1 #ifndef __NTDDK_EX__H__
2 #define __NTDDK_EX__H__
7 typedef enum _SYSTEM_INFORMATION_CLASS
9 SystemBasicInformation
,
10 SystemProcessorInformation
,
11 SystemPerformanceInformation
,
12 SystemTimeOfDayInformation
,
13 SystemPathInformation
, /// Obsolete: Use KUSER_SHARED_DATA
14 SystemProcessInformation
,
15 SystemCallCountInformation
,
16 SystemDeviceInformation
,
17 SystemProcessorPerformanceInformation
,
18 SystemFlagsInformation
,
19 SystemCallTimeInformation
,
20 SystemModuleInformation
,
21 SystemLocksInformation
,
22 SystemStackTraceInformation
,
23 SystemPagedPoolInformation
,
24 SystemNonPagedPoolInformation
,
25 SystemHandleInformation
,
26 SystemObjectInformation
,
27 SystemPageFileInformation
,
28 SystemVdmInstemulInformation
,
29 SystemVdmBopInformation
,
30 SystemFileCacheInformation
,
31 SystemPoolTagInformation
,
32 SystemInterruptInformation
,
33 SystemDpcBehaviorInformation
,
34 SystemFullMemoryInformation
,
35 SystemLoadGdiDriverInformation
,
36 SystemUnloadGdiDriverInformation
,
37 SystemTimeAdjustmentInformation
,
38 SystemSummaryMemoryInformation
,
39 SystemMirrorMemoryInformation
,
40 SystemPerformanceTraceInformation
,
42 SystemExceptionInformation
,
43 SystemCrashDumpStateInformation
,
44 SystemKernelDebuggerInformation
,
45 SystemContextSwitchInformation
,
46 SystemRegistryQuotaInformation
,
47 SystemExtendServiceTableInformation
,
48 SystemPrioritySeperation
,
49 SystemPlugPlayBusInformation
,
50 SystemDockInformation
,
51 SystemPowerInformationNative
,
52 SystemProcessorSpeedInformation
,
53 SystemCurrentTimeZoneInformation
,
54 SystemLookasideInformation
,
55 SystemTimeSlipNotification
,
58 SystemSessionInformation
,
59 SystemRangeStartInformation
,
60 SystemVerifierInformation
,
62 SystemSessionProcessesInformation
,
63 SystemLoadGdiDriverInSystemSpaceInformation
,
64 SystemNumaProcessorMap
,
65 SystemPrefetcherInformation
,
66 SystemExtendedProcessInformation
,
67 SystemRecommendedSharedDataAlignment
,
69 SystemNumaAvailableMemory
,
70 SystemProcessorPowerInformation
,
71 SystemEmulationBasicInformation
,
72 SystemEmulationProcessorInformation
,
73 SystemExtendedHanfleInformation
,
74 SystemLostDelayedWriteInformation
,
75 SystemBigPoolInformation
,
76 SystemSessionPoolTagInformation
,
77 SystemSessionMappedViewInformation
,
78 SystemHotpatchInformation
,
79 SystemObjectSecurityMode
,
80 SystemWatchDogTimerHandler
,
81 SystemWatchDogTimerInformation
,
82 SystemLogicalProcessorInformation
,
83 SystemWo64SharedInformationObosolete
,
84 SystemRegisterFirmwareTableInformationHandler
,
85 SystemFirmwareTableInformation
,
86 SystemModuleInformationEx
,
87 SystemVerifierTriageInformation
,
88 SystemSuperfetchInformation
,
89 SystemMemoryListInformation
,
90 SystemFileCacheInformationEx
,
91 SystemThreadPriorityClientIdInformation
,
92 SystemProcessorIdleCycleTimeInformation
,
93 SystemVerifierCancellationInformation
,
94 SystemProcessorPowerInformationEx
,
95 SystemRefTraceInformation
,
96 SystemSpecialPoolInformation
,
97 SystemProcessIdInformation
,
98 SystemErrorPortInformation
,
99 SystemBootEnvironmentInformation
,
100 SystemHypervisorInformation
,
101 SystemVerifierInformationEx
,
102 SystemTimeZoneInformation
,
103 SystemImageFileExecutionOptionsInformation
,
104 SystemCoverageInformation
,
105 SystemPrefetchPathInformation
,
106 SystemVerifierFaultsInformation
,
108 } SYSTEM_INFORMATION_CLASS
;
113 ZwQuerySystemInformation(
114 IN SYSTEM_INFORMATION_CLASS SystemInfoClass
,
115 OUT PVOID SystemInfoBuffer
,
116 IN ULONG SystemInfoBufferSize
,
117 OUT PULONG BytesReturned OPTIONAL
123 NtQuerySystemInformation(
124 IN SYSTEM_INFORMATION_CLASS SystemInfoClass
,
125 OUT PVOID SystemInfoBuffer
,
126 IN ULONG SystemInfoBufferSize
,
127 OUT PULONG BytesReturned OPTIONAL
130 typedef struct _SYSTEM_BASIC_INFORMATION
{
132 ULONG TimerResolution
;
134 ULONG NumberOfPhysicalPages
;
135 ULONG LowestPhysicalPageNumber
;
136 ULONG HighestPhysicalPageNumber
;
137 ULONG AllocationGranularity
;
138 ULONG MinimumUserModeAddress
;
139 ULONG MaximumUserModeAddress
;
140 KAFFINITY ActiveProcessorsAffinityMask
;
141 CCHAR NumberOfProcessors
;
142 } SYSTEM_BASIC_INFORMATION
, *PSYSTEM_BASIC_INFORMATION
;
144 typedef struct _SYSTEM_MODULE_ENTRY
148 PVOID ModuleBaseAddress
;
151 ULONG ModuleEntryIndex
;
152 USHORT ModuleNameLength
;
153 USHORT ModuleNameOffset
;
154 CHAR ModuleName
[256];
155 } SYSTEM_MODULE_ENTRY
, * PSYSTEM_MODULE_ENTRY
;
157 typedef struct _SYSTEM_MODULE_INFORMATION
160 SYSTEM_MODULE_ENTRY Module
[1];
161 } SYSTEM_MODULE_INFORMATION
, *PSYSTEM_MODULE_INFORMATION
;
163 typedef unsigned short WORD
;
164 //typedef unsigned int BOOL;
165 typedef unsigned long DWORD
;
166 typedef unsigned char BYTE
;
169 typedef struct _LDR_DATA_TABLE_ENTRY
{
170 LIST_ENTRY LoadOrder
;
171 LIST_ENTRY MemoryOrder
;
172 LIST_ENTRY InitializationOrder
;
173 PVOID ModuleBaseAddress
;
176 UNICODE_STRING FullModuleName
;
177 UNICODE_STRING ModuleName
;
184 PVOID SectionPointer
;
189 } LDR_DATA_TABLE_ENTRY
, *PLDR_DATA_TABLE_ENTRY
;
191 typedef struct _PEB_LDR_DATA
{
195 LIST_ENTRY LoadOrder
;
196 LIST_ENTRY MemoryOrder
;
197 LIST_ENTRY InitializationOrder
;
198 } PEB_LDR_DATA
, *PPEB_LDR_DATA
;
200 typedef struct _PEB_FREE_BLOCK
{
201 struct _PEB_FREE_BLOCK
*Next
;
203 } PEB_FREE_BLOCK
, *PPEB_FREE_BLOCK
;
205 #define GDI_HANDLE_BUFFER_SIZE 34
207 #define TLS_MINIMUM_AVAILABLE 64 // winnt
209 typedef struct _PEB
{
210 BOOLEAN InheritedAddressSpace
; // These four fields cannot change unless the
211 BOOLEAN ReadImageFileExecOptions
; //
212 BOOLEAN BeingDebugged
; //
213 BOOLEAN SpareBool
; //
214 HANDLE Mutant
; // INITIAL_PEB structure is also updated.
216 PVOID ImageBaseAddress
;
218 struct _RTL_USER_PROCESS_PARAMETERS
*ProcessParameters
;
222 PVOID FastPebLockRoutine
;
223 PVOID FastPebUnlockRoutine
;
224 ULONG EnvironmentUpdateCount
;
225 PVOID KernelCallbackTable
;
226 HANDLE EventLogSection
;
228 PPEB_FREE_BLOCK FreeList
;
229 ULONG TlsExpansionCounter
;
231 ULONG TlsBitmapBits
[2]; // relates to TLS_MINIMUM_AVAILABLE
232 PVOID ReadOnlySharedMemoryBase
;
233 PVOID ReadOnlySharedMemoryHeap
;
234 PVOID
*ReadOnlyStaticServerData
;
235 PVOID AnsiCodePageData
;
236 PVOID OemCodePageData
;
237 PVOID UnicodeCaseTableData
;
239 // Useful information for LdrpInitialize
240 ULONG NumberOfProcessors
;
243 // Passed up from MmCreatePeb from Session Manager registry key
245 LARGE_INTEGER CriticalSectionTimeout
;
246 ULONG HeapSegmentReserve
;
247 ULONG HeapSegmentCommit
;
248 ULONG HeapDeCommitTotalFreeThreshold
;
249 ULONG HeapDeCommitFreeBlockThreshold
;
251 // Where heap manager keeps track of all heaps created for a process
252 // Fields initialized by MmCreatePeb. ProcessHeaps is initialized
253 // to point to the first free byte after the PEB and MaximumNumberOfHeaps
254 // is computed from the page size used to hold the PEB, less the fixed
255 // size of this data structure.
258 ULONG MaximumNumberOfHeaps
;
263 PVOID GdiSharedHandleTable
;
264 PVOID ProcessStarterHelper
;
265 PVOID GdiDCAttributeList
;
268 // Following fields filled in by MmCreatePeb from system values and/or
271 ULONG OSMajorVersion
;
272 ULONG OSMinorVersion
;
275 ULONG ImageSubsystem
;
276 ULONG ImageSubsystemMajorVersion
;
277 ULONG ImageSubsystemMinorVersion
;
278 ULONG ImageProcessAffinityMask
;
279 ULONG GdiHandleBuffer
[GDI_HANDLE_BUFFER_SIZE
];
283 // Gdi command batching
286 #define GDI_BATCH_BUFFER_SIZE 310
288 typedef struct _GDI_TEB_BATCH
{
291 ULONG Buffer
[GDI_BATCH_BUFFER_SIZE
];
292 } GDI_TEB_BATCH
,*PGDI_TEB_BATCH
;
295 // TEB - The thread environment block
298 #define STATIC_UNICODE_BUFFER_LENGTH 261
299 #define WIN32_CLIENT_INFO_LENGTH 31
300 #define WIN32_CLIENT_INFO_SPIN_COUNT 1
302 typedef struct _TEB
{
304 PVOID EnvironmentPointer
;
306 PVOID ActiveRpcHandle
;
307 PVOID ThreadLocalStoragePointer
;
308 PPEB ProcessEnvironmentBlock
;
309 ULONG LastErrorValue
;
310 ULONG CountOfOwnedCriticalSections
;
311 PVOID CsrClientThread
;
312 PVOID Win32ThreadInfo
; // PtiCurrent
313 ULONG Win32ClientInfo
[WIN32_CLIENT_INFO_LENGTH
]; // User32 Client Info
314 PVOID WOW32Reserved
; // used by WOW
316 ULONG FpSoftwareStatusRegister
;
317 PVOID SystemReserved1
[54]; // Used by FP emulator
318 PVOID Spare1
; // unused
319 NTSTATUS ExceptionCode
; // for RaiseUserException
320 UCHAR SpareBytes1
[40];
321 PVOID SystemReserved2
[10]; // Used by user/console for temp obja
322 GDI_TEB_BATCH GdiTebBatch
; // Gdi batching
326 CLIENT_ID RealClientId
;
327 HANDLE GdiCachedProcessHandle
;
330 PVOID GdiThreadLocalInfo
;
331 PVOID UserReserved
[5]; // unused
332 PVOID glDispatchTable
[280]; // OpenGL
333 ULONG glReserved1
[26]; // OpenGL
334 PVOID glReserved2
; // OpenGL
335 PVOID glSectionInfo
; // OpenGL
336 PVOID glSection
; // OpenGL
337 PVOID glTable
; // OpenGL
338 PVOID glCurrentRC
; // OpenGL
339 PVOID glContext
; // OpenGL
340 ULONG LastStatusValue
;
341 UNICODE_STRING StaticUnicodeString
;
342 WCHAR StaticUnicodeBuffer
[STATIC_UNICODE_BUFFER_LENGTH
];
343 PVOID DeallocationStack
;
344 PVOID TlsSlots
[TLS_MINIMUM_AVAILABLE
];
347 PVOID ReservedForNtRpc
;
348 PVOID DbgSsReserved
[2];
349 ULONG HardErrorsAreDisabled
;
350 PVOID Instrumentation
[16];
351 PVOID WinSockData
; // WinSock
356 PVOID ReservedForOle
;
357 ULONG WaitingOnLoaderLock
;
361 typedef struct _KTHREAD_HDR
{
364 // The dispatcher header and mutant listhead are faifly infrequently
365 // referenced, but pad the thread to a 32-byte boundary (assumption
366 // that pool allocation is in units of 32-bytes).
369 DISPATCHER_HEADER Header
;
370 LIST_ENTRY MutantListHead
;
373 // The following fields are referenced during trap, interrupts, or
376 // N.B. The Teb address and TlsArray are loaded as a quadword quantity
377 // on MIPS and therefore must to on a quadword boundary.
387 BOOLEAN Alerted
[MaximumMode
];
392 /* KAPC_STATE ApcState;
393 ULONG ContextSwitches;
396 // The following fields are referenced during wait operations.
401 KPROCESSOR_MODE WaitMode;
404 PRKWAIT_BLOCK WaitBlockList;
405 LIST_ENTRY WaitListEntry;
408 UCHAR DecrementCount;
409 SCHAR PriorityDecrement;
411 KWAIT_BLOCK WaitBlock[THREAD_WAIT_OBJECTS + 1];
413 ULONG KernelApcDisable;
414 KAFFINITY UserAffinity;
415 BOOLEAN SystemAffinityActive;
418 // struct _ECHANNEL *Channel;
420 // PCHANNEL_MESSAGE SystemView;
421 // PCHANNEL_MESSAGE ThreadView;
424 // The following fields are referenced during queue operations.
428 KSPIN_LOCK ApcQueueLock;
430 LIST_ENTRY QueueListEntry;
433 // The following fields are referenced during read and find ready
439 BOOLEAN ProcessReadyQueue;
440 BOOLEAN KernelStackResident;
444 // The following fields are referenced suring system calls.
449 PKTRAP_FRAME TrapFrame;
450 PKAPC_STATE ApcStatePointer[2];
451 UCHAR EnableStackSwap;
457 // The following entries are reference during clock interrupts.
464 // The following fileds are referenced during APC queuing and process
468 KAPC_STATE SavedApcState;
471 BOOLEAN ApcQueueable;
472 BOOLEAN AutoAlignment;
475 // The following fields are referenced when the thread is initialized
476 // and very infrequently thereafter.
481 KSEMAPHORE SuspendSemaphore;
482 LIST_ENTRY ThreadListEntry;
485 // N.B. The below four UCHARs share the same DWORD and are modified
486 // by other threads. Therefore, they must ALWAYS be modified
487 // under the dispatcher lock to prevent granularity problems
488 // on Alpha machines.
492 UCHAR IdealProcessor;
495 } KTHREAD_HDR
, *PKTHREAD_HDR
;
498 typedef struct _IMAGE_DOS_HEADER
{ // DOS .EXE header
499 WORD e_magic
; // Magic number
500 WORD e_cblp
; // Bytes on last page of file
501 WORD e_cp
; // Pages in file
502 WORD e_crlc
; // Relocations
503 WORD e_cparhdr
; // Size of header in paragraphs
504 WORD e_minalloc
; // Minimum extra paragraphs needed
505 WORD e_maxalloc
; // Maximum extra paragraphs needed
506 WORD e_ss
; // Initial (relative) SS value
507 WORD e_sp
; // Initial SP value
508 WORD e_csum
; // Checksum
509 WORD e_ip
; // Initial IP value
510 WORD e_cs
; // Initial (relative) CS value
511 WORD e_lfarlc
; // File address of relocation table
512 WORD e_ovno
; // Overlay number
513 WORD e_res
[4]; // Reserved words
514 WORD e_oemid
; // OEM identifier (for e_oeminfo)
515 WORD e_oeminfo
; // OEM information; e_oemid specific
516 WORD e_res2
[10]; // Reserved words
517 LONG e_lfanew
; // File address of new exe header
518 } IMAGE_DOS_HEADER
, *PIMAGE_DOS_HEADER
;
520 typedef struct _IMAGE_FILE_HEADER
{
522 WORD NumberOfSections
;
524 DWORD PointerToSymbolTable
;
525 DWORD NumberOfSymbols
;
526 WORD SizeOfOptionalHeader
;
527 WORD Characteristics
;
528 } IMAGE_FILE_HEADER
, *PIMAGE_FILE_HEADER
;
530 typedef struct _IMAGE_DATA_DIRECTORY
{
531 DWORD VirtualAddress
;
533 } IMAGE_DATA_DIRECTORY
, *PIMAGE_DATA_DIRECTORY
;
534 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
537 typedef struct _IMAGE_OPTIONAL_HEADER
{
543 BYTE MajorLinkerVersion
;
544 BYTE MinorLinkerVersion
;
546 DWORD SizeOfInitializedData
;
547 DWORD SizeOfUninitializedData
;
548 DWORD AddressOfEntryPoint
;
553 // NT additional fields.
557 DWORD SectionAlignment
;
559 WORD MajorOperatingSystemVersion
;
560 WORD MinorOperatingSystemVersion
;
561 WORD MajorImageVersion
;
562 WORD MinorImageVersion
;
563 WORD MajorSubsystemVersion
;
564 WORD MinorSubsystemVersion
;
565 DWORD Win32VersionValue
;
570 WORD DllCharacteristics
;
571 DWORD SizeOfStackReserve
;
572 DWORD SizeOfStackCommit
;
573 DWORD SizeOfHeapReserve
;
574 DWORD SizeOfHeapCommit
;
576 DWORD NumberOfRvaAndSizes
;
577 IMAGE_DATA_DIRECTORY DataDirectory
[IMAGE_NUMBEROF_DIRECTORY_ENTRIES
];
578 } IMAGE_OPTIONAL_HEADER32
, *PIMAGE_OPTIONAL_HEADER32
;
580 typedef struct _IMAGE_NT_HEADERS
{
582 IMAGE_FILE_HEADER FileHeader
;
583 IMAGE_OPTIONAL_HEADER32 OptionalHeader
;
584 } IMAGE_NT_HEADERS32
, *PIMAGE_NT_HEADERS32
;
585 typedef IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS
;
586 typedef PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS
;
588 #define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory
590 typedef struct _IMAGE_EXPORT_DIRECTORY
{
591 DWORD Characteristics
;
597 DWORD NumberOfFunctions
;
599 DWORD AddressOfFunctions
; // RVA from base of image
600 DWORD AddressOfNames
; // RVA from base of image
601 DWORD AddressOfNameOrdinals
; // RVA from base of image
602 } IMAGE_EXPORT_DIRECTORY
, *PIMAGE_EXPORT_DIRECTORY
;
613 HalQueryDisplayParameters (
614 OUT PULONG WidthInCharacters
,
615 OUT PULONG HeightInLines
,
616 OUT PULONG CursorColumn
,
622 HalSetDisplayParameters (
623 IN ULONG CursorColumn
,
627 extern ULONG NtBuildNumber
;
629 #endif //__NTDDK_EX__H__