diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..8c535f6 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,45 @@ +# Auto detect text files +* text=crlf + +# Custom for Visual Studio +*.cs diff=csharp +*.sln merge=union +*.csproj merge=union +*.vbproj merge=union +*.fsproj merge=union +*.dbproj merge=union + +# Project files +*.bat eol=crlf +*.c eol=crlf +*.cs eol=crlf +*.config eol=crlf +*.cmd eol=crlf +*.csproj eol=crlf +*.def eol=crlf +*.h eol=crlf +*.manifest eol=crlf +*.resx eol=crlf +*.rc eol=crlf +*.sln eol=crlf +*.txt eol=crlf +*.vcxproj eol=crlf + +# Standard to msysgit +*.doc diff=astextplain +*.DOC diff=astextplain +*.docx diff=astextplain +*.DOCX diff=astextplain +*.dot diff=astextplain +*.DOT diff=astextplain +*.pdf diff=astextplain +*.PDF diff=astextplain +*.rtf diff=astextplain +*.RTF diff=astextplain + +# Ignore files during repository export +.gitattributes export-ignore +.gitignore export-ignore +.gitmodules export-ignore +appveyor.yml export-ignore +Doxyfile export-ignore \ No newline at end of file diff --git a/ntexapi.h b/ntexapi.h index 5e43866..fac17d6 100644 --- a/ntexapi.h +++ b/ntexapi.h @@ -1292,7 +1292,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemComPlusPackage, // q; s SystemNumaAvailableMemory, // 60 SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION - SystemEmulationBasicInformation, // q + SystemEmulationBasicInformation, SystemEmulationProcessorInformation, SystemExtendedHandleInformation, // q: SYSTEM_HANDLE_INFORMATION_EX SystemLostDelayedWriteInformation, // q: ULONG @@ -1331,7 +1331,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemSystemPartitionInformation, // q: SYSTEM_SYSTEM_PARTITION_INFORMATION SystemSystemDiskInformation, // q: SYSTEM_SYSTEM_DISK_INFORMATION SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION // 100 - SystemNumaProximityNodeInformation, // q + SystemNumaProximityNodeInformation, SystemDynamicTimeZoneInformation, // q; s (requires SeTimeZonePrivilege) SystemCodeIntegrityInformation, // q: SYSTEM_CODEINTEGRITY_INFORMATION // SeCodeIntegrityQueryInformation SystemProcessorMicrocodeUpdateInformation, // s @@ -1339,7 +1339,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemVirtualAddressInformation, // q: SYSTEM_VA_LIST_INFORMATION[]; s: SYSTEM_VA_LIST_INFORMATION[] (requires SeIncreaseQuotaPrivilege) // MmQuerySystemVaInformation SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // since WIN7 // KeQueryLogicalProcessorRelationship SystemProcessorCycleTimeInformation, // q: SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[] - SystemStoreInformation, // q; s // SmQueryStoreInformation + SystemStoreInformation, // q; s: SYSTEM_STORE_INFORMATION // SmQueryStoreInformation SystemRegistryAppendString, // s: SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // 110 SystemAitSamplingValue, // s: ULONG (requires SeProfileSingleProcessPrivilege) SystemVhdBootInformation, // q: SYSTEM_VHD_BOOT_INFORMATION @@ -1351,7 +1351,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemVerifierCountersInformation, // q: SYSTEM_VERIFIER_COUNTERS_INFORMATION SystemPagedPoolInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypePagedPool) SystemSystemPtesInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemPtes) // 120 - SystemNodeDistanceInformation, // q + SystemNodeDistanceInformation, SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26 SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1 @@ -1381,7 +1381,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemFullProcessInformation, // q: SYSTEM_PROCESS_INFORMATION with SYSTEM_PROCESS_INFORMATION_EXTENSION (requires admin) SystemKernelDebuggerInformationEx, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX SystemBootMetadataInformation, // 150 - SystemSoftRebootInformation, + SystemSoftRebootInformation, // q: ULONG SystemElamCertificateInformation, // s: SYSTEM_ELAM_CERTIFICATE_INFORMATION SystemOfflineDumpConfigInformation, SystemProcessorFeaturesInformation, // q: SYSTEM_PROCESSOR_FEATURES_INFORMATION @@ -1393,7 +1393,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemProcessorCycleStatsInformation, // q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION // 160 SystemVmGenerationCountInformation, SystemTrustedPlatformModuleInformation, // q: SYSTEM_TPM_INFORMATION - SystemKernelDebuggerFlags, + SystemKernelDebuggerFlags, // SYSTEM_KERNEL_DEBUGGER_FLAGS SystemCodeIntegrityPolicyInformation, // q: SYSTEM_CODEINTEGRITYPOLICY_INFORMATION SystemIsolatedUserModeInformation, // q: SYSTEM_ISOLATED_USER_MODE_INFORMATION SystemHardwareSecurityTestInterfaceResultsInformation, @@ -1416,28 +1416,28 @@ typedef enum _SYSTEM_INFORMATION_CLASS SystemCodeIntegrityCertificateInformation, // q: SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION SystemPhysicalMemoryInformation, // q: SYSTEM_PHYSICAL_MEMORY_INFORMATION // since REDSTONE2 SystemControlFlowTransition, - SystemKernelDebuggingAllowed, + SystemKernelDebuggingAllowed, // s: ULONG SystemActivityModerationExeState, // SYSTEM_ACTIVITY_MODERATION_EXE_STATE SystemActivityModerationUserSettings, // SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS SystemCodeIntegrityPoliciesFullInformation, SystemCodeIntegrityUnlockInformation, // SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION // 190 SystemIntegrityQuotaInformation, SystemFlushInformation, // q: SYSTEM_FLUSH_INFORMATION - SystemProcessorIdleMaskInformation, // since REDSTONE3 + SystemProcessorIdleMaskInformation, // q: ULONG_PTR // since REDSTONE3 SystemSecureDumpEncryptionInformation, SystemWriteConstraintInformation, // SYSTEM_WRITE_CONSTRAINT_INFORMATION SystemKernelVaShadowInformation, // SYSTEM_KERNEL_VA_SHADOW_INFORMATION SystemHypervisorSharedPageInformation, // SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION // since REDSTONE4 SystemFirmwareBootPerformanceInformation, SystemCodeIntegrityVerificationInformation, // SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION - SystemFirmwarePartitionInformation, // 200 + SystemFirmwarePartitionInformation, // SYSTEM_FIRMWARE_PARTITION_INFORMATION // 200 SystemSpeculationControlInformation, // SYSTEM_SPECULATION_CONTROL_INFORMATION // (CVE-2017-5715) REDSTONE3 and above. SystemDmaGuardPolicyInformation, // SYSTEM_DMA_GUARD_POLICY_INFORMATION SystemEnclaveLaunchControlInformation, // SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION SystemWorkloadAllowedCpuSetsInformation, // SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION // since REDSTONE5 SystemCodeIntegrityUnlockModeInformation, SystemLeapSecondInformation, // SYSTEM_LEAP_SECOND_INFORMATION - SystemFlags2Information, + SystemFlags2Information, // q: SYSTEM_FLAGS_INFORMATION SystemSecurityModelInformation, // SYSTEM_SECURITY_MODEL_INFORMATION // since 19H1 SystemCodeIntegritySyntheticCacheInformation, MaxSystemInfoClass @@ -2486,6 +2486,38 @@ typedef struct _SYSTEM_VA_LIST_INFORMATION SIZE_T AllocationFailures; } SYSTEM_VA_LIST_INFORMATION, *PSYSTEM_VA_LIST_INFORMATION; +// rev +typedef enum _SYSTEM_STORE_INFORMATION_CLASS +{ + SystemStoreCompressionInformation = 22 // q: SYSTEM_STORE_COMPRESSION_INFORMATION +} SYSTEM_STORE_INFORMATION_CLASS; + +// rev +#define SYSTEM_STORE_INFORMATION_VERSION 1 + +// rev +typedef struct _SYSTEM_STORE_INFORMATION +{ + _In_ ULONG Version; + _In_ SYSTEM_STORE_INFORMATION_CLASS StoreInformationClass; + _Inout_ PVOID Data; + _Inout_ ULONG Length; +} SYSTEM_STORE_INFORMATION, *PSYSTEM_STORE_INFORMATION; + +// rev +#define SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION 3 + +// rev +typedef struct _SYSTEM_STORE_COMPRESSION_INFORMATION +{ + ULONG Version; + ULONG CompressionPid; + ULONGLONG CompressionWorkingSetSize; + ULONGLONG CompressSize; + ULONGLONG CompressedSize; + ULONGLONG NonCompressedSize; +} SYSTEM_STORE_COMPRESSION_INFORMATION, *PSYSTEM_STORE_COMPRESSION_INFORMATION; + // private typedef struct _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS { @@ -3052,6 +3084,12 @@ typedef struct _SYSTEM_VSM_PROTECTION_INFORMATION BOOLEAN HardwareMbecAvailable; // REDSTONE4 (CVE-2018-3639) } SYSTEM_VSM_PROTECTION_INFORMATION, *PSYSTEM_VSM_PROTECTION_INFORMATION; +// private +typedef struct _SYSTEM_KERNEL_DEBUGGER_FLAGS +{ + UCHAR KernelDebuggerIgnoreUmExceptions; +} SYSTEM_KERNEL_DEBUGGER_FLAGS, *PSYSTEM_KERNEL_DEBUGGER_FLAGS; + // private typedef struct _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION { @@ -3284,6 +3322,12 @@ typedef struct _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION PVOID HypervisorSharedUserVa; } SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION, *PSYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION; +// private +typedef struct _SYSTEM_FIRMWARE_PARTITION_INFORMATION +{ + UNICODE_STRING FirmwarePartition; +} SYSTEM_FIRMWARE_PARTITION_INFORMATION, *PSYSTEM_FIRMWARE_PARTITION_INFORMATION; + // private typedef struct _SYSTEM_SPECULATION_CONTROL_INFORMATION { diff --git a/ntioapi.h b/ntioapi.h index 17b5434..9c556c1 100644 --- a/ntioapi.h +++ b/ntioapi.h @@ -244,22 +244,22 @@ typedef enum _FILE_INFORMATION_CLASS FileLinkInformationBypassAccessCheck, // (kernel-mode only); FILE_LINK_INFORMATION FileVolumeNameInformation, // FILE_VOLUME_NAME_INFORMATION FileIdInformation, // FILE_ID_INFORMATION - FileIdExtdDirectoryInformation, // FILE_ID_EXTD_DIR_INFORMATION + FileIdExtdDirectoryInformation, // FILE_ID_EXTD_DIR_INFORMATION // 60 FileReplaceCompletionInformation, // FILE_COMPLETION_INFORMATION // since WINBLUE FileHardLinkFullIdInformation, // FILE_LINK_ENTRY_FULL_ID_INFORMATION FileIdExtdBothDirectoryInformation, // FILE_ID_EXTD_BOTH_DIR_INFORMATION // since THRESHOLD FileDispositionInformationEx, // FILE_DISPOSITION_INFO_EX // since REDSTONE - FileRenameInformationEx, - FileRenameInformationExBypassAccessCheck, + FileRenameInformationEx, // FILE_RENAME_INFORMATION + FileRenameInformationExBypassAccessCheck, // FILE_RENAME_INFORMATION FileDesiredStorageClassInformation, // FILE_DESIRED_STORAGE_CLASS_INFORMATION // since REDSTONE2 FileStatInformation, // FILE_STAT_INFORMATION FileMemoryPartitionInformation, // FILE_MEMORY_PARTITION_INFORMATION // since REDSTONE3 - FileStatLxInformation, // FILE_STAT_LX_INFORMATION // since REDSTONE4 + FileStatLxInformation, // FILE_STAT_LX_INFORMATION // since REDSTONE4 // 70 FileCaseSensitiveInformation, // FILE_CASE_SENSITIVE_INFORMATION - FileLinkInformationEx, // since REDSTONE5 - FileLinkInformationExBypassAccessCheck, - FileStorageReserveIdInformation, - FileCaseSensitiveInformationForceAccessCheck, + FileLinkInformationEx, // FILE_LINK_INFORMATION // since REDSTONE5 + FileLinkInformationExBypassAccessCheck, // FILE_LINK_INFORMATION + FileStorageReserveIdInformation, // FILE_SET_STORAGE_RESERVE_ID_INFORMATION + FileCaseSensitiveInformationForceAccessCheck, // FILE_CASE_SENSITIVE_INFORMATION FileMaximumInformation } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS; @@ -938,7 +938,7 @@ typedef enum _FSINFOCLASS FileFsFullSizeInformation, // FILE_FS_FULL_SIZE_INFORMATION FileFsObjectIdInformation, // FILE_FS_OBJECTID_INFORMATION FileFsDriverPathInformation, // FILE_FS_DRIVER_PATH_INFORMATION - FileFsVolumeFlagsInformation, // FILE_FS_VOLUME_FLAGS_INFORMATION + FileFsVolumeFlagsInformation, // FILE_FS_VOLUME_FLAGS_INFORMATION // 10 FileFsSectorSizeInformation, // FILE_FS_SECTOR_SIZE_INFORMATION // since WIN8 FileFsDataCopyInformation, // FILE_FS_DATA_COPY_INFORMATION FileFsMetadataSizeInformation, // FILE_FS_METADATA_SIZE_INFORMATION // since THRESHOLD @@ -948,12 +948,7 @@ typedef enum _FSINFOCLASS // NtQueryVolumeInformation/NtSetVolumeInformation types -typedef struct _FILE_FS_LABEL_INFORMATION -{ - ULONG VolumeLabelLength; - WCHAR VolumeLabel[1]; -} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION; - +// private typedef struct _FILE_FS_VOLUME_INFORMATION { LARGE_INTEGER VolumeCreationTime; @@ -963,6 +958,14 @@ typedef struct _FILE_FS_VOLUME_INFORMATION WCHAR VolumeLabel[1]; } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION; +// private +typedef struct _FILE_FS_LABEL_INFORMATION +{ + ULONG VolumeLabelLength; + WCHAR VolumeLabel[1]; +} FILE_FS_LABEL_INFORMATION, * PFILE_FS_LABEL_INFORMATION; + +// private typedef struct _FILE_FS_SIZE_INFORMATION { LARGE_INTEGER TotalAllocationUnits; @@ -982,6 +985,7 @@ typedef struct _FILE_FS_CONTROL_INFORMATION ULONG FileSystemControlFlags; } FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION; +// private typedef struct _FILE_FS_FULL_SIZE_INFORMATION { LARGE_INTEGER TotalAllocationUnits; @@ -991,18 +995,21 @@ typedef struct _FILE_FS_FULL_SIZE_INFORMATION ULONG BytesPerSector; } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION; +// private typedef struct _FILE_FS_OBJECTID_INFORMATION { UCHAR ObjectId[16]; UCHAR ExtendedInfo[48]; } FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION; +// private typedef struct _FILE_FS_DEVICE_INFORMATION { DEVICE_TYPE DeviceType; ULONG Characteristics; } FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION; +// private typedef struct _FILE_FS_ATTRIBUTE_INFORMATION { ULONG FileSystemAttributes; @@ -1011,6 +1018,7 @@ typedef struct _FILE_FS_ATTRIBUTE_INFORMATION WCHAR FileSystemName[1]; } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION; +// private typedef struct _FILE_FS_DRIVER_PATH_INFORMATION { BOOLEAN DriverInPath; @@ -1018,6 +1026,7 @@ typedef struct _FILE_FS_DRIVER_PATH_INFORMATION WCHAR DriverName[1]; } FILE_FS_DRIVER_PATH_INFORMATION, *PFILE_FS_DRIVER_PATH_INFORMATION; +// private typedef struct _FILE_FS_VOLUME_FLAGS_INFORMATION { ULONG Flags; @@ -1180,17 +1189,6 @@ NtQueryInformationFile( _In_ FILE_INFORMATION_CLASS FileInformationClass ); -NTSYSCALLAPI -NTSTATUS -NTAPI -NtSetInformationFile( - _In_ HANDLE FileHandle, - _Out_ PIO_STATUS_BLOCK IoStatusBlock, - _In_reads_bytes_(Length) PVOID FileInformation, - _In_ ULONG Length, - _In_ FILE_INFORMATION_CLASS FileInformationClass - ); - #if (PHNT_VERSION >= PHNT_REDSTONE2) NTSYSCALLAPI NTSTATUS @@ -1204,6 +1202,17 @@ NtQueryInformationByName( ); #endif +NTSYSCALLAPI +NTSTATUS +NTAPI +NtSetInformationFile( + _In_ HANDLE FileHandle, + _Out_ PIO_STATUS_BLOCK IoStatusBlock, + _In_reads_bytes_(Length) PVOID FileInformation, + _In_ ULONG Length, + _In_ FILE_INFORMATION_CLASS FileInformationClass + ); + NTSYSCALLAPI NTSTATUS NTAPI @@ -1473,6 +1482,31 @@ NtNotifyChangeDirectoryFile( _In_ BOOLEAN WatchTree ); +// private +typedef enum _DIRECTORY_NOTIFY_INFORMATION_CLASS +{ + DirectoryNotifyInformation, // FILE_NOTIFY_INFORMATION + DirectoryNotifyExtendedInformation // FILE_NOTIFY_EXTENDED_INFORMATION +} DIRECTORY_NOTIFY_INFORMATION_CLASS, *PDIRECTORY_NOTIFY_INFORMATION_CLASS; + +#if (PHNT_VERSION >= PHNT_REDSTONE3) +NTSYSCALLAPI +NTSTATUS +NTAPI +NtNotifyChangeDirectoryFileEx( + _In_ HANDLE FileHandle, + _In_opt_ HANDLE Event, + _In_opt_ PIO_APC_ROUTINE ApcRoutine, + _In_opt_ PVOID ApcContext, + _Out_ PIO_STATUS_BLOCK IoStatusBlock, + _Out_writes_bytes_(Length) PVOID Buffer, + _In_ ULONG Length, + _In_ ULONG CompletionFilter, + _In_ BOOLEAN WatchTree, + _In_opt_ DIRECTORY_NOTIFY_INFORMATION_CLASS DirectoryNotifyInformationClass + ); +#endif + NTSYSCALLAPI NTSTATUS NTAPI diff --git a/ntlpcapi.h b/ntlpcapi.h index 5e36f30..a18d39c 100644 --- a/ntlpcapi.h +++ b/ntlpcapi.h @@ -497,7 +497,7 @@ typedef struct _ALPC_HANDLE_ATTR } ALPC_HANDLE_ATTR, *PALPC_HANDLE_ATTR; #define ALPC_SECFLG_CREATE_HANDLE 0x20000 // dbg - +#define ALPC_SECFLG_NOSECTIONHANDLE 0x40000 // private typedef struct _ALPC_SECURITY_ATTR { @@ -891,6 +891,10 @@ AlpcGetHeaderSize( _In_ ULONG Flags ); +#define ALPC_ATTRFLG_ALLOCATEDATTR 0x20000000 +#define ALPC_ATTRFLG_VALIDATTR 0x40000000 +#define ALPC_ATTRFLG_KEEPRUNNINGATTR 0x60000000 + NTSYSAPI NTSTATUS NTAPI diff --git a/ntpfapi.h b/ntpfapi.h index c25e758..67ba32d 100644 --- a/ntpfapi.h +++ b/ntpfapi.h @@ -151,7 +151,7 @@ typedef struct _PF_PRIVSOURCE_INFO ULONG Spare : 28; } PF_PRIVSOURCE_INFO, *PPF_PRIVSOURCE_INFO; -#define PF_PRIVSOURCE_QUERY_REQUEST_VERSION 3 +#define PF_PRIVSOURCE_QUERY_REQUEST_VERSION 8 typedef struct _PF_PRIVSOURCE_QUERY_REQUEST { diff --git a/ntrtl.h b/ntrtl.h index ddfe539..716ab51 100644 --- a/ntrtl.h +++ b/ntrtl.h @@ -3394,13 +3394,6 @@ RtlDetermineDosPathNameType_U( _In_ PWSTR DosFileName ); -NTSYSAPI -ULONG -NTAPI -RtlIsDosDeviceName_U( - _In_ PWSTR DosFileName - ); - NTSYSAPI RTL_PATH_TYPE NTAPI @@ -3408,6 +3401,13 @@ RtlDetermineDosPathNameType_Ustr( _In_ PCUNICODE_STRING DosFileName ); +NTSYSAPI +ULONG +NTAPI +RtlIsDosDeviceName_U( + _In_ PWSTR DosFileName + ); + NTSYSAPI ULONG NTAPI