1 ////////////////////////////////////////////////////////////////////
2 // Copyright (C) Alexander Telyatnikov, Ivan Keliukh, Yegor Anchishkin, SKIF Software, 1999-2013. Kiev, Ukraine
4 ////////////////////////////////////////////////////////////////////
6 #ifndef __NTDDK_EX__H__
7 #define __NTDDK_EX__H__
9 typedef enum _SYSTEM_INFORMATION_CLASS
{
10 SystemBasicInformation
,
11 SystemProcessorInformation
,
12 SystemPerformanceInformation
,
13 SystemTimeOfDayInformation
,
14 SystemPathInformation
,
15 SystemProcessInformation
,
16 SystemCallCountInformation
,
17 SystemDeviceInformation
,
18 SystemProcessorPerformanceInformation
,
19 SystemFlagsInformation
,
20 SystemCallTimeInformation
,
21 SystemModuleInformation
,
22 SystemLocksInformation
,
23 SystemStackTraceInformation
,
24 SystemPagedPoolInformation
,
25 SystemNonPagedPoolInformation
,
26 SystemHandleInformation
,
27 SystemObjectInformation
,
28 SystemPageFileInformation
,
29 SystemVdmInstemulInformation
,
30 SystemVdmBopInformation
,
31 SystemFileCacheInformation
,
32 SystemPoolTagInformation
,
33 SystemInterruptInformation
,
34 SystemDpcBehaviorInformation
,
35 SystemFullMemoryInformation
,
36 SystemLoadGdiDriverInformation
,
37 SystemUnloadGdiDriverInformation
,
38 SystemTimeAdjustmentInformation
,
39 SystemSummaryMemoryInformation
,
40 SystemNextEventIdInformation
,
41 SystemEventIdsInformation
,
42 SystemCrashDumpInformation
,
43 SystemExceptionInformation
,
44 SystemCrashDumpStateInformation
,
45 SystemKernelDebuggerInformation
,
46 SystemContextSwitchInformation
,
47 SystemRegistryQuotaInformation
,
48 SystemExtendServiceTableInformation
,
49 SystemPrioritySeperation
,
50 SystemPlugPlayBusInformation
,
51 SystemDockInformation
,
52 #if !defined PO_CB_SYSTEM_POWER_POLICY
53 SystemPowerInformation
,
55 _SystemPowerInformation
,
57 SystemProcessorSpeedInformation
,
58 SystemCurrentTimeZoneInformation
,
59 SystemLookasideInformation
60 } SYSTEM_INFORMATION_CLASS
;
66 ZwQuerySystemInformation(
67 IN SYSTEM_INFORMATION_CLASS SystemInfoClass
,
68 OUT PVOID SystemInfoBuffer
,
69 IN ULONG SystemInfoBufferSize
,
70 OUT PULONG BytesReturned OPTIONAL
73 typedef struct _SYSTEM_MODULE_ENTRY
77 PVOID ModuleBaseAddress
;
80 ULONG ModuleEntryIndex
;
81 USHORT ModuleNameLength
;
82 USHORT ModuleNameOffset
;
83 CHAR ModuleName
[256];
84 } SYSTEM_MODULE_ENTRY
, * PSYSTEM_MODULE_ENTRY
;
86 typedef struct _SYSTEM_MODULE_INFORMATION
89 SYSTEM_MODULE_ENTRY Module
[1];
90 } SYSTEM_MODULE_INFORMATION
, *PSYSTEM_MODULE_INFORMATION
;
92 typedef unsigned short WORD
;
93 typedef unsigned int BOOL
;
94 typedef unsigned long DWORD
;
95 typedef unsigned char BYTE
;
98 typedef struct _IMAGE_DOS_HEADER
{ // DOS .EXE header
99 WORD e_magic
; // Magic number
100 WORD e_cblp
; // Bytes on last page of file
101 WORD e_cp
; // Pages in file
102 WORD e_crlc
; // Relocations
103 WORD e_cparhdr
; // Size of header in paragraphs
104 WORD e_minalloc
; // Minimum extra paragraphs needed
105 WORD e_maxalloc
; // Maximum extra paragraphs needed
106 WORD e_ss
; // Initial (relative) SS value
107 WORD e_sp
; // Initial SP value
108 WORD e_csum
; // Checksum
109 WORD e_ip
; // Initial IP value
110 WORD e_cs
; // Initial (relative) CS value
111 WORD e_lfarlc
; // File address of relocation table
112 WORD e_ovno
; // Overlay number
113 WORD e_res
[4]; // Reserved words
114 WORD e_oemid
; // OEM identifier (for e_oeminfo)
115 WORD e_oeminfo
; // OEM information; e_oemid specific
116 WORD e_res2
[10]; // Reserved words
117 LONG e_lfanew
; // File address of new exe header
118 } IMAGE_DOS_HEADER
, *PIMAGE_DOS_HEADER
;
120 typedef struct _IMAGE_FILE_HEADER
{
122 WORD NumberOfSections
;
124 DWORD PointerToSymbolTable
;
125 DWORD NumberOfSymbols
;
126 WORD SizeOfOptionalHeader
;
127 WORD Characteristics
;
128 } IMAGE_FILE_HEADER
, *PIMAGE_FILE_HEADER
;
130 typedef struct _IMAGE_DATA_DIRECTORY
{
131 DWORD VirtualAddress
;
133 } IMAGE_DATA_DIRECTORY
, *PIMAGE_DATA_DIRECTORY
;
134 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
137 typedef struct _IMAGE_OPTIONAL_HEADER
{
143 BYTE MajorLinkerVersion
;
144 BYTE MinorLinkerVersion
;
146 DWORD SizeOfInitializedData
;
147 DWORD SizeOfUninitializedData
;
148 DWORD AddressOfEntryPoint
;
153 // NT additional fields.
157 DWORD SectionAlignment
;
159 WORD MajorOperatingSystemVersion
;
160 WORD MinorOperatingSystemVersion
;
161 WORD MajorImageVersion
;
162 WORD MinorImageVersion
;
163 WORD MajorSubsystemVersion
;
164 WORD MinorSubsystemVersion
;
165 DWORD Win32VersionValue
;
170 WORD DllCharacteristics
;
171 DWORD SizeOfStackReserve
;
172 DWORD SizeOfStackCommit
;
173 DWORD SizeOfHeapReserve
;
174 DWORD SizeOfHeapCommit
;
176 DWORD NumberOfRvaAndSizes
;
177 IMAGE_DATA_DIRECTORY DataDirectory
[IMAGE_NUMBEROF_DIRECTORY_ENTRIES
];
178 } IMAGE_OPTIONAL_HEADER32
, *PIMAGE_OPTIONAL_HEADER32
;
180 typedef struct _IMAGE_NT_HEADERS
{
182 IMAGE_FILE_HEADER FileHeader
;
183 IMAGE_OPTIONAL_HEADER32 OptionalHeader
;
184 } IMAGE_NT_HEADERS32
, *PIMAGE_NT_HEADERS32
;
185 typedef IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS
;
186 typedef PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS
;
188 #define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory
190 typedef struct _IMAGE_EXPORT_DIRECTORY
{
191 DWORD Characteristics
;
197 DWORD NumberOfFunctions
;
199 DWORD AddressOfFunctions
; // RVA from base of image
200 DWORD AddressOfNames
; // RVA from base of image
201 DWORD AddressOfNameOrdinals
; // RVA from base of image
202 } IMAGE_EXPORT_DIRECTORY
, *PIMAGE_EXPORT_DIRECTORY
;
204 #define IOCTL_DISK_GET_PARTITION_INFO_EX CTL_CODE(IOCTL_DISK_BASE, 0x0012, METHOD_BUFFERED, FILE_ANY_ACCESS)
205 #define IOCTL_DISK_GET_DRIVE_LAYOUT_EX CTL_CODE(IOCTL_DISK_BASE, 0x0014, METHOD_BUFFERED, FILE_ANY_ACCESS)
206 #define IOCTL_DISK_GET_DRIVE_GEOMETRY_EX CTL_CODE(IOCTL_DISK_BASE, 0x0028, METHOD_BUFFERED, FILE_ANY_ACCESS)
208 #define IOCTL_STORAGE_LOAD_MEDIA2 CTL_CODE(IOCTL_STORAGE_BASE, 0x0203, METHOD_BUFFERED, FILE_ANY_ACCESS)
209 #define IOCTL_STORAGE_GET_MEDIA_TYPES_EX CTL_CODE(IOCTL_STORAGE_BASE, 0x0301, METHOD_BUFFERED, FILE_ANY_ACCESS)
210 #define IOCTL_STORAGE_CHECK_VERIFY2 CTL_CODE(IOCTL_STORAGE_BASE, 0x0200, METHOD_BUFFERED, FILE_ANY_ACCESS)
212 #endif //__NTDDK_EX__H__