admin/winsiderss-phnt
1
0
Fork 0
mirror of https://github.com/winsiderss/phnt synced 2026-06-08 18:20:04 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
winsiderss-phnt/ntpebteb.h
T
Johnny Shaw 53fbbdc5b5 sync latest
2026-03-25 18:14:46 -06:00

1598 lines
41 KiB
C
Raw Permalink Blame History

/*
* Process and Thread Environment Block support functions
*
* This file is part of System Informer.
*/
#ifndef _NTPEBTEB_H
#define _NTPEBTEB_H
#ifdef __has_include
#if __has_include (<ntgdi.h>)
#include <ntgdi.h>
#endif // __has_include
#if __has_include (<ntsxs.h>)
#include <ntsxs.h>
#endif // __has_include
#endif // __has_include
typedef struct _APPCOMPAT_EXE_DATA APPCOMPAT_EXE_DATA, *PAPPCOMPAT_EXE_DATA;
typedef struct _RTL_USER_PROCESS_PARAMETERS *PRTL_USER_PROCESS_PARAMETERS;
typedef struct _RTL_CRITICAL_SECTION *PRTL_CRITICAL_SECTION;
typedef struct _SILO_USER_SHARED_DATA *PSILO_USER_SHARED_DATA;
typedef struct _LDR_RESLOADER_RET LDR_RESLOADER_RET, *PLDR_RESLOADER_RET;
typedef struct _LEAP_SECOND_DATA *PLEAP_SECOND_DATA;
typedef struct _PEB_LDR_DATA PEB_LDR_DATA, *PPEB_LDR_DATA;
typedef struct tagSOleTlsData SOleTlsData, *PSOleTlsData;
typedef struct _KERNEL_CALLBACK_TABLE KERNEL_CALLBACK_TABLE, *PKERNEL_CALLBACK_TABLE;
typedef struct _GDI_HANDLE_ENTRY GDI_HANDLE_ENTRY, *PGDI_HANDLE_ENTRY;
typedef struct _SHIM_PROCESS_CONTEXT SHIM_PROCESS_CONTEXT, *PSHIM_PROCESS_CONTEXT;
typedef struct _HEAP HEAP, *PHEAP;
// PEB->AppCompatFlags
#define KACF_OLDGETSHORTPATHNAME 0x00000001
#define KACF_VERSIONLIE_NOT_USED 0x00000002
#define KACF_GETTEMPPATH_NOT_USED 0x00000004
#define KACF_GETDISKFREESPACE 0x00000008
#define KACF_APPCOMPATFLAG_BIT4 0x00000010
#define KACF_FTMFROMCURRENTAPT 0x00000020
#define KACF_DISALLOWORBINDINGCHANGES 0x00000040
#define KACF_OLE32VALIDATEPTRS 0x00000080
#define KACF_DISABLECICERO 0x00000100
#define KACF_OLE32ENABLEASYNCDOCFILE 0x00000200
#define KACF_OLE32ENABLELEGACYEXCEPTIONHANDLING 0x00000400
#define KACF_RPCDISABLENDRCLIENTHARDENING 0x00000800
#define KACF_RPCDISABLENDRMAYBENULL_SIZEIS 0x00001000
#define KACF_DISABLEALLDDEHACK_NOT_USED 0x00002000
#define KACF_RPCDISABLENDR61_RANGE 0x00004000
#define KACF_RPC32ENABLELEGACYEXCEPTIONHANDLING 0x00008000
#define KACF_OLE32DOCFILEUSELEGACYNTFSFLAGS 0x00010000
#define KACF_RPCDISABLENDRCONSTIIDCHECK 0x00020000
#define KACF_USERDISABLEFORWARDERPATCH 0x00040000
#define KACF_APPCOMPATFLAG_BIT19 0x00080000
#define KACF_OLE32DISABLENEW_WMPAINT_DISPATCH 0x00100000
#define KACF_ADDRESTRICTEDSIDINCOINITIALIZESECURITY 0x00200000
#define KACF_ALLOCDEBUGINFOFORCRITSECTIONS 0x00400000
#define KACF_OLEAUT32ENABLEUNSAFELOADTYPELIBRELATIVE 0x00800000
#define KACF_ALLOWMAXIMIZEDWINDOWGAMMA 0x01000000
#define KACF_DONOTADDTOCACHE 0x80000000
#define KACF_DISABLEPOSIXDELETEFILE 0x100000000 // rev KernelBase!InternalDeleteFileW
#define KACF_ENABLE_PROCESS_SYSTEMDPIAWARENESS 0x20000000000000 // rev // Enable Per-Process System DPI Awareness and Opt-in to Per-Process System DPI mode.
#define KACF_DISABLE_PROCESS_SYSTEMDPIAWARENESS 0x40000000000000 // rev // Disable Per-Process System DPI Awareness and force legacy DPI behavior.
#define KACF_ENABLE_GDI_DPI_SCALING 0x800000000000000
#define KACF_FORCE_DISABLE_GDI_SCALING 0x4000000000000000
// PEB->CrossProcessFlags
#define PEB_FLAG_PROCESS_IN_JOB 0x00000001 // Process is part of a job
#define PEB_FLAG_PROCESS_INITIALIZING 0x00000002 // Process is initializing
#define PEB_FLAG_PROCESS_USING_VEH 0x00000004 // Process is using VEH
#define PEB_FLAG_PROCESS_USING_VCH 0x00000008 // Process is using VCH
#define PEB_FLAG_PROCESS_USING_FTH 0x00000010 // Process is using FTH
#define PEB_FLAG_PROCESS_PREVIOUSLY_THROTTLED 0x00000020 // Process was previously throttled
#define PEB_FLAG_PROCESS_CURRENTLY_THROTTLED 0x00000040 // Process is currently throttled
#define PEB_FLAG_PROCESS_IMAGES_HOT_PATCHED 0x00000080 // Process images are hot patched (RS5+)
// private
#define API_SET_SECTION_NAME ".apiset"
// private
#define API_SET_SCHEMA_VERSION_V2 0x00000002 // WIN7, WIN8
#define API_SET_SCHEMA_VERSION_V4 0x00000004 // WINBLUE
#define API_SET_SCHEMA_VERSION_V6 0x00000006 // since THRESHOLD
#define API_SET_SCHEMA_VERSION API_SET_SCHEMA_VERSION_V6
// private
#define API_SET_SCHEMA_FLAGS_SEALED 0x00000001
#define API_SET_SCHEMA_FLAGS_HOST_EXTENSION 0x00000002
// private
#define API_SET_SCHEMA_ENTRY_FLAGS_SEALED 0x00000001
#define API_SET_SCHEMA_ENTRY_FLAGS_EXTENSION 0x00000002
// private
typedef struct _API_SET_VALUE_ENTRY_V2
{
ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base
ULONG NameLength;
ULONG ValueOffset; // to WCHAR[ValueLength / sizeof(WCHAR)], from schema base
ULONG ValueLength;
} API_SET_VALUE_ENTRY_V2, *PAPI_SET_VALUE_ENTRY_V2;
// private
typedef struct _API_SET_VALUE_ARRAY_V2
{
ULONG Count;
_Field_size_full_(Count) API_SET_VALUE_ENTRY_V2 Array[ANYSIZE_ARRAY];
} API_SET_VALUE_ARRAY_V2, *PAPI_SET_VALUE_ARRAY_V2;
// private
typedef struct _API_SET_NAMESPACE_ENTRY_V2
{
ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base
ULONG NameLength;
ULONG DataOffset; // to API_SET_VALUE_ARRAY_V2, from schema base
} API_SET_NAMESPACE_ENTRY_V2, *PAPI_SET_NAMESPACE_ENTRY_V2;
// private // PEB->ApiSetMap on WIN7, WIN8
typedef struct _API_SET_NAMESPACE_ARRAY_V2
{
ULONG Version; // API_SET_SCHEMA_VERSION_V2
ULONG Count;
_Field_size_full_(Count) API_SET_NAMESPACE_ENTRY_V2 Array[ANYSIZE_ARRAY];
} API_SET_NAMESPACE_ARRAY_V2, *PAPI_SET_NAMESPACE_ARRAY_V2;
// private
typedef struct _API_SET_VALUE_ENTRY_V4
{
ULONG Flags;
ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base
ULONG NameLength;
ULONG ValueOffset; // to WCHAR[ValueLength / sizeof(WCHAR)], from schema base
ULONG ValueLength;
} API_SET_VALUE_ENTRY_V4, *PAPI_SET_VALUE_ENTRY_V4;
// private
typedef struct _API_SET_VALUE_ARRAY_V4
{
ULONG Flags;
ULONG Count;
_Field_size_full_(Count) API_SET_VALUE_ENTRY_V4 Array[ANYSIZE_ARRAY];
} API_SET_VALUE_ARRAY_V4, *PAPI_SET_VALUE_ARRAY_V4;
// private
typedef struct _API_SET_NAMESPACE_ENTRY_V4
{
ULONG Flags; // API_SET_SCHEMA_ENTRY_FLAGS_*
ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base
ULONG NameLength;
ULONG AliasOffset; // to WCHAR[AliasLength / sizeof(WCHAR)], from schema base
ULONG AliasLength;
ULONG DataOffset; // to API_SET_VALUE_ARRAY_V4, from schema base
} API_SET_NAMESPACE_ENTRY_V4, *PAPI_SET_NAMESPACE_ENTRY_V4;
// private // PEB->ApiSetMap on WINBLUE
typedef struct _API_SET_NAMESPACE_ARRAY_V4
{
ULONG Version; // API_SET_SCHEMA_VERSION_V4
ULONG Size;
ULONG Flags; // API_SET_SCHEMA_FLAGS_*
ULONG Count;
_Field_size_full_(Count) API_SET_NAMESPACE_ENTRY_V4 Array[ANYSIZE_ARRAY];
} API_SET_NAMESPACE_ARRAY_V4, *PAPI_SET_NAMESPACE_ARRAY_V4;
// private
typedef struct _API_SET_VALUE_ENTRY
{
ULONG Flags;
ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base
ULONG NameLength;
ULONG ValueOffset; // to WCHAR[ValueLength / sizeof(WCHAR)], from schema base
ULONG ValueLength;
} API_SET_VALUE_ENTRY, *PAPI_SET_VALUE_ENTRY;
// private
typedef struct _API_SET_NAMESPACE_ENTRY
{
ULONG Flags; // API_SET_SCHEMA_ENTRY_FLAGS_*
ULONG NameOffset; // to WCHAR[NameLength / sizeof(WCHAR)], from schema base
ULONG NameLength;
ULONG HashedLength;
ULONG ValueOffset; // to API_SET_VALUE_ENTRY[ValueCount], from schema base
ULONG ValueCount;
} API_SET_NAMESPACE_ENTRY, *PAPI_SET_NAMESPACE_ENTRY;
// private
typedef struct _API_SET_HASH_ENTRY
{
ULONG Hash;
ULONG Index;
} API_SET_HASH_ENTRY, *PAPI_SET_HASH_ENTRY;
// private // PEB->ApiSetMap since THRESHOLD
typedef struct _API_SET_NAMESPACE
{
ULONG Version; // API_SET_SCHEMA_VERSION_V6
ULONG Size;
ULONG Flags; // API_SET_SCHEMA_FLAGS_*
ULONG Count;
ULONG EntryOffset; // to API_SET_NAMESPACE_ENTRY[Count], from this struct base
ULONG HashOffset; // to API_SET_HASH_ENTRY[Count], from this struct base
ULONG HashFactor;
} API_SET_NAMESPACE, *PAPI_SET_NAMESPACE;
// PEB->TelemetryCoverageHeader
typedef struct _TELEMETRY_COVERAGE_HEADER
{
UCHAR MajorVersion;
UCHAR MinorVersion;
struct
{
USHORT TracingEnabled : 1;
USHORT Reserved1 : 15;
};
ULONG HashTableEntries;
ULONG HashIndexMask;
ULONG TableUpdateVersion;
ULONG TableSizeInBytes;
ULONG LastResetTick;
ULONG ResetRound;
ULONG Reserved2;
ULONG RecordedCount;
ULONG Reserved3[4];
ULONG HashTable[ANYSIZE_ARRAY];
} TELEMETRY_COVERAGE_HEADER, *PTELEMETRY_COVERAGE_HEADER;
typedef struct _WER_RECOVERY_INFO
{
ULONG Length;
PVOID Callback;
PVOID Parameter;
HANDLE Started;
HANDLE Finished;
HANDLE InProgress;
LONG LastError;
BOOL Successful;
ULONG PingInterval;
ULONG Flags;
} WER_RECOVERY_INFO, *PWER_RECOVERY_INFO;
typedef struct _WER_FILE
{
USHORT Flags;
WCHAR Path[MAX_PATH];
} WER_FILE, *PWER_FILE;
typedef struct _WER_MEMORY
{
PVOID Address;
ULONG Size;
} WER_MEMORY, *PWER_MEMORY;
typedef struct _WER_GATHER
{
PVOID Next;
USHORT Flags;
union
{
WER_FILE File;
WER_MEMORY Memory;
} v;
} WER_GATHER, *PWER_GATHER;
typedef struct _WER_METADATA
{
PVOID Next;
WCHAR Key[64];
WCHAR Value[128];
} WER_METADATA, *PWER_METADATA;
typedef struct _WER_RUNTIME_DLL
{
PVOID Next;
ULONG Length;
PVOID Context;
WCHAR CallbackDllPath[MAX_PATH];
} WER_RUNTIME_DLL, *PWER_RUNTIME_DLL;
typedef struct _WER_DUMP_COLLECTION
{
PVOID Next;
ULONG ProcessId;
ULONG ThreadId;
} WER_DUMP_COLLECTION, *PWER_DUMP_COLLECTION;
typedef struct _WER_HEAP_MAIN_HEADER
{
WCHAR Signature[16];
LIST_ENTRY Links;
HANDLE Mutex;
PVOID FreeHeap;
ULONG FreeCount;
} WER_HEAP_MAIN_HEADER, *PWER_HEAP_MAIN_HEADER;
#ifndef RESTART_MAX_CMD_LINE
#define RESTART_MAX_CMD_LINE 1024
#endif
typedef struct _WER_PEB_HEADER_BLOCK
{
LONG Length;
WCHAR Signature[16];
WCHAR AppDataRelativePath[64];
WCHAR RestartCommandLine[RESTART_MAX_CMD_LINE];
WER_RECOVERY_INFO RecoveryInfo;
PWER_GATHER Gather;
PWER_METADATA MetaData;
PWER_RUNTIME_DLL RuntimeDll;
PWER_DUMP_COLLECTION DumpCollection;
LONG GatherCount;
LONG MetaDataCount;
LONG DumpCount;
LONG Flags;
WER_HEAP_MAIN_HEADER MainHeader;
PVOID Reserved;
} WER_PEB_HEADER_BLOCK, *PWER_PEB_HEADER_BLOCK;
#define GDI_HANDLE_BUFFER_SIZE32 34
#define GDI_HANDLE_BUFFER_SIZE64 60
#ifndef _WIN64
#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE32
#else
#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE64
#endif
typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE];
typedef ULONG GDI_HANDLE_BUFFER32[GDI_HANDLE_BUFFER_SIZE32];
typedef ULONG GDI_HANDLE_BUFFER64[GDI_HANDLE_BUFFER_SIZE64];
typedef _Function_class_(PS_POST_PROCESS_INIT_ROUTINE)
VOID NTAPI PS_POST_PROCESS_INIT_ROUTINE(
VOID
);
typedef PS_POST_PROCESS_INIT_ROUTINE* PPS_POST_PROCESS_INIT_ROUTINE;
#ifndef RTL_FLS_MAXIMUM_AVAILABLE
#define RTL_FLS_MAXIMUM_AVAILABLE 128
#endif
#ifndef FLS_MAXIMUM_AVAILABLE
#define FLS_MAXIMUM_AVAILABLE 4080
#endif
#ifndef TLS_MINIMUM_AVAILABLE
#define TLS_MINIMUM_AVAILABLE 64
#endif
#ifndef TLS_EXPANSION_SLOTS
#define TLS_EXPANSION_SLOTS 1024
#endif
/**
* Process Environment Block (PEB) structure.
*
* \sa https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb
*/
typedef struct _PEB
{
//
// The process was cloned with an inherited address space.
//
BOOLEAN InheritedAddressSpace;
//
// The process has image file execution options (IFEO).
//
BOOLEAN ReadImageFileExecOptions;
//
// The process has a debugger attached.
//
BOOLEAN BeingDebugged;
union
{
BOOLEAN BitField;
struct
{
BOOLEAN ImageUsesLargePages : 1; // The process uses large image regions (4 MB).
BOOLEAN IsProtectedProcess : 1; // The process is a protected process.
BOOLEAN IsImageDynamicallyRelocated : 1; // The process image base address was relocated.
BOOLEAN SkipPatchingUser32Forwarders : 1; // The process skipped forwarders for User32.dll functions. 1 for 64-bit, 0 for 32-bit.
BOOLEAN IsPackagedProcess : 1; // The process is a packaged store process (APPX/MSIX).
BOOLEAN IsAppContainerProcess : 1; // The process has an AppContainer token.
BOOLEAN IsProtectedProcessLight : 1; // The process is a protected process (light).
BOOLEAN IsLongPathAwareProcess : 1; // The process is long path aware.
};
};
//
// Handle to a mutex for synchronization.
//
HANDLE Mutant;
//
// Pointer to the base address of the process image.
//
PVOID ImageBaseAddress;
//
// Pointer to the process loader data.
//
PPEB_LDR_DATA Ldr;
//
// Pointer to the process parameters.
//
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
//
// Reserved.
//
PVOID SubSystemData;
//
// Pointer to the process default heap.
//
PHEAP ProcessHeap;
//
// Pointer to a critical section used to synchronize access to the PEB.
//
PRTL_CRITICAL_SECTION FastPebLock;
//
// Pointer to a singly linked list used by ATL.
//
PSLIST_HEADER AtlThunkSListPtr;
//
// Handle to the Image File Execution Options key.
//
HANDLE IFEOKey;
//
// Cross process flags.
//
union
{
ULONG CrossProcessFlags;
struct
{
ULONG ProcessInJob : 1; // The process is part of a job.
ULONG ProcessInitializing : 1; // The process is initializing.
ULONG ProcessUsingVEH : 1; // The process is using VEH.
ULONG ProcessUsingVCH : 1; // The process is using VCH.
ULONG ProcessUsingFTH : 1; // The process is using FTH.
ULONG ProcessPreviouslyThrottled : 1; // The process was previously throttled.
ULONG ProcessCurrentlyThrottled : 1; // The process is currently throttled.
ULONG ProcessImagesHotPatched : 1; // The process images are hot patched. // RS5
ULONG ReservedBits0 : 24;
};
};
//
// User32 KERNEL_CALLBACK_TABLE (ntuser.h)
//
union
{
PKERNEL_CALLBACK_TABLE KernelCallbackTable;
PVOID UserSharedInfoPtr;
};
//
// Reserved.
//
ULONG SystemReserved;
//
// Pointer to the Active Template Library (ATL) singly linked list (32-bit)
//
ULONG AtlThunkSListPtr32;
//
// Pointer to the API Set Schema.
//
PAPI_SET_NAMESPACE ApiSetMap;
//
// Counter for TLS expansion.
//
ULONG TlsExpansionCounter;
//
// Pointer to the TLS bitmap.
//
PRTL_BITMAP TlsBitmap;
//
// Bits for the TLS bitmap.
//
ULONG TlsBitmapBits[2];
//
// Reserved for CSRSS.
//
PVOID ReadOnlySharedMemoryBase;
//
// Pointer to the USER_SHARED_DATA for the current SILO.
//
PSILO_USER_SHARED_DATA SharedData;
//
// Reserved for CSRSS.
//
PVOID* ReadOnlyStaticServerData;
//
// Pointer to the ANSI code page data.
//
PCPTABLEINFO AnsiCodePageData;
//
// Pointer to the OEM code page data.
//
PCPTABLEINFO OemCodePageData;
//
// Pointer to the Unicode case table data.
//
PNLSTABLEINFO UnicodeCaseTableData;
//
// The total number of system processors.
//
ULONG NumberOfProcessors;
//
// Global flags for the system.
//
union
{
ULONG NtGlobalFlag;
struct
{
ULONG StopOnException : 1; // FLG_STOP_ON_EXCEPTION
ULONG ShowLoaderSnaps : 1; // FLG_SHOW_LDR_SNAPS
ULONG DebugInitialCommand : 1; // FLG_DEBUG_INITIAL_COMMAND
ULONG StopOnHungGUI : 1; // FLG_STOP_ON_HUNG_GUI
ULONG HeapEnableTailCheck : 1; // FLG_HEAP_ENABLE_TAIL_CHECK
ULONG HeapEnableFreeCheck : 1; // FLG_HEAP_ENABLE_FREE_CHECK
ULONG HeapValidateParameters : 1; // FLG_HEAP_VALIDATE_PARAMETERS
ULONG HeapValidateAll : 1; // FLG_HEAP_VALIDATE_ALL
ULONG ApplicationVerifier : 1; // FLG_APPLICATION_VERIFIER
ULONG MonitorSilentProcessExit : 1; // FLG_MONITOR_SILENT_PROCESS_EXIT
ULONG PoolEnableTagging : 1; // FLG_POOL_ENABLE_TAGGING
ULONG HeapEnableTagging : 1; // FLG_HEAP_ENABLE_TAGGING
ULONG UserStackTraceDb : 1; // FLG_USER_STACK_TRACE_DB
ULONG KernelStackTraceDb : 1; // FLG_KERNEL_STACK_TRACE_DB
ULONG MaintainObjectTypeList : 1; // FLG_MAINTAIN_OBJECT_TYPELIST
ULONG HeapEnableTagByDll : 1; // FLG_HEAP_ENABLE_TAG_BY_DLL
ULONG DisableStackExtension : 1; // FLG_DISABLE_STACK_EXTENSION
ULONG EnableCsrDebug : 1; // FLG_ENABLE_CSRDEBUG
ULONG EnableKDebugSymbolLoad : 1; // FLG_ENABLE_KDEBUG_SYMBOL_LOAD
ULONG DisablePageKernelStacks : 1; // FLG_DISABLE_PAGE_KERNEL_STACKS
ULONG EnableSystemCritBreaks : 1; // FLG_ENABLE_SYSTEM_CRIT_BREAKS
ULONG HeapDisableCoalescing : 1; // FLG_HEAP_DISABLE_COALESCING
ULONG EnableCloseExceptions : 1; // FLG_ENABLE_CLOSE_EXCEPTIONS
ULONG EnableExceptionLogging : 1; // FLG_ENABLE_EXCEPTION_LOGGING
ULONG EnableHandleTypeTagging : 1; // FLG_ENABLE_HANDLE_TYPE_TAGGING
ULONG HeapPageAllocs : 1; // FLG_HEAP_PAGE_ALLOCS
ULONG DebugInitialCommandEx : 1; // FLG_DEBUG_INITIAL_COMMAND_EX
ULONG DisableDbgPrint : 1; // FLG_DISABLE_DBGPRINT
ULONG CritSecEventCreation : 1; // FLG_CRITSEC_EVENT_CREATION
ULONG LdrTopDown : 1; // FLG_LDR_TOP_DOWN
ULONG EnableHandleExceptions : 1; // FLG_ENABLE_HANDLE_EXCEPTIONS
ULONG DisableProtDlls : 1; // FLG_DISABLE_PROTDLLS
} NtGlobalFlags;
};
//
// Timeout for critical sections.
//
LARGE_INTEGER CriticalSectionTimeout;
//
// Reserved size for heap segments.
//
SIZE_T HeapSegmentReserve;
//
// Committed size for heap segments.
//
SIZE_T HeapSegmentCommit;
//
// Threshold for decommitting total free heap.
//
SIZE_T HeapDeCommitTotalFreeThreshold;
//
// Threshold for decommitting free heap blocks.
//
SIZE_T HeapDeCommitFreeBlockThreshold;
//
// Number of process heaps.
//
ULONG NumberOfHeaps;
//
// Maximum number of process heaps.
//
ULONG MaximumNumberOfHeaps;
//
// Pointer to an array of process heaps. ProcessHeaps is initialized
// to point to the first free byte after the PEB and MaximumNumberOfHeaps
// is computed from the page size used to hold the PEB, less the fixed
// size of this data structure.
//
PVOID* ProcessHeaps;
//
// Pointer to the system GDI shared handle table.
//
PGDI_HANDLE_ENTRY GdiSharedHandleTable;
//
// Pointer to the process starter helper.
//
PVOID ProcessStarterHelper;
//
// The maximum number of GDI function calls during batch operations (GdiSetBatchLimit)
//
ULONG GdiDCAttributeList;
//
// Pointer to the loader lock critical section.
//
PRTL_CRITICAL_SECTION LoaderLock;
//
// Major version of the operating system.
//
ULONG OSMajorVersion;
//
// Minor version of the operating system.
//
ULONG OSMinorVersion;
//
// Build number of the operating system.
//
USHORT OSBuildNumber;
//
// CSD version of the operating system.
//
USHORT OSCSDVersion;
//
// Platform ID of the operating system.
//
ULONG OSPlatformId;
//
// Subsystem version of the current process image (PE Headers).
//
ULONG ImageSubsystem;
//
// Major version of the current process image subsystem (PE Headers).
//
ULONG ImageSubsystemMajorVersion;
//
// Minor version of the current process image subsystem (PE Headers).
//
ULONG ImageSubsystemMinorVersion;
//
// Affinity mask for the current process.
//
KAFFINITY ActiveProcessAffinityMask;
//
// Temporary buffer for GDI handles accumulated in the current batch.
//
GDI_HANDLE_BUFFER GdiHandleBuffer;
//
// Pointer to the post-process initialization routine available for use by the application.
//
PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
//
// Pointer to the TLS expansion bitmap.
//
PRTL_BITMAP TlsExpansionBitmap;
//
// Bits for the TLS expansion bitmap. TLS_EXPANSION_SLOTS
//
ULONG TlsExpansionBitmapBits[32];
//
// Session ID of the current process.
//
ULONG SessionId;
//
// Application compatibility flags. KACF_*
//
ULARGE_INTEGER AppCompatFlags;
//
// Application compatibility flags. KACF_*
//
ULARGE_INTEGER AppCompatFlagsUser;
//
// Pointer to the Application SwitchBack Compatibility Engine.
//
PSHIM_PROCESS_CONTEXT pShimData;
//
// Pointer to the Application Compatibility Engine.
//
PAPPCOMPAT_EXE_DATA AppCompatInfo;
//
// CSD version string of the operating system.
//
UNICODE_STRING CSDVersion;
//
// Pointer to the process activation context.
//
PACTIVATION_CONTEXT_DATA ActivationContextData;
//
// Pointer to the process assembly storage map.
//
PASSEMBLY_STORAGE_MAP ProcessAssemblyStorageMap;
//
// Pointer to the system default activation context.
//
PACTIVATION_CONTEXT_DATA SystemDefaultActivationContextData;
//
// Pointer to the system assembly storage map.
//
PASSEMBLY_STORAGE_MAP SystemAssemblyStorageMap;
//
// Minimum stack commit size.
//
SIZE_T MinimumStackCommit;
//
// since 19H1 (previously FlsCallback to FlsHighIndex)
//
PVOID SparePointers[2];
//
// Pointer to the patch loader data.
//
PVOID PatchLoaderData;
//
// Pointer to the CHPE V2 process information. CHPEV2_PROCESS_INFO
//
PVOID ChpeV2ProcessInfo;
//
// Packaged process feature state.
//
ULONG AppModelFeatureState;
//
// SpareUlongs
//
ULONG SpareUlongs[2];
//
// Active code page.
//
USHORT ActiveCodePage;
//
// OEM code page.
//
USHORT OemCodePage;
//
// Code page case mapping.
//
USHORT UseCaseMapping;
//
// Unused NLS field.
//
USHORT UnusedNlsField;
//
// Pointer to the application WER registration data.
//
PWER_PEB_HEADER_BLOCK WerRegistrationData;
//
// Pointer to the application WER assert pointer.
//
PVOID WerShipAssertPtr;
//
// Pointer to the EC bitmap on ARM64. (Windows 11 and above)
//
union
{
PVOID pContextData; // Pointer to the switchback compatibility engine (Windows 7 and below)
PVOID EcCodeBitMap; // Pointer to the EC bitmap on ARM64 (Windows 11 and above) // since WIN11
};
//
// Reserved.
//
PVOID ImageHeaderHash;
//
// ETW tracing flags.
//
union
{
ULONG TracingFlags;
struct
{
ULONG HeapTracingEnabled : 1; // ETW heap tracing enabled.
ULONG CritSecTracingEnabled : 1; // ETW lock tracing enabled.
ULONG LibLoaderTracingEnabled : 1; // ETW loader tracing enabled.
ULONG SpareTracingBits : 29;
};
};
//
// Reserved for CSRSS.
//
ULONGLONG CsrServerReadOnlySharedMemoryBase;
//
// Pointer to the thread pool worker list lock.
//
PRTL_CRITICAL_SECTION TppWorkerpListLock;
//
// Pointer to the thread pool worker list.
//
LIST_ENTRY TppWorkerpList;
//
// Wait on address hash table. (RtlWaitOnAddress)
//
PVOID WaitOnAddressHashTable[128];
//
// Pointer to the telemetry coverage header. // since RS3
//
PTELEMETRY_COVERAGE_HEADER TelemetryCoverageHeader;
//
// Cloud file flags. (ProjFs and Cloud Files) // since RS4
//
ULONG CloudFileFlags;
//
// Cloud file diagnostic flags.
//
ULONG CloudFileDiagFlags;
//
// Placeholder compatibility mode. (ProjFs and Cloud Files)
//
CHAR PlaceholderCompatibilityMode;
//
// Reserved for placeholder compatibility mode.
//
CHAR PlaceholderCompatibilityModeReserved[7];
//
// Pointer to leap second data. // since RS5
//
PLEAP_SECOND_DATA LeapSecondData;
//
// Leap second flags.
//
union
{
ULONG LeapSecondFlags;
struct
{
ULONG SixtySecondEnabled : 1; // Leap seconds enabled.
ULONG Reserved : 31;
};
};
//
// Global flags for the process.
//
ULONG NtGlobalFlag2;
//
// Extended feature disable mask (AVX). // since WIN11
//
ULONGLONG ExtendedFeatureDisableMask;
} PEB, *PPEB;
#ifdef _WIN64
static_assert(FIELD_OFFSET(PEB, SessionId) == 0x2C0, "FIELD_OFFSET(PEB, SessionId) is incorrect");
static_assert(sizeof(PEB) == 0x7d0, "Size of PEB is incorrect"); // WIN11
#else
static_assert(FIELD_OFFSET(PEB, SessionId) == 0x1D4, "FIELD_OFFSET(PEB, SessionId) is incorrect");
static_assert(sizeof(PEB) == 0x488, "Size of PEB is incorrect"); // WIN11
#endif
#define GDI_BATCH_BUFFER_SIZE 310
/**
* The GDI_TEB_BATCH structure is used to store information about GDI batch operations.
*/
typedef struct _GDI_TEB_BATCH
{
ULONG Offset;
ULONG_PTR HDC;
ULONG Buffer[GDI_BATCH_BUFFER_SIZE];
} GDI_TEB_BATCH, *PGDI_TEB_BATCH;
#define TEB_ACTIVE_FRAME_CONTEXT_FLAG_EXTENDED (0x00000001)
/**
* The TEB_ACTIVE_FRAME_CONTEXT structure is used to store information about an active frame context.
*/
typedef struct _TEB_ACTIVE_FRAME_CONTEXT
{
ULONG Flags;
PCSTR FrameName;
} TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;
/**
* The TEB_ACTIVE_FRAME_CONTEXT_EX structure extends TEB_ACTIVE_FRAME_CONTEXT with additional information.
*/
typedef struct _TEB_ACTIVE_FRAME_CONTEXT_EX
{
TEB_ACTIVE_FRAME_CONTEXT BasicContext;
PCSTR SourceLocation;
} TEB_ACTIVE_FRAME_CONTEXT_EX, *PTEB_ACTIVE_FRAME_CONTEXT_EX;
#define TEB_ACTIVE_FRAME_FLAG_EXTENDED (0x00000001)
/**
* The TEB_ACTIVE_FRAME structure is used to store information about an active frame.
*/
typedef struct _TEB_ACTIVE_FRAME
{
ULONG Flags;
struct _TEB_ACTIVE_FRAME *Previous;
PTEB_ACTIVE_FRAME_CONTEXT Context;
} TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
/**
* The TEB_ACTIVE_FRAME_EX structure extends TEB_ACTIVE_FRAME with additional information.
*/
typedef struct _TEB_ACTIVE_FRAME_EX
{
TEB_ACTIVE_FRAME BasicFrame;
PVOID ExtensionIdentifier;
} TEB_ACTIVE_FRAME_EX, *PTEB_ACTIVE_FRAME_EX;
#define STATIC_UNICODE_BUFFER_LENGTH 261
#define WIN32_CLIENT_INFO_LENGTH 62
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// private
typedef struct _CALLBACKWND
{
HWND hwnd;
ULONG_PTR pwnd;
PACTIVATION_CONTEXT ActCtx;
} CALLBACKWND, *PCALLBACKWND;
// private
typedef struct tagDPICONTEXTINFO
{
ULONG dpiContext;
LOGICAL Dirty;
} DPICONTEXTINFO, *PDPICONTEXTINFO;
// private + rev
typedef struct tagCLIENTINFO
{
ULONG_PTR CI_flags;
ULONG_PTR Spins;
ULONG ExpWinVer;
ULONG CompatFlags;
ULONG CompatFlags2;
ULONG TIFlags;
struct tagDESKTOPINFO* DeskInfo;
PVOID DesktopBase; // ClientDelta before RS2
HHOOK hkCurrent;
ULONG Hooks;
CALLBACKWND CallbackWnd;
ULONG HookCurrent;
LONG InDDEMLCallback;
struct tagCLIENTTHREADINFO* ClientThreadInfo;
ULONG_PTR HookData;
ULONG KeyCache;
UCHAR KeyState[8];
ULONG AsyncKeyCache;
UCHAR AsyncKeyState[8];
UCHAR AsyncKeyStateRecentDown[8];
HKL hKL;
USHORT CodePage;
UCHAR DbcsCFOld[2];
UCHAR DbcsCFNew[2];
MSG msgDbcsCB;
PULONG RegisteredClasses;
HANDLE mmcssHandle;
ULONG_PTR CI_exflags;
DPICONTEXTINFO dci;
} CLIENTINFO, *PCLIENTINFO;
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
// rev - xor key for ReservedForNtRpc
#ifdef _WIN64
#define RPC_THREAD_POINTER_KEY 0xABABABABDEDEDEDEui64
#else
#define RPC_THREAD_POINTER_KEY 0xABABABAB
#endif
/**
* Thread Environment Block (TEB) structure.
*
* \sa https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-teb
*/
typedef struct _TEB
{
//
// Thread Information Block (TIB) contains the thread's stack, base and limit addresses, the current stack pointer, and the exception list.
//
NT_TIB NtTib;
//
// Reserved.
//
PVOID EnvironmentPointer;
//
// Client ID for this thread.
//
CLIENT_ID ClientId;
//
// A handle to an active Remote Procedure Call (RPC) if the thread is currently involved in an RPC operation.
//
PVOID ActiveRpcHandle;
//
// A pointer to the __declspec(thread) local storage array.
//
PVOID ThreadLocalStoragePointer;
//
// A pointer to the Process Environment Block (PEB), which contains information about the process.
//
PPEB ProcessEnvironmentBlock;
//
// The previous Win32 error value for this thread.
//
ULONG LastErrorValue;
//
// The number of critical sections currently owned by this thread.
//
ULONG CountOfOwnedCriticalSections;
//
// Reserved.
//
PVOID CsrClientThread;
//
// Reserved for win32k.sys
//
PVOID Win32ThreadInfo;
//
// Reserved for user32.dll
//
ULONG User32Reserved[26];
//
// Reserved for winsrv.dll
//
ULONG UserReserved[5];
//
// Reserved.
//
PVOID WOW32Reserved;
//
// The LCID of the current thread. (Kernel32!GetThreadLocale)
//
LCID CurrentLocale;
//
// Reserved.
//
ULONG FpSoftwareStatusRegister;
//
// Reserved.
//
PVOID ReservedForDebuggerInstrumentation[16];
#ifdef _WIN64
//
// Reserved for floating-point emulation.
//
PVOID SystemReserved1[25];
//
// Per-thread fiber local storage. (Teb->HasFiberData)
//
PVOID HeapFlsData;
//
// Reserved.
//
ULONG_PTR RngState[4];
#else
//
// Reserved.
//
PVOID SystemReserved1[26];
#endif
//
// Placeholder compatibility mode. (ProjFs and Cloud Files)
//
CHAR PlaceholderCompatibilityMode;
//
// Indicates whether placeholder hydration is always explicit.
//
BOOLEAN PlaceholderHydrationAlwaysExplicit;
//
// ProjFs and Cloud Files (reparse point) file virtualization.
//
CHAR PlaceholderReserved[10];
//
// The process ID (PID) that the current COM server thread is acting on behalf of.
//
ULONG ProxiedProcessId;
//
// Pointer to the activation context stack for the current thread.
//
ACTIVATION_CONTEXT_STACK ActivationStack;
//
// Opaque operation on behalf of another user or process.
//
UCHAR WorkingOnBehalfTicket[8];
//
// The last exception status for the current thread.
//
NTSTATUS ExceptionCode;
//
// Pointer to the activation context stack for the current thread.
//
PACTIVATION_CONTEXT_STACK ActivationContextStackPointer;
//
// The stack pointer (SP) of the current system call or exception during instrumentation.
//
ULONG_PTR InstrumentationCallbackSp;
//
// The program counter (PC) of the previous system call or exception during instrumentation.
//
ULONG_PTR InstrumentationCallbackPreviousPc;
//
// The stack pointer (SP) of the previous system call or exception during instrumentation.
//
ULONG_PTR InstrumentationCallbackPreviousSp;
#ifdef _WIN64
//
// The miniversion ID of the current transacted file operation.
//
ULONG TxFsContext;
#endif
//
// Indicates the state of the system call or exception instrumentation callback.
//
BOOLEAN InstrumentationCallbackDisabled;
#ifdef _WIN64
//
// Indicates the state of alignment exceptions for unaligned load/store operations.
//
BOOLEAN UnalignedLoadStoreExceptions;
#endif
#ifndef _WIN64
//
// SpareBytes.
//
UCHAR SpareBytes[23];
//
// The miniversion ID of the current transacted file operation.
//
ULONG TxFsContext;
#endif
//
// Reserved for GDI (Win32k).
//
GDI_TEB_BATCH GdiTebBatch;
CLIENT_ID RealClientId;
HANDLE GdiCachedProcessHandle;
ULONG GdiClientPID;
ULONG GdiClientTID;
PVOID GdiThreadLocalInfo;
#if (PHNT_MODE != PHNT_MODE_KERNEL)
union
{
//
// User32 (Win32k) thread information.
//
CLIENTINFO Win32ClientInfo;
ULONG_PTR Win32ClientInfoArea[WIN32_CLIENT_INFO_LENGTH];
};
#else
ULONG_PTR Win32ClientInfo[WIN32_CLIENT_INFO_LENGTH];
#endif
//
// Reserved for opengl32.dll
//
PVOID glDispatchTable[233];
ULONG_PTR glReserved1[29];
PVOID glReserved2;
PVOID glSectionInfo;
PVOID glSection;
PVOID glTable;
PVOID glCurrentRC;
PVOID glContext;
//
// The previous status value for this thread.
//
NTSTATUS LastStatusValue;
//
// A static string for use by the application.
//
UNICODE_STRING StaticUnicodeString;
//
// A static buffer for use by the application.
//
WCHAR StaticUnicodeBuffer[STATIC_UNICODE_BUFFER_LENGTH];
//
// The maximum stack size and indicates the base of the stack.
//
PVOID DeallocationStack;
//
// Data for Thread Local Storage. (TlsGetValue)
//
PVOID TlsSlots[TLS_MINIMUM_AVAILABLE];
//
// Reserved for TLS.
//
LIST_ENTRY TlsLinks;
//
// Reserved for NTVDM.
//
PVOID Vdm;
//
// Reserved for RPC. The pointer is XOR'ed with RPC_THREAD_POINTER_KEY.
//
PVOID ReservedForNtRpc;
//
// Reserved for Debugging (DebugActiveProcess).
//
PVOID DbgSsReserved[2];
//
// The error mode for the current thread. (GetThreadErrorMode)
//
ULONG HardErrorMode;
//
// Reserved.
//
#ifdef _WIN64
PVOID Instrumentation[11];
#else
PVOID Instrumentation[9];
#endif
//
// Reserved.
//
GUID ActivityId;
//
// The identifier of the service that created the thread. (svchost)
//
PVOID SubProcessTag;
//
// Reserved.
//
PVOID PerflibData;
//
// Reserved.
//
PVOID EtwTraceData;
//
// The address of a socket handle during a blocking socket operation. (WSAStartup)
//
HANDLE WinSockData;
//
// The number of function calls accumulated in the current GDI batch. (GdiSetBatchLimit)
//
ULONG GdiBatchCount;
//
// The preferred processor for the current thread. (SetThreadIdealProcessor/SetThreadIdealProcessorEx)
//
union
{
PROCESSOR_NUMBER CurrentIdealProcessor;
ULONG IdealProcessorValue;
struct
{
UCHAR ReservedPad0;
UCHAR ReservedPad1;
UCHAR ReservedPad2;
UCHAR IdealProcessor;
};
};
//
// The minimum size of the stack available during any stack overflow exceptions. (SetThreadStackGuarantee)
//
ULONG GuaranteedStackBytes;
//
// Reserved.
//
PVOID ReservedForPerf;
//
// Reserved for Object Linking and Embedding (OLE)
//
PSOleTlsData ReservedForOle;
//
// Indicates whether the thread is waiting on the loader lock.
//
ULONG WaitingOnLoaderLock;
//
// The saved priority state for the thread.
//
PVOID SavedPriorityState;
//
// Reserved.
//
ULONG_PTR ReservedForCodeCoverage;
//
// Reserved.
//
PVOID ThreadPoolData;
//
// Pointer to the TLS (Thread Local Storage) expansion slots for the thread.
//
PVOID *TlsExpansionSlots;
#ifdef _WIN64
PVOID ChpeV2CpuAreaInfo; // CHPEV2_CPUAREA_INFO // previously DeallocationBStore
PVOID Unused; // previously BStoreLimit
#endif
//
// The generation of the MUI (Multilingual User Interface) data.
//
ULONG MuiGeneration;
//
// Indicates whether the thread is impersonating another security context.
//
ULONG IsImpersonating;
//
// Pointer to the NLS (National Language Support) cache.
//
PVOID NlsCache;
//
// Pointer to the AppCompat/Shim Engine data.
//
PVOID pShimData;
//
// Reserved.
//
ULONG HeapData;
//
// Handle to the current transaction associated with the thread.
//
HANDLE CurrentTransactionHandle;
//
// Pointer to the active frame for the thread.
//
PTEB_ACTIVE_FRAME ActiveFrame;
//
// Reserved for FLS (RtlProcessFlsData).
//
PVOID FlsData;
//
// Pointer to the preferred languages for the current thread. (GetThreadPreferredUILanguages)
//
PVOID PreferredLanguages;
//
// Pointer to the user-preferred languages for the current thread. (GetUserPreferredUILanguages)
//
PVOID UserPrefLanguages;
//
// Pointer to the merged preferred languages for the current thread. (MUI_MERGE_USER_FALLBACK)
//
PVOID MergedPrefLanguages;
//
// Indicates whether the thread is impersonating another user's language settings.
//
ULONG MuiImpersonation;
//
// Reserved.
//
union
{
USHORT CrossTebFlags;
USHORT SpareCrossTebBits : 16;
};
//
// SameTebFlags modify the state and behavior of the current thread.
//
union
{
USHORT SameTebFlags;
struct
{
USHORT SafeThunkCall : 1;
USHORT InDebugPrint : 1; // Indicates if the thread is currently in a debug print routine.
USHORT HasFiberData : 1; // Indicates if the thread has local fiber-local storage (FLS).
USHORT SkipThreadAttach : 1; // Indicates if the thread should suppress DLL_THREAD_ATTACH notifications.
USHORT WerInShipAssertCode : 1;
USHORT RanProcessInit : 1; // Indicates if the thread has run process initialization code.
USHORT ClonedThread : 1; // Indicates if the thread is a clone of a different thread.
USHORT SuppressDebugMsg : 1; // Indicates if the thread should suppress LOAD_DLL_DEBUG_INFO notifications.
USHORT DisableUserStackWalk : 1;
USHORT RtlExceptionAttached : 1;
USHORT InitialThread : 1; // Indicates if the thread is the initial thread of the process.
USHORT SessionAware : 1;
USHORT LoadOwner : 1; // Indicates if the thread is the owner of the process loader lock.
USHORT LoaderWorker : 1;
USHORT SkipLoaderInit : 1;
USHORT SkipFileAPIBrokering : 1;
};
};
//
// Pointer to the callback function that is called when a KTM transaction scope is entered.
//
PVOID TxnScopeEnterCallback;
//
// Pointer to the callback function that is called when a KTM transaction scope is exited.
///
PVOID TxnScopeExitCallback;
//
// Pointer to optional context data for use by the application when a KTM transaction scope callback is called.
//
PVOID TxnScopeContext;
//
// The lock count of critical sections for the current thread.
//
ULONG LockCount;
//
// The offset to the WOW64 (Windows on Windows) TEB for the current thread.
//
LONG WowTebOffset;
//
// Pointer to the DLL containing the resource (valid after LdrFindResource_U/LdrResFindResource/etc... returns).
//
PLDR_RESLOADER_RET ResourceRetValue;
//
// Reserved for Windows Driver Framework (WDF).
//
PVOID ReservedForWdf;
//
// Reserved for the Microsoft C runtime (CRT).
//
ULONGLONG ReservedForCrt;
//
// The Host Compute Service (HCS) container identifier.
//
GUID EffectiveContainerId;
//
// Reserved for Kernel32!Sleep (SpinWait).
//
ULONGLONG LastSleepCounter; // since Win11
//
// Reserved for Kernel32!Sleep (SpinWait).
//
ULONG SpinCallCount;
//
// Extended feature disable mask (AVX).
//
ULONGLONG ExtendedFeatureDisableMask;
//
// Reserved.
//
PVOID SchedulerSharedDataSlot; // since 24H2
//
// Reserved.
//
PVOID HeapWalkContext;
//
// The primary processor group affinity of the thread.
//
GROUP_AFFINITY PrimaryGroupAffinity;
//
// Read-copy-update (RCU) synchronization context.
//
ULONG Rcu[2];
} TEB, *PTEB;
#ifdef _WIN64
static_assert(FIELD_OFFSET(TEB, SchedulerSharedDataSlot) == 0x1850, "Size of TEB is incorrect"); // WIN11
static_assert(sizeof(TEB) == 0x1878, "Size of TEB is incorrect"); // 24H2
#else
static_assert(FIELD_OFFSET(TEB, SchedulerSharedDataSlot) == 0x1018, "Size of TEB is incorrect"); // WIN11
static_assert(sizeof(TEB) == 0x1038, "Size of TEB is incorrect"); // 24H2
#endif
#endif
Reference in New Issue View Git Blame Copy Permalink