admin/processhacker-phnt
1
0
Fork 0
mirror of https://github.com/processhacker/phnt synced 2026-06-08 16:49:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Sync latest changes

Browse Source
This commit is contained in:
dmex
2022-10-13 07:14:30 +11:00
parent d6135b7b61
commit 7c1adb8a73
18 changed files with 1427 additions and 242 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ntbcd.h
+38 -38
View File
@@ -459,8 +459,8 @@ typedef enum _BCD_ELEMENT_DATATYPE_FORMAT
BCD_ELEMENT_DATATYPE_FORMAT_UNKNOWN,
BCD_ELEMENT_DATATYPE_FORMAT_DEVICE, // 0x01000000
BCD_ELEMENT_DATATYPE_FORMAT_STRING, // 0x02000000
BCD_ELEMENT_DATATYPE_FORMAT_OBJECT, // 0x03000000
BCD_ELEMENT_DATATYPE_FORMAT_OBJECTLIST, // 0x04000000
BCD_ELEMENT_DATATYPE_FORMAT_OBJECT, // 0x03000000
BCD_ELEMENT_DATATYPE_FORMAT_OBJECTLIST, // 0x04000000
BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, // 0x05000000
BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, // 0x06000000
BCD_ELEMENT_DATATYPE_FORMAT_INTEGERLIST, // 0x07000000
@@ -1067,12 +1067,12 @@ typedef enum _BcdLibraryElementTypes
/// <remarks>0x1200001D</remarks>
BcdLibraryString_DebuggerNetKey = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_STRING, 29),
/// <summary>
///
///
/// </summary>
/// <remarks>0x1600001E</remarks>
BcdLibraryBoolean_DebuggerNetVM = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 30),
/// <summary>
///
///
/// </summary>
/// <remarks>0x1200001F</remarks>
BcdLibraryString_DebuggerNetHostIpv6 = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_STRING, 31),
@@ -1098,7 +1098,7 @@ typedef enum _BcdLibraryElementTypes
/// <remarks>0x12000030</remarks>
BcdLibraryString_LoadOptionsString = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_STRING, 48),
/// <summary>
///
///
/// </summary>
/// <remarks>0x16000031</remarks>
BcdLibraryBoolean_AttemptNonBcdStart = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 49),
@@ -1113,7 +1113,7 @@ typedef enum _BcdLibraryElementTypes
/// <remarks>0x16000041</remarks>
BcdLibraryBoolean_DisplayOptionsEdit = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 65),
/// <summary>
///
///
/// </summary>
/// <remarks>0x15000042</remarks>
BcdLibraryInteger_FVEKeyRingAddress = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 66),
@@ -1133,7 +1133,7 @@ typedef enum _BcdLibraryElementTypes
/// <remarks>0x16000045</remarks>
BcdLibraryBoolean_BsdPreserveLog = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 69),
/// <summary>
///
///
/// </summary>
/// <remarks>0x16000046</remarks>
BcdLibraryBoolean_GraphicsModeDisabled = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 70),
@@ -1160,7 +1160,7 @@ typedef enum _BcdLibraryElementTypes
/// <remarks>0x1200004A</remarks>
BcdLibraryString_FontPath = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_STRING, 74),
/// <summary>
///
///
/// </summary>
/// <remarks>0x1500004B</remarks>
BcdLibraryInteger_SiPolicy = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 75),
@@ -1175,7 +1175,7 @@ typedef enum _BcdLibraryElementTypes
/// <remarks>0x16000050</remarks>
BcdLibraryBoolean_ConsoleExtendedInput = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 80),
/// <summary>
///
///
/// </summary>
/// <remarks>0x15000051</remarks>
BcdLibraryInteger_InitialConsoleInput = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 81),
@@ -1212,7 +1212,7 @@ typedef enum _BcdLibraryElementTypes
/// <remarks>0x15000065</remarks>
BcdLibraryInteger_BootUxDisplayMessage = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 101),
/// <summary>
///
///
/// </summary>
/// <remarks>0x15000066</remarks>
BcdLibraryInteger_BootUxDisplayMessageOverride = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 102),
@@ -1237,42 +1237,42 @@ typedef enum _BcdLibraryElementTypes
/// <remarks>0x1600006A</remarks>
BcdLibraryBoolean_BootUxFadeDisable = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 106),
/// <summary>
///
///
/// </summary>
/// <remarks>0x1600006B</remarks>
BcdLibraryBoolean_BootUxReservePoolDebug = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 107),
/// <summary>
///
///
/// </summary>
/// <remarks>0x1600006C</remarks>
BcdLibraryBoolean_BootUxDisable = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 108),
/// <summary>
///
///
/// </summary>
/// <remarks>0x1500006D</remarks>
BcdLibraryInteger_BootUxFadeFrames = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 109),
/// <summary>
///
///
/// </summary>
/// <remarks>0x1600006E</remarks>
BcdLibraryBoolean_BootUxDumpStats = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 110),
/// <summary>
///
///
/// </summary>
/// <remarks>0x1600006F</remarks>
BcdLibraryBoolean_BootUxShowStats = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 111),
/// <summary>
///
///
/// </summary>
/// <remarks>0x16000071</remarks>
BcdLibraryBoolean_MultiBootSystem = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 113),
/// <summary>
///
///
/// </summary>
/// <remarks>0x16000072</remarks>
BcdLibraryBoolean_ForceNoKeyboard = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 114),
/// <summary>
///
///
/// </summary>
/// <remarks>0x15000073</remarks>
BcdLibraryInteger_AliasWindowsKey = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 115),
@@ -1282,12 +1282,12 @@ typedef enum _BcdLibraryElementTypes
/// <remarks>0x16000074</remarks>
BcdLibraryBoolean_BootShutdownDisabled = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 116),
/// <summary>
///
///
/// </summary>
/// <remarks>0x15000075</remarks>
BcdLibraryInteger_PerformanceFrequency = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 117),
/// <summary>
///
///
/// </summary>
/// <remarks>0x15000076</remarks>
BcdLibraryInteger_SecurebootRawPolicy = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 118),
@@ -1298,12 +1298,12 @@ typedef enum _BcdLibraryElementTypes
/// <remarks>0x17000077</remarks>
BcdLibraryIntegerList_AllowedInMemorySettings = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 119),
/// <summary>
///
///
/// </summary>
/// <remarks>0x15000079</remarks>
BcdLibraryInteger_BootUxBitmapTransitionTime = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 121),
/// <summary>
///
///
/// </summary>
/// <remarks>0x1600007A</remarks>
BcdLibraryBoolean_TwoBootImages = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 122),
@@ -1314,47 +1314,47 @@ typedef enum _BcdLibraryElementTypes
/// <remarks>0x1600007B</remarks>
BcdLibraryBoolean_ForceFipsCrypto = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 123),
/// <summary>
///
///
/// </summary>
/// <remarks>0x1500007D</remarks>
BcdLibraryInteger_BootErrorUx = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 125),
/// <summary>
///
///
/// </summary>
/// <remarks>0x1600007E</remarks>
BcdLibraryBoolean_AllowFlightSignatures = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 126),
/// <summary>
///
///
/// </summary>
/// <remarks>0x1500007F</remarks>
BcdLibraryInteger_BootMeasurementLogFormat = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 127),
/// <summary>
///
///
/// </summary>
/// <remarks>0x15000080</remarks>
BcdLibraryInteger_DisplayRotation = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 128),
/// <summary>
///
///
/// </summary>
/// <remarks>0x15000081</remarks>
BcdLibraryInteger_LogControl = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 129),
/// <summary>
///
///
/// </summary>
/// <remarks>0x16000082</remarks>
BcdLibraryBoolean_NoFirmwareSync = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 130),
/// <summary>
///
///
/// </summary>
/// <remarks>0x11000084</remarks>
BcdLibraryDevice_WindowsSystemDevice = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_DEVICE, 132),
/// <summary>
///
///
/// </summary>
/// <remarks>0x16000087</remarks>
BcdLibraryBoolean_NumLockOn = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 135),
/// <summary>
///
///
/// </summary>
/// <remarks>0x12000088</remarks>
BcdLibraryString_AdditionalCiPolicy = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_LIBRARY, BCD_ELEMENT_DATATYPE_FORMAT_STRING, 136),
@@ -1363,32 +1363,32 @@ typedef enum _BcdLibraryElementTypes
typedef enum _BcdTemplateElementTypes
{
/// <summary>
///
///
/// </summary>
/// <remarks>0x45000001</remarks>
BcdSetupInteger_DeviceType = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_SETUPTEMPLATE, BCD_ELEMENT_DATATYPE_FORMAT_INTEGER, 1),
/// <summary>
///
///
/// </summary>
/// <remarks>0x42000002</remarks>
BcdSetupString_ApplicationRelativePath = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_SETUPTEMPLATE, BCD_ELEMENT_DATATYPE_FORMAT_STRING, 2),
/// <summary>
///
///
/// </summary>
/// <remarks>0x42000003</remarks>
BcdSetupString_RamdiskDeviceRelativePath = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_SETUPTEMPLATE, BCD_ELEMENT_DATATYPE_FORMAT_STRING, 3),
/// <summary>
///
///
/// </summary>
/// <remarks>0x46000004</remarks>
BcdSetupBoolean_OmitOsLoaderElements = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_SETUPTEMPLATE, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 4),
/// <summary>
///
///
/// </summary>
/// <remarks>0x47000006</remarks>
BcdSetupIntegerList_ElementsToMigrateList = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_SETUPTEMPLATE, BCD_ELEMENT_DATATYPE_FORMAT_INTEGERLIST, 6),
/// <summary>
///
///
/// </summary>
/// <remarks>0x46000010</remarks>
BcdSetupBoolean_RecoveryOs = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_SETUPTEMPLATE, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 16),
@@ -1491,7 +1491,7 @@ typedef enum _BcdOSLoaderElementTypes
/// <remarks>0x23000003</remarks>
BcdOSLoaderObject_AssociatedResumeObject = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_APPLICATION, BCD_ELEMENT_DATATYPE_FORMAT_OBJECT, 3),
/// <summary>
///
///
/// </summary>
/// <remarks>0x26000004</remarks>
BcdOSLoaderBoolean_StampDisks = MAKE_BCDE_DATA_TYPE(BCD_ELEMENT_DATATYPE_CLASS_APPLICATION, BCD_ELEMENT_DATATYPE_FORMAT_BOOLEAN, 4),
ntexapi.h
+964 -27
View File
File diff suppressed because it is too large Load Diff
ntioapi.h
+12 -36
View File
@@ -158,7 +158,7 @@
#define FILE_PIPE_SERVER_END 0x00000001
// Win32 pipe instance limit (0xff)
#define FILE_PIPE_UNLIMITED_INSTANCES 0xffffffff
#define FILE_PIPE_UNLIMITED_INSTANCES 0xffffffff
// Mailslot values
@@ -398,7 +398,7 @@ typedef struct _FILE_END_OF_FILE_INFORMATION
#define FLAGS_DELAY_REASONS_LOG_FILE_FULL 0x00000001
#define FLAGS_DELAY_REASONS_BITMAP_SCANNED 0x00000002
typedef struct _FILE_END_OF_FILE_INFORMATION_EX
typedef struct _FILE_END_OF_FILE_INFORMATION_EX
{
LARGE_INTEGER EndOfFile;
LARGE_INTEGER PagingFileSizeInMM;
@@ -412,8 +412,7 @@ typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION
LARGE_INTEGER ValidDataLength;
} FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION;
#if (PHNT_VERSION >= PHNT_REDSTONE5)
#define FILE_LINK_REPLACE_IF_EXISTS 0x00000001
#define FILE_LINK_REPLACE_IF_EXISTS 0x00000001 // since RS5
#define FILE_LINK_POSIX_SEMANTICS 0x00000002
#define FILE_LINK_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008
@@ -421,25 +420,13 @@ typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION
#define FILE_LINK_NO_DECREASE_AVAILABLE_SPACE 0x00000020
#define FILE_LINK_PRESERVE_AVAILABLE_SPACE 0x00000030
#define FILE_LINK_IGNORE_READONLY_ATTRIBUTE 0x00000040
#endif
#if (PHNT_VERSION >= PHNT_19H1)
#define FILE_LINK_FORCE_RESIZE_TARGET_SR 0x00000080
#define FILE_LINK_FORCE_RESIZE_TARGET_SR 0x00000080 // since 19H1
#define FILE_LINK_FORCE_RESIZE_SOURCE_SR 0x00000100
#define FILE_LINK_FORCE_RESIZE_SR 0x00000180
#endif
typedef struct _FILE_LINK_INFORMATION
{
#if (PHNT_VERSION >= PHNT_REDSTONE5)
union
{
BOOLEAN ReplaceIfExists; // FileLinkInformation
ULONG Flags; // FileLinkInformationEx
};
#else
BOOLEAN ReplaceIfExists;
#endif
HANDLE RootDirectory;
ULONG FileNameLength;
WCHAR FileName[1];
@@ -469,28 +456,17 @@ typedef struct _FILE_RENAME_INFORMATION
WCHAR FileName[1];
} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
#if (PHNT_VERSION >= PHNT_REDSTONE)
#define FILE_RENAME_REPLACE_IF_EXISTS 0x00000001
#define FILE_RENAME_REPLACE_IF_EXISTS 0x00000001 // since REDSTONE
#define FILE_RENAME_POSIX_SEMANTICS 0x00000002
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE3)
#define FILE_RENAME_SUPPRESS_PIN_STATE_INHERITANCE 0x00000004
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE5)
#define FILE_RENAME_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008
#define FILE_RENAME_SUPPRESS_PIN_STATE_INHERITANCE 0x00000004 // since REDSTONE3
#define FILE_RENAME_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008 // since REDSTONE5
#define FILE_RENAME_NO_INCREASE_AVAILABLE_SPACE 0x00000010
#define FILE_RENAME_NO_DECREASE_AVAILABLE_SPACE 0x00000020
#define FILE_RENAME_PRESERVE_AVAILABLE_SPACE 0x00000030
#define FILE_RENAME_IGNORE_READONLY_ATTRIBUTE 0x00000040
#endif
#if (PHNT_VERSION >= PHNT_19H1)
#define FILE_RENAME_FORCE_RESIZE_TARGET_SR 0x00000080
#define FILE_RENAME_FORCE_RESIZE_TARGET_SR 0x00000080 // since 19H1
#define FILE_RENAME_FORCE_RESIZE_SOURCE_SR 0x00000100
#define FILE_RENAME_FORCE_RESIZE_SR 0x00000180
#endif
typedef struct _FILE_RENAME_INFORMATION_EX
{
@@ -776,7 +752,7 @@ typedef struct _FILE_LINK_ENTRY_FULL_ID_INFORMATION
WCHAR FileName[1];
} FILE_LINK_ENTRY_FULL_ID_INFORMATION, *PFILE_LINK_ENTRY_FULL_ID_INFORMATION;
typedef struct _FILE_LINKS_FULL_ID_INFORMATION
typedef struct _FILE_LINKS_FULL_ID_INFORMATION
{
ULONG BytesNeeded;
ULONG EntriesReturned;
@@ -1710,7 +1686,7 @@ NtUnloadDriver(
#endif
#ifndef IO_COMPLETION_ALL_ACCESS
#define IO_COMPLETION_ALL_ACCESS (IO_COMPLETION_QUERY_STATE|IO_COMPLETION_MODIFY_STATE|STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE)
#define IO_COMPLETION_ALL_ACCESS (IO_COMPLETION_QUERY_STATE|IO_COMPLETION_MODIFY_STATE|STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE)
#endif
typedef enum _IO_COMPLETION_INFORMATION_CLASS
@@ -2097,7 +2073,7 @@ typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER
// Control structure for FSCTL_PIPE_QUERY_CLIENT_PROCESS_V2
typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_V2
typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_V2
{
ULONGLONG ClientSession;
#if !defined(BUILD_WOW6432)
@@ -2231,7 +2207,7 @@ typedef struct _MOUNTMGR_MOUNT_POINT
ULONG DeviceNameOffset;
USHORT DeviceNameLength;
USHORT Reserved3;
} MOUNTMGR_MOUNT_POINT, * PMOUNTMGR_MOUNT_POINT;
} MOUNTMGR_MOUNT_POINT, *PMOUNTMGR_MOUNT_POINT;
// Output structure for IOCTL_MOUNTMGR_DELETE_POINTS, IOCTL_MOUNTMGR_QUERY_POINTS, and IOCTL_MOUNTMGR_DELETE_POINTS_DBONLY.
typedef struct _MOUNTMGR_MOUNT_POINTS
ntldr.h
+8 -8
View File
@@ -12,8 +12,6 @@
#ifndef _NTLDR_H
#define _NTLDR_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// DLLs
typedef BOOLEAN (NTAPI *PLDR_INIT_ROUTINE)(
@@ -228,6 +226,8 @@ typedef struct _LDR_DATA_TABLE_ENTRY
#define LDR_IMAGEMAPPING_TO_MAPPEDVIEW(DllHandle) ((PVOID)(((ULONG_PTR)(DllHandle)) & ~(ULONG_PTR)2))
#define LDR_IS_RESOURCE(DllHandle) (LDR_IS_IMAGEMAPPING(DllHandle) || LDR_IS_DATAFILE(DllHandle))
#if (PHNT_MODE != PHNT_MODE_KERNEL)
NTSYSAPI
NTSTATUS
NTAPI
@@ -676,12 +676,12 @@ LdrGetFileNameFromLoadAsDataTable(
#endif
NTSYSAPI
NTSTATUS
NTAPI
NTSTATUS
NTAPI
LdrDisableThreadCalloutsForDll(
_In_ PVOID DllImageBase
);
// Resources
NTSYSAPI
@@ -737,7 +737,7 @@ LdrFindResourceDirectory_U(
_Out_ PIMAGE_RESOURCE_DIRECTORY *ResourceDirectory
);
// private
// private
typedef struct _LDR_ENUM_RESOURCE_ENTRY
{
union
@@ -846,8 +846,8 @@ LdrQueryProcessModuleInformation(
);
typedef VOID (NTAPI *PLDR_ENUM_CALLBACK)(
_In_ PLDR_DATA_TABLE_ENTRY ModuleInformation,
_In_ PVOID Parameter,
_In_ PLDR_DATA_TABLE_ENTRY ModuleInformation,
_In_ PVOID Parameter,
_Out_ BOOLEAN *Stop
);
ntmisc.h
+19 -16
View File
@@ -61,29 +61,30 @@ NtTraceEvent(
typedef enum _TRACE_CONTROL_INFORMATION_CLASS
{
TraceControlStartLogger = 1,
TraceControlStopLogger = 2,
TraceControlQueryLogger = 3,
TraceControlUpdateLogger = 4,
TraceControlFlushLogger = 5,
TraceControlIncrementLoggerFile = 6,
TraceControlStartLogger = 1, // inout WMI_LOGGER_INFORMATION
TraceControlStopLogger = 2, // inout WMI_LOGGER_INFORMATION
TraceControlQueryLogger = 3, // inout WMI_LOGGER_INFORMATION
TraceControlUpdateLogger = 4, // inout WMI_LOGGER_INFORMATION
TraceControlFlushLogger = 5, // inout WMI_LOGGER_INFORMATION
TraceControlIncrementLoggerFile = 6, // inout WMI_LOGGER_INFORMATION
TraceControlUnknown = 7,
// unused
TraceControlRealtimeConnect = 11,
TraceControlActivityIdCreate = 12,
TraceControlWdiDispatchControl = 13,
TraceControlRealtimeDisconnectConsumerByHandle = 14,
TraceControlRealtimeDisconnectConsumerByHandle = 14, // in HANDLE
TraceControlRegisterGuidsCode = 15,
TraceControlReceiveNotification = 16,
TraceControlSendDataBlock = 17, // EnableGuid
TraceControlSendDataBlock = 17, // ETW_ENABLE_NOTIFICATION_PACKET
TraceControlSendReplyDataBlock = 18,
TraceControlReceiveReplyDataBlock = 19,
TraceControlWdiUpdateSem = 20,
TraceControlEnumTraceGuidList = 21,
TraceControlGetTraceGuidInfo = 22,
TraceControlEnumTraceGuidList = 21, // out GUID[]
TraceControlGetTraceGuidInfo = 22, // in GUID, out TRACE_GUID_INFO
TraceControlEnumerateTraceGuids = 23,
TraceControlRegisterSecurityProv = 24,
TraceControlQueryReferenceTime = 25,
TraceControlTrackProviderBinary = 26,
TraceControlTrackProviderBinary = 26, // in HANDLE
TraceControlAddNotificationEvent = 27,
TraceControlUpdateDisallowList = 28,
TraceControlSetEnableAllKeywordsCode = 29,
@@ -91,16 +92,18 @@ typedef enum _TRACE_CONTROL_INFORMATION_CLASS
TraceControlUseDescriptorTypeCode = 31,
TraceControlEnumTraceGroupList = 32,
TraceControlGetTraceGroupInfo = 33,
TraceControlTraceSetDisallowList= 34,
TraceControlTraceSetDisallowList = 34,
TraceControlSetCompressionSettings = 35,
TraceControlGetCompressionSettings= 36,
TraceControlGetCompressionSettings = 36,
TraceControlUpdatePeriodicCaptureState = 37,
TraceControlGetPrivateSessionTraceHandle = 38,
TraceControlRegisterPrivateSession = 39,
TraceControlQuerySessionDemuxObject = 40,
TraceControlSetProviderBinaryTracking = 41,
TraceControlMaxLoggers = 42,
TraceControlMaxPmcCounter = 43
TraceControlMaxLoggers = 42, // out ULONG
TraceControlMaxPmcCounter = 43, // out ULONG
TraceControlQueryUsedProcessorCount = 44, // ULONG // since WIN11
TraceControlGetPmcOwnership = 45,
} TRACE_CONTROL_INFORMATION_CLASS;
#if (PHNT_VERSION >= PHNT_VISTA)
ntmmapi.h
+9 -9
View File
@@ -30,11 +30,11 @@
#define PAGE_ENCLAVE_THREAD_CONTROL 0x80000000
#define PAGE_TARGETS_NO_UPDATE 0x40000000
#define PAGE_TARGETS_INVALID 0x40000000
#define PAGE_ENCLAVE_UNVALIDATED 0x20000000
#define PAGE_ENCLAVE_UNVALIDATED 0x20000000
#define PAGE_ENCLAVE_NO_CHANGE 0x20000000
#define PAGE_ENCLAVE_MASK 0x10000000
#define PAGE_ENCLAVE_DECOMMIT (PAGE_ENCLAVE_MASK | 0)
#define PAGE_ENCLAVE_SS_FIRST (PAGE_ENCLAVE_MASK | 1)
#define PAGE_ENCLAVE_MASK 0x10000000
#define PAGE_ENCLAVE_DECOMMIT (PAGE_ENCLAVE_MASK | 0)
#define PAGE_ENCLAVE_SS_FIRST (PAGE_ENCLAVE_MASK | 1)
#define PAGE_ENCLAVE_SS_REST (PAGE_ENCLAVE_MASK | 2)
// Region and section constants
@@ -64,8 +64,8 @@
#define MEM_REPLACE_PLACEHOLDER 0x00004000
#define MEM_RESERVE_PLACEHOLDER 0x00040000
#define SEC_HUGE_PAGES 0x00020000
#define SEC_PARTITION_OWNER_HANDLE 0x00040000
#define SEC_HUGE_PAGES 0x00020000
#define SEC_PARTITION_OWNER_HANDLE 0x00040000
#define SEC_64K_PAGES 0x00080000
#define SEC_BASED 0x00200000
#define SEC_NO_CHANGE 0x00400000
@@ -171,7 +171,7 @@ typedef struct _MEMORY_REGION_INFORMATION
ULONG_PTR NodePreference; // 20H1
} MEMORY_REGION_INFORMATION, *PMEMORY_REGION_INFORMATION;
// private
// private
typedef enum _MEMORY_WORKING_SET_EX_LOCATION
{
MemoryLocationInvalid,
@@ -955,7 +955,7 @@ typedef struct _MEMORY_PARTITION_INITIAL_ADD_INFORMATION
typedef struct _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION
{
union
{
{
struct
{
ULONG CommitEvents : 1;
@@ -963,7 +963,7 @@ typedef struct _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION
};
ULONG AllFlags;
} Flags;
ULONG HandleAttributes;
ULONG DesiredAccess;
HANDLE LowCommitCondition; // \KernelObjects\LowCommitCondition
ntobapi.h
+1
View File
@@ -57,6 +57,7 @@ typedef enum _OBJECT_INFORMATION_CLASS
#else
#define ObjectBasicInformation 0
#define ObjectNameInformation 1
#define ObjectTypeInformation 2
#define ObjectTypesInformation 3
#define ObjectHandleFlagInformation 4
#define ObjectSessionInformation 5
ntpebteb.h
+22 -15
View File
@@ -56,7 +56,7 @@ typedef struct _API_SET_NAMESPACE_ENTRY
} API_SET_NAMESPACE_ENTRY, *PAPI_SET_NAMESPACE_ENTRY;
// private
typedef struct _API_SET_VALUE_ENTRY
typedef struct _API_SET_VALUE_ENTRY
{
ULONG Flags;
ULONG NameOffset;
@@ -125,11 +125,11 @@ typedef struct _PEB
ULONG TlsExpansionCounter;
PVOID TlsBitmap;
ULONG TlsBitmapBits[2];
PVOID ReadOnlySharedMemoryBase;
PVOID ReadOnlySharedMemoryBase;
PVOID SharedData; // HotpatchInformation
PVOID *ReadOnlyStaticServerData;
PVOID AnsiCodePageData; // PCPTABLEINFO
PVOID OemCodePageData; // PCPTABLEINFO
PVOID UnicodeCaseTableData; // PNLSTABLEINFO
@@ -184,13 +184,17 @@ typedef struct _PEB
SIZE_T MinimumStackCommit;
PVOID SparePointers[4]; // 19H1 (previously FlsCallback to FlsHighIndex)
ULONG SpareUlongs[5]; // 19H1
//PVOID* FlsCallback;
//LIST_ENTRY FlsListHead;
//PVOID FlsBitmap;
//ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)];
//ULONG FlsHighIndex;
PVOID SparePointers[2]; // 19H1 (previously FlsCallback to FlsHighIndex)
PVOID PatchLoaderData;
PVOID ChpeV2ProcessInfo; // _CHPEV2_PROCESS_INFO
ULONG AppModelFeatureState;
ULONG SpareUlongs[2];
USHORT ActiveCodePage;
USHORT OemCodePage;
USHORT UseCaseMapping;
USHORT UnusedNlsField;
PVOID WerRegistrationData;
PVOID WerShipAssertPtr;
@@ -234,18 +238,21 @@ typedef struct _PEB
};
};
ULONG NtGlobalFlag2;
ULONGLONG ExtendedFeatureDisableMask; // since WIN11
} PEB, *PPEB;
#ifdef _WIN64
C_ASSERT(FIELD_OFFSET(PEB, SessionId) == 0x2C0);
//C_ASSERT(sizeof(PEB) == 0x7B0); // REDSTONE3
//C_ASSERT(sizeof(PEB) == 0x7B8); // REDSTONE4
C_ASSERT(sizeof(PEB) == 0x7C8); // REDSTONE5 // 19H1
//C_ASSERT(sizeof(PEB) == 0x7C8); // REDSTONE5 // 19H1
C_ASSERT(sizeof(PEB) == 0x7d0); // WIN11
#else
C_ASSERT(FIELD_OFFSET(PEB, SessionId) == 0x1D4);
//C_ASSERT(sizeof(PEB) == 0x468); // REDSTONE3
//C_ASSERT(sizeof(PEB) == 0x470); // REDSTONE4
C_ASSERT(sizeof(PEB) == 0x480); // REDSTONE5 // 19H1
//C_ASSERT(sizeof(PEB) == 0x480); // REDSTONE5 // 19H1
C_ASSERT(sizeof(PEB) == 0x488); // WIN11
#endif
#define GDI_BATCH_BUFFER_SIZE 310
@@ -295,14 +302,14 @@ typedef struct _TEB
#else
PVOID SystemReserved1[26];
#endif
CHAR PlaceholderCompatibilityMode;
BOOLEAN PlaceholderHydrationAlwaysExplicit;
CHAR PlaceholderReserved[10];
ULONG ProxiedProcessId;
ACTIVATION_CONTEXT_STACK ActivationStack;
UCHAR WorkingOnBehalfTicket[8];
NTSTATUS ExceptionCode;
ntpoapi.h
+4 -4
View File
@@ -63,14 +63,14 @@
#define GetPowerRequestList 45 // out: POWER_REQUEST_LIST
#define ProcessorInformationEx 46 // in: USHORT ProcessorGroup, out: PROCESSOR_POWER_INFORMATION
#define NotifyUserModeLegacyPowerEvent 47 // (kernel-mode only)
#define GroupPark 48 // (debug-mode boot only)
#define GroupPark 48 // (debug-mode boot only)
#define ProcessorIdleDomains 49 // (kernel-mode only)
#define WakeTimerList 50 // powercfg.exe /waketimers
#define SystemHiberFileSize 51 // ULONG
#define ProcessorIdleStatesHv 52 // (kernel-mode only)
#define ProcessorPerfStatesHv 53 // (kernel-mode only)
#define ProcessorPerfCapHv 54 // (kernel-mode only)
#define ProcessorSetIdle 55 // (debug-mode boot only)
#define ProcessorSetIdle 55 // (debug-mode boot only)
#define LogicalProcessorIdling 56 // (kernel-mode only)
#define UserPresence 57 // POWER_USER_PRESENCE // not implemented
#define PowerSettingNotificationName 58
@@ -104,7 +104,7 @@
#define BatteryDeviceState 86
#define PowerInformationInternal 87 // POWER_INFORMATION_LEVEL_INTERNAL // PopPowerInformationInternal
#define ThermalStandby 88 // NULL // shutdown with thermal standby as reason.
#define SystemHiberFileType 89 // ULONG // zero ? reduced : full // powercfg.exe /h /type
#define SystemHiberFileType 89 // ULONG // zero ? reduced : full // powercfg.exe /h /type
#define PhysicalPowerButtonPress 90 // BOOLEAN
#define QueryPotentialDripsConstraint 91 // (kernel-mode only)
#define EnergyTrackerCreate 92
@@ -252,7 +252,7 @@ typedef struct _DIAGNOSTIC_BUFFER
ULONG_PTR DeviceDescriptionOffset; // PWSTR
ULONG_PTR DevicePathOffset; // PWSTR
};
};
};
ULONG_PTR ReasonOffset; // PCOUNTED_REASON_CONTEXT_RELATIVE
} DIAGNOSTIC_BUFFER, *PDIAGNOSTIC_BUFFER;
ntpsapi.h
+47 -24
View File
@@ -19,6 +19,7 @@
#define PROCESS_VM_OPERATION 0x0008
#define PROCESS_VM_READ 0x0010
#define PROCESS_VM_WRITE 0x0020
//#define PROCESS_DUP_HANDLE 0x0040
#define PROCESS_CREATE_PROCESS 0x0080
#define PROCESS_SET_QUOTA 0x0100
#define PROCESS_SET_INFORMATION 0x0200
@@ -121,7 +122,7 @@ typedef enum _PROCESSINFOCLASS
ProcessBasePriority, // s: KPRIORITY
ProcessRaisePriority, // s: ULONG
ProcessDebugPort, // q: HANDLE
ProcessExceptionPort, // s: PROCESS_EXCEPTION_PORT
ProcessExceptionPort, // s: PROCESS_EXCEPTION_PORT (requires SeTcbPrivilege)
ProcessAccessToken, // s: PROCESS_ACCESS_TOKEN
ProcessLdtInformation, // qs: PROCESS_LDT_INFORMATION // 10
ProcessLdtSize, // s: PROCESS_LDT_SIZE
@@ -134,7 +135,7 @@ typedef enum _PROCESSINFOCLASS
ProcessPriorityClass, // qs: PROCESS_PRIORITY_CLASS
ProcessWx86Information, // qs: ULONG (requires SeTcbPrivilege) (VdmAllowed)
ProcessHandleCount, // q: ULONG, PROCESS_HANDLE_INFORMATION // 20
ProcessAffinityMask, // qs: KAFFINITY, qs: GROUP_AFFINITY
ProcessAffinityMask, // (q >WIN7)s: KAFFINITY, qs: GROUP_AFFINITY
ProcessPriorityBoost, // qs: ULONG
ProcessDeviceMap, // qs: PROCESS_DEVICEMAP_INFORMATION, PROCESS_DEVICEMAP_INFORMATION_EX
ProcessSessionInformation, // q: PROCESS_SESSION_INFORMATION
@@ -148,11 +149,11 @@ typedef enum _PROCESSINFOCLASS
ProcessHandleTracing, // q: PROCESS_HANDLE_TRACING_QUERY; s: size 0 disables, otherwise enables
ProcessIoPriority, // qs: IO_PRIORITY_HINT
ProcessExecuteFlags, // qs: ULONG
ProcessTlsInformation, // PROCESS_TLS_INFORMATION // ProcessResourceManagement
ProcessTlsInformation, // PROCESS_TLS_INFORMATION // ProcessResourceManagement
ProcessCookie, // q: ULONG
ProcessImageInformation, // q: SECTION_IMAGE_INFORMATION
ProcessCycleTime, // q: PROCESS_CYCLE_TIME_INFORMATION // since VISTA
ProcessPagePriority, // q: PAGE_PRIORITY_INFORMATION
ProcessPagePriority, // qs: PAGE_PRIORITY_INFORMATION
ProcessInstrumentationCallback, // s: PVOID or PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION // 40
ProcessThreadStackAllocation, // s: PROCESS_STACK_ALLOCATION_INFORMATION, PROCESS_STACK_ALLOCATION_INFORMATION_EX
ProcessWorkingSetWatchEx, // q: PROCESS_WS_WATCH_INFORMATION_EX[]
@@ -221,10 +222,10 @@ typedef enum _PROCESSINFOCLASS
ProcessEnableOptionalXStateFeatures,
ProcessAltPrefetchParam, // since 22H1
ProcessAssignCpuPartitions,
ProcessPriorityClassEx,
ProcessPriorityClassEx, // s: PROCESS_PRIORITY_CLASS_EX
ProcessMembershipInformation,
ProcessEffectiveIoPriority,
ProcessEffectivePagePriority,
ProcessEffectiveIoPriority, // q: IO_PRIORITY_HINT
ProcessEffectivePagePriority, // q: ULONG
MaxProcessInfoClass
} PROCESSINFOCLASS;
#endif
@@ -247,7 +248,7 @@ typedef enum _THREADINFOCLASS
ThreadAmILastThread, // q: ULONG
ThreadIdealProcessor, // s: ULONG
ThreadPriorityBoost, // qs: ULONG
ThreadSetTlsArrayAddress, // s: ULONG_PTR
ThreadSetTlsArrayAddress, // s: ULONG_PTR
ThreadIsIoPending, // q: ULONG
ThreadHideFromDebugger, // q: BOOLEAN; s: void
ThreadBreakOnTermination, // qs: ULONG
@@ -256,7 +257,7 @@ typedef enum _THREADINFOCLASS
ThreadLastSystemCall, // q: THREAD_LAST_SYSCALL_INFORMATION
ThreadIoPriority, // qs: IO_PRIORITY_HINT (requires SeIncreaseBasePriorityPrivilege)
ThreadCycleTime, // q: THREAD_CYCLE_TIME_INFORMATION
ThreadPagePriority, // q: ULONG
ThreadPagePriority, // qs: PAGE_PRIORITY_INFORMATION
ThreadActualBasePriority, // s: LONG (requires SeIncreaseBasePriorityPrivilege)
ThreadTebInformation, // q: THREAD_TEB_INFORMATION (requires THREAD_GET_CONTEXT + THREAD_SET_CONTEXT)
ThreadCSwitchMon,
@@ -286,8 +287,8 @@ typedef enum _THREADINFOCLASS
ThreadCreateStateChange, // since WIN11
ThreadApplyStateChange,
ThreadStrongerBadHandleChecks, // since 22H1
ThreadEffectiveIoPriority,
ThreadEffectivePagePriority,
ThreadEffectiveIoPriority, // q: IO_PRIORITY_HINT
ThreadEffectivePagePriority, // q: ULONG
MaxThreadInfoClass
} THREADINFOCLASS;
#endif
@@ -400,7 +401,7 @@ typedef struct _POOLED_USAGE_AND_LIMITS
#define PROCESS_EXCEPTION_PORT_ALL_STATE_BITS 0x00000003
#define PROCESS_EXCEPTION_PORT_ALL_STATE_FLAGS ((ULONG_PTR)((1UL << PROCESS_EXCEPTION_PORT_ALL_STATE_BITS) - 1))
typedef struct _PROCESS_EXCEPTION_PORT
typedef struct _PROCESS_EXCEPTION_PORT
{
_In_ HANDLE ExceptionPortHandle; // Handle to the exception port. No particular access required.
_Inout_ ULONG StateFlags; // Miscellaneous state flags to be cached along with the exception port in the kernel.
@@ -454,6 +455,21 @@ typedef struct _PROCESS_PRIORITY_CLASS
UCHAR PriorityClass;
} PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;
typedef struct _PROCESS_PRIORITY_CLASS_EX
{
union
{
struct
{
USHORT ForegroundValid : 1;
USHORT PriorityClassValid : 1;
};
USHORT AllFlags;
};
UCHAR PriorityClass;
BOOLEAN Foreground;
} PROCESS_PRIORITY_CLASS_EX, *PPROCESS_PRIORITY_CLASS_EX;
typedef struct _PROCESS_FOREGROUND_BACKGROUND
{
BOOLEAN Foreground;
@@ -663,7 +679,7 @@ typedef struct _PROCESS_HANDLE_SNAPSHOT_INFORMATION
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#if !defined(NTDDI_WIN10_CO) || (NTDDI_VERSION < NTDDI_WIN10_CO)
#if !defined(NTDDI_WIN10_FE) || (NTDDI_VERSION < NTDDI_WIN10_FE)
typedef struct _PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY
{
union {
@@ -843,7 +859,8 @@ typedef struct _PROCESS_CHILD_PROCESS_INFORMATION
#define POWER_THROTTLING_PROCESS_CURRENT_VERSION 1
#define POWER_THROTTLING_PROCESS_EXECUTION_SPEED 0x1
#define POWER_THROTTLING_PROCESS_DELAYTIMERS 0x2
#define POWER_THROTTLING_PROCESS_VALID_FLAGS ((POWER_THROTTLING_PROCESS_EXECUTION_SPEED | POWER_THROTTLING_PROCESS_DELAYTIMERS))
#define POWER_THROTTLING_PROCESS_IGNORE_TIMER_RESOLUTION 0x4 // since WIN11
#define POWER_THROTTLING_PROCESS_VALID_FLAGS ((POWER_THROTTLING_PROCESS_EXECUTION_SPEED | POWER_THROTTLING_PROCESS_DELAYTIMERS | POWER_THROTTLING_PROCESS_IGNORE_TIMER_RESOLUTION))
typedef struct _POWER_THROTTLING_PROCESS_STATE
{
@@ -928,7 +945,7 @@ typedef struct _PROCESS_UPTIME_INFORMATION
ULONG HangCount : 4;
ULONG GhostCount : 4;
ULONG Crashed : 1;
ULONG Terminated : 1;
ULONG Terminated : 1;
};
} PROCESS_UPTIME_INFORMATION, *PPROCESS_UPTIME_INFORMATION;
@@ -1177,7 +1194,7 @@ typedef struct _RTL_WORK_ON_BEHALF_TICKET_EX
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// private
typedef enum _SUBSYSTEM_INFORMATION_TYPE
typedef enum _SUBSYSTEM_INFORMATION_TYPE
{
SubsystemInformationTypeWin32,
SubsystemInformationTypeWSL,
@@ -1576,7 +1593,7 @@ NtSetLdtEntries(
_In_ ULONG Entry1Hi
);
typedef VOID (*PPS_APC_ROUTINE)(
typedef VOID (NTAPI* PPS_APC_ROUTINE)(
_In_opt_ PVOID ApcArgument1,
_In_opt_ PVOID ApcArgument2,
_In_opt_ PVOID ApcArgument3
@@ -1632,7 +1649,7 @@ NTAPI
NtQueueApcThreadEx2(
_In_ HANDLE ThreadHandle,
_In_opt_ HANDLE ReserveHandle, // NtAllocateReserveObject
_In_ QUEUE_USER_APC_FLAGS ApcFlags,
_In_ ULONG ApcFlags, // QUEUE_USER_APC_FLAGS
_In_ PPS_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcArgument1,
_In_opt_ PVOID ApcArgument2,
@@ -1698,6 +1715,7 @@ NtWaitForAlertByThreadId(
#define ProcThreadAttributeComponentFilter 26 // in ULONG
#define ProcThreadAttributeEnableOptionalXStateFeatures 27 // in ULONG64 // since WIN11
#define ProcThreadAttributeCreateStore 28 // ULONG // rev (diversenok)
#define ProcThreadAttributeTrustedApp 29
#ifndef PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS
#define PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS \
@@ -1733,21 +1751,23 @@ NtWaitForAlertByThreadId(
#endif
// private
typedef struct _PROC_THREAD_ATTRIBUTE {
typedef struct _PROC_THREAD_ATTRIBUTE
{
ULONG_PTR Attribute;
SIZE_T Size;
ULONG_PTR Value;
} PROC_THREAD_ATTRIBUTE, *PPROC_THREAD_ATTRIBUTE;
// private
typedef struct _PROC_THREAD_ATTRIBUTE_LIST {
typedef struct _PROC_THREAD_ATTRIBUTE_LIST
{
ULONG PresentFlags;
ULONG AttributeCount;
ULONG LastAttribute;
ULONG SpareUlong0;
PPROC_THREAD_ATTRIBUTE ExtendedFlagsAttribute;
PROC_THREAD_ATTRIBUTE Attributes[1];
} PROC_THREAD_ATTRIBUTE_LIST;
} PROC_THREAD_ATTRIBUTE_LIST, *PPROC_THREAD_ATTRIBUTE_LIST;
// private
#define EXTENDED_PROCESS_CREATION_FLAG_ELEVATION_HANDLED 0x00000001
@@ -1765,7 +1785,8 @@ typedef struct _PROC_THREAD_ATTRIBUTE_LIST {
#define PROTECTION_LEVEL_AUTHENTICODE 0x00000007
// private
typedef enum _SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS {
typedef enum _SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS
{
SeSafeOpenExperienceNone = 0x00,
SeSafeOpenExperienceCalled = 0x01,
SeSafeOpenExperienceAppRepCalled = 0x02,
@@ -1778,7 +1799,8 @@ typedef enum _SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS {
} SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS;
// private
typedef struct _SE_SAFE_OPEN_PROMPT_RESULTS {
typedef struct _SE_SAFE_OPEN_PROMPT_RESULTS
{
SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS Results;
WCHAR Path[MAX_PATH];
} SE_SAFE_OPEN_PROMPT_RESULTS, *PSE_SAFE_OPEN_PROMPT_RESULTS;
@@ -1790,7 +1812,8 @@ typedef struct _PROC_THREAD_BNOISOLATION_ATTRIBUTE
} PROC_THREAD_BNOISOLATION_ATTRIBUTE, *PPROC_THREAD_BNOISOLATION_ATTRIBUTE;
// private
typedef struct _ISOLATION_MANIFEST_PROPERTIES {
typedef struct _ISOLATION_MANIFEST_PROPERTIES
{
UNICODE_STRING InstancePath;
UNICODE_STRING FriendlyName;
UNICODE_STRING Description;
ntregapi.h
+2 -2
View File
@@ -524,7 +524,7 @@ NtLoadKeyEx(
_Out_opt_ PHANDLE RootHandle,
_Reserved_ PVOID Reserved // previously PIO_STATUS_BLOCK
);
// rev by tyranid
#if (PHNT_VERSION >= PHNT_20H1)
NTSYSCALLAPI
@@ -715,7 +715,7 @@ NTSTATUS NtCreateRegistryTransaction(
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjAttributes,
_Reserved_ ULONG CreateOptions
);
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE)
ntrtl.h
+280 -47
View File
@@ -1496,12 +1496,24 @@ RtlCreateUnicodeStringFromAsciiz(
_In_ PCSTR SourceString
);
#ifdef PHNT_INLINE_FREE_UNICODE_STRING
FORCEINLINE
VOID
NTAPI
RtlFreeUnicodeString(
_Inout_ _At_(UnicodeString->Buffer, _Frees_ptr_opt_) PUNICODE_STRING UnicodeString
)
{
HeapFree(NtCurrentPeb()->ProcessHeap, 0, UnicodeString->Buffer);
}
#else
NTSYSAPI
VOID
NTAPI
RtlFreeUnicodeString(
_Inout_ _At_(UnicodeString->Buffer, _Frees_ptr_opt_) PUNICODE_STRING UnicodeString
);
#endif
#define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE (0x00000001)
#define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING (0x00000002)
@@ -2849,6 +2861,8 @@ typedef struct _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION
CLIENT_ID ReflectionClientId;
} RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION, *PRTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION;
typedef RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION PROCESS_REFLECTION_INFORMATION, *PPROCESS_REFLECTION_INFORMATION;
#if (PHNT_VERSION >= PHNT_WIN7)
// rev
NTSYSAPI
@@ -3002,13 +3016,13 @@ RtlFreeUserStack(
// Extended thread context
typedef struct _CONTEXT_CHUNK
typedef struct _CONTEXT_CHUNK
{
LONG Offset; // Offset may be negative.
ULONG Length;
} CONTEXT_CHUNK, *PCONTEXT_CHUNK;
typedef struct _CONTEXT_EX
typedef struct _CONTEXT_EX
{
CONTEXT_CHUNK All;
CONTEXT_CHUNK Legacy;
@@ -3355,8 +3369,8 @@ NTSYSAPI
NTSTATUS
NTAPI
RtlGuardCheckLongJumpTarget(
_In_ PVOID PcValue,
_In_ BOOL IsFastFail,
_In_ PVOID PcValue,
_In_ BOOL IsFastFail,
_Out_ PBOOL IsLongJumpTarget
);
@@ -3621,13 +3635,6 @@ RtlDetermineDosPathNameType_U(
_In_ PCWSTR DosFileName
);
NTSYSAPI
RTL_PATH_TYPE
NTAPI
RtlDetermineDosPathNameType_Ustr(
_In_ PCUNICODE_STRING DosFileName
);
NTSYSAPI
ULONG
NTAPI
@@ -3635,13 +3642,6 @@ RtlIsDosDeviceName_U(
_In_ PCWSTR DosFileName
);
NTSYSAPI
ULONG
NTAPI
RtlIsDosDeviceName_Ustr(
_In_ PUNICODE_STRING DosFileName
);
NTSYSAPI
ULONG
NTAPI
@@ -3923,6 +3923,18 @@ RtlReplaceSystemDirectoryInPath(
);
#endif
#if (PHNT_VERSION >= PHNT_21H2)
// rev
NTSYSAPI
NTSTATUS
NTAPI
RtlWow64GetProcessMachines(
_In_ HANDLE ProcessHandle,
_Out_ PUSHORT ProcessMachine,
_Out_ PUSHORT NativeMachine
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE2)
// private
@@ -3999,7 +4011,8 @@ typedef struct _RTL_HEAP_TAG
WCHAR TagName[24];
} RTL_HEAP_TAG, *PRTL_HEAP_TAG;
typedef struct _RTL_HEAP_INFORMATION
// Windows 7/8/10
typedef struct _RTL_HEAP_INFORMATION_V1
{
PVOID BaseAddress;
ULONG Flags;
@@ -4014,17 +4027,41 @@ typedef struct _RTL_HEAP_INFORMATION
ULONG Reserved[5];
PRTL_HEAP_TAG Tags;
PRTL_HEAP_ENTRY Entries;
ULONG64 HeapTag; // Windows 11 > 22000
} RTL_HEAP_INFORMATION, *PRTL_HEAP_INFORMATION;
} RTL_HEAP_INFORMATION_V1, *PRTL_HEAP_INFORMATION_V1;
// Windows 11 > 22000
typedef struct _RTL_HEAP_INFORMATION_V2
{
PVOID BaseAddress;
ULONG Flags;
USHORT EntryOverhead;
USHORT CreatorBackTraceIndex;
SIZE_T BytesAllocated;
SIZE_T BytesCommitted;
ULONG NumberOfTags;
ULONG NumberOfEntries;
ULONG NumberOfPseudoTags;
ULONG PseudoTagGranularity;
ULONG Reserved[5];
PRTL_HEAP_TAG Tags;
PRTL_HEAP_ENTRY Entries;
ULONG64 HeapTag;
} RTL_HEAP_INFORMATION_V2, *PRTL_HEAP_INFORMATION_V2;
#define RTL_HEAP_SIGNATURE 0xFFEEFFEEUL
#define RTL_HEAP_SEGMENT_SIGNATURE 0xDDEEDDEEUL
typedef struct _RTL_PROCESS_HEAPS
typedef struct _RTL_PROCESS_HEAPS_V1
{
ULONG NumberOfHeaps;
RTL_HEAP_INFORMATION Heaps[1];
} RTL_PROCESS_HEAPS, *PRTL_PROCESS_HEAPS;
RTL_HEAP_INFORMATION_V1 Heaps[1];
} RTL_PROCESS_HEAPS_V1, *PRTL_PROCESS_HEAPS_V1;
typedef struct _RTL_PROCESS_HEAPS_V2
{
ULONG NumberOfHeaps;
RTL_HEAP_INFORMATION_V2 Heaps[1];
} RTL_PROCESS_HEAPS_V2, *PRTL_PROCESS_HEAPS_V2;
typedef NTSTATUS (NTAPI *PRTL_HEAP_COMMIT_ROUTINE)(
_In_ PVOID Base,
@@ -4358,10 +4395,11 @@ RtlWalkHeap(
#define HeapCompatibilityInformation 0x0 // q; s: ULONG
#define HeapEnableTerminationOnCorruption 0x1 // q; s: NULL
#define HeapExtendedInformation 0x2 // q; s: HEAP_EXTENDED_INFORMATION
#define HeapOptimizeResources 0x3 // q; s: HEAP_OPTIMIZE_RESOURCES_INFORMATION
#define HeapOptimizeResources 0x3 // q; s: HEAP_OPTIMIZE_RESOURCES_INFORMATION
#define HeapTaggingInformation 0x4
#define HeapStackDatabase 0x5
#define HeapMemoryLimit 0x6 // 19H2
#define HeapStackDatabase 0x5 // q: RTL_HEAP_STACK_QUERY; s: RTL_HEAP_STACK_CONTROL
#define HeapMemoryLimit 0x6 // since 19H2
#define HeapTag 0x7 // since 20H1
#define HeapDetailedFailureInformation 0x80000001
#define HeapSetDebuggingInformation 0x80000002 // q; s: HEAP_DEBUGGING_INFORMATION
@@ -4372,30 +4410,137 @@ typedef enum _HEAP_COMPATIBILITY_MODE
HEAP_COMPATIBILITY_LFH = 2UL,
} HEAP_COMPATIBILITY_MODE;
typedef struct _RTLP_TAG_INFO
{
GUID Id;
ULONG_PTR CurrentAllocatedBytes;
} RTLP_TAG_INFO, *PRTLP_TAG_INFO;
typedef struct _RTLP_HEAP_TAGGING_INFO
{
USHORT Version;
USHORT Flags;
PVOID ProcessHandle;
ULONG_PTR EntriesCount;
RTLP_TAG_INFO Entries[1];
} RTLP_HEAP_TAGGING_INFO, *PRTLP_HEAP_TAGGING_INFO;
typedef struct _PROCESS_HEAP_INFORMATION
{
ULONG_PTR ReserveSize;
ULONG_PTR CommitSize;
SIZE_T ReserveSize;
SIZE_T CommitSize;
ULONG NumberOfHeaps;
ULONG_PTR FirstHeapInformationOffset;
} PROCESS_HEAP_INFORMATION, *PPROCESS_HEAP_INFORMATION;
typedef struct _HEAP_REGION_INFORMATION
{
PVOID Address;
SIZE_T ReserveSize;
SIZE_T CommitSize;
ULONG_PTR FirstRangeInformationOffset;
ULONG_PTR NextRegionInformationOffset;
} HEAP_REGION_INFORMATION, *PHEAP_REGION_INFORMATION;
typedef struct _HEAP_RANGE_INFORMATION
{
PVOID Address;
SIZE_T Size;
ULONG Type;
ULONG Protection;
ULONG_PTR FirstBlockInformationOffset;
ULONG_PTR NextRangeInformationOffset;
} HEAP_RANGE_INFORMATION, *PHEAP_RANGE_INFORMATION;
typedef struct _HEAP_BLOCK_INFORMATION
{
PVOID Address;
ULONG Flags;
SIZE_T DataSize;
ULONG_PTR OverheadSize;
ULONG_PTR NextBlockInformationOffset;
} HEAP_BLOCK_INFORMATION, *PHEAP_BLOCK_INFORMATION;
typedef struct _HEAP_INFORMATION
{
ULONG_PTR Address;
PVOID Address;
ULONG Mode;
ULONG_PTR ReserveSize;
ULONG_PTR CommitSize;
SIZE_T ReserveSize;
SIZE_T CommitSize;
ULONG_PTR FirstRegionInformationOffset;
ULONG_PTR NextHeapInformationOffset;
} HEAP_INFORMATION, *PHEAP_INFORMATION;
typedef struct _SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION
{
SIZE_T SegmentReserveSize;
SIZE_T SegmentCommitSize;
ULONG_PTR SegmentCount;
SIZE_T AllocatedSize;
SIZE_T LargeAllocReserveSize;
SIZE_T LargeAllocCommitSize;
} SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION, *PSEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION;
#define HeapPerformanceCountersInformationStandardHeapVersion 0x1
#define HeapPerformanceCountersInformationSegmentHeapVersion 0x2
typedef struct _HEAP_PERFORMANCE_COUNTERS_INFORMATION
{
ULONG Size;
ULONG Version;
ULONG HeapIndex;
ULONG LastHeapIndex;
PVOID BaseAddress;
SIZE_T ReserveSize;
SIZE_T CommitSize;
ULONG SegmentCount;
SIZE_T LargeUCRMemory;
ULONG UCRLength;
SIZE_T AllocatedSpace;
SIZE_T FreeSpace;
ULONG FreeListLength;
ULONG Contention;
ULONG VirtualBlocks;
ULONG CommitRate;
ULONG DecommitRate;
SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION SegmentHeapPerfInformation; // since WIN8
} HEAP_PERFORMANCE_COUNTERS_INFORMATION, *PHEAP_PERFORMANCE_COUNTERS_INFORMATION;
typedef struct _HEAP_INFORMATION_ITEM
{
ULONG Level;
SIZE_T Size;
union
{
PROCESS_HEAP_INFORMATION ProcessHeapInformation;
HEAP_INFORMATION HeapInformation;
HEAP_REGION_INFORMATION HeapRegionInformation;
HEAP_RANGE_INFORMATION HeapRangeInformation;
HEAP_BLOCK_INFORMATION HeapBlockInformation;
HEAP_PERFORMANCE_COUNTERS_INFORMATION HeapPerfInformation;
ULONG_PTR DynamicStart;
};
} HEAP_INFORMATION_ITEM, *PHEAP_INFORMATION_ITEM;
typedef NTSTATUS (NTAPI *PRTL_HEAP_EXTENDED_ENUMERATION_ROUTINE)(
_In_ PHEAP_INFORMATION_ITEM Information,
_In_ PVOID Context
);
// HEAP_EXTENDED_INFORMATION Level
#define HeapExtendedProcessHeapInformationLevel 0x1
#define HeapExtendedHeapInformationLevel 0x2
#define HeapExtendedHeapRegionInformationLevel 0x3
#define HeapExtendedHeapRangeInformationLevel 0x4
#define HeapExtendedHeapBlockInformationLevel 0x5
#define HeapExtendedHeapHeapPerfInformationLevel 0x80000000
typedef struct _HEAP_EXTENDED_INFORMATION
{
HANDLE Process;
ULONG_PTR Heap;
HANDLE ProcessHandle;
PVOID HeapHandle;
ULONG Level;
PVOID CallbackRoutine;
PRTL_HEAP_EXTENDED_ENUMERATION_ROUTINE CallbackRoutine;
PVOID CallbackContext;
union
{
@@ -4404,6 +4549,76 @@ typedef struct _HEAP_EXTENDED_INFORMATION
};
} HEAP_EXTENDED_INFORMATION, *PHEAP_EXTENDED_INFORMATION;
// rev
typedef NTSTATUS (NTAPI *RTL_HEAP_STACK_WRITE_ROUTINE)(
_In_ PVOID Information, // TODO: 3 missing structures (dmex)
_In_ ULONG Size,
_In_ PVOID Context
);
// rev
typedef struct _RTLP_HEAP_STACK_TRACE_SERIALIZATION_INIT
{
ULONG Count;
ULONG Total;
ULONG Flags;
} RTLP_HEAP_STACK_TRACE_SERIALIZATION_INIT, *PRTLP_HEAP_STACK_TRACE_SERIALIZATION_INIT;
// rev
typedef struct _RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER
{
USHORT Version;
USHORT PointerSize;
PVOID Heap;
SIZE_T TotalCommit;
SIZE_T TotalReserve;
} RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER, *PRTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER;
// rev
typedef struct _RTLP_HEAP_STACK_TRACE_SERIALIZATION_ALLOCATION
{
PVOID Address;
ULONG Flags;
SIZE_T DataSize;
} RTLP_HEAP_STACK_TRACE_SERIALIZATION_ALLOCATION, *PRTLP_HEAP_STACK_TRACE_SERIALIZATION_ALLOCATION;
// rev
typedef struct _RTLP_HEAP_STACK_TRACE_SERIALIZATION_STACKFRAME
{
PVOID StackFrame[8];
} RTLP_HEAP_STACK_TRACE_SERIALIZATION_STACKFRAME, *PRTLP_HEAP_STACK_TRACE_SERIALIZATION_STACKFRAME;
#define HEAP_STACK_QUERY_VERSION 0x2
typedef struct _RTL_HEAP_STACK_QUERY
{
ULONG Version;
HANDLE ProcessHandle;
RTL_HEAP_STACK_WRITE_ROUTINE WriteRoutine;
PVOID SerializationContext;
UCHAR QueryLevel;
UCHAR Flags;
} RTL_HEAP_STACK_QUERY, *PRTL_HEAP_STACK_QUERY;
#define HEAP_STACK_CONTROL_VERSION 0x1
#define HEAP_STACK_CONTROL_FLAGS_STACKTRACE_ENABLE 0x1
#define HEAP_STACK_CONTROL_FLAGS_STACKTRACE_DISABLE 0x2
typedef struct _RTL_HEAP_STACK_CONTROL
{
USHORT Version;
USHORT Flags;
HANDLE ProcessHandle;
} RTL_HEAP_STACK_CONTROL, *PRTL_HEAP_STACK_CONTROL;
// rev
typedef NTSTATUS (NTAPI *PRTL_HEAP_DEBUGGING_INTERCEPTOR_ROUTINE)(
_In_ PVOID HeapHandle,
_In_ ULONG Action,
_In_ ULONG StackFramesToCapture,
_In_ PVOID *StackTrace
);
// rev
typedef NTSTATUS (NTAPI *PRTL_HEAP_LEAK_ENUMERATION_ROUTINE)(
_In_ LONG Reserved,
@@ -4417,7 +4632,7 @@ typedef NTSTATUS (NTAPI *PRTL_HEAP_LEAK_ENUMERATION_ROUTINE)(
// symbols
typedef struct _HEAP_DEBUGGING_INFORMATION
{
PVOID InterceptorFunction;
PRTL_HEAP_DEBUGGING_INTERCEPTOR_ROUTINE InterceptorFunction;
USHORT InterceptorValue;
ULONG ExtendedOptions;
ULONG StackTraceDepth;
@@ -4430,7 +4645,7 @@ NTSYSAPI
NTSTATUS
NTAPI
RtlQueryHeapInformation(
_In_ PVOID HeapHandle,
_In_opt_ PVOID HeapHandle,
_In_ HEAP_INFORMATION_CLASS HeapInformationClass,
_Out_opt_ PVOID HeapInformation,
_In_opt_ SIZE_T HeapInformationLength,
@@ -4441,7 +4656,7 @@ NTSYSAPI
NTSTATUS
NTAPI
RtlSetHeapInformation(
_In_ PVOID HeapHandle,
_In_opt_ PVOID HeapHandle,
_In_ HEAP_INFORMATION_CLASS HeapInformationClass,
_In_opt_ PVOID HeapInformation,
_In_opt_ SIZE_T HeapInformationLength
@@ -4774,7 +4989,7 @@ typedef struct _RTL_DEBUG_INFORMATION
struct _RTL_PROCESS_MODULE_INFORMATION_EX *ModulesEx;
};
struct _RTL_PROCESS_BACKTRACES *BackTraces;
struct _RTL_PROCESS_HEAPS *Heaps;
PVOID Heaps;
struct _RTL_PROCESS_LOCKS *Locks;
PVOID SpecificHeap;
HANDLE TargetProcessHandle;
@@ -7752,7 +7967,7 @@ typedef struct _RTL_UNLOAD_EVENT_TRACE
ULONG Version[2];
} RTL_UNLOAD_EVENT_TRACE, *PRTL_UNLOAD_EVENT_TRACE;
typedef struct _RTL_UNLOAD_EVENT_TRACE32
typedef struct _RTL_UNLOAD_EVENT_TRACE32
{
ULONG BaseAddress;
ULONG SizeOfImage;
@@ -7997,7 +8212,7 @@ RtlSetImageMitigationPolicy(
#endif
// session
// session
// rev
NTSYSAPI
@@ -8033,8 +8248,8 @@ NTSYSAPI
NTSTATUS
NTAPI
RtlGetTokenNamedObjectPath(
_In_ HANDLE Token,
_In_opt_ PSID Sid,
_In_ HANDLE Token,
_In_opt_ PSID Sid,
_Out_ PUNICODE_STRING ObjectPath // RtlFreeUnicodeString
);
#endif
@@ -8058,7 +8273,7 @@ NTSYSAPI
NTSTATUS
NTAPI
RtlGetAppContainerParent(
_In_ PSID AppContainerSid,
_In_ PSID AppContainerSid,
_Out_ PSID* AppContainerSidParent // RtlFreeSid
);
#endif
@@ -8225,7 +8440,25 @@ RtlFlsFree(
_In_ ULONG FlsIndex
);
typedef enum _STATE_LOCATION_TYPE
#if (PHNT_VERSION >= PHNT_20H1)
NTSYSAPI
NTSTATUS
WINAPI
RtlFlsGetValue(
_In_ ULONG FlsIndex,
_Out_ PVOID* FlsData
);
NTSYSAPI
NTSTATUS
WINAPI
RtlFlsSetValue(
_In_ ULONG FlsIndex,
_In_ PVOID FlsData
);
#endif
typedef enum _STATE_LOCATION_TYPE
{
LocationTypeRegistry,
LocationTypeFileSystem,
@@ -8348,7 +8581,7 @@ NTSYSAPI
NTSTATUS
NTAPI
RtlAppxIsFileOwnedByTrustedInstaller(
_In_ HANDLE FileHandle,
_In_ HANDLE FileHandle,
_Out_ PBOOLEAN IsFileOwnedByTrustedInstaller
);
#endif
@@ -8555,7 +8788,7 @@ NTSYSAPI
NTSTATUS
NTAPI
RtlCheckBootStatusIntegrity(
_In_ HANDLE FileHandle,
_In_ HANDLE FileHandle,
_Out_ PBOOLEAN Verified
);
ntsam.h
+1 -1
View File
@@ -1425,7 +1425,7 @@ typedef struct _USER_ALLOWED_TO_DELEGATE_TO_LIST
ULONG Size;
ULONG NumSPNs;
UNICODE_STRING SPNList[ANYSIZE_ARRAY];
} USER_ALLOWED_TO_DELEGATE_TO_LIST, *PUSER_ALLOWED_TO_DELEGATE_TO_LIST;
} USER_ALLOWED_TO_DELEGATE_TO_LIST, *PUSER_ALLOWED_TO_DELEGATE_TO_LIST;
#define USER_EXTENDED_FIELD_UPN 0x00000001L
#define USER_EXTENDED_FIELD_A2D2 0x00000002L
ntwow64.h
+8
View File
@@ -397,6 +397,9 @@ C_ASSERT(FIELD_OFFSET(PEB32, WaitOnAddressHashTable) == 0x25c);
//C_ASSERT(sizeof(PEB32) == 0x460); // REDSTONE3
C_ASSERT(sizeof(PEB32) == 0x470);
// Note: Use PhGetProcessPeb32 instead. (dmex)
//#define WOW64_GET_PEB32(peb64) ((PPEB32)PTR_ADD_OFFSET((peb64), ALIGN_UP_BY(sizeof(PEB), PAGE_SIZE)))
#define GDI_BATCH_BUFFER_SIZE 310
typedef struct _GDI_TEB_BATCH32
@@ -568,6 +571,11 @@ C_ASSERT(FIELD_OFFSET(TEB32, ReservedForCrt) == 0xfe8);
C_ASSERT(FIELD_OFFSET(TEB32, EffectiveContainerId) == 0xff0);
C_ASSERT(sizeof(TEB32) == 0x1000);
// Get the 32-bit TEB without doing a memory reference
// modified from public SDK /10.0.10240.0/um/minwin/wow64t.h (dmex)
#define WOW64_GET_TEB32(teb64) ((PTEB32)PTR_ADD_OFFSET((teb64), ALIGN_UP_BY(sizeof(TEB), PAGE_SIZE)))
#define WOW64_TEB32_POINTER_ADDRESS(teb64) (PVOID)&((teb64)->NtTib.ExceptionList)
// Conversion
FORCEINLINE VOID UStr32ToUStr(
ntzwapi.h
+8 -13
View File
@@ -1084,7 +1084,6 @@ ZwCreatePort(
_In_opt_ ULONG MaxPoolUsage
);
#if (PHNT_VERSION >= PHNT_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1094,7 +1093,6 @@ ZwCreatePrivateNamespace(
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ POBJECT_BOUNDARY_DESCRIPTOR BoundaryDescriptor
);
#endif
NTSYSCALLAPI
NTSTATUS
@@ -1497,14 +1495,12 @@ ZwDeleteObjectAuditAlarm(
_In_ BOOLEAN GenerateOnClose
);
#if (PHNT_VERSION >= PHNT_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwDeletePrivateNamespace(
_In_ HANDLE NamespaceHandle
);
#endif
NTSYSCALLAPI
NTSTATUS
@@ -1630,7 +1626,7 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
ZwEnumerateSystemEnvironmentValuesEx(
_In_ ULONG InformationClass,
_In_ ULONG InformationClass, // SYSTEM_ENVIRONMENT_INFORMATION_CLASS
_Out_ PVOID Buffer,
_Inout_ PULONG BufferLength
);
@@ -2484,7 +2480,6 @@ ZwOpenPartition(
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
#if (PHNT_VERSION >= PHNT_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -2494,7 +2489,6 @@ ZwOpenPrivateNamespace(
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ POBJECT_BOUNDARY_DESCRIPTOR BoundaryDescriptor
);
#endif
NTSYSCALLAPI
NTSTATUS
@@ -3227,7 +3221,7 @@ NTSTATUS
NTAPI
ZwQuerySystemEnvironmentValueEx(
_In_ PUNICODE_STRING VariableName,
_In_ LPGUID VendorGuid,
_In_ PGUID VendorGuid,
_Out_writes_bytes_opt_(*ValueLength) PVOID Value,
_Inout_ PULONG ValueLength,
_Out_opt_ PULONG Attributes // EFI_VARIABLE_*
@@ -3363,20 +3357,18 @@ ZwQueueApcThreadEx(
_In_opt_ PVOID ApcArgument3
);
#if (PHNT_VERSION >= PHNT_WIN11)
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueueApcThreadEx2(
_In_ HANDLE ThreadHandle,
_In_opt_ HANDLE ReserveHandle, // NtAllocateReserveObject
_In_ QUEUE_USER_APC_FLAGS ApcFlags,
_In_ ULONG ApcFlags, // QUEUE_USER_APC_FLAGS
_In_ PPS_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcArgument1,
_In_opt_ PVOID ApcArgument2,
_In_opt_ PVOID ApcArgument3
);
#endif
NTSYSCALLAPI
NTSTATUS
@@ -4159,7 +4151,7 @@ NTSTATUS
NTAPI
ZwSetSystemEnvironmentValueEx(
_In_ PUNICODE_STRING VariableName,
_In_ LPGUID VendorGuid,
_In_ PGUID VendorGuid,
_In_reads_bytes_opt_(ValueLength) PVOID Value,
_In_ ULONG ValueLength, // 0 = delete variable
_In_ ULONG Attributes // EFI_VARIABLE_*
@@ -4614,7 +4606,10 @@ NTSTATUS
NTAPI
ZwWaitForWorkViaWorkerFactory(
_In_ HANDLE WorkerFactoryHandle,
_Out_ struct _FILE_IO_COMPLETION_INFORMATION *MiniPacket
_Out_writes_to_(Count, *PacketsReturned) struct _FILE_IO_COMPLETION_INFORMATION *MiniPackets,
_In_ ULONG Count,
_Out_ PULONG PacketsReturned,
_In_ struct _WORKER_FACTORY_DEFERRED_WORK* DeferredWork
);
NTSYSCALLAPI
phnt.h
+1
View File
@@ -56,6 +56,7 @@
#define PHNT_21H1 111
#define PHNT_21H2 112
#define PHNT_WIN11 113
#define PHNT_WIN11_22H2 114
#ifndef PHNT_MODE
#define PHNT_MODE PHNT_MODE_USER
phnt_ntdef.h
+1
View File
@@ -235,6 +235,7 @@ typedef const OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;
#define RTL_INIT_OBJECT_ATTRIBUTES(n, a) RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a)
#define OBJ_NAME_PATH_SEPARATOR ((WCHAR)L'\\')
#define OBJ_NAME_ALTPATH_SEPARATOR ((WCHAR)L'/')
// Portability
winsta.h
+2 -2
View File
@@ -160,7 +160,7 @@ typedef enum _WINSTATIONINFOCLASS
WinStationReconnectedFromId, // ULONG
WinStationEffectsPolicy, // ULONG
WinStationType, // ULONG
WinStationInformationEx, // WINSTATIONINFORMATIONEX
WinStationInformationEx, // WINSTATIONINFORMATIONEX
WinStationValidationInfo
} WINSTATIONINFOCLASS;
@@ -566,7 +566,7 @@ typedef struct _WINSTATIONVIDEODATA
typedef enum _CDCLASS
{
CdNone, // No connection driver.
CdNone, // No connection driver.
CdModem, // Connection driver is a modem.
CdClass_Maximum,
} CDCLASS;