admin/winsiderss-phnt
1
0
Fork 0
mirror of https://github.com/winsiderss/phnt synced 2026-06-08 18:20:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

sync latest

Browse Source
This commit is contained in:
Johnny Shaw
2025-03-11 16:33:45 -06:00
parent 48759c9b59
commit 4cc8487a97
30 changed files with 2561 additions and 1327 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9 -9
View File
@@ -1,4 +1,4 @@
This collection of Native API header files has been maintained since 2009 for the System Informer project, and is the most up-to-date set of Native API definitions that we know of. We have gathered these definitions from official Microsoft header files and symbol files, as well as a lot of reverse engineering and guessing. See `phnt.h` for more information.
This collection of Native API header files has been maintained since 2009 for the Process Hacker project, and is the most up-to-date set of Native API definitions that I know of. I have gathered these definitions from official Microsoft header files and symbol files, as well as a lot of reverse engineering and guessing. See `phnt.h` for more information.
## Usage
@@ -14,12 +14,12 @@ These header files are designed to be used by user-mode programs. Instead of `#i
at the top of your program. The first line provides access to the Win32 API as well as the `NTSTATUS` values. The second line provides access to the entire Native API. By default, only definitions present in Windows XP are included into your program. To change this, use one of the following:
```
#define PHNT_VERSION PHNT_WINXP // Windows XP
#define PHNT_VERSION PHNT_WS03 // Windows Server 2003
#define PHNT_VERSION PHNT_VISTA // Windows Vista
#define PHNT_VERSION PHNT_WIN7 // Windows 7
#define PHNT_VERSION PHNT_WIN8 // Windows 8
#define PHNT_VERSION PHNT_WINBLUE // Windows 8.1
#define PHNT_VERSION PHNT_THRESHOLD // Windows 10
#define PHNT_VERSION PHNT_WIN11 // Windows 11
#define PHNT_VERSION PHNT_WINDOWS_XP // Windows XP
#define PHNT_VERSION PHNT_WINDOWS_SERVER_2003 // Windows Server 2003
#define PHNT_VERSION PHNT_WINDOWS_VISTA // Windows Vista
#define PHNT_VERSION PHNT_WINDOWS_7 // Windows 7
#define PHNT_VERSION PHNT_WINDOWS_8 // Windows 8
#define PHNT_VERSION PHNT_WINDOWS_8_1 // Windows 8.1
#define PHNT_VERSION PHNT_WINDOWS_10 // Windows 10
#define PHNT_VERSION PHNT_WINDOWS_11 // Windows 11
```
ntbcd.h
+1 -1
View File
@@ -231,7 +231,7 @@ BcdExportStore(
_In_ PCUNICODE_STRING BcdFilePath
);
#if (PHNT_VERSION > PHNT_WIN11)
#if (PHNT_VERSION > PHNT_WINDOWS_11)
/**
* Exports the BCD store to a file with additional flags.
*
ntexapi.h
+535 -129
View File
File diff suppressed because it is too large Load Diff
ntioapi.h
+61 -74
View File
@@ -63,11 +63,26 @@
#define FILE_CONTAINS_EXTENDED_CREATE_INFORMATION 0x10000000
#define FILE_VALID_EXTENDED_OPTION_FLAGS 0x10000000
typedef struct _EXTENDED_CREATE_DUAL_OPLOCK_KEYS
{
//
// Parent oplock key.
// All-zero if not set.
//
GUID ParentOplockKey;
//
// Target oplock key.
// All-zero if not set.
//
GUID TargetOplockKey;
} EXTENDED_CREATE_DUAL_OPLOCK_KEYS, *PEXTENDED_CREATE_DUAL_OPLOCK_KEYS;
typedef struct _EXTENDED_CREATE_INFORMATION
{
LONGLONG ExtendedCreateFlags;
PVOID EaBuffer;
ULONG EaLength;
//PEXTENDED_CREATE_DUAL_OPLOCK_KEYS DualOplockKeys; // since 24H2
} EXTENDED_CREATE_INFORMATION, *PEXTENDED_CREATE_INFORMATION;
typedef struct _EXTENDED_CREATE_INFORMATION_32
@@ -75,6 +90,7 @@ typedef struct _EXTENDED_CREATE_INFORMATION_32
LONGLONG ExtendedCreateFlags;
void* POINTER_32 EaBuffer;
ULONG EaLength;
//PEXTENDED_CREATE_DUAL_OPLOCK_KEYS POINTER_32 DualOplockKeys; // since 24H2
} EXTENDED_CREATE_INFORMATION_32, *PEXTENDED_CREATE_INFORMATION_32;
#define EX_CREATE_FLAG_FILE_SOURCE_OPEN_FOR_COPY 0x00000001
@@ -446,7 +462,7 @@ typedef struct _FILE_END_OF_FILE_INFORMATION
LARGE_INTEGER EndOfFile;
} FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;
//#if (PHNT_VERSION >= PHNT_REDSTONE5)
//#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS5)
#define FLAGS_END_OF_FILE_INFO_EX_EXTEND_PAGING 0x00000001
#define FLAGS_END_OF_FILE_INFO_EX_NO_EXTRA_PAGING_EXTEND 0x00000002
#define FLAGS_END_OF_FILE_INFO_EX_TIME_CONSTRAINED 0x00000004
@@ -826,7 +842,7 @@ typedef struct _FILE_VOLUME_NAME_INFORMATION
#ifndef FILE_INVALID_FILE_ID
#define FILE_INVALID_FILE_ID ((LONGLONG)-1LL)
#endif
#endif // FILE_INVALID_FILE_ID
#define FILE_ID_IS_INVALID(FID) ((FID).QuadPart == FILE_INVALID_FILE_ID)
@@ -1088,7 +1104,7 @@ typedef struct _FILE_STAT_BASIC_INFORMATION
LARGE_INTEGER VolumeSerialNumber;
FILE_ID_128 FileId128;
} FILE_STAT_BASIC_INFORMATION, *PFILE_STAT_BASIC_INFORMATION;
#endif
#endif // NTDDI_WIN11_GE
typedef struct _FILE_MEMORY_PARTITION_INFORMATION
{
@@ -1132,7 +1148,7 @@ typedef struct _FILE_STAT_LX_INFORMATION
ULONG LxDeviceIdMajor;
ULONG LxDeviceIdMinor;
} FILE_STAT_LX_INFORMATION, *PFILE_STAT_LX_INFORMATION;
#endif
#endif // NTDDI_WIN11_GE
typedef struct _FILE_STORAGE_RESERVE_ID_INFORMATION
{
@@ -1146,7 +1162,7 @@ typedef struct _FILE_CASE_SENSITIVE_INFORMATION
{
ULONG Flags;
} FILE_CASE_SENSITIVE_INFORMATION, *PFILE_CASE_SENSITIVE_INFORMATION;
#endif
#endif // NTDDI_WIN11_GE
typedef enum _FILE_KNOWN_FOLDER_TYPE
{
@@ -1720,7 +1736,7 @@ NtFlushBuffersFile(
#define FLUSH_FLAGS_FLUSH_AND_PURGE 0x00000008 // 24H2
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1744,7 +1760,7 @@ NtQueryInformationFile(
_In_ FILE_INFORMATION_CLASS FileInformationClass
);
#if (PHNT_VERSION >= PHNT_REDSTONE2)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS2)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1792,7 +1808,7 @@ NtQueryDirectoryFile(
#define FILE_QUERY_RETURN_ON_DISK_ENTRIES_ONLY 0x00000008
#define FILE_QUERY_NO_CURSOR_UPDATE 0x00000010 // RS5
#if (PHNT_VERSION >= PHNT_REDSTONE3)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1890,7 +1906,7 @@ NtCancelIoFile(
_Out_ PIO_STATUS_BLOCK IoStatusBlock
);
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1901,7 +1917,7 @@ NtCancelIoFileEx(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -2128,7 +2144,7 @@ typedef struct _FILE_NOTIFY_EXTENDED_INFORMATION
ULONG FileNameLength;
WCHAR FileName[1];
} FILE_NOTIFY_EXTENDED_INFORMATION, *PFILE_NOTIFY_EXTENDED_INFORMATION;
#endif
#endif // NTDDI_WIN10_RS5
#define FILE_NAME_FLAG_HARDLINK 0 // not part of a name pair
#define FILE_NAME_FLAG_NTFS 0x01 // NTFS name in a name pair
@@ -2162,7 +2178,7 @@ typedef struct _FILE_NOTIFY_FULL_INFORMATION
} FILE_NOTIFY_FULL_INFORMATION, *PFILE_NOTIFY_FULL_INFORMATION;
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE3)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -2280,7 +2296,7 @@ NtSetIoCompletion(
_In_ ULONG_PTR IoStatusInformation
);
#if (PHNT_VERSION >= PHNT_WIN7)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -2305,7 +2321,7 @@ NtRemoveIoCompletion(
_In_opt_ PLARGE_INTEGER Timeout
);
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
// private
typedef struct _FILE_IO_COMPLETION_INFORMATION
{
@@ -2325,11 +2341,13 @@ NtRemoveIoCompletionEx(
_In_opt_ PLARGE_INTEGER Timeout,
_In_ BOOLEAN Alertable
);
#endif
#endif // (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
//
// Wait completion packet
//
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
@@ -2362,71 +2380,31 @@ NtCancelWaitCompletionPacket(
_In_ BOOLEAN RemoveSignaledPacket
);
#endif
#endif // (PHNT_VERSION >= PHNT_WINDOWS_8)
// Sessions
typedef enum _IO_SESSION_EVENT
{
IoSessionEventIgnore,
IoSessionEventCreated,
IoSessionEventTerminated,
IoSessionEventConnected,
IoSessionEventDisconnected,
IoSessionEventLogon,
IoSessionEventLogoff,
IoSessionEventMax
} IO_SESSION_EVENT;
typedef enum _IO_SESSION_STATE
{
IoSessionStateCreated = 1,
IoSessionStateInitialized = 2,
IoSessionStateConnected = 3,
IoSessionStateDisconnected = 4,
IoSessionStateDisconnectedLoggedOn = 5,
IoSessionStateLoggedOn = 6,
IoSessionStateLoggedOff = 7,
IoSessionStateTerminated = 8,
IoSessionStateMax
} IO_SESSION_STATE;
// Sessions
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_11)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenSession(
_Out_ PHANDLE SessionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
NtCopyFileChunk(
_In_ HANDLE SourceHandle,
_In_ HANDLE DestinationHandle,
_In_opt_ HANDLE EventHandle,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_ ULONG Length,
_In_ PLARGE_INTEGER SourceOffset,
_In_ PLARGE_INTEGER DestOffset,
_In_opt_ PULONG SourceKey,
_In_opt_ PULONG DestKey,
_In_ ULONG Flags
);
#endif
#endif
#if (PHNT_VERSION >= PHNT_WIN7)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtNotifyChangeSession(
_In_ HANDLE SessionHandle,
_In_ ULONG ChangeSequenceNumber,
_In_ PLARGE_INTEGER ChangeTimeStamp,
_In_ IO_SESSION_EVENT Event,
_In_ IO_SESSION_STATE NewState,
_In_ IO_SESSION_STATE PreviousState,
_In_reads_bytes_opt_(PayloadSize) PVOID Payload,
_In_ ULONG PayloadSize
);
#endif
#endif // (PHNT_VERSION >= PHNT_WINDOWS_11)
//
// I/O Ring
//
#if (PHNT_VERSION >= PHNT_WIN11)
#if (PHNT_VERSION >= PHNT_WINDOWS_11)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -2465,9 +2443,11 @@ NtSetInformationIoRing(
_In_ ULONG IoRingInformationLength,
_In_ PVOID IoRingInformation
);
#endif
#endif // (PHNT_VERSION >= PHNT_WINDOWS_11)
//
// Other types
//
typedef enum _INTERFACE_TYPE
{
@@ -2827,7 +2807,9 @@ typedef struct _FILE_MAILSLOT_PEEK_BUFFER
ULONG MessageLength;
} FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
//
// Mount manager FS control definitions
//
#define MOUNTMGR_DEVICE_NAME L"\\Device\\MountPointManager"
#define MOUNTMGRCONTROLTYPE 0x0000006D // 'm'
@@ -3034,7 +3016,12 @@ typedef struct _MOUNTMGR_VOLUME_PATHS
(s)->Length == 98 && \
(s)->Buffer[1] == '?')
//
// Filter manager
//
#define FLT_PORT_CONNECT 0x0001
#define FLT_PORT_ALL_ACCESS (FLT_PORT_CONNECT | STANDARD_RIGHTS_ALL)
// rev
#define FLT_SYMLINK_NAME L"\\Global??\\FltMgr"
ntkeapi.h
+53 -45
View File
@@ -46,52 +46,54 @@ typedef enum _KHETERO_CPU_POLICY
} KHETERO_CPU_POLICY, *PKHETERO_CPU_POLICY;
#if (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* KWAIT_REASON identifies the reasons for context switches or the current waiting state.
*/
typedef enum _KWAIT_REASON
{
Executive,
FreePage,
PageIn,
PoolAllocation,
DelayExecution,
Suspended,
UserRequest,
WrExecutive,
WrFreePage,
WrPageIn,
WrPoolAllocation,
WrDelayExecution,
WrSuspended,
WrUserRequest,
WrEventPair,
WrQueue,
WrLpcReceive,
WrLpcReply,
WrVirtualMemory,
WrPageOut,
WrRendezvous,
WrKeyedEvent,
WrTerminated,
WrProcessInSwap,
WrCpuRateControl,
WrCalloutStack,
WrKernel,
WrResource,
WrPushLock,
WrMutex,
WrQuantumEnd,
WrDispatchInt,
WrPreempted,
WrYieldExecution,
WrFastMutex,
WrGuardedMutex,
WrRundown,
WrAlertByThreadId,
WrDeferredPreempt,
WrPhysicalFault,
WrIoRing,
WrMdlCache,
WrRcu,
Executive, // Waiting for an executive event.
FreePage, // Waiting for a free page.
PageIn, // Waiting for a page to be read in.
PoolAllocation, // Waiting for a pool allocation.
DelayExecution, // Waiting due to a delay execution. // NtDelayExecution
Suspended, // Waiting because the thread is suspended. // NtSuspendThread
UserRequest, // Waiting due to a user request. // NtWaitForSingleObject
WrExecutive, // Waiting for an executive event.
WrFreePage, // Waiting for a free page.
WrPageIn, // Waiting for a page to be read in.
WrPoolAllocation, // Waiting for a pool allocation.
WrDelayExecution, // Waiting due to a delay execution.
WrSuspended, // Waiting because the thread is suspended.
WrUserRequest, // Waiting due to a user request.
WrEventPair, // Waiting for an event pair. // NtCreateEventPair
WrQueue, // Waiting for a queue. // NtRemoveIoCompletion
WrLpcReceive, // Waiting for an LPC receive.
WrLpcReply, // Waiting for an LPC reply.
WrVirtualMemory, // Waiting for virtual memory.
WrPageOut, // Waiting for a page to be written out.
WrRendezvous, // Waiting for a rendezvous.
WrKeyedEvent, // Waiting for a keyed event. // NtCreateKeyedEvent
WrTerminated, // Waiting for thread termination.
WrProcessInSwap, // Waiting for a process to be swapped in.
WrCpuRateControl, // Waiting for CPU rate control.
WrCalloutStack, // Waiting for a callout stack.
WrKernel, // Waiting for a kernel event.
WrResource, // Waiting for a resource.
WrPushLock, // Waiting for a push lock.
WrMutex, // Waiting for a mutex.
WrQuantumEnd, // Waiting for the end of a quantum.
WrDispatchInt, // Waiting for a dispatch interrupt.
WrPreempted, // Waiting because the thread was preempted.
WrYieldExecution, // Waiting to yield execution.
WrFastMutex, // Waiting for a fast mutex.
WrGuardedMutex, // Waiting for a guarded mutex.
WrRundown, // Waiting for a rundown.
WrAlertByThreadId, // Waiting for an alert by thread ID.
WrDeferredPreempt, // Waiting for a deferred preemption.
WrPhysicalFault, // Waiting for a physical fault.
WrIoRing, // Waiting for an I/O ring.
WrMdlCache, // Waiting for an MDL cache.
WrRcu, // Waiting for read-copy-update (RCU) synchronization.
MaximumWaitReason
} KWAIT_REASON, *PKWAIT_REASON;
@@ -137,7 +139,13 @@ NtCallbackReturn(
_In_ NTSTATUS Status
);
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
/**
* The NtFlushProcessWriteBuffers routine flushes the write queue of each processor that is running a thread of the current process.
*
* @return NTSTATUS Successful or errant status.
* @see https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-flushprocesswritebuffers
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
ntldr.h
+24 -24
View File
@@ -198,7 +198,7 @@ typedef struct _LDR_DATA_TABLE_ENTRY
PVOID SwitchBackContext;
RTL_BALANCED_NODE BaseAddressIndexNode;
RTL_BALANCED_NODE MappingInfoIndexNode;
ULONG_PTR OriginalBase;
PVOID OriginalBase;
LARGE_INTEGER LoadTime;
ULONG BaseNameHashValue;
LDR_DLL_LOAD_REASON LoadReason; // since WIN8
@@ -262,7 +262,7 @@ LdrGetDllHandleEx(
_Out_ PVOID *DllHandle
);
#if (PHNT_VERSION >= PHNT_WIN7)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
// rev
NTSYSAPI
NTSTATUS
@@ -273,7 +273,7 @@ LdrGetDllHandleByMapping(
);
#endif
#if (PHNT_VERSION >= PHNT_WIN7)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
// rev
NTSYSAPI
NTSTATUS
@@ -285,7 +285,7 @@ LdrGetDllHandleByName(
);
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
// rev
NTSYSAPI
NTSTATUS
@@ -346,7 +346,7 @@ LdrGetProcedureAddress(
// rev
#define LDR_GET_PROCEDURE_ADDRESS_DONT_RECORD_FORWARDER 0x00000001
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
// private
NTSYSAPI
NTSTATUS
@@ -369,7 +369,7 @@ LdrGetKnownDllSectionHandle(
_Out_ PHANDLE Section
);
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
// rev
NTSYSAPI
NTSTATUS
@@ -443,7 +443,7 @@ LdrProcessRelocationBlock(
_In_ LONG_PTR Diff
);
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSAPI
PIMAGE_BASE_RELOCATION
NTAPI
@@ -509,7 +509,7 @@ typedef struct _LDR_VERIFY_IMAGE_INFO
USHORT ImageCharacteristics;
} LDR_VERIFY_IMAGE_INFO, *PLDR_VERIFY_IMAGE_INFO;
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
// private
NTSYSAPI
NTSTATUS
@@ -520,7 +520,7 @@ LdrVerifyImageMatchesChecksumEx(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
// private
NTSYSAPI
NTSTATUS
@@ -569,7 +569,7 @@ VOID NTAPI LDR_DLL_NOTIFICATION_FUNCTION(
);
typedef LDR_DLL_NOTIFICATION_FUNCTION* PLDR_DLL_NOTIFICATION_FUNCTION;
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
/**
* Registers for notification when a DLL is first loaded. This notification occurs before dynamic linking takes place.
*
@@ -622,7 +622,7 @@ typedef struct _LDR_FAILURE_DATA
WCHAR AdditionalInfo[0x20];
} LDR_FAILURE_DATA, *PLDR_FAILURE_DATA;
#if (PHNT_VERSION >= PHNT_WINBLUE)
#if (PHNT_VERSION >= PHNT_WINDOWS_8_1)
NTSYSAPI
PLDR_FAILURE_DATA
NTAPI
@@ -676,7 +676,7 @@ typedef struct _PS_SYSTEM_DLL_INIT_BLOCK
} PS_SYSTEM_DLL_INIT_BLOCK, *PPS_SYSTEM_DLL_INIT_BLOCK;
// rev
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
NTSYSAPI PS_SYSTEM_DLL_INIT_BLOCK LdrSystemDllInitBlock;
#endif
@@ -715,7 +715,7 @@ typedef struct _RTL_SCPCFG_NTDLL_EXPORTS
} RTL_SCPCFG_NTDLL_EXPORTS, *PRTL_SCPCFG_NTDLL_EXPORTS;
// rev
#if (PHNT_VERSION >= PHNT_WIN11_24H2)
#if (PHNT_VERSION >= PHNT_WINDOWS_11_24H2)
NTSYSAPI RTL_SCPCFG_NTDLL_EXPORTS RtlpScpCfgNtdllExports;
#endif
@@ -723,7 +723,7 @@ NTSYSAPI RTL_SCPCFG_NTDLL_EXPORTS RtlpScpCfgNtdllExports;
// Load as data table
//
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
// private
NTSYSAPI
@@ -823,7 +823,7 @@ LdrFindResourceDirectory_U(
_Out_ PIMAGE_RESOURCE_DIRECTORY *ResourceDirectory
);
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
/**
* The LdrResFindResource function finds a resource in a DLL.
*
@@ -1201,7 +1201,7 @@ PVOID NTAPI DELAYLOAD_FAILURE_SYSTEM_ROUTINE(
);
typedef DELAYLOAD_FAILURE_SYSTEM_ROUTINE* PDELAYLOAD_FAILURE_SYSTEM_ROUTINE;
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
// rev from QueryOptionalDelayLoadedAPI
/**
* Determines whether the specified function in a delay-loaded DLL is available on the system.
@@ -1224,7 +1224,7 @@ LdrQueryOptionalDelayLoadedAPI(
);
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
// rev from ResolveDelayLoadedAPI
/**
* Locates the target function of the specified import and replaces the function pointer in the import thunk with the target of the function implementation.
@@ -1337,7 +1337,7 @@ LdrShutdownThread(
VOID
);
#if (PHNT_VERSION >= PHNT_WINBLUE)
#if (PHNT_VERSION >= PHNT_WINDOWS_8_1)
// rev
NTSYSAPI
NTSTATUS
@@ -1347,7 +1347,7 @@ LdrSetImplicitPathOptions(
);
#endif
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
#ifdef PHNT_INLINE_TYPEDEFS
/**
* The LdrControlFlowGuardEnforced function checks if Control Flow Guard is enforced.
@@ -1379,7 +1379,7 @@ LdrControlFlowGuardEnforced(
#endif
#endif
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
/**
* The LdrControlFlowGuardEnforcedWithExportSuppression function checks if Control Flow Guard is
* enforced with export suppression.
@@ -1399,7 +1399,7 @@ LdrControlFlowGuardEnforcedWithExportSuppression(
}
#endif
#if (PHNT_VERSION >= PHNT_19H1)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_19H1)
// rev
NTSYSAPI
BOOLEAN
@@ -1409,7 +1409,7 @@ LdrIsModuleSxsRedirected(
);
#endif
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
// rev
NTSYSAPI
NTSTATUS
@@ -1441,7 +1441,7 @@ typedef struct _LDR_SOFTWARE_ENCLAVE
PLDR_DATA_TABLE_ENTRY BCryptPrimitivesModule;
} LDR_SOFTWARE_ENCLAVE, *PLDR_SOFTWARE_ENCLAVE;
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
// rev from CreateEnclave
/**
@@ -1597,7 +1597,7 @@ LdrSetDllManifestProber(
_In_ PVOID Routine
);
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
NTSYSAPI BOOLEAN LdrpChildNtdll; // DATA export
#endif
ntlpcapi.h
+4 -4
View File
@@ -654,7 +654,7 @@ typedef struct _ALPC_MESSAGE_HANDLE_INFORMATION
// begin_private
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
//
// System calls
@@ -823,7 +823,7 @@ NtAlpcConnectPort(
_In_opt_ PLARGE_INTEGER Timeout
);
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -897,7 +897,7 @@ NtAlpcImpersonateClientOfPort(
_In_ PVOID Flags
);
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -990,7 +990,7 @@ AlpcUnregisterCompletionList(
_In_ HANDLE PortHandle
);
#if (PHNT_VERSION >= PHNT_WIN7)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
// rev
NTSYSAPI
NTSTATUS
ntmisc.h
+474 -5
View File
@@ -7,12 +7,9 @@
#ifndef _NTMISC_H
#define _NTMISC_H
// Filter manager
#define FLT_PORT_CONNECT 0x0001
#define FLT_PORT_ALL_ACCESS (FLT_PORT_CONNECT | STANDARD_RIGHTS_ALL)
//
// VDM
//
typedef enum _VDMSERVICECLASS
{
@@ -42,7 +39,69 @@ NtVdmControl(
_Inout_ PVOID ServiceData
);
//
// Sessions
//
typedef enum _IO_SESSION_EVENT
{
IoSessionEventIgnore,
IoSessionEventCreated,
IoSessionEventTerminated,
IoSessionEventConnected,
IoSessionEventDisconnected,
IoSessionEventLogon,
IoSessionEventLogoff,
IoSessionEventMax
} IO_SESSION_EVENT;
typedef enum _IO_SESSION_STATE
{
IoSessionStateCreated = 1,
IoSessionStateInitialized = 2,
IoSessionStateConnected = 3,
IoSessionStateDisconnected = 4,
IoSessionStateDisconnectedLoggedOn = 5,
IoSessionStateLoggedOn = 6,
IoSessionStateLoggedOff = 7,
IoSessionStateTerminated = 8,
IoSessionStateMax
} IO_SESSION_STATE;
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenSession(
_Out_ PHANDLE SessionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtNotifyChangeSession(
_In_ HANDLE SessionHandle,
_In_ ULONG ChangeSequenceNumber,
_In_ PLARGE_INTEGER ChangeTimeStamp,
_In_ IO_SESSION_EVENT Event,
_In_ IO_SESSION_STATE NewState,
_In_ IO_SESSION_STATE PreviousState,
_In_reads_bytes_opt_(PayloadSize) PVOID Payload,
_In_ ULONG PayloadSize
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_7)
//
// ApiSet
//
NTSYSAPI
BOOL
@@ -70,6 +129,7 @@ typedef enum _SECURE_SETTING_VALUE_TYPE
SecureSettingValueTypeUnknown = 4
} SECURE_SETTING_VALUE_TYPE, *PSECURE_SETTING_VALUE_TYPE;
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1)
// rev
NTSYSCALLAPI
NTSTATUS
@@ -82,7 +142,9 @@ NtQuerySecurityPolicy(
_Out_writes_bytes_opt_(*ValueSize) PVOID Value,
_Inout_ PULONG ValueSize
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1)
// rev
NTSYSCALLAPI
NTSTATUS
@@ -129,7 +191,9 @@ NtDirectGraphicsCall(
_Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
_Out_ PULONG ReturnLength
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_10_20H1)
#if (PHNT_VERSION >= PHNT_WINDOWS_11_22H2)
// rev
NTSYSCALLAPI
NTSTATUS
@@ -163,8 +227,12 @@ NtSetInformationCpuPartition(
_Reserved_ ULONG,
_Reserved_ ULONG
);
#endif
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS2)
//
// Process KeepAlive (also WakeCounter)
//
typedef enum _PROCESS_ACTIVITY_TYPE
{
@@ -182,4 +250,405 @@ NtAcquireProcessActivityReference(
_Reserved_ PROCESS_ACTIVITY_TYPE Reserved
);
#endif // (PHNT_VERSION >= PHNT_WINDOWS_10_RS2)
//
// Appx/Msix Packages
//
// private
typedef struct _PACKAGE_CONTEXT_REFERENCE
{
PVOID reserved;
} *PACKAGE_CONTEXT_REFERENCE;
// private
typedef enum PackageProperty
{
PackageProperty_Name = 1, // q: WCHAR[]
PackageProperty_Version = 2, // q: WCHAR[]
PackageProperty_Architecture = 3, // q: ULONG (PROCESSOR_ARCHITECTURE_*)
PackageProperty_ResourceId = 4, // q: WCHAR[]
PackageProperty_Publisher = 5, // q: WCHAR[]
PackageProperty_PublisherId = 6, // q: WCHAR[]
PackageProperty_FamilyName = 7, // q: WCHAR[]
PackageProperty_FullName = 8, // q: WCHAR[]
PackageProperty_Flags = 9, // q: ULONG
PackageProperty_InstalledLocation = 10, // q: WCHAR[]
PackageProperty_DisplayName = 11, // q: WCHAR[]
PackageProperty_PublisherDisplayName = 12, // q: WCHAR[]
PackageProperty_Description = 13, // q: WCHAR[]
PackageProperty_Logo = 14, // q: WCHAR[]
PackageProperty_PackageOrigin = 15 // q: PackageOrigin
} PackageProperty;
// private
typedef struct _PACKAGE_APPLICATION_CONTEXT_REFERENCE
{
PVOID reserved;
} *PACKAGE_APPLICATION_CONTEXT_REFERENCE;
// private
typedef enum PackageApplicationProperty
{
PackageApplicationProperty_Aumid = 1, // q: WCHAR[]
PackageApplicationProperty_Praid = 2, // q: WCHAR[]
PackageApplicationProperty_DisplayName = 3, // q: WCHAR[]
PackageApplicationProperty_Description = 4, // q: WCHAR[]
PackageApplicationProperty_Logo = 5, // q: WCHAR[]
PackageApplicationProperty_SmallLogo = 6, // q: WCHAR[]
PackageApplicationProperty_ForegroundText = 7, // q: ULONG
PackageApplicationProperty_ForegroundTextString = 8, // q: WCHAR[]
PackageApplicationProperty_BackgroundColor = 9, // q: ULONG
PackageApplicationProperty_StartPage = 10, // q: WCHAR[]
PackageApplicationProperty_ContentURIRulesCount = 11, // q: ULONG
PackageApplicationProperty_ContentURIRules = 12, // q: WCHAR[] (multi-sz)
PackageApplicationProperty_StaticContentURIRulesCount = 13, // q: ULONG
PackageApplicationProperty_StaticContentURIRules = 14, // q: WCHAR[] (multi-sz)
PackageApplicationProperty_DynamicContentURIRulesCount = 15, // q: ULONG
PackageApplicationProperty_DynamicContentURIRules = 16 // q: WCHAR[] (multi-sz)
} PackageApplicationProperty;
// private
typedef struct _PACKAGE_RESOURCES_CONTEXT_REFERENCE
{
PVOID reserved;
} *PACKAGE_RESOURCES_CONTEXT_REFERENCE;
// private
typedef enum PackageResourcesProperty
{
PackageResourcesProperty_DisplayName = 1,
PackageResourcesProperty_PublisherDisplayName = 2,
PackageResourcesProperty_Description = 3,
PackageResourcesProperty_Logo = 4,
PackageResourcesProperty_SmallLogo = 5,
PackageResourcesProperty_StartPage = 6
} PackageResourcesProperty;
// private
typedef struct _PACKAGE_SECURITY_CONTEXT_REFERENCE
{
PVOID reserved;
} *PACKAGE_SECURITY_CONTEXT_REFERENCE;
// private
typedef enum PackageSecurityProperty
{
PackageSecurityProperty_SecurityFlags = 1, // q: ULONG
PackageSecurityProperty_AppContainerSID = 2, // q: Sid
PackageSecurityProperty_CapabilitiesCount = 3, // q: ULONG
PackageSecurityProperty_Capabilities = 4 // q: Sid[]
} PackageSecurityProperty;
// private
typedef struct _TARGET_PLATFORM_CONTEXT_REFERENCE
{
PVOID reserved;
} *TARGET_PLATFORM_CONTEXT_REFERENCE;
// private
typedef enum TargetPlatformProperty
{
TargetPlatformProperty_Platform = 1, // q: ULONG
TargetPlatformProperty_MinVersion = 2, // q: PACKAGE_VERSION
TargetPlatformProperty_MaxVersion = 3 // q: PACKAGE_VERSION
} TargetPlatformProperty;
// private
typedef struct _PACKAGE_GLOBALIZATION_CONTEXT_REFERENCE
{
PVOID reserved;
} *PACKAGE_GLOBALIZATION_CONTEXT_REFERENCE;
// private
typedef enum PackageGlobalizationProperty
{
PackageGlobalizationProperty_ForceUtf8 = 1, // q: ULONG
PackageGlobalizationProperty_UseWindowsDisplayLanguage = 2 // q: ULONG
} PackageGlobalizationProperty;
#if (PHNT_VERSION >= PHNT_WINDOWS_8_1)
// rev
WINBASEAPI
ULONG
WINAPI
GetCurrentPackageContext(
_In_ ULONG Index,
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_CONTEXT_REFERENCE *PackageContext
);
// rev
WINBASEAPI
ULONG
WINAPI
GetPackageContext(
_In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE
_In_ ULONG Index,
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_CONTEXT_REFERENCE *PackageContext
);
// rev
WINBASEAPI
ULONG
WINAPI
GetPackageProperty(
_In_ PACKAGE_CONTEXT_REFERENCE PackageContext,
_In_ PackageProperty PropertyId,
_Inout_ PULONG BufferSize,
_Out_writes_bytes_(BufferSize) PVOID Buffer
);
// rev
WINBASEAPI
ULONG
WINAPI
GetPackagePropertyString(
_In_ PACKAGE_CONTEXT_REFERENCE PackageContext,
_In_ PackageProperty PropertyId,
_Inout_ PULONG BufferLength,
_Out_writes_(BufferLength) PWSTR Buffer
);
// rev
WINBASEAPI
ULONG
WINAPI
GetPackageOSMaxVersionTested(
_In_ PACKAGE_CONTEXT_REFERENCE PackageContext,
_Out_ ULONGLONG *OSMaxVersionTested // PACKAGE_VERSION
);
//
// Package Application Properties
//
// rev
WINBASEAPI
ULONG
WINAPI
GetCurrentPackageApplicationContext(
_In_ ULONG Index,
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_APPLICATION_CONTEXT_REFERENCE *PackageApplicationContext
);
// rev
WINBASEAPI
ULONG
WINAPI
GetPackageApplicationContext(
_In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE
_In_ ULONG Index,
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_APPLICATION_CONTEXT_REFERENCE *PackageApplicationContext
);
// rev
WINBASEAPI
ULONG
WINAPI
GetPackageApplicationProperty(
_In_ PACKAGE_APPLICATION_CONTEXT_REFERENCE PackageApplicationContext,
_In_ PackageApplicationProperty PropertyId,
_Inout_ PULONG BufferSize,
_Out_writes_bytes_(BufferSize) PVOID Buffer
);
// rev
WINBASEAPI
ULONG
WINAPI
GetPackageApplicationPropertyString(
_In_ PACKAGE_APPLICATION_CONTEXT_REFERENCE PackageApplicationContext,
_In_ PackageApplicationProperty PropertyId,
_Inout_ PULONG BufferLength,
_Out_writes_(BufferLength) PWSTR Buffer
);
//
// Package Resource Properties
//
// rev
WINBASEAPI
ULONG
WINAPI
GetCurrentPackageResourcesContext(
_In_ ULONG Index,
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_RESOURCES_CONTEXT_REFERENCE *PackageResourcesContext
);
// rev
WINBASEAPI
ULONG
WINAPI
GetPackageResourcesContext(
_In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE
_In_ ULONG Index,
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_RESOURCES_CONTEXT_REFERENCE *PackageResourcesContext
);
// rev
WINBASEAPI
ULONG
WINAPI
GetCurrentPackageApplicationResourcesContext(
_In_ ULONG Index,
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_APPLICATION_CONTEXT_REFERENCE *PackageResourcesContext
);
// rev
WINBASEAPI
LONG
WINAPI
GetPackageApplicationResourcesContext(
_In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE
_In_ ULONG Index,
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_APPLICATION_CONTEXT_REFERENCE *PackageResourcesContext
);
// rev
WINBASEAPI
LONG
WINAPI
GetPackageResourcesProperty(
_In_ PACKAGE_APPLICATION_CONTEXT_REFERENCE PackageResourcesContext,
_In_ PackageResourcesProperty PropertyId,
_Inout_ PULONG BufferSize,
_Out_writes_bytes_(BufferSize) PVOID Buffer
);
//
// Package Security Properties
//
// rev
WINBASEAPI
LONG
WINAPI
GetCurrentPackageSecurityContext(
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_SECURITY_CONTEXT_REFERENCE *PackageSecurityContext
);
// rev
WINBASEAPI
LONG
WINAPI
GetPackageSecurityContext(
_In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_SECURITY_CONTEXT_REFERENCE *PackageSecurityContext
);
// rev
WINBASEAPI
LONG
WINAPI
GetPackageSecurityProperty(
_In_ PACKAGE_SECURITY_CONTEXT_REFERENCE PackageSecurityContext,
_In_ PackageSecurityProperty PropertyId,
_Inout_ PULONG BufferSize,
_Out_writes_bytes_(BufferSize) PVOID Buffer
);
#endif // PHNT_VERSION >= PHNT_WINDOWS_8_1
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
//
// Target Platform Properties
//
// rev
WINBASEAPI
LONG
WINAPI
GetCurrentTargetPlatformContext(
_Reserved_ ULONG_PTR Unused,
_Out_ TARGET_PLATFORM_CONTEXT_REFERENCE *TargetPlatformContext
);
WINBASEAPI
LONG
WINAPI
GetTargetPlatformContext(
_In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE
_Reserved_ ULONG_PTR Unused,
_Out_ TARGET_PLATFORM_CONTEXT_REFERENCE *TargetPlatformContext
);
// rev
WINBASEAPI
LONG
WINAPI
GetPackageTargetPlatformProperty(
_In_ TARGET_PLATFORM_CONTEXT_REFERENCE TargetPlatformContext,
_In_ TargetPlatformProperty PropertyId,
_Inout_ PULONG BufferSize,
_Out_writes_bytes_(BufferSize) PVOID Buffer
);
#endif // PHNT_VERSION >= PHNT_WINDOWS_10
#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1)
// rev
WINBASEAPI
HRESULT
WINAPI
GetCurrentPackageInfo3(
_In_ ULONG flags,
_In_ ULONG packagePathType, // PackagePathType
_Inout_ PULONG bufferLength,
_Out_writes_bytes_opt_(*bufferLength) PVOID buffer,
_Out_opt_ PULONG count
);
//
// Package Globalization Properties
//
// rev
WINBASEAPI
LONG
WINAPI
GetCurrentPackageGlobalizationContext(
_In_ ULONG Index,
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_GLOBALIZATION_CONTEXT_REFERENCE *PackageGlobalizationContext
);
// rev
WINBASEAPI
LONG
WINAPI
GetPackageGlobalizationContext(
_In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE
_In_ ULONG Index,
_Reserved_ ULONG_PTR Unused,
_Out_ PACKAGE_GLOBALIZATION_CONTEXT_REFERENCE *PackageGlobalizationContext
);
// rev
WINBASEAPI
LONG
WINAPI
GetPackageGlobalizationProperty(
_In_ PACKAGE_GLOBALIZATION_CONTEXT_REFERENCE PackageGlobalizationContext,
_In_ PackageGlobalizationProperty PropertyId,
_Inout_ PULONG BufferSize,
_Out_writes_bytes_(BufferSize) PVOID Buffer
);
#endif // PHNT_VERSION >= PHNT_WINDOWS_10_20H1
#endif
ntmmapi.h
+76 -15
View File
@@ -248,8 +248,8 @@ typedef union _MEMORY_WORKING_SET_EX_BLOCK
ULONG_PTR Reserved : 3;
ULONG_PTR SharedOriginal : 1; // If this bit is 1, the page was not modified.
ULONG_PTR Bad : 1; // If this bit is 1, the page is has been reported as bad.
ULONG_PTR Win32GraphicsProtection : 4; // The memory protection attributes of the page. // since 19H1
#ifdef _WIN64
ULONG_PTR Win32GraphicsProtection : 4; // The memory protection attributes of the page. // since 19H1
ULONG_PTR ReservedUlong : 28;
#endif
};
@@ -528,7 +528,7 @@ typedef struct _MEMORY_FRAME_INFORMATION
ULONGLONG Priority : 3;
ULONGLONG NonTradeable : 1;
ULONGLONG Reserved : 3;
} MEMORY_FRAME_INFORMATION;
} MEMORY_FRAME_INFORMATION, *PMEMORY_FRAME_INFORMATION;
// private
typedef struct _FILEOFFSET_INFORMATION
@@ -536,7 +536,7 @@ typedef struct _FILEOFFSET_INFORMATION
ULONGLONG DontUse : 9; // MEMORY_FRAME_INFORMATION overlay
ULONGLONG Offset : 48; // mapped files
ULONGLONG Reserved : 7;
} FILEOFFSET_INFORMATION;
} FILEOFFSET_INFORMATION, *PFILEOFFSET_INFORMATION;
// private
typedef struct _PAGEDIR_INFORMATION
@@ -544,7 +544,7 @@ typedef struct _PAGEDIR_INFORMATION
ULONGLONG DontUse : 9; // MEMORY_FRAME_INFORMATION overlay
ULONGLONG PageDirectoryBase : 48; // private pages
ULONGLONG Reserved : 7;
} PAGEDIR_INFORMATION;
} PAGEDIR_INFORMATION, *PPAGEDIR_INFORMATION;
// private
typedef struct _UNIQUE_PROCESS_INFORMATION
@@ -716,7 +716,7 @@ NtAllocateVirtualMemory(
_In_ ULONG PageProtection
);
#if (PHNT_VERSION >= PHNT_REDSTONE5)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS5)
_Must_inspect_result_
_When_(return == 0, __drv_allocatesMem(mem))
NTSYSCALLAPI
@@ -785,7 +785,7 @@ NtWow64ReadVirtualMemory64(
_Out_opt_ PULONGLONG NumberOfBytesRead
);
#if (PHNT_VERSION >= PHNT_WIN11)
#if (PHNT_VERSION >= PHNT_WINDOWS_11)
/**
* Reads virtual memory from a process with extended options.
*
@@ -949,7 +949,7 @@ NtFlushVirtualMemory(
typedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS
{
VmPrefetchInformation, // MEMORY_PREFETCH_INFORMATION
VmPagePriorityInformation, // OFFER_PRIORITY
VmPagePriorityInformation, // MEMORY_PAGE_PRIORITY_INFORMATION
VmCfgCallTargetInformation, // CFG_CALL_TARGET_LIST_INFORMATION // REDSTONE2
VmPageDirtyStateInformation, // REDSTONE3
VmImageHotPatchInformation, // 19H1
@@ -984,6 +984,26 @@ typedef struct _MEMORY_PREFETCH_INFORMATION
ULONG Flags;
} MEMORY_PREFETCH_INFORMATION, *PMEMORY_PREFETCH_INFORMATION;
//
// Page/memory priorities.
//
#define MEMORY_PRIORITY_LOWEST 0
#define MEMORY_PRIORITY_VERY_LOW 1
#define MEMORY_PRIORITY_LOW 2
#define MEMORY_PRIORITY_MEDIUM 3
#define MEMORY_PRIORITY_BELOW_NORMAL 4
#define MEMORY_PRIORITY_NORMAL 5
#define MEMORY_PRIORITY_ABOVE_NORMAL 6 // rev
#define MEMORY_PRIORITY_HIGH 7 // rev
// VmPagePriorityInformation
typedef struct _MEMORY_PAGE_PRIORITY_INFORMATION
{
ULONG PagePriority;
} MEMORY_PAGE_PRIORITY_INFORMATION, *PMEMORY_PAGE_PRIORITY_INFORMATION;
// VmCfgCallTargetInformation
typedef struct _CFG_CALL_TARGET_LIST_INFORMATION
{
ULONG NumberOfEntries;
@@ -998,7 +1018,7 @@ typedef struct _CFG_CALL_TARGET_LIST_INFORMATION
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
@@ -1056,7 +1076,7 @@ NtCreateSection(
_In_opt_ HANDLE FileHandle
);
#if (PHNT_VERSION >= PHNT_REDSTONE5)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS5)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1098,7 +1118,7 @@ NtMapViewOfSection(
_In_ ULONG PageProtection
);
#if (PHNT_VERSION >= PHNT_REDSTONE5)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS5)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1123,7 +1143,7 @@ NtUnmapViewOfSection(
_In_opt_ PVOID BaseAddress
);
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1163,7 +1183,21 @@ NtAreMappedFilesTheSame(
#endif
// Partitions
//
// Memory Partitions
//
#ifndef MEMORY_CURRENT_PARTITION_HANDLE
#define MEMORY_CURRENT_PARTITION_HANDLE ((HANDLE)(LONG_PTR)-1)
#endif
#ifndef MEMORY_SYSTEM_PARTITION_HANDLE
#define MEMORY_SYSTEM_PARTITION_HANDLE ((HANDLE)(LONG_PTR)-2)
#endif
#ifndef MEMORY_EXISTING_VAD_PARTITION_HANDLE
#define MEMORY_EXISTING_VAD_PARTITION_HANDLE ((HANDLE)(LONG_PTR)-3)
#endif
#ifndef MEMORY_PARTITION_QUERY_ACCESS
#define MEMORY_PARTITION_QUERY_ACCESS 0x0001
@@ -1298,7 +1332,7 @@ typedef struct _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
NTSYSCALLAPI
NTSTATUS
@@ -1366,7 +1400,7 @@ NtAllocateUserPhysicalPages(
_Out_writes_(*NumberOfPages) PULONG_PTR UserPfnArray
);
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1390,10 +1424,25 @@ NtFreeUserPhysicalPages(
#endif
//
// Misc.
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* Retrieves the addresses of the pages that are written to in a region of virtual memory.
*
* @param ProcessHandle A handle to the process whose watch information is to be queried.
* @param Flags Additional flags for the operation. To reset the write-tracking state, set this parameter to WRITE_WATCH_FLAG_RESET. Otherwise, set this parameter to zero.
* @param BaseAddress The base address of the memory region for which to retrieve write-tracking information. This address must a region that is allocated using MEM_WRITE_WATCH.
* @param RegionSize The size of the memory region for which to retrieve write-tracking information, in bytes.
* @param UserAddressArray A pointer to a buffer that receives an array of page addresses that have been written to since the region has been allocated or the write-tracking state has been reset.
* @param EntriesInUserAddressArray On input, this variable indicates the size of the UserAddressArray array. On output, the variable receives the number of page addresses that are returned in the array.
* @param Granularity A pointer to a variable that receives the page size, in bytes.
* @return NTSTATUS Successful or errant status.
* @see https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-getwritewatch
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1407,6 +1456,15 @@ NtGetWriteWatch(
_Out_ PULONG Granularity
);
/**
* Resets the write-tracking state for a region of virtual memory.
*
* @param ProcessHandle A handle to the process whose watch information is to be reset.
* @param BaseAddress A pointer to the base address of the memory region for which to reset the write-tracking state.
* @param RegionSize The size of the memory region for which to reset the write-tracking information, in bytes.
* @return NTSTATUS Successful or errant status.
* @see https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-resetwritewatch
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -1444,8 +1502,11 @@ NtFlushWriteBuffer(
#endif
#if (PHNT_VERSION >= PHNT_THRESHOLD)
//
// Enclave support
//
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
NTSYSCALLAPI
NTSTATUS
ntobapi.h
+5 -5
View File
@@ -214,7 +214,7 @@ NtWaitForMultipleObjects(
_In_opt_ PLARGE_INTEGER Timeout
);
#if (PHNT_VERSION >= PHNT_WS03)
#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -254,7 +254,7 @@ NtClose(
_In_ _Post_ptr_invalid_ HANDLE Handle
);
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -279,7 +279,7 @@ NtCreateDirectoryObject(
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -369,7 +369,7 @@ typedef struct _OBJECT_BOUNDARY_DESCRIPTOR
//OBJECT_BOUNDARY_ENTRY Entries[1];
} OBJECT_BOUNDARY_DESCRIPTOR, *POBJECT_BOUNDARY_DESCRIPTOR;
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
@@ -441,7 +441,7 @@ typedef enum _SYMBOLIC_LINK_INFO_CLASS
MaxnSymbolicLinkInfoClass
} SYMBOLIC_LINK_INFO_CLASS;
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
NTSYSCALLAPI
NTSTATUS
NTAPI
ntpebteb.h
+53 -15
View File
@@ -402,7 +402,45 @@ typedef struct _PEB
//
// Global flags for the system.
//
ULONG NtGlobalFlag;
union
{
ULONG NtGlobalFlag;
struct
{
ULONG StopOnException : 1; // FLG_STOP_ON_EXCEPTION
ULONG ShowLoaderSnaps : 1; // FLG_SHOW_LDR_SNAPS
ULONG DebugInitialCommand : 1; // FLG_DEBUG_INITIAL_COMMAND
ULONG StopOnHungGUI : 1; // FLG_STOP_ON_HUNG_GUI
ULONG HeapEnableTailCheck : 1; // FLG_HEAP_ENABLE_TAIL_CHECK
ULONG HeapEnableFreeCheck : 1; // FLG_HEAP_ENABLE_FREE_CHECK
ULONG HeapValidateParameters : 1; // FLG_HEAP_VALIDATE_PARAMETERS
ULONG HeapValidateAll : 1; // FLG_HEAP_VALIDATE_ALL
ULONG ApplicationVerifier : 1; // FLG_APPLICATION_VERIFIER
ULONG MonitorSilentProcessExit : 1; // FLG_MONITOR_SILENT_PROCESS_EXIT
ULONG PoolEnableTagging : 1; // FLG_POOL_ENABLE_TAGGING
ULONG HeapEnableTagging : 1; // FLG_HEAP_ENABLE_TAGGING
ULONG UserStackTraceDb : 1; // FLG_USER_STACK_TRACE_DB
ULONG KernelStackTraceDb : 1; // FLG_KERNEL_STACK_TRACE_DB
ULONG MaintainObjectTypeList : 1; // FLG_MAINTAIN_OBJECT_TYPELIST
ULONG HeapEnableTagByDll : 1; // FLG_HEAP_ENABLE_TAG_BY_DLL
ULONG DisableStackExtension : 1; // FLG_DISABLE_STACK_EXTENSION
ULONG EnableCsrDebug : 1; // FLG_ENABLE_CSRDEBUG
ULONG EnableKDebugSymbolLoad : 1; // FLG_ENABLE_KDEBUG_SYMBOL_LOAD
ULONG DisablePageKernelStacks : 1; // FLG_DISABLE_PAGE_KERNEL_STACKS
ULONG EnableSystemCritBreaks : 1; // FLG_ENABLE_SYSTEM_CRIT_BREAKS
ULONG HeapDisableCoalescing : 1; // FLG_HEAP_DISABLE_COALESCING
ULONG EnableCloseExceptions : 1; // FLG_ENABLE_CLOSE_EXCEPTIONS
ULONG EnableExceptionLogging : 1; // FLG_ENABLE_EXCEPTION_LOGGING
ULONG EnableHandleTypeTagging : 1; // FLG_ENABLE_HANDLE_TYPE_TAGGING
ULONG HeapPageAllocs : 1; // FLG_HEAP_PAGE_ALLOCS
ULONG DebugInitialCommandEx : 1; // FLG_DEBUG_INITIAL_COMMAND_EX
ULONG DisableDbgPrint : 1; // FLG_DISABLE_DBGPRINT
ULONG CritSecEventCreation : 1; // FLG_CRITSEC_EVENT_CREATION
ULONG LdrTopDown : 1; // FLG_LDR_TOP_DOWN
ULONG EnableHandleExceptions : 1; // FLG_ENABLE_HANDLE_EXCEPTIONS
ULONG DisableProtDlls : 1; // FLG_DISABLE_PROTDLLS
} NtGlobalFlags;
};
//
// Timeout for critical sections.
@@ -754,17 +792,17 @@ typedef struct _PEB
} PEB, * PPEB;
#ifdef _WIN64
static_assert(FIELD_OFFSET(PEB, SessionId) == 0x2C0);
//static_assert(sizeof(PEB) == 0x7B0); // REDSTONE3
//static_assert(sizeof(PEB) == 0x7B8); // REDSTONE4
//static_assert(sizeof(PEB) == 0x7C8); // REDSTONE5 // 19H1
static_assert(sizeof(PEB) == 0x7d0); // WIN11
static_assert(FIELD_OFFSET(PEB, SessionId) == 0x2C0, "FIELD_OFFSET(PEB, SessionId) is incorrect");
//static_assert(sizeof(PEB) == 0x7B0, "Size of PEB is incorrect"); // REDSTONE3
//static_assert(sizeof(PEB) == 0x7B8, "Size of PEB is incorrect"); // REDSTONE4
//static_assert(sizeof(PEB) == 0x7C8, "Size of PEB is incorrect"); // REDSTONE5 // 19H1
static_assert(sizeof(PEB) == 0x7d0, "Size of PEB is incorrect"); // WIN11
#else
static_assert(FIELD_OFFSET(PEB, SessionId) == 0x1D4);
//static_assert(sizeof(PEB) == 0x468); // REDSTONE3
//static_assert(sizeof(PEB) == 0x470); // REDSTONE4
//static_assert(sizeof(PEB) == 0x480); // REDSTONE5 // 19H1
static_assert(sizeof(PEB) == 0x488); // WIN11
static_assert(FIELD_OFFSET(PEB, SessionId) == 0x1D4, "FIELD_OFFSET(PEB, SessionId) is incorrect");
//static_assert(sizeof(PEB) == 0x468, "Size of PEB is incorrect"); // REDSTONE3
//static_assert(sizeof(PEB) == 0x470, "Size of PEB is incorrect"); // REDSTONE4
//static_assert(sizeof(PEB) == 0x480, "Size of PEB is incorrect"); // REDSTONE5 // 19H1
static_assert(sizeof(PEB) == 0x488, "Size of PEB is incorrect"); // WIN11
#endif
#define GDI_BATCH_BUFFER_SIZE 310
@@ -1240,11 +1278,11 @@ typedef struct _TEB
} TEB, *PTEB;
#ifdef _WIN64
//static_assert(sizeof(TEB) == 0x1850); // WIN11
static_assert(sizeof(TEB) == 0x1878); // 24H2
//static_assert(sizeof(TEB) == 0x1850, "Size of TEB is incorrect"); // WIN11
static_assert(sizeof(TEB) == 0x1878, "Size of TEB is incorrect"); // 24H2
#else
//static_assert(sizeof(TEB) == 0x1018); // WIN11
static_assert(sizeof(TEB) == 0x1038); // 24H2
//static_assert(sizeof(TEB) == 0x1018, "Size of TEB is incorrect"); // WIN11
static_assert(sizeof(TEB) == 0x1038, "Size of TEB is incorrect"); // 24H2
#endif
#endif
ntpnpapi.h
+3 -3
View File
@@ -149,7 +149,7 @@ typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE
DeviceUsageTypeGuestAssigned
} DEVICE_USAGE_NOTIFICATION_TYPE, *PDEVICE_USAGE_NOTIFICATION_TYPE;
#if (PHNT_VERSION < PHNT_WIN8)
#if (PHNT_VERSION < PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -170,7 +170,7 @@ NtPlugPlayControl(
_In_ ULONG PnPControlDataLength
);
#if (PHNT_VERSION >= PHNT_WIN7)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
NTSYSCALLAPI
NTSTATUS
@@ -195,7 +195,7 @@ NtDisableLastKnownGood(
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
ntpoapi.h
+6 -5
View File
@@ -108,7 +108,8 @@
#define SessionAllowExternalDmaDevices 95 // POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES
#define SendSuspendResumeNotification 96 // since WIN11
#define BlackBoxRecorderDirectAccessBuffer 97
#define PowerInformationLevelMaximum 98
#define SystemPowerSourceState 98 // since 25H2
#define PowerInformationLevelMaximum 99
#endif
typedef struct _PROCESSOR_POWER_INFORMATION
@@ -544,7 +545,7 @@ typedef struct _POWER_REQUEST
ULONG PowerRequestCount[POWER_REQUEST_SUPPORTED_TYPES_V1];
DIAGNOSTIC_BUFFER DiagnosticBuffer;
} V1;
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
struct
{
ULONG SupportedRequestMask;
@@ -552,7 +553,7 @@ typedef struct _POWER_REQUEST
DIAGNOSTIC_BUFFER DiagnosticBuffer;
} V2;
#endif
#if (PHNT_VERSION >= PHNT_WINBLUE)
#if (PHNT_VERSION >= PHNT_WINDOWS_8_1)
struct
{
ULONG SupportedRequestMask;
@@ -560,7 +561,7 @@ typedef struct _POWER_REQUEST
DIAGNOSTIC_BUFFER DiagnosticBuffer;
} V3;
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1)
struct
{
ULONG SupportedRequestMask;
@@ -916,7 +917,7 @@ NtSetThreadExecutionState(
_Out_ EXECUTION_STATE *PreviousFlags
);
#if (PHNT_VERSION < PHNT_WIN7)
#if (PHNT_VERSION < PHNT_WINDOWS_7)
/**
* Requests the system resume latency.
*
ntpsapi.h
+57 -29
View File
@@ -59,7 +59,7 @@
#define PROCESS_SET_LIMITED_INFORMATION 0x2000
#endif
#ifndef PROCESS_ALL_ACCESS
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
#define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | SPECIFIC_RIGHTS_ALL)
#else
#define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFF)
@@ -110,7 +110,7 @@
#define THREAD_RESUME 0x1000
#endif
#ifndef THREAD_ALL_ACCESS
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
#define THREAD_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | SPECIFIC_RIGHTS_ALL)
#else
#define THREAD_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3FF)
@@ -137,7 +137,7 @@
#define JOB_OBJECT_SET_SECURITY_ATTRIBUTES 0x0010
#endif
#ifndef JOB_OBJECT_ALL_ACCESS
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
#define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3F)
#else
#define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1f) // pre-Vista full access
@@ -233,7 +233,7 @@ typedef enum _PROCESSINFOCLASS
ProcessHandleCheckingMode, // qs: ULONG; s: 0 disables, otherwise enables
ProcessKeepAliveCount, // q: PROCESS_KEEPALIVE_COUNT_INFORMATION
ProcessRevokeFileHandles, // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION
ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL (requires SeDebugPrivilege)
ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL
ProcessHandleTable, // q: ULONG[] // since WINBLUE
ProcessCheckStackExtentsMode, // qs: ULONG // KPROCESS->CheckStackExtents (CFG)
ProcessCommandLineInformation, // q: UNICODE_STRING // 60
@@ -292,6 +292,8 @@ typedef enum _PROCESSINFOCLASS
ProcessSlistRollbackInformation,
ProcessNetworkIoCounters, // q: PROCESS_NETWORK_COUNTERS
ProcessFindFirstThreadByTebValue, // PROCESS_TEB_VALUE_INFORMATION
ProcessEnclaveAddressSpaceRestriction, // since 25H2
ProcessAvailableCpus,
MaxProcessInfoClass
} PROCESSINFOCLASS;
#endif
@@ -338,26 +340,26 @@ typedef enum _THREADINFOCLASS
ThreadHeterogeneousCpuPolicy, // q: KHETERO_CPU_POLICY // since THRESHOLD
ThreadContainerId, // q: GUID
ThreadNameInformation, // qs: THREAD_NAME_INFORMATION (requires THREAD_SET_LIMITED_INFORMATION)
ThreadSelectedCpuSets,
ThreadSelectedCpuSets, // q: ULONG[]
ThreadSystemThreadInformation, // q: SYSTEM_THREAD_INFORMATION // 40
ThreadActualGroupAffinity, // q: GROUP_AFFINITY // since THRESHOLD2
ThreadDynamicCodePolicyInfo, // q: ULONG; s: ULONG (NtCurrentThread)
ThreadExplicitCaseSensitivity, // qs: ULONG; s: 0 disables, otherwise enables
ThreadExplicitCaseSensitivity, // qs: ULONG; s: 0 disables, otherwise enables // (requires SeDebugPrivilege and PsProtectedSignerAntimalware)
ThreadWorkOnBehalfTicket, // RTL_WORK_ON_BEHALF_TICKET_EX
ThreadSubsystemInformation, // q: SUBSYSTEM_INFORMATION_TYPE // since REDSTONE2
ThreadDbgkWerReportActive, // s: ULONG; s: 0 disables, otherwise enables
ThreadAttachContainer, // s: HANDLE (job object) // NtCurrentThread
ThreadManageWritesToExecutableMemory, // MANAGE_WRITES_TO_EXECUTABLE_MEMORY // since REDSTONE3
ThreadPowerThrottlingState, // POWER_THROTTLING_THREAD_STATE // since REDSTONE3 (set), WIN11 22H2 (query)
ThreadPowerThrottlingState, // qs: POWER_THROTTLING_THREAD_STATE // since REDSTONE3 (set), WIN11 22H2 (query)
ThreadWorkloadClass, // THREAD_WORKLOAD_CLASS // since REDSTONE5 // 50
ThreadCreateStateChange, // since WIN11
ThreadApplyStateChange,
ThreadStrongerBadHandleChecks, // since 22H1
ThreadStrongerBadHandleChecks, // s: ULONG // NtCurrentThread // since 22H1
ThreadEffectiveIoPriority, // q: IO_PRIORITY_HINT
ThreadEffectivePagePriority, // q: ULONG
ThreadUpdateLockOwnership, // THREAD_LOCK_OWNERSHIP // since 24H2
ThreadSchedulerSharedDataSlot, // SCHEDULER_SHARED_DATA_SLOT_INFORMATION
ThreadTebInformationAtomic, // THREAD_TEB_INFORMATION
ThreadTebInformationAtomic, // q: THREAD_TEB_INFORMATION (requires THREAD_GET_CONTEXT + THREAD_QUERY_INFORMATION)
ThreadIndexInformation, // THREAD_INDEX_INFORMATION
MaxThreadInfoClass
} THREADINFOCLASS;
@@ -1069,8 +1071,7 @@ typedef struct _PROCESS_REVOKE_FILE_HANDLES_INFORMATION
UNICODE_STRING TargetDevicePath;
} PROCESS_REVOKE_FILE_HANDLES_INFORMATION, *PPROCESS_REVOKE_FILE_HANDLES_INFORMATION;
// begin_private
// rev
#define PROCESS_WORKING_SET_CONTROL_VERSION 3
/**
@@ -1078,11 +1079,34 @@ typedef struct _PROCESS_REVOKE_FILE_HANDLES_INFORMATION
*/
typedef enum _PROCESS_WORKING_SET_OPERATION
{
ProcessWorkingSetSwap,
ProcessWorkingSetEmpty,
ProcessWorkingSetSwap, // Swap the working set of a process to disk. // (requires SeDebugPrivilege)
ProcessWorkingSetEmpty, // Remove all pages from the working set of a process.
ProcessWorkingSetEmptyPrivatePages, // Remove private pages from the working set of a process.
ProcessWorkingSetOperationMax
} PROCESS_WORKING_SET_OPERATION;
/**
* The PROCESS_WORKING_SET_FLAG_EMPTY_PRIVATE_PAGES flag indicates that the operation should target private pages in the working set.
* Private pages are those that are not shared with other processes.
*/
#define PROCESS_WORKING_SET_FLAG_EMPTY_PRIVATE_PAGES 0x01
/**
* The PROCESS_WORKING_SET_FLAG_EMPTY_SHARED_PAGES flag indicates that the operation should target shared pages in the working set.
* Shared pages are those that are shared between multiple processes.
*/
#define PROCESS_WORKING_SET_FLAG_EMPTY_SHARED_PAGES 0x02
/**
* The PROCESS_WORKING_SET_FLAG_COMPRESS flag indicates that the operation should compress the pages before they are removed from the working set.
* Compression is typically used in conjunction with other flags to specify that the pages should be compressed as part of the operation.
*/
#define PROCESS_WORKING_SET_FLAG_COMPRESS 0x08
/**
* The PROCESS_WORKING_SET_FLAG_STORE flag indicates that the operation should store the compressed pages.
* This is useful when the compressed data might be needed later, allowing for efficient retrieval and decompression when required.
* This flag is typically used in conjunction with the PROCESS_WORKING_SET_FLAG_COMPRESS flag to specify that the compressed pages should be stored.
*/
#define PROCESS_WORKING_SET_FLAG_STORE 0x10
/**
* The PROCESS_WORKING_SET_CONTROL structure is used to control the working set of a process.
*/
@@ -1232,9 +1256,11 @@ typedef struct _PROCESS_CHILD_PROCESS_INFORMATION
} PROCESS_CHILD_PROCESS_INFORMATION, *PPROCESS_CHILD_PROCESS_INFORMATION;
#define POWER_THROTTLING_PROCESS_CURRENT_VERSION 1
#define POWER_THROTTLING_PROCESS_EXECUTION_SPEED 0x1
#define POWER_THROTTLING_PROCESS_DELAYTIMERS 0x2
#define POWER_THROTTLING_PROCESS_IGNORE_TIMER_RESOLUTION 0x4 // since WIN11
#define POWER_THROTTLING_PROCESS_VALID_FLAGS \
((POWER_THROTTLING_PROCESS_EXECUTION_SPEED | POWER_THROTTLING_PROCESS_DELAYTIMERS | POWER_THROTTLING_PROCESS_IGNORE_TIMER_RESOLUTION))
@@ -1426,8 +1452,6 @@ typedef struct _PROCESS_TEB_VALUE_INFORMATION
ULONG_PTR Value;
} PROCESS_TEB_VALUE_INFORMATION, *PPROCESS_TEB_VALUE_INFORMATION;
// end_private
/**
* The NtQueryPortInformationProcess function retrieves the status of the current process exception port.
*
@@ -1440,7 +1464,7 @@ NtQueryPortInformationProcess(
VOID
);
#endif
#endif // PHNT_MODE != PHNT_MODE_KERNEL
//
// Thread information structures
@@ -1991,7 +2015,7 @@ NtSetInformationProcess(
#define PROCESS_GET_NEXT_FLAGS_PREVIOUS_PROCESS 0x00000001
#if (PHNT_VERSION >= PHNT_WS03)
#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003)
/**
* Retrieves a handle to the next process in the system.
*
@@ -2050,7 +2074,7 @@ typedef enum _PROCESS_STATE_CHANGE_TYPE
ProcessStateChangeMax,
} PROCESS_STATE_CHANGE_TYPE, *PPROCESS_STATE_CHANGE_TYPE;
#if (PHNT_VERSION >= PHNT_WIN11)
#if (PHNT_VERSION >= PHNT_WINDOWS_11)
/**
* Creates a state change handle for changing the suspension state of a process.
*
@@ -2103,7 +2127,7 @@ typedef enum _THREAD_STATE_CHANGE_TYPE
ThreadStateChangeMax,
} THREAD_STATE_CHANGE_TYPE, *PTHREAD_STATE_CHANGE_TYPE;
#if (PHNT_VERSION >= PHNT_WIN11)
#if (PHNT_VERSION >= PHNT_WINDOWS_11)
/**
* Creates a state change handle for changing the suspension state of a thread.
*
@@ -2245,6 +2269,7 @@ NtResumeThread(
_Out_opt_ PULONG PreviousSuspendCount
);
#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003)
/**
* Retrieves the number of the current processor.
*
@@ -2256,8 +2281,9 @@ NTAPI
NtGetCurrentProcessorNumber(
VOID
);
#endif
#if (PHNT_VERSION >= PHNT_WIN7)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
/**
* Retrieves the number of the current processor.
*
@@ -2381,7 +2407,7 @@ NtTestAlert(
VOID
);
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
// rev
/**
* Sends an alert to the specified thread.
@@ -2397,7 +2423,7 @@ NtAlertThreadByThreadId(
);
#endif
#if (PHNT_VERSION >= PHNT_WIN11)
#if (PHNT_VERSION >= PHNT_WINDOWS_11)
/**
* Sends an alert to the specified thread by its thread ID, with an optional lock.
*
@@ -2433,7 +2459,7 @@ NtAlertMultipleThreadByThreadId(
);
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
// rev
/**
* Waits for an alert to be delivered to the specified thread.
@@ -2579,7 +2605,7 @@ NtQueueApcThread(
*/
#define QUEUE_USER_APC_SPECIAL_USER_APC ((HANDLE)0x1)
#if (PHNT_VERSION >= PHNT_WIN7)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
/**
* Queues an APC (Asynchronous Procedure Call) to a thread.
*
@@ -2621,7 +2647,7 @@ typedef struct _APC_CALLBACK_DATA_CONTEXT
#define QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC 0x00000001
#define QUEUE_USER_APC_FLAGS_CALLBACK_DATA_CONTEXT 0x00010000 // APC_CALLBACK_DATA_CONTEXT
#if (PHNT_VERSION >= PHNT_WIN11)
#if (PHNT_VERSION >= PHNT_WINDOWS_11)
/**
* Queues an Asynchronous Procedure Call (APC) to a specified thread.
*
@@ -3173,6 +3199,7 @@ typedef struct _PS_CREATE_INFO
// end_private
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
/**
* Creates a new process and primary thread.
*
@@ -3258,6 +3285,7 @@ NtCreateThreadEx(
_In_ SIZE_T MaximumStackSize,
_In_opt_ PPS_ATTRIBUTE_LIST AttributeList
);
#endif
#endif
@@ -3653,7 +3681,7 @@ NtCreateJobSet(
_In_ ULONG Flags
);
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -3678,7 +3706,7 @@ typedef enum _MEMORY_RESERVE_TYPE
MemoryReserveTypeMax
} MEMORY_RESERVE_TYPE;
#if (PHNT_VERSION >= PHNT_WIN7)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
/**
* Allocates a memory reserve object.
*
@@ -3751,7 +3779,7 @@ typedef enum _PSSNT_QUERY_INFORMATION_CLASS
#define PSSNT_SIGNATURE_PSSD 'PSSD' // 0x50535344
#if (PHNT_VERSION >= PHNT_WINBLUE)
#if (PHNT_VERSION >= PHNT_WINDOWS_8_1)
// rev
/**
* Captures a snapshot of the specified process.
@@ -3862,7 +3890,7 @@ typedef struct _NTPSS_MEMORY_BULK_INFORMATION
PVOID NextValidAddress;
} NTPSS_MEMORY_BULK_INFORMATION, *PNTPSS_MEMORY_BULK_INFORMATION;
#if (PHNT_VERSION >= PHNT_20H1)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1)
// rev
/**
* Captures virtual address space bulk information for a process.
ntregapi.h
+16 -10
View File
@@ -609,7 +609,7 @@ NtCreateKey(
_Out_opt_ PULONG Disposition
);
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
/**
* Creates a new registry key or opens an existing one, and it associates the key with a transaction.
*
@@ -656,7 +656,7 @@ NtOpenKey(
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
/**
* Opens an existing registry key and associates the key with a transaction.
*
@@ -677,7 +677,7 @@ NtOpenKeyTransacted(
);
#endif
#if (PHNT_VERSION >= PHNT_WIN7)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
/**
* Opens an existing registry key with extended options.
*
@@ -990,6 +990,7 @@ NtLoadKey2(
_In_ ULONG Flags
);
#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003)
/**
* Loads a registry key from a file with extended options.
*
@@ -1016,8 +1017,9 @@ NtLoadKeyEx(
_Out_opt_ PHANDLE RootHandle,
_Reserved_ PVOID Reserved // previously PIO_STATUS_BLOCK
);
#endif
#if (PHNT_VERSION >= PHNT_20H1)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1)
// rev by tyranid
/**
* Loads a registry key from a file with extended parameters.
@@ -1143,6 +1145,7 @@ NtUnloadKey(
_In_ POBJECT_ATTRIBUTES TargetKey
);
#if PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003
/**
* Unloads a registry key with additional flags.
*
@@ -1158,6 +1161,7 @@ NtUnloadKey2(
_In_ POBJECT_ATTRIBUTES TargetKey,
_In_ ULONG Flags
);
#endif
/**
* Unloads a registry key and optionally signals an event.
@@ -1255,6 +1259,7 @@ NtQueryOpenSubKeys(
_Out_ PULONG HandleCount
);
#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003)
/**
* Queries the open subkeys of a registry key with additional information.
*
@@ -1274,6 +1279,7 @@ NtQueryOpenSubKeysEx(
_Out_writes_bytes_opt_(BufferLength) PVOID Buffer,
_Out_ PULONG RequiredSize
);
#endif
/**
* Initializes the registry.
@@ -1316,7 +1322,7 @@ NtLockProductActivationKeys(
_Out_opt_ ULONG *pSafeMode
);
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
/**
* Freezes the registry and prevents changes from being flushed to disk.
*
@@ -1331,7 +1337,7 @@ NtFreezeRegistry(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
/**
* Thaws the registry and enables flushing changes to disk.
*
@@ -1345,7 +1351,7 @@ NtThawRegistry(
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1)
/**
* Creates a registry transaction.
*
@@ -1363,7 +1369,7 @@ NTSTATUS NtCreateRegistryTransaction(
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1)
/**
* Opens a registry transaction.
*
@@ -1379,7 +1385,7 @@ NTSTATUS NtOpenRegistryTransaction(
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1)
/**
* Commits a registry transaction.
*
@@ -1393,7 +1399,7 @@ NTSTATUS NtCommitRegistryTransaction(
);
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1)
/**
* Rolls back a registry transaction.
*
ntrtl.h
+392 -330
View File
File diff suppressed because it is too large Load Diff
ntseapi.h
+117 -64
View File
@@ -12,42 +12,41 @@
//
#define SE_MIN_WELL_KNOWN_PRIVILEGE (2L)
#define SE_CREATE_TOKEN_PRIVILEGE (2L)
#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L)
#define SE_LOCK_MEMORY_PRIVILEGE (4L)
#define SE_INCREASE_QUOTA_PRIVILEGE (5L)
#define SE_MACHINE_ACCOUNT_PRIVILEGE (6L)
#define SE_TCB_PRIVILEGE (7L)
#define SE_SECURITY_PRIVILEGE (8L)
#define SE_TAKE_OWNERSHIP_PRIVILEGE (9L)
#define SE_LOAD_DRIVER_PRIVILEGE (10L)
#define SE_SYSTEM_PROFILE_PRIVILEGE (11L)
#define SE_SYSTEMTIME_PRIVILEGE (12L)
#define SE_PROF_SINGLE_PROCESS_PRIVILEGE (13L)
#define SE_INC_BASE_PRIORITY_PRIVILEGE (14L)
#define SE_CREATE_PAGEFILE_PRIVILEGE (15L)
#define SE_CREATE_PERMANENT_PRIVILEGE (16L)
#define SE_BACKUP_PRIVILEGE (17L)
#define SE_RESTORE_PRIVILEGE (18L)
#define SE_SHUTDOWN_PRIVILEGE (19L)
#define SE_DEBUG_PRIVILEGE (20L)
#define SE_AUDIT_PRIVILEGE (21L)
#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE (22L)
#define SE_CHANGE_NOTIFY_PRIVILEGE (23L)
#define SE_REMOTE_SHUTDOWN_PRIVILEGE (24L)
#define SE_UNDOCK_PRIVILEGE (25L)
#define SE_SYNC_AGENT_PRIVILEGE (26L)
#define SE_ENABLE_DELEGATION_PRIVILEGE (27L)
#define SE_MANAGE_VOLUME_PRIVILEGE (28L)
#define SE_IMPERSONATE_PRIVILEGE (29L)
#define SE_CREATE_GLOBAL_PRIVILEGE (30L)
#define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE (31L)
#define SE_RELABEL_PRIVILEGE (32L)
#define SE_INC_WORKING_SET_PRIVILEGE (33L)
#define SE_TIME_ZONE_PRIVILEGE (34L)
#define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE (35L)
#define SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE (36L)
#define SE_CREATE_TOKEN_PRIVILEGE (2L) // Required to create a primary token.
#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L) // Required to assign the primary token of a process.
#define SE_LOCK_MEMORY_PRIVILEGE (4L) // Required to lock physical pages in memory.
#define SE_INCREASE_QUOTA_PRIVILEGE (5L) // Required to increase the quota assigned to a process.
#define SE_MACHINE_ACCOUNT_PRIVILEGE (6L) // Required to create a computer account.
#define SE_TCB_PRIVILEGE (7L) // Required to act as part of the Trusted Computer Base.
#define SE_SECURITY_PRIVILEGE (8L) // Required to perform a number of security-related functions, such as controlling and viewing audit messages. // Security operator.
#define SE_TAKE_OWNERSHIP_PRIVILEGE (9L) // Required to take ownership of an object without being granted discretionary access.
#define SE_LOAD_DRIVER_PRIVILEGE (10L) // Required to load or unload a device driver.
#define SE_SYSTEM_PROFILE_PRIVILEGE (11L) // Required to gather profiling information for the entire system.
#define SE_SYSTEMTIME_PRIVILEGE (12L) // Required to modify the system time.
#define SE_PROF_SINGLE_PROCESS_PRIVILEGE (13L) // Required to gather profiling information for a single process.
#define SE_INC_BASE_PRIORITY_PRIVILEGE (14L) // Required to increase the base priority of a process.
#define SE_CREATE_PAGEFILE_PRIVILEGE (15L) // Required to create a paging file.
#define SE_CREATE_PERMANENT_PRIVILEGE (16L) // Required to create a permanent object.
#define SE_BACKUP_PRIVILEGE (17L) // Required to perform backup operations. This privilege causes the system to grant all read access control to any file.
#define SE_RESTORE_PRIVILEGE (18L) // Required to perform restore operations. This privilege causes the system to grant all write access control to any file.
#define SE_SHUTDOWN_PRIVILEGE (19L) // Required to shut down a local system.
#define SE_DEBUG_PRIVILEGE (20L) // Required to debug and adjust memory of any process, ignoring the DACL for the process.
#define SE_AUDIT_PRIVILEGE (21L) // Required to generate audit-log entries.
#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE (22L) // Required to modify UEFI variables of systems that use this type of memory to store configuration information.
#define SE_CHANGE_NOTIFY_PRIVILEGE (23L) // Required to receive notifications of changes to files or directories and skip all traversal access checks. It is enabled by default for all users.
#define SE_REMOTE_SHUTDOWN_PRIVILEGE (24L) // Required to shut down a system using a network request.
#define SE_UNDOCK_PRIVILEGE (25L) // Required to undock a laptop.
#define SE_SYNC_AGENT_PRIVILEGE (26L) // Required for a domain controller to use the Lightweight Directory Access Protocol (LDAP) directory synchronization services.
#define SE_ENABLE_DELEGATION_PRIVILEGE (27L) // Required to mark user and computer accounts as trusted for delegation.
#define SE_MANAGE_VOLUME_PRIVILEGE (28L) // Required to enable volume management privileges.
#define SE_IMPERSONATE_PRIVILEGE (29L) // Required to impersonate a client after authentication.
#define SE_CREATE_GLOBAL_PRIVILEGE (30L) // Required to create named file mapping objects in the global namespace during Terminal Services sessions. It is enabled by default for all administrators.
#define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE (31L) // Required to access Credential Manager as a trusted caller.
#define SE_RELABEL_PRIVILEGE (32L) // Required to modify the mandatory integrity level of an object.
#define SE_INC_WORKING_SET_PRIVILEGE (33L) // Required to allocate more memory for applications that run in the context of users.
#define SE_TIME_ZONE_PRIVILEGE (34L) // Required to adjust the time zone associated with the computer's internal clock.
#define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE (35L) // Required to create a symbolic link.
#define SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE (36L) // Required to obtain an impersonation token for another user in the same session.
#define SE_MAX_WELL_KNOWN_PRIVILEGE SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE
//
@@ -129,9 +128,9 @@ typedef enum _TOKEN_INFORMATION_CLASS
#define TokenSandBoxInert 15 // q: ULONG
#define TokenAuditPolicy 16 // q; s: TOKEN_AUDIT_POLICY (requires SeSecurityPrivilege/SeTcbPrivilege)
#define TokenOrigin 17 // q; s: TOKEN_ORIGIN (requires SeTcbPrivilege)
#define TokenElevationType 18 // q: TOKEN_ELEVATION_TYPE
//#define TokenElevationType 18 // q: TOKEN_ELEVATION_TYPE
#define TokenLinkedToken 19 // q; s: TOKEN_LINKED_TOKEN (requires SeCreateTokenPrivilege)
#define TokenElevation 20 // q: TOKEN_ELEVATION // 20
//#define TokenElevation 20 // q: TOKEN_ELEVATION // 20
#define TokenHasRestrictions 21 // q: ULONG
#define TokenAccessInformation 22 // q: TOKEN_ACCESS_INFORMATION
#define TokenVirtualizationAllowed 23 // q; s: ULONG (requires SeCreateTokenPrivilege)
@@ -164,22 +163,22 @@ typedef enum _TOKEN_INFORMATION_CLASS
#define MaxTokenInfoClass 50
#endif
//
// Types
//
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_INVALID 0x00
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_INT64 0x01
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_UINT64 0x02
// Case insensitive attribute value string by default.
// Unless the flag TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE
// is set indicating otherwise.
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_STRING 0x03
// Fully-qualified binary name.
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_FQBN 0x04
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_STRING 0x03 // Case insensitive attribute value string by default. Unless the flag TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE is set.
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_FQBN 0x04 // Fully-qualified binary name.
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_SID 0x05
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_BOOLEAN 0x06
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING 0x10
//
// Flags
//
// Attribute must not be inherited across process spawns.
#define TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE 0x0001
@@ -232,11 +231,11 @@ typedef struct _TOKEN_SECURITY_ATTRIBUTE_V1
ULONG ValueCount;
union
{
PLONG64 pInt64;
PULONG64 pUint64;
PUNICODE_STRING pString;
PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE pFqbn;
PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE pOctetString;
PLONG64 Int64;
PULONG64 Uint64;
PUNICODE_STRING String;
PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE Fqbn;
PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE OctetString;
} Values;
} TOKEN_SECURITY_ATTRIBUTE_V1, *PTOKEN_SECURITY_ATTRIBUTE_V1;
@@ -250,11 +249,11 @@ typedef struct _TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1
ULONG ValueCount;
union
{
ULONG pInt64[ANYSIZE_ARRAY];
ULONG pUint64[ANYSIZE_ARRAY];
ULONG ppString[ANYSIZE_ARRAY];
ULONG pFqbn[ANYSIZE_ARRAY];
ULONG pOctetString[ANYSIZE_ARRAY];
ULONG Int64[ANYSIZE_ARRAY];
ULONG Uint64[ANYSIZE_ARRAY];
ULONG String[ANYSIZE_ARRAY];
ULONG Fqbn[ANYSIZE_ARRAY];
ULONG OctetString[ANYSIZE_ARRAY];
} Values;
} TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1, *PTOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1;
@@ -271,8 +270,8 @@ typedef struct _TOKEN_SECURITY_ATTRIBUTES_INFORMATION
ULONG AttributeCount;
union
{
PTOKEN_SECURITY_ATTRIBUTE_V1 pAttributeV1;
} Attribute;
PTOKEN_SECURITY_ATTRIBUTE_V1 AttributeV1;
};
} TOKEN_SECURITY_ATTRIBUTES_INFORMATION, *PTOKEN_SECURITY_ATTRIBUTES_INFORMATION;
// private
@@ -298,6 +297,25 @@ typedef struct _TOKEN_PROCESS_TRUST_LEVEL
PSID TrustLevelSid;
} TOKEN_PROCESS_TRUST_LEVEL, *PTOKEN_PROCESS_TRUST_LEVEL;
#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE)
typedef struct _TOKEN_LOGGING_INFORMATION
{
TOKEN_TYPE TokenType;
TOKEN_ELEVATION TokenElevation;
TOKEN_ELEVATION_TYPE TokenElevationType;
SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
DWORD IntegrityLevel;
SID_AND_ATTRIBUTES User;
PSID TrustLevelSid;
DWORD SessionId;
DWORD AppContainerNumber;
LUID AuthenticationId;
DWORD GroupCount;
DWORD GroupsLength;
PSID_AND_ATTRIBUTES Groups;
} TOKEN_LOGGING_INFORMATION, *PTOKEN_LOGGING_INFORMATION;
#endif
//
// Tokens
//
@@ -321,7 +339,7 @@ NtCreateToken(
_In_ PTOKEN_SOURCE Source
);
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -338,7 +356,7 @@ NtCreateLowBoxToken(
);
#endif
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -467,6 +485,18 @@ NtDuplicateToken(
_Out_ PHANDLE NewTokenHandle
);
/**
* The NtQueryInformationToken routine retrieves a specified type of information about an access token. The calling process must have appropriate access rights to obtain the information.
*
* @param TokenHandle A handle to an existing access token from which information is to be retrieved. If TokenInformationClass is set to TokenSource, the handle must have TOKEN_QUERY_SOURCE access.
* For all other TokenInformationClass values, the handle must have TOKEN_QUERY access.
* @param TokenInformationClass A value from the TOKEN_INFORMATION_CLASS enumerated type identifying the type of information to be retrieved.
* @param TokenInformation Pointer to a caller-allocated buffer that receives the requested information about the token.
* @param TokenInformationLength Length, in bytes, of the caller-allocated TokenInformation buffer.
* @param ReturnLength Pointer to a caller-allocated variable that receives the actual length, in bytes, of the information returned in the TokenInformation buffer.
* @return NTSTATUS Successful or errant status.
* @remarks https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntqueryinformationtoken
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -478,6 +508,16 @@ NtQueryInformationToken(
_Out_ PULONG ReturnLength
);
/**
* The NtSetInformationToken routine modifies information in a specified token. The calling process must have appropriate access rights to set the information.
*
* @param TokenHandle A handle to an existing access token which information is to be modified.
* @param TokenInformationClass A value from the TOKEN_INFORMATION_CLASS enumerated type identifying the type of information to be modified.
* @param TokenInformation Pointer to a caller-allocated buffer containing the information to be modified in the token.
* @param TokenInformationLength Length, in bytes, of the caller-allocated TokenInformation buffer.
* @return NTSTATUS Successful or errant status.
* @remarks https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntsetinformationtoken
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -488,6 +528,19 @@ NtSetInformationToken(
_In_ ULONG TokenInformationLength
);
/**
* The NtAdjustPrivilegesToken routine enables or disables privileges in the specified access token.
*
* @param TokenHandle Handle to the token that contains the privileges to be modified. The handle must have TOKEN_ADJUST_PRIVILEGES access.
* @param DisableAllPrivileges Specifies whether the function disables all of the token's privileges. If this value is TRUE, the function disables all privileges and ignores the NewState parameter.
* If it is FALSE, the function modifies privileges based on the information pointed to by the NewState parameter.
* @param NewState A pointer to a TOKEN_PRIVILEGES structure that specifies an array of privileges and their attributes. If DisableAllPrivileges is TRUE, the function ignores this parameter.
* @param BufferLength Specifies the size, in bytes, of the buffer pointed to by the PreviousState parameter. This parameter can be zero if the PreviousState parameter is NULL.
* @param PreviousState A pointer to a buffer that the function fills with a TOKEN_PRIVILEGES structure that contains the previous state of any privileges that the function modifies.
* @param ReturnLength A pointer to a variable that receives the required size, in bytes, of the buffer pointed to by the PreviousState parameter. This parameter can be NULL if PreviousState is NULL.
* @return NTSTATUS Successful or errant status.
* @remarks https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-adjusttokenprivileges
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -512,7 +565,7 @@ NtAdjustGroupsToken(
_Out_opt_ PULONG ReturnLength
);
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -548,7 +601,7 @@ NtFilterToken(
_Out_ PHANDLE NewTokenHandle
);
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -595,7 +648,7 @@ NtImpersonateAnonymousToken(
_In_ HANDLE ThreadHandle
);
#if (PHNT_VERSION >= PHNT_WIN7)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
// rev
NTSYSCALLAPI
NTSTATUS
@@ -662,7 +715,7 @@ NtAccessCheckByTypeResultList(
// Signing
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
NTSYSCALLAPI
NTSTATUS
@@ -704,7 +757,7 @@ typedef struct _SE_SET_FILE_CACHE_INFORMATION
SE_FILE_CACHE_CLAIM_INFORMATION OriginClaimInfo;
} SE_SET_FILE_CACHE_INFORMATION, *PSE_SET_FILE_CACHE_INFORMATION;
#if (PHNT_VERSION >= PHNT_REDSTONE)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1)
// rev
NTSYSCALLAPI
@@ -721,7 +774,7 @@ NtSetCachedSigningLevel2(
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE2)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS2)
// rev
NTSYSCALLAPI
nttmapi.h
+40 -40
View File
@@ -7,7 +7,7 @@
#ifndef _NTTMAPI_H
#define _NTTMAPI_H
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -21,7 +21,7 @@ NtCreateTransactionManager(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -35,7 +35,7 @@ NtOpenTransactionManager(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -45,7 +45,7 @@ NtRenameTransactionManager(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -55,7 +55,7 @@ NtRollforwardTransactionManager(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -64,7 +64,7 @@ NtRecoverTransactionManager(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -77,7 +77,7 @@ NtQueryInformationTransactionManager(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -89,7 +89,7 @@ NtSetInformationTransactionManager(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -102,7 +102,7 @@ NtEnumerateTransactionObject(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -120,7 +120,7 @@ NtCreateTransaction(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -133,7 +133,7 @@ NtOpenTransaction(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -146,7 +146,7 @@ NtQueryInformationTransaction(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -158,7 +158,7 @@ NtSetInformationTransaction(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -168,7 +168,7 @@ NtCommitTransaction(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -178,7 +178,7 @@ NtRollbackTransaction(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -194,7 +194,7 @@ NtCreateEnlistment(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -207,7 +207,7 @@ NtOpenEnlistment(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -220,7 +220,7 @@ NtQueryInformationEnlistment(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -232,7 +232,7 @@ NtSetInformationEnlistment(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -242,7 +242,7 @@ NtRecoverEnlistment(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -252,7 +252,7 @@ NtPrePrepareEnlistment(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -262,7 +262,7 @@ NtPrepareEnlistment(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -272,7 +272,7 @@ NtCommitEnlistment(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -282,7 +282,7 @@ NtRollbackEnlistment(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -292,7 +292,7 @@ NtPrePrepareComplete(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -302,7 +302,7 @@ NtPrepareComplete(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -312,7 +312,7 @@ NtCommitComplete(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -322,7 +322,7 @@ NtReadOnlyEnlistment(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -332,7 +332,7 @@ NtRollbackComplete(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -342,7 +342,7 @@ NtSinglePhaseReject(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -357,7 +357,7 @@ NtCreateResourceManager(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -370,7 +370,7 @@ NtOpenResourceManager(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -379,7 +379,7 @@ NtRecoverResourceManager(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -394,7 +394,7 @@ NtGetNotificationResourceManager(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -407,7 +407,7 @@ NtQueryInformationResourceManager(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -419,7 +419,7 @@ NtSetInformationResourceManager(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -432,7 +432,7 @@ NtRegisterProtocolAddressInformation(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -444,7 +444,7 @@ NtPropagationComplete(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -455,7 +455,7 @@ NtPropagationFailed(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
// private
NTSYSCALLAPI
NTSTATUS
@@ -466,7 +466,7 @@ NtFreezeTransactions(
);
#endif
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
// private
NTSYSCALLAPI
NTSTATUS
nttp.h
+5 -5
View File
@@ -26,7 +26,7 @@ typedef VOID (NTAPI *PTP_ALPC_CALLBACK_EX)(
_In_ PVOID ApcContext
);
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
// winbase:CreateThreadpool
NTSYSAPI
@@ -63,7 +63,7 @@ TpSetPoolMinThreads(
_In_ ULONG MinThreads
);
#if (PHNT_VERSION >= PHNT_WIN7)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
// winbase:QueryThreadpoolStackInformation
NTSYSAPI
NTSTATUS
@@ -256,7 +256,7 @@ TpSetTimer(
_In_opt_ ULONG WindowLength
);
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
// winbase:SetThreadpoolTimerEx
NTSYSAPI
NTSTATUS
@@ -315,7 +315,7 @@ TpSetWait(
_In_opt_ PLARGE_INTEGER Timeout
);
#if (PHNT_VERSION >= PHNT_WIN8)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)
// winbase:SetThreadpoolWaitEx
NTSYSAPI
NTSTATUS
@@ -403,7 +403,7 @@ TpAllocAlpcCompletion(
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
);
#if (PHNT_VERSION >= PHNT_WIN7)
#if (PHNT_VERSION >= PHNT_WINDOWS_7)
// rev
NTSYSAPI
NTSTATUS
ntuser.h
+404 -391
View File
@@ -7,33 +7,82 @@
#ifndef _NTUSER_H
#define _NTUSER_H
typedef enum _WINDOWINFOCLASS
{
WindowProcess = 0, // q: ULONG (Process ID)
WindowRealProcess = 1, // q: ULONG (Process ID)
WindowThread = 2, // q: ULONG (Thread ID)
WindowActiveWindow = 3, // q: HWND
WindowFocusWindow = 4, // q: HWND
WindowIsHung = 5, // q: BOOLEAN
WindowClientBase = 6, // q: PVOID
WindowIsForegroundThread = 7, // q: BOOLEAN
WindowDefaultImeWindow = 8, // q: HWND
WindowDefaultInputContext = 9, // q: HIMC
} WINDOWINFOCLASS, *PWINDOWINFOCLASS;
typedef enum _USERTHREADINFOCLASS USERTHREADINFOCLASS;
NTSYSCALLAPI
ULONG_PTR
NTSTATUS
NTAPI
NtUserQueryWindow(
NtUserAttachThreadInput(
_In_ ULONG IdAttach,
_In_ ULONG IdAttachTo,
_In_ BOOL Attach
);
NTSYSCALLAPI
HDC
NTAPI
NtUserBeginPaint(
_In_ HWND WindowHandle,
_In_ WINDOWINFOCLASS WindowInfo
_Inout_ LPPAINTSTRUCT lpPaint
);
NTSYSCALLAPI
BOOL
NTAPI
NtUserBlockInput(
_In_ BOOL BlockInput
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUserTestForInteractiveUser(
_In_ PLUID AuthenticationId
NtUserBuildHwndList(
_In_opt_ HANDLE DesktopHandle,
_In_opt_ HWND StartWindowHandle,
_In_opt_ LOGICAL IncludeChildren,
_In_opt_ LOGICAL ExcludeImmersive,
_In_opt_ ULONG ThreadId,
_In_ ULONG HwndListInformationLength,
_Out_writes_bytes_(HwndListInformationLength) PVOID HwndListInformation,
_Out_ PULONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUserBuildNameList(
_In_ HWINSTA WindowStationHandle, // GetProcessWindowStation
_In_ ULONG NameListInformationLength,
_Out_writes_bytes_(NameListInformationLength) PVOID NameListInformation,
_Out_opt_ PULONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUserBuildPropList(
_In_ HWINSTA WindowStationHandle,
_In_ ULONG PropListInformationLength,
_Out_writes_bytes_(PropListInformationLength) PVOID PropListInformation,
_Out_opt_ PULONG ReturnLength
);
NTSYSCALLAPI
LOGICAL
NTAPI
NtUserCanCurrentThreadChangeForeground(
VOID
);
NTSYSCALLAPI
BOOL
NTAPI
NtUserCalculatePopupWindowPosition(
_In_ const POINT* anchorPoint,
_In_ const SIZE* windowSize,
_In_ ULONG flags,
_Inout_ RECT* excludeRect,
_Inout_ RECT* popupWindowPosition
);
NTSYSCALLAPI
@@ -54,29 +103,10 @@ NtUserCheckProcessForClipboardAccess(
);
NTSYSCALLAPI
ULONG
LOGICAL
NTAPI
NtUserInternalGetWindowText(
_In_ HWND WindowHandle,
_Out_writes_to_(cchMaxCount, return + 1) LPWSTR pString,
_In_ ULONG cchMaxCount
);
NTSYSCALLAPI
HICON
NTAPI
NtUserInternalGetWindowIcon(
_In_ HWND WindowHandle,
_In_ ULONG IconType
);
NTSYSCALLAPI
ULONG
NTAPI
NtUserGetClassName(
_In_ HWND WindowHandle,
_In_ LONGLONG Real,
_Out_ PUNICODE_STRING ClassName
NtUserCloseWindowStation(
_In_ HWINSTA WindowStationHandle
);
typedef enum _CONSOLECONTROL
@@ -146,6 +176,20 @@ NtUserConsoleControl(
_In_ ULONG ConsoleInformationLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUserCreateWindowStation(
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ HANDLE KeyboardLayoutHandle,
_In_opt_ PVOID KeyboardLayoutOffset,
_In_opt_ PVOID NlsTableOffset,
_In_opt_ PVOID KeyboardDescriptor,
_In_opt_ PUNICODE_STRING LanguageIdString,
_In_opt_ ULONG KeyboardLocale
);
/**
* Performs special kernel operations for console host applications. (user32.dll)
*
@@ -157,7 +201,7 @@ NtUserConsoleControl(
* @param ConsoleInformationLength The size of the structure pointed to by the ConsoleInformation parameter.
* @return Successful or errant status.
*/
NTSYSCALLAPI
NTSYSAPI
NTSTATUS
NTAPI
ConsoleControl(
@@ -166,185 +210,22 @@ ConsoleControl(
_In_ ULONG ConsoleInformationLength
);
/**
* Opens the specified window station.
*
* @param ObjectAttributes The name of the window station to be opened. Window station names are case-insensitive. This window station must belong to the current session.
* @param DesiredAccess The access to the window station.
* @return Successful or errant status.
*/
NTSYSCALLAPI
HWINSTA
HWND
NTAPI
NtUserOpenWindowStation(
_In_ OBJECT_ATTRIBUTES ObjectAttributes,
_In_ ACCESS_MASK DesiredAccess
NtUserGetClassName(
_In_ HWND WindowHandle,
_In_ BOOL Real,
_Out_ PUNICODE_STRING ClassName
);
NTSYSCALLAPI
HWINSTA
HWND
NTAPI
NtUserCreateWindowStation(
_In_ OBJECT_ATTRIBUTES ObjectAttributes,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ HANDLE KeyboardLayoutHandle,
_In_opt_ PVOID KeyboardLayoutOffset,
_In_opt_ PVOID NlsTableOffset,
_In_opt_ PVOID KeyboardDescriptor,
_In_opt_ UNICODE_STRING LanguageIdString,
_In_opt_ ULONG KeyboardLocale
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUserBuildHwndList(
_In_opt_ HANDLE DesktopHandle,
_In_opt_ HWND StartWindowHandle,
_In_opt_ LOGICAL IncludeChildren,
_In_opt_ LOGICAL ExcludeImmersive,
_In_opt_ ULONG ThreadId,
_In_ ULONG HwndListInformationLength,
_Out_writes_bytes_(HwndListInformationLength) PVOID HwndListInformation,
_Out_ PULONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUserBuildNameList(
_In_ HWINSTA WindowStationHandle, // GetProcessWindowStation
_In_ ULONG NameListInformationLength,
_Out_writes_bytes_(NameListInformationLength) PVOID NameListInformation,
_Out_opt_ PULONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUserBuildPropList(
_In_ HWINSTA WindowStationHandle,
_In_ ULONG PropListInformationLength,
_Out_writes_bytes_(PropListInformationLength) PVOID PropListInformation,
_Out_opt_ PULONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUserCanCurrentThreadChangeForeground(
NtUserGetForegroundWindow(
VOID
);
NTSYSCALLAPI
HWND
NTAPI
NtUserGetProcessWindowStation(
VOID
);
NTSYSCALLAPI
HWND
NTAPI
NtUserGhostWindowFromHungWindow(
_In_ HWND WindowHandle
);
NTSYSCALLAPI
HWND
NTAPI
NtUserHungWindowFromGhostWindow(
_In_ HWND WindowHandle
);
NTSYSAPI
HWND
NTAPI
GhostWindowFromHungWindow(
_In_ HWND WindowHandle
);
NTSYSAPI
HWND
NTAPI
HungWindowFromGhostWindow(
_In_ HWND WindowHandle
);
NTSYSCALLAPI
LOGICAL
NTAPI
NtUserCloseWindowStation(
_In_ HWINSTA WindowStationHandle
);
NTSYSCALLAPI
LOGICAL
NTAPI
NtUserSetProcessWindowStation(
_In_ HWINSTA WindowStationHandle
);
NTSYSAPI
LOGICAL
NTAPI
SetWindowStationUser(
_In_ HWINSTA WindowStationHandle,
_In_ PLUID UserLogonId,
_In_ PSID UserSid,
_In_ ULONG UserSidLength
);
NTSYSCALLAPI
LOGICAL
NTAPI
NtUserSetChildWindowNoActivate(
_In_ HWND WindowHandle
);
// User32 ordinal 2005
NTSYSCALLAPI
LOGICAL
NTAPI
SetChildWindowNoActivate(
_In_ HWND WindowHandle
);
NTSYSCALLAPI
LOGICAL
NTAPI
NtUserSetWindowStationUser(
_In_ HWINSTA WindowStationHandle,
_In_ PLUID UserLogonId,
_In_ PSID UserSid,
_In_ ULONG UserSidLength
);
NTSYSCALLAPI
HANDLE
NTAPI
NtUserOpenDesktop(
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG Flags,
_In_ ACCESS_MASK DesiredAccess
);
NTSYSCALLAPI
LOGICAL
NTAPI
NtUserSetThreadDesktop(
_In_ HDESK DesktopHandle
);
NTSYSCALLAPI
LOGICAL
NTAPI
NtUserSwitchDesktop(
_In_ HDESK DesktopHandle,
_In_opt_ ULONG Flags,
_In_opt_ ULONG FadeTime
);
NTSYSCALLAPI
LOGICAL
NTAPI
@@ -370,10 +251,108 @@ NtUserGetIconSize(
NTSYSCALLAPI
HWND
NTAPI
NtUserGetForegroundWindow(
NtUserGetProcessWindowStation(
VOID
);
NTSYSCALLAPI
ULONG_PTR
NTAPI
NtUserGetThreadState(
_In_ ULONG UserThreadState
);
NTSYSCALLAPI
HWND
NTAPI
NtUserGhostWindowFromHungWindow(
_In_ HWND WindowHandle
);
NTSYSAPI
HWND
NTAPI
GhostWindowFromHungWindow(
_In_ HWND WindowHandle
);
NTSYSCALLAPI
HWND
NTAPI
NtUserHungWindowFromGhostWindow(
_In_ HWND WindowHandle
);
NTSYSAPI
HWND
NTAPI
HungWindowFromGhostWindow(
_In_ HWND WindowHandle
);
NTSYSCALLAPI
ULONG
NTAPI
NtUserInternalGetWindowText(
_In_ HWND WindowHandle,
_Out_writes_to_(cchMaxCount, return + 1) LPWSTR pString,
_In_ ULONG cchMaxCount
);
NTSYSCALLAPI
HICON
NTAPI
NtUserInternalGetWindowIcon(
_In_ HWND WindowHandle,
_In_ ULONG IconType
);
NTSYSCALLAPI
HANDLE
NTAPI
NtUserOpenDesktop(
_In_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG Flags,
_In_ ACCESS_MASK DesiredAccess
);
/**
* Opens the specified window station.
*
* @param ObjectAttributes The name of the window station to be opened. Window station names are case-insensitive. This window station must belong to the current session.
* @param DesiredAccess The access to the window station.
* @return Successful or errant status.
*/
NTSYSCALLAPI
HWINSTA
NTAPI
NtUserOpenWindowStation(
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ ACCESS_MASK DesiredAccess
);
typedef enum _WINDOWINFOCLASS
{
WindowProcess = 0, // q: ULONG (Process ID)
WindowRealProcess = 1, // q: ULONG (Process ID)
WindowThread = 2, // q: ULONG (Thread ID)
WindowActiveWindow = 3, // q: HWND
WindowFocusWindow = 4, // q: HWND
WindowIsHung = 5, // q: BOOLEAN
WindowClientBase = 6, // q: PVOID
WindowIsForegroundThread = 7, // q: BOOLEAN
WindowDefaultImeWindow = 8, // q: HWND
WindowDefaultInputContext = 9, // q: HIMC
} WINDOWINFOCLASS, *PWINDOWINFOCLASS;
NTSYSCALLAPI
ULONG_PTR
NTAPI
NtUserQueryWindow(
_In_ HWND WindowHandle,
_In_ WINDOWINFOCLASS WindowInfo
);
NTSYSCALLAPI
HWND
NTAPI
@@ -381,6 +360,13 @@ NtUserSetActiveWindow(
_In_ HWND WindowHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUserSetChildWindowNoActivate(
_In_ HWND WindowHandle
);
NTSYSCALLAPI
HWND
NTAPI
@@ -388,11 +374,29 @@ NtUserSetFocus(
_In_ HWND WindowHandle
);
NTSYSCALLAPI
ULONG_PTR
// User32 ordinal 2005
NTSYSAPI
LOGICAL
NTAPI
NtUserGetThreadState(
_In_ ULONG UserThreadState
SetChildWindowNoActivate(
_In_ HWND WindowHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUserSetInformationThread(
_In_ HANDLE ThreadHandle,
_In_ USERTHREADINFOCLASS ThreadInformationClass,
_In_reads_bytes_(ThreadInformationLength) PVOID ThreadInformation,
_In_ ULONG ThreadInformationLength
);
NTSYSCALLAPI
LOGICAL
NTAPI
NtUserSetProcessWindowStation(
_In_ HWINSTA WindowStationHandle
);
NTSYSCALLAPI
@@ -404,54 +408,52 @@ NtUserSetWindowPlacement(
);
NTSYSCALLAPI
BOOL
LOGICAL
NTAPI
NtUserAttachThreadInput(
_In_ ULONG IdAttach,
_In_ ULONG IdAttachTo,
_In_ BOOL Attach
NtUserSetWindowStationUser(
_In_ HWINSTA WindowStationHandle,
_In_ PLUID UserLogonId,
_In_ PSID UserSid,
_In_ ULONG UserSidLength
);
NTSYSAPI
LOGICAL
NTAPI
SetWindowStationUser(
_In_ HWINSTA WindowStationHandle,
_In_ PLUID UserLogonId,
_In_ PSID UserSid,
_In_ ULONG UserSidLength
);
NTSYSCALLAPI
HDC
NTSTATUS
NTAPI
NtUserBeginPaint(
_In_ HWND WindowHandle,
_Inout_ LPPAINTSTRUCT lpPaint
NtUserTestForInteractiveUser(
_In_ PLUID AuthenticationId
);
NTSYSCALLAPI
BOOL
LOGICAL
NTAPI
NtUserBlockInput(
_In_ BOOL BlockInput
NtUserSwitchDesktop(
_In_ HDESK DesktopHandle,
_In_opt_ ULONG Flags,
_In_opt_ ULONG FadeTime
);
NTSYSCALLAPI
BOOL
LOGICAL
NTAPI
tUserCalculatePopupWindowPosition(
_In_ const POINT* anchorPoint,
_In_ const SIZE* windowSize,
_In_ ULONG flags,
_Inout_ RECT* excludeRect,
_Inout_ RECT* popupWindowPosition
NtUserSetThreadDesktop(
_In_ HDESK DesktopHandle
);
NTSYSCALLAPI
BOOL
NTAPI
NtUserChangeWindowMessageFilterEx(
_In_ HWND WindowHandle,
_In_ ULONG WindowMessage,
_In_ ULONG FilterAction,
_Inout_opt_ PCHANGEFILTERSTRUCT ChangeFilterStruct
);
NTSYSCALLAPI
NTSYSAPI
HWND
NTAPI
NtUserChildWindowFromPoint(
ChildWindowFromPoint(
_In_ HWND WindowHandle,
_In_ POINT pt
);
@@ -775,6 +777,20 @@ NtUserGetRegisteredRawInputDevices(
_In_ ULONG RawInputDeviceSize
);
NTSYSCALLAPI
HMENU
NTAPI
NtUserGetSendMessageReceiver(
_In_ HANDLE ThreadId
);
NTSYSAPI
HWND
NTAPI
GetSendMessageReceiver(
_In_ HANDLE ThreadId
);
NTSYSCALLAPI
HMENU
NTAPI
@@ -930,8 +946,6 @@ NtUserPrintWindow(
_In_ ULONG nFlags
);
typedef enum _USERTHREADINFOCLASS USERTHREADINFOCLASS;
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -939,7 +953,6 @@ NtUserQueryInformationThread(
_In_ HANDLE ThreadHandle,
_In_ USERTHREADINFOCLASS ThreadInformationClass,
_Out_writes_bytes_(ThreadInformationLength) PVOID ThreadInformation,
_In_ ULONG ThreadInformationLength,
_Out_opt_ PULONG ReturnLength
);
@@ -953,7 +966,7 @@ NtUserSetInformationThread(
_In_ ULONG ThreadInformationLength
);
NTSYSCALLAPI
NTSYSAPI
BOOL
NTAPI
QuerySendMessage(
@@ -1245,146 +1258,146 @@ NtUserWindowFromPoint(
// Peb!KernelCallbackTable = user32.dll!apfnDispatch
typedef struct _KERNEL_CALLBACK_TABLE
{
ULONG_PTR __fnCOPYDATA;
ULONG_PTR __fnCOPYGLOBALDATA;
ULONG_PTR __fnEMPTY1;
ULONG_PTR __fnNCDESTROY;
ULONG_PTR __fnDWORDOPTINLPMSG;
ULONG_PTR __fnINOUTDRAG;
ULONG_PTR __fnGETTEXTLENGTHS1;
ULONG_PTR __fnINCNTOUTSTRING;
ULONG_PTR __fnINCNTOUTSTRINGNULL;
ULONG_PTR __fnINLPCOMPAREITEMSTRUCT;
ULONG_PTR __fnINLPCREATESTRUCT;
ULONG_PTR __fnINLPDELETEITEMSTRUCT;
ULONG_PTR __fnINLPDRAWITEMSTRUCT;
ULONG_PTR __fnPOPTINLPUINT1;
ULONG_PTR __fnPOPTINLPUINT2;
ULONG_PTR __fnINLPMDICREATESTRUCT;
ULONG_PTR __fnINOUTLPMEASUREITEMSTRUCT;
ULONG_PTR __fnINLPWINDOWPOS;
ULONG_PTR __fnINOUTLPPOINT51;
ULONG_PTR __fnINOUTLPSCROLLINFO;
ULONG_PTR __fnINOUTLPRECT;
ULONG_PTR __fnINOUTNCCALCSIZE;
ULONG_PTR __fnINOUTLPPOINT52;
ULONG_PTR __fnINPAINTCLIPBRD;
ULONG_PTR __fnINSIZECLIPBRD;
ULONG_PTR __fnINDESTROYCLIPBRD;
ULONG_PTR __fnINSTRINGNULL1;
ULONG_PTR __fnINSTRINGNULL2;
ULONG_PTR __fnINDEVICECHANGE;
ULONG_PTR __fnPOWERBROADCAST;
ULONG_PTR __fnINLPUAHDRAWMENU1;
ULONG_PTR __fnOPTOUTLPDWORDOPTOUTLPDWORD1;
ULONG_PTR __fnOPTOUTLPDWORDOPTOUTLPDWORD2;
ULONG_PTR __fnOUTDWORDINDWORD;
ULONG_PTR __fnOUTLPRECT;
ULONG_PTR __fnOUTSTRING;
ULONG_PTR __fnPOPTINLPUINT3;
ULONG_PTR __fnPOUTLPINT;
ULONG_PTR __fnSENTDDEMSG;
ULONG_PTR __fnINOUTSTYLECHANGE1;
ULONG_PTR __fnHkINDWORD;
ULONG_PTR __fnHkINLPCBTACTIVATESTRUCT;
ULONG_PTR __fnHkINLPCBTCREATESTRUCT;
ULONG_PTR __fnHkINLPDEBUGHOOKSTRUCT;
ULONG_PTR __fnHkINLPMOUSEHOOKSTRUCTEX1;
ULONG_PTR __fnHkINLPKBDLLHOOKSTRUCT;
ULONG_PTR __fnHkINLPMSLLHOOKSTRUCT;
ULONG_PTR __fnHkINLPMSG;
ULONG_PTR __fnHkINLPRECT;
ULONG_PTR __fnHkOPTINLPEVENTMSG;
ULONG_PTR __xxxClientCallDelegateThread;
ULONG_PTR __ClientCallDummyCallback1;
ULONG_PTR __ClientCallDummyCallback2;
ULONG_PTR __fnSHELLWINDOWMANAGEMENTCALLOUT;
ULONG_PTR __fnSHELLWINDOWMANAGEMENTNOTIFY;
ULONG_PTR __ClientCallDummyCallback3;
ULONG_PTR __xxxClientCallDitThread;
ULONG_PTR __xxxClientEnableMMCSS;
ULONG_PTR __xxxClientUpdateDpi;
ULONG_PTR __xxxClientExpandStringW;
ULONG_PTR __ClientCopyDDEIn1;
ULONG_PTR __ClientCopyDDEIn2;
ULONG_PTR __ClientCopyDDEOut1;
ULONG_PTR __ClientCopyDDEOut2;
ULONG_PTR __ClientCopyImage;
ULONG_PTR __ClientEventCallback;
ULONG_PTR __ClientFindMnemChar;
ULONG_PTR __ClientFreeDDEHandle;
ULONG_PTR __ClientFreeLibrary;
ULONG_PTR __ClientGetCharsetInfo;
ULONG_PTR __ClientGetDDEFlags;
ULONG_PTR __ClientGetDDEHookData;
ULONG_PTR __ClientGetListboxString;
ULONG_PTR __ClientGetMessageMPH;
ULONG_PTR __ClientLoadImage;
ULONG_PTR __ClientLoadLibrary;
ULONG_PTR __ClientLoadMenu;
ULONG_PTR __ClientLoadLocalT1Fonts;
ULONG_PTR __ClientPSMTextOut;
ULONG_PTR __ClientLpkDrawTextEx;
ULONG_PTR __ClientExtTextOutW;
ULONG_PTR __ClientGetTextExtentPointW;
ULONG_PTR __ClientCharToWchar;
ULONG_PTR __ClientAddFontResourceW;
ULONG_PTR __ClientThreadSetup;
ULONG_PTR __ClientDeliverUserApc;
ULONG_PTR __ClientNoMemoryPopup;
ULONG_PTR __ClientMonitorEnumProc;
ULONG_PTR __ClientCallWinEventProc;
ULONG_PTR __ClientWaitMessageExMPH;
ULONG_PTR __ClientCallDummyCallback4;
ULONG_PTR __ClientCallDummyCallback5;
ULONG_PTR __ClientImmLoadLayout;
ULONG_PTR __ClientImmProcessKey;
ULONG_PTR __fnIMECONTROL;
ULONG_PTR __fnINWPARAMDBCSCHAR;
ULONG_PTR __fnGETTEXTLENGTHS2;
ULONG_PTR __ClientCallDummyCallback6;
ULONG_PTR __ClientLoadStringW;
ULONG_PTR __ClientLoadOLE;
ULONG_PTR __ClientRegisterDragDrop;
ULONG_PTR __ClientRevokeDragDrop;
ULONG_PTR __fnINOUTMENUGETOBJECT;
ULONG_PTR __ClientPrinterThunk;
ULONG_PTR __fnOUTLPCOMBOBOXINFO;
ULONG_PTR __fnOUTLPSCROLLBARINFO;
ULONG_PTR __fnINLPUAHDRAWMENU2;
ULONG_PTR __fnINLPUAHDRAWMENUITEM;
ULONG_PTR __fnINLPUAHDRAWMENU3;
ULONG_PTR __fnINOUTLPUAHMEASUREMENUITEM;
ULONG_PTR __fnINLPUAHDRAWMENU4;
ULONG_PTR __fnOUTLPTITLEBARINFOEX;
ULONG_PTR __fnTOUCH;
ULONG_PTR __fnGESTURE;
ULONG_PTR __fnPOPTINLPUINT4;
ULONG_PTR __fnPOPTINLPUINT5;
ULONG_PTR __xxxClientCallDefaultInputHandler;
ULONG_PTR __fnEMPTY2;
ULONG_PTR __ClientRimDevCallback;
ULONG_PTR __xxxClientCallMinTouchHitTestingCallback;
ULONG_PTR __ClientCallLocalMouseHooks;
ULONG_PTR __xxxClientBroadcastThemeChange;
ULONG_PTR __xxxClientCallDevCallbackSimple;
ULONG_PTR __xxxClientAllocWindowClassExtraBytes;
ULONG_PTR __xxxClientFreeWindowClassExtraBytes;
ULONG_PTR __fnGETWINDOWDATA;
ULONG_PTR __fnINOUTSTYLECHANGE2;
ULONG_PTR __fnHkINLPMOUSEHOOKSTRUCTEX2;
ULONG_PTR __xxxClientCallDefWindowProc;
ULONG_PTR __fnSHELLSYNCDISPLAYCHANGED;
ULONG_PTR __fnHkINLPCHARHOOKSTRUCT;
ULONG_PTR __fnINTERCEPTEDWINDOWACTION;
ULONG_PTR __xxxTooltipCallback;
ULONG_PTR __xxxClientInitPSBInfo;
ULONG_PTR __xxxClientDoScrollMenu;
ULONG_PTR __xxxClientEndScroll;
ULONG_PTR __xxxClientDrawSize;
ULONG_PTR __xxxClientDrawScrollBar;
ULONG_PTR __xxxClientHitTestScrollBar;
ULONG_PTR __xxxClientTrackInit;
PVOID __fnCOPYDATA;
PVOID __fnCOPYGLOBALDATA;
PVOID __fnEMPTY1;
PVOID __fnNCDESTROY;
PVOID __fnDWORDOPTINLPMSG;
PVOID __fnINOUTDRAG;
PVOID __fnGETTEXTLENGTHS1;
PVOID __fnINCNTOUTSTRING;
PVOID __fnINCNTOUTSTRINGNULL;
PVOID __fnINLPCOMPAREITEMSTRUCT;
PVOID __fnINLPCREATESTRUCT;
PVOID __fnINLPDELETEITEMSTRUCT;
PVOID __fnINLPDRAWITEMSTRUCT;
PVOID __fnPOPTINLPUINT1;
PVOID __fnPOPTINLPUINT2;
PVOID __fnINLPMDICREATESTRUCT;
PVOID __fnINOUTLPMEASUREITEMSTRUCT;
PVOID __fnINLPWINDOWPOS;
PVOID __fnINOUTLPPOINT51;
PVOID __fnINOUTLPSCROLLINFO;
PVOID __fnINOUTLPRECT;
PVOID __fnINOUTNCCALCSIZE;
PVOID __fnINOUTLPPOINT52;
PVOID __fnINPAINTCLIPBRD;
PVOID __fnINSIZECLIPBRD;
PVOID __fnINDESTROYCLIPBRD;
PVOID __fnINSTRINGNULL1;
PVOID __fnINSTRINGNULL2;
PVOID __fnINDEVICECHANGE;
PVOID __fnPOWERBROADCAST;
PVOID __fnINLPUAHDRAWMENU1;
PVOID __fnOPTOUTLPDWORDOPTOUTLPDWORD1;
PVOID __fnOPTOUTLPDWORDOPTOUTLPDWORD2;
PVOID __fnOUTDWORDINDWORD;
PVOID __fnOUTLPRECT;
PVOID __fnOUTSTRING;
PVOID __fnPOPTINLPUINT3;
PVOID __fnPOUTLPINT;
PVOID __fnSENTDDEMSG;
PVOID __fnINOUTSTYLECHANGE1;
PVOID __fnHkINDWORD;
PVOID __fnHkINLPCBTACTIVATESTRUCT;
PVOID __fnHkINLPCBTCREATESTRUCT;
PVOID __fnHkINLPDEBUGHOOKSTRUCT;
PVOID __fnHkINLPMOUSEHOOKSTRUCTEX1;
PVOID __fnHkINLPKBDLLHOOKSTRUCT;
PVOID __fnHkINLPMSLLHOOKSTRUCT;
PVOID __fnHkINLPMSG;
PVOID __fnHkINLPRECT;
PVOID __fnHkOPTINLPEVENTMSG;
PVOID __xxxClientCallDelegateThread;
PVOID __ClientCallDummyCallback1;
PVOID __ClientCallDummyCallback2;
PVOID __fnSHELLWINDOWMANAGEMENTCALLOUT;
PVOID __fnSHELLWINDOWMANAGEMENTNOTIFY;
PVOID __ClientCallDummyCallback3;
PVOID __xxxClientCallDitThread;
PVOID __xxxClientEnableMMCSS;
PVOID __xxxClientUpdateDpi;
PVOID __xxxClientExpandStringW;
PVOID __ClientCopyDDEIn1;
PVOID __ClientCopyDDEIn2;
PVOID __ClientCopyDDEOut1;
PVOID __ClientCopyDDEOut2;
PVOID __ClientCopyImage;
PVOID __ClientEventCallback;
PVOID __ClientFindMnemChar;
PVOID __ClientFreeDDEHandle;
PVOID __ClientFreeLibrary;
PVOID __ClientGetCharsetInfo;
PVOID __ClientGetDDEFlags;
PVOID __ClientGetDDEHookData;
PVOID __ClientGetListboxString;
PVOID __ClientGetMessageMPH;
PVOID __ClientLoadImage;
PVOID __ClientLoadLibrary;
PVOID __ClientLoadMenu;
PVOID __ClientLoadLocalT1Fonts;
PVOID __ClientPSMTextOut;
PVOID __ClientLpkDrawTextEx;
PVOID __ClientExtTextOutW;
PVOID __ClientGetTextExtentPointW;
PVOID __ClientCharToWchar;
PVOID __ClientAddFontResourceW;
PVOID __ClientThreadSetup;
PVOID __ClientDeliverUserApc;
PVOID __ClientNoMemoryPopup;
PVOID __ClientMonitorEnumProc;
PVOID __ClientCallWinEventProc;
PVOID __ClientWaitMessageExMPH;
PVOID __ClientCallDummyCallback4;
PVOID __ClientCallDummyCallback5;
PVOID __ClientImmLoadLayout;
PVOID __ClientImmProcessKey;
PVOID __fnIMECONTROL;
PVOID __fnINWPARAMDBCSCHAR;
PVOID __fnGETTEXTLENGTHS2;
PVOID __ClientCallDummyCallback6;
PVOID __ClientLoadStringW;
PVOID __ClientLoadOLE;
PVOID __ClientRegisterDragDrop;
PVOID __ClientRevokeDragDrop;
PVOID __fnINOUTMENUGETOBJECT;
PVOID __ClientPrinterThunk;
PVOID __fnOUTLPCOMBOBOXINFO;
PVOID __fnOUTLPSCROLLBARINFO;
PVOID __fnINLPUAHDRAWMENU2;
PVOID __fnINLPUAHDRAWMENUITEM;
PVOID __fnINLPUAHDRAWMENU3;
PVOID __fnINOUTLPUAHMEASUREMENUITEM;
PVOID __fnINLPUAHDRAWMENU4;
PVOID __fnOUTLPTITLEBARINFOEX;
PVOID __fnTOUCH;
PVOID __fnGESTURE;
PVOID __fnPOPTINLPUINT4;
PVOID __fnPOPTINLPUINT5;
PVOID __xxxClientCallDefaultInputHandler;
PVOID __fnEMPTY2;
PVOID __ClientRimDevCallback;
PVOID __xxxClientCallMinTouchHitTestingCallback;
PVOID __ClientCallLocalMouseHooks;
PVOID __xxxClientBroadcastThemeChange;
PVOID __xxxClientCallDevCallbackSimple;
PVOID __xxxClientAllocWindowClassExtraBytes;
PVOID __xxxClientFreeWindowClassExtraBytes;
PVOID __fnGETWINDOWDATA;
PVOID __fnINOUTSTYLECHANGE2;
PVOID __fnHkINLPMOUSEHOOKSTRUCTEX2;
PVOID __xxxClientCallDefWindowProc;
PVOID __fnSHELLSYNCDISPLAYCHANGED;
PVOID __fnHkINLPCHARHOOKSTRUCT;
PVOID __fnINTERCEPTEDWINDOWACTION;
PVOID __xxxTooltipCallback;
PVOID __xxxClientInitPSBInfo;
PVOID __xxxClientDoScrollMenu;
PVOID __xxxClientEndScroll;
PVOID __xxxClientDrawSize;
PVOID __xxxClientDrawScrollBar;
PVOID __xxxClientHitTestScrollBar;
PVOID __xxxClientTrackInit;
} KERNEL_CALLBACK_TABLE, *PKERNEL_CALLBACK_TABLE;
#endif
ntwmi.h
+12 -7
View File
@@ -2156,7 +2156,7 @@ typedef struct _ETW_DISKIO_READWRITE_V2
ULONG DiskNumber;
ULONG IrpFlags;
ULONG Size;
ULONG Reserved;
ULONG ResponseTime;
ULONGLONG ByteOffset;
PVOID FileObject;
PVOID IrpAddress;
@@ -2168,12 +2168,12 @@ typedef struct _ETW_DISKIO_READWRITE_V3
ULONG DiskNumber;
ULONG IrpFlags;
ULONG Size;
ULONG Reserved;
ULONG ResponseTime;
ULONGLONG ByteOffset;
PVOID FileObject;
PVOID IrpAddress;
ULONGLONG HighResResponseTime;
ULONG IssuingThreadId;
ULONG IssuingThreadId; // since WIN8
} ETW_DISKIO_READWRITE_V3, *PETW_DISKIO_READWRITE_V3;
typedef struct _ETW_DISKIO_FLUSH_BUFFERS_V2
@@ -2273,6 +2273,12 @@ typedef struct _WMI_FILE_IO
WCHAR FileName[1];
} WMI_FILE_IO, *PWMI_FILE_IO;
typedef struct _WMI_FILE_IO_WOW64
{
ULONGLONG FileObject;
WCHAR FileName[1];
} WMI_FILE_IO_WOW64, *PWMI_FILE_IO_WOW64;
typedef struct _WMI_TCPIP_V4
{
ULONG ProcessId;
@@ -5962,7 +5968,7 @@ typedef enum _ETWTRACECONTROLCODE
EtwGetPmcSessions = 46,
} ETWTRACECONTROLCODE;
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -5976,7 +5982,7 @@ NtTraceControl(
);
#endif
#if (PHNT_VERSION >= PHNT_WINXP)
#if (PHNT_VERSION >= PHNT_WINDOWS_XP)
NTSYSCALLAPI
NTSTATUS
NTAPI
@@ -5997,7 +6003,7 @@ typedef struct _TELEMETRY_COVERAGE_POINT
ULONG Flags;
} TELEMETRY_COVERAGE_POINT, *PTELEMETRY_COVERAGE_POINT;
#if (PHNT_VERSION >= PHNT_REDSTONE3)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3)
// rev
NTSYSAPI
BOOLEAN
@@ -6155,7 +6161,6 @@ WmiSetSingleItemW(
_In_reads_bytes_(ValueBufferSize) PVOID ValueBuffer
);
NTSYSAPI
ULONG
NTAPI
ntwow64.h
+31 -24
View File
@@ -7,6 +7,10 @@
#ifndef _NTWOW64_H
#define _NTWOW64_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#include <ntxcapi.h>
#endif
#define WOW64_SYSTEM_DIRECTORY "SysWOW64"
#define WOW64_SYSTEM_DIRECTORY_U L"SysWOW64"
#define WOW64_X86_TAG " (x86)"
@@ -415,12 +419,13 @@ typedef struct _PEB32
ULONGLONG ExtendedFeatureDisableMask; // since WIN11
} PEB32, *PPEB32;
//C_ASSERT(sizeof(PEB32) == 0x460); // REDSTONE3
//C_ASSERT(sizeof(PEB32) == 0x470); // REDSTONE5
C_ASSERT(sizeof(PEB32) == 0x488); // WIN11
//static_assert(sizeof(PEB32) == 0x460, "sizeof(PEB32) is incorrect"); // REDSTONE3
//static_assert(sizeof(PEB32) == 0x470, "sizeof(PEB32) is incorrect"); // REDSTONE5
static_assert(sizeof(PEB32) == 0x488, "sizeof(PEB32) is incorrect"); // WIN11
// Note: Use PhGetProcessPeb32 instead. (dmex)
//#define WOW64_GET_PEB32(peb64) ((PPEB32)PTR_ADD_OFFSET((peb64), ALIGN_UP_BY(sizeof(PEB), PAGE_SIZE)))
//#define WOW64_GET_PEB32(peb64) \
// ((PPEB32)RtlOffsetToPointer((peb64), ALIGN_UP_BY(sizeof(PEB), PAGE_SIZE)))
#define GDI_BATCH_BUFFER_SIZE 310
@@ -577,21 +582,15 @@ typedef struct _TEB32
GUID EffectiveContainerId;
} TEB32, *PTEB32;
C_ASSERT(FIELD_OFFSET(TEB32, ProcessEnvironmentBlock) == 0x030);
C_ASSERT(FIELD_OFFSET(TEB32, ExceptionCode) == 0x1a4);
C_ASSERT(FIELD_OFFSET(TEB32, TxFsContext) == 0x1d0);
C_ASSERT(FIELD_OFFSET(TEB32, glContext) == 0xbf0);
C_ASSERT(FIELD_OFFSET(TEB32, StaticUnicodeBuffer) == 0xc00);
C_ASSERT(FIELD_OFFSET(TEB32, TlsLinks) == 0xf10);
C_ASSERT(FIELD_OFFSET(TEB32, DbgSsReserved) == 0xf20);
C_ASSERT(FIELD_OFFSET(TEB32, ActivityId) == 0xf50);
C_ASSERT(FIELD_OFFSET(TEB32, GdiBatchCount) == 0xf70);
C_ASSERT(FIELD_OFFSET(TEB32, TlsExpansionSlots) == 0xf94);
C_ASSERT(FIELD_OFFSET(TEB32, FlsData) == 0xfb4);
C_ASSERT(FIELD_OFFSET(TEB32, MuiImpersonation) == 0xfc4);
C_ASSERT(FIELD_OFFSET(TEB32, ReservedForCrt) == 0xfe8);
C_ASSERT(FIELD_OFFSET(TEB32, EffectiveContainerId) == 0xff0);
C_ASSERT(sizeof(TEB32) == 0x1000);
static_assert(FIELD_OFFSET(TEB32, ProcessEnvironmentBlock) == 0x030, "FIELD_OFFSET(TEB32, ProcessEnvironmentBlock) is incorrect");
static_assert(FIELD_OFFSET(TEB32, ExceptionCode) == 0x1a4, "FIELD_OFFSET(TEB32, ExceptionCode) is incorrect");
static_assert(FIELD_OFFSET(TEB32, StaticUnicodeBuffer) == 0xc00, "FIELD_OFFSET(TEB32, StaticUnicodeBuffer) is incorrect");
static_assert(FIELD_OFFSET(TEB32, TlsLinks) == 0xf10, "FIELD_OFFSET(TEB32, TlsLinks) is incorrect");
static_assert(FIELD_OFFSET(TEB32, TlsExpansionSlots) == 0xf94, "FIELD_OFFSET(TEB32, TlsExpansionSlots) is incorrect");
static_assert(FIELD_OFFSET(TEB32, FlsData) == 0xfb4, "FIELD_OFFSET(TEB32, FlsData) is incorrect");
static_assert(FIELD_OFFSET(TEB32, MuiImpersonation) == 0xfc4, "FIELD_OFFSET(TEB32, MuiImpersonation) is incorrect");
static_assert(FIELD_OFFSET(TEB32, EffectiveContainerId) == 0xff0, "FIELD_OFFSET(TEB32, EffectiveContainerId) is incorrect");
static_assert(sizeof(TEB32) == 0x1000, "sizeof(TEB32) is incorrect");
// Conversion
@@ -628,7 +627,7 @@ FORCEINLINE VOID UStrToUStr32(
// Convert the number of native pages to sub x86-pages
//
#define Wow64GetNumberOfX86Pages(NativePages) \
(NativePages * (PAGE_SIZE_X86NT >> PAGE_SHIFT_X86NT))
((NativePages) * (PAGE_SIZE_X86NT >> PAGE_SHIFT_X86NT))
//
// Macro to round to the nearest page size
@@ -648,6 +647,9 @@ FORCEINLINE VOID UStrToUStr32(
#define WOW64_GET_TEB32(teb64) ((PTEB32)(((ULONG_PTR)(teb64)) + ((ULONG_PTR)WOW64_ROUND_TO_PAGES(sizeof(TEB)))))
#define WOW64_TEB32_POINTER_ADDRESS(teb64) ((PVOID)&(((PTEB)(teb64))->NtTib.ExceptionList))
//
// Get the 32-bit execute options.
//
typedef union _WOW64_EXECUTE_OPTIONS
{
ULONG Flags;
@@ -711,13 +713,14 @@ Wow64CurrentGuestTeb(
if (Teb->WowTebOffset < 0)
{
//
// Was called while running under WoW. The current teb is the guest
// teb.
// Was called while running under WoW. The current teb is the guest teb.
//
Teb32 = (PTEB32)Teb;
#if defined(RTL_ASSERT)
RTL_ASSERT(&Teb32->WowTebOffset == &Teb->WowTebOffset);
#endif
}
else
{
@@ -729,7 +732,9 @@ Wow64CurrentGuestTeb(
Teb32 = (PTEB32)RtlOffsetToPointer(Teb, Teb->WowTebOffset);
}
#if defined(RTL_ASSERT)
RTL_ASSERT(Teb32->NtTib.Self == PtrToUlong(Teb32));
#endif
return Teb32;
}
@@ -765,7 +770,9 @@ Wow64CurrentNativeTeb(
HostTeb = (PVOID)RtlOffsetToPointer(Teb, Teb->WowTebOffset);
}
#if defined(RTL_ASSERT)
RTL_ASSERT((((PTEB32)HostTeb)->NtTib.Self == PtrToUlong(HostTeb)) || ((ULONG_PTR)((PTEB)HostTeb)->NtTib.Self == (ULONG_PTR)HostTeb));
#endif
return HostTeb;
}
@@ -776,7 +783,7 @@ Wow64CurrentNativeTeb(
#define Wow64GetNativeTebField(teb, field) (((ULONG)(teb) == ((PTEB32)(teb))->NtTib.Self) ? (((PTEB32)(teb))->##field) : (((PTEB)(teb))->##field) )
#define Wow64SetNativeTebField(teb, field, value) { if ((ULONG)(teb) == ((PTEB32)(teb))->NtTib.Self) {(((PTEB32)(teb))->##field) = (value);} else {(((PTEB)(teb))->##field) = (value);} }
#endif
#endif
#endif // _M_X64
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#endif
ntxcapi.h
+5 -5
View File
@@ -31,7 +31,7 @@ RtlRaiseException(
_In_ PEXCEPTION_RECORD ExceptionRecord
);
#if (PHNT_VERSION >= PHNT_20H1)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1)
// rev
NTSYSAPI
VOID
@@ -50,7 +50,7 @@ RtlRaiseNoncontinuableException(
_In_ PEXCEPTION_RECORD ExceptionRecord,
_In_ PCONTEXT ContextRecord
);
#endif
#endif // PHNT_VERSION >= PHNT_WINDOWS_10_20H1
NTSYSCALLAPI
NTSTATUS
@@ -60,7 +60,7 @@ NtContinue(
_In_ BOOLEAN TestAlert
);
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
typedef enum _KCONTINUE_TYPE
{
KCONTINUE_UNWIND,
@@ -97,7 +97,7 @@ NtContinueEx(
//{
// return NtContinueEx(ContextRecord, (PCONTINUE_ARGUMENT)TestAlert);
//}
#endif
#endif // PHNT_VERSION >= PHNT_WINDOWS_10
NTSYSCALLAPI
NTSTATUS
@@ -109,7 +109,7 @@ NtRaiseException(
);
_Analysis_noreturn_
NTSYSCALLAPI
NTSYSAPI
DECLSPEC_NORETURN
VOID
NTAPI
ntzwapi.h
+10
View File
@@ -2297,6 +2297,16 @@ ZwMakeTemporaryObject(
_In_ HANDLE Handle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwManageHotPatch(
_In_ HOT_PATCH_INFORMATION_CLASS HotPatchInformationClass,
_Out_writes_bytes_opt_(HotPatchInformationLength) PVOID HotPatchInformation,
_In_ ULONG HotPatchInformationLength,
_Out_opt_ PULONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
phnt.h
+44 -42
View File
@@ -30,57 +30,60 @@
#define PHNT_MODE_USER 1
// Version
#define PHNT_WIN2K 50
#define PHNT_WINXP 51
#define PHNT_WS03 52
#define PHNT_VISTA 60
#define PHNT_WIN7 61
#define PHNT_WIN8 62
#define PHNT_WINBLUE 63
#define PHNT_THRESHOLD 100
#define PHNT_THRESHOLD2 101
#define PHNT_REDSTONE 102
#define PHNT_REDSTONE2 103
#define PHNT_REDSTONE3 104
#define PHNT_REDSTONE4 105
#define PHNT_REDSTONE5 106
#define PHNT_19H1 107
#define PHNT_19H2 108
#define PHNT_20H1 109
#define PHNT_20H2 110
#define PHNT_21H1 111
#define PHNT_WIN10_21H2 112
#define PHNT_WIN10_22H2 113
#define PHNT_WIN11 114
#define PHNT_WIN11_22H2 115
#define PHNT_WIN11_23H2 116
#define PHNT_WIN11_24H2 117
#define PHNT_WINDOWS_ANCIENT 0
#define PHNT_WINDOWS_XP 51 // August, 2001
#define PHNT_WINDOWS_SERVER_2003 52 // April, 2003
#define PHNT_WINDOWS_VISTA 60 // November, 2006
#define PHNT_WINDOWS_7 61 // July, 2009
#define PHNT_WINDOWS_8 62 // August, 2012
#define PHNT_WINDOWS_8_1 63 // August, 2013
#define PHNT_WINDOWS_10 100 // July, 2015 // Version 1507, Build 10240
#define PHNT_WINDOWS_10_TH2 101 // November, 2015 // Version 1511, Build 10586
#define PHNT_WINDOWS_10_RS1 102 // August, 2016 // Version 1607, Build 14393
#define PHNT_WINDOWS_10_RS2 103 // April, 2017 // Version 1703, Build 15063
#define PHNT_WINDOWS_10_RS3 104 // October, 2017 // Version 1709, Build 16299
#define PHNT_WINDOWS_10_RS4 105 // April, 2018 // Version 1803, Build 17134
#define PHNT_WINDOWS_10_RS5 106 // November, 2018 // Version 1809, Build 17763
#define PHNT_WINDOWS_10_19H1 107 // May, 2019 // Version 1903, Build 18362
#define PHNT_WINDOWS_10_19H2 108 // November, 2019 // Version 1909, Build 18363
#define PHNT_WINDOWS_10_20H1 109 // May, 2020 // Version 2004, Build 19041
#define PHNT_WINDOWS_10_20H2 110 // October, 2020 // Build 19042
#define PHNT_WINDOWS_10_21H1 111 // May, 2021 // Build 19043
#define PHNT_WINDOWS_10_21H2 112 // November, 2021 // Build 19044
#define PHNT_WINDOWS_10_22H2 113 // October, 2022 // Build 19045
#define PHNT_WINDOWS_11 114 // October, 2021 // Build 22000
#define PHNT_WINDOWS_11_22H2 115 // September, 2022 // Build 22621
#define PHNT_WINDOWS_11_23H2 116 // October, 2023 // Build 22631
#define PHNT_WINDOWS_11_24H2 117 // October, 2024 // Build 26100
#define PHNT_WINDOWS_NEW ULONG_MAX
#ifndef PHNT_MODE
#define PHNT_MODE PHNT_MODE_USER
#endif
#ifndef PHNT_VERSION
#define PHNT_VERSION PHNT_WIN11_24H2
#define PHNT_VERSION PHNT_WINDOWS_NEW
#endif
//
// Options
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
//#ifndef PHNT_NO_INLINE_INIT_STRING
//#define PHNT_NO_INLINE_INIT_STRING
//#endif // !PHNT_NO_INLINE_INIT_STRING
#ifndef PHNT_INLINE_TYPEDEFS
#define PHNT_INLINE_TYPEDEFS
#endif
#endif
#endif // !PHNT_INLINE_TYPEDEFS
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#ifdef __cplusplus
extern "C" {
#endif
EXTERN_C_START
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#include <phnt_ntdef.h>
#include <ntnls.h>
#endif
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#include <ntkeapi.h>
#include <ntldr.h>
@@ -93,29 +96,28 @@ extern "C" {
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#include <ntdbg.h>
#include <ntimage.h>
#include <ntioapi.h>
#include <ntlsa.h>
#include <ntlpcapi.h>
#include <ntmisc.h>
#include <ntpfapi.h>
#include <ntpnpapi.h>
#include <ntpoapi.h>
#include <ntregapi.h>
#include <ntrtl.h>
#include <ntimage.h>
#include <ntsam.h>
#include <ntseapi.h>
#include <nttmapi.h>
#include <nttp.h>
#include <ntxcapi.h>
#include <ntwow64.h>
#include <ntlsa.h>
#include <ntsam.h>
#include <ntmisc.h>
#include <ntuser.h>
#include <ntwmi.h>
#include <ntwow64.h>
#include <ntxcapi.h>
#include <ntzwapi.h>
#endif
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
#ifdef __cplusplus
}
#endif
EXTERN_C_END
static_assert(__alignof(LARGE_INTEGER) == 8, "Windows headers require the default packing option. Changing the packing can lead to memory corruption.");
static_assert(__alignof(PROCESS_CYCLE_TIME_INFORMATION) == 8, "PHNT headers require the default packing option. Changing the packing can lead to memory corruption.");
phnt_ntdef.h
+96 -15
View File
@@ -117,10 +117,40 @@ typedef struct _ULARGE_INTEGER_128
// Functions
//
#ifndef _WIN64
#define FASTCALL __fastcall
#else
#if defined(_WIN64)
#define FASTCALL
#else
#define FASTCALL __fastcall
#endif
#if defined(_WIN64)
#define POINTER_ALIGNMENT DECLSPEC_ALIGN(8)
#else
#define POINTER_ALIGNMENT
#endif
#if defined(_WIN64) || defined(_M_ALPHA)
#define MAX_NATURAL_ALIGNMENT sizeof(ULONGLONG)
#define MEMORY_ALLOCATION_ALIGNMENT 16
#else
#define MAX_NATURAL_ALIGNMENT sizeof(DWORD)
#define MEMORY_ALLOCATION_ALIGNMENT 8
#endif
#ifndef DECLSPEC_NOALIAS
#if _MSC_VER < 1900
#define DECLSPEC_NOALIAS
#else
#define DECLSPEC_NOALIAS __declspec(noalias)
#endif
#endif
#ifndef DECLSPEC_IMPORT
#define DECLSPEC_IMPORT __declspec(dllimport)
#endif
#ifndef DECLSPEC_EXPORT
#define DECLSPEC_EXPORT __declspec(dllexport)
#endif
//
@@ -192,7 +222,9 @@ UNICODE_STRING _var = { 0, (_size) * sizeof(WCHAR) , _var ## _buffer }
// Balanced tree node
//
#ifndef RTL_BALANCED_NODE_RESERVED_PARENT_MASK
#define RTL_BALANCED_NODE_RESERVED_PARENT_MASK 3
#endif
typedef struct _RTL_BALANCED_NODE
{
@@ -203,18 +235,20 @@ typedef struct _RTL_BALANCED_NODE
{
struct _RTL_BALANCED_NODE *Left;
struct _RTL_BALANCED_NODE *Right;
};
};
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
union
{
UCHAR Red : 1;
UCHAR Balance : 2;
ULONG_PTR ParentValue;
};
} DUMMYUNIONNAME2;
} RTL_BALANCED_NODE, *PRTL_BALANCED_NODE;
#ifndef RTL_BALANCED_NODE_GET_PARENT_POINTER
#define RTL_BALANCED_NODE_GET_PARENT_POINTER(Node) \
((PRTL_BALANCED_NODE)((Node)->ParentValue & ~RTL_BALANCED_NODE_RESERVED_PARENT_MASK))
#endif
//
// Portability
@@ -418,20 +452,67 @@ typedef struct _KSYSTEM_TIME
#define PtrOffset(B,O) ((ULONG)((ULONG_PTR)(O) - (ULONG_PTR)(B)))
#endif
#ifndef ALIGN_UP_BY
#define ALIGN_UP_BY(Address, Align) (((ULONG_PTR)(Address) + (Align) - 1) & ~((Align) - 1))
#endif
#ifndef ALIGN_UP_POINTER_BY
#define ALIGN_UP_POINTER_BY(Pointer, Align) ((PVOID)ALIGN_UP_BY(Pointer, Align))
#endif
#ifndef ALIGN_UP
#define ALIGN_UP(Address, Type) ALIGN_UP_BY(Address, sizeof(Type))
#endif
#ifndef ALIGN_UP_POINTER
#define ALIGN_UP_POINTER(Pointer, Type) ((PVOID)ALIGN_UP(Pointer, Type))
#endif
#ifndef ALIGN_DOWN_BY
#define ALIGN_DOWN_BY(Address, Align) ((ULONG_PTR)(Address) & ~((ULONG_PTR)(Align) - 1))
#endif
#ifndef ALIGN_DOWN_POINTER_BY
#define ALIGN_DOWN_POINTER_BY(Pointer, Align) ((PVOID)ALIGN_DOWN_BY(Pointer, Align))
#endif
#ifndef ALIGN_DOWN
#define ALIGN_DOWN(Address, Type) ALIGN_DOWN_BY(Address, sizeof(Type))
#endif
#ifndef ALIGN_DOWN_POINTER
#define ALIGN_DOWN_POINTER(Pointer, Type) ((PVOID)ALIGN_DOWN(Pointer, Type))
#endif
#ifndef IS_ALIGNED
#define IS_ALIGNED(Pointer, Alignment) ((((ULONG_PTR)(Pointer)) & ((Alignment) - 1)) == 0)
#endif
#if defined(_WIN64)
#define POINTER_ALIGNMENT DECLSPEC_ALIGN(8)
#else
#define POINTER_ALIGNMENT
#ifndef PAGE_SIZE
#define PAGE_SIZE 0x1000
#endif
#ifndef PAGE_MASK
#define PAGE_MASK 0xFFF
#endif
#ifndef PAGE_SHIFT
#define PAGE_SHIFT 0xC
#endif
#ifndef DECLSPEC_NOALIAS
#if _MSC_VER < 1900
#define DECLSPEC_NOALIAS
#else
#define DECLSPEC_NOALIAS __declspec(noalias)
#ifndef BYTE_OFFSET
#define BYTE_OFFSET(Address) ((SIZE_T)((ULONG_PTR)(Address) & PAGE_MASK))
#endif
#ifndef PAGE_ALIGN
#define PAGE_ALIGN(Address) ((PVOID)((ULONG_PTR)(Address) & ~PAGE_MASK))
#endif
#ifndef PAGE_OFFSET
#define PAGE_OFFSET(p) ((PAGE_MASK) & (ULONG_PTR)(p))
#endif
#ifndef ADDRESS_AND_SIZE_TO_SPAN_PAGES
#define ADDRESS_AND_SIZE_TO_SPAN_PAGES(Address, Size) ((BYTE_OFFSET(Address) + ((SIZE_T)(Size)) + PAGE_MASK) >> PAGE_SHIFT)
#endif
#ifndef ROUND_TO_SIZE
#define ROUND_TO_SIZE(Size, Alignment) ((((ULONG_PTR)(Size))+((Alignment)-1)) & ~(ULONG_PTR)((Alignment)-1))
#endif
#ifndef ROUND_TO_PAGES
#define ROUND_TO_PAGES(Size) (((ULONG_PTR)(Size) + PAGE_MASK) & ~PAGE_MASK)
#endif
#ifndef BYTES_TO_PAGES
#define BYTES_TO_PAGES(Size) (((Size) >> PAGE_SHIFT) + (((Size) & PAGE_MASK) != 0))
#endif
#endif // _NTDEF_
#endif
phnt_windows.h
+1 -7
View File
@@ -164,14 +164,8 @@ typedef GUID *PGUID;
typedef const GUID* PCGUID;
#endif
#ifndef GUID_NULL
DEFINE_GUID(GUID_NULL, 0x00000000L, 0x0000, 0x0000, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00);
#if __STDC_VERSION__ >= 202311L
#ifndef __cplusplus
#define nullptr ((void *)0)
#endif
typedef typeof(nullptr) nullptr_t;
#endif
#include <stddef.h>
#endif
subprocesstag.h
+20 -17
View File
@@ -23,14 +23,14 @@ typedef enum _TAG_TYPE
typedef struct _TAG_INFO_NAME_FROM_TAG_IN_PARAMS
{
ULONG dwPid;
ULONG dwTag;
ULONG ProcessId;
ULONG ServiceTag;
} TAG_INFO_NAME_FROM_TAG_IN_PARAMS, *PTAG_INFO_NAME_FROM_TAG_IN_PARAMS;
typedef struct _TAG_INFO_NAME_FROM_TAG_OUT_PARAMS
{
ULONG eTagType;
PWSTR pszName;
ULONG TagType;
PCWSTR Name;
} TAG_INFO_NAME_FROM_TAG_OUT_PARAMS, *PTAG_INFO_NAME_FROM_TAG_OUT_PARAMS;
typedef struct _TAG_INFO_NAME_FROM_TAG
@@ -41,14 +41,14 @@ typedef struct _TAG_INFO_NAME_FROM_TAG
typedef struct _TAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS
{
ULONG dwPid;
PCWSTR pszModule;
ULONG ProcessId;
PCWSTR ModuleName;
} TAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS, *PTAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS;
typedef struct _TAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS
{
ULONG eTagType;
PCWSTR pmszNames;
ULONG TagType;
PCWSTR Names;
} TAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS, *PTAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS;
typedef struct _TAG_INFO_NAMES_REFERENCING_MODULE
@@ -59,21 +59,21 @@ typedef struct _TAG_INFO_NAMES_REFERENCING_MODULE
typedef struct _TAG_INFO_NAME_TAG_MAPPING_IN_PARAMS
{
ULONG dwPid;
ULONG ProcessId;
} TAG_INFO_NAME_TAG_MAPPING_IN_PARAMS, *PTAG_INFO_NAME_TAG_MAPPING_IN_PARAMS;
typedef struct _TAG_INFO_NAME_TAG_MAPPING_ELEMENT
{
ULONG eTagType;
ULONG dwTag;
PWSTR pszName;
PWSTR pszGroupName;
ULONG TagType;
ULONG Tag;
PCWSTR Name;
PCWSTR GroupName;
} TAG_INFO_NAME_TAG_MAPPING_ELEMENT, *PTAG_INFO_NAME_TAG_MAPPING_ELEMENT;
typedef struct _TAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS
{
ULONG cElements;
PTAG_INFO_NAME_TAG_MAPPING_ELEMENT pNameTagMappingElements;
ULONG Count;
PTAG_INFO_NAME_TAG_MAPPING_ELEMENT NameTagMappingElements;
} TAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS, *PTAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS;
typedef struct _TAG_INFO_NAME_TAG_MAPPING
@@ -83,18 +83,21 @@ typedef struct _TAG_INFO_NAME_TAG_MAPPING
} TAG_INFO_NAME_TAG_MAPPING, *PTAG_INFO_NAME_TAG_MAPPING;
_Must_inspect_result_
NTSYSAPI
ULONG
WINAPI
NTAPI
I_QueryTagInformation(
_In_opt_ PCWSTR MachineName,
_In_ TAG_INFO_LEVEL InfoLevel,
_Inout_ PVOID TagInfo
);
typedef ULONG (WINAPI *PQUERY_TAG_INFORMATION)(
typedef _Function_class_(QUERY_TAG_INFORMATION)
ULONG NTAPI QUERY_TAG_INFORMATION(
_In_opt_ PCWSTR MachineName,
_In_ TAG_INFO_LEVEL InfoLevel,
_Inout_ PVOID TagInfo
);
typedef QUERY_TAG_INFORMATION *PQUERY_TAG_INFORMATION;
#endif
usermgr.h
+6 -6
View File
@@ -28,7 +28,7 @@ typedef struct _CRED_PROV_CREDENTIAL
// Contexts
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
// rev
USERMGRAPI
@@ -78,7 +78,7 @@ UMgrQueryUserContextFromName(
// Tokens
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
// rev
USERMGRAPI
@@ -137,7 +137,7 @@ UMgrGetConstrainedUserToken(
#endif
#if (PHNT_VERSION >= PHNT_THRESHOLD2)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_TH2)
// rev
USERMGRAPI
@@ -159,7 +159,7 @@ UMgrGetImpersonationTokenForContext(
#endif
#if (PHNT_VERSION >= PHNT_REDSTONE)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1)
// rev
USERMGRAPI
@@ -174,7 +174,7 @@ UMgrGetSessionActiveShellUserToken(
// Single-session SKU
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
// rev
USERMGRAPI
@@ -199,7 +199,7 @@ UMgrOpenProcessHandleForAccess(
// Credentials
#if (PHNT_VERSION >= PHNT_THRESHOLD)
#if (PHNT_VERSION >= PHNT_WINDOWS_10)
// rev
USERMGRAPI
winsta.h
+1 -1
View File
@@ -1097,7 +1097,7 @@ WinStationGetProcessSid(
// Services isolation
#if (PHNT_VERSION >= PHNT_VISTA)
#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA)
// rev
NTSYSAPI