3 Copyright (c) Alex Ionescu. All rights reserved.
11 Type definitions for the Executive.
15 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
27 #if defined(_MSC_VER) && !defined(NTOS_MODE_USER)
36 // Atom and Language IDs
38 typedef USHORT LANGID
, *PLANGID
;
39 typedef USHORT RTL_ATOM
, *PRTL_ATOM
;
41 #ifndef NTOS_MODE_USER
44 // Kernel Exported Object Types
46 extern POBJECT_TYPE NTSYSAPI ExDesktopObjectType
;
47 extern POBJECT_TYPE NTSYSAPI ExWindowStationObjectType
;
48 extern POBJECT_TYPE NTSYSAPI ExIoCompletionType
;
49 extern POBJECT_TYPE NTSYSAPI ExMutantObjectType
;
50 extern POBJECT_TYPE NTSYSAPI ExTimerType
;
53 // Exported NT Build Number
55 extern ULONG NTSYSAPI NtBuildNumber
;
58 // Invalid Handle Value Constant
60 #define INVALID_HANDLE_VALUE (HANDLE)-1
67 #define MUTANT_INCREMENT 1
70 // Callback Object Access Mask
72 #define CALLBACK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x0001)
73 #define CALLBACK_EXECUTE (STANDARD_RIGHTS_EXECUTE|SYNCHRONIZE|0x0001)
74 #define CALLBACK_WRITE (STANDARD_RIGHTS_WRITE|SYNCHRONIZE|0x0001)
75 #define CALLBACK_READ (STANDARD_RIGHTS_READ|SYNCHRONIZE|0x0001)
78 // Event Object Access Masks
81 #define EVENT_QUERY_STATE 0x0001
84 // Semaphore Object Acess Masks
86 #define SEMAPHORE_QUERY_STATE 0x0001
90 // Event Pair Access Masks
92 #define EVENT_PAIR_ALL_ACCESS 0x1F0000L
95 // Profile Object Access Masks
97 #define PROFILE_CONTROL 0x0001
98 #define PROFILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | PROFILE_CONTROL)
101 // Maximum Parameters for NtRaiseHardError
103 #define MAXIMUM_HARDERROR_PARAMETERS 4
108 #define EX_PUSH_LOCK_LOCK_V ((ULONG_PTR)0x0)
109 #define EX_PUSH_LOCK_LOCK ((ULONG_PTR)0x1)
110 #define EX_PUSH_LOCK_WAITING ((ULONG_PTR)0x2)
111 #define EX_PUSH_LOCK_WAKING ((ULONG_PTR)0x4)
112 #define EX_PUSH_LOCK_MULTIPLE_SHARED ((ULONG_PTR)0x8)
113 #define EX_PUSH_LOCK_SHARE_INC ((ULONG_PTR)0x10)
114 #define EX_PUSH_LOCK_PTR_BITS ((ULONG_PTR)0xf)
117 // Pushlock Wait Block Flags
119 #define EX_PUSH_LOCK_FLAGS_EXCLUSIVE 1
120 #define EX_PUSH_LOCK_FLAGS_WAIT 2
123 // Resource (ERESOURCE) Flags
125 #define ResourceHasDisabledPriorityBoost 0x08
128 // Shutdown types for NtShutdownSystem
130 typedef enum _SHUTDOWN_ACTION
138 // Responses for NtRaiseHardError
140 typedef enum _HARDERROR_RESPONSE_OPTION
142 OptionAbortRetryIgnore
,
149 } HARDERROR_RESPONSE_OPTION
, *PHARDERROR_RESPONSE_OPTION
;
151 typedef enum _HARDERROR_RESPONSE
153 ResponseReturnToCaller
,
162 } HARDERROR_RESPONSE
, *PHARDERROR_RESPONSE
;
165 // System Information Classes for NtQuerySystemInformation
167 typedef enum _SYSTEM_INFORMATION_CLASS
169 SystemBasicInformation
,
170 SystemProcessorInformation
,
171 SystemPerformanceInformation
,
172 SystemTimeOfDayInformation
,
173 SystemPathInformation
, /// Obsolete: Use KUSER_SHARED_DATA
174 SystemProcessInformation
,
175 SystemCallCountInformation
,
176 SystemDeviceInformation
,
177 SystemProcessorPerformanceInformation
,
178 SystemFlagsInformation
,
179 SystemCallTimeInformation
,
180 SystemModuleInformation
,
181 SystemLocksInformation
,
182 SystemStackTraceInformation
,
183 SystemPagedPoolInformation
,
184 SystemNonPagedPoolInformation
,
185 SystemHandleInformation
,
186 SystemObjectInformation
,
187 SystemPageFileInformation
,
188 SystemVdmInstemulInformation
,
189 SystemVdmBopInformation
,
190 SystemFileCacheInformation
,
191 SystemPoolTagInformation
,
192 SystemInterruptInformation
,
193 SystemDpcBehaviorInformation
,
194 SystemFullMemoryInformation
,
195 SystemLoadGdiDriverInformation
,
196 SystemUnloadGdiDriverInformation
,
197 SystemTimeAdjustmentInformation
,
198 SystemSummaryMemoryInformation
,
199 SystemMirrorMemoryInformation
,
200 SystemPerformanceTraceInformation
,
202 SystemExceptionInformation
,
203 SystemCrashDumpStateInformation
,
204 SystemKernelDebuggerInformation
,
205 SystemContextSwitchInformation
,
206 SystemRegistryQuotaInformation
,
207 SystemExtendServiceTableInformation
,
208 SystemPrioritySeperation
,
209 SystemPlugPlayBusInformation
,
210 SystemDockInformation
,
211 SystemPowerInformationNative
,
212 SystemProcessorSpeedInformation
,
213 SystemCurrentTimeZoneInformation
,
214 SystemLookasideInformation
,
215 SystemTimeSlipNotification
,
218 SystemSessionInformation
,
219 SystemRangeStartInformation
,
220 SystemVerifierInformation
,
222 SystemSessionProcessesInformation
,
223 SystemLoadGdiDriverInSystemSpaceInformation
,
224 SystemNumaProcessorMap
,
225 SystemPrefetcherInformation
,
226 SystemExtendedProcessInformation
,
227 SystemRecommendedSharedDataAlignment
,
228 SystemComPlusPackage
,
229 SystemNumaAvailableMemory
,
230 SystemProcessorPowerInformation
,
231 SystemEmulationBasicInformation
,
232 SystemEmulationProcessorInformation
,
233 SystemExtendedHanfleInformation
,
234 SystemLostDelayedWriteInformation
,
235 SystemBigPoolInformation
,
236 SystemSessionPoolTagInformation
,
237 SystemSessionMappedViewInformation
,
238 SystemHotpatchInformation
,
239 SystemObjectSecurityMode
,
240 SystemWatchDogTimerHandler
,
241 SystemWatchDogTimerInformation
,
242 SystemLogicalProcessorInformation
,
243 SystemWo64SharedInformationObosolete
,
244 SystemRegisterFirmwareTableInformationHandler
,
245 SystemFirmwareTableInformation
,
246 SystemModuleInformationEx
,
247 SystemVerifierTriageInformation
,
248 SystemSuperfetchInformation
,
249 SystemMemoryListInformation
,
250 SystemFileCacheInformationEx
,
251 SystemThreadPriorityClientIdInformation
,
252 SystemProcessorIdleCycleTimeInformation
,
253 SystemVerifierCancellationInformation
,
254 SystemProcessorPowerInformationEx
,
255 SystemRefTraceInformation
,
256 SystemSpecialPoolInformation
,
257 SystemProcessIdInformation
,
258 SystemErrorPortInformation
,
259 SystemBootEnvironmentInformation
,
260 SystemHypervisorInformation
,
261 SystemVerifierInformationEx
,
262 SystemTimeZoneInformation
,
263 SystemImageFileExecutionOptionsInformation
,
264 SystemCoverageInformation
,
265 SystemPrefetchPathInformation
,
266 SystemVerifierFaultsInformation
,
268 } SYSTEM_INFORMATION_CLASS
;
271 // System Information Classes for NtQueryMutant
273 typedef enum _MUTANT_INFORMATION_CLASS
275 MutantBasicInformation
,
276 MutantOwnerInformation
277 } MUTANT_INFORMATION_CLASS
;
280 // System Information Classes for NtQueryAtom
282 typedef enum _ATOM_INFORMATION_CLASS
284 AtomBasicInformation
,
285 AtomTableInformation
,
286 } ATOM_INFORMATION_CLASS
;
289 // System Information Classes for NtQueryTimer
291 typedef enum _TIMER_INFORMATION_CLASS
293 TimerBasicInformation
294 } TIMER_INFORMATION_CLASS
;
297 // System Information Classes for NtQuerySemaphore
299 typedef enum _SEMAPHORE_INFORMATION_CLASS
301 SemaphoreBasicInformation
302 } SEMAPHORE_INFORMATION_CLASS
;
305 // System Information Classes for NtQueryEvent
307 typedef enum _EVENT_INFORMATION_CLASS
309 EventBasicInformation
310 } EVENT_INFORMATION_CLASS
;
312 #ifdef NTOS_MODE_USER
315 // Firmware Table Actions for SystemFirmwareTableInformation
317 typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION
319 SystemFirmwareTable_Enumerate
= 0,
320 SystemFirmwareTable_Get
= 1,
321 } SYSTEM_FIRMWARE_TABLE_ACTION
, *PSYSTEM_FIRMWARE_TABLE_ACTION
;
324 // Firmware Handler Callback
326 struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
;
330 IN
struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
*FirmwareTableInformation
336 // Executive Work Queue Structures
338 typedef struct _EX_QUEUE_WORKER_INFO
340 ULONG QueueDisabled
:1;
341 ULONG MakeThreadsAsNecessary
:1;
343 ULONG WorkerCount
:29;
344 } EX_QUEUE_WORKER_INFO
, *PEX_QUEUE_WORKER_INFO
;
346 typedef struct _EX_WORK_QUEUE
349 LONG DynamicThreadCount
;
350 ULONG WorkItemsProcessed
;
351 ULONG WorkItemsProcessedLastPass
;
352 ULONG QueueDepthLastPass
;
353 EX_QUEUE_WORKER_INFO Info
;
354 } EX_WORK_QUEUE
, *PEX_WORK_QUEUE
;
357 // Executive Fast Reference Structure
359 typedef struct _EX_FAST_REF
367 } EX_FAST_REF
, *PEX_FAST_REF
;
370 // Executive Cache-Aware Rundown Reference Descriptor
372 typedef struct _EX_RUNDOWN_REF_CACHE_AWARE
374 PEX_RUNDOWN_REF RunRefs
;
378 } EX_RUNDOWN_REF_CACHE_AWARE
, *PEX_RUNDOWN_REF_CACHE_AWARE
;
381 // Executive Rundown Wait Block
383 typedef struct _EX_RUNDOWN_WAIT_BLOCK
387 } EX_RUNDOWN_WAIT_BLOCK
, *PEX_RUNDOWN_WAIT_BLOCK
;
390 // Executive Pushlock
394 typedef struct _EX_PUSH_LOCK
403 ULONG_PTR MultipleShared
:1;
404 ULONG_PTR Shared
:sizeof (ULONG_PTR
) * 8 - 4;
409 } EX_PUSH_LOCK
, *PEX_PUSH_LOCK
;
412 // Executive Pushlock Wait Block
414 #ifndef __GNUC__ // WARNING! PUSHLOCKS WILL NOT WORK IN GCC FOR NOW!!!
415 __declspec(align(16))
417 typedef struct _EX_PUSH_LOCK_WAIT_BLOCK
424 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Next
;
425 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Last
;
426 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Previous
;
431 EX_PUSH_LOCK NewValue
;
432 EX_PUSH_LOCK OldValue
;
433 PEX_PUSH_LOCK PushLock
;
435 } EX_PUSH_LOCK_WAIT_BLOCK
, *PEX_PUSH_LOCK_WAIT_BLOCK
;
440 typedef struct _CALLBACK_OBJECT
444 LIST_ENTRY RegisteredCallbacks
;
445 ULONG AllowMultipleCallbacks
;
446 } CALLBACK_OBJECT
, *PCALLBACK_OBJECT
;
451 typedef struct _EPROFILE
459 PKPROFILE ProfileObject
;
460 PVOID LockedBufferAddress
;
463 KPROFILE_SOURCE ProfileSource
;
465 } EPROFILE
, *PEPROFILE
;
468 // Handle Table Structures
470 typedef struct _HANDLE_TABLE_ENTRY_INFO
473 } HANDLE_TABLE_ENTRY_INFO
, *PHANDLE_TABLE_ENTRY_INFO
;
475 typedef struct _HANDLE_TABLE_ENTRY
480 ULONG_PTR ObAttributes
;
481 PHANDLE_TABLE_ENTRY_INFO InfoTable
;
487 USHORT GrantedAccessIndex
;
488 LONG NextFreeTableEntry
;
490 } HANDLE_TABLE_ENTRY
, *PHANDLE_TABLE_ENTRY
;
492 typedef struct _HANDLE_TABLE
496 PHANDLE_TABLE_ENTRY
**Table
;
497 PEPROCESS QuotaProcess
;
498 HANDLE UniqueProcessId
;
499 LONG FirstFreeTableEntry
;
500 LONG NextIndexNeedingPool
;
501 ERESOURCE HandleTableLock
;
502 LIST_ENTRY HandleTableList
;
503 KEVENT HandleContentionEvent
;
504 } HANDLE_TABLE
, *PHANDLE_TABLE
;
509 // Hard Error LPC Message
511 typedef struct _HARDERROR_MSG
515 LARGE_INTEGER ErrorTime
;
516 ULONG ValidResponseOptions
;
518 ULONG NumberOfParameters
;
519 ULONG UnicodeStringParameterMask
;
520 ULONG Parameters
[MAXIMUM_HARDERROR_PARAMETERS
];
521 } HARDERROR_MSG
, *PHARDERROR_MSG
;
524 // Information Structures for NtQueryMutant
526 typedef struct _MUTANT_BASIC_INFORMATION
529 BOOLEAN OwnedByCaller
;
530 BOOLEAN AbandonedState
;
531 } MUTANT_BASIC_INFORMATION
, *PMUTANT_BASIC_INFORMATION
;
533 typedef struct _MUTANT_OWNER_INFORMATION
536 } MUTANT_OWNER_INFORMATION
, *PMUTANT_OWNER_INFORMATION
;
539 // Information Structures for NtQueryAtom
541 typedef struct _ATOM_BASIC_INFORMATION
547 } ATOM_BASIC_INFORMATION
, *PATOM_BASIC_INFORMATION
;
549 typedef struct _ATOM_TABLE_INFORMATION
553 } ATOM_TABLE_INFORMATION
, *PATOM_TABLE_INFORMATION
;
556 // Information Structures for NtQueryTimer
558 typedef struct _TIMER_BASIC_INFORMATION
560 LARGE_INTEGER TimeRemaining
;
562 } TIMER_BASIC_INFORMATION
, *PTIMER_BASIC_INFORMATION
;
565 // Information Structures for NtQuerySemaphore
567 typedef struct _SEMAPHORE_BASIC_INFORMATION
571 } SEMAPHORE_BASIC_INFORMATION
, *PSEMAPHORE_BASIC_INFORMATION
;
574 // Information Structures for NtQueryEvent
576 typedef struct _EVENT_BASIC_INFORMATION
578 EVENT_TYPE EventType
;
580 } EVENT_BASIC_INFORMATION
, *PEVENT_BASIC_INFORMATION
;
583 // Information Structures for NtQuerySystemInformation
585 typedef struct _SYSTEM_BASIC_INFORMATION
588 ULONG TimerResolution
;
590 ULONG NumberOfPhysicalPages
;
591 ULONG LowestPhysicalPageNumber
;
592 ULONG HighestPhysicalPageNumber
;
593 ULONG AllocationGranularity
;
594 ULONG MinimumUserModeAddress
;
595 ULONG MaximumUserModeAddress
;
596 KAFFINITY ActiveProcessorsAffinityMask
;
597 CCHAR NumberOfProcessors
;
598 } SYSTEM_BASIC_INFORMATION
, *PSYSTEM_BASIC_INFORMATION
;
601 typedef struct _SYSTEM_PROCESSOR_INFORMATION
603 USHORT ProcessorArchitecture
;
604 USHORT ProcessorLevel
;
605 USHORT ProcessorRevision
;
607 ULONG ProcessorFeatureBits
;
608 } SYSTEM_PROCESSOR_INFORMATION
, *PSYSTEM_PROCESSOR_INFORMATION
;
611 typedef struct _SYSTEM_PERFORMANCE_INFORMATION
613 LARGE_INTEGER IdleProcessTime
;
614 LARGE_INTEGER IoReadTransferCount
;
615 LARGE_INTEGER IoWriteTransferCount
;
616 LARGE_INTEGER IoOtherTransferCount
;
617 ULONG IoReadOperationCount
;
618 ULONG IoWriteOperationCount
;
619 ULONG IoOtherOperationCount
;
620 ULONG AvailablePages
;
621 ULONG CommittedPages
;
623 ULONG PeakCommitment
;
624 ULONG PageFaultCount
;
625 ULONG CopyOnWriteCount
;
626 ULONG TransitionCount
;
627 ULONG CacheTransitionCount
;
628 ULONG DemandZeroCount
;
630 ULONG PageReadIoCount
;
631 ULONG CacheReadCount
;
633 ULONG DirtyPagesWriteCount
;
634 ULONG DirtyWriteIoCount
;
635 ULONG MappedPagesWriteCount
;
636 ULONG MappedWriteIoCount
;
637 ULONG PagedPoolPages
;
638 ULONG NonPagedPoolPages
;
639 ULONG PagedPoolAllocs
;
640 ULONG PagedPoolFrees
;
641 ULONG NonPagedPoolAllocs
;
642 ULONG NonPagedPoolFrees
;
643 ULONG FreeSystemPtes
;
644 ULONG ResidentSystemCodePage
;
645 ULONG TotalSystemDriverPages
;
646 ULONG TotalSystemCodePages
;
647 ULONG NonPagedPoolLookasideHits
;
648 ULONG PagedPoolLookasideHits
;
650 ULONG ResidentSystemCachePage
;
651 ULONG ResidentPagedPoolPage
;
652 ULONG ResidentSystemDriverPage
;
653 ULONG CcFastReadNoWait
;
654 ULONG CcFastReadWait
;
655 ULONG CcFastReadResourceMiss
;
656 ULONG CcFastReadNotPossible
;
657 ULONG CcFastMdlReadNoWait
;
658 ULONG CcFastMdlReadWait
;
659 ULONG CcFastMdlReadResourceMiss
;
660 ULONG CcFastMdlReadNotPossible
;
661 ULONG CcMapDataNoWait
;
663 ULONG CcMapDataNoWaitMiss
;
664 ULONG CcMapDataWaitMiss
;
665 ULONG CcPinMappedDataCount
;
666 ULONG CcPinReadNoWait
;
668 ULONG CcPinReadNoWaitMiss
;
669 ULONG CcPinReadWaitMiss
;
670 ULONG CcCopyReadNoWait
;
671 ULONG CcCopyReadWait
;
672 ULONG CcCopyReadNoWaitMiss
;
673 ULONG CcCopyReadWaitMiss
;
674 ULONG CcMdlReadNoWait
;
676 ULONG CcMdlReadNoWaitMiss
;
677 ULONG CcMdlReadWaitMiss
;
678 ULONG CcReadAheadIos
;
679 ULONG CcLazyWriteIos
;
680 ULONG CcLazyWritePages
;
683 ULONG ContextSwitches
;
684 ULONG FirstLevelTbFills
;
685 ULONG SecondLevelTbFills
;
687 } SYSTEM_PERFORMANCE_INFORMATION
, *PSYSTEM_PERFORMANCE_INFORMATION
;
690 typedef struct _SYSTEM_TIMEOFDAY_INFORMATION
692 LARGE_INTEGER BootTime
;
693 LARGE_INTEGER CurrentTime
;
694 LARGE_INTEGER TimeZoneBias
;
697 } SYSTEM_TIMEOFDAY_INFORMATION
, *PSYSTEM_TIMEOFDAY_INFORMATION
;
700 // This class is obsolete, please use KUSER_SHARED_DATA instead
703 typedef struct _SYSTEM_THREAD_INFORMATION
705 LARGE_INTEGER KernelTime
;
706 LARGE_INTEGER UserTime
;
707 LARGE_INTEGER CreateTime
;
713 ULONG ContextSwitches
;
716 } SYSTEM_THREAD_INFORMATION
, *PSYSTEM_THREAD_INFORMATION
;
718 typedef struct _SYSTEM_PROCESS_INFORMATION
720 ULONG NextEntryOffset
;
721 ULONG NumberOfThreads
;
722 LARGE_INTEGER SpareLi1
;
723 LARGE_INTEGER SpareLi2
;
724 LARGE_INTEGER SpareLi3
;
725 LARGE_INTEGER CreateTime
;
726 LARGE_INTEGER UserTime
;
727 LARGE_INTEGER KernelTime
;
728 UNICODE_STRING ImageName
;
729 KPRIORITY BasePriority
;
730 HANDLE UniqueProcessId
;
731 HANDLE InheritedFromUniqueProcessId
;
734 ULONG UniqueProcessKey
;
737 // This part corresponds to VM_COUNTERS_EX.
738 // NOTE: *NOT* THE SAME AS VM_COUNTERS!
740 ULONG PeakVirtualSize
;
742 ULONG PageFaultCount
;
743 ULONG PeakWorkingSetSize
;
744 ULONG WorkingSetSize
;
745 ULONG QuotaPeakPagedPoolUsage
;
746 ULONG QuotaPagedPoolUsage
;
747 ULONG QuotaPeakNonPagedPoolUsage
;
748 ULONG QuotaNonPagedPoolUsage
;
750 ULONG PeakPagefileUsage
;
751 ULONG PrivatePageCount
;
754 // This part corresponds to IO_COUNTERS
756 LARGE_INTEGER ReadOperationCount
;
757 LARGE_INTEGER WriteOperationCount
;
758 LARGE_INTEGER OtherOperationCount
;
759 LARGE_INTEGER ReadTransferCount
;
760 LARGE_INTEGER WriteTransferCount
;
761 LARGE_INTEGER OtherTransferCount
;
763 //SYSTEM_THREAD_INFORMATION TH[1];
764 } SYSTEM_PROCESS_INFORMATION
, *PSYSTEM_PROCESS_INFORMATION
;
767 typedef struct _SYSTEM_CALL_COUNT_INFORMATION
770 ULONG NumberOfTables
;
771 } SYSTEM_CALL_COUNT_INFORMATION
, *PSYSTEM_CALL_COUNT_INFORMATION
;
774 typedef struct _SYSTEM_DEVICE_INFORMATION
777 ULONG NumberOfFloppies
;
778 ULONG NumberOfCdRoms
;
780 ULONG NumberOfSerialPorts
;
781 ULONG NumberOfParallelPorts
;
782 } SYSTEM_DEVICE_INFORMATION
, *PSYSTEM_DEVICE_INFORMATION
;
785 typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
787 LARGE_INTEGER IdleTime
;
788 LARGE_INTEGER KernelTime
;
789 LARGE_INTEGER UserTime
;
790 LARGE_INTEGER DpcTime
;
791 LARGE_INTEGER InterruptTime
;
792 ULONG InterruptCount
;
793 } SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
;
796 typedef struct _SYSTEM_FLAGS_INFORMATION
799 } SYSTEM_FLAGS_INFORMATION
, *PSYSTEM_FLAGS_INFORMATION
;
802 typedef struct _SYSTEM_CALL_TIME_INFORMATION
806 LARGE_INTEGER TimeOfCalls
[1];
807 } SYSTEM_CALL_TIME_INFORMATION
, *PSYSTEM_CALL_TIME_INFORMATION
;
809 // Class 11 - See RTL_PROCESS_MODULES
811 // Class 12 - See RTL_PROCESS_LOCKS
813 // Class 13 - See RTL_PROCESS_BACKTRACES
816 typedef struct _SYSTEM_POOL_ENTRY
820 USHORT AllocatorBackTraceIndex
;
826 PVOID ProcessChargedQuota
;
828 } SYSTEM_POOL_ENTRY
, *PSYSTEM_POOL_ENTRY
;
830 typedef struct _SYSTEM_POOL_INFORMATION
834 USHORT EntryOverhead
;
835 BOOLEAN PoolTagPresent
;
837 ULONG NumberOfEntries
;
838 SYSTEM_POOL_ENTRY Entries
[1];
839 } SYSTEM_POOL_INFORMATION
, *PSYSTEM_POOL_INFORMATION
;
842 typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
844 USHORT UniqueProcessId
;
845 USHORT CreatorBackTraceIndex
;
846 UCHAR ObjectTypeIndex
;
847 UCHAR HandleAttributes
;
851 } SYSTEM_HANDLE_TABLE_ENTRY_INFO
, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO
;
853 typedef struct _SYSTEM_HANDLE_INFORMATION
855 ULONG NumberOfHandles
;
856 SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles
[1];
857 } SYSTEM_HANDLE_INFORMATION
, *PSYSTEM_HANDLE_INFORMATION
;
860 typedef struct _SYSTEM_OBJECTTYPE_INFORMATION
862 ULONG NextEntryOffset
;
863 ULONG NumberOfObjects
;
864 ULONG NumberOfHandles
;
866 ULONG InvalidAttributes
;
867 GENERIC_MAPPING GenericMapping
;
868 ULONG ValidAccessMask
;
870 BOOLEAN SecurityRequired
;
871 BOOLEAN WaitableObject
;
872 UNICODE_STRING TypeName
;
873 } SYSTEM_OBJECTTYPE_INFORMATION
, *PSYSTEM_OBJECTTYPE_INFORMATION
;
875 typedef struct _SYSTEM_OBJECT_INFORMATION
877 ULONG NextEntryOffset
;
879 HANDLE CreatorUniqueProcess
;
880 USHORT CreatorBackTraceIndex
;
884 ULONG PagedPoolCharge
;
885 ULONG NonPagedPoolCharge
;
886 HANDLE ExclusiveProcessId
;
887 PVOID SecurityDescriptor
;
888 OBJECT_NAME_INFORMATION NameInfo
;
889 } SYSTEM_OBJECT_INFORMATION
, *PSYSTEM_OBJECT_INFORMATION
;
892 typedef struct _SYSTEM_PAGEFILE_INFORMATION
894 ULONG NextEntryOffset
;
898 UNICODE_STRING PageFileName
;
899 } SYSTEM_PAGEFILE_INFORMATION
, *PSYSTEM_PAGEFILE_INFORMATION
;
902 typedef struct _SYSTEM_VDM_INSTEMUL_INFO
904 ULONG SegmentNotPresent
;
906 ULONG OpcodeESPrefix
;
907 ULONG OpcodeCSPrefix
;
908 ULONG OpcodeSSPrefix
;
909 ULONG OpcodeDSPrefix
;
910 ULONG OpcodeFSPrefix
;
911 ULONG OpcodeGSPrefix
;
912 ULONG OpcodeOPER32Prefix
;
913 ULONG OpcodeADDR32Prefix
;
926 ULONG OpcodeOUTWimm
;
931 ULONG OpcodeLOCKPrefix
;
932 ULONG OpcodeREPNEPrefix
;
933 ULONG OpcodeREPPrefix
;
938 } SYSTEM_VDM_INSTEMUL_INFO
, *PSYSTEM_VDM_INSTEMUL_INFO
;
940 // Class 20 - ULONG VDMBOPINFO
943 typedef struct _SYSTEM_FILECACHE_INFORMATION
947 ULONG PageFaultCount
;
948 ULONG MinimumWorkingSet
;
949 ULONG MaximumWorkingSet
;
950 ULONG CurrentSizeIncludingTransitionInPages
;
951 ULONG PeakSizeIncludingTransitionInPages
;
952 ULONG TransitionRePurposeCount
;
954 } SYSTEM_FILECACHE_INFORMATION
, *PSYSTEM_FILECACHE_INFORMATION
;
957 typedef struct _SYSTEM_POOLTAG
967 ULONG NonPagedAllocs
;
970 } SYSTEM_POOLTAG
, *PSYSTEM_POOLTAG
;
971 typedef struct _SYSTEM_POOLTAG_INFORMATION
974 SYSTEM_POOLTAG TagInfo
[1];
975 } SYSTEM_POOLTAG_INFORMATION
, *PSYSTEM_POOLTAG_INFORMATION
;
978 typedef struct _SYSTEM_INTERRUPT_INFORMATION
980 ULONG ContextSwitches
;
984 ULONG DpcBypassCount
;
985 ULONG ApcBypassCount
;
986 } SYSTEM_INTERRUPT_INFORMATION
, *PSYSTEM_INTERRUPT_INFORMATION
;
989 typedef struct _SYSTEM_DPC_BEHAVIOR_INFORMATION
993 ULONG MinimumDpcRate
;
994 ULONG AdjustDpcThreshold
;
996 } SYSTEM_DPC_BEHAVIOR_INFORMATION
, *PSYSTEM_DPC_BEHAVIOR_INFORMATION
;
999 typedef struct _SYSTEM_MEMORY_INFO
1001 PUCHAR StringOffset
;
1003 USHORT TransitionCount
;
1004 USHORT ModifiedCount
;
1005 USHORT PageTableCount
;
1006 } SYSTEM_MEMORY_INFO
, *PSYSTEM_MEMORY_INFO
;
1008 typedef struct _SYSTEM_MEMORY_INFORMATION
1012 SYSTEM_MEMORY_INFO Memory
[1];
1013 } SYSTEM_MEMORY_INFORMATION
, *PSYSTEM_MEMORY_INFORMATION
;
1016 typedef struct _SYSTEM_GDI_DRIVER_INFORMATION
1018 UNICODE_STRING DriverName
;
1020 PVOID SectionPointer
;
1022 PIMAGE_EXPORT_DIRECTORY ExportSectionPointer
;
1024 } SYSTEM_GDI_DRIVER_INFORMATION
, *PSYSTEM_GDI_DRIVER_INFORMATION
;
1027 // Not an actually class, simply a PVOID to the ImageAddress
1030 typedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION
1032 ULONG TimeAdjustment
;
1033 ULONG TimeIncrement
;
1035 } SYSTEM_QUERY_TIME_ADJUST_INFORMATION
, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION
;
1037 typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION
1039 ULONG TimeAdjustment
;
1041 } SYSTEM_SET_TIME_ADJUST_INFORMATION
, *PSYSTEM_SET_TIME_ADJUST_INFORMATION
;
1043 // Class 29 - Same as 25
1048 typedef struct _SYSTEM_REF_TRACE_INFORMATION
1051 UCHAR TracePermanent
;
1052 UNICODE_STRING TraceProcessName
;
1053 UNICODE_STRING TracePoolTags
;
1054 } SYSTEM_REF_TRACE_INFORMATION
, *PSYSTEM_REF_TRACE_INFORMATION
;
1056 // Class 32 - OBSOLETE
1059 typedef struct _SYSTEM_EXCEPTION_INFORMATION
1061 ULONG AlignmentFixupCount
;
1062 ULONG ExceptionDispatchCount
;
1063 ULONG FloatingEmulationCount
;
1064 ULONG ByteWordEmulationCount
;
1065 } SYSTEM_EXCEPTION_INFORMATION
, *PSYSTEM_EXCEPTION_INFORMATION
;
1068 typedef struct _SYSTEM_CRASH_STATE_INFORMATION
1070 ULONG ValidCrashDump
;
1071 } SYSTEM_CRASH_STATE_INFORMATION
, *PSYSTEM_CRASH_STATE_INFORMATION
;
1074 typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION
1076 BOOLEAN KernelDebuggerEnabled
;
1077 BOOLEAN KernelDebuggerNotPresent
;
1078 } SYSTEM_KERNEL_DEBUGGER_INFORMATION
, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION
;
1081 typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION
1083 ULONG ContextSwitches
;
1092 ULONG PreemptCurrent
;
1095 } SYSTEM_CONTEXT_SWITCH_INFORMATION
, *PSYSTEM_CONTEXT_SWITCH_INFORMATION
;
1098 typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION
1100 ULONG RegistryQuotaAllowed
;
1101 ULONG RegistryQuotaUsed
;
1102 ULONG PagedPoolSize
;
1103 } SYSTEM_REGISTRY_QUOTA_INFORMATION
, *PSYSTEM_REGISTRY_QUOTA_INFORMATION
;
1106 // Not a structure, simply send the UNICODE_STRING
1109 // Not a structure, simply send a ULONG containing the new separation
1112 typedef struct _SYSTEM_PLUGPLAY_BUS_INFORMATION
1115 PLUGPLAY_BUS_INSTANCE BusInstance
[1];
1116 } SYSTEM_PLUGPLAY_BUS_INFORMATION
, *PSYSTEM_PLUGPLAY_BUS_INFORMATION
;
1119 typedef struct _SYSTEM_DOCK_INFORMATION
1121 SYSTEM_DOCK_STATE DockState
;
1122 INTERFACE_TYPE DeviceBusType
;
1123 ULONG DeviceBusNumber
;
1125 } SYSTEM_DOCK_INFORMATION
, *PSYSTEM_DOCK_INFORMATION
;
1128 typedef struct _SYSTEM_POWER_INFORMATION_NATIVE
1130 BOOLEAN SystemSuspendSupported
;
1131 BOOLEAN SystemHibernateSupported
;
1132 BOOLEAN ResumeTimerSupportsSuspend
;
1133 BOOLEAN ResumeTimerSupportsHibernate
;
1134 BOOLEAN LidSupported
;
1135 BOOLEAN TurboSettingSupported
;
1137 BOOLEAN SystemAcOrDc
;
1138 BOOLEAN PowerDownDisabled
;
1139 LARGE_INTEGER SpindownDrives
;
1140 } SYSTEM_POWER_INFORMATION_NATIVE
, *PSYSTEM_POWER_INFORMATION_NATIVE
;
1143 typedef struct _SYSTEM_LEGACY_DRIVER_INFORMATION
1145 PNP_VETO_TYPE VetoType
;
1146 UNICODE_STRING VetoDriver
;
1148 } SYSTEM_LEGACY_DRIVER_INFORMATION
, *PSYSTEM_LEGACY_DRIVER_INFORMATION
;
1151 typedef struct _TIME_ZONE_INFORMATION RTL_TIME_ZONE_INFORMATION
;
1154 typedef struct _SYSTEM_LOOKASIDE_INFORMATION
1156 USHORT CurrentDepth
;
1157 USHORT MaximumDepth
;
1158 ULONG TotalAllocates
;
1159 ULONG AllocateMisses
;
1165 } SYSTEM_LOOKASIDE_INFORMATION
, *PSYSTEM_LOOKASIDE_INFORMATION
;
1168 // Not a structure. Only a HANDLE for the SlipEvent;
1171 // Not a structure. Only a ULONG for the SessionId;
1174 // Not a structure. Only a ULONG for the SessionId;
1179 // Not a structure. Only a ULONG_PTR for the SystemRangeStart
1182 typedef struct _SYSTEM_VERIFIER_INFORMATION
1184 ULONG NextEntryOffset
;
1186 UNICODE_STRING DriverName
;
1188 ULONG AcquireSpinLocks
;
1189 ULONG SynchronizeExecutions
;
1190 ULONG AllocationsAttempted
;
1191 ULONG AllocationsSucceeded
;
1192 ULONG AllocationsSucceededSpecialPool
;
1193 ULONG AllocationsWithNoTag
;
1196 ULONG AllocationsFailed
;
1197 ULONG AllocationsFailedDeliberately
;
1200 ULONG UnTrackedPool
;
1201 ULONG CurrentPagedPoolAllocations
;
1202 ULONG CurrentNonPagedPoolAllocations
;
1203 ULONG PeakPagedPoolAllocations
;
1204 ULONG PeakNonPagedPoolAllocations
;
1205 ULONG PagedPoolUsageInBytes
;
1206 ULONG NonPagedPoolUsageInBytes
;
1207 ULONG PeakPagedPoolUsageInBytes
;
1208 ULONG PeakNonPagedPoolUsageInBytes
;
1209 } SYSTEM_VERIFIER_INFORMATION
, *PSYSTEM_VERIFIER_INFORMATION
;
1214 typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
1218 PVOID Buffer
; // Same format as in SystemProcessInformation
1219 } SYSTEM_SESSION_PROCESS_INFORMATION
, *PSYSTEM_SESSION_PROCESS_INFORMATION
;
1221 // FIXME: Class 54-97
1226 #define RTL_HOTPATCH_SUPPORTED_FLAG 0x01
1227 #define RTL_HOTPATCH_SWAP_OBJECT_NAMES 0x08 << 24
1228 #define RTL_HOTPATCH_SYNC_RENAME_FILES 0x10 << 24
1229 #define RTL_HOTPATCH_PATCH_USER_MODE 0x20 << 24
1230 #define RTL_HOTPATCH_REMAP_SYSTEM_DLL 0x40 << 24
1231 #define RTL_HOTPATCH_PATCH_KERNEL_MODE 0x80 << 24
1235 typedef struct _SYSTEM_HOTPATCH_CODE_INFORMATION
1254 USHORT TargetNameOffset
;
1255 USHORT TargetNameLength
;
1256 UCHAR PatchingFinished
;
1262 USHORT TargetNameOffset
;
1263 USHORT TargetNameLength
;
1264 UCHAR PatchingFinished
;
1265 NTSTATUS ReturnCode
;
1266 HANDLE TargetProcess
;
1271 PIO_STATUS_BLOCK IoStatusBlock1
;
1272 PVOID RenameInformation1
;
1273 PVOID RenameInformationLength1
;
1275 PIO_STATUS_BLOCK IoStatusBlock2
;
1276 PVOID RenameInformation2
;
1277 PVOID RenameInformationLength2
;
1281 HANDLE ParentDirectory
;
1282 HANDLE ObjectHandle1
;
1283 HANDLE ObjectHandle2
;
1286 } SYSTEM_HOTPATCH_CODE_INFORMATION
, *PSYSTEM_HOTPATCH_CODE_INFORMATION
;
1291 #ifdef NTOS_MODE_USER
1292 typedef struct _SYSTEM_FIRMWARE_TABLE_HANDLER
1294 ULONG ProviderSignature
;
1296 PFNFTH FirmwareTableHandler
;
1298 } SYSTEM_FIRMWARE_TABLE_HANDLER
, *PSYSTEM_FIRMWARE_TABLE_HANDLER
;
1303 typedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
1305 ULONG ProviderSignature
;
1306 SYSTEM_FIRMWARE_TABLE_ACTION Action
;
1308 ULONG TableBufferLength
;
1309 UCHAR TableBuffer
[1];
1310 } SYSTEM_FIRMWARE_TABLE_INFORMATION
, *PSYSTEM_FIRMWARE_TABLE_INFORMATION
;