opt_ PULONG64 RenderHintID,
_In_ HWND WindowHandle,
_In_ ULONG RenderHintType,
_In_ ULONG HintDataLength,
_In_ PBYTE HintData
);
// rev
/**
* The WinStationActiveSessionExists routine returns active sessions on the system without enumerating through the list of sessions.
* It also does not obtain any extra information from Local Session Manager.
*
* \return BOOLEAN Nonzero if an active session exists.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsactivesessionexists
*/
NTSYSAPI
BOOLEAN
NTAPI
WinStationActiveSessionExists(
VOID
);
#endif