admin/processhacker-phnt
1
0
Fork 0
mirror of https://github.com/processhacker/phnt synced 2026-06-08 16:49:04 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
processhacker-phnt/ntexapi.h
T
Johnny Shaw 53fbbdc5b5 sync latest
2026-03-25 18:14:46 -06:00

9919 lines
377 KiB
C
Raw Permalink Blame History

/*
* Executive support library functions
*
* This file is part of System Informer.
*/
#ifndef _NTEXAPI_H
#define _NTEXAPI_H
typedef struct _TEB* PTEB;
typedef struct _COUNTED_REASON_CONTEXT* PCOUNTED_REASON_CONTEXT;
typedef struct _FILE_IO_COMPLETION_INFORMATION* PFILE_IO_COMPLETION_INFORMATION;
typedef struct _PORT_MESSAGE* PPORT_MESSAGE;
typedef struct _IMAGE_EXPORT_DIRECTORY* PIMAGE_EXPORT_DIRECTORY;
typedef struct _FILE_OBJECT* PFILE_OBJECT;
typedef struct _DEVICE_OBJECT* PDEVICE_OBJECT;
typedef struct _IRP* PIRP;
typedef struct _RTL_BITMAP* PRTL_BITMAP;
#if (PHNT_MODE != PHNT_MODE_KERNEL)
//
// Thread execution
//
/**
* The NtDelayExecution routine suspends the current thread until the specified condition is met.
*
* \param Alertable The function returns when either the time-out period has elapsed or when the APC function is called.
* \param DelayInterval The time interval for which execution is to be suspended, in milliseconds.
* - A value of zero causes the thread to relinquish the remainder of its time slice to any other thread that is ready to run.
* - If there are no other threads ready to run, the function returns immediately, and the thread continues execution.
* - A value of INFINITE indicates that the suspension should not time out.
* \return NTSTATUS Successful or errant status. The return value is STATUS_USER_APC when Alertable is TRUE, and the function returned due to one or more I/O completion callback functions.
* \remarks Note that a ready thread is not guaranteed to run immediately. Consequently, the thread will not run until some arbitrary time after the sleep interval elapses,
* based upon the system "tick" frequency and the load factor from other processes.
* \see https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-sleepex
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDelayExecution(
_In_ BOOLEAN Alertable,
_In_ PLARGE_INTEGER DelayInterval
);
//
// Firmware environment values
//
/**
* Retrieves the value of the specified firmware environment variable.
* The user account that the app is running under must have the SE_SYSTEM_ENVIRONMENT_NAME privilege.
*
* \param VariableName The name of the firmware environment variable. The pointer must not be NULL.
* \param VariableValue A pointer to a buffer that receives the value of the specified firmware environment variable.
* \param ValueLength The size of the \c VariableValue buffer, in bytes.
* \param ReturnLength If the function succeeds, the return length is the number of bytes stored in the \c VariableValue buffer.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySystemEnvironmentValue(
_In_ PCUNICODE_STRING VariableName,
_Out_writes_bytes_(ValueLength) PWSTR VariableValue,
_In_ USHORT ValueLength,
_Out_opt_ PUSHORT ReturnLength
);
// The firmware environment variable is stored in non-volatile memory (e.g. NVRAM).
#define EFI_VARIABLE_NON_VOLATILE 0x00000001
// The firmware environment variable can be accessed during boot service.
#define EFI_VARIABLE_BOOTSERVICE_ACCESS 0x00000002
// The firmware environment variable can be accessed at runtime.
#define EFI_VARIABLE_RUNTIME_ACCESS 0x00000004
// Indicates hardware related errors encountered at runtime.
#define EFI_VARIABLE_HARDWARE_ERROR_RECORD 0x00000008
// Indicates an authentication requirement that must be met before writing to this firmware environment variable.
#define EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS 0x00000010
// Indicates authentication and time stamp requirements that must be met before writing to this firmware environment variable.
// When this attribute is set, the buffer, represented by Buffer, will begin with an instance of a complete (and serialized) EFI_VARIABLE_AUTHENTICATION_2 descriptor.
#define EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS 0x00000020
// Append an existing environment variable with the value of Buffer. If the firmware does not support the operation, the function returns ERROR_INVALID_FUNCTION.
#define EFI_VARIABLE_APPEND_WRITE 0x00000040
// The firmware environment variable will return metadata in addition to variable data.
#define EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS 0x00000080
/**
* Retrieves the value of the specified firmware environment variable and its attributes.
* The user account that the app is running under must have the SE_SYSTEM_ENVIRONMENT_NAME privilege.
*
* \param VariableName The name of the firmware environment variable. The pointer must not be NULL.
* \param VendorGuid The GUID that represents the namespace of the firmware environment variable.
* \param Buffer A pointer to a buffer that receives the value of the specified firmware environment variable.
* \param BufferLength The size of the \c Buffer, in bytes.
* \param Attributes Bitmask identifying UEFI variable attributes associated with the variable.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySystemEnvironmentValueEx(
_In_ PCUNICODE_STRING VariableName,
_In_ PCGUID VendorGuid,
_Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
_Inout_ PULONG BufferLength,
_Out_opt_ PULONG Attributes // EFI_VARIABLE_*
);
/**
* Sets the value of the specified firmware environment variable.
* The user account that the app is running under must have the SE_SYSTEM_ENVIRONMENT_NAME privilege.
*
* \param VariableName The name of the firmware environment variable. The pointer must not be NULL.
* \param VariableValue A pointer to the new value for the firmware environment variable.
* If this parameter is zero, the firmware environment variable is deleted.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetSystemEnvironmentValue(
_In_ PCUNICODE_STRING VariableName,
_In_ PCUNICODE_STRING VariableValue
);
/**
* Sets the value of the specified firmware environment variable and the attributes that indicate how this variable is stored and maintained.
* The user account that the app is running under must have the SE_SYSTEM_ENVIRONMENT_NAME privilege.
*
* \param VariableName The name of the firmware environment variable. The pointer must not be NULL.
* \param VendorGuid The GUID that represents the namespace of the firmware environment variable.
* \param Buffer A pointer to the new value for the firmware environment variable.
* \param BufferLength The size of the pValue buffer, in bytes.
* Unless the VARIABLE_ATTRIBUTE_APPEND_WRITE, VARIABLE_ATTRIBUTE_AUTHENTICATED_WRITE_ACCESS,
* or VARIABLE_ATTRIBUTE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS variable attribute is set via dwAttributes,
* setting this value to zero will result in the deletion of this variable.
* \param Attributes Bitmask to set UEFI variable attributes associated with the variable.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetSystemEnvironmentValueEx(
_In_ PCUNICODE_STRING VariableName,
_In_ PCGUID VendorGuid,
_In_reads_bytes_opt_(BufferLength) PVOID Buffer,
_In_ ULONG BufferLength, // 0 = delete variable
_In_ ULONG Attributes // EFI_VARIABLE_*
);
typedef enum _SYSTEM_ENVIRONMENT_INFORMATION_CLASS
{
SystemEnvironmentNameInformation = 1, // q: VARIABLE_NAME
SystemEnvironmentValueInformation = 2, // q: VARIABLE_NAME_AND_VALUE
MaxSystemEnvironmentInfoClass
} SYSTEM_ENVIRONMENT_INFORMATION_CLASS;
_Struct_size_bytes_(NextEntryOffset)
typedef struct _VARIABLE_NAME
{
ULONG NextEntryOffset;
GUID VendorGuid;
WCHAR Name[ANYSIZE_ARRAY];
} VARIABLE_NAME, *PVARIABLE_NAME;
_Struct_size_bytes_(NextEntryOffset)
typedef struct _VARIABLE_NAME_AND_VALUE
{
ULONG NextEntryOffset;
ULONG ValueOffset;
ULONG ValueLength;
ULONG Attributes;
GUID VendorGuid;
WCHAR Name[ANYSIZE_ARRAY];
//BYTE Value[ANYSIZE_ARRAY];
} VARIABLE_NAME_AND_VALUE, *PVARIABLE_NAME_AND_VALUE;
/**
* The NtEnumerateSystemEnvironmentValuesEx routine enumerates system environment values with extended information.
*
* \param InformationClass The class of system environment information to retrieve.
* \param Buffer Pointer to a buffer that receives the system environment values data.
* \param BufferLength Pointer to a ULONG variable that specifies the size of the Buffer on input.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtEnumerateSystemEnvironmentValuesEx(
_In_ ULONG InformationClass, // SYSTEM_ENVIRONMENT_INFORMATION_CLASS
_Out_ PVOID Buffer,
_Inout_ PULONG BufferLength
);
//
// EFI
//
// private
typedef struct _BOOT_ENTRY
{
ULONG Version;
ULONG Length;
ULONG Id;
ULONG Attributes;
ULONG FriendlyNameOffset;
ULONG BootFilePathOffset;
ULONG OsOptionsLength;
_Field_size_bytes_(OsOptionsLength) UCHAR OsOptions[1];
} BOOT_ENTRY, *PBOOT_ENTRY;
// private
_Struct_size_bytes_(NextEntryOffset)
typedef struct _BOOT_ENTRY_LIST
{
ULONG NextEntryOffset;
BOOT_ENTRY BootEntry;
} BOOT_ENTRY_LIST, *PBOOT_ENTRY_LIST;
// private
typedef struct _BOOT_OPTIONS
{
ULONG Version;
ULONG Length;
ULONG Timeout;
ULONG CurrentBootEntryId;
ULONG NextBootEntryId;
_Field_size_bytes_(Length) WCHAR HeadlessRedirection[1];
} BOOT_OPTIONS, *PBOOT_OPTIONS;
// private
typedef struct _FILE_PATH
{
ULONG Version;
ULONG Length;
ULONG Type;
_Field_size_bytes_(Length) UCHAR FilePath[1];
} FILE_PATH, *PFILE_PATH;
// private
typedef struct _EFI_DRIVER_ENTRY
{
ULONG Version;
ULONG Length;
ULONG Id;
ULONG FriendlyNameOffset;
ULONG DriverFilePathOffset;
} EFI_DRIVER_ENTRY, *PEFI_DRIVER_ENTRY;
// private
_Struct_size_bytes_(NextEntryOffset)
typedef struct _EFI_DRIVER_ENTRY_LIST
{
ULONG NextEntryOffset;
EFI_DRIVER_ENTRY DriverEntry;
} EFI_DRIVER_ENTRY_LIST, *PEFI_DRIVER_ENTRY_LIST;
/**
* The NtAddBootEntry routine adds a new boot entry to the system boot configuration.
*
* \param BootEntry A pointer to a BOOT_ENTRY structure that specifies the boot entry to be added.
* \param Id A pointer to a variable that receives the identifier of the new boot entry.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAddBootEntry(
_In_ PBOOT_ENTRY BootEntry,
_Out_opt_ PULONG Id
);
/**
* The NtDeleteBootEntry routine deletes an existing boot entry from the system boot configuration.
*
* \param Id The identifier of the boot entry to be deleted.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteBootEntry(
_In_ ULONG Id
);
/**
* The NtModifyBootEntry routine modifies an existing boot entry in the system boot configuration.
*
* \param BootEntry A pointer to a BOOT_ENTRY structure that specifies the new boot entry information.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtModifyBootEntry(
_In_ PBOOT_ENTRY BootEntry
);
/**
* The NtEnumerateBootEntries routine retrieves information about all boot entries in the system boot configuration.
*
* \param Buffer A pointer to a buffer that receives the boot entries information.
* \param BufferLength A pointer to a variable that specifies the size of the buffer. On return, it contains the size of the data returned.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtEnumerateBootEntries(
_Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
_Inout_ PULONG BufferLength
);
/**
* The NtQueryBootEntryOrder routine retrieves the current boot entry order.
*
* \param Ids A pointer to a buffer that receives the identifiers of the boot entries in the current boot order.
* \param Count A pointer to a variable that specifies the number of entries in the buffer. On return, it contains the number of entries returned.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryBootEntryOrder(
_Out_writes_opt_(*Count) PULONG Ids,
_Inout_ PULONG Count
);
/**
* The NtSetBootEntryOrder routine sets the boot entry order.
*
* \param Ids A pointer to a buffer that specifies the identifiers of the boot entries in the desired boot order.
* \param Count The number of entries in the buffer.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetBootEntryOrder(
_In_reads_(Count) PULONG Ids,
_In_ ULONG Count
);
/**
* The NtQueryBootOptions routine retrieves the current boot options.
*
* \param BootOptions A pointer to a buffer that receives the boot options.
* \param BootOptionsLength A pointer to a variable that specifies the size of the buffer. On return, it contains the size of the data returned.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryBootOptions(
_Out_writes_bytes_opt_(*BootOptionsLength) PBOOT_OPTIONS BootOptions,
_Inout_ PULONG BootOptionsLength
);
/**
* The NtSetBootOptions routine sets the boot options.
*
* \param BootOptions A pointer to a BOOT_OPTIONS structure that specifies the new boot options.
* \param FieldsToChange A bitmask that specifies which fields in the BOOT_OPTIONS structure are to be changed.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetBootOptions(
_In_ PBOOT_OPTIONS BootOptions,
_In_ ULONG FieldsToChange
);
/**
* The NtTranslateFilePath routine translates a file path from one format to another.
*
* \param InputFilePath A pointer to a FILE_PATH structure that specifies the input file path.
* \param OutputType The type of the output file path.
* \param OutputFilePath A pointer to a buffer that receives the translated file path.
* \param OutputFilePathLength A pointer to a variable that specifies the size of the buffer. On return, it contains the size of the data returned.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtTranslateFilePath(
_In_ PFILE_PATH InputFilePath,
_In_ ULONG OutputType,
_Out_writes_bytes_opt_(*OutputFilePathLength) PFILE_PATH OutputFilePath,
_Inout_opt_ PULONG OutputFilePathLength
);
/**
* The NtAddDriverEntry routine adds a new driver entry to the system boot configuration.
*
* \param DriverEntry A pointer to an EFI_DRIVER_ENTRY structure that specifies the driver entry to be added.
* \param Id A pointer to a variable that receives the identifier of the new driver entry.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAddDriverEntry(
_In_ PEFI_DRIVER_ENTRY DriverEntry,
_Out_opt_ PULONG Id
);
/**
* The NtDeleteDriverEntry routine deletes an existing driver entry from the system boot configuration.
*
* \param Id The identifier of the driver entry to be deleted.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteDriverEntry(
_In_ ULONG Id
);
/**
* The NtModifyDriverEntry routine modifies an existing driver entry in the system boot configuration.
*
* \param DriverEntry A pointer to an EFI_DRIVER_ENTRY structure that specifies the new driver entry information.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtModifyDriverEntry(
_In_ PEFI_DRIVER_ENTRY DriverEntry
);
/**
* The NtEnumerateDriverEntries routine retrieves information about all driver entries in the system boot configuration.
*
* \param Buffer A pointer to a buffer that receives the driver entries information.
* \param BufferLength A pointer to a variable that specifies the size of the buffer. On return, it contains the size of the data returned.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtEnumerateDriverEntries(
_Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
_Inout_ PULONG BufferLength
);
/**
* The NtQueryDriverEntryOrder routine retrieves the current driver entry order.
*
* \param Ids A pointer to a buffer that receives the identifiers of the driver entries in the current driver order.
* \param Count A pointer to a variable that specifies the number of entries in the buffer. On return, it contains the number of entries returned.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryDriverEntryOrder(
_Out_writes_opt_(*Count) PULONG Ids,
_Inout_ PULONG Count
);
/**
* The NtSetDriverEntryOrder routine sets the driver entry order.
*
* \param Ids A pointer to a buffer that specifies the identifiers of the driver entries in the desired driver order.
* \param Count The number of entries in the buffer.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetDriverEntryOrder(
_In_reads_(Count) PULONG Ids,
_In_ ULONG Count
);
typedef enum _FILTER_BOOT_OPTION_OPERATION
{
FilterBootOptionOperationOpenSystemStore,
FilterBootOptionOperationSetElement,
FilterBootOptionOperationDeleteElement,
FilterBootOptionOperationMax
} FILTER_BOOT_OPTION_OPERATION;
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
/**
* The NtFilterBootOption routine filters boot options based on the specified operation, object type, and element type.
*
* \param FilterOperation The operation to be performed on the boot option. This can be one of the values from the FILTER_BOOT_OPTION_OPERATION enumeration.
* \param ObjectType The type of the object to be filtered.
* \param ElementType The type of the element within the object to be filtered.
* \param Data A pointer to a buffer that contains the data to be used in the filter operation. This parameter is optional and can be NULL.
* \param DataSize The size, in bytes, of the data buffer pointed to by the Data parameter.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtFilterBootOption(
_In_ FILTER_BOOT_OPTION_OPERATION FilterOperation,
_In_ ULONG ObjectType,
_In_ ULONG ElementType,
_In_reads_bytes_opt_(DataSize) PVOID Data,
_In_ ULONG DataSize
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_8)
//
// Event
//
#ifndef EVENT_QUERY_STATE
#define EVENT_QUERY_STATE 0x0001
#endif
#ifndef EVENT_MODIFY_STATE
#define EVENT_MODIFY_STATE 0x0002
#endif
#ifndef EVENT_ALL_ACCESS
#define EVENT_ALL_ACCESS (EVENT_QUERY_STATE|EVENT_MODIFY_STATE|STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE)
#endif
/**
* The EVENT_INFORMATION_CLASS specifies the type of information to be retrieved about an event object.
*/
typedef enum _EVENT_INFORMATION_CLASS
{
EventBasicInformation
} EVENT_INFORMATION_CLASS;
/**
* The EVENT_BASIC_INFORMATION structure contains basic information about an event object.
*/
typedef struct _EVENT_BASIC_INFORMATION
{
EVENT_TYPE EventType; // The type of the event object (NotificationEvent or SynchronizationEvent).
LONG EventState; // The current state of the event object. Nonzero if the event is signaled; zero if not signaled.
} EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;
/**
* The NtCreateEvent routine creates an event object, sets the initial state of the event to the specified value,
* and opens a handle to the object with the specified desired access.
*
* \param EventHandle A pointer to a variable that receives the event object handle.
* \param DesiredAccess The access mask that specifies the requested access to the event object.
* \param ObjectAttributes A pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
* \param EventType The type of the event, which can be SynchronizationEvent or a NotificationEvent.
* \param InitialState The initial state of the event object.
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-zwcreateevent
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateEvent(
_Out_ PHANDLE EventHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ EVENT_TYPE EventType,
_In_ BOOLEAN InitialState
);
/**
* The NtOpenEvent routine opens a handle to an existing event object.
*
* \param EventHandle A pointer to a variable that receives the event object handle.
* \param DesiredAccess The access mask that specifies the requested access to the event object.
* \param ObjectAttributes A pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenEvent(
_Out_ PHANDLE EventHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
/**
* The NtSetEvent routine sets an event object to the signaled state.
*
* \param EventHandle A handle to the event object.
* \param PreviousState A pointer to a variable that receives the previous state of the event object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetEvent(
_In_ HANDLE EventHandle,
_Out_opt_ PLONG PreviousState
);
#if (PHNT_VERSION >= PHNT_WINDOWS_11)
/**
* The NtSetEventEx routine sets an event object to the signaled state and optionally acquires a lock.
*
* \param ThreadId A handle to the thread.
* \param Lock A pointer to an RTL_SRWLOCK structure that specifies the lock to acquire.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetEventEx(
_In_ HANDLE ThreadId,
_In_opt_ PRTL_SRWLOCK Lock
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_11)
/**
* The NtSetEventBoostPriority routine sets an event object to the signaled state and boosts the priority of threads waiting on the event.
*
* \param EventHandle A handle to the event object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetEventBoostPriority(
_In_ HANDLE EventHandle
);
/**
* The NtClearEvent routine sets an event object to the not-signaled state.
*
* \param EventHandle A handle to the event object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtClearEvent(
_In_ HANDLE EventHandle
);
/**
* The NtResetEvent routine sets an event object to the not-signaled state and optionally returns the previous state.
*
* \param EventHandle A handle to the event object.
* \param PreviousState A pointer to a variable that receives the previous state of the event object.
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-resetevent
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtResetEvent(
_In_ HANDLE EventHandle,
_Out_opt_ PLONG PreviousState
);
/**
* The NtPulseEvent routine sets an event object to the signaled state and then resets it to the not-signaled state after releasing the appropriate number of waiting threads.
*
* \param EventHandle A handle to the event object.
* \param PreviousState A pointer to a variable that receives the previous state of the event object.
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-pulseevent
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtPulseEvent(
_In_ HANDLE EventHandle,
_Out_opt_ PLONG PreviousState
);
/**
* The NtQueryEvent routine retrieves information about an event object.
*
* \param EventHandle A handle to the event object.
* \param EventInformationClass The type of information to be retrieved.
* \param EventInformation A pointer to a buffer that receives the requested information.
* \param EventInformationLength The size of the buffer pointed to by EventInformation.
* \param ReturnLength A pointer to a variable that receives the size of the data returned in the buffer.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryEvent(
_In_ HANDLE EventHandle,
_In_ EVENT_INFORMATION_CLASS EventInformationClass,
_Out_writes_bytes_(EventInformationLength) PVOID EventInformation,
_In_ ULONG EventInformationLength,
_Out_opt_ PULONG ReturnLength
);
//
// Event Pair
//
#define EVENT_PAIR_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE)
/**
* The NtCreateEventPair routine creates an event pair object and opens a handle to the object with the specified desired access.
*
* \remark Event Pairs are used to communicate with protected subsystems (see Context Switches).
* \param EventPairHandle A pointer to a variable that receives the event pair object handle.
* \param DesiredAccess The access mask that specifies the requested access to the event pair object.
* \param ObjectAttributes A pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateEventPair(
_Out_ PHANDLE EventPairHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes
);
/**
* The NtOpenEventPair routine opens a handle to an existing event pair object.
*
* \param EventPairHandle A pointer to a variable that receives the event pair object handle.
* \param DesiredAccess The access mask that specifies the requested access to the event pair object.
* \param ObjectAttributes A pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenEventPair(
_Out_ PHANDLE EventPairHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes
);
/**
* The NtSetLowEventPair routine sets the low event in an event pair to the signaled state.
*
* \param EventPairHandle A handle to the event pair object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetLowEventPair(
_In_ HANDLE EventPairHandle
);
/**
* The NtSetHighEventPair routine sets the high event in an event pair to the signaled state.
*
* \param EventPairHandle A handle to the event pair object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetHighEventPair(
_In_ HANDLE EventPairHandle
);
/**
* The NtWaitLowEventPair routine waits for the low event in an event pair to be set to the signaled state.
*
* \param EventPairHandle A handle to the event pair object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitLowEventPair(
_In_ HANDLE EventPairHandle
);
/**
* The NtWaitHighEventPair routine waits for the high event in an event pair to be set to the signaled state.
*
* \param EventPairHandle A handle to the event pair object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitHighEventPair(
_In_ HANDLE EventPairHandle
);
/**
* The NtSetLowWaitHighEventPair routine sets the low event in an event pair to the signaled state and waits for the high event to be set to the signaled state.
*
* \param EventPairHandle A handle to the event pair object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetLowWaitHighEventPair(
_In_ HANDLE EventPairHandle
);
/**
* The NtSetHighWaitLowEventPair routine sets the high event in an event pair to the signaled state and waits for the low event to be set to the signaled state.
*
* \param EventPairHandle A handle to the event pair object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetHighWaitLowEventPair(
_In_ HANDLE EventPairHandle
);
//
// Mutant
//
#ifndef MUTANT_QUERY_STATE
#define MUTANT_QUERY_STATE 0x0001
#endif
#ifndef MUTANT_ALL_ACCESS
#define MUTANT_ALL_ACCESS (MUTANT_QUERY_STATE|STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE)
#endif
typedef enum _MUTANT_INFORMATION_CLASS
{
MutantBasicInformation, // MUTANT_BASIC_INFORMATION
MutantOwnerInformation // MUTANT_OWNER_INFORMATION
} MUTANT_INFORMATION_CLASS;
/**
* The MUTANT_BASIC_INFORMATION structure contains basic information about a mutant object.
*/
typedef struct _MUTANT_BASIC_INFORMATION
{
LONG CurrentCount;
BOOLEAN OwnedByCaller;
BOOLEAN AbandonedState;
} MUTANT_BASIC_INFORMATION, *PMUTANT_BASIC_INFORMATION;
/**
* The MUTANT_OWNER_INFORMATION structure contains information about the owner of a mutant object.
*/
typedef struct _MUTANT_OWNER_INFORMATION
{
CLIENT_ID ClientId;
} MUTANT_OWNER_INFORMATION, *PMUTANT_OWNER_INFORMATION;
/**
* The NtCreateMutant routine creates a mutant object, sets the initial state of the mutant to the specified value,
* and opens a handle to the object with the specified desired access.
*
* \param MutantHandle A pointer to a variable that receives the mutant object handle.
* \param DesiredAccess The access mask that specifies the requested access to the mutant object.
* \param ObjectAttributes A pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
* \param InitialOwner If TRUE, the calling thread is the initial owner of the mutant object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateMutant(
_Out_ PHANDLE MutantHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_ BOOLEAN InitialOwner
);
/**
* The NtOpenMutant routine opens a handle to an existing mutant object.
*
* \param MutantHandle A pointer to a variable that receives the mutant object handle.
* \param DesiredAccess The access mask that specifies the requested access to the mutant object.
* \param ObjectAttributes A pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenMutant(
_Out_ PHANDLE MutantHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes
);
/**
* The NtReleaseMutant routine releases ownership of a mutant object.
*
* \param MutantHandle A handle to the mutant object.
* \param PreviousCount A pointer to a variable that receives the previous count of the mutant object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReleaseMutant(
_In_ HANDLE MutantHandle,
_Out_opt_ PLONG PreviousCount
);
/**
* The NtQueryMutant routine retrieves information about a mutant object.
*
* \param MutantHandle A handle to the mutant object.
* \param MutantInformationClass The type of information to be retrieved.
* \param MutantInformation A pointer to a buffer that receives the requested information.
* \param MutantInformationLength The size of the buffer pointed to by MutantInformation.
* \param ReturnLength A pointer to a variable that receives the size of the data returned in the buffer.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryMutant(
_In_ HANDLE MutantHandle,
_In_ MUTANT_INFORMATION_CLASS MutantInformationClass,
_Out_writes_bytes_(MutantInformationLength) PVOID MutantInformation,
_In_ ULONG MutantInformationLength,
_Out_opt_ PULONG ReturnLength
);
//
// Semaphore
//
#ifndef SEMAPHORE_QUERY_STATE
#define SEMAPHORE_QUERY_STATE 0x0001
#endif
#ifndef SEMAPHORE_MODIFY_STATE
#define SEMAPHORE_MODIFY_STATE 0x0002
#endif
#ifndef SEMAPHORE_ALL_ACCESS
#define SEMAPHORE_ALL_ACCESS (SEMAPHORE_QUERY_STATE|SEMAPHORE_MODIFY_STATE|STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE)
#endif
typedef enum _SEMAPHORE_INFORMATION_CLASS
{
SemaphoreBasicInformation
} SEMAPHORE_INFORMATION_CLASS;
/**
* The SEMAPHORE_BASIC_INFORMATION structure contains basic information about a semaphore object.
*/
typedef struct _SEMAPHORE_BASIC_INFORMATION
{
LONG CurrentCount;
LONG MaximumCount;
} SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;
/**
* The NtCreateSemaphore routine creates a semaphore object, sets the initial count of the semaphore to the specified value,
* and opens a handle to the object with the specified desired access.
*
* \param SemaphoreHandle A pointer to a variable that receives the semaphore object handle.
* \param DesiredAccess The access mask that specifies the requested access to the semaphore object.
* \param ObjectAttributes A pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
* \param InitialCount The initial count of the semaphore object.
* \param MaximumCount The maximum count of the semaphore object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateSemaphore(
_Out_ PHANDLE SemaphoreHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_ LONG InitialCount,
_In_ LONG MaximumCount
);
/**
* The NtOpenSemaphore routine opens a handle to an existing semaphore object.
*
* \param SemaphoreHandle A pointer to a variable that receives the semaphore object handle.
* \param DesiredAccess The access mask that specifies the requested access to the semaphore object.
* \param ObjectAttributes A pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenSemaphore(
_Out_ PHANDLE SemaphoreHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes
);
/**
* The NtReleaseSemaphore routine increases the count of the specified semaphore object by a specified amount.
*
* \param SemaphoreHandle A handle to the semaphore object.
* \param ReleaseCount The amount by which the semaphore object's count is to be increased.
* \param PreviousCount A pointer to a variable that receives the previous count of the semaphore object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReleaseSemaphore(
_In_ HANDLE SemaphoreHandle,
_In_ LONG ReleaseCount,
_Out_opt_ PLONG PreviousCount
);
/**
* The NtQuerySemaphore routine retrieves information about a semaphore object.
*
* \param SemaphoreHandle A handle to the semaphore object.
* \param SemaphoreInformationClass The type of information to be retrieved.
* \param SemaphoreInformation A pointer to a buffer that receives the requested information.
* \param SemaphoreInformationLength The size of the buffer pointed to by SemaphoreInformation.
* \param ReturnLength A pointer to a variable that receives the size of the data returned in the buffer.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySemaphore(
_In_ HANDLE SemaphoreHandle,
_In_ SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,
_Out_writes_bytes_(SemaphoreInformationLength) PVOID SemaphoreInformation,
_In_ ULONG SemaphoreInformationLength,
_Out_opt_ PULONG ReturnLength
);
//
// Timer
//
#ifndef TIMER_QUERY_STATE
#define TIMER_QUERY_STATE 0x0001
#endif
#ifndef TIMER_MODIFY_STATE
#define TIMER_MODIFY_STATE 0x0002
#endif
#ifndef TIMER_ALL_ACCESS
#define TIMER_ALL_ACCESS (TIMER_QUERY_STATE|TIMER_MODIFY_STATE|STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE)
#endif
typedef enum _TIMER_INFORMATION_CLASS
{
TimerBasicInformation // TIMER_BASIC_INFORMATION
} TIMER_INFORMATION_CLASS;
typedef enum _TIMER_SET_INFORMATION_CLASS
{
TimerSetCoalescableTimer, // TIMER_SET_COALESCABLE_TIMER_INFO
MaxTimerInfoClass
} TIMER_SET_INFORMATION_CLASS;
/**
* The TIMER_BASIC_INFORMATION structure contains basic information about a timer object.
*/
typedef struct _TIMER_BASIC_INFORMATION
{
LARGE_INTEGER RemainingTime;
BOOLEAN TimerState;
} TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION;
typedef _Function_class_(TIMER_APC_ROUTINE)
VOID NTAPI TIMER_APC_ROUTINE(
_In_ PVOID TimerContext,
_In_ ULONG TimerLowValue,
_In_ LONG TimerHighValue
);
typedef TIMER_APC_ROUTINE* PTIMER_APC_ROUTINE;
typedef struct _TIMER_SET_COALESCABLE_TIMER_INFO
{
_In_ LARGE_INTEGER DueTime;
_In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine;
_In_opt_ PVOID TimerContext;
_In_opt_ PCOUNTED_REASON_CONTEXT WakeContext;
_In_opt_ ULONG Period;
_In_ ULONG TolerableDelay;
_Out_opt_ PBOOLEAN PreviousState;
} TIMER_SET_COALESCABLE_TIMER_INFO, *PTIMER_SET_COALESCABLE_TIMER_INFO;
/**
* The NtCreateTimer routine creates a timer object.
*
* \param TimerHandle A pointer to a variable that receives the handle to the timer object.
* \param DesiredAccess The access mask that specifies the requested access to the timer object.
* \param ObjectAttributes A pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
* \param TimerType The type of the timer object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateTimer(
_Out_ PHANDLE TimerHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_ TIMER_TYPE TimerType
);
/**
* The NtOpenTimer routine opens a handle to an existing timer object.
*
* \param TimerHandle A pointer to a variable that receives the handle to the timer object.
* \param DesiredAccess The access mask that specifies the requested access to the timer object.
* \param ObjectAttributes A pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenTimer(
_Out_ PHANDLE TimerHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes
);
/**
* The NtSetTimer routine sets a timer object to the signaled state after a specified interval.
*
* \param TimerHandle A handle to the timer object.
* \param DueTime A pointer to a LARGE_INTEGER that specifies the absolute or relative time at which the timer is to be set to the signaled state.
* \param TimerApcRoutine An optional pointer to a function to be called when the timer is signaled.
* \param TimerContext An optional pointer to a context to be passed to the APC routine.
* \param ResumeTimer If TRUE, resumes the timer; otherwise, sets a new timer.
* \param Period The period of the timer, in milliseconds. If zero, the timer is signaled once.
* \param PreviousState A pointer to a variable that receives the previous state of the timer.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetTimer(
_In_ HANDLE TimerHandle,
_In_ PLARGE_INTEGER DueTime,
_In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine,
_In_opt_ PVOID TimerContext,
_In_ BOOLEAN ResumeTimer,
_In_opt_ LONG Period,
_Out_opt_ PBOOLEAN PreviousState
);
/**
* The NtSetTimerEx routine sets extended information for a timer object.
*
* \param TimerHandle A handle to the timer object.
* \param TimerSetInformationClass The class of information to set.
* \param TimerSetInformation A pointer to a buffer that contains the information to set.
* \param TimerSetInformationLength The size of the buffer, in bytes.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetTimerEx(
_In_ HANDLE TimerHandle,
_In_ TIMER_SET_INFORMATION_CLASS TimerSetInformationClass,
_Inout_updates_bytes_opt_(TimerSetInformationLength) PVOID TimerSetInformation,
_In_ ULONG TimerSetInformationLength
);
/**
* The NtCancelTimer routine Cancels a timer object.
*
* \param TimerHandle A handle to the timer object.
* \param CurrentState A pointer to a variable that receives the current state of the timer object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCancelTimer(
_In_ HANDLE TimerHandle,
_Out_opt_ PBOOLEAN CurrentState
);
/**
* The NtQueryTimer routine retrieves information about a timer object.
*
* \param TimerHandle A handle to the timer object.
* \param TimerInformationClass The class of information to retrieve.
* \param TimerInformation A pointer to a buffer that receives the requested information.
* \param TimerInformationLength The size of the buffer, in bytes.
* \param ReturnLength A pointer to a variable that receives the size of the data returned.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryTimer(
_In_ HANDLE TimerHandle,
_In_ TIMER_INFORMATION_CLASS TimerInformationClass,
_Out_writes_bytes_(TimerInformationLength) PVOID TimerInformation,
_In_ ULONG TimerInformationLength,
_Out_opt_ PULONG ReturnLength
);
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
// ExCheckValidIRTimerId
typedef enum _IR_TIMER_PROVIDER_INDEX
{
IR_TIMER_PROVIDER_TESTIDENTIFIER, // Token(Service SID)
IR_TIMER_PROVIDER_BROKERINFRASTRUCTURE, // Token(Service SID)
IR_TIMER_PROVIDER_TIMEBROKERSVC, // Token(Service SID)
IR_TIMER_PROVIDER_LFSVC,
IR_TIMER_PROVIDER_WINLOGON,
IR_TIMER_PROVIDER_POWER,
IR_TIMER_PROVIDER_SENSORSERVICE,
IR_TIMER_PROVIDER_NTOSPO,
IR_TIMER_PROVIDER_ACPI,
IR_TIMER_PROVIDER_BUTTON,
IR_TIMER_PROVIDER_MSGPIOCLX,
IR_TIMER_PROVIDER_BUTTONCONVERTER,
IR_TIMER_PROVIDER_MSGPIOWIN32,
IR_TIMER_PROVIDER_KNETPWRDEPBROKER,
IR_TIMER_PROVIDER_CMBATT,
IR_TIMER_PROVIDER_BTHPORT,
IR_TIMER_PROVIDER_AUDIOSRV, // TOKEN(SERVICE SID)
IR_TIMER_PROVIDER_ARTESTIDENTIFIER, // TOKEN(SERVICE SID)
IR_TIMER_PROVIDER_BATTC,
IR_TIMER_PROVIDER_MAXINDEX
} IR_TIMER_PROVIDER_INDEX;
//CONST USHORT IR_TIMER_PROVIDER_ID_MAX[] =
//{
// 1, // IR_TIMER_PROVIDER_TESTIDENTIFIER
// 1, // IR_TIMER_PROVIDER_BROKERINFRASTRUCTURE
// 1, // IR_TIMER_PROVIDER_TIMEBROKERSVC
// 11, // IR_TIMER_PROVIDER_LFSVC (0x0B)
// 1, // IR_TIMER_PROVIDER_WINLOGON
// 2, // IR_TIMER_PROVIDER_POWER
// 1, // IR_TIMER_PROVIDER_SENSORSERVICE
// 6, // IR_TIMER_PROVIDER_NTOSPO
// 1, // IR_TIMER_PROVIDER_ACPI
// 1, // IR_TIMER_PROVIDER_BUTTON
// 2, // MsGpioClx
// 1, // ButtonConverter
// 2, // MsGpioWin32
// 2, // KNetPwrDepBroker
// 1, // Cmbatt
// 2, // Bthport
// 1, // AudioSrv
// 1, // ArTestIdentifier
// 1 // Battc
//};
// rev
#define IR_TIMERID_PROVIDER(TimerId) ((USHORT)LOWORD((ULONG)(TimerId)))
#define IR_TIMERID_ID(TimerId) ((USHORT)HIWORD((ULONG)(TimerId)))
#define IR_TIMERID_IS_NONZERO(TimerId) (IR_TIMERID_PROVIDER(TimerId) != 0)
#define IR_TIMERID_ATTRIBUTES(ProviderIndex, ProviderId) \
((ULONG)MAKELONG((USHORT)(ProviderIndex), (USHORT)(ProviderId)))
/**
* The NtCreateIRTimer routine creates an IR timer object.
* IR timers are interruptdriven and designed for high-resolution timing in system components.
*
* \param TimerHandle A pointer to a variable that receives the handle to the IR timer object.
* \param TimerId A pointer to a timer identifier that specifies the provider.
* \param DesiredAccess The access mask that specifies the requested access to the timer object.
* \return NTSTATUS Successful or errant status.
* \remarks The TimerId must be non-NULL and point to a valid timer identifier.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateIRTimer(
_Out_ PHANDLE TimerHandle,
_In_ PULONG TimerId,
_In_ ACCESS_MASK DesiredAccess
);
/**
* The NtSetIRTimer routine sets an IR timer object.
*
* \param TimerHandle A handle to the IR timer object.
* \param DueTime An optional pointer to a LARGE_INTEGER that specifies
* the time at which the timer is to be set to the signaled state.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetIRTimer(
_In_ HANDLE TimerHandle,
_In_opt_ PLARGE_INTEGER DueTime
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_8)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
//
// NtCreateTimer2 Attributes
//
#define TIMER2_ATTRIBUTE_IR_TIMER 0x00000002UL
#define TIMER2_ATTRIBUTE_HIGH_RESOLUTION 0x00000004UL
#define TIMER2_ATTRIBUTE_NO_WAKE 0x00000008UL
#define TIMER2_ATTRIBUTE_NOTIFICATION 0x80000000UL
// rev
#define TIMER2_ATTRIBUTE_KNOWN_MASK (TIMER2_ATTRIBUTE_IR_TIMER | TIMER2_ATTRIBUTE_HIGH_RESOLUTION | TIMER2_ATTRIBUTE_NO_WAKE | TIMER2_ATTRIBUTE_NOTIFICATION)
#define TIMER2_ATTRIBUTE_RESERVED_MASK (~TIMER2_ATTRIBUTE_KNOWN_MASK)
#define TIMER2_ATTRIBUTE_FOR_TYPE(T) \
(((T) == NotificationTimer) ? TIMER2_ATTRIBUTE_NOTIFICATION : 0)
// Build attributes for a *non-IR* timer
// - T: TIMER_TYPE (NotificationTimer/SynchronizationTimer)
// - R: bool for HighResolution
//
#define TIMER2_BUILD_ATTRIBUTES(T, R) \
(TIMER2_ATTRIBUTE_FOR_TYPE(T) | ((R) ? TIMER2_ATTRIBUTE_HIGH_RESOLUTION : 0))
// Build attributes for an *IR* timer
// - R: bool for HighResolution
//
#define TIMER2_BUILD_IR_ATTRIBUTES(R) \
(TIMER2_ATTRIBUTE_IR_TIMER | ((R) ? TIMER2_ATTRIBUTE_HIGH_RESOLUTION : 0))
// rev
typedef union _TIMER2_ATTRIBUTES
{
ULONG Value;
struct
{
ULONG Reserved0 : 1; // bit 0 (reserved)
ULONG IrTimer : 1; // bit 1 == TIMER2_ATTRIBUTE_IR_TIMER
ULONG HighResolution : 1; // bit 2 == TIMER2_ATTRIBUTE_HIGH_RESOLUTION
ULONG NoWake : 1; // bit 3 == TIMER2_ATTRIBUTE_NO_WAKE
ULONG Reserved1 : 27; // bits [4..30] (reserved)
TIMER_TYPE NotificationType : 1; // bit 31 == TIMER2_ATTRIBUTE_NOTIFICATION
};
} TIMER2_ATTRIBUTES;
/**
* The NtCreateTimer2 routine creates a timer object.
*
* \param TimerHandle A pointer to a variable that receives the handle to the timer object.
* \param TimerId For IR timers: A pointer to ULONG TIMERID (non-NULL). For non-IR timers: must be NULL.
* \param ObjectAttributes A pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
* \param Attributes Timer attributes (TIMER_TYPE).
* \param DesiredAccess The access mask that specifies the requested access to the timer object.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-createwaitabletimerexw
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateTimer2(
_Out_ PHANDLE TimerHandle,
_In_opt_ PULONG TimerId,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG Attributes,
_In_ ACCESS_MASK DesiredAccess
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_10)
// rev
#define TIMER2_SET_PARAMETERS_CURRENT_VERSION 0
// rev
/**
* The T2_SET_PARAMETERS structure configures the high-resolution or coalescable timers,
* and specify a "no-wake tolerance" value, which controls how much the kernel
* may delay the timers for coalescing or power efficiency.
* \remarks Setting NoWakeTolerance to 0 requests **no coalescing** and the most precise
* wake-up behavior the system can provide.
*/
typedef struct _T2_SET_PARAMETERS_V0
{
/**
* Structure version. Must be set to zero.
*/
ULONG Version;
/**
* Reserved.
*/
ULONG Reserved;
/**
* Maximum tolerable delay (in 100-ns units) for timer coalescing.
* - Set to 0 for **no coalescing** (strict wake-up).
* - Set to a positive value to allow the kernel to delay the timer
* by up to this amount for power efficiency.
* Example:
* If NoWakeTolerance = 0 --> High-resolution, best precision, min jitter, zero coalescing, low power savings.
* If NoWakeTolerance > 0 --> Normal-resolution, allow up to this value of coalescing, normal power savings.
* If NoWakeTolerance = -1 --> Low-resolution, worst precision, max jitter, max coalescing, max power savings.
*/
LONGLONG NoWakeTolerance;
} T2_SET_PARAMETERS, *PT2_SET_PARAMETERS;
typedef PVOID PT2_CANCEL_PARAMETERS;
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
/**
* The NtSetTimer2 routine activates the timer object for a specified interval with optional periodic behavior.
*
* \param TimerHandle A handle to the timer object to set.
* \param DueTime A pointer to a LARGE_INTEGER specifying the absolute or relative time when the timer should expire.
* \param Period An optional pointer to a LARGE_INTEGER specifying the period for periodic timer notifications, in 100-nanosecond intervals. If NULL, the timer is non-periodic.
* \param Parameters A pointer to a T2_SET_PARAMETERS structure containing additional timer configuration parameters.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-setwaitabletimer
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetTimer2(
_In_ HANDLE TimerHandle,
_In_ PLARGE_INTEGER DueTime,
_In_opt_ PLARGE_INTEGER Period,
_In_opt_ PT2_SET_PARAMETERS Parameters
);
/**
* The NtCancelTimer2 routine sets the specified waitable timer to the inactive state.
*
* \param TimerHandle A handle to the timer object to set.
* \param Parameters A pointer to a PT2_CANCEL_PARAMETERS structure containing additional parameters.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-cancelwaitabletimer
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCancelTimer2(
_In_ HANDLE TimerHandle,
_In_ PT2_CANCEL_PARAMETERS Parameters
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_10)
//
// Profile
//
#define PROFILE_CONTROL 0x0001
#define PROFILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | PROFILE_CONTROL)
/**
* The NtCreateProfile routine creates a profile object for performance monitoring.
*
* \param ProfileHandle A pointer to a variable that receives the handle to the profile object.
* \param Process Optional handle to the process to be profiled. If NULL, the current process is used.
* \param ProfileBase The base address of the region to be profiled.
* \param ProfileSize The size, in bytes, of the region to be profiled.
* \param BucketSize The size, in bytes, of each bucket in the profile buffer.
* \param Buffer A pointer to a buffer that receives the profile data.
* \param BufferSize The size, in bytes, of the buffer.
* \param ProfileSource The source of the profiling data (KPROFILE_SOURCE).
* \param Affinity The processor affinity mask indicating which processors to profile.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateProfile(
_Out_ PHANDLE ProfileHandle,
_In_opt_ HANDLE Process,
_In_ PVOID ProfileBase,
_In_ SIZE_T ProfileSize,
_In_ ULONG BucketSize,
_In_reads_bytes_(BufferSize) PULONG Buffer,
_In_ ULONG BufferSize,
_In_ KPROFILE_SOURCE ProfileSource,
_In_ KAFFINITY Affinity
);
/**
* The NtCreateProfileEx routine creates a profile object for performance monitoring with group affinity.
*
* \param ProfileHandle A pointer to a variable that receives the handle to the profile object.
* \param Process Optional handle to the process to be profiled. If NULL, the current process is used.
* \param ProfileBase The base address of the region to be profiled.
* \param ProfileSize The size, in bytes, of the region to be profiled.
* \param BucketSize The size, in bytes, of each bucket in the profile buffer.
* \param Buffer A pointer to a buffer that receives the profile data.
* \param BufferSize The size, in bytes, of the buffer.
* \param ProfileSource The source of the profiling data (KPROFILE_SOURCE).
* \param GroupCount The number of group affinities provided.
* \param GroupAffinity A pointer to an array of GROUP_AFFINITY structures specifying processor groups to profile.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateProfileEx(
_Out_ PHANDLE ProfileHandle,
_In_opt_ HANDLE Process,
_In_ PVOID ProfileBase,
_In_ SIZE_T ProfileSize,
_In_ ULONG BucketSize,
_In_reads_bytes_(BufferSize) PULONG Buffer,
_In_ ULONG BufferSize,
_In_ KPROFILE_SOURCE ProfileSource,
_In_ USHORT GroupCount,
_In_reads_(GroupCount) PGROUP_AFFINITY GroupAffinity
);
/**
* The NtStartProfile routine starts the specified profile object.
*
* \param ProfileHandle A handle to the profile object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtStartProfile(
_In_ HANDLE ProfileHandle
);
/**
* The NtStopProfile routine stops the specified profile object.
*
* \param ProfileHandle A handle to the profile object.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtStopProfile(
_In_ HANDLE ProfileHandle
);
/**
* The NtQueryIntervalProfile routine retrieves the interval for the specified profile source.
*
* \param ProfileSource The profile source (KPROFILE_SOURCE) to query.
* \param Interval A pointer to a variable that receives the interval, in 100-nanosecond units.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryIntervalProfile(
_In_ KPROFILE_SOURCE ProfileSource,
_Out_ PULONG Interval
);
/**
* The NtSetIntervalProfile routine sets the interval for the specified profile source.
*
* \param Interval The interval, in 100-nanosecond units, to set.
* \param Source The profile source (KPROFILE_SOURCE) to set the interval for.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetIntervalProfile(
_In_ ULONG Interval,
_In_ KPROFILE_SOURCE Source
);
//
// Keyed Event
//
#define KEYEDEVENT_WAIT 0x0001
#define KEYEDEVENT_WAKE 0x0002
#define KEYEDEVENT_ALL_ACCESS \
(STANDARD_RIGHTS_REQUIRED | KEYEDEVENT_WAIT | KEYEDEVENT_WAKE)
/**
* The NtCreateKeyedEvent routine creates a keyed event object and returns a handle to it.
*
* \param KeyedEventHandle A pointer to a variable that receives the handle to the keyed event object.
* \param DesiredAccess The access mask that specifies the requested access to the keyed event object.
* \param ObjectAttributes A pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
* \param Flags Reserved. Must be zero.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateKeyedEvent(
_Out_ PHANDLE KeyedEventHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_Reserved_ ULONG Flags
);
/**
* The NtOpenKeyedEvent routine opens a handle to an existing keyed event object.
*
* \param KeyedEventHandle A pointer to a variable that receives the handle to the keyed event object.
* \param DesiredAccess The access mask that specifies the requested access to the keyed event object.
* \param ObjectAttributes A pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenKeyedEvent(
_Out_ PHANDLE KeyedEventHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes
);
/**
* The NtReleaseKeyedEvent routine releases a thread that is waiting on a keyed event with the specified key value.
*
* \param KeyedEventHandle Optional handle to the keyed event object. If NULL, the default keyed event is used.
* \param KeyValue The key value that identifies the waiting thread to release.
* \param Alertable Specifies whether the call is alertable (can be interrupted by APCs).
* \param Timeout Optional pointer to a timeout value (in 100-nanosecond intervals). If NULL, waits indefinitely.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReleaseKeyedEvent(
_In_opt_ HANDLE KeyedEventHandle,
_In_ PVOID KeyValue,
_In_ BOOLEAN Alertable,
_In_opt_ PLARGE_INTEGER Timeout
);
/**
* The NtWaitForKeyedEvent routine waits for a keyed event to be released with the specified key value.
*
* \param KeyedEventHandle Optional handle to the keyed event object. If NULL, the default keyed event is used.
* \param KeyValue The key value to wait for.
* \param Alertable Specifies whether the call is alertable (can be interrupted by APCs).
* \param Timeout Optional pointer to a timeout value (in 100-nanosecond intervals). If NULL, waits indefinitely.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForKeyedEvent(
_In_opt_ HANDLE KeyedEventHandle,
_In_ PVOID KeyValue,
_In_ BOOLEAN Alertable,
_In_opt_ PLARGE_INTEGER Timeout
);
//
// UMS
//
/**
* The NtUmsThreadYield routine yields control to the user-mode scheduling (UMS) scheduler thread on which the calling UMS worker thread is running.
* Note: As of Windows 11, user-mode scheduling is not supported. All calls fail with the error STATUS_NOT_SUPPORTED.
*
* \param SchedulerParam Optional handle to the keyed event object. If NULL, the default keyed event is used.
* \return NTSTATUS Successful or errant status.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-umsthreadyield
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUmsThreadYield(
_In_ PVOID SchedulerParam
);
//
// WNF
//
// begin_private
typedef struct _WNF_STATE_NAME
{
union
{
ULONGLONG Value;
ULONG Data[2];
struct
{
ULONG64 Version : 4;
ULONG64 NameLifetime : 2;
ULONG64 DataScope : 4;
ULONG64 PermanentData : 1;
ULONG64 Unique : 53;
};
};
} WNF_STATE_NAME, *PWNF_STATE_NAME;
typedef const WNF_STATE_NAME *PCWNF_STATE_NAME;
typedef enum _WNF_STATE_NAME_LIFETIME
{
WnfWellKnownStateName,
WnfPermanentStateName,
WnfPersistentStateName,
WnfTemporaryStateName
} WNF_STATE_NAME_LIFETIME;
typedef enum _WNF_STATE_NAME_INFORMATION
{
WnfInfoStateNameExist,
WnfInfoSubscribersPresent,
WnfInfoIsQuiescent
} WNF_STATE_NAME_INFORMATION;
typedef enum _WNF_DATA_SCOPE
{
WnfDataScopeSystem,
WnfDataScopeSession,
WnfDataScopeUser,
WnfDataScopeProcess,
WnfDataScopeMachine, // REDSTONE3
WnfDataScopePhysicalMachine, // WIN11
} WNF_DATA_SCOPE;
typedef struct _WNF_TYPE_ID
{
GUID TypeId;
} WNF_TYPE_ID, *PWNF_TYPE_ID;
typedef const WNF_TYPE_ID *PCWNF_TYPE_ID;
// rev
typedef ULONG WNF_CHANGE_STAMP, *PWNF_CHANGE_STAMP;
typedef struct _WNF_DELIVERY_DESCRIPTOR
{
ULONGLONG SubscriptionId;
WNF_STATE_NAME StateName;
WNF_CHANGE_STAMP ChangeStamp;
ULONG StateDataSize;
ULONG EventMask;
WNF_TYPE_ID TypeId;
ULONG StateDataOffset;
} WNF_DELIVERY_DESCRIPTOR, *PWNF_DELIVERY_DESCRIPTOR;
// end_private
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
/**
* The NtCreateWnfStateName routine creates a new WNF (Windows Notification Facility) state name.
*
* \param StateName Pointer to a WNF_STATE_NAME structure that receives the created state name.
* \param NameLifetime The lifetime of the state name (see WNF_STATE_NAME_LIFETIME).
* \param DataScope The data scope for the state name (see WNF_DATA_SCOPE).
* \param PersistData If TRUE, the state data is persistent.
* \param TypeId Optional pointer to a WNF_TYPE_ID structure specifying the type of the state data.
* \param MaximumStateSize The maximum size, in bytes, of the state data.
* \param SecurityDescriptor Pointer to a security descriptor for the state name.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateWnfStateName(
_Out_ PWNF_STATE_NAME StateName,
_In_ WNF_STATE_NAME_LIFETIME NameLifetime,
_In_ WNF_DATA_SCOPE DataScope,
_In_ BOOLEAN PersistData,
_In_opt_ PCWNF_TYPE_ID TypeId,
_In_ ULONG MaximumStateSize,
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor
);
/**
* The NtDeleteWnfStateName routine deletes an existing WNF state name.
*
* \param StateName Pointer to the WNF_STATE_NAME to delete.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteWnfStateName(
_In_ PCWNF_STATE_NAME StateName
);
/**
* The NtUpdateWnfStateData routine updates the data associated with a WNF state name.
*
* \param StateName Pointer to the WNF_STATE_NAME to update.
* \param Buffer Pointer to the data buffer to write.
* \param Length Length, in bytes, of the data buffer.
* \param TypeId Optional pointer to a WNF_TYPE_ID structure specifying the type of the state data.
* \param ExplicitScope Optional pointer to a security identifier (SID) for explicit scope.
* \param MatchingChangeStamp The change stamp to match for update.
* \param CheckStamp If TRUE, the change stamp is checked before updating.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUpdateWnfStateData(
_In_ PCWNF_STATE_NAME StateName,
_In_reads_bytes_opt_(Length) const VOID* Buffer,
_In_opt_ ULONG Length,
_In_opt_ PCWNF_TYPE_ID TypeId,
_In_opt_ PCSID ExplicitScope,
_In_ WNF_CHANGE_STAMP MatchingChangeStamp,
_In_ LOGICAL CheckStamp
);
/**
* The NtDeleteWnfStateData routine deletes the data associated with a WNF state name.
*
* \param StateName Pointer to the WNF_STATE_NAME whose data is to be deleted.
* \param ExplicitScope Optional pointer to a security identifier (SID) for explicit scope.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteWnfStateData(
_In_ PCWNF_STATE_NAME StateName,
_In_opt_ PCSID ExplicitScope
);
/**
* The NtQueryWnfStateData routine queries the data associated with a WNF state name.
*
* \param StateName Pointer to the WNF_STATE_NAME to query.
* \param TypeId Optional pointer to a WNF_TYPE_ID structure specifying the type of the state data.
* \param ExplicitScope Optional pointer to a security identifier (SID) for explicit scope.
* \param ChangeStamp Pointer to a variable that receives the change stamp.
* \param Buffer Pointer to a buffer that receives the state data.
* \param BufferLength On input, the size of the buffer in bytes; on output, the number of bytes written.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryWnfStateData(
_In_ PCWNF_STATE_NAME StateName,
_In_opt_ PCWNF_TYPE_ID TypeId,
_In_opt_ PCSID ExplicitScope,
_Out_ PWNF_CHANGE_STAMP ChangeStamp,
_Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
_Inout_ PULONG BufferLength
);
/**
* The NtQueryWnfStateNameInformation routine queries information about a WNF state name.
*
* \param StateName Pointer to the WNF_STATE_NAME to query.
* \param NameInfoClass The information class to query (see WNF_STATE_NAME_INFORMATION).
* \param ExplicitScope Optional pointer to a security identifier (SID) for explicit scope.
* \param Buffer Pointer to a buffer that receives the requested information.
* \param BufferLength The size, in bytes, of the buffer.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryWnfStateNameInformation(
_In_ PCWNF_STATE_NAME StateName,
_In_ WNF_STATE_NAME_INFORMATION NameInfoClass,
_In_opt_ PCSID ExplicitScope,
_Out_writes_bytes_(BufferLength) PVOID Buffer,
_In_ ULONG BufferLength
);
/**
* The NtSubscribeWnfStateChange routine subscribes to state change notifications for a WNF state name.
*
* \param StateName Pointer to the WNF_STATE_NAME to subscribe to.
* \param ChangeStamp Optional change stamp to start receiving notifications from.
* \param EventMask Bitmask specifying which events to subscribe to.
* \param SubscriptionId Optional pointer to a variable that receives the subscription ID.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSubscribeWnfStateChange(
_In_ PCWNF_STATE_NAME StateName,
_In_opt_ WNF_CHANGE_STAMP ChangeStamp,
_In_ ULONG EventMask,
_Out_opt_ PULONG64 SubscriptionId
);
/**
* The NtUnsubscribeWnfStateChange routine unsubscribes from state change notifications for a WNF state name.
*
* \param StateName Pointer to the WNF_STATE_NAME to unsubscribe from.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUnsubscribeWnfStateChange(
_In_ PCWNF_STATE_NAME StateName
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_8)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
/**
* The NtGetCompleteWnfStateSubscription routine retrieves the complete WNF state subscription information.
*
* \param OldDescriptorStateName Optional pointer to the previous state name.
* \param OldSubscriptionId Optional pointer to the previous subscription ID.
* \param OldDescriptorEventMask Optional previous event mask.
* \param OldDescriptorStatus Optional previous descriptor status.
* \param NewDeliveryDescriptor Pointer to a buffer that receives the new delivery descriptor.
* \param DescriptorSize The size, in bytes, of the delivery descriptor buffer.
* \return NTSTATUS code indicating success or failure.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtGetCompleteWnfStateSubscription(
_In_opt_ PWNF_STATE_NAME OldDescriptorStateName,
_In_opt_ ULONG64 *OldSubscriptionId,
_In_opt_ ULONG OldDescriptorEventMask,
_In_opt_ ULONG OldDescriptorStatus,
_Out_writes_bytes_(DescriptorSize) PWNF_DELIVERY_DESCRIPTOR NewDeliveryDescriptor,
_In_ ULONG DescriptorSize
);
/**
* The NtSetWnfProcessNotificationEvent routine sets a process notification event for WNF state changes.
*
* \param NotificationEvent Handle to the event object to be signaled on state change.
* \return NTSTATUS code indicating success or failure.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetWnfProcessNotificationEvent(
_In_ HANDLE NotificationEvent
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_10)
//
// Worker factory
//
// begin_rev
#define WORKER_FACTORY_RELEASE_WORKER 0x0001
#define WORKER_FACTORY_WAIT 0x0002
#define WORKER_FACTORY_SET_INFORMATION 0x0004
#define WORKER_FACTORY_QUERY_INFORMATION 0x0008
#define WORKER_FACTORY_READY_WORKER 0x0010
#define WORKER_FACTORY_SHUTDOWN 0x0020
#define WORKER_FACTORY_ALL_ACCESS ( \
STANDARD_RIGHTS_REQUIRED | \
WORKER_FACTORY_RELEASE_WORKER | \
WORKER_FACTORY_WAIT | \
WORKER_FACTORY_SET_INFORMATION | \
WORKER_FACTORY_QUERY_INFORMATION | \
WORKER_FACTORY_READY_WORKER | \
WORKER_FACTORY_SHUTDOWN \
)
// end_rev
// begin_private
typedef enum _WORKERFACTORYINFOCLASS
{
WorkerFactoryTimeout, // LARGE_INTEGER
WorkerFactoryRetryTimeout, // LARGE_INTEGER
WorkerFactoryIdleTimeout, // s: LARGE_INTEGER
WorkerFactoryBindingCount, // s: ULONG
WorkerFactoryThreadMinimum, // s: ULONG
WorkerFactoryThreadMaximum, // s: ULONG
WorkerFactoryPaused, // ULONG or BOOLEAN
WorkerFactoryBasicInformation, // q: WORKER_FACTORY_BASIC_INFORMATION
WorkerFactoryAdjustThreadGoal,
WorkerFactoryCallbackType,
WorkerFactoryStackInformation, // 10
WorkerFactoryThreadBasePriority, // s: ULONG
WorkerFactoryTimeoutWaiters, // s: ULONG, since THRESHOLD
WorkerFactoryFlags, // s: ULONG
WorkerFactoryThreadSoftMaximum, // s: ULONG
WorkerFactoryThreadCpuSets, // since REDSTONE5
MaxWorkerFactoryInfoClass
} WORKERFACTORYINFOCLASS, *PWORKERFACTORYINFOCLASS;
typedef struct _WORKER_FACTORY_BASIC_INFORMATION
{
LARGE_INTEGER Timeout;
LARGE_INTEGER RetryTimeout;
LARGE_INTEGER IdleTimeout;
BOOLEAN Paused;
BOOLEAN TimerSet;
BOOLEAN QueuedToExWorker;
BOOLEAN MayCreate;
BOOLEAN CreateInProgress;
BOOLEAN InsertedIntoQueue;
BOOLEAN Shutdown;
ULONG BindingCount;
ULONG ThreadMinimum;
ULONG ThreadMaximum;
ULONG PendingWorkerCount;
ULONG WaitingWorkerCount;
ULONG TotalWorkerCount;
ULONG ReleaseCount;
LONGLONG InfiniteWaitGoal;
PVOID StartRoutine;
PVOID StartParameter;
HANDLE ProcessId;
SIZE_T StackReserve;
SIZE_T StackCommit;
NTSTATUS LastThreadCreationStatus;
} WORKER_FACTORY_BASIC_INFORMATION, *PWORKER_FACTORY_BASIC_INFORMATION;
// end_private
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateWorkerFactory(
_Out_ PHANDLE WorkerFactoryHandleReturn,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_ HANDLE CompletionPortHandle,
_In_ HANDLE WorkerProcessHandle,
_In_ PVOID StartRoutine,
_In_opt_ PVOID StartParameter,
_In_opt_ ULONG MaxThreadCount,
_In_opt_ SIZE_T StackReserve,
_In_opt_ SIZE_T StackCommit
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationWorkerFactory(
_In_ HANDLE WorkerFactoryHandle,
_In_ WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,
_Out_writes_bytes_(WorkerFactoryInformationLength) PVOID WorkerFactoryInformation,
_In_ ULONG WorkerFactoryInformationLength,
_Out_opt_ PULONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationWorkerFactory(
_In_ HANDLE WorkerFactoryHandle,
_In_ WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,
_In_reads_bytes_(WorkerFactoryInformationLength) PVOID WorkerFactoryInformation,
_In_ ULONG WorkerFactoryInformationLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtShutdownWorkerFactory(
_In_ HANDLE WorkerFactoryHandle,
_Inout_ volatile LONG *PendingWorkerCount
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReleaseWorkerFactoryWorker(
_In_ HANDLE WorkerFactoryHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWorkerFactoryWorkerReady(
_In_ HANDLE WorkerFactoryHandle
);
typedef struct _WORKER_FACTORY_DEFERRED_WORK
{
PPORT_MESSAGE AlpcSendMessage;
PVOID AlpcSendMessagePort;
ULONG AlpcSendMessageFlags;
ULONG Flags;
} WORKER_FACTORY_DEFERRED_WORK, *PWORKER_FACTORY_DEFERRED_WORK;
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForWorkViaWorkerFactory(
_In_ HANDLE WorkerFactoryHandle,
_Out_writes_to_(Count, *PacketsReturned) PFILE_IO_COMPLETION_INFORMATION MiniPackets,
_In_ ULONG Count,
_Out_ PULONG PacketsReturned,
_In_ PVOID DeferredWork // PWORKER_FACTORY_DEFERRED_WORK
);
#else
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForWorkViaWorkerFactory(
_In_ HANDLE WorkerFactoryHandle,
_Out_ PFILE_IO_COMPLETION_INFORMATION MiniPacket
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_8)
//
// Time
//
/**
* The NtQuerySystemTime routine obtains the current system time.
*
* \param SystemTime A pointer to a LARGE_INTEGER structure that receives the system time. This is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntquerysystemtime
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySystemTime(
_Out_ PLARGE_INTEGER SystemTime
);
/**
* The NtSetSystemTime routine sets the current system time and date. The system time is expressed in Coordinated Universal Time (UTC).
*
* \param SystemTime A pointer to a LARGE_INTEGER structure that that contains the new system date and time.
* \param PreviousTime A pointer to a LARGE_INTEGER structure that that contains the previous system time.
* \return NTSTATUS Successful or errant status.
* \remarks The calling process must have the SE_SYSTEMTIME_NAME privilege.
* \see https://learn.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-setsystemtime
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetSystemTime(
_In_opt_ PLARGE_INTEGER SystemTime,
_Out_opt_ PLARGE_INTEGER PreviousTime
);
/**
* The NtQueryTimerResolution routine retrieves the range and current value of the system interrupt timer.
*
* \param MaximumTime The maximum timer resolution, in 100-nanosecond units.
* \param MinimumTime The minimum timer resolution, in 100-nanosecond units.
* \param CurrentTime The current timer resolution, in 100-nanosecond units.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryTimerResolution(
_Out_ PULONG MaximumTime,
_Out_ PULONG MinimumTime,
_Out_ PULONG CurrentTime
);
/**
* The NtSetTimerResolution routine sets the system interrupt timer resolution to the specified value.
*
* \param DesiredTime The desired timer resolution, in 100-nanosecond units.
* \param SetResolution If TRUE, the timer resolution is set to the value specified by DesiredTime. If FALSE, the timer resolution is reset to the default value.
* \param ActualTime The actual timer resolution, in 100-nanosecond units.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetTimerResolution(
_In_ ULONG DesiredTime,
_In_ BOOLEAN SetResolution,
_Out_ PULONG ActualTime
);
//
// Performance Counters
//
/**
* The NtQueryPerformanceCounter routine retrieves the current value of the performance counter,
* which is a high resolution (<1us) time stamp that can be used for time-interval measurements.
*
* \param PerformanceCounter A pointer to a variable that receives the current performance-counter value, in 100-nanosecond units.
* \param PerformanceFrequency A pointer to a variable that receives the current performance-frequency value, in 100-nanosecond units.
* \return NTSTATUS Successful or errant status.
* \remarks On systems that run Windows XP or later, the function will always succeed and will thus never return zero. Use RtlQueryPerformanceCounter instead since no system calls are required.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/profileapi/nf-profileapi-queryperformancecounter
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryPerformanceCounter(
_Out_ PLARGE_INTEGER PerformanceCounter,
_Out_opt_ PLARGE_INTEGER PerformanceFrequency
);
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS2)
// rev
/**
* The NtQueryAuxiliaryCounterFrequency routine queries the auxiliary counter frequency. (The auxiliary counter is generally the HPET hardware timer).
*
* \param AuxiliaryCounterFrequency A pointer to an output buffer that contains the specified auxiliary counter frequency. If the auxiliary counter is not supported, the value in the output buffer will be undefined.
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows/win32/api/realtimeapiset/nf-realtimeapiset-queryauxiliarycounterfrequency
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryAuxiliaryCounterFrequency(
_Out_ PULONG64 AuxiliaryCounterFrequency
);
// rev
/**
* The NtConvertBetweenAuxiliaryCounterAndPerformanceCounter routine converts the specified performance counter value to the corresponding auxiliary counter value;
* optionally provides the estimated conversion error in nanoseconds due to latencies and maximum possible drift.
*
* \param ConvertAuxiliaryToPerformanceCounter If TRUE, the value will be converted from AUX to QPC. If FALSE, the value will be converted from QPC to AUX.
* \param PerformanceOrAuxiliaryCounterValue The performance counter value to convert.
* \param ConvertedValue On success, contains the converted auxiliary counter value. Will be undefined if the function fails.
* \param ConversionError On success, contains the estimated conversion error, in nanoseconds. Will be undefined if the function fails.
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows/win32/api/realtimeapiset/nf-realtimeapiset-convertperformancecountertoauxiliarycounter
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter(
_In_ BOOLEAN ConvertAuxiliaryToPerformanceCounter,
_In_ PULONG64 PerformanceOrAuxiliaryCounterValue,
_Out_ PULONG64 ConvertedValue,
_Out_opt_ PULONG64 ConversionError
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_10_RS2)
//
// LUIDs
//
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAllocateLocallyUniqueId(
_Out_ PLUID Luid
);
//
// UUIDs
//
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetUuidSeed(
_In_ PCHAR Seed
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAllocateUuids(
_Out_ PULARGE_INTEGER Time,
_Out_ PULONG Range,
_Out_ PULONG Sequence,
_Out_ PCHAR Seed
);
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
//
// System Information
//
// rev
// private
typedef enum _SYSTEM_INFORMATION_CLASS
{
SystemBasicInformation, // q: SYSTEM_BASIC_INFORMATION
SystemProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION
SystemPerformanceInformation, // q: SYSTEM_PERFORMANCE_INFORMATION
SystemTimeOfDayInformation, // q: SYSTEM_TIMEOFDAY_INFORMATION
SystemPathInformation, // q: not implemented
SystemProcessInformation, // q: SYSTEM_PROCESS_INFORMATION
SystemCallCountInformation, // q: SYSTEM_CALL_COUNT_INFORMATION
SystemDeviceInformation, // q: SYSTEM_DEVICE_INFORMATION
SystemProcessorPerformanceInformation, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION (EX in: USHORT ProcessorGroup)
SystemFlagsInformation, // qs: SYSTEM_FLAGS_INFORMATION
SystemCallTimeInformation, // q: SYSTEM_CALL_TIME_INFORMATION // not implemented // 10
SystemModuleInformation, // q: RTL_PROCESS_MODULES
SystemLocksInformation, // q: RTL_PROCESS_LOCKS
SystemStackTraceInformation, // q: RTL_PROCESS_BACKTRACES
SystemPagedPoolInformation, // q: not implemented
SystemNonPagedPoolInformation, // q: not implemented
SystemHandleInformation, // q: SYSTEM_HANDLE_INFORMATION
SystemObjectInformation, // q: SYSTEM_OBJECTTYPE_INFORMATION mixed with SYSTEM_OBJECT_INFORMATION
SystemPageFileInformation, // q: SYSTEM_PAGEFILE_INFORMATION
SystemVdmInstemulInformation, // q: SYSTEM_VDM_INSTEMUL_INFO
SystemVdmBopInformation, // q: not implemented // 20
SystemFileCacheInformation, // qs: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemCache)
SystemPoolTagInformation, // q: SYSTEM_POOLTAG_INFORMATION
SystemInterruptInformation, // q: SYSTEM_INTERRUPT_INFORMATION (EX in: USHORT ProcessorGroup)
SystemDpcBehaviorInformation, // qs: SYSTEM_DPC_BEHAVIOR_INFORMATION; s: SYSTEM_DPC_BEHAVIOR_INFORMATION (requires SeLoadDriverPrivilege)
SystemFullMemoryInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION // not implemented
SystemLoadGdiDriverInformation, // s: (kernel-mode only)
SystemUnloadGdiDriverInformation, // s: (kernel-mode only)
SystemTimeAdjustmentInformation, // qs: SYSTEM_QUERY_TIME_ADJUST_INFORMATION; s: SYSTEM_SET_TIME_ADJUST_INFORMATION (requires SeSystemtimePrivilege)
SystemSummaryMemoryInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION // not implemented
SystemMirrorMemoryInformation, // qs: (requires license value "Kernel-MemoryMirroringSupported") (requires SeShutdownPrivilege) // 30
SystemPerformanceTraceInformation, // qs: (type depends on EVENT_TRACE_INFORMATION_CLASS)
SystemObsolete0, // q: not implemented
SystemExceptionInformation, // q: SYSTEM_EXCEPTION_INFORMATION
SystemCrashDumpStateInformation, // s: SYSTEM_CRASH_DUMP_STATE_INFORMATION (requires SeDebugPrivilege)
SystemKernelDebuggerInformation, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION
SystemContextSwitchInformation, // q: SYSTEM_CONTEXT_SWITCH_INFORMATION
SystemRegistryQuotaInformation, // qs: SYSTEM_REGISTRY_QUOTA_INFORMATION; s (requires SeIncreaseQuotaPrivilege)
SystemExtendServiceTableInformation, // s: (requires SeLoadDriverPrivilege) // loads win32k only
SystemPrioritySeparation, // s: (requires SeTcbPrivilege)
SystemVerifierAddDriverInformation, // s: UNICODE_STRING (requires SeDebugPrivilege) // 40
SystemVerifierRemoveDriverInformation, // s: UNICODE_STRING (requires SeDebugPrivilege)
SystemProcessorIdleInformation, // q: SYSTEM_PROCESSOR_IDLE_INFORMATION (EX in: USHORT ProcessorGroup)
SystemLegacyDriverInformation, // q: SYSTEM_LEGACY_DRIVER_INFORMATION
SystemCurrentTimeZoneInformation, // qs: RTL_TIME_ZONE_INFORMATION
SystemLookasideInformation, // q: SYSTEM_LOOKASIDE_INFORMATION
SystemTimeSlipNotification, // s: HANDLE (NtCreateEvent) (requires SeSystemtimePrivilege)
SystemSessionCreate, // q: not implemented
SystemSessionDetach, // q: not implemented
SystemSessionInformation, // q: not implemented (SYSTEM_SESSION_INFORMATION)
SystemRangeStartInformation, // q: SYSTEM_RANGE_START_INFORMATION // 50
SystemVerifierInformation, // qs: SYSTEM_VERIFIER_INFORMATION; s (requires SeDebugPrivilege)
SystemVerifierThunkExtend, // qs: (kernel-mode only)
SystemSessionProcessInformation, // q: SYSTEM_SESSION_PROCESS_INFORMATION
SystemLoadGdiDriverInSystemSpace, // qs: SYSTEM_GDI_DRIVER_INFORMATION (kernel-mode only) (same as SystemLoadGdiDriverInformation)
SystemNumaProcessorMap, // q: SYSTEM_NUMA_INFORMATION
SystemPrefetcherInformation, // qs: PREFETCHER_INFORMATION // PfSnQueryPrefetcherInformation
SystemExtendedProcessInformation, // q: SYSTEM_EXTENDED_PROCESS_INFORMATION
SystemRecommendedSharedDataAlignment, // q: ULONG // KeGetRecommendedSharedDataAlignment
SystemComPlusPackage, // qs: ULONG
SystemNumaAvailableMemory, // q: SYSTEM_NUMA_INFORMATION // 60
SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION (EX in: USHORT ProcessorGroup)
SystemEmulationBasicInformation, // q: SYSTEM_BASIC_INFORMATION
SystemEmulationProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION
SystemExtendedHandleInformation, // q: SYSTEM_HANDLE_INFORMATION_EX
SystemLostDelayedWriteInformation, // q: ULONG
SystemBigPoolInformation, // q: SYSTEM_BIGPOOL_INFORMATION
SystemSessionPoolTagInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION
SystemSessionMappedViewInformation, // q: SYSTEM_SESSION_MAPPED_VIEW_INFORMATION
SystemHotpatchInformation, // qs: SYSTEM_HOTPATCH_CODE_INFORMATION
SystemObjectSecurityMode, // q: ULONG // 70
SystemWatchdogTimerHandler, // s: SYSTEM_WATCHDOG_HANDLER_INFORMATION // (kernel-mode only)
SystemWatchdogTimerInformation, // qs: out: SYSTEM_WATCHDOG_TIMER_INFORMATION (EX in: ULONG WATCHDOG_INFORMATION_CLASS) // NtQuerySystemInformationEx
SystemLogicalProcessorInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx
SystemWow64SharedInformationObsolete, // q: not implemented
SystemRegisterFirmwareTableInformationHandler, // s: SYSTEM_FIRMWARE_TABLE_HANDLER // (kernel-mode only)
SystemFirmwareTableInformation, // q: SYSTEM_FIRMWARE_TABLE_INFORMATION
SystemModuleInformationEx, // q: RTL_PROCESS_MODULE_INFORMATION_EX // since VISTA
SystemVerifierTriageInformation, // q: not implemented
SystemSuperfetchInformation, // qs: SUPERFETCH_INFORMATION // PfQuerySuperfetchInformation
SystemMemoryListInformation, // q: SYSTEM_MEMORY_LIST_INFORMATION; s: SYSTEM_MEMORY_LIST_COMMAND (requires SeProfileSingleProcessPrivilege) // 80
SystemFileCacheInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (same as SystemFileCacheInformation)
SystemThreadPriorityClientIdInformation, // s: SYSTEM_THREAD_CID_PRIORITY_INFORMATION (requires SeIncreaseBasePriorityPrivilege) // NtQuerySystemInformationEx
SystemProcessorIdleCycleTimeInformation, // q: SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION[] (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx
SystemVerifierCancellationInformation, // q: SYSTEM_VERIFIER_CANCELLATION_INFORMATION // name:wow64:whNT32QuerySystemVerifierCancellationInformation
SystemProcessorPowerInformationEx, // q: not implemented
SystemRefTraceInformation, // qs: SYSTEM_REF_TRACE_INFORMATION // ObQueryRefTraceInformation
SystemSpecialPoolInformation, // qs: SYSTEM_SPECIAL_POOL_INFORMATION (requires SeDebugPrivilege) // MmSpecialPoolTag, then MmSpecialPoolCatchOverruns != 0
SystemProcessIdInformation, // q: SYSTEM_PROCESS_ID_INFORMATION
SystemErrorPortInformation, // s: HANDLE (requires SeTcbPrivilege)
SystemBootEnvironmentInformation, // q: SYSTEM_BOOT_ENVIRONMENT_INFORMATION // 90
SystemHypervisorInformation, // q: SYSTEM_HYPERVISOR_QUERY_INFORMATION
SystemVerifierInformationEx, // qs: SYSTEM_VERIFIER_INFORMATION_EX
SystemTimeZoneInformation, // qs: RTL_TIME_ZONE_INFORMATION (requires SeTimeZonePrivilege)
SystemImageFileExecutionOptionsInformation, // s: SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION (requires SeTcbPrivilege)
SystemCoverageInformation, // q: COVERAGE_MODULES s: COVERAGE_MODULE_REQUEST // ExpCovQueryInformation (requires SeDebugPrivilege)
SystemPrefetchPatchInformation, // q: SYSTEM_PREFETCH_PATCH_INFORMATION
SystemVerifierFaultsInformation, // s: SYSTEM_VERIFIER_FAULTS_INFORMATION (requires SeDebugPrivilege)
SystemSystemPartitionInformation, // q: SYSTEM_SYSTEM_PARTITION_INFORMATION
SystemSystemDiskInformation, // q: SYSTEM_SYSTEM_DISK_INFORMATION
SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx // 100
SystemNumaProximityNodeInformation, // qs: SYSTEM_NUMA_PROXIMITY_MAP
SystemDynamicTimeZoneInformation, // qs: RTL_DYNAMIC_TIME_ZONE_INFORMATION (requires SeTimeZonePrivilege)
SystemCodeIntegrityInformation, // q: SYSTEM_CODEINTEGRITY_INFORMATION // SeCodeIntegrityQueryInformation
SystemProcessorMicrocodeUpdateInformation, // s: SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION (requires SeLoadDriverPrivilege)
SystemProcessorBrandString, // q: CHAR[] // HaliQuerySystemInformation -> HalpGetProcessorBrandString, info class 23
SystemVirtualAddressInformation, // q: SYSTEM_VA_LIST_INFORMATION[]; s: SYSTEM_VA_LIST_INFORMATION[] (requires SeIncreaseQuotaPrivilege) // MmQuerySystemVaInformation
SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX (EX in: LOGICAL_PROCESSOR_RELATIONSHIP RelationshipType) // since WIN7 // NtQuerySystemInformationEx // KeQueryLogicalProcessorRelationship
SystemProcessorCycleTimeInformation, // q: SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[] (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx
SystemStoreInformation, // qs: SYSTEM_STORE_INFORMATION (requires SeProfileSingleProcessPrivilege) // SmQueryStoreInformation
SystemRegistryAppendString, // s: SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // 110
SystemAitSamplingValue, // s: ULONG (requires SeProfileSingleProcessPrivilege)
SystemVhdBootInformation, // q: SYSTEM_VHD_BOOT_INFORMATION
SystemCpuQuotaInformation, // qs: PS_CPU_QUOTA_QUERY_INFORMATION
SystemNativeBasicInformation, // q: SYSTEM_BASIC_INFORMATION
SystemErrorPortTimeouts, // q: SYSTEM_ERROR_PORT_TIMEOUTS
SystemLowPriorityIoInformation, // q: SYSTEM_LOW_PRIORITY_IO_INFORMATION
SystemTpmBootEntropyInformation, // q: BOOT_ENTROPY_NT_RESULT // ExQueryBootEntropyInformation
SystemVerifierCountersInformation, // q: SYSTEM_VERIFIER_COUNTERS_INFORMATION
SystemPagedPoolInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypePagedPool)
SystemSystemPtesInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemPtes) // 120
SystemNodeDistanceInformation, // q: USHORT[4*NumaNodes] // (EX in: USHORT NodeNumber) // NtQuerySystemInformationEx
SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26
SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation
SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1
SystemSessionBigPoolInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION // since WIN8
SystemBootGraphicsInformation, // qs: SYSTEM_BOOT_GRAPHICS_INFORMATION (kernel-mode only)
SystemScrubPhysicalMemoryInformation, // qs: MEMORY_SCRUB_INFORMATION
SystemBadPageInformation, // q: SYSTEM_BAD_PAGE_INFORMATION
SystemProcessorProfileControlArea, // qs: SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA
SystemCombinePhysicalMemoryInformation, // s: MEMORY_COMBINE_INFORMATION, MEMORY_COMBINE_INFORMATION_EX, MEMORY_COMBINE_INFORMATION_EX2 // 130
SystemEntropyInterruptTimingInformation, // qs: SYSTEM_ENTROPY_TIMING_INFORMATION
SystemConsoleInformation, // qs: SYSTEM_CONSOLE_INFORMATION // (requires SeLoadDriverPrivilege)
SystemPlatformBinaryInformation, // q: SYSTEM_PLATFORM_BINARY_INFORMATION (requires SeTcbPrivilege)
SystemPolicyInformation, // q: SYSTEM_POLICY_INFORMATION (Warbird/Encrypt/Decrypt/Execute)
SystemHypervisorProcessorCountInformation, // q: SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION
SystemDeviceDataInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION
SystemDeviceDataEnumerationInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION
SystemMemoryTopologyInformation, // q: SYSTEM_MEMORY_TOPOLOGY_INFORMATION
SystemMemoryChannelInformation, // q: SYSTEM_MEMORY_CHANNEL_INFORMATION
SystemBootLogoInformation, // q: SYSTEM_BOOT_LOGO_INFORMATION // 140
SystemProcessorPerformanceInformationEx, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx // since WINBLUE
SystemCriticalProcessErrorLogInformation, // q: CRITICAL_PROCESS_EXCEPTION_DATA
SystemSecureBootPolicyInformation, // q: SYSTEM_SECUREBOOT_POLICY_INFORMATION
SystemPageFileInformationEx, // q: SYSTEM_PAGEFILE_INFORMATION_EX
SystemSecureBootInformation, // q: SYSTEM_SECUREBOOT_INFORMATION
SystemEntropyInterruptTimingRawInformation, // qs: SYSTEM_ENTROPY_TIMING_INFORMATION
SystemPortableWorkspaceEfiLauncherInformation, // q: SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION
SystemFullProcessInformation, // q: SYSTEM_EXTENDED_PROCESS_INFORMATION with SYSTEM_PROCESS_INFORMATION_EXTENSION (requires admin)
SystemKernelDebuggerInformationEx, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX
SystemBootMetadataInformation, // q: SYSTEM_BOOT_METADATA_INFORMATION // (requires SeTcbPrivilege) // 150
SystemSoftRebootInformation, // q: SYSTEM_SOFT_REBOOT_INFORMATION
SystemElamCertificateInformation, // s: SYSTEM_ELAM_CERTIFICATE_INFORMATION
SystemOfflineDumpConfigInformation, // q: OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2
SystemProcessorFeaturesInformation, // q: SYSTEM_PROCESSOR_FEATURES_INFORMATION
SystemRegistryReconciliationInformation, // s: NULL (requires admin) (flushes registry hives)
SystemEdidInformation, // q: SYSTEM_EDID_INFORMATION
SystemManufacturingInformation, // q: SYSTEM_MANUFACTURING_INFORMATION // since THRESHOLD
SystemEnergyEstimationConfigInformation, // q: SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION
SystemHypervisorDetailInformation, // q: SYSTEM_HYPERVISOR_DETAIL_INFORMATION
SystemProcessorCycleStatsInformation, // q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx // 160
SystemVmGenerationCountInformation, // s: PHYSICAL_ADDRESS (kernel-mode only) (vmgencounter.sys)
SystemTrustedPlatformModuleInformation, // q: SYSTEM_TPM_INFORMATION
SystemKernelDebuggerFlags, // q: SYSTEM_KERNEL_DEBUGGER_FLAGS
SystemCodeIntegrityPolicyInformation, // qs: SYSTEM_CODEINTEGRITYPOLICY_INFORMATION
SystemIsolatedUserModeInformation, // q: SYSTEM_ISOLATED_USER_MODE_INFORMATION
SystemHardwareSecurityTestInterfaceResultsInformation, // q: SYSTEM_HARDWARE_SECURITY_TEST_INTERFACE_RESULTS_INFORMATION
SystemSingleModuleInformation, // q: SYSTEM_SINGLE_MODULE_INFORMATION
SystemAllowedCpuSetsInformation, // s: SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION
SystemVsmProtectionInformation, // q: SYSTEM_VSM_PROTECTION_INFORMATION (previously SystemDmaProtectionInformation)
SystemInterruptCpuSetsInformation, // q: SYSTEM_INTERRUPT_CPU_SET_INFORMATION // 170
SystemSecureBootPolicyFullInformation, // q: SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION
SystemCodeIntegrityPolicyFullInformation, // q:
SystemAffinitizedInterruptProcessorInformation, // q: KAFFINITY_EX // (requires SeIncreaseBasePriorityPrivilege)
SystemRootSiloInformation, // q: SYSTEM_ROOT_SILO_INFORMATION
SystemCpuSetInformation, // q: SYSTEM_CPU_SET_INFORMATION // since THRESHOLD2
SystemCpuSetTagInformation, // q: SYSTEM_CPU_SET_TAG_INFORMATION
SystemWin32WerStartCallout, // s:
SystemSecureKernelProfileInformation, // q: SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION
SystemCodeIntegrityPlatformManifestInformation, // q: SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION // NtQuerySystemInformationEx // since REDSTONE
SystemInterruptSteeringInformation, // q: in: SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT, out: SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT // NtQuerySystemInformationEx
SystemSupportedProcessorArchitectures, // p: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx // 180
SystemMemoryUsageInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION
SystemCodeIntegrityCertificateInformation, // q: SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION
SystemPhysicalMemoryInformation, // q: SYSTEM_PHYSICAL_MEMORY_INFORMATION // since REDSTONE2
SystemControlFlowTransition, // qs: (Warbird/Encrypt/Decrypt/Execute)
SystemKernelDebuggingAllowed, // s: ULONG
SystemActivityModerationExeState, // s: SYSTEM_ACTIVITY_MODERATION_EXE_STATE
SystemActivityModerationUserSettings, // q: SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS
SystemCodeIntegrityPoliciesFullInformation, // qs: NtQuerySystemInformationEx
SystemCodeIntegrityUnlockInformation, // q: SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION // 190
SystemIntegrityQuotaInformation, // s: SYSTEM_INTEGRITY_QUOTA_INFORMATION (requires SeDebugPrivilege)
SystemFlushInformation, // q: SYSTEM_FLUSH_INFORMATION
SystemProcessorIdleMaskInformation, // q: ULONG_PTR[ActiveGroupCount] // since REDSTONE3
SystemSecureDumpEncryptionInformation, // qs: NtQuerySystemInformationEx // (q: requires SeDebugPrivilege) (s: requires SeTcbPrivilege)
SystemWriteConstraintInformation, // q: SYSTEM_WRITE_CONSTRAINT_INFORMATION
SystemKernelVaShadowInformation, // q: SYSTEM_KERNEL_VA_SHADOW_INFORMATION
SystemHypervisorSharedPageInformation, // q: SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION // since REDSTONE4
SystemFirmwareBootPerformanceInformation, // q:
SystemCodeIntegrityVerificationInformation, // q: SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION
SystemFirmwarePartitionInformation, // q: SYSTEM_FIRMWARE_PARTITION_INFORMATION // 200
SystemSpeculationControlInformation, // q: SYSTEM_SPECULATION_CONTROL_INFORMATION // (CVE-2017-5715) REDSTONE3 and above.
SystemDmaGuardPolicyInformation, // q: SYSTEM_DMA_GUARD_POLICY_INFORMATION
SystemEnclaveLaunchControlInformation, // q: SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION
SystemWorkloadAllowedCpuSetsInformation, // q: SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION // since REDSTONE5
SystemCodeIntegrityUnlockModeInformation, // q: SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION
SystemLeapSecondInformation, // qs: SYSTEM_LEAP_SECOND_INFORMATION // (s: requires SeSystemtimePrivilege)
SystemFlags2Information, // q: SYSTEM_FLAGS_INFORMATION // (s: requires SeDebugPrivilege)
SystemSecurityModelInformation, // q: SYSTEM_SECURITY_MODEL_INFORMATION // since 19H1
SystemCodeIntegritySyntheticCacheInformation, // qs: NtQuerySystemInformationEx
SystemFeatureConfigurationInformation, // q: in: SYSTEM_FEATURE_CONFIGURATION_QUERY, out: SYSTEM_FEATURE_CONFIGURATION_INFORMATION; s: SYSTEM_FEATURE_CONFIGURATION_UPDATE // NtQuerySystemInformationEx // since 20H1 // 210
SystemFeatureConfigurationSectionInformation, // q: in: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST, out: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION // NtQuerySystemInformationEx
SystemFeatureUsageSubscriptionInformation, // q: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS; s: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE
SystemSecureSpeculationControlInformation, // q: SECURE_SPECULATION_CONTROL_INFORMATION
SystemSpacesBootInformation, // qs: // since 20H2
SystemFwRamdiskInformation, // q: SYSTEM_FIRMWARE_RAMDISK_INFORMATION
SystemWheaIpmiHardwareInformation, // q: SYSTEM_WHEA_IPMI_HARDWARE_INFORMATION
SystemDifSetRuleClassInformation, // s: SYSTEM_DIF_VOLATILE_INFORMATION (requires SeDebugPrivilege)
SystemDifClearRuleClassInformation, // s: NULL (requires SeDebugPrivilege)
SystemDifApplyPluginVerificationOnDriver, // q: SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION (requires SeDebugPrivilege)
SystemDifRemovePluginVerificationOnDriver, // q: SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION (requires SeDebugPrivilege) // 220
SystemShadowStackInformation, // q: SYSTEM_SHADOW_STACK_INFORMATION
SystemBuildVersionInformation, // q: in: ULONG (LayerNumber), out: SYSTEM_BUILD_VERSION_INFORMATION // NtQuerySystemInformationEx
SystemPoolLimitInformation, // q: SYSTEM_POOL_LIMIT_INFORMATION (requires SeIncreaseQuotaPrivilege) // NtQuerySystemInformationEx
SystemCodeIntegrityAddDynamicStore, // q: CodeIntegrity-AllowConfigurablePolicy-CustomKernelSigners
SystemCodeIntegrityClearDynamicStores, // q: CodeIntegrity-AllowConfigurablePolicy-CustomKernelSigners
SystemDifPoolTrackingInformation, // s: SYSTEM_DIF_POOL_TRACKING_INFORMATION (requires SeDebugPrivilege)
SystemPoolZeroingInformation, // q: SYSTEM_POOL_ZEROING_INFORMATION
SystemDpcWatchdogInformation, // qs: SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION
SystemDpcWatchdogInformation2, // qs: SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION_V2
SystemSupportedProcessorArchitectures2, // q: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx // 230
SystemSingleProcessorRelationshipInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // (EX in: PROCESSOR_NUMBER Processor) // NtQuerySystemInformationEx
SystemXfgCheckFailureInformation, // q: SYSTEM_XFG_FAILURE_INFORMATION
SystemIommuStateInformation, // q: SYSTEM_IOMMU_STATE_INFORMATION // since 22H1
SystemHypervisorMinrootInformation, // q: SYSTEM_HYPERVISOR_MINROOT_INFORMATION
SystemHypervisorBootPagesInformation, // q: SYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION
SystemPointerAuthInformation, // q: SYSTEM_POINTER_AUTH_INFORMATION
SystemSecureKernelDebuggerInformation, // qs: NtQuerySystemInformationEx
SystemOriginalImageFeatureInformation, // q: in: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT, out: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT // NtQuerySystemInformationEx
SystemMemoryNumaInformation, // q: SYSTEM_MEMORY_NUMA_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT // NtQuerySystemInformationEx
SystemMemoryNumaPerformanceInformation, // q: SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT // since 24H2 // 240
SystemCodeIntegritySignedPoliciesFullInformation, // qs: NtQuerySystemInformationEx
SystemSecureCoreInformation, // qs: SystemSecureSecretsInformation
SystemTrustedAppsRuntimeInformation, // q: SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION
SystemBadPageInformationEx, // q: SYSTEM_BAD_PAGE_INFORMATION
SystemResourceDeadlockTimeout, // q: ULONG
SystemBreakOnContextUnwindFailureInformation, // q: ULONG (requires SeDebugPrivilege)
SystemOslRamdiskInformation, // q: SYSTEM_OSL_RAMDISK_INFORMATION
SystemCodeIntegrityPolicyManagementInformation, // q: SYSTEM_CODEINTEGRITYPOLICY_MANAGEMENT // since 25H2
SystemMemoryNumaCacheInformation, // q: SYSTEM_MEMORY_NUMA_CACHE_INFORMATION
SystemProcessorFeaturesBitMapInformation, // q: ULONG64[2] // RTL_BITMAP_EX // RtlInitializeBitMapEx // 250
SystemRefTraceInformationEx, // q: SYSTEM_REF_TRACE_INFORMATION_EX
SystemBasicProcessInformation, // q: SYSTEM_BASICPROCESS_INFORMATION
SystemHandleCountInformation, // q: SYSTEM_HANDLECOUNT_INFORMATION
SystemRuntimeAttestationReport, // q: SYSTEM_RUNTIME_REPORT_INPUT
SystemPoolTagInformation2, // q: SYSTEM_POOLTAG_INFORMATION2 // since 26H1
MaxSystemInfoClass
} SYSTEM_INFORMATION_CLASS;
/**
* The SYSTEM_BASIC_INFORMATION structure contains basic information about the current system.
*/
typedef struct _SYSTEM_BASIC_INFORMATION
{
ULONG Reserved; // Reserved
ULONG TimerResolution; // The resolution of the timer, in milliseconds. // NtQueryTimerResolution
ULONG PageSize; // The page size and the granularity of page protection and commitment.
ULONG NumberOfPhysicalPages; // The number of physical pages in the system. // KUSER_SHARED_DATA->NumberOfPhysicalPages
ULONG LowestPhysicalPageNumber; // The lowest memory page accessible to applications and dynamic-link libraries (DLLs).
ULONG HighestPhysicalPageNumber; // The highest memory page accessible to applications and dynamic-link libraries (DLLs).
ULONG AllocationGranularity; // The granularity for the starting address at which virtual memory can be allocated.
ULONG_PTR MinimumUserModeAddress; // A pointer to the lowest memory address accessible to applications and dynamic-link libraries (DLLs).
ULONG_PTR MaximumUserModeAddress; // A pointer to the highest memory address accessible to applications and dynamic-link libraries (DLLs).
KAFFINITY ActiveProcessorsAffinityMask; // A mask representing the set of processors configured in the current processor group. // deprecated
UCHAR NumberOfProcessors; // The number of logical processors in the current processor group. // deprecated
} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
// SYSTEM_PROCESSOR_INFORMATION // ProcessorFeatureBits (see also SYSTEM_PROCESSOR_FEATURES_INFORMATION)
#define KF32_V86_VIS 0x00000001 // Virtual 8086 mode.
#define KF32_RDTSC 0x00000002 // RDTSC (Read Time-Stamp Counter) instruction.
#define KF32_CR4 0x00000004 // CR4 (Control Register 4) register.
#define KF32_CMOV 0x00000008 // CMOV (Conditional Move) instruction.
#define KF32_GLOBAL_PAGE 0x00000010 // Global memory pages.
#define KF32_LARGE_PAGE 0x00000020 // Large memory pages.
#define KF32_MTRR 0x00000040 // MTRR (Memory Type Range Registers).
#define KF32_CMPXCHG8B 0x00000080 // CMPXCHG8B (CompareExchange) instruction.
#define KF32_MMX 0x00000100 // MMX (MultiMedia eXtensions).
#define KF32_WORKING_PTE 0x00000200 // PTE (Page Table Entries).
#define KF32_PAT 0x00000400 // PAT (Page Attribute Table).
#define KF32_FXSR 0x00000800 // FXSR (Floating Point Extended Save and Restore).
#define KF32_FAST_SYSCALL 0x00001000 // Fast system calls.
#define KF32_XMMI 0x00002000 // XMMI (Streaming SIMD Extensions - 32-bit).
#define KF32_3DNOW 0x00004000 // AMD 3DNow! technology.
#define KF32_AMDK6MTRR 0x00008000 // AMD K6 MTRR.
#define KF32_XMMI64 0x00010000 // XMMI (Streaming SIMD Extensions - 64-bit).
#define KF32_DTS 0x00020000 // DTS (Digital Thermal Sensor).
#define KF32_TM2 0x00040000 // TM2 (Thermal Monitor 2).
#define KF32_EST 0x00080000 // EST (Enhanced SpeedStep Technology).
#define KF32_IA64 0x00100000 // Intel Itanium architecture.
#define KF32_3DNOW2 0x00200000 // AMD 3DNow! technology, version 2.
#define KF32_VMX 0x00400000 // VMX (Virtual Machine Extensions).
#define KF32_SMX 0x00800000 // SMX (Safer Mode Extensions).
#define KF32_EST2 0x01000000 // EST (Enhanced SpeedStep Technology), version 2.
#define KF32_SSSE3 0x02000000 // SSSE3 (Supplemental Streaming SIMD Extensions 3).
#define KF32_CX16 0x04000000 // CMPXCHG16B instruction.
#define KF32_ETPRD 0x08000000 // ETPRD (Enhanced Time-Stamp Counter Priority Rotation Disable).
#define KF32_PDCM 0x10000000 // PDCM (Performance and Debug Capability MSR).
#define KF32_NOEXECUTE 0x20000000 // No-Execute (NX) bit.
#define KF32_GLOBAL_32BIT_EXECUTE 0x40000000
#define KF32_GLOBAL_32BIT_NOEXECUTE 0x80000000
/**
* The SYSTEM_PROCESSOR_INFORMATION structure contains information about the current processor.
*
* \sa https://learn.microsoft.com/en-us/windows/win32/api/sysinfoapi/ns-sysinfoapi-system_info
*/
typedef struct _SYSTEM_PROCESSOR_INFORMATION
{
USHORT ProcessorArchitecture;
USHORT ProcessorLevel;
USHORT ProcessorRevision;
USHORT MaximumProcessors;
ULONG ProcessorFeatureBits;
} SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION;
/**
* The SYSTEM_PERFORMANCE_INFORMATION structure contains detailed system-wide performance statistics.
*/
typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{
LARGE_INTEGER IdleProcessTime; // Total time spent by the idle process (in 100ns units). Used to calculate overall CPU idle percentage; combine with per-processor stats for system CPU usage.
LARGE_INTEGER IoReadTransferCount; // Total bytes read by all I/O operations system-wide. Combine with IoWriteTransferCount and IoOtherTransferCount for total I/O throughput.
LARGE_INTEGER IoWriteTransferCount; // Total bytes written by all I/O operations system-wide. Use with IoReadTransferCount for disk throughput analysis.
LARGE_INTEGER IoOtherTransferCount; // Total bytes transferred by non-read/write I/O operations (e.g., device control). Add to above for total I/O.
ULONG IoReadOperationCount; // Number of read I/O operations. Use with IoReadTransferCount to get average read size per operation.
ULONG IoWriteOperationCount; // Number of write I/O operations. Use with IoWriteTransferCount for average write size per operation.
ULONG IoOtherOperationCount; // Number of non-read/write I/O operations. Combine with above for total I/O operation count. */
ULONG AvailablePages; // Number of free physical memory pages available for immediate allocation to processes. (Display: Value * PageSize for bytes). Indicates instantly available RAM.
ULONG CommittedPages; // Number of committed virtual memory pages (backed by RAM or pagefile). Use with CommitLimit to assess memory pressure and overcommit risk.
ULONG CommitLimit; // Maximum number of pages that can be committed (RAM + pagefile). Compare with CommittedPages to determine available commit space.
ULONG PeakCommitment; // Highest number of committed pages since boot. Tracks historical maximum memory commitment.
ULONG PageFaultCount; // Total number of page faults (both soft and hard) since boot. Includes all types of faults.
ULONG CopyOnWriteCount; // Number of page faults due to copy-on-write events. Subset of PageFaultCount. Indicates process memory sharing and forking activity.
ULONG TransitionCount; // Number of page faults due to transition from standby to active. Subset of PageFaultCount. Indicates memory reactivation from standby lists.
ULONG CacheTransitionCount; // Number of page faults due to cache transitions. Subset of TransitionCount. Indicates faults resolved from the system cache.
ULONG DemandZeroCount; // Number of page faults resolved by zeroing a page (demand-zero). Subset of PageFaultCount. Indicates new memory allocations.
ULONG PageReadCount; // Number of pages read from disk to resolve faults. Use with PageReadIoCount for read efficiency (pages per I/O).
ULONG PageReadIoCount; // Number of I/O operations for page reads. Compare with PageReadCount for average pages per I/O.
ULONG CacheReadCount; // Number of pages read from the system cache. Use with CacheIoCount for cache hit/miss analysis.
ULONG CacheIoCount; // Number of I/O operations for cache reads. Compare with CacheReadCount for average pages per cache I/O.
ULONG DirtyPagesWriteCount; // Number of dirty pages written to disk (writeback). Use with DirtyWriteIoCount for write efficiency.
ULONG DirtyWriteIoCount; // Number of I/O operations for dirty page writes. Compare with DirtyPagesWriteCount for average pages per write I/O.
ULONG MappedPagesWriteCount; // Number of mapped pages written (e.g., memory-mapped files). Use with MappedWriteIoCount for mapped file activity.
ULONG MappedWriteIoCount; // Number of I/O operations for mapped page writes. Compare with MappedPagesWriteCount for average mapped write size.
ULONG PagedPoolPages; // Number of pages used by the paged pool (kernel memory that can be paged out). Combine with NonPagedPoolPages for total pool usage.
ULONG NonPagedPoolPages; // Number of pages used by the nonpaged pool (kernel memory that must remain resident). Combine with PagedPoolPages for total pool usage.
ULONG PagedPoolAllocs; // Number of paged pool allocations. Use with PagedPoolFrees for leak detection and pool usage trends.
ULONG PagedPoolFrees; // Number of paged pool frees. Compare with PagedPoolAllocs to detect leaks or fragmentation.
ULONG NonPagedPoolAllocs; // Number of nonpaged pool allocations. Use with NonPagedPoolFrees for leak detection.
ULONG NonPagedPoolFrees; // Number of nonpaged pool frees. Compare with NonPagedPoolAllocs for pool usage.
ULONG FreeSystemPtes; // Number of free system page table entries (PTEs). Low values may indicate kernel memory exhaustion or fragmentation.
ULONG ResidentSystemCodePage; // Number of resident pages for system code (kernel and drivers). Use with TotalSystemCodePages for residency ratio.
ULONG TotalSystemDriverPages; // Total pages used by system drivers. Combine with TotalSystemCodePages for total kernel code usage.
ULONG TotalSystemCodePages; // Total pages used by system code (kernel + drivers). Use with ResidentSystemCodePage for residency analysis.
ULONG NonPagedPoolLookasideHits; // Hits in nonpaged pool lookaside lists. Higher values indicate efficient small nonpaged allocations.
ULONG PagedPoolLookasideHits; // Hits in paged pool lookaside lists. Higher values indicate efficient small paged allocations.
ULONG AvailablePagedPoolPages; // Number of free pages in the paged pool. Monitor for pool exhaustion or fragmentation.
ULONG ResidentSystemCachePage; // Resident pages in the system cache. Use with ResidentPagedPoolPage for cache residency analysis.
ULONG ResidentPagedPoolPage; // Resident pages in the paged pool. Indicates how much of the paged pool is currently resident in RAM.
ULONG ResidentSystemDriverPage; // Resident pages for system drivers. Use with TotalSystemDriverPages for residency ratio.
ULONG CcFastReadNoWait; // Fast cache reads completed without waiting. Use with CcFastReadWait for cache performance analysis.
ULONG CcFastReadWait; // Fast cache reads that required waiting. Compare with CcFastReadNoWait to assess cache latency.
ULONG CcFastReadResourceMiss; // Fast cache read misses due to resource contention. Indicates cache bottlenecks.
ULONG CcFastReadNotPossible; // Fast cache reads not possible (e.g., file not cached). Indicates cache limitations or bypasses.
ULONG CcFastMdlReadNoWait; // Fast MDL (Memory Descriptor List) reads completed without waiting. Use with CcFastMdlReadWait.
ULONG CcFastMdlReadWait; // Fast MDL reads that required waiting. Compare with CcFastMdlReadNoWait.
ULONG CcFastMdlReadResourceMiss; // Fast MDL read misses due to resource contention. Indicates MDL bottlenecks.
ULONG CcFastMdlReadNotPossible; // Fast MDL reads not possible. Indicates MDL limitations or cache bypass.
ULONG CcMapDataNoWait; // Cache map data operations completed without waiting. Use with CcMapDataWait for mapping efficiency.
ULONG CcMapDataWait; // Cache map data operations that required waiting. Compare with CcMapDataNoWait.
ULONG CcMapDataNoWaitMiss; // Cache map data misses without waiting. Indicates mapping bottlenecks.
ULONG CcMapDataWaitMiss; // Cache map data misses with waiting. Indicates mapping bottlenecks under contention.
ULONG CcPinMappedDataCount; // Number of pinned mapped data pages. Indicates how much data is locked in cache for I/O.
ULONG CcPinReadNoWait; // Pin reads completed without waiting. Use with CcPinReadWait for pinning efficiency.
ULONG CcPinReadWait; // Pin reads that required waiting. Compare with CcPinReadNoWait.
ULONG CcPinReadNoWaitMiss; // Pin read misses without waiting. Indicates pinning bottlenecks.
ULONG CcPinReadWaitMiss; // Pin read misses with waiting. Indicates pinning bottlenecks under contention.
ULONG CcCopyReadNoWait; // Copy reads completed without waiting. Use with CcCopyReadWait for copy efficiency.
ULONG CcCopyReadWait; // Copy reads that required waiting. Compare with CcCopyReadNoWait.
ULONG CcCopyReadNoWaitMiss; // Copy read misses without waiting. Indicates copy bottlenecks.
ULONG CcCopyReadWaitMiss; // Copy read misses with waiting. Indicates copy bottlenecks under contention.
ULONG CcMdlReadNoWait; // MDL reads completed without waiting. Use with CcMdlReadWait for MDL efficiency.
ULONG CcMdlReadWait; // MDL reads that required waiting. Compare with CcMdlReadNoWait.
ULONG CcMdlReadNoWaitMiss; // MDL read misses without waiting. Indicates MDL bottlenecks.
ULONG CcMdlReadWaitMiss; // MDL read misses with waiting. Indicates MDL bottlenecks under contention.
ULONG CcReadAheadIos; // Number of read-ahead I/O operations. Indicates cache prefetching activity.
ULONG CcLazyWriteIos; // Number of lazy write I/O operations. Indicates deferred write activity by the cache manager.
ULONG CcLazyWritePages; // Number of pages written by the lazy writer. Use with CcLazyWriteIos for writeback efficiency.
ULONG CcDataFlushes; // Number of cache data flushes. Indicates cache consistency operations (e.g., file close).
ULONG CcDataPages; // Number of pages flushed from cache. Use with CcDataFlushes for average flush size.
ULONG ContextSwitches; // Number of context switches system-wide. Use for CPU scheduling and multitasking analysis.
ULONG FirstLevelTbFills; // First-level translation buffer (TLB) fills. Indicates TLB efficiency and memory access patterns.
ULONG SecondLevelTbFills; // Second-level TLB fills. Indicates deeper TLB misses and memory access patterns.
ULONG SystemCalls; // Number of system calls made. Use for syscall activity and system workload analysis.
ULONGLONG CcTotalDirtyPages; // Total number of dirty pages in the cache (since Windows 10/Threshold). Use with CcDirtyPageThreshold for writeback policy. // since THRESHOLD
ULONGLONG CcDirtyPageThreshold; // Dirty page threshold for the cache. Compare with CcTotalDirtyPages to determine if writeback is needed.
LONGLONG ResidentAvailablePages; // Number of available pages that are resident in memory. Combine with AvailablePages for residency analysis.
ULONGLONG SharedCommittedPages; // Number of committed pages that are shared (e.g., mapped by multiple processes). Useful for shared memory analysis.
ULONGLONG MdlPagesAllocated; // Number of pages allocated for MDLs (since Windows 11 24H2). Indicates MDL resource usage. // since 24H2
ULONGLONG PfnDatabaseCommittedPages; // Number of pages committed for the PFN (Page Frame Number) database. Kernel memory usage for tracking physical pages.
ULONGLONG SystemPageTableCommittedPages; // Number of pages committed for system page tables. Kernel memory usage for virtual-to-physical mapping structures.
ULONGLONG ContiguousPagesAllocated; // Number of contiguous pages allocated. Indicates large memory allocations (e.g., for DMA or drivers).
} SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;
/**
* The SYSTEM_TIMEOFDAY_INFORMATION structure contains information about the system uptime.
*/
typedef struct _SYSTEM_TIMEOFDAY_INFORMATION
{
LARGE_INTEGER BootTime; // Number of 100-nanosecond intervals since the system was started.
LARGE_INTEGER CurrentTime; // The current system date and time.
LARGE_INTEGER TimeZoneBias; // Number of 100-nanosecond intervals between local time and Coordinated Universal Time (UTC).
ULONG TimeZoneId; // The current system time zone identifier.
ULONG Reserved; // Reserved
ULONGLONG BootTimeBias; // Number of 100-nanosecond intervals between the boot time and Coordinated Universal Time (UTC).
ULONGLONG SleepTimeBias; // Number of 100-nanosecond intervals between the sleep time and Coordinated Universal Time (UTC).
} SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION;
/**
* The SYSTEM_THREAD_INFORMATION structure contains information about a thread running on a system.
* https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/e82d73e4-cedb-4077-9099-d58f3459722f
*/
typedef struct _SYSTEM_THREAD_INFORMATION
{
LARGE_INTEGER KernelTime; // Number of 100-nanosecond intervals spent executing kernel code.
LARGE_INTEGER UserTime; // Number of 100-nanosecond intervals spent executing user code.
LARGE_INTEGER CreateTime; // The date and time when the thread was created.
ULONG WaitTime; // The current time spent in ready queue or waiting (depending on the thread state).
PVOID StartAddress; // The initial start address of the thread.
CLIENT_ID ClientId; // The identifier of the thread and the process owning the thread.
KPRIORITY Priority; // The dynamic priority of the thread.
KPRIORITY BasePriority; // The starting priority of the thread.
ULONG ContextSwitches; // The total number of context switches performed.
KTHREAD_STATE ThreadState; // The current state of the thread.
KWAIT_REASON WaitReason; // The current reason the thread is waiting.
} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
/**
* The SYSTEM_PROCESS_INFORMATION structure contains information about a process running on a system.
*/
_Struct_size_bytes_(NextEntryOffset)
typedef struct _SYSTEM_PROCESS_INFORMATION
{
ULONG NextEntryOffset; // The address of the previous item plus the value in the NextEntryOffset member. For the last item in the array, NextEntryOffset is 0.
ULONG NumberOfThreads; // The NumberOfThreads member contains the number of threads in the process.
ULONGLONG WorkingSetPrivateSize; // The total private memory that a process currently has allocated and is physically resident in memory. // since VISTA
ULONG HardFaultCount; // The total number of hard faults for data from disk rather than from in-memory pages. // since WIN7
ULONG NumberOfThreadsHighWatermark; // The peak number of threads that were running at any given point in time, indicative of potential performance bottlenecks related to thread management.
ULONGLONG CycleTime; // The sum of the cycle time of all threads in the process.
LARGE_INTEGER CreateTime; // Number of 100-nanosecond intervals since the creation time of the process. Not updated during system timezone changes.
LARGE_INTEGER UserTime; // Number of 100-nanosecond intervals the process has executed in user mode.
LARGE_INTEGER KernelTime; // Number of 100-nanosecond intervals the process has executed in kernel mode.
UNICODE_STRING ImageName; // The file name of the executable image.
KPRIORITY BasePriority; // The starting priority of the process.
HANDLE UniqueProcessId; // The identifier of the process.
HANDLE InheritedFromUniqueProcessId; // The identifier of the process that created this process. Not updated and incorrectly refers to processes with recycled identifiers.
ULONG HandleCount; // The current number of open handles used by the process.
ULONG SessionId; // The identifier of the Remote Desktop Services session under which the specified process is running.
ULONG_PTR UniqueProcessKey; // since VISTA (requires SystemExtendedProcessInformation)
SIZE_T PeakVirtualSize; // The peak size, in bytes, of the virtual memory used by the process.
SIZE_T VirtualSize; // The current size, in bytes, of virtual memory used by the process.
ULONG PageFaultCount; // The total number of page faults for data that is not currently in memory. The value wraps around to zero on average 24 hours.
SIZE_T PeakWorkingSetSize; // The peak size, in kilobytes, of the working set of the process.
SIZE_T WorkingSetSize; // The number of pages visible to the process in physical memory. These pages are resident and available for use without triggering a page fault.
SIZE_T QuotaPeakPagedPoolUsage; // The peak quota charged to the process for pool usage, in bytes.
SIZE_T QuotaPagedPoolUsage; // The quota charged to the process for paged pool usage, in bytes.
SIZE_T QuotaPeakNonPagedPoolUsage; // The peak quota charged to the process for nonpaged pool usage, in bytes.
SIZE_T QuotaNonPagedPoolUsage; // The current quota charged to the process for nonpaged pool usage.
SIZE_T PagefileUsage; // The total number of bytes of page file storage in use by the process.
SIZE_T PeakPagefileUsage; // The maximum number of bytes of page-file storage used by the process.
SIZE_T PrivatePageCount; // The number of memory pages allocated for the use by the process.
LARGE_INTEGER ReadOperationCount; // The total number of read operations performed.
LARGE_INTEGER WriteOperationCount; // The total number of write operations performed.
LARGE_INTEGER OtherOperationCount; // The total number of I/O operations performed other than read and write operations.
LARGE_INTEGER ReadTransferCount; // The total number of bytes read during a read operation.
LARGE_INTEGER WriteTransferCount; // The total number of bytes written during a write operation.
LARGE_INTEGER OtherTransferCount; // The total number of bytes transferred during operations other than read and write operations.
SYSTEM_THREAD_INFORMATION Threads[1]; // This type is not defined in the structure but was added for convenience.
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
// private
typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION
{
union
{
SYSTEM_THREAD_INFORMATION ThreadInfo;
struct
{
ULONGLONG KernelTime; // Number of 100-nanosecond intervals spent executing kernel code.
ULONGLONG UserTime; // Number of 100-nanosecond intervals spent executing user code.
ULONGLONG CreateTime; // The date and time when the thread was created.
ULONG WaitTime; // The current time spent in ready queue or waiting (depending on the thread state).
PVOID StartAddress; // The initial start address of the thread.
CLIENT_ID ClientId; // The identifier of the thread and the process owning the thread.
KPRIORITY Priority; // The dynamic priority of the thread.
KPRIORITY BasePriority; // The starting priority of the thread.
ULONG ContextSwitches; // The total number of context switches performed.
KTHREAD_STATE ThreadState; // The current state of the thread.
KWAIT_REASON WaitReason; // The current reason the thread is waiting.
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
PVOID StackBase; // The lower boundary of the current thread stack.
PVOID StackLimit; // The upper boundary of the current thread stack.
PVOID Win32StartAddress; // The thread's Win32 start address.
PVOID TebBaseAddress; // The base address of the memory region containing the TEB structure. // since VISTA
ULONG_PTR Reserved2;
ULONG_PTR Reserved3;
ULONG_PTR Reserved4;
} SYSTEM_EXTENDED_THREAD_INFORMATION, *PSYSTEM_EXTENDED_THREAD_INFORMATION;
/**
* The SYSTEM_EXTENDED_PROCESS_INFORMATION structure contains extended information about a process running on a system.
* https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-system_extended_process_information
*/
_Struct_size_bytes_(NextEntryOffset)
typedef struct _SYSTEM_EXTENDED_PROCESS_INFORMATION
{
ULONG NextEntryOffset; // The address of the previous item plus the value in the NextEntryOffset member. For the last item in the array, NextEntryOffset is 0.
ULONG NumberOfThreads; // The NumberOfThreads member contains the number of threads in the process.
ULONGLONG WorkingSetPrivateSize; // The total private memory that a process currently has allocated and is physically resident in memory. // since VISTA
ULONG HardFaultCount; // The total number of hard faults for data from disk rather than from in-memory pages. // since WIN7
ULONG NumberOfThreadsHighWatermark; // The peak number of threads that were running at any given point in time, indicative of potential performance bottlenecks related to thread management.
ULONGLONG CycleTime; // The sum of the cycle time of all threads in the process.
ULONGLONG CreateTime; // Number of 100-nanosecond intervals since the creation time of the process. Not updated during system timezone changes.
ULONGLONG UserTime; // Number of 100-nanosecond intervals the process has executed in user mode.
ULONGLONG KernelTime; // Number of 100-nanosecond intervals the process has executed in kernel mode.
UNICODE_STRING ImageName; // The file name of the executable image.
KPRIORITY BasePriority; // The starting priority of the process.
HANDLE UniqueProcessId; // The identifier of the process.
HANDLE InheritedFromUniqueProcessId; // The identifier of the process that created this process. Not updated and incorrectly refers to processes with recycled identifiers.
ULONG HandleCount; // The current number of open handles used by the process.
ULONG SessionId; // The identifier of the Remote Desktop Services session under which the specified process is running.
HANDLE UniqueProcessKey; // since VISTA (requires SystemExtendedProcessInformation)
SIZE_T PeakVirtualSize; // The peak size, in bytes, of the virtual memory used by the process.
SIZE_T VirtualSize; // The current size, in bytes, of virtual memory used by the process.
ULONG PageFaultCount; // The total number of page faults for data that is not currently in memory. The value wraps around to zero on average 24 hours.
SIZE_T PeakWorkingSetSize; // The peak size, in kilobytes, of the working set of the process.
SIZE_T WorkingSetSize; // The number of pages visible to the process in physical memory. These pages are resident and available for use without triggering a page fault.
SIZE_T QuotaPeakPagedPoolUsage; // The peak quota charged to the process for pool usage, in bytes.
SIZE_T QuotaPagedPoolUsage; // The quota charged to the process for paged pool usage, in bytes.
SIZE_T QuotaPeakNonPagedPoolUsage; // The peak quota charged to the process for nonpaged pool usage, in bytes.
SIZE_T QuotaNonPagedPoolUsage; // The current quota charged to the process for nonpaged pool usage.
SIZE_T PagefileUsage; // The total number of bytes of page file storage in use by the process.
SIZE_T PeakPagefileUsage; // The maximum number of bytes of page-file storage used by the process.
SIZE_T PrivatePageCount; // The number of memory pages allocated for the use by the process.
ULONGLONG ReadOperationCount; // The total number of read operations performed.
ULONGLONG WriteOperationCount; // The total number of write operations performed.
ULONGLONG OtherOperationCount; // The total number of I/O operations performed other than read and write operations.
ULONGLONG ReadTransferCount; // The total number of bytes read during a read operation.
ULONGLONG WriteTransferCount; // The total number of bytes written during a write operation.
ULONGLONG OtherTransferCount; // The total number of bytes transferred during operations other than read and write operations.
SYSTEM_THREAD_INFORMATION Threads[1]; // This type is not defined in the structure but was added for convenience.
// SYSTEM_PROCESS_INFORMATION_EXTENSION // SystemFullProcessInformation
} SYSTEM_EXTENDED_PROCESS_INFORMATION, *PSYSTEM_EXTENDED_PROCESS_INFORMATION;
typedef struct _SYSTEM_CALL_COUNT_INFORMATION
{
ULONG Length;
ULONG NumberOfTables;
} SYSTEM_CALL_COUNT_INFORMATION, *PSYSTEM_CALL_COUNT_INFORMATION;
typedef struct _SYSTEM_DEVICE_INFORMATION
{
ULONG NumberOfDisks;
ULONG NumberOfFloppies;
ULONG NumberOfCdRoms;
ULONG NumberOfTapes;
ULONG NumberOfSerialPorts;
ULONG NumberOfParallelPorts;
} SYSTEM_DEVICE_INFORMATION, *PSYSTEM_DEVICE_INFORMATION;
/**
* The SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION structure contains information about the performance of each processor installed in the system.
* https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntquerysysteminformation#system_processor_performance_information
*/
typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
{
LARGE_INTEGER IdleTime; // The IdleTime member contains the amount of time that the system has been idle, in 100-nanosecond intervals.
LARGE_INTEGER KernelTime; // The KernelTime member contains the amount of time that the system has spent executing in Kernel mode (including all threads in all processes, on all processors), in 100-nanosecond intervals.
LARGE_INTEGER UserTime; // The UserTime member contains the amount of time that the system has spent executing in User mode (including all threads in all processes, on all processors), in 100-nanosecond intervals.
LARGE_INTEGER DpcTime; // The DpcTime member contains the amount of time that the system has spent processing deferred procedure calls (DPCs), in 100-nanosecond intervals.
LARGE_INTEGER InterruptTime; // The InterruptTime member contains the amount of time that the system has spent processing hardware interrupts, in 100-nanosecond intervals.
ULONG InterruptCount; // The InterruptCount member contains the number of interrupts that have occurred, as counted by the system.
ULONG Spare0;
} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;
typedef struct _SYSTEM_FLAGS_INFORMATION
{
union
{
ULONG Flags; // NtGlobalFlag
struct
{
ULONG StopOnException : 1; // FLG_STOP_ON_EXCEPTION
ULONG ShowLoaderSnaps : 1; // FLG_SHOW_LDR_SNAPS
ULONG DebugInitialCommand : 1; // FLG_DEBUG_INITIAL_COMMAND
ULONG StopOnHungGUI : 1; // FLG_STOP_ON_HUNG_GUI
ULONG HeapEnableTailCheck : 1; // FLG_HEAP_ENABLE_TAIL_CHECK
ULONG HeapEnableFreeCheck : 1; // FLG_HEAP_ENABLE_FREE_CHECK
ULONG HeapValidateParameters : 1; // FLG_HEAP_VALIDATE_PARAMETERS
ULONG HeapValidateAll : 1; // FLG_HEAP_VALIDATE_ALL
ULONG ApplicationVerifier : 1; // FLG_APPLICATION_VERIFIER
ULONG MonitorSilentProcessExit : 1; // FLG_MONITOR_SILENT_PROCESS_EXIT
ULONG PoolEnableTagging : 1; // FLG_POOL_ENABLE_TAGGING
ULONG HeapEnableTagging : 1; // FLG_HEAP_ENABLE_TAGGING
ULONG UserStackTraceDb : 1; // FLG_USER_STACK_TRACE_DB
ULONG KernelStackTraceDb : 1; // FLG_KERNEL_STACK_TRACE_DB
ULONG MaintainObjectTypeList : 1; // FLG_MAINTAIN_OBJECT_TYPELIST
ULONG HeapEnableTagByDll : 1; // FLG_HEAP_ENABLE_TAG_BY_DLL
ULONG DisableStackExtension : 1; // FLG_DISABLE_STACK_EXTENSION
ULONG EnableCsrDebug : 1; // FLG_ENABLE_CSRDEBUG
ULONG EnableKDebugSymbolLoad : 1; // FLG_ENABLE_KDEBUG_SYMBOL_LOAD
ULONG DisablePageKernelStacks : 1; // FLG_DISABLE_PAGE_KERNEL_STACKS
ULONG EnableSystemCritBreaks : 1; // FLG_ENABLE_SYSTEM_CRIT_BREAKS
ULONG HeapDisableCoalescing : 1; // FLG_HEAP_DISABLE_COALESCING
ULONG EnableCloseExceptions : 1; // FLG_ENABLE_CLOSE_EXCEPTIONS
ULONG EnableExceptionLogging : 1; // FLG_ENABLE_EXCEPTION_LOGGING
ULONG EnableHandleTypeTagging : 1; // FLG_ENABLE_HANDLE_TYPE_TAGGING
ULONG HeapPageAllocs : 1; // FLG_HEAP_PAGE_ALLOCS
ULONG DebugInitialCommandEx : 1; // FLG_DEBUG_INITIAL_COMMAND_EX
ULONG DisableDbgPrint : 1; // FLG_DISABLE_DBGPRINT
ULONG CritSecEventCreation : 1; // FLG_CRITSEC_EVENT_CREATION
ULONG LdrTopDown : 1; // FLG_LDR_TOP_DOWN
ULONG EnableHandleExceptions : 1; // FLG_ENABLE_HANDLE_EXCEPTIONS
ULONG DisableProtDlls : 1; // FLG_DISABLE_PROTDLLS
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
} SYSTEM_FLAGS_INFORMATION, *PSYSTEM_FLAGS_INFORMATION;
// private
typedef struct _SYSTEM_CALL_TIME_INFORMATION
{
ULONG Length;
ULONG TotalCalls;
LARGE_INTEGER TimeOfCalls[1];
} SYSTEM_CALL_TIME_INFORMATION, *PSYSTEM_CALL_TIME_INFORMATION;
// RTL_PROCESS_LOCK_INFORMATION Type
#define RTL_CRITSECT_TYPE 0
#define RTL_RESOURCE_TYPE 1
// private
typedef struct _RTL_PROCESS_LOCK_INFORMATION
{
PVOID Address;
USHORT Type;
USHORT CreatorBackTraceIndex;
HANDLE OwningThread;
LONG LockCount;
ULONG ContentionCount;
ULONG EntryCount;
LONG RecursionCount;
ULONG NumberOfWaitingShared;
ULONG NumberOfWaitingExclusive;
} RTL_PROCESS_LOCK_INFORMATION, *PRTL_PROCESS_LOCK_INFORMATION;
// private
typedef struct _RTL_PROCESS_LOCKS
{
ULONG NumberOfLocks;
_Field_size_(NumberOfLocks) RTL_PROCESS_LOCK_INFORMATION Locks[1];
} RTL_PROCESS_LOCKS, *PRTL_PROCESS_LOCKS;
// private
typedef struct _RTL_PROCESS_BACKTRACE_INFORMATION
{
PCHAR SymbolicBackTrace;
ULONG TraceCount;
USHORT Index;
USHORT Depth;
PVOID BackTrace[32];
} RTL_PROCESS_BACKTRACE_INFORMATION, *PRTL_PROCESS_BACKTRACE_INFORMATION;
// private
typedef struct _RTL_PROCESS_BACKTRACES
{
SIZE_T CommittedMemory;
SIZE_T ReservedMemory;
ULONG NumberOfBackTraceLookups;
ULONG NumberOfBackTraces;
_Field_size_(NumberOfBackTraces) RTL_PROCESS_BACKTRACE_INFORMATION BackTraces[1];
} RTL_PROCESS_BACKTRACES, *PRTL_PROCESS_BACKTRACES;
// Note: This information class is deprecated since values are limited to 65535. Use SystemExtendedHandleInformation instead.
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
{
USHORT UniqueProcessId;
USHORT CreatorBackTraceIndex;
UCHAR ObjectTypeIndex;
UCHAR HandleAttributes;
USHORT HandleValue;
PVOID Object;
ACCESS_MASK GrantedAccess;
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
typedef struct _SYSTEM_HANDLE_INFORMATION
{
ULONG NumberOfHandles;
_Field_size_(NumberOfHandles) SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
_Struct_size_bytes_(NextEntryOffset)
typedef struct _SYSTEM_OBJECTTYPE_INFORMATION
{
ULONG NextEntryOffset;
ULONG NumberOfObjects;
ULONG NumberOfHandles;
ULONG TypeIndex;
ULONG InvalidAttributes;
GENERIC_MAPPING GenericMapping;
ACCESS_MASK ValidAccessMask;
ULONG PoolType;
BOOLEAN SecurityRequired;
BOOLEAN WaitableObject;
UNICODE_STRING TypeName;
} SYSTEM_OBJECTTYPE_INFORMATION, *PSYSTEM_OBJECTTYPE_INFORMATION;
_Struct_size_bytes_(NextEntryOffset)
typedef struct _SYSTEM_OBJECT_INFORMATION
{
ULONG NextEntryOffset;
PVOID Object;
HANDLE CreatorUniqueProcess;
USHORT CreatorBackTraceIndex;
USHORT Flags;
LONG PointerCount;
LONG HandleCount;
ULONG PagedPoolCharge;
ULONG NonPagedPoolCharge;
HANDLE ExclusiveProcessId;
PSECURITY_DESCRIPTOR SecurityDescriptor;
UNICODE_STRING NameInfo;
} SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION;
_Struct_size_bytes_(NextEntryOffset)
typedef struct _SYSTEM_PAGEFILE_INFORMATION
{
ULONG NextEntryOffset;
ULONG TotalSize;
ULONG TotalInUse;
ULONG PeakUsage;
UNICODE_STRING PageFileName;
} SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION;
typedef struct _SYSTEM_VDM_INSTEMUL_INFO
{
ULONG SegmentNotPresent;
ULONG VdmOpcode0F;
ULONG OpcodeESPrefix;
ULONG OpcodeCSPrefix;
ULONG OpcodeSSPrefix;
ULONG OpcodeDSPrefix;
ULONG OpcodeFSPrefix;
ULONG OpcodeGSPrefix;
ULONG OpcodeOPER32Prefix;
ULONG OpcodeADDR32Prefix;
ULONG OpcodeINSB;
ULONG OpcodeINSW;
ULONG OpcodeOUTSB;
ULONG OpcodeOUTSW;
ULONG OpcodePUSHF;
ULONG OpcodePOPF;
ULONG OpcodeINTnn;
ULONG OpcodeINTO;
ULONG OpcodeIRET;
ULONG OpcodeINBimm;
ULONG OpcodeINWimm;
ULONG OpcodeOUTBimm;
ULONG OpcodeOUTWimm;
ULONG OpcodeINB;
ULONG OpcodeINW;
ULONG OpcodeOUTB;
ULONG OpcodeOUTW;
ULONG OpcodeLOCKPrefix;
ULONG OpcodeREPNEPrefix;
ULONG OpcodeREPPrefix;
ULONG OpcodeHLT;
ULONG OpcodeCLI;
ULONG OpcodeSTI;
ULONG BopCount;
} SYSTEM_VDM_INSTEMUL_INFO, *PSYSTEM_VDM_INSTEMUL_INFO;
#define MM_WORKING_SET_MAX_HARD_ENABLE 0x1
#define MM_WORKING_SET_MAX_HARD_DISABLE 0x2
#define MM_WORKING_SET_MIN_HARD_ENABLE 0x4
#define MM_WORKING_SET_MIN_HARD_DISABLE 0x8
typedef struct _SYSTEM_FILECACHE_INFORMATION
{
SIZE_T CurrentSize;
SIZE_T PeakSize;
ULONG PageFaultCount;
SIZE_T MinimumWorkingSet;
SIZE_T MaximumWorkingSet;
SIZE_T CurrentSizeIncludingTransitionInPages;
SIZE_T PeakSizeIncludingTransitionInPages;
ULONG TransitionRePurposeCount;
ULONG Flags;
} SYSTEM_FILECACHE_INFORMATION, *PSYSTEM_FILECACHE_INFORMATION;
// Can be used instead of SYSTEM_FILECACHE_INFORMATION
typedef struct _SYSTEM_BASIC_WORKING_SET_INFORMATION
{
SIZE_T CurrentSize;
SIZE_T PeakSize;
ULONG PageFaultCount;
} SYSTEM_BASIC_WORKING_SET_INFORMATION, *PSYSTEM_BASIC_WORKING_SET_INFORMATION;
typedef struct _SYSTEM_POOLTAG
{
union
{
UCHAR Tag[4];
ULONG TagUlong;
} DUMMYUNIONNAME;
ULONG PagedAllocs;
ULONG PagedFrees;
SIZE_T PagedUsed;
ULONG NonPagedAllocs;
ULONG NonPagedFrees;
SIZE_T NonPagedUsed;
} SYSTEM_POOLTAG, *PSYSTEM_POOLTAG;
typedef struct _SYSTEM_POOLTAG_INFORMATION
{
ULONG Count;
_Field_size_(Count) SYSTEM_POOLTAG TagInfo[1];
} SYSTEM_POOLTAG_INFORMATION, *PSYSTEM_POOLTAG_INFORMATION;
typedef struct _SYSTEM_INTERRUPT_INFORMATION
{
ULONG ContextSwitches;
ULONG DpcCount;
ULONG DpcRate;
ULONG TimeIncrement;
ULONG DpcBypassCount;
ULONG ApcBypassCount;
} SYSTEM_INTERRUPT_INFORMATION, *PSYSTEM_INTERRUPT_INFORMATION;
typedef struct _SYSTEM_DPC_BEHAVIOR_INFORMATION
{
ULONG Spare;
ULONG DpcQueueDepth;
ULONG MinimumDpcRate;
ULONG AdjustDpcThreshold;
ULONG IdealDpcRate;
} SYSTEM_DPC_BEHAVIOR_INFORMATION, *PSYSTEM_DPC_BEHAVIOR_INFORMATION;
typedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION
{
ULONG TimeAdjustment;
ULONG TimeIncrement;
BOOLEAN Enable;
} SYSTEM_QUERY_TIME_ADJUST_INFORMATION, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION;
typedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE
{
ULONGLONG TimeAdjustment;
ULONGLONG TimeIncrement;
BOOLEAN Enable;
} SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE;
typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION
{
ULONG TimeAdjustment;
BOOLEAN Enable;
} SYSTEM_SET_TIME_ADJUST_INFORMATION, *PSYSTEM_SET_TIME_ADJUST_INFORMATION;
typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE
{
ULONGLONG TimeAdjustment;
BOOLEAN Enable;
} SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE, *PSYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE;
typedef enum _EVENT_TRACE_INFORMATION_CLASS
{
EventTraceKernelVersionInformation, // EVENT_TRACE_VERSION_INFORMATION
EventTraceGroupMaskInformation, // EVENT_TRACE_GROUPMASK_INFORMATION
EventTracePerformanceInformation, // EVENT_TRACE_PERFORMANCE_INFORMATION
EventTraceTimeProfileInformation, // EVENT_TRACE_TIME_PROFILE_INFORMATION
EventTraceSessionSecurityInformation, // EVENT_TRACE_SESSION_SECURITY_INFORMATION
EventTraceSpinlockInformation, // EVENT_TRACE_SPINLOCK_INFORMATION
EventTraceStackTracingInformation, // EVENT_TRACE_STACK_TRACING_INFORMATION
EventTraceExecutiveResourceInformation, // EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION
EventTraceHeapTracingInformation, // EVENT_TRACE_HEAP_TRACING_INFORMATION
EventTraceHeapSummaryTracingInformation, // EVENT_TRACE_HEAP_TRACING_INFORMATION
EventTracePoolTagFilterInformation, // EVENT_TRACE_POOLTAG_FILTER_INFORMATION
EventTracePebsTracingInformation, // EVENT_TRACE_PEBS_TRACING_INFORMATION
EventTraceProfileConfigInformation, // EVENT_TRACE_PROFILE_CONFIG_INFORMATION
EventTraceProfileSourceListInformation, // EVENT_TRACE_PROFILE_LIST_INFORMATION
EventTraceProfileEventListInformation, // EVENT_TRACE_PROFILE_EVENT_INFORMATION
EventTraceProfileCounterListInformation, // EVENT_TRACE_PROFILE_COUNTER_INFORMATION
EventTraceStackCachingInformation, // EVENT_TRACE_STACK_CACHING_INFORMATION
EventTraceObjectTypeFilterInformation, // EVENT_TRACE_OBJECT_TYPE_FILTER_INFORMATION
EventTraceSoftRestartInformation, // EVENT_TRACE_SOFT_RESTART_INFORMATION
EventTraceLastBranchConfigurationInformation, // REDSTONE3
EventTraceLastBranchEventListInformation, // EVENT_TRACE_PROFILE_EVENT_INFORMATION
EventTraceProfileSourceAddInformation, // EVENT_TRACE_PROFILE_ADD_INFORMATION // REDSTONE4
EventTraceProfileSourceRemoveInformation, // EVENT_TRACE_PROFILE_REMOVE_INFORMATION
EventTraceProcessorTraceConfigurationInformation,
EventTraceProcessorTraceEventListInformation, // EVENT_TRACE_PROFILE_EVENT_INFORMATION
EventTraceCoverageSamplerInformation, // EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION
EventTraceUnifiedStackCachingInformation, // since 21H1
EventTraceContextRegisterTraceInformation, // TRACE_CONTEXT_REGISTER_INFO // 24H2
MaxEventTraceInfoClass
} EVENT_TRACE_INFORMATION_CLASS;
typedef struct _EVENT_TRACE_VERSION_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
ULONG EventTraceKernelVersion;
} EVENT_TRACE_VERSION_INFORMATION, *PEVENT_TRACE_VERSION_INFORMATION;
typedef struct _EVENT_TRACE_GROUPMASK_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
TRACEHANDLE TraceHandle;
ULONG Masks[8]; // PERFINFO_GROUPMASK
} EVENT_TRACE_GROUPMASK_INFORMATION, *PEVENT_TRACE_GROUPMASK_INFORMATION;
typedef struct _EVENT_TRACE_PERFORMANCE_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
LARGE_INTEGER LogfileBytesWritten;
} EVENT_TRACE_PERFORMANCE_INFORMATION, *PEVENT_TRACE_PERFORMANCE_INFORMATION;
typedef struct _EVENT_TRACE_TIME_PROFILE_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
ULONG ProfileInterval;
} EVENT_TRACE_TIME_PROFILE_INFORMATION, *PEVENT_TRACE_TIME_PROFILE_INFORMATION;
typedef struct _EVENT_TRACE_SESSION_SECURITY_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
ULONG SecurityInformation;
TRACEHANDLE TraceHandle;
UCHAR SecurityDescriptor[1];
} EVENT_TRACE_SESSION_SECURITY_INFORMATION, *PEVENT_TRACE_SESSION_SECURITY_INFORMATION;
typedef struct _EVENT_TRACE_SPINLOCK_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
ULONG SpinLockSpinThreshold;
ULONG SpinLockAcquireSampleRate;
ULONG SpinLockContentionSampleRate;
ULONG SpinLockHoldThreshold;
} EVENT_TRACE_SPINLOCK_INFORMATION, *PEVENT_TRACE_SPINLOCK_INFORMATION;
typedef struct _EVENT_TRACE_SYSTEM_EVENT_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
TRACEHANDLE TraceHandle;
ULONG HookId[1];
} EVENT_TRACE_SYSTEM_EVENT_INFORMATION, *PEVENT_TRACE_SYSTEM_EVENT_INFORMATION;
typedef EVENT_TRACE_SYSTEM_EVENT_INFORMATION EVENT_TRACE_STACK_TRACING_INFORMATION, *PEVENT_TRACE_STACK_TRACING_INFORMATION;
typedef EVENT_TRACE_SYSTEM_EVENT_INFORMATION EVENT_TRACE_PEBS_TRACING_INFORMATION, *PEVENT_TRACE_PEBS_TRACING_INFORMATION;
typedef EVENT_TRACE_SYSTEM_EVENT_INFORMATION EVENT_TRACE_PROFILE_EVENT_INFORMATION, *PEVENT_TRACE_PROFILE_EVENT_INFORMATION;
typedef struct _EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
ULONG ReleaseSamplingRate;
ULONG ContentionSamplingRate;
ULONG NumberOfExcessiveTimeouts;
} EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION, *PEVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION;
typedef struct _EVENT_TRACE_HEAP_TRACING_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
ULONG ProcessId[1];
} EVENT_TRACE_HEAP_TRACING_INFORMATION, *PEVENT_TRACE_HEAP_TRACING_INFORMATION;
typedef struct _EVENT_TRACE_TAG_FILTER_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
TRACEHANDLE TraceHandle;
ULONG Filter[1];
} EVENT_TRACE_TAG_FILTER_INFORMATION, *PEVENT_TRACE_TAG_FILTER_INFORMATION;
typedef EVENT_TRACE_TAG_FILTER_INFORMATION EVENT_TRACE_POOLTAG_FILTER_INFORMATION, *PEVENT_TRACE_POOLTAG_FILTER_INFORMATION;
typedef EVENT_TRACE_TAG_FILTER_INFORMATION EVENT_TRACE_OBJECT_TYPE_FILTER_INFORMATION, *PEVENT_TRACE_OBJECT_TYPE_FILTER_INFORMATION;
// ProfileSource
#define ETW_MAX_PROFILING_SOURCES 4
#define ETW_MAX_PMC_EVENTS 4
#define ETW_MAX_PMC_COUNTERS 4
typedef struct _EVENT_TRACE_PROFILE_COUNTER_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
TRACEHANDLE TraceHandle;
ULONG ProfileSource[1];
} EVENT_TRACE_PROFILE_COUNTER_INFORMATION, *PEVENT_TRACE_PROFILE_COUNTER_INFORMATION;
typedef EVENT_TRACE_PROFILE_COUNTER_INFORMATION EVENT_TRACE_PROFILE_CONFIG_INFORMATION, *PEVENT_TRACE_PROFILE_CONFIG_INFORMATION;
//_Struct_size_bytes_(NextEntryOffset)
//typedef struct _PROFILE_SOURCE_INFO
//{
// ULONG NextEntryOffset;
// ULONG Source;
// ULONG MinInterval;
// ULONG MaxInterval;
// PVOID Reserved;
// WCHAR Description[1];
//} PROFILE_SOURCE_INFO, *PPROFILE_SOURCE_INFO;
typedef struct _PROFILE_SOURCE_INFO *PPROFILE_SOURCE_INFO;
typedef struct _EVENT_TRACE_PROFILE_LIST_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
ULONG Spare;
PPROFILE_SOURCE_INFO Profile[1];
} EVENT_TRACE_PROFILE_LIST_INFORMATION, *PEVENT_TRACE_PROFILE_LIST_INFORMATION;
typedef struct _EVENT_TRACE_STACK_CACHING_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
TRACEHANDLE TraceHandle;
BOOLEAN Enabled;
UCHAR Reserved[3];
ULONG CacheSize;
ULONG BucketCount;
} EVENT_TRACE_STACK_CACHING_INFORMATION, *PEVENT_TRACE_STACK_CACHING_INFORMATION;
typedef struct _EVENT_TRACE_SOFT_RESTART_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
TRACEHANDLE TraceHandle;
BOOLEAN PersistTraceBuffers;
WCHAR FileName[1];
} EVENT_TRACE_SOFT_RESTART_INFORMATION, *PEVENT_TRACE_SOFT_RESTART_INFORMATION;
typedef enum _EVENT_TRACE_PROFILE_ADD_INFORMATION_VERSIONS
{
EventTraceProfileAddInformationMinVersion = 0x2,
EventTraceProfileAddInformationV2 = 0x2,
EventTraceProfileAddInformationV3 = 0x3,
EventTraceProfileAddInformationMaxVersion = 0x3,
} EVENT_TRACE_PROFILE_ADD_INFORMATION_VERSIONS;
typedef union _EVENT_TRACE_PROFILE_ADD_INFORMATION_V2
{
struct
{
UCHAR PerfEvtEventSelect;
UCHAR PerfEvtUnitSelect;
UCHAR PerfEvtCMask;
UCHAR PerfEvtCInv;
UCHAR PerfEvtAnyThread;
UCHAR PerfEvtEdgeDetect;
} Intel;
struct
{
UCHAR PerfEvtEventSelect;
UCHAR PerfEvtUnitSelect;
} Amd;
struct
{
ULONG PerfEvtType;
UCHAR AllowsHalt;
} Arm;
} EVENT_TRACE_PROFILE_ADD_INFORMATION_V2;
typedef union _EVENT_TRACE_PROFILE_ADD_INFORMATION_V3
{
struct
{
UCHAR PerfEvtEventSelect;
UCHAR PerfEvtUnitSelect;
UCHAR PerfEvtCMask;
UCHAR PerfEvtCInv;
UCHAR PerfEvtAnyThread;
UCHAR PerfEvtEdgeDetect;
} Intel;
struct
{
USHORT PerfEvtEventSelect;
UCHAR PerfEvtUnitSelect;
UCHAR PerfEvtCMask;
UCHAR PerfEvtCInv;
UCHAR PerfEvtEdgeDetect;
UCHAR PerfEvtHostGuest;
UCHAR PerfPmuType;
} Amd;
struct
{
ULONG PerfEvtType;
UCHAR AllowsHalt;
} Arm;
} EVENT_TRACE_PROFILE_ADD_INFORMATION_V3;
typedef struct _EVENT_TRACE_PROFILE_ADD_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
UCHAR Version;
union
{
EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 V2;
EVENT_TRACE_PROFILE_ADD_INFORMATION_V3 V3;
};
ULONG CpuInfoHierarchy[0x3];
ULONG InitialInterval;
BOOLEAN Persist;
WCHAR ProfileSourceDescription[0x1];
} EVENT_TRACE_PROFILE_ADD_INFORMATION, *PEVENT_TRACE_PROFILE_ADD_INFORMATION;
typedef struct _EVENT_TRACE_PROFILE_REMOVE_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
KPROFILE_SOURCE ProfileSource;
ULONG CpuInfoHierarchy[0x3];
} EVENT_TRACE_PROFILE_REMOVE_INFORMATION, *PEVENT_TRACE_PROFILE_REMOVE_INFORMATION;
typedef struct _EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION
{
EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
UCHAR CoverageSamplerInformationClass;
UCHAR MajorVersion;
UCHAR MinorVersion;
UCHAR Reserved;
HANDLE SamplerHandle;
} EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION, *PEVENT_TRACE_COVERAGE_SAMPLER_INFORMATION;
//typedef struct _TRACE_CONTEXT_REGISTER_INFO
//{
// ETW_CONTEXT_REGISTER_TYPES RegisterTypes;
// ULONG Reserved;
//} TRACE_CONTEXT_REGISTER_INFO, *PTRACE_CONTEXT_REGISTER_INFO;
typedef struct _SYSTEM_EXCEPTION_INFORMATION
{
ULONG AlignmentFixupCount;
ULONG ExceptionDispatchCount;
ULONG FloatingEmulationCount;
ULONG ByteWordEmulationCount;
} SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION;
typedef enum _SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS
{
SystemCrashDumpDisable,
SystemCrashDumpReconfigure,
SystemCrashDumpInitializationComplete
} SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS, *PSYSTEM_CRASH_DUMP_CONFIGURATION_CLASS;
typedef struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION
{
SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS CrashDumpConfigurationClass;
} SYSTEM_CRASH_DUMP_STATE_INFORMATION, *PSYSTEM_CRASH_DUMP_STATE_INFORMATION;
typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION
{
BOOLEAN KernelDebuggerEnabled;
BOOLEAN KernelDebuggerNotPresent;
} SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION;
typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION
{
ULONG ContextSwitches;
ULONG FindAny;
ULONG FindLast;
ULONG FindIdeal;
ULONG IdleAny;
ULONG IdleCurrent;
ULONG IdleLast;
ULONG IdleIdeal;
ULONG PreemptAny;
ULONG PreemptCurrent;
ULONG PreemptLast;
ULONG SwitchToIdle;
} SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION;
typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION
{
ULONG RegistryQuotaAllowed;
ULONG RegistryQuotaUsed;
SIZE_T PagedPoolSize;
} SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;
typedef struct _SYSTEM_PROCESSOR_IDLE_INFORMATION
{
ULONGLONG IdleTime;
ULONGLONG C1Time;
ULONGLONG C2Time;
ULONGLONG C3Time;
ULONG C1Transitions;
ULONG C2Transitions;
ULONG C3Transitions;
ULONG Padding;
} SYSTEM_PROCESSOR_IDLE_INFORMATION, *PSYSTEM_PROCESSOR_IDLE_INFORMATION;
typedef struct _SYSTEM_LEGACY_DRIVER_INFORMATION
{
ULONG VetoType;
UNICODE_STRING VetoList;
} SYSTEM_LEGACY_DRIVER_INFORMATION, *PSYSTEM_LEGACY_DRIVER_INFORMATION;
typedef struct _SYSTEM_LOOKASIDE_INFORMATION
{
USHORT CurrentDepth;
USHORT MaximumDepth;
ULONG TotalAllocates;
ULONG AllocateMisses;
ULONG TotalFrees;
ULONG FreeMisses;
ULONG Type;
ULONG Tag;
ULONG Size;
} SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION;
// private
typedef struct _SYSTEM_RANGE_START_INFORMATION
{
ULONG_PTR SystemRangeStart;
} SYSTEM_RANGE_START_INFORMATION, *PSYSTEM_RANGE_START_INFORMATION;
_Struct_size_bytes_(NextEntryOffset)
typedef struct _SYSTEM_VERIFIER_INFORMATION_LEGACY // pre-19H1
{
ULONG NextEntryOffset;
ULONG Level;
UNICODE_STRING DriverName;
ULONG RaiseIrqls;
ULONG AcquireSpinLocks;
ULONG SynchronizeExecutions;
ULONG AllocationsAttempted;
ULONG AllocationsSucceeded;
ULONG AllocationsSucceededSpecialPool;
ULONG AllocationsWithNoTag;
ULONG TrimRequests;
ULONG Trims;
ULONG AllocationsFailed;
ULONG AllocationsFailedDeliberately;
ULONG Loads;
ULONG Unloads;
ULONG UnTrackedPool;
ULONG CurrentPagedPoolAllocations;
ULONG CurrentNonPagedPoolAllocations;
ULONG PeakPagedPoolAllocations;
ULONG PeakNonPagedPoolAllocations;
SIZE_T PagedPoolUsageInBytes;
SIZE_T NonPagedPoolUsageInBytes;
SIZE_T PeakPagedPoolUsageInBytes;
SIZE_T PeakNonPagedPoolUsageInBytes;
} SYSTEM_VERIFIER_INFORMATION_LEGACY, *PSYSTEM_VERIFIER_INFORMATION_LEGACY;
_Struct_size_bytes_(NextEntryOffset)
typedef struct _SYSTEM_VERIFIER_INFORMATION
{
ULONG NextEntryOffset;
ULONG Level;
ULONG RuleClasses[2];
ULONG TriageContext;
ULONG AreAllDriversBeingVerified;
UNICODE_STRING DriverName;
ULONG RaiseIrqls;
ULONG AcquireSpinLocks;
ULONG SynchronizeExecutions;
ULONG AllocationsAttempted;
ULONG AllocationsSucceeded;
ULONG AllocationsSucceededSpecialPool;
ULONG AllocationsWithNoTag;
ULONG TrimRequests;
ULONG Trims;
ULONG AllocationsFailed;
ULONG AllocationsFailedDeliberately;
ULONG Loads;
ULONG Unloads;
ULONG UnTrackedPool;
ULONG CurrentPagedPoolAllocations;
ULONG CurrentNonPagedPoolAllocations;
ULONG PeakPagedPoolAllocations;
ULONG PeakNonPagedPoolAllocations;
SIZE_T PagedPoolUsageInBytes;
SIZE_T NonPagedPoolUsageInBytes;
SIZE_T PeakPagedPoolUsageInBytes;
SIZE_T PeakNonPagedPoolUsageInBytes;
} SYSTEM_VERIFIER_INFORMATION, *PSYSTEM_VERIFIER_INFORMATION;
// private
typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
{
ULONG SessionId;
ULONG BufferSize;
PVOID Buffer;
} SYSTEM_SESSION_PROCESS_INFORMATION, *PSYSTEM_SESSION_PROCESS_INFORMATION;
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// private
typedef struct _SYSTEM_GDI_DRIVER_INFORMATION
{
UNICODE_STRING DriverName;
PVOID ImageAddress;
PVOID SectionPointer;
PVOID EntryPoint;
PIMAGE_EXPORT_DIRECTORY ExportSectionPointer;
ULONG ImageLength;
} SYSTEM_GDI_DRIVER_INFORMATION, *PSYSTEM_GDI_DRIVER_INFORMATION;
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
// geoffchappell
#ifdef _WIN64
#define MAXIMUM_NODE_COUNT 0x40
#else
#define MAXIMUM_NODE_COUNT 0x10
#endif
// private
typedef struct _SYSTEM_NUMA_INFORMATION
{
ULONG HighestNodeNumber;
ULONG Reserved;
union
{
GROUP_AFFINITY ActiveProcessorsGroupAffinity[MAXIMUM_NODE_COUNT];
ULONGLONG AvailableMemory[MAXIMUM_NODE_COUNT];
ULONGLONG Pad[MAXIMUM_NODE_COUNT * 2];
} DUMMYUNIONNAME;
} SYSTEM_NUMA_INFORMATION, *PSYSTEM_NUMA_INFORMATION;
typedef struct _SYSTEM_PROCESSOR_POWER_INFORMATION
{
UCHAR CurrentFrequency;
UCHAR ThermalLimitFrequency;
UCHAR ConstantThrottleFrequency;
UCHAR DegradedThrottleFrequency;
UCHAR LastBusyFrequency;
UCHAR LastC3Frequency;
UCHAR LastAdjustedBusyFrequency;
UCHAR ProcessorMinThrottle;
UCHAR ProcessorMaxThrottle;
ULONG NumberOfFrequencies;
ULONG PromotionCount;
ULONG DemotionCount;
ULONG ErrorCount;
ULONG RetryCount;
ULONGLONG CurrentFrequencyTime;
ULONGLONG CurrentProcessorTime;
ULONGLONG CurrentProcessorIdleTime;
ULONGLONG LastProcessorTime;
ULONGLONG LastProcessorIdleTime;
ULONGLONG Energy;
} SYSTEM_PROCESSOR_POWER_INFORMATION, *PSYSTEM_PROCESSOR_POWER_INFORMATION;
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX
{
PVOID Object;
HANDLE UniqueProcessId;
HANDLE HandleValue;
ACCESS_MASK GrantedAccess;
USHORT CreatorBackTraceIndex;
USHORT ObjectTypeIndex;
ULONG HandleAttributes;
ULONG Reserved;
} SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;
typedef struct _SYSTEM_HANDLE_INFORMATION_EX
{
ULONG_PTR NumberOfHandles;
ULONG_PTR Reserved;
_Field_size_(NumberOfHandles) SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];
} SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;
typedef struct _SYSTEM_BIGPOOL_ENTRY
{
union
{
PVOID VirtualAddress;
ULONG_PTR NonPaged : 1;
};
SIZE_T SizeInBytes;
union
{
UCHAR Tag[4];
ULONG TagUlong;
};
} SYSTEM_BIGPOOL_ENTRY, *PSYSTEM_BIGPOOL_ENTRY;
typedef struct _SYSTEM_BIGPOOL_INFORMATION
{
ULONG Count;
_Field_size_(Count) SYSTEM_BIGPOOL_ENTRY AllocatedInfo[1];
} SYSTEM_BIGPOOL_INFORMATION, *PSYSTEM_BIGPOOL_INFORMATION;
typedef struct _SYSTEM_POOL_ENTRY
{
BOOLEAN Allocated;
BOOLEAN Spare0;
USHORT AllocatorBackTraceIndex;
ULONG Size;
union
{
UCHAR Tag[4];
ULONG TagUlong;
PVOID ProcessChargedQuota;
};
} SYSTEM_POOL_ENTRY, *PSYSTEM_POOL_ENTRY;
typedef struct _SYSTEM_POOL_INFORMATION
{
SIZE_T TotalSize;
PVOID FirstEntry;
USHORT EntryOverhead;
BOOLEAN PoolTagPresent;
BOOLEAN Spare0;
ULONG NumberOfEntries;
_Field_size_(NumberOfEntries) SYSTEM_POOL_ENTRY Entries[1];
} SYSTEM_POOL_INFORMATION, *PSYSTEM_POOL_INFORMATION;
_Struct_size_bytes_(NextEntryOffset)
typedef struct _SYSTEM_SESSION_POOLTAG_INFORMATION
{
SIZE_T NextEntryOffset;
ULONG SessionId;
ULONG Count;
_Field_size_(Count) SYSTEM_POOLTAG TagInfo[1];
} SYSTEM_SESSION_POOLTAG_INFORMATION, *PSYSTEM_SESSION_POOLTAG_INFORMATION;
_Struct_size_bytes_(NextEntryOffset)
typedef struct _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION
{
SIZE_T NextEntryOffset;
ULONG SessionId;
ULONG ViewFailures;
SIZE_T NumberOfBytesAvailable;
SIZE_T NumberOfBytesAvailableContiguous;
} SYSTEM_SESSION_MAPPED_VIEW_INFORMATION, *PSYSTEM_SESSION_MAPPED_VIEW_INFORMATION;
typedef enum _WATCHDOG_HANDLER_ACTION
{
WdActionSetTimeoutValue,
WdActionQueryTimeoutValue,
WdActionResetTimer,
WdActionStopTimer,
WdActionStartTimer,
WdActionSetTriggerAction,
WdActionQueryTriggerAction,
WdActionQueryState
} WATCHDOG_HANDLER_ACTION;
typedef _Function_class_(SYSTEM_WATCHDOG_HANDLER)
NTSTATUS NTAPI SYSTEM_WATCHDOG_HANDLER(
_In_ WATCHDOG_HANDLER_ACTION Action,
_In_ PVOID Context,
_Inout_ PULONG DataValue,
_In_ BOOLEAN NoLocks
);
typedef SYSTEM_WATCHDOG_HANDLER* PSYSTEM_WATCHDOG_HANDLER;
// private
typedef struct _SYSTEM_WATCHDOG_HANDLER_INFORMATION
{
PSYSTEM_WATCHDOG_HANDLER WdHandler;
PVOID Context;
} SYSTEM_WATCHDOG_HANDLER_INFORMATION, *PSYSTEM_WATCHDOG_HANDLER_INFORMATION;
typedef enum _WATCHDOG_INFORMATION_CLASS
{
WdInfoTimeoutValue = 0,
WdInfoResetTimer = 1,
WdInfoStopTimer = 2,
WdInfoStartTimer = 3,
WdInfoTriggerAction = 4,
WdInfoState = 5,
WdInfoTriggerReset = 6,
WdInfoNop = 7,
WdInfoGeneratedLastReset = 8,
WdInfoInvalid = 9,
} WATCHDOG_INFORMATION_CLASS;
// private
typedef struct _SYSTEM_WATCHDOG_TIMER_INFORMATION
{
WATCHDOG_INFORMATION_CLASS WdInfoClass;
ULONG DataValue;
} SYSTEM_WATCHDOG_TIMER_INFORMATION, *PSYSTEM_WATCHDOG_TIMER_INFORMATION;
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// private
typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION
{
SystemFirmwareTableEnumerate,
SystemFirmwareTableGet,
SystemFirmwareTableMax
} SYSTEM_FIRMWARE_TABLE_ACTION;
// private
typedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
{
ULONG ProviderSignature; // (same as the GetSystemFirmwareTable function)
SYSTEM_FIRMWARE_TABLE_ACTION Action;
ULONG TableID;
ULONG TableBufferLength;
_Field_size_bytes_(TableBufferLength) UCHAR TableBuffer[1];
} SYSTEM_FIRMWARE_TABLE_INFORMATION, *PSYSTEM_FIRMWARE_TABLE_INFORMATION;
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// private
typedef _Function_class_(FNFTH)
NTSTATUS STDAPIVCALLTYPE FNFTH(
_Inout_ PSYSTEM_FIRMWARE_TABLE_INFORMATION SystemFirmwareTableInfo
);
typedef FNFTH* PFNFTH;
// private
typedef struct _SYSTEM_FIRMWARE_TABLE_HANDLER
{
ULONG ProviderSignature;
BOOLEAN Register;
PFNFTH FirmwareTableHandler;
PVOID DriverObject;
} SYSTEM_FIRMWARE_TABLE_HANDLER, *PSYSTEM_FIRMWARE_TABLE_HANDLER;
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
// private
typedef struct _SYSTEM_MEMORY_LIST_INFORMATION
{
SIZE_T ZeroPageCount;
SIZE_T FreePageCount;
SIZE_T ModifiedPageCount;
SIZE_T ModifiedNoWritePageCount;
SIZE_T BadPageCount;
SIZE_T PageCountByPriority[8];
SIZE_T RepurposedPagesByPriority[8];
SIZE_T ModifiedPageCountPageFile;
} SYSTEM_MEMORY_LIST_INFORMATION, *PSYSTEM_MEMORY_LIST_INFORMATION;
// private
typedef enum _SYSTEM_MEMORY_LIST_COMMAND
{
MemoryCaptureAccessedBits,
MemoryCaptureAndResetAccessedBits,
MemoryEmptyWorkingSets,
MemoryFlushModifiedList,
MemoryPurgeStandbyList,
MemoryPurgeLowPriorityStandbyList,
MemoryCommandMax
} SYSTEM_MEMORY_LIST_COMMAND;
/**
* The SYSTEM_THREAD_CID_PRIORITY_INFORMATION structure is used with NtSetSystemInformation
* to set the priority of a thread by its client ID (process ID and thread ID) without
* requiring a thread handle.
*
* \remarks This structure is used with the SystemThreadPriorityClientIdInformation
* information class (0x52). The caller must have SeIncreaseBasePriorityPrivilege
* to raise a thread's priority above normal.
*/
typedef struct _SYSTEM_THREAD_CID_PRIORITY_INFORMATION
{
CLIENT_ID ClientId; // The process and thread identifiers of the target thread.
KPRIORITY Priority; // The new priority value to assign to the thread.
} SYSTEM_THREAD_CID_PRIORITY_INFORMATION, *PSYSTEM_THREAD_CID_PRIORITY_INFORMATION;
/**
* The SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION structure contains the cumulative number of clock cycles a logical processor
* has spent running its idle thread, deferred procedure calls (DPCs) and interrupt service routines (ISRs) since it became active.
* \see https://learn.microsoft.com/en-us/windows/win32/api/realtimeapiset/nf-realtimeapiset-queryidleprocessorcycletimeex
*/
typedef struct _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION
{
ULONGLONG CycleTime;
} SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION, *PSYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION;
// private
typedef struct _SYSTEM_VERIFIER_ISSUE
{
ULONGLONG IssueType;
PVOID Address;
ULONGLONG Parameters[2];
} SYSTEM_VERIFIER_ISSUE, *PSYSTEM_VERIFIER_ISSUE;
// private
typedef struct _SYSTEM_VERIFIER_CANCELLATION_INFORMATION
{
ULONG CancelProbability;
ULONG CancelThreshold;
ULONG CompletionThreshold;
ULONG CancellationVerifierDisabled;
ULONG AvailableIssues;
SYSTEM_VERIFIER_ISSUE Issues[128];
} SYSTEM_VERIFIER_CANCELLATION_INFORMATION, *PSYSTEM_VERIFIER_CANCELLATION_INFORMATION;
// private
typedef struct _SYSTEM_REF_TRACE_INFORMATION
{
BOOLEAN TraceEnable;
BOOLEAN TracePermanent;
UNICODE_STRING TraceProcessName;
UNICODE_STRING TracePoolTags;
} SYSTEM_REF_TRACE_INFORMATION, *PSYSTEM_REF_TRACE_INFORMATION;
// private
typedef struct _SYSTEM_SPECIAL_POOL_INFORMATION
{
ULONG PoolTag;
ULONG Flags;
} SYSTEM_SPECIAL_POOL_INFORMATION, *PSYSTEM_SPECIAL_POOL_INFORMATION;
/**
* The SYSTEM_PROCESS_ID_INFORMATION structure retrieves the executable image
* name associated with a specific process ID. The caller supplies a process ID,
* and on return the system fills the UNICODE_STRING with the corresponding image path.
*/
typedef struct _SYSTEM_PROCESS_ID_INFORMATION
{
HANDLE ProcessId;
UNICODE_STRING ImageName;
} SYSTEM_PROCESS_ID_INFORMATION, *PSYSTEM_PROCESS_ID_INFORMATION;
// private
typedef struct _SYSTEM_HYPERVISOR_QUERY_INFORMATION
{
BOOLEAN HypervisorConnected;
BOOLEAN HypervisorDebuggingEnabled;
BOOLEAN HypervisorPresent;
BOOLEAN Spare0[5];
ULONGLONG EnabledEnlightenments;
} SYSTEM_HYPERVISOR_QUERY_INFORMATION, *PSYSTEM_HYPERVISOR_QUERY_INFORMATION;
// private
typedef struct _SYSTEM_BOOT_ENVIRONMENT_INFORMATION
{
GUID BootIdentifier;
FIRMWARE_TYPE FirmwareType;
union
{
ULONGLONG BootFlags;
struct
{
ULONGLONG DbgMenuOsSelection : 1; // REDSTONE4
ULONGLONG DbgHiberBoot : 1;
ULONGLONG DbgSoftBoot : 1;
ULONGLONG DbgMeasuredLaunch : 1;
ULONGLONG DbgMeasuredLaunchCapable : 1; // 19H1
ULONGLONG DbgSystemHiveReplace : 1;
ULONGLONG DbgMeasuredLaunchSmmProtections : 1;
ULONGLONG DbgMeasuredLaunchSmmLevel : 7; // 20H1
ULONGLONG DbgBugCheckRecovery : 1; // 24H2
ULONGLONG DbgFASR : 1;
ULONGLONG DbgUseCachedBcd : 1;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
} SYSTEM_BOOT_ENVIRONMENT_INFORMATION, *PSYSTEM_BOOT_ENVIRONMENT_INFORMATION;
// private
typedef struct _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION
{
ULONG FlagsToEnable;
ULONG FlagsToDisable;
} SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION, *PSYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION;
// private
typedef enum _COVERAGE_REQUEST_CODES
{
CoverageAllModules = 0,
CoverageSearchByHash = 1,
CoverageSearchByName = 2
} COVERAGE_REQUEST_CODES;
// private
typedef struct _COVERAGE_MODULE_REQUEST
{
COVERAGE_REQUEST_CODES RequestType;
union
{
UCHAR MD5Hash[16];
UNICODE_STRING ModuleName;
} SearchInfo;
} COVERAGE_MODULE_REQUEST, *PCOVERAGE_MODULE_REQUEST;
// private
typedef struct _COVERAGE_MODULE_INFO
{
ULONG ModuleInfoSize;
ULONG IsBinaryLoaded;
UNICODE_STRING ModulePathName;
ULONG CoverageSectionSize;
UCHAR CoverageSection[1];
} COVERAGE_MODULE_INFO, *PCOVERAGE_MODULE_INFO;
// private
typedef struct _COVERAGE_MODULES
{
ULONG ListAndReset;
ULONG NumberOfModules;
COVERAGE_MODULE_REQUEST ModuleRequestInfo;
COVERAGE_MODULE_INFO Modules[1];
} COVERAGE_MODULES, *PCOVERAGE_MODULES;
// private
typedef struct _SYSTEM_PREFETCH_PATCH_INFORMATION
{
ULONG PrefetchPatchCount;
} SYSTEM_PREFETCH_PATCH_INFORMATION, *PSYSTEM_PREFETCH_PATCH_INFORMATION;
// private
typedef struct _SYSTEM_VERIFIER_FAULTS_INFORMATION
{
ULONG Probability;
ULONG MaxProbability;
UNICODE_STRING PoolTags;
UNICODE_STRING Applications;
} SYSTEM_VERIFIER_FAULTS_INFORMATION, *PSYSTEM_VERIFIER_FAULTS_INFORMATION;
// private
typedef struct _SYSTEM_VERIFIER_INFORMATION_EX
{
ULONG VerifyMode;
ULONG OptionChanges;
UNICODE_STRING PreviousBucketName;
ULONG IrpCancelTimeoutMsec;
ULONG VerifierExtensionEnabled;
#ifdef _WIN64
ULONG Reserved[1];
#else
ULONG Reserved[3];
#endif
} SYSTEM_VERIFIER_INFORMATION_EX, *PSYSTEM_VERIFIER_INFORMATION_EX;
// private
typedef struct _SYSTEM_SYSTEM_PARTITION_INFORMATION
{
UNICODE_STRING SystemPartition;
} SYSTEM_SYSTEM_PARTITION_INFORMATION, *PSYSTEM_SYSTEM_PARTITION_INFORMATION;
// private
typedef struct _SYSTEM_SYSTEM_DISK_INFORMATION
{
UNICODE_STRING SystemDisk;
} SYSTEM_SYSTEM_DISK_INFORMATION, *PSYSTEM_SYSTEM_DISK_INFORMATION;
// private
typedef struct _SYSTEM_NUMA_PROXIMITY_MAP
{
ULONG NodeProximityId;
USHORT NodeNumber;
} SYSTEM_NUMA_PROXIMITY_MAP, *PSYSTEM_NUMA_PROXIMITY_MAP;
// private (Windows 8.1 and above)
typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT
{
ULONGLONG Hits;
UCHAR PercentFrequency;
} SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT, *PSYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT;
// private (Windows 8.1 and above)
typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION
{
ULONG ProcessorNumber;
ULONG StateCount;
_Field_size_(StateCount) SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT States[1];
} SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION, *PSYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION;
// private (Windows 7 and Windows 8)
typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT_WIN8
{
ULONG Hits;
UCHAR PercentFrequency;
} SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT_WIN8, *PSYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT_WIN8;
// private (Windows 7 and Windows 8)
typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION_WIN8
{
ULONG ProcessorNumber;
ULONG StateCount;
_Field_size_(StateCount) SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT_WIN8 States[1];
} SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION_WIN8, *PSYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION_WIN8;
// private
typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION
{
ULONG ProcessorCount;
ULONG Offsets[1];
} SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION, *PSYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION;
#define CODEINTEGRITY_OPTION_ENABLED 0x01
#define CODEINTEGRITY_OPTION_TESTSIGN 0x02
#define CODEINTEGRITY_OPTION_UMCI_ENABLED 0x04
#define CODEINTEGRITY_OPTION_UMCI_AUDITMODE_ENABLED 0x08
#define CODEINTEGRITY_OPTION_UMCI_EXCLUSIONPATHS_ENABLED 0x10
#define CODEINTEGRITY_OPTION_TEST_BUILD 0x20
#define CODEINTEGRITY_OPTION_PREPRODUCTION_BUILD 0x40
#define CODEINTEGRITY_OPTION_DEBUGMODE_ENABLED 0x80
#define CODEINTEGRITY_OPTION_FLIGHT_BUILD 0x100
#define CODEINTEGRITY_OPTION_FLIGHTING_ENABLED 0x200
#define CODEINTEGRITY_OPTION_HVCI_KMCI_ENABLED 0x400
#define CODEINTEGRITY_OPTION_HVCI_KMCI_AUDITMODE_ENABLED 0x800
#define CODEINTEGRITY_OPTION_HVCI_KMCI_STRICTMODE_ENABLED 0x1000
#define CODEINTEGRITY_OPTION_HVCI_IUM_ENABLED 0x2000
#define CODEINTEGRITY_OPTION_WHQL_ENFORCEMENT_ENABLED 0x4000
#define CODEINTEGRITY_OPTION_WHQL_AUDITMODE_ENABLED 0x8000
// private
typedef struct _SYSTEM_CODEINTEGRITY_INFORMATION
{
ULONG Length;
union
{
ULONG CodeIntegrityOptions;
struct
{
ULONG Enabled : 1; // CODEINTEGRITY_OPTION_ENABLED
ULONG TestSign : 1; // CODEINTEGRITY_OPTION_TESTSIGN
ULONG UmciEnabled : 1; // CODEINTEGRITY_OPTION_UMCI_ENABLED
ULONG UmciAuditModeEnabled : 1; // CODEINTEGRITY_OPTION_UMCI_AUDITMODE_ENABLED
ULONG UmciExclusionPathsEnabled : 1; // CODEINTEGRITY_OPTION_UMCI_EXCLUSIONPATHS_ENABLED
ULONG TestBuild : 1; // CODEINTEGRITY_OPTION_TEST_BUILD
ULONG PreproductionBuild : 1; // CODEINTEGRITY_OPTION_PREPRODUCTION_BUILD
ULONG DebugModeEnabled : 1; // CODEINTEGRITY_OPTION_DEBUGMODE_ENABLE
ULONG FlightBuild : 1; // CODEINTEGRITY_OPTION_FLIGHT_BUILD
ULONG FlightingEnabled : 1; // CODEINTEGRITY_OPTION_FLIGHTING_ENABLED
ULONG HvciKmciEnabled : 1; // CODEINTEGRITY_OPTION_HVCI_KMCI_ENABLED
ULONG HvciKmciAuditModeEnabled : 1; // CODEINTEGRITY_OPTION_HVCI_KMCI_AUDITMODE_ENABLED
ULONG HvciKmciStrictModeEnabled : 1; // CODEINTEGRITY_OPTION_HVCI_KMCI_STRICTMODE_ENABLED
ULONG HvciIumEnabled : 1; // CODEINTEGRITY_OPTION_HVCI_IUM_ENABLED
ULONG WhqlEnforcementEnabled : 1; // CODEINTEGRITY_OPTION_WHQL_ENFORCEMENT_ENABLED
ULONG WhqlAuditModeEnabled : 1; // CODEINTEGRITY_OPTION_WHQL_AUDITMODE_ENABLED
ULONG Spare : 16;
};
};
} SYSTEM_CODEINTEGRITY_INFORMATION, *PSYSTEM_CODEINTEGRITY_INFORMATION;
// rev
// Loads mcupdate.dll via ntosext.sys to perform microcode updates.
#define PROCESSOR_MICROCODE_OPERATION_LOAD 0x01
// rev
// Unloads mcupdate.dll via ntosext.sys to preform microcode updates.
#define PROCESSOR_MICROCODE_OPERATION_UNLOAD 0x02
// private
typedef struct _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION
{
ULONG Operation;
} SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION, *PSYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION;
// private
typedef enum _SYSTEM_VA_TYPE
{
SystemVaTypeAll,
SystemVaTypeNonPagedPool,
SystemVaTypePagedPool,
SystemVaTypeSystemCache,
SystemVaTypeSystemPtes,
SystemVaTypeSessionSpace,
SystemVaTypeMax
} SYSTEM_VA_TYPE, *PSYSTEM_VA_TYPE;
// private
typedef struct _SYSTEM_VA_LIST_INFORMATION
{
SIZE_T VirtualSize;
SIZE_T VirtualPeak;
SIZE_T VirtualLimit;
SIZE_T AllocationFailures;
} SYSTEM_VA_LIST_INFORMATION, *PSYSTEM_VA_LIST_INFORMATION;
// private
//typedef enum _LOGICAL_PROCESSOR_RELATIONSHIP
//{
// RelationProcessorCore,
// RelationNumaNode,
// RelationCache,
// RelationProcessorPackage,
// RelationGroup,
// RelationProcessorDie,
// RelationNumaNodeEx,
// RelationProcessorModule,
// RelationAll = 0xffff
//} LOGICAL_PROCESSOR_RELATIONSHIP;
//
// private
//typedef struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION
//{
// ULONG_PTR ProcessorMask;
// LOGICAL_PROCESSOR_RELATIONSHIP Relationship;
// union
// {
// struct
// {
// UCHAR Flags;
// } ProcessorCore;
// struct
// {
// ULONG NodeNumber;
// } NumaNode;
// CACHE_DESCRIPTOR Cache;
// ULONGLONG Reserved[2];
// };
//} SYSTEM_LOGICAL_PROCESSOR_INFORMATION, *PSYSTEM_LOGICAL_PROCESSOR_INFORMATION;
//
// private
//typedef struct _PROCESSOR_RELATIONSHIP
//{
// UCHAR Flags;
// UCHAR EfficiencyClass;
// UCHAR Reserved[20];
// USHORT GroupCount;
// _Field_size_(GroupCount) GROUP_AFFINITY GroupMask[ANYSIZE_ARRAY];
//} PROCESSOR_RELATIONSHIP, *PPROCESSOR_RELATIONSHIP;
//
// private
//typedef struct _NUMA_NODE_RELATIONSHIP
//{
// ULONG NodeNumber;
// UCHAR Reserved[18];
// USHORT GroupCount;
// union
// {
// GROUP_AFFINITY GroupMask;
// _Field_size_(GroupCount) GROUP_AFFINITY GroupMasks[ANYSIZE_ARRAY];
// };
//} NUMA_NODE_RELATIONSHIP, *PNUMA_NODE_RELATIONSHIP;
//
// private
//typedef struct _CACHE_RELATIONSHIP
//{
// UCHAR Level;
// UCHAR Associativity;
// USHORT LineSize;
// ULONG CacheSize;
// PROCESSOR_CACHE_TYPE Type;
// UCHAR Reserved[18];
// USHORT GroupCount;
// union
// {
// GROUP_AFFINITY GroupMask;
// _Field_size_(GroupCount) GROUP_AFFINITY GroupMasks[ANYSIZE_ARRAY];
// };
//} CACHE_RELATIONSHIP, *PCACHE_RELATIONSHIP;
//
// private
//typedef struct _PROCESSOR_GROUP_INFO
//{
// UCHAR MaximumProcessorCount;
// UCHAR ActiveProcessorCount;
// UCHAR Reserved[38];
// KAFFINITY ActiveProcessorMask;
//} PROCESSOR_GROUP_INFO, *PPROCESSOR_GROUP_INFO;
//
// private
//typedef struct _GROUP_RELATIONSHIP
//{
// USHORT MaximumGroupCount;
// USHORT ActiveGroupCount;
// UCHAR Reserved[20];
// _Field_size_(ActiveGroupCount) PROCESSOR_GROUP_INFO GroupInfo[ANYSIZE_ARRAY];
//} GROUP_RELATIONSHIP, *PGROUP_RELATIONSHIP;
//
// private
//typedef _Struct_size_bytes_(Size) struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX
//{
// LOGICAL_PROCESSOR_RELATIONSHIP Relationship;
// ULONG Size;
// _Field_size_bytes_(Size - (sizeof(LOGICAL_PROCESSOR_RELATIONSHIP) + sizeof(ULONG))) union
// {
// PROCESSOR_RELATIONSHIP Processor;
// NUMA_NODE_RELATIONSHIP NumaNode;
// CACHE_RELATIONSHIP Cache;
// GROUP_RELATIONSHIP Group;
// };
//} SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX, *PSYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX;
// rev
typedef enum _STORE_INFORMATION_CLASS
{
StorePageRequest = 1, // q: Not implemented
StoreStatsRequest = 2, // q: SM_STATS_REQUEST // SmProcessStatsRequest
StoreCreateRequest = 3, // s: SM_CREATE_REQUEST (requires SeProfileSingleProcessPrivilege)
StoreDeleteRequest = 4, // s: SM_DELETE_REQUEST (requires SeProfileSingleProcessPrivilege)
StoreListRequest = 5, // q: SM_STORE_LIST_REQUEST // SM_STORE_LIST_REQUEST_EX // SmProcessListRequest
StoreEmptyRequest = 7, // q: Not implemented
CacheListRequest = 8, // q: SMC_CACHE_LIST_REQUEST // SmcProcessListRequest
CacheCreateRequest = 9, // s: SMC_CACHE_CREATE_REQUEST (requires SeProfileSingleProcessPrivilege) // SmcProcessCreateRequest
CacheDeleteRequest = 10, // s: SMC_CACHE_DELETE_REQUEST (requires SeProfileSingleProcessPrivilege) // SmcProcessDeleteRequest
CacheStoreCreateRequest = 11, // s: SMC_STORE_CREATE_REQUEST (requires SeProfileSingleProcessPrivilege) // SmcProcessStoreCreateRequest
CacheStoreDeleteRequest = 12, // s: SMC_STORE_DELETE_REQUEST (requires SeProfileSingleProcessPrivilege) // SmcProcessStoreDeleteRequest
CacheStatsRequest = 13, // q: SMC_CACHE_STATS_REQUEST // SmcProcessStatsRequest
RegistrationRequest = 15, // q: SM_REGISTRATION_REQUEST (requires SeProfileSingleProcessPrivilege) // SmProcessRegistrationRequest
GlobalCacheStatsRequest = 16, // q: Not implemented
StoreResizeRequest = 17, // s: SM_STORE_RESIZE_REQUEST (requires SeProfileSingleProcessPrivilege) // SmProcessResizeRequest
CacheStoreResizeRequest = 18, // s: SM_STORE_CACHE_RESIZE_REQUEST (requires SeProfileSingleProcessPrivilege) // SmcProcessResizeRequest
SmConfigRequest = 19, // s: SM_CONFIG_REQUEST (requires SeProfileSingleProcessPrivilege)
StoreHighMemoryPriorityRequest = 20, // s: SM_STORE_HIGH_MEMORY_PRIORITY_REQUEST (requires SeProfileSingleProcessPrivilege)
SystemStoreTrimRequest = 21, // s: SM_SYSTEM_STORE_TRIM_REQUEST (requires SeProfileSingleProcessPrivilege) // SmProcessSystemStoreTrimRequest
MemCompressionInfoRequest = 22, // q: SM_STORE_COMPRESSION_INFORMATION_REQUEST // SmProcessCompressionInfoRequest
StoreExistsForProcess = 23, // q: SM_SYSTEM_STORE_EXISTS_FOR_PROCESS // SmProcessProcessStoreInfoRequest // 25H2
CompressionReadStatsRequest = 24, // q: SM_COMPRESSION_READ_STATS_REQUEST // SmProcessCompressionReadStatsRequest
CompressionAcceleratorRequest = 25, // q: SM_COMPRESSION_ACCELERATOR_REQUEST // SmProcessCompressionAcceleratorRequest
StoreInformationMax
} STORE_INFORMATION_CLASS;
// rev
#define SYSTEM_STORE_INFORMATION_VERSION 1
// rev
typedef struct _SYSTEM_STORE_INFORMATION
{
_In_ ULONG Version;
_In_ STORE_INFORMATION_CLASS StoreInformationClass;
_Inout_ PVOID Data;
_Inout_ ULONG Length;
} SYSTEM_STORE_INFORMATION, *PSYSTEM_STORE_INFORMATION;
#define SYSTEM_STORE_STATS_INFORMATION_VERSION 2
typedef enum _ST_STATS_LEVEL
{
StStatsLevelBasic = 0,
StStatsLevelIoStats = 1,
StStatsLevelRegionSpace = 2, // requires SeProfileSingleProcessPrivilege
StStatsLevelSpaceBitmap = 3, // requires SeProfileSingleProcessPrivilege
StStatsLevelMax = 4
} ST_STATS_LEVEL;
typedef struct _SM_STATS_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_STATS_INFORMATION_VERSION
ULONG DetailLevel : 8; // ST_STATS_LEVEL
ULONG StoreId : 16;
ULONG BufferSize;
PVOID Buffer; // PST_STATS
} SM_STATS_REQUEST, *PSM_STATS_REQUEST;
typedef struct _ST_DATA_MGR_STATS
{
ULONG RegionCount;
ULONG PagesStored;
ULONG UniquePagesStored;
ULONG LazyCleanupRegionCount;
struct {
ULONG RegionsInUse;
ULONG SpaceUsed;
} Space[8];
} ST_DATA_MGR_STATS, *PST_DATA_MGR_STATS;
typedef struct _ST_IO_STATS_PERIOD
{
ULONG PageCounts[5];
} ST_IO_STATS_PERIOD, *PST_IO_STATS_PERIOD;
typedef struct _ST_IO_STATS
{
ULONG PeriodCount;
ST_IO_STATS_PERIOD Periods[64];
} ST_IO_STATS, *PST_IO_STATS;
typedef struct _ST_READ_LATENCY_BUCKET
{
ULONG LatencyUs;
ULONG Count;
} ST_READ_LATENCY_BUCKET, *PST_READ_LATENCY_BUCKET;
typedef struct _ST_READ_LATENCY_STATS
{
ST_READ_LATENCY_BUCKET Buckets[8];
} ST_READ_LATENCY_STATS, *PST_READ_LATENCY_STATS;
// rev
typedef struct _ST_STATS_REGION_INFO
{
USHORT SpaceUsed;
UCHAR Priority;
UCHAR Spare;
} ST_STATS_REGION_INFO, *PST_STATS_REGION_INFO;
// rev
typedef struct _ST_STATS_SPACE_BITMAP
{
SIZE_T CompressedBytes;
ULONG BytesPerBit;
UCHAR StoreBitmap[1];
} ST_STATS_SPACE_BITMAP, *PST_STATS_SPACE_BITMAP;
// rev
typedef struct _ST_STATS
{
ULONG Version : 8;
ULONG Level : 4;
ULONG StoreType : 4;
ULONG NoDuplication : 1;
ULONG NoCompression : 1;
ULONG EncryptionStrength : 12;
ULONG VirtualRegions : 1;
ULONG Spare0 : 1;
ULONG Size;
USHORT CompressionFormat;
USHORT Spare;
struct
{
ULONG RegionSize;
ULONG RegionCount;
ULONG RegionCountMax;
ULONG Granularity;
ST_DATA_MGR_STATS UserData;
ST_DATA_MGR_STATS Metadata;
} Basic;
struct
{
ST_IO_STATS IoStats;
ST_READ_LATENCY_STATS ReadLatencyStats;
} Io;
// ST_STATS_REGION_INFO[RegionCountMax]
// ST_STATS_SPACE_BITMAP
} ST_STATS, *PST_STATS;
#define SYSTEM_STORE_CREATE_INFORMATION_VERSION 6
typedef enum _SM_STORE_TYPE
{
StoreTypeInMemory=0,
StoreTypeFile=1,
StoreTypeMax=2
} SM_STORE_TYPE;
typedef struct _SM_STORE_BASIC_PARAMS
{
union
{
struct
{
ULONG StoreType : 8; // SM_STORE_TYPE
ULONG NoDuplication : 1;
ULONG FailNoCompression : 1;
ULONG NoCompression : 1 ;
ULONG NoEncryption : 1;
ULONG NoEvictOnAdd : 1;
ULONG PerformsFileIo : 1;
ULONG VdlNotSet : 1 ;
ULONG UseIntermediateAddBuffer : 1;
ULONG CompressNoHuff : 1;
ULONG LockActiveRegions : 1;
ULONG VirtualRegions : 1;
ULONG Spare : 13;
} DUMMYSTRUCTNAME;
ULONG StoreFlags;
} DUMMYUNIONNAME;
ULONG Granularity;
ULONG RegionSize;
ULONG RegionCountMax;
} SM_STORE_BASIC_PARAMS, *PSM_STORE_BASIC_PARAMS;
typedef struct _SMKM_REGION_EXTENT
{
ULONG RegionCount;
SIZE_T ByteOffset;
} SMKM_REGION_EXTENT, *PSMKM_REGION_EXTENT;
typedef struct _SMKM_FILE_INFO
{
HANDLE FileHandle;
PFILE_OBJECT FileObject;
PFILE_OBJECT VolumeFileObject;
PDEVICE_OBJECT VolumeDeviceObject;
HANDLE VolumePnpHandle;
PIRP UsageNotificationIrp;
PSMKM_REGION_EXTENT Extents;
ULONG ExtentCount;
} SMKM_FILE_INFO, *PSMKM_FILE_INFO;
typedef struct _SM_STORE_CACHE_BACKED_PARAMS
{
ULONG SectorSize;
PCHAR EncryptionKey;
ULONG EncryptionKeySize;
PSMKM_FILE_INFO FileInfo;
PVOID EtaContext;
PRTL_BITMAP StoreRegionBitmap;
} SM_STORE_CACHE_BACKED_PARAMS, *PSM_STORE_CACHE_BACKED_PARAMS;
typedef struct _SM_STORE_PARAMETERS
{
SM_STORE_BASIC_PARAMS Store;
ULONG Priority;
ULONG Flags;
SM_STORE_CACHE_BACKED_PARAMS CacheBacked;
} SM_STORE_PARAMETERS, *PSM_STORE_PARAMETERS;
typedef struct _SM_CREATE_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_CREATE_INFORMATION_VERSION
ULONG AcquireReference : 1;
ULONG KeyedStore : 1;
ULONG Spare : 22;
SM_STORE_PARAMETERS Params;
ULONG StoreId;
} SM_CREATE_REQUEST, *PSM_CREATE_REQUEST;
#define SYSTEM_STORE_DELETE_INFORMATION_VERSION 1
typedef struct _SM_DELETE_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_DELETE_INFORMATION_VERSION
ULONG Spare : 24;
ULONG StoreId;
} SM_DELETE_REQUEST, *PSM_DELETE_REQUEST;
#define SYSTEM_STORE_LIST_INFORMATION_VERSION 2
typedef struct _SM_STORE_LIST_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_LIST_INFORMATION_VERSION
ULONG StoreCount : 8; // = 0
ULONG ExtendedRequest : 1; // SM_STORE_LIST_REQUEST_EX if set
ULONG Spare : 15;
ULONG StoreId[32];
} SM_STORE_LIST_REQUEST, *PSM_STORE_LIST_REQUEST;
typedef struct _SM_STORE_LIST_REQUEST_EX
{
SM_STORE_LIST_REQUEST Request;
WCHAR NameBuffer[32][64];
} SM_STORE_LIST_REQUEST_EX, *PSM_STORE_LIST_REQUEST_EX;
#define SYSTEM_CACHE_LIST_INFORMATION_VERSION 2
typedef struct _SMC_CACHE_LIST_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_LIST_INFORMATION_VERSION
ULONG CacheCount : 8; // = 0
ULONG Spare : 16;
ULONG CacheId[16];
} SMC_CACHE_LIST_REQUEST, *PSMC_CACHE_LIST_REQUEST;
#define SYSTEM_CACHE_CREATE_INFORMATION_VERSION 3
typedef struct _SMC_CACHE_PARAMETERS
{
SIZE_T CacheFileSize;
ULONG StoreAlignment;
ULONG PerformsFileIo : 1;
ULONG VdlNotSet : 1;
ULONG Spare : 30;
ULONG CacheFlags;
ULONG Priority;
} SMC_CACHE_PARAMETERS, *PSMC_CACHE_PARAMETERS;
typedef struct _SMC_CACHE_CREATE_PARAMETERS
{
SMC_CACHE_PARAMETERS CacheParameters;
WCHAR TemplateFilePath[512];
} SMC_CACHE_CREATE_PARAMETERS, *PSMC_CACHE_CREATE_PARAMETERS;
typedef struct _SMC_CACHE_CREATE_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_CREATE_INFORMATION_VERSION
ULONG Spare : 24;
ULONG CacheId;
SMC_CACHE_CREATE_PARAMETERS CacheCreateParams;
} SMC_CACHE_CREATE_REQUEST, *PSMC_CACHE_CREATE_REQUEST;
#define SYSTEM_CACHE_DELETE_INFORMATION_VERSION 1
typedef struct _SMC_CACHE_DELETE_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_DELETE_INFORMATION_VERSION
ULONG Spare : 24;
ULONG CacheId;
} SMC_CACHE_DELETE_REQUEST, *PSMC_CACHE_DELETE_REQUEST;
#define SYSTEM_CACHE_STORE_CREATE_INFORMATION_VERSION 2
typedef enum _SM_STORE_MANAGER_TYPE
{
SmStoreManagerTypePhysical = 0,
SmStoreManagerTypeVirtual = 1,
SmStoreManagerTypeMax = 2
} SM_STORE_MANAGER_TYPE;
typedef struct _SMC_STORE_CREATE_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_STORE_CREATE_INFORMATION_VERSION
ULONG Spare : 24;
SM_STORE_BASIC_PARAMS StoreParams;
ULONG CacheId;
SM_STORE_MANAGER_TYPE StoreManagerType;
ULONG StoreId;
} SMC_STORE_CREATE_REQUEST, *PSMC_STORE_CREATE_REQUEST;
#define SYSTEM_CACHE_STORE_DELETE_INFORMATION_VERSION 1
typedef struct _SMC_STORE_DELETE_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_STORE_DELETE_INFORMATION_VERSION
ULONG Spare : 24;
ULONG CacheId;
SM_STORE_MANAGER_TYPE StoreManagerType;
ULONG StoreId;
} SMC_STORE_DELETE_REQUEST, *PSMC_STORE_DELETE_REQUEST;
#define SYSTEM_CACHE_STATS_INFORMATION_VERSION 3
typedef struct _SMC_CACHE_STATS
{
SIZE_T TotalFileSize;
ULONG StoreCount;
ULONG RegionCount;
ULONG RegionSizeBytes;
ULONG FileCount : 6;
ULONG PerformsFileIo : 1;
ULONG Spare : 25;
ULONG StoreIds[16];
ULONG PhysicalStoreBitmap;
ULONG Priority;
WCHAR TemplateFilePath[512];
} SMC_CACHE_STATS, *PSMC_CACHE_STATS;
typedef struct _SMC_CACHE_STATS_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_STATS_INFORMATION_VERSION
ULONG NoFilePath : 1; // Skip TemplateFilePath when set
ULONG Spare : 23;
ULONG CacheId; // cache to query for statistics
SMC_CACHE_STATS CacheStats;
} SMC_CACHE_STATS_REQUEST, *PSMC_CACHE_STATS_REQUEST;
#define SYSTEM_STORE_REGISTRATION_INFORMATION_VERSION 2
typedef struct _SM_REGISTRATION_INFO
{
HANDLE CachesUpdatedEvent;
} SM_REGISTRATION_INFO, *PSM_REGISTRATION_INFO;
typedef struct _SM_REGISTRATION_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_REGISTRATION_INFORMATION_VERSION
ULONG Spare : 24;
SM_REGISTRATION_INFO RegInfo;
} SM_REGISTRATION_REQUEST, *PSM_REGISTRATION_REQUEST;
#define SYSTEM_STORE_RESIZE_INFORMATION_VERSION 6
typedef struct _SM_STORE_RESIZE_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_RESIZE_INFORMATION_VERSION
ULONG AddRegions : 1;
ULONG Spare : 23;
ULONG StoreId;
ULONG NumberOfRegions;
PRTL_BITMAP RegionBitmap;
} SM_STORE_RESIZE_REQUEST, *PSM_STORE_RESIZE_REQUEST;
#define SYSTEM_CACHE_STORE_RESIZE_INFORMATION_VERSION 1
typedef struct _SM_STORE_CACHE_RESIZE_REQUEST
{
ULONG Version : 8; // SYSTEM_CACHE_STORE_RESIZE_INFORMATION_VERSION
ULONG AddRegions : 1;
ULONG Spare : 23;
ULONG CacheId;
ULONG StoreId;
SM_STORE_MANAGER_TYPE StoreManagerType;
ULONG RegionCount;
} SM_STORE_CACHE_RESIZE_REQUEST, *PSM_STORE_CACHE_RESIZE_REQUEST;
#define SYSTEM_STORE_CONFIG_INFORMATION_VERSION 4
typedef enum _SM_CONFIG_TYPE
{
SmConfigDirtyPageCompression = 0,
SmConfigAsyncInswap = 1,
SmConfigPrefetchSeekThreshold = 2,
SmConfigTypeMax = 3
} SM_CONFIG_TYPE;
// rev
typedef struct _SM_CONFIG_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_CONFIG_INFORMATION_VERSION
ULONG Spare : 16;
ULONG ConfigType : 8; // SM_CONFIG_TYPE
ULONG ConfigValue;
} SM_CONFIG_REQUEST, *PSM_CONFIG_REQUEST;
// rev
#define SYSTEM_STORE_PRIORITY_REQUEST_VERSION 1
// rev
#define SYSTEM_STORE_PRIORITY_FLAG_REQUIRE_HANDLE 0x00000100u // required
#define SYSTEM_STORE_PRIORITY_FLAG_SET_PRIORITY 0x00000200u
// rev
typedef struct _SM_STORE_MEMORY_PRIORITY_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_PRIORITY_REQUEST_VERSION
ULONG Flags : 24;
HANDLE ProcessHandle; // in // PROCESS_SET_INFORMATION access required
} SM_STORE_MEMORY_PRIORITY_REQUEST, *PSM_STORE_MEMORY_PRIORITY_REQUEST;
// rev
typedef struct _SM_SYSTEM_STORE_TRIM_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_TRIM_INFORMATION_VERSION
ULONG Spare : 24;
SIZE_T PagesToTrim; // TrimFlags // must be non-zero
HANDLE PartitionHandle; // since 24H2
} SM_SYSTEM_STORE_TRIM_REQUEST, *PSM_SYSTEM_STORE_TRIM_REQUEST;
// rev
#define SYSTEM_STORE_TRIM_INFORMATION_VERSION_V1 1 // WIN10
#define SYSTEM_STORE_TRIM_INFORMATION_VERSION_V2 2 // 24H2
#define SYSTEM_STORE_TRIM_INFORMATION_VERSION SYSTEM_STORE_TRIM_INFORMATION_VERSION_V1
// rev
#define SYSTEM_STORE_TRIM_INFORMATION_SIZE_V1 RTL_SIZEOF_THROUGH_FIELD(SM_SYSTEM_STORE_TRIM_REQUEST, PagesToTrim) // WIN10
#define SYSTEM_STORE_TRIM_INFORMATION_SIZE_V2 RTL_SIZEOF_THROUGH_FIELD(SM_SYSTEM_STORE_TRIM_REQUEST, PartitionHandle) // 24H2
#define SYSTEM_STORE_TRIM_INFORMATION_SIZE SYSTEM_STORE_TRIM_INFORMATION_SIZE_V2
#ifdef _WIN64
static_assert(SYSTEM_STORE_TRIM_INFORMATION_SIZE_V1 == 16, "SYSTEM_STORE_TRIM_INFORMATION_SIZE_V1 must equal 16");
static_assert(SYSTEM_STORE_TRIM_INFORMATION_SIZE_V2 == 24, "SYSTEM_STORE_TRIM_INFORMATION_SIZE_V2 must equal 24");
#else
static_assert(SYSTEM_STORE_TRIM_INFORMATION_SIZE_V1 == 8, "SYSTEM_STORE_TRIM_INFORMATION_SIZE_V1 must equal 8");
static_assert(SYSTEM_STORE_TRIM_INFORMATION_SIZE_V2 == 12, "SYSTEM_STORE_TRIM_INFORMATION_SIZE_V2 must equal 12");
#endif
// rev
typedef struct _SM_STORE_COMPRESSION_INFORMATION_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION
ULONG Spare : 24;
ULONG CompressionPid;
ULONG WorkingSetSize;
SIZE_T TotalDataCompressed;
SIZE_T TotalCompressedSize;
SIZE_T TotalUniqueDataCompressed;
HANDLE PartitionHandle; // since 24H2
} SM_STORE_COMPRESSION_INFORMATION_REQUEST, *PSM_STORE_COMPRESSION_INFORMATION_REQUEST;
// rev
#define SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION_V1 3 // WIN10
#define SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION_V2 4 // 24H2
#define SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION_V2
// rev
#define SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V1 RTL_SIZEOF_THROUGH_FIELD(SM_STORE_COMPRESSION_INFORMATION_REQUEST, TotalUniqueDataCompressed) // WIN10
#define SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V2 RTL_SIZEOF_THROUGH_FIELD(SM_STORE_COMPRESSION_INFORMATION_REQUEST, PartitionHandle) // 24H2
#define SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V2
#ifdef _WIN64
static_assert(SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V1 == 40, "SM_STORE_COMPRESSION_INFORMATION_REQUEST_V1 must equal 40");
static_assert(SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V2 == 48, "SM_STORE_COMPRESSION_INFORMATION_REQUEST_V2 must equal 48");
#else
static_assert(SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V1 == 24, "SM_STORE_COMPRESSION_INFORMATION_REQUEST_V1 must equal 24");
static_assert(SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V2 == 28, "SM_STORE_COMPRESSION_INFORMATION_REQUEST_V2 must equal 28");
#endif
// rev
#define SYSTEM_STORE_EXISTS_FOR_PROCESS_VERSION 1
// rev
typedef struct _SM_SYSTEM_STORE_EXISTS_FOR_PROCESS
{
ULONG Version : 8;
ULONG Spare : 24;
HANDLE ProcessHandle; // in // PROCESS_QUERY_INFORMATION access required
BOOLEAN StoreExists; // out
} SM_SYSTEM_STORE_EXISTS_FOR_PROCESS, *PSM_SYSTEM_STORE_EXISTS_FOR_PROCESS;
// rev
typedef struct _SM_COMPRESSION_READ_STATS
{
ULONGLONG Counters[17];
ULONGLONG TailValue;
} SM_COMPRESSION_READ_STATS, * PSM_COMPRESSION_READ_STATS;
// rev
#define SYSTEM_STORE_COMPRESSION_READ_STATS_VERSION 1
// rev
typedef struct _SM_COMPRESSION_READ_STATS_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_COMPRESSION_READ_STATS_VERSION
ULONG Spare : 24;
ULONG Flags; // must be zero
HANDLE PartitionHandle; // optional
SM_COMPRESSION_READ_STATS Stats; // output
} SM_COMPRESSION_READ_STATS_REQUEST, *PSM_COMPRESSION_READ_STATS_REQUEST;
// rev
#define SYSTEM_STORE_ACCELERATOR_REQUEST_VERSION 1
// rev
typedef struct _SM_COMPRESSION_ACCELERATOR_REQUEST
{
ULONG Version : 8; // SYSTEM_STORE_ACCELERATOR_REQUEST_VERSION
ULONG Spare : 24;
ULONG Flags; // must be zero
HANDLE PartitionHandle; // optional
ULONG AcceleratorValue; // output
} SM_COMPRESSION_ACCELERATOR_REQUEST, *PSM_COMPRESSION_ACCELERATOR_REQUEST;
// private
typedef struct _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS
{
HANDLE KeyHandle;
PUNICODE_STRING ValueNamePointer;
PULONG RequiredLengthPointer;
PUCHAR Buffer;
ULONG BufferLength;
ULONG Type;
PUCHAR AppendBuffer;
ULONG AppendBufferLength;
BOOLEAN CreateIfDoesntExist;
BOOLEAN TruncateExistingValue;
} SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS, *PSYSTEM_REGISTRY_APPEND_STRING_PARAMETERS;
// msdn
typedef struct _SYSTEM_VHD_BOOT_INFORMATION
{
BOOLEAN OsDiskIsVhd;
ULONG OsVhdFilePathOffset;
WCHAR OsVhdParentVolume[1];
} SYSTEM_VHD_BOOT_INFORMATION, *PSYSTEM_VHD_BOOT_INFORMATION;
// private
typedef struct _PS_CPU_QUOTA_QUERY_ENTRY
{
ULONG SessionId;
ULONG Weight;
} PS_CPU_QUOTA_QUERY_ENTRY, *PPS_CPU_QUOTA_QUERY_ENTRY;
// private
typedef struct _PS_CPU_QUOTA_QUERY_INFORMATION
{
ULONG SessionCount;
PS_CPU_QUOTA_QUERY_ENTRY SessionInformation[1];
} PS_CPU_QUOTA_QUERY_INFORMATION, *PPS_CPU_QUOTA_QUERY_INFORMATION;
// private
typedef struct _SYSTEM_ERROR_PORT_TIMEOUTS
{
ULONG StartTimeout;
ULONG CommTimeout;
} SYSTEM_ERROR_PORT_TIMEOUTS, *PSYSTEM_ERROR_PORT_TIMEOUTS;
// private
typedef struct _SYSTEM_LOW_PRIORITY_IO_INFORMATION
{
ULONG LowPriorityReadOperationCount;
ULONG LowPriorityWriteOperationCount;
ULONG KernelBumpedToNormalOperations;
ULONG LowPriorityPagingReadOperations;
ULONG KernelPagingReadsBumpedToNormal;
ULONG LowPriorityPagingWriteOperations;
ULONG KernelPagingWritesBumpedToNormal;
ULONG BoostedThreadedIrpCount;
ULONG BoostedPagingIrpCount;
ULONG BlanketBoostCount;
} SYSTEM_LOW_PRIORITY_IO_INFORMATION, *PSYSTEM_LOW_PRIORITY_IO_INFORMATION;
// symbols
typedef enum _BOOT_ENTROPY_SOURCE_RESULT_CODE
{
BootEntropySourceStructureUninitialized,
BootEntropySourceDisabledByPolicy,
BootEntropySourceNotPresent,
BootEntropySourceError,
BootEntropySourceSuccess
} BOOT_ENTROPY_SOURCE_RESULT_CODE;
typedef enum _BOOT_ENTROPY_SOURCE_ID
{
BootEntropySourceNone = 0,
BootEntropySourceSeedfile = 1,
BootEntropySourceExternal = 2,
BootEntropySourceTpm = 3,
BootEntropySourceRdrand = 4,
BootEntropySourceTime = 5,
BootEntropySourceAcpiOem0 = 6,
BootEntropySourceUefi = 7,
BootEntropySourceCng = 8,
BootEntropySourceTcbTpm = 9,
BootEntropySourceTcbRdrand = 10,
BootMaxEntropySources = 10
} BOOT_ENTROPY_SOURCE_ID, *PBOOT_ENTROPY_SOURCE_ID;
// Contents of KeLoaderBlock->Extension->TpmBootEntropyResult (TPM_BOOT_ENTROPY_LDR_RESULT).
// EntropyData is truncated to 40 bytes.
// private
typedef struct _TPM_BOOT_ENTROPY_NT_RESULT
{
ULONGLONG Policy;
BOOT_ENTROPY_SOURCE_RESULT_CODE ResultCode;
NTSTATUS ResultStatus;
ULONGLONG Time;
ULONG EntropyLength;
UCHAR EntropyData[40];
} TPM_BOOT_ENTROPY_NT_RESULT, *PTPM_BOOT_ENTROPY_NT_RESULT;
// private
typedef struct _BOOT_ENTROPY_SOURCE_NT_RESULT
{
BOOT_ENTROPY_SOURCE_ID SourceId;
ULONG64 Policy;
BOOT_ENTROPY_SOURCE_RESULT_CODE ResultCode;
NTSTATUS ResultStatus;
ULONGLONG Time;
ULONG EntropyLength;
UCHAR EntropyData[64];
} BOOT_ENTROPY_SOURCE_NT_RESULT, *PBOOT_ENTROPY_SOURCE_NT_RESULT;
// private
typedef struct _BOOT_ENTROPY_NT_RESULT
{
ULONG maxEntropySources;
BOOT_ENTROPY_SOURCE_NT_RESULT EntropySourceResult[10];
UCHAR SeedBytesForCng[48];
} BOOT_ENTROPY_NT_RESULT, *PBOOT_ENTROPY_NT_RESULT;
// private
typedef struct _SYSTEM_VERIFIER_COUNTERS_INFORMATION
{
SYSTEM_VERIFIER_INFORMATION Legacy;
ULONG RaiseIrqls;
ULONG AcquireSpinLocks;
ULONG SynchronizeExecutions;
ULONG AllocationsWithNoTag;
ULONG AllocationsFailed;
ULONG AllocationsFailedDeliberately;
SIZE_T LockedBytes;
SIZE_T PeakLockedBytes;
SIZE_T MappedLockedBytes;
SIZE_T PeakMappedLockedBytes;
SIZE_T MappedIoSpaceBytes;
SIZE_T PeakMappedIoSpaceBytes;
SIZE_T PagesForMdlBytes;
SIZE_T PeakPagesForMdlBytes;
SIZE_T ContiguousMemoryBytes;
SIZE_T PeakContiguousMemoryBytes;
ULONG ExecutePoolTypes; // REDSTONE2
ULONG ExecutePageProtections;
ULONG ExecutePageMappings;
ULONG ExecuteWriteSections;
ULONG SectionAlignmentFailures;
ULONG UnsupportedRelocs;
ULONG IATInExecutableSection;
} SYSTEM_VERIFIER_COUNTERS_INFORMATION, *PSYSTEM_VERIFIER_COUNTERS_INFORMATION;
// private
typedef struct _SYSTEM_ACPI_AUDIT_INFORMATION
{
ULONG RsdpCount;
ULONG SameRsdt : 1;
ULONG SlicPresent : 1;
ULONG SlicDifferent : 1;
} SYSTEM_ACPI_AUDIT_INFORMATION, *PSYSTEM_ACPI_AUDIT_INFORMATION;
// private
typedef struct _SYSTEM_BASIC_PERFORMANCE_INFORMATION
{
SIZE_T AvailablePages;
SIZE_T CommittedPages;
SIZE_T CommitLimit;
SIZE_T PeakCommitment;
} SYSTEM_BASIC_PERFORMANCE_INFORMATION, *PSYSTEM_BASIC_PERFORMANCE_INFORMATION;
// begin_msdn
typedef struct _QUERY_PERFORMANCE_COUNTER_FLAGS
{
union
{
struct
{
ULONG KernelTransition : 1;
ULONG Reserved : 31;
};
ULONG ul;
};
} QUERY_PERFORMANCE_COUNTER_FLAGS;
typedef struct _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION
{
ULONG Version;
QUERY_PERFORMANCE_COUNTER_FLAGS Flags;
QUERY_PERFORMANCE_COUNTER_FLAGS ValidFlags;
} SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION, *PSYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION;
// end_msdn
// private
typedef enum _SYSTEM_PIXEL_FORMAT
{
SystemPixelFormatUnknown,
SystemPixelFormatR8G8B8,
SystemPixelFormatR8G8B8X8,
SystemPixelFormatB8G8R8,
SystemPixelFormatB8G8R8X8
} SYSTEM_PIXEL_FORMAT;
// private
typedef struct _SYSTEM_BOOT_GRAPHICS_INFORMATION
{
LARGE_INTEGER FrameBuffer;
ULONG Width;
ULONG Height;
ULONG PixelStride;
ULONG Flags;
SYSTEM_PIXEL_FORMAT Format;
ULONG DisplayRotation;
} SYSTEM_BOOT_GRAPHICS_INFORMATION, *PSYSTEM_BOOT_GRAPHICS_INFORMATION;
// private
typedef struct _MEMORY_SCRUB_INFORMATION
{
HANDLE Handle;
SIZE_T PagesScrubbed;
} MEMORY_SCRUB_INFORMATION, *PMEMORY_SCRUB_INFORMATION;
// private
typedef union _SYSTEM_BAD_PAGE_INFORMATION
{
#ifdef _WIN64
ULONG_PTR PhysicalPageNumber : 52;
#else
ULONG PhysicalPageNumber : 20;
#endif
ULONG_PTR Reserved : 10;
ULONG_PTR Pending : 1;
ULONG_PTR Poisoned : 1;
} SYSTEM_BAD_PAGE_INFORMATION, *PSYSTEM_BAD_PAGE_INFORMATION;
// private
typedef struct _PEBS_DS_SAVE_AREA32
{
ULONG BtsBufferBase;
ULONG BtsIndex;
ULONG BtsAbsoluteMaximum;
ULONG BtsInterruptThreshold;
ULONG PebsBufferBase;
ULONG PebsIndex;
ULONG PebsAbsoluteMaximum;
ULONG PebsInterruptThreshold;
ULONG PebsGpCounterReset[8];
ULONG PebsFixedCounterReset[4];
} PEBS_DS_SAVE_AREA32, *PPEBS_DS_SAVE_AREA32;
// private
typedef struct _PEBS_DS_SAVE_AREA64
{
ULONGLONG BtsBufferBase;
ULONGLONG BtsIndex;
ULONGLONG BtsAbsoluteMaximum;
ULONGLONG BtsInterruptThreshold;
ULONGLONG PebsBufferBase;
ULONGLONG PebsIndex;
ULONGLONG PebsAbsoluteMaximum;
ULONGLONG PebsInterruptThreshold;
ULONGLONG PebsGpCounterReset[8];
ULONGLONG PebsFixedCounterReset[4];
} PEBS_DS_SAVE_AREA64, *PPEBS_DS_SAVE_AREA64;
// private
typedef union _PEBS_DS_SAVE_AREA
{
PEBS_DS_SAVE_AREA32 As32Bit;
PEBS_DS_SAVE_AREA64 As64Bit;
} PEBS_DS_SAVE_AREA, *PPEBS_DS_SAVE_AREA;
// private
typedef struct _PROCESSOR_PROFILE_CONTROL_AREA
{
PEBS_DS_SAVE_AREA PebsDsSaveArea;
} PROCESSOR_PROFILE_CONTROL_AREA, *PPROCESSOR_PROFILE_CONTROL_AREA;
// private
typedef struct _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA
{
PROCESSOR_PROFILE_CONTROL_AREA ProcessorProfileControlArea;
BOOLEAN Allocate;
} SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA, *PSYSTEM_PROCESSOR_PROFILE_CONTROL_AREA;
// private
typedef struct _MEMORY_COMBINE_INFORMATION
{
HANDLE Handle;
SIZE_T PagesCombined;
} MEMORY_COMBINE_INFORMATION, *PMEMORY_COMBINE_INFORMATION;
// rev
#define MEMORY_COMBINE_FLAGS_COMMON_PAGES_ONLY 0x4
// private
typedef struct _MEMORY_COMBINE_INFORMATION_EX
{
HANDLE Handle;
SIZE_T PagesCombined;
ULONG Flags;
} MEMORY_COMBINE_INFORMATION_EX, *PMEMORY_COMBINE_INFORMATION_EX;
// private
typedef struct _MEMORY_COMBINE_INFORMATION_EX2
{
HANDLE Handle;
SIZE_T PagesCombined;
ULONG Flags;
HANDLE ProcessHandle;
} MEMORY_COMBINE_INFORMATION_EX2, *PMEMORY_COMBINE_INFORMATION_EX2;
// private
typedef struct _SYSTEM_ENTROPY_TIMING_INFORMATION
{
VOID (NTAPI *EntropyRoutine)(PVOID, ULONG);
VOID (NTAPI *InitializationRoutine)(PVOID, ULONG, PVOID);
PVOID InitializationContext;
} SYSTEM_ENTROPY_TIMING_INFORMATION, *PSYSTEM_ENTROPY_TIMING_INFORMATION;
// private
typedef struct _SYSTEM_CONSOLE_INFORMATION
{
ULONG DriverLoaded : 1;
ULONG Spare : 31;
} SYSTEM_CONSOLE_INFORMATION, *PSYSTEM_CONSOLE_INFORMATION;
// private
typedef struct _SYSTEM_PLATFORM_BINARY_INFORMATION
{
ULONG64 PhysicalAddress;
PVOID HandoffBuffer;
PVOID CommandLineBuffer;
ULONG HandoffBufferSize;
ULONG CommandLineBufferSize;
} SYSTEM_PLATFORM_BINARY_INFORMATION, *PSYSTEM_PLATFORM_BINARY_INFORMATION;
// private
typedef struct _SYSTEM_POLICY_INFORMATION
{
PVOID InputData;
PVOID OutputData;
ULONG InputDataSize;
ULONG OutputDataSize;
ULONG Version;
} SYSTEM_POLICY_INFORMATION, *PSYSTEM_POLICY_INFORMATION;
// private
typedef struct _SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION
{
ULONG NumberOfLogicalProcessors;
ULONG NumberOfCores;
} SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION, *PSYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION;
// private
typedef struct _SYSTEM_DEVICE_DATA_INFORMATION
{
UNICODE_STRING DeviceId;
UNICODE_STRING DataName;
ULONG DataType;
ULONG DataBufferLength;
PVOID DataBuffer;
} SYSTEM_DEVICE_DATA_INFORMATION, *PSYSTEM_DEVICE_DATA_INFORMATION;
// private
typedef struct _PHYSICAL_CHANNEL_RUN
{
ULONG NodeNumber;
ULONG ChannelNumber;
ULONGLONG BasePage;
ULONGLONG PageCount;
ULONG Flags;
} PHYSICAL_CHANNEL_RUN, *PPHYSICAL_CHANNEL_RUN;
// private
typedef struct _SYSTEM_MEMORY_TOPOLOGY_INFORMATION
{
ULONGLONG NumberOfRuns;
ULONG NumberOfNodes;
ULONG NumberOfChannels;
PHYSICAL_CHANNEL_RUN Run[1];
} SYSTEM_MEMORY_TOPOLOGY_INFORMATION, *PSYSTEM_MEMORY_TOPOLOGY_INFORMATION;
// private
typedef struct _SYSTEM_MEMORY_CHANNEL_INFORMATION
{
ULONG ChannelNumber;
ULONG ChannelHeatIndex;
ULONGLONG TotalPageCount;
ULONGLONG ZeroPageCount;
ULONGLONG FreePageCount;
ULONGLONG StandbyPageCount;
} SYSTEM_MEMORY_CHANNEL_INFORMATION, *PSYSTEM_MEMORY_CHANNEL_INFORMATION;
// private
typedef struct _SYSTEM_BOOT_LOGO_INFORMATION
{
ULONG Flags;
ULONG BitmapOffset;
} SYSTEM_BOOT_LOGO_INFORMATION, *PSYSTEM_BOOT_LOGO_INFORMATION;
// private
typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX
{
LARGE_INTEGER IdleTime;
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER DpcTime;
LARGE_INTEGER InterruptTime;
ULONG InterruptCount;
ULONG Spare0;
LARGE_INTEGER AvailableTime;
LARGE_INTEGER Spare1;
LARGE_INTEGER Spare2;
} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX;
// private
typedef struct _CRITICAL_PROCESS_EXCEPTION_DATA
{
GUID ReportId;
UNICODE_STRING ModuleName;
ULONG ModuleTimestamp;
ULONG ModuleSize;
ULONG_PTR Offset;
} CRITICAL_PROCESS_EXCEPTION_DATA, *PCRITICAL_PROCESS_EXCEPTION_DATA;
// private
typedef struct _SYSTEM_SECUREBOOT_POLICY_INFORMATION
{
GUID PolicyPublisher;
ULONG PolicyVersion;
ULONG PolicyOptions;
} SYSTEM_SECUREBOOT_POLICY_INFORMATION, *PSYSTEM_SECUREBOOT_POLICY_INFORMATION;
// private
_Struct_size_bytes_(NextEntryOffset)
typedef struct _SYSTEM_PAGEFILE_INFORMATION_EX
{
union // union declaration for convenience (dmex)
{
SYSTEM_PAGEFILE_INFORMATION Info;
struct
{
ULONG NextEntryOffset;
ULONG TotalSize;
ULONG TotalInUse;
ULONG PeakUsage;
UNICODE_STRING PageFileName;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
ULONG MinimumSize;
ULONG MaximumSize;
} SYSTEM_PAGEFILE_INFORMATION_EX, *PSYSTEM_PAGEFILE_INFORMATION_EX;
// private
typedef struct _SYSTEM_SECUREBOOT_INFORMATION
{
BOOLEAN SecureBootEnabled;
BOOLEAN SecureBootCapable;
} SYSTEM_SECUREBOOT_INFORMATION, *PSYSTEM_SECUREBOOT_INFORMATION;
// private
typedef struct _PROCESS_DISK_COUNTERS
{
ULONGLONG BytesRead;
ULONGLONG BytesWritten;
ULONGLONG ReadOperationCount;
ULONGLONG WriteOperationCount;
ULONGLONG FlushOperationCount;
} PROCESS_DISK_COUNTERS, *PPROCESS_DISK_COUNTERS;
// private
typedef union _ENERGY_STATE_DURATION
{
ULONGLONG Value;
struct
{
ULONG LastChangeTime;
ULONG Duration : 31;
ULONG IsInState : 1;
} DUMMYSTRUCTNAME;
} ENERGY_STATE_DURATION, *PENERGY_STATE_DURATION;
/**
* The PROCESS_ENERGY_VALUES_QOS_INDEX type represents the QoS (Quality of Service) /
* thread-context bucket used as the first index of the Cycles, AttributedCycles, and
* WorkOnBehalfCycles arrays in PROCESS_ENERGY_VALUES.
*/
typedef enum _PROCESS_ENERGY_VALUES_QOS_INDEX
{
// Foreground / High QoS — threads running at foreground or high quality-of-service priority.
ProcessEnergyValuesQoSHighForeground = 0,
// Above-normal — threads running at above-normal priority.
ProcessEnergyValuesQoSAboveNormal = 1,
// Normal — threads running at normal priority.
ProcessEnergyValuesQoSNormal = 2,
// Background / Low QoS — threads running at background or low quality-of-service priority.
ProcessEnergyValuesQoSLowBackground = 3,
// The maximum number of QoS buckets.
ProcessEnergyValuesQoSMax = 4
} PROCESS_ENERGY_VALUES_QOS_INDEX, *PPROCESS_ENERGY_VALUES_QOS_INDEX;
/**
* The PROCESS_ENERGY_VALUES_CYCLE_TYPE_INDEX type represents the cycle type (user vs. kernel)
* used as the second index of the Cycles, AttributedCycles, and WorkOnBehalfCycles.
*/
typedef enum _PROCESS_ENERGY_VALUES_CYCLE_TYPE_INDEX
{
// User-mode cycles accumulated by threads in this QoS bucket.
ProcessEnergyValuesCycleTypeUser = 0,
// Kernel-mode cycles accumulated by threads in this QoS bucket.
ProcessEnergyValuesCycleTypeKernel = 1,
// The maximum number of cycle types.
ProcessEnergyValuesCycleTypeMax = 2
} PROCESS_ENERGY_VALUES_CYCLE_TYPE_INDEX, *PPROCESS_ENERGY_VALUES_CYCLE_TYPE_INDEX;
/**
* \brief Energy accounting values for a process, broken down by QoS bucket and cycle type.
*
* \details Contains CPU cycle counts, energy estimates, network/MBB byte counts,
* activity durations, and DWM composition statistics accumulated for a process.
* CPU cycles are indexed by QoS bucket (see PROCESS_ENERGY_VALUES_QOS_INDEX) and
* cycle type (see PROCESS_ENERGY_VALUES_CYCLE_TYPE_INDEX).
*/
typedef struct _PROCESS_ENERGY_VALUES
{
/**
* CPU cycles accumulated per QoS bucket and cycle type.
* First index: QoS bucket (PROCESS_ENERGY_VALUES_QOS_INDEX).
* Second index: cycle type — user [0] or kernel [1] (PROCESS_ENERGY_VALUES_CYCLE_TYPE_INDEX).
*/
ULONGLONG Cycles[ProcessEnergyValuesQoSMax][ProcessEnergyValuesCycleTypeMax];
/**
* Energy consumed by disk I/O, in arbitrary energy units.
*/
ULONGLONG DiskEnergy;
/**
* Tail energy attributed to network activity.
*/
ULONGLONG NetworkTailEnergy;
/**
* Tail energy attributed to Mobile Broadband (MBB) activity.
*/
ULONGLONG MBBTailEnergy;
/**
* Total bytes transmitted and received over network interfaces.
*/
ULONGLONG NetworkTxRxBytes;
/**
* Total bytes transmitted and received over Mobile Broadband (MBB) interfaces.
*/
ULONGLONG MBBTxRxBytes;
union
{
/**
* Activity state durations: [0] foreground, [1] desktop visible, [2] PSM foreground.
*/
ENERGY_STATE_DURATION Durations[3];
struct
{
/**
* Duration the process was in the foreground.
*/
ENERGY_STATE_DURATION ForegroundDuration;
/**
* Duration the process was visible on the desktop.
*/
ENERGY_STATE_DURATION DesktopVisibleDuration;
/**
* Duration the process was in the PSM (Process State Manager) foreground state.
*/
ENERGY_STATE_DURATION PSMForegroundDuration;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
/**
* Number of frames rendered by the DWM compositor on behalf of this process.
*/
ULONG CompositionRendered;
/**
* Number of dirty regions generated by this process during DWM composition.
*/
ULONG CompositionDirtyGenerated;
/**
* Number of dirty regions propagated from this process to other windows during DWM composition.
*/
ULONG CompositionDirtyPropagated;
ULONG Reserved1;
/**
* CPU cycles attributed to this process (e.g. from work performed on its behalf).
* Indexed identically to Cycles: [QoS bucket][cycle type].
*/
ULONGLONG AttributedCycles[ProcessEnergyValuesQoSMax][ProcessEnergyValuesCycleTypeMax];
/**
* CPU cycles consumed while performing work on behalf of another process.
* Indexed identically to Cycles: [QoS bucket][cycle type].
*/
ULONGLONG WorkOnBehalfCycles[ProcessEnergyValuesQoSMax][ProcessEnergyValuesCycleTypeMax];
} PROCESS_ENERGY_VALUES, *PPROCESS_ENERGY_VALUES;
/**
* \brief A compact activity timeline encoded as a bitmap with an end-time anchor.
*
* \details Each bit in the Bitmap field represents a fixed-size time slot.
* A set bit indicates the process was active during that slot.
* Each slot is 4096 milliseconds (≈4.1 seconds) in duration.
* The 32-bit bitmap covers approximately 131 seconds of recent history.
* EndTime is a slot index (not wall-clock seconds); multiply by 4096 to get elapsed milliseconds.
*/
typedef union _TIMELINE_BITMAP
{
/** Raw 64-bit value combining EndTime and Bitmap. */
ULONGLONG Value;
struct
{
/**
* The slot index of the most recent time slot represented by the bitmap.
* Real time ≈ EndTime * 4096 milliseconds.
*/
ULONG EndTime;
/**
* Bit-mask of activity slots; bit 0 is the most recent slot.
* One set bit represents approximately 4.096 seconds of activity.
* popcount(Bitmap) * 4096 ms ≈ total active duration within window.
*/
ULONG Bitmap;
};
} TIMELINE_BITMAP, *PTIMELINE_BITMAP;
/**
* \brief Extended energy accounting values for a process, providing activity timelines
* and additional duration/input statistics not present in PROCESS_ENERGY_VALUES.
*
* \details Added in REDSTONE2; the Timelines array grew from 9 to 14 entries in REDSTONE3.
* The Durations union and the input/audio fields are REDSTONE3+.
*/
typedef struct _PROCESS_ENERGY_VALUES_EXTENSION
{
union
{
/** Activity timelines indexed by resource type (9 entries pre-RS3, 14 entries RS3+). */
TIMELINE_BITMAP Timelines[14]; // 9 for REDSTONE2, 14 for REDSTONE3/4/5
struct
{
/**
* CPU activity timeline.
*/
TIMELINE_BITMAP CpuTimeline;
/**
* Disk I/O activity timeline.
*/
TIMELINE_BITMAP DiskTimeline;
/**
* Network activity timeline.
*/
TIMELINE_BITMAP NetworkTimeline;
/**
* Mobile Broadband (MBB) activity timeline.
*/
TIMELINE_BITMAP MBBTimeline;
/**
* Foreground visibility timeline.
*/
TIMELINE_BITMAP ForegroundTimeline;
/**
* Desktop visible timeline.
*/
TIMELINE_BITMAP DesktopVisibleTimeline;
/**
* DWM composition rendered timeline.
*/
TIMELINE_BITMAP CompositionRenderedTimeline;
/**
* DWM composition dirty-generated timeline.
*/
TIMELINE_BITMAP CompositionDirtyGeneratedTimeline;
/**
* DWM composition dirty-propagated timeline.
*/
TIMELINE_BITMAP CompositionDirtyPropagatedTimeline;
/**
* Input activity timeline (REDSTONE3+).
*/
TIMELINE_BITMAP InputTimeline; // REDSTONE3
/**
* Audio input (microphone) activity timeline (REDSTONE3+).
*/
TIMELINE_BITMAP AudioInTimeline;
/**
* Audio output (speaker/headphone) activity timeline (REDSTONE3+).
*/
TIMELINE_BITMAP AudioOutTimeline;
/**
* Display-required (screen-on prevention) timeline (REDSTONE3+).
*/
TIMELINE_BITMAP DisplayRequiredTimeline;
/**
* Keyboard input activity timeline (REDSTONE3+).
*/
TIMELINE_BITMAP KeyboardInputTimeline;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
union // REDSTONE3
{
/**
* Activity state durations for extended resource types (REDSTONE3+).
*/
ENERGY_STATE_DURATION Durations[5];
struct
{
/**
* Duration the process received user input (REDSTONE3+).
*/
ENERGY_STATE_DURATION InputDuration;
/**
* Duration the process used audio input (REDSTONE3+).
*/
ENERGY_STATE_DURATION AudioInDuration;
/**
* Duration the process used audio output (REDSTONE3+).
*/
ENERGY_STATE_DURATION AudioOutDuration;
/**
* Duration the process prevented display power-off (REDSTONE3+).
*/
ENERGY_STATE_DURATION DisplayRequiredDuration;
/**
* Duration the process ran in PSM background state (REDSTONE3+).
*/
ENERGY_STATE_DURATION PSMBackgroundDuration;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
/**
* Number of keyboard input events attributed to the process (REDSTONE3+).
*/
ULONG KeyboardInput;
/**
* Number of mouse input events attributed to the process (REDSTONE3+).
*/
ULONG MouseInput;
} PROCESS_ENERGY_VALUES_EXTENSION, *PPROCESS_ENERGY_VALUES_EXTENSION;
typedef struct _PROCESS_EXTENDED_ENERGY_VALUES
{
PROCESS_ENERGY_VALUES Base;
PROCESS_ENERGY_VALUES_EXTENSION Extension;
} PROCESS_EXTENDED_ENERGY_VALUES, *PPROCESS_EXTENDED_ENERGY_VALUES;
typedef struct _PROCESS_EXTENDED_ENERGY_VALUES_V1
{
PROCESS_ENERGY_VALUES Base;
PROCESS_ENERGY_VALUES_EXTENSION Extension;
ULONG64 NpuWorkUnits;
} PROCESS_EXTENDED_ENERGY_VALUES_V1, *PPROCESS_EXTENDED_ENERGY_VALUES_V1;
// private
typedef enum _SYSTEM_PROCESS_CLASSIFICATION
{
SystemProcessClassificationNormal,
SystemProcessClassificationSystem,
SystemProcessClassificationSecureSystem,
SystemProcessClassificationMemCompression,
SystemProcessClassificationRegistry, // REDSTONE4
SystemProcessClassificationMaximum
} SYSTEM_PROCESS_CLASSIFICATION;
/**
* Extended process information appended to SYSTEM_PROCESS_INFORMATION in full process enumeration queries.
*
* \details This structure provides additional process accounting, classification, and energy metrics
* not present in the base SYSTEM_PROCESS_INFORMATION structure. It is returned when querying
* SystemFullProcessInformation (information class 148) or SystemExtendedProcessInformation (information class 57)
* via NtQuerySystemInformation.
*
* The structure is appended immediately after the SYSTEM_THREAD_INFORMATION array in
* SYSTEM_EXTENDED_PROCESS_INFORMATION, and the offsets are relative to the start of this extension structure.
*
* \since Windows 10 Threshold (version 1507, build 10240)
*
* \remarks This structure contains variable-length data. The UserSidOffset, PackageFullNameOffset,
* and AppIdOffset fields point to data stored immediately after this structure in memory.
* Callers must use these offsets to locate the actual strings and SID data.
*/
typedef struct _SYSTEM_PROCESS_INFORMATION_EXTENSION
{
/**
* Cumulative disk I/O counters for the process (reads, writes, flushes).
* Includes total bytes transferred and operation counts for read, write, and flush operations.
*/
PROCESS_DISK_COUNTERS DiskCounters;
/**
* Total number of context switches performed by all threads in the process since creation.
* Use this to measure scheduling overhead and CPU time-sharing behavior.
*/
ULONGLONG ContextSwitches;
/**
* Process classification flags and security attributes.
*/
union
{
/**
* Raw flags value containing all classification bits.
*/
ULONG Flags;
struct
{
/**
* If set, the process has a strong identity (e.g., packaged app with cryptographic signing).
* Strong identities are used for security policy enforcement and resource isolation.
*/
ULONG HasStrongId : 1;
/**
* Process classification type (SYSTEM_PROCESS_CLASSIFICATION).
* Indicates whether this is a normal user process, system process, secure system process,
* memory compression process, or registry process. Used by the kernel for resource
* management, security policy, and scheduling decisions.
*/
ULONG Classification : 4; // SYSTEM_PROCESS_CLASSIFICATION
/**
* If set, the process has had background activity moderation applied to it.
* The system may throttle CPU, I/O, or network resources when the process is not in the foreground.
* \since Windows 10 Redstone 2 (version 1703)
*/
ULONG BackgroundActivityModerated : 1;
/**
* Reserved for future use.
*/
ULONG Spare : 26;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
/**
* Offset, in bytes, from the start of this structure to the user SID (Security Identifier).
* If zero, no user SID is available. The SID data is stored in standard binary format.
* Use this offset to locate the process owner's security identifier for access control
* and auditing purposes.
*/
ULONG UserSidOffset;
/**
* Offset, in bytes, from the start of this structure to a null-terminated WCHAR string
* containing the full package name (e.g., "Contoso.App_1.0.0.0_x64__8wekyb3d8bbwe").
* If zero, the process is not packaged (classic Win32 application).
* \since Windows 10 Threshold (version 1507)
*/
ULONG PackageFullNameOffset; // since THRESHOLD
/**
* Detailed energy accounting values for the process, including CPU cycles, disk energy,
* network/MBB tail energy, DWM composition metrics, and activity state durations.
* Provides per-QoS-bucket breakdowns of energy consumption for foreground/background
* resource usage analysis.
* \since Windows 10 Threshold (version 1507)
*/
PROCESS_ENERGY_VALUES EnergyValues; // since THRESHOLD
/**
* Offset, in bytes, from the start of this structure to a null-terminated WCHAR string
* containing the Application User Model ID (AUMID) for packaged applications.
* If zero, the process does not have an AppId (either not packaged or not a UWP app).
* \since Windows 10 Threshold (version 1507)
*/
ULONG AppIdOffset; // since THRESHOLD
/**
* Number of bytes of committed memory shared between this process and other processes
* (e.g., memory-mapped sections, shared DLLs, or copy-on-write pages).
* Use this to measure memory overhead due to sharing and to calculate true private bytes.
* SharedCommitCharge + PrivatePageCount gives a more accurate picture of process memory usage.
* \since Windows 10 Threshold 2 (version 1511)
*/
SIZE_T SharedCommitCharge; // since THRESHOLD2
/**
* Identifier of the job object to which the process belongs, if any.
* If zero, the process is not assigned to a job object. Job objects are used to group
* processes and apply resource limits, accounting, and management policies.
* \since Windows 10 Redstone (version 1607)
*/
ULONG JobObjectId; // since REDSTONE
/**
* Reserved for future use.
* \since Windows 10 Redstone (version 1607)
*/
ULONG SpareUlong; // since REDSTONE
/**
* Unique monotonically-increasing sequence number assigned when the process was created.
* Unlike ProcessId (which can be recycled), this value is never reused and provides
* a stable identifier for correlation across logs and telemetry even after process termination.
* \since Windows 10 Redstone (version 1607)
*/
ULONGLONG ProcessSequenceNumber;
} SYSTEM_PROCESS_INFORMATION_EXTENSION, *PSYSTEM_PROCESS_INFORMATION_EXTENSION;
// private
typedef struct _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION
{
BOOLEAN EfiLauncherEnabled;
} SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION, *PSYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION;
// private
typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX
{
BOOLEAN DebuggerAllowed;
BOOLEAN DebuggerEnabled;
BOOLEAN DebuggerPresent;
} SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION_EX;
// rev
typedef struct _SYSTEM_BOOT_METADATA_INFORMATION
{
ULONG Size;
UCHAR Data[1];
} SYSTEM_BOOT_METADATA_INFORMATION, *PSYSTEM_BOOT_METADATA_INFORMATION;
// rev
typedef struct _SYSTEM_SOFT_REBOOT_INFORMATION
{
ULONG Flags;
} SYSTEM_SOFT_REBOOT_INFORMATION, *PSYSTEM_SOFT_REBOOT_INFORMATION;
// private
typedef struct _SYSTEM_ELAM_CERTIFICATE_INFORMATION
{
HANDLE ElamDriverFile;
} SYSTEM_ELAM_CERTIFICATE_INFORMATION, *PSYSTEM_ELAM_CERTIFICATE_INFORMATION;
// private
typedef struct _OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2
{
ULONG Version;
ULONG AbnormalResetOccurred;
ULONG OfflineMemoryDumpCapable;
PVOID ResetDataAddress;
ULONG ResetDataSize;
} OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2, *POFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2;
// private
typedef struct _OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V1
{
ULONG Version;
ULONG AbnormalResetOccurred;
ULONG OfflineMemoryDumpCapable;
} OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V1, *POFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V1;
// SYSTEM_PROCESSOR_FEATURES_INFORMATION // ProcessorFeatureBits
// Processor feature bits (31 flags spanning bits 0-55 with documented gaps at bits 18-22)
// These flags indicate CPU capabilities detected by the kernel via CPUID and other detection mechanisms.
// Allocated bit ranges:
// Bits 0-17 : Base CPU features (MMX, SSE, branch prediction, etc.) - 18 flags
// Bits 18-22 : Reserved/unused (5 bit gap)
// Bits 23-31 : Extended states and additional features (1 flag)
// Bits 32-34 : Advanced features (RDRAND, SMAP, RDTSCP) - 3 flags
// Bits 35-44 : Reserved/unused (10 bit gap)
// Bits 45-46 : Huge pages and extended saves - 2 flags
// Bits 47-51 : Reserved/unused (5 bit gap)
// Bits 52-58 : Security and extended features (FPU_LEAKAGE, CAT, CET_SS, SSSE3, SSE4.x) - 7 flags
// Bits 59-62 : Reserved/unused (4 bit gap)
// Bit 63 : XFD (extended FPU data) - 1 flag
#define KF64_SMEP 0x0000000000000001ULL // Supervisor Mode Execution Protection
#define KF64_RDTSC 0x0000000000000002ULL // Read Time-Stamp Counter
#define KF64_CR4 0x0000000000000004ULL // CR4 Register Features
#define KF64_CMOV 0x0000000000000008ULL // Conditional Move Instructions
#define KF64_GLOBAL_PAGE 0x0000000000000010ULL // Global Pages Support
#define KF64_LARGE_PAGE 0x0000000000000020ULL // Large Page Support
#define KF64_MTRR 0x0000000000000040ULL // Memory Type Range Registers
#define KF64_CMPXCHG8B 0x0000000000000080ULL // CMPXCHG8B Instruction
#define KF64_MMX 0x0000000000000100ULL // MMX Instructions
#define KF64_DTS 0x0000000000000200ULL // Debug Store
#define KF64_PAT 0x0000000000000400ULL // Page Attribute Table
#define KF64_FXSR 0x0000000000000800ULL // FXSAVE and FXRSTOR Instructions
#define KF64_FAST_SYSCALL 0x0000000000001000ULL // Fast System Call
#define KF64_XMMI 0x0000000000002000ULL // Streaming SIMD Extensions
#define KF64_3DNOW 0x0000000000004000ULL // 3DNow! Instructions
#define KF64_AMDK6MTRR 0x0000000000008000ULL // AMD K6 Memory Type Range Registers
#define KF64_XMMI64 0x0000000000010000ULL // Streaming SIMD Extensions 2
#define KF64_BRANCH 0x0000000000020000ULL // Branch Prediction
#define KF64_XSTATE 0x0000000000800000ULL // Extended States
#define KF64_RDRAND 0x0000000100000000ULL // RDRAND Instruction
#define KF64_SMAP 0x0000000200000000ULL // Supervisor Mode Access Prevention
#define KF64_RDTSCP 0x0000000400000000ULL // RDTSCP Instruction
#define KF64_HUGEPAGE 0x0000002000000000ULL // Huge Page Support
#define KF64_XSAVES 0x0000004000000000ULL // XSAVES and XRSTORS Instructions
#define KF64_FPU_LEAKAGE 0x0000020000000000ULL // FPU Data Leakage Mitigations
#define KF64_CAT 0x0000100000000000ULL // Cache Allocation Technology
#define KF64_CET_SS 0x0000400000000000ULL // Control-flow Enforcement Technology - Shadow Stack
#define KF64_SSSE3 0x0000800000000000ULL // Supplemental Streaming SIMD Extensions 3
#define KF64_SSE4_1 0x0001000000000000ULL // Streaming SIMD Extensions 4.1
#define KF64_SSE4_2 0x0002000000000000ULL // Streaming SIMD Extensions 4.2
#define KF64_XFD 0x0080000000000000ULL // eXtended FPU Data
// private
typedef struct _SYSTEM_PROCESSOR_FEATURES_INFORMATION
{
ULONGLONG ProcessorFeatureBits;
ULONGLONG Reserved[3];
} SYSTEM_PROCESSOR_FEATURES_INFORMATION, *PSYSTEM_PROCESSOR_FEATURES_INFORMATION;
// EDID v1.4 detailed timing descriptor (18 bytes)
typedef struct _SYSTEM_EDID_DETAILED_TIMING_DESCRIPTOR
{
USHORT PixelClock; // Pixel clock in 10 kHz units
UCHAR HorizontalActiveLo; // Horizontal active pixels (low 8 bits)
UCHAR HorizontalBlankLo; // Horizontal blanking pixels (low 8 bits)
UCHAR HorizontalActiveBlankHi; // High bits for horizontal active/blanking
UCHAR VerticalActiveLo; // Vertical active lines (low 8 bits)
UCHAR VerticalBlankLo; // Vertical blanking lines (low 8 bits)
UCHAR VerticalActiveBlankHi; // High bits for vertical active/blanking
UCHAR HorizontalSyncOffsetLo;// Horizontal sync offset (low 8 bits)
UCHAR HorizontalSyncPulseWidthLo; // Horizontal sync pulse width (low 8 bits)
UCHAR VerticalSyncOffsetPulseWidthLo; // Vertical sync offset/pulse width (low 4 bits each)
UCHAR SyncOffsetPulseWidthHi; // High bits for sync offset/pulse width
UCHAR HorizontalImageSizeLo; // Horizontal image size in mm (low 8 bits)
UCHAR VerticalImageSizeLo; // Vertical image size in mm (low 8 bits)
UCHAR ImageSizeHi; // High bits for image size
UCHAR HorizontalBorder; // Horizontal border in pixels
UCHAR VerticalBorder; // Vertical border in lines
UCHAR Flags; // Flags (interlaced, stereo, sync, etc.)
} SYSTEM_EDID_DETAILED_TIMING_DESCRIPTOR, *PSYSTEM_EDID_DETAILED_TIMING_DESCRIPTOR;
// EDID v1.4 standard data format
typedef struct _SYSTEM_EDID_INFORMATION
{
union
{
UCHAR Edid[128];
struct
{
UCHAR Header[8]; // 00h: EDID header (00 FF FF FF FF FF FF 00)
UCHAR ManufacturerId[2]; // 08h: Manufacturer ID (big endian)
UCHAR ProductCode[2]; // 0Ah: Product code (little endian)
UCHAR SerialNumber[4]; // 0Ch: Serial number
UCHAR WeekOfManufacture; // 10h: Week of manufacture
UCHAR YearOfManufacture; // 11h: Year of manufacture (offset from 1990)
UCHAR EdidVersion; // 12h: EDID version (should be 1)
UCHAR EdidRevision; // 13h: EDID revision (should be 4)
UCHAR VideoInputDefinition; // 14h: Video input parameters
UCHAR MaxHorizontalImageSize; // 15h: Max horizontal image size (cm)
UCHAR MaxVerticalImageSize; // 16h: Max vertical image size (cm)
UCHAR DisplayGamma; // 17h: Display gamma (gamma*100 - 100)
UCHAR FeatureSupport; // 18h: DPMS features, color encoding, etc.
UCHAR Chromaticity[10]; // 19h: Chromaticity coordinates
UCHAR EstablishedTimings[3]; // 23h: Established timings
UCHAR StandardTimings[16]; // 26h: Standard timings (8x2 bytes)
SYSTEM_EDID_DETAILED_TIMING_DESCRIPTOR DetailedTiming[4]; // 36h: 4 detailed timing descriptors (18 bytes each)
UCHAR ExtensionFlag; // 7Eh: Number of (optional) 128-byte extension blocks
UCHAR Checksum; // 7Fh: Checksum (sum of all 128 bytes = 0)
};
};
} SYSTEM_EDID_INFORMATION, *PSYSTEM_EDID_INFORMATION;
// private
typedef struct _SYSTEM_MANUFACTURING_INFORMATION
{
ULONG Options;
UNICODE_STRING ProfileName;
} SYSTEM_MANUFACTURING_INFORMATION, *PSYSTEM_MANUFACTURING_INFORMATION;
// private
typedef struct _SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION
{
BOOLEAN Enabled;
} SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION, *PSYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION;
// private
typedef struct _HV_DETAILS
{
ULONG Data[4];
} HV_DETAILS, *PHV_DETAILS;
// private
typedef struct _SYSTEM_HYPERVISOR_DETAIL_INFORMATION
{
HV_DETAILS HvVendorAndMaxFunction;
HV_DETAILS HypervisorInterface;
HV_DETAILS HypervisorVersion;
HV_DETAILS HvFeatures;
HV_DETAILS HwFeatures;
HV_DETAILS EnlightenmentInfo;
HV_DETAILS ImplementationLimits;
} SYSTEM_HYPERVISOR_DETAIL_INFORMATION, *PSYSTEM_HYPERVISOR_DETAIL_INFORMATION;
/**
* The SYSTEM_PROCESSOR_CYCLE_STATS_BUCKET_INDEX type represents a frequency bucket
* for processor cycle statistics, selected by PoGetFrequencyBucket based on the current
* processor frequency relative to thresholds in _KPRCB.PowerState.FrequencyBucketThresholds.
*/
typedef enum _SYSTEM_PROCESSOR_CYCLE_STATS_BUCKET_INDEX
{
// Lowest frequency bucket — processor running at or below the first frequency threshold.
SystemProcessorCycleStatsBucketLowestFrequency = 0,
// Low frequency bucket — processor running between the first and second frequency thresholds.
SystemProcessorCycleStatsBucketLowFrequency = 1,
// High frequency bucket — processor running between the second and third frequency thresholds.
SystemProcessorCycleStatsBucketHighFrequency = 2,
// Highest frequency bucket — processor running above the third frequency threshold.
SystemProcessorCycleStatsBucketHighestFrequency = 3,
// The maximum number of frequency buckets.
SystemProcessorCycleStatsBucketMax = 4
} SYSTEM_PROCESSOR_CYCLE_STATS_BUCKET_INDEX, *PSYSTEM_PROCESSOR_CYCLE_STATS_BUCKET_INDEX;
/**
* The SYSTEM_PROCESSOR_CYCLE_STATS_EFFICIENCY_CLASS_INDEX type represents the baseline architectural-efficiency group.
*
* \note In current kernel accounting this is effectively binary grouping (0/1), not an open-ended N-class index.
* So think of it as Group A vs Group B for heterogeneity tracking.
* It is not guaranteed to mean exactly “P-core vs E-core” on every platform, even though that may often correlate.
*/
typedef enum _SYSTEM_PROCESSOR_CYCLE_STATS_EFFICIENCY_CLASS_INDEX
{
// Represents the baseline architectural-efficiency group (the group with the minimum class value in current kernel logic)
// Baseline efficiency-class group (minimum architectural efficiency class).
SystemProcessorCycleStatsEfficiencyClassPrimary = 0,
// Represents processors not in that baseline group (all non-min class values are folded into this second bucket)
// Non-baseline efficiency-class group (all other architectural efficiency classes).
SystemProcessorCycleStatsEfficiencyClassSecondary = 1,
// The current maximum number of architectural-efficiency classes (subject to change).
SystemProcessorCycleStatsEfficiencyClassMax = 2
} SYSTEM_PROCESSOR_CYCLE_STATS_EFFICIENCY_CLASS_INDEX, *PSYSTEM_PROCESSOR_CYCLE_STATS_EFFICIENCY_CLASS_INDEX;
// private
typedef struct _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION
{
//
// First index is bucket (see: PoGetFrequencyBucket) selected based on latest frequency percent
// using _KPRCB.PowerState.FrequencyBucketThresholds.
//
// Second index is _KPRCB.PowerState.ArchitecturalEfficiencyClass, accounting for architecture
// dependent KeHeteroSystem and using _KPRCB.PowerState.EarlyBootArchitecturalEfficiencyClass
// instead, when appropriate.
//
ULONGLONG Cycles[SystemProcessorCycleStatsBucketMax][SystemProcessorCycleStatsEfficiencyClassMax];
} SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION, *PSYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION;
// private
typedef struct _SYSTEM_TPM_INFORMATION
{
ULONG Flags;
} SYSTEM_TPM_INFORMATION, *PSYSTEM_TPM_INFORMATION;
// private
typedef struct _SYSTEM_VSM_PROTECTION_INFORMATION
{
BOOLEAN DmaProtectionsAvailable;
BOOLEAN DmaProtectionsInUse;
BOOLEAN HardwareMbecAvailable; // REDSTONE4 (CVE-2018-3639)
BOOLEAN ApicVirtualizationAvailable; // 20H1
} SYSTEM_VSM_PROTECTION_INFORMATION, *PSYSTEM_VSM_PROTECTION_INFORMATION;
// private
typedef struct _SYSTEM_KERNEL_DEBUGGER_FLAGS
{
BOOLEAN KernelDebuggerIgnoreUmExceptions;
} SYSTEM_KERNEL_DEBUGGER_FLAGS, *PSYSTEM_KERNEL_DEBUGGER_FLAGS;
// SYSTEM_CODEINTEGRITYPOLICY_INFORMATION Options
#define CODEINTEGRITYPOLICY_OPTION_ENABLED 0x01
#define CODEINTEGRITYPOLICY_OPTION_AUDIT 0x02
#define CODEINTEGRITYPOLICY_OPTION_REQUIRE_WHQL 0x04
#define CODEINTEGRITYPOLICY_OPTION_DISABLED_FLIGHTSIGNING 0x08
#define CODEINTEGRITYPOLICY_OPTION_ENABLED_UMCI 0x10
#define CODEINTEGRITYPOLICY_OPTION_ENABLED_UPDATE_POLICY_NOREBOOT 0x20
#define CODEINTEGRITYPOLICY_OPTION_ENABLED_SECURE_SETTING_POLICY 0x40
#define CODEINTEGRITYPOLICY_OPTION_ENABLED_UNSIGNED_SYSTEMINTEGRITY_POLICY 0x80
#define CODEINTEGRITYPOLICY_OPTION_DYNAMIC_CODE_POLICY_ENABLED 0x100
#define CODEINTEGRITYPOLICY_OPTION_RELOAD_POLICY_NO_REBOOT 0x10000000 // NtSetSystemInformation reloads SiPolicy.p7b
#define CODEINTEGRITYPOLICY_OPTION_CONDITIONAL_LOCKDOWN 0x20000000
#define CODEINTEGRITYPOLICY_OPTION_NOLOCKDOWN 0x40000000
#define CODEINTEGRITYPOLICY_OPTION_LOCKDOWN 0x80000000
// SYSTEM_CODEINTEGRITYPOLICY_INFORMATION HVCIOptions
#define CODEINTEGRITYPOLICY_HVCIOPTION_ENABLED 0x01
#define CODEINTEGRITYPOLICY_HVCIOPTION_STRICT 0x02
#define CODEINTEGRITYPOLICY_HVCIOPTION_DEBUG 0x04
// private
/**
* \brief Code Integrity Policy configuration and HVCI (Hypervisor-enforced Code Integrity) settings.
*
* Contains the kernel's code integrity policy enforcement options and Hardware-enforced Code Integrity (HVCI)
* configuration state. Enables applications to query the security posture of code integrity enforcement and
* virtualization-based security features. Available via NtQuerySystemInformation(SystemCodeIntegrityInformation).
*
* \since Windows 10
*/
typedef struct _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION
{
/**
* \brief Code integrity policy options (Options union).
*
* Union providing both raw 32-bit access and bitfield access to policy flags:
* - Enabled: Code integrity enforcement is active
* - Audit: Code integrity operates in audit mode (violations logged, not blocked)
* - RequireWHQL: Windows Hardware Quality Labs certification required for drivers
* - DisabledFlightSigning: Flight-signed binaries are blocked from loading
* - EnabledUMCI: User-mode Code Integrity enforcement enabled (signed DLL requirement)
* - EnabledUpdatePolicyNoReboot: Code integrity policy updates without system reboot
* - EnabledSecureSettingPolicy: Secure settings policy enforcement enabled
* - EnabledUnsignedSystemIntegrityPolicy: Unsigned system integrity policies allowed
* - DynamicCodePolicyEnabled: Dynamic code generation and modification is restricted
* - Spare: 19 reserved bits for future expansion
* - ReloadPolicyNoReboot: Policy reloaded without reboot (bit 28)
* - ConditionalLockdown: Conditional code integrity lockdown mode (bit 29)
* - NoLockdown: Code integrity lockdown is not active (bit 30)
* - Lockdown: Code integrity lockdown mode is enforced (bit 31)
*/
union
{
ULONG Options;
struct
{
ULONG Enabled : 1; ///< Code integrity enforcement enabled
ULONG Audit : 1; ///< Audit mode (log violations, don't block)
ULONG RequireWHQL : 1; ///< Require WHQL certification
ULONG DisabledFlightSigning : 1; ///< Block flight-signed binaries
ULONG EnabledUMCI : 1; ///< User-mode code integrity enabled
ULONG EnabledUpdatePolicyNoReboot : 1; ///< Update policy without reboot
ULONG EnabledSecureSettingPolicy : 1; ///< Secure settings policy active
ULONG EnabledUnsignedSystemIntegrityPolicy : 1; ///< Allow unsigned system integrity policies
ULONG DynamicCodePolicyEnabled : 1; ///< Restrict dynamic code/JIT
ULONG Spare : 19; ///< Reserved for future use
ULONG ReloadPolicyNoReboot : 1; ///< Policy reloaded without reboot
ULONG ConditionalLockdown : 1; ///< Conditional lockdown mode
ULONG NoLockdown : 1; ///< Lockdown not enforced
ULONG Lockdown : 1; ///< Lockdown mode enforced
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
/**
* \brief Hardware-enforced Code Integrity (HVCI) options.
*
* Union providing both raw access and bitfield access to HVCI/VBS configuration:
* - HVCIEnabled: HVCI is active (code integrity enforcement via hypervisor)
* - HVCIStrict: Strict mode enforcement (higher security, lower performance)
* - HVCIDebug: Debug mode enabled (diagnostic/troubleshooting)
* - HVCISpare: 29 reserved bits for future HVCI expansion
*/
union
{
ULONG HVCIOptions;
struct
{
ULONG HVCIEnabled : 1; ///< HVCI enforced by hypervisor
ULONG HVCIStrict : 1; ///< Strict HVCI mode enforcement
ULONG HVCIDebug : 1; ///< HVCI debug mode active
ULONG HVCISpare : 29; ///< Reserved for future use
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
/**
* \brief Code integrity policy version.
*
* Version number incremented when the kernel reloads/updates the code integrity policy.
* Used to detect policy changes without requiring system restart.
*/
ULONGLONG Version;
/**
* \brief Code integrity policy GUID.
*
* Uniquely identifies the loaded code integrity policy file. Changes when a different
* policy becomes active; can be used to correlate policy audit logs.
*/
GUID PolicyGuid;
} SYSTEM_CODEINTEGRITYPOLICY_INFORMATION, *PSYSTEM_CODEINTEGRITYPOLICY_INFORMATION;
// private
/**
* \brief Isolated User Mode (IUM) and virtualization-based security (VBS) status.
*
* Queries the state of Virtualization-Based Security (VBS) infrastructure, including Hyper-V Code Integrity (HVCI),
* Secure Kernel, trustlets, and hardware-enforced security features. Enables applications to detect when running
* in a hardened security posture and to determine available cryptographic protections.
* Available via NtQuerySystemInformation(SystemIsolatedUserModeInformation).
*
* \since Windows 10 (RS2+)
*/
typedef struct _SYSTEM_ISOLATED_USER_MODE_INFORMATION
{
///< \brief Virtualization-based Security core status (byte 0):
BOOLEAN SecureKernelRunning : 1; ///< Secure Kernel (hypervisor-based isolation) is active
BOOLEAN HvciEnabled : 1; ///< Hypervisor-enforced Code Integrity enabled
BOOLEAN HvciStrictMode : 1; ///< HVCI in strict enforcement mode
BOOLEAN DebugEnabled : 1; ///< Kernel debugger enabled (may weaken security)
BOOLEAN FirmwarePageProtection : 1; ///< UEFI Secure Boot firmware page protection active
BOOLEAN EncryptionKeyAvailable : 1; ///< Isolation-backed encryption key available from Secure Kernel
BOOLEAN SpareFlags : 2; ///< Reserved for future VBS flags (bits 6-7)
///< \brief Isolated execution and security features (byte 1):
BOOLEAN TrustletRunning : 1; ///< Trustlet (isolated edge function) is running
BOOLEAN HvciDisableAllowed : 1; ///< HVCI can be disabled without reboot (policy-driven)
BOOLEAN HardwareEnforcedVbs : 1; ///< VBS enforced by processor/platform (e.g., AMD SME, Intel TXT)
BOOLEAN NoSecrets : 1; ///< No cryptographic secrets loaded in isolated user mode
BOOLEAN EncryptionKeyPersistent : 1; ///< Encryption key persists across reboots
BOOLEAN HardwareEnforcedHvpt : 1; ///< Hardware enforces Hypervisor Page Table (HVPT) isolation
BOOLEAN HardwareHvptAvailable : 1; ///< CPU supports hardware-enforced HVPT (architectural feature)
BOOLEAN SpareFlags2 : 1; ///< Reserved for future feature flag (bit 15)
BOOLEAN EncryptionKeyTpmBound : 1; ///< Encryption key bound to TPM (Trusted Platform Module)
///< \brief Reserved for future expansion (binary compatibility):
BOOLEAN Spare0[5]; ///< Reserved bytes for future isolated user mode flags
ULONGLONG Spare1; ///< Reserved 8 bytes for future isolated user mode expansion
} SYSTEM_ISOLATED_USER_MODE_INFORMATION, *PSYSTEM_ISOLATED_USER_MODE_INFORMATION;
// private
typedef struct _SYSTEM_HARDWARE_SECURITY_TEST_INTERFACE_RESULTS_INFORMATION
{
UCHAR Results[1];
} SYSTEM_HARDWARE_SECURITY_TEST_INTERFACE_RESULTS_INFORMATION, *PSYSTEM_HARDWARE_SECURITY_TEST_INTERFACE_RESULTS_INFORMATION;
// private
typedef struct _SYSTEM_SINGLE_MODULE_INFORMATION
{
PVOID TargetModuleAddress;
RTL_PROCESS_MODULE_INFORMATION_EX ExInfo;
} SYSTEM_SINGLE_MODULE_INFORMATION, *PSYSTEM_SINGLE_MODULE_INFORMATION;
// private
typedef struct _SYSTEM_INTERRUPT_CPU_SET_INFORMATION
{
ULONG Gsiv;
USHORT Group;
ULONGLONG CpuSets;
} SYSTEM_INTERRUPT_CPU_SET_INFORMATION, *PSYSTEM_INTERRUPT_CPU_SET_INFORMATION;
// private
typedef struct _SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION
{
SYSTEM_SECUREBOOT_POLICY_INFORMATION PolicyInformation;
ULONG PolicySize;
UCHAR Policy[1];
} SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION, *PSYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION;
// private
typedef struct _KAFFINITY_EX
{
USHORT Count;
USHORT Size;
ULONG Reserved;
union
{
ULONG_PTR Bitmap[1];
ULONG_PTR StaticBitmap[32];
} DUMMYUNIONNAME;
} KAFFINITY_EX, *PKAFFINITY_EX;
// private
typedef struct _SYSTEM_ROOT_SILO_INFORMATION
{
ULONG NumberOfSilos;
ULONG SiloIdList[1];
} SYSTEM_ROOT_SILO_INFORMATION, *PSYSTEM_ROOT_SILO_INFORMATION;
// private
typedef struct _SYSTEM_CPU_SET_TAG_INFORMATION
{
ULONGLONG Tag;
ULONGLONG CpuSets[1];
} SYSTEM_CPU_SET_TAG_INFORMATION, *PSYSTEM_CPU_SET_TAG_INFORMATION;
// private
typedef struct _SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION
{
ULONG ExtentCount;
ULONG ValidStructureSize;
ULONG NextExtentIndex;
ULONG ExtentRestart;
ULONG CycleCount;
ULONG TimeoutCount;
ULONGLONG CycleTime;
ULONGLONG CycleTimeMax;
ULONGLONG ExtentTime;
ULONG ExtentTimeIndex;
ULONG ExtentTimeMaxIndex;
ULONGLONG ExtentTimeMax;
ULONGLONG HyperFlushTimeMax;
ULONGLONG TranslateVaTimeMax;
ULONGLONG DebugExemptionCount;
ULONGLONG TbHitCount;
ULONGLONG TbMissCount;
ULONGLONG VinaPendingYield;
ULONGLONG HashCycles;
ULONG HistogramOffset;
ULONG HistogramBuckets;
ULONG HistogramShift;
ULONG Reserved1;
ULONGLONG PageNotPresentCount;
} SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION, *PSYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION;
// private
typedef struct _SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION
{
ULONG PlatformManifestSize;
UCHAR PlatformManifest[1];
} SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION, *PSYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION;
// private
typedef struct _SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT
{
ULONG Gsiv;
UCHAR ControllerInterrupt;
UCHAR EdgeInterrupt;
UCHAR IsPrimaryInterrupt;
GROUP_AFFINITY TargetAffinity;
} SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT, *PSYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT;
// private
typedef union _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT
{
ULONG AsULONG;
struct
{
ULONG Enabled : 1;
ULONG Reserved : 31;
};
} SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT, *PSYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT;
#if !defined(NTDDI_WIN10_FE) || (NTDDI_VERSION < NTDDI_WIN10_FE)
// private
typedef struct _SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION
{
ULONG Machine : 16;
ULONG KernelMode : 1;
ULONG UserMode : 1;
ULONG Native : 1;
ULONG Process : 1;
ULONG WoW64Container : 1;
ULONG ReservedZero0 : 11;
} SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION, *PSYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION;
#endif // NTDDI_WIN10_FE
// private
/**
* The SYSTEM_MEMORY_USAGE_INFORMATION structure contains information about the memory usage of the system.
*/
typedef struct _SYSTEM_MEMORY_USAGE_INFORMATION
{
ULONGLONG TotalPhysicalBytes;
ULONGLONG AvailableBytes;
LONGLONG ResidentAvailableBytes;
ULONGLONG CommittedBytes;
ULONGLONG SharedCommittedBytes;
ULONGLONG CommitLimitBytes;
ULONGLONG PeakCommitmentBytes;
} SYSTEM_MEMORY_USAGE_INFORMATION, *PSYSTEM_MEMORY_USAGE_INFORMATION;
// rev
/**
* The SYSTEM_CODEINTEGRITY_IMAGE_TYPE constant is used for validating user-mode images (EXE/DLL).
*/
typedef enum _SYSTEM_CODEINTEGRITY_IMAGE_TYPE
{
SystemCodeIntegrityImageTypeUser,
SystemCodeIntegrityImageTypeKernel,
SystemCodeIntegrityImageTypeBoot
} SYSTEM_CODEINTEGRITY_IMAGE_TYPE;
/**
* The SYSTEM_CODEINTEGRITY_IMAGE_TYPE_USER constant is used for validating user-mode images (EXE/DLL).
*
* Validation includes:
* - Digital signature
* - User-mode certificate chain validity.
* - Compliance policies for user-mode binaries.
*/
#define SYSTEM_CODEINTEGRITY_IMAGE_TYPE_USER 0
/**
* The SYSTEM_CODEINTEGRITY_IMAGE_TYPE_KERNEL constant is used for validating kernel-mode images (SYS/Native).
*
* Validation includes:
* - Signed by a trusted certificate authority (or cross-signed).
* - Compliance policies for kernel-mode binaries.
*/
#define SYSTEM_CODEINTEGRITY_IMAGE_TYPE_KERNEL 1
/**
* The SYSTEM_CODEINTEGRITY_IMAGE_TYPE_BOOT constant is used for validating boot-critical images (SYS/Native).
*
* Validation includes:
* - Signed only by Microsoft.
* - Compliance policies for boot-critical binaries (Strict WHQL, Secure Boot requirements).
*/
#define SYSTEM_CODEINTEGRITY_IMAGE_TYPE_BOOT 2
/**
* The SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION structure contains information to validate the integrity of an image.
*
* \note The return status of NtQuerySystemInformation indicates the result of the code integrity validation as determined by the type specified.
*/
typedef struct _SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION
{
HANDLE ImageFile; // in: Handle to a file or image to validate.
ULONG Type; // in: The type of code integrity policy. // REDSTONE4
} SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION, *PSYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION;
/**
* The SYSTEM_PHYSICAL_MEMORY_INFORMATION structure retrieves the physical memory layout of the system.
*
* \remarks The addresses are physical, not virtual.
*/
typedef struct _SYSTEM_PHYSICAL_MEMORY_INFORMATION
{
ULONGLONG TotalPhysicalBytes; // Total amount of physical RAM present, in bytes.
ULONGLONG LowestPhysicalAddress; // Lowest accessible physical address (byte address).
ULONGLONG HighestPhysicalAddress; // Highest accessible physical address (byte address, inclusive).
} SYSTEM_PHYSICAL_MEMORY_INFORMATION, *PSYSTEM_PHYSICAL_MEMORY_INFORMATION;
/**
* The SYSTEM_ACTIVITY_MODERATION_STATE type contains the moderation state applied to an application,
* with respect to background throttling, resource reduction, and related heuristics.
*
* \remarks The state may be assigned automatically by the system or explicitly overridden by the user.
*/
typedef enum _SYSTEM_ACTIVITY_MODERATION_STATE
{
SystemActivityModerationStateSystemManaged, // The system applies heuristics based on the appropriate moderation behavior.
SystemActivityModerationStateUserManagedAllowThrottling, // User allows the system to throttle the application.
SystemActivityModerationStateUserManagedDisableThrottling, // User disables throttling for the application.
MaxSystemActivityModerationState // Upper bound for validation; not a real state.
} SYSTEM_ACTIVITY_MODERATION_STATE;
// private - REDSTONE2
typedef struct _SYSTEM_ACTIVITY_MODERATION_EXE_STATE // REDSTONE3: Renamed SYSTEM_ACTIVITY_MODERATION_INFO
{
UNICODE_STRING ExePathNt;
SYSTEM_ACTIVITY_MODERATION_STATE ModerationState;
} SYSTEM_ACTIVITY_MODERATION_EXE_STATE, *PSYSTEM_ACTIVITY_MODERATION_EXE_STATE;
typedef enum _SYSTEM_ACTIVITY_MODERATION_APP_TYPE
{
SystemActivityModerationAppTypeClassic,
SystemActivityModerationAppTypePackaged,
MaxSystemActivityModerationAppType
} SYSTEM_ACTIVITY_MODERATION_APP_TYPE;
// private - REDSTONE3
typedef struct _SYSTEM_ACTIVITY_MODERATION_INFO
{
UNICODE_STRING Identifier;
SYSTEM_ACTIVITY_MODERATION_STATE ModerationState;
SYSTEM_ACTIVITY_MODERATION_APP_TYPE AppType;
} SYSTEM_ACTIVITY_MODERATION_INFO, *PSYSTEM_ACTIVITY_MODERATION_INFO;
// rev
/**
* The SYSTEM_ACTIVITY_MODERATION_APP_SETTINGS structure describes the moderation state
* and classification of an application as used by the system's activity moderation framework.
* These settings influence how aggressively the system may throttle, defer, or
* suppress certain background activities for the application.
*
* The structure maintains a stable binary layout because it is stored in
* serialized policy blobs and consumed by system components that expect
* fixed field offsets.
*/
typedef struct _SYSTEM_ACTIVITY_MODERATION_APP_SETTINGS
{
LARGE_INTEGER LastUpdatedTime; // Timestamp of the last update to this settings block.
SYSTEM_ACTIVITY_MODERATION_STATE ModerationState; // Current moderation state assigned to the application.
UCHAR Reserved[4]; // Reserved for future expansion
SYSTEM_ACTIVITY_MODERATION_APP_TYPE AppType; // Current application type for moderation purposes.
ULONG Flags; // Additional moderation flags.
} SYSTEM_ACTIVITY_MODERATION_APP_SETTINGS, *PSYSTEM_ACTIVITY_MODERATION_APP_SETTINGS;
/**
* The SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS structure provides the activity-moderation
* registry location where moderation policies or overrides may be stored.
*/
typedef struct _SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS
{
HANDLE UserKeyHandle; // Handle to the user registry key for activity moderation settings.
} SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS, *PSYSTEM_ACTIVITY_MODERATION_USER_SETTINGS;
/**
* The SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION structure contains Code Integrity unlock state and validation token.
*
* **Purpose:**
*
* The UnlockId field is a 32-byte cryptographic validation token used to authenticate requests to temporarily
* disable Code Integrity (CI) enforcement. It works in conjunction with the three flag bits (Locked, UnlockApplied, UnlockIdValid)
* to control the application of code integrity bypass authorization.
*
* **Mechanism:**
*
* \b Token \b Generation: When needing to disable CI, a component (bootloader, recovery environment, or factory process)
* computes a 32-byte UnlockId using:
* - HMAC-SHA256 or similar cryptographic hash function
* - A kernel-embedded or TPM-stored secret key
* - Machine-specific data (boot state, firmware version, hardware configuration, etc.)
*
* \b Validation: The kernel validates the UnlockId by:
* - Recomputing the expected HMAC-SHA256 using its stored secret and machine state
* - Comparing against the provided UnlockId (32-byte comparison)
* - Setting the UnlockIdValid flag if the cryptographic match succeeds
* - Rejecting any token that fails validation
*
* \b Application: Once validated:
* - UnlockApplied flag is set (unlock request accepted by the kernel)
* - Locked flag may be cleared (CI enforcement disabled for this session)
* - Temporary bypass of code integrity checks is granted for authorized operations
*
* **Security Properties:**
*
* - \b 256-bit \b Token: The 32-byte (256-bit) size is standard for HMAC-SHA256 output, providing strong cryptographic security
* - \b Microsoft-Controlled \b Secret: UnlockId tokens are derived from a Microsoft-controlled secret key, preventing unauthorized bypasses
* - \b Machine \b Binding: Machine-specific data ensures tokens are valid only for the intended system
* - \b Temporal \b Scope: Unlock is session-scoped and typically used during controlled recovery or factory processes
*
* **Use Cases:**
*
* - \b Factory \b Reset (OOBE): Allow boot in non-secure mode during device initial setup and provisioning
* - \b Recovery \b Environment: Enable recovery tools to bypass CI during authorized system repairs
* - \b Secure \b Boot \b Bypass: Controlled disabling of code verification during authorized recovery scenarios
* - \b Development/Debugging: Microsoft-signed tokens for internal kernel validation and testing on development systems
*
* \note The UnlockId prevents unauthorized bypasses of code integrity protection and is only trusted after cryptographic validation succeeds.
* \note This structure is private to the kernel and not part of the public API.
* \note Available since Windows Redstone 4 (Windows 10 version 1803).
*/
// private
typedef struct _SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION
{
union
{
ULONG Flags;
struct
{
/** \brief Code Integrity is currently locked (enforced).
*
* When set (1), Code Integrity enforcement is active and code execution restrictions are applied.
* When clear (0), Code Integrity may be disabled if UnlockApplied is set and a valid token was provided.
*/
ULONG Locked : 1;
/** \brief Unlock request has been validated and applied.
*
* Set by the kernel when the provided UnlockId passes cryptographic validation and the unlock is authorized.
* When set, this flag indicates that CI enforcement has been temporarily disabled for this session.
* Field removed after Windows 10 v1909 (19H1) in newer releases.
*/
ULONG UnlockApplied : 1;
/** \brief UnlockId contains a valid, authenticated cryptographic token.
*
* Set by the kernel when the provided UnlockId passes HMAC-SHA256 validation against the kernel's stored secret.
* This flag indicates that the token is cryptographically valid and can authorize CI bypass.
*/
ULONG UnlockIdValid : 1;
/** \brief Reserved flag bits for future use. */
ULONG Reserved : 29;
};
};
/** \brief 32-byte cryptographic validation token for Code Integrity unlock requests.
*
* This HMAC-SHA256 token authorizes temporary disabling of Code Integrity enforcement.
* The token is computed using a kernel-embedded secret key, machine-specific data, and cryptographic derivation.
*
* **Format:**
* - Size: 32 bytes (256 bits)
* - Algorithm: HMAC-SHA256
* - Derivation: Microsoft-controlled secret key + machine state
* - Validation: Kernel verifies token before granting CI bypass
*
* **Validation Process:**
* 1. Kernel recomputes expected HMAC-SHA256 from stored secret and current machine state
* 2. Compares computed HMAC against the provided UnlockId (byte-for-byte)
* 3. Sets UnlockIdValid flag if match succeeds; fails otherwise
* 4. If validation succeeds, kernel sets UnlockApplied and may clear Locked flag
*
* **Authorization Scenarios:**
* - Factory Reset (OOBE): Token allows non-secure boot during device provisioning
* - Recovery Mode: Token allows recovery environment to bypass code verification checks
* - Development/Debug: Microsoft-signed tokens for test systems and kernel development
*
* \note Available since Windows 10 Redstone 4 (version 1803, NTDDI_WIN10_RS4).
*/
UCHAR UnlockId[32];
} SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION, *PSYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION;
// private
typedef struct _SYSTEM_FLUSH_INFORMATION
{
union
{
ULONG SupportedFlushMethods;
struct
{
ULONG MethodAlwaysPresent : 1; // 0x1
ULONG MethodProcessorFeatureBit35 : 1; // 0x2
ULONG MethodProcessorFeatureBit36 : 1; // 0x4
ULONG ReservedMethods : 29;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
ULONG ProcessorCacheFlushSize;
union
{
ULONGLONG SystemFlushCapabilities;
struct
{
ULONGLONG NfitType7FlushCapable : 1; // 0x1
ULONGLONG ReservedCapabilities : 63;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
ULONGLONG Reserved[2];
} SYSTEM_FLUSH_INFORMATION, *PSYSTEM_FLUSH_INFORMATION;
// private
typedef struct _SYSTEM_WRITE_CONSTRAINT_INFORMATION
{
ULONG WriteConstraintPolicy;
ULONG Reserved;
} SYSTEM_WRITE_CONSTRAINT_INFORMATION, *PSYSTEM_WRITE_CONSTRAINT_INFORMATION;
// private
typedef struct _SYSTEM_KERNEL_VA_SHADOW_INFORMATION
{
union
{
ULONG KvaShadowFlags;
struct
{
ULONG KvaShadowEnabled : 1;
ULONG KvaShadowUserGlobal : 1;
ULONG KvaShadowPcid : 1;
ULONG KvaShadowInvpcid : 1;
ULONG KvaShadowRequired : 1; // REDSTONE4
ULONG KvaShadowRequiredAvailable : 1;
ULONG InvalidPteBit : 6;
ULONG L1DataCacheFlushSupported : 1;
ULONG L1TerminalFaultMitigationPresent : 1;
ULONG Reserved : 18;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
} SYSTEM_KERNEL_VA_SHADOW_INFORMATION, *PSYSTEM_KERNEL_VA_SHADOW_INFORMATION;
// private
/**
* The SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION structure contains information
* required for code integrity verification of an image.
*
* Two verification modes are supported:
* - File-backed: supply a non-null FileHandle (handle to an open file); Image and ImageSize are ignored.
* - Memory-backed: supply a null FileHandle, set Image to the base address of a mapped/loaded PE image
* in memory, and ImageSize to its size in bytes. The kernel reads image content directly from the buffer.
*/
typedef struct _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION
{
HANDLE FileHandle; // Handle to an open file for file-backed verification, or NULL for memory-backed verification.
ULONG ImageSize; // Size in bytes of the image buffer; used only when FileHandle is NULL.
PVOID Image; // Base address of the PE image buffer for memory-backed verification; ignored when FileHandle is non-null.
} SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION, *PSYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION;
// rev
/**
* The SYSTEM_HYPERVISOR_USER_SHARED_DATA structure contains information shared with the hypervisor and user-mode.
*
* This structure is populated by the hypervisor (when present) to allow user-mode components to perform
* high-resolution time calculations without requiring a hypercall or kernel transition.
*/
typedef struct _SYSTEM_HYPERVISOR_USER_SHARED_DATA
{
/**
* Lock used to synchronize updates to the timing fields.
*
* The hypervisor increments this value before and after updating the
* QPC multiplier and bias. User-mode callers can sample this value
* before and after reading the timing fields to detect whether an
* update occurred mid-read and retry if necessary.
*/
volatile ULONG TimeUpdateLock;
/**
* Reserved field - The hypervisor does not assign this field.
*/
ULONG Reserved0;
/**
* Multiplier used to convert hypervisor QPC ticks to host time.
*
* This value is applied to the hypervisor's virtualized performance
* counter to compute a stable, high-resolution timebase. The multiplier
* is chosen by the hypervisor based on the underlying hardware timer
* source and virtualization mode.
*/
ULONGLONG QpcMultiplier;
/**
* Bias applied after QPC multiplication to produce final time.
*
* The hypervisor uses this bias to align the virtualized QPC value with
* the host's notion of system time. Combined with QpcMultiplier, this
* allows user-mode components to compute consistent time values even
* under virtualization.
*/
ULONGLONG QpcBias;
} SYSTEM_HYPERVISOR_USER_SHARED_DATA, *PSYSTEM_HYPERVISOR_USER_SHARED_DATA;
/**
* The SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION structure describes
* the user-mode mapping of the hypervisor shared page.
*
* This structure provides the virtual address at which the hypervisor's
* user-accessible shared data page is mapped. When a hypervisor is present,
* the kernel maps a read-only page into user mode containing timing and
* virtualization-related information (see SYSTEM_HYPERVISOR_USER_SHARED_DATA).
*
* User-mode components can read this page directly to obtain high-resolution
* time conversion parameters or other hypervisor-provided data without
* requiring a hypercall or kernel transition.
*/
typedef struct _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION
{
/**
* User-mode virtual address of the hypervisor shared data page.
* If no hypervisor is present, this pointer is NULL.
*/
PSYSTEM_HYPERVISOR_USER_SHARED_DATA HypervisorSharedUserVa;
} SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION, *PSYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION;
// private
typedef struct _SYSTEM_FIRMWARE_PARTITION_INFORMATION
{
UNICODE_STRING FirmwarePartition;
} SYSTEM_FIRMWARE_PARTITION_INFORMATION, *PSYSTEM_FIRMWARE_PARTITION_INFORMATION;
// private
typedef struct _SYSTEM_SPECULATION_CONTROL_INFORMATION
{
union
{
ULONG Flags;
struct
{
ULONG BpbEnabled : 1;
ULONG BpbDisabledSystemPolicy : 1;
ULONG BpbDisabledNoHardwareSupport : 1;
ULONG SpecCtrlEnumerated : 1;
ULONG SpecCmdEnumerated : 1;
ULONG IbrsPresent : 1;
ULONG StibpPresent : 1;
ULONG SmepPresent : 1;
ULONG SpeculativeStoreBypassDisableAvailable : 1; // REDSTONE4 (CVE-2018-3639)
ULONG SpeculativeStoreBypassDisableSupported : 1;
ULONG SpeculativeStoreBypassDisabledSystemWide : 1;
ULONG SpeculativeStoreBypassDisabledKernel : 1;
ULONG SpeculativeStoreBypassDisableRequired : 1;
ULONG BpbDisabledKernelToUser : 1;
ULONG SpecCtrlRetpolineEnabled : 1;
ULONG SpecCtrlImportOptimizationEnabled : 1;
ULONG EnhancedIbrs : 1; // since 19H1
ULONG HvL1tfStatusAvailable : 1;
ULONG HvL1tfProcessorNotAffected : 1;
ULONG HvL1tfMigitationEnabled : 1;
ULONG HvL1tfMigitationNotEnabled_Hardware : 1;
ULONG HvL1tfMigitationNotEnabled_LoadOption : 1;
ULONG HvL1tfMigitationNotEnabled_CoreScheduler : 1;
ULONG EnhancedIbrsReported : 1;
ULONG MdsHardwareProtected : 1; // since 19H2
ULONG MbClearEnabled : 1;
ULONG MbClearReported : 1;
ULONG ReservedTaa : 4;
ULONG Reserved : 1;
};
} SpeculationControlFlags;
union
{
ULONG Flags; // since 23H2
struct
{
ULONG SbdrSsdpHardwareProtected : 1;
ULONG FbsdpHardwareProtected : 1;
ULONG PsdpHardwareProtected : 1;
ULONG FbClearEnabled : 1;
ULONG FbClearReported : 1;
ULONG BhbEnabled : 1;
ULONG BhbDisabledSystemPolicy : 1;
ULONG BhbDisabledNoHardwareSupport : 1;
ULONG BranchConfusionStatus : 2;
ULONG BranchConfusionReported : 1;
ULONG RdclHardwareProtectedReported : 1;
ULONG RdclHardwareProtected : 1;
ULONG Reserved3 : 4;
ULONG Reserved4 : 3;
ULONG DivideByZeroReported : 1;
ULONG DivideByZeroStatus : 1;
ULONG Reserved5 : 3;
ULONG Reserved : 7;
};
} SpeculationControlFlags2;
} SYSTEM_SPECULATION_CONTROL_INFORMATION, *PSYSTEM_SPECULATION_CONTROL_INFORMATION;
// private
typedef struct _SYSTEM_DMA_GUARD_POLICY_INFORMATION
{
BOOLEAN DmaGuardPolicyEnabled;
} SYSTEM_DMA_GUARD_POLICY_INFORMATION, *PSYSTEM_DMA_GUARD_POLICY_INFORMATION;
// private
typedef struct _SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION
{
UCHAR EnclaveLaunchSigner[32];
} SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION, *PSYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION;
// private
typedef struct _SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION
{
ULONGLONG WorkloadClass;
ULONGLONG CpuSets[1];
} SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION, *PSYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION;
// private
typedef struct _SYSTEM_SECURITY_MODEL_INFORMATION
{
union
{
ULONG SecurityModelFlags;
struct
{
ULONG ReservedFlag : 1; // SModeAdminlessEnabled
ULONG AllowDeviceOwnerProtectionDowngrade : 1;
ULONG Reserved : 30;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
} SYSTEM_SECURITY_MODEL_INFORMATION, *PSYSTEM_SECURITY_MODEL_INFORMATION;
// private
typedef union _SECURE_SPECULATION_CONTROL_INFORMATION
{
ULONG KvaShadowSupported : 1;
ULONG KvaShadowEnabled : 1;
ULONG KvaShadowUserGlobal : 1;
ULONG KvaShadowPcid : 1;
ULONG MbClearEnabled : 1;
ULONG L1TFMitigated : 1; // since 20H2
ULONG BpbEnabled : 1;
ULONG IbrsPresent : 1;
ULONG EnhancedIbrs : 1;
ULONG StibpPresent : 1;
ULONG SsbdSupported : 1;
ULONG SsbdRequired : 1;
ULONG BpbKernelToUser : 1;
ULONG BpbUserToKernel : 1;
ULONG ReturnSpeculate : 1;
ULONG BranchConfusionSafe : 1;
ULONG SsbsEnabledAlways : 1; // 24H2
ULONG SsbsEnabledKernel : 1;
ULONG Reserved : 14;
} SECURE_SPECULATION_CONTROL_INFORMATION, *PSECURE_SPECULATION_CONTROL_INFORMATION;
// private
typedef struct _SYSTEM_FIRMWARE_RAMDISK_INFORMATION
{
ULONG Version;
ULONG BlockSize;
ULONG_PTR BaseAddress;
SIZE_T Size;
} SYSTEM_FIRMWARE_RAMDISK_INFORMATION, *PSYSTEM_FIRMWARE_RAMDISK_INFORMATION;
// rev
typedef struct _SYSTEM_WHEA_IPMI_HARDWARE_INFORMATION
{
ULONGLONG RecordId;
UCHAR EventType;
UCHAR SensorType;
USHORT GeneratorId;
UCHAR EvmRevision;
UCHAR RecordType;
UCHAR Data[4];
} SYSTEM_WHEA_IPMI_HARDWARE_INFORMATION, *PSYSTEM_WHEA_IPMI_HARDWARE_INFORMATION;
// private
typedef struct _SYSTEM_SHADOW_STACK_INFORMATION
{
union
{
ULONG Flags;
struct
{
ULONG CetCapable : 1;
ULONG UserCetAllowed : 1;
ULONG ReservedForUserCet : 6;
ULONG KernelCetEnabled : 1;
ULONG KernelCetAuditModeEnabled : 1;
ULONG ReservedForKernelCet : 6; // since Windows 10 build 21387
ULONG Reserved : 16;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
} SYSTEM_SHADOW_STACK_INFORMATION, *PSYSTEM_SHADOW_STACK_INFORMATION;
// private
typedef union _SYSTEM_BUILD_VERSION_INFORMATION_FLAGS
{
ULONG Value32;
struct
{
ULONG IsTopLevel : 1;
ULONG IsChecked : 1;
};
} SYSTEM_BUILD_VERSION_INFORMATION_FLAGS, *PSYSTEM_BUILD_VERSION_INFORMATION_FLAGS;
// private
typedef struct _SYSTEM_BUILD_VERSION_INFORMATION
{
USHORT LayerNumber;
USHORT LayerCount;
ULONG OsMajorVersion;
ULONG OsMinorVersion;
ULONG NtBuildNumber;
ULONG NtBuildQfe;
UCHAR LayerName[128];
UCHAR NtBuildBranch[128];
UCHAR NtBuildLab[128];
UCHAR NtBuildLabEx[128];
UCHAR NtBuildStamp[26];
UCHAR NtBuildArch[16];
SYSTEM_BUILD_VERSION_INFORMATION_FLAGS Flags;
} SYSTEM_BUILD_VERSION_INFORMATION, *PSYSTEM_BUILD_VERSION_INFORMATION;
// private
typedef struct _SYSTEM_POOL_LIMIT_MEM_INFO
{
ULONGLONG MemoryLimit;
ULONGLONG NotificationLimit;
} SYSTEM_POOL_LIMIT_MEM_INFO, *PSYSTEM_POOL_LIMIT_MEM_INFO;
// private
typedef struct _SYSTEM_POOL_LIMIT_INFO
{
ULONG PoolTag;
SYSTEM_POOL_LIMIT_MEM_INFO MemLimits[2];
WNF_STATE_NAME NotificationHandle;
} SYSTEM_POOL_LIMIT_INFO, *PSYSTEM_POOL_LIMIT_INFO;
// private
typedef struct _SYSTEM_POOL_LIMIT_INFORMATION
{
ULONG Version;
ULONG EntryCount;
_Field_size_(EntryCount) SYSTEM_POOL_LIMIT_INFO LimitEntries[1];
} SYSTEM_POOL_LIMIT_INFORMATION, *PSYSTEM_POOL_LIMIT_INFORMATION;
// private
//typedef struct _SYSTEM_POOL_ZEROING_INFORMATION
//{
// BOOLEAN PoolZeroingSupportPresent;
//} SYSTEM_POOL_ZEROING_INFORMATION, *PSYSTEM_POOL_ZEROING_INFORMATION;
// private
typedef struct _HV_MINROOT_NUMA_LPS
{
ULONG NodeIndex;
ULONG_PTR Mask[16];
} HV_MINROOT_NUMA_LPS, *PHV_MINROOT_NUMA_LPS;
// private
typedef struct _SYSTEM_XFG_FAILURE_INFORMATION
{
PVOID ReturnAddress;
PVOID TargetAddress;
ULONG DispatchMode;
ULONGLONG XfgValue;
} SYSTEM_XFG_FAILURE_INFORMATION, *PSYSTEM_XFG_FAILURE_INFORMATION;
// private
typedef enum _SYSTEM_IOMMU_STATE
{
IommuStateBlock,
IommuStateUnblock
} SYSTEM_IOMMU_STATE;
// private
typedef struct _SYSTEM_IOMMU_STATE_INFORMATION
{
SYSTEM_IOMMU_STATE State;
PVOID Pdo;
} SYSTEM_IOMMU_STATE_INFORMATION, *PSYSTEM_IOMMU_STATE_INFORMATION;
// private
typedef struct _SYSTEM_HYPERVISOR_MINROOT_INFORMATION
{
ULONG NumProc;
ULONG RootProc;
ULONG RootProcNumaNodesSpecified;
USHORT RootProcNumaNodes[64];
ULONG RootProcPerCore;
ULONG RootProcPerNode;
ULONG RootProcNumaNodesLpsSpecified;
HV_MINROOT_NUMA_LPS RootProcNumaNodeLps[64];
} SYSTEM_HYPERVISOR_MINROOT_INFORMATION, *PSYSTEM_HYPERVISOR_MINROOT_INFORMATION;
// private
typedef struct _SYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION
{
ULONG RangeCount;
ULONG_PTR RangeArray[1];
} SYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION, *PSYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION;
// private
typedef struct _SYSTEM_POINTER_AUTH_INFORMATION
{
union
{
USHORT SupportedFlags;
struct
{
USHORT AddressAuthSupported : 1;
USHORT AddressAuthQarma : 1;
USHORT GenericAuthSupported : 1;
USHORT GenericAuthQarma : 1;
USHORT AddressAuthFaulting : 1;
USHORT SupportedReserved : 11;
};
};
union
{
USHORT EnabledFlags;
struct
{
USHORT UserPerProcessIpAuthEnabled : 1;
USHORT UserGlobalIpAuthEnabled : 1;
USHORT UserEnabledReserved : 6;
USHORT KernelIpAuthEnabled : 1;
USHORT KernelEnabledReserved : 7;
};
};
} SYSTEM_POINTER_AUTH_INFORMATION, *PSYSTEM_POINTER_AUTH_INFORMATION;
// rev
#define SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_VERSION 1 // Current protocol version for input/output structures.
/**
* Query interface for checking whether a named Windows feature flag is enabled for an image's
* "born-on" Windows version — the OS version the image was originally built or linked against.
* In observed logic, the decision is based on OriginalImageVersion for the image context plus the
* caller-provided BornOnVersion. This is image-compat metadata, not simply current OS version.
* A plain OS upgrade does not automatically guarantee the result flips to enabled for an existing
* old image. It can become enabled if the relevant image/component is updated or replaced so its
* original-image version context is newer and passes the threshold. The code path only reports
* eligibility in FeatureIsEnabled and does not directly enable a feature system-wide.
* So think of it as compatibility gating tied to image provenance, not a global switch that turns on when Windows version increases.
*/
typedef struct _SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT
{
ULONG Version; // Must be set to SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_VERSION (1).
PWSTR FeatureName; // Wide string naming the feature to query. Not consulted by the kernel in observed builds; reserved for future use.
ULONG BornOnVersion; // Windows version number the image was originally targeted at; compared against OriginalImageVersion.
} SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT, *PSYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT;
// private
typedef struct _SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT
{
ULONG Version; // Echoes back the protocol version.
BOOLEAN FeatureIsEnabled; // Eligibility result only; TRUE/FALSE does not directly toggle a system-wide feature state.
} SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT, *PSYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT;
// private
typedef struct _SYSTEM_MEMORY_NUMA_INFORMATION_INPUT
{
ULONG Version;
ULONG TargetNodeNumber;
ULONG Flags;
} SYSTEM_MEMORY_NUMA_INFORMATION_INPUT, *PSYSTEM_MEMORY_NUMA_INFORMATION_INPUT;
// private
typedef struct _SYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT
{
ULONG Version;
ULONG Size;
ULONG InitiatorNode;
union
{
ULONG Flags;
struct
{
ULONG IsAttached : 1;
ULONG Reserved : 31;
};
};
} SYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT, *PSYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT;
// private
typedef enum _SYSTEM_MEMORY_NUMA_PERFORMANCE_QUERY_DATA_TYPES
{
SystemMemoryNumaPerformanceQuery_ReadLatency,
SystemMemoryNumaPerformanceQuery_ReadBandwidth,
SystemMemoryNumaPerformanceQuery_WriteLatency,
SystemMemoryNumaPerformanceQuery_WriteBandwidth,
SystemMemoryNumaPerformanceQuery_Latency,
SystemMemoryNumaPerformanceQuery_Bandwidth,
SystemMemoryNumaPerformanceQuery_AllDataTypes,
SystemMemoryNumaPerformanceQuery_MaxDataType
} SYSTEM_MEMORY_NUMA_PERFORMANCE_QUERY_DATA_TYPES;
// private
typedef struct _SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT
{
ULONG Version;
ULONG TargetNodeNumber;
SYSTEM_MEMORY_NUMA_PERFORMANCE_QUERY_DATA_TYPES QueryDataType;
ULONG Flags;
} SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT, *PSYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT;
// private
typedef struct _SYSTEM_MEMORY_NUMA_PERFORMANCE_ENTRY
{
ULONG InitiatorNodeNumber;
ULONG TargetNodeNumber;
SYSTEM_MEMORY_NUMA_PERFORMANCE_QUERY_DATA_TYPES DataType;
union
{
BOOLEAN Flags;
struct
{
BOOLEAN MinTransferSizeToAchieveValues : 1;
BOOLEAN NonSequentialTransfers : 1;
BOOLEAN Reserved : 6;
};
};
SIZE_T MinTransferSizeInBytes;
ULONG_PTR EntryValue;
} SYSTEM_MEMORY_NUMA_PERFORMANCE_ENTRY, *PSYSTEM_MEMORY_NUMA_PERFORMANCE_ENTRY;
// private
typedef struct _SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT
{
ULONG Version;
ULONG Size;
ULONG EntryCount;
SYSTEM_MEMORY_NUMA_PERFORMANCE_ENTRY PerformanceEntries[1];
} SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT, *PSYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT;
/**
* The SYSTEM_OSL_RAMDISK_ENTRY structure describes a single RAM disk region
* used by the operating system loader.
*/
typedef struct _SYSTEM_OSL_RAMDISK_ENTRY
{
ULONG BlockSize;
ULONG_PTR BaseAddress;
SIZE_T Size;
} SYSTEM_OSL_RAMDISK_ENTRY, *PSYSTEM_OSL_RAMDISK_ENTRY;
/**
* The SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION structure describes runtime
* information related to Trusted Apps support.
*/
typedef struct _SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION
{
union
{
ULONGLONG Flags;
struct
{
ULONGLONG Supported : 1;
ULONGLONG Spare : 63;
};
};
PVOID RemoteBreakingRoutine;
} SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION, *PSYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION;
/**
* The SYSTEM_OSL_RAMDISK_INFORMATION structure describes a variable-length
* array of RAM disk entries used by the operating system loader.
*/
typedef struct _SYSTEM_OSL_RAMDISK_INFORMATION
{
ULONG Version;
ULONG Count;
SYSTEM_OSL_RAMDISK_ENTRY Entries[1];
} SYSTEM_OSL_RAMDISK_INFORMATION, *PSYSTEM_OSL_RAMDISK_INFORMATION;
/**
* The CI_POLICY_MGMT_OPERATION enumeration specifies the type of Code Integrity
* policy management operation requested.
*/
typedef enum _CI_POLICY_MGMT_OPERATION
{
CI_POLICY_MGMT_OPERATION_NONE = 0,
CI_POLICY_MGMT_OPERATION_OPEN_TX = 1,
CI_POLICY_MGMT_OPERATION_COMMIT_TX = 2,
CI_POLICY_MGMT_OPERATION_CLOSE_TX = 3,
CI_POLICY_MGMT_OPERATION_ADD_POLICY = 4,
CI_POLICY_MGMT_OPERATION_REMOVE_POLICY = 5,
CI_POLICY_MGMT_OPERATION_GET_POLICY = 6,
CI_POLICY_MGMT_OPERATION_GET_POLICY_IDS = 7,
CI_POLICY_MGMT_OPERATION_MAX = 8
} CI_POLICY_MGMT_OPERATION;
/**
* The SYSTEM_CODEINTEGRITYPOLICY_MANAGEMENT structure describes parameters
* used to manage Code Integrity policies through the system information
* interface.
*/
typedef struct _SYSTEM_CODEINTEGRITYPOLICY_MANAGEMENT
{
CI_POLICY_MGMT_OPERATION Operation;
UCHAR UseInProgressState;
ULONG Arg1Len;
PUCHAR Arg1;
ULONG Arg2Len;
PUCHAR Arg2;
} SYSTEM_CODEINTEGRITYPOLICY_MANAGEMENT, *PSYSTEM_CODEINTEGRITYPOLICY_MANAGEMENT;
// rev
typedef struct _SYSTEM_MEMORY_NUMA_CACHE_ENTRY
{
ULONG CacheNode;
ULONG CacheLevel;
ULONG CacheSize;
ULONG CacheLineSize;
ULONG CacheType;
ULONG CacheAttributes;
ULONG CacheFlags;
UCHAR Present;
UCHAR Reserved[3];
} SYSTEM_MEMORY_NUMA_CACHE_ENTRY, *PSYSTEM_MEMORY_NUMA_CACHE_ENTRY;
// rev
typedef struct _SYSTEM_MEMORY_NUMA_CACHE_INFORMATION
{
ULONG Version; // always 1
ULONG Size; // total bytes written, aligned to 0x20
ULONG EntryCount; // number of cache entries
ULONG Reserved; // appears to stay zero
SYSTEM_MEMORY_NUMA_CACHE_ENTRY Entries[1]; // Followed by EntryCount records, each 0x20 bytes
} SYSTEM_MEMORY_NUMA_CACHE_INFORMATION, *PSYSTEM_MEMORY_NUMA_CACHE_INFORMATION;
/**
* The SYSTEM_REF_TRACE_INFORMATION_EX structure describes configuration
* parameters for object reference tracing.
*/
typedef struct _SYSTEM_REF_TRACE_INFORMATION_EX
{
ULONG Version;
ULONGLONG MemoryLimits;
union
{
ULONG Flags;
struct
{
ULONG TraceEnable : 1;
ULONG TracePermanent : 1;
ULONG UseTracePoolTags : 1;
ULONG TraceByStacksOnly : 1;
ULONG ReservedFlags : 28;
};
};
UNICODE_STRING TraceProcessName;
UNICODE_STRING TracePoolTags;
ULONG MaxObjectRefTraces;
ULONG TracedObjectLimit;
} SYSTEM_REF_TRACE_INFORMATION_EX, *PSYSTEM_REF_TRACE_INFORMATION_EX;
/**
* The SYSTEM_BASICPROCESS_INFORMATION structure describes basic process
* information returned when enumerating processes.
*/
_Struct_size_bytes_(NextEntryOffset)
typedef struct _SYSTEM_BASICPROCESS_INFORMATION
{
ULONG NextEntryOffset;
HANDLE UniqueProcessId;
HANDLE InheritedFromUniqueProcessId;
ULONG64 SequenceNumber;
UNICODE_STRING ImageName;
} SYSTEM_BASICPROCESS_INFORMATION, *PSYSTEM_BASICPROCESS_INFORMATION;
/**
* The SYSTEM_HANDLECOUNT_INFORMATION structure provides global counts of
* processes, threads, and handles in the system.
*/
typedef struct _SYSTEM_HANDLECOUNT_INFORMATION
{
ULONG ProcessCount;
ULONG ThreadCount;
ULONG HandleCount;
} SYSTEM_HANDLECOUNT_INFORMATION, *PSYSTEM_HANDLECOUNT_INFORMATION;
//
// Runtime Report Definitions
//
#define SYSTEM_RUNTIME_REPORT_INPUT_VERSION_1 1
#define SYSTEM_RUNTIME_REPORT_INPUT_PACKAGE_VERSION_1 1
// private
typedef struct _SYSTEM_RUNTIME_REPORT_INPUT
{
USHORT InputVersion;
USHORT PackageVersion;
ULONG Reserved;
ULONG_PTR ReportTypesBitmap;
UCHAR Nonce[32];
} SYSTEM_RUNTIME_REPORT_INPUT, *PSYSTEM_RUNTIME_REPORT_INPUT;
#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE)
//
// ===============================================
// Runtime Report Package Format:
//
// ------------------------------------- Signed part Begin
//
// RUNTIME_REPORT_PACKAGE_HEADER
//
// BYTE Nonce[RUNTIME_REPORT_NONCE_SIZE]
//
// RUNTIME_REPORT_DIGEST_HEADER_A
//
// RUNTIME_REPORT_DIGEST_HEADER_B
// ...
// ...
//
// ------------------------------------- Signed part End
//
// Signature Blob
//
// ------------------------------------- Authenticated part Begin
//
// RUNTIME_REPORT_HEADER
// REPORT_A
//
// RUNTIME_REPORT_HEADER
// REPORT_B
//
// ------------------------------------- Authenticated part End
//
// ===============================================
//
#define RUNTIME_REPORT_PACKAGE_MAGIC 0x52545250 // = "RTRP"
#define RUNTIME_REPORT_PACKAGE_VERSION_CURRENT (1)
#define RUNTIME_REPORT_NONCE_SIZE 32
#define RUNTIME_REPORT_DIGEST_MAX_SIZE 64
#define RUNTIME_REPORT_SIGNATURE_SCHEME_SHA512_RSA_PSS_SHA512 (1)
//
// Runtime Report Type Enumeration
//
typedef enum _RUNTIME_REPORT_TYPE
{
RuntimeReportTypeDriver = 0,
RuntimeReportTypeCodeIntegrity = 1,
RuntimeReportTypeMax
} RUNTIME_REPORT_TYPE;
//
// Macro to convert a report type enum value to a bitmap mask
//
#define RUNTIME_REPORT_TYPE_TO_MASK(type) (1ULL << (type))
//
// Bitmap mask containing all valid report types
//
#define RUNTIME_REPORT_TYPE_MASK_ALL ((1ULL << RuntimeReportTypeMax) - 1)
typedef struct _RUNTIME_REPORT_PACKAGE_HEADER
{
//
// Set to RUNTIME_REPORT_PACKAGE_MAGIC = 0x52545250 ("RTRP")
//
ULONG Magic;
//
// The version of the package format
//
USHORT PackageVersion;
//
// Number of different report types contained in the package.
//
USHORT NumberOfReports;
//
// A bitmap of all the report types in the package.
//
// Use RUNTIME_REPORT_TYPE_TO_MASK macro to convert enum values to bitmap masks.
// Current valid report types:
// RuntimeReportTypeDriver = 0
// RuntimeReportTypeCodeIntegrity = 1
//
ULONG_PTR ReportTypesBitmap;
//
// The size of the total package including the package header,
// various runtime reports, their digests, and the signature blob.
//
ULONG PackageSize;
//
// The type of digest contained in the report digest headers.
//
// Current valid values:
// CALG_SHA_512 (see wincrypt.h)
//
USHORT ReportDigestType;
//
// Total size of the signed runtime report digest headers
// following the package header.
//
USHORT TotalReportDigestsSize;
//
// Reserved field. Must be set to zero.
//
USHORT Reserved;
//
// The signature scheme used to sign the runtime reports.
//
// Current valid values:
// RUNTIME_REPORT_SIGNATURE_SCHEME_SHA512_RSA_PSS_SHA512 = 1
//
USHORT SignatureScheme;
//
// Size of the signature blob following the runtime report digests.
//
ULONG SignatureSize;
//
// Total size of the authenticated (but unsigned) runtime reports
// following the signature blob.
//
ULONG TotalAuthenticatedReportsSize;
} RUNTIME_REPORT_PACKAGE_HEADER, *PRUNTIME_REPORT_PACKAGE_HEADER;
typedef struct _RUNTIME_REPORT_DIGEST_HEADER
{
//
// Indicates the type of report that was hashed.
//
// Current valid values:
// RuntimeReportTypeDriver = 0
// RuntimeReportTypeCodeIntegrity = 1
//
USHORT ReportType;
//
// Reserved field.
//
USHORT Reserved;
//
// Digest of the report including the report header.
// This is a SHA-512 digest.
//
UCHAR ReportDigest[RUNTIME_REPORT_DIGEST_MAX_SIZE];
} RUNTIME_REPORT_DIGEST_HEADER, *PRUNTIME_REPORT_DIGEST_HEADER;
typedef struct _RUNTIME_REPORT_HEADER
{
//
// Indicates the type of report.
//
// Current valid values:
// RuntimeReportTypeDriver = 0
// RuntimeReportTypeCodeIntegrity = 1
//
USHORT ReportType;
//
// Reserved field.
//
USHORT Reserved;
//
// The number of bytes consumed by this report, including the header.
//
ULONG ReportSize;
} RUNTIME_REPORT_HEADER, *PRUNTIME_REPORT_HEADER;
//
// Driver Report Definitions
//
#define DRIVER_REPORT_DIGEST_MAX_SIZE RUNTIME_REPORT_DIGEST_MAX_SIZE
#define DRIVER_REPORT_NAME_MAX_LENGTH 32
typedef struct _DRIVER_INFO_ENTRY
{
//
// Internal name of the driver from the resource section.
//
CHAR InternalName[DRIVER_REPORT_NAME_MAX_LENGTH];
//
// Hash algorithm used to calculate the image digest.
//
USHORT ImageHashAlgorithm;
//
// Hash algorithm used to calculate the thumbprint of the leaf certificate
// that validates the entire image.
//
USHORT PublisherThumbprintHashAlgorithm;
//
// Offset from the start of the driver report to a buffer containing the
// digest of the driver image on disk.
//
ULONG ImageHashOffset;
//
// Offset from the start of the driver report to a buffer containing the
// thumbprint of the leaf certificate validating the entire image
//
ULONG PublisherThumbprintOffset;
//
// Number of times that this driver image has been loaded into the system.
//
USHORT NumberOfLoadingTimes;
//
// Size and Offset of a string indicating the OEM name stored in the
// authenticated OPUS block of the image digital signature.
// There is no OEM name for inbox Windows signed drivers. The size does *NOT*
// include the NULL terminator (even though the string is NULL-terminated).
//
USHORT OemNameSize;
ULONG OemNameOffset;
//
// Flags indicating various properties of the current driver image:
// - Unloaded - Set to 1 in case the driver is current unloaded.
//
// - BootDriver - Set to 1 in case the image is a Boot Driver;
// 0 otherwise (the image is a Runtime driver).
//
// - HotPatch - Set to 1 in case the image can be also loaded as Hotpatch;
//
// - Reserved - Reserved flags bits.
//
union
{
struct
{
USHORT Unloaded : 1;
USHORT BootDriver : 1;
USHORT HotPatch : 1;
USHORT Reserved : 13;
};
USHORT AsUInt16;
} Flags;
USHORT Padding;
} DRIVER_INFO_ENTRY, *PDRIVER_INFO_ENTRY;
typedef struct _DRIVER_RUNTIME_REPORT
{
//
// The driver runtime report header.
//
RUNTIME_REPORT_HEADER Header;
//
// The current number of unique drivers in the report.
//
USHORT NumberOfDrivers;
//
// Flags indicating various properties of the report:
// - ReportOverflowed - Secure Kernel places a limit on the number of
// drivers it can list in the report. If this is set, it indicates
// that some loaded drivers might be missing from the report.
//
// - PartialReport - Indicates whether the report contains only a
// subset of NT loaded drivers.
//
// - IncludeBootDrivers - Set to 1 in case the report includes
// boot-loaded drivers; 0 otherwise (in that case the information
// is stored in the TCG Log).
//
// - Reserved - Reserved flags bits.
//
union
{
struct
{
USHORT ReportOverflowed : 1;
USHORT PartialReport : 1;
USHORT IncludeBootDrivers : 1;
USHORT Reserved : 13;
};
USHORT AsUInt16;
} Flags;
//
// A list, of size zero up to MaximumDriversRecorded, containing driver entries.
// Unloaded drivers are not removed from the list.
//
DRIVER_INFO_ENTRY DriverEntries[ANYSIZE_ARRAY];
//
// After the driver info array the driver runtime report store hashes,
// strings and information that are dynamic in size.
//
// BYTE DynamicBuffer[ANYSIZE_ARRAY];
//
// The dynamic buffer, for each driver is composed off:
// ImageHash - PublisherHash - OemName.
//
} DRIVER_RUNTIME_REPORT, *PDRIVER_RUNTIME_REPORT;
//
// Code Integrity Report Definitions.
//
typedef struct _CODE_INTEGRITY_RUNTIME_REPORT
{
//
// The Code Integrity runtime report header.
//
RUNTIME_REPORT_HEADER Header;
//
// The number of generations (updates) of policy there have been since boot.
// The initial generation at boot is 1.
//
UINT64 CurrentGeneration;
//
// The number of generations of policy that are in this report. This is
// non-zero with the current generation reported first, followed by prior
// generations in order of ascending age.
//
ULONG NumberOfGenerations;
} CODE_INTEGRITY_RUNTIME_REPORT;
#define CODE_INTEGRITY_REPORT_GENERATION_VERSION_CURRENT (1)
typedef struct _CODE_INTEGRITY_REPORT_GENERATION_HEADER
{
//
// Version of this structure.
//
USHORT Version;
//
// Reserved Field.
//
USHORT Reserved;
//
// The number of bytes consumed by this generation, including this header
// and all CODE_INTEGRITY_REPORT_RECORD_HEADER structures and payloads.
//
ULONG RecordSize;
//
// Secure Kernel / Hypervisor secure time reference when this policy was
// commited.
//
ULONG64 CommitTime;
} CODE_INTEGRITY_REPORT_GENERATION_HEADER;
#define CODE_INTEGRITY_REPORT_RECORD_VERSION_CURRENT (1)
typedef struct _CODE_INTEGRITY_REPORT_RECORD_HEADER
{
//
// Version of this structure.
//
USHORT Version;
//
// Reserved Field.
//
USHORT Reserved;
//
// The number of bytes consumed by this record, including this header.
//
ULONG RecordSize;
//
// The event code (type) of this record. The same codes as the Measured
// Boot TCG Log are used, for example SIPAEVENT_OS_REVOCATION_LIST, and
// indicate the structure type of the payload that immediately follows
// this header.
//
ULONG SipaEventCode;
} CODE_INTEGRITY_REPORT_RECORD_HEADER;
#endif // #if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE)
/**
* The SYSTEM_POOLTAG2 structure describes allocation statistics for a single
* pool tag, including paged and nonpaged usage.
*/
typedef struct _SYSTEM_POOLTAG2
{
union
{
UCHAR Tag[4];
ULONG TagUlong;
} DUMMYUNIONNAME;
SIZE_T PagedAllocs;
SIZE_T PagedFrees;
SIZE_T PagedUsed;
SIZE_T NonPagedAllocs;
SIZE_T NonPagedFrees;
SIZE_T NonPagedUsed;
} SYSTEM_POOLTAG2, *PSYSTEM_POOLTAG2;
/**
* The SYSTEM_POOLTAG_INFORMATION2 structure describes a variable-length array
* of SYSTEM_POOLTAG2 entries representing pool tag usage statistics.
*/
typedef struct _SYSTEM_POOLTAG_INFORMATION2
{
ULONG Count;
_Field_size_(Count) SYSTEM_POOLTAG2 TagInfo[1];
} SYSTEM_POOLTAG_INFORMATION2, *PSYSTEM_POOLTAG_INFORMATION2;
#if (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* The NtQuerySystemInformation routine queries information about the system.
*
* \param SystemInformationClass The type of information to be retrieved.
* \param SystemInformation A pointer to a buffer that receives the requested information.
* \param SystemInformationLength The size of the buffer pointed to by SystemInformation.
* \param ReturnLength A pointer to a variable that receives the size of the data returned in the buffer.
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows/win32/sysinfo/zwquerysysteminformation
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySystemInformation(
_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
_Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
_In_ ULONG SystemInformationLength,
_Out_opt_ PULONG ReturnLength
);
/**
* The NtQuerySystemInformationEx routine queries information about the system.
*
* \param SystemInformationClass The type of information to be retrieved.
* \param InputBuffer Pointer to a caller-allocated input buffer that contains class-specific information.
* \param InputBufferLength The size of the buffer pointed to by InputBuffer.
* \param SystemInformation A pointer to a buffer that receives the requested information.
* \param SystemInformationLength The size of the buffer pointed to by SystemInformation.
* \param ReturnLength A pointer to a variable that receives the size of the data returned in the buffer.
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows/win32/sysinfo/zwquerysysteminformation
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySystemInformationEx(
_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
_In_reads_bytes_(InputBufferLength) PVOID InputBuffer,
_In_ ULONG InputBufferLength,
_Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
_In_ ULONG SystemInformationLength,
_Out_opt_ PULONG ReturnLength
);
/**
* The NtSetSystemInformation routine sets information about the system.
*
* \param SystemInformationClass The type of information to be set.
* \param SystemInformation A pointer to a buffer that receives the requested information.
* \param SystemInformationLength The size of the buffer pointed to by SystemInformation.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetSystemInformation(
_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
_In_reads_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
_In_ ULONG SystemInformationLength
);
//
// SysDbg APIs
//
/**
* The SYSDBG_COMMAND enumeration specifies the type of system debugger
* operation requested through NtSystemDebugControl.
*/
typedef enum _SYSDBG_COMMAND
{
SysDbgQueryModuleInformation, // q: DBGKD_DEBUG_DATA_HEADER64
SysDbgQueryTraceInformation, // q: DBGKD_TRACE_DATA
SysDbgSetTracepoint, // s: PVOID
SysDbgSetSpecialCall, // s: PVOID
SysDbgClearSpecialCalls, // s: void
SysDbgQuerySpecialCalls, // q: PVOID[]
SysDbgBreakPoint, // s: void
SysDbgQueryVersion, // q: DBGKD_GET_VERSION64
SysDbgReadVirtual, // q: SYSDBG_VIRTUAL
SysDbgWriteVirtual, // s: SYSDBG_VIRTUAL
SysDbgReadPhysical, // q: SYSDBG_PHYSICAL // 10
SysDbgWritePhysical, // s: SYSDBG_PHYSICAL
SysDbgReadControlSpace, // q: SYSDBG_CONTROL_SPACE
SysDbgWriteControlSpace, // s: SYSDBG_CONTROL_SPACE
SysDbgReadIoSpace, // q: SYSDBG_IO_SPACE
SysDbgWriteIoSpace, // s: SYSDBG_IO_SPACE
SysDbgReadMsr, // q: SYSDBG_MSR
SysDbgWriteMsr, // s: SYSDBG_MSR
SysDbgReadBusData, // q: SYSDBG_BUS_DATA
SysDbgWriteBusData, // s: SYSDBG_BUS_DATA
SysDbgCheckLowMemory, // q: ULONG // 20
SysDbgEnableKernelDebugger, // s: void
SysDbgDisableKernelDebugger, // s: void
SysDbgGetAutoKdEnable, // q: ULONG
SysDbgSetAutoKdEnable, // s: ULONG
SysDbgGetPrintBufferSize, // q: ULONG
SysDbgSetPrintBufferSize, // s: ULONG
SysDbgGetKdUmExceptionEnable, // q: ULONG
SysDbgSetKdUmExceptionEnable, // s: ULONG
SysDbgGetTriageDump, // q: SYSDBG_TRIAGE_DUMP
SysDbgGetKdBlockEnable, // q: ULONG // 30
SysDbgSetKdBlockEnable, // s: ULONG
SysDbgRegisterForUmBreakInfo, // s: HANDLE
SysDbgGetUmBreakPid, // q: ULONG
SysDbgClearUmBreakPid, // s: void
SysDbgGetUmAttachPid, // q: ULONG
SysDbgClearUmAttachPid, // s: void
SysDbgGetLiveKernelDump, // q: SYSDBG_LIVEDUMP_CONTROL
SysDbgKdPullRemoteFile, // q: SYSDBG_KD_PULL_REMOTE_FILE
SysDbgMaxInfoClass
} SYSDBG_COMMAND, *PSYSDBG_COMMAND;
/**
* The SYSDBG_VIRTUAL structure describes a request to read or write virtual
* memory through the system debugger interface.
*/
typedef struct _SYSDBG_VIRTUAL
{
PVOID Address;
PVOID Buffer;
ULONG Request;
} SYSDBG_VIRTUAL, *PSYSDBG_VIRTUAL;
/**
* The SYSDBG_PHYSICAL structure describes a request to read or write physical
* memory through the system debugger interface.
*/
typedef struct _SYSDBG_PHYSICAL
{
PHYSICAL_ADDRESS Address;
PVOID Buffer;
ULONG Request;
} SYSDBG_PHYSICAL, *PSYSDBG_PHYSICAL;
/**
* The SYSDBG_CONTROL_SPACE structure describes a request to access processor
* control space through the system debugger interface.
*/
typedef struct _SYSDBG_CONTROL_SPACE
{
ULONG64 Address;
PVOID Buffer;
ULONG Request;
ULONG Processor;
} SYSDBG_CONTROL_SPACE, *PSYSDBG_CONTROL_SPACE;
typedef enum _INTERFACE_TYPE INTERFACE_TYPE;
/**
* The SYSDBG_IO_SPACE structure describes a request to access I/O space
* through the system debugger interface.
*/
typedef struct _SYSDBG_IO_SPACE
{
ULONG64 Address;
PVOID Buffer;
ULONG Request;
INTERFACE_TYPE InterfaceType;
ULONG BusNumber;
ULONG AddressSpace;
} SYSDBG_IO_SPACE, *PSYSDBG_IO_SPACE;
/**
* The SYSDBG_MSR structure describes a request to read or write a model-specific
* register (MSR) through the system debugger interface.
*/
typedef struct _SYSDBG_MSR
{
ULONG Msr;
ULONG64 Data;
} SYSDBG_MSR, *PSYSDBG_MSR;
typedef enum _BUS_DATA_TYPE BUS_DATA_TYPE;
/**
* The SYSDBG_BUS_DATA structure describes a request to access bus-specific
* configuration data through the system debugger interface.
*/
typedef struct _SYSDBG_BUS_DATA
{
ULONG Address;
PVOID Buffer;
ULONG Request;
BUS_DATA_TYPE BusDataType;
ULONG BusNumber;
ULONG SlotNumber;
} SYSDBG_BUS_DATA, *PSYSDBG_BUS_DATA;
/**
* The SYSDBG_TRIAGE_DUMP structure describes parameters used when generating
* a triage dump through the system debugger interface.
*/
typedef struct _SYSDBG_TRIAGE_DUMP
{
ULONG Flags;
ULONG BugCheckCode;
ULONG_PTR BugCheckParam1;
ULONG_PTR BugCheckParam2;
ULONG_PTR BugCheckParam3;
ULONG_PTR BugCheckParam4;
ULONG ProcessHandles;
ULONG ThreadHandles;
PHANDLE Handles;
} SYSDBG_TRIAGE_DUMP, *PSYSDBG_TRIAGE_DUMP;
/**
* The SYSDBG_LIVEDUMP_CONTROL_FLAGS union specifies control flags used when
* generating a live kernel dump.
*/
typedef union _SYSDBG_LIVEDUMP_CONTROL_FLAGS
{
struct
{
ULONG UseDumpStorageStack : 1;
ULONG CompressMemoryPagesData : 1;
ULONG IncludeUserSpaceMemoryPages : 1;
ULONG AbortIfMemoryPressure : 1; // REDSTONE4
ULONG SelectiveDump : 1; // WIN11
ULONG Reserved : 27;
};
ULONG AsUlong;
} SYSDBG_LIVEDUMP_CONTROL_FLAGS, *PSYSDBG_LIVEDUMP_CONTROL_FLAGS;
/**
* The SYSDBG_LIVEDUMP_CONTROL_ADDPAGES union specifies additional page
* categories to include when generating a live kernel dump.
*/
typedef union _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES
{
struct
{
ULONG HypervisorPages : 1;
ULONG NonEssentialHypervisorPages : 1; // since WIN11
ULONG Reserved : 30;
};
ULONG AsUlong;
} SYSDBG_LIVEDUMP_CONTROL_ADDPAGES, *PSYSDBG_LIVEDUMP_CONTROL_ADDPAGES;
#define SYSDBG_LIVEDUMP_SELECTIVE_CONTROL_VERSION 1
// rev
/**
* The SYSDBG_LIVEDUMP_SELECTIVE_CONTROL structure specifies selective dump
* options for live kernel dump generation.
*/
typedef struct _SYSDBG_LIVEDUMP_SELECTIVE_CONTROL
{
ULONG Version;
ULONG Size;
union
{
ULONGLONG Flags;
struct
{
ULONGLONG ThreadKernelStacks : 1;
ULONGLONG ReservedFlags : 63;
};
};
ULONGLONG Reserved[4];
} SYSDBG_LIVEDUMP_SELECTIVE_CONTROL, *PSYSDBG_LIVEDUMP_SELECTIVE_CONTROL;
#define SYSDBG_LIVEDUMP_CONTROL_VERSION_1 1
#define SYSDBG_LIVEDUMP_CONTROL_VERSION_2 2
#define SYSDBG_LIVEDUMP_CONTROL_VERSION SYSDBG_LIVEDUMP_CONTROL_VERSION_2
/**
* The SYSDBG_LIVEDUMP_CONTROL_V1 structure describes parameters used when
* generating a live kernel dump (version 1).
*/
typedef struct _SYSDBG_LIVEDUMP_CONTROL_V1
{
ULONG Version;
ULONG BugCheckCode;
ULONG_PTR BugCheckParam1;
ULONG_PTR BugCheckParam2;
ULONG_PTR BugCheckParam3;
ULONG_PTR BugCheckParam4;
HANDLE DumpFileHandle;
HANDLE CancelEventHandle;
SYSDBG_LIVEDUMP_CONTROL_FLAGS Flags;
SYSDBG_LIVEDUMP_CONTROL_ADDPAGES AddPagesControl;
} SYSDBG_LIVEDUMP_CONTROL_V1, *PSYSDBG_LIVEDUMP_CONTROL_V1;
/**
* The SYSDBG_LIVEDUMP_CONTROL structure describes parameters used when
* generating a live kernel dump (current version).
*/
typedef struct _SYSDBG_LIVEDUMP_CONTROL
{
ULONG Version;
ULONG BugCheckCode;
ULONG_PTR BugCheckParam1;
ULONG_PTR BugCheckParam2;
ULONG_PTR BugCheckParam3;
ULONG_PTR BugCheckParam4;
HANDLE DumpFileHandle;
HANDLE CancelEventHandle;
SYSDBG_LIVEDUMP_CONTROL_FLAGS Flags;
SYSDBG_LIVEDUMP_CONTROL_ADDPAGES AddPagesControl;
PSYSDBG_LIVEDUMP_SELECTIVE_CONTROL SelectiveControl; // since WIN11
} SYSDBG_LIVEDUMP_CONTROL, *PSYSDBG_LIVEDUMP_CONTROL;
/**
* The SYSDBG_KD_PULL_REMOTE_FILE structure describes a request to retrieve
* a remote file through the kernel debugger transport.
*/
typedef struct _SYSDBG_KD_PULL_REMOTE_FILE
{
UNICODE_STRING ImageFileName;
} SYSDBG_KD_PULL_REMOTE_FILE, *PSYSDBG_KD_PULL_REMOTE_FILE;
/**
* The NtSystemDebugControl routine provides system debugging and diagnostic control of the system.
*
* \param[in] Command The debug control command to execute (of type SYSDBG_COMMAND).
* \param[in] InputBuffer Optional pointer to a buffer containing input data for the command.
* \param[in] InputBufferLength Length, in bytes, of the input buffer.
* \param[out] OutputBuffer Optional pointer to a buffer that receives output data from the command.
* \param[in] OutputBufferLength Length, in bytes, of the output buffer.
* \param[out] ReturnLength Optional pointer to a variable that receives the number of bytes returned in the output buffer.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSystemDebugControl(
_In_ SYSDBG_COMMAND Command,
_Inout_updates_bytes_opt_(InputBufferLength) PVOID InputBuffer,
_In_ ULONG InputBufferLength,
_Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
_In_ ULONG OutputBufferLength,
_Out_opt_ PULONG ReturnLength
);
//
// Hard errors
//
/**
* The HARDERROR_RESPONSE_OPTION enumeration specifies the type of user
* interface prompt that may be displayed when a hard error occurs.
*/
typedef enum _HARDERROR_RESPONSE_OPTION
{
OptionAbortRetryIgnore,
OptionOk,
OptionOkCancel,
OptionRetryCancel,
OptionYesNo,
OptionYesNoCancel,
OptionShutdownSystem,
OptionOkNoWait,
OptionCancelTryContinue
} HARDERROR_RESPONSE_OPTION;
/**
* The HARDERROR_RESPONSE enumeration specifies the response returned by the
* caller or user when handling a hard error condition.
*/
typedef enum _HARDERROR_RESPONSE
{
ResponseReturnToCaller,
ResponseNotHandled,
ResponseAbort,
ResponseCancel,
ResponseIgnore,
ResponseNo,
ResponseOk,
ResponseRetry,
ResponseYes,
ResponseTryAgain,
ResponseContinue
} HARDERROR_RESPONSE;
/**
* HARDERROR_OVERRIDE_ERRORMODE indicates that the system should ignore the
* calling process's error mode when processing a hard error.
*/
#define HARDERROR_OVERRIDE_ERRORMODE 0x10000000
/**
* The NtRaiseHardError routine raises a hard error or serious error dialog box being displayed to the user.
*
* \param[in] ErrorStatus The NTSTATUS code that describes the error condition.
* \param[in] NumberOfParameters The number of parameters in the Parameters array.
* \param[in] UnicodeStringParameterMask A bitmask indicating which entries in the Parameters array are Unicode strings.
* \param[in] Parameters An array of parameters to be used in the error message.
* \param[in] ValidResponseOptions Specifies the valid responses that the user can select in the error dialog.
* \param[out] Response Receives the user's response to the error dialog.
* \return NTSTATUS Successful or errant status.
*/
_Analysis_noreturn_
DECLSPEC_NORETURN
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRaiseHardError(
_In_ NTSTATUS ErrorStatus,
_In_ ULONG NumberOfParameters,
_In_ ULONG UnicodeStringParameterMask,
_In_reads_(NumberOfParameters) PULONG_PTR Parameters,
_In_ ULONG ValidResponseOptions,
_Out_ PULONG Response
);
//
// Kernel-user shared data
//
/**
* The ALTERNATIVE_ARCHITECTURE_TYPE enumeration specifies the hardware
* architecture variant used by the system.
*
* \remarks NEC98x86 represents the NEC PC-98 architecture,
* supported only on very early Windows releases.
*/
typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
{
StandardDesign,
NEC98x86,
EndAlternatives
} ALTERNATIVE_ARCHITECTURE_TYPE;
/**
* PROCESSOR_FEATURE_MAX defines the maximum number of processor feature flags
* that may be reported by the system.
*/
#define PROCESSOR_FEATURE_MAX 64
/**
* MAX_WOW64_SHARED_ENTRIES defines the number of shared entries available to
* the WOW64 (Windows-on-Windows 64-bit) subsystem.
*/
#define MAX_WOW64_SHARED_ENTRIES 16
//
// Define NX support policy values.
//
#define NX_SUPPORT_POLICY_ALWAYSOFF 0
#define NX_SUPPORT_POLICY_ALWAYSON 1
#define NX_SUPPORT_POLICY_OPTIN 2
#define NX_SUPPORT_POLICY_OPTOUT 3
//
// SEH chain validation policies.
//
#define SEH_VALIDATION_POLICY_ON 0
#define SEH_VALIDATION_POLICY_OFF 1
#define SEH_VALIDATION_POLICY_TELEMETRY 2
#define SEH_VALIDATION_POLICY_DEFER 3
//
// Global shared data flags and manipulation macros.
//
#define SHARED_GLOBAL_FLAGS_ERROR_PORT_V 0x0
#define SHARED_GLOBAL_FLAGS_ERROR_PORT \
(1UL << SHARED_GLOBAL_FLAGS_ERROR_PORT_V)
#define SHARED_GLOBAL_FLAGS_ELEVATION_ENABLED_V 0x1
#define SHARED_GLOBAL_FLAGS_ELEVATION_ENABLED \
(1UL << SHARED_GLOBAL_FLAGS_ELEVATION_ENABLED_V)
#define SHARED_GLOBAL_FLAGS_VIRT_ENABLED_V 0x2
#define SHARED_GLOBAL_FLAGS_VIRT_ENABLED \
(1UL << SHARED_GLOBAL_FLAGS_VIRT_ENABLED_V)
#define SHARED_GLOBAL_FLAGS_INSTALLER_DETECT_ENABLED_V 0x3
#define SHARED_GLOBAL_FLAGS_INSTALLER_DETECT_ENABLED \
(1UL << SHARED_GLOBAL_FLAGS_INSTALLER_DETECT_ENABLED_V)
#define SHARED_GLOBAL_FLAGS_LKG_ENABLED_V 0x4
#define SHARED_GLOBAL_FLAGS_LKG_ENABLED \
(1UL << SHARED_GLOBAL_FLAGS_LKG_ENABLED_V)
#define SHARED_GLOBAL_FLAGS_DYNAMIC_PROC_ENABLED_V 0x5
#define SHARED_GLOBAL_FLAGS_DYNAMIC_PROC_ENABLED \
(1UL << SHARED_GLOBAL_FLAGS_DYNAMIC_PROC_ENABLED_V)
#define SHARED_GLOBAL_FLAGS_CONSOLE_BROKER_ENABLED_V 0x6
#define SHARED_GLOBAL_FLAGS_CONSOLE_BROKER_ENABLED \
(1UL << SHARED_GLOBAL_FLAGS_CONSOLE_BROKER_ENABLED_V)
#define SHARED_GLOBAL_FLAGS_SECURE_BOOT_ENABLED_V 0x7
#define SHARED_GLOBAL_FLAGS_SECURE_BOOT_ENABLED \
(1UL << SHARED_GLOBAL_FLAGS_SECURE_BOOT_ENABLED_V)
#define SHARED_GLOBAL_FLAGS_MULTI_SESSION_SKU_V 0x8
#define SHARED_GLOBAL_FLAGS_MULTI_SESSION_SKU \
(1UL << SHARED_GLOBAL_FLAGS_MULTI_SESSION_SKU_V)
#define SHARED_GLOBAL_FLAGS_MULTIUSERS_IN_SESSION_SKU_V 0x9
#define SHARED_GLOBAL_FLAGS_MULTIUSERS_IN_SESSION_SKU \
(1UL << SHARED_GLOBAL_FLAGS_MULTIUSERS_IN_SESSION_SKU_V)
#define SHARED_GLOBAL_FLAGS_STATE_SEPARATION_ENABLED_V 0xA
#define SHARED_GLOBAL_FLAGS_STATE_SEPARATION_ENABLED \
(1UL << SHARED_GLOBAL_FLAGS_STATE_SEPARATION_ENABLED_V)
#define SHARED_GLOBAL_FLAGS_SET_GLOBAL_DATA_FLAG 0x40000000
#define SHARED_GLOBAL_FLAGS_CLEAR_GLOBAL_DATA_FLAG 0x80000000
//
// Define legal values for the SystemCall member.
//
#define SYSTEM_CALL_SYSCALL 0
#define SYSTEM_CALL_INT_2E 1
//
// Define flags for QPC bypass information. None of these flags may be set
// unless bypass is enabled. This is for compat with existing code which
// compares this value to zero to detect bypass enablement.
//
#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_ENABLED (0x01)
#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_USE_HV_PAGE (0x02)
#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_DISABLE_32BIT (0x04)
#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_USE_MFENCE (0x10)
#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_USE_LFENCE (0x20)
#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_A73_ERRATA (0x40)
#define SHARED_GLOBAL_FLAGS_QPC_BYPASS_USE_RDTSCP (0x80)
/**
* The KUSER_SHARED_DATA structure contains information shared with user-mode.
*
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-kuser_shared_data
*/
typedef struct _KUSER_SHARED_DATA
{
//
// Current low 32-bit of tick count and tick count multiplier.
//
// N.B. The tick count is updated each time the clock ticks.
//
ULONG TickCountLowDeprecated;
ULONG TickCountMultiplier;
//
// Current 64-bit interrupt time in 100ns units.
//
volatile KSYSTEM_TIME InterruptTime;
//
// Current 64-bit system time in 100ns units.
//
volatile KSYSTEM_TIME SystemTime;
//
// Current 64-bit time zone bias.
//
volatile KSYSTEM_TIME TimeZoneBias;
//
// Support image magic number range for the host system.
//
// N.B. This is an inclusive range.
//
USHORT ImageNumberLow;
USHORT ImageNumberHigh;
//
// Copy of system root in unicode.
//
// N.B. This field must be accessed via the RtlGetNtSystemRoot API for
// an accurate result.
//
WCHAR NtSystemRoot[260];
//
// Maximum stack trace depth if tracing enabled.
//
ULONG MaxStackTraceDepth;
//
// Crypto exponent value.
//
ULONG CryptoExponent;
//
// Time zone ID.
//
ULONG TimeZoneId;
//
// Minimum size of a large page on the system, in bytes.
//
// N.B. Returned by GetLargePageMinimum() function.
//
ULONG LargePageMinimum;
//
// This value controls the Application Impact Telemetry (AIT) Sampling rate.
//
// This value determines how frequently the system records AIT events,
// which are used by the Application Experience and compatibility
// subsystems to evaluate application behavior, performance, and
// potential compatibility issues.
//
// Lower values increase sampling frequency, while higher values reduce it.
// The kernel updates this field as part of its internal telemetry and
// heuristics logic.
//
ULONG AitSamplingValue;
//
// This value controls Application Compatibility (AppCompat) switchback processing.
//
union
{
ULONG AppCompatFlag;
struct
{
ULONG SwitchbackEnabled : 1; // Basic switchback processing
ULONG ExtendedHeuristics : 1; // Extended switchback heuristics
ULONG TelemetryFallback : 1; // Telemetry-driven fallback
ULONG Reserved : 29;
} AppCompatFlags;
};
//
// Current Kernel Root RNG state seed version
//
ULONGLONG RNGSeedVersion;
//
// This value controls assertion failure handling.
//
// Historically (prior to Windows 10), this value was also used by
// Code Integrity (CI), AppLocker, and related security components to
// determine the minimum validation requirements for executable images,
// drivers, and privileged operations.
//
// In modern Windows versions, this field is used primarily by the kernel's
// diagnostic and validation infrastructure to decide how assertion failures
// should be handled (e.g., logging, debugger break-in, or bugcheck).
ULONG GlobalValidationRunlevel;
//
// Monotonic stamp incremented by the kernel whenever the system's
// time zone bias value changes.
//
// N.B. This field must be accessed via the RtlGetSystemTimeAndBias API for
// an accurate result.
// This value is read before and after accessing the bias fields to determine
// whether the time zone data changed during the read. If the stamp differs,
// the caller must re-read the bias values to ensure consistency.
//
volatile LONG TimeZoneBiasStamp;
//
// The shared collective build number undecorated with C or F.
// GetVersionEx hides the real number
//
ULONG NtBuildNumber;
//
// Product type.
//
// N.B. This field must be accessed via the RtlGetNtProductType API for
// an accurate result.
//
NT_PRODUCT_TYPE NtProductType;
BOOLEAN ProductTypeIsValid;
BOOLEAN Reserved0[1];
//
// Native hardware processor architecture of the running system.
//
// N.B. User-mode components read this field to determine the true system
// architecture, especially in WOW64 scenarios where the process architecture
// differs from the native one.
//
USHORT NativeProcessorArchitecture;
//
// The NT Version.
//
// N. B. Note that each process sees a version from its PEB, but if the
// process is running with an altered view of the system version,
// the following two fields are used to correctly identify the
// version
//
ULONG NtMajorVersion;
ULONG NtMinorVersion;
//
// Processor features.
//
BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
//
// Reserved fields - do not use.
//
ULONG MaximumUserModeAddressDeprecated; // Deprecated, use SystemBasicInformation instead.
ULONG SystemRangeStartDeprecated; // Deprecated, use SystemRangeStartInformation instead.
//
// Time slippage while in debugger.
//
volatile ULONG TimeSlip;
//
// Alternative system architecture, e.g., NEC PC98xx on x86.
//
ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
//
// Boot sequence, incremented for each boot attempt by the OS loader.
//
ULONG BootId;
//
// If the system is an evaluation unit, the following field contains the
// date and time that the evaluation unit expires. A value of 0 indicates
// that there is no expiration. A non-zero value is the UTC absolute time
// that the system expires.
//
LARGE_INTEGER SystemExpirationDate;
//
// Suite support.
//
// N.B. This field must be accessed via the RtlGetSuiteMask API for
// an accurate result.
//
ULONG SuiteMask;
//
// TRUE if a kernel debugger is connected/enabled.
//
BOOLEAN KdDebuggerEnabled;
//
// Mitigation policies.
//
union
{
UCHAR MitigationPolicies;
struct
{
UCHAR NXSupportPolicy : 2;
UCHAR SEHValidationPolicy : 2;
UCHAR CurDirDevicesSkippedForDlls : 2;
UCHAR Reserved : 2;
};
};
//
// Measured duration of a single processor yield, in cycles. This is used by
// lock packages to determine how many times to spin waiting for a state
// change before blocking.
//
USHORT CyclesPerYield;
//
// Current console session Id. Always zero on non-TS systems.
//
// N.B. This field must be accessed via the RtlGetActiveConsoleId API for an
// accurate result.
//
volatile ULONG ActiveConsoleId;
//
// Force-dismounts cause handles to become invalid. Rather than always
// probe handles, a serial number of dismounts is maintained that clients
// can use to see if they need to probe handles.
//
volatile ULONG DismountCount;
//
// This field indicates the status of the 64-bit COM+ package on the
// system. It indicates whether the Intermediate Language (IL) COM+
// images need to use the 64-bit COM+ runtime or the 32-bit COM+ runtime.
//
ULONG ComPlusPackage;
//
// Time in tick count for system-wide last user input across all terminal
// sessions. For MP performance, it is not updated all the time (e.g. once
// a minute per session). It is used for idle detection.
//
ULONG LastSystemRITEventTickCount;
//
// Number of physical pages in the system. This can dynamically change as
// physical memory can be added or removed from a running system. This
// cell is too small to hold the non-truncated value on very large memory
// machines so code that needs the full value should access
// FullNumberOfPhysicalPages instead.
//
ULONG NumberOfPhysicalPages;
//
// True if the system was booted in safe boot mode.
//
BOOLEAN SafeBootMode;
//
// Virtualization flags.
//
union
{
UCHAR VirtualizationFlags;
#if defined(_ARM64_)
//
// N.B. Keep this bitfield in sync with the one in arc.w.
//
struct
{
UCHAR ArchStartedInEl2 : 1;
UCHAR QcSlIsSupported : 1;
UCHAR : 6;
};
#endif
};
//
// Reserved (available for reuse).
//
UCHAR Reserved12[2];
//
// This is a packed bitfield that contains various flags concerning
// the system state. They must be manipulated using interlocked
// operations.
//
// N.B. DbgMultiSessionSku must be accessed via the RtlIsMultiSessionSku
// API for an accurate result
//
union
{
ULONG SharedDataFlags;
struct
{
//
// The following bit fields are for the debugger only. Do not use.
// Use the bit definitions instead.
//
ULONG DbgErrorPortPresent : 1;
ULONG DbgElevationEnabled : 1;
ULONG DbgVirtEnabled : 1;
ULONG DbgInstallerDetectEnabled : 1;
ULONG DbgLkgEnabled : 1;
ULONG DbgDynProcessorEnabled : 1;
ULONG DbgConsoleBrokerEnabled : 1;
ULONG DbgSecureBootEnabled : 1;
ULONG DbgMultiSessionSku : 1;
ULONG DbgMultiUsersInSessionSku : 1;
ULONG DbgStateSeparationEnabled : 1;
ULONG DbgSplitTokenEnabled : 1;
ULONG DbgShadowAdminEnabled : 1;
ULONG SpareBits : 19;
} DUMMYSTRUCTNAME2;
} DUMMYUNIONNAME2;
//
// Reserved padding field to preserve structure alignment and compatibility.
//
ULONG DataFlagsPad[1];
//
// Depending on the processor, the code for fast system call will differ,
// Stub code is provided pointers below to access the appropriate code.
//
// N.B. The following field is only used on 32-bit systems.
//
ULONGLONG TestRetInstruction;
//
// Query-performance counter (QPC) frequency, in counts per second.
//
// N.B. This value represents the fixed frequency of the system's high-resolution
// performance counter. It is used by user-mode time routines to convert QPC
// ticks into elapsed time without requiring a system call. The frequency is
// constant for the lifetime of the system and reflects the hardware or
// virtualized timer source selected by the kernel.
//
LONGLONG QpcFrequency;
//
// On AMD64, this value is initialized to a nonzero value if the system
// operates with an altered view of the system service call mechanism.
//
ULONG SystemCall;
//
// Reserved field - do not use. Used to be UserCetAvailableEnvironments.
//
ULONG Reserved2;
//
// Full 64 bit version of the number of physical pages in the system.
// This can dynamically change as physical memory can be added or removed
// from a running system.
//
ULONGLONG FullNumberOfPhysicalPages;
//
// Reserved, available for reuse.
//
ULONGLONG SystemCallPad[1];
//
// The 64-bit tick count.
//
union
{
volatile KSYSTEM_TIME TickCount;
volatile ULONG64 TickCountQuad;
struct
{
ULONG ReservedTickCountOverlay[3];
ULONG TickCountPad[1];
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME3;
//
// Cookie for encoding pointers system wide.
//
ULONG Cookie;
ULONG CookiePad[1];
//
// Client id of the process having the focus in the current
// active console session id.
//
// N.B. This field must be accessed via the
// RtlGetConsoleSessionForegroundProcessId API for an accurate result.
//
LONGLONG ConsoleSessionForegroundProcessId;
//
// N.B. The following data is used to implement the precise time
// services. It is aligned on a 64-byte cache-line boundary and
// arranged in the order of typical accesses.
//
// Placeholder for the (internal) time update lock.
//
ULONGLONG TimeUpdateLock;
//
// The performance counter value used to establish the current system time.
//
ULONGLONG BaselineSystemTimeQpc;
//
// The performance counter value used to compute the last interrupt time.
//
ULONGLONG BaselineInterruptTimeQpc;
//
// The scaled number of system time seconds represented by a single
// performance count (this value may vary to achieve time synchronization).
//
ULONGLONG QpcSystemTimeIncrement;
//
// The scaled number of interrupt time seconds represented by a single
// performance count (this value is constant after the system is booted).
//
ULONGLONG QpcInterruptTimeIncrement;
//
// The scaling shift count applied to the performance counter system time
// increment.
//
UCHAR QpcSystemTimeIncrementShift;
//
// The scaling shift count applied to the performance counter interrupt time
// increment.
//
UCHAR QpcInterruptTimeIncrementShift;
//
// The count of unparked processors.
//
USHORT UnparkedProcessorCount;
//
// A bitmask of enclave features supported on this system.
//
// N.B. This field must be accessed via the RtlIsEnclaveFeaturePresent API for an
// accurate result.
//
ULONG EnclaveFeatureMask[4];
//
// Current coverage round for telemetry based coverage.
//
ULONG TelemetryCoverageRound;
//
// The following field is used for ETW user mode global logging
// (UMGL).
//
USHORT UserModeGlobalLogger[16];
//
// Settings that can enable the use of Image File Execution Options
// from HKCU in addition to the original HKLM.
//
ULONG ImageFileExecutionOptions;
//
// Generation of the kernel structure holding system language information
//
ULONG LangGenerationCount;
//
// Reserved (available for reuse).
//
ULONGLONG Reserved4;
//
// Current 64-bit interrupt time bias in 100ns units.
//
volatile ULONGLONG InterruptTimeBias;
//
// Current 64-bit performance counter bias, in performance counter units
// before the shift is applied.
//
volatile ULONGLONG QpcBias;
//
// Number of active logical processors.
//
ULONG ActiveProcessorCount;
//
// Number of active processor groups.
//
// N.B. This value is volatile because group membership and processor
// availability may change dynamically due to hot-add, hot-remove,
// or power management events.
//
volatile UCHAR ActiveGroupCount;
//
// Reserved (available for re-use).
//
UCHAR Reserved9;
union
{
USHORT QpcData;
struct
{
//
// A bitfield indicating whether performance counter queries can
// read the counter directly (bypassing the system call) and flags.
//
union
{
volatile UCHAR QpcBypassEnabled;
struct
{
//
// QPC may bypass the syscall and use a fast user-mode path.
//
volatile UCHAR BypassAllowed : 1;
//
// Hypervisor-assisted QPC conversion.
//
volatile UCHAR HypervisorAssist : 1;
//
// Reserved/unused
//
volatile UCHAR Reserved_2_3 : 2;
//
// MFENCE before RDTSC in relevant paths.
//
volatile UCHAR UseMfence : 1;
//
// LFENCE before RDTSC in relevant paths.
//
volatile UCHAR UseLfence : 1;
//
// Reserved/unused
//
volatile UCHAR Reserved_6 : 1;
//
// RDTSCP instead of RDTSC in the fast path.
//
volatile UCHAR UseRdtscp : 1;
};
};
//
// Reserved, leave as zero for backward compatibility. Was shift
// applied to the raw counter value to derive QPC count.
//
UCHAR QpcReserved;
};
};
//
// Reserved for future use.
//
LARGE_INTEGER TimeZoneBiasEffectiveStart;
LARGE_INTEGER TimeZoneBiasEffectiveEnd;
//
// Extended processor state configuration (AMD64 and x86).
//
XSTATE_CONFIGURATION XState;
//
// RtlQueryFeatureConfigurationChangeStamp
//
KSYSTEM_TIME FeatureConfigurationChangeStamp;
//
// Spare (available for re-use).
//
ULONG Spare;
//
// This field holds a mask that is used in the process of authenticating pointers in user mode.
// It helps in determining which bits of the pointer are used for authentication in user mode.
//
ULONG64 UserPointerAuthMask;
//
// Extended processor state configuration (ARM64). The reserved space for
// other architectures is not available for reuse.
//
#if defined(_ARM64_)
XSTATE_CONFIGURATION XStateArm64;
#else
ULONG Reserved10[210];
#endif
} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountLowDeprecated) == 0x000, "KUSER_SHARED_DATA.TickCountLowDeprecated offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountMultiplier) == 0x004, "KUSER_SHARED_DATA.TickCountMultiplier offset is incorrect");
static_assert(__alignof(KSYSTEM_TIME) == 0X004, "KSYSTEM_TIME alignment is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTime) == 0x008, "KUSER_SHARED_DATA.InterruptTime offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SystemTime) == 0x014, "KUSER_SHARED_DATA.SystemTime offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBias) == 0x020, "KUSER_SHARED_DATA.TimeZoneBias offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ImageNumberLow) == 0x02c, "KUSER_SHARED_DATA.ImageNumberLow offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ImageNumberHigh) == 0x02e, "KUSER_SHARED_DATA.ImageNumberHigh offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NtSystemRoot) == 0x030, "KUSER_SHARED_DATA.NtSystemRoot offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, MaxStackTraceDepth) == 0x238, "KUSER_SHARED_DATA.MaxStackTraceDepth offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, CryptoExponent) == 0x23c, "KUSER_SHARED_DATA.CryptoExponent offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneId) == 0x240, "KUSER_SHARED_DATA.TimeZoneId offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, LargePageMinimum) == 0x244, "KUSER_SHARED_DATA.LargePageMinimum offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, AitSamplingValue) == 0x248, "KUSER_SHARED_DATA.AitSamplingValue offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, AppCompatFlag) == 0x24c, "KUSER_SHARED_DATA.AppCompatFlag offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, RNGSeedVersion) == 0x250, "KUSER_SHARED_DATA.RNGSeedVersion offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, GlobalValidationRunlevel) == 0x258, "KUSER_SHARED_DATA.GlobalValidationRunlevel offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBiasStamp) == 0x25c, "KUSER_SHARED_DATA.TimeZoneBiasStamp offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NtBuildNumber) == 0x260, "KUSER_SHARED_DATA.NtBuildNumber offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NtProductType) == 0x264, "KUSER_SHARED_DATA.NtProductType offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ProductTypeIsValid) == 0x268, "KUSER_SHARED_DATA.ProductTypeIsValid offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NativeProcessorArchitecture) == 0x26a, "KUSER_SHARED_DATA.NativeProcessorArchitecture offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NtMajorVersion) == 0x26c, "KUSER_SHARED_DATA.NtMajorVersion offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NtMinorVersion) == 0x270, "KUSER_SHARED_DATA.NtMinorVersion offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ProcessorFeatures) == 0x274, "KUSER_SHARED_DATA.ProcessorFeatures offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, MaximumUserModeAddressDeprecated) == 0x2b4, "KUSER_SHARED_DATA.MaximumUserModeAddressDeprecated offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SystemRangeStartDeprecated) == 0x2b8, "KUSER_SHARED_DATA.SystemRangeStartDeprecated offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TimeSlip) == 0x2bc, "KUSER_SHARED_DATA.TimeSlip offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, AlternativeArchitecture) == 0x2c0, "KUSER_SHARED_DATA.AlternativeArchitecture offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SystemExpirationDate) == 0x2c8, "KUSER_SHARED_DATA.SystemExpirationDate offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SuiteMask) == 0x2d0, "KUSER_SHARED_DATA.SuiteMask offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, KdDebuggerEnabled) == 0x2d4, "KUSER_SHARED_DATA.KdDebuggerEnabled offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, MitigationPolicies) == 0x2d5, "KUSER_SHARED_DATA.MitigationPolicies offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, CyclesPerYield) == 0x2d6, "KUSER_SHARED_DATA.CyclesPerYield offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveConsoleId) == 0x2d8, "KUSER_SHARED_DATA.ActiveConsoleId offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, DismountCount) == 0x2dc, "KUSER_SHARED_DATA.DismountCount offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ComPlusPackage) == 0x2e0, "KUSER_SHARED_DATA.ComPlusPackage offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, LastSystemRITEventTickCount) == 0x2e4, "KUSER_SHARED_DATA.LastSystemRITEventTickCount offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NumberOfPhysicalPages) == 0x2e8, "KUSER_SHARED_DATA.NumberOfPhysicalPages offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SafeBootMode) == 0x2ec, "KUSER_SHARED_DATA.SafeBootMode offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, VirtualizationFlags) == 0x2ed, "KUSER_SHARED_DATA.VirtualizationFlags offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved12) == 0x2ee, "KUSER_SHARED_DATA.Reserved12 offset is incorrect");
#if defined(_MSC_EXTENSIONS)
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SharedDataFlags) == 0x2f0, "KUSER_SHARED_DATA.SharedDataFlags offset is incorrect");
#endif
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TestRetInstruction) == 0x2f8, "KUSER_SHARED_DATA.TestRetInstruction offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, QpcFrequency) == 0x300, "KUSER_SHARED_DATA.QpcFrequency offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SystemCall) == 0x308, "KUSER_SHARED_DATA.SystemCall offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved2) == 0x30c, "KUSER_SHARED_DATA.Reserved2 offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SystemCallPad) == 0x318, "KUSER_SHARED_DATA.SystemCallPad offset is incorrect (previously 0x310)");
#if defined(_MSC_EXTENSIONS)
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TickCount) == 0x320, "KUSER_SHARED_DATA.TickCount offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountQuad) == 0x320, "KUSER_SHARED_DATA.TickCountQuad offset is incorrect");
#endif
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, Cookie) == 0x330, "KUSER_SHARED_DATA.Cookie offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ConsoleSessionForegroundProcessId) == 0x338, "KUSER_SHARED_DATA.ConsoleSessionForegroundProcessId offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TimeUpdateLock) == 0x340, "KUSER_SHARED_DATA.TimeUpdateLock offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, BaselineSystemTimeQpc) == 0x348, "KUSER_SHARED_DATA.BaselineSystemTimeQpc offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, BaselineInterruptTimeQpc) == 0x350, "KUSER_SHARED_DATA.BaselineInterruptTimeQpc offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, QpcSystemTimeIncrement) == 0x358, "KUSER_SHARED_DATA.QpcSystemTimeIncrement offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, QpcInterruptTimeIncrement) == 0x360, "KUSER_SHARED_DATA.QpcInterruptTimeIncrement offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, QpcSystemTimeIncrementShift) == 0x368, "KUSER_SHARED_DATA.QpcSystemTimeIncrementShift offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, QpcInterruptTimeIncrementShift) == 0x369, "KUSER_SHARED_DATA.QpcInterruptTimeIncrementShift offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, UnparkedProcessorCount) == 0x36a, "KUSER_SHARED_DATA.UnparkedProcessorCount offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, EnclaveFeatureMask) == 0x36c, "KUSER_SHARED_DATA.EnclaveFeatureMask offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TelemetryCoverageRound) == 0x37c, "KUSER_SHARED_DATA.TelemetryCoverageRound offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, UserModeGlobalLogger) == 0x380, "KUSER_SHARED_DATA.UserModeGlobalLogger offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ImageFileExecutionOptions) == 0x3a0, "KUSER_SHARED_DATA.ImageFileExecutionOptions offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, LangGenerationCount) == 0x3a4, "KUSER_SHARED_DATA.LangGenerationCount offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved4) == 0x3a8, "KUSER_SHARED_DATA.Reserved4 offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTimeBias) == 0x3b0, "KUSER_SHARED_DATA.InterruptTimeBias offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, QpcBias) == 0x3b8, "KUSER_SHARED_DATA.QpcBias offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveProcessorCount) == 0x3c0, "KUSER_SHARED_DATA.ActiveProcessorCount offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveGroupCount) == 0x3c4, "KUSER_SHARED_DATA.ActiveGroupCount offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved9) == 0x3c5, "KUSER_SHARED_DATA.Reserved9 offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, QpcData) == 0x3c6, "KUSER_SHARED_DATA.QpcData offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, QpcBypassEnabled) == 0x3c6, "KUSER_SHARED_DATA.QpcBypassEnabled offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, QpcReserved) == 0x3c7, "KUSER_SHARED_DATA.QpcReserved offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBiasEffectiveStart) == 0x3c8, "KUSER_SHARED_DATA.TimeZoneBiasEffectiveStart offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBiasEffectiveEnd) == 0x3d0, "KUSER_SHARED_DATA.TimeZoneBiasEffectiveEnd offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, XState) == 0x3d8, "KUSER_SHARED_DATA.XState offset is incorrect");
#if !defined(NTDDI_WIN10_FE) || (NTDDI_VERSION < NTDDI_WIN10_FE)
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, FeatureConfigurationChangeStamp) == 0x710, "KUSER_SHARED_DATA.FeatureConfigurationChangeStamp offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, UserPointerAuthMask) == 0x720, "KUSER_SHARED_DATA.UserPointerAuthMask offset is incorrect");
#if defined(_ARM64_)
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, XStateArm64) == 0x728, "KUSER_SHARED_DATA.XStateArm64 offset is incorrect");
#else
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved10) == 0x728, "KUSER_SHARED_DATA.Reserved10 offset is incorrect");
#endif
#if !defined(WINDOWS_IGNORE_PACKING_MISMATCH)
static_assert(sizeof(KUSER_SHARED_DATA) == 0xa70, "KUSER_SHARED_DATA size is incorrect (expected 0xa70)");
#endif
#else
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, FeatureConfigurationChangeStamp) == 0x720, "KUSER_SHARED_DATA.FeatureConfigurationChangeStamp offset is incorrect");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, UserPointerAuthMask) == 0x730, "KUSER_SHARED_DATA.UserPointerAuthMask offset is incorrect");
#if defined(_ARM64_)
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, XStateArm64) == 0x738, "KUSER_SHARED_DATA.XStateArm64 offset is incorrect");
#else
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved10) == 0x738, "KUSER_SHARED_DATA.Reserved10 offset is incorrect");
#endif
#if !defined(WINDOWS_IGNORE_PACKING_MISMATCH)
static_assert(sizeof(KUSER_SHARED_DATA) == 0xa80, "KUSER_SHARED_DATA size is incorrect (expected 0xa80)");
#endif
#endif
/**
* USER_SHARED_DATA pointer to the Windows KUSER_SHARED_DATA structure at its fixed
* user-mode mapping address (0x7FFE0000).
*
* The Windows kernel exposes a read-only data structure, mapped into every user-mode
* process at the fixed virtual address `0x7FFE0000`. This region contains frequently
* accessed system information and avoids the overhead of system calls for data that
* the kernel updates frequently. The mapping is always present and identical across
* all user processes, it provides a fast and efficient way to retrieve system state.
*/
#define USER_SHARED_DATA ((KUSER_SHARED_DATA * const)0x7ffe0000)
/**
* The NtGetTickCount64 routine retrieves the number of milliseconds that have elapsed since the system was started.
*
* \return ULONGLONG The return value is the number of milliseconds that have elapsed since the system was started.
* \remarks The resolution of the NtGetTickCount64 function is limited to the resolution of the system timer,
* which is typically in the range of 10 milliseconds to 16 milliseconds. The resolution of the NtGetTickCount64
* function is not affected by adjustments made by the GetSystemTimeAdjustment function.
* \see https://learn.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-gettickcount64
*/
FORCEINLINE
ULONGLONG
NtGetTickCount64(
VOID
)
{
ULARGE_INTEGER tickCount;
#ifdef _WIN64
tickCount.QuadPart = USER_SHARED_DATA->TickCountQuad;
#else
while (TRUE)
{
tickCount.HighPart = (ULONG)USER_SHARED_DATA->TickCount.High1Time;
tickCount.LowPart = USER_SHARED_DATA->TickCount.LowPart;
if (tickCount.HighPart == (ULONG)USER_SHARED_DATA->TickCount.High2Time)
break;
YieldProcessor();
}
#endif
return (UInt32x32To64(tickCount.LowPart, USER_SHARED_DATA->TickCountMultiplier) >> 24) +
(UInt32x32To64(tickCount.HighPart, USER_SHARED_DATA->TickCountMultiplier) << 8);
}
/**
* The NtGetTickCount routine retrieves the number of milliseconds that have elapsed since the system was started, up to 49.7 days.
*
* \return ULONG The return value is the number of milliseconds that have elapsed since the system was started.
* \remarks The elapsed time is stored as a ULONG value. Therefore, the time will wrap around to zero if the system
* is run continuously for 49.7 days. To avoid this problem, use the NtGetTickCount64 function. Otherwise, check
* for an overflow condition when comparing times. The resolution of the NtGetTickCount function is limited to
* the resolution of the system timer, which is typically in the range of 10 milliseconds to 16 milliseconds.
* The resolution of the NtGetTickCount function is not affected by adjustments made by the GetSystemTimeAdjustment function.
* \see https://learn.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-gettickcount
*/
FORCEINLINE
ULONG
NtGetTickCount(
VOID
)
{
#ifdef _WIN64
return (ULONG)((USER_SHARED_DATA->TickCountQuad * USER_SHARED_DATA->TickCountMultiplier) >> 24);
#else
ULARGE_INTEGER tickCount;
while (TRUE)
{
tickCount.HighPart = (ULONG)USER_SHARED_DATA->TickCount.High1Time;
tickCount.LowPart = USER_SHARED_DATA->TickCount.LowPart;
if (tickCount.HighPart == (ULONG)USER_SHARED_DATA->TickCount.High2Time)
break;
YieldProcessor();
}
return (ULONG)((UInt32x32To64(tickCount.LowPart, USER_SHARED_DATA->TickCountMultiplier) >> 24) +
UInt32x32To64((tickCount.HighPart << 8) & 0xffffffff, USER_SHARED_DATA->TickCountMultiplier));
#endif
}
//
// Locale
//
/**
* The NtQueryDefaultLocale routine retrieves the default locale identifier for either the user profile or the system.
*
* \param UserProfile If TRUE, retrieves the user default locale; otherwise, retrieves the system default locale.
* \param DefaultLocaleId A pointer that receives the resulting locale identifier (LCID).
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows/win32/api/winnls/nf-winnls-getsystemdefaultlocale
* \sa https://learn.microsoft.com/en-us/windows/win32/api/winnls/nf-winnls-getuserdefaultlocale
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryDefaultLocale(
_In_ BOOLEAN UserProfile,
_Out_ PLCID DefaultLocaleId
);
/**
* The NtSetDefaultLocale routine sets the default locale identifier for either
* the user profile or the system.
*
* \param UserProfile If TRUE, sets the user default locale; otherwise, sets the system default locale.
* \param DefaultLocaleId The locale identifier (LCID) to set.
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows/win32/api/winnls/nf-winnls-setthreadlocale
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetDefaultLocale(
_In_ BOOLEAN UserProfile,
_In_ LCID DefaultLocaleId
);
/**
* The NtQueryInstallUILanguage routine retrieves the system's installed UI language identifier.
*
* \param InstallUILanguageId A pointer that receives the installed UI language identifier (LANGID).
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows/win32/api/winnls/nf-winnls-getsystemdefaultuilanguage
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInstallUILanguage(
_Out_ LANGID *InstallUILanguageId
);
/**
* The NtFlushInstallUILanguage routine updates the system's installed UI
* language and optionally commits the change.
*
* \param InstallUILanguage The UI language identifier (LANGID) to set.
* \param SetComittedFlag If nonzero, commits the language change.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtFlushInstallUILanguage(
_In_ LANGID InstallUILanguage,
_In_ ULONG SetComittedFlag
);
/**
* The NtQueryDefaultUILanguage routine retrieves the system's default UI language identifier.
*
* \param DefaultUILanguageId A pointer that receives the default UI language identifier (LANGID).
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows/win32/api/winnls/nf-winnls-getsystemdefaultuilanguage
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryDefaultUILanguage(
_Out_ LANGID *DefaultUILanguageId
);
/**
* The NtSetDefaultUILanguage routine sets the system's default UI language identifier.
*
* \param DefaultUILanguageId The UI language identifier (LANGID) to set.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetDefaultUILanguage(
_In_ LANGID DefaultUILanguageId
);
/**
* The NtIsUILanguageComitted routine determines whether the system UI language has been committed.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtIsUILanguageComitted(
VOID
);
//
// NLS
//
// begin_private
NTSYSCALLAPI
NTSTATUS
NTAPI
NtInitializeNlsFiles(
_Out_ PVOID *BaseAddress,
_Out_ PLCID DefaultLocaleId,
_Out_ PLARGE_INTEGER DefaultCasingTableSize,
_Out_opt_ PULONG CurrentNLSVersion
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtGetNlsSectionPtr(
_In_ ULONG SectionType,
_In_ ULONG SectionData,
_In_ PVOID ContextData,
_Out_ PVOID *SectionPointer,
_Out_ PULONG SectionSize
);
#if (PHNT_VERSION < PHNT_WINDOWS_7)
/**
* The NtAcquireCMFViewOwnership routine acquires ownership of the Code Map
* File (CMF) view and optionally replaces an existing ownership token.
*
* \param TimeStamp A pointer that receives the timestamp associated with the
* CMF view ownership.
* \param tokenTaken A pointer that receives TRUE if the caller successfully
* acquired the ownership token, or FALSE if another owner already held it.
* \param replaceExisting If TRUE, replaces any existing ownership token.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAcquireCMFViewOwnership(
_Out_ PULONGLONG TimeStamp,
_Out_ PBOOLEAN tokenTaken,
_In_ BOOLEAN replaceExisting
);
/**
* The NtReleaseCMFViewOwnership routine releases ownership of the Code Map
* File (CMF) view previously acquired by NtAcquireCMFViewOwnership.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReleaseCMFViewOwnership(
VOID
);
#endif // PHNT_VERSION < PHNT_WINDOWS_7
/**
* The `What` flags for NtMapCMFModule.
* The `What` parameter is a bitfield controlling:
* - Which CMF section to map
* - Access rights for CMFCheckAccess()
* - Whether to update CMF global flags
* - Page protection mode
* - CMF cache mode bits (propagate into CMFFlagsCache)
*
* These determine what access rights are checked and influence whether the mapping is allowed.
*/
#define CMF_ACCESS_DIRECTORY 0x00000002 // Access check for directory section.
#define CMF_ACCESS_SEGMENT 0x00000004 // Access check for segment section.
#define CMF_ACCESS_HITS 0x00000008 // Access check for hits section.
/**
* The `What` flags for NtMapCMFModule.
* These determine which CMF section is mapped and directly control the BaseAddress and ViewSizeOut outputs.
*/
#define CMF_OP_DIRECTORY 0x00000010 // Map directory section (Index ignored) // Affects: BaseAddress, ViewSizeOut
#define CMF_OP_SEGMENT 0x00000020 // Map segment section at Index // Affects: BaseAddress, ViewSizeOut
#define CMF_OP_HITS 0x00000100 // Map hits section (Index ignored) // Affects: BaseAddress, ViewSizeOut
/**
* The `What` flags for NtMapCMFModule.
* This affects the protection flags passed to MmMapViewOfSection,
* which ultimately influences the memory protections of the BaseAddress parameter.
*/
#define CMF_PROTECT_SPECIAL 0x00000040 // Changes protection from PAGE_READONLY to PAGE_WRITECOPY
/**
* The `What` flags for NtMapCMFModule.
* When this bit is set, the function does not map anything.
* Instead, it updates CMFFlagsCache and optionally modifies the directory header.
*/
#define CMF_UPDATE_FLAGS 0x00020000 // Enter flag-update mode // CacheFlagsOut parameter
/**
* The `What` flags for NtMapCMFModule.
* These bits are extracted from What and written into CMFFlagsCache.
* They determine global CMF behavior, including which modules are valid.
*/
#define CMF_FLAG_A 0x00040000 // May trigger directory header update
#define CMF_FLAG_B 0x00080000 // Enables directory update path
#define CMF_FLAG_C 0x00100000 // Enables segment unmap path
/**
* Flags for NtMapCMFModule.
* These bits strip all bits outside this mask:
*/
#define CMF_ALLOWED_MASK 0xFFFFFECF // All valid bits for What
/**
* Flags for NtMapCMFModule.
*/
typedef enum _CMF_WHAT_FLAGS
{
// ---- Access rights (used by CMFCheckAccess) ----
CmfAccessDirectory = 0x00000002, // Access check for directory
CmfAccessSegment = 0x00000004, // Access check for segment[Index]
CmfAccessHits = 0x00000008, // Access check for hits
// ---- Operation selection (controls BaseAddress + ViewSizeOut) ----
CmfDirectoryOp = 0x00000010, // Map directory section
CmfSegmentOp = 0x00000020, // Map segment section at Index
CmfHitsOp = 0x00000100, // Map hits section
// ---- Memory protection modifier ----
CmfSpecialProtect = 0x00000040, // Changes protection for MmMapViewOfSection
// ---- Flag update mode (affects CacheFlagsOut only) ----
CmfUpdateFlags = 0x00020000, // Update CMFFlagsCache instead of mapping
// ---- CMF cache mode bits (propagate into CMFFlagsCache) ----
CmfFlagA = 0x00040000, // May trigger directory header update
CmfFlagB = 0x00080000, // Enables directory update path
CmfFlagC = 0x00100000, // Enables segment unmap path
} CMF_WHAT_FLAGS;
DEFINE_ENUM_FLAG_OPERATORS(CMF_WHAT_FLAGS);
/**
* The NtMapCMFModule routine maps a Code Map File (CMF) module into memory
* and returns information about the cached view.
*
* \param What Specifies the CMF operation to perform.
* \param Index The module index to map. Only valid for CmfSegmentOp operations.
* \param CacheIndexOut Optional pointer that receives the cache index.
* \param CacheFlagsOut Optional pointer that receives cache flags.
* \param ViewSizeOut Optional pointer that receives the size of the mapped view.
* \param BaseAddress Optional pointer that receives the base address of the mapped module.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtMapCMFModule(
_In_ ULONG What,
_In_ ULONG Index,
_Out_opt_ PULONG CacheIndexOut,
_Out_opt_ PULONG CacheFlagsOut,
_Out_opt_ PULONG ViewSizeOut,
_Out_opt_ PVOID *BaseAddress
);
/**
* Flags for NtGetMUIRegistryInfo.
* Only the values below are supported. Any other bit results in STATUS_INVALID_PARAMETER.
*/
typedef enum _MUI_REGISTRY_INFO_FLAGS
{
MUIRegInfoQuery = 0x1, // Query or load the MUI registry info.
MUIRegInfoClear = 0x2, // Clear the cached MUI registry info.
MUIRegInfoCommit = 0x8 // Commit/update state (increments counter).
} MUI_REGISTRY_INFO_FLAGS;
DEFINE_ENUM_FLAG_OPERATORS(MUI_REGISTRY_INFO_FLAGS);
/**
* Flags for NtGetMUIRegistryInfo.
* Only the values below are supported. Any other bit results in STATUS_INVALID_PARAMETER.
*/
#define MUI_REGINFO_QUERY 0x1 // Query or load the MUI registry info.
#define MUI_REGINFO_CLEAR 0x2 // Clear the cached MUI registry info.
#define MUI_REGINFO_COMMIT 0x8 // Commit/update state (increments counter).
/**
* The NtGetMUIRegistryInfo routine retrieves Multilingual User Interface (MUI)
* configuration data from the system registry.
*
* \param Flags Flags that control the type of MUI information returned.
* \param DataSize On input, the size of the buffer pointed to by Data.
* On output, the required or actual size of the data returned.
* \param Data A pointer to the MUI registry information.
* \return NTSTATUS Successful or errant status.
* \remarks This routine is private and subject to change.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtGetMUIRegistryInfo(
_In_ ULONG Flags,
_Inout_ PULONG DataSize,
_Out_ PVOID Data
);
// end_private
//
// Global atoms
//
/**
* The NtAddAtom routine adds a Unicode string to the system atom table and
* returns the corresponding atom identifier.
*
* \param AtomName A pointer to a Unicode string containing the atom name.
* \param Length The length, in bytes, of the string pointed to by AtomName.
* \param Atom An optional pointer that receives the resulting atom identifier.
* \return NTSTATUS Successful or errant status.
* \remarks If the atom already exists, its reference count is incremented and
* the existing atom identifier is returned.
* \see https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-addatomw
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAddAtom(
_In_reads_bytes_opt_(Length) PCWSTR AtomName,
_In_ ULONG Length,
_Out_opt_ PRTL_ATOM Atom
);
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
/**
* ATOM_FLAG_NONE indicates that the atom being created should be placed in
* the session-local atom table rather than the global atom table.
*/
#define ATOM_FLAG_NONE 0x0
/**
* ATOM_FLAG_GLOBAL indicates that the atom being created should be placed in
* the global atom table rather than the session-local table.
* \remarks This flag is only valid starting with Windows 8 and later.
*/
#define ATOM_FLAG_GLOBAL 0x2
// rev
/**
* The NtAddAtomEx routine adds a Unicode string to the system atom table with
* additional creation flags.
*
* \param AtomName A pointer to a Unicode string containing the atom name.
* \param Length The length, in bytes, of the string pointed to by AtomName.
* \param Atom An optional pointer that receives the resulting atom identifier.
* \param Flags A set of flags that control atom creation behavior.
* \return NTSTATUS Successful or errant status.
* \remarks ATOM_FLAG_GLOBAL may be used to create a global atom.
* Only ATOM_FLAG_GLOBAL and ATOM_FLAG_NONE are currently supported.
* Any other flag value results in STATUS_INVALID_PARAMETER.
* \see https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-addatomw
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAddAtomEx(
_In_reads_bytes_opt_(Length) PCWSTR AtomName,
_In_ ULONG Length,
_Out_opt_ PRTL_ATOM Atom,
_In_ ULONG Flags
);
#endif // PHNT_VERSION >= PHNT_WINDOWS_8
/**
* The NtFindAtom routine retrieves the atom identifier associated with a
* Unicode string in the system atom table.
*
* \param AtomName A pointer to a Unicode string containing the atom name.
* \param Length The length, in bytes, of the string pointed to by AtomName.
* \param Atom An optional pointer that receives the atom identifier if found.
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-findatomw
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtFindAtom(
_In_reads_bytes_opt_(Length) PCWSTR AtomName,
_In_ ULONG Length,
_Out_opt_ PRTL_ATOM Atom
);
/**
* The NtDeleteAtom routine decrements the reference count of an atom and
* removes it from the system atom table when the count reaches zero.
*
* \param Atom The atom identifier to delete.
* \return NTSTATUS Successful or errant status.
* \remarks If the atom is still referenced elsewhere, it is not removed until
* its reference count reaches zero.
* \see https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-deleteatom
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteAtom(
_In_ RTL_ATOM Atom
);
/**
* The ATOM_INFORMATION_CLASS enumeration specifies the type of information
* returned when querying atom table data.
*/
typedef enum _ATOM_INFORMATION_CLASS
{
AtomBasicInformation,
AtomTableInformation
} ATOM_INFORMATION_CLASS;
/**
* The ATOM_BASIC_INFORMATION structure contains basic information about an Atom.
*/
typedef struct _ATOM_BASIC_INFORMATION
{
USHORT UsageCount; // The number of times the atom is referenced.
USHORT Flags; // Flags associated with the atom. */
USHORT NameLength; // Length, in bytes, of the atom's name.
_Field_size_bytes_(NameLength) WCHAR Name[1]; // The atom's name (not null-terminated).
} ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION;
/**
* The ATOM_TABLE_INFORMATION structure contains information about all Atoms from the system atom table.
*/
typedef struct _ATOM_TABLE_INFORMATION
{
ULONG NumberOfAtoms; // The number of atoms in the atom table.
_Field_size_(NumberOfAtoms) RTL_ATOM Atoms[1]; // Array of atom identifiers.
} ATOM_TABLE_INFORMATION, *PATOM_TABLE_INFORMATION;
/**
* The NtQueryInformationAtom routine retrieves information about a specified atom in the system atom table.
*
* \param Atom The atom identifier for which information is being queried.
* \param AtomInformationClass Specifies the type of information to retrieve. This is an ATOM_INFORMATION_CLASS value.
* \param AtomInformation A pointer to a buffer that receives the requested information.
* \param AtomInformationLength The size, in bytes, of the AtomInformation buffer.
* \param ReturnLength Optional pointer to a variable that receives the number of bytes written to the AtomInformation buffer.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationAtom(
_In_ RTL_ATOM Atom,
_In_ ATOM_INFORMATION_CLASS AtomInformationClass,
_Out_writes_bytes_(AtomInformationLength) PVOID AtomInformation,
_In_ ULONG AtomInformationLength,
_Out_opt_ PULONG ReturnLength
);
//
// Global flags
//
#define FLG_STOP_ON_EXCEPTION 0x00000001 // uk
#define FLG_SHOW_LDR_SNAPS 0x00000002 // uk
#define FLG_DEBUG_INITIAL_COMMAND 0x00000004 // k
#define FLG_STOP_ON_HUNG_GUI 0x00000008 // k
#define FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010 // u
#define FLG_HEAP_ENABLE_FREE_CHECK 0x00000020 // u
#define FLG_HEAP_VALIDATE_PARAMETERS 0x00000040 // u
#define FLG_HEAP_VALIDATE_ALL 0x00000080 // u
#define FLG_APPLICATION_VERIFIER 0x00000100 // u
#define FLG_MONITOR_SILENT_PROCESS_EXIT 0x00000200 // uk
#define FLG_POOL_ENABLE_TAGGING 0x00000400 // k
#define FLG_HEAP_ENABLE_TAGGING 0x00000800 // u
#define FLG_USER_STACK_TRACE_DB 0x00001000 // u,32
#define FLG_KERNEL_STACK_TRACE_DB 0x00002000 // k,32
#define FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000 // k
#define FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000 // u
#define FLG_DISABLE_STACK_EXTENSION 0x00010000 // u
#define FLG_ENABLE_CSRDEBUG 0x00020000 // k
#define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000 // k
#define FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000 // k
#define FLG_ENABLE_SYSTEM_CRIT_BREAKS 0x00100000 // u
#define FLG_HEAP_DISABLE_COALESCING 0x00200000 // u
#define FLG_ENABLE_CLOSE_EXCEPTIONS 0x00400000 // k
#define FLG_ENABLE_EXCEPTION_LOGGING 0x00800000 // k
#define FLG_ENABLE_HANDLE_TYPE_TAGGING 0x01000000 // k
#define FLG_HEAP_PAGE_ALLOCS 0x02000000 // u
#define FLG_DEBUG_INITIAL_COMMAND_EX 0x04000000 // k
#define FLG_DISABLE_DBGPRINT 0x08000000 // k
#define FLG_CRITSEC_EVENT_CREATION 0x10000000 // u
#define FLG_LDR_TOP_DOWN 0x20000000 // u,64
#define FLG_ENABLE_HANDLE_EXCEPTIONS 0x40000000 // k
#define FLG_DISABLE_PROTDLLS 0x80000000 // u
#define FLG_VALID_BITS 0xfffffdff
#define FLG_USERMODE_VALID_BITS (FLG_STOP_ON_EXCEPTION | \
FLG_SHOW_LDR_SNAPS | \
FLG_HEAP_ENABLE_TAIL_CHECK | \
FLG_HEAP_ENABLE_FREE_CHECK | \
FLG_HEAP_VALIDATE_PARAMETERS | \
FLG_HEAP_VALIDATE_ALL | \
FLG_APPLICATION_VERIFIER | \
FLG_HEAP_ENABLE_TAGGING | \
FLG_USER_STACK_TRACE_DB | \
FLG_HEAP_ENABLE_TAG_BY_DLL | \
FLG_DISABLE_STACK_EXTENSION | \
FLG_ENABLE_SYSTEM_CRIT_BREAKS | \
FLG_HEAP_DISABLE_COALESCING | \
FLG_DISABLE_PROTDLLS | \
FLG_HEAP_PAGE_ALLOCS | \
FLG_CRITSEC_EVENT_CREATION | \
FLG_LDR_TOP_DOWN)
#define FLG_BOOTONLY_VALID_BITS (FLG_KERNEL_STACK_TRACE_DB | \
FLG_MAINTAIN_OBJECT_TYPELIST | \
FLG_ENABLE_CSRDEBUG | \
FLG_DEBUG_INITIAL_COMMAND | \
FLG_DEBUG_INITIAL_COMMAND_EX | \
FLG_DISABLE_PAGE_KERNEL_STACKS)
#define FLG_KERNELMODE_VALID_BITS (FLG_STOP_ON_EXCEPTION | \
FLG_SHOW_LDR_SNAPS | \
FLG_STOP_ON_HUNG_GUI | \
FLG_POOL_ENABLE_TAGGING | \
FLG_ENABLE_KDEBUG_SYMBOL_LOAD | \
FLG_ENABLE_CLOSE_EXCEPTIONS | \
FLG_ENABLE_EXCEPTION_LOGGING | \
FLG_ENABLE_HANDLE_TYPE_TAGGING | \
FLG_DISABLE_DBGPRINT | \
FLG_ENABLE_HANDLE_EXCEPTIONS)
//
// Licensing
//
/**
* The NtQueryLicenseValue routine retrieves a licensing-related value from the
* system licensing database.
*
* \param ValueName A pointer to a UNICODE_STRING structure that contains the name of the license value to query.
* \param Type An optional pointer that receives the type of the returned data.
* \param Data An optional buffer that receives the value data.
* \param DataSize The size, in bytes, of the buffer pointed to by Data.
* \param ResultDataSize A pointer that receives the number of bytes required to store the complete value data.
* \return NTSTATUS Successful or errant status.
* \see https://learn.microsoft.com/en-us/windows/win32/api/slpublic/nf-slpublic-slquerylicensevaluefromapp
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryLicenseValue(
_In_ PCUNICODE_STRING ValueName,
_Out_opt_ PULONG Type,
_Out_writes_bytes_to_opt_(DataSize, *ResultDataSize) PVOID Data,
_In_ ULONG DataSize,
_Out_ PULONG ResultDataSize
);
//
// Misc.
//
/**
* The NtSetDefaultHardErrorPort routine sets the system's default hard error
* port, which is used by the kernel to deliver hard error notifications to a
* user-mode process.
*
* \param DefaultHardErrorPort A handle to a port object that will receive
* hard error messages generated by the system.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetDefaultHardErrorPort(
_In_ HANDLE DefaultHardErrorPort
);
/**
* The SHUTDOWN_ACTION enumeration specifies the type of system shutdown to perform.
*/
typedef enum _SHUTDOWN_ACTION
{
ShutdownNoReboot,
ShutdownReboot,
ShutdownPowerOff,
ShutdownRebootForRecovery // since WIN11
} SHUTDOWN_ACTION;
/**
* The NtShutdownSystem routine initiates a system shutdown using the specified
* shutdown action.
*
* \param Action A SHUTDOWN_ACTION value that specifies whether the system
* should halt, reboot, power off, or reboot for recovery.
* \return NTSTATUS Successful or errant status.
* \remarks The calling process must have the SE_SHUTDOWN_NAME privilege.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtShutdownSystem(
_In_ SHUTDOWN_ACTION Action
);
/**
* The NtDisplayString routine displays a Unicode string on the system display
* during early boot or in environments where a console is not yet available.
*
* \param String A pointer to a UNICODE_STRING structure that contains the text to display.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDisplayString(
_In_ PCUNICODE_STRING String
);
//
// Boot graphics
//
// rev
/**
* The NtDrawText routine displays a Unicode string on the system display during
* early boot or in environments where a standard console is not yet available.
*
* \param Text A pointer to a UNICODE_STRING structure that contains the text to draw on the screen.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDrawText(
_In_ PCUNICODE_STRING Text
);
//
// Hot patching
//
typedef enum _HOT_PATCH_INFORMATION_CLASS
{
ManageHotPatchLoadPatch = 0, // MANAGE_HOT_PATCH_LOAD_PATCH
ManageHotPatchUnloadPatch = 1, // MANAGE_HOT_PATCH_UNLOAD_PATCH
ManageHotPatchQueryPatches = 2, // MANAGE_HOT_PATCH_QUERY_PATCHES
ManageHotPatchLoadPatchForUser = 3, // MANAGE_HOT_PATCH_LOAD_PATCH
ManageHotPatchUnloadPatchForUser = 4, // MANAGE_HOT_PATCH_UNLOAD_PATCH
ManageHotPatchQueryPatchesForUser = 5, // MANAGE_HOT_PATCH_QUERY_PATCHES
ManageHotPatchQueryActivePatches = 6, // MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES
ManageHotPatchApplyImagePatch = 7, // MANAGE_HOT_PATCH_APPLY_IMAGE_PATCH
ManageHotPatchQuerySinglePatch = 8, // MANAGE_HOT_PATCH_QUERY_SINGLE_PATCH
ManageHotPatchCheckEnabled = 9, // MANAGE_HOT_PATCH_CHECK_ENABLED
ManageHotPatchCreatePatchSection = 10, // MANAGE_HOT_PATCH_CREATE_PATCH_SECTION
ManageHotPatchMax
} HOT_PATCH_INFORMATION_CLASS;
/**
* The HOT_PATCH_IMAGE_INFO structure contains identifying information about a hot patch image.
*/
typedef struct _HOT_PATCH_IMAGE_INFO
{
ULONG CheckSum; // The checksum of the hot patch image.
ULONG TimeDateStamp; // The time/date stamp of the hot patch image.
} HOT_PATCH_IMAGE_INFO, *PHOT_PATCH_IMAGE_INFO;
#define MANAGE_HOT_PATCH_LOAD_PATCH_VERSION 1
/**
* The MANAGE_HOT_PATCH_LOAD_PATCH structure describes parameters for loading a hot patch.
*/
typedef struct _MANAGE_HOT_PATCH_LOAD_PATCH
{
ULONG Version; // Structure version. Must be MANAGE_HOT_PATCH_LOAD_PATCH_VERSION.
UNICODE_STRING PatchPath; // The path to the hot patch file.
union
{
SID Sid; // The SID of the user for whom the patch is being loaded.
UCHAR Buffer[SECURITY_MAX_SID_SIZE]; // Buffer for the SID.
} UserSid;
HOT_PATCH_IMAGE_INFO BaseInfo; // Identifying information about the base image to patch.
} MANAGE_HOT_PATCH_LOAD_PATCH, *PMANAGE_HOT_PATCH_LOAD_PATCH;
#define MANAGE_HOT_PATCH_UNLOAD_PATCH_VERSION 1
/**
* The MANAGE_HOT_PATCH_UNLOAD_PATCH structure describes parameters for unloading a hot patch.
*/
typedef struct _MANAGE_HOT_PATCH_UNLOAD_PATCH
{
ULONG Version; // Structure version. Must be MANAGE_HOT_PATCH_UNLOAD_PATCH_VERSION.
HOT_PATCH_IMAGE_INFO BaseInfo; // Identifying information about the base image to unpatch.
union
{
SID Sid; // The SID of the user for whom the patch is being unloaded.
UCHAR Buffer[SECURITY_MAX_SID_SIZE]; // Buffer for the SID.
} UserSid;
} MANAGE_HOT_PATCH_UNLOAD_PATCH, *PMANAGE_HOT_PATCH_UNLOAD_PATCH;
#define MANAGE_HOT_PATCH_QUERY_PATCHES_VERSION 1
/**
* The MANAGE_HOT_PATCH_QUERY_PATCHES structure is used to query information about loaded hot patches.
*/
typedef struct _MANAGE_HOT_PATCH_QUERY_PATCHES
{
ULONG Version; // Structure version. Must be MANAGE_HOT_PATCH_QUERY_PATCHES_VERSION.
union
{
SID Sid; // The SID of the user whose patches are being queried.
UCHAR Buffer[SECURITY_MAX_SID_SIZE]; // Buffer for the SID.
} UserSid;
ULONG PatchCount; // The number of patches found.
PUNICODE_STRING PatchPathStrings; // Pointer to an array of patch path strings.
PHOT_PATCH_IMAGE_INFO BaseInfos; // Pointer to an array of patch image info structures.
} MANAGE_HOT_PATCH_QUERY_PATCHES, *PMANAGE_HOT_PATCH_QUERY_PATCHES;
#define MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES_VERSION 1
/**
* The MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES structure is used to query active hot patches for a process.
*/
typedef struct _MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES
{
ULONG Version; // Structure version. Must be MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES_VERSION.
HANDLE ProcessHandle; // Handle to the process being queried.
ULONG PatchCount; // The number of active patches.
PUNICODE_STRING PatchPathStrings; // Pointer to an array of patch path strings.
PHOT_PATCH_IMAGE_INFO BaseInfos; // Pointer to an array of patch image info structures.
PULONG PatchSequenceNumbers; // Pointer to an array of patch sequence numbers.
} MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES, *PMANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES;
#define MANAGE_HOT_PATCH_APPLY_IMAGE_PATCH_VERSION 1
/**
* The MANAGE_HOT_PATCH_APPLY_IMAGE_PATCH structure describes parameters for applying a hot patch to an image.
*/
typedef struct _MANAGE_HOT_PATCH_APPLY_IMAGE_PATCH
{
ULONG Version; // Structure version. Must be MANAGE_HOT_PATCH_APPLY_IMAGE_PATCH_VERSION.
union
{
ULONG AllFlags; // All flags as a ULONG.
struct
{
ULONG ApplyReversePatches : 1; // If set, apply reverse patches.
ULONG ApplyForwardPatches : 1; // If set, apply forward patches.
ULONG Spare : 29;
};
};
HANDLE ProcessHandle; // Handle to the process to patch.
PVOID BaseImageAddress; // Base address of the image to patch.
PVOID PatchImageAddress; // Address of the patch image.
} MANAGE_HOT_PATCH_APPLY_IMAGE_PATCH, *PMANAGE_HOT_PATCH_APPLY_IMAGE_PATCH;
#define MANAGE_HOT_PATCH_QUERY_SINGLE_PATCH_VERSION 1
/**
* The MANAGE_HOT_PATCH_QUERY_SINGLE_PATCH structure is used to query a single hot patch.
*/
typedef struct _MANAGE_HOT_PATCH_QUERY_SINGLE_PATCH
{
ULONG Version; // Structure version. Must be MANAGE_HOT_PATCH_QUERY_SINGLE_PATCH_VERSION.
HANDLE ProcessHandle; // Handle to the process being queried.
PVOID BaseAddress; // Base address of the image being queried.
ULONG Flags; // Query flags.
UNICODE_STRING PatchPathString; // The path to the patch being queried.
} MANAGE_HOT_PATCH_QUERY_SINGLE_PATCH, *PMANAGE_HOT_PATCH_QUERY_SINGLE_PATCH;
#define MANAGE_HOT_PATCH_CHECK_ENABLED_VERSION 1
/**
* The MANAGE_HOT_PATCH_CHECK_ENABLED structure is used to check if hot patching is enabled.
*/
typedef struct _MANAGE_HOT_PATCH_CHECK_ENABLED
{
ULONG Version; // Structure version. Must be MANAGE_HOT_PATCH_CHECK_ENABLED_VERSION.
ULONG Flags; // Flags for the check operation.
} MANAGE_HOT_PATCH_CHECK_ENABLED, *PMANAGE_HOT_PATCH_CHECK_ENABLED;
#define MANAGE_HOT_PATCH_CREATE_PATCH_SECTION_VERSION 1
/**
* The MANAGE_HOT_PATCH_CREATE_PATCH_SECTION structure describes parameters for creating a hot patch section.
*/
typedef struct _MANAGE_HOT_PATCH_CREATE_PATCH_SECTION
{
ULONG Version; // Structure version. Must be MANAGE_HOT_PATCH_CREATE_PATCH_SECTION_VERSION.
ULONG Flags; // Creation flags.
ACCESS_MASK DesiredAccess; // Desired access mask for the section.
ULONG PageProtection; // Page protection flags.
ULONG AllocationAttributes; // Allocation attributes.
PVOID BaseImageAddress; // Base address of the image for the patch section.
HANDLE SectionHandle; // Handle to the created section.
} MANAGE_HOT_PATCH_CREATE_PATCH_SECTION, *PMANAGE_HOT_PATCH_CREATE_PATCH_SECTION;
#if defined(_WIN64)
static_assert(sizeof(MANAGE_HOT_PATCH_LOAD_PATCH) == 0x68, "Size of MANAGE_HOT_PATCH_LOAD_PATCH is incorrect");
static_assert(sizeof(MANAGE_HOT_PATCH_UNLOAD_PATCH) == 0x50, "Size of MANAGE_HOT_PATCH_UNLOAD_PATCH is incorrect");
static_assert(sizeof(MANAGE_HOT_PATCH_QUERY_PATCHES) == 0x60, "Size of MANAGE_HOT_PATCH_QUERY_PATCHES is incorrect");
static_assert(sizeof(MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES) == 0x30, "Size of MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES is incorrect");
static_assert(sizeof(MANAGE_HOT_PATCH_APPLY_IMAGE_PATCH) == 0x20, "Size of MANAGE_HOT_PATCH_APPLY_IMAGE_PATCH is incorrect");
static_assert(sizeof(MANAGE_HOT_PATCH_QUERY_SINGLE_PATCH) == 0x30, "Size of MANAGE_HOT_PATCH_QUERY_SINGLE_PATCH is incorrect");
static_assert(sizeof(MANAGE_HOT_PATCH_CHECK_ENABLED) == 0x8, "Size of MANAGE_HOT_PATCH_CHECK_ENABLED is incorrect");
static_assert(sizeof(MANAGE_HOT_PATCH_CREATE_PATCH_SECTION) == 0x28, "Size of MANAGE_HOT_PATCH_CREATE_PATCH_SECTION is incorrect");
#endif // WIN64
#if (PHNT_VERSION >= PHNT_WINDOWS_11)
// rev
/**
* The NtManageHotPatch routine manages hot patching operations in the system.
*
* \param[in] HotPatchInformationClass Specifies the type of hot patch information being queried or set.
* \param[out] HotPatchInformation A pointer to a buffer that receives or contains the hot patch information, depending on the operation.
* \param[in] HotPatchInformationLength The size, in bytes, of the HotPatchInformation buffer.
* \param[out] ReturnLength Optional pointer to a variable that receives the number of bytes written to the HotPatchInformation buffer.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtManageHotPatch(
_In_ HOT_PATCH_INFORMATION_CLASS HotPatchInformationClass,
_Out_writes_bytes_opt_(HotPatchInformationLength) PVOID HotPatchInformation,
_In_ ULONG HotPatchInformationLength,
_Out_opt_ PULONG ReturnLength
);
#endif // PHNT_VERSION >= PHNT_WINDOWS_11
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#endif // _NTEXAPI_H
Reference in New Issue View Git Blame Copy Permalink