admin/processhacker-phnt
1
0
Fork 0
mirror of https://github.com/processhacker/phnt synced 2026-06-08 16:49:04 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
53fbbdc5b5d2b08761db1c7b26bfa8c820924356
processhacker-phnt/winsta.h
T
Johnny Shaw 53fbbdc5b5 sync latest
2026-03-25 18:14:46 -06:00

1554 lines
48 KiB
C
Raw Blame History

/*
* Window Station Support functions
*
* This file is part of System Informer.
*/
#ifndef _WINSTA_H
#define _WINSTA_H
//
// Sessions
//
// Specifies the current server.
#define WINSTATION_CURRENT_SERVER ((HANDLE)NULL)
#define WINSTATION_CURRENT_SERVER_HANDLE ((HANDLE)NULL)
#define WINSTATION_CURRENT_SERVER_NAME (NULL)
#define SERVERNAME_CURRENT ((PWSTR)NULL)
// Specifies the current session (SessionId)
#define WINSTATION_CURRENT_SESSION ((ULONG)-1)
#define LOGONID_CURRENT (-1)
// Specifies any-session (SessionId)
#define WINSTATION_ANY_SESSION ((ULONG)-2)
//
// Access rights
//
#define WINSTATION_QUERY 0x00000001 // WinStationQueryInformation
#define WINSTATION_SET 0x00000002 // WinStationSetInformation
#define WINSTATION_RESET 0x00000004 // WinStationReset
#define WINSTATION_VIRTUAL 0x00000008 //read/write direct data
#define WINSTATION_SHADOW 0x00000010 // WinStationShadow
#define WINSTATION_LOGON 0x00000020 // logon to WinStation
#define WINSTATION_LOGOFF 0x00000040 // WinStationLogoff
#define WINSTATION_MSG 0x00000080 // WinStationMsg
#define WINSTATION_CONNECT 0x00000100 // WinStationConnect
#define WINSTATION_DISCONNECT 0x00000200 // WinStationDisconnect
#define WINSTATION_GUEST_ACCESS WINSTATION_LOGON
#define WINSTATION_CURRENT_GUEST_ACCESS (WINSTATION_VIRTUAL | WINSTATION_LOGOFF)
#define WINSTATION_USER_ACCESS (WINSTATION_GUEST_ACCESS | WINSTATION_QUERY | WINSTATION_CONNECT)
#define WINSTATION_CURRENT_USER_ACCESS \
(WINSTATION_SET | WINSTATION_RESET | WINSTATION_VIRTUAL | \
WINSTATION_LOGOFF | WINSTATION_DISCONNECT)
#define WINSTATION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | WINSTATION_QUERY | \
WINSTATION_SET | WINSTATION_RESET | WINSTATION_VIRTUAL | \
WINSTATION_SHADOW | WINSTATION_LOGON | WINSTATION_MSG | \
WINSTATION_CONNECT | WINSTATION_DISCONNECT)
#define WDPREFIX_LENGTH 12
#define CALLBACK_LENGTH 50
#define DLLNAME_LENGTH 32
#define CDNAME_LENGTH 32
#define WDNAME_LENGTH 32
#define PDNAME_LENGTH 32
#define DEVICENAME_LENGTH 128
#define MODEMNAME_LENGTH DEVICENAME_LENGTH
#define STACK_ADDRESS_LENGTH 128
#define MAX_BR_NAME 65
#define DIRECTORY_LENGTH 256
#define INITIALPROGRAM_LENGTH 256
#define USERNAME_LENGTH 20
#define DOMAIN_LENGTH 17
#define PASSWORD_LENGTH 14
#define NASISPECIFICNAME_LENGTH 14
#define NASIUSERNAME_LENGTH 47
#define NASIPASSWORD_LENGTH 24
#define NASISESSIONNAME_LENGTH 16
#define NASIFILESERVER_LENGTH 47
#define CLIENTDATANAME_LENGTH 7
#define CLIENTNAME_LENGTH 20
#define CLIENTADDRESS_LENGTH 30
#define IMEFILENAME_LENGTH 32
#define CLIENTLICENSE_LENGTH 32
#define CLIENTMODEM_LENGTH 40
#define CLIENT_PRODUCT_ID_LENGTH 32
#define MAX_COUNTER_EXTENSIONS 2
#define WINSTATIONNAME_LENGTH 32
#define TERMSRV_TOTAL_SESSIONS 1
#define TERMSRV_DISC_SESSIONS 2
#define TERMSRV_RECON_SESSIONS 3
#define TERMSRV_CURRENT_ACTIVE_SESSIONS 4
#define TERMSRV_CURRENT_DISC_SESSIONS 5
#define TERMSRV_PENDING_SESSIONS 6
#define TERMSRV_SUCC_TOTAL_LOGONS 7
#define TERMSRV_SUCC_LOCAL_LOGONS 8
#define TERMSRV_SUCC_REMOTE_LOGONS 9
#define TERMSRV_SUCC_SESSION0_LOGONS 10
#define TERMSRV_CURRENT_TERMINATING_SESSIONS 11
#define TERMSRV_CURRENT_LOGGEDON_SESSIONS 12
typedef RTL_TIME_ZONE_INFORMATION TS_TIME_ZONE_INFORMATION, *PTS_TIME_ZONE_INFORMATION;
typedef WCHAR WINSTATIONNAME[WINSTATIONNAME_LENGTH + 1];
// Variable length data descriptor (not needed)
typedef struct _VARDATA_WIRE
{
USHORT Size;
USHORT Offset;
} VARDATA_WIRE, *PVARDATA_WIRE;
typedef enum _WINSTATIONSTATECLASS
{
State_Active = 0,
State_Connected = 1,
State_ConnectQuery = 2,
State_Shadow = 3,
State_Disconnected = 4,
State_Idle = 5,
State_Listen = 6,
State_Reset = 7,
State_Down = 8,
State_Init = 9
} WINSTATIONSTATECLASS;
typedef struct _SESSIONIDW
{
union
{
ULONG SessionId;
ULONG LogonId;
};
WINSTATIONNAME WinStationName;
WINSTATIONSTATECLASS State;
} SESSIONIDW, *PSESSIONIDW;
/**
* The WINSTATIONINFOCLASS enumeration indicates the class of data for which to either query or set on the server.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/f333c223-de8a-46e1-a83e-79cbdab92371
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/1bba9ff2-71d3-49a3-bb26-2e5f6fcab3ee
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/2a5ee131-a1dd-44c7-9880-98df708061ea
*/
typedef enum _WINSTATIONINFOCLASS
{
WinStationCreateData, // q: WINSTATIONCREATE
WinStationConfiguration, // qs: WINSTACONFIGWIRE + USERCONFIG
WinStationPdParams, // qs: PDPARAMSWIRE + PDPARAMS
WinStationWd, // q: WDCONFIG
WinStationPd, // q: PDCONFIG2 + PDPARAMS
WinStationPrinter, // qs: Not supported.
WinStationClient, // q: VARDATA_WIRE + WINSTATIONCLIENT
WinStationModules, // q:
WinStationInformation, // q: WINSTATIONINFORMATION
WinStationTrace, // s: TS_TRACE
WinStationBeep, // s: BEEPINPUT // 10
WinStationEncryptionOff, // s:
WinStationEncryptionPerm, // s:
WinStationNtSecurity, // s: (open secure desktop ctrl+alt+del)
WinStationUserToken, // q: WINSTATIONUSERTOKEN
WinStationUnused1, // qs: Not supported.
WinStationVideoData, // q: WINSTATIONVIDEODATA
WinStationInitialProgram, // s: (set current process as initial program)
WinStationCd, // q: CDCONFIG
WinStationSystemTrace, // s: TS_TRACE
WinStationVirtualData, // q: PVOID // 20
WinStationClientData, // s: VARDATA_WIRE + WINSTATIONCLIENTDATA
WinStationSecureDesktopEnter, // qs:
WinStationSecureDesktopExit, // qs:
WinStationLoadBalanceSessionTarget, // q: ULONG
WinStationLoadIndicator, // q: WINSTATIONLOADINDICATORDATA
WinStationShadowInfo, // qs: WINSTATIONSHADOW
WinStationDigProductId, // q: WINSTATIONPRODID
WinStationLockedState, // qs: BOOL
WinStationRemoteAddress, // q: WINSTATIONREMOTEADDRESS
WinStationIdleTime, // q: ULONG // 30
WinStationLastReconnectType, // q: ULONG
WinStationDisallowAutoReconnect, // qs: BOOLEAN
WinStationMprNotifyInfo, // q:
WinStationExecSrvSystemPipe, // q: WCHAR[48]
WinStationSmartCardAutoLogon, // q: BOOLEAN
WinStationIsAdminLoggedOn, // q: BOOLEAN
WinStationReconnectedFromId, // q: ULONG
WinStationEffectsPolicy, // q: ULONG
WinStationType, // q: ULONG
WinStationInformationEx, // q: VARDATA_WIRE + WINSTATIONINFORMATIONEX // 40
WinStationValidationInfo, // q:
WinStationActivityId, // q: GUID
MaxWinStationInfoClass
} WINSTATIONINFOCLASS;
/**
* Retrieves general information used to create the terminal server session (protocol) to which the station belongs.
*/
typedef struct _WINSTATIONCREATE
{
ULONG fEnableWinStation : 1;
ULONG MaxInstanceCount;
} WINSTATIONCREATE, *PWINSTATIONCREATE;
typedef struct _WINSTACONFIGWIRE
{
WCHAR Comment[61]; // The WinStation descriptive comment.
CHAR OEMId[4]; // Value identifying the OEM implementer of the TermService Listener to which this session (WinStation) belongs. This can be any value defined by the implementer (OEM) of the listener.
VARDATA_WIRE UserConfig; // VARDATA_WIRE structure defining the size and offset of the variable-length user configuration data succeeding it.
VARDATA_WIRE NewFields; // VARDATA_WIRE structure defining the size and offset of the variable-length new data succeeding it. This field is not used and is a placeholder for any new data, if and when added.
} WINSTACONFIGWIRE, *PWINSTACONFIGWIRE;
typedef enum _CALLBACKCLASS
{
Callback_Disable,
Callback_Roving,
Callback_Fixed
} CALLBACKCLASS;
/**
* The SHADOWCLASS enumeration is used to indicate the shadow-related settings for a session running on a terminal server.
*/
typedef enum _SHADOWCLASS
{
Shadow_Disable, // Shadowing is disabled.
Shadow_EnableInputNotify, // Permission is asked first from the session being shadowed. The shadower is also permitted keyboard and mouse input.
Shadow_EnableInputNoNotify, // Permission is not asked first from the session being shadowed. The shadower is also permitted keyboard and mouse input.
Shadow_EnableNoInputNotify, // Permission is asked first from the session being shadowed. The shadower is not permitted keyboard and mouse input and MUST observe the shadowed session.
Shadow_EnableNoInputNoNotify // Permission is not asked first from the session being shadowed. The shadower is not permitted keyboard and mouse input and MUST observe the shadowed session.
} SHADOWCLASS;
/**
* The USERCONFIG structure indicates the user and session configuration for a specific terminal server session.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/dba750b8-cb35-4e88-9811-e2a1f8a10701
*/
typedef struct _USERCONFIG
{
ULONG fInheritAutoLogon : 1;
ULONG fInheritResetBroken : 1;
ULONG fInheritReconnectSame : 1;
ULONG fInheritInitialProgram : 1;
ULONG fInheritCallback : 1;
ULONG fInheritCallbackNumber : 1;
ULONG fInheritShadow : 1;
ULONG fInheritMaxSessionTime : 1;
ULONG fInheritMaxDisconnectionTime : 1;
ULONG fInheritMaxIdleTime : 1;
ULONG fInheritAutoClient : 1;
ULONG fInheritSecurity : 1;
ULONG fPromptForPassword : 1;
ULONG fResetBroken : 1;
ULONG fReconnectSame : 1;
ULONG fLogonDisabled : 1;
ULONG fWallPaperDisabled : 1;
ULONG fAutoClientDrives : 1;
ULONG fAutoClientLpts : 1;
ULONG fForceClientLptDef : 1;
ULONG fRequireEncryption : 1;
ULONG fDisableEncryption : 1;
ULONG fUnused1 : 1;
ULONG fHomeDirectoryMapRoot : 1;
ULONG fUseDefaultGina : 1;
ULONG fCursorBlinkDisabled : 1;
ULONG fPublishedApp : 1;
ULONG fHideTitleBar : 1;
ULONG fMaximize : 1;
ULONG fDisableCpm : 1;
ULONG fDisableCdm : 1;
ULONG fDisableCcm : 1;
ULONG fDisableLPT : 1;
ULONG fDisableClip : 1;
ULONG fDisableExe : 1;
ULONG fDisableCam : 1;
ULONG fDisableAutoReconnect : 1;
ULONG ColorDepth : 3;
ULONG fInheritColorDepth : 1;
ULONG fErrorInvalidProfile : 1;
ULONG fPasswordIsScPin : 1;
ULONG fDisablePNPRedir : 1;
WCHAR UserName[USERNAME_LENGTH + 1];
WCHAR Domain[DOMAIN_LENGTH + 1];
WCHAR Password[PASSWORD_LENGTH + 1];
WCHAR WorkDirectory[DIRECTORY_LENGTH + 1];
WCHAR InitialProgram[INITIALPROGRAM_LENGTH + 1];
WCHAR CallbackNumber[CALLBACK_LENGTH + 1];
CALLBACKCLASS Callback;
SHADOWCLASS Shadow;
ULONG MaxConnectionTime;
ULONG MaxDisconnectionTime;
ULONG MaxIdleTime;
ULONG KeyboardLayout;
BYTE MinEncryptionLevel;
WCHAR NWLogonServer[NASIFILESERVER_LENGTH + 1];
WCHAR PublishedName[MAX_BR_NAME];
WCHAR WFProfilePath[DIRECTORY_LENGTH + 1];
WCHAR WFHomeDir[DIRECTORY_LENGTH + 1];
WCHAR WFHomeDirDrive[4];
} USERCONFIG, *PUSERCONFIG;
typedef enum _SDCLASS
{
SdNone = 0,
SdConsole,
SdNetwork,
SdAsync,
SdOemTransport
} SDCLASS;
typedef WCHAR DEVICENAME[DEVICENAME_LENGTH + 1];
typedef WCHAR MODEMNAME[MODEMNAME_LENGTH + 1];
typedef WCHAR NASISPECIFICNAME[NASISPECIFICNAME_LENGTH + 1];
typedef WCHAR NASIUSERNAME[NASIUSERNAME_LENGTH + 1];
typedef WCHAR NASIPASSWORD[NASIPASSWORD_LENGTH + 1];
typedef WCHAR NASISESIONNAME[NASISESSIONNAME_LENGTH + 1];
typedef WCHAR NASIFILESERVER[NASIFILESERVER_LENGTH + 1];
typedef WCHAR WDNAME[WDNAME_LENGTH + 1];
typedef WCHAR WDPREFIX[WDPREFIX_LENGTH + 1];
typedef WCHAR CDNAME[CDNAME_LENGTH + 1];
typedef WCHAR DLLNAME[DLLNAME_LENGTH + 1];
typedef WCHAR PDNAME[PDNAME_LENGTH + 1];
typedef struct _NETWORKCONFIG
{
LONG LanAdapter;
DEVICENAME NetworkName;
ULONG Flags;
} NETWORKCONFIG, *PNETWORKCONFIG;
typedef enum _FLOWCONTROLCLASS
{
FlowControl_None,
FlowControl_Hardware,
FlowControl_Software
} FLOWCONTROLCLASS;
typedef enum _RECEIVEFLOWCONTROLCLASS
{
ReceiveFlowControl_None,
ReceiveFlowControl_RTS,
ReceiveFlowControl_DTR,
} RECEIVEFLOWCONTROLCLASS;
typedef enum _TRANSMITFLOWCONTROLCLASS
{
TransmitFlowControl_None,
TransmitFlowControl_CTS,
TransmitFlowControl_DSR,
} TRANSMITFLOWCONTROLCLASS;
typedef enum _ASYNCCONNECTCLASS
{
Connect_CTS,
Connect_DSR,
Connect_RI,
Connect_DCD,
Connect_FirstChar,
Connect_Perm,
} ASYNCCONNECTCLASS;
typedef struct _FLOWCONTROLCONFIG
{
ULONG fEnableSoftwareTx : 1;
ULONG fEnableSoftwareRx : 1;
ULONG fEnableDTR : 1;
ULONG fEnableRTS : 1;
CHAR XonChar;
CHAR XoffChar;
FLOWCONTROLCLASS Type;
RECEIVEFLOWCONTROLCLASS HardwareReceive;
TRANSMITFLOWCONTROLCLASS HardwareTransmit;
} FLOWCONTROLCONFIG, *PFLOWCONTROLCONFIG;
typedef struct _CONNECTCONFIG
{
ASYNCCONNECTCLASS Type;
ULONG fEnableBreakDisconnect : 1;
} CONNECTCONFIG, *PCONNECTCONFIG;
typedef struct _ASYNCCONFIG
{
DEVICENAME DeviceName;
MODEMNAME ModemName;
ULONG BaudRate;
ULONG Parity;
ULONG StopBits;
ULONG ByteSize;
ULONG fEnableDsrSensitivity : 1;
ULONG fConnectionDriver : 1;
FLOWCONTROLCONFIG FlowControl;
CONNECTCONFIG Connect;
} ASYNCCONFIG, *PASYNCCONFIG;
typedef struct _NASICONFIG
{
NASISPECIFICNAME SpecificName;
NASIUSERNAME UserName;
NASIPASSWORD PassWord;
NASISESIONNAME SessionName;
NASIFILESERVER FileServer;
BOOLEAN GlobalSession;
} NASICONFIG, *PNASICONFIG;
typedef struct _OEMTDCONFIG
{
LONG Adapter;
DEVICENAME DeviceName;
ULONG Flags;
} OEMTDCONFIG, *POEMTDCONFIG;
/**
* The PDPARAMS structure represents the transport protocol driver parameters.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/ff0e2998-fb8b-4dff-ab64-8427fad556eb
*/
typedef struct _PDPARAMS
{
SDCLASS SdClass; // Stack driver class. Indicates which one of the union's structures is valid.
union
{
NETWORKCONFIG Network; // Configuration of network drivers. Used if SdClass is SdNetwork.
ASYNCCONFIG Async; // Configuration of async (modem) driver. Used if SdClass is SdAsync.
NASICONFIG Nasi; // Reserved.
OEMTDCONFIG OemTd; // Configuration of OEM transport driver. Used if SdClass is SdOemTransport.
};
} PDPARAMS, *PPDPARAMS;
/**
* The WDCONFIG structure represents the WinStation (session) driver configuration.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/d1bf099b-eb54-4ed9-a723-0b1062dbc128
*/
typedef struct _WDCONFIG
{
WDNAME WdName; // The descriptive name of the WinStation driver.
DLLNAME WdDLL; // The driver's image name.
DLLNAME WsxDLL; // Used by the Terminal Services service to communicate with the WinStation driver.
ULONG WdFlag; // Driver flags.
ULONG WdInputBufferLength; // Length, in bytes, of the input buffer used by the driver. Defaults to 2048.
DLLNAME CfgDLL; // Configuration DLL used by Terminal Services administrative tools for configuring the driver.
WDPREFIX WdPrefix; // Used as the prefix of the WinStation name generated for the connected sessions with this WinStation driver.
} WDCONFIG, *PWDCONFIG;
/**
* The PDCONFIG2 structure represents the protocol driver's software configuration.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/74204022-eb7c-4454-b3d0-24f642c892a4
*/
typedef struct _PDCONFIG2
{
PDNAME PdName;
SDCLASS SdClass;
DLLNAME PdDLL;
ULONG PdFlag;
ULONG OutBufLength;
ULONG OutBufCount;
ULONG OutBufDelay;
ULONG InteractiveDelay;
ULONG PortNumber;
ULONG KeepAliveTimeout;
} PDCONFIG2, *PPDCONFIG2;
/**
* The WINSTATIONCLIENT structure defines the client-requested configuration when connecting to a session.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/673d8ac0-f557-48cb-98a6-49925160d729
*/
typedef struct _WINSTATIONCLIENT
{
ULONG fTextOnly : 1;
ULONG fDisableCtrlAltDel : 1;
ULONG fMouse : 1;
ULONG fDoubleClickDetect : 1;
ULONG fINetClient : 1;
ULONG fPromptForPassword : 1;
ULONG fMaximizeShell : 1;
ULONG fEnableWindowsKey : 1;
ULONG fRemoteConsoleAudio : 1;
ULONG fPasswordIsScPin : 1;
ULONG fNoAudioPlayback : 1;
ULONG fUsingSavedCreds : 1;
WCHAR ClientName[CLIENTNAME_LENGTH + 1];
WCHAR Domain[DOMAIN_LENGTH + 1];
WCHAR UserName[USERNAME_LENGTH + 1];
WCHAR Password[PASSWORD_LENGTH + 1];
WCHAR WorkDirectory[DIRECTORY_LENGTH + 1];
WCHAR InitialProgram[INITIALPROGRAM_LENGTH + 1];
ULONG SerialNumber;
BYTE EncryptionLevel;
ULONG ClientAddressFamily;
WCHAR ClientAddress[CLIENTADDRESS_LENGTH + 1];
USHORT HRes;
USHORT VRes;
USHORT ColorDepth;
USHORT ProtocolType;
ULONG KeyboardLayout;
ULONG KeyboardType;
ULONG KeyboardSubType;
ULONG KeyboardFunctionKey;
WCHAR ImeFileName[IMEFILENAME_LENGTH + 1];
WCHAR ClientDirectory[DIRECTORY_LENGTH + 1];
WCHAR ClientLicense[CLIENTLICENSE_LENGTH + 1];
WCHAR ClientModem[CLIENTMODEM_LENGTH + 1];
ULONG ClientBuildNumber;
ULONG ClientHardwareId;
USHORT ClientProductId;
USHORT OutBufCountHost;
USHORT OutBufCountClient;
USHORT OutBufLength;
WCHAR AudioDriverName[9];
TS_TIME_ZONE_INFORMATION ClientTimeZone;
ULONG ClientSessionId;
WCHAR ClientDigProductId[CLIENT_PRODUCT_ID_LENGTH];
ULONG PerformanceFlags;
ULONG ActiveInputLocale;
} WINSTATIONCLIENT, *PWINSTATIONCLIENT;
typedef struct _TSHARE_COUNTERS
{
ULONG Reserved;
} TSHARE_COUNTERS, *PTSHARE_COUNTERS;
typedef struct _PROTOCOLCOUNTERS
{
ULONG WdBytes;
ULONG WdFrames;
ULONG WaitForOutBuf;
ULONG Frames;
ULONG Bytes;
ULONG CompressedBytes;
ULONG CompressFlushes;
ULONG Errors;
ULONG Timeouts;
ULONG AsyncFramingError;
ULONG AsyncOverrunError;
ULONG AsyncOverflowError;
ULONG AsyncParityError;
ULONG TdErrors;
USHORT ProtocolType;
USHORT Length;
union
{
TSHARE_COUNTERS TShareCounters;
ULONG Reserved[100];
} Specific;
} PROTOCOLCOUNTERS, *PPROTOCOLCOUNTERS;
typedef struct _THINWIRECACHE
{
ULONG CacheReads;
ULONG CacheHits;
} THINWIRECACHE, *PTHINWIRECACHE;
#define MAX_THINWIRECACHE 4
typedef struct _RESERVED_CACHE
{
THINWIRECACHE ThinWireCache[MAX_THINWIRECACHE];
} RESERVED_CACHE, *PRESERVED_CACHE;
typedef struct _TSHARE_CACHE
{
ULONG Reserved;
} TSHARE_CACHE, *PTSHARE_CACHE;
/**
* The CACHE_STATISTICS structure represents the cache statistics on the protocol.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/81203ca2-e58b-4681-affa-924e59671b5c
*/
typedef struct CACHE_STATISTICS
{
USHORT ProtocolType; // Protocol type.
USHORT Length; // Length of data in the protocol-specific area. Can be up to 20 * sizeof(ULONG) in size.
union
{
RESERVED_CACHE ReservedCacheStats; // Not used.
TSHARE_CACHE TShareCacheStats; // Protocol cache statistics.
ULONG Reserved[20]; // Reserved for future use.
} Specific;
} CACHE_STATISTICS, *PCACHE_STATISTICS;
/**
* The PROTOCOLSTATUS structure represents the status of the protocol used by the session.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/c9066753-acbd-4678-9a72-8fb1b080bd09
*/
typedef struct _PROTOCOLSTATUS
{
PROTOCOLCOUNTERS Output; // A PROTOCOLCOUNTERS structure containing the output protocol counters.
PROTOCOLCOUNTERS Input; // A PROTOCOLCOUNTERS structure containing the input protocol counters.
CACHE_STATISTICS Cache; // A CACHE_STATISTICS structure containing statistics for the cache.
ULONG AsyncSignal; // Indicator of async signal, such as MS_CTS_ON, for async protocols.
ULONG AsyncSignalMask; // Mask of async signal events, such as EV_CTS, for async protocols.
} PROTOCOLSTATUS, *PPROTOCOLSTATUS;
/**
* The WINSTATIONINFORMATION structure retrieves the state, connect time, last input time, and so on, for a session.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/c2566d8b-7016-440b-b7e0-0d07c3b2418f
*/
typedef struct _WINSTATIONINFORMATION
{
WINSTATIONSTATECLASS ConnectState; // The current connect state of the session.
WINSTATIONNAME WinStationName; // The name of the session.
ULONG LogonId; // The session identifier of the session.
LARGE_INTEGER ConnectTime; // The time of the most recent connection to the session.
LARGE_INTEGER DisconnectTime; // The time of the most recent disconnection from the session.
LARGE_INTEGER LastInputTime; // The time the session last received input.
LARGE_INTEGER LogonTime; // The time of the logon to the session.
PROTOCOLSTATUS Status; // The status of the protocol.
WCHAR Domain[DOMAIN_LENGTH + 1]; // The user's domain name.
WCHAR UserName[USERNAME_LENGTH + 1]; // The user's user name.
LARGE_INTEGER CurrentTime; // The current time in the session.
} WINSTATIONINFORMATION, *PWINSTATIONINFORMATION;
/**
* The TS_TRACE structure specifies fields used for configuring tracing operations in TS binaries if they are checked.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/ad349575-5369-4830-a174-1920a7af8d5f
*/
typedef struct _TS_TRACE
{
WCHAR TraceFile[256]; // Specifies the file name, if any, to which to write debug information.
BOOLEAN Debugger; // Specifies whether debugger is attached.
BOOLEAN Timestamp; // Specifies whether to append time stamp to the traces logged.
ULONG TraceClass; // Classes of tracing to log. They enable tracing for the various terminal server binaries/functionalities.
ULONG TraceEnable; // Type of tracing calls log.
WCHAR TraceOption[64]; // Trace option string. This can be an empty string meaning collect trace for all files and lines in those files.
} TS_TRACE, *PTS_TRACE;
/**
* The BEEPINPUT structure performs a beep in the session.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/2faf4c5b-3a79-491a-9d1a-145f46a797d1
*/
typedef struct _BEEPINPUT
{
/**
* If the session ID is 0, this can be any of the values that can be passed to the standard MessageBeep function.
* If the session ID is not 0, a frequency and duration is chosen by the server to send as a beep to the session.
*/
ULONG Type;
} BEEPINPUT, *PBEEPINPUT;
/**
* The WINSTATIONUSERTOKEN structure retrieves the user's token for the session.
*
* \remarks Caller requires WINSTATION_ALL_ACCESS permission.
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/07f9831c-6331-43e5-ba27-d3d58772eb4c
*/
typedef struct _WINSTATIONUSERTOKEN
{
HANDLE ProcessId; // Specifies the Process ID.
HANDLE ThreadId; // Specifies the calling thread.
HANDLE UserToken; // Returns the user token that is currently logged on to the session.
} WINSTATIONUSERTOKEN, *PWINSTATIONUSERTOKEN;
/**
* The WINSTATIONVIDEODATA structure defines the resolution and color depth of a session.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/5f95f657-89d2-472d-b4ab-b0595618dbd1
*/
typedef struct _WINSTATIONVIDEODATA
{
USHORT HResolution; // Specifies the horizontal resolution, in pixels.
USHORT VResolution; // Specifies the vertical resolution, in pixels.
USHORT ColorDepth; // Specifies the color depth.
} WINSTATIONVIDEODATA, *PWINSTATIONVIDEODATA;
typedef enum _CDCLASS
{
CdNone, // No connection driver.
CdModem, // Connection driver is a modem.
CdClass_Maximum,
} CDCLASS;
/**
* The CDCONFIG structure defines the configuration used for connecting via modem to a server.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/f88900e1-c159-4f02-b3ae-84f05eec212f
*/
typedef struct _CDCONFIG
{
CDCLASS CdClass; // Connection driver type.
CDNAME CdName; // Connection driver descriptive name.
DLLNAME CdDLL; // Connection driver image name.
ULONG CdFlag; // Connection driver flags. Connection driver specific.
} CDCONFIG, *PCDCONFIG;
// The name has the following form:
// name syntax : xxxyyyy<null>
typedef CHAR CLIENTDATANAME[CLIENTDATANAME_LENGTH + 1];
typedef CHAR* PCLIENTDATANAME;
typedef struct _WINSTATIONCLIENTDATA
{
CLIENTDATANAME DataName; // Identifies the type of data sent in this WINSTATIONCLIENTDATA structure.
BOOLEAN fUnicodeData; // TRUE indicates data is in Unicode format; FALSE otherwise.
} WINSTATIONCLIENTDATA, *PWINSTATIONCLIENTDATA;
typedef enum _LOADFACTORTYPE
{
ErrorConstraint, // An error occurred while obtaining constraint data.
PagedPoolConstraint, // The amount of paged pool is the constraint.
NonPagedPoolConstraint, // The amount of non-paged pool is the constraint.
AvailablePagesConstraint, // The amount of available pages is the constraint.
SystemPtesConstraint, // The number of system page table entries (PTEs) is the constraint.
CPUConstraint // CPU usage is the constraint.
} LOADFACTORTYPE;
/**
* The WINSTATIONLOADINDICATORDATA structure defines data used for the load balancing of a server.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/91459fa1-77e8-4987-a6f0-fe7dd3e62bfc
*/
typedef struct _WINSTATIONLOADINDICATORDATA
{
ULONG RemainingSessionCapacity; // The estimated number of additional sessions that can be supported given the CPU constraint.
LOADFACTORTYPE LoadFactor; // Indicates the most constrained current resource.
ULONG TotalSessions; // The total number of sessions.
ULONG DisconnectedSessions; // The number of disconnected sessions.
LARGE_INTEGER IdleCPU; // This is always set to 0.
LARGE_INTEGER TotalCPU; // This is always set to 0.
ULONG RawSessionCapacity; // The raw number of sessions capacity.
ULONG reserved[9]; // Reserved.
} WINSTATIONLOADINDICATORDATA, *PWINSTATIONLOADINDICATORDATA;
/**
* The SHADOWSTATECLASS enumeration specifies WinStation shadow states.
*
* \sa https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/c55fbd8f-d7e3-4efe-9ca6-d0985dab9602
*/
typedef enum _SHADOWSTATECLASS
{
State_NoShadow, // No shadow operations are currently being performed on this session.
State_Shadowing, // The session is shadowing a different session. The current session is referred to as a shadow client.
State_Shadowed // The session is being shadowed by a different session. The current session is referred to as a shadow target.
} SHADOWSTATECLASS;
#define PROTOCOL_CONSOLE 0
#define PROTOCOL_OTHERS 1
#define PROTOCOL_RDP 2
// Retrieves the current shadow state of a session.
typedef struct _WINSTATIONSHADOW
{
SHADOWSTATECLASS ShadowState; // Specifies the current state of shadowing.
SHADOWCLASS ShadowClass; // Specifies the type of shadowing.
ULONG SessionId; // Specifies the session ID of the session.
ULONG ProtocolType; // Specifies the type of protocol on the session. Can be one of PROTOCOL_* values.
} WINSTATIONSHADOW, *PWINSTATIONSHADOW;
// Retrieves the client product ID and current product ID of the session.
typedef struct _WINSTATIONPRODID
{
WCHAR DigProductId[CLIENT_PRODUCT_ID_LENGTH];
WCHAR ClientDigProductId[CLIENT_PRODUCT_ID_LENGTH];
WCHAR OuterMostDigProductId[CLIENT_PRODUCT_ID_LENGTH];
ULONG CurrentSessionId;
ULONG ClientSessionId;
ULONG OuterMostSessionId;
} WINSTATIONPRODID, *PWINSTATIONPRODID;
// Retrieves the remote IP address of the terminal server client in the session.
typedef struct _WINSTATIONREMOTEADDRESS
{
USHORT sin_family;
union
{
struct
{
USHORT sin_port;
ULONG sin_addr;
UCHAR sin_zero[8];
} ipv4;
struct
{
USHORT sin6_port;
ULONG sin6_flowinfo;
USHORT sin6_addr[8];
ULONG sin6_scope_id;
} ipv6;
};
} WINSTATIONREMOTEADDRESS, *PWINSTATIONREMOTEADDRESS;
//
// WinStationInformationEx
//
// private
typedef struct _WINSTATIONINFORMATIONEX_LEVEL1
{
ULONG SessionId;
WINSTATIONSTATECLASS SessionState;
LONG SessionFlags;
WINSTATIONNAME WinStationName;
WCHAR UserName[USERNAME_LENGTH + 1];
WCHAR DomainName[DOMAIN_LENGTH + 1];
LARGE_INTEGER LogonTime;
LARGE_INTEGER ConnectTime;
LARGE_INTEGER DisconnectTime;
LARGE_INTEGER LastInputTime;
LARGE_INTEGER CurrentTime;
PROTOCOLSTATUS ProtocolStatus;
} WINSTATIONINFORMATIONEX_LEVEL1, *PWINSTATIONINFORMATIONEX_LEVEL1;
// private
typedef struct _WINSTATIONINFORMATIONEX_LEVEL2
{
ULONG SessionId;
WINSTATIONSTATECLASS SessionState;
LONG SessionFlags;
WINSTATIONNAME WinStationName;
WCHAR SamCompatibleUserName[USERNAME_LENGTH + 1];
WCHAR SamCompatibleDomainName[DOMAIN_LENGTH + 1];
LARGE_INTEGER LogonTime;
LARGE_INTEGER ConnectTime;
LARGE_INTEGER DisconnectTime;
LARGE_INTEGER LastInputTime;
LARGE_INTEGER CurrentTime;
PROTOCOLSTATUS ProtocolStatus;
WCHAR UserName[257];
WCHAR DomainName[256];
} WINSTATIONINFORMATIONEX_LEVEL2, *PWINSTATIONINFORMATIONEX_LEVEL2;
// private
typedef union _WINSTATIONINFORMATIONEX_LEVEL
{
WINSTATIONINFORMATIONEX_LEVEL1 WinStationInfoExLevel1;
WINSTATIONINFORMATIONEX_LEVEL2 WinStationInfoExLevel2;
} WINSTATIONINFORMATIONEX_LEVEL, *PWINSTATIONINFORMATIONEX_LEVEL;
// private
typedef struct _WINSTATIONINFORMATIONEX
{
ULONG Level;
WINSTATIONINFORMATIONEX_LEVEL Data;
} WINSTATIONINFORMATIONEX, *PWINSTATIONINFORMATIONEX;
#define TS_PROCESS_INFO_MAGIC_NT4 0x23495452
typedef struct _TS_PROCESS_INFORMATION_NT4
{
ULONG MagicNumber;
ULONG LogonId;
PVOID ProcessSid;
ULONG Pad;
} TS_PROCESS_INFORMATION_NT4, *PTS_PROCESS_INFORMATION_NT4;
#define SIZEOF_TS4_SYSTEM_THREAD_INFORMATION 64
#define SIZEOF_TS4_SYSTEM_PROCESS_INFORMATION 136
_Struct_size_bytes_(NextEntryOffset)
typedef struct _TS_SYS_PROCESS_INFORMATION
{
ULONG NextEntryOffset;
ULONG NumberOfThreads;
LARGE_INTEGER SpareLi1;
LARGE_INTEGER SpareLi2;
LARGE_INTEGER CycleTime;
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ImageName;
KPRIORITY BasePriority;
ULONG UniqueProcessId;
ULONG InheritedFromUniqueProcessId;
ULONG HandleCount;
ULONG SessionId;
ULONG UniqueProcessKey;
SIZE_T PeakVirtualSize;
SIZE_T VirtualSize;
ULONG PageFaultCount;
ULONG PeakWorkingSetSize;
ULONG WorkingSetSize;
SIZE_T QuotaPeakPagedPoolUsage;
SIZE_T QuotaPagedPoolUsage;
SIZE_T QuotaPeakNonPagedPoolUsage;
SIZE_T QuotaNonPagedPoolUsage;
SIZE_T PagefileUsage;
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
} TS_SYS_PROCESS_INFORMATION, *PTS_SYS_PROCESS_INFORMATION;
typedef struct _TS_ALL_PROCESSES_INFO
{
PTS_SYS_PROCESS_INFORMATION TsProcessInfo;
ULONG SizeOfSid;
PSID Sid;
} TS_ALL_PROCESSES_INFO, *PTS_ALL_PROCESSES_INFO;
typedef struct _TS_COUNTER_HEADER
{
ULONG CounterID;
BOOLEAN Result;
} TS_COUNTER_HEADER, *PTS_COUNTER_HEADER;
typedef struct _TS_COUNTER
{
TS_COUNTER_HEADER CounterHead;
ULONG Value;
LARGE_INTEGER StartTime;
} TS_COUNTER, *PTS_COUNTER;
// Flags for WinStationShutdownSystem
#define WSD_LOGOFF 0x1
#define WSD_SHUTDOWN 0x2
#define WSD_REBOOT 0x4
#define WSD_POWEROFF 0x8
// Flags for WinStationWaitSystemEvent
#define WEVENT_NONE 0x0
#define WEVENT_CREATE 0x1
#define WEVENT_DELETE 0x2
#define WEVENT_RENAME 0x4
#define WEVENT_CONNECT 0x8
#define WEVENT_DISCONNECT 0x10
#define WEVENT_LOGON 0x20
#define WEVENT_LOGOFF 0x40
#define WEVENT_STATECHANGE 0x80
#define WEVENT_LICENSE 0x100
#define WEVENT_ALL 0x7fffffff
#define WEVENT_FLUSH 0x80000000
// Hotkey modifiers for WinStationShadow
#define KBDSHIFT 0x1
#define KBDCTRL 0x2
#define KBDALT 0x4
// begin_rev
// Flags for WinStationRegisterConsoleNotification
/**
* WNOTIFY_THIS_SESSION
*
* Specifies that only session notifications involving the session attached
* to by the window identified by the WindowHandle are to be received.
*/
#define WNOTIFY_THIS_SESSION 0x0
/**
* WNOTIFY_ALL_SESSIONS
*
* Specifies that all session notifications are to be received.
*/
#define WNOTIFY_ALL_SESSIONS 0x1
// end_rev
// In the functions below, memory returned can be freed using LocalFree. NULL can be specified for
// server handles to indicate the local server. -1 can be specified for session IDs to indicate the
// current session ID.
// rev
/**
* The WinStationFreeMemory routine frees memory allocated by a Remote Desktop Services function.
*
* \param Buffer Pointer to the memory to free.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsfreememory
*/
NTSYSAPI
BOOLEAN
NTAPI
WinStationFreeMemory(
_In_ PVOID Buffer
);
// rev
/**
* The WinStationOpenServerW routine opens a handle to the specified Remote Desktop Session Host (RD Session Host) server.
*
* \param ServerName Pointer to a null-terminated string specifying the NetBIOS name of the RD Session Host server.
* \return HANDLE If the function succeeds, the return value is a handle to the specified server.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsopenserverw
*/
NTSYSAPI
HANDLE
NTAPI
WinStationOpenServerW(
_In_opt_ PCWSTR ServerName
);
// rev
/**
* The WinStationOpenServerExW routine opens a handle to the specified Remote Desktop Session Host (RD Session Host) server
* or Remote Desktop Virtualization Host (RD Virtualization Host) server.
*
* \param ServerName Pointer to a null-terminated string specifying the NetBIOS name of the RD Session Host server.
* \return HANDLE If the function succeeds, the return value is a handle to the specified server.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsopenserverexw
*/
NTSYSAPI
HANDLE
NTAPI
WinStationOpenServerExW(
_In_opt_ PCWSTR ServerName
);
// rev
/**
* The WinStationCloseServer routine closes an open handle to a Remote Desktop Session Host (RD Session Host) server.
*
* \param ServerHandle A handle to an RD Session Host server opened by a call to the WinStationOpenServerW function.
* \return BOOLEAN Nonzero if the function succeeds, or zero otherwise. To get extended error information, call GetLastError.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtscloseserver
*/
NTSYSAPI
BOOLEAN
NTAPI
WinStationCloseServer(
_In_ HANDLE ServerHandle
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationServerPing(
_In_opt_ HANDLE ServerHandle
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationGetTermSrvCountersValue(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG Count,
_Inout_ PTS_COUNTER Counters // set counter IDs before calling
);
// rev
/**
* The WinStationShutdownSystem routine shuts down (and optionally restarts) the specified Remote Desktop Session Host (RD Session Host) server.
*
* \param ServerHandle Handle to an RD Session Host server, or specify WINSTATION_CURRENT_SERVER to indicate the server on which your application is running.
* \param ShutdownFlags Indicates the type of shutdown. This parameter can be one of the WSD_* values.
* \return BOOLEAN Nonzero if the function succeeds, or zero otherwise. To get extended error information, call GetLastError.
* \remarks To shut down or restart the system, the calling process must have the SE_SHUTDOWN_NAME privilege enabled.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsshutdownsystem
*/
NTSYSAPI
BOOLEAN
NTAPI
WinStationShutdownSystem(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG ShutdownFlags // WSD_*
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationWaitSystemEvent(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG EventMask, // WEVENT_*
_Out_ PULONG EventFlags
);
// rev
/**
* The WinStationRegisterConsoleNotification routine shuts down (and optionally restarts) the specified Remote Desktop Session Host (RD Session Host) server.
*
* \param ServerHandle Handle to an RD Session Host server, or WINSTATION_CURRENT_SERVER .
* \param WindowHandle Handle of the window to receive session change notifications.
* \param Flags Specifies whether to receive notifications for all sessions (WNOTIFY_ALL_SESSIONS) or only for the console session.
* \return BOOLEAN Nonzero if the function succeeds, or zero otherwise. To get extended error information, call GetLastError.
* \remarks To shut down or restart the system, the calling process must have the SE_SHUTDOWN_NAME privilege enabled.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsregistersessionnotificationex
*/
NTSYSAPI
BOOLEAN
NTAPI
WinStationRegisterConsoleNotification(
_In_opt_ HANDLE ServerHandle,
_In_ HWND WindowHandle,
_In_ ULONG Flags
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationUnRegisterConsoleNotification(
_In_opt_ HANDLE ServerHandle,
_In_ HWND WindowHandle
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationEnumerateW(
_In_opt_ HANDLE ServerHandle,
_Out_ PSESSIONIDW *SessionIds,
_Out_ PULONG Count
);
/**
* The WinStationQueryInformationW routine retrieves information about a window station.
*
* \param ServerHandle A handle to an RD Session Host server. Specify a handle opened by the WinStationOpenServerW function, or specify WINSTATION_CURRENT_SERVER to indicate the server on which your application is running.
* \param SessionId A Remote Desktop Services session identifier.
* To indicate the session in which the calling application is running (or the current session) specify WINSTATION_CURRENT_SESSION.
* Only specify WINSTATION_CURRENT_SESSION when obtaining session information on the local server.
* If WINSTATION_CURRENT_SESSION is specified when querying session information on a remote server, the returned session information will be inconsistent. Do not use the returned data.
* \param WinStationInformationClass A value from the TOKEN_INFORMATION_CLASS enumerated type identifying the type of information to be retrieved.
* \param WinStationInformation Pointer to a caller-allocated buffer that receives the requested information about the token.
* \param WinStationInformationLength Length, in bytes, of the caller-allocated TokenInformation buffer.
* \param ReturnLength Pointer to a caller-allocated variable that receives the actual length, in bytes, of the information returned in the TokenInformation buffer.
* \return BOOLEAN Nonzero if the function succeeds, or zero otherwise. To get extended error information, call GetLastError.
* \sa https://learn.microsoft.com/en-us/previous-versions/aa383827(v=vs.85)
*/
NTSYSAPI
BOOLEAN
NTAPI
WinStationQueryInformationW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ WINSTATIONINFOCLASS WinStationInformationClass,
_Out_writes_bytes_(WinStationInformationLength) PVOID WinStationInformation,
_In_ ULONG WinStationInformationLength,
_Out_ PULONG ReturnLength
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationSetInformationW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ WINSTATIONINFOCLASS WinStationInformationClass,
_In_reads_bytes_(WinStationInformationLength) PVOID WinStationInformation,
_In_ ULONG WinStationInformationLength
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationQueryCurrentSessionInformation(
_In_ WINSTATIONINFOCLASS WinStationInformationClass,
_In_reads_bytes_(WinStationInformationLength) PVOID WinStationInformation,
_In_ ULONG WinStationInformationLength
);
NTSYSAPI
BOOLEAN
NTAPI
WinStationNameFromLogonIdW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_Out_writes_(WINSTATIONNAME_LENGTH + 1) PWSTR WinStationName
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
LogonIdFromWinStationNameW(
_In_opt_ HANDLE ServerHandle,
_In_ PCWSTR WinStationName,
_Out_ PULONG SessionId
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationSendMessageW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ PCWSTR Title,
_In_ ULONG TitleLength,
_In_ PCWSTR Message,
_In_ ULONG MessageLength,
_In_ ULONG Style,
_In_ ULONG Timeout,
_Out_ PULONG Response,
_In_ BOOLEAN DoNotWait
);
NTSYSAPI
BOOLEAN
NTAPI
WinStationConnectW(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ ULONG TargetSessionId,
_In_opt_ PCWSTR Password,
_In_ BOOLEAN bWait
);
NTSYSAPI
BOOLEAN
NTAPI
WinStationDisconnect(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ BOOLEAN bWait
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationReset(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ BOOLEAN bWait
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationShadow(
_In_opt_ HANDLE ServerHandle,
_In_ PCWSTR TargetServerName,
_In_ ULONG TargetSessionId,
_In_ UCHAR HotKeyVk,
_In_ USHORT HotkeyModifiers // KBD*
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationShadowStop(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ BOOLEAN bWait // ignored
);
// Processes
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationEnumerateProcesses(
_In_opt_ HANDLE ServerHandle,
_Out_ PVOID *Processes
);
#define WINSTATION_PROCESS_LEVEL 0
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationGetAllProcesses(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG Level,
_Out_ PULONG NumberOfProcesses,
_Out_ PTS_ALL_PROCESSES_INFO *Processes
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationFreeGAPMemory(
_In_ ULONG Level,
_In_ PTS_ALL_PROCESSES_INFO Processes,
_In_ ULONG NumberOfProcesses
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationTerminateProcess(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG ProcessId,
_In_ ULONG ExitCode
);
NTSYSAPI
BOOLEAN
NTAPI
WinStationGetProcessSid(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG ProcessId,
_In_ FILETIME ProcessStartTime,
_Out_ PVOID ProcessUserSid,
_Inout_ PULONG dwSidSize
);
//
// Services isolation
//
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationSwitchToServicesSession(
VOID
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationRevertFromServicesSession(
VOID
);
// Misc.
NTSYSAPI
BOOLEAN
NTAPI
_WinStationWaitForConnect(
VOID
);
// rev
NTSYSAPI
HANDLE
NTAPI
WinStationVirtualOpen(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ PCSTR Name
);
// rev
NTSYSAPI
HANDLE
NTAPI
WinStationVirtualOpenEx(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ PCSTR Name,
_In_ ULONG Flags
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationIsCurrentSessionRemoteable(
_Out_ PBOOLEAN IsRemoteable
);
EXTERN_C DECLSPEC_SELECTANY CONST GUID PROPERTY_TYPE_GET_MONITOR_CONFIG = { 0x865D5285, 0xF70A, 0x4ECF, { 0x8B, 0x28, 0x51, 0x2F, 0xE0, 0xAA, 0x2D, 0x53 } };
EXTERN_C DECLSPEC_SELECTANY CONST GUID PROPERTY_TYPE_CORRELATIONID_GUID = { 0x9A363F8E, 0x1902, 0x40DA, { 0xA2, 0xCC, 0x56, 0x4F, 0x09, 0x40, 0xAD, 0xE3 } };
typedef struct _TS_PROPERTY_INFORMATION
{
ULONG Length;
PVOID Buffer;
} TS_PROPERTY_INFORMATION, *PTS_PROPERTY_INFORMATION;
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationGetConnectionProperty(
_In_ ULONG SessionId,
_In_ PCGUID PropertyType,
_Out_ PTS_PROPERTY_INFORMATION PropertyBuffer
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationFreePropertyValue(
_In_ PVOID PropertyBuffer
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationIsSessionRemoteable(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_Out_ PBOOLEAN IsRemote
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationSetAutologonPassword(
_In_ PCSTR KeyName,
_In_ PCSTR Password
);
// private
typedef struct _EXECENVDATAEX_LEVEL1
{
LONG ExecEnvId;
LONG State;
LONG AbsSessionId;
PWSTR SessionName;
PWSTR HostName;
PWSTR UserName;
PWSTR DomainName;
PWSTR FarmName;
} EXECENVDATAEX_LEVEL1, *PEXECENVDATAEX_LEVEL1;
typedef union _EXECENVDATAEX_PAYLOAD
{
UCHAR Data[1];
EXECENVDATAEX_LEVEL1 Level1;
// define level 2/3/4 here
} EXECENVDATAEX_PAYLOAD;
typedef struct _EXECENVDATAEX
{
ULONG Level;
EXECENVDATAEX_PAYLOAD Payload;
} EXECENVDATAEX, *PEXECENVDATAEX;
// typedef struct _EXECENVDATAEX
// {
// ULONG Level;
// union
// {
// EXECENVDATAEX_LEVEL1 ExecEnvEnum_Level1;
// };
// } EXECENVDATAEX, *PEXECENVDATAEX;
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationGetAllSessionsEx(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG Level, // Must be 1
_Out_ PEXECENVDATAEX *SessionData,
_Out_ PULONG Count
);
// rev
NTSYSAPI
VOID
WINAPI
WinStationFreeEXECENVDATAEX(
_In_opt_ PEXECENVDATAEX SessionData,
_In_ ULONG Count
);
typedef enum _SessionType
{
SESSIONTYPE_UNKNOWN = 0,
SESSIONTYPE_SERVICES,
SESSIONTYPE_LISTENER,
SESSIONTYPE_REGULARDESKTOP,
SESSIONTYPE_ALTERNATESHELL,
SESSIONTYPE_REMOTEAPP,
SESSIONTYPE_MEDIACENTEREXT
} SESSIONTYPE;
// rev
typedef struct _TS_USER_SESSION
{
ULONG Version;
ULONG SessionId;
ULONG Unknown;
SESSIONTYPE State;
ULONG field5;
} TS_USER_SESSION, *PTS_USER_SESSION;
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationGetAllUserSessions(
_In_opt_ HANDLE ServerHandle,
_In_ PSID Sid,
_Out_ PVOID* Processes, // LocalFree
_Out_ PULONG NumberOfProcesses
);
// rev
typedef struct _TS_SESSION_VIRTUAL_ADDRESS
{
USHORT AddressFamily;
USHORT AddressLength;
BYTE Address[20];
} TS_SESSION_VIRTUAL_ADDRESS, *PTS_SESSION_VIRTUAL_ADDRESS;
typedef USHORT ADDRESS_FAMILY;
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationQuerySessionVirtualIP(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_In_ ADDRESS_FAMILY Family,
_Out_ TS_SESSION_VIRTUAL_ADDRESS* SessionVirtualIP
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationGetDeviceId(
_In_opt_ HANDLE ServerHandle,
_In_ ULONG SessionId,
_Out_ PCHAR* Buffer, // CHAR DeviceId[MAX_PATH + 1];
_In_ SIZE_T BufferLength
);
// rev
NTSYSAPI
BOOLEAN
NTAPI
WinStationGetLoggedOnCount(
_Out_ PULONG LoggedOnUserCount,
_Out_ PULONG LoggedOnDeviceCount
);
// rev
/**
* The WinStationSetRenderHint routine is used by an application that is displaying content that
* can be optimized for displaying in a remote session to identify the region of a window that is the actual content.
* In the remote session, this content will be encoded, sent to the client, then decoded and displayed.
*
* \param[out] RenderHintID The address of a value that identifies the rendering hint affected by this call.
* If a new hint is being created, this value must contain zero.
* This function will return a unique rendering hint identifier which is used for subsequent calls, such as clearing the hint.
* \param[in] WindowHandle The handle of window linked to lifetime of the rendering hint. This window is used in situations where a hint target is removed without the hint being explicitly cleared.
* \param[in] RenderHintType Specifies the type of hint represented by this call.
* \param[in] HintDataLength The size in bytes, of the HintData buffer.
* \param[in] HintData Additional data for the hint. The format of this data is dependent upon the value passed in the renderHintType parameter.
* \return BOOLEAN Nonzero if the function succeeds, or zero otherwise.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtshintapi/nf-wtshintapi-wtssetrenderhint
*/
NTSYSAPI
BOOLEAN
NTAPI
WinStationSetRenderHint(
_In_opt_ PULONG64 RenderHintID,
_In_ HWND WindowHandle,
_In_ ULONG RenderHintType,
_In_ ULONG HintDataLength,
_In_ PBYTE HintData
);
// rev
/**
* The WinStationActiveSessionExists routine returns active sessions on the system without enumerating through the list of sessions.
* It also does not obtain any extra information from Local Session Manager.
*
* \return BOOLEAN Nonzero if an active session exists.
* \sa https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsactivesessionexists
*/
NTSYSAPI
BOOLEAN
NTAPI
WinStationActiveSessionExists(
VOID
);
#endif
Reference in New Issue View Git Blame Copy Permalink