include/ndk/peb_teb.h

   1 #define PASTE2(x,y)       x##y
   2 #define PASTE(x,y)         PASTE2(x,y)
   3
   4 #ifdef EXPLICIT_32BIT
   5   #define STRUCT(x) PASTE(x,32)
   6   #define PTR(x) ULONG
   7 #elif defined(EXPLICIT_64BIT)
   8   #define STRUCT(x) PASTE(x,64)
   9   #define PTR(x) ULONG64
  10 #else
  11   #define STRUCT(x) x
  12   #define PTR(x) x
  13 #endif
  14
  15 #if defined(_WIN64) && !defined(EXPLICIT_32BIT)
  16   #define GDI_HANDLE_BUFFER_SIZE 60
  17 #else
  18   #define GDI_HANDLE_BUFFER_SIZE 34
  19 #endif
  20
  21 #if defined(_NTDDK_INCLUDED_) || defined(_NTIFS_)
  22 #define PPEB PPEB_RENAMED
  23 #endif
  24
  25 typedef struct STRUCT(_PEB)
  26 {
  27     BOOLEAN InheritedAddressSpace;
  28     BOOLEAN ReadImageFileExecOptions;
  29     BOOLEAN BeingDebugged;
  30 #if (NTDDI_VERSION >= NTDDI_WS03)
  31     union
  32     {
  33         BOOLEAN BitField;
  34         struct
  35         {
  36             BOOLEAN ImageUsesLargePages:1;
  37 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
  38             BOOLEAN IsProtectedProcess:1;
  39             BOOLEAN IsLegacyProcess:1;
  40             BOOLEAN IsImageDynamicallyRelocated:1;
  41             BOOLEAN SkipPatchingUser32Forwarders:1;
  42             BOOLEAN SpareBits:3;
  43 #else
  44             BOOLEAN SpareBits:7;
  45 #endif
  46         };
  47     };
  48 #else
  49     BOOLEAN SpareBool;
  50 #endif
  51     PTR(HANDLE) Mutant;
  52     PTR(PVOID) ImageBaseAddress;
  53     PTR(PPEB_LDR_DATA) Ldr;
  54     PTR(struct _RTL_USER_PROCESS_PARAMETERS*) ProcessParameters;
  55     PTR(PVOID) SubSystemData;
  56     PTR(PVOID) ProcessHeap;
  57     PTR(struct _RTL_CRITICAL_SECTION*) FastPebLock;
  58 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
  59     PTR(PVOID) AltThunkSListPtr;
  60     PTR(PVOID) IFEOKey;
  61     union
  62     {
  63         ULONG CrossProcessFlags;
  64         struct
  65         {
  66             ULONG ProcessInJob:1;
  67             ULONG ProcessInitializing:1;
  68             ULONG ProcessUsingVEH:1;
  69             ULONG ProcessUsingVCH:1;
  70             ULONG ReservedBits0:28;
  71         };
  72     };
  73     union
  74     {
  75         PTR(PVOID) KernelCallbackTable;
  76         PTR(PVOID) UserSharedInfoPtr;
  77     };
  78 #elif (NTDDI_VERSION >= NTDDI_WS03)
  79     PTR(PVOID) AltThunkSListPtr;
  80     PTR(PVOID) SparePtr2;
  81     ULONG EnvironmentUpdateCount;
  82     PTR(PVOID) KernelCallbackTable;
  83 #else
  84     PTR(PPEBLOCKROUTINE) FastPebLockRoutine;
  85     PTR(PPEBLOCKROUTINE) FastPebUnlockRoutine;
  86     ULONG EnvironmentUpdateCount;
  87     PTR(PVOID) KernelCallbackTable;
  88 #endif
  89     ULONG SystemReserved[1];
  90     ULONG SpareUlong; // AtlThunkSListPtr32
  91     PTR(PPEB_FREE_BLOCK) FreeList;
  92     ULONG TlsExpansionCounter;
  93     PTR(PVOID) TlsBitmap;
  94     ULONG TlsBitmapBits[2];
  95     PTR(PVOID) ReadOnlySharedMemoryBase;
  96 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
  97     PTR(PVOID) HotpatchInformation;
  98 #else
  99     PTR(PVOID) ReadOnlySharedMemoryHeap;
 100 #endif
 101     PTR(PVOID*) ReadOnlyStaticServerData;
 102     PTR(PVOID) AnsiCodePageData;
 103     PTR(PVOID) OemCodePageData;
 104     PTR(PVOID) UnicodeCaseTableData;
 105     ULONG NumberOfProcessors;
 106     ULONG NtGlobalFlag;
 107     LARGE_INTEGER CriticalSectionTimeout;
 108     PTR(ULONG_PTR) HeapSegmentReserve;
 109     PTR(ULONG_PTR) HeapSegmentCommit;
 110     PTR(ULONG_PTR) HeapDeCommitTotalFreeThreshold;
 111     PTR(ULONG_PTR) HeapDeCommitFreeBlockThreshold;
 112     ULONG NumberOfHeaps;
 113     ULONG MaximumNumberOfHeaps;
 114     PTR(PVOID*) ProcessHeaps;
 115     PTR(PVOID) GdiSharedHandleTable;
 116     PTR(PVOID) ProcessStarterHelper;
 117     ULONG GdiDCAttributeList;
 118     PTR(struct _RTL_CRITICAL_SECTION*) LoaderLock;
 119     ULONG OSMajorVersion;
 120     ULONG OSMinorVersion;
 121     USHORT OSBuildNumber;
 122     USHORT OSCSDVersion;
 123     ULONG OSPlatformId;
 124     ULONG ImageSubsystem;
 125     ULONG ImageSubsystemMajorVersion;
 126     ULONG ImageSubsystemMinorVersion;
 127     PTR(ULONG_PTR) ImageProcessAffinityMask;
 128     ULONG GdiHandleBuffer[GDI_HANDLE_BUFFER_SIZE];
 129     PTR(PPOST_PROCESS_INIT_ROUTINE) PostProcessInitRoutine;
 130     PTR(PVOID) TlsExpansionBitmap;
 131     ULONG TlsExpansionBitmapBits[32];
 132     ULONG SessionId;
 133 #if (NTDDI_VERSION >= NTDDI_WINXP)
 134     ULARGE_INTEGER AppCompatFlags;
 135     ULARGE_INTEGER AppCompatFlagsUser;
 136     PTR(PVOID) pShimData;
 137     PTR(PVOID) AppCompatInfo;
 138     STRUCT(UNICODE_STRING) CSDVersion;
 139     PTR(struct _ACTIVATION_CONTEXT_DATA*) ActivationContextData;
 140     PTR(struct _ASSEMBLY_STORAGE_MAP*) ProcessAssemblyStorageMap;
 141     PTR(struct _ACTIVATION_CONTEXT_DATA*) SystemDefaultActivationContextData;
 142     PTR(struct _ASSEMBLY_STORAGE_MAP*) SystemAssemblyStorageMap;
 143     PTR(ULONG_PTR) MinimumStackCommit;
 144 #endif
 145 #if (NTDDI_VERSION >= NTDDI_WS03)
 146     PTR(PVOID*) FlsCallback;
 147     STRUCT(LIST_ENTRY) FlsListHead;
 148     PTR(PVOID) FlsBitmap;
 149     ULONG FlsBitmapBits[4];
 150     ULONG FlsHighIndex;
 151 #endif
 152 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 153     PTR(PVOID) WerRegistrationData;
 154     PTR(PVOID) WerShipAssertPtr;
 155 #endif
 156 } STRUCT(PEB), *STRUCT(PPEB);
 157
 158 #undef PPEB
 159
 160 #if defined(_WIN64) && !defined(EXPLICIT_32BIT)
 161 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Mutant) == 0x08);
 162 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Ldr) == 0x18);
 163 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FastPebLock) == 0x038);
 164 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), TlsExpansionCounter) == 0x070);
 165 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), NtGlobalFlag) == 0x0BC);
 166 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), GdiSharedHandleTable) == 0x0F8);
 167 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), LoaderLock) == 0x110);
 168 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageSubsystem) == 0x128);
 169 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageProcessAffinityMask) == 0x138);
 170 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), PostProcessInitRoutine) == 0x230);
 171 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), SessionId) == 0x2C0);
 172 #if (NTDDI_VERSION >= NTDDI_WS03)
 173 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FlsHighIndex) == 0x350);
 174 #endif
 175 #else
 176 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Mutant) == 0x04);
 177 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Ldr) == 0x0C);
 178 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FastPebLock) == 0x01C);
 179 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), TlsExpansionCounter) == 0x03C);
 180 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), NtGlobalFlag) == 0x068);
 181 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), GdiSharedHandleTable) == 0x094);
 182 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), LoaderLock) == 0x0A0);
 183 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageSubsystem) == 0x0B4);
 184 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageProcessAffinityMask) == 0x0C0);
 185 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), PostProcessInitRoutine) == 0x14C);
 186 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), SessionId) == 0x1D4);
 187 #if (NTDDI_VERSION >= NTDDI_WS03)
 188 C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FlsHighIndex) == 0x22C);
 189 #endif
 190 #endif
 191
 192 //
 193 // GDI Batch Descriptor
 194 //
 195 typedef struct STRUCT(_GDI_TEB_BATCH)
 196 {
 197     ULONG Offset;
 198     PTR(HANDLE) HDC;
 199     ULONG Buffer[0x136];
 200 } STRUCT(GDI_TEB_BATCH), *STRUCT(PGDI_TEB_BATCH);
 201
 202 //
 203 // Thread Environment Block (TEB)
 204 //
 205 typedef struct STRUCT(_TEB)
 206 {
 207     STRUCT(NT_TIB)         NtTib;
 208     PTR(PVOID)             EnvironmentPointer;
 209     STRUCT(CLIENT_ID)      ClientId;
 210     PTR(PVOID)             ActiveRpcHandle;
 211     PTR(PVOID)             ThreadLocalStoragePointer;
 212     PTR(STRUCT(PPEB))      ProcessEnvironmentBlock;
 213     ULONG                  LastErrorValue;
 214     ULONG                  CountOfOwnedCriticalSections;
 215     PTR(PVOID)             CsrClientThread;
 216     PTR(PVOID)             Win32ThreadInfo;
 217     ULONG                  User32Reserved[26];
 218     ULONG                  UserReserved[5];
 219     PTR(PVOID)             WOW32Reserved;
 220     LCID                   CurrentLocale;
 221     ULONG                  FpSoftwareStatusRegister;
 222     PTR(PVOID)             SystemReserved1[54];
 223     LONG                   ExceptionCode;
 224 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 225     PTR(struct _ACTIVATION_CONTEXT_STACK*) ActivationContextStackPointer;
 226     UCHAR                  SpareBytes1[0x30 - 3 * sizeof(PTR(PVOID))];
 227     ULONG                  TxFsContext;
 228 #elif (NTDDI_VERSION >= NTDDI_WS03)
 229     PTR(struct _ACTIVATION_CONTEXT_STACK*) ActivationContextStackPointer;
 230     UCHAR                  SpareBytes1[0x34 - 3 * sizeof(PTR(PVOID))];
 231 #else
 232     ACTIVATION_CONTEXT_STACK ActivationContextStack;
 233     UCHAR                  SpareBytes1[24];
 234 #endif
 235     STRUCT(GDI_TEB_BATCH)  GdiTebBatch;
 236     STRUCT(CLIENT_ID)      RealClientId;
 237     PTR(PVOID)             GdiCachedProcessHandle;
 238     ULONG                  GdiClientPID;
 239     ULONG                  GdiClientTID;
 240     PTR(PVOID)             GdiThreadLocalInfo;
 241     PTR(SIZE_T)            Win32ClientInfo[62];
 242     PTR(PVOID)             glDispatchTable[233];
 243     PTR(SIZE_T)            glReserved1[29];
 244     PTR(PVOID)             glReserved2;
 245     PTR(PVOID)             glSectionInfo;
 246     PTR(PVOID)             glSection;
 247     PTR(PVOID)             glTable;
 248     PTR(PVOID)             glCurrentRC;
 249     PTR(PVOID)             glContext;
 250     NTSTATUS               LastStatusValue;
 251     STRUCT(UNICODE_STRING) StaticUnicodeString;
 252     WCHAR                  StaticUnicodeBuffer[261];
 253     PTR(PVOID)             DeallocationStack;
 254     PTR(PVOID)             TlsSlots[64];
 255     STRUCT(LIST_ENTRY)     TlsLinks;
 256     PTR(PVOID)             Vdm;
 257     PTR(PVOID)             ReservedForNtRpc;
 258     PTR(PVOID)             DbgSsReserved[2];
 259 #if (NTDDI_VERSION >= NTDDI_WS03)
 260     ULONG                  HardErrorMode;
 261 #else
 262     ULONG                  HardErrorsAreDisabled;
 263 #endif
 264 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 265     PTR(PVOID)             Instrumentation[13 - sizeof(GUID)/sizeof(PTR(PVOID))];
 266     GUID                   ActivityId;
 267     PTR(PVOID)             SubProcessTag;
 268     PTR(PVOID)             EtwLocalData;
 269     PTR(PVOID)             EtwTraceData;
 270 #elif (NTDDI_VERSION >= NTDDI_WS03)
 271     PTR(PVOID)             Instrumentation[14];
 272     PTR(PVOID)             SubProcessTag;
 273     PTR(PVOID)             EtwLocalData;
 274 #else
 275     PTR(PVOID)             Instrumentation[16];
 276 #endif
 277     PTR(PVOID)             WinSockData;
 278     ULONG                  GdiBatchCount;
 279 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 280     BOOLEAN                SpareBool0;
 281     BOOLEAN                SpareBool1;
 282     BOOLEAN                SpareBool2;
 283 #else
 284     BOOLEAN                InDbgPrint;
 285     BOOLEAN                FreeStackOnTermination;
 286     BOOLEAN                HasFiberData;
 287 #endif
 288     UCHAR                  IdealProcessor;
 289 #if (NTDDI_VERSION >= NTDDI_WS03)
 290     ULONG                  GuaranteedStackBytes;
 291 #else
 292     ULONG                  Spare3;
 293 #endif
 294     PTR(PVOID)             ReservedForPerf;
 295     PTR(PVOID)             ReservedForOle;
 296     ULONG                  WaitingOnLoaderLock;
 297 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 298     PTR(PVOID)             SavedPriorityState;
 299     PTR(ULONG_PTR)         SoftPatchPtr1;
 300     PTR(ULONG_PTR)         ThreadPoolData;
 301 #elif (NTDDI_VERSION >= NTDDI_WS03)
 302     PTR(ULONG_PTR)         SparePointer1;
 303     PTR(ULONG_PTR)         SoftPatchPtr1;
 304     PTR(ULONG_PTR)         SoftPatchPtr2;
 305 #else
 306     Wx86ThreadState        Wx86Thread;
 307 #endif
 308     PTR(PVOID*)            TlsExpansionSlots;
 309 #if defined(_WIN64) && !defined(EXPLICIT_32BIT)
 310     PTR(PVOID)             DeallocationBStore;
 311     PTR(PVOID)             BStoreLimit;
 312 #endif
 313     ULONG                  ImpersonationLocale;
 314     ULONG                  IsImpersonating;
 315     PTR(PVOID)             NlsCache;
 316     PTR(PVOID)             pShimData;
 317     ULONG                  HeapVirtualAffinity;
 318     PTR(HANDLE)            CurrentTransactionHandle;
 319     PTR(PTEB_ACTIVE_FRAME) ActiveFrame;
 320 #if (NTDDI_VERSION >= NTDDI_WS03)
 321     PVOID FlsData;
 322 #endif
 323 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 324     PVOID PreferredLangauges;
 325     PVOID UserPrefLanguages;
 326     PVOID MergedPrefLanguages;
 327     ULONG MuiImpersonation;
 328     union
 329     {
 330         struct
 331         {
 332             USHORT SpareCrossTebFlags:16;
 333         };
 334         USHORT CrossTebFlags;
 335     };
 336     union
 337     {
 338         struct
 339         {
 340             USHORT DbgSafeThunkCall:1;
 341             USHORT DbgInDebugPrint:1;
 342             USHORT DbgHasFiberData:1;
 343             USHORT DbgSkipThreadAttach:1;
 344             USHORT DbgWerInShipAssertCode:1;
 345             USHORT DbgIssuedInitialBp:1;
 346             USHORT DbgClonedThread:1;
 347             USHORT SpareSameTebBits:9;
 348         };
 349         USHORT SameTebFlags;
 350     };
 351     PTR(PVOID) TxnScopeEntercallback;
 352     PTR(PVOID) TxnScopeExitCAllback;
 353     PTR(PVOID) TxnScopeContext;
 354     ULONG LockCount;
 355     ULONG ProcessRundown;
 356     ULONG64 LastSwitchTime;
 357     ULONG64 TotalSwitchOutTime;
 358     LARGE_INTEGER WaitReasonBitMap;
 359 #else
 360     BOOLEAN SafeThunkCall;
 361     BOOLEAN BooleanSpare[3];
 362 #endif
 363 } STRUCT(TEB), *STRUCT(PTEB);
 364
 365 #if defined(_WIN64) && !defined(EXPLICIT_32BIT)
 366 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), EnvironmentPointer) == 0x038);
 367 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ExceptionCode) == 0x2C0);
 368 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiTebBatch) == 0x2F0);
 369 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), LastStatusValue) == 0x1250);
 370 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), Vdm) == 0x1690);
 371 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), HardErrorMode) == 0x16B0);
 372 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiBatchCount) == 0x1740);
 373 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), IdealProcessor) == 0x1747);
 374 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), WaitingOnLoaderLock) == 0x1760);
 375 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), TlsExpansionSlots) == 0x1780);
 376 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), WaitingOnLoaderLock) == 0x1760);
 377 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ActiveFrame) == 0x17C0);
 378 #else
 379 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), EnvironmentPointer) == 0x01C);
 380 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ExceptionCode) == 0x1A4);
 381 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiTebBatch) == 0x1D4);
 382 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), LastStatusValue) == 0xBF4);
 383 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), Vdm) == 0xF18);
 384 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiBatchCount) == 0xF70);
 385 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), TlsExpansionSlots) == 0xF94);
 386 C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ActiveFrame) == 0xFB0);
 387 #endif
 388
 389 #undef PTR
 390 #undef STRUCT
 391 #undef PASTE
 392 #undef PASTE2
 393 #undef GDI_HANDLE_BUFFER_SIZE