include/ndk/pstypes.h

   1 /*++ NDK Version: 0098
   2
   3 Copyright (c) Alex Ionescu.  All rights reserved.
   4
   5 Header Name:
   6
   7     pstypes.h
   8
   9 Abstract:
  10
  11     Type definitions for the Process Manager
  12
  13 Author:
  14
  15     Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
  16
  17 --*/
  18
  19 #ifndef _PSTYPES_H
  20 #define _PSTYPES_H
  21
  22 //
  23 // Dependencies
  24 //
  25 #include <umtypes.h>
  26 #include <ldrtypes.h>
  27 #include <mmtypes.h>
  28 #include <obtypes.h>
  29 #include <rtltypes.h>
  30 #ifndef NTOS_MODE_USER
  31 #include <extypes.h>
  32 #include <setypes.h>
  33 #endif
  34
  35 //
  36 // KUSER_SHARED_DATA location in User Mode
  37 //
  38 #define USER_SHARED_DATA                        (0x7FFE0000)
  39
  40 //
  41 // Global Flags
  42 //
  43 #define FLG_STOP_ON_EXCEPTION                   0x00000001
  44 #define FLG_SHOW_LDR_SNAPS                      0x00000002
  45 #define FLG_DEBUG_INITIAL_COMMAND               0x00000004
  46 #define FLG_STOP_ON_HUNG_GUI                    0x00000008
  47 #define FLG_HEAP_ENABLE_TAIL_CHECK              0x00000010
  48 #define FLG_HEAP_ENABLE_FREE_CHECK              0x00000020
  49 #define FLG_HEAP_VALIDATE_PARAMETERS            0x00000040
  50 #define FLG_HEAP_VALIDATE_ALL                   0x00000080
  51 #define FLG_POOL_ENABLE_TAIL_CHECK              0x00000100
  52 #define FLG_POOL_ENABLE_FREE_CHECK              0x00000200
  53 #define FLG_POOL_ENABLE_TAGGING                 0x00000400
  54 #define FLG_HEAP_ENABLE_TAGGING                 0x00000800
  55 #define FLG_USER_STACK_TRACE_DB                 0x00001000
  56 #define FLG_KERNEL_STACK_TRACE_DB               0x00002000
  57 #define FLG_MAINTAIN_OBJECT_TYPELIST            0x00004000
  58 #define FLG_HEAP_ENABLE_TAG_BY_DLL              0x00008000
  59 #define FLG_IGNORE_DEBUG_PRIV                   0x00010000
  60 #define FLG_ENABLE_CSRDEBUG                     0x00020000
  61 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD           0x00040000
  62 #define FLG_DISABLE_PAGE_KERNEL_STACKS          0x00080000
  63 #define FLG_HEAP_ENABLE_CALL_TRACING            0x00100000
  64 #define FLG_HEAP_DISABLE_COALESCING             0x00200000
  65 #define FLG_ENABLE_CLOSE_EXCEPTIONS             0x00400000
  66 #define FLG_ENABLE_EXCEPTION_LOGGING            0x00800000
  67 #define FLG_ENABLE_HANDLE_TYPE_TAGGING          0x01000000
  68 #define FLG_HEAP_PAGE_ALLOCS                    0x02000000
  69 #define FLG_DEBUG_INITIAL_COMMAND_EX            0x04000000
  70 #define FLG_VALID_BITS                          0x07FFFFFF
  71
  72 //
  73 // Process priority classes
  74 //
  75 #define PROCESS_PRIORITY_CLASS_INVALID          0
  76 #define PROCESS_PRIORITY_CLASS_IDLE             1
  77 #define PROCESS_PRIORITY_CLASS_NORMAL           2
  78 #define PROCESS_PRIORITY_CLASS_HIGH             3
  79 #define PROCESS_PRIORITY_CLASS_REALTIME         4
  80 #define PROCESS_PRIORITY_CLASS_BELOW_NORMAL     5
  81 #define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL     6
  82
  83 //
  84 // NtCreateProcessEx flags
  85 //
  86 #define PS_REQUEST_BREAKAWAY                    1
  87 #define PS_NO_DEBUG_INHERIT                     2
  88 #define PS_INHERIT_HANDLES                      4
  89 #define PS_LARGE_PAGES                          8
  90 #define PS_ALL_FLAGS                            (PS_REQUEST_BREAKAWAY | \
  91                                                  PS_NO_DEBUG_INHERIT  | \
  92                                                  PS_INHERIT_HANDLES   | \
  93                                                  PS_LARGE_PAGES)
  94
  95 //
  96 // Process base priorities
  97 //
  98 #define PROCESS_PRIORITY_IDLE                   3
  99 #define PROCESS_PRIORITY_NORMAL                 8
 100 #define PROCESS_PRIORITY_NORMAL_FOREGROUND      9
 101
 102 //
 103 // Process memory priorities
 104 //
 105 #define MEMORY_PRIORITY_BACKGROUND             0
 106 #define MEMORY_PRIORITY_UNKNOWN                1
 107 #define MEMORY_PRIORITY_FOREGROUND             2
 108
 109 //
 110 // Process Priority Separation Values (OR)
 111 //
 112 #define PSP_VARIABLE_QUANTUMS                   4
 113 #define PSP_LONG_QUANTUMS                       16
 114
 115 #ifndef NTOS_MODE_USER
 116
 117 //
 118 // Thread Access Types
 119 //
 120 #define THREAD_QUERY_INFORMATION                0x0040
 121 #define THREAD_SET_THREAD_TOKEN                 0x0080
 122 #define THREAD_IMPERSONATE                      0x0100
 123 #define THREAD_DIRECT_IMPERSONATION             0x0200
 124
 125 //
 126 // Process Access Types
 127 //
 128 #define PROCESS_TERMINATE                       0x0001
 129 #define PROCESS_CREATE_THREAD                   0x0002
 130 #define PROCESS_SET_SESSIONID                   0x0004
 131 #define PROCESS_VM_OPERATION                    0x0008
 132 #define PROCESS_VM_READ                         0x0010
 133 #define PROCESS_VM_WRITE                        0x0020
 134 #define PROCESS_CREATE_PROCESS                  0x0080
 135 #define PROCESS_SET_QUOTA                       0x0100
 136 #define PROCESS_SET_INFORMATION                 0x0200
 137 #define PROCESS_QUERY_INFORMATION               0x0400
 138 #define PROCESS_SUSPEND_RESUME                  0x0800
 139 #define PROCESS_QUERY_LIMITED_INFORMATION       0x1000
 140 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 141 #define PROCESS_ALL_ACCESS                      (STANDARD_RIGHTS_REQUIRED | \
 142                                                  SYNCHRONIZE | \
 143                                                  0xFFFF)
 144 #else
 145 #define PROCESS_ALL_ACCESS                      (STANDARD_RIGHTS_REQUIRED | \
 146                                                  SYNCHRONIZE | \
 147                                                  0xFFF)
 148
 149 //
 150 // Thread Base Priorities
 151 //
 152 #define THREAD_BASE_PRIORITY_LOWRT              15
 153 #define THREAD_BASE_PRIORITY_MAX                2
 154 #define THREAD_BASE_PRIORITY_MIN                -2
 155 #define THREAD_BASE_PRIORITY_IDLE               -15
 156
 157 //
 158 // TLS Slots
 159 //
 160 #define TLS_MINIMUM_AVAILABLE                   64
 161 #endif
 162
 163 //
 164 // Job Access Types
 165 //
 166 #define JOB_OBJECT_ASSIGN_PROCESS               0x1
 167 #define JOB_OBJECT_SET_ATTRIBUTES               0x2
 168 #define JOB_OBJECT_QUERY                        0x4
 169 #define JOB_OBJECT_TERMINATE                    0x8
 170 #define JOB_OBJECT_SET_SECURITY_ATTRIBUTES      0x10
 171 #define JOB_OBJECT_ALL_ACCESS                   (STANDARD_RIGHTS_REQUIRED | \
 172                                                  SYNCHRONIZE | \
 173                                                  31)
 174
 175 //
 176 // Job Limit Flags
 177 //
 178 #define JOB_OBJECT_LIMIT_WORKINGSET             0x1
 179 #define JOB_OBJECT_LIMIT_PROCESS_TIME           0x2
 180 #define JOB_OBJECT_LIMIT_JOB_TIME               0x4
 181 #define JOB_OBJECT_LIMIT_ACTIVE_PROCESS         0x8
 182 #define JOB_OBJECT_LIMIT_AFFINITY               0x10
 183 #define JOB_OBJECT_LIMIT_PRIORITY_CLASS         0x20
 184 #define JOB_OBJECT_LIMIT_PRESERVE_JOB_TIME      0x40
 185 #define JOB_OBJECT_LIMIT_SCHEDULING_CLASS       0x80
 186 #define JOB_OBJECT_LIMIT_PROCESS_MEMORY         0x100
 187 #define JOB_OBJECT_LIMIT_JOB_MEMORY             0x200
 188 #define JOB_OBJECT_LIMIT_DIE_ON_UNHANDLED_EXCEPTION 0x400
 189 #define JOB_OBJECT_LIMIT_BREAKAWAY_OK           0x800
 190 #define JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK    0x1000
 191 #define JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE      0x2000
 192
 193
 194 //
 195 // Cross Thread Flags
 196 //
 197 #define CT_TERMINATED_BIT                       0x1
 198 #define CT_DEAD_THREAD_BIT                      0x2
 199 #define CT_HIDE_FROM_DEBUGGER_BIT               0x4
 200 #define CT_ACTIVE_IMPERSONATION_INFO_BIT        0x8
 201 #define CT_SYSTEM_THREAD_BIT                    0x10
 202 #define CT_HARD_ERRORS_ARE_DISABLED_BIT         0x20
 203 #define CT_BREAK_ON_TERMINATION_BIT             0x40
 204 #define CT_SKIP_CREATION_MSG_BIT                0x80
 205 #define CT_SKIP_TERMINATION_MSG_BIT             0x100
 206
 207 //
 208 // Same Thread Passive Flags
 209 //
 210 #define STP_ACTIVE_EX_WORKER_BIT                0x1
 211 #define STP_EX_WORKER_CAN_WAIT_USER_BIT         0x2
 212 #define STP_MEMORY_MAKER_BIT                    0x4
 213 #define STP_KEYED_EVENT_IN_USE_BIT              0x8
 214
 215 //
 216 // Same Thread APC Flags
 217 //
 218 #define STA_LPC_RECEIVED_MSG_ID_VALID_BIT       0x1
 219 #define STA_LPC_EXIT_THREAD_CALLED_BIT          0x2
 220 #define STA_ADDRESS_SPACE_OWNER_BIT             0x4
 221 #define STA_OWNS_WORKING_SET_BITS               0x1F8
 222 #endif
 223
 224 #define TLS_EXPANSION_SLOTS                     1024
 225 //
 226 // Process Flags
 227 //
 228 #define PSF_CREATE_REPORTED_BIT                 0x1
 229 #define PSF_NO_DEBUG_INHERIT_BIT                0x2
 230 #define PSF_PROCESS_EXITING_BIT                 0x4
 231 #define PSF_PROCESS_DELETE_BIT                  0x8
 232 #define PSF_WOW64_SPLIT_PAGES_BIT               0x10
 233 #define PSF_VM_DELETED_BIT                      0x20
 234 #define PSF_OUTSWAP_ENABLED_BIT                 0x40
 235 #define PSF_OUTSWAPPED_BIT                      0x80
 236 #define PSF_FORK_FAILED_BIT                     0x100
 237 #define PSF_WOW64_VA_SPACE_4GB_BIT              0x200
 238 #define PSF_ADDRESS_SPACE_INITIALIZED_BIT       0x400
 239 #define PSF_SET_TIMER_RESOLUTION_BIT            0x1000
 240 #define PSF_BREAK_ON_TERMINATION_BIT            0x2000
 241 #define PSF_SESSION_CREATION_UNDERWAY_BIT       0x4000
 242 #define PSF_WRITE_WATCH_BIT                     0x8000
 243 #define PSF_PROCESS_IN_SESSION_BIT              0x10000
 244 #define PSF_OVERRIDE_ADDRESS_SPACE_BIT          0x20000
 245 #define PSF_HAS_ADDRESS_SPACE_BIT               0x40000
 246 #define PSF_LAUNCH_PREFETCHED_BIT               0x80000
 247 #define PSF_INJECT_INPAGE_ERRORS_BIT            0x100000
 248 #define PSF_VM_TOP_DOWN_BIT                     0x200000
 249 #define PSF_IMAGE_NOTIFY_DONE_BIT               0x400000
 250 #define PSF_PDE_UPDATE_NEEDED_BIT               0x800000
 251 #define PSF_VDM_ALLOWED_BIT                     0x1000000
 252 #define PSF_SWAP_ALLOWED_BIT                    0x2000000
 253 #define PSF_CREATE_FAILED_BIT                   0x4000000
 254 #define PSF_DEFAULT_IO_PRIORITY_BIT             0x8000000
 255
 256 //
 257 // Vista Process Flags
 258 //
 259 #define PSF2_PROTECTED_BIT                      0x800
 260
 261 #ifdef NTOS_MODE_USER
 262 //
 263 // Current Process/Thread built-in 'special' handles
 264 //
 265 #define NtCurrentProcess()                      ((HANDLE)(LONG_PTR)-1)
 266 #define ZwCurrentProcess()                      NtCurrentProcess()
 267 #define NtCurrentThread()                       ((HANDLE)(LONG_PTR)-2)
 268 #define ZwCurrentThread()                       NtCurrentThread()
 269
 270 //
 271 // Process/Thread/Job Information Classes for NtQueryInformationProcess/Thread/Job
 272 //
 273 typedef enum _PROCESSINFOCLASS
 274 {
 275     ProcessBasicInformation,
 276     ProcessQuotaLimits,
 277     ProcessIoCounters,
 278     ProcessVmCounters,
 279     ProcessTimes,
 280     ProcessBasePriority,
 281     ProcessRaisePriority,
 282     ProcessDebugPort,
 283     ProcessExceptionPort,
 284     ProcessAccessToken,
 285     ProcessLdtInformation,
 286     ProcessLdtSize,
 287     ProcessDefaultHardErrorMode,
 288     ProcessIoPortHandlers,
 289     ProcessPooledUsageAndLimits,
 290     ProcessWorkingSetWatch,
 291     ProcessUserModeIOPL,
 292     ProcessEnableAlignmentFaultFixup,
 293     ProcessPriorityClass,
 294     ProcessWx86Information,
 295     ProcessHandleCount,
 296     ProcessAffinityMask,
 297     ProcessPriorityBoost,
 298     ProcessDeviceMap,
 299     ProcessSessionInformation,
 300     ProcessForegroundInformation,
 301     ProcessWow64Information,
 302     ProcessImageFileName,
 303     ProcessLUIDDeviceMapsEnabled,
 304     ProcessBreakOnTermination,
 305     ProcessDebugObjectHandle,
 306     ProcessDebugFlags,
 307     ProcessHandleTracing,
 308     ProcessIoPriority,
 309     ProcessExecuteFlags,
 310     ProcessTlsInformation,
 311     ProcessCookie,
 312     ProcessImageInformation,
 313     ProcessCycleTime,
 314     ProcessPagePriority,
 315     ProcessInstrumentationCallback,
 316     ProcessThreadStackAllocation,
 317     ProcessWorkingSetWatchEx,
 318     ProcessImageFileNameWin32,
 319     ProcessImageFileMapping,
 320     ProcessAffinityUpdateMode,
 321     ProcessMemoryAllocationMode,
 322     MaxProcessInfoClass
 323 } PROCESSINFOCLASS;
 324
 325 typedef enum _THREADINFOCLASS
 326 {
 327     ThreadBasicInformation,
 328     ThreadTimes,
 329     ThreadPriority,
 330     ThreadBasePriority,
 331     ThreadAffinityMask,
 332     ThreadImpersonationToken,
 333     ThreadDescriptorTableEntry,
 334     ThreadEnableAlignmentFaultFixup,
 335     ThreadEventPair_Reusable,
 336     ThreadQuerySetWin32StartAddress,
 337     ThreadZeroTlsCell,
 338     ThreadPerformanceCount,
 339     ThreadAmILastThread,
 340     ThreadIdealProcessor,
 341     ThreadPriorityBoost,
 342     ThreadSetTlsArrayAddress,
 343     ThreadIsIoPending,
 344     ThreadHideFromDebugger,
 345     ThreadBreakOnTermination,
 346     ThreadSwitchLegacyState,
 347     ThreadIsTerminated,
 348     ThreadLastSystemCall,
 349     ThreadIoPriority,
 350     ThreadCycleTime,
 351     ThreadPagePriority,
 352     ThreadActualBasePriority,
 353     ThreadTebInformation,
 354     ThreadCSwitchMon,
 355     MaxThreadInfoClass
 356 } THREADINFOCLASS;
 357
 358 #else
 359
 360 typedef enum _PSPROCESSPRIORITYMODE
 361 {
 362     PsProcessPriorityForeground,
 363     PsProcessPriorityBackground,
 364     PsProcessPrioritySpinning
 365 } PSPROCESSPRIORITYMODE;
 366
 367 typedef enum _JOBOBJECTINFOCLASS
 368 {
 369     JobObjectBasicAccountingInformation = 1,
 370     JobObjectBasicLimitInformation,
 371     JobObjectBasicProcessIdList,
 372     JobObjectBasicUIRestrictions,
 373     JobObjectSecurityLimitInformation,
 374     JobObjectEndOfJobTimeInformation,
 375     JobObjectAssociateCompletionPortInformation,
 376     JobObjectBasicAndIoAccountingInformation,
 377     JobObjectExtendedLimitInformation,
 378     JobObjectJobSetInformation,
 379     MaxJobObjectInfoClass
 380 } JOBOBJECTINFOCLASS;
 381
 382 //
 383 // Power Event Events for Win32K Power Event Callback
 384 //
 385 typedef enum _PSPOWEREVENTTYPE
 386 {
 387     PsW32FullWake = 0,
 388     PsW32EventCode = 1,
 389     PsW32PowerPolicyChanged = 2,
 390     PsW32SystemPowerState = 3,
 391     PsW32SystemTime = 4,
 392     PsW32DisplayState = 5,
 393     PsW32CapabilitiesChanged = 6,
 394     PsW32SetStateFailed = 7,
 395     PsW32GdiOff = 8,
 396     PsW32GdiOn = 9,
 397     PsW32GdiPrepareResumeUI = 10,
 398     PsW32GdiOffRequest = 11,
 399     PsW32MonitorOff = 12,
 400 } PSPOWEREVENTTYPE;
 401
 402 //
 403 // Power State Tasks for Win32K Power State Callback
 404 //
 405 typedef enum _POWERSTATETASK
 406 {
 407     PowerState_BlockSessionSwitch = 0,
 408     PowerState_Init = 1,
 409     PowerState_QueryApps = 2,
 410     PowerState_QueryServices = 3,
 411     PowerState_QueryAppsFailed = 4,
 412     PowerState_QueryServicesFailed = 5,
 413     PowerState_SuspendApps = 6,
 414     PowerState_SuspendServices = 7,
 415     PowerState_ShowUI = 8,
 416     PowerState_NotifyWL = 9,
 417     PowerState_ResumeApps = 10,
 418     PowerState_ResumeServices = 11,
 419     PowerState_UnBlockSessionSwitch = 12,
 420     PowerState_End = 13,
 421     PowerState_BlockInput = 14,
 422     PowerState_UnblockInput = 15,
 423 } POWERSTATETASK;
 424
 425 //
 426 // Win32K Job Callback Types
 427 //
 428 typedef enum _PSW32JOBCALLOUTTYPE
 429 {
 430    PsW32JobCalloutSetInformation = 0,
 431    PsW32JobCalloutAddProcess = 1,
 432    PsW32JobCalloutTerminate = 2,
 433 } PSW32JOBCALLOUTTYPE;
 434
 435 //
 436 // Win32K Thread Callback Types
 437 //
 438 typedef enum _PSW32THREADCALLOUTTYPE
 439 {
 440     PsW32ThreadCalloutInitialize,
 441     PsW32ThreadCalloutExit,
 442 } PSW32THREADCALLOUTTYPE;
 443
 444 //
 445 // Declare empty structure definitions so that they may be referenced by
 446 // routines before they are defined
 447 //
 448 struct _W32THREAD;
 449 struct _W32PROCESS;
 450 //struct _ETHREAD;
 451 struct _WIN32_POWEREVENT_PARAMETERS;
 452 struct _WIN32_POWERSTATE_PARAMETERS;
 453 struct _WIN32_JOBCALLOUT_PARAMETERS;
 454 struct _WIN32_OPENMETHOD_PARAMETERS;
 455 struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS;
 456 struct _WIN32_CLOSEMETHOD_PARAMETERS;
 457 struct _WIN32_DELETEMETHOD_PARAMETERS;
 458 struct _WIN32_PARSEMETHOD_PARAMETERS;
 459
 460 //
 461 // Win32K Process and Thread Callbacks
 462 //
 463 typedef
 464 NTSTATUS
 465 (NTAPI *PKWIN32_PROCESS_CALLOUT)(
 466     struct _EPROCESS *Process,
 467     BOOLEAN Create
 468 );
 469
 470 typedef
 471 NTSTATUS
 472 (NTAPI *PKWIN32_THREAD_CALLOUT)(
 473     struct _ETHREAD *Thread,
 474     PSW32THREADCALLOUTTYPE Type
 475 );
 476
 477 typedef
 478 NTSTATUS
 479 (NTAPI *PKWIN32_GLOBALATOMTABLE_CALLOUT)(
 480     VOID
 481 );
 482
 483 typedef
 484 NTSTATUS
 485 (NTAPI *PKWIN32_POWEREVENT_CALLOUT)(
 486     struct _WIN32_POWEREVENT_PARAMETERS *Parameters
 487 );
 488
 489 typedef
 490 NTSTATUS
 491 (NTAPI *PKWIN32_POWERSTATE_CALLOUT)(
 492     struct _WIN32_POWERSTATE_PARAMETERS *Parameters
 493 );
 494
 495 typedef
 496 NTSTATUS
 497 (NTAPI *PKWIN32_JOB_CALLOUT)(
 498     struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters
 499 );
 500
 501 typedef
 502 NTSTATUS
 503 (NTAPI *PGDI_BATCHFLUSH_ROUTINE)(
 504     VOID
 505 );
 506
 507 typedef
 508 NTSTATUS
 509 (NTAPI *PKWIN32_OPENMETHOD_CALLOUT)(
 510     struct _WIN32_OPENMETHOD_PARAMETERS *Parameters
 511 );
 512
 513 typedef
 514 NTSTATUS
 515 (NTAPI *PKWIN32_OKTOCLOSEMETHOD_CALLOUT)(
 516     struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters
 517 );
 518
 519 typedef
 520 NTSTATUS
 521 (NTAPI *PKWIN32_CLOSEMETHOD_CALLOUT)(
 522     struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters
 523 );
 524
 525 typedef
 526 VOID
 527 (NTAPI *PKWIN32_DELETEMETHOD_CALLOUT)(
 528     struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters
 529 );
 530
 531 typedef
 532 NTSTATUS
 533 (NTAPI *PKWIN32_PARSEMETHOD_CALLOUT)(
 534     struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters
 535 );
 536
 537 typedef
 538 NTSTATUS
 539 (NTAPI *PKWIN32_WIN32DATACOLLECTION_CALLOUT)(
 540     struct _EPROCESS *Process,
 541     PVOID Callback,
 542     PVOID Context
 543 );
 544
 545 //
 546 // Lego Callback
 547 //
 548 typedef
 549 VOID
 550 (NTAPI *PLEGO_NOTIFY_ROUTINE)(
 551     IN PKTHREAD Thread
 552 );
 553
 554 #endif
 555
 556 typedef NTSTATUS
 557 (NTAPI *PPOST_PROCESS_INIT_ROUTINE)(
 558     VOID
 559 );
 560
 561 //
 562 // Descriptor Table Entry Definition
 563 //
 564 #if (_M_IX86)
 565 #define _DESCRIPTOR_TABLE_ENTRY_DEFINED
 566 typedef struct _DESCRIPTOR_TABLE_ENTRY
 567 {
 568     ULONG Selector;
 569     LDT_ENTRY Descriptor;
 570 } DESCRIPTOR_TABLE_ENTRY, *PDESCRIPTOR_TABLE_ENTRY;
 571 #endif
 572
 573 //
 574 // PEB Lock Routine
 575 //
 576 typedef VOID
 577 (NTAPI *PPEBLOCKROUTINE)(
 578     PVOID PebLock
 579 );
 580
 581 //
 582 // PEB Free Block Descriptor
 583 //
 584 typedef struct _PEB_FREE_BLOCK
 585 {
 586     struct _PEB_FREE_BLOCK* Next;
 587     ULONG Size;
 588 } PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
 589
 590 //
 591 // Initial PEB
 592 //
 593 typedef struct _INITIAL_PEB
 594 {
 595     BOOLEAN InheritedAddressSpace;
 596     BOOLEAN ReadImageFileExecOptions;
 597     BOOLEAN BeingDebugged;
 598     union
 599     {
 600         BOOLEAN BitField;
 601 #if (NTDDI_VERSION >= NTDDI_WS03)
 602         struct
 603         {
 604             BOOLEAN ImageUsesLargePages:1;
 605 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 606             BOOLEAN IsProtectedProcess:1;
 607             BOOLEAN IsLegacyProcess:1;
 608             BOOLEAN SpareBits:5;
 609 #else
 610             BOOLEAN SpareBits:7;
 611 #endif
 612         };
 613 #else
 614         BOOLEAN SpareBool;
 615 #endif
 616     };
 617     HANDLE Mutant;
 618 } INITIAL_PEB, *PINITIAL_PEB;
 619
 620 //
 621 // Initial TEB
 622 //
 623 typedef struct _INITIAL_TEB
 624 {
 625     PVOID PreviousStackBase;
 626     PVOID PreviousStackLimit;
 627     PVOID StackBase;
 628     PVOID StackLimit;
 629     PVOID AllocatedStackBase;
 630 } INITIAL_TEB, *PINITIAL_TEB;
 631
 632 //
 633 // TEB Active Frame Structures
 634 //
 635 typedef struct _TEB_ACTIVE_FRAME_CONTEXT
 636 {
 637     ULONG Flags;
 638     LPSTR FrameName;
 639 } TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;
 640
 641 typedef struct _TEB_ACTIVE_FRAME
 642 {
 643     ULONG Flags;
 644     struct _TEB_ACTIVE_FRAME *Previous;
 645     PTEB_ACTIVE_FRAME_CONTEXT Context;
 646 } TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
 647
 648 typedef struct _CLIENT_ID32
 649 {
 650     ULONG UniqueProcess;
 651     ULONG UniqueThread;
 652 } CLIENT_ID32, *PCLIENT_ID32;
 653
 654 typedef struct _CLIENT_ID64
 655 {
 656     ULONG64 UniqueProcess;
 657     ULONG64 UniqueThread;
 658 } CLIENT_ID64, *PCLIENT_ID64;
 659
 660 #if (NTDDI_VERSION < NTDDI_WS03)
 661 typedef struct _Wx86ThreadState
 662 {
 663     PULONG  CallBx86Eip;
 664     PVOID   DeallocationCpu;
 665     BOOLEAN UseKnownWx86Dll;
 666     CHAR    OleStubInvoked;
 667 } Wx86ThreadState, *PWx86ThreadState;
 668 #endif
 669
 670
 671 //
 672 // Process Environment Block (PEB)
 673 // Thread Environment Block (TEB)
 674 //
 675 #include "peb_teb.h"
 676
 677 #ifdef _WIN64
 678 //
 679 // Explicit 32 bit PEB/TEB
 680 //
 681 #define EXPLICIT_32BIT
 682 #include "peb_teb.h"
 683 #undef EXPLICIT_32BIT
 684
 685 //
 686 // Explicit 64 bit PEB/TEB
 687 //
 688 #define EXPLICIT_64BIT
 689 #include "peb_teb.h"
 690 #undef EXPLICIT_64BIT
 691 #endif
 692
 693 #ifdef NTOS_MODE_USER
 694
 695 //
 696 // Process Information Structures for NtQueryProcessInformation
 697 //
 698 typedef struct _PROCESS_BASIC_INFORMATION
 699 {
 700     NTSTATUS ExitStatus;
 701     PPEB PebBaseAddress;
 702     ULONG_PTR AffinityMask;
 703     KPRIORITY BasePriority;
 704     ULONG_PTR UniqueProcessId;
 705     ULONG_PTR InheritedFromUniqueProcessId;
 706 } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
 707
 708 typedef struct _PROCESS_ACCESS_TOKEN
 709 {
 710     HANDLE Token;
 711     HANDLE Thread;
 712 } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
 713
 714 typedef struct _PROCESS_DEVICEMAP_INFORMATION
 715 {
 716     union
 717     {
 718         struct
 719         {
 720             HANDLE DirectoryHandle;
 721         } Set;
 722         struct
 723         {
 724             ULONG DriveMap;
 725             UCHAR DriveType[32];
 726         } Query;
 727     };
 728 } PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION;
 729
 730 typedef struct _KERNEL_USER_TIMES
 731 {
 732     LARGE_INTEGER CreateTime;
 733     LARGE_INTEGER ExitTime;
 734     LARGE_INTEGER KernelTime;
 735     LARGE_INTEGER UserTime;
 736 } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
 737
 738 typedef struct _PROCESS_SESSION_INFORMATION
 739 {
 740     ULONG SessionId;
 741 } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
 742
 743 #endif
 744
 745 typedef struct _PROCESS_PRIORITY_CLASS
 746 {
 747     BOOLEAN Foreground;
 748     UCHAR PriorityClass;
 749 } PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;
 750
 751 //
 752 // Thread Information Structures for NtQueryProcessInformation
 753 //
 754 typedef struct _THREAD_BASIC_INFORMATION
 755 {
 756     NTSTATUS ExitStatus;
 757     PVOID TebBaseAddress;
 758     CLIENT_ID ClientId;
 759     KAFFINITY AffinityMask;
 760     KPRIORITY Priority;
 761     KPRIORITY BasePriority;
 762 } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
 763
 764 #ifndef NTOS_MODE_USER
 765
 766 //
 767 // Job Set Array
 768 //
 769 typedef struct _JOB_SET_ARRAY
 770 {
 771     HANDLE JobHandle;
 772     ULONG MemberLevel;
 773     ULONG Flags;
 774 } JOB_SET_ARRAY, *PJOB_SET_ARRAY;
 775
 776 //
 777 // EPROCESS Quota Structures
 778 //
 779 typedef struct _EPROCESS_QUOTA_ENTRY
 780 {
 781     SIZE_T Usage;
 782     SIZE_T Limit;
 783     SIZE_T Peak;
 784     SIZE_T Return;
 785 } EPROCESS_QUOTA_ENTRY, *PEPROCESS_QUOTA_ENTRY;
 786
 787 typedef struct _EPROCESS_QUOTA_BLOCK
 788 {
 789     EPROCESS_QUOTA_ENTRY QuotaEntry[3];
 790     LIST_ENTRY QuotaList;
 791     ULONG ReferenceCount;
 792     ULONG ProcessCount;
 793 } EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;
 794
 795 //
 796 // Process Pagefault History
 797 //
 798 typedef struct _PAGEFAULT_HISTORY
 799 {
 800     ULONG CurrentIndex;
 801     ULONG MapIndex;
 802     KSPIN_LOCK SpinLock;
 803     PVOID Reserved;
 804     PROCESS_WS_WATCH_INFORMATION WatchInfo[1];
 805 } PAGEFAULT_HISTORY, *PPAGEFAULT_HISTORY;
 806
 807 //
 808 // Process Impersonation Information
 809 //
 810 typedef struct _PS_IMPERSONATION_INFORMATION
 811 {
 812     PACCESS_TOKEN Token;
 813     BOOLEAN CopyOnOpen;
 814     BOOLEAN EffectiveOnly;
 815     SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
 816 } PS_IMPERSONATION_INFORMATION, *PPS_IMPERSONATION_INFORMATION;
 817
 818 //
 819 // Process Termination Port
 820 //
 821 typedef struct _TERMINATION_PORT
 822 {
 823     struct _TERMINATION_PORT *Next;
 824     PVOID Port;
 825 } TERMINATION_PORT, *PTERMINATION_PORT;
 826
 827 //
 828 // Per-Process APC Rate Limiting
 829 //
 830 typedef struct _PSP_RATE_APC
 831 {
 832     union
 833     {
 834         SINGLE_LIST_ENTRY NextApc;
 835         ULONGLONG ExcessCycles;
 836     };
 837     ULONGLONG TargetGEneration;
 838     KAPC RateApc;
 839 } PSP_RATE_APC, *PPSP_RATE_APC;
 840
 841 //
 842 // Executive Thread (ETHREAD)
 843 //
 844 typedef struct _ETHREAD
 845 {
 846     KTHREAD Tcb;
 847     LARGE_INTEGER CreateTime;
 848     union
 849     {
 850         LARGE_INTEGER ExitTime;
 851         LIST_ENTRY LpcReplyChain;
 852         LIST_ENTRY KeyedWaitChain;
 853     };
 854     union
 855     {
 856         NTSTATUS ExitStatus;
 857         PVOID OfsChain;
 858     };
 859     LIST_ENTRY PostBlockList;
 860     union
 861     {
 862         struct _TERMINATION_PORT *TerminationPort;
 863         struct _ETHREAD *ReaperLink;
 864         PVOID KeyedWaitValue;
 865 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 866         PVOID Win32StartParameter;
 867 #endif
 868     };
 869     KSPIN_LOCK ActiveTimerListLock;
 870     LIST_ENTRY ActiveTimerListHead;
 871     CLIENT_ID Cid;
 872 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 873     KSEMAPHORE KeyedWaitSemaphore;
 874 #else
 875     union
 876     {
 877         KSEMAPHORE LpcReplySemaphore;
 878         KSEMAPHORE KeyedReplySemaphore;
 879     };
 880     union
 881     {
 882         PVOID LpcReplyMessage;
 883         PVOID LpcWaitingOnPort;
 884     };
 885 #endif
 886     PPS_IMPERSONATION_INFORMATION ImpersonationInfo;
 887     LIST_ENTRY IrpList;
 888     ULONG_PTR TopLevelIrp;
 889     PDEVICE_OBJECT DeviceToVerify;
 890 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 891     PPSP_RATE_APC RateControlApc;
 892 #else
 893     struct _EPROCESS *ThreadsProcess;
 894 #endif
 895     PVOID Win32StartAddress;
 896     union
 897     {
 898         PKSTART_ROUTINE StartAddress;
 899         ULONG LpcReceivedMessageId;
 900     };
 901     LIST_ENTRY ThreadListEntry;
 902     EX_RUNDOWN_REF RundownProtect;
 903     EX_PUSH_LOCK ThreadLock;
 904 #if (NTDDI_VERSION < NTDDI_LONGHORN)
 905     ULONG LpcReplyMessageId;
 906 #endif
 907     ULONG ReadClusterSize;
 908 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 909     ULONG SpareUlong0;
 910 #else
 911     ACCESS_MASK GrantedAccess;
 912 #endif
 913     union
 914     {
 915         struct
 916         {
 917            ULONG Terminated:1;
 918 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 919            ULONG ThreadInserted:1;
 920 #else
 921            ULONG DeadThread:1;
 922 #endif
 923            ULONG HideFromDebugger:1;
 924            ULONG ActiveImpersonationInfo:1;
 925            ULONG SystemThread:1;
 926            ULONG HardErrorsAreDisabled:1;
 927            ULONG BreakOnTermination:1;
 928            ULONG SkipCreationMsg:1;
 929            ULONG SkipTerminationMsg:1;
 930 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 931            ULONG CreateMsgSent:1;
 932            ULONG ThreadIoPriority:3;
 933            ULONG ThreadPagePriority:3;
 934            ULONG PendingRatecontrol:1;
 935 #endif
 936         };
 937         ULONG CrossThreadFlags;
 938     };
 939     union
 940     {
 941         struct
 942         {
 943            ULONG ActiveExWorker:1;
 944            ULONG ExWorkerCanWaitUser:1;
 945            ULONG MemoryMaker:1;
 946            ULONG KeyedEventInUse:1;
 947 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 948            ULONG RateApcState:2;
 949 #endif
 950         };
 951         ULONG SameThreadPassiveFlags;
 952     };
 953     union
 954     {
 955         struct
 956         {
 957            ULONG LpcReceivedMsgIdValid:1;
 958            ULONG LpcExitThreadCalled:1;
 959 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 960            ULONG Spare:1;
 961 #else
 962            ULONG AddressSpaceOwner:1;
 963 #endif
 964            ULONG OwnsProcessWorkingSetExclusive:1;
 965            ULONG OwnsProcessWorkingSetShared:1;
 966            ULONG OwnsSystemWorkingSetExclusive:1;
 967            ULONG OwnsSystemWorkingSetShared:1;
 968            ULONG OwnsSessionWorkingSetExclusive:1;
 969            ULONG OwnsSessionWorkingSetShared:1;
 970 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 971            ULONG SupressSymbolLoad:1;
 972            ULONG Spare1:3;
 973            ULONG PriorityRegionActive:4;
 974 #else
 975            ULONG ApcNeeded:1;
 976 #endif
 977         };
 978         ULONG SameThreadApcFlags;
 979     };
 980 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 981     UCHAR CacheManagerActive;
 982 #else
 983     UCHAR ForwardClusterOnly;
 984 #endif
 985     UCHAR DisablePageFaultClustering;
 986     UCHAR ActiveFaultCount;
 987 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 988     ULONG AlpcMessageId;
 989     union
 990     {
 991         PVOID AlpcMessage;
 992         ULONG AlpcReceiveAttributeSet;
 993     };
 994     LIST_ENTRY AlpcWaitListEntry;
 995     KSEMAPHORE AlpcWaitSemaphore;
 996     ULONG CacheManagerCount;
 997 #endif
 998 } ETHREAD;
 999
1000 //
1001 // Executive Process (EPROCESS)
1002 //
1003 typedef struct _EPROCESS
1004 {
1005     KPROCESS Pcb;
1006     EX_PUSH_LOCK ProcessLock;
1007     LARGE_INTEGER CreateTime;
1008     LARGE_INTEGER ExitTime;
1009     EX_RUNDOWN_REF RundownProtect;
1010     HANDLE UniqueProcessId;
1011     LIST_ENTRY ActiveProcessLinks;
1012     ULONG QuotaUsage[3]; /* 0=PagedPool, 1=NonPagedPool, 2=Pagefile */
1013     ULONG QuotaPeak[3];  /* ditto */
1014     ULONG CommitCharge;
1015     ULONG PeakVirtualSize;
1016     ULONG VirtualSize;
1017     LIST_ENTRY SessionProcessLinks;
1018     PVOID DebugPort;
1019 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1020     union
1021     {
1022         PVOID ExceptionPortData;
1023         ULONG ExceptionPortValue;
1024         UCHAR ExceptionPortState:3;
1025     };
1026 #else
1027     PVOID ExceptionPort;
1028 #endif
1029     PHANDLE_TABLE ObjectTable;
1030     EX_FAST_REF Token;
1031     ULONG WorkingSetPage;
1032 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1033     EX_PUSH_LOCK AddressCreationLock;
1034     PETHREAD RotateInProgress;
1035 #else
1036     KGUARDED_MUTEX AddressCreationLock;
1037     KSPIN_LOCK HyperSpaceLock;
1038 #endif
1039     PETHREAD ForkInProgress;
1040     ULONG HardwareTrigger;
1041     PMM_AVL_TABLE PhysicalVadRoot;
1042     PVOID CloneRoot;
1043     ULONG NumberOfPrivatePages;
1044     ULONG NumberOfLockedPages;
1045     PVOID *Win32Process;
1046     struct _EJOB *Job;
1047     PVOID SectionObject;
1048     PVOID SectionBaseAddress;
1049     PEPROCESS_QUOTA_BLOCK QuotaBlock;
1050     PPAGEFAULT_HISTORY WorkingSetWatch;
1051     PVOID Win32WindowStation;
1052     HANDLE InheritedFromUniqueProcessId;
1053     PVOID LdtInformation;
1054     PVOID VadFreeHint;
1055     PVOID VdmObjects;
1056     PVOID DeviceMap;
1057 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1058     PVOID EtwDataSource;
1059     PVOID FreeTebHint;
1060 #else
1061     PVOID Spare0[3];
1062 #endif
1063     union
1064     {
1065         HARDWARE_PTE PageDirectoryPte;
1066         ULONGLONG Filler;
1067     };
1068     ULONG Session;
1069     CHAR ImageFileName[16];
1070     LIST_ENTRY JobLinks;
1071     PVOID LockedPagesList;
1072     LIST_ENTRY ThreadListHead;
1073     PVOID SecurityPort;
1074     PVOID PaeTop;
1075     ULONG ActiveThreads;
1076 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1077     ULONG ImagePathHash;
1078 #else
1079     ACCESS_MASK GrantedAccess;
1080 #endif
1081     ULONG DefaultHardErrorProcessing;
1082     NTSTATUS LastThreadExitStatus;
1083     struct _PEB* Peb;
1084     EX_FAST_REF PrefetchTrace;
1085     LARGE_INTEGER ReadOperationCount;
1086     LARGE_INTEGER WriteOperationCount;
1087     LARGE_INTEGER OtherOperationCount;
1088     LARGE_INTEGER ReadTransferCount;
1089     LARGE_INTEGER WriteTransferCount;
1090     LARGE_INTEGER OtherTransferCount;
1091     ULONG CommitChargeLimit;
1092     ULONG CommitChargePeak;
1093     PVOID AweInfo;
1094     SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;
1095     MMSUPPORT Vm;
1096     LIST_ENTRY MmProcessLinks;
1097     ULONG ModifiedPageCount;
1098 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1099     union
1100     {
1101         struct
1102         {
1103             ULONG JobNotReallyActive:1;
1104             ULONG AccountingFolded:1;
1105             ULONG NewProcessReported:1;
1106             ULONG ExitProcessReported:1;
1107             ULONG ReportCommitChanges:1;
1108             ULONG LastReportMemory:1;
1109             ULONG ReportPhysicalPageChanges:1;
1110             ULONG HandleTableRundown:1;
1111             ULONG NeedsHandleRundown:1;
1112             ULONG RefTraceEnabled:1;
1113             ULONG NumaAware:1;
1114             ULONG ProtectedProcess:1;
1115             ULONG DefaultPagePriority:3;
1116             ULONG ProcessDeleteSelf:1;
1117             ULONG ProcessVerifierTarget:1;
1118         };
1119         ULONG Flags2;
1120     };
1121 #else
1122     ULONG JobStatus;
1123 #endif
1124     union
1125     {
1126         struct
1127         {
1128             ULONG CreateReported:1;
1129             ULONG NoDebugInherit:1;
1130             ULONG ProcessExiting:1;
1131             ULONG ProcessDelete:1;
1132             ULONG Wow64SplitPages:1;
1133             ULONG VmDeleted:1;
1134             ULONG OutswapEnabled:1;
1135             ULONG Outswapped:1;
1136             ULONG ForkFailed:1;
1137             ULONG Wow64VaSpace4Gb:1;
1138             ULONG AddressSpaceInitialized:2;
1139             ULONG SetTimerResolution:1;
1140             ULONG BreakOnTermination:1;
1141 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1142             ULONG DeprioritizeViews:1;
1143 #else
1144             ULONG SessionCreationUnderway:1;
1145 #endif
1146             ULONG WriteWatch:1;
1147             ULONG ProcessInSession:1;
1148             ULONG OverrideAddressSpace:1;
1149             ULONG HasAddressSpace:1;
1150             ULONG LaunchPrefetched:1;
1151             ULONG InjectInpageErrors:1;
1152             ULONG VmTopDown:1;
1153             ULONG ImageNotifyDone:1;
1154             ULONG PdeUpdateNeeded:1;
1155             ULONG VdmAllowed:1;
1156             ULONG SmapAllowed:1;
1157 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1158             ULONG ProcessInserted:1;
1159 #else
1160             ULONG CreateFailed:1;
1161 #endif
1162             ULONG DefaultIoPriority:3;
1163 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1164             ULONG SparePsFlags1:2;
1165 #else
1166             ULONG Spare1:1;
1167             ULONG Spare2:1;
1168 #endif
1169         };
1170         ULONG Flags;
1171     };
1172     NTSTATUS ExitStatus;
1173 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1174     USHORT Spare7;
1175 #else
1176     USHORT NextPageColor;
1177 #endif
1178     union
1179     {
1180         struct
1181         {
1182             UCHAR SubSystemMinorVersion;
1183             UCHAR SubSystemMajorVersion;
1184         };
1185         USHORT SubSystemVersion;
1186     };
1187     UCHAR PriorityClass;
1188     MM_AVL_TABLE VadRoot;
1189     ULONG Cookie;
1190 } EPROCESS;
1191
1192 //
1193 // Job Token Filter Data
1194 //
1195 #include <pshpack1.h>
1196 typedef struct _PS_JOB_TOKEN_FILTER
1197 {
1198     ULONG CapturedSidCount;
1199     PSID_AND_ATTRIBUTES CapturedSids;
1200     ULONG CapturedSidsLength;
1201     ULONG CapturedGroupCount;
1202     PSID_AND_ATTRIBUTES CapturedGroups;
1203     ULONG CapturedGroupsLength;
1204     ULONG CapturedPrivilegeCount;
1205     PLUID_AND_ATTRIBUTES CapturedPrivileges;
1206     ULONG CapturedPrivilegesLength;
1207 } PS_JOB_TOKEN_FILTER, *PPS_JOB_TOKEN_FILTER;
1208
1209 //
1210 // Executive Job (EJOB)
1211 //
1212 typedef struct _EJOB
1213 {
1214     KEVENT Event;
1215     LIST_ENTRY JobLinks;
1216     LIST_ENTRY ProcessListHead;
1217     ERESOURCE JobLock;
1218     LARGE_INTEGER TotalUserTime;
1219     LARGE_INTEGER TotalKernelTime;
1220     LARGE_INTEGER ThisPeriodTotalUserTime;
1221     LARGE_INTEGER ThisPeriodTotalKernelTime;
1222     ULONG TotalPageFaultCount;
1223     ULONG TotalProcesses;
1224     ULONG ActiveProcesses;
1225     ULONG TotalTerminatedProcesses;
1226     LARGE_INTEGER PerProcessUserTimeLimit;
1227     LARGE_INTEGER PerJobUserTimeLimit;
1228     ULONG LimitFlags;
1229     ULONG MinimumWorkingSetSize;
1230     ULONG MaximumWorkingSetSize;
1231     ULONG ActiveProcessLimit;
1232     ULONG Affinity;
1233     UCHAR PriorityClass;
1234     ULONG UIRestrictionsClass;
1235     ULONG SecurityLimitFlags;
1236     PVOID Token;
1237     PPS_JOB_TOKEN_FILTER Filter;
1238     ULONG EndOfJobTimeAction;
1239     PVOID CompletionPort;
1240     PVOID CompletionKey;
1241     ULONG SessionId;
1242     ULONG SchedulingClass;
1243     ULONGLONG ReadOperationCount;
1244     ULONGLONG WriteOperationCount;
1245     ULONGLONG OtherOperationCount;
1246     ULONGLONG ReadTransferCount;
1247     ULONGLONG WriteTransferCount;
1248     ULONGLONG OtherTransferCount;
1249     IO_COUNTERS IoInfo;
1250     ULONG ProcessMemoryLimit;
1251     ULONG JobMemoryLimit;
1252     ULONG PeakProcessMemoryUsed;
1253     ULONG PeakJobMemoryUsed;
1254     ULONG CurrentJobMemoryUsed;
1255 #if (NTDDI_VERSION >= NTDDI_WINXP) && (NTDDI_VERSION < NTDDI_WS03)
1256     FAST_MUTEX MemoryLimitsLock;
1257 #elif (NTDDI_VERSION >= NTDDI_WS03) && (NTDDI_VERSION < NTDDI_LONGHORN)
1258     KGUARDED_MUTEX MemoryLimitsLock;
1259 #elif (NTDDI_VERSION >= NTDDI_LONGHORN)
1260     EX_PUSH_LOCK MemoryLimitsLock;
1261 #endif
1262     LIST_ENTRY JobSetLinks;
1263     ULONG MemberLevel;
1264     ULONG JobFlags;
1265 } EJOB, *PEJOB;
1266 #include <poppack.h>
1267
1268 //
1269 // Win32K Callback Registration Data
1270 //
1271 typedef struct _WIN32_POWEREVENT_PARAMETERS
1272 {
1273     PSPOWEREVENTTYPE EventNumber;
1274     ULONG Code;
1275 } WIN32_POWEREVENT_PARAMETERS, *PWIN32_POWEREVENT_PARAMETERS;
1276
1277 typedef struct _WIN32_POWERSTATE_PARAMETERS
1278 {
1279     UCHAR Promotion;
1280     POWER_ACTION SystemAction;
1281     SYSTEM_POWER_STATE MinSystemState;
1282     ULONG Flags;
1283     POWERSTATETASK PowerStateTask;
1284 } WIN32_POWERSTATE_PARAMETERS, *PWIN32_POWERSTATE_PARAMETERS;
1285
1286 typedef struct _WIN32_JOBCALLOUT_PARAMETERS
1287 {
1288     PVOID Job;
1289     PSW32JOBCALLOUTTYPE CalloutType;
1290     PVOID Data;
1291 } WIN32_JOBCALLOUT_PARAMETERS, *PWIN32_JOBCALLOUT_PARAMETERS;
1292
1293 typedef struct _WIN32_OPENMETHOD_PARAMETERS
1294 {
1295     OB_OPEN_REASON OpenReason;
1296     PEPROCESS Process;
1297     PVOID Object;
1298     ULONG GrantedAccess;
1299     ULONG HandleCount;
1300 } WIN32_OPENMETHOD_PARAMETERS, *PWIN32_OPENMETHOD_PARAMETERS;
1301
1302 typedef struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS
1303 {
1304     PEPROCESS Process;
1305     PVOID Object;
1306     HANDLE Handle;
1307     KPROCESSOR_MODE PreviousMode;
1308 } WIN32_OKAYTOCLOSEMETHOD_PARAMETERS, *PWIN32_OKAYTOCLOSEMETHOD_PARAMETERS;
1309
1310 typedef struct _WIN32_CLOSEMETHOD_PARAMETERS
1311 {
1312     PEPROCESS Process;
1313     PVOID Object;
1314     ACCESS_MASK AccessMask;
1315     ULONG ProcessHandleCount;
1316     ULONG SystemHandleCount;
1317 } WIN32_CLOSEMETHOD_PARAMETERS, *PWIN32_CLOSEMETHOD_PARAMETERS;
1318
1319 typedef struct _WIN32_DELETEMETHOD_PARAMETERS
1320 {
1321     PVOID Object;
1322 } WIN32_DELETEMETHOD_PARAMETERS, *PWIN32_DELETEMETHOD_PARAMETERS;
1323
1324 typedef struct _WIN32_PARSEMETHOD_PARAMETERS
1325 {
1326     PVOID ParseObject;
1327     PVOID ObjectType;
1328     PACCESS_STATE AccessState;
1329     KPROCESSOR_MODE AccessMode;
1330     ULONG Attributes;
1331     OUT PUNICODE_STRING CompleteName;
1332     PUNICODE_STRING RemainingName;
1333     PVOID Context;
1334     PSECURITY_QUALITY_OF_SERVICE SecurityQos;
1335     PVOID *Object;
1336 } WIN32_PARSEMETHOD_PARAMETERS, *PWIN32_PARSEMETHOD_PARAMETERS;
1337
1338 typedef struct _WIN32_CALLOUTS_FPNS
1339 {
1340     PKWIN32_PROCESS_CALLOUT ProcessCallout;
1341     PKWIN32_THREAD_CALLOUT ThreadCallout;
1342     PKWIN32_GLOBALATOMTABLE_CALLOUT GlobalAtomTableCallout;
1343     PKWIN32_POWEREVENT_CALLOUT PowerEventCallout;
1344     PKWIN32_POWERSTATE_CALLOUT PowerStateCallout;
1345     PKWIN32_JOB_CALLOUT JobCallout;
1346     PGDI_BATCHFLUSH_ROUTINE BatchFlushRoutine;
1347     PKWIN32_OPENMETHOD_CALLOUT DesktopOpenProcedure;
1348     PKWIN32_OKTOCLOSEMETHOD_CALLOUT DesktopOkToCloseProcedure;
1349     PKWIN32_CLOSEMETHOD_CALLOUT DesktopCloseProcedure;
1350     PKWIN32_DELETEMETHOD_CALLOUT DesktopDeleteProcedure;
1351     PKWIN32_OKTOCLOSEMETHOD_CALLOUT WindowStationOkToCloseProcedure;
1352     PKWIN32_CLOSEMETHOD_CALLOUT WindowStationCloseProcedure;
1353     PKWIN32_DELETEMETHOD_CALLOUT WindowStationDeleteProcedure;
1354     PKWIN32_PARSEMETHOD_CALLOUT WindowStationParseProcedure;
1355     PKWIN32_OPENMETHOD_CALLOUT WindowStationOpenProcedure;
1356     PKWIN32_WIN32DATACOLLECTION_CALLOUT Win32DataCollectionProcedure;
1357 } WIN32_CALLOUTS_FPNS, *PWIN32_CALLOUTS_FPNS;
1358
1359 #endif // !NTOS_MODE_USER
1360
1361 #endif // _PSTYPES_H