1 #ifndef __INCLUDE_DDK_ZWTYPES_H
2 #define __INCLUDE_DDK_ZWTYPES_H
4 typedef enum _DEBUG_CONTROL_CODE
6 DebugGetTraceInformation
= 1,
7 DebugSetInternalBreakpoint
,
9 DebugClearSpecialCalls
,
10 DebugQuerySpecialCalls
,
14 typedef enum _KPROFILE_SOURCE
19 #define NtCurrentProcess() ( (HANDLE) 0xFFFFFFFF )
20 #define NtCurrentThread() ( (HANDLE) 0xFFFFFFFE )
23 extern ULONG EXPORTED NtBuildNumber
;
25 extern ULONG IMPORTED NtBuildNumber
;
31 #define EVENT_READ_ACCESS 1
32 #define EVENT_WRITE_ACCESS 2
35 // file disposition values
38 #define FILE_SUPERSEDE 0x0000
39 #define FILE_OPEN 0x0001
40 #define FILE_CREATE 0x0002
41 #define FILE_OPEN_IF 0x0003
42 #define FILE_OVERWRITE 0x0004
43 #define FILE_OVERWRITE_IF 0x0005
44 #define FILE_MAXIMUM_DISPOSITION 0x0005
46 // job query / set information class
48 typedef enum _JOBOBJECTINFOCLASS
{ // Q S
49 JobObjectBasicAccountingInformation
= 1, // Y N
50 JobObjectBasicLimitInformation
, // Y Y
51 JobObjectBasicProcessIdList
, // Y N
52 JobObjectBasicUIRestrictions
, // Y Y
53 JobObjectSecurityLimitInformation
, // Y Y
54 JobObjectEndOfJobTimeInformation
, // N Y
55 JobObjectAssociateCompletionPortInformation
, // N Y
56 JobObjectBasicAndIoAccountingInformation
, // Y N
57 JobObjectExtendedLimitInformation
, // Y Y
60 //process query / set information class
62 #define ProcessBasicInformation 0
63 #define ProcessQuotaLimits 1
64 #define ProcessIoCounters 2
65 #define ProcessVmCounters 3
66 #define ProcessTimes 4
67 #define ProcessBasePriority 5
68 #define ProcessRaisePriority 6
69 #define ProcessDebugPort 7
70 #define ProcessExceptionPort 8
71 #define ProcessAccessToken 9
72 #define ProcessLdtInformation 10
73 #define ProcessLdtSize 11
74 #define ProcessDefaultHardErrorMode 12
75 #define ProcessIoPortHandlers 13
76 #define ProcessPooledUsageAndLimits 14
77 #define ProcessWorkingSetWatch 15
78 #define ProcessUserModeIOPL 16
79 #define ProcessEnableAlignmentFaultFixup 17
80 #define ProcessPriorityClass 18
81 #define ProcessWx86Information 19
82 #define ProcessHandleCount 20
83 #define ProcessAffinityMask 21
84 #define ProcessImageFileName 22 // ???
85 #define ProcessPriorityBoost 22
86 #define ProcessDeviceMap 23
87 #define ProcessSessionInformation 24
88 #define ProcessForegroundInformation 25
89 #define ProcessWow64Information 26
90 #define MaxProcessInfoClass 26
93 * thread query / set information class
95 #define ThreadBasicInformation 0
97 #define ThreadPriority 2
98 #define ThreadBasePriority 3
99 #define ThreadAffinityMask 4
100 #define ThreadImpersonationToken 5
101 #define ThreadDescriptorTableEntry 6
102 #define ThreadEnableAlignmentFaultFixup 7
103 #define ThreadEventPair 8
104 #define ThreadQuerySetWin32StartAddress 9
105 #define ThreadZeroTlsCell 10
106 #define ThreadPerformanceCount 11
107 #define ThreadAmILastThread 12
108 #define ThreadIdealProcessor 13
109 #define ThreadPriorityBoost 14
110 #define ThreadSetTlsArrayAddress 15
111 #define ThreadIsIoPending 16
112 #define ThreadHideFromDebugger 17
113 #define MaxThreadInfoClass 17
115 // object handle information
117 #define ObjectBasicInformation 0
118 #define ObjectNameInformation 1
119 #define ObjectTypeInformation 2
120 #define ObjectAllInformation 3
121 #define ObjectDataInformation 4
125 typedef enum _ATOM_INFORMATION_CLASS
127 AtomBasicInformation
= 0,
128 AtomTableInformation
= 1,
129 } ATOM_INFORMATION_CLASS
;
131 typedef struct _ATOM_BASIC_INFORMATION
137 } ATOM_BASIC_INFORMATION
, *PATOM_BASIC_INFORMATION
;
139 typedef struct _ATOM_TABLE_INFORMATION
143 } ATOM_TABLE_INFORMATION
, *PATOM_TABLE_INFORMATION
;
146 // semaphore information
148 typedef enum _SEMAPHORE_INFORMATION_CLASS
150 SemaphoreBasicInformation
= 0
151 } SEMAPHORE_INFORMATION_CLASS
;
153 typedef struct _SEMAPHORE_BASIC_INFORMATION
157 } SEMAPHORE_BASIC_INFORMATION
, *PSEMAPHORE_BASIC_INFORMATION
;
162 typedef enum _EVENT_INFORMATION_CLASS
164 EventBasicInformation
= 0
165 } EVENT_INFORMATION_CLASS
;
167 typedef struct _EVENT_BASIC_INFORMATION
169 EVENT_TYPE EventType
;
171 } EVENT_BASIC_INFORMATION
, *PEVENT_BASIC_INFORMATION
;
174 // system information
175 // {Nt|Zw}{Query|Set}SystemInformation
176 // (GN means Gary Nebbet in "NT/W2K Native API Reference")
179 enum _SYSTEM_INFORMATION_CLASS
181 SystemInformationClassMin
= 0,
182 SystemBasicInformation
= 0, /* Q */
184 SystemProcessorInformation
= 1, /* Q */
186 SystemPerformanceInformation
= 2, /* Q */
188 SystemTimeOfDayInformation
= 3, /* Q */
190 SystemPathInformation
= 4, /* Q (checked build only) */
191 SystemNotImplemented1
= 4, /* Q (GN) */
193 SystemProcessInformation
= 5, /* Q */
194 SystemProcessesAndThreadsInformation
= 5, /* Q (GN) */
196 SystemCallCountInfoInformation
= 6, /* Q */
197 SystemCallCounts
= 6, /* Q (GN) */
199 SystemDeviceInformation
= 7, /* Q */
200 // It conflicts with symbol in ntoskrnl/io/resource.c
201 // SystemConfigurationInformation = 7, /* Q (GN) */
203 SystemProcessorPerformanceInformation
= 8, /* Q */
204 SystemProcessorTimes
= 8, /* Q (GN) */
206 SystemFlagsInformation
= 9, /* QS */
207 SystemGlobalFlag
= 9, /* QS (GN) */
209 SystemCallTimeInformation
= 10,
210 SystemNotImplemented2
= 10, /* (GN) */
212 SystemModuleInformation
= 11, /* Q */
214 SystemLocksInformation
= 12, /* Q */
215 SystemLockInformation
= 12, /* Q (GN) */
217 SystemStackTraceInformation
= 13,
218 SystemNotImplemented3
= 13, /* Q (GN) */
220 SystemPagedPoolInformation
= 14,
221 SystemNotImplemented4
= 14, /* Q (GN) */
223 SystemNonPagedPoolInformation
= 15,
224 SystemNotImplemented5
= 15, /* Q (GN) */
226 SystemHandleInformation
= 16, /* Q */
228 SystemObjectInformation
= 17, /* Q */
230 SystemPageFileInformation
= 18, /* Q */
231 SystemPagefileInformation
= 18, /* Q (GN) */
233 SystemVdmInstemulInformation
= 19, /* Q */
234 SystemInstructionEmulationCounts
= 19, /* Q (GN) */
236 SystemVdmBopInformation
= 20,
237 SystemInvalidInfoClass1
= 20, /* (GN) */
239 SystemFileCacheInformation
= 21, /* QS */
240 SystemCacheInformation
= 21, /* QS (GN) */
242 SystemPoolTagInformation
= 22, /* Q (checked build only) */
244 SystemInterruptInformation
= 23, /* Q */
245 SystemProcessorStatistics
= 23, /* Q (GN) */
247 SystemDpcBehaviourInformation
= 24, /* QS */
248 SystemDpcInformation
= 24, /* QS (GN) */
250 SystemFullMemoryInformation
= 25,
251 SystemNotImplemented6
= 25, /* (GN) */
253 SystemLoadGdiDriverInformation
= 26, /* S (callable) */
254 SystemLoadImage
= 26, /* S (callable) (GN) */
256 SystemUnloadGdiDriverInformation
= 27, /* S (callable) */
257 SystemUnloadImage
= 27, /* S (callable) (GN) */
259 SystemTimeAdjustmentInformation
= 28, /* QS */
260 SystemTimeAdjustment
= 28, /* QS (GN) */
262 SystemSummaryMemoryInformation
= 29,
263 SystemNotImplemented7
= 29, /* (GN) */
265 SystemNextEventIdInformation
= 30,
266 SystemNotImplemented8
= 30, /* (GN) */
268 SystemEventIdsInformation
= 31,
269 SystemNotImplemented9
= 31, /* (GN) */
271 SystemCrashDumpInformation
= 32, /* Q */
273 SystemExceptionInformation
= 33, /* Q */
275 SystemCrashDumpStateInformation
= 34, /* Q */
277 SystemKernelDebuggerInformation
= 35, /* Q */
279 SystemContextSwitchInformation
= 36, /* Q */
281 SystemRegistryQuotaInformation
= 37, /* QS */
283 SystemExtendServiceTableInformation
= 38, /* S */
284 SystemLoadAndCallImage
= 38, /* S (GN) */
286 SystemPrioritySeparation
= 39, /* S */
288 SystemPlugPlayBusInformation
= 40,
289 SystemNotImplemented10
= 40, /* Q (GN) */
291 SystemDockInformation
= 41,
292 SystemNotImplemented11
= 41, /* Q (GN) */
294 SystemPowerInformation
= 42,
295 SystemInvalidInfoClass2
= 42, /* (GN) */
297 SystemProcessorSpeedInformation
= 43,
298 SystemInvalidInfoClass3
= 43, /* (GN) */
300 SystemCurrentTimeZoneInformation
= 44, /* QS */
301 SystemTimeZoneInformation
= 44, /* QS (GN) */
303 SystemLookasideInformation
= 45, /* Q */
305 SystemSetTimeSlipEvent
= 46, /* S (GN) */
307 SystemCreateSession
= 47, /* S (GN) */
309 SystemDeleteSession
= 48, /* S (GN) */
311 SystemInvalidInfoClass4
= 49, /* (GN) */
313 SystemRangeStartInformation
= 50, /* Q (GN) */
315 SystemVerifierInformation
= 51, /* QS (GN) */
317 SystemAddVerifier
= 52, /* S (GN) */
319 SystemSessionProcessesInformation
= 53, /* Q (GN) */
320 SystemInformationClassMax
322 } SYSTEM_INFORMATION_CLASS
;
324 // SystemBasicInformation (0)
326 struct _SYSTEM_BASIC_INFORMATION
329 ULONG TimerResolution
;
331 ULONG NumberOfPhysicalPages
;
332 ULONG LowestPhysicalPageNumber
;
333 ULONG HighestPhysicalPageNumber
;
334 ULONG AllocationGranularity
;
335 ULONG MinimumUserModeAddress
;
336 ULONG MaximumUserModeAddress
;
337 KAFFINITY ActiveProcessorsAffinityMask
;
338 CCHAR NumberOfProcessors
;
339 } SYSTEM_BASIC_INFORMATION
, *PSYSTEM_BASIC_INFORMATION
;
341 // SystemProcessorInformation (1)
343 struct _SYSTEM_PROCESSOR_INFORMATION
345 USHORT ProcessorArchitecture
;
346 USHORT ProcessorLevel
;
347 USHORT ProcessorRevision
;
349 ULONG ProcessorFeatureBits
;
350 } SYSTEM_PROCESSOR_INFORMATION
, *PSYSTEM_PROCESSOR_INFORMATION
;
352 // SystemPerformanceInfo (2)
354 struct _SYSTEM_PERFORMANCE_INFORMATION
356 LARGE_INTEGER IdleProcessorTime
;
357 LARGE_INTEGER IoReadTransferCount
;
358 LARGE_INTEGER IoWriteTransferCount
;
359 LARGE_INTEGER IoOtherTransferCount
;
360 ULONG IoReadOperationCount
;
361 ULONG IoWriteOperationCount
;
362 ULONG IoOtherOperationCount
;
363 ULONG AvailablePages
;
366 ULONG PeakCommitment
;
367 ULONG PageFaultCount
;
368 ULONG CopyOnWriteCount
;
369 ULONG TransitionCount
;
370 ULONG CacheTransitionCount
;
371 ULONG DemandZeroCount
;
373 ULONG PageReadIoCount
;
374 ULONG CacheReadCount
;
376 ULONG DirtyPagesWriteCount
;
377 ULONG DirtyWriteIoCount
;
378 ULONG MappedPagesWriteCount
;
379 ULONG MappedWriteIoCount
;
380 ULONG PagedPoolPages
;
381 ULONG NonPagedPoolPages
;
386 ULONG MmTotalSystemFreePtes
;
387 ULONG MmSystemCodepage
;
388 ULONG MmTotalSystemDriverPages
;
389 ULONG MmTotalSystemCodePages
;
393 ULONG MmSystemCachePage
;
394 ULONG MmPagedPoolPage
;
395 ULONG MmSystemDriverPage
;
396 ULONG CcFastReadNoWait
;
397 ULONG CcFastReadWait
;
398 ULONG CcFastReadResourceMiss
;
399 ULONG CcFastReadNotPossible
;
400 ULONG CcFastMdlReadNoWait
;
401 ULONG CcFastMdlReadWait
;
402 ULONG CcFastMdlReadResourceMiss
;
403 ULONG CcFastMdlReadNotPossible
;
404 ULONG CcMapDataNoWait
;
406 ULONG CcMapDataNoWaitMiss
;
407 ULONG CcMapDataWaitMiss
;
408 ULONG CcPinMappedDataCount
;
409 ULONG CcPinReadNoWait
;
411 ULONG CcPinReadNoWaitMiss
;
412 ULONG CcPinReadWaitMiss
;
413 ULONG CcCopyReadNoWait
;
414 ULONG CcCopyReadWait
;
415 ULONG CcCopyReadNoWaitMiss
;
416 ULONG CcCopyReadWaitMiss
;
417 ULONG CcMdlReadNoWait
;
419 ULONG CcMdlReadNoWaitMiss
;
420 ULONG CcMdlReadWaitMiss
;
421 ULONG CcReadaheadIos
;
422 ULONG CcLazyWriteIos
;
423 ULONG CcLazyWritePages
;
426 ULONG ContextSwitches
;
431 } SYSTEM_PERFORMANCE_INFO
, *PSYSTEM_PERFORMANCE_INFO
;
433 // SystemTimeOfDayInformation (3)
435 struct _SYSTEM_TIMEOFDAY_INFORMATION
437 LARGE_INTEGER BootTime
;
438 LARGE_INTEGER CurrentTime
;
439 LARGE_INTEGER TimeZoneBias
;
442 } SYSTEM_TIMEOFDAY_INFORMATION
, *PSYSTEM_TIMEOFDAY_INFORMATION
;
444 // SystemPathInformation (4)
447 struct _SYSTEM_PATH_INFORMATION
451 } SYSTEM_PATH_INFORMATION
, * PSYSTEM_PATH_INFORMATION
;
453 // SystemProcessInformation (5)
455 struct _SYSTEM_THREAD_INFORMATION
463 ULONG DynamicPriority
;
467 KWAIT_REASON WaitReason
;
469 } SYSTEM_THREAD_INFORMATION
, *PSYSTEM_THREAD_INFORMATION
;
472 struct SYSTEM_PROCESS_INFORMATION
474 ULONG RelativeOffset
;
483 ULONG ParentProcessId
;
486 ULONG PeakVirtualSizeBytes
;
487 ULONG TotalVirtualSizeBytes
;
488 ULONG PageFaultCount
;
489 ULONG PeakWorkingSetSizeBytes
;
490 ULONG TotalWorkingSetSizeBytes
;
491 ULONG PeakPagedPoolUsagePages
;
492 ULONG TotalPagedPoolUsagePages
;
493 ULONG PeakNonPagedPoolUsagePages
;
494 ULONG TotalNonPagedPoolUsagePages
;
495 ULONG TotalPageFileUsageBytes
;
496 ULONG PeakPageFileUsageBytes
;
497 ULONG TotalPrivateBytes
;
498 SYSTEM_THREAD_INFORMATION ThreadSysInfo
[1];
500 } SYSTEM_PROCESS_INFORMATION
, *PSYSTEM_PROCESS_INFORMATION
;
502 // SystemCallCountInformation (6)
504 struct _SYSTEM_SDT_INFORMATION
507 ULONG NumberOfSystemServiceTables
;
508 ULONG NumberOfServices
[1];
509 ULONG ServiceCounters
[1];
511 } SYSTEM_SDT_INFORMATION
, *PSYSTEM_SDT_INFORMATION
;
513 // SystemDeviceInformation (7)
515 struct _SYSTEM_DEVICE_INFORMATION
518 ULONG NumberOfFloppies
;
519 ULONG NumberOfCdRoms
;
521 ULONG NumberOfSerialPorts
;
522 ULONG NumberOfParallelPorts
;
523 } SYSTEM_DEVICE_INFORMATION
, *PSYSTEM_DEVICE_INFORMATION
;
525 // SystemProcessorPerformanceInformation (8)
526 // (one per processor in the system)
528 struct _SYSTEM_PROCESSORTIME_INFO
530 TIME TotalProcessorRunTime
;
531 TIME TotalProcessorTime
;
532 TIME TotalProcessorUserTime
;
534 TIME TotalInterruptTime
;
535 ULONG TotalInterrupts
;
538 } SYSTEM_PROCESSORTIME_INFO
, *PSYSTEM_PROCESSORTIME_INFO
;
540 // SystemFlagsInformation (9)
542 struct _SYSTEM_FLAGS_INFORMATION
546 } SYSTEM_FLAGS_INFORMATION
, * PSYSTEM_FLAGS_INFORMATION
;
548 #define FLG_STOP_ON_EXCEPTION 0x00000001
549 #define FLG_SHOW_LDR_SNAPS 0x00000002
550 #define FLG_DEBUG_INITIAL_COMMAND 0x00000004
551 #define FLG_STOP_ON_HANG_GUI 0x00000008
552 #define FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010
553 #define FLG_HEAP_ENABLE_FREE_CHECK 0x00000020
554 #define FLG_HEAP_VALIDATE_PARAMETERS 0x00000040
555 #define FLG_HEAP_VALIDATE_ALL 0x00000080
556 #define FLG_POOL_ENABLE_TAIL_CHECK 0x00000100
557 #define FLG_POOL_ENABLE_FREE_CHECK 0x00000200
558 #define FLG_POOL_ENABLE_TAGGING 0x00000400
559 #define FLG_HEAP_ENABLE_TAGGING 0x00000800
560 #define FLG_USER_STACK_TRACE_DB 0x00001000
561 #define FLG_KERNEL_STACK_TRACE_DB 0x00002000
562 #define FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000
563 #define FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000
564 #define FLG_IGNORE_DEBUG_PRIV 0x00010000
565 #define FLG_ENABLE_CSRDEBUG 0x00020000
566 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000
567 #define FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000
568 #define FLG_HEAP_ENABLE_CALL_TRACING 0x00100000
569 #define FLG_HEAP_DISABLE_COALESCING 0x00200000
570 #define FLG_ENABLE_CLOSE_EXCEPTION 0x00400000
571 #define FLG_ENABLE_EXCEPTION_LOGGING 0x00800000
572 #define FLG_UNKNOWN_01000000 0x01000000
573 #define FLG_UNKNOWN_02000000 0x02000000
574 #define FLG_UNKNOWN_04000000 0x04000000
575 #define FLG_ENABLE_DBGPRINT_BUFFERING 0x08000000
576 #define FLG_UNKNOWN_10000000 0x10000000
577 #define FLG_UNKNOWN_20000000 0x20000000
578 #define FLG_UNKNOWN_40000000 0x40000000
579 #define FLG_UNKNOWN_80000000 0x80000000
581 // SystemCallTimeInformation (10)
584 // SystemModuleInformation (11)
586 struct _SYSTEM_MODULE_ENTRY
594 USHORT NameLength
; /* Length of module name not including the path, this field contains valid value only for NTOSKRNL module*/
595 USHORT PathLength
; /* Length of 'directory path' part of modulename*/
597 } SYSTEM_MODULE_ENTRY
, * PSYSTEM_MODULE_ENTRY
;
600 struct _SYSTEM_MODULE_INFORMATION
603 SYSTEM_MODULE_ENTRY Module
[1];
604 } SYSTEM_MODULE_INFORMATION
, *PSYSTEM_MODULE_INFORMATION
;
606 // SystemLocksInformation (12)
608 struct _SYSTEM_RESOURCE_LOCK_ENTRY
610 ULONG ResourceAddress
;
614 ULONG ContentionCount
;
616 ULONG NumberOfSharedWaiters
;
617 ULONG NumberOfExclusiveWaiters
;
619 } SYSTEM_RESOURCE_LOCK_ENTRY
, *PSYSTEM_RESOURCE_LOCK_ENTRY
;
622 struct _SYSTEM_RESOURCE_LOCK_INFO
625 SYSTEM_RESOURCE_LOCK_ENTRY Lock
[1];
627 } SYSTEM_RESOURCE_LOCK_INFO
, *PSYSTEM_RESOURCE_LOCK_INFO
;
629 // SystemInformation13 (13)
632 // SystemInformation14 (14)
635 // SystemInformation15 (15)
638 // SystemHandleInformation (16)
641 struct _SYSTEM_HANDLE_ENTRY
650 } SYSTEM_HANDLE_ENTRY
, *PSYSTEM_HANDLE_ENTRY
;
653 struct _SYSTEM_HANDLE_INFORMATION
656 SYSTEM_HANDLE_ENTRY Handle
[1];
658 } SYSTEM_HANDLE_INFORMATION
, *PSYSTEM_HANDLE_INFORMATION
;
660 // SystemObjectInformation (17)
662 struct _SYSTEM_OBJECT_TYPE_INFORMATION
664 ULONG NextEntryOffset
;
668 ULONG InvalidAttributes
;
669 GENERIC_MAPPING GenericMapping
;
670 ACCESS_MASK ValidAccessMask
;
675 } SYSTEM_OBJECT_TYPE_INFORMATION
, *PSYSTEM_OBJECT_TYPE_INFORMATION
;
678 struct _SYSTEM_OBJECT_INFORMATION
680 ULONG NextEntryOffset
;
682 ULONG CreatorProcessId
;
687 ULONG PagedPoolUsage
;
688 ULONG NonPagedPoolUsage
;
689 ULONG ExclusiveProcessId
;
690 PSECURITY_DESCRIPTOR SecurityDescriptor
;
693 } SYSTEM_OBJECT_INFORMATION
, *PSYSTEM_OBJECT_INFORMATION
;
695 // SystemPageFileInformation (18)
697 struct _SYSTEM_PAGEFILE_INFORMATION
699 ULONG RelativeOffset
;
700 ULONG CurrentSizePages
;
701 ULONG TotalUsedPages
;
703 UNICODE_STRING PagefileFileName
;
705 } SYSTEM_PAGEFILE_INFORMATION
, *PSYSTEM_PAGEFILE_INFORMATION
;
707 // SystemInstructionEmulationInfo (19)
709 struct _SYSTEM_VDM_INFORMATION
711 ULONG VdmSegmentNotPresentCount
;
713 ULONG VdmESPREFIXCount
;
714 ULONG VdmCSPREFIXCount
;
715 ULONG VdmSSPREFIXCount
;
716 ULONG VdmDSPREFIXCount
;
717 ULONG VdmFSPREFIXCount
;
718 ULONG VdmGSPREFIXCount
;
719 ULONG VdmOPER32PREFIXCount
;
720 ULONG VdmADDR32PREFIXCount
;
722 ULONG VdmINSWV86Count
;
730 ULONG VdmINBIMMCount
;
731 ULONG VdmINWIMMCount
;
732 ULONG VdmOUTBIMMCount
;
733 ULONG VdmOUTWIMMCount
;
738 ULONG VdmLOCKPREFIXCount
;
739 ULONG VdmREPNEPREFIXCount
;
740 ULONG VdmREPPREFIXCount
;
746 } SYSTEM_VDM_INFORMATION
, *PSYSTEM_VDM_INFORMATION
;
748 // SystemInformation20 (20)
751 // SystemCacheInformation (21)
753 struct _SYSTEM_CACHE_INFORMATION
757 ULONG PageFaultCount
;
758 ULONG MinimumWorkingSet
;
759 ULONG MaximumWorkingSet
;
762 } SYSTEM_CACHE_INFORMATION
;
764 // SystemPoolTagInformation (22)
765 // found by Klaus P. Gerlicher
766 // (implemented only in checked builds)
768 struct _POOL_TAG_STATS
770 ULONG AllocationCount
;
777 struct _SYSTEM_POOL_TAG_ENTRY
780 POOL_TAG_STATS Paged
;
781 POOL_TAG_STATS NonPaged
;
783 } SYSTEM_POOL_TAG_ENTRY
, * PSYSTEM_POOL_TAG_ENTRY
;
786 struct _SYSTEM_POOL_TAG_INFO
789 SYSTEM_POOL_TAG_ENTRY PoolEntry
[1];
791 } SYSTEM_POOL_TAG_INFO
, *PSYSTEM_POOL_TAG_INFO
;
793 // SystemProcessorScheduleInfo (23)
795 struct _SYSTEM_PROCESSOR_SCHEDULE_INFO
797 ULONG nContextSwitches
;
800 ULONG TimerResolution
;
804 } SYSTEM_PROCESSOR_SCHEDULE_INFO
, *PSYSTEM_PROCESSOR_SCHEDULE_INFO
;
806 // SystemDpcInformation (24)
808 struct _SYSTEM_DPC_INFORMATION
811 ULONG KiMaximumDpcQueueDepth
;
812 ULONG KiMinimumDpcRate
;
813 ULONG KiAdjustDpcThreshold
;
814 ULONG KiIdealDpcRate
;
816 } SYSTEM_DPC_INFORMATION
, *PSYSTEM_DPC_INFORMATION
;
818 // SystemInformation25 (25)
821 // SystemLoadGdiDriverInformation (26)
822 // SystemUnloadGdiDriverInformation (27)
823 typedef struct _SYSTEM_GDI_DRIVER_INFORMATION
825 UNICODE_STRING DriverName
;
827 PVOID SectionPointer
;
829 // PIMAGE_EXPORT_DIRECTORY ExportSectionPointer;
830 PVOID ExportSectionPointer
;
831 } SYSTEM_GDI_DRIVER_INFORMATION
, *PSYSTEM_GDI_DRIVER_INFORMATION
;
833 // SystemTimeAdjustmentInformation (28)
835 struct _SYSTEM_QUERY_TIME_ADJUSTMENT
837 ULONG TimeAdjustment
;
838 ULONG MaximumIncrement
;
839 BOOLEAN TimeSynchronization
;
841 } SYSTEM_QUERY_TIME_ADJUSTMENT
, *PSYSTEM_QUERY_TIME_ADJUSTMENT
;
844 struct _SYSTEM_SET_TIME_ADJUSTMENT
846 ULONG TimeAdjustment
;
847 BOOLEAN TimeSynchronization
;
849 } SYSTEM_TIME_ADJUSTMENT_INFO
, *PSYSTEM_TIME_ADJUSTMENT_INFO
;
851 // SystemProcessorFaultCountInfo (33)
853 struct _SYSTEM_PROCESSOR_FAULT_INFO
855 ULONG nAlignmentFixup
;
856 ULONG nExceptionDispatches
;
857 ULONG nFloatingEmulation
;
860 } SYSTEM_PROCESSOR_FAULT_INFO
, *PSYSTEM_PROCESSOR_FAULT_INFO
;
862 // SystemCrashDumpStateInfo (34)
865 // SystemDebuggerInformation (35)
867 struct _SYSTEM_DEBUGGER_INFO
869 BOOLEAN KdDebuggerEnabled
;
870 BOOLEAN KdDebuggerPresent
;
872 } SYSTEM_DEBUGGER_INFO
, *PSYSTEM_DEBUGGER_INFO
;
874 // SystemInformation36 (36)
877 // SystemQuotaInformation (37)
879 struct _SYSTEM_QUOTA_INFORMATION
881 ULONG CmpGlobalQuota
;
882 ULONG CmpGlobalQuotaUsed
;
883 ULONG MmSizeofPagedPoolInBytes
;
885 } SYSTEM_QUOTA_INFORMATION
, *PSYSTEM_QUOTA_INFORMATION
;
887 // SystemLoadDriver (38)
889 struct _SYSTEM_DRIVER_LOAD
891 UNICODE_STRING DriverRegistryEntry
;
893 } SYSTEM_DRIVER_LOAD
, *PSYSTEM_DRIVER_LOAD
;
895 // SystemTimeZoneInformation (44)
897 struct _SYSTEM_TIME_ZONE_INFORMATION
900 WCHAR StandardName
[32];
903 WCHAR DaylightName
[32];
907 } SYSTEM_TIME_ZONE_INFORMATION
, * PSYSTEM_TIME_ZONE_INFORMATION
;
909 // SystemLookasideInformation (45)
911 struct _SYSTEM_LOOKASIDE_INFORMATION
915 ULONG TotalAllocates
;
916 ULONG AllocatesMisses
;
923 } SYSTEM_LOOKASIDE_INFORMATION
, * PSYSTEM_LOOKASIDE_INFORMATION
;
925 // SystemSetTimeSlipEvent (46)
927 struct _SYSTEM_SET_TIME_SLIP_EVENT
929 HANDLE TimeSlipEvent
; /* IN */
931 } SYSTEM_SET_TIME_SLIP_EVENT
, * PSYSTEM_SET_TIME_SLIP_EVENT
;
933 // SystemCreateSession (47)
934 // (available only on TSE/NT5+)
936 struct _SYSTEM_CREATE_SESSION
938 ULONG SessionId
; /* OUT */
940 } SYSTEM_CREATE_SESSION
, * PSYSTEM_CREATE_SESSION
;
942 // SystemDeleteSession (48)
943 // (available only on TSE/NT5+)
945 struct _SYSTEM_DELETE_SESSION
947 ULONG SessionId
; /* IN */
949 } SYSTEM_DELETE_SESSION
, * PSYSTEM_DELETE_SESSION
;
954 // SystemRangeStartInformation (50)
956 struct _SYSTEM_RANGE_START_INFORMATION
958 PVOID SystemRangeStart
;
960 } SYSTEM_RANGE_START_INFORMATION
, * PSYSTEM_RANGE_START_INFORMATION
;
962 // SystemVerifierInformation (51)
965 // SystemAddVerifier (52)
968 // SystemSessionProcessesInformation (53)
969 // (available only on TSE/NT5+)
971 struct _SYSTEM_SESSION_PROCESSES_INFORMATION
975 PVOID Buffer
; /* same format as in SystemProcessInformation */
977 } SYSTEM_SESSION_PROCESSES_INFORMATION
, * PSYSTEM_SESSION_PROCESSES_INFORMATION
;
979 // memory information
981 #define MemoryBasicInformation 0
985 typedef enum SHUTDOWN_ACTION_TAG
{
996 // number of wait objects
998 #define THREAD_WAIT_OBJECTS 3
999 //#define MAXIMUM_WAIT_OBJECTS 64
1001 // key restore flags
1003 #define REG_WHOLE_HIVE_VOLATILE 1
1004 #define REG_REFRESH_HIVE 2
1006 // object type access rights
1008 #define OBJECT_TYPE_CREATE 0x0001
1009 #define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
1011 // directory access rights
1013 #define DIRECTORY_QUERY 0x0001
1014 #define DIRECTORY_TRAVERSE 0x0002
1015 #define DIRECTORY_CREATE_OBJECT 0x0004
1016 #define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
1018 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
1020 // symbolic link access rights
1022 #define SYMBOLIC_LINK_QUERY 0x0001
1023 #define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
1025 // Information class 0
1026 typedef struct _PROCESS_BASIC_INFORMATION
1028 NTSTATUS ExitStatus
;
1029 PPEB PebBaseAddress
;
1030 KAFFINITY AffinityMask
;
1031 KPRIORITY BasePriority
;
1032 ULONG UniqueProcessId
;
1033 ULONG InheritedFromUniqueProcessId
;
1034 } PROCESS_BASIC_INFORMATION
, *PPROCESS_BASIC_INFORMATION
;
1036 // Information class 1
1037 typedef struct _QUOTA_LIMITS
1039 ULONG PagedPoolLimit
;
1040 ULONG NonPagedPoolLimit
;
1041 ULONG MinimumWorkingSetSize
;
1042 ULONG MaximumWorkingSetSize
;
1043 ULONG PagefileLimit
;
1045 } QUOTA_LIMITS
, *PQUOTA_LIMITS
;
1047 // Information class 2
1048 typedef struct _IO_COUNTERS
1050 ULONG ReadOperationCount
;
1051 ULONG WriteOperationCount
;
1052 ULONG OtherOperationCount
;
1053 LARGE_INTEGER ReadTransferCount
;
1054 LARGE_INTEGER WriteTransferCount
;
1055 LARGE_INTEGER OtherTransferCount
;
1056 } IO_COUNTERS
, *PIO_COUNTERS
;
1058 // Information class 3
1059 typedef struct _VM_COUNTERS_
1061 ULONG PeakVirtualSize
;
1063 ULONG PageFaultCount
;
1064 ULONG PeakWorkingSetSize
;
1065 ULONG WorkingSetSize
;
1066 ULONG QuotaPeakPagedPoolUsage
;
1067 ULONG QuotaPagedPoolUsage
;
1068 ULONG QuotaPeakNonPagedPoolUsage
;
1069 ULONG QuotaNonPagedPoolUsage
;
1070 ULONG PagefileUsage
;
1071 ULONG PeakPagefileUsage
;
1072 } VM_COUNTERS
, *PVM_COUNTERS
;
1074 // Information class 4
1075 typedef struct _KERNEL_USER_TIMES
1081 } KERNEL_USER_TIMES
, *PKERNEL_USER_TIMES
;
1083 // Information class 9
1084 typedef struct _PROCESS_ACCESS_TOKEN
1088 } PROCESS_ACCESS_TOKEN
, *PPROCESS_ACCESS_TOKEN
;
1090 // Information class 14
1091 typedef struct _POOLED_USAGE_AND_LIMITS_
1093 ULONG PeakPagedPoolUsage
;
1094 ULONG PagedPoolUsage
;
1095 ULONG PagedPoolLimit
;
1096 ULONG PeakNonPagedPoolUsage
;
1097 ULONG NonPagedPoolUsage
;
1098 ULONG NonPagedPoolLimit
;
1099 ULONG PeakPagefileUsage
;
1100 ULONG PagefileUsage
;
1101 ULONG PagefileLimit
;
1102 } POOLED_USAGE_AND_LIMITS
, *PPOOLED_USAGE_AND_LIMITS
;
1104 // Information class 15
1105 typedef struct _PROCESS_WS_WATCH_INFORMATION
1109 } PROCESS_WS_WATCH_INFORMATION
, *PPROCESS_WS_WATCH_INFORMATION
;
1111 // Information class 18
1112 typedef struct _PROCESS_PRIORITY_CLASS
1115 UCHAR PriorityClass
;
1116 } PROCESS_PRIORITY_CLASS
, *PPROCESS_PRIORITY_CLASS
;
1118 // Information class 23
1119 typedef struct _PROCESS_DEVICEMAP_INFORMATION
1123 HANDLE DirectoryHandle
;
1127 UCHAR DriveType
[32];
1130 } PROCESS_DEVICEMAP_INFORMATION
, *pPROCESS_DEVICEMAP_INFORMATION
;
1132 // Information class 24
1133 typedef struct _PROCESS_SESSION_INFORMATION
1136 } PROCESS_SESSION_INFORMATION
, *PPROCESS_SESSION_INFORMATION
;
1138 // thread information
1140 // incompatible with MS NT
1142 typedef struct _THREAD_BASIC_INFORMATION
1144 NTSTATUS ExitStatus
;
1145 PVOID TebBaseAddress
; // PNT_TIB (GN)
1147 KAFFINITY AffinityMask
;
1149 KPRIORITY BasePriority
;
1150 } THREAD_BASIC_INFORMATION
, *PTHREAD_BASIC_INFORMATION
;
1152 // object information
1154 typedef struct _OBJECT_NAME_INFORMATION
1156 UNICODE_STRING Name
;
1157 } OBJECT_NAME_INFORMATION
, *POBJECT_NAME_INFORMATION
;
1161 typedef struct _OBJECT_DATA_INFORMATION
1163 BOOLEAN bInheritHandle
;
1164 BOOLEAN bProtectFromClose
;
1165 } OBJECT_DATA_INFORMATION
, *POBJECT_DATA_INFORMATION
;
1168 typedef struct _OBJECT_TYPE_INFORMATION
1170 UNICODE_STRING Name
;
1171 UNICODE_STRING Type
;
1173 ULONG ReferenceCount
;
1174 } OBJECT_TYPE_INFORMATION
, *POBJECT_TYPE_INFORMATION
;
1178 typedef struct _FILE_BASIC_INFORMATION
1181 TIME LastAccessTime
;
1184 ULONG FileAttributes
;
1185 } FILE_BASIC_INFORMATION
, *PFILE_BASIC_INFORMATION
;
1187 typedef struct _FILE_STANDARD_INFORMATION
1189 LARGE_INTEGER AllocationSize
;
1190 LARGE_INTEGER EndOfFile
;
1191 ULONG NumberOfLinks
;
1192 BOOLEAN DeletePending
;
1194 } FILE_STANDARD_INFORMATION
, *PFILE_STANDARD_INFORMATION
;
1196 typedef struct _FILE_POSITION_INFORMATION
1198 LARGE_INTEGER CurrentByteOffset
;
1199 } FILE_POSITION_INFORMATION
, *PFILE_POSITION_INFORMATION
;
1201 typedef struct _FILE_ALIGNMENT_INFORMATION
1203 ULONG AlignmentRequirement
;
1204 } FILE_ALIGNMENT_INFORMATION
, *PFILE_ALIGNMENT_INFORMATION
;
1206 typedef struct _FILE_DISPOSITION_INFORMATION
1208 BOOLEAN DoDeleteFile
;
1209 } FILE_DISPOSITION_INFORMATION
, *PFILE_DISPOSITION_INFORMATION
;
1211 typedef struct _FILE_END_OF_FILE_INFORMATION
1213 LARGE_INTEGER EndOfFile
;
1214 } FILE_END_OF_FILE_INFORMATION
, *PFILE_END_OF_FILE_INFORMATION
;
1216 typedef struct _FILE_NETWORK_OPEN_INFORMATION
1219 TIME LastAccessTime
;
1222 LARGE_INTEGER AllocationSize
;
1223 LARGE_INTEGER EndOfFile
;
1224 ULONG FileAttributes
;
1225 } FILE_NETWORK_OPEN_INFORMATION
, *PFILE_NETWORK_OPEN_INFORMATION
;
1227 typedef struct _FILE_FULL_EA_INFORMATION
1229 ULONG NextEntryOffset
;
1232 USHORT EaValueLength
;
1234 } FILE_FULL_EA_INFORMATION
, *PFILE_FULL_EA_INFORMATION
;
1237 typedef struct _FILE_EA_INFORMATION
{
1239 } FILE_EA_INFORMATION
, *PFILE_EA_INFORMATION
;
1242 typedef struct _FILE_GET_EA_INFORMATION
{
1243 ULONG NextEntryOffset
;
1246 } FILE_GET_EA_INFORMATION
, *PFILE_GET_EA_INFORMATION
;
1248 typedef struct _FILE_STREAM_INFORMATION
{
1249 ULONG NextEntryOffset
;
1250 ULONG StreamNameLength
;
1251 LARGE_INTEGER StreamSize
;
1252 LARGE_INTEGER StreamAllocationSize
;
1253 WCHAR StreamName
[0];
1254 } FILE_STREAM_INFORMATION
, *PFILE_STREAM_INFORMATION
;
1256 typedef struct _FILE_ALLOCATION_INFORMATION
{
1257 LARGE_INTEGER AllocationSize
;
1258 } FILE_ALLOCATION_INFORMATION
, *PFILE_ALLOCATION_INFORMATION
;
1260 typedef struct _FILE_NAME_INFORMATION
{
1261 ULONG FileNameLength
;
1263 } FILE_NAME_INFORMATION
, *PFILE_NAME_INFORMATION
;
1265 typedef struct _FILE_NAMES_INFORMATION
1267 ULONG NextEntryOffset
;
1269 ULONG FileNameLength
;
1271 } FILE_NAMES_INFORMATION
, *PFILE_NAMES_INFORMATION
;
1274 typedef struct _FILE_RENAME_INFORMATION
{
1277 ULONG FileNameLength
;
1279 } FILE_RENAME_INFORMATION
, *PFILE_RENAME_INFORMATION
;
1282 typedef struct _FILE_INTERNAL_INFORMATION
{
1283 LARGE_INTEGER IndexNumber
;
1284 } FILE_INTERNAL_INFORMATION
, *PFILE_INTERNAL_INFORMATION
;
1286 typedef struct _FILE_ACCESS_INFORMATION
{
1287 ACCESS_MASK AccessFlags
;
1288 } FILE_ACCESS_INFORMATION
, *PFILE_ACCESS_INFORMATION
;
1291 typedef struct _FILE_MODE_INFORMATION
{
1293 } FILE_MODE_INFORMATION
, *PFILE_MODE_INFORMATION
;
1296 typedef struct _FILE_PIPE_INFORMATION
{
1298 ULONG CompletionMode
;
1299 } FILE_PIPE_INFORMATION
, *PFILE_PIPE_INFORMATION
;
1301 typedef struct _FILE_PIPE_LOCAL_INFORMATION
{
1302 ULONG NamedPipeType
;
1303 ULONG NamedPipeConfiguration
;
1304 ULONG MaximumInstances
;
1305 ULONG CurrentInstances
;
1307 ULONG ReadDataAvailable
;
1308 ULONG OutboundQuota
;
1309 ULONG WriteQuotaAvailable
;
1310 ULONG NamedPipeState
;
1312 } FILE_PIPE_LOCAL_INFORMATION
, *PFILE_PIPE_LOCAL_INFORMATION
;
1314 typedef struct _FILE_PIPE_REMOTE_INFORMATION
{
1315 LARGE_INTEGER CollectDataTime
;
1316 ULONG MaximumCollectionCount
;
1317 } FILE_PIPE_REMOTE_INFORMATION
, *PFILE_PIPE_REMOTE_INFORMATION
;
1319 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION
{
1320 ULONG MaxMessageSize
;
1321 ULONG Unknown
; /* ?? */
1324 LARGE_INTEGER Timeout
;
1325 } FILE_MAILSLOT_QUERY_INFORMATION
, *PFILE_MAILSLOT_QUERY_INFORMATION
;
1327 typedef struct _FILE_MAILSLOT_SET_INFORMATION
{
1328 LARGE_INTEGER Timeout
;
1329 } FILE_MAILSLOT_SET_INFORMATION
, *PFILE_MAILSLOT_SET_INFORMATION
;
1331 typedef struct _FILE_COMPRESSION_INFORMATION
{
1332 LARGE_INTEGER CompressedFileSize
;
1333 USHORT CompressionFormat
;
1334 UCHAR CompressionUnitShift
;
1338 } FILE_COMPRESSION_INFORMATION
, *PFILE_COMPRESSION_INFORMATION
;
1340 typedef struct _FILE_ALL_INFORMATION
{
1341 FILE_BASIC_INFORMATION BasicInformation
;
1342 FILE_STANDARD_INFORMATION StandardInformation
;
1343 FILE_INTERNAL_INFORMATION InternalInformation
;
1344 FILE_EA_INFORMATION EaInformation
;
1345 FILE_ACCESS_INFORMATION AccessInformation
;
1346 FILE_POSITION_INFORMATION PositionInformation
;
1347 FILE_MODE_INFORMATION ModeInformation
;
1348 FILE_ALIGNMENT_INFORMATION AlignmentInformation
;
1349 FILE_NAME_INFORMATION NameInformation
;
1350 } FILE_ALL_INFORMATION
, *PFILE_ALL_INFORMATION
;
1353 // file system information structures
1355 typedef struct _FILE_FS_DEVICE_INFORMATION
{
1356 DEVICE_TYPE DeviceType
;
1357 ULONG Characteristics
;
1358 } FILE_FS_DEVICE_INFORMATION
, *PFILE_FS_DEVICE_INFORMATION
;
1361 typedef struct _FILE_FS_VOLUME_INFORMATION
{
1362 TIME VolumeCreationTime
;
1363 ULONG VolumeSerialNumber
;
1364 ULONG VolumeLabelLength
;
1365 BOOLEAN SupportsObjects
;
1366 WCHAR VolumeLabel
[0];
1367 } FILE_FS_VOLUME_INFORMATION
, *PFILE_FS_VOLUME_INFORMATION
;
1369 typedef struct _FILE_FS_SIZE_INFORMATION
{
1370 LARGE_INTEGER TotalAllocationUnits
;
1371 LARGE_INTEGER AvailableAllocationUnits
;
1372 ULONG SectorsPerAllocationUnit
;
1373 ULONG BytesPerSector
;
1374 } FILE_FS_SIZE_INFORMATION
, *PFILE_FS_SIZE_INFORMATION
;
1376 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
{
1377 ULONG FileSystemAttributes
;
1378 LONG MaximumComponentNameLength
;
1379 ULONG FileSystemNameLength
;
1380 WCHAR FileSystemName
[0];
1381 } FILE_FS_ATTRIBUTE_INFORMATION
, *PFILE_FS_ATTRIBUTE_INFORMATION
;
1384 FileSystemAttributes is one of the following values:
1386 FILE_CASE_SENSITIVE_SEARCH 0x00000001
1387 FILE_CASE_PRESERVED_NAMES 0x00000002
1388 FILE_UNICODE_ON_DISK 0x00000004
1389 FILE_PERSISTENT_ACLS 0x00000008
1390 FILE_FILE_COMPRESSION 0x00000010
1391 FILE_VOLUME_QUOTAS 0x00000020
1392 FILE_VOLUME_IS_COMPRESSED 0x00008000
1394 typedef struct _FILE_FS_LABEL_INFORMATION
{
1395 ULONG VolumeLabelLength
;
1396 WCHAR VolumeLabel
[0];
1397 } FILE_FS_LABEL_INFORMATION
, *PFILE_FS_LABEL_INFORMATION
;
1399 // read file scatter / write file scatter
1400 //FIXME I am a win32 struct aswell
1402 typedef union _FILE_SEGMENT_ELEMENT
{
1405 }FILE_SEGMENT_ELEMENT
, *PFILE_SEGMENT_ELEMENT
;
1407 // directory information
1409 typedef struct _OBJDIR_INFORMATION
{
1410 UNICODE_STRING ObjectName
;
1411 UNICODE_STRING ObjectTypeName
; // Directory, Device ...
1413 } OBJDIR_INFORMATION
, *POBJDIR_INFORMATION
;
1416 typedef struct _FILE_DIRECTORY_INFORMATION
{
1417 ULONG NextEntryOffset
;
1420 TIME LastAccessTime
;
1423 LARGE_INTEGER EndOfFile
;
1424 LARGE_INTEGER AllocationSize
;
1425 ULONG FileAttributes
;
1426 ULONG FileNameLength
;
1428 } FILE_DIRECTORY_INFORMATION
, *PFILE_DIRECTORY_INFORMATION
;
1430 typedef struct _FILE_FULL_DIRECTORY_INFORMATION
{
1431 ULONG NextEntryOffset
;
1434 TIME LastAccessTime
;
1437 LARGE_INTEGER EndOfFile
;
1438 LARGE_INTEGER AllocationSize
;
1439 ULONG FileAttributes
;
1440 ULONG FileNameLength
;
1442 WCHAR FileName
[0]; // variable size
1443 } FILE_FULL_DIRECTORY_INFORMATION
, *PFILE_FULL_DIRECTORY_INFORMATION
,
1444 FILE_FULL_DIR_INFORMATION
, *PFILE_FULL_DIR_INFORMATION
;
1447 typedef struct _FILE_BOTH_DIRECTORY_INFORMATION
{
1448 ULONG NextEntryOffset
;
1451 TIME LastAccessTime
;
1454 LARGE_INTEGER EndOfFile
;
1455 LARGE_INTEGER AllocationSize
;
1456 ULONG FileAttributes
;
1457 ULONG FileNameLength
;
1459 CHAR ShortNameLength
;
1460 WCHAR ShortName
[12]; // 8.3 name
1462 } FILE_BOTH_DIRECTORY_INFORMATION
, *PFILE_BOTH_DIRECTORY_INFORMATION
,
1463 FILE_BOTH_DIR_INFORMATION
, *PFILE_BOTH_DIR_INFORMATION
;
1467 NotifyFilter / CompletionFilter:
1469 FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001
1470 FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002
1471 FILE_NOTIFY_CHANGE_NAME 0x00000003
1472 FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004
1473 FILE_NOTIFY_CHANGE_SIZE 0x00000008
1474 FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010
1475 FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020
1476 FILE_NOTIFY_CHANGE_CREATION 0x00000040
1477 FILE_NOTIFY_CHANGE_EA 0x00000080
1478 FILE_NOTIFY_CHANGE_SECURITY 0x00000100
1479 FILE_NOTIFY_CHANGE_STREAM_NAME 0x00000200
1480 FILE_NOTIFY_CHANGE_STREAM_SIZE 0x00000400
1481 FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
1484 typedef struct _FILE_NOTIFY_INFORMATION
{
1486 ULONG FileNameLength
;
1488 } FILE_NOTIFY_INFORMATION
;
1492 Action is one of the following values:
1494 FILE_ACTION_ADDED 0x00000001
1495 FILE_ACTION_REMOVED 0x00000002
1496 FILE_ACTION_MODIFIED 0x00000003
1497 FILE_ACTION_RENAMED_OLD_NAME 0x00000004
1498 FILE_ACTION_RENAMED_NEW_NAME 0x00000005
1499 FILE_ACTION_ADDED_STREAM 0x00000006
1500 FILE_ACTION_REMOVED_STREAM 0x00000007
1501 FILE_ACTION_MODIFIED_STREAM 0x00000008
1506 // File System Control commands ( related to defragging )
1508 #define FSCTL_READ_MFT_RECORD 0x90068 // NTFS only
1509 #define FSCTL_GET_VOLUME_BITMAP 0x9006F
1510 #define FSCTL_GET_RETRIEVAL_POINTERS 0x90073
1511 #define FSCTL_MOVE_FILE 0x90074
1513 typedef struct _MAPPING_PAIR
1517 } MAPPING_PAIR
, *PMAPPING_PAIR
;
1519 typedef struct _GET_RETRIEVAL_DESCRIPTOR
1521 ULONG NumberOfPairs
;
1523 MAPPING_PAIR Pair
[0]; // variable size
1524 } GET_RETRIEVAL_DESCRIPTOR
, *PGET_RETRIEVAL_DESCRIPTOR
;
1526 typedef struct _BITMAP_DESCRIPTOR
1529 ULONGLONG ClustersToEndOfVol
;
1530 BYTE Map
[0]; // variable size
1531 } BITMAP_DESCRIPTOR
, *PBITMAP_DESCRIPTOR
;
1533 typedef struct _MOVEFILE_DESCRIPTOR
1537 LARGE_INTEGER StartVcn
;
1538 LARGE_INTEGER TargetLcn
;
1541 } MOVEFILE_DESCRIPTOR
, *PMOVEFILE_DESCRIPTOR
;
1545 //typedef enum _TIMER_TYPE
1547 // NotificationTimer,
1548 // SynchronizationTimer
1551 typedef struct _TIMER_BASIC_INFORMATION
1553 LARGE_INTEGER TimeRemaining
;
1554 BOOLEAN SignalState
;
1555 } TIMER_BASIC_INFORMATION
, *PTIMER_BASIC_INFORMATION
;
1557 typedef enum _TIMER_INFORMATION_CLASS
1559 TimerBasicInformation
1560 } TIMER_INFORMATION_CLASS
;
1563 struct _LPC_PORT_BASIC_INFORMATION
1580 } LPC_PORT_BASIC_INFORMATION
, * PLPC_PORT_BASIC_INFORMATION
;
1582 typedef struct _SECTION_BASIC_INFORMATION
1587 } SECTION_BASIC_INFORMATION
, *PSECTION_BASIC_INFORMATION
;
1589 typedef struct _SECTION_IMAGE_INFORMATION
1596 USHORT MinorSubsystemVersion
;
1597 USHORT MajorSubsystemVersion
;
1599 ULONG Characteristics
;
1604 } SECTION_IMAGE_INFORMATION
, *PSECTION_IMAGE_INFORMATION
;
1606 typedef enum _SECTION_INFORMATION_CLASS
1608 SectionBasicInformation
,
1609 SectionImageInformation
,
1610 } SECTION_INFORMATION_CLASS
;