3 Copyright (c) Alex Ionescu. All rights reserved.
11 Type definitions for the Run-Time Library
15 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
30 // Maximum Atom Length
32 #define RTL_MAXIMUM_ATOM_LENGTH 255
35 // Process Parameters Flags
37 #define RTL_USER_PROCESS_PARAMETERS_NORMALIZED 0x01
38 #define RTL_USER_PROCESS_PARAMETERS_PROFILE_USER 0x02
39 #define RTL_USER_PROCESS_PARAMETERS_PROFILE_SERVER 0x04
40 #define RTL_USER_PROCESS_PARAMETERS_PROFILE_KERNEL 0x08
41 #define RTL_USER_PROCESS_PARAMETERS_UNKNOWN 0x10
42 #define RTL_USER_PROCESS_PARAMETERS_RESERVE_1MB 0x20
43 #define RTL_USER_PROCESS_PARAMETERS_DISABLE_HEAP_CHECKS 0x100
44 #define RTL_USER_PROCESS_PARAMETERS_PROCESS_OR_1 0x200
45 #define RTL_USER_PROCESS_PARAMETERS_PROCESS_OR_2 0x400
46 #define RTL_USER_PROCESS_PARAMETERS_PRIVATE_DLL_PATH 0x1000
47 #define RTL_USER_PROCESS_PARAMETERS_LOCAL_DLL_PATH 0x2000
48 #define RTL_USER_PROCESS_PARAMETERS_NX 0x20000
53 #define EXCEPTION_CHAIN_END ((PEXCEPTION_REGISTRATION_RECORD)-1)
54 #define EXCEPTION_UNWINDING 0x02
55 #define EXCEPTION_EXIT_UNWIND 0x04
56 #define EXCEPTION_STACK_INVALID 0x08
57 #define EXCEPTION_UNWIND (EXCEPTION_UNWINDING + EXCEPTION_EXIT_UNWIND)
58 #define EXCEPTION_NESTED_CALL 0x10
59 #define EXCEPTION_TARGET_UNWIND 0x20
60 #define EXCEPTION_COLLIDED_UNWIND 0x20
63 // Range and Range List Flags
65 #define RTL_RANGE_LIST_ADD_IF_CONFLICT 0x00000001
66 #define RTL_RANGE_LIST_ADD_SHARED 0x00000002
68 #define RTL_RANGE_SHARED 0x01
69 #define RTL_RANGE_CONFLICT 0x02
72 // Activation Context Frame Flags
74 #define RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER \
80 #if !defined(NTOS_MODE_USER) && !defined(_NTIFS_)
81 #define HEAP_NO_SERIALIZE 0x00000001
82 #define HEAP_GROWABLE 0x00000002
83 #define HEAP_GENERATE_EXCEPTIONS 0x00000004
84 #define HEAP_ZERO_MEMORY 0x00000008
85 #define HEAP_REALLOC_IN_PLACE_ONLY 0x00000010
86 #define HEAP_TAIL_CHECKING_ENABLED 0x00000020
87 #define HEAP_FREE_CHECKING_ENABLED 0x00000040
88 #define HEAP_DISABLE_COALESCE_ON_FREE 0x00000080
89 #define HEAP_CREATE_ALIGN_16 0x00010000
90 #define HEAP_CREATE_ENABLE_TRACING 0x00020000
91 #define HEAP_CREATE_ENABLE_EXECUTE 0x00040000
95 // User-Defined Heap Flags and Classes
97 #define HEAP_SETTABLE_USER_VALUE 0x00000100
98 #define HEAP_SETTABLE_USER_FLAG1 0x00000200
99 #define HEAP_SETTABLE_USER_FLAG2 0x00000400
100 #define HEAP_SETTABLE_USER_FLAG3 0x00000800
101 #define HEAP_SETTABLE_USER_FLAGS 0x00000E00
102 #define HEAP_CLASS_0 0x00000000
103 #define HEAP_CLASS_1 0x00001000
104 #define HEAP_CLASS_2 0x00002000
105 #define HEAP_CLASS_3 0x00003000
106 #define HEAP_CLASS_4 0x00004000
107 #define HEAP_CLASS_5 0x00005000
108 #define HEAP_CLASS_6 0x00006000
109 #define HEAP_CLASS_7 0x00007000
110 #define HEAP_CLASS_8 0x00008000
111 #define HEAP_CLASS_MASK 0x0000F000
114 // Internal HEAP Structure Flags
116 #define HEAP_FLAG_PAGE_ALLOCS 0x01000000
117 #define HEAP_PROTECTION_ENABLED 0x02000000
118 #define HEAP_BREAK_WHEN_OUT_OF_VM 0x04000000
119 #define HEAP_NO_ALIGNMENT 0x08000000
120 #define HEAP_CAPTURE_STACK_BACKTRACES 0x08000000
121 #define HEAP_SKIP_VALIDATION_CHECKS 0x10000000
122 #define HEAP_VALIDATE_ALL_ENABLED 0x20000000
123 #define HEAP_VALIDATE_PARAMETERS_ENABLED 0x40000000
124 #define HEAP_LOCK_USER_ALLOCATED 0x80000000
127 // Heap Validation Flags
129 #define HEAP_CREATE_VALID_MASK \
130 (HEAP_NO_SERIALIZE | \
132 HEAP_GENERATE_EXCEPTIONS | \
134 HEAP_REALLOC_IN_PLACE_ONLY | \
135 HEAP_TAIL_CHECKING_ENABLED | \
136 HEAP_FREE_CHECKING_ENABLED | \
137 HEAP_DISABLE_COALESCE_ON_FREE | \
139 HEAP_CREATE_ALIGN_16 | \
140 HEAP_CREATE_ENABLE_TRACING | \
141 HEAP_CREATE_ENABLE_EXECUTE)
143 C_ASSERT(HEAP_CREATE_VALID_MASK
== 0x0007F0FF);
147 // Native image architecture
150 #define IMAGE_FILE_MACHINE_NATIVE IMAGE_FILE_MACHINE_I386
151 #elif defined(_M_ARM)
152 #define IMAGE_FILE_MACHINE_NATIVE IMAGE_FILE_MACHINE_ARM
153 #elif defined(_M_AMD64)
154 #define IMAGE_FILE_MACHINE_NATIVE IMAGE_FILE_MACHINE_AMD64
156 #error Define these please!
162 #define RTL_REGISTRY_ABSOLUTE 0
163 #define RTL_REGISTRY_SERVICES 1
164 #define RTL_REGISTRY_CONTROL 2
165 #define RTL_REGISTRY_WINDOWS_NT 3
166 #define RTL_REGISTRY_DEVICEMAP 4
167 #define RTL_REGISTRY_USER 5
168 #define RTL_REGISTRY_MAXIMUM 6
169 #define RTL_REGISTRY_HANDLE 0x40000000
170 #define RTL_REGISTRY_OPTIONAL 0x80000000
171 #define RTL_QUERY_REGISTRY_SUBKEY 0x00000001
172 #define RTL_QUERY_REGISTRY_TOPKEY 0x00000002
173 #define RTL_QUERY_REGISTRY_REQUIRED 0x00000004
174 #define RTL_QUERY_REGISTRY_NOVALUE 0x00000008
175 #define RTL_QUERY_REGISTRY_NOEXPAND 0x00000010
176 #define RTL_QUERY_REGISTRY_DIRECT 0x00000020
177 #define RTL_QUERY_REGISTRY_DELETE 0x00000040
182 #define VER_MINORVERSION 0x0000001
183 #define VER_MAJORVERSION 0x0000002
184 #define VER_BUILDNUMBER 0x0000004
185 #define VER_PLATFORMID 0x0000008
186 #define VER_SERVICEPACKMINOR 0x0000010
187 #define VER_SERVICEPACKMAJOR 0x0000020
188 #define VER_SUITENAME 0x0000040
189 #define VER_PRODUCT_TYPE 0x0000080
190 #define VER_PLATFORM_WIN32s 0
191 #define VER_PLATFORM_WIN32_WINDOWS 1
192 #define VER_PLATFORM_WIN32_NT 2
194 #define VER_GREATER 2
195 #define VER_GREATER_EQUAL 3
197 #define VER_LESS_EQUAL 5
200 #define VER_CONDITION_MASK 7
201 #define VER_NUM_BITS_PER_CONDITION_MASK 3
206 #define TIME_ZONE_ID_UNKNOWN 0
207 #define TIME_ZONE_ID_STANDARD 1
208 #define TIME_ZONE_ID_DAYLIGHT 2
211 // Maximum Path Length
216 // RTL Lock Type (Critical Section or Resource)
218 #define RTL_CRITSECT_TYPE 0
219 #define RTL_RESOURCE_TYPE 1
222 // RtlAcquirePrivileges Flags
224 #define RTL_ACQUIRE_PRIVILEGE_IMPERSONATE 1
225 #define RTL_ACQUIRE_PRIVILEGE_PROCESS 2
227 #ifdef NTOS_MODE_USER
230 // String Hash Algorithms
232 #define HASH_STRING_ALGORITHM_DEFAULT 0
233 #define HASH_STRING_ALGORITHM_X65599 1
234 #define HASH_STRING_ALGORITHM_INVALID 0xffffffff
237 // RtlDuplicateString Flags
239 #define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE 1
240 #define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING 2
243 // RtlFindCharInUnicodeString Flags
245 #define RTL_FIND_CHAR_IN_UNICODE_STRING_CASE_INSENSITIVE 4
250 #define NLS_MB_CODE_PAGE_TAG NlsMbCodePageTag
251 #define NLS_MB_OEM_CODE_PAGE_TAG NlsMbOemCodePageTag
252 #define NLS_OEM_LEAD_BYTE_INFO NlsOemLeadByteInfo
257 #if defined(__cplusplus)
258 #define RTL_CONST_CAST(type) const_cast<type>
260 #define RTL_CONST_CAST(type) (type)
264 // Constant String Macro
266 #define RTL_CONSTANT_STRING(__SOURCE_STRING__) \
268 sizeof(__SOURCE_STRING__) - sizeof((__SOURCE_STRING__)[0]), \
269 sizeof(__SOURCE_STRING__), \
270 (__SOURCE_STRING__) \
274 // Constant Object Attributes Macro
276 #define RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a) \
278 sizeof(OBJECT_ATTRIBUTES), \
280 RTL_CONST_CAST(PUNICODE_STRING)(n), \
286 #define RTL_INIT_OBJECT_ATTRIBUTES(n, a) \
287 RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a)
291 // Message Resource Flag
293 #define MESSAGE_RESOURCE_UNICODE 0x0001
296 #define MAXIMUM_LEADBYTES 12
301 #define RTL_DEBUG_QUERY_MODULES 0x01
302 #define RTL_DEBUG_QUERY_BACKTRACES 0x02
303 #define RTL_DEBUG_QUERY_HEAPS 0x04
304 #define RTL_DEBUG_QUERY_HEAP_TAGS 0x08
305 #define RTL_DEBUG_QUERY_HEAP_BLOCKS 0x10
306 #define RTL_DEBUG_QUERY_LOCKS 0x20
311 #define RTL_HANDLE_VALID 0x1
316 #define RTL_ATOM_IS_PINNED 0x1
319 // Critical section lock bits
321 #define CS_LOCK_BIT 0x1
322 #define CS_LOCK_BIT_V 0x0
323 #define CS_LOCK_WAITER_WOKEN 0x2
324 #define CS_LOCK_WAITER_INC 0x4
329 #ifdef NTOS_MODE_USER
330 extern BOOLEAN NTSYSAPI NLS_MB_CODE_PAGE_TAG
;
331 extern BOOLEAN NTSYSAPI NLS_MB_OEM_CODE_PAGE_TAG
;
334 // Constant String Macro
336 #define RTL_CONSTANT_STRING(__SOURCE_STRING__) \
338 sizeof(__SOURCE_STRING__) - sizeof((__SOURCE_STRING__)[0]), \
339 sizeof(__SOURCE_STRING__), \
340 (__SOURCE_STRING__) \
345 #ifdef NTOS_MODE_USER
348 // Table and Compare result types
350 typedef enum _TABLE_SEARCH_RESULT
356 } TABLE_SEARCH_RESULT
;
358 typedef enum _RTL_GENERIC_COMPARE_RESULTS
363 } RTL_GENERIC_COMPARE_RESULTS
;
370 typedef enum _RTL_PATH_TYPE
373 RtlPathTypeUncAbsolute
,
374 RtlPathTypeDriveAbsolute
,
375 RtlPathTypeDriveRelative
,
378 RtlPathTypeLocalDevice
,
379 RtlPathTypeRootLocalDevice
,
382 #ifndef NTOS_MODE_USER
385 // Heap Information Class
387 typedef enum _HEAP_INFORMATION_CLASS
389 HeapCompatibilityInformation
,
390 HeapEnableTerminationOnCorruption
391 } HEAP_INFORMATION_CLASS
;
394 // Callback function for RTL Timers or Registered Waits
397 (NTAPI
*WAITORTIMERCALLBACKFUNC
)(
399 BOOLEAN fTimerOrWaitFired
403 // Handler during Vectored RTL Exceptions
406 (NTAPI
*PVECTORED_EXCEPTION_HANDLER
)(
407 PEXCEPTION_POINTERS ExceptionPointers
411 // Worker Thread Callback for Rtl
414 (NTAPI
*WORKERCALLBACKFUNC
)(
421 // Handler during regular RTL Exceptions
423 typedef EXCEPTION_DISPOSITION
424 (NTAPI
*PEXCEPTION_ROUTINE
)(
425 IN
struct _EXCEPTION_RECORD
*ExceptionRecord
,
426 IN PVOID EstablisherFrame
,
427 IN OUT
struct _CONTEXT
*ContextRecord
,
428 IN OUT PVOID DispatcherContext
432 // RTL Library Allocation/Free Routines
435 (NTAPI
*PRTL_ALLOCATE_STRING_ROUTINE
)(
440 (NTAPI
*PRTL_REALLOCATE_STRING_ROUTINE
)(
441 SIZE_T NumberOfBytes
,
447 (NTAPI
*PRTL_FREE_STRING_ROUTINE
)(
451 extern const PRTL_ALLOCATE_STRING_ROUTINE RtlAllocateStringRoutine
;
452 extern const PRTL_FREE_STRING_ROUTINE RtlFreeStringRoutine
;
453 extern const PRTL_REALLOCATE_STRING_ROUTINE RtlReallocateStringRoutine
;
458 // Callback for RTL Heap Enumeration
461 (NTAPI
*PHEAP_ENUMERATION_ROUTINE
)(
467 // Thread and Process Start Routines for RtlCreateUserThread/Process
469 typedef ULONG (NTAPI
*PTHREAD_START_ROUTINE
)(
474 (NTAPI
*PRTL_BASE_PROCESS_START_ROUTINE
)(
475 PTHREAD_START_ROUTINE StartAddress
,
480 // Declare empty structure definitions so that they may be referenced by
481 // routines before they are defined
483 struct _RTL_AVL_TABLE
;
484 struct _RTL_GENERIC_TABLE
;
488 // Routines and callbacks for the RTL AVL/Generic Table package
490 #if defined(NTOS_MODE_USER) || (!defined(NTOS_MODE_USER) && !defined(_NTIFS_))
492 (NTAPI
*PRTL_AVL_MATCH_FUNCTION
)(
493 struct _RTL_AVL_TABLE
*Table
,
498 typedef RTL_GENERIC_COMPARE_RESULTS
499 (NTAPI
*PRTL_AVL_COMPARE_ROUTINE
) (
500 struct _RTL_AVL_TABLE
*Table
,
505 typedef RTL_GENERIC_COMPARE_RESULTS
506 (NTAPI
*PRTL_GENERIC_COMPARE_ROUTINE
) (
507 struct _RTL_GENERIC_TABLE
*Table
,
513 (NTAPI
*PRTL_GENERIC_ALLOCATE_ROUTINE
) (
514 struct _RTL_GENERIC_TABLE
*Table
,
519 (NTAPI
*PRTL_GENERIC_FREE_ROUTINE
) (
520 struct _RTL_GENERIC_TABLE
*Table
,
525 (NTAPI
*PRTL_AVL_ALLOCATE_ROUTINE
) (
526 struct _RTL_AVL_TABLE
*Table
,
531 (NTAPI
*PRTL_AVL_FREE_ROUTINE
) (
532 struct _RTL_AVL_TABLE
*Table
,
538 // RTL Query Registry callback
540 #ifdef NTOS_MODE_USER
542 (NTAPI
*PRTL_QUERY_REGISTRY_ROUTINE
)(
546 IN ULONG ValueLength
,
548 IN PVOID EntryContext
553 // RTL Secure Memory callbacks
555 #ifdef NTOS_MODE_USER
557 (NTAPI
*PRTL_SECURE_MEMORY_CACHE_CALLBACK
)(
564 // RTL Range List callbacks
566 #ifdef NTOS_MODE_USER
568 (NTAPI
*PRTL_CONFLICT_RANGE_CALLBACK
)(
570 struct _RTL_RANGE
*Range
574 // Custom Heap Commit Routine for RtlCreateHeap
577 (NTAPI
* PRTL_HEAP_COMMIT_ROUTINE
)(
579 IN OUT PVOID
*CommitAddress
,
580 IN OUT PSIZE_T CommitSize
584 // Parameters for RtlCreateHeap
586 typedef struct _RTL_HEAP_PARAMETERS
589 SIZE_T SegmentReserve
;
590 SIZE_T SegmentCommit
;
591 SIZE_T DeCommitFreeBlockThreshold
;
592 SIZE_T DeCommitTotalFreeThreshold
;
593 SIZE_T MaximumAllocationSize
;
594 SIZE_T VirtualMemoryThreshold
;
595 SIZE_T InitialCommit
;
596 SIZE_T InitialReserve
;
597 PRTL_HEAP_COMMIT_ROUTINE CommitRoutine
;
599 } RTL_HEAP_PARAMETERS
, *PRTL_HEAP_PARAMETERS
;
602 // RTL Bitmap structures
604 typedef struct _RTL_BITMAP
608 } RTL_BITMAP
, *PRTL_BITMAP
;
610 typedef struct _RTL_BITMAP_RUN
614 } RTL_BITMAP_RUN
, *PRTL_BITMAP_RUN
;
617 // RtlGenerateXxxName context
619 typedef struct _GENERATE_NAME_CONTEXT
622 BOOLEAN CheckSumInserted
;
625 ULONG ExtensionLength
;
626 WCHAR ExtensionBuffer
[4];
627 ULONG LastIndexValue
;
628 } GENERATE_NAME_CONTEXT
, *PGENERATE_NAME_CONTEXT
;
631 // RTL Splay and Balanced Links structures
633 typedef struct _RTL_SPLAY_LINKS
635 struct _RTL_SPLAY_LINKS
*Parent
;
636 struct _RTL_SPLAY_LINKS
*LeftChild
;
637 struct _RTL_SPLAY_LINKS
*RightChild
;
638 } RTL_SPLAY_LINKS
, *PRTL_SPLAY_LINKS
;
640 typedef struct _RTL_BALANCED_LINKS
642 struct _RTL_BALANCED_LINKS
*Parent
;
643 struct _RTL_BALANCED_LINKS
*LeftChild
;
644 struct _RTL_BALANCED_LINKS
*RightChild
;
647 } RTL_BALANCED_LINKS
, *PRTL_BALANCED_LINKS
;
650 // RTL Avl/Generic Tables
652 typedef struct _RTL_GENERIC_TABLE
654 PRTL_SPLAY_LINKS TableRoot
;
655 LIST_ENTRY InsertOrderList
;
656 PLIST_ENTRY OrderedPointer
;
657 ULONG WhichOrderedElement
;
658 ULONG NumberGenericTableElements
;
659 PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine
;
660 PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine
;
661 PRTL_GENERIC_FREE_ROUTINE FreeRoutine
;
663 } RTL_GENERIC_TABLE
, *PRTL_GENERIC_TABLE
;
665 typedef struct _RTL_AVL_TABLE
667 RTL_BALANCED_LINKS BalancedRoot
;
668 PVOID OrderedPointer
;
669 ULONG WhichOrderedElement
;
670 ULONG NumberGenericTableElements
;
672 PRTL_BALANCED_LINKS RestartKey
;
674 PRTL_AVL_COMPARE_ROUTINE CompareRoutine
;
675 PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine
;
676 PRTL_AVL_FREE_ROUTINE FreeRoutine
;
678 } RTL_AVL_TABLE
, *PRTL_AVL_TABLE
;
681 // RTL Compression Buffer
683 typedef struct _COMPRESSED_DATA_INFO
{
684 USHORT CompressionFormatAndEngine
;
685 UCHAR CompressionUnitShift
;
689 USHORT NumberOfChunks
;
690 ULONG CompressedChunkSizes
[ANYSIZE_ARRAY
];
691 } COMPRESSED_DATA_INFO
, *PCOMPRESSED_DATA_INFO
;
694 // RtlQueryRegistry Data
696 typedef struct _RTL_QUERY_REGISTRY_TABLE
698 PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine
;
705 } RTL_QUERY_REGISTRY_TABLE
, *PRTL_QUERY_REGISTRY_TABLE
;
708 // RTL Unicode Table Structures
710 typedef struct _UNICODE_PREFIX_TABLE_ENTRY
714 struct _UNICODE_PREFIX_TABLE_ENTRY
*NextPrefixTree
;
715 struct _UNICODE_PREFIX_TABLE_ENTRY
*CaseMatch
;
716 RTL_SPLAY_LINKS Links
;
717 PUNICODE_STRING Prefix
;
718 } UNICODE_PREFIX_TABLE_ENTRY
, *PUNICODE_PREFIX_TABLE_ENTRY
;
720 typedef struct _UNICODE_PREFIX_TABLE
724 PUNICODE_PREFIX_TABLE_ENTRY NextPrefixTree
;
725 PUNICODE_PREFIX_TABLE_ENTRY LastNextEntry
;
726 } UNICODE_PREFIX_TABLE
, *PUNICODE_PREFIX_TABLE
;
729 // Time Structure for RTL Time calls
731 typedef struct _TIME_FIELDS
741 } TIME_FIELDS
, *PTIME_FIELDS
;
744 // Activation Context
746 typedef PVOID PACTIVATION_CONTEXT
;
749 // Activation Context Frame
751 typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME
753 struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME
*Previous
;
754 PACTIVATION_CONTEXT ActivationContext
;
756 } RTL_ACTIVATION_CONTEXT_STACK_FRAME
,
757 *PRTL_ACTIVATION_CONTEXT_STACK_FRAME
;
759 typedef struct _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
763 RTL_ACTIVATION_CONTEXT_STACK_FRAME Frame
;
768 } RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
,
769 *PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
;
771 #if (NTDDI_VERSION >= NTDDI_WS03)
772 typedef struct _ACTIVATION_CONTEXT_STACK
774 PRTL_ACTIVATION_CONTEXT_STACK_FRAME ActiveFrame
;
775 LIST_ENTRY FrameListCache
;
777 ULONG NextCookieSequenceNumber
;
779 } ACTIVATION_CONTEXT_STACK
,
780 *PACTIVATION_CONTEXT_STACK
;
782 typedef struct _ACTIVATION_CONTEXT_STACK
785 ULONG NextCookieSequenceNumber
;
787 LIST_ENTRY FrameListCache
;
788 } ACTIVATION_CONTEXT_STACK
, *PACTIVATION_CONTEXT_STACK
;
799 ACCESS_MASK AccessMask
;
803 // Information Structures for RTL Debug Functions
805 typedef struct _RTL_PROCESS_MODULE_INFORMATION
812 USHORT LoadOrderIndex
;
813 USHORT InitOrderIndex
;
815 USHORT OffsetToFileName
;
816 CHAR FullPathName
[256];
817 } RTL_PROCESS_MODULE_INFORMATION
, *PRTL_PROCESS_MODULE_INFORMATION
;
819 typedef struct _RTL_PROCESS_MODULES
821 ULONG NumberOfModules
;
822 RTL_PROCESS_MODULE_INFORMATION Modules
[1];
823 } RTL_PROCESS_MODULES
, *PRTL_PROCESS_MODULES
;
825 typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX
828 RTL_PROCESS_MODULE_INFORMATION BaseInfo
;
832 } RTL_PROCESS_MODULE_INFORMATION_EX
, *PRTL_PROCESS_MODULE_INFORMATION_EX
;
834 typedef struct _RTL_HEAP_TAG_INFO
836 ULONG NumberOfAllocations
;
838 ULONG BytesAllocated
;
839 } RTL_HEAP_TAG_INFO
, *PRTL_HEAP_TAG_INFO
;
841 typedef struct _RTL_HEAP_USAGE_ENTRY
843 struct _RTL_HEAP_USAGE_ENTRY
*Next
;
844 } RTL_HEAP_USAGE_ENTRY
, *PRTL_HEAP_USAGE_ENTRY
;
846 typedef struct _RTL_HEAP_USAGE
849 ULONG BytesAllocated
;
850 ULONG BytesCommitted
;
852 ULONG BytesReservedMaximum
;
853 PRTL_HEAP_USAGE_ENTRY Entries
;
854 PRTL_HEAP_USAGE_ENTRY AddedEntries
;
855 PRTL_HEAP_USAGE_ENTRY RemovedEntries
;
857 } RTL_HEAP_USAGE
, *PRTL_HEAP_USAGE
;
859 typedef struct _RTL_HEAP_INFORMATION
863 USHORT EntryOverhead
;
864 USHORT CreatorBackTraceIndex
;
865 ULONG BytesAllocated
;
866 ULONG BytesCommitted
;
868 ULONG NumberOfEntries
;
869 ULONG NumberOfPseudoTags
;
870 ULONG PseudoTagGranularity
;
874 } RTL_HEAP_INFORMATION
, *PRTL_HEAP_INFORMATION
;
876 typedef struct _RTL_PROCESS_HEAPS
879 RTL_HEAP_INFORMATION Heaps
[1];
880 } RTL_PROCESS_HEAPS
, *PRTL_PROCESS_HEAPS
;
882 typedef struct _RTL_PROCESS_LOCK_INFORMATION
886 USHORT CreatorBackTraceIndex
;
889 ULONG ContentionCount
;
891 ULONG RecursionCount
;
892 ULONG NumberOfSharedWaiters
;
893 ULONG NumberOfExclusiveWaiters
;
894 } RTL_PROCESS_LOCK_INFORMATION
, *PRTL_PROCESS_LOCK_INFORMATION
;
896 typedef struct _RTL_PROCESS_LOCKS
899 RTL_PROCESS_LOCK_INFORMATION Locks
[1];
900 } RTL_PROCESS_LOCKS
, *PRTL_PROCESS_LOCKS
;
902 typedef struct _RTL_PROCESS_BACKTRACE_INFORMATION
904 PVOID SymbolicBackTrace
;
909 } RTL_PROCESS_BACKTRACE_INFORMATION
, *PRTL_PROCESS_BACKTRACE_INFORMATION
;
911 typedef struct _RTL_PROCESS_BACKTRACES
913 ULONG CommittedMemory
;
914 ULONG ReservedMemory
;
915 ULONG NumberOfBackTraceLookups
;
916 ULONG NumberOfBackTraces
;
917 RTL_PROCESS_BACKTRACE_INFORMATION BackTraces
[1];
918 } RTL_PROCESS_BACKTRACES
, *PRTL_PROCESS_BACKTRACES
;
920 typedef struct _RTL_PROCESS_VERIFIER_OPTIONS
926 // Option array continues below
928 } RTL_PROCESS_VERIFIER_OPTIONS
, *PRTL_PROCESS_VERIFIER_OPTIONS
;
930 typedef struct _RTL_DEBUG_INFORMATION
932 HANDLE SectionHandleClient
;
933 PVOID ViewBaseClient
;
934 PVOID ViewBaseTarget
;
936 HANDLE EventPairClient
;
937 PVOID EventPairTarget
;
938 HANDLE TargetProcessId
;
939 HANDLE TargetThreadHandle
;
946 PRTL_PROCESS_MODULES Modules
;
947 PRTL_PROCESS_MODULE_INFORMATION_EX ModulesEx
;
949 PRTL_PROCESS_BACKTRACES BackTraces
;
950 PRTL_PROCESS_HEAPS Heaps
;
951 PRTL_PROCESS_LOCKS Locks
;
953 HANDLE TargetProcessHandle
;
954 RTL_PROCESS_VERIFIER_OPTIONS VerifierOptions
;
956 HANDLE CriticalSectionHandle
;
957 HANDLE CriticalSectionOwnerThread
;
959 } RTL_DEBUG_INFORMATION
, *PRTL_DEBUG_INFORMATION
;
962 // Unload Event Trace Structure for RtlGetUnloadEventTrace
964 typedef struct _RTL_UNLOAD_EVENT_TRACE
972 } RTL_UNLOAD_EVENT_TRACE
, *PRTL_UNLOAD_EVENT_TRACE
;
975 // RTL Handle Structures
977 typedef struct _RTL_HANDLE_TABLE_ENTRY
982 struct _RTL_HANDLE_TABLE_ENTRY
*NextFree
;
984 } RTL_HANDLE_TABLE_ENTRY
, *PRTL_HANDLE_TABLE_ENTRY
;
986 typedef struct _RTL_HANDLE_TABLE
988 ULONG MaximumNumberOfHandles
;
989 ULONG SizeOfHandleTableEntry
;
991 PRTL_HANDLE_TABLE_ENTRY FreeHandles
;
992 PRTL_HANDLE_TABLE_ENTRY CommittedHandles
;
993 PRTL_HANDLE_TABLE_ENTRY UnCommittedHandles
;
994 PRTL_HANDLE_TABLE_ENTRY MaxReservedHandles
;
995 } RTL_HANDLE_TABLE
, *PRTL_HANDLE_TABLE
;
1000 typedef struct _EXCEPTION_REGISTRATION_RECORD
1002 struct _EXCEPTION_REGISTRATION_RECORD
*Next
;
1003 PEXCEPTION_ROUTINE Handler
;
1004 } EXCEPTION_REGISTRATION_RECORD
, *PEXCEPTION_REGISTRATION_RECORD
;
1007 // Current Directory Structures
1009 typedef struct _CURDIR
1011 UNICODE_STRING DosPath
;
1015 typedef struct _RTL_DRIVE_LETTER_CURDIR
1020 UNICODE_STRING DosPath
;
1021 } RTL_DRIVE_LETTER_CURDIR
, *PRTL_DRIVE_LETTER_CURDIR
;
1023 typedef struct _RTL_PERTHREAD_CURDIR
1025 PRTL_DRIVE_LETTER_CURDIR CurrentDirectories
;
1026 PUNICODE_STRING ImageName
;
1028 } RTL_PERTHREAD_CURDIR
, *PRTL_PERTHREAD_CURDIR
;
1031 // Private State structure for RtlAcquirePrivilege/RtlReleasePrivilege
1033 typedef struct _RTL_ACQUIRE_STATE
1036 HANDLE OldImpersonationToken
;
1037 PTOKEN_PRIVILEGES OldPrivileges
;
1038 PTOKEN_PRIVILEGES NewPrivileges
;
1040 UCHAR OldPrivBuffer
[1024];
1041 } RTL_ACQUIRE_STATE
, *PRTL_ACQUIRE_STATE
;
1043 #ifndef NTOS_MODE_USER
1046 // RTL Critical Section Structures
1048 typedef struct _RTL_CRITICAL_SECTION_DEBUG
1051 USHORT CreatorBackTraceIndex
;
1052 struct _RTL_CRITICAL_SECTION
*CriticalSection
;
1053 LIST_ENTRY ProcessLocksList
;
1055 ULONG ContentionCount
;
1057 } RTL_CRITICAL_SECTION_DEBUG
, *PRTL_CRITICAL_SECTION_DEBUG
, RTL_RESOURCE_DEBUG
, *PRTL_RESOURCE_DEBUG
;
1059 typedef struct _RTL_CRITICAL_SECTION
1061 PRTL_CRITICAL_SECTION_DEBUG DebugInfo
;
1063 LONG RecursionCount
;
1064 HANDLE OwningThread
;
1065 HANDLE LockSemaphore
;
1066 ULONG_PTR SpinCount
;
1067 } RTL_CRITICAL_SECTION
, *PRTL_CRITICAL_SECTION
;
1072 // RTL Private Heap Structures
1074 typedef struct _HEAP_LOCK
1078 RTL_CRITICAL_SECTION CriticalSection
;
1079 #ifndef NTOS_MODE_USER
1082 UCHAR Padding
[0x68]; /* Max ERESOURCE size for x64 build. Needed because RTL is built only once */
1084 } HEAP_LOCK
, *PHEAP_LOCK
;
1087 // RTL Range List Structures
1089 typedef struct _RTL_RANGE_LIST
1091 LIST_ENTRY ListHead
;
1095 } RTL_RANGE_LIST
, *PRTL_RANGE_LIST
;
1097 typedef struct _RTL_RANGE
1105 } RTL_RANGE
, *PRTL_RANGE
;
1107 typedef struct _RANGE_LIST_ITERATOR
1109 PLIST_ENTRY RangeListHead
;
1110 PLIST_ENTRY MergedHead
;
1113 } RTL_RANGE_LIST_ITERATOR
, *PRTL_RANGE_LIST_ITERATOR
;
1118 typedef struct _RTL_RESOURCE
1120 RTL_CRITICAL_SECTION Lock
;
1121 HANDLE SharedSemaphore
;
1122 ULONG SharedWaiters
;
1123 HANDLE ExclusiveSemaphore
;
1124 ULONG ExclusiveWaiters
;
1126 HANDLE OwningThread
;
1129 } RTL_RESOURCE
, *PRTL_RESOURCE
;
1132 // Structures for RtlCreateUserProcess
1134 typedef struct _RTL_USER_PROCESS_PARAMETERS
1136 ULONG MaximumLength
;
1140 HANDLE ConsoleHandle
;
1142 HANDLE StandardInput
;
1143 HANDLE StandardOutput
;
1144 HANDLE StandardError
;
1145 CURDIR CurrentDirectory
;
1146 UNICODE_STRING DllPath
;
1147 UNICODE_STRING ImagePathName
;
1148 UNICODE_STRING CommandLine
;
1156 ULONG FillAttribute
;
1158 ULONG ShowWindowFlags
;
1159 UNICODE_STRING WindowTitle
;
1160 UNICODE_STRING DesktopInfo
;
1161 UNICODE_STRING ShellInfo
;
1162 UNICODE_STRING RuntimeData
;
1163 RTL_DRIVE_LETTER_CURDIR CurrentDirectories
[32];
1164 } RTL_USER_PROCESS_PARAMETERS
, *PRTL_USER_PROCESS_PARAMETERS
;
1166 typedef struct _RTL_USER_PROCESS_INFORMATION
1169 HANDLE ProcessHandle
;
1170 HANDLE ThreadHandle
;
1172 SECTION_IMAGE_INFORMATION ImageInformation
;
1173 } RTL_USER_PROCESS_INFORMATION
, *PRTL_USER_PROCESS_INFORMATION
;
1176 // RTL Atom Table Structures
1178 typedef struct _RTL_ATOM_TABLE_ENTRY
1180 struct _RTL_ATOM_TABLE_ENTRY
*HashLink
;
1183 USHORT ReferenceCount
;
1187 } RTL_ATOM_TABLE_ENTRY
, *PRTL_ATOM_TABLE_ENTRY
;
1189 typedef struct _RTL_ATOM_TABLE
1194 #ifdef NTOS_MODE_USER
1195 RTL_CRITICAL_SECTION CriticalSection
;
1197 FAST_MUTEX FastMutex
;
1202 #ifdef NTOS_MODE_USER
1203 RTL_HANDLE_TABLE RtlHandleTable
;
1205 PHANDLE_TABLE ExHandleTable
;
1208 ULONG NumberOfBuckets
;
1209 PRTL_ATOM_TABLE_ENTRY Buckets
[1];
1210 } RTL_ATOM_TABLE
, *PRTL_ATOM_TABLE
;
1214 // System Time and Timezone Structures
1216 typedef struct _SYSTEMTIME
1225 USHORT wMilliseconds
;
1226 } SYSTEMTIME
, *PSYSTEMTIME
, *LPSYSTEMTIME
;
1228 typedef struct _TIME_ZONE_INFORMATION
1231 WCHAR StandardName
[32];
1232 SYSTEMTIME StandardDate
;
1234 WCHAR DaylightName
[32];
1235 SYSTEMTIME DaylightDate
;
1237 } TIME_ZONE_INFORMATION
, *PTIME_ZONE_INFORMATION
, *LPTIME_ZONE_INFORMATION
;
1241 // Native version of Timezone Structure
1243 typedef LPTIME_ZONE_INFORMATION PRTL_TIME_ZONE_INFORMATION
;
1248 typedef struct _RTL_PATCH_HEADER
1250 LIST_ENTRY PatchList
;
1251 PVOID PatchImageBase
;
1252 struct _RTL_PATCH_HEADER
*NextPath
;
1255 struct _HOTPATCH_HEADER
*HotpatchHeader
;
1256 UNICODE_STRING TargetDllName
;
1257 PVOID TargetDllBase
;
1258 PLDR_DATA_TABLE_ENTRY TargetLdrDataTableEntry
;
1259 PLDR_DATA_TABLE_ENTRY PatchLdrDataTableEntry
;
1260 struct _SYSTEM_HOTPATCH_CODE_INFORMATION
*CodeInfo
;
1261 } RTL_PATCH_HEADER
, *PRTL_PATCH_HEADER
;
1264 // Header for NLS Files
1266 typedef struct _NLS_FILE_HEADER
1270 USHORT MaximumCharacterSize
;
1272 USHORT UniDefaultChar
;
1273 USHORT TransDefaultChar
;
1274 USHORT TransUniDefaultChar
;
1275 UCHAR LeadByte
[MAXIMUM_LEADBYTES
];
1276 } NLS_FILE_HEADER
, *PNLS_FILE_HEADER
;
1281 typedef struct _RTL_STACK_TRACE_ENTRY
1283 struct _RTL_STACK_TRACE_ENTRY
*HashChain
;
1287 PVOID BackTrace
[32];
1288 } RTL_STACK_TRACE_ENTRY
, *PRTL_STACK_TRACE_ENTRY
;
1290 typedef struct _STACK_TRACE_DATABASE
1292 RTL_CRITICAL_SECTION CriticalSection
;
1293 } STACK_TRACE_DATABASE
, *PSTACK_TRACE_DATABASE
;
1295 typedef struct _RTL_TRACE_BLOCK
1303 struct _RTL_TRACE_BLOCK
*Next
;
1305 } RTL_TRACE_BLOCK
, *PRTL_TRACE_BLOCK
;
1307 #ifndef NTOS_MODE_USER
1310 // Message Resource Entry, Block and Data
1312 typedef struct _MESSAGE_RESOURCE_ENTRY
1316 UCHAR Text
[ANYSIZE_ARRAY
];
1317 } MESSAGE_RESOURCE_ENTRY
, *PMESSAGE_RESOURCE_ENTRY
;
1319 typedef struct _MESSAGE_RESOURCE_BLOCK
1323 ULONG OffsetToEntries
;
1324 } MESSAGE_RESOURCE_BLOCK
, *PMESSAGE_RESOURCE_BLOCK
;
1326 typedef struct _MESSAGE_RESOURCE_DATA
1328 ULONG NumberOfBlocks
;
1329 MESSAGE_RESOURCE_BLOCK Blocks
[ANYSIZE_ARRAY
];
1330 } MESSAGE_RESOURCE_DATA
, *PMESSAGE_RESOURCE_DATA
;