3 Copyright (c) Alex Ionescu. All rights reserved.
11 Type definitions for the Executive.
15 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
27 #if defined(_MSC_VER) && !defined(NTOS_MODE_USER)
42 #define __ALIGNED(n) __attribute__((aligned (n)))
43 #elif defined(_MSC_VER)
44 #define __ALIGNED(n) __declspec(align(n))
46 #error __ALIGNED not defined for your compiler!
50 // Atom and Language IDs
52 typedef USHORT LANGID
, *PLANGID
;
53 typedef USHORT RTL_ATOM
, *PRTL_ATOM
;
55 #ifndef NTOS_MODE_USER
58 // Kernel Exported Object Types
60 extern POBJECT_TYPE NTSYSAPI ExDesktopObjectType
;
61 extern POBJECT_TYPE NTSYSAPI ExWindowStationObjectType
;
62 extern POBJECT_TYPE NTSYSAPI ExIoCompletionType
;
63 extern POBJECT_TYPE NTSYSAPI ExMutantObjectType
;
64 extern POBJECT_TYPE NTSYSAPI ExTimerType
;
67 // Exported NT Build Number
69 extern ULONG NtBuildNumber
;
72 // Invalid Handle Value Constant
74 #define INVALID_HANDLE_VALUE (HANDLE)-1
81 #define MUTANT_INCREMENT 1
84 // Callback Object Access Mask
86 #define CALLBACK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x0001)
87 #define CALLBACK_EXECUTE (STANDARD_RIGHTS_EXECUTE|SYNCHRONIZE|0x0001)
88 #define CALLBACK_WRITE (STANDARD_RIGHTS_WRITE|SYNCHRONIZE|0x0001)
89 #define CALLBACK_READ (STANDARD_RIGHTS_READ|SYNCHRONIZE|0x0001)
92 // Event Object Access Masks
95 #define EVENT_QUERY_STATE 0x0001
98 // Semaphore Object Access Masks
100 #define SEMAPHORE_QUERY_STATE 0x0001
104 // Mutant Object Access Masks
106 #define MUTANT_QUERY_STATE 0x0001
107 #define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
111 #define TIMER_QUERY_STATE 0x0001
112 #define TIMER_MODIFY_STATE 0x0002
113 #define TIMER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
115 TIMER_QUERY_STATE | \
120 // Event Pair Access Masks
122 #define EVENT_PAIR_ALL_ACCESS 0x1F0000L
125 // Profile Object Access Masks
127 #define PROFILE_CONTROL 0x0001
128 #define PROFILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | PROFILE_CONTROL)
131 // Maximum Parameters for NtRaiseHardError
133 #define MAXIMUM_HARDERROR_PARAMETERS 4
138 #define EX_PUSH_LOCK_LOCK_V ((ULONG_PTR)0x0)
139 #define EX_PUSH_LOCK_LOCK ((ULONG_PTR)0x1)
140 #define EX_PUSH_LOCK_WAITING ((ULONG_PTR)0x2)
141 #define EX_PUSH_LOCK_WAKING ((ULONG_PTR)0x4)
142 #define EX_PUSH_LOCK_MULTIPLE_SHARED ((ULONG_PTR)0x8)
143 #define EX_PUSH_LOCK_SHARE_INC ((ULONG_PTR)0x10)
144 #define EX_PUSH_LOCK_PTR_BITS ((ULONG_PTR)0xf)
147 // Pushlock Wait Block Flags
149 #define EX_PUSH_LOCK_FLAGS_EXCLUSIVE 1
150 #define EX_PUSH_LOCK_FLAGS_WAIT_V 1
151 #define EX_PUSH_LOCK_FLAGS_WAIT 2
154 // Resource (ERESOURCE) Flags
156 #define ResourceHasDisabledPriorityBoost 0x08
159 // Shutdown types for NtShutdownSystem
161 typedef enum _SHUTDOWN_ACTION
169 // Responses for NtRaiseHardError
171 typedef enum _HARDERROR_RESPONSE_OPTION
173 OptionAbortRetryIgnore
,
180 } HARDERROR_RESPONSE_OPTION
, *PHARDERROR_RESPONSE_OPTION
;
182 typedef enum _HARDERROR_RESPONSE
184 ResponseReturnToCaller
,
195 } HARDERROR_RESPONSE
, *PHARDERROR_RESPONSE
;
198 // System Information Classes for NtQuerySystemInformation
200 typedef enum _SYSTEM_INFORMATION_CLASS
202 SystemBasicInformation
,
203 SystemProcessorInformation
,
204 SystemPerformanceInformation
,
205 SystemTimeOfDayInformation
,
206 SystemPathInformation
, /// Obsolete: Use KUSER_SHARED_DATA
207 SystemProcessInformation
,
208 SystemCallCountInformation
,
209 SystemDeviceInformation
,
210 SystemProcessorPerformanceInformation
,
211 SystemFlagsInformation
,
212 SystemCallTimeInformation
,
213 SystemModuleInformation
,
214 SystemLocksInformation
,
215 SystemStackTraceInformation
,
216 SystemPagedPoolInformation
,
217 SystemNonPagedPoolInformation
,
218 SystemHandleInformation
,
219 SystemObjectInformation
,
220 SystemPageFileInformation
,
221 SystemVdmInstemulInformation
,
222 SystemVdmBopInformation
,
223 SystemFileCacheInformation
,
224 SystemPoolTagInformation
,
225 SystemInterruptInformation
,
226 SystemDpcBehaviorInformation
,
227 SystemFullMemoryInformation
,
228 SystemLoadGdiDriverInformation
,
229 SystemUnloadGdiDriverInformation
,
230 SystemTimeAdjustmentInformation
,
231 SystemSummaryMemoryInformation
,
232 SystemMirrorMemoryInformation
,
233 SystemPerformanceTraceInformation
,
235 SystemExceptionInformation
,
236 SystemCrashDumpStateInformation
,
237 SystemKernelDebuggerInformation
,
238 SystemContextSwitchInformation
,
239 SystemRegistryQuotaInformation
,
240 SystemExtendServiceTableInformation
,
241 SystemPrioritySeperation
,
242 SystemPlugPlayBusInformation
,
243 SystemDockInformation
,
244 SystemPowerInformationNative
,
245 SystemProcessorSpeedInformation
,
246 SystemCurrentTimeZoneInformation
,
247 SystemLookasideInformation
,
248 SystemTimeSlipNotification
,
251 SystemSessionInformation
,
252 SystemRangeStartInformation
,
253 SystemVerifierInformation
,
255 SystemSessionProcessesInformation
,
256 SystemLoadGdiDriverInSystemSpaceInformation
,
257 SystemNumaProcessorMap
,
258 SystemPrefetcherInformation
,
259 SystemExtendedProcessInformation
,
260 SystemRecommendedSharedDataAlignment
,
261 SystemComPlusPackage
,
262 SystemNumaAvailableMemory
,
263 SystemProcessorPowerInformation
,
264 SystemEmulationBasicInformation
,
265 SystemEmulationProcessorInformation
,
266 SystemExtendedHanfleInformation
,
267 SystemLostDelayedWriteInformation
,
268 SystemBigPoolInformation
,
269 SystemSessionPoolTagInformation
,
270 SystemSessionMappedViewInformation
,
271 SystemHotpatchInformation
,
272 SystemObjectSecurityMode
,
273 SystemWatchDogTimerHandler
,
274 SystemWatchDogTimerInformation
,
275 SystemLogicalProcessorInformation
,
276 SystemWow64SharedInformationObsolete
,
277 SystemRegisterFirmwareTableInformationHandler
,
278 SystemFirmwareTableInformation
,
279 SystemModuleInformationEx
,
280 SystemVerifierTriageInformation
,
281 SystemSuperfetchInformation
,
282 SystemMemoryListInformation
,
283 SystemFileCacheInformationEx
,
284 SystemThreadPriorityClientIdInformation
,
285 SystemProcessorIdleCycleTimeInformation
,
286 SystemVerifierCancellationInformation
,
287 SystemProcessorPowerInformationEx
,
288 SystemRefTraceInformation
,
289 SystemSpecialPoolInformation
,
290 SystemProcessIdInformation
,
291 SystemErrorPortInformation
,
292 SystemBootEnvironmentInformation
,
293 SystemHypervisorInformation
,
294 SystemVerifierInformationEx
,
295 SystemTimeZoneInformation
,
296 SystemImageFileExecutionOptionsInformation
,
297 SystemCoverageInformation
,
298 SystemPrefetchPathInformation
,
299 SystemVerifierFaultsInformation
,
301 } SYSTEM_INFORMATION_CLASS
;
304 // System Information Classes for NtQueryMutant
306 typedef enum _MUTANT_INFORMATION_CLASS
308 MutantBasicInformation
,
309 MutantOwnerInformation
310 } MUTANT_INFORMATION_CLASS
;
313 // System Information Classes for NtQueryAtom
315 typedef enum _ATOM_INFORMATION_CLASS
317 AtomBasicInformation
,
318 AtomTableInformation
,
319 } ATOM_INFORMATION_CLASS
;
322 // System Information Classes for NtQueryTimer
324 typedef enum _TIMER_INFORMATION_CLASS
326 TimerBasicInformation
327 } TIMER_INFORMATION_CLASS
;
330 // System Information Classes for NtQuerySemaphore
332 typedef enum _SEMAPHORE_INFORMATION_CLASS
334 SemaphoreBasicInformation
335 } SEMAPHORE_INFORMATION_CLASS
;
338 // System Information Classes for NtQueryEvent
340 typedef enum _EVENT_INFORMATION_CLASS
342 EventBasicInformation
343 } EVENT_INFORMATION_CLASS
;
345 #ifdef NTOS_MODE_USER
348 // Firmware Table Actions for SystemFirmwareTableInformation
350 typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION
352 SystemFirmwareTable_Enumerate
= 0,
353 SystemFirmwareTable_Get
= 1,
354 } SYSTEM_FIRMWARE_TABLE_ACTION
, *PSYSTEM_FIRMWARE_TABLE_ACTION
;
357 // Firmware Handler Callback
359 struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
;
363 IN
struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
*FirmwareTableInformation
369 // Handle Enumeration Callback
371 struct _HANDLE_TABLE_ENTRY
;
373 (NTAPI
*PEX_ENUM_HANDLE_CALLBACK
)(
374 IN
struct _HANDLE_TABLE_ENTRY
*HandleTableEntry
,
380 // Executive Work Queue Structures
382 typedef struct _EX_QUEUE_WORKER_INFO
384 ULONG QueueDisabled
:1;
385 ULONG MakeThreadsAsNecessary
:1;
387 ULONG WorkerCount
:29;
388 } EX_QUEUE_WORKER_INFO
, *PEX_QUEUE_WORKER_INFO
;
390 typedef struct _EX_WORK_QUEUE
393 LONG DynamicThreadCount
;
394 ULONG WorkItemsProcessed
;
395 ULONG WorkItemsProcessedLastPass
;
396 ULONG QueueDepthLastPass
;
397 EX_QUEUE_WORKER_INFO Info
;
398 } EX_WORK_QUEUE
, *PEX_WORK_QUEUE
;
401 // Executive Fast Reference Structure
403 typedef struct _EX_FAST_REF
411 } EX_FAST_REF
, *PEX_FAST_REF
;
414 // Executive Cache-Aware Rundown Reference Descriptor
416 typedef struct _EX_RUNDOWN_REF_CACHE_AWARE
418 PEX_RUNDOWN_REF RunRefs
;
422 } EX_RUNDOWN_REF_CACHE_AWARE
, *PEX_RUNDOWN_REF_CACHE_AWARE
;
425 // Executive Rundown Wait Block
427 typedef struct _EX_RUNDOWN_WAIT_BLOCK
431 } EX_RUNDOWN_WAIT_BLOCK
, *PEX_RUNDOWN_WAIT_BLOCK
;
434 // Executive Pushlock
438 typedef struct _EX_PUSH_LOCK
447 ULONG_PTR MultipleShared
:1;
448 ULONG_PTR Shared
:sizeof (ULONG_PTR
) * 8 - 4;
453 } EX_PUSH_LOCK
, *PEX_PUSH_LOCK
;
456 // Executive Pushlock Wait Block
458 typedef __ALIGNED(16) struct _EX_PUSH_LOCK_WAIT_BLOCK
465 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Next
;
466 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Last
;
467 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Previous
;
472 EX_PUSH_LOCK NewValue
;
473 EX_PUSH_LOCK OldValue
;
474 PEX_PUSH_LOCK PushLock
;
476 } EX_PUSH_LOCK_WAIT_BLOCK
, *PEX_PUSH_LOCK_WAIT_BLOCK
;
481 typedef struct _CALLBACK_OBJECT
485 LIST_ENTRY RegisteredCallbacks
;
486 BOOLEAN AllowMultipleCallbacks
;
488 } CALLBACK_OBJECT
, *PCALLBACK_OBJECT
;
493 typedef struct _CALLBACK_REGISTRATION
496 PCALLBACK_OBJECT CallbackObject
;
497 PCALLBACK_FUNCTION CallbackFunction
;
498 PVOID CallbackContext
;
500 BOOLEAN UnregisterWaiting
;
501 } CALLBACK_REGISTRATION
, *PCALLBACK_REGISTRATION
;
504 // Internal Callback Object
506 typedef struct _EX_CALLBACK_ROUTINE_BLOCK
508 EX_RUNDOWN_REF RundownProtect
;
509 PEX_CALLBACK_FUNCTION Function
;
511 } EX_CALLBACK_ROUTINE_BLOCK
, *PEX_CALLBACK_ROUTINE_BLOCK
;
514 // Internal Callback Handle
516 typedef struct _EX_CALLBACK
518 EX_FAST_REF RoutineBlock
;
519 } EX_CALLBACK
, *PEX_CALLBACK
;
524 typedef struct _EPROFILE
532 PKPROFILE ProfileObject
;
533 PVOID LockedBufferAddress
;
536 KPROFILE_SOURCE ProfileSource
;
538 } EPROFILE
, *PEPROFILE
;
541 // Handle Table Structures
543 typedef struct _HANDLE_TRACE_DB_ENTRY
548 PVOID StackTrace
[16];
549 } HANDLE_TRACE_DB_ENTRY
, *PHANDLE_TRACE_DB_ENTRY
;
551 typedef struct _HANDLE_TRACE_DEBUG_INFO
556 FAST_MUTEX CloseCompatcionLock
;
557 ULONG CurrentStackIndex
;
558 HANDLE_TRACE_DB_ENTRY TraceDb
[1];
559 } HANDLE_TRACE_DEBUG_INFO
, *PHANDLE_TRACE_DEBUG_INFO
;
561 typedef struct _HANDLE_TABLE_ENTRY_INFO
564 } HANDLE_TABLE_ENTRY_INFO
, *PHANDLE_TABLE_ENTRY_INFO
;
566 typedef struct _HANDLE_TABLE_ENTRY
571 ULONG_PTR ObAttributes
;
572 PHANDLE_TABLE_ENTRY_INFO InfoTable
;
580 USHORT GrantedAccessIndex
;
581 USHORT CreatorBackTraceIndex
;
583 LONG NextFreeTableEntry
;
585 } HANDLE_TABLE_ENTRY
, *PHANDLE_TABLE_ENTRY
;
587 typedef struct _HANDLE_TABLE
589 #if (NTDDI_VERSION >= NTDDI_WINXP)
592 PHANDLE_TABLE_ENTRY
**Table
;
594 PEPROCESS QuotaProcess
;
595 PVOID UniqueProcessId
;
596 #if (NTDDI_VERSION >= NTDDI_WINXP)
597 EX_PUSH_LOCK HandleTableLock
[4];
598 LIST_ENTRY HandleTableList
;
599 EX_PUSH_LOCK HandleContentionEvent
;
601 ERESOURCE HandleLock
;
602 LIST_ENTRY HandleTableList
;
603 KEVENT HandleContentionEvent
;
605 PHANDLE_TRACE_DEBUG_INFO DebugInfo
;
607 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
613 LONG FirstFreeHandle
;
614 PHANDLE_TABLE_ENTRY LastFreeHandleEntry
;
616 ULONG NextHandleNeedingPool
;
620 ULONG NextHandleNeedingPool
;
628 } HANDLE_TABLE
, *PHANDLE_TABLE
;
633 // Hard Error LPC Message
635 typedef struct _HARDERROR_MSG
639 LARGE_INTEGER ErrorTime
;
640 ULONG ValidResponseOptions
;
642 ULONG NumberOfParameters
;
643 ULONG UnicodeStringParameterMask
;
644 ULONG Parameters
[MAXIMUM_HARDERROR_PARAMETERS
];
645 } HARDERROR_MSG
, *PHARDERROR_MSG
;
648 // Information Structures for NtQueryMutant
650 typedef struct _MUTANT_BASIC_INFORMATION
653 BOOLEAN OwnedByCaller
;
654 BOOLEAN AbandonedState
;
655 } MUTANT_BASIC_INFORMATION
, *PMUTANT_BASIC_INFORMATION
;
657 typedef struct _MUTANT_OWNER_INFORMATION
660 } MUTANT_OWNER_INFORMATION
, *PMUTANT_OWNER_INFORMATION
;
663 // Information Structures for NtQueryAtom
665 typedef struct _ATOM_BASIC_INFORMATION
671 } ATOM_BASIC_INFORMATION
, *PATOM_BASIC_INFORMATION
;
673 typedef struct _ATOM_TABLE_INFORMATION
677 } ATOM_TABLE_INFORMATION
, *PATOM_TABLE_INFORMATION
;
680 // Information Structures for NtQueryTimer
682 typedef struct _TIMER_BASIC_INFORMATION
684 LARGE_INTEGER TimeRemaining
;
686 } TIMER_BASIC_INFORMATION
, *PTIMER_BASIC_INFORMATION
;
689 // Information Structures for NtQuerySemaphore
691 typedef struct _SEMAPHORE_BASIC_INFORMATION
695 } SEMAPHORE_BASIC_INFORMATION
, *PSEMAPHORE_BASIC_INFORMATION
;
698 // Information Structures for NtQueryEvent
700 typedef struct _EVENT_BASIC_INFORMATION
702 EVENT_TYPE EventType
;
704 } EVENT_BASIC_INFORMATION
, *PEVENT_BASIC_INFORMATION
;
707 // Information Structures for NtQuerySystemInformation
709 typedef struct _SYSTEM_BASIC_INFORMATION
712 ULONG TimerResolution
;
714 ULONG NumberOfPhysicalPages
;
715 ULONG LowestPhysicalPageNumber
;
716 ULONG HighestPhysicalPageNumber
;
717 ULONG AllocationGranularity
;
718 ULONG_PTR MinimumUserModeAddress
;
719 ULONG_PTR MaximumUserModeAddress
;
720 ULONG_PTR ActiveProcessorsAffinityMask
;
721 CCHAR NumberOfProcessors
;
722 } SYSTEM_BASIC_INFORMATION
, *PSYSTEM_BASIC_INFORMATION
;
725 typedef struct _SYSTEM_PROCESSOR_INFORMATION
727 USHORT ProcessorArchitecture
;
728 USHORT ProcessorLevel
;
729 USHORT ProcessorRevision
;
731 ULONG ProcessorFeatureBits
;
732 } SYSTEM_PROCESSOR_INFORMATION
, *PSYSTEM_PROCESSOR_INFORMATION
;
735 typedef struct _SYSTEM_PERFORMANCE_INFORMATION
737 LARGE_INTEGER IdleProcessTime
;
738 LARGE_INTEGER IoReadTransferCount
;
739 LARGE_INTEGER IoWriteTransferCount
;
740 LARGE_INTEGER IoOtherTransferCount
;
741 ULONG IoReadOperationCount
;
742 ULONG IoWriteOperationCount
;
743 ULONG IoOtherOperationCount
;
744 ULONG AvailablePages
;
745 ULONG CommittedPages
;
747 ULONG PeakCommitment
;
748 ULONG PageFaultCount
;
749 ULONG CopyOnWriteCount
;
750 ULONG TransitionCount
;
751 ULONG CacheTransitionCount
;
752 ULONG DemandZeroCount
;
754 ULONG PageReadIoCount
;
755 ULONG CacheReadCount
;
757 ULONG DirtyPagesWriteCount
;
758 ULONG DirtyWriteIoCount
;
759 ULONG MappedPagesWriteCount
;
760 ULONG MappedWriteIoCount
;
761 ULONG PagedPoolPages
;
762 ULONG NonPagedPoolPages
;
763 ULONG PagedPoolAllocs
;
764 ULONG PagedPoolFrees
;
765 ULONG NonPagedPoolAllocs
;
766 ULONG NonPagedPoolFrees
;
767 ULONG FreeSystemPtes
;
768 ULONG ResidentSystemCodePage
;
769 ULONG TotalSystemDriverPages
;
770 ULONG TotalSystemCodePages
;
771 ULONG NonPagedPoolLookasideHits
;
772 ULONG PagedPoolLookasideHits
;
774 ULONG ResidentSystemCachePage
;
775 ULONG ResidentPagedPoolPage
;
776 ULONG ResidentSystemDriverPage
;
777 ULONG CcFastReadNoWait
;
778 ULONG CcFastReadWait
;
779 ULONG CcFastReadResourceMiss
;
780 ULONG CcFastReadNotPossible
;
781 ULONG CcFastMdlReadNoWait
;
782 ULONG CcFastMdlReadWait
;
783 ULONG CcFastMdlReadResourceMiss
;
784 ULONG CcFastMdlReadNotPossible
;
785 ULONG CcMapDataNoWait
;
787 ULONG CcMapDataNoWaitMiss
;
788 ULONG CcMapDataWaitMiss
;
789 ULONG CcPinMappedDataCount
;
790 ULONG CcPinReadNoWait
;
792 ULONG CcPinReadNoWaitMiss
;
793 ULONG CcPinReadWaitMiss
;
794 ULONG CcCopyReadNoWait
;
795 ULONG CcCopyReadWait
;
796 ULONG CcCopyReadNoWaitMiss
;
797 ULONG CcCopyReadWaitMiss
;
798 ULONG CcMdlReadNoWait
;
800 ULONG CcMdlReadNoWaitMiss
;
801 ULONG CcMdlReadWaitMiss
;
802 ULONG CcReadAheadIos
;
803 ULONG CcLazyWriteIos
;
804 ULONG CcLazyWritePages
;
807 ULONG ContextSwitches
;
808 ULONG FirstLevelTbFills
;
809 ULONG SecondLevelTbFills
;
811 } SYSTEM_PERFORMANCE_INFORMATION
, *PSYSTEM_PERFORMANCE_INFORMATION
;
814 typedef struct _SYSTEM_TIMEOFDAY_INFORMATION
816 LARGE_INTEGER BootTime
;
817 LARGE_INTEGER CurrentTime
;
818 LARGE_INTEGER TimeZoneBias
;
821 } SYSTEM_TIMEOFDAY_INFORMATION
, *PSYSTEM_TIMEOFDAY_INFORMATION
;
824 // This class is obsolete, please use KUSER_SHARED_DATA instead
827 typedef struct _SYSTEM_THREAD_INFORMATION
829 LARGE_INTEGER KernelTime
;
830 LARGE_INTEGER UserTime
;
831 LARGE_INTEGER CreateTime
;
837 ULONG ContextSwitches
;
840 } SYSTEM_THREAD_INFORMATION
, *PSYSTEM_THREAD_INFORMATION
;
842 typedef struct _SYSTEM_PROCESS_INFORMATION
844 ULONG NextEntryOffset
;
845 ULONG NumberOfThreads
;
846 LARGE_INTEGER SpareLi1
;
847 LARGE_INTEGER SpareLi2
;
848 LARGE_INTEGER SpareLi3
;
849 LARGE_INTEGER CreateTime
;
850 LARGE_INTEGER UserTime
;
851 LARGE_INTEGER KernelTime
;
852 UNICODE_STRING ImageName
;
853 KPRIORITY BasePriority
;
854 HANDLE UniqueProcessId
;
855 HANDLE InheritedFromUniqueProcessId
;
858 ULONG_PTR PageDirectoryBase
;
861 // This part corresponds to VM_COUNTERS_EX.
862 // NOTE: *NOT* THE SAME AS VM_COUNTERS!
864 SIZE_T PeakVirtualSize
;
866 SIZE_T PageFaultCount
;
867 SIZE_T PeakWorkingSetSize
;
868 SIZE_T WorkingSetSize
;
869 SIZE_T QuotaPeakPagedPoolUsage
;
870 SIZE_T QuotaPagedPoolUsage
;
871 SIZE_T QuotaPeakNonPagedPoolUsage
;
872 SIZE_T QuotaNonPagedPoolUsage
;
873 SIZE_T PagefileUsage
;
874 SIZE_T PeakPagefileUsage
;
875 SIZE_T PrivatePageCount
;
878 // This part corresponds to IO_COUNTERS
880 LARGE_INTEGER ReadOperationCount
;
881 LARGE_INTEGER WriteOperationCount
;
882 LARGE_INTEGER OtherOperationCount
;
883 LARGE_INTEGER ReadTransferCount
;
884 LARGE_INTEGER WriteTransferCount
;
885 LARGE_INTEGER OtherTransferCount
;
887 //SYSTEM_THREAD_INFORMATION TH[1];
888 } SYSTEM_PROCESS_INFORMATION
, *PSYSTEM_PROCESS_INFORMATION
;
891 typedef struct _SYSTEM_CALL_COUNT_INFORMATION
894 ULONG NumberOfTables
;
895 } SYSTEM_CALL_COUNT_INFORMATION
, *PSYSTEM_CALL_COUNT_INFORMATION
;
898 typedef struct _SYSTEM_DEVICE_INFORMATION
901 ULONG NumberOfFloppies
;
902 ULONG NumberOfCdRoms
;
904 ULONG NumberOfSerialPorts
;
905 ULONG NumberOfParallelPorts
;
906 } SYSTEM_DEVICE_INFORMATION
, *PSYSTEM_DEVICE_INFORMATION
;
909 typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
911 LARGE_INTEGER IdleTime
;
912 LARGE_INTEGER KernelTime
;
913 LARGE_INTEGER UserTime
;
914 LARGE_INTEGER DpcTime
;
915 LARGE_INTEGER InterruptTime
;
916 ULONG InterruptCount
;
917 } SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
;
920 typedef struct _SYSTEM_FLAGS_INFORMATION
923 } SYSTEM_FLAGS_INFORMATION
, *PSYSTEM_FLAGS_INFORMATION
;
926 typedef struct _SYSTEM_CALL_TIME_INFORMATION
930 LARGE_INTEGER TimeOfCalls
[1];
931 } SYSTEM_CALL_TIME_INFORMATION
, *PSYSTEM_CALL_TIME_INFORMATION
;
933 // Class 11 - See RTL_PROCESS_MODULES
935 // Class 12 - See RTL_PROCESS_LOCKS
937 // Class 13 - See RTL_PROCESS_BACKTRACES
940 typedef struct _SYSTEM_POOL_ENTRY
944 USHORT AllocatorBackTraceIndex
;
950 PVOID ProcessChargedQuota
;
952 } SYSTEM_POOL_ENTRY
, *PSYSTEM_POOL_ENTRY
;
954 typedef struct _SYSTEM_POOL_INFORMATION
958 USHORT EntryOverhead
;
959 BOOLEAN PoolTagPresent
;
961 ULONG NumberOfEntries
;
962 SYSTEM_POOL_ENTRY Entries
[1];
963 } SYSTEM_POOL_INFORMATION
, *PSYSTEM_POOL_INFORMATION
;
966 typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
968 USHORT UniqueProcessId
;
969 USHORT CreatorBackTraceIndex
;
970 UCHAR ObjectTypeIndex
;
971 UCHAR HandleAttributes
;
975 } SYSTEM_HANDLE_TABLE_ENTRY_INFO
, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO
;
977 typedef struct _SYSTEM_HANDLE_INFORMATION
979 ULONG NumberOfHandles
;
980 SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles
[1];
981 } SYSTEM_HANDLE_INFORMATION
, *PSYSTEM_HANDLE_INFORMATION
;
984 typedef struct _SYSTEM_OBJECTTYPE_INFORMATION
986 ULONG NextEntryOffset
;
987 ULONG NumberOfObjects
;
988 ULONG NumberOfHandles
;
990 ULONG InvalidAttributes
;
991 GENERIC_MAPPING GenericMapping
;
992 ULONG ValidAccessMask
;
994 BOOLEAN SecurityRequired
;
995 BOOLEAN WaitableObject
;
996 UNICODE_STRING TypeName
;
997 } SYSTEM_OBJECTTYPE_INFORMATION
, *PSYSTEM_OBJECTTYPE_INFORMATION
;
999 typedef struct _SYSTEM_OBJECT_INFORMATION
1001 ULONG NextEntryOffset
;
1003 HANDLE CreatorUniqueProcess
;
1004 USHORT CreatorBackTraceIndex
;
1008 ULONG PagedPoolCharge
;
1009 ULONG NonPagedPoolCharge
;
1010 HANDLE ExclusiveProcessId
;
1011 PVOID SecurityDescriptor
;
1012 OBJECT_NAME_INFORMATION NameInfo
;
1013 } SYSTEM_OBJECT_INFORMATION
, *PSYSTEM_OBJECT_INFORMATION
;
1016 typedef struct _SYSTEM_PAGEFILE_INFORMATION
1018 ULONG NextEntryOffset
;
1022 UNICODE_STRING PageFileName
;
1023 } SYSTEM_PAGEFILE_INFORMATION
, *PSYSTEM_PAGEFILE_INFORMATION
;
1026 typedef struct _SYSTEM_VDM_INSTEMUL_INFO
1028 ULONG SegmentNotPresent
;
1030 ULONG OpcodeESPrefix
;
1031 ULONG OpcodeCSPrefix
;
1032 ULONG OpcodeSSPrefix
;
1033 ULONG OpcodeDSPrefix
;
1034 ULONG OpcodeFSPrefix
;
1035 ULONG OpcodeGSPrefix
;
1036 ULONG OpcodeOPER32Prefix
;
1037 ULONG OpcodeADDR32Prefix
;
1049 ULONG OpcodeOUTBimm
;
1050 ULONG OpcodeOUTWimm
;
1055 ULONG OpcodeLOCKPrefix
;
1056 ULONG OpcodeREPNEPrefix
;
1057 ULONG OpcodeREPPrefix
;
1062 } SYSTEM_VDM_INSTEMUL_INFO
, *PSYSTEM_VDM_INSTEMUL_INFO
;
1064 // Class 20 - ULONG VDMBOPINFO
1067 typedef struct _SYSTEM_FILECACHE_INFORMATION
1071 ULONG PageFaultCount
;
1072 ULONG MinimumWorkingSet
;
1073 ULONG MaximumWorkingSet
;
1074 ULONG CurrentSizeIncludingTransitionInPages
;
1075 ULONG PeakSizeIncludingTransitionInPages
;
1076 ULONG TransitionRePurposeCount
;
1078 } SYSTEM_FILECACHE_INFORMATION
, *PSYSTEM_FILECACHE_INFORMATION
;
1081 typedef struct _SYSTEM_POOLTAG
1091 ULONG NonPagedAllocs
;
1092 ULONG NonPagedFrees
;
1094 } SYSTEM_POOLTAG
, *PSYSTEM_POOLTAG
;
1095 typedef struct _SYSTEM_POOLTAG_INFORMATION
1098 SYSTEM_POOLTAG TagInfo
[1];
1099 } SYSTEM_POOLTAG_INFORMATION
, *PSYSTEM_POOLTAG_INFORMATION
;
1102 typedef struct _SYSTEM_INTERRUPT_INFORMATION
1104 ULONG ContextSwitches
;
1107 ULONG TimeIncrement
;
1108 ULONG DpcBypassCount
;
1109 ULONG ApcBypassCount
;
1110 } SYSTEM_INTERRUPT_INFORMATION
, *PSYSTEM_INTERRUPT_INFORMATION
;
1113 typedef struct _SYSTEM_DPC_BEHAVIOR_INFORMATION
1116 ULONG DpcQueueDepth
;
1117 ULONG MinimumDpcRate
;
1118 ULONG AdjustDpcThreshold
;
1120 } SYSTEM_DPC_BEHAVIOR_INFORMATION
, *PSYSTEM_DPC_BEHAVIOR_INFORMATION
;
1123 typedef struct _SYSTEM_MEMORY_INFO
1125 PUCHAR StringOffset
;
1127 USHORT TransitionCount
;
1128 USHORT ModifiedCount
;
1129 USHORT PageTableCount
;
1130 } SYSTEM_MEMORY_INFO
, *PSYSTEM_MEMORY_INFO
;
1132 typedef struct _SYSTEM_MEMORY_INFORMATION
1136 SYSTEM_MEMORY_INFO Memory
[1];
1137 } SYSTEM_MEMORY_INFORMATION
, *PSYSTEM_MEMORY_INFORMATION
;
1140 typedef struct _SYSTEM_GDI_DRIVER_INFORMATION
1142 UNICODE_STRING DriverName
;
1144 PVOID SectionPointer
;
1146 PIMAGE_EXPORT_DIRECTORY ExportSectionPointer
;
1148 } SYSTEM_GDI_DRIVER_INFORMATION
, *PSYSTEM_GDI_DRIVER_INFORMATION
;
1151 // Not an actually class, simply a PVOID to the ImageAddress
1154 typedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION
1156 ULONG TimeAdjustment
;
1157 ULONG TimeIncrement
;
1159 } SYSTEM_QUERY_TIME_ADJUST_INFORMATION
, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION
;
1161 typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION
1163 ULONG TimeAdjustment
;
1165 } SYSTEM_SET_TIME_ADJUST_INFORMATION
, *PSYSTEM_SET_TIME_ADJUST_INFORMATION
;
1167 // Class 29 - Same as 25
1172 typedef struct _SYSTEM_REF_TRACE_INFORMATION
1175 UCHAR TracePermanent
;
1176 UNICODE_STRING TraceProcessName
;
1177 UNICODE_STRING TracePoolTags
;
1178 } SYSTEM_REF_TRACE_INFORMATION
, *PSYSTEM_REF_TRACE_INFORMATION
;
1180 // Class 32 - OBSOLETE
1183 typedef struct _SYSTEM_EXCEPTION_INFORMATION
1185 ULONG AlignmentFixupCount
;
1186 ULONG ExceptionDispatchCount
;
1187 ULONG FloatingEmulationCount
;
1188 ULONG ByteWordEmulationCount
;
1189 } SYSTEM_EXCEPTION_INFORMATION
, *PSYSTEM_EXCEPTION_INFORMATION
;
1192 typedef struct _SYSTEM_CRASH_STATE_INFORMATION
1194 ULONG ValidCrashDump
;
1195 } SYSTEM_CRASH_STATE_INFORMATION
, *PSYSTEM_CRASH_STATE_INFORMATION
;
1198 typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION
1200 BOOLEAN KernelDebuggerEnabled
;
1201 BOOLEAN KernelDebuggerNotPresent
;
1202 } SYSTEM_KERNEL_DEBUGGER_INFORMATION
, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION
;
1205 typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION
1207 ULONG ContextSwitches
;
1216 ULONG PreemptCurrent
;
1219 } SYSTEM_CONTEXT_SWITCH_INFORMATION
, *PSYSTEM_CONTEXT_SWITCH_INFORMATION
;
1222 typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION
1224 ULONG RegistryQuotaAllowed
;
1225 ULONG RegistryQuotaUsed
;
1226 ULONG PagedPoolSize
;
1227 } SYSTEM_REGISTRY_QUOTA_INFORMATION
, *PSYSTEM_REGISTRY_QUOTA_INFORMATION
;
1230 // Not a structure, simply send the UNICODE_STRING
1233 // Not a structure, simply send a ULONG containing the new separation
1236 typedef struct _SYSTEM_PLUGPLAY_BUS_INFORMATION
1239 PLUGPLAY_BUS_INSTANCE BusInstance
[1];
1240 } SYSTEM_PLUGPLAY_BUS_INFORMATION
, *PSYSTEM_PLUGPLAY_BUS_INFORMATION
;
1243 typedef struct _SYSTEM_DOCK_INFORMATION
1245 SYSTEM_DOCK_STATE DockState
;
1246 INTERFACE_TYPE DeviceBusType
;
1247 ULONG DeviceBusNumber
;
1249 } SYSTEM_DOCK_INFORMATION
, *PSYSTEM_DOCK_INFORMATION
;
1252 typedef struct _SYSTEM_POWER_INFORMATION_NATIVE
1254 BOOLEAN SystemSuspendSupported
;
1255 BOOLEAN SystemHibernateSupported
;
1256 BOOLEAN ResumeTimerSupportsSuspend
;
1257 BOOLEAN ResumeTimerSupportsHibernate
;
1258 BOOLEAN LidSupported
;
1259 BOOLEAN TurboSettingSupported
;
1261 BOOLEAN SystemAcOrDc
;
1262 BOOLEAN PowerDownDisabled
;
1263 LARGE_INTEGER SpindownDrives
;
1264 } SYSTEM_POWER_INFORMATION_NATIVE
, *PSYSTEM_POWER_INFORMATION_NATIVE
;
1267 typedef struct _SYSTEM_LEGACY_DRIVER_INFORMATION
1269 PNP_VETO_TYPE VetoType
;
1270 UNICODE_STRING VetoDriver
;
1272 } SYSTEM_LEGACY_DRIVER_INFORMATION
, *PSYSTEM_LEGACY_DRIVER_INFORMATION
;
1275 //typedef struct _TIME_ZONE_INFORMATION RTL_TIME_ZONE_INFORMATION;
1278 typedef struct _SYSTEM_LOOKASIDE_INFORMATION
1280 USHORT CurrentDepth
;
1281 USHORT MaximumDepth
;
1282 ULONG TotalAllocates
;
1283 ULONG AllocateMisses
;
1289 } SYSTEM_LOOKASIDE_INFORMATION
, *PSYSTEM_LOOKASIDE_INFORMATION
;
1292 // Not a structure. Only a HANDLE for the SlipEvent;
1295 // Not a structure. Only a ULONG for the SessionId;
1298 // Not a structure. Only a ULONG for the SessionId;
1303 // Not a structure. Only a ULONG_PTR for the SystemRangeStart
1306 typedef struct _SYSTEM_VERIFIER_INFORMATION
1308 ULONG NextEntryOffset
;
1310 UNICODE_STRING DriverName
;
1312 ULONG AcquireSpinLocks
;
1313 ULONG SynchronizeExecutions
;
1314 ULONG AllocationsAttempted
;
1315 ULONG AllocationsSucceeded
;
1316 ULONG AllocationsSucceededSpecialPool
;
1317 ULONG AllocationsWithNoTag
;
1320 ULONG AllocationsFailed
;
1321 ULONG AllocationsFailedDeliberately
;
1324 ULONG UnTrackedPool
;
1325 ULONG CurrentPagedPoolAllocations
;
1326 ULONG CurrentNonPagedPoolAllocations
;
1327 ULONG PeakPagedPoolAllocations
;
1328 ULONG PeakNonPagedPoolAllocations
;
1329 ULONG PagedPoolUsageInBytes
;
1330 ULONG NonPagedPoolUsageInBytes
;
1331 ULONG PeakPagedPoolUsageInBytes
;
1332 ULONG PeakNonPagedPoolUsageInBytes
;
1333 } SYSTEM_VERIFIER_INFORMATION
, *PSYSTEM_VERIFIER_INFORMATION
;
1338 typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
1342 PVOID Buffer
; // Same format as in SystemProcessInformation
1343 } SYSTEM_SESSION_PROCESS_INFORMATION
, *PSYSTEM_SESSION_PROCESS_INFORMATION
;
1345 // FIXME: Class 54-97
1350 #define RTL_HOTPATCH_SUPPORTED_FLAG 0x01
1351 #define RTL_HOTPATCH_SWAP_OBJECT_NAMES 0x08 << 24
1352 #define RTL_HOTPATCH_SYNC_RENAME_FILES 0x10 << 24
1353 #define RTL_HOTPATCH_PATCH_USER_MODE 0x20 << 24
1354 #define RTL_HOTPATCH_REMAP_SYSTEM_DLL 0x40 << 24
1355 #define RTL_HOTPATCH_PATCH_KERNEL_MODE 0x80 << 24
1359 typedef struct _SYSTEM_HOTPATCH_CODE_INFORMATION
1378 USHORT TargetNameOffset
;
1379 USHORT TargetNameLength
;
1380 UCHAR PatchingFinished
;
1386 USHORT TargetNameOffset
;
1387 USHORT TargetNameLength
;
1388 UCHAR PatchingFinished
;
1389 NTSTATUS ReturnCode
;
1390 HANDLE TargetProcess
;
1395 PIO_STATUS_BLOCK IoStatusBlock1
;
1396 PVOID RenameInformation1
;
1397 PVOID RenameInformationLength1
;
1399 PIO_STATUS_BLOCK IoStatusBlock2
;
1400 PVOID RenameInformation2
;
1401 PVOID RenameInformationLength2
;
1405 HANDLE ParentDirectory
;
1406 HANDLE ObjectHandle1
;
1407 HANDLE ObjectHandle2
;
1410 } SYSTEM_HOTPATCH_CODE_INFORMATION
, *PSYSTEM_HOTPATCH_CODE_INFORMATION
;
1415 #ifdef NTOS_MODE_USER
1416 typedef struct _SYSTEM_FIRMWARE_TABLE_HANDLER
1418 ULONG ProviderSignature
;
1420 PFNFTH FirmwareTableHandler
;
1422 } SYSTEM_FIRMWARE_TABLE_HANDLER
, *PSYSTEM_FIRMWARE_TABLE_HANDLER
;
1427 typedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
1429 ULONG ProviderSignature
;
1430 SYSTEM_FIRMWARE_TABLE_ACTION Action
;
1432 ULONG TableBufferLength
;
1433 UCHAR TableBuffer
[1];
1434 } SYSTEM_FIRMWARE_TABLE_INFORMATION
, *PSYSTEM_FIRMWARE_TABLE_INFORMATION
;
1439 typedef struct _SYSTEM_MEMORY_LIST_INFORMATION
1441 SIZE_T ZeroPageCount
;
1442 SIZE_T FreePageCount
;
1443 SIZE_T ModifiedPageCount
;
1444 SIZE_T ModifiedNoWritePageCount
;
1445 SIZE_T BadPageCount
;
1446 SIZE_T PageCountByPriority
[8];
1447 SIZE_T RepurposedPagesByPriority
[8];
1448 } SYSTEM_MEMORY_LIST_INFORMATION
, *PSYSTEM_MEMORY_LIST_INFORMATION
;