1 #ifndef __INCLUDE_DDK_ZWTYPES_H
2 #define __INCLUDE_DDK_ZWTYPES_H
4 typedef enum _DEBUG_CONTROL_CODE
6 DebugGetTraceInformation
= 1,
7 DebugSetInternalBreakpoint
,
9 DebugClearSpecialCalls
,
10 DebugQuerySpecialCalls
,
14 typedef enum _KPROFILE_SOURCE
19 #define NtCurrentProcess() ( (HANDLE) 0xFFFFFFFF )
20 #define NtCurrentThread() ( (HANDLE) 0xFFFFFFFE )
23 extern ULONG EXPORTED NtBuildNumber
;
25 extern ULONG IMPORTED NtBuildNumber
;
31 #define EVENT_READ_ACCESS 1
32 #define EVENT_WRITE_ACCESS 2
35 // file disposition values
38 #define FILE_SUPERSEDE 0x0000
39 #define FILE_OPEN 0x0001
40 #define FILE_CREATE 0x0002
41 #define FILE_OPEN_IF 0x0003
42 #define FILE_OVERWRITE 0x0004
43 #define FILE_OVERWRITE_IF 0x0005
44 #define FILE_MAXIMUM_DISPOSITION 0x0005
46 //process query / set information class
48 #define ProcessBasicInformation 0
49 #define ProcessQuotaLimits 1
50 #define ProcessIoCounters 2
51 #define ProcessVmCounters 3
52 #define ProcessTimes 4
53 #define ProcessBasePriority 5
54 #define ProcessRaisePriority 6
55 #define ProcessDebugPort 7
56 #define ProcessExceptionPort 8
57 #define ProcessAccessToken 9
58 #define ProcessLdtInformation 10
59 #define ProcessLdtSize 11
60 #define ProcessDefaultHardErrorMode 12
61 #define ProcessIoPortHandlers 13
62 #define ProcessPooledUsageAndLimits 14
63 #define ProcessWorkingSetWatch 15
64 #define ProcessUserModeIOPL 16
65 #define ProcessEnableAlignmentFaultFixup 17
66 #define ProcessPriorityClass 18
67 #define ProcessWx86Information 19
68 #define ProcessHandleCount 20
69 #define ProcessAffinityMask 21
70 #define ProcessImageFileName 22
71 #define MaxProcessInfoClass 23
74 * thread query / set information class
76 #define ThreadBasicInformation 0
78 #define ThreadPriority 2
79 #define ThreadBasePriority 3
80 #define ThreadAffinityMask 4
81 #define ThreadImpersonationToken 5
82 #define ThreadDescriptorTableEntry 6
83 #define ThreadEnableAlignmentFaultFixup 7
84 #define ThreadEventPair 8
85 #define ThreadQuerySetWin32StartAddress 9
86 #define ThreadZeroTlsCell 10
87 #define ThreadPerformanceCount 11
88 #define ThreadAmILastThread 12
89 #define ThreadIdealProcessor 13
90 #define ThreadPriorityBoost 14
91 #define ThreadSetTlsArrayAddress 15
92 #define ThreadIsIoPending 16
93 #define ThreadHideFromDebugger 17
94 #define MaxThreadInfoClass 17
96 // object handle information
98 #define ObjectBasicInformation 0
99 #define ObjectNameInformation 1
100 #define ObjectTypeInformation 2
101 #define ObjectAllInformation 3
102 #define ObjectDataInformation 4
106 typedef enum _ATOM_INFORMATION_CLASS
108 AtomBasicInformation
= 0,
109 AtomTableInformation
= 1,
110 } ATOM_INFORMATION_CLASS
;
112 typedef struct _ATOM_BASIC_INFORMATION
118 } ATOM_BASIC_INFORMATION
, *PATOM_BASIC_INFORMATION
;
120 typedef struct _ATOM_TABLE_INFORMATION
124 } ATOM_TABLE_INFORMATION
, *PATOM_TABLE_INFORMATION
;
127 // semaphore information
129 typedef enum _SEMAPHORE_INFORMATION_CLASS
131 SemaphoreBasicInformation
= 0
132 } SEMAPHORE_INFORMATION_CLASS
;
134 typedef struct _SEMAPHORE_BASIC_INFORMATION
138 } SEMAPHORE_BASIC_INFORMATION
, *PSEMAPHORE_BASIC_INFORMATION
;
143 typedef enum _EVENT_INFORMATION_CLASS
145 EventBasicInformation
= 0
146 } EVENT_INFORMATION_CLASS
;
148 typedef struct _EVENT_BASIC_INFORMATION
150 EVENT_TYPE EventType
;
152 } EVENT_BASIC_INFORMATION
, *PEVENT_BASIC_INFORMATION
;
155 // system information
156 // {Nt|Zw}{Query|Set}SystemInformation
157 // (GN means Gary Nebbet in "NT/W2K Native API Reference")
160 enum _SYSTEM_INFORMATION_CLASS
162 SystemInformationClassMin
= 0,
163 SystemBasicInformation
= 0, /* Q */
165 SystemProcessorInformation
= 1, /* Q */
167 SystemPerformanceInformation
= 2, /* Q */
169 SystemTimeOfDayInformation
= 3, /* Q */
171 SystemPathInformation
= 4, /* Q (checked build only) */
172 SystemNotImplemented1
= 4, /* Q (GN) */
174 SystemProcessInformation
= 5, /* Q */
175 SystemProcessesAndThreadsInformation
= 5, /* Q (GN) */
177 SystemCallCountInfoInformation
= 6, /* Q */
178 SystemCallCounts
= 6, /* Q (GN) */
180 SystemDeviceInformation
= 7, /* Q */
181 // It conflicts with symbol in ntoskrnl/io/resource.c
182 // SystemConfigurationInformation = 7, /* Q (GN) */
184 SystemProcessorPerformanceInformation
= 8, /* Q */
185 SystemProcessorTimes
= 8, /* Q (GN) */
187 SystemFlagsInformation
= 9, /* QS */
188 SystemGlobalFlag
= 9, /* QS (GN) */
190 SystemCallTimeInformation
= 10,
191 SystemNotImplemented2
= 10, /* (GN) */
193 SystemModuleInformation
= 11, /* Q */
195 SystemLocksInformation
= 12, /* Q */
196 SystemLockInformation
= 12, /* Q (GN) */
198 SystemStackTraceInformation
= 13,
199 SystemNotImplemented3
= 13, /* Q (GN) */
201 SystemPagedPoolInformation
= 14,
202 SystemNotImplemented4
= 14, /* Q (GN) */
204 SystemNonPagedPoolInformation
= 15,
205 SystemNotImplemented5
= 15, /* Q (GN) */
207 SystemHandleInformation
= 16, /* Q */
209 SystemObjectInformation
= 17, /* Q */
211 SystemPageFileInformation
= 18, /* Q */
212 SystemPagefileInformation
= 18, /* Q (GN) */
214 SystemVdmInstemulInformation
= 19, /* Q */
215 SystemInstructionEmulationCounts
= 19, /* Q (GN) */
217 SystemVdmBopInformation
= 20,
218 SystemInvalidInfoClass1
= 20, /* (GN) */
220 SystemFileCacheInformation
= 21, /* QS */
221 SystemCacheInformation
= 21, /* QS (GN) */
223 SystemPoolTagInformation
= 22, /* Q (checked build only) */
225 SystemInterruptInformation
= 23, /* Q */
226 SystemProcessorStatistics
= 23, /* Q (GN) */
228 SystemDpcBehaviourInformation
= 24, /* QS */
229 SystemDpcInformation
= 24, /* QS (GN) */
231 SystemFullMemoryInformation
= 25,
232 SystemNotImplemented6
= 25, /* (GN) */
234 SystemLoadGdiDriverInformation
= 26, /* S (callable) */
235 SystemLoadImage
= 26, /* S (callable) (GN) */
237 SystemUnloadGdiDriverInformation
= 27, /* S (callable) */
238 SystemUnloadImage
= 27, /* S (callable) (GN) */
240 SystemTimeAdjustmentInformation
= 28, /* QS */
241 SystemTimeAdjustment
= 28, /* QS (GN) */
243 SystemSummaryMemoryInformation
= 29,
244 SystemNotImplemented7
= 29, /* (GN) */
246 SystemNextEventIdInformation
= 30,
247 SystemNotImplemented8
= 30, /* (GN) */
249 SystemEventIdsInformation
= 31,
250 SystemNotImplemented9
= 31, /* (GN) */
252 SystemCrashDumpInformation
= 32, /* Q */
254 SystemExceptionInformation
= 33, /* Q */
256 SystemCrashDumpStateInformation
= 34, /* Q */
258 SystemKernelDebuggerInformation
= 35, /* Q */
260 SystemContextSwitchInformation
= 36, /* Q */
262 SystemRegistryQuotaInformation
= 37, /* QS */
264 SystemExtendServiceTableInformation
= 38, /* S */
265 SystemLoadAndCallImage
= 38, /* S (GN) */
267 SystemPrioritySeparation
= 39, /* S */
269 SystemPlugPlayBusInformation
= 40,
270 SystemNotImplemented10
= 40, /* Q (GN) */
272 SystemDockInformation
= 41,
273 SystemNotImplemented11
= 41, /* Q (GN) */
275 SystemPowerInformation
= 42,
276 SystemInvalidInfoClass2
= 42, /* (GN) */
278 SystemProcessorSpeedInformation
= 43,
279 SystemInvalidInfoClass3
= 43, /* (GN) */
281 SystemCurrentTimeZoneInformation
= 44, /* QS */
282 SystemTimeZoneInformation
= 44, /* QS (GN) */
284 SystemLookasideInformation
= 45, /* Q */
286 SystemSetTimeSlipEvent
= 46, /* S (GN) */
288 SystemCreateSession
= 47, /* S (GN) */
290 SystemDeleteSession
= 48, /* S (GN) */
292 SystemInvalidInfoClass4
= 49, /* (GN) */
294 SystemRangeStartInformation
= 50, /* Q (GN) */
296 SystemVerifierInformation
= 51, /* QS (GN) */
298 SystemAddVerifier
= 52, /* S (GN) */
300 SystemSessionProcessesInformation
= 53, /* Q (GN) */
301 SystemInformationClassMax
303 } SYSTEM_INFORMATION_CLASS
;
305 // SystemBasicInformation (0)
307 struct _SYSTEM_BASIC_INFORMATION
310 ULONG TimerResolution
;
312 ULONG NumberOfPhysicalPages
;
313 ULONG LowestPhysicalPageNumber
;
314 ULONG HighestPhysicalPageNumber
;
315 ULONG AllocationGranularity
;
316 ULONG MinimumUserModeAddress
;
317 ULONG MaximumUserModeAddress
;
318 KAFFINITY ActiveProcessorsAffinityMask
;
319 CCHAR NumberOfProcessors
;
320 } SYSTEM_BASIC_INFORMATION
, *PSYSTEM_BASIC_INFORMATION
;
322 // SystemProcessorInformation (1)
324 struct _SYSTEM_PROCESSOR_INFORMATION
326 USHORT ProcessorArchitecture
;
327 USHORT ProcessorLevel
;
328 USHORT ProcessorRevision
;
330 ULONG ProcessorFeatureBits
;
331 } SYSTEM_PROCESSOR_INFORMATION
, *PSYSTEM_PROCESSOR_INFORMATION
;
333 // SystemPerformanceInfo (2)
335 struct _SYSTEM_PERFORMANCE_INFORMATION
337 LARGE_INTEGER IdleProcessorTime
;
338 LARGE_INTEGER IoReadTransferCount
;
339 LARGE_INTEGER IoWriteTransferCount
;
340 LARGE_INTEGER IoOtherTransferCount
;
341 ULONG IoReadOperationCount
;
342 ULONG IoWriteOperationCount
;
343 ULONG IoOtherOperationCount
;
344 ULONG AvailablePages
;
347 ULONG PeakCommitment
;
348 ULONG PageFaultCount
;
349 ULONG CopyOnWriteCount
;
350 ULONG TransitionCount
;
351 ULONG CacheTransitionCount
;
352 ULONG DemandZeroCount
;
354 ULONG PageReadIoCount
;
355 ULONG CacheReadCount
;
357 ULONG DirtyPagesWriteCount
;
358 ULONG DirtyWriteIoCount
;
359 ULONG MappedPagesWriteCount
;
360 ULONG MappedWriteIoCount
;
361 ULONG PagedPoolPages
;
362 ULONG NonPagedPoolPages
;
367 ULONG MmTotalSystemFreePtes
;
368 ULONG MmSystemCodepage
;
369 ULONG MmTotalSystemDriverPages
;
370 ULONG MmTotalSystemCodePages
;
374 ULONG MmSystemCachePage
;
375 ULONG MmPagedPoolPage
;
376 ULONG MmSystemDriverPage
;
377 ULONG CcFastReadNoWait
;
378 ULONG CcFastReadWait
;
379 ULONG CcFastReadResourceMiss
;
380 ULONG CcFastReadNotPossible
;
381 ULONG CcFastMdlReadNoWait
;
382 ULONG CcFastMdlReadWait
;
383 ULONG CcFastMdlReadResourceMiss
;
384 ULONG CcFastMdlReadNotPossible
;
385 ULONG CcMapDataNoWait
;
387 ULONG CcMapDataNoWaitMiss
;
388 ULONG CcMapDataWaitMiss
;
389 ULONG CcPinMappedDataCount
;
390 ULONG CcPinReadNoWait
;
392 ULONG CcPinReadNoWaitMiss
;
393 ULONG CcPinReadWaitMiss
;
394 ULONG CcCopyReadNoWait
;
395 ULONG CcCopyReadWait
;
396 ULONG CcCopyReadNoWaitMiss
;
397 ULONG CcCopyReadWaitMiss
;
398 ULONG CcMdlReadNoWait
;
400 ULONG CcMdlReadNoWaitMiss
;
401 ULONG CcMdlReadWaitMiss
;
402 ULONG CcReadaheadIos
;
403 ULONG CcLazyWriteIos
;
404 ULONG CcLazyWritePages
;
407 ULONG ContextSwitches
;
412 } SYSTEM_PERFORMANCE_INFO
, *PSYSTEM_PERFORMANCE_INFO
;
414 // SystemTimeOfDayInformation (3)
416 struct _SYSTEM_TIMEOFDAY_INFORMATION
418 LARGE_INTEGER BootTime
;
419 LARGE_INTEGER CurrentTime
;
420 LARGE_INTEGER TimeZoneBias
;
423 } SYSTEM_TIMEOFDAY_INFORMATION
, *PSYSTEM_TIMEOFDAY_INFORMATION
;
425 // SystemPathInformation (4)
428 struct _SYSTEM_PATH_INFORMATION
432 } SYSTEM_PATH_INFORMATION
, * PSYSTEM_PATH_INFORMATION
;
434 // SystemProcessInformation (5)
436 struct _SYSTEM_THREAD_INFORMATION
444 ULONG DynamicPriority
;
448 KWAIT_REASON WaitReason
;
450 } SYSTEM_THREAD_INFORMATION
, *PSYSTEM_THREAD_INFORMATION
;
453 struct SYSTEM_PROCESS_INFORMATION
455 ULONG RelativeOffset
;
464 ULONG ParentProcessId
;
467 ULONG PeakVirtualSizeBytes
;
468 ULONG TotalVirtualSizeBytes
;
469 ULONG PageFaultCount
;
470 ULONG PeakWorkingSetSizeBytes
;
471 ULONG TotalWorkingSetSizeBytes
;
472 ULONG PeakPagedPoolUsagePages
;
473 ULONG TotalPagedPoolUsagePages
;
474 ULONG PeakNonPagedPoolUsagePages
;
475 ULONG TotalNonPagedPoolUsagePages
;
476 ULONG TotalPageFileUsageBytes
;
477 ULONG PeakPageFileUsageBytes
;
478 ULONG TotalPrivateBytes
;
479 SYSTEM_THREAD_INFORMATION ThreadSysInfo
[1];
481 } SYSTEM_PROCESS_INFORMATION
, *PSYSTEM_PROCESS_INFORMATION
;
483 // SystemCallCountInformation (6)
485 struct _SYSTEM_SDT_INFORMATION
488 ULONG NumberOfSystemServiceTables
;
489 ULONG NumberOfServices
[1];
490 ULONG ServiceCounters
[1];
492 } SYSTEM_SDT_INFORMATION
, *PSYSTEM_SDT_INFORMATION
;
494 // SystemDeviceInformation (7)
496 struct _SYSTEM_DEVICE_INFORMATION
499 ULONG NumberOfFloppies
;
500 ULONG NumberOfCdRoms
;
502 ULONG NumberOfSerialPorts
;
503 ULONG NumberOfParallelPorts
;
504 } SYSTEM_DEVICE_INFORMATION
, *PSYSTEM_DEVICE_INFORMATION
;
506 // SystemProcessorPerformanceInformation (8)
507 // (one per processor in the system)
509 struct _SYSTEM_PROCESSORTIME_INFO
511 TIME TotalProcessorRunTime
;
512 TIME TotalProcessorTime
;
513 TIME TotalProcessorUserTime
;
515 TIME TotalInterruptTime
;
516 ULONG TotalInterrupts
;
519 } SYSTEM_PROCESSORTIME_INFO
, *PSYSTEM_PROCESSORTIME_INFO
;
521 // SystemFlagsInformation (9)
523 struct _SYSTEM_FLAGS_INFORMATION
527 } SYSTEM_FLAGS_INFORMATION
, * PSYSTEM_FLAGS_INFORMATION
;
529 #define FLG_STOP_ON_EXCEPTION 0x00000001
530 #define FLG_SHOW_LDR_SNAPS 0x00000002
531 #define FLG_DEBUG_INITIAL_COMMAND 0x00000004
532 #define FLG_STOP_ON_HANG_GUI 0x00000008
533 #define FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010
534 #define FLG_HEAP_ENABLE_FREE_CHECK 0x00000020
535 #define FLG_HEAP_VALIDATE_PARAMETERS 0x00000040
536 #define FLG_HEAP_VALIDATE_ALL 0x00000080
537 #define FLG_POOL_ENABLE_TAIL_CHECK 0x00000100
538 #define FLG_POOL_ENABLE_FREE_CHECK 0x00000200
539 #define FLG_POOL_ENABLE_TAGGING 0x00000400
540 #define FLG_HEAP_ENABLE_TAGGING 0x00000800
541 #define FLG_USER_STACK_TRACE_DB 0x00001000
542 #define FLG_KERNEL_STACK_TRACE_DB 0x00002000
543 #define FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000
544 #define FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000
545 #define FLG_IGNORE_DEBUG_PRIV 0x00010000
546 #define FLG_ENABLE_CSRDEBUG 0x00020000
547 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000
548 #define FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000
549 #define FLG_HEAP_ENABLE_CALL_TRACING 0x00100000
550 #define FLG_HEAP_DISABLE_COALESCING 0x00200000
551 #define FLG_ENABLE_CLOSE_EXCEPTION 0x00400000
552 #define FLG_ENABLE_EXCEPTION_LOGGING 0x00800000
553 #define FLG_UNKNOWN_01000000 0x01000000
554 #define FLG_UNKNOWN_02000000 0x02000000
555 #define FLG_UNKNOWN_04000000 0x04000000
556 #define FLG_ENABLE_DBGPRINT_BUFFERING 0x08000000
557 #define FLG_UNKNOWN_10000000 0x10000000
558 #define FLG_UNKNOWN_20000000 0x20000000
559 #define FLG_UNKNOWN_40000000 0x40000000
560 #define FLG_UNKNOWN_80000000 0x80000000
562 // SystemCallTimeInformation (10)
565 // SystemModuleInformation (11)
567 struct _SYSTEM_MODULE_ENTRY
575 USHORT NameLength
; /* Length of module name not including the path, this field contains valid value only for NTOSKRNL module*/
576 USHORT PathLength
; /* Length of 'directory path' part of modulename*/
578 } SYSTEM_MODULE_ENTRY
, * PSYSTEM_MODULE_ENTRY
;
581 struct _SYSTEM_MODULE_INFORMATION
584 SYSTEM_MODULE_ENTRY Module
[1];
585 } SYSTEM_MODULE_INFORMATION
, *PSYSTEM_MODULE_INFORMATION
;
587 // SystemLocksInformation (12)
589 struct _SYSTEM_RESOURCE_LOCK_ENTRY
591 ULONG ResourceAddress
;
595 ULONG ContentionCount
;
597 ULONG NumberOfSharedWaiters
;
598 ULONG NumberOfExclusiveWaiters
;
600 } SYSTEM_RESOURCE_LOCK_ENTRY
, *PSYSTEM_RESOURCE_LOCK_ENTRY
;
603 struct _SYSTEM_RESOURCE_LOCK_INFO
606 SYSTEM_RESOURCE_LOCK_ENTRY Lock
[1];
608 } SYSTEM_RESOURCE_LOCK_INFO
, *PSYSTEM_RESOURCE_LOCK_INFO
;
610 // SystemInformation13 (13)
613 // SystemInformation14 (14)
616 // SystemInformation15 (15)
619 // SystemHandleInformation (16)
622 struct _SYSTEM_HANDLE_ENTRY
631 } SYSTEM_HANDLE_ENTRY
, *PSYSTEM_HANDLE_ENTRY
;
634 struct _SYSTEM_HANDLE_INFORMATION
637 SYSTEM_HANDLE_ENTRY Handle
[1];
639 } SYSTEM_HANDLE_INFORMATION
, *PSYSTEM_HANDLE_INFORMATION
;
641 // SystemObjectInformation (17)
643 struct _SYSTEM_OBJECT_TYPE_INFORMATION
645 ULONG NextEntryOffset
;
649 ULONG InvalidAttributes
;
650 GENERIC_MAPPING GenericMapping
;
651 ACCESS_MASK ValidAccessMask
;
656 } SYSTEM_OBJECT_TYPE_INFORMATION
, *PSYSTEM_OBJECT_TYPE_INFORMATION
;
659 struct _SYSTEM_OBJECT_INFORMATION
661 ULONG NextEntryOffset
;
663 ULONG CreatorProcessId
;
668 ULONG PagedPoolUsage
;
669 ULONG NonPagedPoolUsage
;
670 ULONG ExclusiveProcessId
;
671 PSECURITY_DESCRIPTOR SecurityDescriptor
;
674 } SYSTEM_OBJECT_INFORMATION
, *PSYSTEM_OBJECT_INFORMATION
;
676 // SystemPageFileInformation (18)
678 struct _SYSTEM_PAGEFILE_INFORMATION
680 ULONG RelativeOffset
;
681 ULONG CurrentSizePages
;
682 ULONG TotalUsedPages
;
684 UNICODE_STRING PagefileFileName
;
686 } SYSTEM_PAGEFILE_INFORMATION
, *PSYSTEM_PAGEFILE_INFORMATION
;
688 // SystemInstructionEmulationInfo (19)
690 struct _SYSTEM_VDM_INFORMATION
692 ULONG VdmSegmentNotPresentCount
;
694 ULONG VdmESPREFIXCount
;
695 ULONG VdmCSPREFIXCount
;
696 ULONG VdmSSPREFIXCount
;
697 ULONG VdmDSPREFIXCount
;
698 ULONG VdmFSPREFIXCount
;
699 ULONG VdmGSPREFIXCount
;
700 ULONG VdmOPER32PREFIXCount
;
701 ULONG VdmADDR32PREFIXCount
;
703 ULONG VdmINSWV86Count
;
711 ULONG VdmINBIMMCount
;
712 ULONG VdmINWIMMCount
;
713 ULONG VdmOUTBIMMCount
;
714 ULONG VdmOUTWIMMCount
;
719 ULONG VdmLOCKPREFIXCount
;
720 ULONG VdmREPNEPREFIXCount
;
721 ULONG VdmREPPREFIXCount
;
727 } SYSTEM_VDM_INFORMATION
, *PSYSTEM_VDM_INFORMATION
;
729 // SystemInformation20 (20)
732 // SystemCacheInformation (21)
734 struct _SYSTEM_CACHE_INFORMATION
738 ULONG PageFaultCount
;
739 ULONG MinimumWorkingSet
;
740 ULONG MaximumWorkingSet
;
743 } SYSTEM_CACHE_INFORMATION
;
745 // SystemPoolTagInformation (22)
746 // found by Klaus P. Gerlicher
747 // (implemented only in checked builds)
749 struct _POOL_TAG_STATS
751 ULONG AllocationCount
;
758 struct _SYSTEM_POOL_TAG_ENTRY
761 POOL_TAG_STATS Paged
;
762 POOL_TAG_STATS NonPaged
;
764 } SYSTEM_POOL_TAG_ENTRY
, * PSYSTEM_POOL_TAG_ENTRY
;
767 struct _SYSTEM_POOL_TAG_INFO
770 SYSTEM_POOL_TAG_ENTRY PoolEntry
[1];
772 } SYSTEM_POOL_TAG_INFO
, *PSYSTEM_POOL_TAG_INFO
;
774 // SystemProcessorScheduleInfo (23)
776 struct _SYSTEM_PROCESSOR_SCHEDULE_INFO
778 ULONG nContextSwitches
;
781 ULONG TimerResolution
;
785 } SYSTEM_PROCESSOR_SCHEDULE_INFO
, *PSYSTEM_PROCESSOR_SCHEDULE_INFO
;
787 // SystemDpcInformation (24)
789 struct _SYSTEM_DPC_INFORMATION
792 ULONG KiMaximumDpcQueueDepth
;
793 ULONG KiMinimumDpcRate
;
794 ULONG KiAdjustDpcThreshold
;
795 ULONG KiIdealDpcRate
;
797 } SYSTEM_DPC_INFORMATION
, *PSYSTEM_DPC_INFORMATION
;
799 // SystemInformation25 (25)
802 // SystemLoadGdiDriverInformation (26)
803 // SystemUnloadGdiDriverInformation (27)
804 typedef struct _SYSTEM_GDI_DRIVER_INFORMATION
806 UNICODE_STRING DriverName
;
808 PVOID SectionPointer
;
810 // PIMAGE_EXPORT_DIRECTORY ExportSectionPointer;
811 PVOID ExportSectionPointer
;
812 } SYSTEM_GDI_DRIVER_INFORMATION
, *PSYSTEM_GDI_DRIVER_INFORMATION
;
814 // SystemTimeAdjustmentInformation (28)
816 struct _SYSTEM_QUERY_TIME_ADJUSTMENT
818 ULONG TimeAdjustment
;
819 ULONG MaximumIncrement
;
820 BOOLEAN TimeSynchronization
;
822 } SYSTEM_QUERY_TIME_ADJUSTMENT
, *PSYSTEM_QUERY_TIME_ADJUSTMENT
;
825 struct _SYSTEM_SET_TIME_ADJUSTMENT
827 ULONG TimeAdjustment
;
828 BOOLEAN TimeSynchronization
;
830 } SYSTEM_TIME_ADJUSTMENT_INFO
, *PSYSTEM_TIME_ADJUSTMENT_INFO
;
832 // SystemProcessorFaultCountInfo (33)
834 struct _SYSTEM_PROCESSOR_FAULT_INFO
836 ULONG nAlignmentFixup
;
837 ULONG nExceptionDispatches
;
838 ULONG nFloatingEmulation
;
841 } SYSTEM_PROCESSOR_FAULT_INFO
, *PSYSTEM_PROCESSOR_FAULT_INFO
;
843 // SystemCrashDumpStateInfo (34)
846 // SystemDebuggerInformation (35)
848 struct _SYSTEM_DEBUGGER_INFO
850 BOOLEAN KdDebuggerEnabled
;
851 BOOLEAN KdDebuggerPresent
;
853 } SYSTEM_DEBUGGER_INFO
, *PSYSTEM_DEBUGGER_INFO
;
855 // SystemInformation36 (36)
858 // SystemQuotaInformation (37)
860 struct _SYSTEM_QUOTA_INFORMATION
862 ULONG CmpGlobalQuota
;
863 ULONG CmpGlobalQuotaUsed
;
864 ULONG MmSizeofPagedPoolInBytes
;
866 } SYSTEM_QUOTA_INFORMATION
, *PSYSTEM_QUOTA_INFORMATION
;
868 // SystemLoadDriver (38)
870 struct _SYSTEM_DRIVER_LOAD
872 UNICODE_STRING DriverRegistryEntry
;
874 } SYSTEM_DRIVER_LOAD
, *PSYSTEM_DRIVER_LOAD
;
876 // SystemTimeZoneInformation (44)
878 struct _SYSTEM_TIME_ZONE_INFORMATION
881 WCHAR StandardName
[32];
884 WCHAR DaylightName
[32];
888 } SYSTEM_TIME_ZONE_INFORMATION
, * PSYSTEM_TIME_ZONE_INFORMATION
;
890 // SystemLookasideInformation (45)
892 struct _SYSTEM_LOOKASIDE_INFORMATION
896 ULONG TotalAllocates
;
897 ULONG AllocatesMisses
;
904 } SYSTEM_LOOKASIDE_INFORMATION
, * PSYSTEM_LOOKASIDE_INFORMATION
;
906 // SystemSetTimeSlipEvent (46)
908 struct _SYSTEM_SET_TIME_SLIP_EVENT
910 HANDLE TimeSlipEvent
; /* IN */
912 } SYSTEM_SET_TIME_SLIP_EVENT
, * PSYSTEM_SET_TIME_SLIP_EVENT
;
914 // SystemCreateSession (47)
915 // (available only on TSE)
917 struct _SYSTEM_CREATE_SESSION
919 ULONG SessionId
; /* OUT */
921 } SYSTEM_CREATE_SESSION
, * PSYSTEM_CREATE_SESSION
;
923 // SystemDeleteSession (48)
924 // (available only on TSE)
926 struct _SYSTEM_DELETE_SESSION
928 ULONG SessionId
; /* IN */
930 } SYSTEM_DELETE_SESSION
, * PSYSTEM_DELETE_SESSION
;
935 // SystemRangeStartInformation (50)
937 struct _SYSTEM_RANGE_START_INFORMATION
939 PVOID SystemRangeStart
;
941 } SYSTEM_RANGE_START_INFORMATION
, * PSYSTEM_RANGE_START_INFORMATION
;
943 // SystemVerifierInformation (51)
946 // SystemAddVerifier (52)
949 // SystemSessionProcessesInformation (53)
950 // (available only on TSE)
952 struct _SYSTEM_SESSION_PROCESSES_INFORMATION
956 PVOID Buffer
; /* same format as in SystemProcessInformation */
958 } SYSTEM_SESSION_PROCESSES_INFORMATION
, * PSYSTEM_SESSION_PROCESSES_INFORMATION
;
960 // memory information
962 #define MemoryBasicInformation 0
966 typedef enum SHUTDOWN_ACTION_TAG
{
977 // number of wait objects
979 #define THREAD_WAIT_OBJECTS 3
980 //#define MAXIMUM_WAIT_OBJECTS 64
984 #define REG_WHOLE_HIVE_VOLATILE 1
985 #define REG_REFRESH_HIVE 2
987 // object type access rights
989 #define OBJECT_TYPE_CREATE 0x0001
990 #define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
992 // directory access rights
994 #define DIRECTORY_QUERY 0x0001
995 #define DIRECTORY_TRAVERSE 0x0002
996 #define DIRECTORY_CREATE_OBJECT 0x0004
997 #define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
999 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
1001 // symbolic link access rights
1003 #define SYMBOLIC_LINK_QUERY 0x0001
1004 #define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
1006 typedef struct _PROCESS_WS_WATCH_INFORMATION
1010 } PROCESS_WS_WATCH_INFORMATION
, *PPROCESS_WS_WATCH_INFORMATION
;
1012 typedef struct _PROCESS_BASIC_INFORMATION
1014 NTSTATUS ExitStatus
;
1015 PPEB PebBaseAddress
;
1016 KAFFINITY AffinityMask
;
1017 KPRIORITY BasePriority
;
1018 ULONG UniqueProcessId
;
1019 ULONG InheritedFromUniqueProcessId
;
1020 } PROCESS_BASIC_INFORMATION
, *PPROCESS_BASIC_INFORMATION
;
1022 typedef struct _QUOTA_LIMITS
1024 ULONG PagedPoolLimit
;
1025 ULONG NonPagedPoolLimit
;
1026 ULONG MinimumWorkingSetSize
;
1027 ULONG MaximumWorkingSetSize
;
1028 ULONG PagefileLimit
;
1030 } QUOTA_LIMITS
, *PQUOTA_LIMITS
;
1032 typedef struct _IO_COUNTERS
1034 ULONG ReadOperationCount
;
1035 ULONG WriteOperationCount
;
1036 ULONG OtherOperationCount
;
1037 LARGE_INTEGER ReadTransferCount
;
1038 LARGE_INTEGER WriteTransferCount
;
1039 LARGE_INTEGER OtherTransferCount
;
1040 } IO_COUNTERS
, *PIO_COUNTERS
;
1043 typedef struct _VM_COUNTERS_
1045 ULONG PeakVirtualSize
;
1047 ULONG PageFaultCount
;
1048 ULONG PeakWorkingSetSize
;
1049 ULONG WorkingSetSize
;
1050 ULONG QuotaPeakPagedPoolUsage
;
1051 ULONG QuotaPagedPoolUsage
;
1052 ULONG QuotaPeakNonPagedPoolUsage
;
1053 ULONG QuotaNonPagedPoolUsage
;
1054 ULONG PagefileUsage
;
1055 ULONG PeakPagefileUsage
;
1056 } VM_COUNTERS
, *PVM_COUNTERS
;
1059 typedef struct _POOLED_USAGE_AND_LIMITS_
1061 ULONG PeakPagedPoolUsage
;
1062 ULONG PagedPoolUsage
;
1063 ULONG PagedPoolLimit
;
1064 ULONG PeakNonPagedPoolUsage
;
1065 ULONG NonPagedPoolUsage
;
1066 ULONG NonPagedPoolLimit
;
1067 ULONG PeakPagefileUsage
;
1068 ULONG PagefileUsage
;
1069 ULONG PagefileLimit
;
1070 } POOLED_USAGE_AND_LIMITS
, *PPOOLED_USAGE_AND_LIMITS
;
1073 typedef struct _PROCESS_ACCESS_TOKEN
1077 } PROCESS_ACCESS_TOKEN
, *PPROCESS_ACCESS_TOKEN
;
1079 typedef struct _KERNEL_USER_TIMES
1085 } KERNEL_USER_TIMES
;
1086 typedef KERNEL_USER_TIMES
*PKERNEL_USER_TIMES
;
1088 // thread information
1090 // incompatible with MS NT
1092 typedef struct _THREAD_BASIC_INFORMATION
1094 NTSTATUS ExitStatus
;
1095 PVOID TebBaseAddress
;
1097 KAFFINITY AffinityMask
;
1099 KPRIORITY BasePriority
;
1100 } THREAD_BASIC_INFORMATION
, *PTHREAD_BASIC_INFORMATION
;
1102 // object information
1104 typedef struct _OBJECT_NAME_INFORMATION
1106 UNICODE_STRING Name
;
1107 } OBJECT_NAME_INFORMATION
, *POBJECT_NAME_INFORMATION
;
1111 typedef struct _OBJECT_DATA_INFORMATION
1113 BOOLEAN bInheritHandle
;
1114 BOOLEAN bProtectFromClose
;
1115 } OBJECT_DATA_INFORMATION
, *POBJECT_DATA_INFORMATION
;
1118 typedef struct _OBJECT_TYPE_INFORMATION
1120 UNICODE_STRING Name
;
1121 UNICODE_STRING Type
;
1123 ULONG ReferenceCount
;
1124 } OBJECT_TYPE_INFORMATION
, *POBJECT_TYPE_INFORMATION
;
1128 typedef struct _FILE_BASIC_INFORMATION
1131 TIME LastAccessTime
;
1134 ULONG FileAttributes
;
1135 } FILE_BASIC_INFORMATION
, *PFILE_BASIC_INFORMATION
;
1137 typedef struct _FILE_STANDARD_INFORMATION
1139 LARGE_INTEGER AllocationSize
;
1140 LARGE_INTEGER EndOfFile
;
1141 ULONG NumberOfLinks
;
1142 BOOLEAN DeletePending
;
1144 } FILE_STANDARD_INFORMATION
, *PFILE_STANDARD_INFORMATION
;
1146 typedef struct _FILE_POSITION_INFORMATION
1148 LARGE_INTEGER CurrentByteOffset
;
1149 } FILE_POSITION_INFORMATION
, *PFILE_POSITION_INFORMATION
;
1151 typedef struct _FILE_ALIGNMENT_INFORMATION
1153 ULONG AlignmentRequirement
;
1154 } FILE_ALIGNMENT_INFORMATION
, *PFILE_ALIGNMENT_INFORMATION
;
1156 typedef struct _FILE_DISPOSITION_INFORMATION
1158 BOOLEAN DoDeleteFile
;
1159 } FILE_DISPOSITION_INFORMATION
, *PFILE_DISPOSITION_INFORMATION
;
1161 typedef struct _FILE_END_OF_FILE_INFORMATION
1163 LARGE_INTEGER EndOfFile
;
1164 } FILE_END_OF_FILE_INFORMATION
, *PFILE_END_OF_FILE_INFORMATION
;
1166 typedef struct _FILE_NETWORK_OPEN_INFORMATION
1169 TIME LastAccessTime
;
1172 LARGE_INTEGER AllocationSize
;
1173 LARGE_INTEGER EndOfFile
;
1174 ULONG FileAttributes
;
1175 } FILE_NETWORK_OPEN_INFORMATION
, *PFILE_NETWORK_OPEN_INFORMATION
;
1177 typedef struct _FILE_FULL_EA_INFORMATION
1179 ULONG NextEntryOffset
;
1182 USHORT EaValueLength
;
1184 } FILE_FULL_EA_INFORMATION
, *PFILE_FULL_EA_INFORMATION
;
1187 typedef struct _FILE_EA_INFORMATION
{
1189 } FILE_EA_INFORMATION
, *PFILE_EA_INFORMATION
;
1192 typedef struct _FILE_GET_EA_INFORMATION
{
1193 ULONG NextEntryOffset
;
1196 } FILE_GET_EA_INFORMATION
, *PFILE_GET_EA_INFORMATION
;
1198 typedef struct _FILE_STREAM_INFORMATION
{
1199 ULONG NextEntryOffset
;
1200 ULONG StreamNameLength
;
1201 LARGE_INTEGER StreamSize
;
1202 LARGE_INTEGER StreamAllocationSize
;
1203 WCHAR StreamName
[0];
1204 } FILE_STREAM_INFORMATION
, *PFILE_STREAM_INFORMATION
;
1206 typedef struct _FILE_ALLOCATION_INFORMATION
{
1207 LARGE_INTEGER AllocationSize
;
1208 } FILE_ALLOCATION_INFORMATION
, *PFILE_ALLOCATION_INFORMATION
;
1210 typedef struct _FILE_NAME_INFORMATION
{
1211 ULONG FileNameLength
;
1213 } FILE_NAME_INFORMATION
, *PFILE_NAME_INFORMATION
;
1215 typedef struct _FILE_NAMES_INFORMATION
1217 ULONG NextEntryOffset
;
1219 ULONG FileNameLength
;
1221 } FILE_NAMES_INFORMATION
, *PFILE_NAMES_INFORMATION
;
1224 typedef struct _FILE_RENAME_INFORMATION
{
1227 ULONG FileNameLength
;
1229 } FILE_RENAME_INFORMATION
, *PFILE_RENAME_INFORMATION
;
1232 typedef struct _FILE_INTERNAL_INFORMATION
{
1233 LARGE_INTEGER IndexNumber
;
1234 } FILE_INTERNAL_INFORMATION
, *PFILE_INTERNAL_INFORMATION
;
1236 typedef struct _FILE_ACCESS_INFORMATION
{
1237 ACCESS_MASK AccessFlags
;
1238 } FILE_ACCESS_INFORMATION
, *PFILE_ACCESS_INFORMATION
;
1241 typedef struct _FILE_MODE_INFORMATION
{
1243 } FILE_MODE_INFORMATION
, *PFILE_MODE_INFORMATION
;
1246 typedef struct _FILE_PIPE_INFORMATION
{
1248 ULONG CompletionMode
;
1249 } FILE_PIPE_INFORMATION
, *PFILE_PIPE_INFORMATION
;
1251 typedef struct _FILE_PIPE_LOCAL_INFORMATION
{
1252 ULONG NamedPipeType
;
1253 ULONG NamedPipeConfiguration
;
1254 ULONG MaximumInstances
;
1255 ULONG CurrentInstances
;
1257 ULONG ReadDataAvailable
;
1258 ULONG OutboundQuota
;
1259 ULONG WriteQuotaAvailable
;
1260 ULONG NamedPipeState
;
1262 } FILE_PIPE_LOCAL_INFORMATION
, *PFILE_PIPE_LOCAL_INFORMATION
;
1264 typedef struct _FILE_PIPE_REMOTE_INFORMATION
{
1265 LARGE_INTEGER CollectDataTime
;
1266 ULONG MaximumCollectionCount
;
1267 } FILE_PIPE_REMOTE_INFORMATION
, *PFILE_PIPE_REMOTE_INFORMATION
;
1269 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION
{
1270 ULONG MaxMessageSize
;
1271 ULONG Unknown
; /* ?? */
1274 LARGE_INTEGER Timeout
;
1275 } FILE_MAILSLOT_QUERY_INFORMATION
, *PFILE_MAILSLOT_QUERY_INFORMATION
;
1277 typedef struct _FILE_MAILSLOT_SET_INFORMATION
{
1278 LARGE_INTEGER Timeout
;
1279 } FILE_MAILSLOT_SET_INFORMATION
, *PFILE_MAILSLOT_SET_INFORMATION
;
1281 typedef struct _FILE_COMPRESSION_INFORMATION
{
1282 LARGE_INTEGER CompressedFileSize
;
1283 USHORT CompressionFormat
;
1284 UCHAR CompressionUnitShift
;
1288 } FILE_COMPRESSION_INFORMATION
, *PFILE_COMPRESSION_INFORMATION
;
1290 typedef struct _FILE_ALL_INFORMATION
{
1291 FILE_BASIC_INFORMATION BasicInformation
;
1292 FILE_STANDARD_INFORMATION StandardInformation
;
1293 FILE_INTERNAL_INFORMATION InternalInformation
;
1294 FILE_EA_INFORMATION EaInformation
;
1295 FILE_ACCESS_INFORMATION AccessInformation
;
1296 FILE_POSITION_INFORMATION PositionInformation
;
1297 FILE_MODE_INFORMATION ModeInformation
;
1298 FILE_ALIGNMENT_INFORMATION AlignmentInformation
;
1299 FILE_NAME_INFORMATION NameInformation
;
1300 } FILE_ALL_INFORMATION
, *PFILE_ALL_INFORMATION
;
1303 // file system information structures
1305 typedef struct _FILE_FS_DEVICE_INFORMATION
{
1306 DEVICE_TYPE DeviceType
;
1307 ULONG Characteristics
;
1308 } FILE_FS_DEVICE_INFORMATION
, *PFILE_FS_DEVICE_INFORMATION
;
1311 typedef struct _FILE_FS_VOLUME_INFORMATION
{
1312 TIME VolumeCreationTime
;
1313 ULONG VolumeSerialNumber
;
1314 ULONG VolumeLabelLength
;
1315 BOOLEAN SupportsObjects
;
1316 WCHAR VolumeLabel
[0];
1317 } FILE_FS_VOLUME_INFORMATION
, *PFILE_FS_VOLUME_INFORMATION
;
1319 typedef struct _FILE_FS_SIZE_INFORMATION
{
1320 LARGE_INTEGER TotalAllocationUnits
;
1321 LARGE_INTEGER AvailableAllocationUnits
;
1322 ULONG SectorsPerAllocationUnit
;
1323 ULONG BytesPerSector
;
1324 } FILE_FS_SIZE_INFORMATION
, *PFILE_FS_SIZE_INFORMATION
;
1326 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
{
1327 ULONG FileSystemAttributes
;
1328 LONG MaximumComponentNameLength
;
1329 ULONG FileSystemNameLength
;
1330 WCHAR FileSystemName
[0];
1331 } FILE_FS_ATTRIBUTE_INFORMATION
, *PFILE_FS_ATTRIBUTE_INFORMATION
;
1334 FileSystemAttributes is one of the following values:
1336 FILE_CASE_SENSITIVE_SEARCH 0x00000001
1337 FILE_CASE_PRESERVED_NAMES 0x00000002
1338 FILE_UNICODE_ON_DISK 0x00000004
1339 FILE_PERSISTENT_ACLS 0x00000008
1340 FILE_FILE_COMPRESSION 0x00000010
1341 FILE_VOLUME_QUOTAS 0x00000020
1342 FILE_VOLUME_IS_COMPRESSED 0x00008000
1344 typedef struct _FILE_FS_LABEL_INFORMATION
{
1345 ULONG VolumeLabelLength
;
1346 WCHAR VolumeLabel
[0];
1347 } FILE_FS_LABEL_INFORMATION
, *PFILE_FS_LABEL_INFORMATION
;
1349 // read file scatter / write file scatter
1350 //FIXME I am a win32 struct aswell
1352 typedef union _FILE_SEGMENT_ELEMENT
{
1355 }FILE_SEGMENT_ELEMENT
, *PFILE_SEGMENT_ELEMENT
;
1357 // directory information
1359 typedef struct _OBJDIR_INFORMATION
{
1360 UNICODE_STRING ObjectName
;
1361 UNICODE_STRING ObjectTypeName
; // Directory, Device ...
1363 } OBJDIR_INFORMATION
, *POBJDIR_INFORMATION
;
1366 typedef struct _FILE_DIRECTORY_INFORMATION
{
1367 ULONG NextEntryOffset
;
1370 TIME LastAccessTime
;
1373 LARGE_INTEGER EndOfFile
;
1374 LARGE_INTEGER AllocationSize
;
1375 ULONG FileAttributes
;
1376 ULONG FileNameLength
;
1378 } FILE_DIRECTORY_INFORMATION
, *PFILE_DIRECTORY_INFORMATION
;
1380 typedef struct _FILE_FULL_DIRECTORY_INFORMATION
{
1381 ULONG NextEntryOffset
;
1384 TIME LastAccessTime
;
1387 LARGE_INTEGER EndOfFile
;
1388 LARGE_INTEGER AllocationSize
;
1389 ULONG FileAttributes
;
1390 ULONG FileNameLength
;
1392 WCHAR FileName
[0]; // variable size
1393 } FILE_FULL_DIRECTORY_INFORMATION
, *PFILE_FULL_DIRECTORY_INFORMATION
,
1394 FILE_FULL_DIR_INFORMATION
, *PFILE_FULL_DIR_INFORMATION
;
1397 typedef struct _FILE_BOTH_DIRECTORY_INFORMATION
{
1398 ULONG NextEntryOffset
;
1401 TIME LastAccessTime
;
1404 LARGE_INTEGER EndOfFile
;
1405 LARGE_INTEGER AllocationSize
;
1406 ULONG FileAttributes
;
1407 ULONG FileNameLength
;
1409 CHAR ShortNameLength
;
1410 WCHAR ShortName
[12]; // 8.3 name
1412 } FILE_BOTH_DIRECTORY_INFORMATION
, *PFILE_BOTH_DIRECTORY_INFORMATION
,
1413 FILE_BOTH_DIR_INFORMATION
, *PFILE_BOTH_DIR_INFORMATION
;
1417 NotifyFilter / CompletionFilter:
1419 FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001
1420 FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002
1421 FILE_NOTIFY_CHANGE_NAME 0x00000003
1422 FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004
1423 FILE_NOTIFY_CHANGE_SIZE 0x00000008
1424 FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010
1425 FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020
1426 FILE_NOTIFY_CHANGE_CREATION 0x00000040
1427 FILE_NOTIFY_CHANGE_EA 0x00000080
1428 FILE_NOTIFY_CHANGE_SECURITY 0x00000100
1429 FILE_NOTIFY_CHANGE_STREAM_NAME 0x00000200
1430 FILE_NOTIFY_CHANGE_STREAM_SIZE 0x00000400
1431 FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
1434 typedef struct _FILE_NOTIFY_INFORMATION
{
1436 ULONG FileNameLength
;
1438 } FILE_NOTIFY_INFORMATION
;
1442 Action is one of the following values:
1444 FILE_ACTION_ADDED 0x00000001
1445 FILE_ACTION_REMOVED 0x00000002
1446 FILE_ACTION_MODIFIED 0x00000003
1447 FILE_ACTION_RENAMED_OLD_NAME 0x00000004
1448 FILE_ACTION_RENAMED_NEW_NAME 0x00000005
1449 FILE_ACTION_ADDED_STREAM 0x00000006
1450 FILE_ACTION_REMOVED_STREAM 0x00000007
1451 FILE_ACTION_MODIFIED_STREAM 0x00000008
1456 // File System Control commands ( related to defragging )
1458 #define FSCTL_READ_MFT_RECORD 0x90068 // NTFS only
1459 #define FSCTL_GET_VOLUME_BITMAP 0x9006F
1460 #define FSCTL_GET_RETRIEVAL_POINTERS 0x90073
1461 #define FSCTL_MOVE_FILE 0x90074
1463 typedef struct _MAPPING_PAIR
1467 } MAPPING_PAIR
, *PMAPPING_PAIR
;
1469 typedef struct _GET_RETRIEVAL_DESCRIPTOR
1471 ULONG NumberOfPairs
;
1473 MAPPING_PAIR Pair
[0]; // variable size
1474 } GET_RETRIEVAL_DESCRIPTOR
, *PGET_RETRIEVAL_DESCRIPTOR
;
1476 typedef struct _BITMAP_DESCRIPTOR
1479 ULONGLONG ClustersToEndOfVol
;
1480 BYTE Map
[0]; // variable size
1481 } BITMAP_DESCRIPTOR
, *PBITMAP_DESCRIPTOR
;
1483 typedef struct _MOVEFILE_DESCRIPTOR
1487 LARGE_INTEGER StartVcn
;
1488 LARGE_INTEGER TargetLcn
;
1491 } MOVEFILE_DESCRIPTOR
, *PMOVEFILE_DESCRIPTOR
;
1495 //typedef enum _TIMER_TYPE
1497 // NotificationTimer,
1498 // SynchronizationTimer
1501 typedef struct _TIMER_BASIC_INFORMATION
1503 LARGE_INTEGER TimeRemaining
;
1504 BOOLEAN SignalState
;
1505 } TIMER_BASIC_INFORMATION
, *PTIMER_BASIC_INFORMATION
;
1507 typedef enum _TIMER_INFORMATION_CLASS
1509 TimerBasicInformation
1510 } TIMER_INFORMATION_CLASS
;
1513 struct _LPC_PORT_BASIC_INFORMATION
1530 } LPC_PORT_BASIC_INFORMATION
, * PLPC_PORT_BASIC_INFORMATION
;
1532 typedef struct _SECTION_BASIC_INFORMATION
1537 } SECTION_BASIC_INFORMATION
, *PSECTION_BASIC_INFORMATION
;
1539 typedef struct _SECTION_IMAGE_INFORMATION
1546 USHORT MinorSubsystemVersion
;
1547 USHORT MajorSubsystemVersion
;
1549 ULONG Characteristics
;
1554 } SECTION_IMAGE_INFORMATION
, *PSECTION_IMAGE_INFORMATION
;
1556 typedef enum _SECTION_INFORMATION_CLASS
1558 SectionBasicInformation
,
1559 SectionImageInformation
,
1560 } SECTION_INFORMATION_CLASS
;