3 Copyright (c) Alex Ionescu. All rights reserved.
11 Type definitions for the Executive.
15 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
27 #if !defined(NTOS_MODE_USER)
46 #define __ALIGNED(n) __attribute__((aligned (n)))
47 #elif defined(_MSC_VER)
48 #define __ALIGNED(n) __declspec(align(n))
50 #error __ALIGNED not defined for your compiler!
56 typedef USHORT RTL_ATOM
, *PRTL_ATOM
;
58 #ifndef NTOS_MODE_USER
61 // Kernel Exported Object Types
63 extern POBJECT_TYPE NTSYSAPI ExDesktopObjectType
;
64 extern POBJECT_TYPE NTSYSAPI ExWindowStationObjectType
;
65 extern POBJECT_TYPE NTSYSAPI ExIoCompletionType
;
66 extern POBJECT_TYPE NTSYSAPI ExMutantObjectType
;
67 extern POBJECT_TYPE NTSYSAPI ExTimerType
;
70 // Exported NT Build Number
72 extern ULONG NTSYSAPI NtBuildNumber
;
75 // Invalid Handle Value Constant
77 #define INVALID_HANDLE_VALUE (HANDLE)-1
84 #define MUTANT_INCREMENT 1
87 // Callback Object Access Mask
89 #define CALLBACK_MODIFY_STATE 0x0001
90 #define CALLBACK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
92 CALLBACK_MODIFY_STATE)
95 // Event Object Access Masks
98 #define EVENT_QUERY_STATE 0x0001
101 // Semaphore Object Access Masks
103 #define SEMAPHORE_QUERY_STATE 0x0001
107 // Mutant Object Access Masks
109 #define MUTANT_QUERY_STATE 0x0001
110 #define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
114 #define TIMER_QUERY_STATE 0x0001
115 #define TIMER_MODIFY_STATE 0x0002
116 #define TIMER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
118 TIMER_QUERY_STATE | \
123 // Event Pair Access Masks
125 #define EVENT_PAIR_ALL_ACCESS 0x1F0000L
128 // Profile Object Access Masks
130 #define PROFILE_CONTROL 0x0001
131 #define PROFILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | PROFILE_CONTROL)
134 // Keyed Event Object Access Masks
136 #define KEYEDEVENT_WAIT 0x0001
137 #define KEYEDEVENT_WAKE 0x0002
138 #define KEYEDEVENT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
143 // NtRaiseHardError-related parameters
145 #define MAXIMUM_HARDERROR_PARAMETERS 4
146 #define HARDERROR_OVERRIDE_ERRORMODE 0x10000000
151 #define EX_PUSH_LOCK_LOCK_V ((ULONG_PTR)0x0)
152 #define EX_PUSH_LOCK_LOCK ((ULONG_PTR)0x1)
153 #define EX_PUSH_LOCK_WAITING ((ULONG_PTR)0x2)
154 #define EX_PUSH_LOCK_WAKING ((ULONG_PTR)0x4)
155 #define EX_PUSH_LOCK_MULTIPLE_SHARED ((ULONG_PTR)0x8)
156 #define EX_PUSH_LOCK_SHARE_INC ((ULONG_PTR)0x10)
157 #define EX_PUSH_LOCK_PTR_BITS ((ULONG_PTR)0xf)
160 // Pushlock Wait Block Flags
162 #define EX_PUSH_LOCK_FLAGS_EXCLUSIVE 1
163 #define EX_PUSH_LOCK_FLAGS_WAIT_V 1
164 #define EX_PUSH_LOCK_FLAGS_WAIT 2
167 // Resource (ERESOURCE) Flags
169 #define ResourceHasDisabledPriorityBoost 0x08
172 // Shutdown types for NtShutdownSystem
174 typedef enum _SHUTDOWN_ACTION
182 // Responses for NtRaiseHardError
184 typedef enum _HARDERROR_RESPONSE_OPTION
186 OptionAbortRetryIgnore
,
192 OptionShutdownSystem
,
194 OptionCancelTryContinue
195 } HARDERROR_RESPONSE_OPTION
, *PHARDERROR_RESPONSE_OPTION
;
197 typedef enum _HARDERROR_RESPONSE
199 ResponseReturnToCaller
,
210 } HARDERROR_RESPONSE
, *PHARDERROR_RESPONSE
;
213 // System Information Classes for NtQuerySystemInformation
215 typedef enum _SYSTEM_INFORMATION_CLASS
217 SystemBasicInformation
,
218 SystemProcessorInformation
,
219 SystemPerformanceInformation
,
220 SystemTimeOfDayInformation
,
221 SystemPathInformation
, /// Obsolete: Use KUSER_SHARED_DATA
222 SystemProcessInformation
,
223 SystemCallCountInformation
,
224 SystemDeviceInformation
,
225 SystemProcessorPerformanceInformation
,
226 SystemFlagsInformation
,
227 SystemCallTimeInformation
,
228 SystemModuleInformation
,
229 SystemLocksInformation
,
230 SystemStackTraceInformation
,
231 SystemPagedPoolInformation
,
232 SystemNonPagedPoolInformation
,
233 SystemHandleInformation
,
234 SystemObjectInformation
,
235 SystemPageFileInformation
,
236 SystemVdmInstemulInformation
,
237 SystemVdmBopInformation
,
238 SystemFileCacheInformation
,
239 SystemPoolTagInformation
,
240 SystemInterruptInformation
,
241 SystemDpcBehaviorInformation
,
242 SystemFullMemoryInformation
,
243 SystemLoadGdiDriverInformation
,
244 SystemUnloadGdiDriverInformation
,
245 SystemTimeAdjustmentInformation
,
246 SystemSummaryMemoryInformation
,
247 SystemMirrorMemoryInformation
,
248 SystemPerformanceTraceInformation
,
250 SystemExceptionInformation
,
251 SystemCrashDumpStateInformation
,
252 SystemKernelDebuggerInformation
,
253 SystemContextSwitchInformation
,
254 SystemRegistryQuotaInformation
,
255 SystemExtendServiceTableInformation
,
256 SystemPrioritySeperation
,
257 SystemPlugPlayBusInformation
,
258 SystemDockInformation
,
259 SystemPowerInformationNative
,
260 SystemProcessorSpeedInformation
,
261 SystemCurrentTimeZoneInformation
,
262 SystemLookasideInformation
,
263 SystemTimeSlipNotification
,
266 SystemSessionInformation
,
267 SystemRangeStartInformation
,
268 SystemVerifierInformation
,
270 SystemSessionProcessesInformation
,
271 SystemLoadGdiDriverInSystemSpaceInformation
,
272 SystemNumaProcessorMap
,
273 SystemPrefetcherInformation
,
274 SystemExtendedProcessInformation
,
275 SystemRecommendedSharedDataAlignment
,
276 SystemComPlusPackage
,
277 SystemNumaAvailableMemory
,
278 SystemProcessorPowerInformation
,
279 SystemEmulationBasicInformation
,
280 SystemEmulationProcessorInformation
,
281 SystemExtendedHanfleInformation
,
282 SystemLostDelayedWriteInformation
,
283 SystemBigPoolInformation
,
284 SystemSessionPoolTagInformation
,
285 SystemSessionMappedViewInformation
,
286 SystemHotpatchInformation
,
287 SystemObjectSecurityMode
,
288 SystemWatchDogTimerHandler
,
289 SystemWatchDogTimerInformation
,
290 SystemLogicalProcessorInformation
,
291 SystemWow64SharedInformationObsolete
,
292 SystemRegisterFirmwareTableInformationHandler
,
293 SystemFirmwareTableInformation
,
294 SystemModuleInformationEx
,
295 SystemVerifierTriageInformation
,
296 SystemSuperfetchInformation
,
297 SystemMemoryListInformation
,
298 SystemFileCacheInformationEx
,
299 SystemThreadPriorityClientIdInformation
,
300 SystemProcessorIdleCycleTimeInformation
,
301 SystemVerifierCancellationInformation
,
302 SystemProcessorPowerInformationEx
,
303 SystemRefTraceInformation
,
304 SystemSpecialPoolInformation
,
305 SystemProcessIdInformation
,
306 SystemErrorPortInformation
,
307 SystemBootEnvironmentInformation
,
308 SystemHypervisorInformation
,
309 SystemVerifierInformationEx
,
310 SystemTimeZoneInformation
,
311 SystemImageFileExecutionOptionsInformation
,
312 SystemCoverageInformation
,
313 SystemPrefetchPathInformation
,
314 SystemVerifierFaultsInformation
,
316 } SYSTEM_INFORMATION_CLASS
;
319 // System Information Classes for NtQueryMutant
321 typedef enum _MUTANT_INFORMATION_CLASS
323 MutantBasicInformation
,
324 MutantOwnerInformation
325 } MUTANT_INFORMATION_CLASS
;
328 // System Information Classes for NtQueryAtom
330 typedef enum _ATOM_INFORMATION_CLASS
332 AtomBasicInformation
,
333 AtomTableInformation
,
334 } ATOM_INFORMATION_CLASS
;
337 // System Information Classes for NtQueryTimer
339 typedef enum _TIMER_INFORMATION_CLASS
341 TimerBasicInformation
342 } TIMER_INFORMATION_CLASS
;
345 // System Information Classes for NtQuerySemaphore
347 typedef enum _SEMAPHORE_INFORMATION_CLASS
349 SemaphoreBasicInformation
350 } SEMAPHORE_INFORMATION_CLASS
;
353 // System Information Classes for NtQueryEvent
355 typedef enum _EVENT_INFORMATION_CLASS
357 EventBasicInformation
358 } EVENT_INFORMATION_CLASS
;
360 #ifdef NTOS_MODE_USER
363 // Firmware Table Actions for SystemFirmwareTableInformation
365 typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION
367 SystemFirmwareTable_Enumerate
= 0,
368 SystemFirmwareTable_Get
= 1,
369 } SYSTEM_FIRMWARE_TABLE_ACTION
, *PSYSTEM_FIRMWARE_TABLE_ACTION
;
372 // Firmware Handler Callback
374 struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
;
378 _In_
struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
*FirmwareTableInformation
384 // Handle Enumeration Callback
386 struct _HANDLE_TABLE_ENTRY
;
388 (NTAPI
*PEX_ENUM_HANDLE_CALLBACK
)(
389 _In_
struct _HANDLE_TABLE_ENTRY
*HandleTableEntry
,
395 // Executive Work Queue Structures
397 typedef struct _EX_QUEUE_WORKER_INFO
399 ULONG QueueDisabled
:1;
400 ULONG MakeThreadsAsNecessary
:1;
402 ULONG WorkerCount
:29;
403 } EX_QUEUE_WORKER_INFO
, *PEX_QUEUE_WORKER_INFO
;
405 typedef struct _EX_WORK_QUEUE
408 LONG DynamicThreadCount
;
409 ULONG WorkItemsProcessed
;
410 ULONG WorkItemsProcessedLastPass
;
411 ULONG QueueDepthLastPass
;
412 EX_QUEUE_WORKER_INFO Info
;
413 } EX_WORK_QUEUE
, *PEX_WORK_QUEUE
;
416 // Executive Fast Reference Structure
418 typedef struct _EX_FAST_REF
426 } EX_FAST_REF
, *PEX_FAST_REF
;
429 // Executive Cache-Aware Rundown Reference Descriptor
431 typedef struct _EX_RUNDOWN_REF_CACHE_AWARE
433 PEX_RUNDOWN_REF RunRefs
;
437 } EX_RUNDOWN_REF_CACHE_AWARE
;
440 // Executive Rundown Wait Block
442 typedef struct _EX_RUNDOWN_WAIT_BLOCK
446 } EX_RUNDOWN_WAIT_BLOCK
, *PEX_RUNDOWN_WAIT_BLOCK
;
449 // Executive Pushlock
453 typedef struct _EX_PUSH_LOCK
462 ULONG_PTR MultipleShared
:1;
463 ULONG_PTR Shared
:sizeof (ULONG_PTR
) * 8 - 4;
468 } EX_PUSH_LOCK
, *PEX_PUSH_LOCK
;
471 // Executive Pushlock Wait Block
473 typedef __ALIGNED(16) struct _EX_PUSH_LOCK_WAIT_BLOCK
480 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Next
;
481 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Last
;
482 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Previous
;
487 EX_PUSH_LOCK NewValue
;
488 EX_PUSH_LOCK OldValue
;
489 PEX_PUSH_LOCK PushLock
;
491 } EX_PUSH_LOCK_WAIT_BLOCK
, *PEX_PUSH_LOCK_WAIT_BLOCK
;
496 typedef struct _CALLBACK_OBJECT
500 LIST_ENTRY RegisteredCallbacks
;
501 BOOLEAN AllowMultipleCallbacks
;
508 typedef struct _CALLBACK_REGISTRATION
511 PCALLBACK_OBJECT CallbackObject
;
512 PCALLBACK_FUNCTION CallbackFunction
;
513 PVOID CallbackContext
;
515 BOOLEAN UnregisterWaiting
;
516 } CALLBACK_REGISTRATION
, *PCALLBACK_REGISTRATION
;
519 // Internal Callback Object
521 typedef struct _EX_CALLBACK_ROUTINE_BLOCK
523 EX_RUNDOWN_REF RundownProtect
;
524 PEX_CALLBACK_FUNCTION Function
;
526 } EX_CALLBACK_ROUTINE_BLOCK
, *PEX_CALLBACK_ROUTINE_BLOCK
;
529 // Internal Callback Handle
531 typedef struct _EX_CALLBACK
533 EX_FAST_REF RoutineBlock
;
534 } EX_CALLBACK
, *PEX_CALLBACK
;
539 typedef struct _EPROFILE
547 PKPROFILE ProfileObject
;
548 PVOID LockedBufferAddress
;
551 KPROFILE_SOURCE ProfileSource
;
553 } EPROFILE
, *PEPROFILE
;
556 // Handle Table Structures
558 typedef struct _HANDLE_TRACE_DB_ENTRY
563 PVOID StackTrace
[16];
564 } HANDLE_TRACE_DB_ENTRY
, *PHANDLE_TRACE_DB_ENTRY
;
566 typedef struct _HANDLE_TRACE_DEBUG_INFO
571 FAST_MUTEX CloseCompatcionLock
;
572 ULONG CurrentStackIndex
;
573 HANDLE_TRACE_DB_ENTRY TraceDb
[1];
574 } HANDLE_TRACE_DEBUG_INFO
, *PHANDLE_TRACE_DEBUG_INFO
;
576 typedef struct _HANDLE_TABLE_ENTRY_INFO
579 } HANDLE_TABLE_ENTRY_INFO
, *PHANDLE_TABLE_ENTRY_INFO
;
581 typedef struct _HANDLE_TABLE_ENTRY
586 ULONG_PTR ObAttributes
;
587 PHANDLE_TABLE_ENTRY_INFO InfoTable
;
595 USHORT GrantedAccessIndex
;
596 USHORT CreatorBackTraceIndex
;
598 LONG NextFreeTableEntry
;
600 } HANDLE_TABLE_ENTRY
, *PHANDLE_TABLE_ENTRY
;
602 typedef struct _HANDLE_TABLE
604 #if (NTDDI_VERSION >= NTDDI_WINXP)
607 PHANDLE_TABLE_ENTRY
**Table
;
609 PEPROCESS QuotaProcess
;
610 PVOID UniqueProcessId
;
611 #if (NTDDI_VERSION >= NTDDI_WINXP)
612 EX_PUSH_LOCK HandleTableLock
[4];
613 LIST_ENTRY HandleTableList
;
614 EX_PUSH_LOCK HandleContentionEvent
;
616 ERESOURCE HandleLock
;
617 LIST_ENTRY HandleTableList
;
618 KEVENT HandleContentionEvent
;
620 PHANDLE_TRACE_DEBUG_INFO DebugInfo
;
622 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
628 LONG FirstFreeHandle
;
629 PHANDLE_TABLE_ENTRY LastFreeHandleEntry
;
631 ULONG NextHandleNeedingPool
;
635 ULONG NextHandleNeedingPool
;
643 } HANDLE_TABLE
, *PHANDLE_TABLE
;
648 // Hard Error LPC Message
650 typedef struct _HARDERROR_MSG
654 LARGE_INTEGER ErrorTime
;
655 ULONG ValidResponseOptions
;
657 ULONG NumberOfParameters
;
658 ULONG UnicodeStringParameterMask
;
659 ULONG_PTR Parameters
[MAXIMUM_HARDERROR_PARAMETERS
];
660 } HARDERROR_MSG
, *PHARDERROR_MSG
;
663 // Information Structures for NtQueryMutant
665 typedef struct _MUTANT_BASIC_INFORMATION
668 BOOLEAN OwnedByCaller
;
669 BOOLEAN AbandonedState
;
670 } MUTANT_BASIC_INFORMATION
, *PMUTANT_BASIC_INFORMATION
;
672 typedef struct _MUTANT_OWNER_INFORMATION
675 } MUTANT_OWNER_INFORMATION
, *PMUTANT_OWNER_INFORMATION
;
678 // Information Structures for NtQueryAtom
680 typedef struct _ATOM_BASIC_INFORMATION
686 } ATOM_BASIC_INFORMATION
, *PATOM_BASIC_INFORMATION
;
688 typedef struct _ATOM_TABLE_INFORMATION
692 } ATOM_TABLE_INFORMATION
, *PATOM_TABLE_INFORMATION
;
695 // Information Structures for NtQueryTimer
697 typedef struct _TIMER_BASIC_INFORMATION
699 LARGE_INTEGER TimeRemaining
;
701 } TIMER_BASIC_INFORMATION
, *PTIMER_BASIC_INFORMATION
;
704 // Information Structures for NtQuerySemaphore
706 typedef struct _SEMAPHORE_BASIC_INFORMATION
710 } SEMAPHORE_BASIC_INFORMATION
, *PSEMAPHORE_BASIC_INFORMATION
;
713 // Information Structures for NtQueryEvent
715 typedef struct _EVENT_BASIC_INFORMATION
717 EVENT_TYPE EventType
;
719 } EVENT_BASIC_INFORMATION
, *PEVENT_BASIC_INFORMATION
;
722 // Information Structures for NtQuerySystemInformation
724 typedef struct _SYSTEM_BASIC_INFORMATION
727 ULONG TimerResolution
;
729 ULONG NumberOfPhysicalPages
;
730 ULONG LowestPhysicalPageNumber
;
731 ULONG HighestPhysicalPageNumber
;
732 ULONG AllocationGranularity
;
733 ULONG_PTR MinimumUserModeAddress
;
734 ULONG_PTR MaximumUserModeAddress
;
735 ULONG_PTR ActiveProcessorsAffinityMask
;
736 CCHAR NumberOfProcessors
;
737 } SYSTEM_BASIC_INFORMATION
, *PSYSTEM_BASIC_INFORMATION
;
740 typedef struct _SYSTEM_PROCESSOR_INFORMATION
742 USHORT ProcessorArchitecture
;
743 USHORT ProcessorLevel
;
744 USHORT ProcessorRevision
;
746 ULONG ProcessorFeatureBits
;
747 } SYSTEM_PROCESSOR_INFORMATION
, *PSYSTEM_PROCESSOR_INFORMATION
;
750 typedef struct _SYSTEM_PERFORMANCE_INFORMATION
752 LARGE_INTEGER IdleProcessTime
;
753 LARGE_INTEGER IoReadTransferCount
;
754 LARGE_INTEGER IoWriteTransferCount
;
755 LARGE_INTEGER IoOtherTransferCount
;
756 ULONG IoReadOperationCount
;
757 ULONG IoWriteOperationCount
;
758 ULONG IoOtherOperationCount
;
759 ULONG AvailablePages
;
760 ULONG CommittedPages
;
762 ULONG PeakCommitment
;
763 ULONG PageFaultCount
;
764 ULONG CopyOnWriteCount
;
765 ULONG TransitionCount
;
766 ULONG CacheTransitionCount
;
767 ULONG DemandZeroCount
;
769 ULONG PageReadIoCount
;
770 ULONG CacheReadCount
;
772 ULONG DirtyPagesWriteCount
;
773 ULONG DirtyWriteIoCount
;
774 ULONG MappedPagesWriteCount
;
775 ULONG MappedWriteIoCount
;
776 ULONG PagedPoolPages
;
777 ULONG NonPagedPoolPages
;
778 ULONG PagedPoolAllocs
;
779 ULONG PagedPoolFrees
;
780 ULONG NonPagedPoolAllocs
;
781 ULONG NonPagedPoolFrees
;
782 ULONG FreeSystemPtes
;
783 ULONG ResidentSystemCodePage
;
784 ULONG TotalSystemDriverPages
;
785 ULONG TotalSystemCodePages
;
786 ULONG NonPagedPoolLookasideHits
;
787 ULONG PagedPoolLookasideHits
;
789 ULONG ResidentSystemCachePage
;
790 ULONG ResidentPagedPoolPage
;
791 ULONG ResidentSystemDriverPage
;
792 ULONG CcFastReadNoWait
;
793 ULONG CcFastReadWait
;
794 ULONG CcFastReadResourceMiss
;
795 ULONG CcFastReadNotPossible
;
796 ULONG CcFastMdlReadNoWait
;
797 ULONG CcFastMdlReadWait
;
798 ULONG CcFastMdlReadResourceMiss
;
799 ULONG CcFastMdlReadNotPossible
;
800 ULONG CcMapDataNoWait
;
802 ULONG CcMapDataNoWaitMiss
;
803 ULONG CcMapDataWaitMiss
;
804 ULONG CcPinMappedDataCount
;
805 ULONG CcPinReadNoWait
;
807 ULONG CcPinReadNoWaitMiss
;
808 ULONG CcPinReadWaitMiss
;
809 ULONG CcCopyReadNoWait
;
810 ULONG CcCopyReadWait
;
811 ULONG CcCopyReadNoWaitMiss
;
812 ULONG CcCopyReadWaitMiss
;
813 ULONG CcMdlReadNoWait
;
815 ULONG CcMdlReadNoWaitMiss
;
816 ULONG CcMdlReadWaitMiss
;
817 ULONG CcReadAheadIos
;
818 ULONG CcLazyWriteIos
;
819 ULONG CcLazyWritePages
;
822 ULONG ContextSwitches
;
823 ULONG FirstLevelTbFills
;
824 ULONG SecondLevelTbFills
;
826 } SYSTEM_PERFORMANCE_INFORMATION
, *PSYSTEM_PERFORMANCE_INFORMATION
;
829 typedef struct _SYSTEM_TIMEOFDAY_INFORMATION
831 LARGE_INTEGER BootTime
;
832 LARGE_INTEGER CurrentTime
;
833 LARGE_INTEGER TimeZoneBias
;
836 #if (NTDDI_VERSION >= NTDDI_WIN2K)
837 ULONGLONG BootTimeBias
;
838 ULONGLONG SleepTimeBias
;
840 } SYSTEM_TIMEOFDAY_INFORMATION
, *PSYSTEM_TIMEOFDAY_INFORMATION
;
843 // This class is obsolete, please use KUSER_SHARED_DATA instead
846 typedef struct _SYSTEM_THREAD_INFORMATION
848 LARGE_INTEGER KernelTime
;
849 LARGE_INTEGER UserTime
;
850 LARGE_INTEGER CreateTime
;
856 ULONG ContextSwitches
;
859 ULONG PadPadAlignment
;
860 } SYSTEM_THREAD_INFORMATION
, *PSYSTEM_THREAD_INFORMATION
;
862 C_ASSERT(sizeof(SYSTEM_THREAD_INFORMATION
) == 0x40); // Must be 8-byte aligned
865 typedef struct _SYSTEM_PROCESS_INFORMATION
867 ULONG NextEntryOffset
;
868 ULONG NumberOfThreads
;
869 LARGE_INTEGER WorkingSetPrivateSize
; //VISTA
870 ULONG HardFaultCount
; //WIN7
871 ULONG NumberOfThreadsHighWatermark
; //WIN7
872 ULONGLONG CycleTime
; //WIN7
873 LARGE_INTEGER CreateTime
;
874 LARGE_INTEGER UserTime
;
875 LARGE_INTEGER KernelTime
;
876 UNICODE_STRING ImageName
;
877 KPRIORITY BasePriority
;
878 HANDLE UniqueProcessId
;
879 HANDLE InheritedFromUniqueProcessId
;
882 ULONG_PTR PageDirectoryBase
;
885 // This part corresponds to VM_COUNTERS_EX.
886 // NOTE: *NOT* THE SAME AS VM_COUNTERS!
888 SIZE_T PeakVirtualSize
;
890 ULONG PageFaultCount
;
891 SIZE_T PeakWorkingSetSize
;
892 SIZE_T WorkingSetSize
;
893 SIZE_T QuotaPeakPagedPoolUsage
;
894 SIZE_T QuotaPagedPoolUsage
;
895 SIZE_T QuotaPeakNonPagedPoolUsage
;
896 SIZE_T QuotaNonPagedPoolUsage
;
897 SIZE_T PagefileUsage
;
898 SIZE_T PeakPagefileUsage
;
899 SIZE_T PrivatePageCount
;
902 // This part corresponds to IO_COUNTERS
904 LARGE_INTEGER ReadOperationCount
;
905 LARGE_INTEGER WriteOperationCount
;
906 LARGE_INTEGER OtherOperationCount
;
907 LARGE_INTEGER ReadTransferCount
;
908 LARGE_INTEGER WriteTransferCount
;
909 LARGE_INTEGER OtherTransferCount
;
910 // SYSTEM_THREAD_INFORMATION TH[1];
911 } SYSTEM_PROCESS_INFORMATION
, *PSYSTEM_PROCESS_INFORMATION
;
913 C_ASSERT(sizeof(SYSTEM_PROCESS_INFORMATION
) == 0xB8); // Must be 8-byte aligned
918 typedef struct _SYSTEM_CALL_COUNT_INFORMATION
921 ULONG NumberOfTables
;
922 } SYSTEM_CALL_COUNT_INFORMATION
, *PSYSTEM_CALL_COUNT_INFORMATION
;
925 typedef struct _SYSTEM_DEVICE_INFORMATION
928 ULONG NumberOfFloppies
;
929 ULONG NumberOfCdRoms
;
931 ULONG NumberOfSerialPorts
;
932 ULONG NumberOfParallelPorts
;
933 } SYSTEM_DEVICE_INFORMATION
, *PSYSTEM_DEVICE_INFORMATION
;
936 typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
938 LARGE_INTEGER IdleTime
;
939 LARGE_INTEGER KernelTime
;
940 LARGE_INTEGER UserTime
;
941 LARGE_INTEGER DpcTime
;
942 LARGE_INTEGER InterruptTime
;
943 ULONG InterruptCount
;
944 } SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
;
947 typedef struct _SYSTEM_FLAGS_INFORMATION
950 } SYSTEM_FLAGS_INFORMATION
, *PSYSTEM_FLAGS_INFORMATION
;
953 typedef struct _SYSTEM_CALL_TIME_INFORMATION
957 LARGE_INTEGER TimeOfCalls
[1];
958 } SYSTEM_CALL_TIME_INFORMATION
, *PSYSTEM_CALL_TIME_INFORMATION
;
960 // Class 11 - See RTL_PROCESS_MODULES
962 // Class 12 - See RTL_PROCESS_LOCKS
964 // Class 13 - See RTL_PROCESS_BACKTRACES
967 typedef struct _SYSTEM_POOL_ENTRY
971 USHORT AllocatorBackTraceIndex
;
977 PVOID ProcessChargedQuota
;
979 } SYSTEM_POOL_ENTRY
, *PSYSTEM_POOL_ENTRY
;
981 typedef struct _SYSTEM_POOL_INFORMATION
985 USHORT EntryOverhead
;
986 BOOLEAN PoolTagPresent
;
988 ULONG NumberOfEntries
;
989 SYSTEM_POOL_ENTRY Entries
[1];
990 } SYSTEM_POOL_INFORMATION
, *PSYSTEM_POOL_INFORMATION
;
993 typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
995 USHORT UniqueProcessId
;
996 USHORT CreatorBackTraceIndex
;
997 UCHAR ObjectTypeIndex
;
998 UCHAR HandleAttributes
;
1001 ULONG GrantedAccess
;
1002 } SYSTEM_HANDLE_TABLE_ENTRY_INFO
, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO
;
1004 typedef struct _SYSTEM_HANDLE_INFORMATION
1006 ULONG NumberOfHandles
;
1007 SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles
[1];
1008 } SYSTEM_HANDLE_INFORMATION
, *PSYSTEM_HANDLE_INFORMATION
;
1011 typedef struct _SYSTEM_OBJECTTYPE_INFORMATION
1013 ULONG NextEntryOffset
;
1014 ULONG NumberOfObjects
;
1015 ULONG NumberOfHandles
;
1017 ULONG InvalidAttributes
;
1018 GENERIC_MAPPING GenericMapping
;
1019 ULONG ValidAccessMask
;
1021 BOOLEAN SecurityRequired
;
1022 BOOLEAN WaitableObject
;
1023 UNICODE_STRING TypeName
;
1024 } SYSTEM_OBJECTTYPE_INFORMATION
, *PSYSTEM_OBJECTTYPE_INFORMATION
;
1026 typedef struct _SYSTEM_OBJECT_INFORMATION
1028 ULONG NextEntryOffset
;
1030 HANDLE CreatorUniqueProcess
;
1031 USHORT CreatorBackTraceIndex
;
1035 ULONG PagedPoolCharge
;
1036 ULONG NonPagedPoolCharge
;
1037 HANDLE ExclusiveProcessId
;
1038 PVOID SecurityDescriptor
;
1039 OBJECT_NAME_INFORMATION NameInfo
;
1040 } SYSTEM_OBJECT_INFORMATION
, *PSYSTEM_OBJECT_INFORMATION
;
1043 typedef struct _SYSTEM_PAGEFILE_INFORMATION
1045 ULONG NextEntryOffset
;
1049 UNICODE_STRING PageFileName
;
1050 } SYSTEM_PAGEFILE_INFORMATION
, *PSYSTEM_PAGEFILE_INFORMATION
;
1053 typedef struct _SYSTEM_VDM_INSTEMUL_INFO
1055 ULONG SegmentNotPresent
;
1057 ULONG OpcodeESPrefix
;
1058 ULONG OpcodeCSPrefix
;
1059 ULONG OpcodeSSPrefix
;
1060 ULONG OpcodeDSPrefix
;
1061 ULONG OpcodeFSPrefix
;
1062 ULONG OpcodeGSPrefix
;
1063 ULONG OpcodeOPER32Prefix
;
1064 ULONG OpcodeADDR32Prefix
;
1076 ULONG OpcodeOUTBimm
;
1077 ULONG OpcodeOUTWimm
;
1082 ULONG OpcodeLOCKPrefix
;
1083 ULONG OpcodeREPNEPrefix
;
1084 ULONG OpcodeREPPrefix
;
1089 } SYSTEM_VDM_INSTEMUL_INFO
, *PSYSTEM_VDM_INSTEMUL_INFO
;
1091 // Class 20 - ULONG VDMBOPINFO
1094 typedef struct _SYSTEM_FILECACHE_INFORMATION
1098 ULONG PageFaultCount
;
1099 SIZE_T MinimumWorkingSet
;
1100 SIZE_T MaximumWorkingSet
;
1101 SIZE_T CurrentSizeIncludingTransitionInPages
;
1102 SIZE_T PeakSizeIncludingTransitionInPages
;
1103 ULONG TransitionRePurposeCount
;
1105 } SYSTEM_FILECACHE_INFORMATION
, *PSYSTEM_FILECACHE_INFORMATION
;
1108 typedef struct _SYSTEM_POOLTAG
1118 ULONG NonPagedAllocs
;
1119 ULONG NonPagedFrees
;
1120 SIZE_T NonPagedUsed
;
1121 } SYSTEM_POOLTAG
, *PSYSTEM_POOLTAG
;
1123 typedef struct _SYSTEM_POOLTAG_INFORMATION
1126 SYSTEM_POOLTAG TagInfo
[1];
1127 } SYSTEM_POOLTAG_INFORMATION
, *PSYSTEM_POOLTAG_INFORMATION
;
1130 typedef struct _SYSTEM_INTERRUPT_INFORMATION
1132 ULONG ContextSwitches
;
1135 ULONG TimeIncrement
;
1136 ULONG DpcBypassCount
;
1137 ULONG ApcBypassCount
;
1138 } SYSTEM_INTERRUPT_INFORMATION
, *PSYSTEM_INTERRUPT_INFORMATION
;
1141 typedef struct _SYSTEM_DPC_BEHAVIOR_INFORMATION
1144 ULONG DpcQueueDepth
;
1145 ULONG MinimumDpcRate
;
1146 ULONG AdjustDpcThreshold
;
1148 } SYSTEM_DPC_BEHAVIOR_INFORMATION
, *PSYSTEM_DPC_BEHAVIOR_INFORMATION
;
1151 typedef struct _SYSTEM_MEMORY_INFO
1153 PUCHAR StringOffset
;
1155 USHORT TransitionCount
;
1156 USHORT ModifiedCount
;
1157 USHORT PageTableCount
;
1158 } SYSTEM_MEMORY_INFO
, *PSYSTEM_MEMORY_INFO
;
1160 typedef struct _SYSTEM_MEMORY_INFORMATION
1164 SYSTEM_MEMORY_INFO Memory
[1];
1165 } SYSTEM_MEMORY_INFORMATION
, *PSYSTEM_MEMORY_INFORMATION
;
1168 typedef struct _SYSTEM_GDI_DRIVER_INFORMATION
1170 UNICODE_STRING DriverName
;
1172 PVOID SectionPointer
;
1174 PIMAGE_EXPORT_DIRECTORY ExportSectionPointer
;
1176 } SYSTEM_GDI_DRIVER_INFORMATION
, *PSYSTEM_GDI_DRIVER_INFORMATION
;
1179 // Not an actually class, simply a PVOID to the ImageAddress
1182 typedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION
1184 ULONG TimeAdjustment
;
1185 ULONG TimeIncrement
;
1187 } SYSTEM_QUERY_TIME_ADJUST_INFORMATION
, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION
;
1189 typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION
1191 ULONG TimeAdjustment
;
1193 } SYSTEM_SET_TIME_ADJUST_INFORMATION
, *PSYSTEM_SET_TIME_ADJUST_INFORMATION
;
1195 // Class 29 - Same as 25
1200 typedef struct _SYSTEM_REF_TRACE_INFORMATION
1203 UCHAR TracePermanent
;
1204 UNICODE_STRING TraceProcessName
;
1205 UNICODE_STRING TracePoolTags
;
1206 } SYSTEM_REF_TRACE_INFORMATION
, *PSYSTEM_REF_TRACE_INFORMATION
;
1208 // Class 32 - OBSOLETE
1211 typedef struct _SYSTEM_EXCEPTION_INFORMATION
1213 ULONG AlignmentFixupCount
;
1214 ULONG ExceptionDispatchCount
;
1215 ULONG FloatingEmulationCount
;
1216 ULONG ByteWordEmulationCount
;
1217 } SYSTEM_EXCEPTION_INFORMATION
, *PSYSTEM_EXCEPTION_INFORMATION
;
1220 typedef struct _SYSTEM_CRASH_STATE_INFORMATION
1222 ULONG ValidCrashDump
;
1223 } SYSTEM_CRASH_STATE_INFORMATION
, *PSYSTEM_CRASH_STATE_INFORMATION
;
1226 typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION
1228 BOOLEAN KernelDebuggerEnabled
;
1229 BOOLEAN KernelDebuggerNotPresent
;
1230 } SYSTEM_KERNEL_DEBUGGER_INFORMATION
, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION
;
1233 typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION
1235 ULONG ContextSwitches
;
1244 ULONG PreemptCurrent
;
1247 } SYSTEM_CONTEXT_SWITCH_INFORMATION
, *PSYSTEM_CONTEXT_SWITCH_INFORMATION
;
1250 typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION
1252 ULONG RegistryQuotaAllowed
;
1253 ULONG RegistryQuotaUsed
;
1254 SIZE_T PagedPoolSize
;
1255 } SYSTEM_REGISTRY_QUOTA_INFORMATION
, *PSYSTEM_REGISTRY_QUOTA_INFORMATION
;
1258 // Not a structure, simply send the UNICODE_STRING
1261 // Not a structure, simply send a ULONG containing the new separation
1264 typedef struct _SYSTEM_PLUGPLAY_BUS_INFORMATION
1267 PLUGPLAY_BUS_INSTANCE BusInstance
[1];
1268 } SYSTEM_PLUGPLAY_BUS_INFORMATION
, *PSYSTEM_PLUGPLAY_BUS_INFORMATION
;
1271 typedef struct _SYSTEM_DOCK_INFORMATION
1273 SYSTEM_DOCK_STATE DockState
;
1274 INTERFACE_TYPE DeviceBusType
;
1275 ULONG DeviceBusNumber
;
1277 } SYSTEM_DOCK_INFORMATION
, *PSYSTEM_DOCK_INFORMATION
;
1280 typedef struct _SYSTEM_POWER_INFORMATION_NATIVE
1282 BOOLEAN SystemSuspendSupported
;
1283 BOOLEAN SystemHibernateSupported
;
1284 BOOLEAN ResumeTimerSupportsSuspend
;
1285 BOOLEAN ResumeTimerSupportsHibernate
;
1286 BOOLEAN LidSupported
;
1287 BOOLEAN TurboSettingSupported
;
1289 BOOLEAN SystemAcOrDc
;
1290 BOOLEAN PowerDownDisabled
;
1291 LARGE_INTEGER SpindownDrives
;
1292 } SYSTEM_POWER_INFORMATION_NATIVE
, *PSYSTEM_POWER_INFORMATION_NATIVE
;
1295 typedef struct _SYSTEM_LEGACY_DRIVER_INFORMATION
1297 PNP_VETO_TYPE VetoType
;
1298 UNICODE_STRING VetoDriver
;
1299 } SYSTEM_LEGACY_DRIVER_INFORMATION
, *PSYSTEM_LEGACY_DRIVER_INFORMATION
;
1302 //typedef struct _TIME_ZONE_INFORMATION RTL_TIME_ZONE_INFORMATION;
1305 typedef struct _SYSTEM_LOOKASIDE_INFORMATION
1307 USHORT CurrentDepth
;
1308 USHORT MaximumDepth
;
1309 ULONG TotalAllocates
;
1310 ULONG AllocateMisses
;
1316 } SYSTEM_LOOKASIDE_INFORMATION
, *PSYSTEM_LOOKASIDE_INFORMATION
;
1319 // Not a structure. Only a HANDLE for the SlipEvent;
1322 // Not a structure. Only a ULONG for the SessionId;
1325 // Not a structure. Only a ULONG for the SessionId;
1330 // Not a structure. Only a ULONG_PTR for the SystemRangeStart
1333 typedef struct _SYSTEM_VERIFIER_INFORMATION
1335 ULONG NextEntryOffset
;
1337 UNICODE_STRING DriverName
;
1339 ULONG AcquireSpinLocks
;
1340 ULONG SynchronizeExecutions
;
1341 ULONG AllocationsAttempted
;
1342 ULONG AllocationsSucceeded
;
1343 ULONG AllocationsSucceededSpecialPool
;
1344 ULONG AllocationsWithNoTag
;
1347 ULONG AllocationsFailed
;
1348 ULONG AllocationsFailedDeliberately
;
1351 ULONG UnTrackedPool
;
1352 ULONG CurrentPagedPoolAllocations
;
1353 ULONG CurrentNonPagedPoolAllocations
;
1354 ULONG PeakPagedPoolAllocations
;
1355 ULONG PeakNonPagedPoolAllocations
;
1356 SIZE_T PagedPoolUsageInBytes
;
1357 SIZE_T NonPagedPoolUsageInBytes
;
1358 SIZE_T PeakPagedPoolUsageInBytes
;
1359 SIZE_T PeakNonPagedPoolUsageInBytes
;
1360 } SYSTEM_VERIFIER_INFORMATION
, *PSYSTEM_VERIFIER_INFORMATION
;
1365 typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
1369 PVOID Buffer
; // Same format as in SystemProcessInformation
1370 } SYSTEM_SESSION_PROCESS_INFORMATION
, *PSYSTEM_SESSION_PROCESS_INFORMATION
;
1375 #define MAXIMUM_NUMA_NODES 16
1376 typedef struct _SYSTEM_NUMA_INFORMATION
1378 ULONG HighestNodeNumber
;
1382 ULONGLONG ActiveProcessorsAffinityMask
[MAXIMUM_NUMA_NODES
];
1383 ULONGLONG AvailableMemory
[MAXIMUM_NUMA_NODES
];
1385 } SYSTEM_NUMA_INFORMATION
, *PSYSTEM_NUMA_INFORMATION
;
1387 // FIXME: Class 56-97
1392 #define RTL_HOTPATCH_SUPPORTED_FLAG 0x01
1393 #define RTL_HOTPATCH_SWAP_OBJECT_NAMES 0x08 << 24
1394 #define RTL_HOTPATCH_SYNC_RENAME_FILES 0x10 << 24
1395 #define RTL_HOTPATCH_PATCH_USER_MODE 0x20 << 24
1396 #define RTL_HOTPATCH_REMAP_SYSTEM_DLL 0x40 << 24
1397 #define RTL_HOTPATCH_PATCH_KERNEL_MODE 0x80 << 24
1401 typedef struct _SYSTEM_HOTPATCH_CODE_INFORMATION
1420 USHORT TargetNameOffset
;
1421 USHORT TargetNameLength
;
1422 UCHAR PatchingFinished
;
1428 USHORT TargetNameOffset
;
1429 USHORT TargetNameLength
;
1430 UCHAR PatchingFinished
;
1431 NTSTATUS ReturnCode
;
1432 HANDLE TargetProcess
;
1437 PIO_STATUS_BLOCK IoStatusBlock1
;
1438 PVOID RenameInformation1
;
1439 PVOID RenameInformationLength1
;
1441 PIO_STATUS_BLOCK IoStatusBlock2
;
1442 PVOID RenameInformation2
;
1443 PVOID RenameInformationLength2
;
1447 HANDLE ParentDirectory
;
1448 HANDLE ObjectHandle1
;
1449 HANDLE ObjectHandle2
;
1452 } SYSTEM_HOTPATCH_CODE_INFORMATION
, *PSYSTEM_HOTPATCH_CODE_INFORMATION
;
1457 #ifdef NTOS_MODE_USER
1458 typedef struct _SYSTEM_FIRMWARE_TABLE_HANDLER
1460 ULONG ProviderSignature
;
1462 PFNFTH FirmwareTableHandler
;
1464 } SYSTEM_FIRMWARE_TABLE_HANDLER
, *PSYSTEM_FIRMWARE_TABLE_HANDLER
;
1469 typedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
1471 ULONG ProviderSignature
;
1472 SYSTEM_FIRMWARE_TABLE_ACTION Action
;
1474 ULONG TableBufferLength
;
1475 UCHAR TableBuffer
[1];
1476 } SYSTEM_FIRMWARE_TABLE_INFORMATION
, *PSYSTEM_FIRMWARE_TABLE_INFORMATION
;
1481 typedef struct _SYSTEM_MEMORY_LIST_INFORMATION
1483 SIZE_T ZeroPageCount
;
1484 SIZE_T FreePageCount
;
1485 SIZE_T ModifiedPageCount
;
1486 SIZE_T ModifiedNoWritePageCount
;
1487 SIZE_T BadPageCount
;
1488 SIZE_T PageCountByPriority
[8];
1489 SIZE_T RepurposedPagesByPriority
[8];
1490 SIZE_T ModifiedPageCountPageFile
;
1491 } SYSTEM_MEMORY_LIST_INFORMATION
, *PSYSTEM_MEMORY_LIST_INFORMATION
;
1493 #endif // !NTOS_MODE_USER
1499 #endif // !_EXTYPES_H