admin/processhacker-phnt
1
0
Fork 0
mirror of https://github.com/processhacker/phnt synced 2026-06-08 16:49:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Sync latest

Browse Source
This commit is contained in:
Johnny Shaw
2024-08-06 15:04:55 -06:00
parent 2b70847be7
commit df94006275
15 changed files with 1204 additions and 185 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ntexapi.h
+142 -60
View File
@@ -721,6 +721,7 @@ NTSTATUS
NTAPI
NtCreateIRTimer(
_Out_ PHANDLE TimerHandle,
_In_ PVOID Reserved,
_In_ ACCESS_MASK DesiredAccess
);
@@ -1559,9 +1560,9 @@ typedef enum _SYSTEM_INFORMATION_CLASS
SystemFlags2Information, // q: SYSTEM_FLAGS_INFORMATION
SystemSecurityModelInformation, // SYSTEM_SECURITY_MODEL_INFORMATION // since 19H1
SystemCodeIntegritySyntheticCacheInformation,
SystemFeatureConfigurationInformation, // SYSTEM_FEATURE_CONFIGURATION_INFORMATION // since 20H1 // 210
SystemFeatureConfigurationSectionInformation, // SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION
SystemFeatureUsageSubscriptionInformation, // SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS
SystemFeatureConfigurationInformation, // q: in: SYSTEM_FEATURE_CONFIGURATION_QUERY, out: SYSTEM_FEATURE_CONFIGURATION_INFORMATION; s: SYSTEM_FEATURE_CONFIGURATION_UPDATE // NtQuerySystemInformationEx // since 20H1 // 210
SystemFeatureConfigurationSectionInformation, // q: in: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST, out: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION // NtQuerySystemInformationEx
SystemFeatureUsageSubscriptionInformation, // q: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS; s: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE
SystemSecureSpeculationControlInformation, // SECURE_SPECULATION_CONTROL_INFORMATION
SystemSpacesBootInformation, // since 20H2
SystemFwRamdiskInformation, // SYSTEM_FIRMWARE_RAMDISK_INFORMATION
@@ -1588,14 +1589,14 @@ typedef enum _SYSTEM_INFORMATION_CLASS
SystemPointerAuthInformation, // SYSTEM_POINTER_AUTH_INFORMATION
SystemSecureKernelDebuggerInformation,
SystemOriginalImageFeatureInformation, // q: in: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT, out: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT // NtQuerySystemInformationEx
SystemMemoryNumaInformation,
SystemMemoryNumaPerformanceInformation, // SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT // since 24H2 // 240
SystemMemoryNumaInformation, // SYSTEM_MEMORY_NUMA_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT
SystemMemoryNumaPerformanceInformation, // SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUTSYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT // since 24H2 // 240
SystemCodeIntegritySignedPoliciesFullInformation,
SystemSecureSecretsInformation,
SystemTrustedAppsRuntimeInformation, // SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION
SystemBadPageInformationEx, // SYSTEM_BAD_PAGE_INFORMATION
SystemResourceDeadlockTimeout,
SystemBreakOnContextUnwindFailureInformation,
SystemResourceDeadlockTimeout, // ULONG
SystemBreakOnContextUnwindFailureInformation, // ULONG (requires SeDebugPrivilege)
SystemOslRamdiskInformation, // SYSTEM_OSL_RAMDISK_INFORMATION
MaxSystemInfoClass
} SYSTEM_INFORMATION_CLASS;
@@ -3128,8 +3129,6 @@ typedef struct _SM_REGISTRATION_REQUEST
SM_REGISTRATION_INFO RegInfo;
} SM_REGISTRATION_REQUEST, *PSM_REGISTRATION_REQUEST;
typedef struct _RTL_BITMAP *PRTL_BITMAP;
#define SYSTEM_STORE_RESIZE_INFORMATION_VERSION 6
typedef struct _SM_STORE_RESIZE_REQUEST
@@ -4158,10 +4157,18 @@ typedef struct _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION
PVOID Image;
} SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION, *PSYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION;
// rev
typedef struct _SYSTEM_HYPERVISOR_USER_SHARED_DATA
{
ULONGLONG TimeUpdateLock; // QpcSystemTimeIncrement?
volatile ULONGLONG QpcMultiplier;
volatile ULONGLONG QpcBias; // HvlGetQpcBias
} SYSTEM_HYPERVISOR_USER_SHARED_DATA, *PSYSTEM_HYPERVISOR_USER_SHARED_DATA;
// private
typedef struct _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION
{
PVOID HypervisorSharedUserVa;
PSYSTEM_HYPERVISOR_USER_SHARED_DATA HypervisorSharedUserVa;
} SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION, *PSYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION;
// private
@@ -4270,45 +4277,6 @@ typedef struct _SYSTEM_SECURITY_MODEL_INFORMATION
};
} SYSTEM_SECURITY_MODEL_INFORMATION, *PSYSTEM_SECURITY_MODEL_INFORMATION;
typedef struct _RTL_FEATURE_CONFIGURATION *PRTL_FEATURE_CONFIGURATION; // from ntrtl.h
// private
typedef struct _SYSTEM_FEATURE_CONFIGURATION_INFORMATION
{
ULONGLONG ChangeStamp;
PRTL_FEATURE_CONFIGURATION Configuration;
} SYSTEM_FEATURE_CONFIGURATION_INFORMATION, *PSYSTEM_FEATURE_CONFIGURATION_INFORMATION;
// private
typedef struct _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY
{
ULONGLONG ChangeStamp;
PVOID Section;
ULONGLONG Size;
} SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY, *PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY;
// private
typedef struct _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION
{
ULONGLONG OverallChangeStamp;
SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY Descriptors[3];
} SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION, *PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION;
// private
typedef struct _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET
{
ULONG Data[2];
} RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET, *PRTL_FEATURE_USAGE_SUBSCRIPTION_TARGET;
// private
typedef struct _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS
{
ULONG FeatureId;
USHORT ReportingKind;
USHORT ReportingOptions;
RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET ReportingTarget;
} SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS, *PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS;
// private
typedef union _SECURE_SPECULATION_CONTROL_INFORMATION
{
@@ -4514,6 +4482,82 @@ typedef struct _SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT
BOOLEAN FeatureIsEnabled;
} SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT, *PSYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT;
// private
typedef struct _SYSTEM_MEMORY_NUMA_INFORMATION_INPUT
{
ULONG Version;
ULONG TargetNodeNumber;
ULONG Flags;
} SYSTEM_MEMORY_NUMA_INFORMATION_INPUT, *PSYSTEM_MEMORY_NUMA_INFORMATION_INPUT;
// private
typedef struct _SYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT
{
ULONG Version;
ULONG Size;
ULONG InitiatorNode;
union
{
ULONG Flags;
struct
{
ULONG IsAttached : 1;
ULONG Reserved : 31;
};
};
} SYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT, *PSYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT;
// private
typedef enum _SYSTEM_MEMORY_NUMA_PERFORMANCE_QUERY_DATA_TYPES
{
SystemMemoryNumaPerformanceQuery_ReadLatency,
SystemMemoryNumaPerformanceQuery_ReadBandwidth,
SystemMemoryNumaPerformanceQuery_WriteLatency,
SystemMemoryNumaPerformanceQuery_WriteBandwidth,
SystemMemoryNumaPerformanceQuery_Latency,
SystemMemoryNumaPerformanceQuery_Bandwidth,
SystemMemoryNumaPerformanceQuery_AllDataTypes,
SystemMemoryNumaPerformanceQuery_MaxDataType
} SYSTEM_MEMORY_NUMA_PERFORMANCE_QUERY_DATA_TYPES;
// private
typedef struct _SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT
{
ULONG Version;
ULONG TargetNodeNumber;
SYSTEM_MEMORY_NUMA_PERFORMANCE_QUERY_DATA_TYPES QueryDataType;
ULONG Flags;
} SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT, *PSYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT;
// private
typedef struct _SYSTEM_MEMORY_NUMA_PERFORMANCE_ENTRY
{
ULONG InitiatorNodeNumber;
ULONG TargetNodeNumber;
SYSTEM_MEMORY_NUMA_PERFORMANCE_QUERY_DATA_TYPES DataType;
union
{
BOOLEAN Flags;
struct
{
BOOLEAN MinTransferSizeToAchieveValues : 1;
BOOLEAN NonSequentialTransfers : 1;
BOOLEAN Reserved : 6;
};
};
ULONG_PTR MinTransferSizeInBytes;
ULONG_PTR EntryValue;
} SYSTEM_MEMORY_NUMA_PERFORMANCE_ENTRY, *PSYSTEM_MEMORY_NUMA_PERFORMANCE_ENTRY;
// private
typedef struct _SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT
{
ULONG Version;
ULONG Size;
ULONG EntryCount;
SYSTEM_MEMORY_NUMA_PERFORMANCE_ENTRY PerformanceEntries[1];
} SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT, *PSYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT;
// private
typedef struct _SYSTEM_OSL_RAMDISK_ENTRY
{
@@ -4522,6 +4566,21 @@ typedef struct _SYSTEM_OSL_RAMDISK_ENTRY
SIZE_T Size;
} SYSTEM_OSL_RAMDISK_ENTRY, *PSYSTEM_OSL_RAMDISK_ENTRY;
// private
typedef struct _SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION
{
union
{
ULONGLONG Flags;
struct
{
ULONGLONG Supported : 1;
ULONGLONG Spare : 63;
};
};
PVOID RemoteBreakingRoutine;
} SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION, *PSYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION;
// private
typedef struct _SYSTEM_OSL_RAMDISK_INFORMATION
{
@@ -4976,6 +5035,7 @@ typedef struct _KUSER_SHARED_DATA
//
ULONG TimeZoneId;
ULONG LargePageMinimum;
//
@@ -5149,7 +5209,10 @@ typedef struct _KUSER_SHARED_DATA
//
// Number of physical pages in the system. This can dynamically change as
// physical memory can be added or removed from a running system.
// physical memory can be added or removed from a running system. This
// cell is too small to hold the non-truncated value on very large memory
// machines so code that needs the full value should access
// FullNumberOfPhysicalPages instead.
//
ULONG NumberOfPhysicalPages;
@@ -5221,7 +5284,9 @@ typedef struct _KUSER_SHARED_DATA
ULONG DbgMultiSessionSku : 1;
ULONG DbgMultiUsersInSessionSku : 1;
ULONG DbgStateSeparationEnabled : 1;
ULONG SpareBits : 21;
ULONG DbgSplitTokenEnabled : 1;
ULONG DbgShadowAdminEnabled : 1;
ULONG SpareBits : 19;
} DUMMYSTRUCTNAME2;
} DUMMYUNIONNAME2;
@@ -5235,6 +5300,7 @@ typedef struct _KUSER_SHARED_DATA
//
ULONGLONG TestRetInstruction;
LONGLONG QpcFrequency;
//
@@ -5251,7 +5317,9 @@ typedef struct _KUSER_SHARED_DATA
ULONG Reserved2;
//
//
// Full 64 bit version of the number of physical pages in the system.
// This can dynamically change as physical memory can be added or removed
// from a running system.
//
ULONGLONG FullNumberOfPhysicalPages;
@@ -5423,18 +5491,18 @@ typedef struct _KUSER_SHARED_DATA
struct
{
//
// A boolean indicating whether performance counter queries
// can read the counter directly (bypassing the system call).
// A bitfield indicating whether performance counter queries can
// read the counter directly (bypassing the system call) and flags.
//
volatile UCHAR QpcBypassEnabled;
//
// Shift applied to the raw counter value to derive the
// QPC count.
// Reserved, leave as zero for backward compatibility. Was shift
// applied to the raw counter value to derive QPC count.
//
UCHAR QpcShift;
UCHAR QpcReserved;
};
};
@@ -5442,7 +5510,7 @@ typedef struct _KUSER_SHARED_DATA
LARGE_INTEGER TimeZoneBiasEffectiveEnd;
//
// Extended processor state configuration
// Extended processor state configuration (AMD64 and x86).
//
XSTATE_CONFIGURATION XState;
@@ -5452,7 +5520,16 @@ typedef struct _KUSER_SHARED_DATA
ULONG64 UserPointerAuthMask;
ULONG InternsReserved[210];
//
// Extended processor state configuration (ARM64). The reserved space for
// other architectures is not available for reuse.
//
#if defined(_ARM64_)
XSTATE_CONFIGURATION XStateArm64;
#else
ULONG Reserved10[210];
#endif
} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountLowDeprecated) == 0x0);
@@ -5532,7 +5609,7 @@ C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveGroupCount) == 0x3c4);
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved9) == 0x3c5);
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcData) == 0x3c6);
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcBypassEnabled) == 0x3c6);
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcShift) == 0x3c7);
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcReserved) == 0x3c7);
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBiasEffectiveStart) == 0x3c8);
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBiasEffectiveEnd) == 0x3d0);
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, XState) == 0x3d8);
@@ -5545,6 +5622,11 @@ C_ASSERT(sizeof(KUSER_SHARED_DATA) == 0x728);
#else
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, FeatureConfigurationChangeStamp) == 0x720);
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, UserPointerAuthMask) == 0x730);
#if defined(_ARM64_)
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, XStateArm64) == 0x738);
#else
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved10) == 0x738);
#endif
#if !defined(WINDOWS_IGNORE_PACKING_MISMATCH)
C_ASSERT(sizeof(KUSER_SHARED_DATA) == 0xa80);
#endif
ntimage.h
+5
View File
@@ -208,4 +208,9 @@ typedef struct _IMAGE_BDD_DYNAMIC_RELOCATION {
#define IMAGE_FUNCTION_OVERRIDE_ARM64_THUNK 3
#endif
#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE)
#define IMAGE_DLLCHARACTERISTICS_EX_FORWARD_CFI_COMPAT 0x40
#define IMAGE_DLLCHARACTERISTICS_EX_HOTPATCH_COMPATIBLE 0x80
#endif
#endif
ntioapi.h
+277 -14
View File
@@ -300,10 +300,10 @@ typedef enum _FILE_INFORMATION_CLASS
FileCaseSensitiveInformationForceAccessCheck, // q; s: FILE_CASE_SENSITIVE_INFORMATION
FileKnownFolderInformation, // q; s: FILE_KNOWN_FOLDER_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) // since WIN11
FileStatBasicInformation, // since 23H2
FileId64ExtdDirectoryInformation,
FileId64ExtdBothDirectoryInformation,
FileIdAllExtdDirectoryInformation,
FileIdAllExtdBothDirectoryInformation,
FileId64ExtdDirectoryInformation, // FILE_ID_64_EXTD_DIR_INFORMATION
FileId64ExtdBothDirectoryInformation, // FILE_ID_64_EXTD_BOTH_DIR_INFORMATION
FileIdAllExtdDirectoryInformation, // FILE_ID_ALL_EXTD_DIR_INFORMATION
FileIdAllExtdBothDirectoryInformation, // FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION
FileStreamReservationInformation, // FILE_STREAM_RESERVATION_INFORMATION // since 24H2
FileMupProviderInfo, // MUP_PROVIDER_INFORMATION
FileMaximumInformation
@@ -845,6 +845,13 @@ typedef struct _FILE_ID_EXTD_DIR_INFORMATION
_Field_size_bytes_(FileNameLength) WCHAR FileName[1];
} FILE_ID_EXTD_DIR_INFORMATION, *PFILE_ID_EXTD_DIR_INFORMATION;
#define FileIdExtdDirectoryInformationDefinition { \
FileIdExtdDirectoryInformation, \
FIELD_OFFSET(FILE_ID_EXTD_DIR_INFORMATION, NextEntryOffset), \
FIELD_OFFSET(FILE_ID_EXTD_DIR_INFORMATION, FileName), \
FIELD_OFFSET(FILE_ID_EXTD_DIR_INFORMATION, FileNameLength) \
}
typedef struct _FILE_LINK_ENTRY_FULL_ID_INFORMATION
{
ULONG NextEntryOffset;
@@ -880,6 +887,119 @@ typedef struct _FILE_ID_EXTD_BOTH_DIR_INFORMATION
_Field_size_bytes_(FileNameLength) WCHAR FileName[1];
} FILE_ID_EXTD_BOTH_DIR_INFORMATION, *PFILE_ID_EXTD_BOTH_DIR_INFORMATION;
#define FileIdExtdBothDirectoryInformationDefinition { \
FileIdExtdBothDirectoryInformation, \
FIELD_OFFSET(FILE_ID_EXTD_BOTH_DIR_INFORMATION, NextEntryOffset), \
FIELD_OFFSET(FILE_ID_EXTD_BOTH_DIR_INFORMATION, FileName), \
FIELD_OFFSET(FILE_ID_EXTD_BOTH_DIR_INFORMATION, FileNameLength) \
}
typedef struct _FILE_ID_64_EXTD_DIR_INFORMATION
{
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
ULONG ReparsePointTag;
LARGE_INTEGER FileId;
_Field_size_bytes_(FileNameLength) WCHAR FileName[1];
} FILE_ID_64_EXTD_DIR_INFORMATION, *PFILE_ID_64_EXTD_DIR_INFORMATION;
#define FileId64ExtdDirectoryInformationDefinition { \
FileId64ExtdDirectoryInformation, \
FIELD_OFFSET(FILE_ID_64_EXTD_DIR_INFORMATION, NextEntryOffset), \
FIELD_OFFSET(FILE_ID_64_EXTD_DIR_INFORMATION, FileName), \
FIELD_OFFSET(FILE_ID_64_EXTD_DIR_INFORMATION, FileNameLength) \
}
typedef struct _FILE_ID_64_EXTD_BOTH_DIR_INFORMATION
{
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
ULONG ReparsePointTag;
LARGE_INTEGER FileId;
CCHAR ShortNameLength;
WCHAR ShortName[12];
_Field_size_bytes_(FileNameLength) WCHAR FileName[1];
} FILE_ID_64_EXTD_BOTH_DIR_INFORMATION, *PFILE_ID_64_EXTD_BOTH_DIR_INFORMATION;
#define FileId64ExtdBothDirectoryInformationDefinition { \
FileId64ExtdBothDirectoryInformation, \
FIELD_OFFSET(FILE_ID_64_EXTD_BOTH_DIR_INFORMATION, NextEntryOffset), \
FIELD_OFFSET(FILE_ID_64_EXTD_BOTH_DIR_INFORMATION, FileName), \
FIELD_OFFSET(FILE_ID_64_EXTD_BOTH_DIR_INFORMATION, FileNameLength) \
}
typedef struct _FILE_ID_ALL_EXTD_DIR_INFORMATION
{
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
ULONG ReparsePointTag;
LARGE_INTEGER FileId;
FILE_ID_128 FileId128;
_Field_size_bytes_(FileNameLength) WCHAR FileName[1];
} FILE_ID_ALL_EXTD_DIR_INFORMATION, *PFILE_ID_ALL_EXTD_DIR_INFORMATION;
#define FileIdAllExtdDirectoryInformationDefinition { \
FileIdAllExtdDirectoryInformation, \
FIELD_OFFSET(FILE_ID_ALL_EXTD_DIR_INFORMATION, NextEntryOffset), \
FIELD_OFFSET(FILE_ID_ALL_EXTD_DIR_INFORMATION, FileName), \
FIELD_OFFSET(FILE_ID_ALL_EXTD_DIR_INFORMATION, FileNameLength) \
}
typedef struct _FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION
{
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
ULONG ReparsePointTag;
LARGE_INTEGER FileId;
FILE_ID_128 FileId128;
CCHAR ShortNameLength;
WCHAR ShortName[12];
_Field_size_bytes_(FileNameLength) WCHAR FileName[1];
} FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION, *PFILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION;
#define FileIdAllExtdBothDirectoryInformationDefinition { \
FileIdAllExtdBothDirectoryInformation, \
FIELD_OFFSET(FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION, NextEntryOffset), \
FIELD_OFFSET(FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION, FileName), \
FIELD_OFFSET(FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION, FileNameLength) \
}
#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE)
typedef struct _FILE_STAT_INFORMATION
{
@@ -1004,11 +1124,19 @@ typedef struct _MUP_PROVIDER_INFORMATION
{
ULONG Level;
PVOID Buffer;
SIZE_T BufferSize;
PULONG BufferSize;
} MUP_PROVIDER_INFORMATION, *PMUP_PROVIDER_INFORMATION;
// NtQueryDirectoryFile types
typedef struct _FILE_INFORMATION_DEFINITION
{
FILE_INFORMATION_CLASS Class;
ULONG NextEntryOffset;
ULONG FileNameOffset;
ULONG FileNameLengthOffset;
} FILE_INFORMATION_DEFINITION, *PFILE_INFORMATION_DEFINITION;
typedef struct _FILE_DIRECTORY_INFORMATION
{
ULONG NextEntryOffset;
@@ -1024,6 +1152,13 @@ typedef struct _FILE_DIRECTORY_INFORMATION
_Field_size_bytes_(FileNameLength) WCHAR FileName[1];
} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
#define FileDirectoryInformationDefinition { \
FileDirectoryInformation, \
FIELD_OFFSET(FILE_DIRECTORY_INFORMATION, NextEntryOffset), \
FIELD_OFFSET(FILE_DIRECTORY_INFORMATION, FileName), \
FIELD_OFFSET(FILE_DIRECTORY_INFORMATION, FileNameLength) \
}
typedef struct _FILE_FULL_DIR_INFORMATION
{
ULONG NextEntryOffset;
@@ -1040,6 +1175,13 @@ typedef struct _FILE_FULL_DIR_INFORMATION
_Field_size_bytes_(FileNameLength) WCHAR FileName[1];
} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
#define FileFullDirectoryInformationDefinition { \
FileFullDirectoryInformation, \
FIELD_OFFSET(FILE_FULL_DIR_INFORMATION, NextEntryOffset), \
FIELD_OFFSET(FILE_FULL_DIR_INFORMATION, FileName), \
FIELD_OFFSET(FILE_FULL_DIR_INFORMATION, FileNameLength) \
}
typedef struct _FILE_ID_FULL_DIR_INFORMATION
{
ULONG NextEntryOffset;
@@ -1057,6 +1199,13 @@ typedef struct _FILE_ID_FULL_DIR_INFORMATION
_Field_size_bytes_(FileNameLength) WCHAR FileName[1];
} FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;
#define FileIdFullDirectoryInformationDefinition { \
FileIdFullDirectoryInformation, \
FIELD_OFFSET(FILE_ID_FULL_DIR_INFORMATION, NextEntryOffset),\
FIELD_OFFSET(FILE_ID_FULL_DIR_INFORMATION, FileName), \
FIELD_OFFSET(FILE_ID_FULL_DIR_INFORMATION, FileNameLength) \
}
typedef struct _FILE_BOTH_DIR_INFORMATION
{
ULONG NextEntryOffset;
@@ -1075,6 +1224,13 @@ typedef struct _FILE_BOTH_DIR_INFORMATION
_Field_size_bytes_(FileNameLength) WCHAR FileName[1];
} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
#define FileBothDirectoryInformationDefinition { \
FileBothDirectoryInformation, \
FIELD_OFFSET(FILE_BOTH_DIR_INFORMATION, NextEntryOffset), \
FIELD_OFFSET(FILE_BOTH_DIR_INFORMATION, FileName), \
FIELD_OFFSET(FILE_BOTH_DIR_INFORMATION, FileNameLength) \
}
typedef struct _FILE_ID_BOTH_DIR_INFORMATION
{
ULONG NextEntryOffset;
@@ -1094,6 +1250,13 @@ typedef struct _FILE_ID_BOTH_DIR_INFORMATION
_Field_size_bytes_(FileNameLength) WCHAR FileName[1];
} FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;
#define FileIdBothDirectoryInformationDefinition { \
FileIdBothDirectoryInformation, \
FIELD_OFFSET(FILE_ID_BOTH_DIR_INFORMATION, NextEntryOffset),\
FIELD_OFFSET(FILE_ID_BOTH_DIR_INFORMATION, FileName), \
FIELD_OFFSET(FILE_ID_BOTH_DIR_INFORMATION, FileNameLength) \
}
typedef struct _FILE_NAMES_INFORMATION
{
ULONG NextEntryOffset;
@@ -1102,6 +1265,13 @@ typedef struct _FILE_NAMES_INFORMATION
_Field_size_bytes_(FileNameLength) WCHAR FileName[1];
} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
#define FileNamesInformationDefinition { \
FileNamesInformation, \
FIELD_OFFSET(FILE_NAMES_INFORMATION, NextEntryOffset), \
FIELD_OFFSET(FILE_NAMES_INFORMATION, FileName), \
FIELD_OFFSET(FILE_NAMES_INFORMATION, FileNameLength) \
}
typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION
{
ULONG NextEntryOffset;
@@ -1124,6 +1294,13 @@ typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION
#define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX 0x00000002
#define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX 0x00000004
#define FileIdGlobalTxDirectoryInformationDefinition { \
FileIdGlobalTxDirectoryInformation, \
FIELD_OFFSET(FILE_ID_GLOBAL_TX_DIR_INFORMATION, NextEntryOffset), \
FIELD_OFFSET(FILE_ID_GLOBAL_TX_DIR_INFORMATION, FileName), \
FIELD_OFFSET(FILE_ID_GLOBAL_TX_DIR_INFORMATION, FileNameLength) \
}
typedef struct _FILE_OBJECTID_INFORMATION
{
LONGLONG FileReference;
@@ -1439,9 +1616,55 @@ NtFlushBuffersFile(
_Out_ PIO_STATUS_BLOCK IoStatusBlock
);
// Flag definitions for NtFlushBuffersFileEx
//
// If none of the below flags are specified the following will occur for a
// given file handle:
// - Write any modified data for the given file from the Windows in-memory
// cache.
// - Commit all pending metadata changes for the given file from the
// Windows in-memory cache.
// - Send a SYNC command to the underlying storage device to commit all
// written data in the devices cache to persistent storage.
//
// If a volume handle is specified:
// - Write all modified data for all files on the volume from the Windows
// in-memory cache.
// - Commit all pending metadata changes for all files on the volume from
// the Windows in-memory cache.
// - Send a SYNC command to the underlying storage device to commit all
// written data in the devices cache to persistent storage.
//
// This is equivalent to how NtFlushBuffersFile has always worked.
//
// If set, this operation will write the data for the given file from the
// Windows in-memory cache. This will NOT commit any associated metadata
// changes. This will NOT send a SYNC to the storage device to flush its
// cache. Not supported on volume handles.
//
#define FLUSH_FLAGS_FILE_DATA_ONLY 0x00000001
//
// If set, this operation will commit both the data and metadata changes for
// the given file from the Windows in-memory cache. This will NOT send a SYNC
// to the storage device to flush its cache. Not supported on volume handles.
//
#define FLUSH_FLAGS_NO_SYNC 0x00000002
//
// If set, this operation will write the data for the given file from the
// Windows in-memory cache. It will also try to skip updating the timestamp
// as much as possible. This will send a SYNC to the storage device to flush its
// cache. Not supported on volume or directory handles.
//
#define FLUSH_FLAGS_FILE_DATA_SYNC_ONLY 0x00000004 // REDSTONE1
//
// If set, this operation will write the data for the given file from the
// Windows in-memory cache. It will also try to skip updating the timestamp
// as much as possible. This will send a SYNC to the storage device to flush its
// cache. Not supported on volume or directory handles.
//
#define FLUSH_FLAGS_FLUSH_AND_PURGE 0x00000008 // 24H2
#if (PHNT_VERSION >= PHNT_WIN8)
NTSYSCALLAPI
@@ -1819,19 +2042,19 @@ typedef enum _DIRECTORY_NOTIFY_INFORMATION_CLASS
{
DirectoryNotifyInformation = 1, // FILE_NOTIFY_INFORMATION
DirectoryNotifyExtendedInformation, // FILE_NOTIFY_EXTENDED_INFORMATION
DirectoryNotifyFullInformation, // since 22H2
DirectoryNotifyFullInformation, // FILE_NOTIFY_FULL_INFORMATION // since 22H2
DirectoryNotifyMaximumInformation
} DIRECTORY_NOTIFY_INFORMATION_CLASS, *PDIRECTORY_NOTIFY_INFORMATION_CLASS;
//typedef struct _FILE_NOTIFY_INFORMATION
//{
// ULONG NextEntryOffset;
// ULONG Action;
// ULONG FileNameLength;
// WCHAR FileName[1];
//} FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION;
#if !defined(NTDDI_WIN10_RS5) || (NTDDI_VERSION < NTDDI_WIN10_RS5)
typedef struct _FILE_NOTIFY_INFORMATION
{
ULONG NextEntryOffset;
ULONG Action;
ULONG FileNameLength;
WCHAR FileName[1];
} FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION;
typedef struct _FILE_NOTIFY_EXTENDED_INFORMATION
{
ULONG NextEntryOffset;
@@ -3077,6 +3300,46 @@ typedef struct _OPLOCK_KEY_CONTEXT
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
// pub
#define SUPPORTED_FS_FEATURES_OFFLOAD_READ 0x00000001
#define SUPPORTED_FS_FEATURES_OFFLOAD_WRITE 0x00000002
#if (PHNT_VERSION >= PHNT_REDSTONE2)
// pub
#define SUPPORTED_FS_FEATURES_QUERY_OPEN 0x00000004
#if (PHNT_VERSION >= PHNT_WIN11)
// pub
#define SUPPORTED_FS_FEATURES_BYPASS_IO 0x00000008
// pub
#define SUPPORTED_FS_FEATURES_VALID_MASK (SUPPORTED_FS_FEATURES_OFFLOAD_READ |\
SUPPORTED_FS_FEATURES_OFFLOAD_WRITE |\
SUPPORTED_FS_FEATURES_QUERY_OPEN |\
SUPPORTED_FS_FEATURES_BYPASS_IO)
#else // (PHNT_VERSION >= PHNT_WIN11)
// pub
#define SUPPORTED_FS_FEATURES_VALID_MASK (SUPPORTED_FS_FEATURES_OFFLOAD_READ |\
SUPPORTED_FS_FEATURES_OFFLOAD_WRITE |\
SUPPORTED_FS_FEATURES_QUERY_OPEN)
#endif // (PHNT_VERSION >= PHNT_WIN11)
#else // (PHNT_VERSION >= PHNT_REDSTONE2)
// pub
#define SUPPORTED_FS_FEATURES_VALID_MASK (SUPPORTED_FS_FEATURES_OFFLOAD_READ |\
SUPPORTED_FS_FEATURES_OFFLOAD_WRITE)
#endif // (PHNT_VERSION >= PHNT_REDSTONE2)
#endif // (PHNT_VERSION >= PHNT_WIN8)
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#endif
ntkeapi.h
+1
View File
@@ -91,6 +91,7 @@ typedef enum _KWAIT_REASON
WrPhysicalFault,
WrIoRing,
WrMdlCache,
WrRcu,
MaximumWaitReason
} KWAIT_REASON, *PKWAIT_REASON;
ntldr.h
-2
View File
@@ -669,8 +669,6 @@ NTSYSAPI PS_SYSTEM_DLL_INIT_BLOCK LdrSystemDllInitBlock;
#if (PHNT_VERSION >= PHNT_VISTA)
typedef struct _ACTIVATION_CONTEXT *PACTIVATION_CONTEXT;
// private
NTSYSAPI
NTSTATUS
ntmmapi.h
+9 -2
View File
@@ -650,7 +650,7 @@ NtFlushVirtualMemory(
#if (PHNT_MODE != PHNT_MODE_KERNEL)
typedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS
{
VmPrefetchInformation, // ULONG
VmPrefetchInformation, // MEMORY_PREFETCH_INFORMATION
VmPagePriorityInformation, // OFFER_PRIORITY
VmCfgCallTargetInformation, // CFG_CALL_TARGET_LIST_INFORMATION // REDSTONE2
VmPageDirtyStateInformation, // REDSTONE3
@@ -679,6 +679,13 @@ typedef struct _MEMORY_RANGE_ENTRY
SIZE_T NumberOfBytes;
} MEMORY_RANGE_ENTRY, *PMEMORY_RANGE_ENTRY;
#define VM_PREFETCH_TO_WORKING_SET 0x1 // since 24H4
typedef struct _MEMORY_PREFETCH_INFORMATION
{
ULONG Flags;
} MEMORY_PREFETCH_INFORMATION, *PMEMORY_PREFETCH_INFORMATION;
typedef struct _CFG_CALL_TARGET_LIST_INFORMATION
{
ULONG NumberOfEntries;
@@ -804,7 +811,7 @@ NtMapViewOfSectionEx(
_Inout_opt_ PLARGE_INTEGER SectionOffset,
_Inout_ PSIZE_T ViewSize,
_In_ ULONG AllocationType,
_In_ ULONG Win32Protect,
_In_ ULONG PageProtection,
_Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters,
_In_ ULONG ExtendedParameterCount
);
ntobapi.h
+1 -1
View File
@@ -233,7 +233,7 @@ NTAPI
NtQuerySecurityObject(
_In_ HANDLE Handle,
_In_ SECURITY_INFORMATION SecurityInformation,
_Out_writes_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor,
_Out_writes_bytes_to_opt_(Length, *LengthNeeded) PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ ULONG Length,
_Out_ PULONG LengthNeeded
);
ntpoapi.h
+134 -5
View File
@@ -68,7 +68,7 @@
#define ProcessorSetIdle 55 // (debug-mode boot only)
#define LogicalProcessorIdling 56 // (kernel-mode only)
#define UserPresence 57 // POWER_USER_PRESENCE // not implemented
#define PowerSettingNotificationName 58
#define PowerSettingNotificationName 58 // in: ? (optional) // out: PWNF_STATE_NAME (RtlSubscribeWnfStateChangeNotification)
#define GetPowerSettingValue 59 // GUID
#define IdleResiliency 60 // POWER_IDLE_RESILIENCY
#define SessionRITState 61 // POWER_SESSION_RIT_STATE
@@ -80,14 +80,14 @@
#define PdcInvocation 67 // (kernel-mode only)
#define MonitorInvocation 68 // (kernel-mode only)
#define FirmwareTableInformationRegistered 69 // (kernel-mode only)
#define SetShutdownSelectedTime 70 // NULL
#define SetShutdownSelectedTime 70 // in: NULL
#define SuspendResumeInvocation 71 // (kernel-mode only)
#define PlmPowerRequestCreate 72 // in: COUNTED_REASON_CONTEXT, out: HANDLE
#define ScreenOff 73 // NULL (PowerMonitorOff)
#define ScreenOff 73 // in: NULL (PowerMonitorOff)
#define CsDeviceNotification 74 // (kernel-mode only)
#define PlatformRole 75 // POWER_PLATFORM_ROLE
#define LastResumePerformance 76 // RESUME_PERFORMANCE
#define DisplayBurst 77 // NULL (PowerMonitorOn)
#define DisplayBurst 77 // in: NULL (PowerMonitorOn)
#define ExitLatencySamplingPercentage 78
#define RegisterSpmPowerSettings 79 // (kernel-mode only)
#define PlatformIdleStates 80 // (kernel-mode only)
@@ -105,7 +105,7 @@
#define EnergyTrackerCreate 92
#define EnergyTrackerQuery 93
#define UpdateBlackBoxRecorder 94
#define SessionAllowExternalDmaDevices 95
#define SessionAllowExternalDmaDevices 95 // POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES
#define SendSuspendResumeNotification 96 // since WIN11
#define BlackBoxRecorderDirectAccessBuffer 97
#define PowerInformationLevelMaximum 98
@@ -135,6 +135,107 @@ typedef struct _SYSTEM_HIBERFILE_INFORMATION
LARGE_INTEGER Mcb[1];
} SYSTEM_HIBERFILE_INFORMATION, *PSYSTEM_HIBERFILE_INFORMATION;
//typedef enum POWER_USER_PRESENCE_TYPE
//{
// UserNotPresent = 0,
// UserPresent = 1,
// UserUnknown = 0xff
//} POWER_USER_PRESENCE_TYPE, *PPOWER_USER_PRESENCE_TYPE;
//typedef struct _POWER_USER_PRESENCE
//{
// POWER_USER_PRESENCE_TYPE PowerUserPresence;
//} POWER_USER_PRESENCE, *PPOWER_USER_PRESENCE;
//typedef struct _POWER_SESSION_CONNECT
//{
// BOOLEAN Connected; // TRUE - connected, FALSE - disconnected
// BOOLEAN Console; // TRUE - console, FALSE - TS (not used for Connected = FALSE)
//} POWER_SESSION_CONNECT, *PPOWER_SESSION_CONNECT;
//typedef struct _POWER_SESSION_TIMEOUTS
//{
// ULONG InputTimeout;
// ULONG DisplayTimeout;
//} POWER_SESSION_TIMEOUTS, *PPOWER_SESSION_TIMEOUTS;
//typedef struct _POWER_SESSION_RIT_STATE
//{
// BOOLEAN Active; // TRUE - RIT input received, FALSE - RIT timeout
// ULONG64 LastInputTime; // last input time held for this session
//} POWER_SESSION_RIT_STATE, *PPOWER_SESSION_RIT_STATE;
//typedef struct _POWER_SESSION_WINLOGON
//{
// ULONG SessionId; // the Win32k session identifier
// BOOLEAN Console; // TRUE - for console session, FALSE - for remote session
// BOOLEAN Locked; // TRUE - lock, FALSE - unlock
//} POWER_SESSION_WINLOGON, *PPOWER_SESSION_WINLOGON;
//typedef struct _POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES
//{
// BOOLEAN IsAllowed;
//} POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES, *PPOWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES;
//
//typedef struct _POWER_IDLE_RESILIENCY
//{
// ULONG CoalescingTimeout;
// ULONG IdleResiliencyPeriod;
//} POWER_IDLE_RESILIENCY, *PPOWER_IDLE_RESILIENCY;
//typedef struct _RESUME_PERFORMANCE
//{
// ULONG PostTimeMs;
// ULONGLONG TotalResumeTimeMs;
// ULONGLONG ResumeCompleteTimestamp;
//} RESUME_PERFORMANCE, *PRESUME_PERFORMANCE;
//typedef struct _NOTIFY_USER_POWER_SETTING
//{
// GUID Guid;
//} NOTIFY_USER_POWER_SETTING, *PNOTIFY_USER_POWER_SETTING;
#define POWER_PERF_SCALE 100
#define PERF_LEVEL_TO_PERCENT(_x_) ((_x_ * 1000) / (POWER_PERF_SCALE * 10))
#define PERCENT_TO_PERF_LEVEL(_x_) ((_x_ * POWER_PERF_SCALE * 10) / 1000)
#define PO_REASON_STATE_STANDBY (PO_REASON_STATE_S1 | \
PO_REASON_STATE_S2 | \
PO_REASON_STATE_S3)
#define PO_REASON_STATE_ALL (PO_REASON_STATE_STANDBY | \
PO_REASON_STATE_S4 | \
PO_REASON_STATE_S4FIRM)
typedef struct _SYSTEM_POWER_LOGGING_ENTRY
{
ULONG Reason;
ULONG States;
} SYSTEM_POWER_LOGGING_ENTRY, *PSYSTEM_POWER_LOGGING_ENTRY;
typedef enum _POWER_STATE_DISABLED_TYPE
{
PoDisabledStateSleeping1 = 0,
PoDisabledStateSleeping2 = 1,
PoDisabledStateSleeping3 = 2,
PoDisabledStateSleeping4 = 3,
PoDisabledStateSleeping0Idle = 4,
PoDisabledStateReserved5 = 5,
PoDisabledStateSleeping4Firmware = 6,
PoDisabledStateMaximum = 7
} POWER_STATE_DISABLED_TYPE, PPOWER_STATE_DISABLED_TYPE;
#define POWER_STATE_DISABLED_TYPE_MAX 8
_Struct_size_bytes_(sizeof(SYSTEM_POWER_STATE_DISABLE_REASON) + PowerReasonLength)
typedef struct _SYSTEM_POWER_STATE_DISABLE_REASON
{
BOOLEAN AffectedState[POWER_STATE_DISABLED_TYPE_MAX];
ULONG PowerReasonCode;
ULONG PowerReasonLength;
//UCHAR PowerReasonInfo[ANYSIZE_ARRAY];
} SYSTEM_POWER_STATE_DISABLE_REASON, *PSYSTEM_POWER_STATE_DISABLE_REASON;
// Reason Context
#define POWER_REQUEST_CONTEXT_NOT_SPECIFIED DIAGNOSTIC_REASON_NOT_SPECIFIED
// wdm
@@ -314,6 +415,34 @@ typedef struct _PROCESSOR_IDLE_STATES
KAFFINITY TargetProcessors;
PROCESSOR_IDLE_STATE State[ANYSIZE_ARRAY];
} PROCESSOR_IDLE_STATES, *PPROCESSOR_IDLE_STATES;
//
//#define PROCESSOR_IDLESTATE_POLICY_COUNT 0x3
//
//typedef struct
//{
// ULONG TimeCheck;
// UCHAR DemotePercent;
// UCHAR PromotePercent;
// UCHAR Spare[2];
//} PROCESSOR_IDLESTATE_INFO, *PPROCESSOR_IDLESTATE_INFO;
//
//typedef struct
//{
// USHORT Revision;
// union
// {
// USHORT AsUSHORT;
// struct
// {
// USHORT AllowScaling : 1;
// USHORT Disabled : 1;
// USHORT Reserved : 14;
// } DUMMYSTRUCTNAME;
// } Flags;
//
// ULONG PolicyCount;
// PROCESSOR_IDLESTATE_INFO Policy[PROCESSOR_IDLESTATE_POLICY_COUNT];
//} PROCESSOR_IDLESTATE_POLICY, *PPROCESSOR_IDLESTATE_POLICY;
// rev
typedef struct _PROCESSOR_LOAD
ntpsapi.h
+105 -16
View File
@@ -219,12 +219,12 @@ typedef enum _PROCESSINFOCLASS
ProcessAssignCpuPartitions,
ProcessPriorityClassEx, // s: PROCESS_PRIORITY_CLASS_EX
ProcessMembershipInformation, // q: PROCESS_MEMBERSHIP_INFORMATION
ProcessEffectiveIoPriority, // q: IO_PRIORITY_HINT
ProcessEffectiveIoPriority, // q: IO_PRIORITY_HINT // 110
ProcessEffectivePagePriority, // q: ULONG
ProcessSchedulerSharedData, // since 24H2
ProcessSlistRollbackInformation,
ProcessNetworkIoCounters, // q: PROCESS_NETWORK_COUNTERS
ProcessFindFirstThreadByTebValue,
ProcessFindFirstThreadByTebValue, // PROCESS_TEB_VALUE_INFORMATION
MaxProcessInfoClass
} PROCESSINFOCLASS;
#endif
@@ -289,7 +289,7 @@ typedef enum _THREADINFOCLASS
ThreadEffectiveIoPriority, // q: IO_PRIORITY_HINT
ThreadEffectivePagePriority, // q: ULONG
ThreadUpdateLockOwnership, // since 24H2
ThreadSchedulerSharedDataSlot,
ThreadSchedulerSharedDataSlot, // SCHEDULER_SHARED_DATA_SLOT_INFORMATION
ThreadTebInformationAtomic, // THREAD_TEB_INFORMATION
ThreadIndexInformation, // THREAD_INDEX_INFORMATION
MaxThreadInfoClass
@@ -336,7 +336,8 @@ typedef struct _PROCESS_EXTENDED_BASIC_INFORMATION
ULONG IsStronglyNamed : 1;
ULONG IsSecureProcess : 1;
ULONG IsSubsystemProcess : 1;
ULONG SpareBits : 23;
ULONG IsTrustedApp : 1; // since 24H2
ULONG SpareBits : 22;
};
};
} PROCESS_EXTENDED_BASIC_INFORMATION, *PPROCESS_EXTENDED_BASIC_INFORMATION;
@@ -438,7 +439,15 @@ typedef struct _PROCESS_WS_WATCH_INFORMATION
// psapi:PSAPI_WS_WATCH_INFORMATION_EX
typedef struct _PROCESS_WS_WATCH_INFORMATION_EX
{
PROCESS_WS_WATCH_INFORMATION BasicInfo;
union
{
PROCESS_WS_WATCH_INFORMATION BasicInfo;
struct
{
PVOID FaultingPc;
PVOID FaultingVa;
};
};
ULONG_PTR FaultingThreadId;
ULONG_PTR Flags;
} PROCESS_WS_WATCH_INFORMATION_EX, *PPROCESS_WS_WATCH_INFORMATION_EX;
@@ -683,9 +692,6 @@ typedef struct _PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY
#endif
#if !defined(NTDDI_WIN10_NI) || (NTDDI_VERSION < NTDDI_WIN10_NI)
#define ProcessUserPointerAuthPolicy 17
#define ProcessSEHOPPolicy 18
typedef struct _PROCESS_MITIGATION_USER_POINTER_AUTH_POLICY {
union {
ULONG Flags;
@@ -707,6 +713,43 @@ typedef struct _PROCESS_MITIGATION_SEHOP_POLICY {
} PROCESS_MITIGATION_SEHOP_POLICY, *PPROCESS_MITIGATION_SEHOP_POLICY;
#endif
typedef struct _PROCESS_MITIGATION_ACTIVATION_CONTEXT_TRUST_POLICY2
{
union
{
ULONG Flags;
struct
{
ULONG AssemblyManifestRedirectionTrust : 1;
ULONG ReservedFlags : 31;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
} PROCESS_MITIGATION_ACTIVATION_CONTEXT_TRUST_POLICY2, *PPROCESS_MITIGATION_ACTIVATION_CONTEXT_TRUST_POLICY2;
// enum PROCESS_MITIGATION_POLICY
#define PROCESS_MITIGATION_POLICY ULONG
#define ProcessDEPPolicy 0
#define ProcessASLRPolicy 1
#define ProcessDynamicCodePolicy 2
#define ProcessStrictHandleCheckPolicy 3
#define ProcessSystemCallDisablePolicy 4
#define ProcessMitigationOptionsMask 5
#define ProcessExtensionPointDisablePolicy 6
#define ProcessControlFlowGuardPolicy 7
#define ProcessSignaturePolicy 8
#define ProcessFontDisablePolicy 9
#define ProcessImageLoadPolicy 10
#define ProcessSystemCallFilterPolicy 11
#define ProcessPayloadRestrictionPolicy 12
#define ProcessChildProcessPolicy 13
#define ProcessSideChannelIsolationPolicy 14
#define ProcessUserShadowStackPolicy 15
#define ProcessRedirectionTrustPolicy 16
#define ProcessUserPointerAuthPolicy 17
#define ProcessSEHOPPolicy 18
#define ProcessActivationContextTrustPolicy 19
#define MaxProcessMitigationPolicy 20
typedef struct _PROCESS_MITIGATION_POLICY_INFORMATION
{
PROCESS_MITIGATION_POLICY Policy;
@@ -1058,11 +1101,18 @@ typedef struct _PROCESS_MEMBERSHIP_INFORMATION
#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE)
typedef struct _PROCESS_NETWORK_COUNTERS
{
ULONG_PTR BytesIn;
ULONG_PTR BytesOut;
ULONG64 BytesIn;
ULONG64 BytesOut;
} PROCESS_NETWORK_COUNTERS, *PPROCESS_NETWORK_COUNTERS;
#endif
typedef struct _PROCESS_TEB_VALUE_INFORMATION
{
ULONG ThreadId;
ULONG TebOffset;
ULONG_PTR Value;
} PROCESS_TEB_VALUE_INFORMATION, *PPROCESS_TEB_VALUE_INFORMATION;
// end_private
NTSYSCALLAPI
@@ -1104,6 +1154,20 @@ typedef struct _THREAD_CYCLE_TIME_INFORMATION
ULONGLONG CurrentCycleCount;
} THREAD_CYCLE_TIME_INFORMATION, *PTHREAD_CYCLE_TIME_INFORMATION;
typedef enum _SCHEDULER_SHARED_DATA_SLOT_ACTION
{
SchedulerSharedSlotAssign,
SchedulerSharedSlotFree,
SchedulerSharedSlotQuery
} SCHEDULER_SHARED_DATA_SLOT_ACTION;
typedef struct _SCHEDULER_SHARED_DATA_SLOT_INFORMATION
{
SCHEDULER_SHARED_DATA_SLOT_ACTION Action;
PVOID SchedulerSharedDataHandle;
PVOID Slot;
} SCHEDULER_SHARED_DATA_SLOT_INFORMATION, *PSCHEDULER_SHARED_DATA_SLOT_INFORMATION;
typedef struct _THREAD_TEB_INFORMATION
{
PVOID TebInformation; // buffer to place data in
@@ -1370,6 +1434,8 @@ NtCreateProcess(
#define PROCESS_CREATE_FLAGS_AUXILIARY_PROCESS 0x00008000 // NtCreateProcessEx & NtCreateUserProcess, requires SeTcb
#define PROCESS_CREATE_FLAGS_CREATE_STORE 0x00020000 // NtCreateProcessEx & NtCreateUserProcess
#define PROCESS_CREATE_FLAGS_USE_PROTECTED_ENVIRONMENT 0x00040000 // NtCreateProcessEx & NtCreateUserProcess
#define PROCESS_CREATE_FLAGS_IMAGE_EXPANSION_MITIGATION_DISABLE 0x00080000
#define PROCESS_CREATE_FLAGS_PARTITION_CREATE_SLAB_IDENTITY 0x00400000 // NtCreateProcessEx & NtCreateUserProcess, requires SeLockMemoryPrivilege
// end_rev
NTSYSCALLAPI
@@ -1991,7 +2057,7 @@ typedef enum _PS_ATTRIBUTE_NUM
PsAttributeComponentFilter,
PsAttributeEnableOptionalXStateFeatures, // since WIN11
PsAttributeSupportedMachines, // since 24H2
PsAttributeSveVectorLength,
PsAttributeSveVectorLength, // PPS_PROCESS_CREATION_SVE_VECTOR_LENGTH
PsAttributeMax
} PS_ATTRIBUTE_NUM;
@@ -2181,6 +2247,13 @@ typedef struct _PS_BNO_ISOLATION_PARAMETERS
BOOLEAN IsolationEnabled;
} PS_BNO_ISOLATION_PARAMETERS, *PPS_BNO_ISOLATION_PARAMETERS;
// private
typedef union _PS_PROCESS_CREATION_SVE_VECTOR_LENGTH
{
ULONG VectorLength : 24;
ULONG FlagsReserved : 8;
} PS_PROCESS_CREATION_SVE_VECTOR_LENGTH, *PPS_PROCESS_CREATION_SVE_VECTOR_LENGTH;
// private
typedef enum _PS_MITIGATION_OPTION
{
@@ -2338,9 +2411,9 @@ NtCreateUserProcess(
#define THREAD_CREATE_FLAGS_CREATE_SUSPENDED 0x00000001 // NtCreateUserProcess & NtCreateThreadEx
#define THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH 0x00000002 // NtCreateThreadEx only
#define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER 0x00000004 // NtCreateThreadEx only
#define THREAD_CREATE_FLAGS_LOADER_WORKER 0x00000010 // NtCreateThreadEx only
#define THREAD_CREATE_FLAGS_SKIP_LOADER_INIT 0x00000020 // NtCreateThreadEx only
#define THREAD_CREATE_FLAGS_BYPASS_PROCESS_FREEZE 0x00000040 // NtCreateThreadEx only
#define THREAD_CREATE_FLAGS_LOADER_WORKER 0x00000010 // NtCreateThreadEx only, since THRESHOLD
#define THREAD_CREATE_FLAGS_SKIP_LOADER_INIT 0x00000020 // NtCreateThreadEx only, since REDSTONE2
#define THREAD_CREATE_FLAGS_BYPASS_PROCESS_FREEZE 0x00000040 // NtCreateThreadEx only, since 19H1
// end_rev
#if (PHNT_VERSION >= PHNT_VISTA)
@@ -2425,8 +2498,8 @@ NtCreateThreadEx(
#define JobObjectThreadImpersonationInformation 47
#define JobObjectIoPriorityLimit 48 // JOBOBJECT_IO_PRIORITY_LIMIT
#define JobObjectPagePriorityLimit 49 // JOBOBJECT_PAGE_PRIORITY_LIMIT
#define JobObjectServerSiloDiagnosticInformation 50 // since 24H2
#define JobObjectNetworkAccountingInformation 51
#define JobObjectServerSiloDiagnosticInformation 50 // SERVERSILO_DIAGNOSTIC_INFORMATION // since 24H2
#define JobObjectNetworkAccountingInformation 51 // JOBOBJECT_NETWORK_ACCOUNTING_INFORMATION
#define MaxJobObjectInfoClass 52
// rev // extended limit v2
@@ -2604,6 +2677,22 @@ typedef struct _JOBOBJECT_PAGE_PRIORITY_LIMIT
ULONG Priority;
} JOBOBJECT_PAGE_PRIORITY_LIMIT, *PJOBOBJECT_PAGE_PRIORITY_LIMIT;
#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE)
// private
typedef struct _SERVERSILO_DIAGNOSTIC_INFORMATION
{
NTSTATUS ExitStatus;
WCHAR CriticalProcessName[15];
} SERVERSILO_DIAGNOSTIC_INFORMATION, *PSERVERSILO_DIAGNOSTIC_INFORMATION;
// private
typedef struct _JOBOBJECT_NETWORK_ACCOUNTING_INFORMATION
{
ULONG64 DataBytesIn;
ULONG64 DataBytesOut;
} JOBOBJECT_NETWORK_ACCOUNTING_INFORMATION, *PJOBOBJECT_NETWORK_ACCOUNTING_INFORMATION;
#endif
NTSYSCALLAPI
NTSTATUS
NTAPI
ntrtl.h
+439 -56
View File
@@ -2352,18 +2352,74 @@ RtlNextUnicodePrefix(
// Compression
#define COMPRESSION_FORMAT_NONE (0x0000)
#define COMPRESSION_FORMAT_DEFAULT (0x0001)
#define COMPRESSION_FORMAT_LZNT1 (0x0002)
#define COMPRESSION_FORMAT_XPRESS (0x0003)
#define COMPRESSION_FORMAT_XPRESS_HUFF (0x0004)
#define COMPRESSION_FORMAT_XP10 (0x0005)
#define COMPRESSION_FORMAT_LZ4 (0x0006)
#define COMPRESSION_FORMAT_DEFLATE (0x0007)
#define COMPRESSION_FORMAT_ZLIB (0x0008)
#define COMPRESSION_FORMAT_MAX (0x0008)
#define COMPRESSION_ENGINE_STANDARD (0x0000)
#define COMPRESSION_ENGINE_MAXIMUM (0x0100)
#define COMPRESSION_ENGINE_HIBER (0x0200)
#define COMPRESSION_ENGINE_MAX (0x0200)
#define COMPRESSION_FORMAT_MASK (0x00FF)
#define COMPRESSION_ENGINE_MASK (0xFF00)
#define COMPRESSION_FORMAT_ENGINE_MASK (COMPRESSION_FORMAT_MASK | COMPRESSION_ENGINE_MASK)
typedef struct _COMPRESSED_DATA_INFO
{
USHORT CompressionFormatAndEngine; // COMPRESSION_FORMAT_* and COMPRESSION_ENGINE_*
//
// Code for the compression format (and engine) as
// defined in ntrtl.h. Note that COMPRESSION_FORMAT_NONE
// and COMPRESSION_FORMAT_DEFAULT are invalid if
// any of the described chunks are compressed.
//
USHORT CompressionFormatAndEngine;
//
// Since chunks and compression units are expected to be
// powers of 2 in size, we express then log2. So, for
// example (1 << ChunkShift) == ChunkSizeInBytes. The
// ClusterShift indicates how much space must be saved
// to successfully compress a compression unit - each
// successfully compressed compression unit must occupy
// at least one cluster less in bytes than an uncompressed
// compression unit.
//
UCHAR CompressionUnitShift;
UCHAR ChunkShift;
UCHAR ClusterShift;
UCHAR Reserved;
//
// This is the number of entries in the CompressedChunkSizes
// array.
//
USHORT NumberOfChunks;
ULONG CompressedChunkSizes[1];
//
// This is an array of the sizes of all chunks resident
// in the compressed data buffer. There must be one entry
// in this array for each chunk possible in the uncompressed
// buffer size. A size of FSRTL_CHUNK_SIZE indicates the
// corresponding chunk is uncompressed and occupies exactly
// that size. A size of 0 indicates that the corresponding
// chunk contains nothing but binary 0's, and occupies no
// space in the compressed data. All other sizes must be
// less than FSRTL_CHUNK_SIZE, and indicate the exact size
// of the compressed data in bytes.
//
ULONG CompressedChunkSizes[ANYSIZE_ARRAY];
} COMPRESSED_DATA_INFO, *PCOMPRESSED_DATA_INFO;
NTSYSAPI
@@ -4129,6 +4185,30 @@ typedef struct _RTL_BUFFER
SIZE_T StaticSize;
} RTL_BUFFER, *PRTL_BUFFER;
//FORCEINLINE
//VOID
//RtlInitBuffer(
// _Inout_ PRTL_BUFFER Buffer,
// _In_ PUCHAR Data,
// _In_ ULONG DataSize
// )
//{
// Buffer->Buffer = Buffer->StaticBuffer = Data;
// Buffer->Size = Buffer->StaticSize = DataSize;
//}
//
//FORCEINLINE
//VOID
//RtlFreeBuffer(
// _Inout_ PRTL_BUFFER Buffer
// )
//{
// if (Buffer->Buffer != Buffer->StaticBuffer && Buffer->Buffer)
// RtlFreeHeap(RtlProcessHeap(), 0, Buffer->Buffer);
// Buffer->Buffer = Buffer->StaticBuffer;
// Buffer->Size = Buffer->StaticSize;
//}
// rev
typedef struct _RTL_UNICODE_STRING_BUFFER
{
@@ -4668,7 +4748,8 @@ typedef struct _RTL_SEGMENT_HEAP_MEMORY_SOURCE
#define SEGMENT_HEAP_PARAMETERS_VERSION 3
#define SEGMENT_HEAP_FLG_USE_PAGE_HEAP 0x1
#define SEGMENT_HEAP_PARAMS_VALID_FLAGS SEGMENT_HEAP_FLG_USE_PAGE_HEAP
#define SEGMENT_HEAP_FLG_NO_LFH 0x2
#define SEGMENT_HEAP_PARAMS_VALID_FLAGS 0x3
typedef struct _RTL_SEGMENT_HEAP_PARAMETERS
{
@@ -4725,6 +4806,24 @@ typedef struct _RTL_HEAP_PARAMETERS
#define HEAP_CLASS_8 0x00008000 // CSR port heap
#define HEAP_CLASS_MASK 0x0000f000
#define HEAP_MAXIMUM_TAG 0x0FFF
#define HEAP_GLOBAL_TAG 0x0800
#define HEAP_PSEUDO_TAG_FLAG 0x8000
#define HEAP_TAG_SHIFT 18
#define HEAP_TAG_MASK (HEAP_MAXIMUM_TAG << HEAP_TAG_SHIFT)
#define HEAP_CREATE_SEGMENT_HEAP 0x00000100
//
// Only applies to segment heap. Applies pointer obfuscation which is
// generally excessive and unnecessary but is necessary for certain insecure
// heaps in win32k.
//
// Specifying HEAP_CREATE_HARDENED prevents the heap from using locks as
// pointers would potentially be exposed in heap metadata lock variables.
// Callers are therefore responsible for synchronizing access to hardened heaps.
//
#define HEAP_CREATE_HARDENED 0x00000200
_Must_inspect_result_
NTSYSAPI
PVOID
@@ -5550,6 +5649,36 @@ RtlConvertUlongToLuid(
return tempLuid;
}
FORCEINLINE
LONGLONG
NTAPI_INLINE
RtlConvertLuidToLonglong(
_In_ LUID Luid
)
{
LONGLONG tempLuid;
tempLuid = Luid.LowPart;
tempLuid += ((LONGLONG)(Luid.HighPart) << 32);
return tempLuid;
}
FORCEINLINE
ULONGLONG
NTAPI_INLINE
RtlConvertLuidToUlonglong(
_In_ LUID Luid
)
{
ULARGE_INTEGER tempLi;
tempLi.LowPart = Luid.LowPart;
tempLi.HighPart = Luid.HighPart;
return tempLi.QuadPart;
}
NTSYSAPI
VOID
NTAPI
@@ -5829,6 +5958,8 @@ RtlNtStatusToDosError(
_In_ NTSTATUS Status
);
_When_(Status < 0, _Out_range_(>, 0))
_When_(Status >= 0, _Out_range_(==, 0))
NTSYSAPI
ULONG
NTAPI
@@ -7491,6 +7622,16 @@ RtlGetAce(
_Outptr_ PVOID *Ace
);
#if (PHNT_VERSION >= PHNT_WIN11_24H2)
NTSYSAPI
NTSTATUS
NTAPI
RtlGetAcesBufferSize(
_In_ PACL Acl,
_Out_ PULONG AcesBufferSize
);
#endif
NTSYSAPI
BOOLEAN
NTAPI
@@ -9221,6 +9362,13 @@ RtlFlsGetValue(
_Out_ PVOID* FlsData
);
NTSYSAPI
PVOID
WINAPI
RtlFlsGetValue2(
_In_ ULONG FlsIndex
);
NTSYSAPI
NTSTATUS
NTAPI
@@ -9754,25 +9902,24 @@ RtlFlushSecureMemoryCache(
_In_opt_ SIZE_T MemoryLength
);
#if (PHNT_VERSION >= PHNT_20H1)
// Feature configuration
typedef struct __RTL_FEATURE_USAGE_REPORT
// private
typedef ULONG RTL_FEATURE_ID;
typedef ULONGLONG RTL_FEATURE_CHANGE_STAMP, *PRTL_FEATURE_CHANGE_STAMP;
typedef UCHAR RTL_FEATURE_VARIANT;
typedef ULONG RTL_FEATURE_VARIANT_PAYLOAD;
typedef PVOID RTL_FEATURE_CONFIGURATION_CHANGE_REGISTRATION, *PRTL_FEATURE_CONFIGURATION_CHANGE_REGISTRATION;
// private
typedef struct _RTL_FEATURE_USAGE_REPORT
{
ULONG FeatureId;
USHORT ReportingKind;
USHORT ReportingOptions;
} RTL_FEATURE_USAGE_REPORT, *PRTL_FEATURE_USAGE_REPORT;
// rev
NTSYSAPI
NTSTATUS
NTAPI
RtlNotifyFeatureUsage(
_In_ PRTL_FEATURE_USAGE_REPORT FeatureUsageReport
);
// private
typedef enum _RTL_FEATURE_CONFIGURATION_TYPE
{
RtlFeatureConfigurationBoot,
@@ -9780,10 +9927,10 @@ typedef enum _RTL_FEATURE_CONFIGURATION_TYPE
RtlFeatureConfigurationCount
} RTL_FEATURE_CONFIGURATION_TYPE;
// rev
// private
typedef struct _RTL_FEATURE_CONFIGURATION
{
ULONG FeatureId;
RTL_FEATURE_ID FeatureId;
union
{
ULONG Flags;
@@ -9798,100 +9945,327 @@ typedef struct _RTL_FEATURE_CONFIGURATION
ULONG Reserved : 16;
};
};
ULONG VariantPayload;
RTL_FEATURE_VARIANT_PAYLOAD VariantPayload;
} RTL_FEATURE_CONFIGURATION, *PRTL_FEATURE_CONFIGURATION;
// rev
// private
typedef struct _RTL_FEATURE_CONFIGURATION_TABLE
{
ULONG FeatureCount;
_Field_size_(FeatureCount) RTL_FEATURE_CONFIGURATION Features[ANYSIZE_ARRAY];
} RTL_FEATURE_CONFIGURATION_TABLE, *PRTL_FEATURE_CONFIGURATION_TABLE;
// private
typedef enum _RTL_FEATURE_CONFIGURATION_PRIORITY
{
FeatureConfigurationPriorityImageDefault = 0,
FeatureConfigurationPriorityEKB = 1,
FeatureConfigurationPrioritySafeguard = 2,
FeatureConfigurationPriorityPersistent = FeatureConfigurationPrioritySafeguard,
FeatureConfigurationPriorityReserved3 = 3,
FeatureConfigurationPriorityService = 4,
FeatureConfigurationPriorityReserved5 = 5,
FeatureConfigurationPriorityDynamic = 6,
FeatureConfigurationPriorityReserved7 = 7,
FeatureConfigurationPriorityUser = 8,
FeatureConfigurationPrioritySecurity = 9,
FeatureConfigurationPriorityUserPolicy = 10,
FeatureConfigurationPriorityReserved11 = 11,
FeatureConfigurationPriorityTest = 12,
FeatureConfigurationPriorityReserved13 = 13,
FeatureConfigurationPriorityReserved14 = 14,
FeatureConfigurationPriorityImageOverride = 15,
FeatureConfigurationPriorityMax = FeatureConfigurationPriorityImageOverride
} RTL_FEATURE_CONFIGURATION_PRIORITY, *PRTL_FEATURE_CONFIGURATION_PRIORITY;
// private
typedef enum _RTL_FEATURE_ENABLED_STATE
{
FeatureEnabledStateDefault,
FeatureEnabledStateDisabled,
FeatureEnabledStateEnabled
} RTL_FEATURE_ENABLED_STATE;
// private
typedef enum _RTL_FEATURE_ENABLED_STATE_OPTIONS
{
FeatureEnabledStateOptionsNone,
FeatureEnabledStateOptionsWexpConfig
} RTL_FEATURE_ENABLED_STATE_OPTIONS, *PRTL_FEATURE_ENABLED_STATE_OPTIONS;
// private
typedef enum _RTL_FEATURE_VARIANT_PAYLOAD_KIND
{
FeatureVariantPayloadKindNone,
FeatureVariantPayloadKindResident,
FeatureVariantPayloadKindExternal
} RTL_FEATURE_VARIANT_PAYLOAD_KIND, *PRTL_FEATURE_VARIANT_PAYLOAD_KIND;
// private
typedef enum _RTL_FEATURE_CONFIGURATION_OPERATION
{
FeatureConfigurationOperationNone = 0,
FeatureConfigurationOperationFeatureState = 1,
FeatureConfigurationOperationVariantState = 2,
FeatureConfigurationOperationResetState = 4
} RTL_FEATURE_CONFIGURATION_OPERATION, *PRTL_FEATURE_CONFIGURATION_OPERATION;
// private
typedef struct _RTL_FEATURE_CONFIGURATION_UPDATE
{
RTL_FEATURE_ID FeatureId;
RTL_FEATURE_CONFIGURATION_PRIORITY Priority;
RTL_FEATURE_ENABLED_STATE EnabledState;
RTL_FEATURE_ENABLED_STATE_OPTIONS EnabledStateOptions;
RTL_FEATURE_VARIANT Variant;
UCHAR Reserved[3];
RTL_FEATURE_VARIANT_PAYLOAD_KIND VariantPayloadKind;
RTL_FEATURE_VARIANT_PAYLOAD VariantPayload;
RTL_FEATURE_CONFIGURATION_OPERATION Operation;
} RTL_FEATURE_CONFIGURATION_UPDATE, *PRTL_FEATURE_CONFIGURATION_UPDATE;
// private
typedef struct _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET
{
ULONG Data[2];
} RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET, *PRTL_FEATURE_USAGE_SUBSCRIPTION_TARGET;
// private
typedef struct _RTL_FEATURE_USAGE_DATA
{
RTL_FEATURE_ID FeatureId;
USHORT ReportingKind;
USHORT Reserved;
} RTL_FEATURE_USAGE_DATA, *PRTL_FEATURE_USAGE_DATA;
// private
typedef struct _RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS
{
RTL_FEATURE_ID FeatureId;
USHORT ReportingKind;
USHORT ReportingOptions;
RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET ReportingTarget;
} RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS, *PRTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS;
// private
typedef struct _RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE
{
ULONG SubscriptionCount;
_Field_size_(SubscriptionCount) RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS Subscriptions[ANYSIZE_ARRAY];
} RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE, *PRTL_FEATURE_USAGE_SUBSCRIPTION_TABLE;
// private
_Function_class_(RTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK)
typedef VOID (NTAPI RTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK)(
_In_opt_ PVOID Context
);
typedef RTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK *PRTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK;
// private
typedef struct _SYSTEM_FEATURE_CONFIGURATION_QUERY
{
RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType;
RTL_FEATURE_ID FeatureId;
} SYSTEM_FEATURE_CONFIGURATION_QUERY, *PSYSTEM_FEATURE_CONFIGURATION_QUERY;
// private
typedef struct _SYSTEM_FEATURE_CONFIGURATION_INFORMATION
{
RTL_FEATURE_CHANGE_STAMP ChangeStamp;
RTL_FEATURE_CONFIGURATION Configuration;
} SYSTEM_FEATURE_CONFIGURATION_INFORMATION, *PSYSTEM_FEATURE_CONFIGURATION_INFORMATION;
// private
typedef enum _SYSTEM_FEATURE_CONFIGURATION_UPDATE_TYPE
{
SystemFeatureConfigurationUpdateTypeUpdate = 0,
SystemFeatureConfigurationUpdateTypeOverwrite = 1,
SystemFeatureConfigurationUpdateTypeCount = 2,
} SYSTEM_FEATURE_CONFIGURATION_UPDATE_TYPE, *PSYSTEM_FEATURE_CONFIGURATION_UPDATE_TYPE;
// private
typedef struct _SYSTEM_FEATURE_CONFIGURATION_UPDATE
{
SYSTEM_FEATURE_CONFIGURATION_UPDATE_TYPE UpdateType;
union
{
struct
{
RTL_FEATURE_CHANGE_STAMP PreviousChangeStamp;
RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType;
ULONG UpdateCount;
_Field_size_(UpdateCount) RTL_FEATURE_CONFIGURATION_UPDATE Updates[ANYSIZE_ARRAY];
} Update;
struct
{
RTL_FEATURE_CHANGE_STAMP PreviousChangeStamp;
RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType;
SIZE_T BufferSize;
PVOID Buffer;
} Overwrite;
};
} SYSTEM_FEATURE_CONFIGURATION_UPDATE, *PSYSTEM_FEATURE_CONFIGURATION_UPDATE;
// private
typedef struct _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY
{
RTL_FEATURE_CHANGE_STAMP ChangeStamp;
PVOID Section;
SIZE_T Size;
} SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY, *PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY;
// private
typedef enum _SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE
{
SystemFeatureConfigurationSectionTypeBoot = 0,
SystemFeatureConfigurationSectionTypeRuntime = 1,
SystemFeatureConfigurationSectionTypeUsageTriggers = 2,
SystemFeatureConfigurationSectionTypeCount = 3,
} SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE;
// private
typedef struct _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST
{
RTL_FEATURE_CHANGE_STAMP PreviousChangeStamps[SystemFeatureConfigurationSectionTypeCount];
} SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST, *PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST;
// private
typedef struct _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION
{
RTL_FEATURE_CHANGE_STAMP OverallChangeStamp;
SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY Descriptors[SystemFeatureConfigurationSectionTypeCount];
} SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION, *PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION;
// private
typedef struct _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS
{
RTL_FEATURE_ID FeatureId;
USHORT ReportingKind;
USHORT ReportingOptions;
RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET ReportingTarget;
} SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS, *PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS;
typedef struct _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY
{
ULONG Remove;
RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS Details;
} SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY, *PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY;
typedef struct _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE
{
ULONG UpdateCount;
_Field_size_(UpdateCount) SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY Updates[ANYSIZE_ARRAY];
} SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE, *PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE;
#if (PHNT_VERSION >= PHNT_20H1)
// private
NTSYSAPI
NTSTATUS
NTAPI
RtlNotifyFeatureUsage(
_In_ PRTL_FEATURE_USAGE_REPORT FeatureUsageReport
);
// private
NTSYSAPI
NTSTATUS
NTAPI
RtlQueryFeatureConfiguration(
_In_ ULONG FeatureId,
_In_ RTL_FEATURE_CONFIGURATION_TYPE FeatureType,
_Inout_ PULONGLONG ChangeStamp,
_In_ PRTL_FEATURE_CONFIGURATION FeatureConfiguration
_In_ RTL_FEATURE_ID FeatureId,
_In_ RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType,
_Out_ PRTL_FEATURE_CHANGE_STAMP ChangeStamp,
_Out_ PRTL_FEATURE_CONFIGURATION FeatureConfiguration
);
// rev
// private
NTSYSAPI
NTSTATUS
NTAPI
RtlSetFeatureConfigurations(
_Inout_ PULONGLONG ChangeStamp,
_In_ RTL_FEATURE_CONFIGURATION_TYPE FeatureType,
_In_ PRTL_FEATURE_CONFIGURATION FeatureConfiguration,
_In_ ULONG FeatureConfigurationCount
_In_opt_ PRTL_FEATURE_CHANGE_STAMP PreviousChangeStamp,
_In_ RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType,
_In_reads_(ConfigurationUpdateCount) PRTL_FEATURE_CONFIGURATION_UPDATE ConfigurationUpdates,
_In_ SIZE_T ConfigurationUpdateCount
);
// rev
// private
NTSYSAPI
NTSTATUS
NTAPI
RtlQueryAllFeatureConfigurations(
_In_ RTL_FEATURE_CONFIGURATION_TYPE FeatureType,
_Inout_ PULONGLONG ChangeStamp,
_Out_ PRTL_FEATURE_CONFIGURATION FeatureConfigurations,
_Inout_ PULONG FeatureConfigurationCount
_In_ RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType,
_Out_opt_ PRTL_FEATURE_CHANGE_STAMP ChangeStamp,
_Out_writes_(*ConfigurationCount) PRTL_FEATURE_CONFIGURATION Configurations,
_Inout_ PSIZE_T ConfigurationCount
);
// rev
// private
NTSYSAPI
ULONGLONG
RTL_FEATURE_CHANGE_STAMP
NTAPI
RtlQueryFeatureConfigurationChangeStamp(
VOID
);
// rev
// private
NTSYSAPI
NTSTATUS
NTAPI
RtlQueryFeatureUsageNotificationSubscriptions(
_Out_ PRTL_FEATURE_CONFIGURATION FeatureConfiguration,
_Inout_ PULONG FeatureConfigurationCount
_Out_writes_(*SubscriptionCount) PRTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS Subscriptions,
_Inout_ PSIZE_T SubscriptionCount
);
_Function_class_(RTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION)
typedef VOID (NTAPI RTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION)(
_In_opt_ PVOID Context
);
typedef RTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION *PRTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION;
// rev
// private
NTSYSAPI
NTSTATUS
NTAPI
RtlRegisterFeatureConfigurationChangeNotification(
_In_ PRTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION Callback,
_In_ PRTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK Callback,
_In_opt_ PVOID Context,
_Inout_opt_ PULONGLONG ChangeStamp,
_Out_ PHANDLE NotificationHandle
_In_opt_ PRTL_FEATURE_CHANGE_STAMP ObservedChangeStamp,
_Out_ PRTL_FEATURE_CONFIGURATION_CHANGE_REGISTRATION RegistrationHandle
);
// rev
// private
NTSYSAPI
NTSTATUS
NTAPI
RtlUnregisterFeatureConfigurationChangeNotification(
_In_ HANDLE NotificationHandle
_In_ RTL_FEATURE_CONFIGURATION_CHANGE_REGISTRATION RegistrationHandle
);
// rev
// private
NTSYSAPI
NTSTATUS
NTAPI
RtlSubscribeForFeatureUsageNotification(
_In_ PRTL_FEATURE_CONFIGURATION FeatureConfiguration,
_In_ ULONG FeatureConfigurationCount
_In_reads_(SubscriptionCount) PRTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS SubscriptionDetails,
_In_ SIZE_T SubscriptionCount
);
// rev
// private
NTSYSAPI
NTSTATUS
NTAPI
RtlUnsubscribeFromFeatureUsageNotifications(
_In_ PRTL_FEATURE_CONFIGURATION FeatureConfiguration,
_In_ ULONG FeatureConfigurationCount
_In_reads_(SubscriptionCount) PRTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS SubscriptionDetails,
_In_ SIZE_T SubscriptionCount
);
#endif
// private
#if (PHNT_VERSION >= PHNT_WIN11)
NTSYSAPI
NTSTATUS
NTAPI
RtlOverwriteFeatureConfigurationBuffer(
_In_opt_ PRTL_FEATURE_CHANGE_STAMP PreviousChangeStamp,
_In_ RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType,
_In_reads_bytes_opt_(ConfigurationBufferSize) PVOID ConfigurationBuffer,
_In_ ULONG ConfigurationBufferSize
);
#endif
@@ -10036,6 +10410,13 @@ RtlUnsubscribeWnfStateChangeNotification(
_In_ PWNF_USER_CALLBACK Callback
);
NTSYSAPI
NTSTATUS
NTAPI
RtlWnfDllUnloadCallback(
_In_ PVOID DllBase
);
#endif
#if (PHNT_VERSION >= PHNT_WIN11)
@@ -10055,9 +10436,11 @@ NtCopyFileChunk(
_In_opt_ PULONG DestKey,
_In_ ULONG Flags
);
#endif
#define COPY_FILE_CHUNK_DUPLICATE_EXTENTS 0x00000001L // 24H2
#define VALID_COPY_FILE_CHUNK_FLAGS (COPY_FILE_CHUNK_DUPLICATE_EXTENTS)
#if (PHNT_VERSION >= PHNT_WIN11)
// rev
NTSYSAPI
ntseapi.h
+53
View File
@@ -103,8 +103,61 @@ typedef enum _TOKEN_INFORMATION_CLASS
TokenIsLessPrivilegedAppContainer, // q: ULONG // since REDSTONE5
TokenIsSandboxed, // q: ULONG // since 19H1
TokenIsAppSilo, // q: ULONG // since WIN11 22H2 // previously TokenOriginatingProcessTrustLevel // q: TOKEN_PROCESS_TRUST_LEVEL
TokenLoggingInformation, // TOKEN_LOGGING_INFORMATION // since 24H2
MaxTokenInfoClass
} TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;
#else
#define TOKEN_INFORMATION_CLASS ULONG
//#define TokenUser 1 // q: TOKEN_USER, SE_TOKEN_USER
//#define TokenGroups 2 // q: TOKEN_GROUPS
//#define TokenPrivileges 3 // q: TOKEN_PRIVILEGES
//#define TokenOwner 4 // q; s: TOKEN_OWNER
#define TokenPrimaryGroup 5 // q; s: TOKEN_PRIMARY_GROUP
#define TokenDefaultDacl 6 // q; s: TOKEN_DEFAULT_DACL
#define TokenSource 7 // q: TOKEN_SOURCE
//#define TokenType 8 // q: TOKEN_TYPE
#define TokenImpersonationLevel 9 // q: SECURITY_IMPERSONATION_LEVEL
#define TokenStatistics 10 // q: TOKEN_STATISTICS // 10
#define TokenRestrictedSids 11 // q: TOKEN_GROUPS
#define TokenSessionId 12 // q; s: ULONG (requires SeTcbPrivilege)
#define TokenGroupsAndPrivileges 13 // q: TOKEN_GROUPS_AND_PRIVILEGES
#define TokenSessionReference 14 // s: ULONG (requires SeTcbPrivilege)
#define TokenSandBoxInert 15 // q: ULONG
#define TokenAuditPolicy 16 // q; s: TOKEN_AUDIT_POLICY (requires SeSecurityPrivilege/SeTcbPrivilege)
#define TokenOrigin 17 // q; s: TOKEN_ORIGIN (requires SeTcbPrivilege)
#define TokenElevationType 18 // q: TOKEN_ELEVATION_TYPE
#define TokenLinkedToken 19 // q; s: TOKEN_LINKED_TOKEN (requires SeCreateTokenPrivilege)
#define TokenElevation 20 // q: TOKEN_ELEVATION // 20
#define TokenHasRestrictions 21 // q: ULONG
#define TokenAccessInformation 22 // q: TOKEN_ACCESS_INFORMATION
#define TokenVirtualizationAllowed 23 // q; s: ULONG (requires SeCreateTokenPrivilege)
#define TokenVirtualizationEnabled 24 // q; s: ULONG
#define TokenIntegrityLevel 25 // q; s: TOKEN_MANDATORY_LABEL
#define TokenUIAccess 26 // q; s: ULONG (requires SeTcbPrivilege)
#define TokenMandatoryPolicy 27 // q; s: TOKEN_MANDATORY_POLICY (requires SeTcbPrivilege)
#define TokenLogonSid 28 // q: TOKEN_GROUPS
#define TokenIsAppContainer 29 // q: ULONG // since WIN8
#define TokenCapabilities 30 // q: TOKEN_GROUPS // 30
//#define TokenAppContainerSid 31 // q: TOKEN_APPCONTAINER_INFORMATION
#define TokenAppContainerNumber 32 // q: ULONG
#define TokenUserClaimAttributes 33 // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION
#define TokenDeviceClaimAttributes 34 // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION
#define TokenRestrictedUserClaimAttributes 35 // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION
#define TokenRestrictedDeviceClaimAttributes 36 // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION
#define TokenDeviceGroups 37 // q: TOKEN_GROUPS
#define TokenRestrictedDeviceGroups 38 // q: TOKEN_GROUPS
#define TokenSecurityAttributes 39 // q; s: TOKEN_SECURITY_ATTRIBUTES_[AND_OPERATION_]INFORMATION (requires SeTcbPrivilege)
#define TokenIsRestricted 40 // q: ULONG // 40
#define TokenProcessTrustLevel 41 // q: TOKEN_PROCESS_TRUST_LEVEL // since WINBLUE
#define TokenPrivateNameSpace 42// q; s: ULONG (requires SeTcbPrivilege) // since THRESHOLD
#define TokenSingletonAttributes 43 // q: TOKEN_SECURITY_ATTRIBUTES_INFORMATION // since REDSTONE
#define TokenBnoIsolation 44 // q: TOKEN_BNO_ISOLATION_INFORMATION // since REDSTONE2
#define TokenChildProcessFlags 45 // s: ULONG (requires SeTcbPrivilege) // since REDSTONE3
#define TokenIsLessPrivilegedAppContainer 46 // q: ULONG // since REDSTONE5
#define TokenIsSandboxed 47 // q: ULONG // since 19H1
#define TokenIsAppSilo 48 // q: ULONG // since 22H2 // previously TokenOriginatingProcessTrustLevel // q: TOKEN_PROCESS_TRUST_LEVEL
#define TokenLoggingInformation 49 // TOKEN_LOGGING_INFORMATION // since 24H2
#define MaxTokenInfoClass 50
#endif
// Types
ntwmi.h
+16 -27
View File
@@ -11,9 +11,24 @@ EXTERN_C_START
#ifndef _TRACEHANDLE_DEFINED
#define _TRACEHANDLE_DEFINED
// Obsolete - prefer PROCESSTRACE_HANDLE or CONTROLTRACE_ID.
typedef ULONG64 TRACEHANDLE, *PTRACEHANDLE;
#endif
// Used to read the events from a trace file or real-time trace session (via
// ProcessTrace). The handle is invalid if it contains the value
// INVALID_PROCESSTRACE_HANDLE. Obtain the handle by calling an OpenTrace
// function (e.g. OpenTrace, OpenTraceFromFile, OpenTraceFromRealTimeLogger).
// Close the handle by calling CloseTrace.
typedef ULONG64 PROCESSTRACE_HANDLE;
// Used to identify a trace collection session. The id is invalid if it
// contains the value (CONTROLTRACE_ID)0. Obtain the id from StartTrace or from
// the Wnode.HistoricalContext field of the EVENT_TRACE_PROPERTIES returned by
// ControlTrace(0, sessionName, ...). The id is valid until the trace stops and
// does not need to be closed by the user.
typedef ULONG64 CONTROLTRACE_ID;
//
// Maximum supported buffer size in KB - Win8 (16MB)
//
@@ -2832,7 +2847,7 @@ typedef struct _HEAP_SUBSEGMENT_INIT
#include <poppack.h>
#include <pshpack1.h>
typedef struct _HEAP_AFINITY_MANAGER_ENABLE
typedef struct _HEAP_AFFINITY_MANAGER_ENABLE
{
SYSTEM_TRACE_HEADER Header;
PVOID HeapHandle;
@@ -5433,32 +5448,6 @@ typedef struct _ETW_UMGL_KEY
#define MEMORY_FROM_INVALID 5
#define MEMORY_FROM_SEGMENT_HEAP 6 //Activity from segment heap.
//
// Header preparation macro for UMGL
//
#define TRACE_HEADER_TYPE_SYSTEM32 1
#define TRACE_HEADER_TYPE_SYSTEM64 2
#define TRACE_HEADER_TYPE_COMPACT32 3
#define TRACE_HEADER_TYPE_COMPACT64 4
#define TRACE_HEADER_TYPE_FULL_HEADER32 10
#define TRACE_HEADER_TYPE_INSTANCE32 11
#define TRACE_HEADER_TYPE_TIMED 12 // Not used
#define TRACE_HEADER_TYPE_ERROR 13 // Error while logging event
#define TRACE_HEADER_TYPE_WNODE_HEADER 14 // Not used
#define TRACE_HEADER_TYPE_MESSAGE 15
#define TRACE_HEADER_TYPE_PERFINFO32 16
#define TRACE_HEADER_TYPE_PERFINFO64 17
#define TRACE_HEADER_TYPE_EVENT_HEADER32 18
#define TRACE_HEADER_TYPE_EVENT_HEADER64 19
#define TRACE_HEADER_TYPE_FULL_HEADER64 20
#define TRACE_HEADER_TYPE_INSTANCE64 21
#define EVENT_HEADER_SIZE_MASK 0x0000FFFF
#define SYSTEM_TRACE_VERSION 2
#define TRACE_HEADER_FLAG 0x80000000
#define EVENT_HEADER_EVENT64 ((USHORT)(((TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE) >> 16) | TRACE_HEADER_TYPE_EVENT_HEADER64))
#define EVENT_HEADER_EVENT32 ((USHORT)(((TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE) >> 16) | TRACE_HEADER_TYPE_EVENT_HEADER32))
#define EVENT_HEADER_ERROR ((USHORT)(((TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE) >> 16) | TRACE_HEADER_TYPE_ERROR))
ntzwapi.h
+1 -1
View File
@@ -2284,7 +2284,7 @@ ZwMapViewOfSectionEx(
_Inout_opt_ PLARGE_INTEGER SectionOffset,
_Inout_ PSIZE_T ViewSize,
_In_ ULONG AllocationType,
_In_ ULONG Win32Protect,
_In_ ULONG PageProtection,
_Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters,
_In_ ULONG ExtendedParameterCount
);
phnt_ntdef.h
+12 -1
View File
@@ -111,7 +111,9 @@ typedef enum _WAIT_TYPE
{
WaitAll,
WaitAny,
WaitNotification
WaitNotification,
WaitDequeue,
WaitDpc,
} WAIT_TYPE;
// Strings
@@ -243,6 +245,15 @@ typedef const OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;
(p)->SecurityQualityOfService = NULL; \
}
#define InitializeObjectAttributesEx(p, n, a, r, s, q) { \
(p)->Length = sizeof(OBJECT_ATTRIBUTES); \
(p)->RootDirectory = r; \
(p)->Attributes = a; \
(p)->ObjectName = n; \
(p)->SecurityDescriptor = s; \
(p)->SecurityQualityOfService = q; \
}
#define RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a) { sizeof(OBJECT_ATTRIBUTES), NULL, n, a, NULL, NULL }
#define RTL_INIT_OBJECT_ATTRIBUTES(n, a) RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a)
phnt_windows.h
+9
View File
@@ -55,6 +55,10 @@
#define WIN32_NO_STATUS
#endif
#ifndef COM_NO_WINDOWS_H
#define COM_NO_WINDOWS_H
#endif
#ifndef __cplusplus
// This is needed to workaround C17 preprocessor errors when using legacy versions of the Windows SDK. (dmex)
#ifndef MICROSOFT_WINDOWS_WINBASE_H_DEFINE_INTERLOCKED_CPLUSPLUS_OVERLOADS
@@ -67,6 +71,11 @@
#undef WIN32_NO_STATUS
#include <ntstatus.h>
#include <winioctl.h>
#include <evntrace.h>
#ifdef COM_NO_WINDOWS_H
#include <ole2.h>
#endif
typedef double DOUBLE;
typedef GUID *PGUID;