From 4cc8487a970a85be7eec70484c930e0a3b2ffc10 Mon Sep 17 00:00:00 2001 From: Johnny Shaw Date: Tue, 11 Mar 2025 16:33:45 -0600 Subject: [PATCH] sync latest --- README.md | 18 +- ntbcd.h | 2 +- ntexapi.h | 664 ++++++++++++++++++++++++++++++++-------- ntioapi.h | 135 ++++---- ntkeapi.h | 98 +++--- ntldr.h | 48 +-- ntlpcapi.h | 8 +- ntmisc.h | 479 ++++++++++++++++++++++++++++- ntmmapi.h | 91 +++++- ntobapi.h | 10 +- ntpebteb.h | 68 ++++- ntpnpapi.h | 6 +- ntpoapi.h | 11 +- ntpsapi.h | 86 ++++-- ntregapi.h | 26 +- ntrtl.h | 722 +++++++++++++++++++++++-------------------- ntseapi.h | 181 +++++++---- nttmapi.h | 80 ++--- nttp.h | 10 +- ntuser.h | 795 ++++++++++++++++++++++++------------------------ ntwmi.h | 19 +- ntwow64.h | 55 ++-- ntxcapi.h | 10 +- ntzwapi.h | 10 + phnt.h | 86 +++--- phnt_ntdef.h | 111 ++++++- phnt_windows.h | 8 +- subprocesstag.h | 37 +-- usermgr.h | 12 +- winsta.h | 2 +- 30 files changed, 2561 insertions(+), 1327 deletions(-) diff --git a/README.md b/README.md index 2768f1c..ac35a0d 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -This collection of Native API header files has been maintained since 2009 for the System Informer project, and is the most up-to-date set of Native API definitions that we know of. We have gathered these definitions from official Microsoft header files and symbol files, as well as a lot of reverse engineering and guessing. See `phnt.h` for more information. +This collection of Native API header files has been maintained since 2009 for the Process Hacker project, and is the most up-to-date set of Native API definitions that I know of. I have gathered these definitions from official Microsoft header files and symbol files, as well as a lot of reverse engineering and guessing. See `phnt.h` for more information. ## Usage @@ -14,12 +14,12 @@ These header files are designed to be used by user-mode programs. Instead of `#i at the top of your program. The first line provides access to the Win32 API as well as the `NTSTATUS` values. The second line provides access to the entire Native API. By default, only definitions present in Windows XP are included into your program. To change this, use one of the following: ``` -#define PHNT_VERSION PHNT_WINXP // Windows XP -#define PHNT_VERSION PHNT_WS03 // Windows Server 2003 -#define PHNT_VERSION PHNT_VISTA // Windows Vista -#define PHNT_VERSION PHNT_WIN7 // Windows 7 -#define PHNT_VERSION PHNT_WIN8 // Windows 8 -#define PHNT_VERSION PHNT_WINBLUE // Windows 8.1 -#define PHNT_VERSION PHNT_THRESHOLD // Windows 10 -#define PHNT_VERSION PHNT_WIN11 // Windows 11 +#define PHNT_VERSION PHNT_WINDOWS_XP // Windows XP +#define PHNT_VERSION PHNT_WINDOWS_SERVER_2003 // Windows Server 2003 +#define PHNT_VERSION PHNT_WINDOWS_VISTA // Windows Vista +#define PHNT_VERSION PHNT_WINDOWS_7 // Windows 7 +#define PHNT_VERSION PHNT_WINDOWS_8 // Windows 8 +#define PHNT_VERSION PHNT_WINDOWS_8_1 // Windows 8.1 +#define PHNT_VERSION PHNT_WINDOWS_10 // Windows 10 +#define PHNT_VERSION PHNT_WINDOWS_11 // Windows 11 ``` diff --git a/ntbcd.h b/ntbcd.h index 79607cc..1327e22 100644 --- a/ntbcd.h +++ b/ntbcd.h @@ -231,7 +231,7 @@ BcdExportStore( _In_ PCUNICODE_STRING BcdFilePath ); -#if (PHNT_VERSION > PHNT_WIN11) +#if (PHNT_VERSION > PHNT_WINDOWS_11) /** * Exports the BCD store to a file with additional flags. * diff --git a/ntexapi.h b/ntexapi.h index 40ee268..0ffe98f 100644 --- a/ntexapi.h +++ b/ntexapi.h @@ -245,7 +245,7 @@ typedef struct _EFI_DRIVER_ENTRY_LIST EFI_DRIVER_ENTRY DriverEntry; } EFI_DRIVER_ENTRY_LIST, *PEFI_DRIVER_ENTRY_LIST; -#if (PHNT_VERSION >= PHNT_WINXP) +#if (PHNT_VERSION >= PHNT_WINDOWS_XP) /** * The NtAddBootEntry routine adds a new boot entry to the system boot configuration. * @@ -380,7 +380,9 @@ NtTranslateFilePath( _Out_writes_bytes_opt_(*OutputFilePathLength) PFILE_PATH OutputFilePath, _Inout_opt_ PULONG OutputFilePathLength ); +#endif // (PHNT_VERSION >= PHNT_WINDOWS_XP) +#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003) /** * The NtAddDriverEntry routine adds a new driver entry to the system boot configuration. * @@ -466,7 +468,7 @@ NtSetDriverEntryOrder( _In_reads_(Count) PULONG Ids, _In_ ULONG Count ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003) typedef enum _FILTER_BOOT_OPTION_OPERATION { @@ -476,7 +478,7 @@ typedef enum _FILTER_BOOT_OPTION_OPERATION FilterBootOptionOperationMax } FILTER_BOOT_OPTION_OPERATION; -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) /** * The NtFilterBootOption routine filters boot options based on the specified operation, object type, and element type. * @@ -497,7 +499,7 @@ NtFilterBootOption( _In_reads_bytes_opt_(DataSize) PVOID Data, _In_ ULONG DataSize ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_8) // // Event @@ -581,7 +583,7 @@ NtSetEvent( _Out_opt_ PLONG PreviousState ); -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) /** * The NtSetEventEx routine sets an event object to the signaled state and optionally acquires a lock. * @@ -596,7 +598,7 @@ NtSetEventEx( _In_ HANDLE ThreadId, _In_opt_ PRTL_SRWLOCK Lock ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_11) /** * The NtSetEventBoostPriority routine sets an event object to the signaled state and boosts the priority of threads waiting on the event. @@ -1038,11 +1040,13 @@ typedef struct _TIMER_BASIC_INFORMATION BOOLEAN TimerState; } TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION; -typedef VOID (NTAPI *PTIMER_APC_ROUTINE)( +typedef _Function_class_(TIMER_APC_ROUTINE) +VOID NTAPI TIMER_APC_ROUTINE( _In_ PVOID TimerContext, _In_ ULONG TimerLowValue, _In_ LONG TimerHighValue ); +typedef TIMER_APC_ROUTINE* PTIMER_APC_ROUTINE; typedef enum _TIMER_SET_INFORMATION_CLASS { @@ -1093,7 +1097,7 @@ NtSetTimer( _Out_opt_ PBOOLEAN PreviousState ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSCALLAPI NTSTATUS NTAPI @@ -1103,7 +1107,7 @@ NtSetTimerEx( _Inout_updates_bytes_opt_(TimerSetInformationLength) PVOID TimerSetInformation, _In_ ULONG TimerSetInformationLength ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSCALLAPI NTSTATUS @@ -1124,7 +1128,7 @@ NtQueryTimer( _Out_opt_ PULONG ReturnLength ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS @@ -1143,9 +1147,9 @@ NtSetIRTimer( _In_opt_ PLARGE_INTEGER DueTime ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_8) -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSCALLAPI NTSTATUS @@ -1158,7 +1162,7 @@ NtCreateTimer2( _In_ ACCESS_MASK DesiredAccess ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_10) typedef struct _T2_SET_PARAMETERS_V0 { @@ -1169,7 +1173,7 @@ typedef struct _T2_SET_PARAMETERS_V0 typedef PVOID PT2_CANCEL_PARAMETERS; -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSCALLAPI NTSTATUS @@ -1189,9 +1193,11 @@ NtCancelTimer2( _In_ PT2_CANCEL_PARAMETERS Parameters ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_10) +// // Profile +// #define PROFILE_CONTROL 0x0001 #define PROFILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | PROFILE_CONTROL) @@ -1211,7 +1217,7 @@ NtCreateProfile( _In_ KAFFINITY Affinity ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSCALLAPI NTSTATUS NTAPI @@ -1227,7 +1233,7 @@ NtCreateProfileEx( _In_ USHORT GroupCount, _In_reads_(GroupCount) PGROUP_AFFINITY GroupAffinity ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSCALLAPI NTSTATUS @@ -1305,18 +1311,22 @@ NtWaitForKeyedEvent( _In_opt_ PLARGE_INTEGER Timeout ); +// // UMS +// -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSCALLAPI NTSTATUS NTAPI NtUmsThreadYield( _In_ PVOID SchedulerParam ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_7) +// // WNF +// // begin_private @@ -1375,7 +1385,7 @@ typedef struct _WNF_DELIVERY_DESCRIPTOR // end_private -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS @@ -1458,9 +1468,9 @@ NtUnsubscribeWnfStateChange( _In_ PCWNF_STATE_NAME StateName ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_8) -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSCALLAPI NTSTATUS @@ -1481,9 +1491,11 @@ NtSetWnfProcessNotificationEvent( _In_ HANDLE NotificationEvent ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_10) +// // Worker factory +// // begin_rev @@ -1559,7 +1571,7 @@ typedef struct _WORKER_FACTORY_BASIC_INFORMATION // end_private -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS @@ -1628,7 +1640,7 @@ typedef struct _WORKER_FACTORY_DEFERRED_WORK ULONG Flags; } WORKER_FACTORY_DEFERRED_WORK, *PWORKER_FACTORY_DEFERRED_WORK; -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS @@ -1651,9 +1663,9 @@ NtWaitForWorkViaWorkerFactory( _Out_ PFILE_IO_COMPLETION_INFORMATION MiniPacket ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_8) -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // // Time @@ -1725,7 +1737,7 @@ NtSetTimerResolution( ); // -// Performance Counter +// Performance Counters // NTSYSCALLAPI @@ -1736,8 +1748,15 @@ NtQueryPerformanceCounter( _Out_opt_ PLARGE_INTEGER PerformanceFrequency ); -#if (PHNT_VERSION >= PHNT_REDSTONE2) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS2) // rev +/** + * The NtQueryAuxiliaryCounterFrequency routine queries the auxiliary counter frequency. (The auxiliary counter is generally the HPET hardware timer). + * + * @param AuxiliaryCounterFrequency A pointer to an output buffer that contains the specified auxiliary counter frequency. If the auxiliary counter is not supported, the value in the output buffer will be undefined. + * @return NTSTATUS Successful or errant status. + * @see https://learn.microsoft.com/en-us/windows/win32/api/realtimeapiset/nf-realtimeapiset-queryauxiliarycounterfrequency + */ NTSYSCALLAPI NTSTATUS NTAPI @@ -1746,6 +1765,17 @@ NtQueryAuxiliaryCounterFrequency( ); // rev +/** + * The NtConvertBetweenAuxiliaryCounterAndPerformanceCounter routine converts the specified performance counter value to the corresponding auxiliary counter value; + * optionally provides the estimated conversion error in nanoseconds due to latencies and maximum possible drift. + * + * @param ConvertAuxiliaryToPerformanceCounter If TRUE, the value will be converted from AUX to QPC. If FALSE, the value will be converted from QPC to AUX. + * @param PerformanceOrAuxiliaryCounterValue The performance counter value to convert. + * @param ConvertedValue On success, contains the converted auxiliary counter value. Will be undefined if the function fails. + * @param ConversionError On success, contains the estimated conversion error, in nanoseconds. Will be undefined if the function fails. + * @return NTSTATUS Successful or errant status. + * @see https://learn.microsoft.com/en-us/windows/win32/api/realtimeapiset/nf-realtimeapiset-convertperformancecountertoauxiliarycounter + */ NTSYSCALLAPI NTSTATUS NTAPI @@ -1755,9 +1785,11 @@ NtConvertBetweenAuxiliaryCounterAndPerformanceCounter( _Out_ PULONG64 ConvertedValue, _Out_opt_ PULONG64 ConversionError ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_10_RS2) +// // LUIDs +// NTSYSCALLAPI NTSTATUS @@ -1766,7 +1798,9 @@ NtAllocateLocallyUniqueId( _Out_ PLUID Luid ); +// // UUIDs +// NTSYSCALLAPI NTSTATUS @@ -1785,10 +1819,12 @@ NtAllocateUuids( _Out_ PCHAR Seed ); -// System Information - #endif // (PHNT_MODE != PHNT_MODE_KERNEL) +// +// System Information +// + // rev // private typedef enum _SYSTEM_INFORMATION_CLASS @@ -1850,7 +1886,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemLoadGdiDriverInSystemSpace, // s: SYSTEM_GDI_DRIVER_INFORMATION (kernel-mode only) (same as SystemLoadGdiDriverInformation) SystemNumaProcessorMap, // q: SYSTEM_NUMA_INFORMATION SystemPrefetcherInformation, // q; s: PREFETCHER_INFORMATION // PfSnQueryPrefetcherInformation - SystemExtendedProcessInformation, // q: SYSTEM_PROCESS_INFORMATION + SystemExtendedProcessInformation, // q: SYSTEM_EXTENDED_PROCESS_INFORMATION SystemRecommendedSharedDataAlignment, // q: ULONG // KeGetRecommendedSharedDataAlignment SystemComPlusPackage, // q; s: ULONG SystemNumaAvailableMemory, // q: SYSTEM_NUMA_INFORMATION // 60 @@ -1939,9 +1975,9 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemSecureBootPolicyInformation, // q: SYSTEM_SECUREBOOT_POLICY_INFORMATION SystemPageFileInformationEx, // q: SYSTEM_PAGEFILE_INFORMATION_EX SystemSecureBootInformation, // q: SYSTEM_SECUREBOOT_INFORMATION - SystemEntropyInterruptTimingRawInformation, + SystemEntropyInterruptTimingRawInformation, // q; s: SYSTEM_ENTROPY_TIMING_INFORMATION SystemPortableWorkspaceEfiLauncherInformation, // q: SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION - SystemFullProcessInformation, // q: SYSTEM_PROCESS_INFORMATION with SYSTEM_PROCESS_INFORMATION_EXTENSION (requires admin) + SystemFullProcessInformation, // q: SYSTEM_EXTENDED_PROCESS_INFORMATION with SYSTEM_PROCESS_INFORMATION_EXTENSION (requires admin) SystemKernelDebuggerInformationEx, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX SystemBootMetadataInformation, // 150 // (requires SeTcbPrivilege) SystemSoftRebootInformation, // q: ULONG @@ -2041,6 +2077,9 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemResourceDeadlockTimeout, // ULONG SystemBreakOnContextUnwindFailureInformation, // ULONG (requires SeDebugPrivilege) SystemOslRamdiskInformation, // SYSTEM_OSL_RAMDISK_INFORMATION + SystemCodeIntegrityPolicyManagementInformation, // since 25H2 + SystemMemoryNumaCacheInformation, + SystemProcessorFeaturesBitMapInformation, MaxSystemInfoClass } SYSTEM_INFORMATION_CLASS; @@ -2188,25 +2227,93 @@ typedef struct _SYSTEM_TIMEOFDAY_INFORMATION ULONGLONG SleepTimeBias; } SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION; +/** + * The SYSTEM_THREAD_INFORMATION structure contains information about a thread running on a system. + * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/e82d73e4-cedb-4077-9099-d58f3459722f + */ typedef struct _SYSTEM_THREAD_INFORMATION { - LARGE_INTEGER KernelTime; - LARGE_INTEGER UserTime; - LARGE_INTEGER CreateTime; - ULONG WaitTime; - PVOID StartAddress; - CLIENT_ID ClientId; - KPRIORITY Priority; - KPRIORITY BasePriority; - ULONG ContextSwitches; - KTHREAD_STATE ThreadState; - KWAIT_REASON WaitReason; + LARGE_INTEGER KernelTime; // Number of 100-nanosecond intervals spent executing kernel code. + LARGE_INTEGER UserTime; // Number of 100-nanosecond intervals spent executing user code. + LARGE_INTEGER CreateTime; // System time when the thread was created. + ULONG WaitTime; // Time spent in ready queue or waiting (depending on the thread state). + PVOID StartAddress; // Start address of the thread. + CLIENT_ID ClientId; // ID of the thread and the process owning the thread. + KPRIORITY Priority; // Dynamic thread priority. + KPRIORITY BasePriority; // Base thread priority. + ULONG ContextSwitches; // Total context switches. + KTHREAD_STATE ThreadState; // Current thread state. + KWAIT_REASON WaitReason; // The reason the thread is waiting. } SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION; +typedef struct _SYSTEM_PROCESS_INFORMATION +{ + ULONG NextEntryOffset; // The address of the previous item plus the value in the NextEntryOffset member. For the last item in the array, NextEntryOffset is 0. + ULONG NumberOfThreads; // The NumberOfThreads member contains the number of threads in the process. + ULONGLONG WorkingSetPrivateSize; // since VISTA + ULONG HardFaultCount; // since WIN7 + ULONG NumberOfThreadsHighWatermark; // The peak number of threads that were running at any given point in time, indicative of potential performance bottlenecks related to thread management. + ULONGLONG CycleTime; // The sum of the cycle time of all threads in the process. + LARGE_INTEGER CreateTime; // Number of 100-nanosecond intervals since the creation time of the process. Not updated during system timezone changes resullting in an incorrect value. + LARGE_INTEGER UserTime; + LARGE_INTEGER KernelTime; + UNICODE_STRING ImageName; // The file name of the executable image. + KPRIORITY BasePriority; + HANDLE UniqueProcessId; + HANDLE InheritedFromUniqueProcessId; + ULONG HandleCount; + ULONG SessionId; + ULONG_PTR UniqueProcessKey; // since VISTA (requires SystemExtendedProcessInformation) + SIZE_T PeakVirtualSize; // The peak size, in bytes, of the virtual memory used by the process. + SIZE_T VirtualSize; // The current size, in bytes, of virtual memory used by the process. + ULONG PageFaultCount; // The member of page faults for data that is not currently in memory. + SIZE_T PeakWorkingSetSize; // The peak size, in kilobytes, of the working set of the process. + SIZE_T WorkingSetSize; // The number of pages visible to the process in physical memory. These pages are resident and available for use without triggering a page fault. + SIZE_T QuotaPeakPagedPoolUsage; // The peak quota charged to the process for pool usage, in bytes. + SIZE_T QuotaPagedPoolUsage; // The quota charged to the process for paged pool usage, in bytes. + SIZE_T QuotaPeakNonPagedPoolUsage; // The peak quota charged to the process for nonpaged pool usage, in bytes. + SIZE_T QuotaNonPagedPoolUsage; // The current quota charged to the process for nonpaged pool usage. + SIZE_T PagefileUsage; // The PagefileUsage member contains the number of bytes of page file storage in use by the process. + SIZE_T PeakPagefileUsage; // The maximum number of bytes of page-file storage used by the process. + SIZE_T PrivatePageCount; // The number of memory pages allocated for the use by the process. + LARGE_INTEGER ReadOperationCount; // The total number of read operations performed. + LARGE_INTEGER WriteOperationCount; // The total number of write operations performed. + LARGE_INTEGER OtherOperationCount; // The total number of I/O operations performed other than read and write operations. + LARGE_INTEGER ReadTransferCount; // The total number of bytes read during a read operation. + LARGE_INTEGER WriteTransferCount; // The total number of bytes written during a write operation. + LARGE_INTEGER OtherTransferCount; // The total number of bytes transferred during operations other than read and write operations. + SYSTEM_THREAD_INFORMATION Threads[1]; // This type is not defined in the structure but was added for convenience. +} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION; + +#define SYSTEM_PROCESS_INFORMATION_SIZE RTL_SIZEOF_THROUGH_FIELD(SYSTEM_PROCESS_INFORMATION, OtherTransferCount) + +#ifdef _WIN64 +static_assert(SYSTEM_PROCESS_INFORMATION_SIZE == 0x100, "SYSTEM_PROCESS_INFORMATION_SIZE must equal SIZEOF_THROUGH_FIELD(OtherTransferCount)"); +#else +static_assert(SYSTEM_PROCESS_INFORMATION_SIZE == 0xB8, "SYSTEM_PROCESS_INFORMATION_SIZE must equal SIZEOF_THROUGH_FIELD(OtherTransferCount)"); +#endif + // private typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION { - SYSTEM_THREAD_INFORMATION ThreadInfo; + union + { + SYSTEM_THREAD_INFORMATION ThreadInfo; + struct + { + ULONGLONG KernelTime; + ULONGLONG UserTime; + ULONGLONG CreateTime; + ULONG WaitTime; + PVOID StartAddress; + CLIENT_ID ClientId; + KPRIORITY Priority; + KPRIORITY BasePriority; + ULONG ContextSwitches; + KTHREAD_STATE ThreadState; + KWAIT_REASON WaitReason; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; ULONG_PTR StackBase; ULONG_PTR StackLimit; PVOID Win32StartAddress; @@ -2216,24 +2323,24 @@ typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION ULONG_PTR Reserved4; } SYSTEM_EXTENDED_THREAD_INFORMATION, *PSYSTEM_EXTENDED_THREAD_INFORMATION; -typedef struct _SYSTEM_PROCESS_INFORMATION +typedef struct _SYSTEM_EXTENDED_PROCESS_INFORMATION { ULONG NextEntryOffset; ULONG NumberOfThreads; - LARGE_INTEGER WorkingSetPrivateSize; // since VISTA + ULONGLONG WorkingSetPrivateSize; // since VISTA ULONG HardFaultCount; // since WIN7 - ULONG NumberOfThreadsHighWatermark; // since WIN7 - ULONGLONG CycleTime; // since WIN7 - LARGE_INTEGER CreateTime; - LARGE_INTEGER UserTime; - LARGE_INTEGER KernelTime; + ULONG NumberOfThreadsHighWatermark; + ULONGLONG CycleTime; + ULONGLONG CreateTime; + ULONGLONG UserTime; + ULONGLONG KernelTime; UNICODE_STRING ImageName; KPRIORITY BasePriority; HANDLE UniqueProcessId; HANDLE InheritedFromUniqueProcessId; ULONG HandleCount; ULONG SessionId; - ULONG_PTR UniqueProcessKey; // since VISTA (requires SystemExtendedProcessInformation) + HANDLE UniqueProcessKey; // since VISTA SIZE_T PeakVirtualSize; SIZE_T VirtualSize; ULONG PageFaultCount; @@ -2246,16 +2353,23 @@ typedef struct _SYSTEM_PROCESS_INFORMATION SIZE_T PagefileUsage; SIZE_T PeakPagefileUsage; SIZE_T PrivatePageCount; - LARGE_INTEGER ReadOperationCount; - LARGE_INTEGER WriteOperationCount; - LARGE_INTEGER OtherOperationCount; - LARGE_INTEGER ReadTransferCount; - LARGE_INTEGER WriteTransferCount; - LARGE_INTEGER OtherTransferCount; - SYSTEM_THREAD_INFORMATION Threads[1]; // SystemProcessInformation - // SYSTEM_EXTENDED_THREAD_INFORMATION Threads[1]; // SystemExtendedProcessinformation - // SYSTEM_EXTENDED_THREAD_INFORMATION + SYSTEM_PROCESS_INFORMATION_EXTENSION // SystemFullProcessInformation -} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION; + ULONGLONG ReadOperationCount; + ULONGLONG WriteOperationCount; + ULONGLONG OtherOperationCount; + ULONGLONG ReadTransferCount; + ULONGLONG WriteTransferCount; + ULONGLONG OtherTransferCount; + SYSTEM_EXTENDED_THREAD_INFORMATION Threads[1]; + // SYSTEM_PROCESS_INFORMATION_EXTENSION // SystemFullProcessInformation +} SYSTEM_EXTENDED_PROCESS_INFORMATION, *PSYSTEM_EXTENDED_PROCESS_INFORMATION; + +#define SYSTEM_EXTENDED_PROCESS_INFORMATION_SIZE RTL_SIZEOF_THROUGH_FIELD(SYSTEM_EXTENDED_PROCESS_INFORMATION, OtherTransferCount) + +#ifdef _WIN64 +static_assert(SYSTEM_EXTENDED_PROCESS_INFORMATION_SIZE == 0x100, "SYSTEM_EXTENDED_PROCESS_INFORMATION_SIZE must equal SIZEOF_THROUGH_FIELD(OtherTransferCount)"); +#else +static_assert(SYSTEM_EXTENDED_PROCESS_INFORMATION_SIZE == 0xB8, "SYSTEM_EXTENDED_PROCESS_INFORMATION_SIZE must equal SIZEOF_THROUGH_FIELD(OtherTransferCount)"); +#endif typedef struct _SYSTEM_CALL_COUNT_INFORMATION { @@ -2285,7 +2399,45 @@ typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION typedef struct _SYSTEM_FLAGS_INFORMATION { - ULONG Flags; // NtGlobalFlag + union + { + ULONG Flags; // NtGlobalFlag + struct + { + ULONG StopOnException : 1; // FLG_STOP_ON_EXCEPTION + ULONG ShowLoaderSnaps : 1; // FLG_SHOW_LDR_SNAPS + ULONG DebugInitialCommand : 1; // FLG_DEBUG_INITIAL_COMMAND + ULONG StopOnHungGUI : 1; // FLG_STOP_ON_HUNG_GUI + ULONG HeapEnableTailCheck : 1; // FLG_HEAP_ENABLE_TAIL_CHECK + ULONG HeapEnableFreeCheck : 1; // FLG_HEAP_ENABLE_FREE_CHECK + ULONG HeapValidateParameters : 1; // FLG_HEAP_VALIDATE_PARAMETERS + ULONG HeapValidateAll : 1; // FLG_HEAP_VALIDATE_ALL + ULONG ApplicationVerifier : 1; // FLG_APPLICATION_VERIFIER + ULONG MonitorSilentProcessExit : 1; // FLG_MONITOR_SILENT_PROCESS_EXIT + ULONG PoolEnableTagging : 1; // FLG_POOL_ENABLE_TAGGING + ULONG HeapEnableTagging : 1; // FLG_HEAP_ENABLE_TAGGING + ULONG UserStackTraceDb : 1; // FLG_USER_STACK_TRACE_DB + ULONG KernelStackTraceDb : 1; // FLG_KERNEL_STACK_TRACE_DB + ULONG MaintainObjectTypeList : 1; // FLG_MAINTAIN_OBJECT_TYPELIST + ULONG HeapEnableTagByDll : 1; // FLG_HEAP_ENABLE_TAG_BY_DLL + ULONG DisableStackExtension : 1; // FLG_DISABLE_STACK_EXTENSION + ULONG EnableCsrDebug : 1; // FLG_ENABLE_CSRDEBUG + ULONG EnableKDebugSymbolLoad : 1; // FLG_ENABLE_KDEBUG_SYMBOL_LOAD + ULONG DisablePageKernelStacks : 1; // FLG_DISABLE_PAGE_KERNEL_STACKS + ULONG EnableSystemCritBreaks : 1; // FLG_ENABLE_SYSTEM_CRIT_BREAKS + ULONG HeapDisableCoalescing : 1; // FLG_HEAP_DISABLE_COALESCING + ULONG EnableCloseExceptions : 1; // FLG_ENABLE_CLOSE_EXCEPTIONS + ULONG EnableExceptionLogging : 1; // FLG_ENABLE_EXCEPTION_LOGGING + ULONG EnableHandleTypeTagging : 1; // FLG_ENABLE_HANDLE_TYPE_TAGGING + ULONG HeapPageAllocs : 1; // FLG_HEAP_PAGE_ALLOCS + ULONG DebugInitialCommandEx : 1; // FLG_DEBUG_INITIAL_COMMAND_EX + ULONG DisableDbgPrint : 1; // FLG_DISABLE_DBGPRINT + ULONG CritSecEventCreation : 1; // FLG_CRITSEC_EVENT_CREATION + ULONG LdrTopDown : 1; // FLG_LDR_TOP_DOWN + ULONG EnableHandleExceptions : 1; // FLG_ENABLE_HANDLE_EXCEPTIONS + ULONG DisableProtDlls : 1; // FLG_DISABLE_PROTDLLS + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; } SYSTEM_FLAGS_INFORMATION, *PSYSTEM_FLAGS_INFORMATION; // private @@ -2465,7 +2617,7 @@ typedef struct _SYSTEM_POOLTAG { UCHAR Tag[4]; ULONG TagUlong; - }; + } DUMMYUNIONNAME; ULONG PagedAllocs; ULONG PagedFrees; SIZE_T PagedUsed; @@ -2963,7 +3115,7 @@ typedef struct _SYSTEM_GDI_DRIVER_INFORMATION PIMAGE_EXPORT_DIRECTORY ExportSectionPointer; ULONG ImageLength; } SYSTEM_GDI_DRIVER_INFORMATION, *PSYSTEM_GDI_DRIVER_INFORMATION; -#endif +#endif // (PHNT_MODE != PHNT_MODE_KERNEL) // geoffchappell #ifdef _WIN64 @@ -2982,7 +3134,7 @@ typedef struct _SYSTEM_NUMA_INFORMATION GROUP_AFFINITY ActiveProcessorsGroupAffinity[MAXIMUM_NODE_COUNT]; ULONGLONG AvailableMemory[MAXIMUM_NODE_COUNT]; ULONGLONG Pad[MAXIMUM_NODE_COUNT * 2]; - }; + } DUMMYUNIONNAME; } SYSTEM_NUMA_INFORMATION, *PSYSTEM_NUMA_INFORMATION; typedef struct _SYSTEM_PROCESSOR_POWER_INFORMATION @@ -3103,7 +3255,14 @@ typedef enum _WATCHDOG_HANDLER_ACTION WdActionQueryState } WATCHDOG_HANDLER_ACTION; -typedef NTSTATUS (NTAPI *PSYSTEM_WATCHDOG_HANDLER)(_In_ WATCHDOG_HANDLER_ACTION Action, _In_ PVOID Context, _Inout_ PULONG DataValue, _In_ BOOLEAN NoLocks); +typedef _Function_class_(SYSTEM_WATCHDOG_HANDLER) +NTSTATUS NTAPI SYSTEM_WATCHDOG_HANDLER( + _In_ WATCHDOG_HANDLER_ACTION Action, + _In_ PVOID Context, + _Inout_ PULONG DataValue, + _In_ BOOLEAN NoLocks + ); +typedef SYSTEM_WATCHDOG_HANDLER* PSYSTEM_WATCHDOG_HANDLER; // private typedef struct _SYSTEM_WATCHDOG_HANDLER_INFORMATION @@ -3151,7 +3310,7 @@ typedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION ULONG TableBufferLength; _Field_size_bytes_(TableBufferLength) UCHAR TableBuffer[1]; } SYSTEM_FIRMWARE_TABLE_INFORMATION, *PSYSTEM_FIRMWARE_TABLE_INFORMATION; -#endif +#endif // (PHNT_MODE != PHNT_MODE_KERNEL) #if (PHNT_MODE != PHNT_MODE_KERNEL) // private @@ -3167,7 +3326,7 @@ typedef struct _SYSTEM_FIRMWARE_TABLE_HANDLER PFNFTH FirmwareTableHandler; PVOID DriverObject; } SYSTEM_FIRMWARE_TABLE_HANDLER, *PSYSTEM_FIRMWARE_TABLE_HANDLER; -#endif +#endif // (PHNT_MODE != PHNT_MODE_KERNEL) // private typedef struct _SYSTEM_MEMORY_LIST_INFORMATION @@ -3280,8 +3439,8 @@ typedef struct _SYSTEM_BOOT_ENVIRONMENT_INFORMATION ULONGLONG DbgBugCheckRecovery : 1; // 24H2 ULONGLONG DbgFASR : 1; ULONGLONG DbgUseCachedBcd : 1; - }; - }; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; } SYSTEM_BOOT_ENVIRONMENT_INFORMATION, *PSYSTEM_BOOT_ENVIRONMENT_INFORMATION; // private @@ -3436,7 +3595,30 @@ typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION typedef struct _SYSTEM_CODEINTEGRITY_INFORMATION { ULONG Length; - ULONG CodeIntegrityOptions; + union + { + ULONG CodeIntegrityOptions; + struct + { + ULONG Enabled : 1; + ULONG TestSign : 1; + ULONG UmciEnabled : 1; + ULONG UmciAuditModeEnabled : 1; + ULONG UmciExclusionPathsEnabled : 1; + ULONG TestBuild : 1; + ULONG PreproductionBuild : 1; + ULONG DebugModeEnabled : 1; + ULONG FlightBuild : 1; + ULONG FlightingEnabled : 1; + ULONG HvciKmciEnabled : 1; + ULONG HvciKmciAuditModeEnabled : 1; + ULONG HvciKmciStrictModeEnabled : 1; + ULONG HvciIumEnabled : 1; + ULONG WhqlEnforcementEnabled : 1; + ULONG WhqlAuditModeEnabled : 1; + ULONG Spare : 16; + }; + }; } SYSTEM_CODEINTEGRITY_INFORMATION, *PSYSTEM_CODEINTEGRITY_INFORMATION; // private @@ -3486,11 +3668,11 @@ typedef enum _STORE_INFORMATION_CLASS RegistrationRequest = 15, // q: SM_REGISTRATION_REQUEST (requires SeProfileSingleProcessPrivilege) // SmProcessRegistrationRequest GlobalCacheStatsRequest = 16, StoreResizeRequest = 17, // s: SM_STORE_RESIZE_REQUEST (requires SeProfileSingleProcessPrivilege) - CacheStoreResizeRequest = 18, // s: SMC_STORE_RESIZE_REQUEST (requires SeProfileSingleProcessPrivilege) + CacheStoreResizeRequest = 18, // s: SM_STORE_CACHE_RESIZE_REQUEST (requires SeProfileSingleProcessPrivilege) SmConfigRequest = 19, // s: SM_CONFIG_REQUEST (requires SeProfileSingleProcessPrivilege) - StoreHighMemoryPriorityRequest = 20, // s: SM_STORE_HIGH_MEM_PRIORITY_REQUEST (requires SeProfileSingleProcessPrivilege) - SystemStoreTrimRequest = 21, // s: SM_SYSTEM_STORE_TRIM_REQUEST (requires SeProfileSingleProcessPrivilege) - MemCompressionInfoRequest = 22, // q: SM_MEM_COMPRESSION_INFO_REQUEST // SmProcessCompressionInfoRequest + StoreHighMemoryPriorityRequest = 20, // s: SM_STORE_HIGH_MEMORY_PRIORITY_REQUEST (requires SeProfileSingleProcessPrivilege) + SystemStoreTrimRequest = 21, // s: SM_SYSTEM_STORE_TRIM_REQUEST (requires SeProfileSingleProcessPrivilege) // SmProcessSystemStoreTrimRequest + MemCompressionInfoRequest = 22, // q: SM_STORE_COMPRESSION_INFORMATION_REQUEST // SmProcessCompressionInfoRequest ProcessStoreInfoRequest = 23, // SmProcessProcessStoreInfoRequest StoreInformationMax } STORE_INFORMATION_CLASS; @@ -3640,9 +3822,9 @@ typedef struct _SM_STORE_BASIC_PARAMS ULONG LockActiveRegions : 1; ULONG VirtualRegions : 1; ULONG Spare : 13; - }; + } DUMMYSTRUCTNAME; ULONG StoreFlags; - }; + } DUMMYUNIONNAME; ULONG Granularity; ULONG RegionSize; ULONG RegionCountMax; @@ -3850,7 +4032,7 @@ typedef struct _SM_STORE_RESIZE_REQUEST #define SYSTEM_CACHE_STORE_RESIZE_INFORMATION_VERSION 1 -typedef struct _SMC_STORE_RESIZE_REQUEST +typedef struct _SM_STORE_CACHE_RESIZE_REQUEST { ULONG Version : 8; // SYSTEM_CACHE_STORE_RESIZE_INFORMATION_VERSION ULONG AddRegions : 1; @@ -3859,7 +4041,7 @@ typedef struct _SMC_STORE_RESIZE_REQUEST ULONG StoreId; SM_STORE_MANAGER_TYPE StoreManagerType; ULONG RegionCount; -} SMC_STORE_RESIZE_REQUEST, *PSMC_STORE_RESIZE_REQUEST; +} SM_STORE_CACHE_RESIZE_REQUEST, *PSM_STORE_CACHE_RESIZE_REQUEST; #define SYSTEM_STORE_CONFIG_INFORMATION_VERSION 4 @@ -3882,29 +4064,43 @@ typedef struct _SM_CONFIG_REQUEST #define SYSTEM_STORE_HIGH_MEM_PRIORITY_INFORMATION_VERSION 1 // rev -typedef struct _SM_STORE_HIGH_MEM_PRIORITY_REQUEST +typedef struct _SM_STORE_HIGH_MEMORY_PRIORITY_REQUEST { - ULONG Version : 8; // SYSTEM_STORE_HIGH_MEM_PRIORITY_INFORMATION_VERSION + ULONG Version : 8; // SYSTEM_STORE_HIGH_MEMORY_PRIORITY_INFORMATION_VERSION ULONG SetHighMemoryPriority : 1; ULONG Spare : 23; HANDLE ProcessHandle; -} SM_STORE_HIGH_MEM_PRIORITY_REQUEST, *PSM_STORE_HIGH_MEM_PRIORITY_REQUEST; - -#define SYSTEM_STORE_TRIM_INFORMATION_VERSION 1 +} SM_STORE_HIGH_MEMORY_PRIORITY_REQUEST, *PSM_STORE_HIGH_MEMORY_PRIORITY_REQUEST; // rev typedef struct _SM_SYSTEM_STORE_TRIM_REQUEST { - ULONG Version : 8; // SYSTEM_STORE_TRIM_INFORMATION_VERSION + ULONG Version : 8; // SYSTEM_STORE_TRIM_INFORMATION_VERSION ULONG Spare : 24; - SIZE_T PagesToTrim; // ULONG? + SIZE_T PagesToTrim; + HANDLE PartitionHandle; // since 24H2 } SM_SYSTEM_STORE_TRIM_REQUEST, *PSM_SYSTEM_STORE_TRIM_REQUEST; // rev -#define SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION 3 +#define SYSTEM_STORE_TRIM_INFORMATION_VERSION_V1 1 // WIN10 +#define SYSTEM_STORE_TRIM_INFORMATION_VERSION_V2 2 // 24H2 +#define SYSTEM_STORE_TRIM_INFORMATION_VERSION SYSTEM_STORE_TRIM_INFORMATION_VERSION_V1 // rev -typedef struct _SM_MEM_COMPRESSION_INFO_REQUEST +#define SYSTEM_STORE_TRIM_INFORMATION_SIZE_V1 RTL_SIZEOF_THROUGH_FIELD(SM_SYSTEM_STORE_TRIM_REQUEST, PagesToTrim) // WIN10 +#define SYSTEM_STORE_TRIM_INFORMATION_SIZE_V2 RTL_SIZEOF_THROUGH_FIELD(SM_SYSTEM_STORE_TRIM_REQUEST, PartitionHandle) // 24H2 +#define SYSTEM_STORE_TRIM_INFORMATION_SIZE SYSTEM_STORE_TRIM_INFORMATION_SIZE_V2 + +#ifdef _WIN64 +static_assert(SYSTEM_STORE_TRIM_INFORMATION_SIZE_V1 == 16, "SYSTEM_STORE_TRIM_INFORMATION_SIZE_V1 must equal 16"); +static_assert(SYSTEM_STORE_TRIM_INFORMATION_SIZE_V2 == 24, "SYSTEM_STORE_TRIM_INFORMATION_SIZE_V2 must equal 24"); +#else +static_assert(SYSTEM_STORE_TRIM_INFORMATION_SIZE_V1 == 8, "SYSTEM_STORE_TRIM_INFORMATION_SIZE_V1 must equal 8"); +static_assert(SYSTEM_STORE_TRIM_INFORMATION_SIZE_V2 == 12, "SYSTEM_STORE_TRIM_INFORMATION_SIZE_V2 must equal 12"); +#endif + +// rev +typedef struct _SM_STORE_COMPRESSION_INFORMATION_REQUEST { ULONG Version : 8; // SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION ULONG Spare : 24; @@ -3913,7 +4109,26 @@ typedef struct _SM_MEM_COMPRESSION_INFO_REQUEST SIZE_T TotalDataCompressed; SIZE_T TotalCompressedSize; SIZE_T TotalUniqueDataCompressed; -} SM_MEM_COMPRESSION_INFO_REQUEST, *PSM_MEM_COMPRESSION_INFO_REQUEST; + HANDLE PartitionHandle; // since 24H2 +} SM_STORE_COMPRESSION_INFORMATION_REQUEST, *PSM_STORE_COMPRESSION_INFORMATION_REQUEST; + +// rev +#define SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION_V1 3 // WIN10 +#define SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION_V2 4 // 24H2 +#define SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION_V2 + +// rev +#define SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V1 RTL_SIZEOF_THROUGH_FIELD(SM_STORE_COMPRESSION_INFORMATION_REQUEST, TotalUniqueDataCompressed) // WIN10 +#define SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V2 RTL_SIZEOF_THROUGH_FIELD(SM_STORE_COMPRESSION_INFORMATION_REQUEST, PartitionHandle) // 24H2 +#define SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V2 + +#ifdef _WIN64 +static_assert(SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V1 == 40, "SM_STORE_COMPRESSION_INFORMATION_REQUEST_V1 must equal 40"); +static_assert(SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V2 == 48, "SM_STORE_COMPRESSION_INFORMATION_REQUEST_V2 must equal 48"); +#else +static_assert(SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V1 == 24, "SM_STORE_COMPRESSION_INFORMATION_REQUEST_V1 must equal 24"); +static_assert(SYSTEM_STORE_COMPRESSION_INFORMATION_SIZE_V2 == 28, "SM_STORE_COMPRESSION_INFORMATION_REQUEST_V2 must equal 28"); +#endif // private typedef struct _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS @@ -4359,8 +4574,8 @@ typedef struct _SYSTEM_PAGEFILE_INFORMATION_EX ULONG TotalInUse; ULONG PeakUsage; UNICODE_STRING PageFileName; - }; - }; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; ULONG MinimumSize; ULONG MaximumSize; @@ -4392,7 +4607,7 @@ typedef union _ENERGY_STATE_DURATION ULONG LastChangeTime; ULONG Duration : 31; ULONG IsInState : 1; - }; + } DUMMYSTRUCTNAME; } ENERGY_STATE_DURATION, *PENERGY_STATE_DURATION; typedef struct _PROCESS_ENERGY_VALUES @@ -4411,8 +4626,8 @@ typedef struct _PROCESS_ENERGY_VALUES ENERGY_STATE_DURATION ForegroundDuration; ENERGY_STATE_DURATION DesktopVisibleDuration; ENERGY_STATE_DURATION PSMForegroundDuration; - }; - }; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; ULONG CompositionRendered; ULONG CompositionDirtyGenerated; ULONG CompositionDirtyPropagated; @@ -4452,8 +4667,8 @@ typedef struct _PROCESS_ENERGY_VALUES_EXTENSION TIMELINE_BITMAP AudioOutTimeline; TIMELINE_BITMAP DisplayRequiredTimeline; TIMELINE_BITMAP KeyboardInputTimeline; - }; - }; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; union // REDSTONE3 { @@ -4465,8 +4680,8 @@ typedef struct _PROCESS_ENERGY_VALUES_EXTENSION ENERGY_STATE_DURATION AudioOutDuration; ENERGY_STATE_DURATION DisplayRequiredDuration; ENERGY_STATE_DURATION PSMBackgroundDuration; - }; - }; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; ULONG KeyboardInput; ULONG MouseInput; @@ -4503,8 +4718,8 @@ typedef struct _SYSTEM_PROCESS_INFORMATION_EXTENSION ULONG Classification : 4; // SYSTEM_PROCESS_CLASSIFICATION ULONG BackgroundActivityModerated : 1; ULONG Spare : 26; - }; - }; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; ULONG UserSidOffset; ULONG PackageFullNameOffset; // since THRESHOLD PROCESS_ENERGY_VALUES EnergyValues; // since THRESHOLD @@ -4541,7 +4756,7 @@ typedef struct _OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2 ULONG Version; ULONG AbnormalResetOccurred; ULONG OfflineMemoryDumpCapable; - LARGE_INTEGER ResetDataAddress; + PVOID ResetDataAddress; ULONG ResetDataSize; } OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2, *POFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2; @@ -4662,8 +4877,38 @@ typedef struct _SYSTEM_KERNEL_DEBUGGER_FLAGS // private typedef struct _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION { - ULONG Options; - ULONG HVCIOptions; + union + { + ULONG Options; + struct + { + ULONG Enabled : 1; + ULONG Audit : 1; + ULONG RequireWHQL : 1; + ULONG DisabledFlightSigning : 1; + ULONG EnabledUMCI : 1; + ULONG EnabledUpdatePolicyNoReboot : 1; + ULONG EnabledSecureSettingPolicy : 1; + ULONG EnabledUnsignedSystemIntegrityPolicy : 1; + ULONG DynamicCodePolicyEnabled : 1; + ULONG Spare : 19; + ULONG ReloadPolicyNoReboot : 1; + ULONG ConditionalLockdown : 1; + ULONG NoLockdown : 1; + ULONG Lockdown : 1; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; + union + { + ULONG HVCIOptions; + struct + { + ULONG HVCIEnabled : 1; + ULONG HVCIStrict : 1; + ULONG HVCIDebug : 1; + ULONG HVCISpare : 29; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; ULONGLONG Version; GUID PolicyGuid; } SYSTEM_CODEINTEGRITYPOLICY_INFORMATION, *PSYSTEM_CODEINTEGRITYPOLICY_INFORMATION; @@ -4723,7 +4968,7 @@ typedef struct _KAFFINITY_EX { ULONG_PTR Bitmap[1]; ULONG_PTR StaticBitmap[32]; - }; + } DUMMYUNIONNAME; } KAFFINITY_EX, *PKAFFINITY_EX; // private @@ -4809,7 +5054,7 @@ typedef struct _SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION ULONG WoW64Container : 1; ULONG ReservedZero0 : 11; } SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION, *PSYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION; -#endif +#endif // NTDDI_WIN10_FE // private typedef struct _SYSTEM_MEMORY_USAGE_INFORMATION @@ -4869,6 +5114,18 @@ typedef struct _SYSTEM_ACTIVITY_MODERATION_INFO SYSTEM_ACTIVITY_MODERATION_APP_TYPE AppType; } SYSTEM_ACTIVITY_MODERATION_INFO, *PSYSTEM_ACTIVITY_MODERATION_INFO; +// rev +#include +typedef struct _SYSTEM_ACTIVITY_MODERATION_APP_SETTINGS +{ + LARGE_INTEGER LastUpdatedTime; // QuerySystemTime + SYSTEM_ACTIVITY_MODERATION_STATE ModerationState; + UCHAR Reserved[4]; + SYSTEM_ACTIVITY_MODERATION_APP_TYPE AppType; + UCHAR Flags[4]; +} SYSTEM_ACTIVITY_MODERATION_APP_SETTINGS, *PSYSTEM_ACTIVITY_MODERATION_APP_SETTINGS; +#include + // private typedef struct _SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS { @@ -4926,8 +5183,8 @@ typedef struct _SYSTEM_KERNEL_VA_SHADOW_INFORMATION ULONG L1DataCacheFlushSupported : 1; ULONG L1TerminalFaultMitigationPresent : 1; ULONG Reserved : 18; - }; - }; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; } SYSTEM_KERNEL_VA_SHADOW_INFORMATION, *PSYSTEM_KERNEL_VA_SHADOW_INFORMATION; // private @@ -5054,8 +5311,8 @@ typedef struct _SYSTEM_SECURITY_MODEL_INFORMATION ULONG ReservedFlag : 1; // SModeAdminlessEnabled ULONG AllowDeviceOwnerProtectionDowngrade : 1; ULONG Reserved : 30; - }; - }; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; } SYSTEM_SECURITY_MODEL_INFORMATION, *PSYSTEM_SECURITY_MODEL_INFORMATION; // private @@ -5106,8 +5363,8 @@ typedef struct _SYSTEM_SHADOW_STACK_INFORMATION ULONG KernelCetAuditModeEnabled : 1; ULONG ReservedForKernelCet : 6; // since Windows 10 build 21387 ULONG Reserved : 16; - }; - }; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; } SYSTEM_SHADOW_STACK_INFORMATION, *PSYSTEM_SHADOW_STACK_INFORMATION; // private @@ -5382,7 +5639,7 @@ NtQuerySystemInformation( _Out_opt_ PULONG ReturnLength ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSCALLAPI NTSTATUS NTAPI @@ -5394,7 +5651,7 @@ NtQuerySystemInformationEx( _In_ ULONG SystemInformationLength, _Out_opt_ PULONG ReturnLength ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSCALLAPI NTSTATUS @@ -6497,7 +6754,9 @@ NtGetTickCount( #endif } +// // Locale +// NTSYSCALLAPI NTSTATUS @@ -6522,7 +6781,7 @@ NtQueryInstallUILanguage( _Out_ LANGID *InstallUILanguageId ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSCALLAPI NTSTATUS @@ -6531,7 +6790,7 @@ NtFlushInstallUILanguage( _In_ LANGID InstallUILanguage, _In_ ULONG SetComittedFlag ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA NTSYSCALLAPI NTSTATUS @@ -6547,7 +6806,7 @@ NtSetDefaultUILanguage( _In_ LANGID DefaultUILanguageId ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSCALLAPI NTSTATUS @@ -6555,13 +6814,13 @@ NTAPI NtIsUILanguageComitted( VOID ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA // NLS // begin_private -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS @@ -6584,7 +6843,7 @@ NtGetNlsSectionPtr( _Out_ PULONG SectionSize ); -#if (PHNT_VERSION < PHNT_WIN7) +#if (PHNT_VERSION < PHNT_WINDOWS_7) NTSYSCALLAPI NTSTATUS @@ -6602,7 +6861,7 @@ NtReleaseCMFViewOwnership( VOID ); -#endif +#endif // PHNT_VERSION < PHNT_WINDOWS_7 NTSYSCALLAPI NTSTATUS @@ -6625,11 +6884,13 @@ NtGetMUIRegistryInfo( _Out_ PVOID Data ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA // end_private +// // Global atoms +// NTSYSCALLAPI NTSTATUS @@ -6640,7 +6901,7 @@ NtAddAtom( _Out_opt_ PRTL_ATOM Atom ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) #define ATOM_FLAG_GLOBAL 0x2 @@ -6655,7 +6916,7 @@ NtAddAtomEx( _In_ ULONG Flags ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 NTSYSCALLAPI NTSTATUS @@ -6704,7 +6965,9 @@ NtQueryInformationAtom( _Out_opt_ PULONG ReturnLength ); +// // Global flags +// #define FLG_STOP_ON_EXCEPTION 0x00000001 // uk #define FLG_SHOW_LDR_SNAPS 0x00000002 // uk @@ -6785,7 +7048,7 @@ NtQueryInformationAtom( FLG_ENABLE_HANDLE_EXCEPTIONS) // Licensing - +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -6796,8 +7059,11 @@ NtQueryLicenseValue( _In_ ULONG DataSize, _Out_ PULONG ResultDataSize ); +#endif +// // Misc. +// NTSYSCALLAPI NTSTATUS @@ -6830,7 +7096,7 @@ NtDisplayString( // Boot graphics -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSCALLAPI NTSTATUS @@ -6840,6 +7106,146 @@ NtDrawText( ); #endif +// +// Hot patching +// + +typedef enum _HOT_PATCH_INFORMATION_CLASS +{ + ManageHotPatchLoadPatch = 0, // MANAGE_HOT_PATCH_LOAD_PATCH + ManageHotPatchUnloadPatch = 1, // MANAGE_HOT_PATCH_UNLOAD_PATCH + ManageHotPatchQueryPatches = 2, // MANAGE_HOT_PATCH_QUERY_PATCHES + ManageHotPatchLoadPatchForUser = 3, // MANAGE_HOT_PATCH_LOAD_PATCH + ManageHotPatchUnloadPatchForUser = 4, // MANAGE_HOT_PATCH_UNLOAD_PATCH + ManageHotPatchQueryPatchesForUser = 5, // MANAGE_HOT_PATCH_QUERY_PATCHES + ManageHotPatchQueryActivePatches = 6, // MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES + ManageHotPatchApplyImagePatch = 7, // MANAGE_HOT_PATCH_APPLY_IMAGE_PATCH + ManageHotPatchQuerySinglePatch = 8, // MANAGE_HOT_PATCH_QUERY_SINGLE_PATCH + ManageHotPatchCheckEnabled = 9, // MANAGE_HOT_PATCH_CHECK_ENABLED + ManageHotPatchCreatePatchSection = 10, // MANAGE_HOT_PATCH_CREATE_PATCH_SECTION + ManageHotPatchMax +} HOT_PATCH_INFORMATION_CLASS; + +typedef struct _HOT_PATCH_IMAGE_INFO +{ + ULONG CheckSum; + ULONG TimeDateStamp; +} HOT_PATCH_IMAGE_INFO, *PHOT_PATCH_IMAGE_INFO; + +typedef struct _MANAGE_HOT_PATCH_LOAD_PATCH +{ + ULONG Version; + UNICODE_STRING PatchPath; + union + { + SID Sid; + UCHAR Buffer[SECURITY_MAX_SID_SIZE]; + } UserSid; + HOT_PATCH_IMAGE_INFO BaseInfo; +} MANAGE_HOT_PATCH_LOAD_PATCH, *PMANAGE_HOT_PATCH_LOAD_PATCH; + +typedef struct _MANAGE_HOT_PATCH_UNLOAD_PATCH +{ + ULONG Version; + HOT_PATCH_IMAGE_INFO BaseInfo; + union + { + SID Sid; + UCHAR Buffer[SECURITY_MAX_SID_SIZE]; + } UserSid; +} MANAGE_HOT_PATCH_UNLOAD_PATCH, *PMANAGE_HOT_PATCH_UNLOAD_PATCH; + +typedef struct _MANAGE_HOT_PATCH_QUERY_PATCHES +{ + ULONG Version; + union + { + SID Sid; + UCHAR Buffer[SECURITY_MAX_SID_SIZE]; + } UserSid; + ULONG PatchCount; + PUNICODE_STRING PatchPathStrings; + PHOT_PATCH_IMAGE_INFO BaseInfos; +} MANAGE_HOT_PATCH_QUERY_PATCHES, *PMANAGE_HOT_PATCH_QUERY_PATCHES; + +typedef struct _MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES +{ + ULONG Version; + HANDLE ProcessHandle; + ULONG PatchCount; + PUNICODE_STRING PatchPathStrings; + PHOT_PATCH_IMAGE_INFO BaseInfos; + PULONG PatchSequenceNumbers; +} MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES, *PMANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES; + +typedef struct _MANAGE_HOT_PATCH_APPLY_IMAGE_PATCH +{ + ULONG Version; + union + { + struct + { + ULONG ApplyReversePatches : 1; + ULONG ApplyForwardPatches : 1; + ULONG Spare : 29; + }; + ULONG AllFlags; + }; + HANDLE ProcessHandle; + PVOID BaseImageAddress; + PVOID PatchImageAddress; +} MANAGE_HOT_PATCH_APPLY_IMAGE_PATCH, *PMANAGE_HOT_PATCH_APPLY_IMAGE_PATCH; + +typedef struct _MANAGE_HOT_PATCH_QUERY_SINGLE_PATCH +{ + ULONG Version; + HANDLE ProcessHandle; + PVOID BaseAddress; + ULONG Flags; + UNICODE_STRING PatchPathString; +} MANAGE_HOT_PATCH_QUERY_SINGLE_PATCH, *PMANAGE_HOT_PATCH_QUERY_SINGLE_PATCH; + +typedef struct _MANAGE_HOT_PATCH_CHECK_ENABLED +{ + ULONG Version; + ULONG Flags; +} MANAGE_HOT_PATCH_CHECK_ENABLED, *PMANAGE_HOT_PATCH_CHECK_ENABLED; + +typedef struct _MANAGE_HOT_PATCH_CREATE_PATCH_SECTION +{ + ULONG Version; + ULONG Flags; + ACCESS_MASK DesiredAccess; + ULONG PageProtection; + ULONG AllocationAttributes; + PVOID BaseImageAddress; + HANDLE SectionHandle; +} MANAGE_HOT_PATCH_CREATE_PATCH_SECTION, *PMANAGE_HOT_PATCH_CREATE_PATCH_SECTION; + +#ifdef WIN64 +static_assert(sizeof(MANAGE_HOT_PATCH_LOAD_PATCH) == 0x68, "Size of MANAGE_HOT_PATCH_LOAD_PATCH is incorrect"); +static_assert(sizeof(MANAGE_HOT_PATCH_UNLOAD_PATCH) == 0x50, "Size of MANAGE_HOT_PATCH_UNLOAD_PATCH is incorrect"); +static_assert(sizeof(MANAGE_HOT_PATCH_QUERY_PATCHES) == 0x60, "Size of MANAGE_HOT_PATCH_QUERY_PATCHES is incorrect"); +static_assert(sizeof(MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES) == 0x30, "Size of MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES is incorrect"); +static_assert(sizeof(MANAGE_HOT_PATCH_APPLY_IMAGE_PATCH) == 0x20, "Size of MANAGE_HOT_PATCH_APPLY_IMAGE_PATCH is incorrect"); +static_assert(sizeof(MANAGE_HOT_PATCH_QUERY_SINGLE_PATCH) == 0x30, "Size of MANAGE_HOT_PATCH_QUERY_SINGLE_PATCH is incorrect"); +static_assert(sizeof(MANAGE_HOT_PATCH_CHECK_ENABLED) == 0x8, "Size of MANAGE_HOT_PATCH_CHECK_ENABLED is incorrect"); +static_assert(sizeof(MANAGE_HOT_PATCH_CREATE_PATCH_SECTION) == 0x28, "Size of MANAGE_HOT_PATCH_CREATE_PATCH_SECTION is incorrect"); +#endif + +#if (PHNT_VERSION >= PHNT_WINDOWS_11) +// rev +NTSYSCALLAPI +NTSTATUS +NTAPI +NtManageHotPatch( + _In_ HOT_PATCH_INFORMATION_CLASS HotPatchInformationClass, + _Out_writes_bytes_opt_(HotPatchInformationLength) PVOID HotPatchInformation, + _In_ ULONG HotPatchInformationLength, + _Out_opt_ PULONG ReturnLength + ); +#endif // PHNT_VERSION >= PHNT_WINDOWS_11 + #endif // (PHNT_MODE != PHNT_MODE_KERNEL) #endif diff --git a/ntioapi.h b/ntioapi.h index f0fe5ba..cfcbe76 100644 --- a/ntioapi.h +++ b/ntioapi.h @@ -63,11 +63,26 @@ #define FILE_CONTAINS_EXTENDED_CREATE_INFORMATION 0x10000000 #define FILE_VALID_EXTENDED_OPTION_FLAGS 0x10000000 +typedef struct _EXTENDED_CREATE_DUAL_OPLOCK_KEYS +{ + // + // Parent oplock key. + // All-zero if not set. + // + GUID ParentOplockKey; + // + // Target oplock key. + // All-zero if not set. + // + GUID TargetOplockKey; +} EXTENDED_CREATE_DUAL_OPLOCK_KEYS, *PEXTENDED_CREATE_DUAL_OPLOCK_KEYS; + typedef struct _EXTENDED_CREATE_INFORMATION { LONGLONG ExtendedCreateFlags; PVOID EaBuffer; ULONG EaLength; + //PEXTENDED_CREATE_DUAL_OPLOCK_KEYS DualOplockKeys; // since 24H2 } EXTENDED_CREATE_INFORMATION, *PEXTENDED_CREATE_INFORMATION; typedef struct _EXTENDED_CREATE_INFORMATION_32 @@ -75,6 +90,7 @@ typedef struct _EXTENDED_CREATE_INFORMATION_32 LONGLONG ExtendedCreateFlags; void* POINTER_32 EaBuffer; ULONG EaLength; + //PEXTENDED_CREATE_DUAL_OPLOCK_KEYS POINTER_32 DualOplockKeys; // since 24H2 } EXTENDED_CREATE_INFORMATION_32, *PEXTENDED_CREATE_INFORMATION_32; #define EX_CREATE_FLAG_FILE_SOURCE_OPEN_FOR_COPY 0x00000001 @@ -446,7 +462,7 @@ typedef struct _FILE_END_OF_FILE_INFORMATION LARGE_INTEGER EndOfFile; } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION; -//#if (PHNT_VERSION >= PHNT_REDSTONE5) +//#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS5) #define FLAGS_END_OF_FILE_INFO_EX_EXTEND_PAGING 0x00000001 #define FLAGS_END_OF_FILE_INFO_EX_NO_EXTRA_PAGING_EXTEND 0x00000002 #define FLAGS_END_OF_FILE_INFO_EX_TIME_CONSTRAINED 0x00000004 @@ -826,7 +842,7 @@ typedef struct _FILE_VOLUME_NAME_INFORMATION #ifndef FILE_INVALID_FILE_ID #define FILE_INVALID_FILE_ID ((LONGLONG)-1LL) -#endif +#endif // FILE_INVALID_FILE_ID #define FILE_ID_IS_INVALID(FID) ((FID).QuadPart == FILE_INVALID_FILE_ID) @@ -1088,7 +1104,7 @@ typedef struct _FILE_STAT_BASIC_INFORMATION LARGE_INTEGER VolumeSerialNumber; FILE_ID_128 FileId128; } FILE_STAT_BASIC_INFORMATION, *PFILE_STAT_BASIC_INFORMATION; -#endif +#endif // NTDDI_WIN11_GE typedef struct _FILE_MEMORY_PARTITION_INFORMATION { @@ -1132,7 +1148,7 @@ typedef struct _FILE_STAT_LX_INFORMATION ULONG LxDeviceIdMajor; ULONG LxDeviceIdMinor; } FILE_STAT_LX_INFORMATION, *PFILE_STAT_LX_INFORMATION; -#endif +#endif // NTDDI_WIN11_GE typedef struct _FILE_STORAGE_RESERVE_ID_INFORMATION { @@ -1146,7 +1162,7 @@ typedef struct _FILE_CASE_SENSITIVE_INFORMATION { ULONG Flags; } FILE_CASE_SENSITIVE_INFORMATION, *PFILE_CASE_SENSITIVE_INFORMATION; -#endif +#endif // NTDDI_WIN11_GE typedef enum _FILE_KNOWN_FOLDER_TYPE { @@ -1720,7 +1736,7 @@ NtFlushBuffersFile( #define FLUSH_FLAGS_FLUSH_AND_PURGE 0x00000008 // 24H2 -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS NTAPI @@ -1744,7 +1760,7 @@ NtQueryInformationFile( _In_ FILE_INFORMATION_CLASS FileInformationClass ); -#if (PHNT_VERSION >= PHNT_REDSTONE2) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS2) NTSYSCALLAPI NTSTATUS NTAPI @@ -1792,7 +1808,7 @@ NtQueryDirectoryFile( #define FILE_QUERY_RETURN_ON_DISK_ENTRIES_ONLY 0x00000008 #define FILE_QUERY_NO_CURSOR_UPDATE 0x00000010 // RS5 -#if (PHNT_VERSION >= PHNT_REDSTONE3) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3) NTSYSCALLAPI NTSTATUS NTAPI @@ -1890,7 +1906,7 @@ NtCancelIoFile( _Out_ PIO_STATUS_BLOCK IoStatusBlock ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -1901,7 +1917,7 @@ NtCancelIoFileEx( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -2128,7 +2144,7 @@ typedef struct _FILE_NOTIFY_EXTENDED_INFORMATION ULONG FileNameLength; WCHAR FileName[1]; } FILE_NOTIFY_EXTENDED_INFORMATION, *PFILE_NOTIFY_EXTENDED_INFORMATION; -#endif +#endif // NTDDI_WIN10_RS5 #define FILE_NAME_FLAG_HARDLINK 0 // not part of a name pair #define FILE_NAME_FLAG_NTFS 0x01 // NTFS name in a name pair @@ -2162,7 +2178,7 @@ typedef struct _FILE_NOTIFY_FULL_INFORMATION } FILE_NOTIFY_FULL_INFORMATION, *PFILE_NOTIFY_FULL_INFORMATION; #endif -#if (PHNT_VERSION >= PHNT_REDSTONE3) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3) NTSYSCALLAPI NTSTATUS NTAPI @@ -2280,7 +2296,7 @@ NtSetIoCompletion( _In_ ULONG_PTR IoStatusInformation ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSCALLAPI NTSTATUS NTAPI @@ -2305,7 +2321,7 @@ NtRemoveIoCompletion( _In_opt_ PLARGE_INTEGER Timeout ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private typedef struct _FILE_IO_COMPLETION_INFORMATION { @@ -2325,11 +2341,13 @@ NtRemoveIoCompletionEx( _In_opt_ PLARGE_INTEGER Timeout, _In_ BOOLEAN Alertable ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_VISTA) +// // Wait completion packet +// -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS @@ -2362,71 +2380,31 @@ NtCancelWaitCompletionPacket( _In_ BOOLEAN RemoveSignaledPacket ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_8) -// Sessions - -typedef enum _IO_SESSION_EVENT -{ - IoSessionEventIgnore, - IoSessionEventCreated, - IoSessionEventTerminated, - IoSessionEventConnected, - IoSessionEventDisconnected, - IoSessionEventLogon, - IoSessionEventLogoff, - IoSessionEventMax -} IO_SESSION_EVENT; - -typedef enum _IO_SESSION_STATE -{ - IoSessionStateCreated = 1, - IoSessionStateInitialized = 2, - IoSessionStateConnected = 3, - IoSessionStateDisconnected = 4, - IoSessionStateDisconnectedLoggedOn = 5, - IoSessionStateLoggedOn = 6, - IoSessionStateLoggedOff = 7, - IoSessionStateTerminated = 8, - IoSessionStateMax -} IO_SESSION_STATE; - -// Sessions - -#if (PHNT_MODE != PHNT_MODE_KERNEL) - -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) NTSYSCALLAPI NTSTATUS NTAPI -NtOpenSession( - _Out_ PHANDLE SessionHandle, - _In_ ACCESS_MASK DesiredAccess, - _In_ POBJECT_ATTRIBUTES ObjectAttributes +NtCopyFileChunk( + _In_ HANDLE SourceHandle, + _In_ HANDLE DestinationHandle, + _In_opt_ HANDLE EventHandle, + _Out_ PIO_STATUS_BLOCK IoStatusBlock, + _In_ ULONG Length, + _In_ PLARGE_INTEGER SourceOffset, + _In_ PLARGE_INTEGER DestOffset, + _In_opt_ PULONG SourceKey, + _In_opt_ PULONG DestKey, + _In_ ULONG Flags ); -#endif - -#endif - -#if (PHNT_VERSION >= PHNT_WIN7) -NTSYSCALLAPI -NTSTATUS -NTAPI -NtNotifyChangeSession( - _In_ HANDLE SessionHandle, - _In_ ULONG ChangeSequenceNumber, - _In_ PLARGE_INTEGER ChangeTimeStamp, - _In_ IO_SESSION_EVENT Event, - _In_ IO_SESSION_STATE NewState, - _In_ IO_SESSION_STATE PreviousState, - _In_reads_bytes_opt_(PayloadSize) PVOID Payload, - _In_ ULONG PayloadSize - ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_11) +// // I/O Ring +// -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) NTSYSCALLAPI NTSTATUS NTAPI @@ -2465,9 +2443,11 @@ NtSetInformationIoRing( _In_ ULONG IoRingInformationLength, _In_ PVOID IoRingInformation ); -#endif +#endif // (PHNT_VERSION >= PHNT_WINDOWS_11) +// // Other types +// typedef enum _INTERFACE_TYPE { @@ -2827,7 +2807,9 @@ typedef struct _FILE_MAILSLOT_PEEK_BUFFER ULONG MessageLength; } FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER; +// // Mount manager FS control definitions +// #define MOUNTMGR_DEVICE_NAME L"\\Device\\MountPointManager" #define MOUNTMGRCONTROLTYPE 0x0000006D // 'm' @@ -3034,7 +3016,12 @@ typedef struct _MOUNTMGR_VOLUME_PATHS (s)->Length == 98 && \ (s)->Buffer[1] == '?') +// // Filter manager +// + +#define FLT_PORT_CONNECT 0x0001 +#define FLT_PORT_ALL_ACCESS (FLT_PORT_CONNECT | STANDARD_RIGHTS_ALL) // rev #define FLT_SYMLINK_NAME L"\\Global??\\FltMgr" diff --git a/ntkeapi.h b/ntkeapi.h index 9694bec..9b06855 100644 --- a/ntkeapi.h +++ b/ntkeapi.h @@ -46,52 +46,54 @@ typedef enum _KHETERO_CPU_POLICY } KHETERO_CPU_POLICY, *PKHETERO_CPU_POLICY; #if (PHNT_MODE != PHNT_MODE_KERNEL) - +/** + * KWAIT_REASON identifies the reasons for context switches or the current waiting state. + */ typedef enum _KWAIT_REASON { - Executive, - FreePage, - PageIn, - PoolAllocation, - DelayExecution, - Suspended, - UserRequest, - WrExecutive, - WrFreePage, - WrPageIn, - WrPoolAllocation, - WrDelayExecution, - WrSuspended, - WrUserRequest, - WrEventPair, - WrQueue, - WrLpcReceive, - WrLpcReply, - WrVirtualMemory, - WrPageOut, - WrRendezvous, - WrKeyedEvent, - WrTerminated, - WrProcessInSwap, - WrCpuRateControl, - WrCalloutStack, - WrKernel, - WrResource, - WrPushLock, - WrMutex, - WrQuantumEnd, - WrDispatchInt, - WrPreempted, - WrYieldExecution, - WrFastMutex, - WrGuardedMutex, - WrRundown, - WrAlertByThreadId, - WrDeferredPreempt, - WrPhysicalFault, - WrIoRing, - WrMdlCache, - WrRcu, + Executive, // Waiting for an executive event. + FreePage, // Waiting for a free page. + PageIn, // Waiting for a page to be read in. + PoolAllocation, // Waiting for a pool allocation. + DelayExecution, // Waiting due to a delay execution. // NtDelayExecution + Suspended, // Waiting because the thread is suspended. // NtSuspendThread + UserRequest, // Waiting due to a user request. // NtWaitForSingleObject + WrExecutive, // Waiting for an executive event. + WrFreePage, // Waiting for a free page. + WrPageIn, // Waiting for a page to be read in. + WrPoolAllocation, // Waiting for a pool allocation. + WrDelayExecution, // Waiting due to a delay execution. + WrSuspended, // Waiting because the thread is suspended. + WrUserRequest, // Waiting due to a user request. + WrEventPair, // Waiting for an event pair. // NtCreateEventPair + WrQueue, // Waiting for a queue. // NtRemoveIoCompletion + WrLpcReceive, // Waiting for an LPC receive. + WrLpcReply, // Waiting for an LPC reply. + WrVirtualMemory, // Waiting for virtual memory. + WrPageOut, // Waiting for a page to be written out. + WrRendezvous, // Waiting for a rendezvous. + WrKeyedEvent, // Waiting for a keyed event. // NtCreateKeyedEvent + WrTerminated, // Waiting for thread termination. + WrProcessInSwap, // Waiting for a process to be swapped in. + WrCpuRateControl, // Waiting for CPU rate control. + WrCalloutStack, // Waiting for a callout stack. + WrKernel, // Waiting for a kernel event. + WrResource, // Waiting for a resource. + WrPushLock, // Waiting for a push lock. + WrMutex, // Waiting for a mutex. + WrQuantumEnd, // Waiting for the end of a quantum. + WrDispatchInt, // Waiting for a dispatch interrupt. + WrPreempted, // Waiting because the thread was preempted. + WrYieldExecution, // Waiting to yield execution. + WrFastMutex, // Waiting for a fast mutex. + WrGuardedMutex, // Waiting for a guarded mutex. + WrRundown, // Waiting for a rundown. + WrAlertByThreadId, // Waiting for an alert by thread ID. + WrDeferredPreempt, // Waiting for a deferred preemption. + WrPhysicalFault, // Waiting for a physical fault. + WrIoRing, // Waiting for an I/O ring. + WrMdlCache, // Waiting for an MDL cache. + WrRcu, // Waiting for read-copy-update (RCU) synchronization. MaximumWaitReason } KWAIT_REASON, *PKWAIT_REASON; @@ -137,7 +139,13 @@ NtCallbackReturn( _In_ NTSTATUS Status ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) +/** + * The NtFlushProcessWriteBuffers routine flushes the write queue of each processor that is running a thread of the current process. + * + * @return NTSTATUS Successful or errant status. + * @see https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-flushprocesswritebuffers + */ NTSYSCALLAPI NTSTATUS NTAPI diff --git a/ntldr.h b/ntldr.h index e02fe71..fde2770 100644 --- a/ntldr.h +++ b/ntldr.h @@ -198,7 +198,7 @@ typedef struct _LDR_DATA_TABLE_ENTRY PVOID SwitchBackContext; RTL_BALANCED_NODE BaseAddressIndexNode; RTL_BALANCED_NODE MappingInfoIndexNode; - ULONG_PTR OriginalBase; + PVOID OriginalBase; LARGE_INTEGER LoadTime; ULONG BaseNameHashValue; LDR_DLL_LOAD_REASON LoadReason; // since WIN8 @@ -262,7 +262,7 @@ LdrGetDllHandleEx( _Out_ PVOID *DllHandle ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSAPI NTSTATUS @@ -273,7 +273,7 @@ LdrGetDllHandleByMapping( ); #endif -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSAPI NTSTATUS @@ -285,7 +285,7 @@ LdrGetDllHandleByName( ); #endif -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // rev NTSYSAPI NTSTATUS @@ -346,7 +346,7 @@ LdrGetProcedureAddress( // rev #define LDR_GET_PROCEDURE_ADDRESS_DONT_RECORD_FORWARDER 0x00000001 -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -369,7 +369,7 @@ LdrGetKnownDllSectionHandle( _Out_ PHANDLE Section ); -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev NTSYSAPI NTSTATUS @@ -443,7 +443,7 @@ LdrProcessRelocationBlock( _In_ LONG_PTR Diff ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSAPI PIMAGE_BASE_RELOCATION NTAPI @@ -509,7 +509,7 @@ typedef struct _LDR_VERIFY_IMAGE_INFO USHORT ImageCharacteristics; } LDR_VERIFY_IMAGE_INFO, *PLDR_VERIFY_IMAGE_INFO; -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -520,7 +520,7 @@ LdrVerifyImageMatchesChecksumEx( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -569,7 +569,7 @@ VOID NTAPI LDR_DLL_NOTIFICATION_FUNCTION( ); typedef LDR_DLL_NOTIFICATION_FUNCTION* PLDR_DLL_NOTIFICATION_FUNCTION; -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) /** * Registers for notification when a DLL is first loaded. This notification occurs before dynamic linking takes place. * @@ -622,7 +622,7 @@ typedef struct _LDR_FAILURE_DATA WCHAR AdditionalInfo[0x20]; } LDR_FAILURE_DATA, *PLDR_FAILURE_DATA; -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) NTSYSAPI PLDR_FAILURE_DATA NTAPI @@ -676,7 +676,7 @@ typedef struct _PS_SYSTEM_DLL_INIT_BLOCK } PS_SYSTEM_DLL_INIT_BLOCK, *PPS_SYSTEM_DLL_INIT_BLOCK; // rev -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSAPI PS_SYSTEM_DLL_INIT_BLOCK LdrSystemDllInitBlock; #endif @@ -715,7 +715,7 @@ typedef struct _RTL_SCPCFG_NTDLL_EXPORTS } RTL_SCPCFG_NTDLL_EXPORTS, *PRTL_SCPCFG_NTDLL_EXPORTS; // rev -#if (PHNT_VERSION >= PHNT_WIN11_24H2) +#if (PHNT_VERSION >= PHNT_WINDOWS_11_24H2) NTSYSAPI RTL_SCPCFG_NTDLL_EXPORTS RtlpScpCfgNtdllExports; #endif @@ -723,7 +723,7 @@ NTSYSAPI RTL_SCPCFG_NTDLL_EXPORTS RtlpScpCfgNtdllExports; // Load as data table // -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI @@ -823,7 +823,7 @@ LdrFindResourceDirectory_U( _Out_ PIMAGE_RESOURCE_DIRECTORY *ResourceDirectory ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) /** * The LdrResFindResource function finds a resource in a DLL. * @@ -1201,7 +1201,7 @@ PVOID NTAPI DELAYLOAD_FAILURE_SYSTEM_ROUTINE( ); typedef DELAYLOAD_FAILURE_SYSTEM_ROUTINE* PDELAYLOAD_FAILURE_SYSTEM_ROUTINE; -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev from QueryOptionalDelayLoadedAPI /** * Determines whether the specified function in a delay-loaded DLL is available on the system. @@ -1224,7 +1224,7 @@ LdrQueryOptionalDelayLoadedAPI( ); #endif -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // rev from ResolveDelayLoadedAPI /** * Locates the target function of the specified import and replaces the function pointer in the import thunk with the target of the function implementation. @@ -1337,7 +1337,7 @@ LdrShutdownThread( VOID ); -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) // rev NTSYSAPI NTSTATUS @@ -1347,7 +1347,7 @@ LdrSetImplicitPathOptions( ); #endif -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) #ifdef PHNT_INLINE_TYPEDEFS /** * The LdrControlFlowGuardEnforced function checks if Control Flow Guard is enforced. @@ -1379,7 +1379,7 @@ LdrControlFlowGuardEnforced( #endif #endif -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) /** * The LdrControlFlowGuardEnforcedWithExportSuppression function checks if Control Flow Guard is * enforced with export suppression. @@ -1399,7 +1399,7 @@ LdrControlFlowGuardEnforcedWithExportSuppression( } #endif -#if (PHNT_VERSION >= PHNT_19H1) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_19H1) // rev NTSYSAPI BOOLEAN @@ -1409,7 +1409,7 @@ LdrIsModuleSxsRedirected( ); #endif -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev NTSYSAPI NTSTATUS @@ -1441,7 +1441,7 @@ typedef struct _LDR_SOFTWARE_ENCLAVE PLDR_DATA_TABLE_ENTRY BCryptPrimitivesModule; } LDR_SOFTWARE_ENCLAVE, *PLDR_SOFTWARE_ENCLAVE; -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev from CreateEnclave /** @@ -1597,7 +1597,7 @@ LdrSetDllManifestProber( _In_ PVOID Routine ); -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSAPI BOOLEAN LdrpChildNtdll; // DATA export #endif diff --git a/ntlpcapi.h b/ntlpcapi.h index f945fde..290eae5 100644 --- a/ntlpcapi.h +++ b/ntlpcapi.h @@ -654,7 +654,7 @@ typedef struct _ALPC_MESSAGE_HANDLE_INFORMATION // begin_private -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // // System calls @@ -823,7 +823,7 @@ NtAlpcConnectPort( _In_opt_ PLARGE_INTEGER Timeout ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS NTAPI @@ -897,7 +897,7 @@ NtAlpcImpersonateClientOfPort( _In_ PVOID Flags ); -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSCALLAPI NTSTATUS NTAPI @@ -990,7 +990,7 @@ AlpcUnregisterCompletionList( _In_ HANDLE PortHandle ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSAPI NTSTATUS diff --git a/ntmisc.h b/ntmisc.h index 91ea51c..d6d7c7b 100644 --- a/ntmisc.h +++ b/ntmisc.h @@ -7,12 +7,9 @@ #ifndef _NTMISC_H #define _NTMISC_H -// Filter manager - -#define FLT_PORT_CONNECT 0x0001 -#define FLT_PORT_ALL_ACCESS (FLT_PORT_CONNECT | STANDARD_RIGHTS_ALL) - +// // VDM +// typedef enum _VDMSERVICECLASS { @@ -42,7 +39,69 @@ NtVdmControl( _Inout_ PVOID ServiceData ); +// +// Sessions +// + +typedef enum _IO_SESSION_EVENT +{ + IoSessionEventIgnore, + IoSessionEventCreated, + IoSessionEventTerminated, + IoSessionEventConnected, + IoSessionEventDisconnected, + IoSessionEventLogon, + IoSessionEventLogoff, + IoSessionEventMax +} IO_SESSION_EVENT; + +typedef enum _IO_SESSION_STATE +{ + IoSessionStateCreated = 1, + IoSessionStateInitialized = 2, + IoSessionStateConnected = 3, + IoSessionStateDisconnected = 4, + IoSessionStateDisconnectedLoggedOn = 5, + IoSessionStateLoggedOn = 6, + IoSessionStateLoggedOff = 7, + IoSessionStateTerminated = 8, + IoSessionStateMax +} IO_SESSION_STATE; + +#if (PHNT_MODE != PHNT_MODE_KERNEL) + +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) +NTSYSCALLAPI +NTSTATUS +NTAPI +NtOpenSession( + _Out_ PHANDLE SessionHandle, + _In_ ACCESS_MASK DesiredAccess, + _In_ POBJECT_ATTRIBUTES ObjectAttributes + ); +#endif // (PHNT_VERSION >= PHNT_WINDOWS_VISTA) + +#endif // (PHNT_MODE != PHNT_MODE_KERNEL) + +#if (PHNT_VERSION >= PHNT_WINDOWS_7) +NTSYSCALLAPI +NTSTATUS +NTAPI +NtNotifyChangeSession( + _In_ HANDLE SessionHandle, + _In_ ULONG ChangeSequenceNumber, + _In_ PLARGE_INTEGER ChangeTimeStamp, + _In_ IO_SESSION_EVENT Event, + _In_ IO_SESSION_STATE NewState, + _In_ IO_SESSION_STATE PreviousState, + _In_reads_bytes_opt_(PayloadSize) PVOID Payload, + _In_ ULONG PayloadSize + ); +#endif // (PHNT_VERSION >= PHNT_WINDOWS_7) + +// // ApiSet +// NTSYSAPI BOOL @@ -70,6 +129,7 @@ typedef enum _SECURE_SETTING_VALUE_TYPE SecureSettingValueTypeUnknown = 4 } SECURE_SETTING_VALUE_TYPE, *PSECURE_SETTING_VALUE_TYPE; +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // rev NTSYSCALLAPI NTSTATUS @@ -82,7 +142,9 @@ NtQuerySecurityPolicy( _Out_writes_bytes_opt_(*ValueSize) PVOID Value, _Inout_ PULONG ValueSize ); +#endif +#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1) // rev NTSYSCALLAPI NTSTATUS @@ -129,7 +191,9 @@ NtDirectGraphicsCall( _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer, _Out_ PULONG ReturnLength ); +#endif // (PHNT_VERSION >= PHNT_WINDOWS_10_20H1) +#if (PHNT_VERSION >= PHNT_WINDOWS_11_22H2) // rev NTSYSCALLAPI NTSTATUS @@ -163,8 +227,12 @@ NtSetInformationCpuPartition( _Reserved_ ULONG, _Reserved_ ULONG ); +#endif +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS2) +// // Process KeepAlive (also WakeCounter) +// typedef enum _PROCESS_ACTIVITY_TYPE { @@ -182,4 +250,405 @@ NtAcquireProcessActivityReference( _Reserved_ PROCESS_ACTIVITY_TYPE Reserved ); +#endif // (PHNT_VERSION >= PHNT_WINDOWS_10_RS2) + +// +// Appx/Msix Packages +// + +// private +typedef struct _PACKAGE_CONTEXT_REFERENCE +{ + PVOID reserved; +} *PACKAGE_CONTEXT_REFERENCE; + +// private +typedef enum PackageProperty +{ + PackageProperty_Name = 1, // q: WCHAR[] + PackageProperty_Version = 2, // q: WCHAR[] + PackageProperty_Architecture = 3, // q: ULONG (PROCESSOR_ARCHITECTURE_*) + PackageProperty_ResourceId = 4, // q: WCHAR[] + PackageProperty_Publisher = 5, // q: WCHAR[] + PackageProperty_PublisherId = 6, // q: WCHAR[] + PackageProperty_FamilyName = 7, // q: WCHAR[] + PackageProperty_FullName = 8, // q: WCHAR[] + PackageProperty_Flags = 9, // q: ULONG + PackageProperty_InstalledLocation = 10, // q: WCHAR[] + PackageProperty_DisplayName = 11, // q: WCHAR[] + PackageProperty_PublisherDisplayName = 12, // q: WCHAR[] + PackageProperty_Description = 13, // q: WCHAR[] + PackageProperty_Logo = 14, // q: WCHAR[] + PackageProperty_PackageOrigin = 15 // q: PackageOrigin +} PackageProperty; + +// private +typedef struct _PACKAGE_APPLICATION_CONTEXT_REFERENCE +{ + PVOID reserved; +} *PACKAGE_APPLICATION_CONTEXT_REFERENCE; + +// private +typedef enum PackageApplicationProperty +{ + PackageApplicationProperty_Aumid = 1, // q: WCHAR[] + PackageApplicationProperty_Praid = 2, // q: WCHAR[] + PackageApplicationProperty_DisplayName = 3, // q: WCHAR[] + PackageApplicationProperty_Description = 4, // q: WCHAR[] + PackageApplicationProperty_Logo = 5, // q: WCHAR[] + PackageApplicationProperty_SmallLogo = 6, // q: WCHAR[] + PackageApplicationProperty_ForegroundText = 7, // q: ULONG + PackageApplicationProperty_ForegroundTextString = 8, // q: WCHAR[] + PackageApplicationProperty_BackgroundColor = 9, // q: ULONG + PackageApplicationProperty_StartPage = 10, // q: WCHAR[] + PackageApplicationProperty_ContentURIRulesCount = 11, // q: ULONG + PackageApplicationProperty_ContentURIRules = 12, // q: WCHAR[] (multi-sz) + PackageApplicationProperty_StaticContentURIRulesCount = 13, // q: ULONG + PackageApplicationProperty_StaticContentURIRules = 14, // q: WCHAR[] (multi-sz) + PackageApplicationProperty_DynamicContentURIRulesCount = 15, // q: ULONG + PackageApplicationProperty_DynamicContentURIRules = 16 // q: WCHAR[] (multi-sz) +} PackageApplicationProperty; + +// private +typedef struct _PACKAGE_RESOURCES_CONTEXT_REFERENCE +{ + PVOID reserved; +} *PACKAGE_RESOURCES_CONTEXT_REFERENCE; + +// private +typedef enum PackageResourcesProperty +{ + PackageResourcesProperty_DisplayName = 1, + PackageResourcesProperty_PublisherDisplayName = 2, + PackageResourcesProperty_Description = 3, + PackageResourcesProperty_Logo = 4, + PackageResourcesProperty_SmallLogo = 5, + PackageResourcesProperty_StartPage = 6 +} PackageResourcesProperty; + +// private +typedef struct _PACKAGE_SECURITY_CONTEXT_REFERENCE +{ + PVOID reserved; +} *PACKAGE_SECURITY_CONTEXT_REFERENCE; + +// private +typedef enum PackageSecurityProperty +{ + PackageSecurityProperty_SecurityFlags = 1, // q: ULONG + PackageSecurityProperty_AppContainerSID = 2, // q: Sid + PackageSecurityProperty_CapabilitiesCount = 3, // q: ULONG + PackageSecurityProperty_Capabilities = 4 // q: Sid[] +} PackageSecurityProperty; + +// private +typedef struct _TARGET_PLATFORM_CONTEXT_REFERENCE +{ + PVOID reserved; +} *TARGET_PLATFORM_CONTEXT_REFERENCE; + +// private +typedef enum TargetPlatformProperty +{ + TargetPlatformProperty_Platform = 1, // q: ULONG + TargetPlatformProperty_MinVersion = 2, // q: PACKAGE_VERSION + TargetPlatformProperty_MaxVersion = 3 // q: PACKAGE_VERSION +} TargetPlatformProperty; + +// private +typedef struct _PACKAGE_GLOBALIZATION_CONTEXT_REFERENCE +{ + PVOID reserved; +} *PACKAGE_GLOBALIZATION_CONTEXT_REFERENCE; + +// private +typedef enum PackageGlobalizationProperty +{ + PackageGlobalizationProperty_ForceUtf8 = 1, // q: ULONG + PackageGlobalizationProperty_UseWindowsDisplayLanguage = 2 // q: ULONG +} PackageGlobalizationProperty; + +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) + +// rev +WINBASEAPI +ULONG +WINAPI +GetCurrentPackageContext( + _In_ ULONG Index, + _Reserved_ ULONG_PTR Unused, + _Out_ PACKAGE_CONTEXT_REFERENCE *PackageContext + ); + +// rev +WINBASEAPI +ULONG +WINAPI +GetPackageContext( + _In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE + _In_ ULONG Index, + _Reserved_ ULONG_PTR Unused, + _Out_ PACKAGE_CONTEXT_REFERENCE *PackageContext + ); + +// rev +WINBASEAPI +ULONG +WINAPI +GetPackageProperty( + _In_ PACKAGE_CONTEXT_REFERENCE PackageContext, + _In_ PackageProperty PropertyId, + _Inout_ PULONG BufferSize, + _Out_writes_bytes_(BufferSize) PVOID Buffer + ); + +// rev +WINBASEAPI +ULONG +WINAPI +GetPackagePropertyString( + _In_ PACKAGE_CONTEXT_REFERENCE PackageContext, + _In_ PackageProperty PropertyId, + _Inout_ PULONG BufferLength, + _Out_writes_(BufferLength) PWSTR Buffer + ); + +// rev +WINBASEAPI +ULONG +WINAPI +GetPackageOSMaxVersionTested( + _In_ PACKAGE_CONTEXT_REFERENCE PackageContext, + _Out_ ULONGLONG *OSMaxVersionTested // PACKAGE_VERSION + ); + +// +// Package Application Properties +// + +// rev +WINBASEAPI +ULONG +WINAPI +GetCurrentPackageApplicationContext( + _In_ ULONG Index, + _Reserved_ ULONG_PTR Unused, + _Out_ PACKAGE_APPLICATION_CONTEXT_REFERENCE *PackageApplicationContext + ); + +// rev +WINBASEAPI +ULONG +WINAPI +GetPackageApplicationContext( + _In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE + _In_ ULONG Index, + _Reserved_ ULONG_PTR Unused, + _Out_ PACKAGE_APPLICATION_CONTEXT_REFERENCE *PackageApplicationContext + ); + +// rev +WINBASEAPI +ULONG +WINAPI +GetPackageApplicationProperty( + _In_ PACKAGE_APPLICATION_CONTEXT_REFERENCE PackageApplicationContext, + _In_ PackageApplicationProperty PropertyId, + _Inout_ PULONG BufferSize, + _Out_writes_bytes_(BufferSize) PVOID Buffer + ); + +// rev +WINBASEAPI +ULONG +WINAPI +GetPackageApplicationPropertyString( + _In_ PACKAGE_APPLICATION_CONTEXT_REFERENCE PackageApplicationContext, + _In_ PackageApplicationProperty PropertyId, + _Inout_ PULONG BufferLength, + _Out_writes_(BufferLength) PWSTR Buffer + ); + +// +// Package Resource Properties +// + +// rev +WINBASEAPI +ULONG +WINAPI +GetCurrentPackageResourcesContext( + _In_ ULONG Index, + _Reserved_ ULONG_PTR Unused, + _Out_ PACKAGE_RESOURCES_CONTEXT_REFERENCE *PackageResourcesContext + ); + +// rev +WINBASEAPI +ULONG +WINAPI +GetPackageResourcesContext( + _In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE + _In_ ULONG Index, + _Reserved_ ULONG_PTR Unused, + _Out_ PACKAGE_RESOURCES_CONTEXT_REFERENCE *PackageResourcesContext + ); + +// rev +WINBASEAPI +ULONG +WINAPI +GetCurrentPackageApplicationResourcesContext( + _In_ ULONG Index, + _Reserved_ ULONG_PTR Unused, + _Out_ PACKAGE_APPLICATION_CONTEXT_REFERENCE *PackageResourcesContext + ); + +// rev +WINBASEAPI +LONG +WINAPI +GetPackageApplicationResourcesContext( + _In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE + _In_ ULONG Index, + _Reserved_ ULONG_PTR Unused, + _Out_ PACKAGE_APPLICATION_CONTEXT_REFERENCE *PackageResourcesContext + ); + +// rev +WINBASEAPI +LONG +WINAPI +GetPackageResourcesProperty( + _In_ PACKAGE_APPLICATION_CONTEXT_REFERENCE PackageResourcesContext, + _In_ PackageResourcesProperty PropertyId, + _Inout_ PULONG BufferSize, + _Out_writes_bytes_(BufferSize) PVOID Buffer + ); + +// +// Package Security Properties +// + +// rev +WINBASEAPI +LONG +WINAPI +GetCurrentPackageSecurityContext( + _Reserved_ ULONG_PTR Unused, + _Out_ PACKAGE_SECURITY_CONTEXT_REFERENCE *PackageSecurityContext + ); + +// rev +WINBASEAPI +LONG +WINAPI +GetPackageSecurityContext( + _In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE + _Reserved_ ULONG_PTR Unused, + _Out_ PACKAGE_SECURITY_CONTEXT_REFERENCE *PackageSecurityContext + ); + +// rev +WINBASEAPI +LONG +WINAPI +GetPackageSecurityProperty( + _In_ PACKAGE_SECURITY_CONTEXT_REFERENCE PackageSecurityContext, + _In_ PackageSecurityProperty PropertyId, + _Inout_ PULONG BufferSize, + _Out_writes_bytes_(BufferSize) PVOID Buffer + ); + +#endif // PHNT_VERSION >= PHNT_WINDOWS_8_1 + +#if (PHNT_VERSION >= PHNT_WINDOWS_10) + +// +// Target Platform Properties +// + +// rev +WINBASEAPI +LONG +WINAPI +GetCurrentTargetPlatformContext( + _Reserved_ ULONG_PTR Unused, + _Out_ TARGET_PLATFORM_CONTEXT_REFERENCE *TargetPlatformContext + ); + +WINBASEAPI +LONG +WINAPI +GetTargetPlatformContext( + _In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE + _Reserved_ ULONG_PTR Unused, + _Out_ TARGET_PLATFORM_CONTEXT_REFERENCE *TargetPlatformContext + ); + +// rev +WINBASEAPI +LONG +WINAPI +GetPackageTargetPlatformProperty( + _In_ TARGET_PLATFORM_CONTEXT_REFERENCE TargetPlatformContext, + _In_ TargetPlatformProperty PropertyId, + _Inout_ PULONG BufferSize, + _Out_writes_bytes_(BufferSize) PVOID Buffer + ); + +#endif // PHNT_VERSION >= PHNT_WINDOWS_10 + +#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1) + +// rev +WINBASEAPI +HRESULT +WINAPI +GetCurrentPackageInfo3( + _In_ ULONG flags, + _In_ ULONG packagePathType, // PackagePathType + _Inout_ PULONG bufferLength, + _Out_writes_bytes_opt_(*bufferLength) PVOID buffer, + _Out_opt_ PULONG count + ); + +// +// Package Globalization Properties +// + +// rev +WINBASEAPI +LONG +WINAPI +GetCurrentPackageGlobalizationContext( + _In_ ULONG Index, + _Reserved_ ULONG_PTR Unused, + _Out_ PACKAGE_GLOBALIZATION_CONTEXT_REFERENCE *PackageGlobalizationContext + ); + +// rev +WINBASEAPI +LONG +WINAPI +GetPackageGlobalizationContext( + _In_ PVOID PackageInfoReference, // PACKAGE_INFO_REFERENCE + _In_ ULONG Index, + _Reserved_ ULONG_PTR Unused, + _Out_ PACKAGE_GLOBALIZATION_CONTEXT_REFERENCE *PackageGlobalizationContext + ); + +// rev +WINBASEAPI +LONG +WINAPI +GetPackageGlobalizationProperty( + _In_ PACKAGE_GLOBALIZATION_CONTEXT_REFERENCE PackageGlobalizationContext, + _In_ PackageGlobalizationProperty PropertyId, + _Inout_ PULONG BufferSize, + _Out_writes_bytes_(BufferSize) PVOID Buffer + ); + +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_20H1 + #endif diff --git a/ntmmapi.h b/ntmmapi.h index 42189c2..25469be 100644 --- a/ntmmapi.h +++ b/ntmmapi.h @@ -248,8 +248,8 @@ typedef union _MEMORY_WORKING_SET_EX_BLOCK ULONG_PTR Reserved : 3; ULONG_PTR SharedOriginal : 1; // If this bit is 1, the page was not modified. ULONG_PTR Bad : 1; // If this bit is 1, the page is has been reported as bad. - ULONG_PTR Win32GraphicsProtection : 4; // The memory protection attributes of the page. // since 19H1 #ifdef _WIN64 + ULONG_PTR Win32GraphicsProtection : 4; // The memory protection attributes of the page. // since 19H1 ULONG_PTR ReservedUlong : 28; #endif }; @@ -528,7 +528,7 @@ typedef struct _MEMORY_FRAME_INFORMATION ULONGLONG Priority : 3; ULONGLONG NonTradeable : 1; ULONGLONG Reserved : 3; -} MEMORY_FRAME_INFORMATION; +} MEMORY_FRAME_INFORMATION, *PMEMORY_FRAME_INFORMATION; // private typedef struct _FILEOFFSET_INFORMATION @@ -536,7 +536,7 @@ typedef struct _FILEOFFSET_INFORMATION ULONGLONG DontUse : 9; // MEMORY_FRAME_INFORMATION overlay ULONGLONG Offset : 48; // mapped files ULONGLONG Reserved : 7; -} FILEOFFSET_INFORMATION; +} FILEOFFSET_INFORMATION, *PFILEOFFSET_INFORMATION; // private typedef struct _PAGEDIR_INFORMATION @@ -544,7 +544,7 @@ typedef struct _PAGEDIR_INFORMATION ULONGLONG DontUse : 9; // MEMORY_FRAME_INFORMATION overlay ULONGLONG PageDirectoryBase : 48; // private pages ULONGLONG Reserved : 7; -} PAGEDIR_INFORMATION; +} PAGEDIR_INFORMATION, *PPAGEDIR_INFORMATION; // private typedef struct _UNIQUE_PROCESS_INFORMATION @@ -716,7 +716,7 @@ NtAllocateVirtualMemory( _In_ ULONG PageProtection ); -#if (PHNT_VERSION >= PHNT_REDSTONE5) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS5) _Must_inspect_result_ _When_(return == 0, __drv_allocatesMem(mem)) NTSYSCALLAPI @@ -785,7 +785,7 @@ NtWow64ReadVirtualMemory64( _Out_opt_ PULONGLONG NumberOfBytesRead ); -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) /** * Reads virtual memory from a process with extended options. * @@ -949,7 +949,7 @@ NtFlushVirtualMemory( typedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS { VmPrefetchInformation, // MEMORY_PREFETCH_INFORMATION - VmPagePriorityInformation, // OFFER_PRIORITY + VmPagePriorityInformation, // MEMORY_PAGE_PRIORITY_INFORMATION VmCfgCallTargetInformation, // CFG_CALL_TARGET_LIST_INFORMATION // REDSTONE2 VmPageDirtyStateInformation, // REDSTONE3 VmImageHotPatchInformation, // 19H1 @@ -984,6 +984,26 @@ typedef struct _MEMORY_PREFETCH_INFORMATION ULONG Flags; } MEMORY_PREFETCH_INFORMATION, *PMEMORY_PREFETCH_INFORMATION; +// +// Page/memory priorities. +// + +#define MEMORY_PRIORITY_LOWEST 0 +#define MEMORY_PRIORITY_VERY_LOW 1 +#define MEMORY_PRIORITY_LOW 2 +#define MEMORY_PRIORITY_MEDIUM 3 +#define MEMORY_PRIORITY_BELOW_NORMAL 4 +#define MEMORY_PRIORITY_NORMAL 5 +#define MEMORY_PRIORITY_ABOVE_NORMAL 6 // rev +#define MEMORY_PRIORITY_HIGH 7 // rev + +// VmPagePriorityInformation +typedef struct _MEMORY_PAGE_PRIORITY_INFORMATION +{ + ULONG PagePriority; +} MEMORY_PAGE_PRIORITY_INFORMATION, *PMEMORY_PAGE_PRIORITY_INFORMATION; + +// VmCfgCallTargetInformation typedef struct _CFG_CALL_TARGET_LIST_INFORMATION { ULONG NumberOfEntries; @@ -998,7 +1018,7 @@ typedef struct _CFG_CALL_TARGET_LIST_INFORMATION #if (PHNT_MODE != PHNT_MODE_KERNEL) -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS @@ -1056,7 +1076,7 @@ NtCreateSection( _In_opt_ HANDLE FileHandle ); -#if (PHNT_VERSION >= PHNT_REDSTONE5) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS5) NTSYSCALLAPI NTSTATUS NTAPI @@ -1098,7 +1118,7 @@ NtMapViewOfSection( _In_ ULONG PageProtection ); -#if (PHNT_VERSION >= PHNT_REDSTONE5) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS5) NTSYSCALLAPI NTSTATUS NTAPI @@ -1123,7 +1143,7 @@ NtUnmapViewOfSection( _In_opt_ PVOID BaseAddress ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS NTAPI @@ -1163,7 +1183,21 @@ NtAreMappedFilesTheSame( #endif -// Partitions +// +// Memory Partitions +// + +#ifndef MEMORY_CURRENT_PARTITION_HANDLE +#define MEMORY_CURRENT_PARTITION_HANDLE ((HANDLE)(LONG_PTR)-1) +#endif + +#ifndef MEMORY_SYSTEM_PARTITION_HANDLE +#define MEMORY_SYSTEM_PARTITION_HANDLE ((HANDLE)(LONG_PTR)-2) +#endif + +#ifndef MEMORY_EXISTING_VAD_PARTITION_HANDLE +#define MEMORY_EXISTING_VAD_PARTITION_HANDLE ((HANDLE)(LONG_PTR)-3) +#endif #ifndef MEMORY_PARTITION_QUERY_ACCESS #define MEMORY_PARTITION_QUERY_ACCESS 0x0001 @@ -1298,7 +1332,7 @@ typedef struct _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION #if (PHNT_MODE != PHNT_MODE_KERNEL) -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSCALLAPI NTSTATUS @@ -1366,7 +1400,7 @@ NtAllocateUserPhysicalPages( _Out_writes_(*NumberOfPages) PULONG_PTR UserPfnArray ); -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSCALLAPI NTSTATUS NTAPI @@ -1390,10 +1424,25 @@ NtFreeUserPhysicalPages( #endif +// // Misc. +// #if (PHNT_MODE != PHNT_MODE_KERNEL) +/** + * Retrieves the addresses of the pages that are written to in a region of virtual memory. + * + * @param ProcessHandle A handle to the process whose watch information is to be queried. + * @param Flags Additional flags for the operation. To reset the write-tracking state, set this parameter to WRITE_WATCH_FLAG_RESET. Otherwise, set this parameter to zero. + * @param BaseAddress The base address of the memory region for which to retrieve write-tracking information. This address must a region that is allocated using MEM_WRITE_WATCH. + * @param RegionSize The size of the memory region for which to retrieve write-tracking information, in bytes. + * @param UserAddressArray A pointer to a buffer that receives an array of page addresses that have been written to since the region has been allocated or the write-tracking state has been reset. + * @param EntriesInUserAddressArray On input, this variable indicates the size of the UserAddressArray array. On output, the variable receives the number of page addresses that are returned in the array. + * @param Granularity A pointer to a variable that receives the page size, in bytes. + * @return NTSTATUS Successful or errant status. + * @see https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-getwritewatch + */ NTSYSCALLAPI NTSTATUS NTAPI @@ -1407,6 +1456,15 @@ NtGetWriteWatch( _Out_ PULONG Granularity ); +/** + * Resets the write-tracking state for a region of virtual memory. + * + * @param ProcessHandle A handle to the process whose watch information is to be reset. + * @param BaseAddress A pointer to the base address of the memory region for which to reset the write-tracking state. + * @param RegionSize The size of the memory region for which to reset the write-tracking information, in bytes. + * @return NTSTATUS Successful or errant status. + * @see https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-resetwritewatch + */ NTSYSCALLAPI NTSTATUS NTAPI @@ -1444,8 +1502,11 @@ NtFlushWriteBuffer( #endif -#if (PHNT_VERSION >= PHNT_THRESHOLD) +// // Enclave support +// + +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSCALLAPI NTSTATUS diff --git a/ntobapi.h b/ntobapi.h index be35538..18a8d50 100644 --- a/ntobapi.h +++ b/ntobapi.h @@ -214,7 +214,7 @@ NtWaitForMultipleObjects( _In_opt_ PLARGE_INTEGER Timeout ); -#if (PHNT_VERSION >= PHNT_WS03) +#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003) NTSYSCALLAPI NTSTATUS NTAPI @@ -254,7 +254,7 @@ NtClose( _In_ _Post_ptr_invalid_ HANDLE Handle ); -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSCALLAPI NTSTATUS NTAPI @@ -279,7 +279,7 @@ NtCreateDirectoryObject( _In_ POBJECT_ATTRIBUTES ObjectAttributes ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS NTAPI @@ -369,7 +369,7 @@ typedef struct _OBJECT_BOUNDARY_DESCRIPTOR //OBJECT_BOUNDARY_ENTRY Entries[1]; } OBJECT_BOUNDARY_DESCRIPTOR, *POBJECT_BOUNDARY_DESCRIPTOR; -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS @@ -441,7 +441,7 @@ typedef enum _SYMBOLIC_LINK_INFO_CLASS MaxnSymbolicLinkInfoClass } SYMBOLIC_LINK_INFO_CLASS; -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSCALLAPI NTSTATUS NTAPI diff --git a/ntpebteb.h b/ntpebteb.h index 68d5ba4..1836c4f 100644 --- a/ntpebteb.h +++ b/ntpebteb.h @@ -402,7 +402,45 @@ typedef struct _PEB // // Global flags for the system. // - ULONG NtGlobalFlag; + union + { + ULONG NtGlobalFlag; + struct + { + ULONG StopOnException : 1; // FLG_STOP_ON_EXCEPTION + ULONG ShowLoaderSnaps : 1; // FLG_SHOW_LDR_SNAPS + ULONG DebugInitialCommand : 1; // FLG_DEBUG_INITIAL_COMMAND + ULONG StopOnHungGUI : 1; // FLG_STOP_ON_HUNG_GUI + ULONG HeapEnableTailCheck : 1; // FLG_HEAP_ENABLE_TAIL_CHECK + ULONG HeapEnableFreeCheck : 1; // FLG_HEAP_ENABLE_FREE_CHECK + ULONG HeapValidateParameters : 1; // FLG_HEAP_VALIDATE_PARAMETERS + ULONG HeapValidateAll : 1; // FLG_HEAP_VALIDATE_ALL + ULONG ApplicationVerifier : 1; // FLG_APPLICATION_VERIFIER + ULONG MonitorSilentProcessExit : 1; // FLG_MONITOR_SILENT_PROCESS_EXIT + ULONG PoolEnableTagging : 1; // FLG_POOL_ENABLE_TAGGING + ULONG HeapEnableTagging : 1; // FLG_HEAP_ENABLE_TAGGING + ULONG UserStackTraceDb : 1; // FLG_USER_STACK_TRACE_DB + ULONG KernelStackTraceDb : 1; // FLG_KERNEL_STACK_TRACE_DB + ULONG MaintainObjectTypeList : 1; // FLG_MAINTAIN_OBJECT_TYPELIST + ULONG HeapEnableTagByDll : 1; // FLG_HEAP_ENABLE_TAG_BY_DLL + ULONG DisableStackExtension : 1; // FLG_DISABLE_STACK_EXTENSION + ULONG EnableCsrDebug : 1; // FLG_ENABLE_CSRDEBUG + ULONG EnableKDebugSymbolLoad : 1; // FLG_ENABLE_KDEBUG_SYMBOL_LOAD + ULONG DisablePageKernelStacks : 1; // FLG_DISABLE_PAGE_KERNEL_STACKS + ULONG EnableSystemCritBreaks : 1; // FLG_ENABLE_SYSTEM_CRIT_BREAKS + ULONG HeapDisableCoalescing : 1; // FLG_HEAP_DISABLE_COALESCING + ULONG EnableCloseExceptions : 1; // FLG_ENABLE_CLOSE_EXCEPTIONS + ULONG EnableExceptionLogging : 1; // FLG_ENABLE_EXCEPTION_LOGGING + ULONG EnableHandleTypeTagging : 1; // FLG_ENABLE_HANDLE_TYPE_TAGGING + ULONG HeapPageAllocs : 1; // FLG_HEAP_PAGE_ALLOCS + ULONG DebugInitialCommandEx : 1; // FLG_DEBUG_INITIAL_COMMAND_EX + ULONG DisableDbgPrint : 1; // FLG_DISABLE_DBGPRINT + ULONG CritSecEventCreation : 1; // FLG_CRITSEC_EVENT_CREATION + ULONG LdrTopDown : 1; // FLG_LDR_TOP_DOWN + ULONG EnableHandleExceptions : 1; // FLG_ENABLE_HANDLE_EXCEPTIONS + ULONG DisableProtDlls : 1; // FLG_DISABLE_PROTDLLS + } NtGlobalFlags; + }; // // Timeout for critical sections. @@ -754,17 +792,17 @@ typedef struct _PEB } PEB, * PPEB; #ifdef _WIN64 -static_assert(FIELD_OFFSET(PEB, SessionId) == 0x2C0); -//static_assert(sizeof(PEB) == 0x7B0); // REDSTONE3 -//static_assert(sizeof(PEB) == 0x7B8); // REDSTONE4 -//static_assert(sizeof(PEB) == 0x7C8); // REDSTONE5 // 19H1 -static_assert(sizeof(PEB) == 0x7d0); // WIN11 +static_assert(FIELD_OFFSET(PEB, SessionId) == 0x2C0, "FIELD_OFFSET(PEB, SessionId) is incorrect"); +//static_assert(sizeof(PEB) == 0x7B0, "Size of PEB is incorrect"); // REDSTONE3 +//static_assert(sizeof(PEB) == 0x7B8, "Size of PEB is incorrect"); // REDSTONE4 +//static_assert(sizeof(PEB) == 0x7C8, "Size of PEB is incorrect"); // REDSTONE5 // 19H1 +static_assert(sizeof(PEB) == 0x7d0, "Size of PEB is incorrect"); // WIN11 #else -static_assert(FIELD_OFFSET(PEB, SessionId) == 0x1D4); -//static_assert(sizeof(PEB) == 0x468); // REDSTONE3 -//static_assert(sizeof(PEB) == 0x470); // REDSTONE4 -//static_assert(sizeof(PEB) == 0x480); // REDSTONE5 // 19H1 -static_assert(sizeof(PEB) == 0x488); // WIN11 +static_assert(FIELD_OFFSET(PEB, SessionId) == 0x1D4, "FIELD_OFFSET(PEB, SessionId) is incorrect"); +//static_assert(sizeof(PEB) == 0x468, "Size of PEB is incorrect"); // REDSTONE3 +//static_assert(sizeof(PEB) == 0x470, "Size of PEB is incorrect"); // REDSTONE4 +//static_assert(sizeof(PEB) == 0x480, "Size of PEB is incorrect"); // REDSTONE5 // 19H1 +static_assert(sizeof(PEB) == 0x488, "Size of PEB is incorrect"); // WIN11 #endif #define GDI_BATCH_BUFFER_SIZE 310 @@ -1240,11 +1278,11 @@ typedef struct _TEB } TEB, *PTEB; #ifdef _WIN64 -//static_assert(sizeof(TEB) == 0x1850); // WIN11 -static_assert(sizeof(TEB) == 0x1878); // 24H2 +//static_assert(sizeof(TEB) == 0x1850, "Size of TEB is incorrect"); // WIN11 +static_assert(sizeof(TEB) == 0x1878, "Size of TEB is incorrect"); // 24H2 #else -//static_assert(sizeof(TEB) == 0x1018); // WIN11 -static_assert(sizeof(TEB) == 0x1038); // 24H2 +//static_assert(sizeof(TEB) == 0x1018, "Size of TEB is incorrect"); // WIN11 +static_assert(sizeof(TEB) == 0x1038, "Size of TEB is incorrect"); // 24H2 #endif #endif diff --git a/ntpnpapi.h b/ntpnpapi.h index 801b82b..6b49034 100644 --- a/ntpnpapi.h +++ b/ntpnpapi.h @@ -149,7 +149,7 @@ typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE DeviceUsageTypeGuestAssigned } DEVICE_USAGE_NOTIFICATION_TYPE, *PDEVICE_USAGE_NOTIFICATION_TYPE; -#if (PHNT_VERSION < PHNT_WIN8) +#if (PHNT_VERSION < PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS NTAPI @@ -170,7 +170,7 @@ NtPlugPlayControl( _In_ ULONG PnPControlDataLength ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSCALLAPI NTSTATUS @@ -195,7 +195,7 @@ NtDisableLastKnownGood( #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI diff --git a/ntpoapi.h b/ntpoapi.h index 2ddb084..44ff100 100644 --- a/ntpoapi.h +++ b/ntpoapi.h @@ -108,7 +108,8 @@ #define SessionAllowExternalDmaDevices 95 // POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES #define SendSuspendResumeNotification 96 // since WIN11 #define BlackBoxRecorderDirectAccessBuffer 97 -#define PowerInformationLevelMaximum 98 +#define SystemPowerSourceState 98 // since 25H2 +#define PowerInformationLevelMaximum 99 #endif typedef struct _PROCESSOR_POWER_INFORMATION @@ -544,7 +545,7 @@ typedef struct _POWER_REQUEST ULONG PowerRequestCount[POWER_REQUEST_SUPPORTED_TYPES_V1]; DIAGNOSTIC_BUFFER DiagnosticBuffer; } V1; -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) struct { ULONG SupportedRequestMask; @@ -552,7 +553,7 @@ typedef struct _POWER_REQUEST DIAGNOSTIC_BUFFER DiagnosticBuffer; } V2; #endif -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) struct { ULONG SupportedRequestMask; @@ -560,7 +561,7 @@ typedef struct _POWER_REQUEST DIAGNOSTIC_BUFFER DiagnosticBuffer; } V3; #endif -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) struct { ULONG SupportedRequestMask; @@ -916,7 +917,7 @@ NtSetThreadExecutionState( _Out_ EXECUTION_STATE *PreviousFlags ); -#if (PHNT_VERSION < PHNT_WIN7) +#if (PHNT_VERSION < PHNT_WINDOWS_7) /** * Requests the system resume latency. * diff --git a/ntpsapi.h b/ntpsapi.h index 341c94f..2e6e04a 100644 --- a/ntpsapi.h +++ b/ntpsapi.h @@ -59,7 +59,7 @@ #define PROCESS_SET_LIMITED_INFORMATION 0x2000 #endif #ifndef PROCESS_ALL_ACCESS -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) #define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | SPECIFIC_RIGHTS_ALL) #else #define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFF) @@ -110,7 +110,7 @@ #define THREAD_RESUME 0x1000 #endif #ifndef THREAD_ALL_ACCESS -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) #define THREAD_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | SPECIFIC_RIGHTS_ALL) #else #define THREAD_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3FF) @@ -137,7 +137,7 @@ #define JOB_OBJECT_SET_SECURITY_ATTRIBUTES 0x0010 #endif #ifndef JOB_OBJECT_ALL_ACCESS -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) #define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3F) #else #define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1f) // pre-Vista full access @@ -233,7 +233,7 @@ typedef enum _PROCESSINFOCLASS ProcessHandleCheckingMode, // qs: ULONG; s: 0 disables, otherwise enables ProcessKeepAliveCount, // q: PROCESS_KEEPALIVE_COUNT_INFORMATION ProcessRevokeFileHandles, // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION - ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL (requires SeDebugPrivilege) + ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL ProcessHandleTable, // q: ULONG[] // since WINBLUE ProcessCheckStackExtentsMode, // qs: ULONG // KPROCESS->CheckStackExtents (CFG) ProcessCommandLineInformation, // q: UNICODE_STRING // 60 @@ -292,6 +292,8 @@ typedef enum _PROCESSINFOCLASS ProcessSlistRollbackInformation, ProcessNetworkIoCounters, // q: PROCESS_NETWORK_COUNTERS ProcessFindFirstThreadByTebValue, // PROCESS_TEB_VALUE_INFORMATION + ProcessEnclaveAddressSpaceRestriction, // since 25H2 + ProcessAvailableCpus, MaxProcessInfoClass } PROCESSINFOCLASS; #endif @@ -338,26 +340,26 @@ typedef enum _THREADINFOCLASS ThreadHeterogeneousCpuPolicy, // q: KHETERO_CPU_POLICY // since THRESHOLD ThreadContainerId, // q: GUID ThreadNameInformation, // qs: THREAD_NAME_INFORMATION (requires THREAD_SET_LIMITED_INFORMATION) - ThreadSelectedCpuSets, + ThreadSelectedCpuSets, // q: ULONG[] ThreadSystemThreadInformation, // q: SYSTEM_THREAD_INFORMATION // 40 ThreadActualGroupAffinity, // q: GROUP_AFFINITY // since THRESHOLD2 ThreadDynamicCodePolicyInfo, // q: ULONG; s: ULONG (NtCurrentThread) - ThreadExplicitCaseSensitivity, // qs: ULONG; s: 0 disables, otherwise enables + ThreadExplicitCaseSensitivity, // qs: ULONG; s: 0 disables, otherwise enables // (requires SeDebugPrivilege and PsProtectedSignerAntimalware) ThreadWorkOnBehalfTicket, // RTL_WORK_ON_BEHALF_TICKET_EX ThreadSubsystemInformation, // q: SUBSYSTEM_INFORMATION_TYPE // since REDSTONE2 ThreadDbgkWerReportActive, // s: ULONG; s: 0 disables, otherwise enables ThreadAttachContainer, // s: HANDLE (job object) // NtCurrentThread ThreadManageWritesToExecutableMemory, // MANAGE_WRITES_TO_EXECUTABLE_MEMORY // since REDSTONE3 - ThreadPowerThrottlingState, // POWER_THROTTLING_THREAD_STATE // since REDSTONE3 (set), WIN11 22H2 (query) + ThreadPowerThrottlingState, // qs: POWER_THROTTLING_THREAD_STATE // since REDSTONE3 (set), WIN11 22H2 (query) ThreadWorkloadClass, // THREAD_WORKLOAD_CLASS // since REDSTONE5 // 50 ThreadCreateStateChange, // since WIN11 ThreadApplyStateChange, - ThreadStrongerBadHandleChecks, // since 22H1 + ThreadStrongerBadHandleChecks, // s: ULONG // NtCurrentThread // since 22H1 ThreadEffectiveIoPriority, // q: IO_PRIORITY_HINT ThreadEffectivePagePriority, // q: ULONG ThreadUpdateLockOwnership, // THREAD_LOCK_OWNERSHIP // since 24H2 ThreadSchedulerSharedDataSlot, // SCHEDULER_SHARED_DATA_SLOT_INFORMATION - ThreadTebInformationAtomic, // THREAD_TEB_INFORMATION + ThreadTebInformationAtomic, // q: THREAD_TEB_INFORMATION (requires THREAD_GET_CONTEXT + THREAD_QUERY_INFORMATION) ThreadIndexInformation, // THREAD_INDEX_INFORMATION MaxThreadInfoClass } THREADINFOCLASS; @@ -1069,8 +1071,7 @@ typedef struct _PROCESS_REVOKE_FILE_HANDLES_INFORMATION UNICODE_STRING TargetDevicePath; } PROCESS_REVOKE_FILE_HANDLES_INFORMATION, *PPROCESS_REVOKE_FILE_HANDLES_INFORMATION; -// begin_private - +// rev #define PROCESS_WORKING_SET_CONTROL_VERSION 3 /** @@ -1078,11 +1079,34 @@ typedef struct _PROCESS_REVOKE_FILE_HANDLES_INFORMATION */ typedef enum _PROCESS_WORKING_SET_OPERATION { - ProcessWorkingSetSwap, - ProcessWorkingSetEmpty, + ProcessWorkingSetSwap, // Swap the working set of a process to disk. // (requires SeDebugPrivilege) + ProcessWorkingSetEmpty, // Remove all pages from the working set of a process. + ProcessWorkingSetEmptyPrivatePages, // Remove private pages from the working set of a process. ProcessWorkingSetOperationMax } PROCESS_WORKING_SET_OPERATION; +/** + * The PROCESS_WORKING_SET_FLAG_EMPTY_PRIVATE_PAGES flag indicates that the operation should target private pages in the working set. + * Private pages are those that are not shared with other processes. + */ +#define PROCESS_WORKING_SET_FLAG_EMPTY_PRIVATE_PAGES 0x01 +/** + * The PROCESS_WORKING_SET_FLAG_EMPTY_SHARED_PAGES flag indicates that the operation should target shared pages in the working set. + * Shared pages are those that are shared between multiple processes. + */ +#define PROCESS_WORKING_SET_FLAG_EMPTY_SHARED_PAGES 0x02 +/** + * The PROCESS_WORKING_SET_FLAG_COMPRESS flag indicates that the operation should compress the pages before they are removed from the working set. + * Compression is typically used in conjunction with other flags to specify that the pages should be compressed as part of the operation. + */ +#define PROCESS_WORKING_SET_FLAG_COMPRESS 0x08 +/** + * The PROCESS_WORKING_SET_FLAG_STORE flag indicates that the operation should store the compressed pages. + * This is useful when the compressed data might be needed later, allowing for efficient retrieval and decompression when required. + * This flag is typically used in conjunction with the PROCESS_WORKING_SET_FLAG_COMPRESS flag to specify that the compressed pages should be stored. + */ +#define PROCESS_WORKING_SET_FLAG_STORE 0x10 + /** * The PROCESS_WORKING_SET_CONTROL structure is used to control the working set of a process. */ @@ -1232,9 +1256,11 @@ typedef struct _PROCESS_CHILD_PROCESS_INFORMATION } PROCESS_CHILD_PROCESS_INFORMATION, *PPROCESS_CHILD_PROCESS_INFORMATION; #define POWER_THROTTLING_PROCESS_CURRENT_VERSION 1 + #define POWER_THROTTLING_PROCESS_EXECUTION_SPEED 0x1 #define POWER_THROTTLING_PROCESS_DELAYTIMERS 0x2 #define POWER_THROTTLING_PROCESS_IGNORE_TIMER_RESOLUTION 0x4 // since WIN11 + #define POWER_THROTTLING_PROCESS_VALID_FLAGS \ ((POWER_THROTTLING_PROCESS_EXECUTION_SPEED | POWER_THROTTLING_PROCESS_DELAYTIMERS | POWER_THROTTLING_PROCESS_IGNORE_TIMER_RESOLUTION)) @@ -1426,8 +1452,6 @@ typedef struct _PROCESS_TEB_VALUE_INFORMATION ULONG_PTR Value; } PROCESS_TEB_VALUE_INFORMATION, *PPROCESS_TEB_VALUE_INFORMATION; -// end_private - /** * The NtQueryPortInformationProcess function retrieves the status of the current process exception port. * @@ -1440,7 +1464,7 @@ NtQueryPortInformationProcess( VOID ); -#endif +#endif // PHNT_MODE != PHNT_MODE_KERNEL // // Thread information structures @@ -1991,7 +2015,7 @@ NtSetInformationProcess( #define PROCESS_GET_NEXT_FLAGS_PREVIOUS_PROCESS 0x00000001 -#if (PHNT_VERSION >= PHNT_WS03) +#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003) /** * Retrieves a handle to the next process in the system. * @@ -2050,7 +2074,7 @@ typedef enum _PROCESS_STATE_CHANGE_TYPE ProcessStateChangeMax, } PROCESS_STATE_CHANGE_TYPE, *PPROCESS_STATE_CHANGE_TYPE; -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) /** * Creates a state change handle for changing the suspension state of a process. * @@ -2103,7 +2127,7 @@ typedef enum _THREAD_STATE_CHANGE_TYPE ThreadStateChangeMax, } THREAD_STATE_CHANGE_TYPE, *PTHREAD_STATE_CHANGE_TYPE; -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) /** * Creates a state change handle for changing the suspension state of a thread. * @@ -2245,6 +2269,7 @@ NtResumeThread( _Out_opt_ PULONG PreviousSuspendCount ); +#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003) /** * Retrieves the number of the current processor. * @@ -2256,8 +2281,9 @@ NTAPI NtGetCurrentProcessorNumber( VOID ); +#endif -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) /** * Retrieves the number of the current processor. * @@ -2381,7 +2407,7 @@ NtTestAlert( VOID ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // rev /** * Sends an alert to the specified thread. @@ -2397,7 +2423,7 @@ NtAlertThreadByThreadId( ); #endif -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) /** * Sends an alert to the specified thread by its thread ID, with an optional lock. * @@ -2433,7 +2459,7 @@ NtAlertMultipleThreadByThreadId( ); #endif -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // rev /** * Waits for an alert to be delivered to the specified thread. @@ -2579,7 +2605,7 @@ NtQueueApcThread( */ #define QUEUE_USER_APC_SPECIAL_USER_APC ((HANDLE)0x1) -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) /** * Queues an APC (Asynchronous Procedure Call) to a thread. * @@ -2621,7 +2647,7 @@ typedef struct _APC_CALLBACK_DATA_CONTEXT #define QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC 0x00000001 #define QUEUE_USER_APC_FLAGS_CALLBACK_DATA_CONTEXT 0x00010000 // APC_CALLBACK_DATA_CONTEXT -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) /** * Queues an Asynchronous Procedure Call (APC) to a specified thread. * @@ -3173,6 +3199,7 @@ typedef struct _PS_CREATE_INFO // end_private +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) /** * Creates a new process and primary thread. * @@ -3258,6 +3285,7 @@ NtCreateThreadEx( _In_ SIZE_T MaximumStackSize, _In_opt_ PPS_ATTRIBUTE_LIST AttributeList ); +#endif #endif @@ -3653,7 +3681,7 @@ NtCreateJobSet( _In_ ULONG Flags ); -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSCALLAPI NTSTATUS NTAPI @@ -3678,7 +3706,7 @@ typedef enum _MEMORY_RESERVE_TYPE MemoryReserveTypeMax } MEMORY_RESERVE_TYPE; -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) /** * Allocates a memory reserve object. * @@ -3751,7 +3779,7 @@ typedef enum _PSSNT_QUERY_INFORMATION_CLASS #define PSSNT_SIGNATURE_PSSD 'PSSD' // 0x50535344 -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) // rev /** * Captures a snapshot of the specified process. @@ -3862,7 +3890,7 @@ typedef struct _NTPSS_MEMORY_BULK_INFORMATION PVOID NextValidAddress; } NTPSS_MEMORY_BULK_INFORMATION, *PNTPSS_MEMORY_BULK_INFORMATION; -#if (PHNT_VERSION >= PHNT_20H1) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1) // rev /** * Captures virtual address space bulk information for a process. diff --git a/ntregapi.h b/ntregapi.h index 19fce74..261f841 100644 --- a/ntregapi.h +++ b/ntregapi.h @@ -609,7 +609,7 @@ NtCreateKey( _Out_opt_ PULONG Disposition ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) /** * Creates a new registry key or opens an existing one, and it associates the key with a transaction. * @@ -656,7 +656,7 @@ NtOpenKey( _In_ POBJECT_ATTRIBUTES ObjectAttributes ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) /** * Opens an existing registry key and associates the key with a transaction. * @@ -677,7 +677,7 @@ NtOpenKeyTransacted( ); #endif -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) /** * Opens an existing registry key with extended options. * @@ -990,6 +990,7 @@ NtLoadKey2( _In_ ULONG Flags ); +#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003) /** * Loads a registry key from a file with extended options. * @@ -1016,8 +1017,9 @@ NtLoadKeyEx( _Out_opt_ PHANDLE RootHandle, _Reserved_ PVOID Reserved // previously PIO_STATUS_BLOCK ); +#endif -#if (PHNT_VERSION >= PHNT_20H1) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1) // rev by tyranid /** * Loads a registry key from a file with extended parameters. @@ -1143,6 +1145,7 @@ NtUnloadKey( _In_ POBJECT_ATTRIBUTES TargetKey ); +#if PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003 /** * Unloads a registry key with additional flags. * @@ -1158,6 +1161,7 @@ NtUnloadKey2( _In_ POBJECT_ATTRIBUTES TargetKey, _In_ ULONG Flags ); +#endif /** * Unloads a registry key and optionally signals an event. @@ -1255,6 +1259,7 @@ NtQueryOpenSubKeys( _Out_ PULONG HandleCount ); +#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003) /** * Queries the open subkeys of a registry key with additional information. * @@ -1274,6 +1279,7 @@ NtQueryOpenSubKeysEx( _Out_writes_bytes_opt_(BufferLength) PVOID Buffer, _Out_ PULONG RequiredSize ); +#endif /** * Initializes the registry. @@ -1316,7 +1322,7 @@ NtLockProductActivationKeys( _Out_opt_ ULONG *pSafeMode ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) /** * Freezes the registry and prevents changes from being flushed to disk. * @@ -1331,7 +1337,7 @@ NtFreezeRegistry( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) /** * Thaws the registry and enables flushing changes to disk. * @@ -1345,7 +1351,7 @@ NtThawRegistry( ); #endif -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) /** * Creates a registry transaction. * @@ -1363,7 +1369,7 @@ NTSTATUS NtCreateRegistryTransaction( ); #endif -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) /** * Opens a registry transaction. * @@ -1379,7 +1385,7 @@ NTSTATUS NtOpenRegistryTransaction( ); #endif -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) /** * Commits a registry transaction. * @@ -1393,7 +1399,7 @@ NTSTATUS NtCommitRegistryTransaction( ); #endif -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) /** * Rolls back a registry transaction. * diff --git a/ntrtl.h b/ntrtl.h index e95dd9e..96eef3f 100644 --- a/ntrtl.h +++ b/ntrtl.h @@ -594,7 +594,7 @@ typedef struct _RTL_RB_TREE PRTL_BALANCED_NODE Min; } RTL_RB_TREE, *PRTL_RB_TREE; -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // rev NTSYSAPI @@ -615,9 +615,9 @@ RtlRbRemoveNode( _In_ PRTL_RB_TREE Tree, _In_ PRTL_BALANCED_NODE Node ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) // rev NTSYSAPI NTSTATUS @@ -646,9 +646,11 @@ RtlRemovePointerMapping( _In_ PRTL_RB_TREE Tree, _Inout_ PRTL_BALANCED_NODE Children ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_11 +// // Hash tables +// // begin_ntddk @@ -697,7 +699,7 @@ typedef struct _RTL_DYNAMIC_HASH_TABLE PVOID Directory; } RTL_DYNAMIC_HASH_TABLE, *PRTL_DYNAMIC_HASH_TABLE; -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) FORCEINLINE VOID @@ -906,9 +908,9 @@ RtlContractHashTable( _In_ PRTL_DYNAMIC_HASH_TABLE HashTable ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSAPI BOOLEAN @@ -935,7 +937,7 @@ RtlEndStrongEnumerationHashTable( _Inout_ PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10 // end_ntddk @@ -1063,7 +1065,7 @@ RtlSetCriticalSectionSpinCount( _In_ ULONG SpinCount ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI HANDLE @@ -1071,7 +1073,7 @@ NTAPI RtlQueryCriticalSectionOwner( _In_ HANDLE EventHandle ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA NTSYSAPI VOID @@ -1177,7 +1179,7 @@ RtlDumpResource( // Slim reader-writer locks, condition variables, and barriers -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // winbase:InitializeSRWLock NTSYSAPI @@ -1241,7 +1243,9 @@ RtlTryAcquireSRWLockShared( _Inout_ PRTL_SRWLOCK SRWLock ); -#if (PHNT_VERSION >= PHNT_WIN7) +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA + +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSAPI VOID @@ -1249,9 +1253,9 @@ NTAPI RtlAcquireReleaseSRWLockExclusive( _Inout_ PRTL_SRWLOCK SRWLock ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 -#if (PHNT_VERSION >= PHNT_WIN10) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev NTSYSAPI BOOLEAN @@ -1259,8 +1263,9 @@ NTAPI RtlConvertSRWLockExclusiveToShared( _Inout_ PRTL_SRWLOCK SRWLock ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10 +#if (PHNT_VERSION >= PHNT_WINDOWS_11) // // Read-Copy Update. // @@ -1307,9 +1312,9 @@ RtlRcuSynchronize( _Inout_ PRTL_SRWLOCK SRWLock ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_11 -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) #define RTL_CONDITION_VARIABLE_INIT {0} #define RTL_CONDITION_VARIABLE_LOCKMODE_SHARED 0x1 @@ -1359,7 +1364,7 @@ RtlWakeAllConditionVariable( _Inout_ PRTL_CONDITION_VARIABLE ConditionVariable ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA // begin_rev #define RTL_BARRIER_FLAGS_SPIN_ONLY 0x00000001 // never block on event - always spin @@ -1369,7 +1374,7 @@ RtlWakeAllConditionVariable( // begin_private -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSAPI NTSTATUS @@ -1403,15 +1408,17 @@ RtlBarrierForDelete( _In_ ULONG Flags ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA // end_private +// // Wait on address +// // begin_rev -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSAPI NTSTATUS @@ -1451,7 +1458,7 @@ RtlWakeAddressSingleNoFence( _In_ PVOID Address ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 // end_rev @@ -1492,9 +1499,9 @@ RtlInitString( _Out_ PSTRING DestinationString, _In_opt_z_ PCSTR SourceString ); -#endif +#endif // PHNT_NO_INLINE_INIT_STRING -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSAPI NTSTATUS NTAPI @@ -1502,7 +1509,7 @@ RtlInitStringEx( _Out_ PSTRING DestinationString, _In_opt_z_ PCSZ SourceString ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10 #ifndef PHNT_NO_INLINE_INIT_STRING FORCEINLINE VOID RtlInitAnsiString( @@ -1525,9 +1532,9 @@ RtlInitAnsiString( _Out_ PANSI_STRING DestinationString, _In_opt_z_ PCSTR SourceString ); -#endif +#endif // PHNT_NO_INLINE_INIT_STRING -#if (PHNT_VERSION >= PHNT_WS03) +#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003) NTSYSAPI NTSTATUS NTAPI @@ -1535,7 +1542,7 @@ RtlInitAnsiStringEx( _Out_ PANSI_STRING DestinationString, _In_opt_z_ PCSZ SourceString ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003 NTSYSAPI VOID @@ -1544,7 +1551,7 @@ RtlFreeAnsiString( _Inout_ _At_(AnsiString->Buffer, _Frees_ptr_opt_) PANSI_STRING AnsiString ); -#if (PHNT_VERSION >= PHNT_20H1) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1) NTSYSAPI VOID NTAPI @@ -1567,7 +1574,7 @@ NTAPI RtlFreeUTF8String( _Inout_ _At_(Utf8String->Buffer, _Frees_ptr_opt_) PUTF8_STRING Utf8String ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_20H1 NTSYSAPI VOID @@ -1689,7 +1696,7 @@ RtlInitUnicodeString( _Out_ PUNICODE_STRING DestinationString, _In_opt_z_ PCWSTR SourceString ); -#endif +#endif // PHNT_NO_INLINE_INIT_STRING #ifndef PHNT_NO_INLINE_INIT_STRING FORCEINLINE NTSTATUS RtlInitUnicodeStringEx( @@ -1724,7 +1731,7 @@ RtlInitUnicodeStringEx( _Out_ PUNICODE_STRING DestinationString, _In_opt_z_ PCWSTR SourceString ); -#endif +#endif // PHNT_NO_INLINE_INIT_STRING _Success_(return != 0) _Must_inspect_result_ @@ -1795,7 +1802,7 @@ RtlCompareUnicodeString( _In_ BOOLEAN CaseInSensitive ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) _Must_inspect_result_ NTSYSAPI LONG @@ -1807,7 +1814,7 @@ RtlCompareUnicodeStrings( _In_ SIZE_T String2Length, _In_ BOOLEAN CaseInSensitive ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA _Must_inspect_result_ NTSYSAPI @@ -1851,7 +1858,7 @@ RtlPrefixUnicodeString( _In_ BOOLEAN CaseInSensitive ); -#if (PHNT_MODE == PHNT_MODE_KERNEL && PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_MODE == PHNT_MODE_KERNEL && PHNT_VERSION >= PHNT_WINDOWS_10) _Must_inspect_result_ NTSYSAPI BOOLEAN @@ -1861,9 +1868,9 @@ RtlSuffixUnicodeString( _In_ PUNICODE_STRING String2, _In_ BOOLEAN CaseInSensitive ); -#endif +#endif // PHNT_MODE == PHNT_MODE_KERNEL && PHNT_VERSION >= PHNT_WINDOWS_10 -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) _Must_inspect_result_ NTSYSAPI PWCHAR @@ -1873,7 +1880,7 @@ RtlFindUnicodeSubstring( _In_ PUNICODE_STRING SearchString, _In_ BOOLEAN CaseInSensitive ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10 #define RTL_FIND_CHAR_IN_UNICODE_STRING_START_AT_END 0x00000001 #define RTL_FIND_CHAR_IN_UNICODE_STRING_COMPLEMENT_CHAR_SET 0x00000002 @@ -1973,7 +1980,7 @@ RtlUnicodeStringToAnsiSize( _In_ PUNICODE_STRING SourceString ); -#if (PHNT_VERSION >= PHNT_20H1) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1) NTSYSAPI NTSTATUS NTAPI @@ -1991,7 +1998,7 @@ RtlUTF8StringToUnicodeString( _In_ PUTF8_STRING SourceString, _In_ BOOLEAN AllocateDestinationString ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_20H1 NTSYSAPI WCHAR @@ -2159,7 +2166,7 @@ RtlConsoleMultiByteToUnicodeN( _Out_ PULONG pdwSpecialChar ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSAPI NTSTATUS NTAPI @@ -2170,9 +2177,9 @@ RtlUTF8ToUnicodeN( _In_reads_bytes_(UTF8StringByteCount) PCCH UTF8StringSource, _In_ ULONG UTF8StringByteCount ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSAPI NTSTATUS NTAPI @@ -2183,7 +2190,7 @@ RtlUnicodeToUTF8N( _In_reads_bytes_(UnicodeStringByteCount) PCWCH UnicodeStringSource, _In_ ULONG UnicodeStringByteCount ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 NTSYSAPI NTSTATUS @@ -2271,7 +2278,7 @@ typedef enum _RTL_NORM_FORM NormIdnaDisallowUnassigned = 0x10d } RTL_NORM_FORM; -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSAPI NTSTATUS NTAPI @@ -2282,9 +2289,9 @@ RtlNormalizeString( _Out_writes_to_(*DestinationStringLength, *DestinationStringLength) PWSTR DestinationString, _Inout_ PLONG DestinationStringLength ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSAPI NTSTATUS NTAPI @@ -2294,9 +2301,9 @@ RtlIsNormalizedString( _In_ LONG SourceStringLength, _Out_ PBOOLEAN Normalized ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // ntifs:FsRtlIsNameInExpression NTSYSAPI BOOLEAN @@ -2307,9 +2314,9 @@ RtlIsNameInExpression( _In_ BOOLEAN IgnoreCase, _In_opt_ PWCH UpcaseTable ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 -#if (PHNT_VERSION >= PHNT_REDSTONE4) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS4) // rev NTSYSAPI BOOLEAN @@ -2320,16 +2327,16 @@ RtlIsNameInUnUpcasedExpression( _In_ BOOLEAN IgnoreCase, _In_opt_ PWCH UpcaseTable ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS4 -#if (PHNT_VERSION >= PHNT_19H1) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_19H1) NTSYSAPI BOOLEAN NTAPI RtlDoesNameContainWildCards( _In_ PUNICODE_STRING Expression ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_19H1 NTSYSAPI BOOLEAN @@ -2364,7 +2371,7 @@ RtlStringFromGUID( _Out_ PUNICODE_STRING GuidString ); -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) // rev NTSYSAPI @@ -2376,7 +2383,7 @@ RtlStringFromGUIDEx( _In_ BOOLEAN AllocateGuidString ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8_1 NTSYSAPI NTSTATUS @@ -2386,7 +2393,7 @@ RtlGUIDFromString( _Out_ PGUID Guid ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSAPI LONG @@ -2429,9 +2436,11 @@ RtlIdnToNameprepUnicode( _Inout_ PLONG DestinationStringLength ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA +// // Prefix +// typedef struct _PREFIX_TABLE_ENTRY { @@ -2647,7 +2656,7 @@ RtlDecompressBuffer( _Out_ PULONG FinalUncompressedSize ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSAPI NTSTATUS NTAPI @@ -2662,7 +2671,7 @@ RtlDecompressBufferEx( ); #endif -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) NTSYSAPI NTSTATUS NTAPI @@ -2692,7 +2701,7 @@ RtlDecompressFragment( _In_ PVOID WorkSpace ); -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) NTSYSAPI NTSTATUS NTAPI @@ -2707,7 +2716,7 @@ RtlDecompressFragmentEx( _Out_ PULONG FinalUncompressedSize, _In_ PVOID WorkSpace ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8_1 NTSYSAPI NTSTATUS @@ -2759,7 +2768,7 @@ RtlCompressChunks( // Locale -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI @@ -2840,9 +2849,9 @@ RtlCleanUpTEBLangLists( VOID ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev from GetThreadPreferredUILanguages NTSYSAPI @@ -2922,9 +2931,11 @@ RtlGetLocaleFileMappingAddress( _Out_opt_ PULONG CurrentNLSVersion ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 +// // PEB +// NTSYSAPI PPEB @@ -2947,7 +2958,7 @@ RtlReleasePebLock( VOID ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI LOGICAL @@ -2955,9 +2966,9 @@ NTAPI RtlTryAcquirePebLock( VOID ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION < PHNT_VISTA) +#if (PHNT_VERSION < PHNT_WINDOWS_VISTA) NTSYSAPI NTSTATUS NTAPI @@ -2973,7 +2984,7 @@ RtlFreeToPeb( _In_ PVOID Block, _In_ ULONG Size ); -#endif +#endif // PHNT_VERSION < PHNT_WINDOWS_VISTA // // Processes @@ -3091,7 +3102,7 @@ RtlCreateProcessParameters( _In_opt_ PUNICODE_STRING RuntimeData ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -3109,9 +3120,9 @@ RtlCreateProcessParametersEx( _In_opt_ PUNICODE_STRING RuntimeData, _In_ ULONG Flags // pass RTL_USER_PROC_PARAMS_NORMALIZED to keep parameters normalized ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION >= PHNT_WIN10_RS4) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS4) // private NTSYSAPI NTSTATUS @@ -3130,7 +3141,7 @@ RtlCreateProcessParametersWithTemplate( _In_opt_ PUNICODE_STRING RedirectionDllName, _In_ ULONG Flags // pass RTL_USER_PROC_PARAMS_NORMALIZED to keep parameters normalized ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS4 NTSYSAPI NTSTATUS @@ -3194,7 +3205,7 @@ typedef struct _RTL_USER_PROCESS_EXTENDED_PARAMETERS HANDLE JobHandle; } RTL_USER_PROCESS_EXTENDED_PARAMETERS, *PRTL_USER_PROCESS_EXTENDED_PARAMETERS; -#if (PHNT_VERSION >= PHNT_REDSTONE2) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS2) NTSYSAPI NTSTATUS NTAPI @@ -3205,9 +3216,9 @@ RtlCreateUserProcessEx( _In_opt_ PRTL_USER_PROCESS_EXTENDED_PARAMETERS ProcessExtendedParameters, _Out_ PRTL_USER_PROCESS_INFORMATION ProcessInformation ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS2 -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) _Analysis_noreturn_ DECLSPEC_NORETURN NTSYSAPI @@ -3216,9 +3227,9 @@ NTAPI RtlExitUserProcess( _In_ NTSTATUS ExitStatus ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // begin_rev #define RTL_CLONE_PROCESS_FLAGS_CREATE_SUSPENDED 0x00000001 @@ -3271,6 +3282,8 @@ RtlUpdateClonedSRWLock( _In_ LOGICAL Shared // TRUE to set to shared acquire ); +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA + // rev #define RTL_PROCESS_REFLECTION_FLAGS_INHERIT_HANDLES 0x2 #define RTL_PROCESS_REFLECTION_FLAGS_NO_SUSPEND 0x4 @@ -3287,7 +3300,7 @@ typedef struct _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION typedef RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION PROCESS_REFLECTION_INFORMATION, *PPROCESS_REFLECTION_INFORMATION; -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSAPI NTSTATUS @@ -3300,9 +3313,7 @@ RtlCreateProcessReflection( _In_opt_ HANDLE EventHandle, _Out_opt_ PRTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION ReflectionInformation ); -#endif - -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 NTSYSAPI NTSTATUS @@ -3347,7 +3358,7 @@ RtlTestProtectedAccess( _In_ PS_PROTECTION Target ); -#if (PHNT_VERSION >= PHNT_REDSTONE3) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3) // rev NTSYSAPI BOOLEAN @@ -3363,7 +3374,7 @@ NTAPI RtlIsCurrentThread( // NtCompareObjects(NtCurrentThread(), ThreadHandle) _In_ HANDLE ThreadHandle ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS3 // Threads @@ -3387,7 +3398,7 @@ RtlCreateUserThread( _Out_opt_ PCLIENT_ID ClientId ); -#if (PHNT_VERSION >= PHNT_WINXP) +#if (PHNT_VERSION >= PHNT_WINDOWS_XP) _Analysis_noreturn_ DECLSPEC_NORETURN NTSYSAPI @@ -3396,9 +3407,9 @@ NTAPI RtlExitUserThread( _In_ NTSTATUS ExitStatus ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_XP -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // rev NTSYSAPI BOOLEAN @@ -3406,9 +3417,9 @@ NTAPI RtlIsCurrentThreadAttachExempt( VOID ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -3429,9 +3440,11 @@ NTAPI RtlFreeUserStack( _In_ PVOID AllocationBase ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA +// // Extended thread context +// typedef struct _CONTEXT_CHUNK { @@ -3507,7 +3520,7 @@ RtlInitializeContext( _In_opt_ PVOID InitialPc, _In_opt_ PVOID InitialSp ); -#endif +#endif // _M_AMD64 NTSYSAPI NTSTATUS @@ -3622,8 +3635,8 @@ RtlWow64GetThreadContext( _In_ HANDLE ThreadHandle, _Inout_ PWOW64_CONTEXT ThreadContext ); -#endif -#endif +#endif // PHNT_INLINE_TYPEDEFS +#endif // _WIN64 #ifdef _WIN64 #ifdef PHNT_INLINE_TYPEDEFS @@ -3651,8 +3664,8 @@ RtlWow64SetThreadContext( _In_ HANDLE ThreadHandle, _In_ PWOW64_CONTEXT ThreadContext ); -#endif -#endif +#endif // PHNT_INLINE_TYPEDEFS +#endif // _WIN64 NTSYSAPI NTSTATUS @@ -3806,7 +3819,7 @@ RtlGetFunctionTableListHead( VOID ); -#endif +#endif // _WIN64 // // Linked lists @@ -3819,7 +3832,6 @@ RtlInitializeSListHead( _Out_ PSLIST_HEADER ListHead ); -_Must_inspect_result_ NTSYSAPI PSLIST_ENTRY NTAPI @@ -4066,9 +4078,11 @@ RtlQueryInformationActiveActivationContext( _In_ SIZE_T ActivationContextInformationLength, _Out_opt_ PSIZE_T ReturnLength ); -#endif +#endif // PHNT_INLINE_TYPEDEFS +// // Images +// NTSYSAPI PIMAGE_NT_HEADERS @@ -4136,7 +4150,7 @@ RtlImageRvaToVa( _Out_opt_ PIMAGE_SECTION_HEADER *LastRvaSection ); -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // rev NTSYSAPI @@ -4157,9 +4171,9 @@ RtlGuardCheckLongJumpTarget( _Out_ PBOOL IsLongJumpTarget ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS1 -#if (PHNT_VERSION >= PHNT_WIN11_22H2) +#if (PHNT_VERSION >= PHNT_WINDOWS_11_22H2) NTSYSAPI VOID NTAPI @@ -4167,7 +4181,7 @@ RtlValidateUserCallTarget( _In_ PVOID Address, _Out_ PULONG Flags ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_11_22H2 // // Memory @@ -4250,7 +4264,7 @@ RtlFillMemoryUlong( _In_ SIZE_T Length, _In_ ULONG Pattern ); -#endif +#endif // _M_AMD64 #if defined(_M_AMD64) @@ -4266,9 +4280,9 @@ RtlFillMemoryUlonglong( _In_ SIZE_T Length, _In_ ULONGLONG Pattern ); -#endif +#endif // _M_AMD64 -#if (PHNT_VERSION >= PHNT_19H2) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_19H2) NTSYSAPI BOOLEAN NTAPI @@ -4276,7 +4290,7 @@ RtlIsZeroMemory( _In_ PVOID Buffer, _In_ SIZE_T Length ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_19H2 NTSYSAPI ULONG @@ -4317,6 +4331,10 @@ RtlCrc64( #define GlobalDataIdQpcData 17 #define GlobalDataIdQpcBias 18 +#if !defined(NTDDI_WIN10_FE) || (NTDDI_VERSION < NTDDI_WIN10_FE) +typedef ULONG RTL_SYSTEM_GLOBAL_DATA_ID; +#endif + NTSYSAPI ULONG NTAPI @@ -4353,7 +4371,7 @@ RtlCreateEnvironment( #define RTL_CREATE_ENVIRONMENT_EMPTY 0x4 // create empty environment block // end_rev -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -4363,7 +4381,7 @@ RtlCreateEnvironmentEx( _Out_ PVOID *Environment, _In_ ULONG Flags ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA NTSYSAPI NTSTATUS @@ -4380,7 +4398,7 @@ RtlSetCurrentEnvironment( _Out_opt_ PVOID *PreviousEnvironment ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -4392,7 +4410,7 @@ RtlSetEnvironmentVar( _In_reads_(ValueLength) PCWSTR Value, _In_opt_ SIZE_T ValueLength ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA NTSYSAPI NTSTATUS @@ -4403,7 +4421,7 @@ RtlSetEnvironmentVariable( _In_opt_ PUNICODE_STRING Value ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -4416,7 +4434,7 @@ RtlQueryEnvironmentVariable( _In_opt_ SIZE_T ValueLength, _Out_ PSIZE_T ReturnLength ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA NTSYSAPI NTSTATUS @@ -4427,7 +4445,7 @@ RtlQueryEnvironmentVariable_U( _Inout_ PUNICODE_STRING Value ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -4440,7 +4458,7 @@ RtlExpandEnvironmentStrings( _In_ SIZE_T DestinationLength, _Out_opt_ PSIZE_T ReturnLength ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA NTSYSAPI NTSTATUS @@ -4460,7 +4478,9 @@ RtlSetEnvironmentStrings( _In_ SIZE_T NewEnvironmentSize ); +// // Directory and path support +// typedef struct _RTLP_CURDIR_REF { @@ -4478,13 +4498,13 @@ typedef struct _RTL_RELATIVE_NAME_U typedef enum _RTL_PATH_TYPE { RtlPathTypeUnknown, - RtlPathTypeUncAbsolute, - RtlPathTypeDriveAbsolute, - RtlPathTypeDriveRelative, - RtlPathTypeRooted, - RtlPathTypeRelative, - RtlPathTypeLocalDevice, - RtlPathTypeRootLocalDevice + RtlPathTypeUncAbsolute, // "\\\\server\\share\\folder\\file.txt + RtlPathTypeDriveAbsolute, // "C:\\folder\\file.txt" + RtlPathTypeDriveRelative, // "C:folder\\file.txt" + RtlPathTypeRooted, // "\\folder\\file.txt" + RtlPathTypeRelative, // "folder\\file.txt" + RtlPathTypeLocalDevice, // "\\\\.\\PhysicalDrive0" + RtlPathTypeRootLocalDevice // "\\\\?\\C:\\folder\\file.txt" } RTL_PATH_TYPE; // Data exports (ntdll.lib/ntdllp.lib) @@ -4509,9 +4529,11 @@ NTSYSAPI UNICODE_STRING RtlNtPathSeperatorString; #define RtlWin32NtUncRoot ((UNICODE_STRING)RTL_CONSTANT_STRING(L"\\\\?\\UNC")) #define RtlWin32NtUncRootSlash ((UNICODE_STRING)RTL_CONSTANT_STRING(L"\\\\?\\UNC\\")) #define RtlDefaultExtension ((UNICODE_STRING)RTL_CONSTANT_STRING(L".DLL")) -#endif +#endif // PHNT_INLINE_SEPERATOR_STRINGS +// // Path functions +// NTSYSAPI RTL_PATH_TYPE @@ -4537,7 +4559,7 @@ RtlGetFullPathName_U( _Out_opt_ PWSTR *FilePart ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSAPI NTSTATUS @@ -4549,9 +4571,9 @@ RtlGetFullPathName_UEx( _Out_opt_ PWSTR *FilePart, _Out_opt_ ULONG *BytesRequired ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 -#if (PHNT_VERSION >= PHNT_WS03) +#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003) NTSYSAPI NTSTATUS NTAPI @@ -4565,7 +4587,7 @@ RtlGetFullPathName_UstrEx( _Out_ RTL_PATH_TYPE *InputPathType, _Out_opt_ SIZE_T *BytesRequired ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003 NTSYSAPI ULONG @@ -4651,7 +4673,7 @@ RtlDosPathNameToNtPathName_U( _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName ); -#if (PHNT_VERSION >= PHNT_WS03) +#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003) NTSYSAPI NTSTATUS NTAPI @@ -4663,7 +4685,7 @@ RtlDosPathNameToNtPathName_U_WithStatus( ); #endif -#if (PHNT_VERSION >= PHNT_REDSTONE3) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3) // rev NTSYSAPI NTSTATUS @@ -4676,7 +4698,7 @@ RtlDosLongPathNameToNtPathName_U_WithStatus( ); #endif -#if (PHNT_VERSION >= PHNT_WS03) +#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003) NTSYSAPI BOOLEAN NTAPI @@ -4688,7 +4710,7 @@ RtlDosPathNameToRelativeNtPathName_U( ); #endif -#if (PHNT_VERSION >= PHNT_WS03) +#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003) NTSYSAPI NTSTATUS NTAPI @@ -4700,7 +4722,7 @@ RtlDosPathNameToRelativeNtPathName_U_WithStatus( ); #endif -#if (PHNT_VERSION >= PHNT_REDSTONE3) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3) // rev NTSYSAPI NTSTATUS @@ -4713,7 +4735,7 @@ RtlDosLongPathNameToRelativeNtPathName_U_WithStatus( ); #endif -#if (PHNT_VERSION >= PHNT_WS03) +#if (PHNT_VERSION >= PHNT_WINDOWS_SERVER_2003) NTSYSAPI VOID NTAPI @@ -4816,7 +4838,7 @@ RtlGenerate8dot3Name( _Inout_ PUNICODE_STRING Name8dot3 ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // private NTSYSAPI @@ -4861,9 +4883,9 @@ RtlReleasePath( _In_ PCWSTR Path ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // rev NTSYSAPI ULONG @@ -4874,9 +4896,9 @@ RtlReplaceSystemDirectoryInPath( _In_ USHORT TargetMachine, // IMAGE_FILE_MACHINE_TARGET_HOST _In_ BOOLEAN IncludePathSeperator ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS1 -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // rev from Wow64DetermineEnvironment NTSYSAPI USHORT @@ -4893,9 +4915,9 @@ RtlWow64IsWowGuestMachineSupported( _In_ USHORT NativeMachine, _Out_ PBOOLEAN IsWowGuestMachineSupported ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS1 -#if (PHNT_VERSION >= PHNT_WIN10_21H2) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_21H2) // rev NTSYSAPI NTSTATUS @@ -4905,9 +4927,9 @@ RtlWow64GetProcessMachines( _Out_ PUSHORT ProcessMachine, _Out_opt_ PUSHORT NativeMachine ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_21H2 -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) // rev #define IMAGE_FILE_NATIVE_MACHINE_I386 0x1 #define IMAGE_FILE_NATIVE_MACHINE_AMD64 0x2 @@ -4922,9 +4944,9 @@ RtlGetImageFileMachines( _In_ PCWSTR FileName, _Out_ PUSHORT FileMachines ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_11 -#if (PHNT_VERSION >= PHNT_REDSTONE2) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS2) #ifdef PHNT_INLINE_TYPEDEFS // rev @@ -4948,7 +4970,7 @@ NTAPI RtlGetNtSystemRoot( VOID ); -#endif +#endif // PHNT_INLINE_TYPEDEFS #ifdef PHNT_INLINE_TYPEDEFS // rev @@ -4969,9 +4991,9 @@ NTAPI RtlAreLongPathsEnabled( VOID ); -#endif +#endif // PHNT_INLINE_TYPEDEFS -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS2 NTSYSAPI BOOLEAN @@ -5255,7 +5277,9 @@ typedef struct _RTL_HEAP_PARAMETERS * @return RtlCreateHeap returns a handle to be used in accessing the created heap. * \remarks https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-rtlcreateheap */ +_Success_(return != 0) _Must_inspect_result_ +_Ret_maybenull_ NTSYSAPI PVOID NTAPI @@ -5278,6 +5302,7 @@ RtlCreateHeap( * @return If the call to RtlDestroyHeap succeeds, the return value is a NULL pointer. If the call to RtlDestroyHeap fails, the return value is a handle for the heap. * \remarks https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-rtldestroyheap */ +_Success_(return == 0) NTSYSAPI PVOID NTAPI @@ -5311,7 +5336,7 @@ RtlAllocateHeap( _In_ SIZE_T Size ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) _Success_(return != 0) NTSYSAPI LOGICAL @@ -5331,7 +5356,7 @@ RtlFreeHeap( _In_opt_ ULONG Flags, _Frees_ptr_opt_ PVOID BaseAddress ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 NTSYSAPI SIZE_T @@ -5871,14 +5896,14 @@ RtlMultipleFreeHeap( _In_ PVOID *Array ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSAPI VOID NTAPI RtlDetectHeapLeaks( VOID ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 NTSYSAPI VOID @@ -5907,7 +5932,7 @@ typedef struct _RTL_MEMORY_ZONE PRTL_MEMORY_ZONE_SEGMENT FirstSegment; } RTL_MEMORY_ZONE, *PRTL_MEMORY_ZONE; -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSAPI NTSTATUS @@ -5955,11 +5980,13 @@ RtlUnlockMemoryZone( _In_ PVOID MemoryZone ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA +// // Memory block lookaside lists +// -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSAPI NTSTATUS @@ -6025,13 +6052,15 @@ RtlUnlockMemoryBlockLookaside( _In_ PVOID MemoryBlockLookaside ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA // end_private +// // Transactions +// -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI HANDLE @@ -6042,7 +6071,7 @@ RtlGetCurrentTransaction( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI LOGICAL @@ -6052,7 +6081,9 @@ RtlSetCurrentTransaction( ); #endif +// // LUIDs +// FORCEINLINE BOOLEAN RtlIsEqualLuid( // RtlEqualLuid _In_ PLUID L1, @@ -6175,7 +6206,7 @@ FASTCALL RtlUlonglongByteSwap( _In_ ULONGLONG Source ); -#endif +#endif // PHNT_RTL_BYTESWAP DECLSPEC_DEPRECATED NTSYSAPI @@ -6273,7 +6304,7 @@ RtlDestroyQueryDebugBuffer( _In_ PRTL_DEBUG_INFORMATION Buffer ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI @@ -6294,7 +6325,7 @@ RtlDeCommitDebugInfo( _In_ SIZE_T Size ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA #define RTL_QUERY_PROCESS_MODULES 0x00000001 #define RTL_QUERY_PROCESS_BACKTRACES 0x00000002 @@ -6520,7 +6551,7 @@ RtlSetThreadErrorMode( // Windows Error Reporting -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -6530,9 +6561,9 @@ RtlReportException( _In_ PCONTEXT ContextRecord, _In_ ULONG Flags ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // rev NTSYSAPI NTSTATUS @@ -6543,9 +6574,9 @@ RtlReportExceptionEx( _In_ ULONG Flags, _In_ PLARGE_INTEGER Timeout ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS1 -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -6556,9 +6587,9 @@ RtlWerpReportException( _In_ ULONG Flags, _Out_ PHANDLE CrashVerticalProcessHandle ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSAPI NTSTATUS @@ -6567,7 +6598,7 @@ RtlReportSilentProcessExit( _In_ HANDLE ProcessHandle, _In_ NTSTATUS ExitStatus ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 // // Random @@ -6690,6 +6721,49 @@ RtlUnicodeStringToInteger( // IPv4/6 conversion // +#ifndef s_addr +// +// IPv4 Internet address +// This is an 'on-wire' format structure. +// +typedef struct in_addr +{ + union + { + struct { UCHAR s_b1, s_b2, s_b3, s_b4; } S_un_b; + struct { USHORT s_w1, s_w2; } S_un_w; + ULONG S_addr; + } S_un; +#define s_addr S_un.S_addr /* can be used for most tcp & ip code */ +#define s_host S_un.S_un_b.s_b2 // host on imp +#define s_net S_un.S_un_b.s_b1 // network +#define s_imp S_un.S_un_w.s_w2 // imp +#define s_impno S_un.S_un_b.s_b4 // imp # +#define s_lh S_un.S_un_b.s_b3 // logical host +} IN_ADDR, * PIN_ADDR, FAR* LPIN_ADDR; +#endif + +#ifndef s6_addr +// +// IPv6 Internet address (RFC 2553) +// This is an 'on-wire' format structure. +// +typedef struct in6_addr +{ + union + { + UCHAR Byte[16]; + USHORT Word[8]; + } u; +#define in_addr6 in6_addr +#define _S6_un u +#define _S6_u8 Byte +#define s6_addr _S6_un._S6_u8 +#define s6_bytes u.Byte +#define s6_words u.Word +} IN6_ADDR, *PIN6_ADDR, FAR *LPIN6_ADDR; +#endif + typedef struct in_addr IN_ADDR, *PIN_ADDR; typedef struct in6_addr IN6_ADDR, *PIN6_ADDR; typedef IN_ADDR const *PCIN_ADDR; @@ -6879,16 +6953,16 @@ RtlSecondsSince1970ToTime( _Out_ PLARGE_INTEGER Time ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSAPI ULONGLONG NTAPI RtlGetSystemTimePrecise( VOID ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 -#if (PHNT_VERSION >= PHNT_WIN10_21H2) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_21H2) NTSYSAPI KSYSTEM_TIME NTAPI @@ -6897,25 +6971,25 @@ RtlGetSystemTimeAndBias( _Out_opt_ PLARGE_INTEGER TimeZoneBiasEffectiveStart, _Out_opt_ PLARGE_INTEGER TimeZoneBiasEffectiveEnd ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_21H2 -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSAPI ULONGLONG NTAPI RtlGetInterruptTimePrecise( _Out_ PLARGE_INTEGER PerformanceCounter ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10 -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSAPI BOOLEAN NTAPI RtlQueryUnbiasedInterruptTime( _Out_ PLARGE_INTEGER InterruptTime ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 FORCEINLINE ULONGLONG @@ -7010,7 +7084,7 @@ RtlInitializeBitMap( _In_ ULONG SizeOfBitMap ); -#if (PHNT_MODE == PHNT_MODE_KERNEL || PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_MODE == PHNT_MODE_KERNEL || PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSAPI VOID NTAPI @@ -7020,7 +7094,7 @@ RtlClearBit( ); #endif -#if (PHNT_MODE == PHNT_MODE_KERNEL || PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_MODE == PHNT_MODE_KERNEL || PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSAPI VOID NTAPI @@ -7226,7 +7300,7 @@ RtlFindLastBackwardRunClear( _Out_ PULONG StartingRunIndex ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSAPI ULONG @@ -7235,9 +7309,9 @@ RtlNumberOfSetBitsUlongPtr( _In_ ULONG_PTR Target ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSAPI @@ -7259,9 +7333,9 @@ RtlInterlockedSetBitRun( _In_range_(0, BitMapHeader->SizeOfBitMap - StartingIndex) ULONG NumberToSet ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSAPI VOID @@ -7300,9 +7374,9 @@ RtlNumberOfSetBitsInRange( _In_ ULONG Length ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // private typedef struct _RTL_BITMAP_EX @@ -7376,7 +7450,7 @@ RtlFindSetBitsAndClearEx( _In_ ULONG64 HintIndex ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10 // // Handle tables @@ -7532,7 +7606,7 @@ RtlQueryAtomInAtomTable( _Inout_opt_ PULONG AtomNameLength ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // rev NTSYSAPI BOOLEAN @@ -7541,7 +7615,7 @@ RtlGetIntegerAtom( _In_ PCWSTR AtomName, _Out_opt_ PUSHORT IntegerAtom ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA // // SIDs @@ -7605,7 +7679,7 @@ RtlAllocateAndInitializeSid( _Outptr_ PSID *Sid ); -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) _Must_inspect_result_ NTSYSAPI NTSTATUS @@ -7616,7 +7690,7 @@ RtlAllocateAndInitializeSidEx( _In_reads_(SubAuthorityCount) PULONG SubAuthorities, _Outptr_ PSID *Sid ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8_1 NTSYSAPI NTSTATUS @@ -7627,7 +7701,7 @@ RtlInitializeSid( _In_ UCHAR SubAuthorityCount ); -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSAPI NTSTATUS NTAPI @@ -7637,7 +7711,7 @@ RtlInitializeSidEx( _In_ UCHAR SubAuthorityCount, ... ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10 NTSYSAPI PSID_IDENTIFIER_AUTHORITY @@ -7691,7 +7765,7 @@ RtlCopySidAndAttributesArray( _Out_ PULONG RemainingSidAreaSize ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSAPI NTSTATUS @@ -7702,9 +7776,9 @@ RtlCreateServiceSid( _Inout_ PULONG ServiceSidLength ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI @@ -7716,9 +7790,9 @@ RtlSidDominates( _Out_ PBOOLEAN Dominates ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) // rev NTSYSAPI @@ -7730,9 +7804,9 @@ RtlSidDominatesForTrust( _Out_ PBOOLEAN DominatesTrust // TokenProcessTrustLevel ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8_1 -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -7752,9 +7826,9 @@ RtlSidIsHigherLevel( _In_ PSID Sid2, _Out_ PBOOLEAN HigherLevel ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSAPI NTSTATUS NTAPI @@ -7766,7 +7840,7 @@ RtlCreateVirtualAccountSid( ); #endif -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSAPI NTSTATUS NTAPI @@ -7797,7 +7871,7 @@ RtlConvertSidToUnicodeString( _In_ BOOLEAN AllocateDestinationString ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -7809,7 +7883,7 @@ RtlSidHashInitialize( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI PSID_AND_ATTRIBUTES @@ -7820,7 +7894,7 @@ RtlSidHashLookup( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // rev NTSYSAPI BOOLEAN @@ -7830,7 +7904,7 @@ RtlIsElevatedRid( ); #endif -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev NTSYSAPI NTSTATUS @@ -8111,7 +8185,7 @@ RtlSelfRelativeToAbsoluteSD2( _Inout_ PULONG BufferSize ); -#if (PHNT_VERSION >= PHNT_19H2) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_19H2) __drv_maxIRQL(APC_LEVEL) NTSYSAPI BOOLEAN @@ -8205,7 +8279,7 @@ RtlAreAnyAccessesGranted( _In_ ACCESS_MASK GrantedAccess, _In_ ACCESS_MASK DesiredAccess ); -#endif +#endif // PHNT_NO_INLINE_ACCESSES_GRANTED NTSYSAPI VOID @@ -8283,7 +8357,7 @@ RtlGetAce( _Outptr_ PVOID *Ace ); -#if (PHNT_VERSION >= PHNT_WIN11_24H2) +#if (PHNT_VERSION >= PHNT_WINDOWS_11_24H2) NTSYSAPI NTSTATUS NTAPI @@ -8301,7 +8375,7 @@ RtlFirstFreeAce( _Out_ PVOID *FirstFree ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI PVOID @@ -8313,7 +8387,7 @@ RtlFindAceByType( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI BOOLEAN @@ -8457,7 +8531,7 @@ RtlAddCompoundAce( _In_ PSID ClientSid ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -8472,7 +8546,7 @@ RtlAddMandatoryAce( ); #endif -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSAPI NTSTATUS NTAPI @@ -8509,7 +8583,7 @@ RtlAddProcessTrustLabelAce( _In_ UCHAR AceType, // SYSTEM_PROCESS_TRUST_LABEL_ACE_TYPE _In_ ACCESS_MASK AccessMask ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 // // Named pipes @@ -8703,7 +8777,7 @@ RtlImpersonateSelf( _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -8745,7 +8819,7 @@ RtlReleasePrivilege( _In_ PVOID StatePointer ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI NTSTATUS @@ -8757,7 +8831,7 @@ RtlRemovePrivileges( ); #endif -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // rev NTSYSAPI @@ -8776,11 +8850,13 @@ RtlQueryValidationRunlevel( _In_opt_ PUNICODE_STRING ComponentName ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 +// // Private namespaces +// -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // rev #define BOUNDARY_DESCRIPTOR_ADD_APPCONTAINER_SID 0x0001 @@ -8812,7 +8888,9 @@ RtlAddSIDToBoundaryDescriptor( _In_ PSID RequiredSid ); -#if (PHNT_VERSION >= PHNT_WIN7) +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA + +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSAPI NTSTATUS @@ -8821,12 +8899,10 @@ RtlAddIntegrityLabelToBoundaryDescriptor( _Inout_ POBJECT_BOUNDARY_DESCRIPTOR *BoundaryDescriptor, _In_ PSID IntegrityLabel ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 // end_private -#endif - // // Version // @@ -8877,7 +8953,7 @@ RtlGetNtProductType( _Out_ PNT_PRODUCT_TYPE NtProductType ); -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // private NTSYSAPI ULONG @@ -8980,7 +9056,7 @@ LdrInitializeThunk( // Thread execution // -NTSYSCALLAPI +NTSYSAPI NTSTATUS NTAPI RtlDelayExecution( @@ -9147,7 +9223,7 @@ RtlQueryRegistryValues( _In_opt_ PVOID Environment ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSAPI NTSTATUS NTAPI @@ -9160,7 +9236,7 @@ RtlQueryRegistryValuesEx( ); #endif -#if (PHNT_VERSION >= PHNT_REDSTONE4) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS4) NTSYSAPI NTSTATUS NTAPI @@ -9200,7 +9276,7 @@ RtlDeleteRegistryValue( // Thread profiling // -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSAPI @@ -9240,7 +9316,7 @@ RtlReadThreadProfilingData( _Out_ PPERFORMANCE_DATA PerformanceData ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 // // WOW64 @@ -9334,7 +9410,7 @@ RtlDecodeSystemPointer( _In_ PVOID Ptr ); -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev NTSYSAPI NTSTATUS @@ -9354,9 +9430,9 @@ RtlDecodeRemotePointer( _In_ PVOID Pointer, _Out_ PVOID *DecodedPointer ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10 -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev NTSYSAPI @@ -9376,7 +9452,7 @@ RtlGetCurrentProcessorNumber( VOID ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSAPI @@ -9436,7 +9512,7 @@ RtlGetCallersAddress( // Use the intrinsic _ReturnAddress instead. _Out_ PVOID *CallersCaller ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) NTSYSAPI ULONG64 @@ -9447,7 +9523,7 @@ RtlGetEnabledExtendedFeatures( #endif -#if (PHNT_VERSION >= PHNT_REDSTONE4) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS4) // msdn NTSYSAPI @@ -9490,7 +9566,7 @@ typedef union _RTL_ELEVATION_FLAGS }; } RTL_ELEVATION_FLAGS, *PRTL_ELEVATION_FLAGS; -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI @@ -9502,7 +9578,7 @@ RtlQueryElevationFlags( #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI @@ -9514,7 +9590,7 @@ RtlRegisterThreadWithCsrss( #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI @@ -9526,7 +9602,7 @@ RtlLockCurrentThread( #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI @@ -9538,7 +9614,7 @@ RtlUnlockCurrentThread( #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI @@ -9550,7 +9626,7 @@ RtlLockModuleSection( #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSAPI @@ -9596,7 +9672,7 @@ RtlGetUnloadEventTrace( VOID ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSAPI PRTL_UNLOAD_EVENT_TRACE NTAPI @@ -9626,7 +9702,7 @@ RtlCaptureContext( _Out_ PCONTEXT ContextRecord ); -#if (PHNT_VERSION >= PHNT_WIN10_20H1) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1) NTSYSAPI VOID NTAPI @@ -9635,7 +9711,7 @@ RtlCaptureContext2( ); #endif -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) NTSYSAPI VOID __cdecl @@ -9685,7 +9761,7 @@ RtlInstallFunctionTableCallback( _In_opt_ PCWSTR OutOfProcessCallbackDll ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSAPI DWORD NTAPI @@ -9712,8 +9788,8 @@ NTAPI RtlDeleteGrowableFunctionTable( _In_ PVOID DynamicTable ); -#endif -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 +#endif // _M_AMD64 && _M_ARM64EC #if defined(_M_ARM64EC) NTSYSAPI @@ -9722,7 +9798,7 @@ NTAPI RtlIsEcCode( _In_ ULONG64 CodePointer ); -#endif +#endif // _M_ARM64EC NTSYSAPI PVOID @@ -9734,7 +9810,7 @@ RtlPcToFileHeader( // end_msdn -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSAPI LOGICAL @@ -9750,9 +9826,11 @@ NTAPI RtlQueryPerformanceFrequency( _Out_ PLARGE_INTEGER PerformanceFrequency ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_7 +// // Image Mitigation +// // rev typedef enum _IMAGE_MITIGATION_POLICY @@ -9933,7 +10011,7 @@ typedef enum _RTL_IMAGE_MITIGATION_OPTION_STATE #define RTL_IMAGE_MITIGATION_FLAG_OSDEFAULT 0x4 #define RTL_IMAGE_MITIGATION_FLAG_AUDIT 0x8 -#if (PHNT_VERSION >= PHNT_REDSTONE3) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3) // rev NTSYSAPI @@ -10014,7 +10092,7 @@ RtlGetActiveConsoleId( #endif #ifdef PHNT_INLINE_TYPEDEFS -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // private FORCEINLINE LONGLONG @@ -10030,7 +10108,7 @@ RtlGetConsoleSessionForegroundProcessId( } #endif #else -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // private NTSYSAPI LONGLONG @@ -10045,7 +10123,7 @@ RtlGetConsoleSessionForegroundProcessId( // Appcontainer // -#if (PHNT_VERSION >= PHNT_REDSTONE2) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS2) // rev NTSYSAPI NTSTATUS @@ -10057,7 +10135,7 @@ RtlGetTokenNamedObjectPath( ); #endif -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // rev NTSYSAPI NTSTATUS @@ -10070,7 +10148,7 @@ RtlGetAppContainerNamedObjectPath( ); #endif -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) // rev NTSYSAPI NTSTATUS @@ -10081,7 +10159,7 @@ RtlGetAppContainerParent( ); #endif -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev NTSYSAPI NTSTATUS @@ -10092,7 +10170,7 @@ RtlCheckSandboxedToken( ); #endif -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // rev NTSYSAPI NTSTATUS @@ -10104,7 +10182,7 @@ RtlCheckTokenCapability( ); #endif -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev NTSYSAPI NTSTATUS @@ -10116,7 +10194,7 @@ RtlCapabilityCheck( ); #endif -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // rev NTSYSAPI NTSTATUS @@ -10142,9 +10220,9 @@ RtlCheckTokenMembershipEx( _In_ ULONG Flags, // CTMF_VALID_FLAGS _Out_ PBOOLEAN IsMember ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 -#if (PHNT_VERSION >= PHNT_REDSTONE4) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS4) // rev NTSYSAPI NTSTATUS @@ -10155,7 +10233,7 @@ RtlQueryTokenHostIdAsUlong64( ); #endif -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) // rev NTSYSAPI BOOLEAN @@ -10166,7 +10244,7 @@ RtlIsParentOfChildAppContainer( ); #endif -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) // rev NTSYSAPI NTSTATUS @@ -10176,7 +10254,7 @@ RtlIsApiSetImplemented( ); #endif -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // rev NTSYSAPI BOOLEAN @@ -10194,7 +10272,7 @@ RtlIsPackageSid( ); #endif -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) // rev NTSYSAPI BOOLEAN @@ -10213,7 +10291,7 @@ typedef enum _APPCONTAINER_SID_TYPE MaxAppContainerSidType } APPCONTAINER_SID_TYPE, *PAPPCONTAINER_SID_TYPE; -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) // rev NTSYSAPI NTSTATUS @@ -10249,7 +10327,7 @@ RtlFlsFree( _In_ ULONG FlsIndex ); -#if (PHNT_VERSION >= PHNT_20H1) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1) NTSYSAPI NTSTATUS NTAPI @@ -10282,7 +10360,7 @@ RtlProcessFlsData( ); #endif -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) // rev NTSYSAPI NTSTATUS @@ -10320,7 +10398,7 @@ typedef enum _STATE_LOCATION_TYPE LocationTypeMaximum } STATE_LOCATION_TYPE; -#if (PHNT_VERSION >= PHNT_REDSTONE3) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3) // private NTSYSAPI BOOLEAN @@ -10346,7 +10424,7 @@ RtlGetPersistedStateLocation( // Cloud Filters -#if (PHNT_VERSION >= PHNT_REDSTONE3) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3) // msdn NTSYSAPI BOOLEAN @@ -10406,14 +10484,14 @@ NTAPI RtlSetThreadPlaceholderCompatibilityMode( _In_ CHAR Mode ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS3 #undef PHCM_MAX #define PHCM_DISGUISE_FULL_PLACEHOLDERS ((CHAR)3) #define PHCM_MAX ((CHAR)3) #define PHCM_ERROR_NO_PEB ((CHAR)-3) -#if (PHNT_VERSION >= PHNT_REDSTONE4) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS4) NTSYSAPI CHAR @@ -10429,9 +10507,9 @@ RtlSetProcessPlaceholderCompatibilityMode( _In_ CHAR Mode ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS4 -#if (PHNT_VERSION >= PHNT_REDSTONE2) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS2) // rev NTSYSAPI BOOLEAN @@ -10439,9 +10517,9 @@ NTAPI RtlIsNonEmptyDirectoryReparsePointAllowed( _In_ ULONG ReparseTag ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS2 -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // rev NTSYSAPI NTSTATUS @@ -10450,7 +10528,7 @@ RtlAppxIsFileOwnedByTrustedInstaller( _In_ HANDLE FileHandle, _Out_ PBOOLEAN IsFileOwnedByTrustedInstaller ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 // Windows Internals book #define PSM_ACTIVATION_TOKEN_PACKAGED_APPLICATION 0x00000001UL // AppX package format @@ -10483,7 +10561,7 @@ typedef struct _PS_PKG_CLAIM ULONG Origin; // PackageOrigin } PS_PKG_CLAIM, *PPS_PKG_CLAIM; -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) NTSYSAPI NTSTATUS NTAPI @@ -10499,7 +10577,7 @@ RtlQueryPackageClaims( ); #endif -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSAPI NTSTATUS NTAPI @@ -10513,7 +10591,7 @@ RtlQueryPackageIdentity( ); #endif -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) NTSYSAPI NTSTATUS NTAPI @@ -10530,7 +10608,7 @@ RtlQueryPackageIdentityEx( // Protected policies -#if (PHNT_VERSION >= PHNT_WINBLUE) +#if (PHNT_VERSION >= PHNT_WINDOWS_8_1) // rev NTSYSAPI NTSTATUS @@ -10551,7 +10629,7 @@ RtlSetProtectedPolicy( ); #endif -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // rev NTSYSAPI BOOLEAN @@ -10561,7 +10639,7 @@ RtlIsEnclaveFeaturePresent( ); #endif -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // private NTSYSAPI BOOLEAN @@ -10571,7 +10649,7 @@ RtlIsMultiSessionSku( ); #endif -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // private NTSYSAPI BOOLEAN @@ -10581,7 +10659,7 @@ RtlIsMultiUsersInSessionSku( ); #endif -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) // rev NTSYSAPI NTSTATUS @@ -10715,7 +10793,7 @@ RtlGetSetBootStatusData( _Out_opt_ PULONG ReturnLength ); -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // rev NTSYSAPI NTSTATUS @@ -10734,7 +10812,7 @@ RtlRestoreBootStatusDefaults( ); #endif -#if (PHNT_VERSION >= PHNT_REDSTONE3) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3) // rev NTSYSAPI NTSTATUS @@ -10764,9 +10842,9 @@ RtlSetSystemBootStatus( _In_ ULONG DataLength, _Out_opt_ PULONG ReturnLength ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS3 -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // rev NTSYSAPI NTSTATUS @@ -10790,9 +10868,9 @@ NTAPI RtlSetProxiedProcessId( _In_ ULONG ProxiedProcessId ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_8 -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSAPI NTSTATUS @@ -10802,9 +10880,11 @@ RtlFindClosestEncodableLength( _Out_ PULONGLONG TargetLength ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA +// // Memory cache +// _Function_class_(RTL_SECURE_MEMORY_CACHE_CALLBACK) typedef NTSTATUS (NTAPI RTL_SECURE_MEMORY_CACHE_CALLBACK)( @@ -11093,7 +11173,7 @@ typedef struct _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE _Field_size_(UpdateCount) SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY Updates[ANYSIZE_ARRAY]; } SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE, *PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE; -#if (PHNT_VERSION >= PHNT_20H1) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1) // private NTSYSAPI @@ -11192,7 +11272,7 @@ RtlUnsubscribeFromFeatureUsageNotifications( #endif // private -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) NTSYSAPI NTSTATUS NTAPI @@ -11236,9 +11316,9 @@ typedef union _RTL_RUN_ONCE { PVOID Ptr; } RTL_RUN_ONCE, *PRTL_RUN_ONCE; -#endif +#endif // _RTL_RUN_ONCE_DEF -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSAPI VOID @@ -11287,9 +11367,9 @@ RtlRunOnceComplete( _In_opt_ PVOID Context ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_VISTA -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) #define WNF_STATE_KEY 0x41C64E6DA3BC0074 @@ -11366,30 +11446,12 @@ RtlWnfDllUnloadCallback( _In_ PVOID DllBase ); -#endif - -#if (PHNT_VERSION >= PHNT_WIN11) -NTSYSCALLAPI -NTSTATUS -NTAPI -NtCopyFileChunk( - _In_ HANDLE SourceHandle, - _In_ HANDLE DestinationHandle, - _In_opt_ HANDLE EventHandle, - _Out_ PIO_STATUS_BLOCK IoStatusBlock, - _In_ ULONG Length, - _In_ PLARGE_INTEGER SourceOffset, - _In_ PLARGE_INTEGER DestOffset, - _In_opt_ PULONG SourceKey, - _In_opt_ PULONG DestKey, - _In_ ULONG Flags - ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10 #define COPY_FILE_CHUNK_DUPLICATE_EXTENTS 0x00000001L // 24H2 #define VALID_COPY_FILE_CHUNK_FLAGS (COPY_FILE_CHUNK_DUPLICATE_EXTENTS) -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) // rev NTSYSAPI NTSTATUS @@ -11418,9 +11480,9 @@ RtlCompareExchangePropertyStore( _In_opt_ PULONG_PTR Exchange, _Out_ PULONG_PTR Context ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_11 -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) typedef enum _THREAD_STATE_CHANGE_TYPE THREAD_STATE_CHANGE_TYPE, *PTHREAD_STATE_CHANGE_TYPE; // rev @@ -11435,10 +11497,10 @@ RtlWow64ChangeThreadState( _In_opt_ SIZE_T ExtendedInformationLength, _In_opt_ ULONG64 Reserved ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_11 #ifdef PHNT_INLINE_TYPEDEFS -#if (PHNT_VERSION >= PHNT_WIN11) +#if (PHNT_VERSION >= PHNT_WINDOWS_11) // rev FORCEINLINE USHORT @@ -11449,9 +11511,9 @@ RtlGetCurrentThreadPrimaryGroup( { return NtCurrentTeb()->PrimaryGroupAffinity.Group; } -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_11 #else -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // rev NTSYSAPI USHORT @@ -11459,8 +11521,8 @@ NTAPI RtlGetCurrentThreadPrimaryGroup( VOID ); -#endif -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_RS1 +#endif // PHNT_INLINE_TYPEDEFS #endif // _NTRTL_H @@ -11485,7 +11547,7 @@ RtlGetCurrentThreadPrimaryGroup( #define RtlQueryImageFileKeyOption LdrQueryImageFileKeyOption #define RtlSetTimer RtlCreateTimer #define RtlRestoreLastWin32Error RtlSetLastWin32Error -#endif +#endif // PHNT_INLINE_NAME_FORWARDERS #ifndef PHNT_INLINE_PEB_FORWARDERS FORCEINLINE @@ -11517,7 +11579,7 @@ RtlReleasePebLock( { return RtlLeaveCriticalSection(NtCurrentPeb()->FastPebLock); } -#endif +#endif // PHNT_INLINE_PEB_FORWARDERS #ifndef PHNT_INLINE_FREE_FORWARDERS //#define RtlFreeUnicodeString(UnicodeString) {if ((UnicodeString)->Buffer) RtlFreeHeap(RtlProcessHeap(), 0, (UnicodeString)->Buffer); memset(UnicodeString, 0, sizeof(UNICODE_STRING));} @@ -11622,7 +11684,7 @@ RtlDestroyProcessParameters( RtlFreeHeap(RtlProcessHeap(), 0, ProcessParameters); return STATUS_SUCCESS; } -#endif +#endif // PHNT_INLINE_FREE_FORWARDERS // end_forwarders #endif // _NTRTL_FWD_H diff --git a/ntseapi.h b/ntseapi.h index 66eb172..f56df2c 100644 --- a/ntseapi.h +++ b/ntseapi.h @@ -12,42 +12,41 @@ // #define SE_MIN_WELL_KNOWN_PRIVILEGE (2L) -#define SE_CREATE_TOKEN_PRIVILEGE (2L) -#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L) -#define SE_LOCK_MEMORY_PRIVILEGE (4L) -#define SE_INCREASE_QUOTA_PRIVILEGE (5L) - -#define SE_MACHINE_ACCOUNT_PRIVILEGE (6L) -#define SE_TCB_PRIVILEGE (7L) -#define SE_SECURITY_PRIVILEGE (8L) -#define SE_TAKE_OWNERSHIP_PRIVILEGE (9L) -#define SE_LOAD_DRIVER_PRIVILEGE (10L) -#define SE_SYSTEM_PROFILE_PRIVILEGE (11L) -#define SE_SYSTEMTIME_PRIVILEGE (12L) -#define SE_PROF_SINGLE_PROCESS_PRIVILEGE (13L) -#define SE_INC_BASE_PRIORITY_PRIVILEGE (14L) -#define SE_CREATE_PAGEFILE_PRIVILEGE (15L) -#define SE_CREATE_PERMANENT_PRIVILEGE (16L) -#define SE_BACKUP_PRIVILEGE (17L) -#define SE_RESTORE_PRIVILEGE (18L) -#define SE_SHUTDOWN_PRIVILEGE (19L) -#define SE_DEBUG_PRIVILEGE (20L) -#define SE_AUDIT_PRIVILEGE (21L) -#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE (22L) -#define SE_CHANGE_NOTIFY_PRIVILEGE (23L) -#define SE_REMOTE_SHUTDOWN_PRIVILEGE (24L) -#define SE_UNDOCK_PRIVILEGE (25L) -#define SE_SYNC_AGENT_PRIVILEGE (26L) -#define SE_ENABLE_DELEGATION_PRIVILEGE (27L) -#define SE_MANAGE_VOLUME_PRIVILEGE (28L) -#define SE_IMPERSONATE_PRIVILEGE (29L) -#define SE_CREATE_GLOBAL_PRIVILEGE (30L) -#define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE (31L) -#define SE_RELABEL_PRIVILEGE (32L) -#define SE_INC_WORKING_SET_PRIVILEGE (33L) -#define SE_TIME_ZONE_PRIVILEGE (34L) -#define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE (35L) -#define SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE (36L) +#define SE_CREATE_TOKEN_PRIVILEGE (2L) // Required to create a primary token. +#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L) // Required to assign the primary token of a process. +#define SE_LOCK_MEMORY_PRIVILEGE (4L) // Required to lock physical pages in memory. +#define SE_INCREASE_QUOTA_PRIVILEGE (5L) // Required to increase the quota assigned to a process. +#define SE_MACHINE_ACCOUNT_PRIVILEGE (6L) // Required to create a computer account. +#define SE_TCB_PRIVILEGE (7L) // Required to act as part of the Trusted Computer Base. +#define SE_SECURITY_PRIVILEGE (8L) // Required to perform a number of security-related functions, such as controlling and viewing audit messages. // Security operator. +#define SE_TAKE_OWNERSHIP_PRIVILEGE (9L) // Required to take ownership of an object without being granted discretionary access. +#define SE_LOAD_DRIVER_PRIVILEGE (10L) // Required to load or unload a device driver. +#define SE_SYSTEM_PROFILE_PRIVILEGE (11L) // Required to gather profiling information for the entire system. +#define SE_SYSTEMTIME_PRIVILEGE (12L) // Required to modify the system time. +#define SE_PROF_SINGLE_PROCESS_PRIVILEGE (13L) // Required to gather profiling information for a single process. +#define SE_INC_BASE_PRIORITY_PRIVILEGE (14L) // Required to increase the base priority of a process. +#define SE_CREATE_PAGEFILE_PRIVILEGE (15L) // Required to create a paging file. +#define SE_CREATE_PERMANENT_PRIVILEGE (16L) // Required to create a permanent object. +#define SE_BACKUP_PRIVILEGE (17L) // Required to perform backup operations. This privilege causes the system to grant all read access control to any file. +#define SE_RESTORE_PRIVILEGE (18L) // Required to perform restore operations. This privilege causes the system to grant all write access control to any file. +#define SE_SHUTDOWN_PRIVILEGE (19L) // Required to shut down a local system. +#define SE_DEBUG_PRIVILEGE (20L) // Required to debug and adjust memory of any process, ignoring the DACL for the process. +#define SE_AUDIT_PRIVILEGE (21L) // Required to generate audit-log entries. +#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE (22L) // Required to modify UEFI variables of systems that use this type of memory to store configuration information. +#define SE_CHANGE_NOTIFY_PRIVILEGE (23L) // Required to receive notifications of changes to files or directories and skip all traversal access checks. It is enabled by default for all users. +#define SE_REMOTE_SHUTDOWN_PRIVILEGE (24L) // Required to shut down a system using a network request. +#define SE_UNDOCK_PRIVILEGE (25L) // Required to undock a laptop. +#define SE_SYNC_AGENT_PRIVILEGE (26L) // Required for a domain controller to use the Lightweight Directory Access Protocol (LDAP) directory synchronization services. +#define SE_ENABLE_DELEGATION_PRIVILEGE (27L) // Required to mark user and computer accounts as trusted for delegation. +#define SE_MANAGE_VOLUME_PRIVILEGE (28L) // Required to enable volume management privileges. +#define SE_IMPERSONATE_PRIVILEGE (29L) // Required to impersonate a client after authentication. +#define SE_CREATE_GLOBAL_PRIVILEGE (30L) // Required to create named file mapping objects in the global namespace during Terminal Services sessions. It is enabled by default for all administrators. +#define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE (31L) // Required to access Credential Manager as a trusted caller. +#define SE_RELABEL_PRIVILEGE (32L) // Required to modify the mandatory integrity level of an object. +#define SE_INC_WORKING_SET_PRIVILEGE (33L) // Required to allocate more memory for applications that run in the context of users. +#define SE_TIME_ZONE_PRIVILEGE (34L) // Required to adjust the time zone associated with the computer's internal clock. +#define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE (35L) // Required to create a symbolic link. +#define SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE (36L) // Required to obtain an impersonation token for another user in the same session. #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE // @@ -129,9 +128,9 @@ typedef enum _TOKEN_INFORMATION_CLASS #define TokenSandBoxInert 15 // q: ULONG #define TokenAuditPolicy 16 // q; s: TOKEN_AUDIT_POLICY (requires SeSecurityPrivilege/SeTcbPrivilege) #define TokenOrigin 17 // q; s: TOKEN_ORIGIN (requires SeTcbPrivilege) -#define TokenElevationType 18 // q: TOKEN_ELEVATION_TYPE +//#define TokenElevationType 18 // q: TOKEN_ELEVATION_TYPE #define TokenLinkedToken 19 // q; s: TOKEN_LINKED_TOKEN (requires SeCreateTokenPrivilege) -#define TokenElevation 20 // q: TOKEN_ELEVATION // 20 +//#define TokenElevation 20 // q: TOKEN_ELEVATION // 20 #define TokenHasRestrictions 21 // q: ULONG #define TokenAccessInformation 22 // q: TOKEN_ACCESS_INFORMATION #define TokenVirtualizationAllowed 23 // q; s: ULONG (requires SeCreateTokenPrivilege) @@ -164,22 +163,22 @@ typedef enum _TOKEN_INFORMATION_CLASS #define MaxTokenInfoClass 50 #endif +// // Types +// #define TOKEN_SECURITY_ATTRIBUTE_TYPE_INVALID 0x00 #define TOKEN_SECURITY_ATTRIBUTE_TYPE_INT64 0x01 #define TOKEN_SECURITY_ATTRIBUTE_TYPE_UINT64 0x02 -// Case insensitive attribute value string by default. -// Unless the flag TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE -// is set indicating otherwise. -#define TOKEN_SECURITY_ATTRIBUTE_TYPE_STRING 0x03 -// Fully-qualified binary name. -#define TOKEN_SECURITY_ATTRIBUTE_TYPE_FQBN 0x04 +#define TOKEN_SECURITY_ATTRIBUTE_TYPE_STRING 0x03 // Case insensitive attribute value string by default. Unless the flag TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE is set. +#define TOKEN_SECURITY_ATTRIBUTE_TYPE_FQBN 0x04 // Fully-qualified binary name. #define TOKEN_SECURITY_ATTRIBUTE_TYPE_SID 0x05 #define TOKEN_SECURITY_ATTRIBUTE_TYPE_BOOLEAN 0x06 #define TOKEN_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING 0x10 +// // Flags +// // Attribute must not be inherited across process spawns. #define TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE 0x0001 @@ -232,11 +231,11 @@ typedef struct _TOKEN_SECURITY_ATTRIBUTE_V1 ULONG ValueCount; union { - PLONG64 pInt64; - PULONG64 pUint64; - PUNICODE_STRING pString; - PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE pFqbn; - PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE pOctetString; + PLONG64 Int64; + PULONG64 Uint64; + PUNICODE_STRING String; + PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE Fqbn; + PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE OctetString; } Values; } TOKEN_SECURITY_ATTRIBUTE_V1, *PTOKEN_SECURITY_ATTRIBUTE_V1; @@ -250,11 +249,11 @@ typedef struct _TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 ULONG ValueCount; union { - ULONG pInt64[ANYSIZE_ARRAY]; - ULONG pUint64[ANYSIZE_ARRAY]; - ULONG ppString[ANYSIZE_ARRAY]; - ULONG pFqbn[ANYSIZE_ARRAY]; - ULONG pOctetString[ANYSIZE_ARRAY]; + ULONG Int64[ANYSIZE_ARRAY]; + ULONG Uint64[ANYSIZE_ARRAY]; + ULONG String[ANYSIZE_ARRAY]; + ULONG Fqbn[ANYSIZE_ARRAY]; + ULONG OctetString[ANYSIZE_ARRAY]; } Values; } TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1, *PTOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1; @@ -271,8 +270,8 @@ typedef struct _TOKEN_SECURITY_ATTRIBUTES_INFORMATION ULONG AttributeCount; union { - PTOKEN_SECURITY_ATTRIBUTE_V1 pAttributeV1; - } Attribute; + PTOKEN_SECURITY_ATTRIBUTE_V1 AttributeV1; + }; } TOKEN_SECURITY_ATTRIBUTES_INFORMATION, *PTOKEN_SECURITY_ATTRIBUTES_INFORMATION; // private @@ -298,6 +297,25 @@ typedef struct _TOKEN_PROCESS_TRUST_LEVEL PSID TrustLevelSid; } TOKEN_PROCESS_TRUST_LEVEL, *PTOKEN_PROCESS_TRUST_LEVEL; +#if !defined(NTDDI_WIN11_GE) || (NTDDI_VERSION < NTDDI_WIN11_GE) +typedef struct _TOKEN_LOGGING_INFORMATION +{ + TOKEN_TYPE TokenType; + TOKEN_ELEVATION TokenElevation; + TOKEN_ELEVATION_TYPE TokenElevationType; + SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; + DWORD IntegrityLevel; + SID_AND_ATTRIBUTES User; + PSID TrustLevelSid; + DWORD SessionId; + DWORD AppContainerNumber; + LUID AuthenticationId; + DWORD GroupCount; + DWORD GroupsLength; + PSID_AND_ATTRIBUTES Groups; +} TOKEN_LOGGING_INFORMATION, *PTOKEN_LOGGING_INFORMATION; +#endif + // // Tokens // @@ -321,7 +339,7 @@ NtCreateToken( _In_ PTOKEN_SOURCE Source ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS NTAPI @@ -338,7 +356,7 @@ NtCreateLowBoxToken( ); #endif -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS NTAPI @@ -467,6 +485,18 @@ NtDuplicateToken( _Out_ PHANDLE NewTokenHandle ); +/** + * The NtQueryInformationToken routine retrieves a specified type of information about an access token. The calling process must have appropriate access rights to obtain the information. + * + * @param TokenHandle A handle to an existing access token from which information is to be retrieved. If TokenInformationClass is set to TokenSource, the handle must have TOKEN_QUERY_SOURCE access. + * For all other TokenInformationClass values, the handle must have TOKEN_QUERY access. + * @param TokenInformationClass A value from the TOKEN_INFORMATION_CLASS enumerated type identifying the type of information to be retrieved. + * @param TokenInformation Pointer to a caller-allocated buffer that receives the requested information about the token. + * @param TokenInformationLength Length, in bytes, of the caller-allocated TokenInformation buffer. + * @param ReturnLength Pointer to a caller-allocated variable that receives the actual length, in bytes, of the information returned in the TokenInformation buffer. + * @return NTSTATUS Successful or errant status. + * @remarks https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntqueryinformationtoken + */ NTSYSCALLAPI NTSTATUS NTAPI @@ -478,6 +508,16 @@ NtQueryInformationToken( _Out_ PULONG ReturnLength ); +/** + * The NtSetInformationToken routine modifies information in a specified token. The calling process must have appropriate access rights to set the information. + * + * @param TokenHandle A handle to an existing access token which information is to be modified. + * @param TokenInformationClass A value from the TOKEN_INFORMATION_CLASS enumerated type identifying the type of information to be modified. + * @param TokenInformation Pointer to a caller-allocated buffer containing the information to be modified in the token. + * @param TokenInformationLength Length, in bytes, of the caller-allocated TokenInformation buffer. + * @return NTSTATUS Successful or errant status. + * @remarks https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntsetinformationtoken + */ NTSYSCALLAPI NTSTATUS NTAPI @@ -488,6 +528,19 @@ NtSetInformationToken( _In_ ULONG TokenInformationLength ); +/** + * The NtAdjustPrivilegesToken routine enables or disables privileges in the specified access token. + * + * @param TokenHandle Handle to the token that contains the privileges to be modified. The handle must have TOKEN_ADJUST_PRIVILEGES access. + * @param DisableAllPrivileges Specifies whether the function disables all of the token's privileges. If this value is TRUE, the function disables all privileges and ignores the NewState parameter. + * If it is FALSE, the function modifies privileges based on the information pointed to by the NewState parameter. + * @param NewState A pointer to a TOKEN_PRIVILEGES structure that specifies an array of privileges and their attributes. If DisableAllPrivileges is TRUE, the function ignores this parameter. + * @param BufferLength Specifies the size, in bytes, of the buffer pointed to by the PreviousState parameter. This parameter can be zero if the PreviousState parameter is NULL. + * @param PreviousState A pointer to a buffer that the function fills with a TOKEN_PRIVILEGES structure that contains the previous state of any privileges that the function modifies. + * @param ReturnLength A pointer to a variable that receives the required size, in bytes, of the buffer pointed to by the PreviousState parameter. This parameter can be NULL if PreviousState is NULL. + * @return NTSTATUS Successful or errant status. + * @remarks https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-adjusttokenprivileges + */ NTSYSCALLAPI NTSTATUS NTAPI @@ -512,7 +565,7 @@ NtAdjustGroupsToken( _Out_opt_ PULONG ReturnLength ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS NTAPI @@ -548,7 +601,7 @@ NtFilterToken( _Out_ PHANDLE NewTokenHandle ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS NTAPI @@ -595,7 +648,7 @@ NtImpersonateAnonymousToken( _In_ HANDLE ThreadHandle ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSCALLAPI NTSTATUS @@ -662,7 +715,7 @@ NtAccessCheckByTypeResultList( // Signing -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) NTSYSCALLAPI NTSTATUS @@ -704,7 +757,7 @@ typedef struct _SE_SET_FILE_CACHE_INFORMATION SE_FILE_CACHE_CLAIM_INFORMATION OriginClaimInfo; } SE_SET_FILE_CACHE_INFORMATION, *PSE_SET_FILE_CACHE_INFORMATION; -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // rev NTSYSCALLAPI @@ -721,7 +774,7 @@ NtSetCachedSigningLevel2( #endif -#if (PHNT_VERSION >= PHNT_REDSTONE2) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS2) // rev NTSYSCALLAPI diff --git a/nttmapi.h b/nttmapi.h index 4e9e8ad..43b8c09 100644 --- a/nttmapi.h +++ b/nttmapi.h @@ -7,7 +7,7 @@ #ifndef _NTTMAPI_H #define _NTTMAPI_H -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -21,7 +21,7 @@ NtCreateTransactionManager( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -35,7 +35,7 @@ NtOpenTransactionManager( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -45,7 +45,7 @@ NtRenameTransactionManager( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -55,7 +55,7 @@ NtRollforwardTransactionManager( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -64,7 +64,7 @@ NtRecoverTransactionManager( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -77,7 +77,7 @@ NtQueryInformationTransactionManager( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -89,7 +89,7 @@ NtSetInformationTransactionManager( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -102,7 +102,7 @@ NtEnumerateTransactionObject( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -120,7 +120,7 @@ NtCreateTransaction( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -133,7 +133,7 @@ NtOpenTransaction( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -146,7 +146,7 @@ NtQueryInformationTransaction( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -158,7 +158,7 @@ NtSetInformationTransaction( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -168,7 +168,7 @@ NtCommitTransaction( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -178,7 +178,7 @@ NtRollbackTransaction( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -194,7 +194,7 @@ NtCreateEnlistment( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -207,7 +207,7 @@ NtOpenEnlistment( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -220,7 +220,7 @@ NtQueryInformationEnlistment( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -232,7 +232,7 @@ NtSetInformationEnlistment( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -242,7 +242,7 @@ NtRecoverEnlistment( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -252,7 +252,7 @@ NtPrePrepareEnlistment( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -262,7 +262,7 @@ NtPrepareEnlistment( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -272,7 +272,7 @@ NtCommitEnlistment( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -282,7 +282,7 @@ NtRollbackEnlistment( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -292,7 +292,7 @@ NtPrePrepareComplete( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -302,7 +302,7 @@ NtPrepareComplete( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -312,7 +312,7 @@ NtCommitComplete( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -322,7 +322,7 @@ NtReadOnlyEnlistment( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -332,7 +332,7 @@ NtRollbackComplete( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -342,7 +342,7 @@ NtSinglePhaseReject( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -357,7 +357,7 @@ NtCreateResourceManager( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -370,7 +370,7 @@ NtOpenResourceManager( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -379,7 +379,7 @@ NtRecoverResourceManager( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -394,7 +394,7 @@ NtGetNotificationResourceManager( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -407,7 +407,7 @@ NtQueryInformationResourceManager( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -419,7 +419,7 @@ NtSetInformationResourceManager( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -432,7 +432,7 @@ NtRegisterProtocolAddressInformation( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -444,7 +444,7 @@ NtPropagationComplete( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -455,7 +455,7 @@ NtPropagationFailed( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSCALLAPI NTSTATUS @@ -466,7 +466,7 @@ NtFreezeTransactions( ); #endif -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // private NTSYSCALLAPI NTSTATUS diff --git a/nttp.h b/nttp.h index 9ab4468..ad99d3c 100644 --- a/nttp.h +++ b/nttp.h @@ -26,7 +26,7 @@ typedef VOID (NTAPI *PTP_ALPC_CALLBACK_EX)( _In_ PVOID ApcContext ); -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // winbase:CreateThreadpool NTSYSAPI @@ -63,7 +63,7 @@ TpSetPoolMinThreads( _In_ ULONG MinThreads ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // winbase:QueryThreadpoolStackInformation NTSYSAPI NTSTATUS @@ -256,7 +256,7 @@ TpSetTimer( _In_opt_ ULONG WindowLength ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // winbase:SetThreadpoolTimerEx NTSYSAPI NTSTATUS @@ -315,7 +315,7 @@ TpSetWait( _In_opt_ PLARGE_INTEGER Timeout ); -#if (PHNT_VERSION >= PHNT_WIN8) +#if (PHNT_VERSION >= PHNT_WINDOWS_8) // winbase:SetThreadpoolWaitEx NTSYSAPI NTSTATUS @@ -403,7 +403,7 @@ TpAllocAlpcCompletion( _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron ); -#if (PHNT_VERSION >= PHNT_WIN7) +#if (PHNT_VERSION >= PHNT_WINDOWS_7) // rev NTSYSAPI NTSTATUS diff --git a/ntuser.h b/ntuser.h index 6832135..5105fc5 100644 --- a/ntuser.h +++ b/ntuser.h @@ -7,33 +7,82 @@ #ifndef _NTUSER_H #define _NTUSER_H -typedef enum _WINDOWINFOCLASS -{ - WindowProcess = 0, // q: ULONG (Process ID) - WindowRealProcess = 1, // q: ULONG (Process ID) - WindowThread = 2, // q: ULONG (Thread ID) - WindowActiveWindow = 3, // q: HWND - WindowFocusWindow = 4, // q: HWND - WindowIsHung = 5, // q: BOOLEAN - WindowClientBase = 6, // q: PVOID - WindowIsForegroundThread = 7, // q: BOOLEAN - WindowDefaultImeWindow = 8, // q: HWND - WindowDefaultInputContext = 9, // q: HIMC -} WINDOWINFOCLASS, *PWINDOWINFOCLASS; +typedef enum _USERTHREADINFOCLASS USERTHREADINFOCLASS; NTSYSCALLAPI -ULONG_PTR +NTSTATUS NTAPI -NtUserQueryWindow( +NtUserAttachThreadInput( + _In_ ULONG IdAttach, + _In_ ULONG IdAttachTo, + _In_ BOOL Attach + ); + +NTSYSCALLAPI +HDC +NTAPI +NtUserBeginPaint( _In_ HWND WindowHandle, - _In_ WINDOWINFOCLASS WindowInfo + _Inout_ LPPAINTSTRUCT lpPaint + ); + +NTSYSCALLAPI +BOOL +NTAPI +NtUserBlockInput( + _In_ BOOL BlockInput ); NTSYSCALLAPI NTSTATUS NTAPI -NtUserTestForInteractiveUser( - _In_ PLUID AuthenticationId +NtUserBuildHwndList( + _In_opt_ HANDLE DesktopHandle, + _In_opt_ HWND StartWindowHandle, + _In_opt_ LOGICAL IncludeChildren, + _In_opt_ LOGICAL ExcludeImmersive, + _In_opt_ ULONG ThreadId, + _In_ ULONG HwndListInformationLength, + _Out_writes_bytes_(HwndListInformationLength) PVOID HwndListInformation, + _Out_ PULONG ReturnLength + ); + +NTSYSCALLAPI +NTSTATUS +NTAPI +NtUserBuildNameList( + _In_ HWINSTA WindowStationHandle, // GetProcessWindowStation + _In_ ULONG NameListInformationLength, + _Out_writes_bytes_(NameListInformationLength) PVOID NameListInformation, + _Out_opt_ PULONG ReturnLength + ); + +NTSYSCALLAPI +NTSTATUS +NTAPI +NtUserBuildPropList( + _In_ HWINSTA WindowStationHandle, + _In_ ULONG PropListInformationLength, + _Out_writes_bytes_(PropListInformationLength) PVOID PropListInformation, + _Out_opt_ PULONG ReturnLength + ); + +NTSYSCALLAPI +LOGICAL +NTAPI +NtUserCanCurrentThreadChangeForeground( + VOID + ); + +NTSYSCALLAPI +BOOL +NTAPI +NtUserCalculatePopupWindowPosition( + _In_ const POINT* anchorPoint, + _In_ const SIZE* windowSize, + _In_ ULONG flags, + _Inout_ RECT* excludeRect, + _Inout_ RECT* popupWindowPosition ); NTSYSCALLAPI @@ -54,29 +103,10 @@ NtUserCheckProcessForClipboardAccess( ); NTSYSCALLAPI -ULONG +LOGICAL NTAPI -NtUserInternalGetWindowText( - _In_ HWND WindowHandle, - _Out_writes_to_(cchMaxCount, return + 1) LPWSTR pString, - _In_ ULONG cchMaxCount - ); - -NTSYSCALLAPI -HICON -NTAPI -NtUserInternalGetWindowIcon( - _In_ HWND WindowHandle, - _In_ ULONG IconType - ); - -NTSYSCALLAPI -ULONG -NTAPI -NtUserGetClassName( - _In_ HWND WindowHandle, - _In_ LONGLONG Real, - _Out_ PUNICODE_STRING ClassName +NtUserCloseWindowStation( + _In_ HWINSTA WindowStationHandle ); typedef enum _CONSOLECONTROL @@ -146,6 +176,20 @@ NtUserConsoleControl( _In_ ULONG ConsoleInformationLength ); +NTSYSCALLAPI +NTSTATUS +NTAPI +NtUserCreateWindowStation( + _In_ POBJECT_ATTRIBUTES ObjectAttributes, + _In_ ACCESS_MASK DesiredAccess, + _In_opt_ HANDLE KeyboardLayoutHandle, + _In_opt_ PVOID KeyboardLayoutOffset, + _In_opt_ PVOID NlsTableOffset, + _In_opt_ PVOID KeyboardDescriptor, + _In_opt_ PUNICODE_STRING LanguageIdString, + _In_opt_ ULONG KeyboardLocale + ); + /** * Performs special kernel operations for console host applications. (user32.dll) * @@ -157,7 +201,7 @@ NtUserConsoleControl( * @param ConsoleInformationLength The size of the structure pointed to by the ConsoleInformation parameter. * @return Successful or errant status. */ -NTSYSCALLAPI +NTSYSAPI NTSTATUS NTAPI ConsoleControl( @@ -166,185 +210,22 @@ ConsoleControl( _In_ ULONG ConsoleInformationLength ); -/** - * Opens the specified window station. - * - * @param ObjectAttributes The name of the window station to be opened. Window station names are case-insensitive. This window station must belong to the current session. - * @param DesiredAccess The access to the window station. - * @return Successful or errant status. - */ NTSYSCALLAPI -HWINSTA +HWND NTAPI -NtUserOpenWindowStation( - _In_ OBJECT_ATTRIBUTES ObjectAttributes, - _In_ ACCESS_MASK DesiredAccess +NtUserGetClassName( + _In_ HWND WindowHandle, + _In_ BOOL Real, + _Out_ PUNICODE_STRING ClassName ); NTSYSCALLAPI -HWINSTA +HWND NTAPI -NtUserCreateWindowStation( - _In_ OBJECT_ATTRIBUTES ObjectAttributes, - _In_ ACCESS_MASK DesiredAccess, - _In_opt_ HANDLE KeyboardLayoutHandle, - _In_opt_ PVOID KeyboardLayoutOffset, - _In_opt_ PVOID NlsTableOffset, - _In_opt_ PVOID KeyboardDescriptor, - _In_opt_ UNICODE_STRING LanguageIdString, - _In_opt_ ULONG KeyboardLocale - ); - -NTSYSCALLAPI -NTSTATUS -NTAPI -NtUserBuildHwndList( - _In_opt_ HANDLE DesktopHandle, - _In_opt_ HWND StartWindowHandle, - _In_opt_ LOGICAL IncludeChildren, - _In_opt_ LOGICAL ExcludeImmersive, - _In_opt_ ULONG ThreadId, - _In_ ULONG HwndListInformationLength, - _Out_writes_bytes_(HwndListInformationLength) PVOID HwndListInformation, - _Out_ PULONG ReturnLength - ); - -NTSYSCALLAPI -NTSTATUS -NTAPI -NtUserBuildNameList( - _In_ HWINSTA WindowStationHandle, // GetProcessWindowStation - _In_ ULONG NameListInformationLength, - _Out_writes_bytes_(NameListInformationLength) PVOID NameListInformation, - _Out_opt_ PULONG ReturnLength - ); - -NTSYSCALLAPI -NTSTATUS -NTAPI -NtUserBuildPropList( - _In_ HWINSTA WindowStationHandle, - _In_ ULONG PropListInformationLength, - _Out_writes_bytes_(PropListInformationLength) PVOID PropListInformation, - _Out_opt_ PULONG ReturnLength - ); - -NTSYSCALLAPI -NTSTATUS -NTAPI -NtUserCanCurrentThreadChangeForeground( +NtUserGetForegroundWindow( VOID ); -NTSYSCALLAPI -HWND -NTAPI -NtUserGetProcessWindowStation( - VOID - ); - -NTSYSCALLAPI -HWND -NTAPI -NtUserGhostWindowFromHungWindow( - _In_ HWND WindowHandle - ); - -NTSYSCALLAPI -HWND -NTAPI -NtUserHungWindowFromGhostWindow( - _In_ HWND WindowHandle - ); - -NTSYSAPI -HWND -NTAPI -GhostWindowFromHungWindow( - _In_ HWND WindowHandle - ); - -NTSYSAPI -HWND -NTAPI -HungWindowFromGhostWindow( - _In_ HWND WindowHandle - ); - -NTSYSCALLAPI -LOGICAL -NTAPI -NtUserCloseWindowStation( - _In_ HWINSTA WindowStationHandle - ); - -NTSYSCALLAPI -LOGICAL -NTAPI -NtUserSetProcessWindowStation( - _In_ HWINSTA WindowStationHandle - ); - -NTSYSAPI -LOGICAL -NTAPI -SetWindowStationUser( - _In_ HWINSTA WindowStationHandle, - _In_ PLUID UserLogonId, - _In_ PSID UserSid, - _In_ ULONG UserSidLength - ); - -NTSYSCALLAPI -LOGICAL -NTAPI -NtUserSetChildWindowNoActivate( - _In_ HWND WindowHandle - ); - -// User32 ordinal 2005 -NTSYSCALLAPI -LOGICAL -NTAPI -SetChildWindowNoActivate( - _In_ HWND WindowHandle - ); - -NTSYSCALLAPI -LOGICAL -NTAPI -NtUserSetWindowStationUser( - _In_ HWINSTA WindowStationHandle, - _In_ PLUID UserLogonId, - _In_ PSID UserSid, - _In_ ULONG UserSidLength - ); - -NTSYSCALLAPI -HANDLE -NTAPI -NtUserOpenDesktop( - _In_ PCOBJECT_ATTRIBUTES ObjectAttributes, - _In_ ULONG Flags, - _In_ ACCESS_MASK DesiredAccess - ); - -NTSYSCALLAPI -LOGICAL -NTAPI -NtUserSetThreadDesktop( - _In_ HDESK DesktopHandle - ); - -NTSYSCALLAPI -LOGICAL -NTAPI -NtUserSwitchDesktop( - _In_ HDESK DesktopHandle, - _In_opt_ ULONG Flags, - _In_opt_ ULONG FadeTime - ); - NTSYSCALLAPI LOGICAL NTAPI @@ -370,10 +251,108 @@ NtUserGetIconSize( NTSYSCALLAPI HWND NTAPI -NtUserGetForegroundWindow( +NtUserGetProcessWindowStation( VOID ); +NTSYSCALLAPI +ULONG_PTR +NTAPI +NtUserGetThreadState( + _In_ ULONG UserThreadState + ); + +NTSYSCALLAPI +HWND +NTAPI +NtUserGhostWindowFromHungWindow( + _In_ HWND WindowHandle + ); + +NTSYSAPI +HWND +NTAPI +GhostWindowFromHungWindow( + _In_ HWND WindowHandle + ); + +NTSYSCALLAPI +HWND +NTAPI +NtUserHungWindowFromGhostWindow( + _In_ HWND WindowHandle + ); + +NTSYSAPI +HWND +NTAPI +HungWindowFromGhostWindow( + _In_ HWND WindowHandle + ); + +NTSYSCALLAPI +ULONG +NTAPI +NtUserInternalGetWindowText( + _In_ HWND WindowHandle, + _Out_writes_to_(cchMaxCount, return + 1) LPWSTR pString, + _In_ ULONG cchMaxCount + ); + +NTSYSCALLAPI +HICON +NTAPI +NtUserInternalGetWindowIcon( + _In_ HWND WindowHandle, + _In_ ULONG IconType + ); + +NTSYSCALLAPI +HANDLE +NTAPI +NtUserOpenDesktop( + _In_ PCOBJECT_ATTRIBUTES ObjectAttributes, + _In_ ULONG Flags, + _In_ ACCESS_MASK DesiredAccess + ); + +/** + * Opens the specified window station. + * + * @param ObjectAttributes The name of the window station to be opened. Window station names are case-insensitive. This window station must belong to the current session. + * @param DesiredAccess The access to the window station. + * @return Successful or errant status. + */ +NTSYSCALLAPI +HWINSTA +NTAPI +NtUserOpenWindowStation( + _In_ POBJECT_ATTRIBUTES ObjectAttributes, + _In_ ACCESS_MASK DesiredAccess + ); + +typedef enum _WINDOWINFOCLASS +{ + WindowProcess = 0, // q: ULONG (Process ID) + WindowRealProcess = 1, // q: ULONG (Process ID) + WindowThread = 2, // q: ULONG (Thread ID) + WindowActiveWindow = 3, // q: HWND + WindowFocusWindow = 4, // q: HWND + WindowIsHung = 5, // q: BOOLEAN + WindowClientBase = 6, // q: PVOID + WindowIsForegroundThread = 7, // q: BOOLEAN + WindowDefaultImeWindow = 8, // q: HWND + WindowDefaultInputContext = 9, // q: HIMC +} WINDOWINFOCLASS, *PWINDOWINFOCLASS; + +NTSYSCALLAPI +ULONG_PTR +NTAPI +NtUserQueryWindow( + _In_ HWND WindowHandle, + _In_ WINDOWINFOCLASS WindowInfo + ); + NTSYSCALLAPI HWND NTAPI @@ -381,6 +360,13 @@ NtUserSetActiveWindow( _In_ HWND WindowHandle ); +NTSYSCALLAPI +NTSTATUS +NTAPI +NtUserSetChildWindowNoActivate( + _In_ HWND WindowHandle + ); + NTSYSCALLAPI HWND NTAPI @@ -388,11 +374,29 @@ NtUserSetFocus( _In_ HWND WindowHandle ); -NTSYSCALLAPI -ULONG_PTR +// User32 ordinal 2005 +NTSYSAPI +LOGICAL NTAPI -NtUserGetThreadState( - _In_ ULONG UserThreadState +SetChildWindowNoActivate( + _In_ HWND WindowHandle + ); + +NTSYSCALLAPI +NTSTATUS +NTAPI +NtUserSetInformationThread( + _In_ HANDLE ThreadHandle, + _In_ USERTHREADINFOCLASS ThreadInformationClass, + _In_reads_bytes_(ThreadInformationLength) PVOID ThreadInformation, + _In_ ULONG ThreadInformationLength + ); + +NTSYSCALLAPI +LOGICAL +NTAPI +NtUserSetProcessWindowStation( + _In_ HWINSTA WindowStationHandle ); NTSYSCALLAPI @@ -404,54 +408,52 @@ NtUserSetWindowPlacement( ); NTSYSCALLAPI -BOOL +LOGICAL NTAPI -NtUserAttachThreadInput( - _In_ ULONG IdAttach, - _In_ ULONG IdAttachTo, - _In_ BOOL Attach +NtUserSetWindowStationUser( + _In_ HWINSTA WindowStationHandle, + _In_ PLUID UserLogonId, + _In_ PSID UserSid, + _In_ ULONG UserSidLength + ); + +NTSYSAPI +LOGICAL +NTAPI +SetWindowStationUser( + _In_ HWINSTA WindowStationHandle, + _In_ PLUID UserLogonId, + _In_ PSID UserSid, + _In_ ULONG UserSidLength ); NTSYSCALLAPI -HDC +NTSTATUS NTAPI -NtUserBeginPaint( - _In_ HWND WindowHandle, - _Inout_ LPPAINTSTRUCT lpPaint +NtUserTestForInteractiveUser( + _In_ PLUID AuthenticationId ); NTSYSCALLAPI -BOOL +LOGICAL NTAPI -NtUserBlockInput( - _In_ BOOL BlockInput +NtUserSwitchDesktop( + _In_ HDESK DesktopHandle, + _In_opt_ ULONG Flags, + _In_opt_ ULONG FadeTime ); NTSYSCALLAPI -BOOL +LOGICAL NTAPI -tUserCalculatePopupWindowPosition( - _In_ const POINT* anchorPoint, - _In_ const SIZE* windowSize, - _In_ ULONG flags, - _Inout_ RECT* excludeRect, - _Inout_ RECT* popupWindowPosition +NtUserSetThreadDesktop( + _In_ HDESK DesktopHandle ); -NTSYSCALLAPI -BOOL -NTAPI -NtUserChangeWindowMessageFilterEx( - _In_ HWND WindowHandle, - _In_ ULONG WindowMessage, - _In_ ULONG FilterAction, - _Inout_opt_ PCHANGEFILTERSTRUCT ChangeFilterStruct - ); - -NTSYSCALLAPI +NTSYSAPI HWND NTAPI -NtUserChildWindowFromPoint( +ChildWindowFromPoint( _In_ HWND WindowHandle, _In_ POINT pt ); @@ -775,6 +777,20 @@ NtUserGetRegisteredRawInputDevices( _In_ ULONG RawInputDeviceSize ); +NTSYSCALLAPI +HMENU +NTAPI +NtUserGetSendMessageReceiver( + _In_ HANDLE ThreadId + ); + +NTSYSAPI +HWND +NTAPI +GetSendMessageReceiver( + _In_ HANDLE ThreadId + ); + NTSYSCALLAPI HMENU NTAPI @@ -930,8 +946,6 @@ NtUserPrintWindow( _In_ ULONG nFlags ); -typedef enum _USERTHREADINFOCLASS USERTHREADINFOCLASS; - NTSYSCALLAPI NTSTATUS NTAPI @@ -939,7 +953,6 @@ NtUserQueryInformationThread( _In_ HANDLE ThreadHandle, _In_ USERTHREADINFOCLASS ThreadInformationClass, _Out_writes_bytes_(ThreadInformationLength) PVOID ThreadInformation, - _In_ ULONG ThreadInformationLength, _Out_opt_ PULONG ReturnLength ); @@ -953,7 +966,7 @@ NtUserSetInformationThread( _In_ ULONG ThreadInformationLength ); -NTSYSCALLAPI +NTSYSAPI BOOL NTAPI QuerySendMessage( @@ -1245,146 +1258,146 @@ NtUserWindowFromPoint( // Peb!KernelCallbackTable = user32.dll!apfnDispatch typedef struct _KERNEL_CALLBACK_TABLE { - ULONG_PTR __fnCOPYDATA; - ULONG_PTR __fnCOPYGLOBALDATA; - ULONG_PTR __fnEMPTY1; - ULONG_PTR __fnNCDESTROY; - ULONG_PTR __fnDWORDOPTINLPMSG; - ULONG_PTR __fnINOUTDRAG; - ULONG_PTR __fnGETTEXTLENGTHS1; - ULONG_PTR __fnINCNTOUTSTRING; - ULONG_PTR __fnINCNTOUTSTRINGNULL; - ULONG_PTR __fnINLPCOMPAREITEMSTRUCT; - ULONG_PTR __fnINLPCREATESTRUCT; - ULONG_PTR __fnINLPDELETEITEMSTRUCT; - ULONG_PTR __fnINLPDRAWITEMSTRUCT; - ULONG_PTR __fnPOPTINLPUINT1; - ULONG_PTR __fnPOPTINLPUINT2; - ULONG_PTR __fnINLPMDICREATESTRUCT; - ULONG_PTR __fnINOUTLPMEASUREITEMSTRUCT; - ULONG_PTR __fnINLPWINDOWPOS; - ULONG_PTR __fnINOUTLPPOINT51; - ULONG_PTR __fnINOUTLPSCROLLINFO; - ULONG_PTR __fnINOUTLPRECT; - ULONG_PTR __fnINOUTNCCALCSIZE; - ULONG_PTR __fnINOUTLPPOINT52; - ULONG_PTR __fnINPAINTCLIPBRD; - ULONG_PTR __fnINSIZECLIPBRD; - ULONG_PTR __fnINDESTROYCLIPBRD; - ULONG_PTR __fnINSTRINGNULL1; - ULONG_PTR __fnINSTRINGNULL2; - ULONG_PTR __fnINDEVICECHANGE; - ULONG_PTR __fnPOWERBROADCAST; - ULONG_PTR __fnINLPUAHDRAWMENU1; - ULONG_PTR __fnOPTOUTLPDWORDOPTOUTLPDWORD1; - ULONG_PTR __fnOPTOUTLPDWORDOPTOUTLPDWORD2; - ULONG_PTR __fnOUTDWORDINDWORD; - ULONG_PTR __fnOUTLPRECT; - ULONG_PTR __fnOUTSTRING; - ULONG_PTR __fnPOPTINLPUINT3; - ULONG_PTR __fnPOUTLPINT; - ULONG_PTR __fnSENTDDEMSG; - ULONG_PTR __fnINOUTSTYLECHANGE1; - ULONG_PTR __fnHkINDWORD; - ULONG_PTR __fnHkINLPCBTACTIVATESTRUCT; - ULONG_PTR __fnHkINLPCBTCREATESTRUCT; - ULONG_PTR __fnHkINLPDEBUGHOOKSTRUCT; - ULONG_PTR __fnHkINLPMOUSEHOOKSTRUCTEX1; - ULONG_PTR __fnHkINLPKBDLLHOOKSTRUCT; - ULONG_PTR __fnHkINLPMSLLHOOKSTRUCT; - ULONG_PTR __fnHkINLPMSG; - ULONG_PTR __fnHkINLPRECT; - ULONG_PTR __fnHkOPTINLPEVENTMSG; - ULONG_PTR __xxxClientCallDelegateThread; - ULONG_PTR __ClientCallDummyCallback1; - ULONG_PTR __ClientCallDummyCallback2; - ULONG_PTR __fnSHELLWINDOWMANAGEMENTCALLOUT; - ULONG_PTR __fnSHELLWINDOWMANAGEMENTNOTIFY; - ULONG_PTR __ClientCallDummyCallback3; - ULONG_PTR __xxxClientCallDitThread; - ULONG_PTR __xxxClientEnableMMCSS; - ULONG_PTR __xxxClientUpdateDpi; - ULONG_PTR __xxxClientExpandStringW; - ULONG_PTR __ClientCopyDDEIn1; - ULONG_PTR __ClientCopyDDEIn2; - ULONG_PTR __ClientCopyDDEOut1; - ULONG_PTR __ClientCopyDDEOut2; - ULONG_PTR __ClientCopyImage; - ULONG_PTR __ClientEventCallback; - ULONG_PTR __ClientFindMnemChar; - ULONG_PTR __ClientFreeDDEHandle; - ULONG_PTR __ClientFreeLibrary; - ULONG_PTR __ClientGetCharsetInfo; - ULONG_PTR __ClientGetDDEFlags; - ULONG_PTR __ClientGetDDEHookData; - ULONG_PTR __ClientGetListboxString; - ULONG_PTR __ClientGetMessageMPH; - ULONG_PTR __ClientLoadImage; - ULONG_PTR __ClientLoadLibrary; - ULONG_PTR __ClientLoadMenu; - ULONG_PTR __ClientLoadLocalT1Fonts; - ULONG_PTR __ClientPSMTextOut; - ULONG_PTR __ClientLpkDrawTextEx; - ULONG_PTR __ClientExtTextOutW; - ULONG_PTR __ClientGetTextExtentPointW; - ULONG_PTR __ClientCharToWchar; - ULONG_PTR __ClientAddFontResourceW; - ULONG_PTR __ClientThreadSetup; - ULONG_PTR __ClientDeliverUserApc; - ULONG_PTR __ClientNoMemoryPopup; - ULONG_PTR __ClientMonitorEnumProc; - ULONG_PTR __ClientCallWinEventProc; - ULONG_PTR __ClientWaitMessageExMPH; - ULONG_PTR __ClientCallDummyCallback4; - ULONG_PTR __ClientCallDummyCallback5; - ULONG_PTR __ClientImmLoadLayout; - ULONG_PTR __ClientImmProcessKey; - ULONG_PTR __fnIMECONTROL; - ULONG_PTR __fnINWPARAMDBCSCHAR; - ULONG_PTR __fnGETTEXTLENGTHS2; - ULONG_PTR __ClientCallDummyCallback6; - ULONG_PTR __ClientLoadStringW; - ULONG_PTR __ClientLoadOLE; - ULONG_PTR __ClientRegisterDragDrop; - ULONG_PTR __ClientRevokeDragDrop; - ULONG_PTR __fnINOUTMENUGETOBJECT; - ULONG_PTR __ClientPrinterThunk; - ULONG_PTR __fnOUTLPCOMBOBOXINFO; - ULONG_PTR __fnOUTLPSCROLLBARINFO; - ULONG_PTR __fnINLPUAHDRAWMENU2; - ULONG_PTR __fnINLPUAHDRAWMENUITEM; - ULONG_PTR __fnINLPUAHDRAWMENU3; - ULONG_PTR __fnINOUTLPUAHMEASUREMENUITEM; - ULONG_PTR __fnINLPUAHDRAWMENU4; - ULONG_PTR __fnOUTLPTITLEBARINFOEX; - ULONG_PTR __fnTOUCH; - ULONG_PTR __fnGESTURE; - ULONG_PTR __fnPOPTINLPUINT4; - ULONG_PTR __fnPOPTINLPUINT5; - ULONG_PTR __xxxClientCallDefaultInputHandler; - ULONG_PTR __fnEMPTY2; - ULONG_PTR __ClientRimDevCallback; - ULONG_PTR __xxxClientCallMinTouchHitTestingCallback; - ULONG_PTR __ClientCallLocalMouseHooks; - ULONG_PTR __xxxClientBroadcastThemeChange; - ULONG_PTR __xxxClientCallDevCallbackSimple; - ULONG_PTR __xxxClientAllocWindowClassExtraBytes; - ULONG_PTR __xxxClientFreeWindowClassExtraBytes; - ULONG_PTR __fnGETWINDOWDATA; - ULONG_PTR __fnINOUTSTYLECHANGE2; - ULONG_PTR __fnHkINLPMOUSEHOOKSTRUCTEX2; - ULONG_PTR __xxxClientCallDefWindowProc; - ULONG_PTR __fnSHELLSYNCDISPLAYCHANGED; - ULONG_PTR __fnHkINLPCHARHOOKSTRUCT; - ULONG_PTR __fnINTERCEPTEDWINDOWACTION; - ULONG_PTR __xxxTooltipCallback; - ULONG_PTR __xxxClientInitPSBInfo; - ULONG_PTR __xxxClientDoScrollMenu; - ULONG_PTR __xxxClientEndScroll; - ULONG_PTR __xxxClientDrawSize; - ULONG_PTR __xxxClientDrawScrollBar; - ULONG_PTR __xxxClientHitTestScrollBar; - ULONG_PTR __xxxClientTrackInit; + PVOID __fnCOPYDATA; + PVOID __fnCOPYGLOBALDATA; + PVOID __fnEMPTY1; + PVOID __fnNCDESTROY; + PVOID __fnDWORDOPTINLPMSG; + PVOID __fnINOUTDRAG; + PVOID __fnGETTEXTLENGTHS1; + PVOID __fnINCNTOUTSTRING; + PVOID __fnINCNTOUTSTRINGNULL; + PVOID __fnINLPCOMPAREITEMSTRUCT; + PVOID __fnINLPCREATESTRUCT; + PVOID __fnINLPDELETEITEMSTRUCT; + PVOID __fnINLPDRAWITEMSTRUCT; + PVOID __fnPOPTINLPUINT1; + PVOID __fnPOPTINLPUINT2; + PVOID __fnINLPMDICREATESTRUCT; + PVOID __fnINOUTLPMEASUREITEMSTRUCT; + PVOID __fnINLPWINDOWPOS; + PVOID __fnINOUTLPPOINT51; + PVOID __fnINOUTLPSCROLLINFO; + PVOID __fnINOUTLPRECT; + PVOID __fnINOUTNCCALCSIZE; + PVOID __fnINOUTLPPOINT52; + PVOID __fnINPAINTCLIPBRD; + PVOID __fnINSIZECLIPBRD; + PVOID __fnINDESTROYCLIPBRD; + PVOID __fnINSTRINGNULL1; + PVOID __fnINSTRINGNULL2; + PVOID __fnINDEVICECHANGE; + PVOID __fnPOWERBROADCAST; + PVOID __fnINLPUAHDRAWMENU1; + PVOID __fnOPTOUTLPDWORDOPTOUTLPDWORD1; + PVOID __fnOPTOUTLPDWORDOPTOUTLPDWORD2; + PVOID __fnOUTDWORDINDWORD; + PVOID __fnOUTLPRECT; + PVOID __fnOUTSTRING; + PVOID __fnPOPTINLPUINT3; + PVOID __fnPOUTLPINT; + PVOID __fnSENTDDEMSG; + PVOID __fnINOUTSTYLECHANGE1; + PVOID __fnHkINDWORD; + PVOID __fnHkINLPCBTACTIVATESTRUCT; + PVOID __fnHkINLPCBTCREATESTRUCT; + PVOID __fnHkINLPDEBUGHOOKSTRUCT; + PVOID __fnHkINLPMOUSEHOOKSTRUCTEX1; + PVOID __fnHkINLPKBDLLHOOKSTRUCT; + PVOID __fnHkINLPMSLLHOOKSTRUCT; + PVOID __fnHkINLPMSG; + PVOID __fnHkINLPRECT; + PVOID __fnHkOPTINLPEVENTMSG; + PVOID __xxxClientCallDelegateThread; + PVOID __ClientCallDummyCallback1; + PVOID __ClientCallDummyCallback2; + PVOID __fnSHELLWINDOWMANAGEMENTCALLOUT; + PVOID __fnSHELLWINDOWMANAGEMENTNOTIFY; + PVOID __ClientCallDummyCallback3; + PVOID __xxxClientCallDitThread; + PVOID __xxxClientEnableMMCSS; + PVOID __xxxClientUpdateDpi; + PVOID __xxxClientExpandStringW; + PVOID __ClientCopyDDEIn1; + PVOID __ClientCopyDDEIn2; + PVOID __ClientCopyDDEOut1; + PVOID __ClientCopyDDEOut2; + PVOID __ClientCopyImage; + PVOID __ClientEventCallback; + PVOID __ClientFindMnemChar; + PVOID __ClientFreeDDEHandle; + PVOID __ClientFreeLibrary; + PVOID __ClientGetCharsetInfo; + PVOID __ClientGetDDEFlags; + PVOID __ClientGetDDEHookData; + PVOID __ClientGetListboxString; + PVOID __ClientGetMessageMPH; + PVOID __ClientLoadImage; + PVOID __ClientLoadLibrary; + PVOID __ClientLoadMenu; + PVOID __ClientLoadLocalT1Fonts; + PVOID __ClientPSMTextOut; + PVOID __ClientLpkDrawTextEx; + PVOID __ClientExtTextOutW; + PVOID __ClientGetTextExtentPointW; + PVOID __ClientCharToWchar; + PVOID __ClientAddFontResourceW; + PVOID __ClientThreadSetup; + PVOID __ClientDeliverUserApc; + PVOID __ClientNoMemoryPopup; + PVOID __ClientMonitorEnumProc; + PVOID __ClientCallWinEventProc; + PVOID __ClientWaitMessageExMPH; + PVOID __ClientCallDummyCallback4; + PVOID __ClientCallDummyCallback5; + PVOID __ClientImmLoadLayout; + PVOID __ClientImmProcessKey; + PVOID __fnIMECONTROL; + PVOID __fnINWPARAMDBCSCHAR; + PVOID __fnGETTEXTLENGTHS2; + PVOID __ClientCallDummyCallback6; + PVOID __ClientLoadStringW; + PVOID __ClientLoadOLE; + PVOID __ClientRegisterDragDrop; + PVOID __ClientRevokeDragDrop; + PVOID __fnINOUTMENUGETOBJECT; + PVOID __ClientPrinterThunk; + PVOID __fnOUTLPCOMBOBOXINFO; + PVOID __fnOUTLPSCROLLBARINFO; + PVOID __fnINLPUAHDRAWMENU2; + PVOID __fnINLPUAHDRAWMENUITEM; + PVOID __fnINLPUAHDRAWMENU3; + PVOID __fnINOUTLPUAHMEASUREMENUITEM; + PVOID __fnINLPUAHDRAWMENU4; + PVOID __fnOUTLPTITLEBARINFOEX; + PVOID __fnTOUCH; + PVOID __fnGESTURE; + PVOID __fnPOPTINLPUINT4; + PVOID __fnPOPTINLPUINT5; + PVOID __xxxClientCallDefaultInputHandler; + PVOID __fnEMPTY2; + PVOID __ClientRimDevCallback; + PVOID __xxxClientCallMinTouchHitTestingCallback; + PVOID __ClientCallLocalMouseHooks; + PVOID __xxxClientBroadcastThemeChange; + PVOID __xxxClientCallDevCallbackSimple; + PVOID __xxxClientAllocWindowClassExtraBytes; + PVOID __xxxClientFreeWindowClassExtraBytes; + PVOID __fnGETWINDOWDATA; + PVOID __fnINOUTSTYLECHANGE2; + PVOID __fnHkINLPMOUSEHOOKSTRUCTEX2; + PVOID __xxxClientCallDefWindowProc; + PVOID __fnSHELLSYNCDISPLAYCHANGED; + PVOID __fnHkINLPCHARHOOKSTRUCT; + PVOID __fnINTERCEPTEDWINDOWACTION; + PVOID __xxxTooltipCallback; + PVOID __xxxClientInitPSBInfo; + PVOID __xxxClientDoScrollMenu; + PVOID __xxxClientEndScroll; + PVOID __xxxClientDrawSize; + PVOID __xxxClientDrawScrollBar; + PVOID __xxxClientHitTestScrollBar; + PVOID __xxxClientTrackInit; } KERNEL_CALLBACK_TABLE, *PKERNEL_CALLBACK_TABLE; #endif diff --git a/ntwmi.h b/ntwmi.h index f3bc64e..bb08ab8 100644 --- a/ntwmi.h +++ b/ntwmi.h @@ -2156,7 +2156,7 @@ typedef struct _ETW_DISKIO_READWRITE_V2 ULONG DiskNumber; ULONG IrpFlags; ULONG Size; - ULONG Reserved; + ULONG ResponseTime; ULONGLONG ByteOffset; PVOID FileObject; PVOID IrpAddress; @@ -2168,12 +2168,12 @@ typedef struct _ETW_DISKIO_READWRITE_V3 ULONG DiskNumber; ULONG IrpFlags; ULONG Size; - ULONG Reserved; + ULONG ResponseTime; ULONGLONG ByteOffset; PVOID FileObject; PVOID IrpAddress; ULONGLONG HighResResponseTime; - ULONG IssuingThreadId; + ULONG IssuingThreadId; // since WIN8 } ETW_DISKIO_READWRITE_V3, *PETW_DISKIO_READWRITE_V3; typedef struct _ETW_DISKIO_FLUSH_BUFFERS_V2 @@ -2273,6 +2273,12 @@ typedef struct _WMI_FILE_IO WCHAR FileName[1]; } WMI_FILE_IO, *PWMI_FILE_IO; +typedef struct _WMI_FILE_IO_WOW64 +{ + ULONGLONG FileObject; + WCHAR FileName[1]; +} WMI_FILE_IO_WOW64, *PWMI_FILE_IO_WOW64; + typedef struct _WMI_TCPIP_V4 { ULONG ProcessId; @@ -5962,7 +5968,7 @@ typedef enum _ETWTRACECONTROLCODE EtwGetPmcSessions = 46, } ETWTRACECONTROLCODE; -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) NTSYSCALLAPI NTSTATUS NTAPI @@ -5976,7 +5982,7 @@ NtTraceControl( ); #endif -#if (PHNT_VERSION >= PHNT_WINXP) +#if (PHNT_VERSION >= PHNT_WINDOWS_XP) NTSYSCALLAPI NTSTATUS NTAPI @@ -5997,7 +6003,7 @@ typedef struct _TELEMETRY_COVERAGE_POINT ULONG Flags; } TELEMETRY_COVERAGE_POINT, *PTELEMETRY_COVERAGE_POINT; -#if (PHNT_VERSION >= PHNT_REDSTONE3) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3) // rev NTSYSAPI BOOLEAN @@ -6155,7 +6161,6 @@ WmiSetSingleItemW( _In_reads_bytes_(ValueBufferSize) PVOID ValueBuffer ); - NTSYSAPI ULONG NTAPI diff --git a/ntwow64.h b/ntwow64.h index 3b4bf37..6ddc35a 100644 --- a/ntwow64.h +++ b/ntwow64.h @@ -7,6 +7,10 @@ #ifndef _NTWOW64_H #define _NTWOW64_H +#if (PHNT_MODE != PHNT_MODE_KERNEL) +#include +#endif + #define WOW64_SYSTEM_DIRECTORY "SysWOW64" #define WOW64_SYSTEM_DIRECTORY_U L"SysWOW64" #define WOW64_X86_TAG " (x86)" @@ -415,12 +419,13 @@ typedef struct _PEB32 ULONGLONG ExtendedFeatureDisableMask; // since WIN11 } PEB32, *PPEB32; -//C_ASSERT(sizeof(PEB32) == 0x460); // REDSTONE3 -//C_ASSERT(sizeof(PEB32) == 0x470); // REDSTONE5 -C_ASSERT(sizeof(PEB32) == 0x488); // WIN11 +//static_assert(sizeof(PEB32) == 0x460, "sizeof(PEB32) is incorrect"); // REDSTONE3 +//static_assert(sizeof(PEB32) == 0x470, "sizeof(PEB32) is incorrect"); // REDSTONE5 +static_assert(sizeof(PEB32) == 0x488, "sizeof(PEB32) is incorrect"); // WIN11 // Note: Use PhGetProcessPeb32 instead. (dmex) -//#define WOW64_GET_PEB32(peb64) ((PPEB32)PTR_ADD_OFFSET((peb64), ALIGN_UP_BY(sizeof(PEB), PAGE_SIZE))) +//#define WOW64_GET_PEB32(peb64) \ +// ((PPEB32)RtlOffsetToPointer((peb64), ALIGN_UP_BY(sizeof(PEB), PAGE_SIZE))) #define GDI_BATCH_BUFFER_SIZE 310 @@ -577,21 +582,15 @@ typedef struct _TEB32 GUID EffectiveContainerId; } TEB32, *PTEB32; -C_ASSERT(FIELD_OFFSET(TEB32, ProcessEnvironmentBlock) == 0x030); -C_ASSERT(FIELD_OFFSET(TEB32, ExceptionCode) == 0x1a4); -C_ASSERT(FIELD_OFFSET(TEB32, TxFsContext) == 0x1d0); -C_ASSERT(FIELD_OFFSET(TEB32, glContext) == 0xbf0); -C_ASSERT(FIELD_OFFSET(TEB32, StaticUnicodeBuffer) == 0xc00); -C_ASSERT(FIELD_OFFSET(TEB32, TlsLinks) == 0xf10); -C_ASSERT(FIELD_OFFSET(TEB32, DbgSsReserved) == 0xf20); -C_ASSERT(FIELD_OFFSET(TEB32, ActivityId) == 0xf50); -C_ASSERT(FIELD_OFFSET(TEB32, GdiBatchCount) == 0xf70); -C_ASSERT(FIELD_OFFSET(TEB32, TlsExpansionSlots) == 0xf94); -C_ASSERT(FIELD_OFFSET(TEB32, FlsData) == 0xfb4); -C_ASSERT(FIELD_OFFSET(TEB32, MuiImpersonation) == 0xfc4); -C_ASSERT(FIELD_OFFSET(TEB32, ReservedForCrt) == 0xfe8); -C_ASSERT(FIELD_OFFSET(TEB32, EffectiveContainerId) == 0xff0); -C_ASSERT(sizeof(TEB32) == 0x1000); +static_assert(FIELD_OFFSET(TEB32, ProcessEnvironmentBlock) == 0x030, "FIELD_OFFSET(TEB32, ProcessEnvironmentBlock) is incorrect"); +static_assert(FIELD_OFFSET(TEB32, ExceptionCode) == 0x1a4, "FIELD_OFFSET(TEB32, ExceptionCode) is incorrect"); +static_assert(FIELD_OFFSET(TEB32, StaticUnicodeBuffer) == 0xc00, "FIELD_OFFSET(TEB32, StaticUnicodeBuffer) is incorrect"); +static_assert(FIELD_OFFSET(TEB32, TlsLinks) == 0xf10, "FIELD_OFFSET(TEB32, TlsLinks) is incorrect"); +static_assert(FIELD_OFFSET(TEB32, TlsExpansionSlots) == 0xf94, "FIELD_OFFSET(TEB32, TlsExpansionSlots) is incorrect"); +static_assert(FIELD_OFFSET(TEB32, FlsData) == 0xfb4, "FIELD_OFFSET(TEB32, FlsData) is incorrect"); +static_assert(FIELD_OFFSET(TEB32, MuiImpersonation) == 0xfc4, "FIELD_OFFSET(TEB32, MuiImpersonation) is incorrect"); +static_assert(FIELD_OFFSET(TEB32, EffectiveContainerId) == 0xff0, "FIELD_OFFSET(TEB32, EffectiveContainerId) is incorrect"); +static_assert(sizeof(TEB32) == 0x1000, "sizeof(TEB32) is incorrect"); // Conversion @@ -628,7 +627,7 @@ FORCEINLINE VOID UStrToUStr32( // Convert the number of native pages to sub x86-pages // #define Wow64GetNumberOfX86Pages(NativePages) \ - (NativePages * (PAGE_SIZE_X86NT >> PAGE_SHIFT_X86NT)) + ((NativePages) * (PAGE_SIZE_X86NT >> PAGE_SHIFT_X86NT)) // // Macro to round to the nearest page size @@ -648,6 +647,9 @@ FORCEINLINE VOID UStrToUStr32( #define WOW64_GET_TEB32(teb64) ((PTEB32)(((ULONG_PTR)(teb64)) + ((ULONG_PTR)WOW64_ROUND_TO_PAGES(sizeof(TEB))))) #define WOW64_TEB32_POINTER_ADDRESS(teb64) ((PVOID)&(((PTEB)(teb64))->NtTib.ExceptionList)) +// +// Get the 32-bit execute options. +// typedef union _WOW64_EXECUTE_OPTIONS { ULONG Flags; @@ -711,13 +713,14 @@ Wow64CurrentGuestTeb( if (Teb->WowTebOffset < 0) { // - // Was called while running under WoW. The current teb is the guest - // teb. + // Was called while running under WoW. The current teb is the guest teb. // Teb32 = (PTEB32)Teb; +#if defined(RTL_ASSERT) RTL_ASSERT(&Teb32->WowTebOffset == &Teb->WowTebOffset); +#endif } else { @@ -729,7 +732,9 @@ Wow64CurrentGuestTeb( Teb32 = (PTEB32)RtlOffsetToPointer(Teb, Teb->WowTebOffset); } +#if defined(RTL_ASSERT) RTL_ASSERT(Teb32->NtTib.Self == PtrToUlong(Teb32)); +#endif return Teb32; } @@ -765,7 +770,9 @@ Wow64CurrentNativeTeb( HostTeb = (PVOID)RtlOffsetToPointer(Teb, Teb->WowTebOffset); } +#if defined(RTL_ASSERT) RTL_ASSERT((((PTEB32)HostTeb)->NtTib.Self == PtrToUlong(HostTeb)) || ((ULONG_PTR)((PTEB)HostTeb)->NtTib.Self == (ULONG_PTR)HostTeb)); +#endif return HostTeb; } @@ -776,7 +783,7 @@ Wow64CurrentNativeTeb( #define Wow64GetNativeTebField(teb, field) (((ULONG)(teb) == ((PTEB32)(teb))->NtTib.Self) ? (((PTEB32)(teb))->##field) : (((PTEB)(teb))->##field) ) #define Wow64SetNativeTebField(teb, field, value) { if ((ULONG)(teb) == ((PTEB32)(teb))->NtTib.Self) {(((PTEB32)(teb))->##field) = (value);} else {(((PTEB)(teb))->##field) = (value);} } -#endif -#endif +#endif // _M_X64 +#endif // (PHNT_MODE != PHNT_MODE_KERNEL) #endif diff --git a/ntxcapi.h b/ntxcapi.h index 28a85a6..9236ef5 100644 --- a/ntxcapi.h +++ b/ntxcapi.h @@ -31,7 +31,7 @@ RtlRaiseException( _In_ PEXCEPTION_RECORD ExceptionRecord ); -#if (PHNT_VERSION >= PHNT_20H1) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1) // rev NTSYSAPI VOID @@ -50,7 +50,7 @@ RtlRaiseNoncontinuableException( _In_ PEXCEPTION_RECORD ExceptionRecord, _In_ PCONTEXT ContextRecord ); -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10_20H1 NTSYSCALLAPI NTSTATUS @@ -60,7 +60,7 @@ NtContinue( _In_ BOOLEAN TestAlert ); -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) typedef enum _KCONTINUE_TYPE { KCONTINUE_UNWIND, @@ -97,7 +97,7 @@ NtContinueEx( //{ // return NtContinueEx(ContextRecord, (PCONTINUE_ARGUMENT)TestAlert); //} -#endif +#endif // PHNT_VERSION >= PHNT_WINDOWS_10 NTSYSCALLAPI NTSTATUS @@ -109,7 +109,7 @@ NtRaiseException( ); _Analysis_noreturn_ -NTSYSCALLAPI +NTSYSAPI DECLSPEC_NORETURN VOID NTAPI diff --git a/ntzwapi.h b/ntzwapi.h index 6a9e5f8..27d49a1 100644 --- a/ntzwapi.h +++ b/ntzwapi.h @@ -2297,6 +2297,16 @@ ZwMakeTemporaryObject( _In_ HANDLE Handle ); +NTSYSCALLAPI +NTSTATUS +NTAPI +ZwManageHotPatch( + _In_ HOT_PATCH_INFORMATION_CLASS HotPatchInformationClass, + _Out_writes_bytes_opt_(HotPatchInformationLength) PVOID HotPatchInformation, + _In_ ULONG HotPatchInformationLength, + _Out_opt_ PULONG ReturnLength + ); + NTSYSCALLAPI NTSTATUS NTAPI diff --git a/phnt.h b/phnt.h index 1acd674..db0a3d2 100644 --- a/phnt.h +++ b/phnt.h @@ -30,57 +30,60 @@ #define PHNT_MODE_USER 1 // Version -#define PHNT_WIN2K 50 -#define PHNT_WINXP 51 -#define PHNT_WS03 52 -#define PHNT_VISTA 60 -#define PHNT_WIN7 61 -#define PHNT_WIN8 62 -#define PHNT_WINBLUE 63 -#define PHNT_THRESHOLD 100 -#define PHNT_THRESHOLD2 101 -#define PHNT_REDSTONE 102 -#define PHNT_REDSTONE2 103 -#define PHNT_REDSTONE3 104 -#define PHNT_REDSTONE4 105 -#define PHNT_REDSTONE5 106 -#define PHNT_19H1 107 -#define PHNT_19H2 108 -#define PHNT_20H1 109 -#define PHNT_20H2 110 -#define PHNT_21H1 111 -#define PHNT_WIN10_21H2 112 -#define PHNT_WIN10_22H2 113 -#define PHNT_WIN11 114 -#define PHNT_WIN11_22H2 115 -#define PHNT_WIN11_23H2 116 -#define PHNT_WIN11_24H2 117 +#define PHNT_WINDOWS_ANCIENT 0 +#define PHNT_WINDOWS_XP 51 // August, 2001 +#define PHNT_WINDOWS_SERVER_2003 52 // April, 2003 +#define PHNT_WINDOWS_VISTA 60 // November, 2006 +#define PHNT_WINDOWS_7 61 // July, 2009 +#define PHNT_WINDOWS_8 62 // August, 2012 +#define PHNT_WINDOWS_8_1 63 // August, 2013 +#define PHNT_WINDOWS_10 100 // July, 2015 // Version 1507, Build 10240 +#define PHNT_WINDOWS_10_TH2 101 // November, 2015 // Version 1511, Build 10586 +#define PHNT_WINDOWS_10_RS1 102 // August, 2016 // Version 1607, Build 14393 +#define PHNT_WINDOWS_10_RS2 103 // April, 2017 // Version 1703, Build 15063 +#define PHNT_WINDOWS_10_RS3 104 // October, 2017 // Version 1709, Build 16299 +#define PHNT_WINDOWS_10_RS4 105 // April, 2018 // Version 1803, Build 17134 +#define PHNT_WINDOWS_10_RS5 106 // November, 2018 // Version 1809, Build 17763 +#define PHNT_WINDOWS_10_19H1 107 // May, 2019 // Version 1903, Build 18362 +#define PHNT_WINDOWS_10_19H2 108 // November, 2019 // Version 1909, Build 18363 +#define PHNT_WINDOWS_10_20H1 109 // May, 2020 // Version 2004, Build 19041 +#define PHNT_WINDOWS_10_20H2 110 // October, 2020 // Build 19042 +#define PHNT_WINDOWS_10_21H1 111 // May, 2021 // Build 19043 +#define PHNT_WINDOWS_10_21H2 112 // November, 2021 // Build 19044 +#define PHNT_WINDOWS_10_22H2 113 // October, 2022 // Build 19045 +#define PHNT_WINDOWS_11 114 // October, 2021 // Build 22000 +#define PHNT_WINDOWS_11_22H2 115 // September, 2022 // Build 22621 +#define PHNT_WINDOWS_11_23H2 116 // October, 2023 // Build 22631 +#define PHNT_WINDOWS_11_24H2 117 // October, 2024 // Build 26100 +#define PHNT_WINDOWS_NEW ULONG_MAX #ifndef PHNT_MODE #define PHNT_MODE PHNT_MODE_USER #endif #ifndef PHNT_VERSION -#define PHNT_VERSION PHNT_WIN11_24H2 +#define PHNT_VERSION PHNT_WINDOWS_NEW #endif +// // Options +// #if (PHNT_MODE != PHNT_MODE_KERNEL) +//#ifndef PHNT_NO_INLINE_INIT_STRING //#define PHNT_NO_INLINE_INIT_STRING +//#endif // !PHNT_NO_INLINE_INIT_STRING #ifndef PHNT_INLINE_TYPEDEFS #define PHNT_INLINE_TYPEDEFS -#endif -#endif +#endif // !PHNT_INLINE_TYPEDEFS +#endif // (PHNT_MODE != PHNT_MODE_KERNEL) -#ifdef __cplusplus -extern "C" { -#endif +EXTERN_C_START #if (PHNT_MODE != PHNT_MODE_KERNEL) #include #include -#endif +#endif // (PHNT_MODE != PHNT_MODE_KERNEL) #include #include @@ -93,29 +96,28 @@ extern "C" { #if (PHNT_MODE != PHNT_MODE_KERNEL) #include +#include #include +#include #include +#include #include #include #include #include #include -#include +#include #include #include #include -#include -#include -#include -#include -#include +#include #include +#include +#include #include -#endif +#endif // (PHNT_MODE != PHNT_MODE_KERNEL) -#ifdef __cplusplus -} -#endif +EXTERN_C_END static_assert(__alignof(LARGE_INTEGER) == 8, "Windows headers require the default packing option. Changing the packing can lead to memory corruption."); static_assert(__alignof(PROCESS_CYCLE_TIME_INFORMATION) == 8, "PHNT headers require the default packing option. Changing the packing can lead to memory corruption."); diff --git a/phnt_ntdef.h b/phnt_ntdef.h index adccbc6..941baa6 100644 --- a/phnt_ntdef.h +++ b/phnt_ntdef.h @@ -117,10 +117,40 @@ typedef struct _ULARGE_INTEGER_128 // Functions // -#ifndef _WIN64 -#define FASTCALL __fastcall -#else +#if defined(_WIN64) #define FASTCALL +#else +#define FASTCALL __fastcall +#endif + +#if defined(_WIN64) +#define POINTER_ALIGNMENT DECLSPEC_ALIGN(8) +#else +#define POINTER_ALIGNMENT +#endif + +#if defined(_WIN64) || defined(_M_ALPHA) +#define MAX_NATURAL_ALIGNMENT sizeof(ULONGLONG) +#define MEMORY_ALLOCATION_ALIGNMENT 16 +#else +#define MAX_NATURAL_ALIGNMENT sizeof(DWORD) +#define MEMORY_ALLOCATION_ALIGNMENT 8 +#endif + +#ifndef DECLSPEC_NOALIAS +#if _MSC_VER < 1900 +#define DECLSPEC_NOALIAS +#else +#define DECLSPEC_NOALIAS __declspec(noalias) +#endif +#endif + +#ifndef DECLSPEC_IMPORT +#define DECLSPEC_IMPORT __declspec(dllimport) +#endif + +#ifndef DECLSPEC_EXPORT +#define DECLSPEC_EXPORT __declspec(dllexport) #endif // @@ -192,7 +222,9 @@ UNICODE_STRING _var = { 0, (_size) * sizeof(WCHAR) , _var ## _buffer } // Balanced tree node // +#ifndef RTL_BALANCED_NODE_RESERVED_PARENT_MASK #define RTL_BALANCED_NODE_RESERVED_PARENT_MASK 3 +#endif typedef struct _RTL_BALANCED_NODE { @@ -203,18 +235,20 @@ typedef struct _RTL_BALANCED_NODE { struct _RTL_BALANCED_NODE *Left; struct _RTL_BALANCED_NODE *Right; - }; - }; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; union { UCHAR Red : 1; UCHAR Balance : 2; ULONG_PTR ParentValue; - }; + } DUMMYUNIONNAME2; } RTL_BALANCED_NODE, *PRTL_BALANCED_NODE; +#ifndef RTL_BALANCED_NODE_GET_PARENT_POINTER #define RTL_BALANCED_NODE_GET_PARENT_POINTER(Node) \ ((PRTL_BALANCED_NODE)((Node)->ParentValue & ~RTL_BALANCED_NODE_RESERVED_PARENT_MASK)) +#endif // // Portability @@ -418,20 +452,67 @@ typedef struct _KSYSTEM_TIME #define PtrOffset(B,O) ((ULONG)((ULONG_PTR)(O) - (ULONG_PTR)(B))) #endif +#ifndef ALIGN_UP_BY +#define ALIGN_UP_BY(Address, Align) (((ULONG_PTR)(Address) + (Align) - 1) & ~((Align) - 1)) +#endif +#ifndef ALIGN_UP_POINTER_BY +#define ALIGN_UP_POINTER_BY(Pointer, Align) ((PVOID)ALIGN_UP_BY(Pointer, Align)) +#endif +#ifndef ALIGN_UP +#define ALIGN_UP(Address, Type) ALIGN_UP_BY(Address, sizeof(Type)) +#endif +#ifndef ALIGN_UP_POINTER +#define ALIGN_UP_POINTER(Pointer, Type) ((PVOID)ALIGN_UP(Pointer, Type)) +#endif +#ifndef ALIGN_DOWN_BY +#define ALIGN_DOWN_BY(Address, Align) ((ULONG_PTR)(Address) & ~((ULONG_PTR)(Align) - 1)) +#endif +#ifndef ALIGN_DOWN_POINTER_BY +#define ALIGN_DOWN_POINTER_BY(Pointer, Align) ((PVOID)ALIGN_DOWN_BY(Pointer, Align)) +#endif +#ifndef ALIGN_DOWN +#define ALIGN_DOWN(Address, Type) ALIGN_DOWN_BY(Address, sizeof(Type)) +#endif +#ifndef ALIGN_DOWN_POINTER +#define ALIGN_DOWN_POINTER(Pointer, Type) ((PVOID)ALIGN_DOWN(Pointer, Type)) +#endif +#ifndef IS_ALIGNED +#define IS_ALIGNED(Pointer, Alignment) ((((ULONG_PTR)(Pointer)) & ((Alignment) - 1)) == 0) #endif -#if defined(_WIN64) -#define POINTER_ALIGNMENT DECLSPEC_ALIGN(8) -#else -#define POINTER_ALIGNMENT +#ifndef PAGE_SIZE +#define PAGE_SIZE 0x1000 +#endif +#ifndef PAGE_MASK +#define PAGE_MASK 0xFFF +#endif +#ifndef PAGE_SHIFT +#define PAGE_SHIFT 0xC #endif -#ifndef DECLSPEC_NOALIAS -#if _MSC_VER < 1900 -#define DECLSPEC_NOALIAS -#else -#define DECLSPEC_NOALIAS __declspec(noalias) +#ifndef BYTE_OFFSET +#define BYTE_OFFSET(Address) ((SIZE_T)((ULONG_PTR)(Address) & PAGE_MASK)) #endif +#ifndef PAGE_ALIGN +#define PAGE_ALIGN(Address) ((PVOID)((ULONG_PTR)(Address) & ~PAGE_MASK)) +#endif +#ifndef PAGE_OFFSET +#define PAGE_OFFSET(p) ((PAGE_MASK) & (ULONG_PTR)(p)) #endif +#ifndef ADDRESS_AND_SIZE_TO_SPAN_PAGES +#define ADDRESS_AND_SIZE_TO_SPAN_PAGES(Address, Size) ((BYTE_OFFSET(Address) + ((SIZE_T)(Size)) + PAGE_MASK) >> PAGE_SHIFT) +#endif +#ifndef ROUND_TO_SIZE +#define ROUND_TO_SIZE(Size, Alignment) ((((ULONG_PTR)(Size))+((Alignment)-1)) & ~(ULONG_PTR)((Alignment)-1)) +#endif +#ifndef ROUND_TO_PAGES +#define ROUND_TO_PAGES(Size) (((ULONG_PTR)(Size) + PAGE_MASK) & ~PAGE_MASK) +#endif +#ifndef BYTES_TO_PAGES +#define BYTES_TO_PAGES(Size) (((Size) >> PAGE_SHIFT) + (((Size) & PAGE_MASK) != 0)) +#endif + +#endif // _NTDEF_ + #endif diff --git a/phnt_windows.h b/phnt_windows.h index 6f1fa3e..307e72f 100644 --- a/phnt_windows.h +++ b/phnt_windows.h @@ -164,14 +164,8 @@ typedef GUID *PGUID; typedef const GUID* PCGUID; #endif +#ifndef GUID_NULL DEFINE_GUID(GUID_NULL, 0x00000000L, 0x0000, 0x0000, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00); - -#if __STDC_VERSION__ >= 202311L -#ifndef __cplusplus -#define nullptr ((void *)0) #endif -typedef typeof(nullptr) nullptr_t; -#endif -#include #endif diff --git a/subprocesstag.h b/subprocesstag.h index bec1e4b..4161ce5 100644 --- a/subprocesstag.h +++ b/subprocesstag.h @@ -23,14 +23,14 @@ typedef enum _TAG_TYPE typedef struct _TAG_INFO_NAME_FROM_TAG_IN_PARAMS { - ULONG dwPid; - ULONG dwTag; + ULONG ProcessId; + ULONG ServiceTag; } TAG_INFO_NAME_FROM_TAG_IN_PARAMS, *PTAG_INFO_NAME_FROM_TAG_IN_PARAMS; typedef struct _TAG_INFO_NAME_FROM_TAG_OUT_PARAMS { - ULONG eTagType; - PWSTR pszName; + ULONG TagType; + PCWSTR Name; } TAG_INFO_NAME_FROM_TAG_OUT_PARAMS, *PTAG_INFO_NAME_FROM_TAG_OUT_PARAMS; typedef struct _TAG_INFO_NAME_FROM_TAG @@ -41,14 +41,14 @@ typedef struct _TAG_INFO_NAME_FROM_TAG typedef struct _TAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS { - ULONG dwPid; - PCWSTR pszModule; + ULONG ProcessId; + PCWSTR ModuleName; } TAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS, *PTAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS; typedef struct _TAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS { - ULONG eTagType; - PCWSTR pmszNames; + ULONG TagType; + PCWSTR Names; } TAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS, *PTAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS; typedef struct _TAG_INFO_NAMES_REFERENCING_MODULE @@ -59,21 +59,21 @@ typedef struct _TAG_INFO_NAMES_REFERENCING_MODULE typedef struct _TAG_INFO_NAME_TAG_MAPPING_IN_PARAMS { - ULONG dwPid; + ULONG ProcessId; } TAG_INFO_NAME_TAG_MAPPING_IN_PARAMS, *PTAG_INFO_NAME_TAG_MAPPING_IN_PARAMS; typedef struct _TAG_INFO_NAME_TAG_MAPPING_ELEMENT { - ULONG eTagType; - ULONG dwTag; - PWSTR pszName; - PWSTR pszGroupName; + ULONG TagType; + ULONG Tag; + PCWSTR Name; + PCWSTR GroupName; } TAG_INFO_NAME_TAG_MAPPING_ELEMENT, *PTAG_INFO_NAME_TAG_MAPPING_ELEMENT; typedef struct _TAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS { - ULONG cElements; - PTAG_INFO_NAME_TAG_MAPPING_ELEMENT pNameTagMappingElements; + ULONG Count; + PTAG_INFO_NAME_TAG_MAPPING_ELEMENT NameTagMappingElements; } TAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS, *PTAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS; typedef struct _TAG_INFO_NAME_TAG_MAPPING @@ -83,18 +83,21 @@ typedef struct _TAG_INFO_NAME_TAG_MAPPING } TAG_INFO_NAME_TAG_MAPPING, *PTAG_INFO_NAME_TAG_MAPPING; _Must_inspect_result_ +NTSYSAPI ULONG -WINAPI +NTAPI I_QueryTagInformation( _In_opt_ PCWSTR MachineName, _In_ TAG_INFO_LEVEL InfoLevel, _Inout_ PVOID TagInfo ); -typedef ULONG (WINAPI *PQUERY_TAG_INFORMATION)( +typedef _Function_class_(QUERY_TAG_INFORMATION) +ULONG NTAPI QUERY_TAG_INFORMATION( _In_opt_ PCWSTR MachineName, _In_ TAG_INFO_LEVEL InfoLevel, _Inout_ PVOID TagInfo ); +typedef QUERY_TAG_INFORMATION *PQUERY_TAG_INFORMATION; #endif diff --git a/usermgr.h b/usermgr.h index 5bbecbd..e69fcdf 100644 --- a/usermgr.h +++ b/usermgr.h @@ -28,7 +28,7 @@ typedef struct _CRED_PROV_CREDENTIAL // Contexts -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev USERMGRAPI @@ -78,7 +78,7 @@ UMgrQueryUserContextFromName( // Tokens -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev USERMGRAPI @@ -137,7 +137,7 @@ UMgrGetConstrainedUserToken( #endif -#if (PHNT_VERSION >= PHNT_THRESHOLD2) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_TH2) // rev USERMGRAPI @@ -159,7 +159,7 @@ UMgrGetImpersonationTokenForContext( #endif -#if (PHNT_VERSION >= PHNT_REDSTONE) +#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS1) // rev USERMGRAPI @@ -174,7 +174,7 @@ UMgrGetSessionActiveShellUserToken( // Single-session SKU -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev USERMGRAPI @@ -199,7 +199,7 @@ UMgrOpenProcessHandleForAccess( // Credentials -#if (PHNT_VERSION >= PHNT_THRESHOLD) +#if (PHNT_VERSION >= PHNT_WINDOWS_10) // rev USERMGRAPI diff --git a/winsta.h b/winsta.h index f5a9b0e..e7361ff 100644 --- a/winsta.h +++ b/winsta.h @@ -1097,7 +1097,7 @@ WinStationGetProcessSid( // Services isolation -#if (PHNT_VERSION >= PHNT_VISTA) +#if (PHNT_VERSION >= PHNT_WINDOWS_VISTA) // rev NTSYSAPI