From df94006275bb26ed739785556c1200496b78b1a2 Mon Sep 17 00:00:00 2001 From: Johnny Shaw Date: Tue, 6 Aug 2024 15:04:55 -0600 Subject: [PATCH] Sync latest --- ntexapi.h | 202 ++++++++++++++------ ntimage.h | 5 + ntioapi.h | 291 +++++++++++++++++++++++++++-- ntkeapi.h | 1 + ntldr.h | 2 - ntmmapi.h | 11 +- ntobapi.h | 2 +- ntpoapi.h | 139 +++++++++++++- ntpsapi.h | 121 ++++++++++-- ntrtl.h | 495 +++++++++++++++++++++++++++++++++++++++++++------ ntseapi.h | 53 ++++++ ntwmi.h | 43 ++--- ntzwapi.h | 2 +- phnt_ntdef.h | 13 +- phnt_windows.h | 9 + 15 files changed, 1204 insertions(+), 185 deletions(-) diff --git a/ntexapi.h b/ntexapi.h index 2ba17d5..29b78fd 100644 --- a/ntexapi.h +++ b/ntexapi.h @@ -721,6 +721,7 @@ NTSTATUS NTAPI NtCreateIRTimer( _Out_ PHANDLE TimerHandle, + _In_ PVOID Reserved, _In_ ACCESS_MASK DesiredAccess ); @@ -1559,9 +1560,9 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemFlags2Information, // q: SYSTEM_FLAGS_INFORMATION SystemSecurityModelInformation, // SYSTEM_SECURITY_MODEL_INFORMATION // since 19H1 SystemCodeIntegritySyntheticCacheInformation, - SystemFeatureConfigurationInformation, // SYSTEM_FEATURE_CONFIGURATION_INFORMATION // since 20H1 // 210 - SystemFeatureConfigurationSectionInformation, // SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION - SystemFeatureUsageSubscriptionInformation, // SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS + SystemFeatureConfigurationInformation, // q: in: SYSTEM_FEATURE_CONFIGURATION_QUERY, out: SYSTEM_FEATURE_CONFIGURATION_INFORMATION; s: SYSTEM_FEATURE_CONFIGURATION_UPDATE // NtQuerySystemInformationEx // since 20H1 // 210 + SystemFeatureConfigurationSectionInformation, // q: in: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST, out: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION // NtQuerySystemInformationEx + SystemFeatureUsageSubscriptionInformation, // q: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS; s: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE SystemSecureSpeculationControlInformation, // SECURE_SPECULATION_CONTROL_INFORMATION SystemSpacesBootInformation, // since 20H2 SystemFwRamdiskInformation, // SYSTEM_FIRMWARE_RAMDISK_INFORMATION @@ -1588,14 +1589,14 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemPointerAuthInformation, // SYSTEM_POINTER_AUTH_INFORMATION SystemSecureKernelDebuggerInformation, SystemOriginalImageFeatureInformation, // q: in: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT, out: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT // NtQuerySystemInformationEx - SystemMemoryNumaInformation, - SystemMemoryNumaPerformanceInformation, // SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT // since 24H2 // 240 + SystemMemoryNumaInformation, // SYSTEM_MEMORY_NUMA_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT + SystemMemoryNumaPerformanceInformation, // SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUTSYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT // since 24H2 // 240 SystemCodeIntegritySignedPoliciesFullInformation, SystemSecureSecretsInformation, SystemTrustedAppsRuntimeInformation, // SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION SystemBadPageInformationEx, // SYSTEM_BAD_PAGE_INFORMATION - SystemResourceDeadlockTimeout, - SystemBreakOnContextUnwindFailureInformation, + SystemResourceDeadlockTimeout, // ULONG + SystemBreakOnContextUnwindFailureInformation, // ULONG (requires SeDebugPrivilege) SystemOslRamdiskInformation, // SYSTEM_OSL_RAMDISK_INFORMATION MaxSystemInfoClass } SYSTEM_INFORMATION_CLASS; @@ -3128,8 +3129,6 @@ typedef struct _SM_REGISTRATION_REQUEST SM_REGISTRATION_INFO RegInfo; } SM_REGISTRATION_REQUEST, *PSM_REGISTRATION_REQUEST; -typedef struct _RTL_BITMAP *PRTL_BITMAP; - #define SYSTEM_STORE_RESIZE_INFORMATION_VERSION 6 typedef struct _SM_STORE_RESIZE_REQUEST @@ -4158,10 +4157,18 @@ typedef struct _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION PVOID Image; } SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION, *PSYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION; +// rev +typedef struct _SYSTEM_HYPERVISOR_USER_SHARED_DATA +{ + ULONGLONG TimeUpdateLock; // QpcSystemTimeIncrement? + volatile ULONGLONG QpcMultiplier; + volatile ULONGLONG QpcBias; // HvlGetQpcBias +} SYSTEM_HYPERVISOR_USER_SHARED_DATA, *PSYSTEM_HYPERVISOR_USER_SHARED_DATA; + // private typedef struct _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION { - PVOID HypervisorSharedUserVa; + PSYSTEM_HYPERVISOR_USER_SHARED_DATA HypervisorSharedUserVa; } SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION, *PSYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION; // private @@ -4270,45 +4277,6 @@ typedef struct _SYSTEM_SECURITY_MODEL_INFORMATION }; } SYSTEM_SECURITY_MODEL_INFORMATION, *PSYSTEM_SECURITY_MODEL_INFORMATION; -typedef struct _RTL_FEATURE_CONFIGURATION *PRTL_FEATURE_CONFIGURATION; // from ntrtl.h - -// private -typedef struct _SYSTEM_FEATURE_CONFIGURATION_INFORMATION -{ - ULONGLONG ChangeStamp; - PRTL_FEATURE_CONFIGURATION Configuration; -} SYSTEM_FEATURE_CONFIGURATION_INFORMATION, *PSYSTEM_FEATURE_CONFIGURATION_INFORMATION; - -// private -typedef struct _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY -{ - ULONGLONG ChangeStamp; - PVOID Section; - ULONGLONG Size; -} SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY, *PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY; - -// private -typedef struct _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION -{ - ULONGLONG OverallChangeStamp; - SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY Descriptors[3]; -} SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION, *PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION; - -// private -typedef struct _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET -{ - ULONG Data[2]; -} RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET, *PRTL_FEATURE_USAGE_SUBSCRIPTION_TARGET; - -// private -typedef struct _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS -{ - ULONG FeatureId; - USHORT ReportingKind; - USHORT ReportingOptions; - RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET ReportingTarget; -} SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS, *PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS; - // private typedef union _SECURE_SPECULATION_CONTROL_INFORMATION { @@ -4514,6 +4482,82 @@ typedef struct _SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT BOOLEAN FeatureIsEnabled; } SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT, *PSYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT; +// private +typedef struct _SYSTEM_MEMORY_NUMA_INFORMATION_INPUT +{ + ULONG Version; + ULONG TargetNodeNumber; + ULONG Flags; +} SYSTEM_MEMORY_NUMA_INFORMATION_INPUT, *PSYSTEM_MEMORY_NUMA_INFORMATION_INPUT; + +// private +typedef struct _SYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT +{ + ULONG Version; + ULONG Size; + ULONG InitiatorNode; + union + { + ULONG Flags; + struct + { + ULONG IsAttached : 1; + ULONG Reserved : 31; + }; + }; +} SYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT, *PSYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT; + +// private +typedef enum _SYSTEM_MEMORY_NUMA_PERFORMANCE_QUERY_DATA_TYPES +{ + SystemMemoryNumaPerformanceQuery_ReadLatency, + SystemMemoryNumaPerformanceQuery_ReadBandwidth, + SystemMemoryNumaPerformanceQuery_WriteLatency, + SystemMemoryNumaPerformanceQuery_WriteBandwidth, + SystemMemoryNumaPerformanceQuery_Latency, + SystemMemoryNumaPerformanceQuery_Bandwidth, + SystemMemoryNumaPerformanceQuery_AllDataTypes, + SystemMemoryNumaPerformanceQuery_MaxDataType +} SYSTEM_MEMORY_NUMA_PERFORMANCE_QUERY_DATA_TYPES; + +// private +typedef struct _SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT +{ + ULONG Version; + ULONG TargetNodeNumber; + SYSTEM_MEMORY_NUMA_PERFORMANCE_QUERY_DATA_TYPES QueryDataType; + ULONG Flags; +} SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT, *PSYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT; + +// private +typedef struct _SYSTEM_MEMORY_NUMA_PERFORMANCE_ENTRY +{ + ULONG InitiatorNodeNumber; + ULONG TargetNodeNumber; + SYSTEM_MEMORY_NUMA_PERFORMANCE_QUERY_DATA_TYPES DataType; + union + { + BOOLEAN Flags; + struct + { + BOOLEAN MinTransferSizeToAchieveValues : 1; + BOOLEAN NonSequentialTransfers : 1; + BOOLEAN Reserved : 6; + }; + }; + ULONG_PTR MinTransferSizeInBytes; + ULONG_PTR EntryValue; +} SYSTEM_MEMORY_NUMA_PERFORMANCE_ENTRY, *PSYSTEM_MEMORY_NUMA_PERFORMANCE_ENTRY; + +// private +typedef struct _SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT +{ + ULONG Version; + ULONG Size; + ULONG EntryCount; + SYSTEM_MEMORY_NUMA_PERFORMANCE_ENTRY PerformanceEntries[1]; +} SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT, *PSYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT; + // private typedef struct _SYSTEM_OSL_RAMDISK_ENTRY { @@ -4522,6 +4566,21 @@ typedef struct _SYSTEM_OSL_RAMDISK_ENTRY SIZE_T Size; } SYSTEM_OSL_RAMDISK_ENTRY, *PSYSTEM_OSL_RAMDISK_ENTRY; +// private +typedef struct _SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION +{ + union + { + ULONGLONG Flags; + struct + { + ULONGLONG Supported : 1; + ULONGLONG Spare : 63; + }; + }; + PVOID RemoteBreakingRoutine; +} SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION, *PSYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION; + // private typedef struct _SYSTEM_OSL_RAMDISK_INFORMATION { @@ -4976,6 +5035,7 @@ typedef struct _KUSER_SHARED_DATA // ULONG TimeZoneId; + ULONG LargePageMinimum; // @@ -5149,7 +5209,10 @@ typedef struct _KUSER_SHARED_DATA // // Number of physical pages in the system. This can dynamically change as - // physical memory can be added or removed from a running system. + // physical memory can be added or removed from a running system. This + // cell is too small to hold the non-truncated value on very large memory + // machines so code that needs the full value should access + // FullNumberOfPhysicalPages instead. // ULONG NumberOfPhysicalPages; @@ -5221,7 +5284,9 @@ typedef struct _KUSER_SHARED_DATA ULONG DbgMultiSessionSku : 1; ULONG DbgMultiUsersInSessionSku : 1; ULONG DbgStateSeparationEnabled : 1; - ULONG SpareBits : 21; + ULONG DbgSplitTokenEnabled : 1; + ULONG DbgShadowAdminEnabled : 1; + ULONG SpareBits : 19; } DUMMYSTRUCTNAME2; } DUMMYUNIONNAME2; @@ -5235,6 +5300,7 @@ typedef struct _KUSER_SHARED_DATA // ULONGLONG TestRetInstruction; + LONGLONG QpcFrequency; // @@ -5251,7 +5317,9 @@ typedef struct _KUSER_SHARED_DATA ULONG Reserved2; // - // + // Full 64 bit version of the number of physical pages in the system. + // This can dynamically change as physical memory can be added or removed + // from a running system. // ULONGLONG FullNumberOfPhysicalPages; @@ -5423,18 +5491,18 @@ typedef struct _KUSER_SHARED_DATA struct { // - // A boolean indicating whether performance counter queries - // can read the counter directly (bypassing the system call). + // A bitfield indicating whether performance counter queries can + // read the counter directly (bypassing the system call) and flags. // volatile UCHAR QpcBypassEnabled; // - // Shift applied to the raw counter value to derive the - // QPC count. + // Reserved, leave as zero for backward compatibility. Was shift + // applied to the raw counter value to derive QPC count. // - UCHAR QpcShift; + UCHAR QpcReserved; }; }; @@ -5442,7 +5510,7 @@ typedef struct _KUSER_SHARED_DATA LARGE_INTEGER TimeZoneBiasEffectiveEnd; // - // Extended processor state configuration + // Extended processor state configuration (AMD64 and x86). // XSTATE_CONFIGURATION XState; @@ -5452,7 +5520,16 @@ typedef struct _KUSER_SHARED_DATA ULONG64 UserPointerAuthMask; - ULONG InternsReserved[210]; + // + // Extended processor state configuration (ARM64). The reserved space for + // other architectures is not available for reuse. + // + +#if defined(_ARM64_) + XSTATE_CONFIGURATION XStateArm64; +#else + ULONG Reserved10[210]; +#endif } KUSER_SHARED_DATA, *PKUSER_SHARED_DATA; C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountLowDeprecated) == 0x0); @@ -5532,7 +5609,7 @@ C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveGroupCount) == 0x3c4); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved9) == 0x3c5); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcData) == 0x3c6); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcBypassEnabled) == 0x3c6); -C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcShift) == 0x3c7); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, QpcReserved) == 0x3c7); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBiasEffectiveStart) == 0x3c8); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBiasEffectiveEnd) == 0x3d0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, XState) == 0x3d8); @@ -5545,6 +5622,11 @@ C_ASSERT(sizeof(KUSER_SHARED_DATA) == 0x728); #else C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, FeatureConfigurationChangeStamp) == 0x720); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, UserPointerAuthMask) == 0x730); +#if defined(_ARM64_) +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, XStateArm64) == 0x738); +#else +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved10) == 0x738); +#endif #if !defined(WINDOWS_IGNORE_PACKING_MISMATCH) C_ASSERT(sizeof(KUSER_SHARED_DATA) == 0xa80); #endif diff --git a/ntimage.h b/ntimage.h index 8007a99..ae21f05 100644 --- a/ntimage.h +++ b/ntimage.h @@ -208,4 +208,9 @@ typedef struct _IMAGE_BDD_DYNAMIC_RELOCATION { #define IMAGE_FUNCTION_OVERRIDE_ARM64_THUNK 3 #endif +#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE) +#define IMAGE_DLLCHARACTERISTICS_EX_FORWARD_CFI_COMPAT 0x40 +#define IMAGE_DLLCHARACTERISTICS_EX_HOTPATCH_COMPATIBLE 0x80 +#endif + #endif diff --git a/ntioapi.h b/ntioapi.h index 1cee2c2..23be64c 100644 --- a/ntioapi.h +++ b/ntioapi.h @@ -300,10 +300,10 @@ typedef enum _FILE_INFORMATION_CLASS FileCaseSensitiveInformationForceAccessCheck, // q; s: FILE_CASE_SENSITIVE_INFORMATION FileKnownFolderInformation, // q; s: FILE_KNOWN_FOLDER_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) // since WIN11 FileStatBasicInformation, // since 23H2 - FileId64ExtdDirectoryInformation, - FileId64ExtdBothDirectoryInformation, - FileIdAllExtdDirectoryInformation, - FileIdAllExtdBothDirectoryInformation, + FileId64ExtdDirectoryInformation, // FILE_ID_64_EXTD_DIR_INFORMATION + FileId64ExtdBothDirectoryInformation, // FILE_ID_64_EXTD_BOTH_DIR_INFORMATION + FileIdAllExtdDirectoryInformation, // FILE_ID_ALL_EXTD_DIR_INFORMATION + FileIdAllExtdBothDirectoryInformation, // FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION FileStreamReservationInformation, // FILE_STREAM_RESERVATION_INFORMATION // since 24H2 FileMupProviderInfo, // MUP_PROVIDER_INFORMATION FileMaximumInformation @@ -845,6 +845,13 @@ typedef struct _FILE_ID_EXTD_DIR_INFORMATION _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_ID_EXTD_DIR_INFORMATION, *PFILE_ID_EXTD_DIR_INFORMATION; +#define FileIdExtdDirectoryInformationDefinition { \ + FileIdExtdDirectoryInformation, \ + FIELD_OFFSET(FILE_ID_EXTD_DIR_INFORMATION, NextEntryOffset), \ + FIELD_OFFSET(FILE_ID_EXTD_DIR_INFORMATION, FileName), \ + FIELD_OFFSET(FILE_ID_EXTD_DIR_INFORMATION, FileNameLength) \ +} + typedef struct _FILE_LINK_ENTRY_FULL_ID_INFORMATION { ULONG NextEntryOffset; @@ -880,6 +887,119 @@ typedef struct _FILE_ID_EXTD_BOTH_DIR_INFORMATION _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_ID_EXTD_BOTH_DIR_INFORMATION, *PFILE_ID_EXTD_BOTH_DIR_INFORMATION; +#define FileIdExtdBothDirectoryInformationDefinition { \ + FileIdExtdBothDirectoryInformation, \ + FIELD_OFFSET(FILE_ID_EXTD_BOTH_DIR_INFORMATION, NextEntryOffset), \ + FIELD_OFFSET(FILE_ID_EXTD_BOTH_DIR_INFORMATION, FileName), \ + FIELD_OFFSET(FILE_ID_EXTD_BOTH_DIR_INFORMATION, FileNameLength) \ +} + +typedef struct _FILE_ID_64_EXTD_DIR_INFORMATION +{ + ULONG NextEntryOffset; + ULONG FileIndex; + LARGE_INTEGER CreationTime; + LARGE_INTEGER LastAccessTime; + LARGE_INTEGER LastWriteTime; + LARGE_INTEGER ChangeTime; + LARGE_INTEGER EndOfFile; + LARGE_INTEGER AllocationSize; + ULONG FileAttributes; + ULONG FileNameLength; + ULONG EaSize; + ULONG ReparsePointTag; + LARGE_INTEGER FileId; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; +} FILE_ID_64_EXTD_DIR_INFORMATION, *PFILE_ID_64_EXTD_DIR_INFORMATION; + +#define FileId64ExtdDirectoryInformationDefinition { \ + FileId64ExtdDirectoryInformation, \ + FIELD_OFFSET(FILE_ID_64_EXTD_DIR_INFORMATION, NextEntryOffset), \ + FIELD_OFFSET(FILE_ID_64_EXTD_DIR_INFORMATION, FileName), \ + FIELD_OFFSET(FILE_ID_64_EXTD_DIR_INFORMATION, FileNameLength) \ +} + +typedef struct _FILE_ID_64_EXTD_BOTH_DIR_INFORMATION +{ + ULONG NextEntryOffset; + ULONG FileIndex; + LARGE_INTEGER CreationTime; + LARGE_INTEGER LastAccessTime; + LARGE_INTEGER LastWriteTime; + LARGE_INTEGER ChangeTime; + LARGE_INTEGER EndOfFile; + LARGE_INTEGER AllocationSize; + ULONG FileAttributes; + ULONG FileNameLength; + ULONG EaSize; + ULONG ReparsePointTag; + LARGE_INTEGER FileId; + CCHAR ShortNameLength; + WCHAR ShortName[12]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; +} FILE_ID_64_EXTD_BOTH_DIR_INFORMATION, *PFILE_ID_64_EXTD_BOTH_DIR_INFORMATION; + +#define FileId64ExtdBothDirectoryInformationDefinition { \ + FileId64ExtdBothDirectoryInformation, \ + FIELD_OFFSET(FILE_ID_64_EXTD_BOTH_DIR_INFORMATION, NextEntryOffset), \ + FIELD_OFFSET(FILE_ID_64_EXTD_BOTH_DIR_INFORMATION, FileName), \ + FIELD_OFFSET(FILE_ID_64_EXTD_BOTH_DIR_INFORMATION, FileNameLength) \ +} + +typedef struct _FILE_ID_ALL_EXTD_DIR_INFORMATION +{ + ULONG NextEntryOffset; + ULONG FileIndex; + LARGE_INTEGER CreationTime; + LARGE_INTEGER LastAccessTime; + LARGE_INTEGER LastWriteTime; + LARGE_INTEGER ChangeTime; + LARGE_INTEGER EndOfFile; + LARGE_INTEGER AllocationSize; + ULONG FileAttributes; + ULONG FileNameLength; + ULONG EaSize; + ULONG ReparsePointTag; + LARGE_INTEGER FileId; + FILE_ID_128 FileId128; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; +} FILE_ID_ALL_EXTD_DIR_INFORMATION, *PFILE_ID_ALL_EXTD_DIR_INFORMATION; + +#define FileIdAllExtdDirectoryInformationDefinition { \ + FileIdAllExtdDirectoryInformation, \ + FIELD_OFFSET(FILE_ID_ALL_EXTD_DIR_INFORMATION, NextEntryOffset), \ + FIELD_OFFSET(FILE_ID_ALL_EXTD_DIR_INFORMATION, FileName), \ + FIELD_OFFSET(FILE_ID_ALL_EXTD_DIR_INFORMATION, FileNameLength) \ +} + +typedef struct _FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION +{ + ULONG NextEntryOffset; + ULONG FileIndex; + LARGE_INTEGER CreationTime; + LARGE_INTEGER LastAccessTime; + LARGE_INTEGER LastWriteTime; + LARGE_INTEGER ChangeTime; + LARGE_INTEGER EndOfFile; + LARGE_INTEGER AllocationSize; + ULONG FileAttributes; + ULONG FileNameLength; + ULONG EaSize; + ULONG ReparsePointTag; + LARGE_INTEGER FileId; + FILE_ID_128 FileId128; + CCHAR ShortNameLength; + WCHAR ShortName[12]; + _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; +} FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION, *PFILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION; + +#define FileIdAllExtdBothDirectoryInformationDefinition { \ + FileIdAllExtdBothDirectoryInformation, \ + FIELD_OFFSET(FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION, NextEntryOffset), \ + FIELD_OFFSET(FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION, FileName), \ + FIELD_OFFSET(FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION, FileNameLength) \ +} + #if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE) typedef struct _FILE_STAT_INFORMATION { @@ -1004,11 +1124,19 @@ typedef struct _MUP_PROVIDER_INFORMATION { ULONG Level; PVOID Buffer; - SIZE_T BufferSize; + PULONG BufferSize; } MUP_PROVIDER_INFORMATION, *PMUP_PROVIDER_INFORMATION; // NtQueryDirectoryFile types +typedef struct _FILE_INFORMATION_DEFINITION +{ + FILE_INFORMATION_CLASS Class; + ULONG NextEntryOffset; + ULONG FileNameOffset; + ULONG FileNameLengthOffset; +} FILE_INFORMATION_DEFINITION, *PFILE_INFORMATION_DEFINITION; + typedef struct _FILE_DIRECTORY_INFORMATION { ULONG NextEntryOffset; @@ -1024,6 +1152,13 @@ typedef struct _FILE_DIRECTORY_INFORMATION _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION; +#define FileDirectoryInformationDefinition { \ + FileDirectoryInformation, \ + FIELD_OFFSET(FILE_DIRECTORY_INFORMATION, NextEntryOffset), \ + FIELD_OFFSET(FILE_DIRECTORY_INFORMATION, FileName), \ + FIELD_OFFSET(FILE_DIRECTORY_INFORMATION, FileNameLength) \ +} + typedef struct _FILE_FULL_DIR_INFORMATION { ULONG NextEntryOffset; @@ -1040,6 +1175,13 @@ typedef struct _FILE_FULL_DIR_INFORMATION _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION; +#define FileFullDirectoryInformationDefinition { \ + FileFullDirectoryInformation, \ + FIELD_OFFSET(FILE_FULL_DIR_INFORMATION, NextEntryOffset), \ + FIELD_OFFSET(FILE_FULL_DIR_INFORMATION, FileName), \ + FIELD_OFFSET(FILE_FULL_DIR_INFORMATION, FileNameLength) \ +} + typedef struct _FILE_ID_FULL_DIR_INFORMATION { ULONG NextEntryOffset; @@ -1057,6 +1199,13 @@ typedef struct _FILE_ID_FULL_DIR_INFORMATION _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION; +#define FileIdFullDirectoryInformationDefinition { \ + FileIdFullDirectoryInformation, \ + FIELD_OFFSET(FILE_ID_FULL_DIR_INFORMATION, NextEntryOffset),\ + FIELD_OFFSET(FILE_ID_FULL_DIR_INFORMATION, FileName), \ + FIELD_OFFSET(FILE_ID_FULL_DIR_INFORMATION, FileNameLength) \ +} + typedef struct _FILE_BOTH_DIR_INFORMATION { ULONG NextEntryOffset; @@ -1075,6 +1224,13 @@ typedef struct _FILE_BOTH_DIR_INFORMATION _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION; +#define FileBothDirectoryInformationDefinition { \ + FileBothDirectoryInformation, \ + FIELD_OFFSET(FILE_BOTH_DIR_INFORMATION, NextEntryOffset), \ + FIELD_OFFSET(FILE_BOTH_DIR_INFORMATION, FileName), \ + FIELD_OFFSET(FILE_BOTH_DIR_INFORMATION, FileNameLength) \ +} + typedef struct _FILE_ID_BOTH_DIR_INFORMATION { ULONG NextEntryOffset; @@ -1094,6 +1250,13 @@ typedef struct _FILE_ID_BOTH_DIR_INFORMATION _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION; +#define FileIdBothDirectoryInformationDefinition { \ + FileIdBothDirectoryInformation, \ + FIELD_OFFSET(FILE_ID_BOTH_DIR_INFORMATION, NextEntryOffset),\ + FIELD_OFFSET(FILE_ID_BOTH_DIR_INFORMATION, FileName), \ + FIELD_OFFSET(FILE_ID_BOTH_DIR_INFORMATION, FileNameLength) \ +} + typedef struct _FILE_NAMES_INFORMATION { ULONG NextEntryOffset; @@ -1102,6 +1265,13 @@ typedef struct _FILE_NAMES_INFORMATION _Field_size_bytes_(FileNameLength) WCHAR FileName[1]; } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION; +#define FileNamesInformationDefinition { \ + FileNamesInformation, \ + FIELD_OFFSET(FILE_NAMES_INFORMATION, NextEntryOffset), \ + FIELD_OFFSET(FILE_NAMES_INFORMATION, FileName), \ + FIELD_OFFSET(FILE_NAMES_INFORMATION, FileNameLength) \ +} + typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION { ULONG NextEntryOffset; @@ -1124,6 +1294,13 @@ typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX 0x00000002 #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX 0x00000004 +#define FileIdGlobalTxDirectoryInformationDefinition { \ + FileIdGlobalTxDirectoryInformation, \ + FIELD_OFFSET(FILE_ID_GLOBAL_TX_DIR_INFORMATION, NextEntryOffset), \ + FIELD_OFFSET(FILE_ID_GLOBAL_TX_DIR_INFORMATION, FileName), \ + FIELD_OFFSET(FILE_ID_GLOBAL_TX_DIR_INFORMATION, FileNameLength) \ +} + typedef struct _FILE_OBJECTID_INFORMATION { LONGLONG FileReference; @@ -1439,9 +1616,55 @@ NtFlushBuffersFile( _Out_ PIO_STATUS_BLOCK IoStatusBlock ); +// Flag definitions for NtFlushBuffersFileEx +// +// If none of the below flags are specified the following will occur for a +// given file handle: +// - Write any modified data for the given file from the Windows in-memory +// cache. +// - Commit all pending metadata changes for the given file from the +// Windows in-memory cache. +// - Send a SYNC command to the underlying storage device to commit all +// written data in the devices cache to persistent storage. +// +// If a volume handle is specified: +// - Write all modified data for all files on the volume from the Windows +// in-memory cache. +// - Commit all pending metadata changes for all files on the volume from +// the Windows in-memory cache. +// - Send a SYNC command to the underlying storage device to commit all +// written data in the devices cache to persistent storage. +// +// This is equivalent to how NtFlushBuffersFile has always worked. +// + +// If set, this operation will write the data for the given file from the +// Windows in-memory cache. This will NOT commit any associated metadata +// changes. This will NOT send a SYNC to the storage device to flush its +// cache. Not supported on volume handles. +// #define FLUSH_FLAGS_FILE_DATA_ONLY 0x00000001 +// +// If set, this operation will commit both the data and metadata changes for +// the given file from the Windows in-memory cache. This will NOT send a SYNC +// to the storage device to flush its cache. Not supported on volume handles. +// #define FLUSH_FLAGS_NO_SYNC 0x00000002 +// +// If set, this operation will write the data for the given file from the +// Windows in-memory cache. It will also try to skip updating the timestamp +// as much as possible. This will send a SYNC to the storage device to flush its +// cache. Not supported on volume or directory handles. +// #define FLUSH_FLAGS_FILE_DATA_SYNC_ONLY 0x00000004 // REDSTONE1 +// +// If set, this operation will write the data for the given file from the +// Windows in-memory cache. It will also try to skip updating the timestamp +// as much as possible. This will send a SYNC to the storage device to flush its +// cache. Not supported on volume or directory handles. +// +#define FLUSH_FLAGS_FLUSH_AND_PURGE 0x00000008 // 24H2 + #if (PHNT_VERSION >= PHNT_WIN8) NTSYSCALLAPI @@ -1819,19 +2042,19 @@ typedef enum _DIRECTORY_NOTIFY_INFORMATION_CLASS { DirectoryNotifyInformation = 1, // FILE_NOTIFY_INFORMATION DirectoryNotifyExtendedInformation, // FILE_NOTIFY_EXTENDED_INFORMATION - DirectoryNotifyFullInformation, // since 22H2 + DirectoryNotifyFullInformation, // FILE_NOTIFY_FULL_INFORMATION // since 22H2 DirectoryNotifyMaximumInformation } DIRECTORY_NOTIFY_INFORMATION_CLASS, *PDIRECTORY_NOTIFY_INFORMATION_CLASS; -//typedef struct _FILE_NOTIFY_INFORMATION -//{ -// ULONG NextEntryOffset; -// ULONG Action; -// ULONG FileNameLength; -// WCHAR FileName[1]; -//} FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION; - #if !defined(NTDDI_WIN10_RS5) || (NTDDI_VERSION < NTDDI_WIN10_RS5) +typedef struct _FILE_NOTIFY_INFORMATION +{ + ULONG NextEntryOffset; + ULONG Action; + ULONG FileNameLength; + WCHAR FileName[1]; +} FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION; + typedef struct _FILE_NOTIFY_EXTENDED_INFORMATION { ULONG NextEntryOffset; @@ -3077,6 +3300,46 @@ typedef struct _OPLOCK_KEY_CONTEXT #endif +#if (PHNT_VERSION >= PHNT_WIN8) + +// pub +#define SUPPORTED_FS_FEATURES_OFFLOAD_READ 0x00000001 +#define SUPPORTED_FS_FEATURES_OFFLOAD_WRITE 0x00000002 + +#if (PHNT_VERSION >= PHNT_REDSTONE2) + +// pub +#define SUPPORTED_FS_FEATURES_QUERY_OPEN 0x00000004 + +#if (PHNT_VERSION >= PHNT_WIN11) + +// pub +#define SUPPORTED_FS_FEATURES_BYPASS_IO 0x00000008 + +// pub +#define SUPPORTED_FS_FEATURES_VALID_MASK (SUPPORTED_FS_FEATURES_OFFLOAD_READ |\ + SUPPORTED_FS_FEATURES_OFFLOAD_WRITE |\ + SUPPORTED_FS_FEATURES_QUERY_OPEN |\ + SUPPORTED_FS_FEATURES_BYPASS_IO) + +#else // (PHNT_VERSION >= PHNT_WIN11) + +// pub +#define SUPPORTED_FS_FEATURES_VALID_MASK (SUPPORTED_FS_FEATURES_OFFLOAD_READ |\ + SUPPORTED_FS_FEATURES_OFFLOAD_WRITE |\ + SUPPORTED_FS_FEATURES_QUERY_OPEN) + +#endif // (PHNT_VERSION >= PHNT_WIN11) + +#else // (PHNT_VERSION >= PHNT_REDSTONE2) + +// pub +#define SUPPORTED_FS_FEATURES_VALID_MASK (SUPPORTED_FS_FEATURES_OFFLOAD_READ |\ + SUPPORTED_FS_FEATURES_OFFLOAD_WRITE) + +#endif // (PHNT_VERSION >= PHNT_REDSTONE2) +#endif // (PHNT_VERSION >= PHNT_WIN8) + #endif // (PHNT_MODE != PHNT_MODE_KERNEL) #endif diff --git a/ntkeapi.h b/ntkeapi.h index af9c67e..9694bec 100644 --- a/ntkeapi.h +++ b/ntkeapi.h @@ -91,6 +91,7 @@ typedef enum _KWAIT_REASON WrPhysicalFault, WrIoRing, WrMdlCache, + WrRcu, MaximumWaitReason } KWAIT_REASON, *PKWAIT_REASON; diff --git a/ntldr.h b/ntldr.h index b1eddaa..2025355 100644 --- a/ntldr.h +++ b/ntldr.h @@ -669,8 +669,6 @@ NTSYSAPI PS_SYSTEM_DLL_INIT_BLOCK LdrSystemDllInitBlock; #if (PHNT_VERSION >= PHNT_VISTA) -typedef struct _ACTIVATION_CONTEXT *PACTIVATION_CONTEXT; - // private NTSYSAPI NTSTATUS diff --git a/ntmmapi.h b/ntmmapi.h index 2f19466..00659c2 100644 --- a/ntmmapi.h +++ b/ntmmapi.h @@ -650,7 +650,7 @@ NtFlushVirtualMemory( #if (PHNT_MODE != PHNT_MODE_KERNEL) typedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS { - VmPrefetchInformation, // ULONG + VmPrefetchInformation, // MEMORY_PREFETCH_INFORMATION VmPagePriorityInformation, // OFFER_PRIORITY VmCfgCallTargetInformation, // CFG_CALL_TARGET_LIST_INFORMATION // REDSTONE2 VmPageDirtyStateInformation, // REDSTONE3 @@ -679,6 +679,13 @@ typedef struct _MEMORY_RANGE_ENTRY SIZE_T NumberOfBytes; } MEMORY_RANGE_ENTRY, *PMEMORY_RANGE_ENTRY; +#define VM_PREFETCH_TO_WORKING_SET 0x1 // since 24H4 + +typedef struct _MEMORY_PREFETCH_INFORMATION +{ + ULONG Flags; +} MEMORY_PREFETCH_INFORMATION, *PMEMORY_PREFETCH_INFORMATION; + typedef struct _CFG_CALL_TARGET_LIST_INFORMATION { ULONG NumberOfEntries; @@ -804,7 +811,7 @@ NtMapViewOfSectionEx( _Inout_opt_ PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize, _In_ ULONG AllocationType, - _In_ ULONG Win32Protect, + _In_ ULONG PageProtection, _Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters, _In_ ULONG ExtendedParameterCount ); diff --git a/ntobapi.h b/ntobapi.h index b77ce30..127998c 100644 --- a/ntobapi.h +++ b/ntobapi.h @@ -233,7 +233,7 @@ NTAPI NtQuerySecurityObject( _In_ HANDLE Handle, _In_ SECURITY_INFORMATION SecurityInformation, - _Out_writes_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor, + _Out_writes_bytes_to_opt_(Length, *LengthNeeded) PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ ULONG Length, _Out_ PULONG LengthNeeded ); diff --git a/ntpoapi.h b/ntpoapi.h index daafb75..b12623e 100644 --- a/ntpoapi.h +++ b/ntpoapi.h @@ -68,7 +68,7 @@ #define ProcessorSetIdle 55 // (debug-mode boot only) #define LogicalProcessorIdling 56 // (kernel-mode only) #define UserPresence 57 // POWER_USER_PRESENCE // not implemented -#define PowerSettingNotificationName 58 +#define PowerSettingNotificationName 58 // in: ? (optional) // out: PWNF_STATE_NAME (RtlSubscribeWnfStateChangeNotification) #define GetPowerSettingValue 59 // GUID #define IdleResiliency 60 // POWER_IDLE_RESILIENCY #define SessionRITState 61 // POWER_SESSION_RIT_STATE @@ -80,14 +80,14 @@ #define PdcInvocation 67 // (kernel-mode only) #define MonitorInvocation 68 // (kernel-mode only) #define FirmwareTableInformationRegistered 69 // (kernel-mode only) -#define SetShutdownSelectedTime 70 // NULL +#define SetShutdownSelectedTime 70 // in: NULL #define SuspendResumeInvocation 71 // (kernel-mode only) #define PlmPowerRequestCreate 72 // in: COUNTED_REASON_CONTEXT, out: HANDLE -#define ScreenOff 73 // NULL (PowerMonitorOff) +#define ScreenOff 73 // in: NULL (PowerMonitorOff) #define CsDeviceNotification 74 // (kernel-mode only) #define PlatformRole 75 // POWER_PLATFORM_ROLE #define LastResumePerformance 76 // RESUME_PERFORMANCE -#define DisplayBurst 77 // NULL (PowerMonitorOn) +#define DisplayBurst 77 // in: NULL (PowerMonitorOn) #define ExitLatencySamplingPercentage 78 #define RegisterSpmPowerSettings 79 // (kernel-mode only) #define PlatformIdleStates 80 // (kernel-mode only) @@ -105,7 +105,7 @@ #define EnergyTrackerCreate 92 #define EnergyTrackerQuery 93 #define UpdateBlackBoxRecorder 94 -#define SessionAllowExternalDmaDevices 95 +#define SessionAllowExternalDmaDevices 95 // POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES #define SendSuspendResumeNotification 96 // since WIN11 #define BlackBoxRecorderDirectAccessBuffer 97 #define PowerInformationLevelMaximum 98 @@ -135,6 +135,107 @@ typedef struct _SYSTEM_HIBERFILE_INFORMATION LARGE_INTEGER Mcb[1]; } SYSTEM_HIBERFILE_INFORMATION, *PSYSTEM_HIBERFILE_INFORMATION; +//typedef enum POWER_USER_PRESENCE_TYPE +//{ +// UserNotPresent = 0, +// UserPresent = 1, +// UserUnknown = 0xff +//} POWER_USER_PRESENCE_TYPE, *PPOWER_USER_PRESENCE_TYPE; + +//typedef struct _POWER_USER_PRESENCE +//{ +// POWER_USER_PRESENCE_TYPE PowerUserPresence; +//} POWER_USER_PRESENCE, *PPOWER_USER_PRESENCE; + +//typedef struct _POWER_SESSION_CONNECT +//{ +// BOOLEAN Connected; // TRUE - connected, FALSE - disconnected +// BOOLEAN Console; // TRUE - console, FALSE - TS (not used for Connected = FALSE) +//} POWER_SESSION_CONNECT, *PPOWER_SESSION_CONNECT; + +//typedef struct _POWER_SESSION_TIMEOUTS +//{ +// ULONG InputTimeout; +// ULONG DisplayTimeout; +//} POWER_SESSION_TIMEOUTS, *PPOWER_SESSION_TIMEOUTS; + +//typedef struct _POWER_SESSION_RIT_STATE +//{ +// BOOLEAN Active; // TRUE - RIT input received, FALSE - RIT timeout +// ULONG64 LastInputTime; // last input time held for this session +//} POWER_SESSION_RIT_STATE, *PPOWER_SESSION_RIT_STATE; + +//typedef struct _POWER_SESSION_WINLOGON +//{ +// ULONG SessionId; // the Win32k session identifier +// BOOLEAN Console; // TRUE - for console session, FALSE - for remote session +// BOOLEAN Locked; // TRUE - lock, FALSE - unlock +//} POWER_SESSION_WINLOGON, *PPOWER_SESSION_WINLOGON; + +//typedef struct _POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES +//{ +// BOOLEAN IsAllowed; +//} POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES, *PPOWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES; +// +//typedef struct _POWER_IDLE_RESILIENCY +//{ +// ULONG CoalescingTimeout; +// ULONG IdleResiliencyPeriod; +//} POWER_IDLE_RESILIENCY, *PPOWER_IDLE_RESILIENCY; + +//typedef struct _RESUME_PERFORMANCE +//{ +// ULONG PostTimeMs; +// ULONGLONG TotalResumeTimeMs; +// ULONGLONG ResumeCompleteTimestamp; +//} RESUME_PERFORMANCE, *PRESUME_PERFORMANCE; + +//typedef struct _NOTIFY_USER_POWER_SETTING +//{ +// GUID Guid; +//} NOTIFY_USER_POWER_SETTING, *PNOTIFY_USER_POWER_SETTING; + +#define POWER_PERF_SCALE 100 +#define PERF_LEVEL_TO_PERCENT(_x_) ((_x_ * 1000) / (POWER_PERF_SCALE * 10)) +#define PERCENT_TO_PERF_LEVEL(_x_) ((_x_ * POWER_PERF_SCALE * 10) / 1000) +#define PO_REASON_STATE_STANDBY (PO_REASON_STATE_S1 | \ + PO_REASON_STATE_S2 | \ + PO_REASON_STATE_S3) + +#define PO_REASON_STATE_ALL (PO_REASON_STATE_STANDBY | \ + PO_REASON_STATE_S4 | \ + PO_REASON_STATE_S4FIRM) + +typedef struct _SYSTEM_POWER_LOGGING_ENTRY +{ + ULONG Reason; + ULONG States; +} SYSTEM_POWER_LOGGING_ENTRY, *PSYSTEM_POWER_LOGGING_ENTRY; + +typedef enum _POWER_STATE_DISABLED_TYPE +{ + PoDisabledStateSleeping1 = 0, + PoDisabledStateSleeping2 = 1, + PoDisabledStateSleeping3 = 2, + PoDisabledStateSleeping4 = 3, + PoDisabledStateSleeping0Idle = 4, + PoDisabledStateReserved5 = 5, + PoDisabledStateSleeping4Firmware = 6, + PoDisabledStateMaximum = 7 +} POWER_STATE_DISABLED_TYPE, PPOWER_STATE_DISABLED_TYPE; + +#define POWER_STATE_DISABLED_TYPE_MAX 8 + +_Struct_size_bytes_(sizeof(SYSTEM_POWER_STATE_DISABLE_REASON) + PowerReasonLength) +typedef struct _SYSTEM_POWER_STATE_DISABLE_REASON +{ + BOOLEAN AffectedState[POWER_STATE_DISABLED_TYPE_MAX]; + ULONG PowerReasonCode; + ULONG PowerReasonLength; + //UCHAR PowerReasonInfo[ANYSIZE_ARRAY]; +} SYSTEM_POWER_STATE_DISABLE_REASON, *PSYSTEM_POWER_STATE_DISABLE_REASON; + +// Reason Context #define POWER_REQUEST_CONTEXT_NOT_SPECIFIED DIAGNOSTIC_REASON_NOT_SPECIFIED // wdm @@ -314,6 +415,34 @@ typedef struct _PROCESSOR_IDLE_STATES KAFFINITY TargetProcessors; PROCESSOR_IDLE_STATE State[ANYSIZE_ARRAY]; } PROCESSOR_IDLE_STATES, *PPROCESSOR_IDLE_STATES; +// +//#define PROCESSOR_IDLESTATE_POLICY_COUNT 0x3 +// +//typedef struct +//{ +// ULONG TimeCheck; +// UCHAR DemotePercent; +// UCHAR PromotePercent; +// UCHAR Spare[2]; +//} PROCESSOR_IDLESTATE_INFO, *PPROCESSOR_IDLESTATE_INFO; +// +//typedef struct +//{ +// USHORT Revision; +// union +// { +// USHORT AsUSHORT; +// struct +// { +// USHORT AllowScaling : 1; +// USHORT Disabled : 1; +// USHORT Reserved : 14; +// } DUMMYSTRUCTNAME; +// } Flags; +// +// ULONG PolicyCount; +// PROCESSOR_IDLESTATE_INFO Policy[PROCESSOR_IDLESTATE_POLICY_COUNT]; +//} PROCESSOR_IDLESTATE_POLICY, *PPROCESSOR_IDLESTATE_POLICY; // rev typedef struct _PROCESSOR_LOAD diff --git a/ntpsapi.h b/ntpsapi.h index eeb2226..e5a7c0e 100644 --- a/ntpsapi.h +++ b/ntpsapi.h @@ -219,12 +219,12 @@ typedef enum _PROCESSINFOCLASS ProcessAssignCpuPartitions, ProcessPriorityClassEx, // s: PROCESS_PRIORITY_CLASS_EX ProcessMembershipInformation, // q: PROCESS_MEMBERSHIP_INFORMATION - ProcessEffectiveIoPriority, // q: IO_PRIORITY_HINT + ProcessEffectiveIoPriority, // q: IO_PRIORITY_HINT // 110 ProcessEffectivePagePriority, // q: ULONG ProcessSchedulerSharedData, // since 24H2 ProcessSlistRollbackInformation, ProcessNetworkIoCounters, // q: PROCESS_NETWORK_COUNTERS - ProcessFindFirstThreadByTebValue, + ProcessFindFirstThreadByTebValue, // PROCESS_TEB_VALUE_INFORMATION MaxProcessInfoClass } PROCESSINFOCLASS; #endif @@ -289,7 +289,7 @@ typedef enum _THREADINFOCLASS ThreadEffectiveIoPriority, // q: IO_PRIORITY_HINT ThreadEffectivePagePriority, // q: ULONG ThreadUpdateLockOwnership, // since 24H2 - ThreadSchedulerSharedDataSlot, + ThreadSchedulerSharedDataSlot, // SCHEDULER_SHARED_DATA_SLOT_INFORMATION ThreadTebInformationAtomic, // THREAD_TEB_INFORMATION ThreadIndexInformation, // THREAD_INDEX_INFORMATION MaxThreadInfoClass @@ -336,7 +336,8 @@ typedef struct _PROCESS_EXTENDED_BASIC_INFORMATION ULONG IsStronglyNamed : 1; ULONG IsSecureProcess : 1; ULONG IsSubsystemProcess : 1; - ULONG SpareBits : 23; + ULONG IsTrustedApp : 1; // since 24H2 + ULONG SpareBits : 22; }; }; } PROCESS_EXTENDED_BASIC_INFORMATION, *PPROCESS_EXTENDED_BASIC_INFORMATION; @@ -438,7 +439,15 @@ typedef struct _PROCESS_WS_WATCH_INFORMATION // psapi:PSAPI_WS_WATCH_INFORMATION_EX typedef struct _PROCESS_WS_WATCH_INFORMATION_EX { - PROCESS_WS_WATCH_INFORMATION BasicInfo; + union + { + PROCESS_WS_WATCH_INFORMATION BasicInfo; + struct + { + PVOID FaultingPc; + PVOID FaultingVa; + }; + }; ULONG_PTR FaultingThreadId; ULONG_PTR Flags; } PROCESS_WS_WATCH_INFORMATION_EX, *PPROCESS_WS_WATCH_INFORMATION_EX; @@ -683,9 +692,6 @@ typedef struct _PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY #endif #if !defined(NTDDI_WIN10_NI) || (NTDDI_VERSION < NTDDI_WIN10_NI) -#define ProcessUserPointerAuthPolicy 17 -#define ProcessSEHOPPolicy 18 - typedef struct _PROCESS_MITIGATION_USER_POINTER_AUTH_POLICY { union { ULONG Flags; @@ -707,6 +713,43 @@ typedef struct _PROCESS_MITIGATION_SEHOP_POLICY { } PROCESS_MITIGATION_SEHOP_POLICY, *PPROCESS_MITIGATION_SEHOP_POLICY; #endif +typedef struct _PROCESS_MITIGATION_ACTIVATION_CONTEXT_TRUST_POLICY2 +{ + union + { + ULONG Flags; + struct + { + ULONG AssemblyManifestRedirectionTrust : 1; + ULONG ReservedFlags : 31; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; +} PROCESS_MITIGATION_ACTIVATION_CONTEXT_TRUST_POLICY2, *PPROCESS_MITIGATION_ACTIVATION_CONTEXT_TRUST_POLICY2; + +// enum PROCESS_MITIGATION_POLICY +#define PROCESS_MITIGATION_POLICY ULONG +#define ProcessDEPPolicy 0 +#define ProcessASLRPolicy 1 +#define ProcessDynamicCodePolicy 2 +#define ProcessStrictHandleCheckPolicy 3 +#define ProcessSystemCallDisablePolicy 4 +#define ProcessMitigationOptionsMask 5 +#define ProcessExtensionPointDisablePolicy 6 +#define ProcessControlFlowGuardPolicy 7 +#define ProcessSignaturePolicy 8 +#define ProcessFontDisablePolicy 9 +#define ProcessImageLoadPolicy 10 +#define ProcessSystemCallFilterPolicy 11 +#define ProcessPayloadRestrictionPolicy 12 +#define ProcessChildProcessPolicy 13 +#define ProcessSideChannelIsolationPolicy 14 +#define ProcessUserShadowStackPolicy 15 +#define ProcessRedirectionTrustPolicy 16 +#define ProcessUserPointerAuthPolicy 17 +#define ProcessSEHOPPolicy 18 +#define ProcessActivationContextTrustPolicy 19 +#define MaxProcessMitigationPolicy 20 + typedef struct _PROCESS_MITIGATION_POLICY_INFORMATION { PROCESS_MITIGATION_POLICY Policy; @@ -1058,11 +1101,18 @@ typedef struct _PROCESS_MEMBERSHIP_INFORMATION #if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE) typedef struct _PROCESS_NETWORK_COUNTERS { - ULONG_PTR BytesIn; - ULONG_PTR BytesOut; + ULONG64 BytesIn; + ULONG64 BytesOut; } PROCESS_NETWORK_COUNTERS, *PPROCESS_NETWORK_COUNTERS; #endif +typedef struct _PROCESS_TEB_VALUE_INFORMATION +{ + ULONG ThreadId; + ULONG TebOffset; + ULONG_PTR Value; +} PROCESS_TEB_VALUE_INFORMATION, *PPROCESS_TEB_VALUE_INFORMATION; + // end_private NTSYSCALLAPI @@ -1104,6 +1154,20 @@ typedef struct _THREAD_CYCLE_TIME_INFORMATION ULONGLONG CurrentCycleCount; } THREAD_CYCLE_TIME_INFORMATION, *PTHREAD_CYCLE_TIME_INFORMATION; +typedef enum _SCHEDULER_SHARED_DATA_SLOT_ACTION +{ + SchedulerSharedSlotAssign, + SchedulerSharedSlotFree, + SchedulerSharedSlotQuery +} SCHEDULER_SHARED_DATA_SLOT_ACTION; + +typedef struct _SCHEDULER_SHARED_DATA_SLOT_INFORMATION +{ + SCHEDULER_SHARED_DATA_SLOT_ACTION Action; + PVOID SchedulerSharedDataHandle; + PVOID Slot; +} SCHEDULER_SHARED_DATA_SLOT_INFORMATION, *PSCHEDULER_SHARED_DATA_SLOT_INFORMATION; + typedef struct _THREAD_TEB_INFORMATION { PVOID TebInformation; // buffer to place data in @@ -1370,6 +1434,8 @@ NtCreateProcess( #define PROCESS_CREATE_FLAGS_AUXILIARY_PROCESS 0x00008000 // NtCreateProcessEx & NtCreateUserProcess, requires SeTcb #define PROCESS_CREATE_FLAGS_CREATE_STORE 0x00020000 // NtCreateProcessEx & NtCreateUserProcess #define PROCESS_CREATE_FLAGS_USE_PROTECTED_ENVIRONMENT 0x00040000 // NtCreateProcessEx & NtCreateUserProcess +#define PROCESS_CREATE_FLAGS_IMAGE_EXPANSION_MITIGATION_DISABLE 0x00080000 +#define PROCESS_CREATE_FLAGS_PARTITION_CREATE_SLAB_IDENTITY 0x00400000 // NtCreateProcessEx & NtCreateUserProcess, requires SeLockMemoryPrivilege // end_rev NTSYSCALLAPI @@ -1991,7 +2057,7 @@ typedef enum _PS_ATTRIBUTE_NUM PsAttributeComponentFilter, PsAttributeEnableOptionalXStateFeatures, // since WIN11 PsAttributeSupportedMachines, // since 24H2 - PsAttributeSveVectorLength, + PsAttributeSveVectorLength, // PPS_PROCESS_CREATION_SVE_VECTOR_LENGTH PsAttributeMax } PS_ATTRIBUTE_NUM; @@ -2181,6 +2247,13 @@ typedef struct _PS_BNO_ISOLATION_PARAMETERS BOOLEAN IsolationEnabled; } PS_BNO_ISOLATION_PARAMETERS, *PPS_BNO_ISOLATION_PARAMETERS; +// private +typedef union _PS_PROCESS_CREATION_SVE_VECTOR_LENGTH +{ + ULONG VectorLength : 24; + ULONG FlagsReserved : 8; +} PS_PROCESS_CREATION_SVE_VECTOR_LENGTH, *PPS_PROCESS_CREATION_SVE_VECTOR_LENGTH; + // private typedef enum _PS_MITIGATION_OPTION { @@ -2338,9 +2411,9 @@ NtCreateUserProcess( #define THREAD_CREATE_FLAGS_CREATE_SUSPENDED 0x00000001 // NtCreateUserProcess & NtCreateThreadEx #define THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH 0x00000002 // NtCreateThreadEx only #define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER 0x00000004 // NtCreateThreadEx only -#define THREAD_CREATE_FLAGS_LOADER_WORKER 0x00000010 // NtCreateThreadEx only -#define THREAD_CREATE_FLAGS_SKIP_LOADER_INIT 0x00000020 // NtCreateThreadEx only -#define THREAD_CREATE_FLAGS_BYPASS_PROCESS_FREEZE 0x00000040 // NtCreateThreadEx only +#define THREAD_CREATE_FLAGS_LOADER_WORKER 0x00000010 // NtCreateThreadEx only, since THRESHOLD +#define THREAD_CREATE_FLAGS_SKIP_LOADER_INIT 0x00000020 // NtCreateThreadEx only, since REDSTONE2 +#define THREAD_CREATE_FLAGS_BYPASS_PROCESS_FREEZE 0x00000040 // NtCreateThreadEx only, since 19H1 // end_rev #if (PHNT_VERSION >= PHNT_VISTA) @@ -2425,8 +2498,8 @@ NtCreateThreadEx( #define JobObjectThreadImpersonationInformation 47 #define JobObjectIoPriorityLimit 48 // JOBOBJECT_IO_PRIORITY_LIMIT #define JobObjectPagePriorityLimit 49 // JOBOBJECT_PAGE_PRIORITY_LIMIT -#define JobObjectServerSiloDiagnosticInformation 50 // since 24H2 -#define JobObjectNetworkAccountingInformation 51 +#define JobObjectServerSiloDiagnosticInformation 50 // SERVERSILO_DIAGNOSTIC_INFORMATION // since 24H2 +#define JobObjectNetworkAccountingInformation 51 // JOBOBJECT_NETWORK_ACCOUNTING_INFORMATION #define MaxJobObjectInfoClass 52 // rev // extended limit v2 @@ -2604,6 +2677,22 @@ typedef struct _JOBOBJECT_PAGE_PRIORITY_LIMIT ULONG Priority; } JOBOBJECT_PAGE_PRIORITY_LIMIT, *PJOBOBJECT_PAGE_PRIORITY_LIMIT; +#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE) +// private +typedef struct _SERVERSILO_DIAGNOSTIC_INFORMATION +{ + NTSTATUS ExitStatus; + WCHAR CriticalProcessName[15]; +} SERVERSILO_DIAGNOSTIC_INFORMATION, *PSERVERSILO_DIAGNOSTIC_INFORMATION; + +// private +typedef struct _JOBOBJECT_NETWORK_ACCOUNTING_INFORMATION +{ + ULONG64 DataBytesIn; + ULONG64 DataBytesOut; +} JOBOBJECT_NETWORK_ACCOUNTING_INFORMATION, *PJOBOBJECT_NETWORK_ACCOUNTING_INFORMATION; +#endif + NTSYSCALLAPI NTSTATUS NTAPI diff --git a/ntrtl.h b/ntrtl.h index b3874d8..83df7f0 100644 --- a/ntrtl.h +++ b/ntrtl.h @@ -2352,18 +2352,74 @@ RtlNextUnicodePrefix( // Compression +#define COMPRESSION_FORMAT_NONE (0x0000) +#define COMPRESSION_FORMAT_DEFAULT (0x0001) +#define COMPRESSION_FORMAT_LZNT1 (0x0002) +#define COMPRESSION_FORMAT_XPRESS (0x0003) +#define COMPRESSION_FORMAT_XPRESS_HUFF (0x0004) +#define COMPRESSION_FORMAT_XP10 (0x0005) +#define COMPRESSION_FORMAT_LZ4 (0x0006) +#define COMPRESSION_FORMAT_DEFLATE (0x0007) +#define COMPRESSION_FORMAT_ZLIB (0x0008) +#define COMPRESSION_FORMAT_MAX (0x0008) + +#define COMPRESSION_ENGINE_STANDARD (0x0000) +#define COMPRESSION_ENGINE_MAXIMUM (0x0100) +#define COMPRESSION_ENGINE_HIBER (0x0200) +#define COMPRESSION_ENGINE_MAX (0x0200) + +#define COMPRESSION_FORMAT_MASK (0x00FF) +#define COMPRESSION_ENGINE_MASK (0xFF00) +#define COMPRESSION_FORMAT_ENGINE_MASK (COMPRESSION_FORMAT_MASK | COMPRESSION_ENGINE_MASK) + typedef struct _COMPRESSED_DATA_INFO { - USHORT CompressionFormatAndEngine; // COMPRESSION_FORMAT_* and COMPRESSION_ENGINE_* + // + // Code for the compression format (and engine) as + // defined in ntrtl.h. Note that COMPRESSION_FORMAT_NONE + // and COMPRESSION_FORMAT_DEFAULT are invalid if + // any of the described chunks are compressed. + // + + USHORT CompressionFormatAndEngine; + + // + // Since chunks and compression units are expected to be + // powers of 2 in size, we express then log2. So, for + // example (1 << ChunkShift) == ChunkSizeInBytes. The + // ClusterShift indicates how much space must be saved + // to successfully compress a compression unit - each + // successfully compressed compression unit must occupy + // at least one cluster less in bytes than an uncompressed + // compression unit. + // UCHAR CompressionUnitShift; UCHAR ChunkShift; UCHAR ClusterShift; UCHAR Reserved; + // + // This is the number of entries in the CompressedChunkSizes + // array. + // + USHORT NumberOfChunks; - ULONG CompressedChunkSizes[1]; + // + // This is an array of the sizes of all chunks resident + // in the compressed data buffer. There must be one entry + // in this array for each chunk possible in the uncompressed + // buffer size. A size of FSRTL_CHUNK_SIZE indicates the + // corresponding chunk is uncompressed and occupies exactly + // that size. A size of 0 indicates that the corresponding + // chunk contains nothing but binary 0's, and occupies no + // space in the compressed data. All other sizes must be + // less than FSRTL_CHUNK_SIZE, and indicate the exact size + // of the compressed data in bytes. + // + + ULONG CompressedChunkSizes[ANYSIZE_ARRAY]; } COMPRESSED_DATA_INFO, *PCOMPRESSED_DATA_INFO; NTSYSAPI @@ -4129,6 +4185,30 @@ typedef struct _RTL_BUFFER SIZE_T StaticSize; } RTL_BUFFER, *PRTL_BUFFER; +//FORCEINLINE +//VOID +//RtlInitBuffer( +// _Inout_ PRTL_BUFFER Buffer, +// _In_ PUCHAR Data, +// _In_ ULONG DataSize +// ) +//{ +// Buffer->Buffer = Buffer->StaticBuffer = Data; +// Buffer->Size = Buffer->StaticSize = DataSize; +//} +// +//FORCEINLINE +//VOID +//RtlFreeBuffer( +// _Inout_ PRTL_BUFFER Buffer +// ) +//{ +// if (Buffer->Buffer != Buffer->StaticBuffer && Buffer->Buffer) +// RtlFreeHeap(RtlProcessHeap(), 0, Buffer->Buffer); +// Buffer->Buffer = Buffer->StaticBuffer; +// Buffer->Size = Buffer->StaticSize; +//} + // rev typedef struct _RTL_UNICODE_STRING_BUFFER { @@ -4668,7 +4748,8 @@ typedef struct _RTL_SEGMENT_HEAP_MEMORY_SOURCE #define SEGMENT_HEAP_PARAMETERS_VERSION 3 #define SEGMENT_HEAP_FLG_USE_PAGE_HEAP 0x1 -#define SEGMENT_HEAP_PARAMS_VALID_FLAGS SEGMENT_HEAP_FLG_USE_PAGE_HEAP +#define SEGMENT_HEAP_FLG_NO_LFH 0x2 +#define SEGMENT_HEAP_PARAMS_VALID_FLAGS 0x3 typedef struct _RTL_SEGMENT_HEAP_PARAMETERS { @@ -4725,6 +4806,24 @@ typedef struct _RTL_HEAP_PARAMETERS #define HEAP_CLASS_8 0x00008000 // CSR port heap #define HEAP_CLASS_MASK 0x0000f000 +#define HEAP_MAXIMUM_TAG 0x0FFF +#define HEAP_GLOBAL_TAG 0x0800 +#define HEAP_PSEUDO_TAG_FLAG 0x8000 +#define HEAP_TAG_SHIFT 18 +#define HEAP_TAG_MASK (HEAP_MAXIMUM_TAG << HEAP_TAG_SHIFT) + +#define HEAP_CREATE_SEGMENT_HEAP 0x00000100 +// +// Only applies to segment heap. Applies pointer obfuscation which is +// generally excessive and unnecessary but is necessary for certain insecure +// heaps in win32k. +// +// Specifying HEAP_CREATE_HARDENED prevents the heap from using locks as +// pointers would potentially be exposed in heap metadata lock variables. +// Callers are therefore responsible for synchronizing access to hardened heaps. +// +#define HEAP_CREATE_HARDENED 0x00000200 + _Must_inspect_result_ NTSYSAPI PVOID @@ -5550,6 +5649,36 @@ RtlConvertUlongToLuid( return tempLuid; } +FORCEINLINE +LONGLONG +NTAPI_INLINE +RtlConvertLuidToLonglong( + _In_ LUID Luid + ) +{ + LONGLONG tempLuid; + + tempLuid = Luid.LowPart; + tempLuid += ((LONGLONG)(Luid.HighPart) << 32); + + return tempLuid; +} + +FORCEINLINE +ULONGLONG +NTAPI_INLINE +RtlConvertLuidToUlonglong( + _In_ LUID Luid + ) +{ + ULARGE_INTEGER tempLi; + + tempLi.LowPart = Luid.LowPart; + tempLi.HighPart = Luid.HighPart; + + return tempLi.QuadPart; +} + NTSYSAPI VOID NTAPI @@ -5829,6 +5958,8 @@ RtlNtStatusToDosError( _In_ NTSTATUS Status ); +_When_(Status < 0, _Out_range_(>, 0)) +_When_(Status >= 0, _Out_range_(==, 0)) NTSYSAPI ULONG NTAPI @@ -7491,6 +7622,16 @@ RtlGetAce( _Outptr_ PVOID *Ace ); +#if (PHNT_VERSION >= PHNT_WIN11_24H2) +NTSYSAPI +NTSTATUS +NTAPI +RtlGetAcesBufferSize( + _In_ PACL Acl, + _Out_ PULONG AcesBufferSize + ); +#endif + NTSYSAPI BOOLEAN NTAPI @@ -9221,6 +9362,13 @@ RtlFlsGetValue( _Out_ PVOID* FlsData ); +NTSYSAPI +PVOID +WINAPI +RtlFlsGetValue2( + _In_ ULONG FlsIndex + ); + NTSYSAPI NTSTATUS NTAPI @@ -9754,25 +9902,24 @@ RtlFlushSecureMemoryCache( _In_opt_ SIZE_T MemoryLength ); -#if (PHNT_VERSION >= PHNT_20H1) - // Feature configuration -typedef struct __RTL_FEATURE_USAGE_REPORT +// private +typedef ULONG RTL_FEATURE_ID; +typedef ULONGLONG RTL_FEATURE_CHANGE_STAMP, *PRTL_FEATURE_CHANGE_STAMP; +typedef UCHAR RTL_FEATURE_VARIANT; +typedef ULONG RTL_FEATURE_VARIANT_PAYLOAD; +typedef PVOID RTL_FEATURE_CONFIGURATION_CHANGE_REGISTRATION, *PRTL_FEATURE_CONFIGURATION_CHANGE_REGISTRATION; + +// private +typedef struct _RTL_FEATURE_USAGE_REPORT { ULONG FeatureId; USHORT ReportingKind; USHORT ReportingOptions; } RTL_FEATURE_USAGE_REPORT, *PRTL_FEATURE_USAGE_REPORT; -// rev -NTSYSAPI -NTSTATUS -NTAPI -RtlNotifyFeatureUsage( - _In_ PRTL_FEATURE_USAGE_REPORT FeatureUsageReport - ); - +// private typedef enum _RTL_FEATURE_CONFIGURATION_TYPE { RtlFeatureConfigurationBoot, @@ -9780,10 +9927,10 @@ typedef enum _RTL_FEATURE_CONFIGURATION_TYPE RtlFeatureConfigurationCount } RTL_FEATURE_CONFIGURATION_TYPE; -// rev +// private typedef struct _RTL_FEATURE_CONFIGURATION { - ULONG FeatureId; + RTL_FEATURE_ID FeatureId; union { ULONG Flags; @@ -9798,100 +9945,327 @@ typedef struct _RTL_FEATURE_CONFIGURATION ULONG Reserved : 16; }; }; - ULONG VariantPayload; + RTL_FEATURE_VARIANT_PAYLOAD VariantPayload; } RTL_FEATURE_CONFIGURATION, *PRTL_FEATURE_CONFIGURATION; -// rev +// private +typedef struct _RTL_FEATURE_CONFIGURATION_TABLE +{ + ULONG FeatureCount; + _Field_size_(FeatureCount) RTL_FEATURE_CONFIGURATION Features[ANYSIZE_ARRAY]; +} RTL_FEATURE_CONFIGURATION_TABLE, *PRTL_FEATURE_CONFIGURATION_TABLE; + +// private +typedef enum _RTL_FEATURE_CONFIGURATION_PRIORITY +{ + FeatureConfigurationPriorityImageDefault = 0, + FeatureConfigurationPriorityEKB = 1, + FeatureConfigurationPrioritySafeguard = 2, + FeatureConfigurationPriorityPersistent = FeatureConfigurationPrioritySafeguard, + FeatureConfigurationPriorityReserved3 = 3, + FeatureConfigurationPriorityService = 4, + FeatureConfigurationPriorityReserved5 = 5, + FeatureConfigurationPriorityDynamic = 6, + FeatureConfigurationPriorityReserved7 = 7, + FeatureConfigurationPriorityUser = 8, + FeatureConfigurationPrioritySecurity = 9, + FeatureConfigurationPriorityUserPolicy = 10, + FeatureConfigurationPriorityReserved11 = 11, + FeatureConfigurationPriorityTest = 12, + FeatureConfigurationPriorityReserved13 = 13, + FeatureConfigurationPriorityReserved14 = 14, + FeatureConfigurationPriorityImageOverride = 15, + FeatureConfigurationPriorityMax = FeatureConfigurationPriorityImageOverride +} RTL_FEATURE_CONFIGURATION_PRIORITY, *PRTL_FEATURE_CONFIGURATION_PRIORITY; + +// private +typedef enum _RTL_FEATURE_ENABLED_STATE +{ + FeatureEnabledStateDefault, + FeatureEnabledStateDisabled, + FeatureEnabledStateEnabled +} RTL_FEATURE_ENABLED_STATE; + +// private +typedef enum _RTL_FEATURE_ENABLED_STATE_OPTIONS +{ + FeatureEnabledStateOptionsNone, + FeatureEnabledStateOptionsWexpConfig +} RTL_FEATURE_ENABLED_STATE_OPTIONS, *PRTL_FEATURE_ENABLED_STATE_OPTIONS; + +// private +typedef enum _RTL_FEATURE_VARIANT_PAYLOAD_KIND +{ + FeatureVariantPayloadKindNone, + FeatureVariantPayloadKindResident, + FeatureVariantPayloadKindExternal +} RTL_FEATURE_VARIANT_PAYLOAD_KIND, *PRTL_FEATURE_VARIANT_PAYLOAD_KIND; + +// private +typedef enum _RTL_FEATURE_CONFIGURATION_OPERATION +{ + FeatureConfigurationOperationNone = 0, + FeatureConfigurationOperationFeatureState = 1, + FeatureConfigurationOperationVariantState = 2, + FeatureConfigurationOperationResetState = 4 +} RTL_FEATURE_CONFIGURATION_OPERATION, *PRTL_FEATURE_CONFIGURATION_OPERATION; + +// private +typedef struct _RTL_FEATURE_CONFIGURATION_UPDATE +{ + RTL_FEATURE_ID FeatureId; + RTL_FEATURE_CONFIGURATION_PRIORITY Priority; + RTL_FEATURE_ENABLED_STATE EnabledState; + RTL_FEATURE_ENABLED_STATE_OPTIONS EnabledStateOptions; + RTL_FEATURE_VARIANT Variant; + UCHAR Reserved[3]; + RTL_FEATURE_VARIANT_PAYLOAD_KIND VariantPayloadKind; + RTL_FEATURE_VARIANT_PAYLOAD VariantPayload; + RTL_FEATURE_CONFIGURATION_OPERATION Operation; +} RTL_FEATURE_CONFIGURATION_UPDATE, *PRTL_FEATURE_CONFIGURATION_UPDATE; + +// private +typedef struct _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET +{ + ULONG Data[2]; +} RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET, *PRTL_FEATURE_USAGE_SUBSCRIPTION_TARGET; + +// private +typedef struct _RTL_FEATURE_USAGE_DATA +{ + RTL_FEATURE_ID FeatureId; + USHORT ReportingKind; + USHORT Reserved; +} RTL_FEATURE_USAGE_DATA, *PRTL_FEATURE_USAGE_DATA; + +// private +typedef struct _RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS +{ + RTL_FEATURE_ID FeatureId; + USHORT ReportingKind; + USHORT ReportingOptions; + RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET ReportingTarget; +} RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS, *PRTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS; + +// private +typedef struct _RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE +{ + ULONG SubscriptionCount; + _Field_size_(SubscriptionCount) RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS Subscriptions[ANYSIZE_ARRAY]; +} RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE, *PRTL_FEATURE_USAGE_SUBSCRIPTION_TABLE; + +// private +_Function_class_(RTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK) +typedef VOID (NTAPI RTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK)( + _In_opt_ PVOID Context + ); +typedef RTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK *PRTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK; + +// private +typedef struct _SYSTEM_FEATURE_CONFIGURATION_QUERY +{ + RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType; + RTL_FEATURE_ID FeatureId; +} SYSTEM_FEATURE_CONFIGURATION_QUERY, *PSYSTEM_FEATURE_CONFIGURATION_QUERY; + +// private +typedef struct _SYSTEM_FEATURE_CONFIGURATION_INFORMATION +{ + RTL_FEATURE_CHANGE_STAMP ChangeStamp; + RTL_FEATURE_CONFIGURATION Configuration; +} SYSTEM_FEATURE_CONFIGURATION_INFORMATION, *PSYSTEM_FEATURE_CONFIGURATION_INFORMATION; + +// private +typedef enum _SYSTEM_FEATURE_CONFIGURATION_UPDATE_TYPE +{ + SystemFeatureConfigurationUpdateTypeUpdate = 0, + SystemFeatureConfigurationUpdateTypeOverwrite = 1, + SystemFeatureConfigurationUpdateTypeCount = 2, +} SYSTEM_FEATURE_CONFIGURATION_UPDATE_TYPE, *PSYSTEM_FEATURE_CONFIGURATION_UPDATE_TYPE; + +// private +typedef struct _SYSTEM_FEATURE_CONFIGURATION_UPDATE +{ + SYSTEM_FEATURE_CONFIGURATION_UPDATE_TYPE UpdateType; + union + { + struct + { + RTL_FEATURE_CHANGE_STAMP PreviousChangeStamp; + RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType; + ULONG UpdateCount; + _Field_size_(UpdateCount) RTL_FEATURE_CONFIGURATION_UPDATE Updates[ANYSIZE_ARRAY]; + } Update; + + struct + { + RTL_FEATURE_CHANGE_STAMP PreviousChangeStamp; + RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType; + SIZE_T BufferSize; + PVOID Buffer; + } Overwrite; + }; +} SYSTEM_FEATURE_CONFIGURATION_UPDATE, *PSYSTEM_FEATURE_CONFIGURATION_UPDATE; + +// private +typedef struct _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY +{ + RTL_FEATURE_CHANGE_STAMP ChangeStamp; + PVOID Section; + SIZE_T Size; +} SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY, *PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY; + +// private +typedef enum _SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE +{ + SystemFeatureConfigurationSectionTypeBoot = 0, + SystemFeatureConfigurationSectionTypeRuntime = 1, + SystemFeatureConfigurationSectionTypeUsageTriggers = 2, + SystemFeatureConfigurationSectionTypeCount = 3, +} SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE; + +// private +typedef struct _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST +{ + RTL_FEATURE_CHANGE_STAMP PreviousChangeStamps[SystemFeatureConfigurationSectionTypeCount]; +} SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST, *PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST; + +// private +typedef struct _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION +{ + RTL_FEATURE_CHANGE_STAMP OverallChangeStamp; + SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY Descriptors[SystemFeatureConfigurationSectionTypeCount]; +} SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION, *PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION; + +// private +typedef struct _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS +{ + RTL_FEATURE_ID FeatureId; + USHORT ReportingKind; + USHORT ReportingOptions; + RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET ReportingTarget; +} SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS, *PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS; + +typedef struct _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY +{ + ULONG Remove; + RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS Details; +} SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY, *PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY; + +typedef struct _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE +{ + ULONG UpdateCount; + _Field_size_(UpdateCount) SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY Updates[ANYSIZE_ARRAY]; +} SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE, *PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE; + +#if (PHNT_VERSION >= PHNT_20H1) + +// private +NTSYSAPI +NTSTATUS +NTAPI +RtlNotifyFeatureUsage( + _In_ PRTL_FEATURE_USAGE_REPORT FeatureUsageReport + ); + +// private NTSYSAPI NTSTATUS NTAPI RtlQueryFeatureConfiguration( - _In_ ULONG FeatureId, - _In_ RTL_FEATURE_CONFIGURATION_TYPE FeatureType, - _Inout_ PULONGLONG ChangeStamp, - _In_ PRTL_FEATURE_CONFIGURATION FeatureConfiguration + _In_ RTL_FEATURE_ID FeatureId, + _In_ RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType, + _Out_ PRTL_FEATURE_CHANGE_STAMP ChangeStamp, + _Out_ PRTL_FEATURE_CONFIGURATION FeatureConfiguration ); -// rev +// private NTSYSAPI NTSTATUS NTAPI RtlSetFeatureConfigurations( - _Inout_ PULONGLONG ChangeStamp, - _In_ RTL_FEATURE_CONFIGURATION_TYPE FeatureType, - _In_ PRTL_FEATURE_CONFIGURATION FeatureConfiguration, - _In_ ULONG FeatureConfigurationCount + _In_opt_ PRTL_FEATURE_CHANGE_STAMP PreviousChangeStamp, + _In_ RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType, + _In_reads_(ConfigurationUpdateCount) PRTL_FEATURE_CONFIGURATION_UPDATE ConfigurationUpdates, + _In_ SIZE_T ConfigurationUpdateCount ); -// rev +// private NTSYSAPI NTSTATUS NTAPI RtlQueryAllFeatureConfigurations( - _In_ RTL_FEATURE_CONFIGURATION_TYPE FeatureType, - _Inout_ PULONGLONG ChangeStamp, - _Out_ PRTL_FEATURE_CONFIGURATION FeatureConfigurations, - _Inout_ PULONG FeatureConfigurationCount + _In_ RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType, + _Out_opt_ PRTL_FEATURE_CHANGE_STAMP ChangeStamp, + _Out_writes_(*ConfigurationCount) PRTL_FEATURE_CONFIGURATION Configurations, + _Inout_ PSIZE_T ConfigurationCount ); -// rev +// private NTSYSAPI -ULONGLONG +RTL_FEATURE_CHANGE_STAMP NTAPI RtlQueryFeatureConfigurationChangeStamp( VOID ); -// rev +// private NTSYSAPI NTSTATUS NTAPI RtlQueryFeatureUsageNotificationSubscriptions( - _Out_ PRTL_FEATURE_CONFIGURATION FeatureConfiguration, - _Inout_ PULONG FeatureConfigurationCount + _Out_writes_(*SubscriptionCount) PRTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS Subscriptions, + _Inout_ PSIZE_T SubscriptionCount ); -_Function_class_(RTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION) -typedef VOID (NTAPI RTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION)( - _In_opt_ PVOID Context - ); -typedef RTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION *PRTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION; - -// rev +// private NTSYSAPI NTSTATUS NTAPI RtlRegisterFeatureConfigurationChangeNotification( - _In_ PRTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION Callback, + _In_ PRTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK Callback, _In_opt_ PVOID Context, - _Inout_opt_ PULONGLONG ChangeStamp, - _Out_ PHANDLE NotificationHandle + _In_opt_ PRTL_FEATURE_CHANGE_STAMP ObservedChangeStamp, + _Out_ PRTL_FEATURE_CONFIGURATION_CHANGE_REGISTRATION RegistrationHandle ); -// rev +// private NTSYSAPI NTSTATUS NTAPI RtlUnregisterFeatureConfigurationChangeNotification( - _In_ HANDLE NotificationHandle + _In_ RTL_FEATURE_CONFIGURATION_CHANGE_REGISTRATION RegistrationHandle ); -// rev +// private NTSYSAPI NTSTATUS NTAPI RtlSubscribeForFeatureUsageNotification( - _In_ PRTL_FEATURE_CONFIGURATION FeatureConfiguration, - _In_ ULONG FeatureConfigurationCount + _In_reads_(SubscriptionCount) PRTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS SubscriptionDetails, + _In_ SIZE_T SubscriptionCount ); -// rev +// private NTSYSAPI NTSTATUS NTAPI RtlUnsubscribeFromFeatureUsageNotifications( - _In_ PRTL_FEATURE_CONFIGURATION FeatureConfiguration, - _In_ ULONG FeatureConfigurationCount + _In_reads_(SubscriptionCount) PRTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS SubscriptionDetails, + _In_ SIZE_T SubscriptionCount + ); +#endif + +// private +#if (PHNT_VERSION >= PHNT_WIN11) +NTSYSAPI +NTSTATUS +NTAPI +RtlOverwriteFeatureConfigurationBuffer( + _In_opt_ PRTL_FEATURE_CHANGE_STAMP PreviousChangeStamp, + _In_ RTL_FEATURE_CONFIGURATION_TYPE ConfigurationType, + _In_reads_bytes_opt_(ConfigurationBufferSize) PVOID ConfigurationBuffer, + _In_ ULONG ConfigurationBufferSize ); #endif @@ -10036,6 +10410,13 @@ RtlUnsubscribeWnfStateChangeNotification( _In_ PWNF_USER_CALLBACK Callback ); +NTSYSAPI +NTSTATUS +NTAPI +RtlWnfDllUnloadCallback( + _In_ PVOID DllBase + ); + #endif #if (PHNT_VERSION >= PHNT_WIN11) @@ -10055,9 +10436,11 @@ NtCopyFileChunk( _In_opt_ PULONG DestKey, _In_ ULONG Flags ); - #endif +#define COPY_FILE_CHUNK_DUPLICATE_EXTENTS 0x00000001L // 24H2 +#define VALID_COPY_FILE_CHUNK_FLAGS (COPY_FILE_CHUNK_DUPLICATE_EXTENTS) + #if (PHNT_VERSION >= PHNT_WIN11) // rev NTSYSAPI diff --git a/ntseapi.h b/ntseapi.h index a572d8a..0bcdfd1 100644 --- a/ntseapi.h +++ b/ntseapi.h @@ -103,8 +103,61 @@ typedef enum _TOKEN_INFORMATION_CLASS TokenIsLessPrivilegedAppContainer, // q: ULONG // since REDSTONE5 TokenIsSandboxed, // q: ULONG // since 19H1 TokenIsAppSilo, // q: ULONG // since WIN11 22H2 // previously TokenOriginatingProcessTrustLevel // q: TOKEN_PROCESS_TRUST_LEVEL + TokenLoggingInformation, // TOKEN_LOGGING_INFORMATION // since 24H2 MaxTokenInfoClass } TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS; +#else +#define TOKEN_INFORMATION_CLASS ULONG +//#define TokenUser 1 // q: TOKEN_USER, SE_TOKEN_USER +//#define TokenGroups 2 // q: TOKEN_GROUPS +//#define TokenPrivileges 3 // q: TOKEN_PRIVILEGES +//#define TokenOwner 4 // q; s: TOKEN_OWNER +#define TokenPrimaryGroup 5 // q; s: TOKEN_PRIMARY_GROUP +#define TokenDefaultDacl 6 // q; s: TOKEN_DEFAULT_DACL +#define TokenSource 7 // q: TOKEN_SOURCE +//#define TokenType 8 // q: TOKEN_TYPE +#define TokenImpersonationLevel 9 // q: SECURITY_IMPERSONATION_LEVEL +#define TokenStatistics 10 // q: TOKEN_STATISTICS // 10 +#define TokenRestrictedSids 11 // q: TOKEN_GROUPS +#define TokenSessionId 12 // q; s: ULONG (requires SeTcbPrivilege) +#define TokenGroupsAndPrivileges 13 // q: TOKEN_GROUPS_AND_PRIVILEGES +#define TokenSessionReference 14 // s: ULONG (requires SeTcbPrivilege) +#define TokenSandBoxInert 15 // q: ULONG +#define TokenAuditPolicy 16 // q; s: TOKEN_AUDIT_POLICY (requires SeSecurityPrivilege/SeTcbPrivilege) +#define TokenOrigin 17 // q; s: TOKEN_ORIGIN (requires SeTcbPrivilege) +#define TokenElevationType 18 // q: TOKEN_ELEVATION_TYPE +#define TokenLinkedToken 19 // q; s: TOKEN_LINKED_TOKEN (requires SeCreateTokenPrivilege) +#define TokenElevation 20 // q: TOKEN_ELEVATION // 20 +#define TokenHasRestrictions 21 // q: ULONG +#define TokenAccessInformation 22 // q: TOKEN_ACCESS_INFORMATION +#define TokenVirtualizationAllowed 23 // q; s: ULONG (requires SeCreateTokenPrivilege) +#define TokenVirtualizationEnabled 24 // q; s: ULONG +#define TokenIntegrityLevel 25 // q; s: TOKEN_MANDATORY_LABEL +#define TokenUIAccess 26 // q; s: ULONG (requires SeTcbPrivilege) +#define TokenMandatoryPolicy 27 // q; s: TOKEN_MANDATORY_POLICY (requires SeTcbPrivilege) +#define TokenLogonSid 28 // q: TOKEN_GROUPS +#define TokenIsAppContainer 29 // q: ULONG // since WIN8 +#define TokenCapabilities 30 // q: TOKEN_GROUPS // 30 +//#define TokenAppContainerSid 31 // q: TOKEN_APPCONTAINER_INFORMATION +#define TokenAppContainerNumber 32 // q: ULONG +#define TokenUserClaimAttributes 33 // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION +#define TokenDeviceClaimAttributes 34 // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION +#define TokenRestrictedUserClaimAttributes 35 // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION +#define TokenRestrictedDeviceClaimAttributes 36 // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION +#define TokenDeviceGroups 37 // q: TOKEN_GROUPS +#define TokenRestrictedDeviceGroups 38 // q: TOKEN_GROUPS +#define TokenSecurityAttributes 39 // q; s: TOKEN_SECURITY_ATTRIBUTES_[AND_OPERATION_]INFORMATION (requires SeTcbPrivilege) +#define TokenIsRestricted 40 // q: ULONG // 40 +#define TokenProcessTrustLevel 41 // q: TOKEN_PROCESS_TRUST_LEVEL // since WINBLUE +#define TokenPrivateNameSpace 42// q; s: ULONG (requires SeTcbPrivilege) // since THRESHOLD +#define TokenSingletonAttributes 43 // q: TOKEN_SECURITY_ATTRIBUTES_INFORMATION // since REDSTONE +#define TokenBnoIsolation 44 // q: TOKEN_BNO_ISOLATION_INFORMATION // since REDSTONE2 +#define TokenChildProcessFlags 45 // s: ULONG (requires SeTcbPrivilege) // since REDSTONE3 +#define TokenIsLessPrivilegedAppContainer 46 // q: ULONG // since REDSTONE5 +#define TokenIsSandboxed 47 // q: ULONG // since 19H1 +#define TokenIsAppSilo 48 // q: ULONG // since 22H2 // previously TokenOriginatingProcessTrustLevel // q: TOKEN_PROCESS_TRUST_LEVEL +#define TokenLoggingInformation 49 // TOKEN_LOGGING_INFORMATION // since 24H2 +#define MaxTokenInfoClass 50 #endif // Types diff --git a/ntwmi.h b/ntwmi.h index f743940..3b62606 100644 --- a/ntwmi.h +++ b/ntwmi.h @@ -11,9 +11,24 @@ EXTERN_C_START #ifndef _TRACEHANDLE_DEFINED #define _TRACEHANDLE_DEFINED +// Obsolete - prefer PROCESSTRACE_HANDLE or CONTROLTRACE_ID. typedef ULONG64 TRACEHANDLE, *PTRACEHANDLE; #endif +// Used to read the events from a trace file or real-time trace session (via +// ProcessTrace). The handle is invalid if it contains the value +// INVALID_PROCESSTRACE_HANDLE. Obtain the handle by calling an OpenTrace +// function (e.g. OpenTrace, OpenTraceFromFile, OpenTraceFromRealTimeLogger). +// Close the handle by calling CloseTrace. +typedef ULONG64 PROCESSTRACE_HANDLE; + +// Used to identify a trace collection session. The id is invalid if it +// contains the value (CONTROLTRACE_ID)0. Obtain the id from StartTrace or from +// the Wnode.HistoricalContext field of the EVENT_TRACE_PROPERTIES returned by +// ControlTrace(0, sessionName, ...). The id is valid until the trace stops and +// does not need to be closed by the user. +typedef ULONG64 CONTROLTRACE_ID; + // // Maximum supported buffer size in KB - Win8 (16MB) // @@ -2832,7 +2847,7 @@ typedef struct _HEAP_SUBSEGMENT_INIT #include #include -typedef struct _HEAP_AFINITY_MANAGER_ENABLE +typedef struct _HEAP_AFFINITY_MANAGER_ENABLE { SYSTEM_TRACE_HEADER Header; PVOID HeapHandle; @@ -5433,32 +5448,6 @@ typedef struct _ETW_UMGL_KEY #define MEMORY_FROM_INVALID 5 #define MEMORY_FROM_SEGMENT_HEAP 6 //Activity from segment heap. -// -// Header preparation macro for UMGL -// -#define TRACE_HEADER_TYPE_SYSTEM32 1 -#define TRACE_HEADER_TYPE_SYSTEM64 2 -#define TRACE_HEADER_TYPE_COMPACT32 3 -#define TRACE_HEADER_TYPE_COMPACT64 4 -#define TRACE_HEADER_TYPE_FULL_HEADER32 10 -#define TRACE_HEADER_TYPE_INSTANCE32 11 -#define TRACE_HEADER_TYPE_TIMED 12 // Not used -#define TRACE_HEADER_TYPE_ERROR 13 // Error while logging event -#define TRACE_HEADER_TYPE_WNODE_HEADER 14 // Not used -#define TRACE_HEADER_TYPE_MESSAGE 15 -#define TRACE_HEADER_TYPE_PERFINFO32 16 -#define TRACE_HEADER_TYPE_PERFINFO64 17 -#define TRACE_HEADER_TYPE_EVENT_HEADER32 18 -#define TRACE_HEADER_TYPE_EVENT_HEADER64 19 -#define TRACE_HEADER_TYPE_FULL_HEADER64 20 -#define TRACE_HEADER_TYPE_INSTANCE64 21 - -#define EVENT_HEADER_SIZE_MASK 0x0000FFFF - -#define SYSTEM_TRACE_VERSION 2 - -#define TRACE_HEADER_FLAG 0x80000000 - #define EVENT_HEADER_EVENT64 ((USHORT)(((TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE) >> 16) | TRACE_HEADER_TYPE_EVENT_HEADER64)) #define EVENT_HEADER_EVENT32 ((USHORT)(((TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE) >> 16) | TRACE_HEADER_TYPE_EVENT_HEADER32)) #define EVENT_HEADER_ERROR ((USHORT)(((TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE) >> 16) | TRACE_HEADER_TYPE_ERROR)) diff --git a/ntzwapi.h b/ntzwapi.h index 949384e..1fafdb7 100644 --- a/ntzwapi.h +++ b/ntzwapi.h @@ -2284,7 +2284,7 @@ ZwMapViewOfSectionEx( _Inout_opt_ PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize, _In_ ULONG AllocationType, - _In_ ULONG Win32Protect, + _In_ ULONG PageProtection, _Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters, _In_ ULONG ExtendedParameterCount ); diff --git a/phnt_ntdef.h b/phnt_ntdef.h index 9166d1a..6f269b2 100644 --- a/phnt_ntdef.h +++ b/phnt_ntdef.h @@ -111,7 +111,9 @@ typedef enum _WAIT_TYPE { WaitAll, WaitAny, - WaitNotification + WaitNotification, + WaitDequeue, + WaitDpc, } WAIT_TYPE; // Strings @@ -243,6 +245,15 @@ typedef const OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES; (p)->SecurityQualityOfService = NULL; \ } +#define InitializeObjectAttributesEx(p, n, a, r, s, q) { \ + (p)->Length = sizeof(OBJECT_ATTRIBUTES); \ + (p)->RootDirectory = r; \ + (p)->Attributes = a; \ + (p)->ObjectName = n; \ + (p)->SecurityDescriptor = s; \ + (p)->SecurityQualityOfService = q; \ + } + #define RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a) { sizeof(OBJECT_ATTRIBUTES), NULL, n, a, NULL, NULL } #define RTL_INIT_OBJECT_ATTRIBUTES(n, a) RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a) diff --git a/phnt_windows.h b/phnt_windows.h index c1bd932..48e8ad9 100644 --- a/phnt_windows.h +++ b/phnt_windows.h @@ -55,6 +55,10 @@ #define WIN32_NO_STATUS #endif +#ifndef COM_NO_WINDOWS_H +#define COM_NO_WINDOWS_H +#endif + #ifndef __cplusplus // This is needed to workaround C17 preprocessor errors when using legacy versions of the Windows SDK. (dmex) #ifndef MICROSOFT_WINDOWS_WINBASE_H_DEFINE_INTERLOCKED_CPLUSPLUS_OVERLOADS @@ -67,6 +71,11 @@ #undef WIN32_NO_STATUS #include #include +#include + +#ifdef COM_NO_WINDOWS_H +#include +#endif typedef double DOUBLE; typedef GUID *PGUID;