chenx221/Textractor_test
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
70ae03279c
Textractor_test/vnrhook/util/ntdll/ntdll.h

4341 lines
110 KiB
C
Raw Normal View History

starting commit
2015-04-02 22:29:41 +08:00
//#pragma once
#ifndef NTDLL_H
#define NTDLL_H
// ntdll.h 10/14/2011
really final fixes for beta release
2018-07-13 23:47:16 +08:00
/* Artikash 7/13/2018: WHERE THE FUCK DID THIS FILE COME FROM?
Redefines a bunch of stuff in the standard windows headers (especially winnt.h) but has additional information that isn't documented anywhere else I can find.
It's like someone stole this file from Microsoft's internal database of windows source code?? */
starting commit
2015-04-02 22:29:41 +08:00
#include <windows.h>
#ifdef _MSC_VER
# pragma warning(disable:4005) // C4005: macro redefinition
# pragma warning(disable:4200) // C4200: nonstandard extension used : zero-sized array in struct/union
# pragma warning(disable:4010) // C4010: single-line comment contains line-continuation character
# pragma warning(disable:4996) // C4996: unsafe function or variable used such as swprintf, wcscpy; alternatively use __CRT_SECURE_NO_WARNINGS
#endif // _MSC_VER
#define NT_INCLUDED
#define _NTDEF_
#define _CTYPE_DISABLE_MACROS
// Remove official macros from WSDK
#undef STATUS_WAIT_0
#undef STATUS_ABANDONED_WAIT_0
#undef STATUS_USER_APC
#undef STATUS_TIMEOUT
#undef STATUS_PENDING
#undef DBG_CONTINUE
#undef STATUS_SEGMENT_NOTIFICATION
#undef DBG_TERMINATE_THREAD
#undef DBG_TERMINATE_PROCESS
#undef DBG_CONTROL_C
#undef DBG_CONTROL_BREAK
#undef STATUS_GUARD_PAGE_VIOLATION
#undef STATUS_DATATYPE_MISALIGNMENT
#undef STATUS_BREAKPOINT
#undef STATUS_SINGLE_STEP
#undef DBG_EXCEPTION_NOT_HANDLED
#undef STATUS_ACCESS_VIOLATION
#undef STATUS_IN_PAGE_ERROR
#undef STATUS_INVALID_HANDLE
#undef STATUS_NO_MEMORY
#undef STATUS_ILLEGAL_INSTRUCTION
#undef STATUS_NONCONTINUABLE_EXCEPTION
#undef STATUS_INVALID_DISPOSITION
#undef STATUS_ARRAY_BOUNDS_EXCEEDED
#undef STATUS_FLOAT_DENORMAL_OPERAND
#undef STATUS_FLOAT_DIVIDE_BY_ZERO
#undef STATUS_FLOAT_INEXACT_RESULT
#undef STATUS_FLOAT_INVALID_OPERATION
#undef STATUS_FLOAT_OVERFLOW
#undef STATUS_FLOAT_STACK_CHECK
#undef STATUS_FLOAT_UNDERFLOW
#undef STATUS_INTEGER_DIVIDE_BY_ZERO
#undef STATUS_INTEGER_OVERFLOW
#undef STATUS_PRIVILEGED_INSTRUCTION
#undef STATUS_STACK_OVERFLOW
#undef STATUS_CONTROL_C_EXIT
#undef STATUS_FLOAT_MULTIPLE_FAULTS
#undef STATUS_FLOAT_MULTIPLE_TRAPS
#undef STATUS_ILLEGAL_VLM_REFERENCE
#undef STATUS_REG_NAT_CONSUMPTION
#undef DBG_EXCEPTION_HANDLED
#include <ntstatus.h>
#if (_MSC_VER >= 800) || defined(_STDCALL_SUPPORTED)
# define NTAPI __stdcall
#else
# define _cdecl
# define NTAPI
#endif // STDCALL
#ifdef __cplusplus
extern "C" {
#endif // __cplusplus
// - Macros -
#define MAXIMUM_FILENAME_LENGTH 256
#define PORT_MAXIMUM_MESSAGE_LENGTH 256
#define INITIAL_PRIVILEGE_COUNT 3
#define FSCTL_GET_VOLUME_INFORMATION 0x90064
// Constants for RtlDetermineDosPathNameType_U
#define DOS_PATHTYPE_UNC 0x00000001 // \\COMPUTER1
#define DOS_PATHTYPE_ROOTDRIVE 0x00000002 // C:\
#define DOS_PATHTYPE_STREAM 0x00000003 // X:X or C:
#define DOS_PATHTYPE_NT 0x00000004 // \\??\\C:
#define DOS_PATHTYPE_NAME 0x00000005 // C
#define DOS_PATHTYPE_DEVICE 0x00000006 // \\.\C:
#define DOS_PATHTYPE_LOCALUNCROOT 0x00000007 // \\.
// Define the various device characteristics flags
#define FILE_REMOVABLE_MEDIA 0x00000001
#define FILE_READ_ONLY_DEVICE 0x00000002
#define FILE_FLOPPY_DISKETTE 0x00000004
#define FILE_WRITE_ONCE_MEDIA 0x00000008
#define FILE_REMOTE_DEVICE 0x00000010
#define FILE_DEVICE_IS_MOUNTED 0x00000020
#define FILE_VIRTUAL_VOLUME 0x00000040
#define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080
#define FILE_DEVICE_SECURE_OPEN 0x00000100
#define FILE_SUPERSEDE 0x00000000
#define FILE_OPEN 0x00000001
#define FILE_CREATE 0x00000002
#define FILE_OPEN_IF 0x00000003
#define FILE_OVERWRITE 0x00000004
#define FILE_OVERWRITE_IF 0x00000005
#define FILE_MAXIMUM_DISPOSITION 0x00000005
#define FILE_DIRECTORY_FILE 0x00000001
#define FILE_WRITE_THROUGH 0x00000002
#define FILE_SEQUENTIAL_ONLY 0x00000004
#define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008
#define FILE_SYNCHRONOUS_IO_ALERT 0x00000010
#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
#define FILE_NON_DIRECTORY_FILE 0x00000040
#define FILE_CREATE_TREE_CONNECTION 0x00000080
#define FILE_COMPLETE_IF_OPLOCKED 0x00000100
#define FILE_NO_EA_KNOWLEDGE 0x00000200
#define FILE_OPEN_FOR_RECOVERY 0x00000400
#define FILE_RANDOM_ACCESS 0x00000800
#define FILE_DELETE_ON_CLOSE 0x00001000
#define FILE_OPEN_BY_FILE_ID 0x00002000
#define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000
#define FILE_NO_COMPRESSION 0x00008000
#define FILE_RESERVE_OPFILTER 0x00100000
#define FILE_OPEN_REPARSE_POINT 0x00200000
#define FILE_OPEN_NO_RECALL 0x00400000
#define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000
#define FILE_COPY_STRUCTURED_STORAGE 0x00000041
#define FILE_STRUCTURED_STORAGE 0x00000441
#define FILE_VALID_OPTION_FLAGS 0x00ffffff
#define FILE_VALID_PIPE_OPTION_FLAGS 0x00000032
#define FILE_VALID_MAILSLOT_OPTION_FLAGS 0x00000032
#define FILE_VALID_SET_FLAGS 0x00000036
// Thread states
#define THREAD_STATE_INITIALIZED 0
#define THREAD_STATE_READY 1
#define THREAD_STATE_RUNNING 2
#define THREAD_STATE_STANDBY 3
#define THREAD_STATE_TERMINATED 4
#define THREAD_STATE_WAIT 5
#define THREAD_STATE_TRANSITION 6
#define THREAD_STATE_UNKNOWN 7
// Object types
#define OB_TYPE_TYPE 1
#define OB_TYPE_DIRECTORY 2
#define OB_TYPE_SYMBOLIC_LINK 3
#define OB_TYPE_TOKEN 4
#define OB_TYPE_PROCESS 5
#define OB_TYPE_THREAD 6
#define OB_TYPE_EVENT 7
#define OB_TYPE_EVENT_PAIR 8
#define OB_TYPE_MUTANT 9
#define OB_TYPE_SEMAPHORE 10
#define OB_TYPE_TIMER 11
#define OB_TYPE_PROFILE 12
#define OB_TYPE_WINDOW_STATION 13
#define OB_TYPE_DESKTOP 14
#define OB_TYPE_SECTION 15
#define OB_TYPE_KEY 16
#define OB_TYPE_PORT 17
#define OB_TYPE_ADAPTER 18
#define OB_TYPE_CONTROLLER 19
#define OB_TYPE_DEVICE 20
#define OB_TYPE_DRIVER 21
#define OB_TYPE_IO_COMPLETION 22
#define OB_TYPE_FILE 23
#define OBJ_INHERIT 0x00000002
#define OBJ_PERMANENT 0x00000010
#define OBJ_EXCLUSIVE 0x00000020
#define OBJ_CASE_INSENSITIVE 0x00000040
#define OBJ_OPENIF 0x00000080
#define OBJ_OPENLINK 0x00000100
#define OBJ_VALID_ATTRIBUTES 0x000001F2
// Object Manager Directory Specific Access Rights.
#define DIRECTORY_QUERY 0x0001
#define DIRECTORY_TRAVERSE 0x0002
#define DIRECTORY_CREATE_OBJECT 0x0004
#define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
// Object Manager Symbolic Link Specific Access Rights.
#define SYMBOLIC_LINK_QUERY 0x0001
#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
#define NT_SUCCESS(Status) ((LONG)(Status) >= 0)
#define NT_ERROR(Status) ((ULONG)(Status) >> 30 == 3)
#define DEVICE_TYPE DWORD
// Values for RtlAdjustPrivilege
#define SE_MIN_WELL_KNOWN_PRIVILEGE (2L)
#define SE_CREATE_TOKEN_PRIVILEGE (2L)
#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L)
#define SE_LOCK_MEMORY_PRIVILEGE (4L)
#define SE_INCREASE_QUOTA_PRIVILEGE (5L)
#define SE_UNSOLICITED_INPUT_PRIVILEGE (6L) // obsolete and unused
#define SE_MACHINE_ACCOUNT_PRIVILEGE (6L)
#define SE_TCB_PRIVILEGE (7L)
#define SE_SECURITY_PRIVILEGE (8L)
#define SE_TAKE_OWNERSHIP_PRIVILEGE (9L)
#define SE_LOAD_DRIVER_PRIVILEGE (10L)
#define SE_PROFILE_PRIVILEGE (11L)
#define SE_SYSTEMTIME_PRIVILEGE (12L)
#define SE_PROF_SINGLE_PROCESS_PRIVILEGE (13L)
#define SE_INC_BASE_PRIORITY_PRIVILEGE (14L)
#define SE_CREATE_PAGEFILE_PRIVILEGE (15L)
#define SE_CREATE_PERMANENT_PRIVILEGE (16L)
#define SE_BACKUP_PRIVILEGE (17L)
#define SE_RESTORE_PRIVILEGE (18L)
#define SE_SHUTDOWN_PRIVILEGE (19L)
#define SE_DEBUG_PRIVILEGE (20L)
#define SE_AUDIT_PRIVILEGE (21L)
#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE (22L)
#define SE_CHANGE_NOTIFY_PRIVILEGE (23L)
#define SE_REMOTE_SHUTDOWN_PRIVILEGE (24L)
#define SE_MAX_WELL_KNOWN_PRIVILEGE (SE_REMOTE_SHUTDOWN_PRIVILEGE)
#define VdmDirectoryFile 6
#define InitializeObjectAttributes( p, n, a, r, s ) { \
(p)->uLength = sizeof( OBJECT_ATTRIBUTES ); \
(p)->hRootDirectory = r; \
(p)->uAttributes = a; \
(p)->pObjectName = n; \
(p)->pSecurityDescriptor = s; \
(p)->pSecurityQualityOfService = NULL; \
}
// - Basic Types -
typedef LONG NTSTATUS;
//lint -e624 // Don't complain about different typedefs.
//
typedef NTSTATUS *PNTSTATUS;
//lint +e624 // Resume checking for different typedefs.
typedef NTSTATUS (NTAPI *NTSYSCALL)();
typedef NTSYSCALL *PNTSYSCALL;
typedef ULONG KAFFINITY;
typedef KAFFINITY *PKAFFINITY;
typedef LONG KPRIORITY;
typedef BYTE KPROCESSOR_MODE;
// - Structures -
typedef VOID *POBJECT;
typedef VOID (*PKNORMAL_ROUTINE) (
__in PVOID NormalContext,
__in PVOID SystemArgument1,
__in PVOID SystemArgument2
);
typedef struct _STRING
{
USHORT Length;
USHORT MaximumLength;
#ifdef MIDL_PASS
[ size_is(MaximumLength), length_is(Length) ]
#endif // MIDL_PASS
PCHAR Buffer;
} STRING, *PSTRING;
typedef STRING ANSI_STRING;
typedef PSTRING PANSI_STRING;
typedef STRING OEM_STRING;
typedef PSTRING POEM_STRING;
typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
// - APIs -
NTSYSAPI
NTSTATUS
NTAPI
RtlUnicodeStringToAnsiString(
PANSI_STRING DestinationString,
PUNICODE_STRING SourceString,
BOOLEAN AllocateDestinationString
);
typedef struct _HARDWARE_PTE
{
ULONG Valid : 1;
ULONG Write : 1;
ULONG Owner : 1;
ULONG WriteThrough : 1;
ULONG CacheDisable : 1;
ULONG Accessed : 1;
ULONG Dirty : 1;
ULONG LargePage : 1;
ULONG Global : 1;
ULONG CopyOnWrite : 1;
ULONG Prototype : 1;
ULONG reserved : 1;
ULONG PageFrameNumber : 20;
} HARDWARE_PTE, *PHARDWARE_PTE;
typedef struct _OBJECT_ATTRIBUTES
{
ULONG uLength;
HANDLE hRootDirectory;
PUNICODE_STRING pObjectName;
ULONG uAttributes;
PVOID pSecurityDescriptor;
PVOID pSecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef struct _CLIENT_ID
{
DWORD UniqueProcess;
DWORD UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
typedef struct _PEB_FREE_BLOCK
{
struct _PEB_FREE_BLOCK *Next;
ULONG Size;
} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
typedef struct _CURDIR
{
UNICODE_STRING DosPath;
HANDLE Handle;
} CURDIR, *PCURDIR;
typedef struct _RTL_DRIVE_LETTER_CURDIR
{
WORD Flags;
WORD Length;
DWORD TimeStamp;
STRING DosPath;
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
#define PROCESS_PARAMETERS_NORMALIZED 1 // pointers in are absolute (not self-relative)
typedef struct _PROCESS_PARAMETERS
{
ULONG MaximumLength;
ULONG Length;
ULONG Flags; // PROCESS_PARAMETERS_NORMALIZED
ULONG DebugFlags;
HANDLE ConsoleHandle;
ULONG ConsoleFlags;
HANDLE StandardInput;
HANDLE StandardOutput;
HANDLE StandardError;
CURDIR CurrentDirectory;
UNICODE_STRING DllPath;
UNICODE_STRING ImagePathName;
UNICODE_STRING CommandLine;
PWSTR Environment;
ULONG StartingX;
ULONG StartingY;
ULONG CountX;
ULONG CountY;
ULONG ountCharsX;
ULONG CountCharsY;
ULONG FillAttribute;
ULONG WindowFlags;
ULONG ShowWindowFlags;
UNICODE_STRING WindowTitle;
UNICODE_STRING Desktop;
UNICODE_STRING ShellInfo;
UNICODE_STRING RuntimeInfo;
RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32];
} PROCESS_PARAMETERS, *PPROCESS_PARAMETERS;
typedef struct _RTL_BITMAP
{
DWORD SizeOfBitMap;
PDWORD Buffer;
} RTL_BITMAP, *PRTL_BITMAP, **PPRTL_BITMAP;
#define LDR_STATIC_LINK 0x0000002
#define LDR_IMAGE_DLL 0x0000004
#define LDR_LOAD_IN_PROGRESS 0x0001000
#define LDR_UNLOAD_IN_PROGRESS 0x0002000
#define LDR_ENTRY_PROCESSED 0x0004000
#define LDR_ENTRY_INSERTED 0x0008000
#define LDR_CURRENT_LOAD 0x0010000
#define LDR_FAILED_BUILTIN_LOAD 0x0020000
#define LDR_DONT_CALL_FOR_THREADS 0x0040000
#define LDR_PROCESS_ATTACH_CALLED 0x0080000
#define LDR_DEBUG_SYMBOLS_LOADED 0x0100000
#define LDR_IMAGE_NOT_AT_BASE 0x0200000
#define LDR_WX86_IGNORE_MACHINETYPE 0x0400000
typedef struct _LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage; // in bytes
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags; // LDR_*
USHORT LoadCount;
USHORT TlsIndex;
LIST_ENTRY HashLinks;
PVOID SectionPointer;
ULONG CheckSum;
ULONG TimeDateStamp;
//PVOID LoadedImports; // seems they are exist only on XP !!!
//PVOID EntryPointActivationContext; // the same as above
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
// See: http://en.wikipedia.org/wiki/Process_Environment_Block
typedef struct _PEB_LDR_DATA
{
ULONG Length; // 0
BOOLEAN Initialized; // 4
PVOID SsHandle; // 8?
LIST_ENTRY InLoadOrderModuleList; // C, ref. to PLDR_DATA_TABLE_ENTRY->InLoadOrderModuleList
LIST_ENTRY InMemoryOrderModuleList; // 14, ref. to PLDR_DATA_TABLE_ENTRY->InMemoryOrderModuleList
LIST_ENTRY InInitializationOrderModuleList; // 1C, ref. to PLDR_DATA_TABLE_ENTRY->InInitializationOrderModuleList
} PEB_LDR_DATA, *PPEB_LDR_DATA;
typedef VOID NTSYSAPI (*PPEBLOCKROUTINE)(PVOID);
typedef struct _SYSTEM_STRINGS
{
UNICODE_STRING SystemRoot; // C:\WINNT
UNICODE_STRING System32Root; // C:\WINNT\System32
UNICODE_STRING BaseNamedObjects; // \BaseNamedObjects
} SYSTEM_STRINGS,*PSYSTEM_STRINGS;
typedef struct _TEXT_INFO
{
PVOID Reserved;
PSYSTEM_STRINGS SystemStrings;
} TEXT_INFO, *PTEXT_INFO;
// See: http://en.wikipedia.org/wiki/Process_Environment_Block
typedef struct _PEB
{
UCHAR InheritedAddressSpace; // 0
UCHAR ReadImageFileExecOptions; // 1
UCHAR BeingDebugged; // 2
BYTE b003; // 3
PVOID Mutant; // 4
PVOID ImageBaseAddress; // 8
PPEB_LDR_DATA Ldr; // C
PPROCESS_PARAMETERS ProcessParameters; // 10
PVOID SubSystemData; // 14
PVOID ProcessHeap; // 18
KSPIN_LOCK FastPebLock; // 1C
PPEBLOCKROUTINE FastPebLockRoutine; // 20
PPEBLOCKROUTINE FastPebUnlockRoutine; // 24
ULONG EnvironmentUpdateCount; // 28
PVOID *KernelCallbackTable; // 2C
PVOID EventLogSection; // 30
PVOID EventLog; // 34
PPEB_FREE_BLOCK FreeList; // 38
ULONG TlsExpansionCounter; // 3C
PRTL_BITMAP TlsBitmap; // 40
ULONG TlsBitmapData[0x2]; // 44
PVOID ReadOnlySharedMemoryBase; // 4C
PVOID ReadOnlySharedMemoryHeap; // 50
PTEXT_INFO ReadOnlyStaticServerData; // 54
PVOID InitAnsiCodePageData; // 58
PVOID InitOemCodePageData; // 5C
PVOID InitUnicodeCaseTableData; // 60
ULONG KeNumberProcessors; // 64
ULONG NtGlobalFlag; // 68
DWORD d6C; // 6C
LARGE_INTEGER MmCriticalSectionTimeout; // 70
ULONG MmHeapSegmentReserve; // 78
ULONG MmHeapSegmentCommit; // 7C
ULONG MmHeapDeCommitTotalFreeThreshold; // 80
ULONG MmHeapDeCommitFreeBlockThreshold; // 84
ULONG NumberOfHeaps; // 88
ULONG AvailableHeaps; // 8C
PHANDLE ProcessHeapsListBuffer; // 90
PVOID GdiSharedHandleTable; // 94
PVOID ProcessStarterHelper; // 98
PVOID GdiDCAttributeList; // 9C
KSPIN_LOCK LoaderLock; // A0
ULONG NtMajorVersion; // A4
ULONG NtMinorVersion; // A8
USHORT NtBuildNumber; // AC
USHORT NtCSDVersion; // AE
ULONG PlatformId; // B0
ULONG Subsystem; // B4
ULONG MajorSubsystemVersion; // B8
ULONG MinorSubsystemVersion; // BC
KAFFINITY AffinityMask; // C0
ULONG GdiHandleBuffer[0x22]; // C4
ULONG PostProcessInitRoutine; // 14C
ULONG TlsExpansionBitmap; // 150
UCHAR TlsExpansionBitmapBits[0x80]; // 154
ULONG SessionId; // 1D4
ULARGE_INTEGER AppCompatFlags; // 1D8
PWORD CSDVersion; // 1E0
/* PVOID AppCompatInfo; // 1E4
UNICODE_STRING usCSDVersion;
PVOID ActivationContextData;
PVOID ProcessAssemblyStorageMap;
PVOID SystemDefaultActivationContextData;
PVOID SystemAssemblyStorageMap;
ULONG MinimumStackCommit; */
} PEB, *PPEB;
typedef struct _PEB64 {
BYTE Reserved1[2];
BYTE BeingDebugged;
BYTE Reserved2[21];
PPEB_LDR_DATA Ldr;
PPROCESS_PARAMETERS ProcessParameters;
BYTE Reserved3[520];
ULONG PostProcessInitRoutine;
BYTE Reserved4[136];
ULONG SessionId;
} PEB64;
typedef struct _TEB
{
NT_TIB Tib;
PVOID EnvironmentPointer;
CLIENT_ID Cid;
PVOID ActiveRpcInfo;
PVOID ThreadLocalStoragePointer;
PPEB Peb;
ULONG LastErrorValue;
ULONG CountOfOwnedCriticalSections;
PVOID CsrClientThread;
PVOID Win32ThreadInfo;
ULONG Win32ClientInfo[0x1F];
PVOID WOW32Reserved;
ULONG CurrentLocale;
ULONG FpSoftwareStatusRegister;
PVOID SystemReserved1[0x36];
PVOID Spare1;
LONG ExceptionCode;
ULONG SpareBytes1[0x28];
PVOID SystemReserved2[0xA];
ULONG gdiRgn;
ULONG gdiPen;
ULONG gdiBrush;
CLIENT_ID RealClientId;
PVOID GdiCachedProcessHandle;
ULONG GdiClientPID;
ULONG GdiClientTID;
PVOID GdiThreadLocaleInfo;
PVOID UserReserved[5];
PVOID glDispatchTable[0x118];
ULONG glReserved1[0x1A];
PVOID glReserved2;
PVOID glSectionInfo;
PVOID glSection;
PVOID glTable;
PVOID glCurrentRC;
PVOID glContext;
NTSTATUS LastStatusValue;
UNICODE_STRING StaticUnicodeString;
WCHAR StaticUnicodeBuffer[0x105];
PVOID DeallocationStack;
PVOID TlsSlots[0x40];
LIST_ENTRY TlsLinks;
PVOID Vdm;
PVOID ReservedForNtRpc;
PVOID DbgSsReserved[0x2];
ULONG HardErrorDisabled;
PVOID Instrumentation[0x10];
PVOID WinSockData;
ULONG GdiBatchCount;
ULONG Spare2;
ULONG Spare3;
ULONG Spare4;
PVOID ReservedForOle;
ULONG WaitingOnLoaderLock;
PVOID StackCommit;
PVOID StackCommitMax;
PVOID StackReserve;
} TEB, *PTEB;
typedef enum _POOL_TYPE
{
NonPagedPool,
PagedPool,
NonPagedPoolMustSucceed,
DontUseThisType,
NonPagedPoolCacheAligned,
PagedPoolCacheAligned,
NonPagedPoolCacheAlignedMustS,
MaxPoolType
} POOL_TYPE, *PPOOL_TYPE;
typedef enum _KWAIT_REASON
{
Executive,
FreePage,
PageIn,
PoolAllocation,
DelayExecution,
Suspended,
UserRequest,
WrExecutive,
WrFreePage,
WrPageIn,
WrPoolAllocation,
WrDelayExecution,
WrSuspended,
WrUserRequest,
WrEventPair,
WrQueue,
WrLpcReceive,
WrLpcReply,
WrVirtualMemory,
WrPageOut,
WrRendezvous,
Spare2,
Spare3,
Spare4,
Spare5,
Spare6,
WrKernel,
MaximumWaitReason
} KWAIT_REASON, *PKWAIT_REASON;
typedef struct _DISPATCHER_HEADER
{
BYTE uType; //DO_TYPE_*
BYTE uAbsolute;
BYTE uSize; // number of DWORDs
BYTE uInserted;
LONG lSignalState;
LIST_ENTRY WaitListHead;
} DISPATCHER_HEADER, *PDISPATCHER_HEADER;
typedef struct _KPROCESS
{
DISPATCHER_HEADER Header; // DO_TYPE_PROCESS (0x1A)
LIST_ENTRY le10;
DWORD d18;
DWORD d1C;
DWORD d20;
DWORD d24;
DWORD d28;
DWORD d2C;
DWORD d30;
DWORD d34;
DWORD dKernelTime; // ticks
DWORD dUserTime; // ticks
LIST_ENTRY le40;
LIST_ENTRY OutSwapList;
LIST_ENTRY ThreadListHead; // KTHREAD.ThreadList
DWORD d58;
KAFFINITY AffinityMask;
WORD w60;
BYTE bBasePriority;
BYTE b63;
WORD w64;
BYTE b66;
BOOLEAN fPriorityBoost;
} KPROCESS, *PKPROCESS;
typedef struct _PORT_MESSAGE
{
USHORT DataSize;
USHORT MessageSize;
USHORT MessageType;
USHORT VirtualRangesOffset;
CLIENT_ID ClientId;
ULONG MessageId;
ULONG SectionSize;
//UCHAR Data[];
} PORT_MESSAGE, *PPORT_MESSAGE;
typedef struct _SERVICE_DESCRIPTOR_TABLE
{
PNTSYSCALL ServiceTable; // array of entrypoints
PULONG puCounterTable; // array of counters
ULONG uTableSize; // number of table entries
PBYTE pbArgumentTable; // array of byte counts
} SERVICE_DESCRIPTOR_TABLE, *PSERVICE_DESCRIPTOR_TABLE;
typedef struct _KSEMAPHORE
{
DISPATCHER_HEADER Header;
LONG lLimit;
} KSEMAPHORE, *PKSEMAPHORE;
typedef struct _KTHREAD
{
DISPATCHER_HEADER Header; // DO_TYPE_THREAD (0x6C)
LIST_ENTRY le010;
DWORD d018;
DWORD d01C;
PTEB pTeb;
DWORD d024;
DWORD d028;
BYTE b02C;
BYTE bThreadState; // THREAD_STATE_*
WORD w02E;
WORD w030;
BYTE b032;
BYTE bPriority;
LIST_ENTRY le034;
LIST_ENTRY le03C;
PKPROCESS pProcess;
DWORD d048;
DWORD dContextSwitches;
DWORD d050;
WORD w054;
BYTE b056;
BYTE bWaitReason;
DWORD d058;
PLIST_ENTRY ple05C;
PLIST_ENTRY ple060;
DWORD d064;
BYTE bBasePriority;
BYTE b069;
WORD w06A;
DWORD d06C;
DWORD d070;
DWORD d074;
DWORD d078;
DWORD d07C;
DWORD d080;
DWORD d084;
DWORD d088;
DWORD d08C;
DWORD d090;
DWORD d094;
DWORD d098;
DWORD d09C;
DWORD d0A0;
DWORD d0A4;
DWORD d0A8;
DWORD d0AC;
DWORD d0B0;
DWORD d0B4;
DWORD d0B8;
DWORD d0BC;
DWORD d0C0;
DWORD d0C4;
DWORD d0C8;
DWORD d0CC;
DWORD d0D0;
DWORD d0D4;
DWORD d0D8;
PSERVICE_DESCRIPTOR_TABLE pServiceDescriptorTable;
DWORD d0E0;
DWORD d0E4;
DWORD d0E8;
DWORD d0EC;
LIST_ENTRY le0F0;
DWORD d0F8;
DWORD d0FC;
DWORD d100;
DWORD d104;
DWORD d108;
DWORD d10C;
DWORD d110;
DWORD d114;
DWORD d118;
BYTE b11C;
BYTE b11D;
WORD w11E;
DWORD d120;
DWORD d124;
DWORD d128;
DWORD d12C;
DWORD d130;
WORD w134;
BYTE b136;
KPROCESSOR_MODE ProcessorMode;
DWORD dKernelTime; // ticks
DWORD dUserTime; // ticks
DWORD d140;
DWORD d144;
DWORD d148;
DWORD d14C;
DWORD d150;
DWORD d154;
DWORD d158;
DWORD d15C;
DWORD d160;
DWORD d164;
DWORD d168;
DWORD d16C;
DWORD d170;
PROC SuspendNop;
DWORD d178;
DWORD d17C;
DWORD d180;
DWORD d184;
DWORD d188;
DWORD d18C;
KSEMAPHORE SuspendSemaphore;
LIST_ENTRY ThreadList; // KPROCESS.ThreadListHead
DWORD d1AC;
} KTHREAD, *PKTHREAD;
typedef struct _ETHREAD
{
KTHREAD Tcb;
LARGE_INTEGER liCreateTime;
LARGE_INTEGER liExitTime;
NTSTATUS ExitStatus;
LIST_ENTRY PostBlockList;
LIST_ENTRY TerminationPortList;
ULONG uActiveTimerListLock;
LIST_ENTRY ActiveTimerListHead;
CLIENT_ID Cid;
KSEMAPHORE LpcReplySemaphore;
ULONG uLpcReplyMessage;
LARGE_INTEGER liLpcReplyMessageId;
ULONG uImpersonationInfo;
LIST_ENTRY IrpList;
LIST_ENTRY TopLevelIrp;
ULONG uReadClusterSize;
BOOLEAN fForwardClusterOnly;
BOOLEAN fDisablePageFaultClustering;
BOOLEAN fDeadThread;
BOOLEAN fHasTerminated;
ULONG uEventPair;
ULONG uGrantedAccess;
ULONG uThreadsProcess;
PVOID pStartAddress;
PVOID Win32StartAddress;
BOOLEAN fLpcExitThreadCalled;
BOOLEAN fHardErrorsAreDisabled;
WORD wUknown1;
DWORD dwUknown2;
} ETHREAD, *PETHREAD;
typedef PETHREAD
ERESOURCE_THREAD, *PERESOURCE_THREAD;
typedef struct _KEVENT
{
DISPATCHER_HEADER Header;
} KEVENT, *PKEVENT;
typedef struct _ERESOURCE_OLD
{
LIST_ENTRY SystemResourcesList;
PERESOURCE_THREAD OwnerThreads;
PBYTE pbOwnerCounts;
WORD wTableSize;
WORD wActiveCount;
WORD wFlag;
WORD wTableRover;
BYTE bInitialOwnerCounts[4];
ERESOURCE_THREAD InitialOwnerThreads[4];
DWORD dwUknown1;
ULONG uContentionCount;
WORD wNumberOfExclusiveWaiters;
WORD wNumberOfSharedWaiters;
KSEMAPHORE SharedWaiters;
KEVENT ExclusiveWaiters;
KSPIN_LOCK SpinLock;
ULONG uCreatorBackTraceIndex;
WORD wDepth;
WORD wUknown2;
PVOID pOwnerBackTrace[4];
} ERESOURCE_OLD, *PERESOURCE_OLD;
typedef struct _OWNER_ENTRY
{
ERESOURCE_THREAD OwnerThread;
SHORT sOwnerCount;
WORD wTableSize;
} OWNER_ENTRY, *POWNER_ENTRY;
typedef struct _ERESOURCE_LITE
{
LIST_ENTRY SystemResourcesList;
POWNER_ENTRY OwnerTable;
SHORT sActiveCount;
WORD wFlag;
PKSEMAPHORE SharedWaiters;
PKEVENT ExclusiveWaiters;
OWNER_ENTRY OwnerThreads[2];
ULONG uContentionCount;
WORD wNumberOfSharedWaiters;
WORD wNumberOfExclusiveWaiters;
union
{
PVOID pAddress;
ULONG uCreatorBackTraceIndex;
};
KSPIN_LOCK SpinLock;
} ERESOURCE_LITE, *PERESOURCE_LITE;
typedef ERESOURCE_LITE ERESOURCE,
*PERESOURCE;
typedef struct _IO_STATUS_BLOCK
{
NTSTATUS Status;
ULONG uInformation;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
/* Defined in Winnt.h
typedef struct _QUOTA_LIMITS {
SIZE_T PagedPoolLimit;
SIZE_T NonPagedPoolLimit;
SIZE_T MinimumWorkingSetSize;
SIZE_T MaximumWorkingSetSize;
SIZE_T PagefileLimit;
LARGE_INTEGER TimeLimit;
} QUOTA_LIMITS, *PQUOTA_LIMITS;
*/
typedef struct _IOCOUNTERS
{
ULONG uReadOperationCount;
ULONG uWriteOperationCount;
ULONG uOtherOperationCount;
LARGE_INTEGER liReadTransferCount;
LARGE_INTEGER liWriteTransferCount;
LARGE_INTEGER liOtherTransferCount;
} IOCOUNTERS, *PIOCOUNTERS;
typedef struct _VM_COUNTERS
{
ULONG uPeakVirtualSize;
ULONG uVirtualSize;
ULONG uPageFaultCount;
ULONG uPeakWorkingSetSize;
ULONG uWorkingSetSize;
ULONG uQuotaPeakPagedPoolUsage;
ULONG uQuotaPagedPoolUsage;
ULONG uQuotaPeakNonPagedPoolUsage;
ULONG uQuotaNonPagedPoolUsage;
ULONG uPagefileUsage;
ULONG uPeakPagefileUsage;
} VM_COUNTERS, *PVM_COUNTERS;
typedef struct _KERNEL_USER_TIMES
{
LARGE_INTEGER liCreateTime;
LARGE_INTEGER liExitTime;
LARGE_INTEGER liKernelTime;
LARGE_INTEGER liUserTime;
} KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
typedef struct _BASE_PRIORITY_INFORMATION
{
KPRIORITY BasePriority;
} BASE_PRIORITY_INFORMATION, *PBASE_PRIORITY_INFORMATION;
typedef struct _AFFINITY_MASK
{
KAFFINITY AffinityMask;
} AFFINITY_MASK, *PAFFINITY_MASK;
typedef struct _TIME_FIELDS
{
WORD wYear;
WORD wMonth;
WORD wDay;
WORD wHour;
WORD wMinute;
WORD wSecond;
WORD wMilliseconds;
WORD wWeekday;
} TIME_FIELDS, *PTIME_FIELDS;
typedef void (*PIO_APC_ROUTINE)
(PVOID ApcContext,
PIO_STATUS_BLOCK IoStatusBlock,
ULONG Reserved);
#if(_WIN32_WINNT < 0x0400)
typedef struct _NTVOLUME_DATA_BUFFER
{
LARGE_INTEGER liSerialNumber;
LARGE_INTEGER liNumberOfSectors;
LARGE_INTEGER liTotalClusters;
LARGE_INTEGER liFreeClusters;
LARGE_INTEGER liReserved;
ULONG uBytesPerSector;
ULONG uBytesPerCluster;
ULONG uBytesPerMFTRecord;
ULONG uClustersPerMFTRecord;
LARGE_INTEGER liMFTLength;
LARGE_INTEGER liMFTStart;
LARGE_INTEGER liMFTMirrorStart;
LARGE_INTEGER liMFTZoneStart;
LARGE_INTEGER liMFTZoneEnd;
} NTFS_VOLUME_DATA_BUFFER, *PNTFS_VOLUME_DATA_BUFFER;
#endif // _WIN23_WINNT < 0x0400
typedef struct _OBJDIR_INFORMATION
{
UNICODE_STRING ObjectName;
UNICODE_STRING ObjectTypeName; // e.g. Directory, Device ...
UCHAR Data[1]; // variable length
} OBJDIR_INFORMATION, *POBJDIR_INFORMATION;
// Define the file system information class values
typedef enum _FSINFOCLASS {
FileFsVolumeInformation = 1,
FileFsLabelInformation, // 2
FileFsSizeInformation, // 3
FileFsDeviceInformation, // 4
FileFsAttributeInformation, // 5
FileFsControlInformation, // 6
FileFsFullSizeInformation, // 7
FileFsObjectIdInformation, // 8
FileFsMaximumInformation
} FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;
typedef struct _FILE_FS_VOLUME_INFORMATION {
LARGE_INTEGER VolumeCreationTime;
ULONG VolumeSerialNumber;
ULONG VolumeLabelLength;
BOOLEAN SupportsObjects;
WCHAR VolumeLabel[1];
} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
typedef struct _FILE_FS_LABEL_INFORMATION {
ULONG VolumeLabelLength;
WCHAR VolumeLabel[1];
} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
typedef struct _FILE_FS_SIZE_INFORMATION {
LARGE_INTEGER TotalAllocationUnits;
LARGE_INTEGER AvailableAllocationUnits;
ULONG SectorsPerAllocationUnit;
ULONG BytesPerSector;
} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
typedef struct _FILE_FS_DEVICE_INFORMATION {
DEVICE_TYPE DeviceType;
ULONG Characteristics;
} FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;
typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
ULONG FileSystemAttributes;
LONG MaximumComponentNameLength;
ULONG FileSystemNameLength;
WCHAR FileSystemName[1];
} FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
typedef struct _FILE_FS_CONTROL_INFORMATION {
LARGE_INTEGER FreeSpaceStartFiltering;
LARGE_INTEGER FreeSpaceThreshold;
LARGE_INTEGER FreeSpaceStopFiltering;
LARGE_INTEGER DefaultQuotaThreshold;
LARGE_INTEGER DefaultQuotaLimit;
ULONG FileSystemControlFlags;
} FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;
typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
LARGE_INTEGER TotalQuotaAllocationUnits;
LARGE_INTEGER AvailableQuotaAllocationUnits;
LARGE_INTEGER AvailableAllocationUnits;
ULONG SectorsPerAllocationUnit;
ULONG BytesPerSector;
} FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
typedef struct _FILE_FS_OBJECT_ID_INFORMATION {
GUID VolumeObjectId;
ULONG VolumeObjectIdExtendedInfo[12];
} FILE_FS_OBJECT_ID_INFORMATION, *PFILE_FS_OBJECT_ID_INFORMATION;
typedef enum _SYSTEMINFOCLASS
{
SystemBasicInformation, // 0x002C
SystemProcessorInformation, // 0x000C
SystemPerformanceInformation, // 0x0138
SystemTimeInformation, // 0x0020
SystemPathInformation, // not implemented
SystemProcessInformation, // 0x00C8+ per process
SystemCallInformation, // 0x0018 + (n * 0x0004)
SystemConfigurationInformation, // 0x0018
SystemProcessorCounters, // 0x0030 per cpu
SystemGlobalFlag, // 0x0004 (fails if size != 4)
SystemCallTimeInformation, // not implemented
SystemModuleInformation, // 0x0004 + (n * 0x011C)
SystemLockInformation, // 0x0004 + (n * 0x0024)
SystemStackTraceInformation, // not implemented
SystemPagedPoolInformation, // checked build only
SystemNonPagedPoolInformation, // checked build only
SystemHandleInformation, // 0x0004 + (n * 0x0010)
SystemObjectTypeInformation, // 0x0038+ + (n * 0x0030+)
SystemPageFileInformation, // 0x0018+ per page file
SystemVdmInstemulInformation, // 0x0088
SystemVdmBopInformation, // invalid info class
SystemCacheInformation, // 0x0024
SystemPoolTagInformation, // 0x0004 + (n * 0x001C)
SystemInterruptInformation, // 0x0000, or 0x0018 per cpu
SystemDpcInformation, // 0x0014
SystemFullMemoryInformation, // checked build only
SystemLoadDriver, // 0x0018, set mode only
SystemUnloadDriver, // 0x0004, set mode only
SystemTimeAdjustmentInformation, // 0x000C, 0x0008 writeable
SystemSummaryMemoryInformation, // checked build only
SystemNextEventIdInformation, // checked build only
SystemEventIdsInformation, // checked build only
SystemCrashDumpInformation, // 0x0004
SystemExceptionInformation, // 0x0010
SystemCrashDumpStateInformation, // 0x0004
SystemDebuggerInformation, // 0x0002
SystemContextSwitchInformation, // 0x0030
SystemRegistryQuotaInformation, // 0x000C
SystemAddDriver, // 0x0008, set mode only
SystemPrioritySeparationInformation, // 0x0004, set mode only
SystemPlugPlayBusInformation, // not implemented
SystemDockInformation, // not implemented
SystemPowerInfo, // 0x0060 (XP only!)
SystemProcessorSpeedInformation, // 0x000C (XP only!)
SystemTimeZoneInformation, // 0x00AC
SystemLookasideInformation, // n * 0x0020
SystemSetTimeSlipEvent,
SystemCreateSession, // set mode only
SystemDeleteSession, // set mode only
SystemInvalidInfoClass1, // invalid info class
SystemRangeStartInformation, // 0x0004 (fails if size != 4)
SystemVerifierInformation,
SystemAddVerifier,
SystemSessionProcessesInformation, // checked build only
MaxSystemInfoClass
} SYSTEMINFOCLASS, *PSYSTEMINFOCLASS;
typedef struct _SYSTEM_BASIC_INFORMATION
{
DWORD dwUnknown1; // 0
ULONG uKeMaximumIncrement; // x86: 0x0002625A or 0x00018730
ULONG uPageSize; // bytes
ULONG uMmNumberOfPhysicalPages;
ULONG uMmLowestPhysicalPage;
ULONG uMmHighestPhysicalPage;
ULONG uAllocationGranularity; // bytes
PVOID pLowestUserAddress;
PVOID pMmHighestUserAddress;
KAFFINITY uKeActiveProcessors;
BYTE bKeNumberProcessors;
BYTE bUnknown2;
WORD wUnknown3;
} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
typedef struct _SYSTEM_PROCESSOR_INFORMATION
{
WORD wKeProcessorArchitecture; // PROCESSOR_ARCHITECTURE_* (PROCESSOR_ARCHITECTURE_INTEL)
WORD wKeProcessorLevel; // PROCESSOR_* (PROCESSOR_INTEL_PENTIUM)
WORD wKeProcessorRevision; // Pentium: H=model, L=stepping
WORD wUnknown1; // 0
ULONG uKeFeatureBits;
} SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION;
typedef struct _MM_INFO_COUNTERS
{
ULONG uPageFaults;
ULONG uWriteCopyFaults;
ULONG uTransistionFaults;
ULONG uCacheTransitionCount;
ULONG uDemandZeroFaults;
ULONG uPagesRead;
ULONG uPageReadIos;
ULONG uCacheReadCount;
ULONG uCacheIoCount;
ULONG uPagefilePagesWritten;
ULONG uPagefilePageWriteIos;
ULONG uMappedFilePagesWritten;
ULONG uMappedFilePageWriteIos;
} MM_INFO_COUNTERS, *PMM_INFO_COUNTERS;
typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{
LARGE_INTEGER liIdleTime; // 100 nsec units
LARGE_INTEGER liIoReadTransferCount;
LARGE_INTEGER liIoWriteTransferCount;
LARGE_INTEGER liIoOtherTransferCount;
ULONG uIoReadOperationCount;
ULONG uIoWriteOperationCount;
ULONG uIoOtherOperationCount;
ULONG uMmAvailablePages;
ULONG uMmTotalCommittedPages;
ULONG uMmTotalCommitLimit; // pages
ULONG uMmPeakCommitLimit; // pages
MM_INFO_COUNTERS MmInfoCounters;
ULONG uPoolPaged; // pages
ULONG uPoolNonPaged; // pages
ULONG uPagedPoolAllocs;
ULONG uPagedPoolFrees;
ULONG uNonPagedPoolAllocs;
ULONG uNonPagedPoolFrees;
ULONG uMmTotalFreeSystemPages;
ULONG uMmSystemCodePage;
ULONG uMmTotalSystemDriverPages;
ULONG uMmTotalSystemCodePages;
ULONG uSmallNonPagedLookasideListAllocateHits;
ULONG uSmallPagedLookasideListAllocateHits;
DWORD dwUnknown1;
ULONG uMmSystemCachePage;
ULONG uMmPagedPoolPage;
ULONG uMmSystemDriverPage;
ULONG uCcFastReadNoWait;
ULONG uCcFastReadWait;
ULONG uCcFastReadResourceMiss;
ULONG uCcFastReadNotPossible;
ULONG uCcFastMdlReadNoWait;
ULONG uCcFastMdlReadWait;
ULONG uCcFastMdlReadResourceMiss;
ULONG uCcFastMdlReadNotPossible;
ULONG uCcMapDataNoWait;
ULONG uCcMapDataWait;
ULONG uCcMapDataNoWaitMiss;
ULONG uCcMapDataWaitMiss;
ULONG uCcPinMappedDataCount;
ULONG uCcPinReadNoWait;
ULONG uCcPinReadWait;
ULONG uCcPinReadNoWaitMiss;
ULONG uCcPinReadWaitMiss;
ULONG uCcCopyReadNoWait;
ULONG uCcCopyReadWait;
ULONG uCcCopyReadNoWaitMiss;
ULONG uCcCopyReadWaitMiss;
ULONG uCcMdlReadNoWait;
ULONG uCcMdlReadWait;
ULONG uCcMdlReadNoWaitMiss;
ULONG uCcMdlReadWaitMiss;
ULONG uCcReadAheadIos;
ULONG uCcLazyWriteIos;
ULONG uCcLazyWritePages;
ULONG uCcDataFlushes;
ULONG uCcDataPages;
ULONG uTotalContextSwitches; // total across cpus
ULONG uFirstLevelTbFills;
ULONG uSecondLevelTbFills;
ULONG uSystemCalls;
} SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;
typedef struct _SYSTEM_TIME_INFORMATION
{
LARGE_INTEGER liKeBootTime; // relative to 01-01-1601
LARGE_INTEGER liKeSystemTime; // relative to 01-01-1601
LARGE_INTEGER liExpTimeZoneBias; // utc time = local time + bias
ULONG uExpCurrentTimeZoneId; // TIME_ZONE_ID_* (TIME_ZONE_ID_UNKNOWN, etc.)
DWORD dwUnknown1;
} SYSTEM_TIME_INFORMATION, *PSYSTEM_TIME_INFORMATION;
typedef enum
{
StateInitialized,
StateReady,
StateRunning,
StateStandby,
StateTerminated,
StateWait,
StateTransition,
StateUnknown
} THREAD_STATE;
/*typedef struct _IO_COUNTERSEX
{
LARGE_INTEGER ReadOperationCount;
LARGE_INTEGER WriteOperationCount;
LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
} IO_COUNTERS, *PIO_COUNTERS;*/
typedef struct _SYSTEM_THREAD {
FILETIME ftKernelTime; // 100 nsec units
FILETIME ftUserTime; // 100 nsec units
FILETIME ftCreateTime; // relative to 01-01-1601
DWORD dWaitTime;
PVOID pStartAddress;
CLIENT_ID Cid; // process/thread ids
DWORD dPriority;
DWORD dBasePriority;
DWORD dContextSwitches;
DWORD dThreadState; // 2=running, 5=waiting
KWAIT_REASON WaitReason;
DWORD dReserved01;
} SYSTEM_THREAD, * PSYSTEM_THREAD, **PPSYSTEM_THREAD;
typedef struct _SYSTEM_PROCESS_INFORMATION { // common members
DWORD dNext; // relative offset
DWORD dThreadCount;
DWORD dReserved01;
DWORD dReserved02;
DWORD dReserved03;
DWORD dReserved04;
DWORD dReserved05;
DWORD dReserved06;
FILETIME ftCreateTime; // relative to 01-01-1601
FILETIME ftUserTime; // 100 nsec units
FILETIME ftKernelTime; // 100 nsec units
UNICODE_STRING usName;
KPRIORITY BasePriority;
DWORD dUniqueProcessId;
DWORD dInheritedFromUniqueProcessId;
DWORD dHandleCount;
DWORD dReserved07;
DWORD dReserved08;
VM_COUNTERS VmCounters; // see ntddk.h
DWORD dCommitCharge; // bytes
LARGE_INTEGER Reserved6[6];
} SYSTEM_PROCESS_INFORMATION, * PSYSTEM_PROCESS_INFORMATION, **PPSYSTEM_PROCESS_INFORMATION;
typedef struct _SYSTEM_PROCESS_INFORMATION_NT4 { // Windows NT 4.0
SYSTEM_PROCESS_INFORMATION Process; // common members
SYSTEM_THREAD aThreads [1]; // thread array
} SYSTEM_PROCESS_INFORMATION_NT4, * PSYSTEM_PROCESS_INFORMATION_NT4, **PPSYSTEM_PROCESS_INFORMATION_NT4;
typedef struct _SYSTEM_PROCESS_NT5 { // Windows 2000 and up
SYSTEM_PROCESS_INFORMATION Process; // common members
IO_COUNTERS IoCounters; // see ntddk.h
SYSTEM_THREAD aThreads [1]; // thread array
} SYSTEM_PROCESS_INFORMATION_NT5, * PSYSTEM_PROCESS_INFORMATION_NT5, **PPSYSTEM_PROCESS_INFORMATION_NT5;
typedef struct _SYSTEM_CALL_INFORMATION
{
ULONG Length;
ULONG NumberOfTables;
// ULONG NumberOfEntries[NumberOfTables]
// ULONG CallCounts[NumberOfTables][NumberOfEntries];
} SYSTEM_CALL_INFORMATION, *PSYSTEM_CALL_INFORMATION;
typedef struct _SYSTEM_CONFIGURATION_INFORMATION
{
ULONG uDiskCount;
ULONG uFloppyCount;
ULONG uCDRomCount;
ULONG uTapeCount;
ULONG uSerialCount; // com port with mouse not included
ULONG uParallelCount;
} SYSTEM_CONFIGURATION_INFORMATION, *PSYSTEM_CONFIGURATION_INFORMATION;
typedef struct _SYSTEM_PROCESSOR_COUNTERS
{
LARGE_INTEGER liProcessorTime; // 100 nsec units
LARGE_INTEGER liKernelTime; // 100 nsec units
LARGE_INTEGER liUserTime; // 100 nsec units
LARGE_INTEGER liDpcTime; // 100 nsec units
LARGE_INTEGER liInterruptTime; // 100 nsec units
ULONG uInterruptCount;
DWORD dwUnknown1;
} SYSTEM_PROCESSOR_COUNTERS, *PSYSTEM_PROCESSOR_COUNTERS;
typedef struct _SYSTEM_GLOBAL_FLAG
{
ULONG NtGlobalFlag; // see Q147314, Q102985, Q105677
} SYSTEM_GLOBAL_FLAG, *PSYSTEM_GLOBAL_FLAG;
typedef struct _SYSTEM_CALL_TIME_INFORMATION
{
ULONG Length;
ULONG TotalCalls;
LARGE_INTEGER TimeOfCalls[1];
} SYSTEM_CALL_TIME_INFORMATION, *PSYSTEM_CALL_TIME_INFORMATION;
typedef struct _SYSTEM_MODULE
{
ULONG Reserved[2];
ULONG Base;
ULONG Size;
ULONG Flags;
USHORT Index;
USHORT Unknown;
USHORT LoadCount;
USHORT ModuleNameOffset;
CHAR ImageName[256];
} SYSTEM_MODULE, *PSYSTEM_MODULE;
typedef struct _SYSTEM_MODULE_INFORMATION
{
ULONG uCount;
SYSTEM_MODULE aSM[];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
typedef struct _SYSTEM_LOCK
{
union
{
PERESOURCE_OLD pEResourceOld; // old ERESOURCE format
PERESOURCE_LITE pEResourceLite; // new "lite" format
PERESOURCE pEResource; // current format
};
WORD wUnknown1; // 1
WORD wUnknown2; // 0
ULONG ExclusiveOwnerThreadId;
ULONG uActiveCount;
ULONG uContentionCount;
DWORD dwUnknown3;
DWORD dwUnknown4;
ULONG uNumberOfSharedWaiters;
ULONG uNumberOfExclusiveWaiters;
} SYSTEM_LOCK, *PSYSTEM_LOCK;
typedef struct _SYSTEM_LOCK_INFORMATION
{
ULONG uCount;
SYSTEM_LOCK aSL[];
} SYSTEM_LOCK_INFORMATION, *PSYSTEM_LOCK_INFORMATION;
typedef struct _SYSTEM_HANDLE
{
ULONG uIdProcess;
UCHAR ObjectType; // OB_TYPE_* (OB_TYPE_TYPE, etc.)
UCHAR Flags; // HANDLE_FLAG_* (HANDLE_FLAG_INHERIT, etc.)
USHORT Handle;
POBJECT pObject;
ACCESS_MASK GrantedAccess;
} SYSTEM_HANDLE, *PSYSTEM_HANDLE;
typedef struct _SYSTEM_HANDLE_INFORMATION
{
ULONG NumberOfHandles;
SYSTEM_HANDLE Information[];
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
typedef struct _SYSTEM_OBJECTTYPE_INFORMATION
{
ULONG NextEntryOffset; // absolute offset
ULONG ObjectCount;
ULONG HandleCount;
ULONG TypeIndex; // OB_TYPE_* (OB_TYPE_TYPE, etc.)
ULONG InvalidAttributes; // OBJ_* (OBJ_INHERIT, etc.)
GENERIC_MAPPING GenericMapping;
ACCESS_MASK ValidAccessMask;
POOL_TYPE PoolType;
BOOLEAN SecurityRequired;
BOOLEAN WaitableObject;
UNICODE_STRING TypeName;
} SYSTEM_OBJECTTYPE_INFORMATION, *PSYSTEM_OBJECTTYPE_INFORMATION;
// follows after SYSTEM_OBJECTTYPE_INFORMATION.TypeName
typedef struct _SYSTEM_OBJECT_INFORMATION
{
ULONG NextEntryOffset; // absolute offset
POBJECT Object;
ULONG CreatorProcessId;
USHORT CreatorBackTraceIndex;
USHORT Flags; // see "Native API Reference" page 24
LONG PointerCount;
LONG HandleCount;
ULONG PagedPoolCharge;
ULONG NonPagedPoolCharge;
ULONG ExclusiveProcessId;
PSECURITY_DESCRIPTOR SecurityDescriptor;
UNICODE_STRING ObjectName;
} SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION;
typedef struct _SYSTEM_PAGE_FILE_INFORMATION
{
ULONG NextEntryOffset; // relative offset
ULONG CurrentSize; // pages
ULONG TotalUsed; // pages
ULONG PeakUsed; // pages
UNICODE_STRING FileName;
} SYSTEM_PAGE_FILE_INFORMATION, *PSYSTEM_PAGE_FILE_INFORMATION;
typedef struct _SYSTEM_VDM_INSTEMUL_INFO
{
BOOL fExVdmSegmentNotPresent;
ULONG uOpcode0FV86;
ULONG uOpcodeESPrefixV86;
ULONG uOpcodeCSPrefixV86;
ULONG uOpcodeSSPrefixV86;
ULONG uOpcodeDSPrefixV86;
ULONG uOpcodeFSPrefixV86;
ULONG uOpcodeGSPrefixV86;
ULONG uOpcodeOPER32PrefixV86;
ULONG uOpcodeADDR32PrefixV86;
ULONG uOpcodeINSBV86;
ULONG uOpcodeINSWV86;
ULONG uOpcodeOUTSBV86;
ULONG uOpcodeOUTSWV86;
ULONG uOpcodePUSHFV86;
ULONG uOpcodePOPFV86;
ULONG uOpcodeINTnnV86;
ULONG uOpcodeINTOV86;
ULONG uOpcodeIRETV86;
ULONG uOpcodeINBimmV86;
ULONG uOpcodeINWimmV86;
ULONG uOpcodeOUTBimmV86;
ULONG uOpcodeOUTWimmV86;
ULONG uOpcodeINBV86;
ULONG uOpcodeINWV86;
ULONG uOpcodeOUTBV86;
ULONG uOpcodeOUTWV86;
ULONG uOpcodeLOCKPrefixV86;
ULONG uOpcodeREPNEPrefixV86;
ULONG uOpcodeREPPrefixV86;
ULONG uOpcodeHLTV86;
ULONG uOpcodeCLIV86;
ULONG uOpcodeSTIV86;
ULONG uVdmBopCount;
} SYSTEM_VDM_INSTEMUL_INFO, *PSYSTEM_VDM_INSTEMUL_INFO;
typedef struct _SYSTEM_CACHE_INFORMATION
{
ULONG uFileCache; // bytes
ULONG uFileCachePeak; // bytes
ULONG PageFaultCount;
ULONG MinimumWorkingSet;
ULONG MaximumWorkingSet;
ULONG TransitionSharedPages;
ULONG TransitionSharedPagesPeak;
ULONG Reserved[2];
} SYSTEM_CACHE_INFORMATION, *PSYSTEM_CACHE_INFORMATION;
typedef struct _SYSTEM_POOL_ENTRY
{
BOOLEAN Allocated;
BOOLEAN Spare0;
USHORT AllocatorBackTraceIndex;
ULONG Size;
union
{
UCHAR Tag[4];
ULONG TagUlong;
PVOID ProcessChargedQuota;
};
} SYSTEM_POOL_ENTRY, *PSYSTEM_POOL_ENTRY;
typedef struct _SYSTEM_POOL_INFORMATION
{
ULONG TotalSize;
PVOID FirstEntry;
USHORT EntryOverhead;
BOOLEAN PoolTagPresent;
BOOLEAN Spare0;
ULONG NumberOfEntries;
SYSTEM_POOL_ENTRY Entries[1];
} SYSTEM_POOL_INFORMATION, *PSYSTEM_POOL_INFORMATION;
typedef struct _SYSTEM_POOL_TAG
{
union
{
UCHAR Tag[4];
ULONG TagUlong;
};
ULONG PagedPoolAllocs;
ULONG PagedPoolFrees;
ULONG PagedPoolUsage;
ULONG NonPagedPoolAllocs;
ULONG NonPagedPoolFrees;
ULONG NonPagedPoolUsage;
} SYSTEM_POOL_TAG, *PSYSTEM_POOL_TAG;
typedef struct _SYSTEM_POOL_TAG_INFORMATION
{
ULONG uCount;
SYSTEM_POOL_TAG aSPT[];
} SYSTEM_POOL_TAG_INFORMATION, *PSYSTEM_POOL_TAG_INFORMATION;
typedef struct _SYSTEM_INTERRUPT_INFORMATION
{
ULONG ContextSwitches;
ULONG DpcCount;
ULONG DpcRate;
ULONG TimeIncrement;
ULONG DpcBypassCount;
ULONG ApcBypassCount;
} SYSTEM_INTERRUPT_INFORMATION, *PSYSTEM_INTERRUPT_INFORMATION;
typedef struct _SYSTEM_DPC_INFORMATION
{
DWORD dwUnknown1;
ULONG MaximumDpcQueueDepth;
ULONG MinimumDpcRate;
ULONG AdjustDpcThreshold;
ULONG IdealDpcRate;
} SYSTEM_DPC_INFORMATION, *PSYSTEM_DPC_INFORMATION;
typedef struct _SYSTEM_MEMORY_INFO
{
PUCHAR StringOffset;
USHORT ValidCount;
USHORT TransitionCount;
USHORT ModifiedCount;
USHORT PageTableCount;
} SYSTEM_MEMORY_INFO, *PSYSTEM_MEMORY_INFO;
typedef struct _SYSTEM_MEMORY_INFORMATION
{
ULONG InfoSize;
ULONG StringStart;
SYSTEM_MEMORY_INFO Memory[1];
} SYSTEM_MEMORY_INFORMATION, *PSYSTEM_MEMORY_INFORMATION;
typedef struct _SYSTEM_LOAD_DRIVER
{
UNICODE_STRING DriverName; // input
PVOID BaseAddress; // output
PVOID SectionPointer; // output
PVOID EntryPoint; // output
PIMAGE_EXPORT_DIRECTORY ExportDirectory; // output
} SYSTEM_LOAD_DRIVER, *PSYSTEM_LOAD_DRIVER;
typedef struct _SYSTEM_UNLOAD_DRIVER
{
PVOID SectionPointer;
} SYSTEM_UNLOAD_DRIVER, *PSYSTEM_UNLOAD_DRIVER;
typedef struct _SYSTEM_QUERY_TIME_ADJUSTMENT
{
ULONG TimeAdjustment;
ULONG MaximumIncrement;
BOOLEAN TimeSynchronization;
} SYSTEM_QUERY_TIME_ADJUSTMENT, *PSYSTEM_QUERY_TIME_ADJUSTMENT;
typedef struct _SYSTEM_SET_TIME_ADJUSTMENT
{
ULONG TimeAdjustment;
BOOLEAN TimeSynchronization;
} SYSTEM_SET_TIME_ADJUSTMENT, *PSYSTEM_SET_TIME_ADJUSTMENT;
typedef struct _SYSTEM_CRASH_DUMP_INFORMATION
{
HANDLE CrashDumpSectionHandle;
} SYSTEM_CRASH_DUMP_INFORMATION, *PSYSTEM_CRASH_DUMP_INFORMATION;
typedef struct _SYSTEM_CRASH_DUMP_INFORMATION_2000
{
HANDLE CrashDumpSectionHandle;
HANDLE Unknown; // Windows 2000 only
} SYSTEM_CRASH_DUMP_INFORMATION_2000, *PSYSTEM_CRASH_DUMP_INFORMATION_2000;
typedef struct _SYSTEM_EXCEPTION_INFORMATION
{
ULONG AlignmentFixupCount;
ULONG ExceptionDispatchCount;
ULONG FloatingEmulationCount;
ULONG ByteWordEmulationCount;
} SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION;
typedef struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION
{
ULONG ValidCrashDump;
} SYSTEM_CRASH_DUMP_STATE_INFORMATION, *PSYSTEM_CRASH_DUMP_STATE_INFORMATION;
typedef struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION_2000
{
ULONG ValidCrashDump;
ULONG Unknown; // Windows 2000 only
} SYSTEM_CRASH_DUMP_STATE_INFORMATION_2000, *PSYSTEM_CRASH_DUMP_STATE_INFORMATION_2000;
typedef struct _SYSTEM_DEBUGGER_INFORMATION
{
BOOLEAN KernelDebuggerEnabled;
BOOLEAN KernelDebuggerNotPresent;
} SYSTEM_DEBUGGER_INFORMATION, *PSYSTEM_DEBUGGER_INFORMATION;
typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION
{
ULONG ContextSwitches;
ULONG FindAny;
ULONG FindLast;
ULONG FindIdeal;
ULONG IdleAny;
ULONG IdleCurrent;
ULONG IdleLast;
ULONG IdleIdeal;
ULONG PreemptAny;
ULONG PreemptCurrent;
ULONG PreemptLast;
ULONG SwitchToIdle;
} SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION;
typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION
{
ULONG RegistryQuotaAllowed; // bytes
ULONG RegistryQuotaUsed; // bytes
ULONG PagedPoolSize; // bytes
} SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;
typedef struct _SYSTEM_ADD_DRIVER
{
UNICODE_STRING ModuleName;
} SYSTEM_ADD_DRIVER, *PSYSTEM_ADD_DRIVER;
typedef struct _SYSTEM_PRIORITY_SEPARATION_INFORMATION
{
ULONG PrioritySeparation; // 0..2
} SYSTEM_PRIORITY_SEPARATION_INFORMATION, *PSYSTEM_PRIORITY_SEPARATION_INFORMATION;
#define MAX_BUS_NAME 24
typedef enum _PLUGPLAY_BUS_CLASS
{
SystemBus,
PlugPlayVirtualBus,
MaxPlugPlayBusClass
} PLUGPLAY_BUS_CLASS, *PPLUGPLAY_BUS_CLASS;
typedef enum _PLUGPLAY_VIRTUAL_BUS_TYPE
{
Root,
MaxPlugPlayVirtualBusType
} PLUGPLAY_VIRTUAL_BUS_TYPE, *PPLUGPLAY_VIRTUAL_BUS_TYPE;
typedef enum _INTERFACE_TYPE
{
InterfaceTypeUndefined = -1,
Internal,
Isa,
Eisa,
MicroChannel,
TurboChannel,
PCIBus,
VMEBus,
NuBus,
PCMCIABus,
CBus,
MPIBus,
MPSABus,
ProcessorInternal,
InternalPowerBus,
PNPISABus,
PNPBus,
MaximumInterfaceType
}INTERFACE_TYPE, *PINTERFACE_TYPE;
typedef struct _PLUGPLAY_BUS_TYPE
{
PLUGPLAY_BUS_CLASS BusClass;
union
{
INTERFACE_TYPE SystemBusType;
PLUGPLAY_VIRTUAL_BUS_TYPE PlugPlayVirtualBusType;
};
} PLUGPLAY_BUS_TYPE, *PPLUGPLAY_BUS_TYPE;
typedef struct _PLUGPLAY_BUS_INSTANCE
{
PLUGPLAY_BUS_TYPE BusType;
ULONG BusNumber;
WCHAR BusName[MAX_BUS_NAME];
} PLUGPLAY_BUS_INSTANCE, *PPLUGPLAY_BUS_INSTANCE;
typedef struct _SYSTEM_PLUGPLAY_BUS_INFORMATION
{
ULONG BusCount;
PLUGPLAY_BUS_INSTANCE BusInstance[1];
} SYSTEM_PLUGPLAY_BUS_INFORMATION, *PSYSTEM_PLUGPLAY_BUS_INFORMATION;
typedef enum _SYSTEM_DOCK_STATE
{
SystemDockStateUnknown,
SystemUndocked,
SystemDocked
} SYSTEM_DOCK_STATE, *PSYSTEM_DOCK_STATE;
typedef struct _SYSTEM_DOCK_INFORMATION
{
SYSTEM_DOCK_STATE DockState;
INTERFACE_TYPE DeviceBusType;
ULONG DeviceBusNumber;
ULONG SlotNumber;
} SYSTEM_DOCK_INFORMATION, *PSYSTEM_DOCK_INFORMATION;
typedef struct _SYSTEM_POWER_INFORMATION // not for SystemPowerInfo !
{
BOOLEAN SystemSuspendSupported;
BOOLEAN SystemHibernateSupported;
BOOLEAN ResumeTimerSupportsSuspend;
BOOLEAN ResumeTimerSupportsHibernate;
BOOLEAN LidSupported;
BOOLEAN TurboSettingSupported;
BOOLEAN TurboMode;
BOOLEAN SystemAcOrDc;
BOOLEAN PowerDownDisabled;
LARGE_INTEGER SpindownDrives;
} SYSTEM_POWER_INFORMATION, *PSYSTEM_POWER_INFORMATION;
typedef struct _SYSTEM_PROCESSOR_SPEED_INFORMATION // not for SystemProcessorSpeedInformation !
{
ULONG MaximumProcessorSpeed;
ULONG CurrentAvailableSpeed;
ULONG ConfiguredSpeedLimit;
BOOLEAN PowerLimit;
BOOLEAN ThermalLimit;
BOOLEAN TurboLimit;
} SYSTEM_PROCESSOR_SPEED_INFORMATION, *PSYSTEM_PROCESSOR_SPEED_INFORMATION;
typedef struct _SYSTEM_TIME_ZONE_INFORMATION
{
LONG Bias;
WCHAR StandardName[32];
TIME_FIELDS StandardDate;
LONG StandardBias;
WCHAR DaylightName[32];
TIME_FIELDS DaylightDate;
LONG DaylightBias;
} SYSTEM_TIME_ZONE_INFORMATION, *PSYSTEM_TIME_ZONE_INFORMATION;
typedef struct _SYSTEM_LOOKASIDE
{
USHORT Depth;
USHORT MaximumDepth;
ULONG TotalAllocates;
ULONG AllocateMisses;
ULONG TotalFrees;
ULONG FreeMisses;
POOL_TYPE Type;
ULONG Tag;
ULONG Size;
} SYSTEM_LOOKASIDE, *PSYSTEM_LOOKASIDE;
typedef struct _SYSTEM_LOOKASIDE_INFORMATION
{
SYSTEM_LOOKASIDE asl[];
} SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION;
typedef struct _SYSTEM_SET_TIME_SLIP_EVENT
{
HANDLE TimeSlipEvent;
} SYSTEM_SET_TIME_SLIP_EVENT, *PSYSTEM_SET_TIME_SLIP_EVENT;
typedef struct _SYSTEM_CREATE_SESSION
{
ULONG Session;
} SYSTEM_CREATE_SESSION, *PSYSTEM_CREATE_SESSION;
typedef struct _SYSTEM_DELETE_SESSION
{
ULONG Session;
} SYSTEM_DELETE_SESSION, *PSYSTEM_DELETE_SESSION;
typedef struct _SYSTEM_RANGE_START_INFORMATION
{
PVOID SystemRangeStart;
} SYSTEM_RANGE_START_INFORMATION, *PSYSTEM_RANGE_START_INFORMATION;
// - NTAPI -
// See also: WSK 1.2
NTSYSAPI
NTSTATUS
NTAPI
NtQuerySystemInformation(
__in SYSTEMINFOCLASS SystemInformationClass,
__out PVOID pSystemInformation,
__in ULONG uSystemInformationLength,
__out_opt PULONG puReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
NtSetSystemInformation(
__in SYSTEMINFOCLASS SystemInformationClass,
__in PVOID pSystemInformation,
__in ULONG uSystemInformationLength
);
// Time functions
NTSYSAPI
NTSTATUS
NTAPI
NtQuerySystemTime(
__out PLARGE_INTEGER SystemTime
);
NTSYSAPI
NTSTATUS
NTAPI
NtSetSystemTime(
__in PLARGE_INTEGER NewTime,
__out_opt PLARGE_INTEGER OldTime
);
NTSYSAPI
VOID
NTAPI
RtlTimeToTimeFields(
__in PLARGE_INTEGER pliTime,
__out PTIME_FIELDS pTimeFields
);
NTSYSAPI
BOOLEAN
NTAPI
RtlTimeFieldsToTime(
__in PTIME_FIELDS pTimeFields,
__out PLARGE_INTEGER pliTime
);
NTSYSAPI
VOID
NTAPI
RtlSecondsSince1970ToTime(
__in ULONG SecondsSince1970,
__out PLARGE_INTEGER Time
);
NTSYSAPI
VOID
NTAPI
RtlTimeToSecondsSince1970(
__in PLARGE_INTEGER Time,
__out PULONG SecondsSince1970
);
//Mutex functions
NTSYSAPI
NTSTATUS
NTAPI
NtCreateMutant(
__out PHANDLE MutantHandle,
ACCESS_MASK AccessMask,
POBJECT_ATTRIBUTES pObjectAttributes,
BOOL InitialOwner
);
NTSYSAPI
NTSTATUS
NTAPI
NtOpenMutant(
__out PHANDLE MutantHandle,
ACCESS_MASK AccessMask,
POBJECT_ATTRIBUTES pObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
NtReleaseMutant(
__in HANDLE hMutex,
PULONG Optional
);
// Event functions
NTSYSAPI
NTSTATUS
NTAPI
NtCreateEvent(
__out PHANDLE EventHandle,
ACCESS_MASK AccessMask,
POBJECT_ATTRIBUTES pObjectAttributes,
DWORD AutoReset,
DWORD InitialState
);
NTSYSAPI
NTSTATUS
NTAPI
NtOpenEvent(
PHANDLE phEvent,
ACCESS_MASK AccessMask,
POBJECT_ATTRIBUTES pObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
NtClearEvent(
__in HANDLE hEvent
);
NTSYSAPI
NTSTATUS
NTAPI
NtSetEvent(
__in HANDLE hEvent,
__out_opt PLONG plSignaled
);
NTSYSAPI
NTSTATUS
NTAPI
NtCreateSemaphore(
__out PHANDLE SemaphoreHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes,
__in LONG InitialCount,
__in LONG MaximumCount
);
NTSYSAPI
NTSTATUS
NTAPI
NtOpenSemaphore(
__out PHANDLE SemaphoreHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
NtReleaseSemaphore(
__in HANDLE SemaphoreHandle,
__in LONG ReleaseCount,
__out_opt PLONG PreviousCount
);
typedef enum _SEMAPHORE_INFORMATION_CLASS
{
SemaphoreBasicInformation
} SEMAPHORE_INFORMATION_CLASS;
NTSYSAPI
NTSTATUS
NTAPI
NtQuerySemaphore(
__in HANDLE SemaphoreHandle,
__in SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,
__out PVOID SemaphoreInformation,
__in ULONG SemaphoreInformationLength,
__out_opt PULONG ResultLength
);
typedef struct _SEMAPHORE_BASIC_INFORMATION
{
LONG CurrentCount;
LONG MaximumCount;
} SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;
// Directory and Symbolic Link functions
NTSYSAPI
NTSTATUS
NTAPI
NtCreateDirectoryObject(
__out PHANDLE phDirectory,
__in ACCESS_MASK AccessMask,
__in POBJECT_ATTRIBUTES pObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
NtOpenDirectoryObject(
__out PHANDLE DirectoryHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes
);
typedef struct _DIRECTORY_CONTENTS
{
struct
{
UNICODE_STRING Name;
UNICODE_STRING Type;
} Entry[ANYSIZE_ARRAY];
} DIRECTORY_CONTENTS, *PDIRECTORY_CONTENTS;
NTSYSAPI
NTSTATUS
NTAPI
NtQueryDirectoryObject(
__in HANDLE DirectoryHandle,
__out PDIRECTORY_CONTENTS Buffer,
__in ULONG Length,
__in BOOLEAN ReturnSingleEntry,
__in BOOLEAN RestartScan,
__inout PULONG Index,
__out_opt PULONG ResultLength
);
NTSYSAPI
NTSTATUS
NTAPI
NtOpenSymbolicLinkObject(
__out PHANDLE SymbolicLinkHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
NtQuerySymbolicLinkObject(
__in HANDLE SymbolicLinkHandle,
__out PUNICODE_STRING NameString,
__out_opt PULONG ResultLength
);
// File functions
NTSYSAPI
NTSTATUS
NTAPI
NtCreateFile(
PHANDLE phFile,
ACCESS_MASK AccessMask,
POBJECT_ATTRIBUTES pObjectAttributes,
PIO_STATUS_BLOCK pIoStatusBlock,
PLARGE_INTEGER pliAllocationSize,
ULONG uFileAttributes,
ULONG uShareAccess,
ULONG uCreateDisposition,
ULONG uCreateOptions,
PVOID pEaBuffer,
ULONG uEaLength
);
NTSYSAPI
NTSTATUS
NTAPI
NtCreateNamedPipeFile(
PHANDLE phFile,
ACCESS_MASK AccessMask,
POBJECT_ATTRIBUTES pObjectAttributes,
PIO_STATUS_BLOCK pIoStatusBlock,
ULONG uShareAccess,
ULONG uCreateDisposition,
ULONG uCreateOptions,
BOOLEAN TypeMessage,
BOOLEAN ReadModeMessage,
BOOLEAN NonBlocking,
ULONG MaxInstance,
ULONG InBufferSize,
ULONG OutBufferSize,
PLARGE_INTEGER DefaultTimeout
);
NTSYSAPI
NTSTATUS
NTAPI
NtOpenFile(
PHANDLE phFile,
ACCESS_MASK AccessMask,
POBJECT_ATTRIBUTES pObjectAttributes,
PIO_STATUS_BLOCK pIoStatusBlock,
ULONG uShareAccess,
ULONG uOpenOptions
);
NTSYSAPI
NTSTATUS
NTAPI
NtDeleteFile(
__in POBJECT_ATTRIBUTES pObjectAttributes
);
typedef enum _FILE_INFORMATION_CLASS
{
FileDirectoryInformation = 1,
FileFullDirectoryInformation, // 2
FileBothDirectoryInformation, // 3
FileBasicInformation, // 4
FileStandardInformation, // 5
FileInternalInformation, // 6
FileEaInformation, // 7
FileAccessInformation, // 8
FileNameInformation, // 9
FileRenameInformation, // 10
FileLinkInformation, // 11
FileNamesInformation, // 12
FileDispositionInformation, // 13
FilePositionInformation, // 14
FileFullEaInformation, // 15
FileModeInformation, // 16
FileAlignmentInformation, // 17
FileAllInformation, // 18
FileAllocationInformation, // 19
FileEndOfFileInformation, // 20
FileAlternateNameInformation, // 21
FileStreamInformation, // 22
FilePipeInformation, // 23
FilePipeLocalInformation, // 24
FilePipeRemoteInformation, // 25
FileMailslotQueryInformation, // 26
FileMailslotSetInformation, // 27
FileCompressionInformation, // 28
FileObjectIdInformation, // 29
FileCompletionInformation, // 30
FileMoveClusterInformation, // 31
FileInformationReserved32, // 32
FileInformationReserved33, // 33
FileNetworkOpenInformation, // 34
FileAttributeTagInformation, // 35
FileTrackingInformation, // 36
FileIdBothDirectoryInformation, // 37
FileIdFullDirectoryInformation, // 38
FileValidDataLengthInformation, // 39
FileShortNameInformation, // 40
FileMaximumInformation
} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
typedef struct _FILE_DIRECTORY_INFORMATION
{
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
WCHAR FileName[1];
} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
typedef struct _FILE_FULL_DIR_INFORMATION
{
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
WCHAR FileName[1];
} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
typedef struct _FILE_BOTH_DIR_INFORMATION
{
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
UCHAR ShortNameLength;
WCHAR ShortName[12];
WCHAR FileName[1];
} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
typedef struct _FILE_ID_BOTH_DIR_INFORMATION {
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
CCHAR ShortNameLength;
WCHAR ShortName[12];
LARGE_INTEGER FileId;
WCHAR FileName[1];
} FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;
typedef struct _FILE_ID_FULL_DIR_INFORMATION {
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
LARGE_INTEGER FileId;
WCHAR FileName[1];
} FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;
typedef struct _FILE_BASIC_INFORMATION
{
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
ULONG FileAttributes;
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
typedef struct _FILE_STANDARD_INFORMATION
{
LARGE_INTEGER AllocationSize;
LARGE_INTEGER EndOfFile;
ULONG NumberOfLinks;
BOOLEAN DeletePending;
BOOLEAN Directory;
} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
typedef struct _FILE_INTERNAL_INFORMATION
{
LARGE_INTEGER IndexNumber;
} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
typedef struct _FILE_EA_INFORMATION
{
ULONG EaSize;
} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
typedef struct _FILE_ACCESS_INFORMATION
{
ACCESS_MASK AccessFlags;
} FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
typedef struct _FILE_NAME_INFORMATION
{
ULONG FileNameLength;
WCHAR FileName[1];
} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
typedef struct _FILE_RENAME_INFORMATION
{
BOOLEAN ReplaceIfExists;
HANDLE RootDirectory;
ULONG FileNameLength;
WCHAR FileName[1];
} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
typedef struct _FILE_LINK_INFORMATION
{
BOOLEAN ReplaceIfExists;
HANDLE RootDirectory;
ULONG FileNameLength;
WCHAR FileName[1];
} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
typedef struct _FILE_NAMES_INFORMATION
{
ULONG NextEntryOffset;
ULONG FileIndex;
ULONG FileNameLength;
WCHAR FileName[1];
} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
typedef struct _FILE_ALLOCATION_INFORMATION
{
LARGE_INTEGER AllocationSize;
} FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
typedef struct _FILE_COMPRESSION_INFORMATION
{
LARGE_INTEGER CompressedFileSize;
USHORT CompressionFormat;
UCHAR CompressionUnitShift;
UCHAR ChunkShift;
UCHAR ClusterShift;
UCHAR Reserved[3];
} FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
typedef struct _FILE_COMPLETION_INFORMATION
{
HANDLE Port;
ULONG Key;
} FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
NTSYSAPI
NTSTATUS
NTAPI
NtQueryInformationFile(
__in HANDLE FileHandle,
__out PIO_STATUS_BLOCK IoStatusBlock,
__out PVOID FileInformation,
__in ULONG Length,
__in FILE_INFORMATION_CLASS FileInformationClass
);
NTSYSAPI
NTSTATUS
NTAPI
NtDeviceIoControlFile(
__in HANDLE FileHandle,
__in_opt HANDLE Event,
__in_opt PIO_APC_ROUTINE ApcRoutine,
__in_opt PVOID ApcContext,
__out PIO_STATUS_BLOCK IoStatusBlock,
__in ULONG IoControlCode,
__in_opt PVOID InputBuffer,
__in ULONG InputBufferLength,
__out_opt PVOID OutputBuffer,
__in ULONG OutputBufferLength
);
NTSYSAPI
NTSTATUS
NTAPI
NtFsControlFile(
__in HANDLE FileHandle,
__in_opt HANDLE Event,
__in_opt PIO_APC_ROUTINE ApcRoutine,
__in_opt PVOID ApcContext,
__out PIO_STATUS_BLOCK IoStatusBlock,
__in ULONG FsControlCode,
__in_opt PVOID InputBuffer,
__in ULONG InputBufferLength,
__out_opt PVOID OutputBuffer,
__in ULONG OutputBufferLength
);
NTSYSAPI
NTSTATUS
NTAPI
NtQueryVolumeInformationFile(
__in HANDLE FileHandle,
__out PIO_STATUS_BLOCK IoStatusBlock,
__out PVOID FsInformation,
__in ULONG Length,
__in FS_INFORMATION_CLASS FsInformationClass
);
NTSYSAPI
NTSTATUS
NTAPI
NtFlushBuffersFile(
__in HANDLE FileHandle,
__out PIO_STATUS_BLOCK IoStatusBlock
);
// Process functions
//#define NtCurrentProcess() ((HANDLE) -1)
inline HANDLE NtCurrentProcess() { return (HANDLE)-1; }
NTSYSAPI
NTSTATUS
NTAPI
NtOpenProcess(
__out PHANDLE phProcess,
__in ACCESS_MASK AccessMask,
__in POBJECT_ATTRIBUTES pObjectAttributes,
__in PCLIENT_ID pClientId
);
NTSYSAPI
NTSTATUS
NTAPI
NtCreateProcess(
__out PHANDLE ProcessHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes,
__in HANDLE InheritFromProcessHandle,
__in BOOLEAN InheritHandles,
__in_opt HANDLE SectionHandle,
__in_opt HANDLE DebugPort,
__in_opt HANDLE ExceptionPort
);
NTSYSAPI
NTSTATUS
NTAPI
NtTerminateProcess(
__in HANDLE ProcessHandle,
__in DWORD ExitCode
);
typedef enum _PROCESSINFOCLASS
{
ProcessBasicInformation,
ProcessQuotaLimits, // QUOTA_LIMITS
ProcessIoCounters, // IOCOUNTERS
ProcessVmCounters, // VM_COUNTERS
ProcessTimes, // KERNEL_USER_TIMES
ProcessBasePriority, // BASE_PRIORITY_INFORMATION
ProcessRaisePriority,
ProcessDebugPort,
ProcessExceptionPort,
ProcessAccessToken,
ProcessLdtInformation,
ProcessLdtSize,
ProcessDefaultHardErrorMode,
ProcessIoPortHandlers, // Note: this is kernel mode only
ProcessPooledUsageAndLimits,
ProcessWorkingSetWatch,
ProcessUserModeIOPL,
ProcessEnableAlignmentFaultFixup,
ProcessPriorityClass,
ProcessWx86Information,
ProcessHandleCount,
ProcessAffinityMask, // AFFINITY_MASK
ProcessPriorityBoost,
ProcessDeviceMap,
ProcessSessionInformation,
ProcessForegroundInformation,
ProcessWow64Information,
MaxProcessInfoClass
} PROCESSINFOCLASS;
typedef struct _PROCESS_BASIC_INFORMATION
{
NTSTATUS ExitStatus;
PPEB PebBaseAddress;
KAFFINITY AffinityMask;
KPRIORITY BasePriority;
ULONG uUniqueProcessId;
ULONG uInheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
typedef struct _PROCESS_RAISE_PRIORITY
{
KPRIORITY RaisePriority;
} PROCESS_RAISE_PRIORITY, *PPROCESS_RAISE_PRIORITY;
typedef struct _PROCESS_DEBUG_PORT_INFORMATION
{
HANDLE DebugPort;
} PROCESS_DEBUG_PORT_INFORMATION, *PPROCESS_DEBUG_PORT_INFORMATION;
typedef struct _PROCESS_EXCEPTION_PORT
{
HANDLE ExceptionPort;
} PROCESS_EXCEPTION_PORT, *PPROCESS_EXCEPTION_PORT;
typedef struct _PROCESS_ACCESS_TOKEN
{
HANDLE Token;
HANDLE Thread;
} PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
#ifndef _LDT_ENTRY_DEFINED
#define _LDT_ENTRY_DEFINED
typedef struct _LDT_ENTRY
{
USHORT LimitLow;
USHORT BaseLow;
union
{
struct
{
UCHAR BaseMid;
UCHAR Flags1; // Declare as bytes to avoid alignment
UCHAR Flags2; // Problems.
UCHAR BaseHi;
} Bytes;
struct
{
ULONG BaseMid : 8;
ULONG Type : 5;
ULONG Dpl : 2;
ULONG Pres : 1;
ULONG LimitHi : 4;
ULONG Sys : 1;
ULONG Reserved_0 : 1;
ULONG Default_Big : 1;
ULONG Granularity : 1;
ULONG BaseHi : 8;
} Bits;
} HighWord;
} LDT_ENTRY, *PLDT_ENTRY;
#endif // _LDT_ENTRY_DEFINED
#define LDT_TABLE_SIZE (8 * 1024 * sizeof(LDT_ENTRY))
typedef struct _LDT_INFORMATION
{
ULONG Start;
ULONG Length;
LDT_ENTRY LdtEntries[1];
} PROCESS_LDT_INFORMATION, *PPROCESS_LDT_INFORMATION;
typedef struct _LDT_SIZE
{
ULONG Length;
} PROCESS_LDT_SIZE, *PPROCESS_LDT_SIZE;
typedef struct _PROCESS_DEFAULT_HARDERROR_MODE_INFORMATION
{
ULONG HardErrorMode; // SEM_* (SEM_FAILCRITICALERRORS, etc.)
} PROCESS_DEFAULT_HARDERROR_MODE_INFORMATION, *PPROCESS_DEFAULT_HARDERROR_MODE_INFORMATION;
typedef struct _PROCESS_POOLED_USAGE_AND_LIMITS_INFORMATION
{
ULONG PeakPagedPoolUsage;
ULONG PagedPoolUsage;
ULONG PagedPoolLimit;
ULONG PeakNonPagedPoolUsage;
ULONG NonPagedPoolUsage;
ULONG NonPagedPoolLimit;
ULONG PeakPagefileUsage;
ULONG PagefileUsage;
ULONG PagefileLimit;
} PROCESS_POOLED_USAGE_AND_LIMITS_INFORMATION, *PPROCESS_POOLED_USAGE_AND_LIMITS_INFORMATION;
typedef struct _PROCESS_WS_WATCH_INFORMATION
{
PVOID FaultingPc;
PVOID FaultingVa;
} PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION;
typedef struct _PROCESS_IOPL
{
ULONG Iopl;
} PROCESS_IOPL, *PPROCESS_IOPL;
typedef struct _PROCESS_ALLIGNMENT_FAULT_FIXUP
{
BOOLEAN EnableAllignmentFaultFixup;
} PROCESS_ALLIGNMENT_FAULT_FIXUP, *PPROCESS_ALLIGNMENT_FAULT_FIXUP;
#define KRNL_NORMAL_PRIORITY_CLASS 0x02
#define KRNL_IDLE_PRIORITY_CLASS 0x01
#define KRNL_HIGH_PRIORITY_CLASS 0x03
#define KRNL_REALTIME_PRIORITY_CLASS 0x04
typedef struct _PROCESS_PRIORITY_CLASS_INFORMATION
{
UCHAR Unknown;
UCHAR PriorityClass;
} PROCESS_PRIORITY_CLASS_INFORMATION, *PPROCESS_PRIORITY_CLASS_INFORMATION;
typedef struct _PROCESS_X86_INFORMATION
{
ULONG x86Info;
} PROCESS_X86_INFORMATION, *PPROCESS_X86_INFORMATION;
typedef struct _PROCESS_HANDLE_COUNT_INFORMATION
{
ULONG HandleCount;
} PROCESS_HANDLE_COUNT_INFORMATION, *PPROCESS_HANDLE_COUNT_INFORMATION;
typedef struct _PROCESS_PRIORITY_BOOST_INFORMATION
{
ULONG PriorityBoostEnabled;
} PROCESS_PRIORITY_BOOST_INFORMATION, *PPROCESS_PRIORITY_BOOST_INFORMATION;
typedef struct _PROCESS_DEVICE_MAP_INFORMATION
{
union
{
struct
{
HANDLE DirectoryHandle;
} Set;
struct
{
ULONG DriveMap;
UCHAR DriveType[32];
} Query;
};
} PROCESS_DEVICE_MAP_INFORMATION, *PPROCESS_DEVICE_MAP_INFORMATION;
typedef struct _PROCESS_SESSION_INFORMATION
{
ULONG SessionId;
} PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
NTSYSAPI
NTSTATUS
NTAPI
NtQueryInformationProcess(
__in HANDLE hProcess,
__in PROCESSINFOCLASS ProcessInformationClass,
__out PVOID pProcessInformation,
__in ULONG uProcessInformationLength,
__out_opt PULONG puReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
NtSetInformationProcess(
__in HANDLE hProcess,
__in PROCESSINFOCLASS ProcessInformationClass,
__out PVOID pProcessInformation,
__in ULONG uProcessInformationLength
);
NTSTATUS
NTAPI
RtlCreateProcessParameters(
__out PPROCESS_PARAMETERS *ProcessParameters,
__in PUNICODE_STRING ImageFile,
__in_opt PUNICODE_STRING DllPath,
__in_opt PUNICODE_STRING CurrentDirectory,
__in_opt PUNICODE_STRING CommandLine,
__in ULONG CreationFlags,
__in_opt PUNICODE_STRING WindowTitle,
__in_opt PUNICODE_STRING Desktop,
__in_opt PUNICODE_STRING Reserved,
__in_opt PUNICODE_STRING Reserved2
);
NTSTATUS
NTAPI
RtlDestroyProcessParameters(
__in PPROCESS_PARAMETERS ProcessParameters
);
// jichi 9/28/2013
// See: http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/Executable%20Images/RtlCreateUserThread.html
// See: http://waleedassar.blogspot.com/2012/06/createremotethread-vs.html
NTSYSAPI
NTSTATUS
NTAPI
RtlCreateUserThread(
__in HANDLE ProcessHandle,
__in_opt PSECURITY_DESCRIPTOR SecurityDescriptor,
__in BOOLEAN CreateSuspended,
__in ULONG StackZeroBits,
__inout PULONG StackReserved,
__inout PULONG StackCommit,
__in PVOID StartAddress,
__in_opt PVOID StartParameter,
__out PHANDLE ThreadHandle,
__out PCLIENT_ID ClientID
);
// Thread functions
#define NtCurrentThread() ((HANDLE) -2)
typedef struct _USER_STACK
{
PVOID FixedStackBase;
PVOID FixedStackLimit;
PVOID ExpandableStackBase;
PVOID ExpandableStackLimit;
PVOID ExpandableStackBottom;
} USER_STACK, *PUSER_STACK;
/*
typedef struct _INITIAL_TEB {
struct {
PVOID OldStackBase;
PVOID OldStackLimit;
} OldInitialTeb;
PVOID StackBase;
PVOID StackLimit;
PVOID StackAllocationBase;
} INITIAL_TEB, *PINITIAL_TEB;
*/
typedef _USER_STACK _INITIAL_TEB;
typedef USER_STACK INITIAL_TEB;
typedef PUSER_STACK PINITIAL_TEB;
NTSYSAPI
NTSTATUS
NTAPI
NtCreateThread(
__out PHANDLE ThreadHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes,
__in HANDLE ProcessHandle,
__out PCLIENT_ID ClientId,
__in PCONTEXT ThreadContext,
__in PUSER_STACK UserStack,
__in BOOLEAN CreateSuspended
);
typedef
NTSTATUS
(WINAPI *FpNtCreateThread)(
__out PHANDLE ThreadHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes,
__in HANDLE ProcessHandle,
__out PCLIENT_ID ClientId,
__in PCONTEXT ThreadContext,
__in PUSER_STACK UserStack,
__in BOOLEAN CreateSuspended
);
typedef struct _NtCreateThreadExBuffer{
ULONG Size; // sizeof(NtCreateThreadEx)
ULONG Unknown1;
ULONG Unknown2;
PULONG Unknown3; // &dw1: SizeOfStackCommit
ULONG Unknown4;
ULONG Unknown5;
ULONG Unknown6;
PULONG Unknown7; // &dw2: SizeOfStackReserve
ULONG Unknown8;
} NtCreateThreadExBuffer, *PNtCreateThreadExBuffer;
// jichi 9/28/2013: An alternative way to create thread on Windows Vista and later
NTSYSAPI
NTSTATUS
NTAPI
NtCreateThreadEx (
__out PHANDLE hThread,
__in ACCESS_MASK DesiredAccess,
__in LPVOID ObjectAttributes,
__in HANDLE ProcessHandle,
__in LPTHREAD_START_ROUTINE lpStartAddress,
__in LPVOID lpParameter,
__in BOOL CreateSuspended,
__in ULONG StackZeroBits,
__in ULONG SizeOfStackCommit,
__in ULONG SizeOfStackReserve,
__out LPVOID lpBytesBuffer
);
typedef
NTSTATUS
(WINAPI *FpNtCreateThreadEx) (
__out PHANDLE hThread,
__in ACCESS_MASK DesiredAccess,
__in LPVOID ObjectAttributes,
__in HANDLE ProcessHandle,
__in LPTHREAD_START_ROUTINE lpStartAddress,
__in LPVOID lpParameter,
__in BOOL CreateSuspended,
__in ULONG StackZeroBits,
__in ULONG SizeOfStackCommit,
__in ULONG SizeOfStackReserve,
__out LPVOID lpBytesBuffer
);
NTSYSAPI
NTSTATUS
NTAPI
NtOpenThread(
__out PHANDLE phThread,
__in ACCESS_MASK AccessMask,
__in POBJECT_ATTRIBUTES pObjectAttributes,
__in PCLIENT_ID pClientId
);
NTSYSAPI
NTSTATUS
NTAPI
NtTerminateThread(
__in_opt HANDLE ThreadHandle,
__in NTSTATUS ExitStatus
);
NTSYSAPI
NTSTATUS
NTAPI
NtSuspendThread(
__in HANDLE ThreadHandle,
__out_opt PULONG PreviousSuspendCount
);
NTSYSAPI
NTSTATUS
NTAPI
NtResumeThread(
__in HANDLE ThreadHandle,
__out_opt PULONG PreviousSuspendCount
);
typedef
NTSTATUS
(WINAPI
* LpNtResumeThread)(
__in HANDLE ThreadHandle,
__out_opt PULONG PreviousSuspendCount
);
NTSYSAPI
NTSTATUS
NTAPI
RtlExitUserThread(
__in DWORD ExitCode
);
typedef enum _THREADINFOCLASS
{
ThreadBasicInformation,
ThreadTimes, // KERNEL_USER_TIMES
ThreadPriority,
ThreadBasePriority, // BASE_PRIORITY_INFORMATION
ThreadAffinityMask, // AFFINITY_MASK
ThreadImpersonationToken,
ThreadDescriptorTableEntry,
ThreadEnableAlignmentFaultFixup,
ThreadEventPair,
ThreadQuerySetWin32StartAddress,
ThreadZeroTlsCell,
ThreadPerformanceCount,
ThreadAmILastThread,
ThreadIdealProcessor,
ThreadPriorityBoost,
ThreadSetTlsArrayAddress,
ThreadIsIoPending, // W2K
ThreadHideFromDebugger, // W2K
MaxThreadInfoClass
} THREADINFOCLASS;
typedef struct _THREAD_BASIC_INFORMATION
{
NTSTATUS ExitStatus;
PTEB TebBaseAddress;
CLIENT_ID ClientId;
KAFFINITY AffinityMask;
KPRIORITY Priority;
KPRIORITY BasePriority;
} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
typedef struct _THREAD_PRIORITY
{
KPRIORITY Priority;
} THREAD_PRIORITY, *PTHREAD_PRIORITY;
typedef struct _THREAD_DESCRIPTOR_TABLE_ENTRY_INFORMATION
{
ULONG Selector;
LDT_ENTRY Descriptor;
} THREAD_DESCRIPTOR_TABLE_ENTRY_INFORMATION, *PTHREAD_DESCRIPTOR_TABLE_ENTRY_INFORMATION;
typedef struct _THREAD_EVENTPAIR
{
HANDLE EventPair;
} THREAD_EVENTPAIR, *PTHREAD_EVENTPAIR;
typedef struct _THREAD_WIN32_START_ADDRESS_INFORMATION
{
PVOID Win32StartAddress;
} THREAD_WIN32_START_ADDRESS_INFORMATION, *PTHREAD_WIN32_START_ADDRESS_INFORMATION;
typedef struct _THREAD_ZERO_TLSCELL
{
ULONG TlsIndex;
} THREAD_ZERO_TLSCELL, *PTHREAD_ZERO_TLSCELL;
typedef struct _THREAD_PERFORMANCE_COUNTER_INFORMATION
{
ULONG Count1;
ULONG Count2;
} THREAD_PERFORMANCE_COUNTER_INFORMATION, *PTHREAD_PERFORMANCE_COUNTER_INFORMATION;
typedef struct _THREAD_AMI_LAST_THREAD
{
ULONG AmILastThread;
} THREAD_AMI_LAST_THREAD, *PTHREAD_AMI_LAST_THREAD;
typedef struct _THREAD_IDEAL_PROCESSOR
{
ULONG IdealProcessor;
} THREAD_IDEAL_PROCESSOR, *PTHREAD_IDEAL_PROCESSOR;
typedef struct _THREAD_TLS_ARRAY
{
PULONG TlsArray;
} THREAD_TLS_ARRAY, *PTHREAD_TLS_ARRAY;
typedef struct _THREAD_IS_IO_PENDING_INFORMATION
{
ULONG IsIOPending;
} THREAD_IS_IO_PENDING_INFORMATION, *PTHREAD_IS_IO_PENDING_INFORMATION;
typedef struct _THREAD_HIDE_FROM_DEBUGGER
{
ULONG HideFromDebugger;
} THREAD_HIDE_FROM_DEBUGGER, *PTHREAD_HIDE_FROM_DEBUGGER;
NTSYSAPI
NTSTATUS
NTAPI
NtQueryInformationThread(
__in HANDLE hThread,
__in THREADINFOCLASS ThreadInformationClass,
__out PVOID pThreadInformation,
__in ULONG uThreadInformationLength,
__out_opt PULONG puReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
NtSetInformationThread(
__in HANDLE hThread,
__in THREADINFOCLASS ThreadInformationClass,
__out PVOID pThreadInformation,
__in ULONG uthreadInformationLength
);
NTSYSAPI
NTSTATUS
NTAPI
NtOpenThreadToken(
__in HANDLE hThread,
__in ACCESS_MASK DesiredAccess,
__in BOOLEAN bOpenAsSelf,
__out PHANDLE phToken
);
NTSYSAPI
NTSTATUS
NTAPI
NtImpersonateThread(
__in HANDLE ThreadHandle,
__in HANDLE TargetThreadHandle,
__in PSECURITY_QUALITY_OF_SERVICE SecurityQos
);
NTSYSAPI
NTSTATUS
NTAPI
NtGetContextThread(
__in HANDLE ThreadHandle,
__out PCONTEXT Context
);
NTSYSAPI
NTSTATUS
NTAPI
NtSetContextThread(
__in HANDLE ThreadHandle,
__in PCONTEXT Context
);
NTSYSAPI
NTSTATUS
NTAPI
NtQueueApcThread(
__in HANDLE ThreadHandle,
__in PKNORMAL_ROUTINE ApcRoutine,
__in_opt PVOID ApcContext,
__in_opt PVOID Argument1,
__in_opt PVOID Argument2
);
NTSYSAPI
NTSTATUS
NTAPI
NtImpersonateAnonymousToken(
__in HANDLE hThread
);
NTSYSAPI
NTSTATUS
NTAPI
NtCreateSection(
__out PHANDLE SectionHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes,
__in_opt PLARGE_INTEGER SectionSize,
__in ULONG Protect,
__in ULONG Attributes,
__in HANDLE FileHandle
);
NTSYSAPI
NTSTATUS
NTAPI
NtOpenSection(
__out PHANDLE SectionHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes
);
typedef enum _SECTION_INFORMATION_CLASS
{
SectionBasicInformation,
SectionImageInformation
} SECTION_INFORMATION_CLASS;
NTSYSAPI
NTSTATUS
NTAPI
NtQuerySection(
__in HANDLE SectionHandle,
__in SECTION_INFORMATION_CLASS SectionInformationClass,
__out PVOID SectionInformation,
__in ULONG SectionInformationLength,
__out_opt PULONG ResultLength
);
typedef struct _SECTION_BASIC_INFORMATION
{
PVOID BaseAddress;
ULONG Attributes;
LARGE_INTEGER Size;
} SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;
typedef struct _SECTION_IMAGE_INFORMATION
{
PVOID EntryPoint;
ULONG Unknown1;
ULONG StackReserve;
ULONG StackCommit;
ULONG Subsystem;
USHORT MinorSubsystemVersion;
USHORT MajorSubsystemVersion;
ULONG Unknown2;
ULONG Characteristics;
USHORT ImageNumber;
BOOLEAN Executable;
UCHAR Unknown3;
ULONG Unknown4[3];
} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;
NTSYSAPI
NTSTATUS
NTAPI
NtExtendSection(
__in HANDLE SectionHandle,
__in PLARGE_INTEGER SectionSize
);
NTSYSAPI
NTSTATUS
NTAPI
NtUnmapViewOfSection(
__in HANDLE hProcess,
__in PVOID pBaseAddress
);
NTSYSAPI
NTSTATUS
NTAPI
NtWaitForSingleObject(
__in HANDLE hObject,
__in BOOL fAlertable,
__in PLARGE_INTEGER pliTimeout // NULL = infinite
);
// Object functions
typedef enum _OBJECT_INFORMATION_CLASS
{
ObjectBasicInformation, // 0 Y N
ObjectNameInformation, // 1 Y N
ObjectTypeInformation, // 2 Y N
ObjectAllTypesInformation, // 3 Y N
ObjectHandleInformation // 4 Y Y
} OBJECT_INFORMATION_CLASS;
typedef struct _OBJECT_BASIC_INFORMATION
{
ULONG Attributes;
ACCESS_MASK GrantedAccess;
ULONG HandleCount;
ULONG PointerCount;
ULONG PagedPoolUsage;
ULONG NonPagedPoolUsage;
ULONG Reserved[3];
ULONG NameInformationLength;
ULONG TypeInformationLength;
ULONG SecurityDescriptorLength;
LARGE_INTEGER CreateTime;
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
typedef struct _OBJECT_NAME_INFORMATION
{
UNICODE_STRING Name;
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
typedef struct _OBJECT_TYPE_INFORMATION
{
UNICODE_STRING Name;
ULONG ObjectCount;
ULONG HandleCount;
ULONG Reserved1[4];
ULONG PeakObjectCount;
ULONG PeakHandleCount;
ULONG Reserved2[4];
ULONG InvalidAttributes;
GENERIC_MAPPING GenericMapping;
ULONG ValidAccess;
UCHAR Unknown;
BOOLEAN MaintainHandleDatabase;
UCHAR Reserved3[2];
POOL_TYPE PoolType;
ULONG PagedPoolUsage;
ULONG NonPagedPoolUsage;
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
typedef struct _OBJECT_ALL_TYPES_INFORMATION
{
ULONG NumberOfTypes;
OBJECT_TYPE_INFORMATION TypeInformation;
} OBJECT_ALL_TYPES_INFORMATION, *POBJECT_ALL_TYPES_INFORMATION;
typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFORMATION
{
BOOLEAN Inherit;
BOOLEAN ProtectFromClose;
} OBJECT_HANDLE_ATTRIBUTE_INFORMATION, *POBJECT_HANDLE_ATTRIBUTE_INFORMATION;
NTSYSAPI
NTSTATUS
NTAPI
NtQueryObject(
__in HANDLE ObjectHandle,
__in OBJECT_INFORMATION_CLASS ObjectInformationClass,
__out PVOID ObjectInformation,
__in ULONG ObjectInformationLength,
__out_opt PULONG ReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
NtSetInformationObject(
__in HANDLE ObjectHandle,
__in OBJECT_INFORMATION_CLASS ObjectInformationClass,
__in PVOID ObjectInformation,
__in ULONG ObjectInformationLength
);
NTSYSAPI
NTSTATUS
NTAPI
NtDuplicateObject(
__in HANDLE SourceProcessHandle,
__in HANDLE SourceHandle,
__in_opt HANDLE TargetProcessHandle,
__out_opt PHANDLE TargetHandle,
__in ACCESS_MASK DesiredAccess,
__in ULONG HandleAttributes,
__in ULONG Options
);
NTSYSAPI
NTSTATUS
NTAPI
NtQuerySecurityObject(
__in HANDLE FileHandle,
__in SECURITY_INFORMATION SecurityInformation,
__out PSECURITY_DESCRIPTOR SecurityDescriptor,
__in ULONG Length,
__out PULONG ResultLength
);
NTSYSAPI
NTSTATUS
NTAPI
NtSetSecurityObject(
__in HANDLE FileHandle,
__in SECURITY_INFORMATION SecurityInformation,
__in PSECURITY_DESCRIPTOR SecurityDescriptor
);
// Memory management functions
NTSYSAPI
NTSTATUS
NTAPI
NtAllocateVirtualMemory(
__in HANDLE ProcessHandle,
__inout PVOID *BaseAddress,
__in ULONG ZeroBits,
__inout PULONG AllocationSize,
__in ULONG AllocationType,
__in ULONG Protect
);
typedef enum _MEMORY_INFORMATION_CLASS
{
MemoryBasicInformation,
MemoryWorkingSetList,
MemorySectionName,
MemoryBasicVlmInformation
} MEMORY_INFORMATION_CLASS;
NTSYSAPI
NTSTATUS
NTAPI
NtQueryVirtualMemory(
__in HANDLE ProcessHandle,
__in PVOID BaseAddress,
__in MEMORY_INFORMATION_CLASS MemoryInformationClass,
__out PVOID MemoryInformation,
__in ULONG MemoryInformationLength,
__out PULONG ReturnLength OPTIONAL
);
NTSYSAPI NTSTATUS NTAPI LdrUnloadDll(IN HANDLE ModuleHandl);
/* Defined in Winnt.h
typedef struct _MEMORY_BASIC_INFORMATION
{
PVOID BaseAddress;
PVOID AllocationBase;
ULONG AllocationProtect;
ULONG RegionSize;
ULONG State;
ULONG Protect;
ULONG Type;
} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;
*/
typedef struct _MEMORY_WORKING_SET_LIST
{
ULONG NumberOfPages;
ULONG WorkingSetList[1];
} MEMORY_WORKING_SET_LIST, *PMEMORY_WORKING_SET_LIST;
typedef struct _WORKING_SET_LIST{
ULONG_PTR Protection : 5;
ULONG_PTR ShareCount : 3;
ULONG_PTR Shared : 1;
ULONG_PTR Reserved : 3;
ULONG_PTR VirtualPage : 20;
} WORKING_SET_LIST, *PWORKING_SET_LIST;
typedef struct _MEMORY_SECTION_NAME
{
UNICODE_STRING SectionFileName;
} MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;
NTSYSAPI
NTSTATUS
NTAPI
NtReadVirtualMemory(
__in HANDLE ProcessHandle,
__in PVOID BaseAddress,
__out PVOID Buffer,
__in ULONG BufferLength,
__out PULONG ReturnLength OPTIONAL
);
NTSYSAPI
NTSTATUS
NTAPI
NtWriteVirtualMemory(
__in HANDLE ProcessHandle,
__in PVOID BaseAddress,
__in PVOID Buffer,
__in ULONG BufferLength,
__out PULONG ReturnLength OPTIONAL
);
NTSYSAPI
NTSTATUS
NTAPI
NtProtectVirtualMemory(
__in HANDLE ProcessHandle,
__inout PVOID *BaseAddress,
__inout PULONG ProtectSize,
__in ULONG NewProtect,
__out PULONG OldProtect
);
NTSYSAPI
NTSTATUS
NTAPI
NtFlushVirtualMemory(
__in HANDLE ProcessHandle,
__inout PVOID *BaseAddress,
__inout PULONG FlushSize,
__out PIO_STATUS_BLOCK IoStatusBlock
);
// Ldr Functions
NTSYSAPI
NTSTATUS
NTAPI
LdrDisableThreadCalloutsForDll(
__in HANDLE hModule
);
NTSYSAPI
NTSTATUS
NTAPI
LdrGetDllHandle(
__in PWORD pwPath OPTIONAL,
__in PVOID Unused OPTIONAL,
__in PUNICODE_STRING ModuleFileName,
__out PHANDLE pHModule
);
NTSYSAPI
NTSTATUS
NTAPI
LdrGetProcedureAddress(
__in HMODULE ModuleHandle,
__in PANSI_STRING FunctionName OPTIONAL,
__in WORD Oridinal OPTIONAL,
__out PVOID *FunctionAddress
);
NTSYSAPI
NTSTATUS
NTAPI
LdrLoadDll(
__in PWCHAR PathToFile OPTIONAL,
__in ULONG Flags OPTIONAL,
__in PUNICODE_STRING ModuleFileName,
__out PHANDLE ModuleHandle
);
// Modified from ntdef.h
#ifdef __cplusplus
extern "C++" {
char _RTL_CONSTANT_STRING_type_check(const char *s);
char _RTL_CONSTANT_STRING_type_check(const WCHAR *s);
// __typeof would be desirable here instead of sizeof.
template <size_t N> class _RTL_CONSTANT_STRING_remove_const_template_class;
template <> class _RTL_CONSTANT_STRING_remove_const_template_class<sizeof(char)> {public: typedef char T; };
template <> class _RTL_CONSTANT_STRING_remove_const_template_class<sizeof(WCHAR)> {public: typedef WCHAR T; };
#define _RTL_CONSTANT_STRING_remove_const_macro(s) \
(const_cast<_RTL_CONSTANT_STRING_remove_const_template_class<sizeof((s)[0])>::T*>(s))
} // extern "C++"
#else
char _RTL_CONSTANT_STRING_type_check(const void *s);
#define _RTL_CONSTANT_STRING_remove_const_macro(s) (s)
#endif // __cplusplus
#define RTL_CONSTANT_STRING(s) \
{ \
sizeof( s ) - sizeof( (s)[0] ), \
sizeof( s ) / sizeof(_RTL_CONSTANT_STRING_type_check(s)), \
_RTL_CONSTANT_STRING_remove_const_macro(s) \
}
// Rtl String Functions
NTSYSAPI
VOID
NTAPI
RtlInitUnicodeString (
__out PUNICODE_STRING DestinationString,
__in PCWSTR SourceString
);
NTSYSAPI
VOID
NTAPI
RtlCreateUnicodeString(
__out PUNICODE_STRING AllocatedString,
__in PCWSTR SourceString
);
NTSYSAPI
VOID
NTAPI
RtlFreeUnicodeString(
__in PUNICODE_STRING UnicodeString
);
NTSYSAPI
ULONG
NTAPI
RtlAnsiStringToUnicodeSize(
__in PANSI_STRING AnsiString
);
NTSYSAPI
NTSTATUS
NTAPI
RtlAnsiStringToUnicodeString(
__out PUNICODE_STRING DestinationString,
__in PANSI_STRING SourceString,
__in BOOLEAN AllocateDestinationString
);
NTSYSAPI
NTSTATUS
NTAPI
RtlAppendUnicodeStringToString(
__out PUNICODE_STRING Destination,
__in PUNICODE_STRING Source
);
NTSYSAPI
NTSTATUS
NTAPI
RtlAppendUnicodeToString(
__out PUNICODE_STRING Destination,
__in PWSTR Source
);
NTSYSAPI
LONG
NTAPI
RtlCompareUnicodeString(
__in PUNICODE_STRING String1,
__in PUNICODE_STRING String2,
__in BOOLEAN CaseInSensitive
);
NTSYSAPI
VOID
NTAPI
RtlCopyUnicodeString(
__out PUNICODE_STRING DestinationString,
__in PUNICODE_STRING SourceString
);
NTSYSAPI
NTSTATUS
NTAPI
RtlDowncaseUnicodeString(
__out PUNICODE_STRING DestinationString,
__in PUNICODE_STRING SourceString,
__in BOOLEAN AllocateDestinationString
);
NTSYSAPI
BOOLEAN
NTAPI
RtlEqualUnicodeString(
__in PUNICODE_STRING String1,
__in PUNICODE_STRING String2,
__in BOOLEAN CaseInSensitive
);
NTSYSAPI
NTSTATUS
NTAPI
RtlIntegerToUnicodeString(
__in ULONG Value,
__in ULONG Base,
__out PUNICODE_STRING String
);
NTSYSAPI
NTSTATUS
NTAPI
RtlUnicodeStringToInteger(
__in PUNICODE_STRING String,
__in ULONG Base,
__out PULONG Value
);
NTSYSAPI
NTSTATUS
NTAPI
RtlOemStringToUnicodeString(
__out PUNICODE_STRING DestinationString,
__in POEM_STRING SourceString,
__in BOOLEAN AllocateDestinationString
);
NTSYSAPI
BOOLEAN
NTAPI
RtlPrefixUnicodeString(
__in PUNICODE_STRING String1,
__in PUNICODE_STRING String2,
__in BOOLEAN CaseInSensitive
);
NTSYSAPI
WCHAR
NTAPI
RtlUpcaseUnicodeChar(
__in WCHAR SourceCharacter
);
NTSYSAPI
NTSTATUS
NTAPI
RtlUpcaseUnicodeString(
__out PUNICODE_STRING DestinationString,
__in PUNICODE_STRING SourceString,
__in BOOLEAN AllocateDestinationString
);
NTSYSAPI
ULONG
NTAPI
RtlxAnsiStringToUnicodeSize(
__in PANSI_STRING AnsiString
);
NTSYSAPI
ULONG
NTAPI
RtlxOemStringToUnicodeSize(
__in POEM_STRING OemString
);
// Rtl Misc Operations
NTSYSAPI
NTSTATUS
NTAPI
NtReplyPort(
__in HANDLE hPort,
__out PVOID pReply
);
NTSYSAPI
NTSTATUS
NTAPI
NtClose(
__in HANDLE hObject
);
NTSYSAPI
ULONG
NTAPI
RtlNtStatusToDosError(
NTSTATUS status
);
NTSYSAPI
UINT
NTAPI
RtlGetLongestNtPathLength();
NTSYSAPI
UINT
NTAPI
RtlDetermineDosPathNameType_U(
__in PWSTR Path
);
NTSYSAPI
UINT
NTAPI
RtlIsDosDeviceName_U(
__in PWSTR Path
);
NTSYSAPI
BOOLEAN
NTAPI
RtlDosPathNameToNtPathName_U(
__in PCWSTR DosName,
__out PUNICODE_STRING NtName,
__out PCWSTR *DosFilePath OPTIONAL,
__out PUNICODE_STRING NtFilePath OPTIONAL
);
// Rtl Large Integer Operations
#define RtlLargeIntegerLessThanZero($a) (($a).HighPart < 0)
#define Li2Double(x) ((double)((x).HighPart) * 4.294967296E9 + (double)((x).LowPart))
NTSYSAPI
LARGE_INTEGER
NTAPI
RtlEnlargedIntegerMultiply(
__in LONG lMultiplicand,
__in LONG lMultiplier
);
NTSYSAPI
ULONG
NTAPI
RtlEnlargedUnsignedDivide(
__in LARGE_INTEGER liDividend,
__in ULONG uDivisor,
__out PULONG puRemainder OPTIONAL
);
NTSYSAPI
LARGE_INTEGER
NTAPI
RtlEnlargedUnsignedMultiply(
__in ULONG uMultiplicand,
__in ULONG uMultiplier
);
NTSYSAPI
LARGE_INTEGER
NTAPI
RtlExtendedIntegerMultiply(
__in LARGE_INTEGER liMultiplicand,
__in LONG lMultiplier
);
NTSYSAPI
LARGE_INTEGER
NTAPI
RtlExtendedLargeIntegerDivide(
__in LARGE_INTEGER liDividend,
__in ULONG uDivisor,
__out PULONG puRemainder OPTIONAL
);
NTSYSAPI
LARGE_INTEGER
NTAPI
RtlLargeIntegerAdd(
__in LARGE_INTEGER liAddend1,
__in LARGE_INTEGER liAddend2
);
NTSYSAPI
LARGE_INTEGER
NTAPI
RtlLargeIntegerDivide(
__in LARGE_INTEGER liDividend,
__in LARGE_INTEGER liDivisor,
__out PLARGE_INTEGER pliRemainder OPTIONAL
);
NTSYSAPI
LARGE_INTEGER
NTAPI
RtlLargeIntegerNegate(
__in LARGE_INTEGER liSubtrahend
);
NTSYSAPI
LARGE_INTEGER
NTAPI
RtlLargeIntegerSubtract(
__in LARGE_INTEGER liMinuend,
__in LARGE_INTEGER liSubtrahend
);
// Debug Functions
typedef struct _DEBUG_BUFFER
{
HANDLE SectionHandle;
PVOID SectionBase;
PVOID RemoteSectionBase;
ULONG SectionBaseDelta;
HANDLE EventPairHandle;
ULONG Unknown[2];
HANDLE RemoteThreadHandle;
ULONG InfoClassMask;
ULONG SizeOfInfo;
ULONG AllocatedSize;
ULONG SectionSize;
PVOID ModuleInformation;
PVOID BackTraceInformation;
PVOID HeapInformation;
PVOID LockInformation;
PVOID Reserved[8];
} DEBUG_BUFFER, *PDEBUG_BUFFER;
#define PDI_MODULES 0x01
#define PDI_BACKTRACE 0x02
#define PDI_HEAPS 0x04
#define PDI_HEAP_TAGS 0x08
#define PDI_HEAP_BLOCKS 0x10
#define PDI_LOCKS 0x20
typedef struct _DEBUG_MODULE_INFORMATION // c.f. SYSTEM_MODULE_INFORMATION
{
ULONG Reserved[2];
ULONG Base;
ULONG Size;
ULONG Flags;
USHORT Index;
USHORT Unknown;
USHORT LoadCount;
USHORT ModuleNameOffset;
CHAR ImageName[256];
} DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION;
typedef struct _DEBUG_HEAP_INFORMATION
{
ULONG Base;
ULONG Flags;
USHORT Granularity;
USHORT Unknown;
ULONG Allocated;
ULONG Committed;
ULONG TagCount;
ULONG BlockCount;
ULONG Reserved[7];
PVOID Tags;
PVOID Blocks;
} DEBUG_HEAP_INFORMATION, *PDEBUG_HEAP_INFORMATION;
typedef struct _DEBUG_LOCK_INFORMATION // c.f. SYSTEM_LOCK_INFORMATION
{
PVOID Address;
USHORT Type;
USHORT CreatorBackTraceIndex;
ULONG OwnerThreadId;
ULONG ActiveCount;
ULONG ContentionCount;
ULONG EntryCount;
ULONG RecursionCount;
ULONG NumberOfSharedWaiters;
ULONG NumberOfExclusiveWaiters;
} DEBUG_LOCK_INFORMATION, *PDEBUG_LOCK_INFORMATION;
NTSYSAPI
PDEBUG_BUFFER
NTAPI
RtlCreateQueryDebugBuffer(
__in ULONG Size,
__in BOOLEAN EventPair
);
NTSYSAPI
NTSTATUS
NTAPI
RtlQueryProcessDebugInformation(
__in ULONG ProcessId,
__in ULONG DebugInfoClassMask,
__inout PDEBUG_BUFFER DebugBuffer
);
NTSYSAPI
NTSTATUS
NTAPI
RtlDestroyQueryDebugBuffer(
__in PDEBUG_BUFFER DebugBuffer
);
NTSYSAPI
NTSTATUS
NTAPI
NtLoadDriver(
// "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>"
__in PUNICODE_STRING RegistryPath
);
NTSYSAPI
NTSTATUS
NTAPI
NtFlushInstructionCache(
__in HANDLE ProcessHandle,
__in PVOID BaseAddress,
__in ULONG NumberOfBytesToFlush
);
NTSYSAPI
NTSTATUS
NTAPI
NtProtectVirtualMemory(
__in HANDLE ProcessHandle,
__inout PVOID *BaseAddress,
__inout PULONG NumberOfBytesToProtect,
__in ULONG NewAccessProtection,
__out PULONG OldAccessProtection
);
NTSYSAPI
NTSTATUS
NTAPI
NtFreeVirtualMemory(
__in HANDLE ProcessHandle,
__in PVOID *BaseAddress,
__inout PULONG RegionSize,
__in ULONG FreeType
);
NTSYSAPI
NTSTATUS
NTAPI
NtUnloadDriver(
// "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>"
__in PUNICODE_STRING RegistryPath
);
NTSYSAPI
NTSTATUS
NTAPI
RtlAdjustPrivilege(
__in ULONG Privilege,
__in BOOLEAN NewValue,
__in BOOLEAN ForThread,
__out PBOOLEAN OldValue
);
/*typedef struct _RTL_OSVERSIONINFOW
{
ULONG dwOSVersionInfoSize;
ULONG dwMajorVersion;
ULONG dwMinorVersion;
ULONG dwBuildNumber;
ULONG dwPlatformId;
WCHAR szCSDVersion[128]; // Maintenance string for PSS usage
} RTL_OSVERSIONINFOW, *PRTL_OSVERSIONINFOW;*/
NTSYSAPI
NTSTATUS
NTAPI
RtlGetVersion(
__inout PRTL_OSVERSIONINFOW lpVersionInformation
);
NTSYSAPI
void
NTAPI
RtlFreeAnsiString(PANSI_STRING AnsiString);
NTSYSAPI
NTSTATUS
NTAPI
RtlRunDecodeUnicodeString(BYTE bHash,PUNICODE_STRING uString);
// - Extra -
typedef struct _TDI_CONNECTION_INFORMATION {
LONG UserDataLength;
PVOID UserData;
LONG OptionsLength;
PVOID Options;
LONG RemoteAddressLength;
PVOID RemoteAddress;
} TDI_CONNECTION_INFORMATION, *PTDI_CONNECTION_INFORMATION;
typedef struct _TDI_CONNECTION_INFO {
ULONG State;
ULONG Event;
ULONG TransmittedTsdus;
ULONG ReceivedTsdus;
ULONG TransmissionErrors;
ULONG ReceiveErrors;
LARGE_INTEGER Throughput;
LARGE_INTEGER Delay;
ULONG SendBufferSize;
ULONG ReceiveBufferSize;
BOOLEAN Unreliable;
} TDI_CONNECTION_INFO, *PTDI_CONNECTION_INFO;
typedef enum _KEY_INFORMATION_CLASS {
KeyBasicInformation,
KeyNodeInformation,
KeyFullInformation
} KEY_INFORMATION_CLASS;
typedef struct _KEY_BASIC_INFORMATION {
LARGE_INTEGER LastWriteTime;
ULONG TitleIndex;
ULONG NameLength;
WCHAR Name[1];
} KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;
typedef struct _KEY_NODE_INFORMATION
{
LARGE_INTEGER LastWriteTime;
ULONG TitleIndex;
ULONG ClassOffset;
ULONG ClassLength;
ULONG NameLength;
WCHAR Name[1];
/* Class[1]; */
} KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION;
typedef struct _KEY_FULL_INFORMATION
{
LARGE_INTEGER LastWriteTime;
ULONG TitleIndex;
ULONG ClassOffset;
ULONG ClassLength;
ULONG SubKeys;
ULONG MaxNameLen;
ULONG MaxClassLen;
ULONG Values;
ULONG MaxValueNameLen;
ULONG MaxValueDataLen;
WCHAR Class[1];
} KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION;
typedef enum _KEY_VALUE_INFORMATION_CLASS {
KeyValueBasicInformation,
KeyValueFullInformation,
KeyValuePartialInformation,
KeyValueFullInformationAlign64,
KeyValuePartialInformationAlign64
} KEY_VALUE_INFORMATION_CLASS;
typedef struct _KEY_VALUE_BASIC_INFORMATION {
ULONG TitleIndex;
ULONG Type;
ULONG NameLength;
WCHAR Name[1];
} KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION;
typedef struct _KEY_VALUE_FULL_INFORMATION {
ULONG TitleIndex;
ULONG Type;
ULONG DataOffset;
ULONG DataLength;
ULONG NameLength;
WCHAR Name[1];
} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;
typedef struct _KEY_VALUE_PARTIAL_INFORMATION {
ULONG TitleIndex;
ULONG Type;
ULONG DataLength;
UCHAR Data[1];
} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;
NTSYSAPI
NTSTATUS
NTAPI
NtOpenKey(
__out PHANDLE KeyHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSAPI
void
NTAPI
RtlInitAnsiString(
__out ANSI_STRING* DestinationString,
__in CHAR* SourceString
);
NTSYSAPI
NTSTATUS
NTAPI
NtWriteFile(
__in HANDLE FileHandle,
__in HANDLE Event OPTIONAL,
__in PIO_APC_ROUTINE ApcRoutine OPTIONAL,
__in PVOID ApcContext OPTIONAL,
__out PIO_STATUS_BLOCK IoStatusBlock,
__in PVOID Buffer,
__in ULONG Length,
__in PLARGE_INTEGER ByteOffset OPTIONAL,
__in PULONG Key OPTIONAL
);
NTSYSAPI
NTSTATUS
NTAPI
NtReadFile(
__in HANDLE FileHandle,
__in HANDLE Event OPTIONAL,
__in PIO_APC_ROUTINE ApcRoutine OPTIONAL,
__in PVOID ApcContext OPTIONAL,
__out PIO_STATUS_BLOCK IoStatusBlock,
__out PVOID Buffer,
__in ULONG Length,
__in PLARGE_INTEGER ByteOffset OPTIONAL,
__in PULONG Key OPTIONAL
);
NTSYSAPI
NTSTATUS
NTAPI
DbgPrint(
__in LPCSTR Format,
...
);
NTSYSAPI
NTSTATUS
NTAPI
NtGetContextThread(
__in HANDLE ThreadHandle,
__out PCONTEXT pContext
);
NTSYSAPI
NTSTATUS
NTAPI
NtSetContextThread(
__in HANDLE ThreadHandle,
__in PCONTEXT Context
);
NTSYSAPI
NTSTATUS
NTAPI
NtAlertThread(
__in HANDLE ThreadHandle
);
NTSYSAPI
NTSTATUS
NTAPI
RtlInitializeCriticalSection(
__in PCRITICAL_SECTION CriticalSection
);
NTSYSAPI
NTSTATUS
NTAPI
RtlEnterCriticalSection(
__in PCRITICAL_SECTION CriticalSection
);
NTSYSAPI
NTSTATUS
NTAPI
RtlLeaveCriticalSection(
__in PCRITICAL_SECTION CriticalSection
);
NTSYSAPI
NTSTATUS
NTAPI
NtDelayExecution(
__in BOOLEAN Alertable,
__in PLARGE_INTEGER DelayInterval
);
NTSYSAPI
NTSTATUS
NTAPI
NtYieldExecution();
NTSYSAPI
ULONG
NTAPI
NtGetTickCount(void);
NTSYSAPI
NTSTATUS
NTAPI
NtQueryPerformanceCounter(
__out PLARGE_INTEGER PerformanceCounter,
__out PLARGE_INTEGER PerformanceFrequency OPTIONAL
);
NTSYSAPI
NTSTATUS
NTAPI
NtQueryDirectoryFile(
__in HANDLE FileHandle,
__in HANDLE Event OPTIONAL,
__in PIO_APC_ROUTINE ApcRoutine OPTIONAL,
__in PVOID ApcContext OPTIONAL,
__out PIO_STATUS_BLOCK IoStatusBlock,
__out PVOID FileInformation,
__in ULONG Length,
__in FILE_INFORMATION_CLASS FileInformationClass,
__in BOOLEAN ReturnSingleEntry,
__in PUNICODE_STRING FileMask OPTIONAL,
__in BOOLEAN RestartScan
);
NTSYSAPI
NTSTATUS
NTAPI
NtVdmControl(
__in ULONG ControlCode,
__in PVOID ControlData
);
#define KEY_QUERY_VALUE (0x0001)
NTSYSAPI
NTSTATUS
NTAPI
NtEnumerateKey(
__in HANDLE KeyHandle,
__in ULONG Index,
__in KEY_INFORMATION_CLASS KeyInformationClass,
__out PVOID KeyInformation,
__in ULONG KeyInformationLength,
__out PULONG ResultLength
);
NTSYSAPI
NTSTATUS
NTAPI
NtEnumerateValueKey(
__in HANDLE KeyHandle,
__in ULONG Index,
__in KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
__out PVOID KeyValueInformation,
__in ULONG KeyValueInformationLength,
__out PULONG ResultLength
);
BOOL
WINAPI
EnumServiceGroupW(
SC_HANDLE hSCManager,
DWORD dwServiceType,
DWORD dwServiceState,
LPBYTE lpServices,
DWORD cbBufSize,
LPDWORD pcbBytesNeeded,
LPDWORD lpServicesReturned,
LPDWORD lpResumeHandle,
DWORD dwUnknown
);
NTSYSAPI
NTSTATUS
NTAPI
NtQueryKey(
__in HANDLE KeyHandle,
__in KEY_INFORMATION_CLASS KeyInformationClass,
__out PVOID KeyInformation,
__in ULONG Length,
__out PULONG ResultLength );
typedef enum _SECTION_INHERIT {
ViewShare = 1,
ViewUnmap = 2
} SECTION_INHERIT;
NTSYSAPI
NTSTATUS
NTAPI
NtMapViewOfSection(
__in HANDLE SectionHandle,
__in HANDLE ProcessHandle,
__inout PVOID *BaseAddress,
__in ULONG ZeroBits OPTIONAL,
__in ULONG CommitSize,
__inout PLARGE_INTEGER SectionOffset,
__inout PULONG ViewSize,
__in SECTION_INHERIT InheritDisposition,
__in ULONG AllocationType,
__in ULONG Protect
);
typedef struct _LDR_RESOURCE_INFO
{
ULONG Type;
ULONG Name;
ULONG Language;
} LDR_RESOURCE_INFO, *PLDR_RESOURCE_INFO;
NTSYSAPI
NTSTATUS
NTAPI
LdrFindResourceDirectory_U(
HMODULE hModule,
LDR_RESOURCE_INFO* pResInfo,
ULONG ulNrOfItems,
IMAGE_RESOURCE_DIRECTORY** pResDir
);
NTSYSAPI
NTSTATUS
NTAPI
LdrFindResource_U(
HMODULE hModule,
LDR_RESOURCE_INFO* pResInfo,
ULONG ulNrOfItems,
IMAGE_RESOURCE_DATA_ENTRY** pResDataDir
);
NTSYSAPI
NTSTATUS
NTAPI
LdrAccessResource(
HMODULE hModule,
IMAGE_RESOURCE_DATA_ENTRY* pResDataEntry,
void ** pData,
PULONG pulOptional
);
NTSYSAPI
NTSTATUS
NTAPI
NtSaveKey(
HANDLE KeyHandle,
HANDLE FileHandle
);
NTSYSAPI
NTSTATUS
NTAPI
NtSaveMergedKeys(
__in HANDLE KeyHandle1,
__in HANDLE KeyHandle2,
__in HANDLE FileHandle
);
NTSYSAPI
NTSTATUS
NTAPI
NtOpenProcessToken (
__in HANDLE ProcessHandle,
__in DWORD DesiredAccess,
__deref_out PHANDLE TokenHandle
);
NTSYSAPI
NTSTATUS
NTAPI
NtAdjustPrivilegesToken(
__in HANDLE TokenHandle,
__in BOOL DisableAllPrivileges,
__in_opt PTOKEN_PRIVILEGES NewState,
__in DWORD BufferLength,
__out_bcount_part_opt(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,
__out_opt PDWORD ReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
RtlCreateSecurityDescriptor (
__out PSECURITY_DESCRIPTOR pSecurityDescriptor,
__in DWORD dwRevision
);
NTSYSAPI
NTSTATUS
NTAPI
RtlSetDaclSecurityDescriptor (
__inout PSECURITY_DESCRIPTOR pSecurityDescriptor,
__in BOOL bDaclPresent,
__in_opt PACL pDacl,
__in BOOL bDaclDefaulted
);
NTSYSAPI
HANDLE
NTAPI
RtlCreateHeap (
__in DWORD flag,
__in DWORD v1,
__in DWORD v2,
__in DWORD v3,
__in DWORD v4,
__in DWORD v5
);
NTSYSAPI
NTSTATUS
NTAPI RtlSetHeapInformation(
__in HANDLE HeapHandle,
__in HEAP_INFORMATION_CLASS HeapInformationClass,
__in PVOID HeapInformation,
__in SIZE_T HeapInformationLength
);
NTSYSAPI
LPVOID
NTAPI
RtlAllocateHeap(
__in HANDLE hHeap,
__in DWORD dwFlags,
__in SIZE_T dwBytes
);
NTSYSAPI
BOOL
NTAPI
RtlFreeHeap(
__in HANDLE hHeap,
__in DWORD dwFlags,
__in LPVOID lpMem
);
NTSYSAPI
NTSTATUS
NTAPI
RtlDestroyHeap (
__in HANDLE hHeap
);
#ifdef __cplusplus
} // extern "C"
#endif // __cplusplus
#endif // NTDLL_H
Reference in New Issue Copy Permalink