3 Copyright (c) Alex Ionescu. All rights reserved.
11 Type definitions for the Executive.
15 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
27 #if defined(_MSC_VER) && !defined(NTOS_MODE_USER)
39 #define __ALIGNED(n) __attribute__((aligned (n)))
40 #elif defined(_MSC_VER)
41 #define __ALIGNED(n) __declspec(align(n))
43 #error __ALIGNED not defined for your compiler!
47 // Atom and Language IDs
49 typedef USHORT LANGID
, *PLANGID
;
50 typedef USHORT RTL_ATOM
, *PRTL_ATOM
;
52 #ifndef NTOS_MODE_USER
55 // Kernel Exported Object Types
57 extern POBJECT_TYPE NTSYSAPI ExDesktopObjectType
;
58 extern POBJECT_TYPE NTSYSAPI ExWindowStationObjectType
;
59 extern POBJECT_TYPE NTSYSAPI ExIoCompletionType
;
60 extern POBJECT_TYPE NTSYSAPI ExMutantObjectType
;
61 extern POBJECT_TYPE NTSYSAPI ExTimerType
;
64 // Exported NT Build Number
66 extern ULONG NtBuildNumber
;
69 // Invalid Handle Value Constant
71 #define INVALID_HANDLE_VALUE (HANDLE)-1
78 #define MUTANT_INCREMENT 1
81 // Callback Object Access Mask
83 #define CALLBACK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x0001)
84 #define CALLBACK_EXECUTE (STANDARD_RIGHTS_EXECUTE|SYNCHRONIZE|0x0001)
85 #define CALLBACK_WRITE (STANDARD_RIGHTS_WRITE|SYNCHRONIZE|0x0001)
86 #define CALLBACK_READ (STANDARD_RIGHTS_READ|SYNCHRONIZE|0x0001)
89 // Event Object Access Masks
92 #define EVENT_QUERY_STATE 0x0001
95 // Semaphore Object Access Masks
97 #define SEMAPHORE_QUERY_STATE 0x0001
101 // Mutant Object Access Masks
103 #define MUTANT_QUERY_STATE 0x0001
104 #define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
110 // Event Pair Access Masks
112 #define EVENT_PAIR_ALL_ACCESS 0x1F0000L
115 // Profile Object Access Masks
117 #define PROFILE_CONTROL 0x0001
118 #define PROFILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | PROFILE_CONTROL)
121 // Maximum Parameters for NtRaiseHardError
123 #define MAXIMUM_HARDERROR_PARAMETERS 4
128 #define EX_PUSH_LOCK_LOCK_V ((ULONG_PTR)0x0)
129 #define EX_PUSH_LOCK_LOCK ((ULONG_PTR)0x1)
130 #define EX_PUSH_LOCK_WAITING ((ULONG_PTR)0x2)
131 #define EX_PUSH_LOCK_WAKING ((ULONG_PTR)0x4)
132 #define EX_PUSH_LOCK_MULTIPLE_SHARED ((ULONG_PTR)0x8)
133 #define EX_PUSH_LOCK_SHARE_INC ((ULONG_PTR)0x10)
134 #define EX_PUSH_LOCK_PTR_BITS ((ULONG_PTR)0xf)
137 // Pushlock Wait Block Flags
139 #define EX_PUSH_LOCK_FLAGS_EXCLUSIVE 1
140 #define EX_PUSH_LOCK_FLAGS_WAIT 2
143 // Resource (ERESOURCE) Flags
145 #define ResourceHasDisabledPriorityBoost 0x08
148 // Shutdown types for NtShutdownSystem
150 typedef enum _SHUTDOWN_ACTION
158 // Responses for NtRaiseHardError
160 typedef enum _HARDERROR_RESPONSE_OPTION
162 OptionAbortRetryIgnore
,
169 } HARDERROR_RESPONSE_OPTION
, *PHARDERROR_RESPONSE_OPTION
;
171 typedef enum _HARDERROR_RESPONSE
173 ResponseReturnToCaller
,
182 } HARDERROR_RESPONSE
, *PHARDERROR_RESPONSE
;
185 // System Information Classes for NtQuerySystemInformation
187 typedef enum _SYSTEM_INFORMATION_CLASS
189 SystemBasicInformation
,
190 SystemProcessorInformation
,
191 SystemPerformanceInformation
,
192 SystemTimeOfDayInformation
,
193 SystemPathInformation
, /// Obsolete: Use KUSER_SHARED_DATA
194 SystemProcessInformation
,
195 SystemCallCountInformation
,
196 SystemDeviceInformation
,
197 SystemProcessorPerformanceInformation
,
198 SystemFlagsInformation
,
199 SystemCallTimeInformation
,
200 SystemModuleInformation
,
201 SystemLocksInformation
,
202 SystemStackTraceInformation
,
203 SystemPagedPoolInformation
,
204 SystemNonPagedPoolInformation
,
205 SystemHandleInformation
,
206 SystemObjectInformation
,
207 SystemPageFileInformation
,
208 SystemVdmInstemulInformation
,
209 SystemVdmBopInformation
,
210 SystemFileCacheInformation
,
211 SystemPoolTagInformation
,
212 SystemInterruptInformation
,
213 SystemDpcBehaviorInformation
,
214 SystemFullMemoryInformation
,
215 SystemLoadGdiDriverInformation
,
216 SystemUnloadGdiDriverInformation
,
217 SystemTimeAdjustmentInformation
,
218 SystemSummaryMemoryInformation
,
219 SystemMirrorMemoryInformation
,
220 SystemPerformanceTraceInformation
,
222 SystemExceptionInformation
,
223 SystemCrashDumpStateInformation
,
224 SystemKernelDebuggerInformation
,
225 SystemContextSwitchInformation
,
226 SystemRegistryQuotaInformation
,
227 SystemExtendServiceTableInformation
,
228 SystemPrioritySeperation
,
229 SystemPlugPlayBusInformation
,
230 SystemDockInformation
,
231 SystemPowerInformationNative
,
232 SystemProcessorSpeedInformation
,
233 SystemCurrentTimeZoneInformation
,
234 SystemLookasideInformation
,
235 SystemTimeSlipNotification
,
238 SystemSessionInformation
,
239 SystemRangeStartInformation
,
240 SystemVerifierInformation
,
242 SystemSessionProcessesInformation
,
243 SystemLoadGdiDriverInSystemSpaceInformation
,
244 SystemNumaProcessorMap
,
245 SystemPrefetcherInformation
,
246 SystemExtendedProcessInformation
,
247 SystemRecommendedSharedDataAlignment
,
248 SystemComPlusPackage
,
249 SystemNumaAvailableMemory
,
250 SystemProcessorPowerInformation
,
251 SystemEmulationBasicInformation
,
252 SystemEmulationProcessorInformation
,
253 SystemExtendedHanfleInformation
,
254 SystemLostDelayedWriteInformation
,
255 SystemBigPoolInformation
,
256 SystemSessionPoolTagInformation
,
257 SystemSessionMappedViewInformation
,
258 SystemHotpatchInformation
,
259 SystemObjectSecurityMode
,
260 SystemWatchDogTimerHandler
,
261 SystemWatchDogTimerInformation
,
262 SystemLogicalProcessorInformation
,
263 SystemWo64SharedInformationObosolete
,
264 SystemRegisterFirmwareTableInformationHandler
,
265 SystemFirmwareTableInformation
,
266 SystemModuleInformationEx
,
267 SystemVerifierTriageInformation
,
268 SystemSuperfetchInformation
,
269 SystemMemoryListInformation
,
270 SystemFileCacheInformationEx
,
271 SystemThreadPriorityClientIdInformation
,
272 SystemProcessorIdleCycleTimeInformation
,
273 SystemVerifierCancellationInformation
,
274 SystemProcessorPowerInformationEx
,
275 SystemRefTraceInformation
,
276 SystemSpecialPoolInformation
,
277 SystemProcessIdInformation
,
278 SystemErrorPortInformation
,
279 SystemBootEnvironmentInformation
,
280 SystemHypervisorInformation
,
281 SystemVerifierInformationEx
,
282 SystemTimeZoneInformation
,
283 SystemImageFileExecutionOptionsInformation
,
284 SystemCoverageInformation
,
285 SystemPrefetchPathInformation
,
286 SystemVerifierFaultsInformation
,
288 } SYSTEM_INFORMATION_CLASS
;
291 // System Information Classes for NtQueryMutant
293 typedef enum _MUTANT_INFORMATION_CLASS
295 MutantBasicInformation
,
296 MutantOwnerInformation
297 } MUTANT_INFORMATION_CLASS
;
300 // System Information Classes for NtQueryAtom
302 typedef enum _ATOM_INFORMATION_CLASS
304 AtomBasicInformation
,
305 AtomTableInformation
,
306 } ATOM_INFORMATION_CLASS
;
309 // System Information Classes for NtQueryTimer
311 typedef enum _TIMER_INFORMATION_CLASS
313 TimerBasicInformation
314 } TIMER_INFORMATION_CLASS
;
317 // System Information Classes for NtQuerySemaphore
319 typedef enum _SEMAPHORE_INFORMATION_CLASS
321 SemaphoreBasicInformation
322 } SEMAPHORE_INFORMATION_CLASS
;
325 // System Information Classes for NtQueryEvent
327 typedef enum _EVENT_INFORMATION_CLASS
329 EventBasicInformation
330 } EVENT_INFORMATION_CLASS
;
332 #ifdef NTOS_MODE_USER
335 // Firmware Table Actions for SystemFirmwareTableInformation
337 typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION
339 SystemFirmwareTable_Enumerate
= 0,
340 SystemFirmwareTable_Get
= 1,
341 } SYSTEM_FIRMWARE_TABLE_ACTION
, *PSYSTEM_FIRMWARE_TABLE_ACTION
;
344 // Firmware Handler Callback
346 struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
;
350 IN
struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
*FirmwareTableInformation
356 // Compatibility with Windows XP Drivers using ERESOURCE
358 typedef struct _ERESOURCE_XP
360 LIST_ENTRY SystemResourcesList
;
361 POWNER_ENTRY OwnerTable
;
364 PKSEMAPHORE SharedWaiters
;
365 PKEVENT ExclusiveWaiters
;
366 OWNER_ENTRY OwnerThreads
[2];
367 ULONG ContentionCount
;
368 USHORT NumberOfSharedWaiters
;
369 USHORT NumberOfExclusiveWaiters
;
373 ULONG_PTR CreatorBackTraceIndex
;
376 } ERESOURCE_XP
, *PERESOURCE_XP
;
379 // Executive Work Queue Structures
381 typedef struct _EX_QUEUE_WORKER_INFO
383 ULONG QueueDisabled
:1;
384 ULONG MakeThreadsAsNecessary
:1;
386 ULONG WorkerCount
:29;
387 } EX_QUEUE_WORKER_INFO
, *PEX_QUEUE_WORKER_INFO
;
389 typedef struct _EX_WORK_QUEUE
392 LONG DynamicThreadCount
;
393 ULONG WorkItemsProcessed
;
394 ULONG WorkItemsProcessedLastPass
;
395 ULONG QueueDepthLastPass
;
396 EX_QUEUE_WORKER_INFO Info
;
397 } EX_WORK_QUEUE
, *PEX_WORK_QUEUE
;
400 // Executive Fast Reference Structure
402 typedef struct _EX_FAST_REF
410 } EX_FAST_REF
, *PEX_FAST_REF
;
413 // Executive Cache-Aware Rundown Reference Descriptor
415 typedef struct _EX_RUNDOWN_REF_CACHE_AWARE
417 PEX_RUNDOWN_REF RunRefs
;
421 } EX_RUNDOWN_REF_CACHE_AWARE
, *PEX_RUNDOWN_REF_CACHE_AWARE
;
424 // Executive Rundown Wait Block
426 typedef struct _EX_RUNDOWN_WAIT_BLOCK
430 } EX_RUNDOWN_WAIT_BLOCK
, *PEX_RUNDOWN_WAIT_BLOCK
;
433 // Executive Pushlock
437 typedef struct _EX_PUSH_LOCK
446 ULONG_PTR MultipleShared
:1;
447 ULONG_PTR Shared
:sizeof (ULONG_PTR
) * 8 - 4;
452 } EX_PUSH_LOCK
, *PEX_PUSH_LOCK
;
455 // Executive Pushlock Wait Block
457 typedef __ALIGNED(16) struct _EX_PUSH_LOCK_WAIT_BLOCK
464 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Next
;
465 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Last
;
466 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Previous
;
471 EX_PUSH_LOCK NewValue
;
472 EX_PUSH_LOCK OldValue
;
473 PEX_PUSH_LOCK PushLock
;
475 } EX_PUSH_LOCK_WAIT_BLOCK
, *PEX_PUSH_LOCK_WAIT_BLOCK
;
480 typedef struct _CALLBACK_OBJECT
484 LIST_ENTRY RegisteredCallbacks
;
485 ULONG AllowMultipleCallbacks
;
486 } CALLBACK_OBJECT
, *PCALLBACK_OBJECT
;
489 // Internal Callback Object
491 typedef struct _EX_CALLBACK_ROUTINE_BLOCK
493 EX_RUNDOWN_REF RundownProtect
;
496 } EX_CALLBACK_ROUTINE_BLOCK
, *PEX_CALLBACK_ROUTINE_BLOCK
;
499 // Internal Callback Handle
501 typedef struct _EX_CALLBACK
503 EX_FAST_REF RoutineBlock
;
504 } EX_CALLBACK
, *PEX_CALLBACK
;
509 typedef struct _EPROFILE
517 PKPROFILE ProfileObject
;
518 PVOID LockedBufferAddress
;
521 KPROFILE_SOURCE ProfileSource
;
523 } EPROFILE
, *PEPROFILE
;
526 // Handle Table Structures
528 typedef struct _HANDLE_TRACE_DB_ENTRY
533 PVOID StackTrace
[16];
534 } HANDLE_TRACE_DB_ENTRY
, *PHANDLE_TRACE_DB_ENTRY
;
536 typedef struct _HANDLE_TRACE_DEBUG_INFO
541 FAST_MUTEX CloseCompatcionLock
;
542 ULONG CurrentStackIndex
;
543 HANDLE_TRACE_DB_ENTRY TraceDb
[1];
544 } HANDLE_TRACE_DEBUG_INFO
, *PHANDLE_TRACE_DEBUG_INFO
;
546 typedef struct _HANDLE_TABLE_ENTRY_INFO
549 } HANDLE_TABLE_ENTRY_INFO
, *PHANDLE_TABLE_ENTRY_INFO
;
551 typedef struct _HANDLE_TABLE_ENTRY
556 ULONG_PTR ObAttributes
;
557 PHANDLE_TABLE_ENTRY_INFO InfoTable
;
565 USHORT GrantedAccessIndex
;
566 USHORT CreatorBackTraceIndex
;
568 LONG NextFreeTableEntry
;
570 } HANDLE_TABLE_ENTRY
, *PHANDLE_TABLE_ENTRY
;
577 #define NTDDI_VERSION NTDDI_WIN2K
580 typedef struct _HANDLE_TABLE
582 #if (NTDDI_VERSION >= NTDDI_WINXP)
585 PHANDLE_TABLE_ENTRY
**Table
;
587 PEPROCESS QuotaProcess
;
588 PVOID UniqueProcessId
;
589 #if (NTDDI_VERSION >= NTDDI_WINXP)
590 EX_PUSH_LOCK HandleLock
;
591 LIST_ENTRY HandleTableList
;
592 EX_PUSH_LOCK HandleContentionEvent
;
594 ERESOURCE HandleLock
;
595 LIST_ENTRY HandleTableList
;
596 KEVENT HandleContentionEvent
;
598 PHANDLE_TRACE_DEBUG_INFO DebugInfo
;
600 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
606 LONG FirstFreeHandle
;
607 PHANDLE_TABLE_ENTRY LastFreeHandleEntry
;
609 ULONG NextHandleNeedingPool
;
613 ULONG NextHandleNeedingPool
;
621 } HANDLE_TABLE
, *PHANDLE_TABLE
;
626 // Hard Error LPC Message
628 typedef struct _HARDERROR_MSG
632 LARGE_INTEGER ErrorTime
;
633 ULONG ValidResponseOptions
;
635 ULONG NumberOfParameters
;
636 ULONG UnicodeStringParameterMask
;
637 ULONG Parameters
[MAXIMUM_HARDERROR_PARAMETERS
];
638 } HARDERROR_MSG
, *PHARDERROR_MSG
;
641 // Information Structures for NtQueryMutant
643 typedef struct _MUTANT_BASIC_INFORMATION
646 BOOLEAN OwnedByCaller
;
647 BOOLEAN AbandonedState
;
648 } MUTANT_BASIC_INFORMATION
, *PMUTANT_BASIC_INFORMATION
;
650 typedef struct _MUTANT_OWNER_INFORMATION
653 } MUTANT_OWNER_INFORMATION
, *PMUTANT_OWNER_INFORMATION
;
656 // Information Structures for NtQueryAtom
658 typedef struct _ATOM_BASIC_INFORMATION
664 } ATOM_BASIC_INFORMATION
, *PATOM_BASIC_INFORMATION
;
666 typedef struct _ATOM_TABLE_INFORMATION
670 } ATOM_TABLE_INFORMATION
, *PATOM_TABLE_INFORMATION
;
673 // Information Structures for NtQueryTimer
675 typedef struct _TIMER_BASIC_INFORMATION
677 LARGE_INTEGER TimeRemaining
;
679 } TIMER_BASIC_INFORMATION
, *PTIMER_BASIC_INFORMATION
;
682 // Information Structures for NtQuerySemaphore
684 typedef struct _SEMAPHORE_BASIC_INFORMATION
688 } SEMAPHORE_BASIC_INFORMATION
, *PSEMAPHORE_BASIC_INFORMATION
;
691 // Information Structures for NtQueryEvent
693 typedef struct _EVENT_BASIC_INFORMATION
695 EVENT_TYPE EventType
;
697 } EVENT_BASIC_INFORMATION
, *PEVENT_BASIC_INFORMATION
;
700 // Information Structures for NtQuerySystemInformation
702 typedef struct _SYSTEM_BASIC_INFORMATION
705 ULONG TimerResolution
;
707 ULONG NumberOfPhysicalPages
;
708 ULONG LowestPhysicalPageNumber
;
709 ULONG HighestPhysicalPageNumber
;
710 ULONG AllocationGranularity
;
711 ULONG MinimumUserModeAddress
;
712 ULONG MaximumUserModeAddress
;
713 KAFFINITY ActiveProcessorsAffinityMask
;
714 CCHAR NumberOfProcessors
;
715 } SYSTEM_BASIC_INFORMATION
, *PSYSTEM_BASIC_INFORMATION
;
718 typedef struct _SYSTEM_PROCESSOR_INFORMATION
720 USHORT ProcessorArchitecture
;
721 USHORT ProcessorLevel
;
722 USHORT ProcessorRevision
;
724 ULONG ProcessorFeatureBits
;
725 } SYSTEM_PROCESSOR_INFORMATION
, *PSYSTEM_PROCESSOR_INFORMATION
;
728 typedef struct _SYSTEM_PERFORMANCE_INFORMATION
730 LARGE_INTEGER IdleProcessTime
;
731 LARGE_INTEGER IoReadTransferCount
;
732 LARGE_INTEGER IoWriteTransferCount
;
733 LARGE_INTEGER IoOtherTransferCount
;
734 ULONG IoReadOperationCount
;
735 ULONG IoWriteOperationCount
;
736 ULONG IoOtherOperationCount
;
737 ULONG AvailablePages
;
738 ULONG CommittedPages
;
740 ULONG PeakCommitment
;
741 ULONG PageFaultCount
;
742 ULONG CopyOnWriteCount
;
743 ULONG TransitionCount
;
744 ULONG CacheTransitionCount
;
745 ULONG DemandZeroCount
;
747 ULONG PageReadIoCount
;
748 ULONG CacheReadCount
;
750 ULONG DirtyPagesWriteCount
;
751 ULONG DirtyWriteIoCount
;
752 ULONG MappedPagesWriteCount
;
753 ULONG MappedWriteIoCount
;
754 ULONG PagedPoolPages
;
755 ULONG NonPagedPoolPages
;
756 ULONG PagedPoolAllocs
;
757 ULONG PagedPoolFrees
;
758 ULONG NonPagedPoolAllocs
;
759 ULONG NonPagedPoolFrees
;
760 ULONG FreeSystemPtes
;
761 ULONG ResidentSystemCodePage
;
762 ULONG TotalSystemDriverPages
;
763 ULONG TotalSystemCodePages
;
764 ULONG NonPagedPoolLookasideHits
;
765 ULONG PagedPoolLookasideHits
;
767 ULONG ResidentSystemCachePage
;
768 ULONG ResidentPagedPoolPage
;
769 ULONG ResidentSystemDriverPage
;
770 ULONG CcFastReadNoWait
;
771 ULONG CcFastReadWait
;
772 ULONG CcFastReadResourceMiss
;
773 ULONG CcFastReadNotPossible
;
774 ULONG CcFastMdlReadNoWait
;
775 ULONG CcFastMdlReadWait
;
776 ULONG CcFastMdlReadResourceMiss
;
777 ULONG CcFastMdlReadNotPossible
;
778 ULONG CcMapDataNoWait
;
780 ULONG CcMapDataNoWaitMiss
;
781 ULONG CcMapDataWaitMiss
;
782 ULONG CcPinMappedDataCount
;
783 ULONG CcPinReadNoWait
;
785 ULONG CcPinReadNoWaitMiss
;
786 ULONG CcPinReadWaitMiss
;
787 ULONG CcCopyReadNoWait
;
788 ULONG CcCopyReadWait
;
789 ULONG CcCopyReadNoWaitMiss
;
790 ULONG CcCopyReadWaitMiss
;
791 ULONG CcMdlReadNoWait
;
793 ULONG CcMdlReadNoWaitMiss
;
794 ULONG CcMdlReadWaitMiss
;
795 ULONG CcReadAheadIos
;
796 ULONG CcLazyWriteIos
;
797 ULONG CcLazyWritePages
;
800 ULONG ContextSwitches
;
801 ULONG FirstLevelTbFills
;
802 ULONG SecondLevelTbFills
;
804 } SYSTEM_PERFORMANCE_INFORMATION
, *PSYSTEM_PERFORMANCE_INFORMATION
;
807 typedef struct _SYSTEM_TIMEOFDAY_INFORMATION
809 LARGE_INTEGER BootTime
;
810 LARGE_INTEGER CurrentTime
;
811 LARGE_INTEGER TimeZoneBias
;
814 } SYSTEM_TIMEOFDAY_INFORMATION
, *PSYSTEM_TIMEOFDAY_INFORMATION
;
817 // This class is obsolete, please use KUSER_SHARED_DATA instead
820 typedef struct _SYSTEM_THREAD_INFORMATION
822 LARGE_INTEGER KernelTime
;
823 LARGE_INTEGER UserTime
;
824 LARGE_INTEGER CreateTime
;
830 ULONG ContextSwitches
;
833 } SYSTEM_THREAD_INFORMATION
, *PSYSTEM_THREAD_INFORMATION
;
835 typedef struct _SYSTEM_PROCESS_INFORMATION
837 ULONG NextEntryOffset
;
838 ULONG NumberOfThreads
;
839 LARGE_INTEGER SpareLi1
;
840 LARGE_INTEGER SpareLi2
;
841 LARGE_INTEGER SpareLi3
;
842 LARGE_INTEGER CreateTime
;
843 LARGE_INTEGER UserTime
;
844 LARGE_INTEGER KernelTime
;
845 UNICODE_STRING ImageName
;
846 KPRIORITY BasePriority
;
847 HANDLE UniqueProcessId
;
848 HANDLE InheritedFromUniqueProcessId
;
851 ULONG UniqueProcessKey
;
854 // This part corresponds to VM_COUNTERS_EX.
855 // NOTE: *NOT* THE SAME AS VM_COUNTERS!
857 ULONG PeakVirtualSize
;
859 ULONG PageFaultCount
;
860 ULONG PeakWorkingSetSize
;
861 ULONG WorkingSetSize
;
862 ULONG QuotaPeakPagedPoolUsage
;
863 ULONG QuotaPagedPoolUsage
;
864 ULONG QuotaPeakNonPagedPoolUsage
;
865 ULONG QuotaNonPagedPoolUsage
;
867 ULONG PeakPagefileUsage
;
868 ULONG PrivatePageCount
;
871 // This part corresponds to IO_COUNTERS
873 LARGE_INTEGER ReadOperationCount
;
874 LARGE_INTEGER WriteOperationCount
;
875 LARGE_INTEGER OtherOperationCount
;
876 LARGE_INTEGER ReadTransferCount
;
877 LARGE_INTEGER WriteTransferCount
;
878 LARGE_INTEGER OtherTransferCount
;
880 //SYSTEM_THREAD_INFORMATION TH[1];
881 } SYSTEM_PROCESS_INFORMATION
, *PSYSTEM_PROCESS_INFORMATION
;
884 typedef struct _SYSTEM_CALL_COUNT_INFORMATION
887 ULONG NumberOfTables
;
888 } SYSTEM_CALL_COUNT_INFORMATION
, *PSYSTEM_CALL_COUNT_INFORMATION
;
891 typedef struct _SYSTEM_DEVICE_INFORMATION
894 ULONG NumberOfFloppies
;
895 ULONG NumberOfCdRoms
;
897 ULONG NumberOfSerialPorts
;
898 ULONG NumberOfParallelPorts
;
899 } SYSTEM_DEVICE_INFORMATION
, *PSYSTEM_DEVICE_INFORMATION
;
902 typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
904 LARGE_INTEGER IdleTime
;
905 LARGE_INTEGER KernelTime
;
906 LARGE_INTEGER UserTime
;
907 LARGE_INTEGER DpcTime
;
908 LARGE_INTEGER InterruptTime
;
909 ULONG InterruptCount
;
910 } SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
;
913 typedef struct _SYSTEM_FLAGS_INFORMATION
916 } SYSTEM_FLAGS_INFORMATION
, *PSYSTEM_FLAGS_INFORMATION
;
919 typedef struct _SYSTEM_CALL_TIME_INFORMATION
923 LARGE_INTEGER TimeOfCalls
[1];
924 } SYSTEM_CALL_TIME_INFORMATION
, *PSYSTEM_CALL_TIME_INFORMATION
;
926 // Class 11 - See RTL_PROCESS_MODULES
928 // Class 12 - See RTL_PROCESS_LOCKS
930 // Class 13 - See RTL_PROCESS_BACKTRACES
933 typedef struct _SYSTEM_POOL_ENTRY
937 USHORT AllocatorBackTraceIndex
;
943 PVOID ProcessChargedQuota
;
945 } SYSTEM_POOL_ENTRY
, *PSYSTEM_POOL_ENTRY
;
947 typedef struct _SYSTEM_POOL_INFORMATION
951 USHORT EntryOverhead
;
952 BOOLEAN PoolTagPresent
;
954 ULONG NumberOfEntries
;
955 SYSTEM_POOL_ENTRY Entries
[1];
956 } SYSTEM_POOL_INFORMATION
, *PSYSTEM_POOL_INFORMATION
;
959 typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
961 USHORT UniqueProcessId
;
962 USHORT CreatorBackTraceIndex
;
963 UCHAR ObjectTypeIndex
;
964 UCHAR HandleAttributes
;
968 } SYSTEM_HANDLE_TABLE_ENTRY_INFO
, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO
;
970 typedef struct _SYSTEM_HANDLE_INFORMATION
972 ULONG NumberOfHandles
;
973 SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles
[1];
974 } SYSTEM_HANDLE_INFORMATION
, *PSYSTEM_HANDLE_INFORMATION
;
977 typedef struct _SYSTEM_OBJECTTYPE_INFORMATION
979 ULONG NextEntryOffset
;
980 ULONG NumberOfObjects
;
981 ULONG NumberOfHandles
;
983 ULONG InvalidAttributes
;
984 GENERIC_MAPPING GenericMapping
;
985 ULONG ValidAccessMask
;
987 BOOLEAN SecurityRequired
;
988 BOOLEAN WaitableObject
;
989 UNICODE_STRING TypeName
;
990 } SYSTEM_OBJECTTYPE_INFORMATION
, *PSYSTEM_OBJECTTYPE_INFORMATION
;
992 typedef struct _SYSTEM_OBJECT_INFORMATION
994 ULONG NextEntryOffset
;
996 HANDLE CreatorUniqueProcess
;
997 USHORT CreatorBackTraceIndex
;
1001 ULONG PagedPoolCharge
;
1002 ULONG NonPagedPoolCharge
;
1003 HANDLE ExclusiveProcessId
;
1004 PVOID SecurityDescriptor
;
1005 OBJECT_NAME_INFORMATION NameInfo
;
1006 } SYSTEM_OBJECT_INFORMATION
, *PSYSTEM_OBJECT_INFORMATION
;
1009 typedef struct _SYSTEM_PAGEFILE_INFORMATION
1011 ULONG NextEntryOffset
;
1015 UNICODE_STRING PageFileName
;
1016 } SYSTEM_PAGEFILE_INFORMATION
, *PSYSTEM_PAGEFILE_INFORMATION
;
1019 typedef struct _SYSTEM_VDM_INSTEMUL_INFO
1021 ULONG SegmentNotPresent
;
1023 ULONG OpcodeESPrefix
;
1024 ULONG OpcodeCSPrefix
;
1025 ULONG OpcodeSSPrefix
;
1026 ULONG OpcodeDSPrefix
;
1027 ULONG OpcodeFSPrefix
;
1028 ULONG OpcodeGSPrefix
;
1029 ULONG OpcodeOPER32Prefix
;
1030 ULONG OpcodeADDR32Prefix
;
1042 ULONG OpcodeOUTBimm
;
1043 ULONG OpcodeOUTWimm
;
1048 ULONG OpcodeLOCKPrefix
;
1049 ULONG OpcodeREPNEPrefix
;
1050 ULONG OpcodeREPPrefix
;
1055 } SYSTEM_VDM_INSTEMUL_INFO
, *PSYSTEM_VDM_INSTEMUL_INFO
;
1057 // Class 20 - ULONG VDMBOPINFO
1060 typedef struct _SYSTEM_FILECACHE_INFORMATION
1064 ULONG PageFaultCount
;
1065 ULONG MinimumWorkingSet
;
1066 ULONG MaximumWorkingSet
;
1067 ULONG CurrentSizeIncludingTransitionInPages
;
1068 ULONG PeakSizeIncludingTransitionInPages
;
1069 ULONG TransitionRePurposeCount
;
1071 } SYSTEM_FILECACHE_INFORMATION
, *PSYSTEM_FILECACHE_INFORMATION
;
1074 typedef struct _SYSTEM_POOLTAG
1084 ULONG NonPagedAllocs
;
1085 ULONG NonPagedFrees
;
1087 } SYSTEM_POOLTAG
, *PSYSTEM_POOLTAG
;
1088 typedef struct _SYSTEM_POOLTAG_INFORMATION
1091 SYSTEM_POOLTAG TagInfo
[1];
1092 } SYSTEM_POOLTAG_INFORMATION
, *PSYSTEM_POOLTAG_INFORMATION
;
1095 typedef struct _SYSTEM_INTERRUPT_INFORMATION
1097 ULONG ContextSwitches
;
1100 ULONG TimeIncrement
;
1101 ULONG DpcBypassCount
;
1102 ULONG ApcBypassCount
;
1103 } SYSTEM_INTERRUPT_INFORMATION
, *PSYSTEM_INTERRUPT_INFORMATION
;
1106 typedef struct _SYSTEM_DPC_BEHAVIOR_INFORMATION
1109 ULONG DpcQueueDepth
;
1110 ULONG MinimumDpcRate
;
1111 ULONG AdjustDpcThreshold
;
1113 } SYSTEM_DPC_BEHAVIOR_INFORMATION
, *PSYSTEM_DPC_BEHAVIOR_INFORMATION
;
1116 typedef struct _SYSTEM_MEMORY_INFO
1118 PUCHAR StringOffset
;
1120 USHORT TransitionCount
;
1121 USHORT ModifiedCount
;
1122 USHORT PageTableCount
;
1123 } SYSTEM_MEMORY_INFO
, *PSYSTEM_MEMORY_INFO
;
1125 typedef struct _SYSTEM_MEMORY_INFORMATION
1129 SYSTEM_MEMORY_INFO Memory
[1];
1130 } SYSTEM_MEMORY_INFORMATION
, *PSYSTEM_MEMORY_INFORMATION
;
1133 typedef struct _SYSTEM_GDI_DRIVER_INFORMATION
1135 UNICODE_STRING DriverName
;
1137 PVOID SectionPointer
;
1139 PIMAGE_EXPORT_DIRECTORY ExportSectionPointer
;
1141 } SYSTEM_GDI_DRIVER_INFORMATION
, *PSYSTEM_GDI_DRIVER_INFORMATION
;
1144 // Not an actually class, simply a PVOID to the ImageAddress
1147 typedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION
1149 ULONG TimeAdjustment
;
1150 ULONG TimeIncrement
;
1152 } SYSTEM_QUERY_TIME_ADJUST_INFORMATION
, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION
;
1154 typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION
1156 ULONG TimeAdjustment
;
1158 } SYSTEM_SET_TIME_ADJUST_INFORMATION
, *PSYSTEM_SET_TIME_ADJUST_INFORMATION
;
1160 // Class 29 - Same as 25
1165 typedef struct _SYSTEM_REF_TRACE_INFORMATION
1168 UCHAR TracePermanent
;
1169 UNICODE_STRING TraceProcessName
;
1170 UNICODE_STRING TracePoolTags
;
1171 } SYSTEM_REF_TRACE_INFORMATION
, *PSYSTEM_REF_TRACE_INFORMATION
;
1173 // Class 32 - OBSOLETE
1176 typedef struct _SYSTEM_EXCEPTION_INFORMATION
1178 ULONG AlignmentFixupCount
;
1179 ULONG ExceptionDispatchCount
;
1180 ULONG FloatingEmulationCount
;
1181 ULONG ByteWordEmulationCount
;
1182 } SYSTEM_EXCEPTION_INFORMATION
, *PSYSTEM_EXCEPTION_INFORMATION
;
1185 typedef struct _SYSTEM_CRASH_STATE_INFORMATION
1187 ULONG ValidCrashDump
;
1188 } SYSTEM_CRASH_STATE_INFORMATION
, *PSYSTEM_CRASH_STATE_INFORMATION
;
1191 typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION
1193 BOOLEAN KernelDebuggerEnabled
;
1194 BOOLEAN KernelDebuggerNotPresent
;
1195 } SYSTEM_KERNEL_DEBUGGER_INFORMATION
, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION
;
1198 typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION
1200 ULONG ContextSwitches
;
1209 ULONG PreemptCurrent
;
1212 } SYSTEM_CONTEXT_SWITCH_INFORMATION
, *PSYSTEM_CONTEXT_SWITCH_INFORMATION
;
1215 typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION
1217 ULONG RegistryQuotaAllowed
;
1218 ULONG RegistryQuotaUsed
;
1219 ULONG PagedPoolSize
;
1220 } SYSTEM_REGISTRY_QUOTA_INFORMATION
, *PSYSTEM_REGISTRY_QUOTA_INFORMATION
;
1223 // Not a structure, simply send the UNICODE_STRING
1226 // Not a structure, simply send a ULONG containing the new separation
1229 typedef struct _SYSTEM_PLUGPLAY_BUS_INFORMATION
1232 PLUGPLAY_BUS_INSTANCE BusInstance
[1];
1233 } SYSTEM_PLUGPLAY_BUS_INFORMATION
, *PSYSTEM_PLUGPLAY_BUS_INFORMATION
;
1236 typedef struct _SYSTEM_DOCK_INFORMATION
1238 SYSTEM_DOCK_STATE DockState
;
1239 INTERFACE_TYPE DeviceBusType
;
1240 ULONG DeviceBusNumber
;
1242 } SYSTEM_DOCK_INFORMATION
, *PSYSTEM_DOCK_INFORMATION
;
1245 typedef struct _SYSTEM_POWER_INFORMATION_NATIVE
1247 BOOLEAN SystemSuspendSupported
;
1248 BOOLEAN SystemHibernateSupported
;
1249 BOOLEAN ResumeTimerSupportsSuspend
;
1250 BOOLEAN ResumeTimerSupportsHibernate
;
1251 BOOLEAN LidSupported
;
1252 BOOLEAN TurboSettingSupported
;
1254 BOOLEAN SystemAcOrDc
;
1255 BOOLEAN PowerDownDisabled
;
1256 LARGE_INTEGER SpindownDrives
;
1257 } SYSTEM_POWER_INFORMATION_NATIVE
, *PSYSTEM_POWER_INFORMATION_NATIVE
;
1260 typedef struct _SYSTEM_LEGACY_DRIVER_INFORMATION
1262 PNP_VETO_TYPE VetoType
;
1263 UNICODE_STRING VetoDriver
;
1265 } SYSTEM_LEGACY_DRIVER_INFORMATION
, *PSYSTEM_LEGACY_DRIVER_INFORMATION
;
1268 //typedef struct _TIME_ZONE_INFORMATION RTL_TIME_ZONE_INFORMATION;
1271 typedef struct _SYSTEM_LOOKASIDE_INFORMATION
1273 USHORT CurrentDepth
;
1274 USHORT MaximumDepth
;
1275 ULONG TotalAllocates
;
1276 ULONG AllocateMisses
;
1282 } SYSTEM_LOOKASIDE_INFORMATION
, *PSYSTEM_LOOKASIDE_INFORMATION
;
1285 // Not a structure. Only a HANDLE for the SlipEvent;
1288 // Not a structure. Only a ULONG for the SessionId;
1291 // Not a structure. Only a ULONG for the SessionId;
1296 // Not a structure. Only a ULONG_PTR for the SystemRangeStart
1299 typedef struct _SYSTEM_VERIFIER_INFORMATION
1301 ULONG NextEntryOffset
;
1303 UNICODE_STRING DriverName
;
1305 ULONG AcquireSpinLocks
;
1306 ULONG SynchronizeExecutions
;
1307 ULONG AllocationsAttempted
;
1308 ULONG AllocationsSucceeded
;
1309 ULONG AllocationsSucceededSpecialPool
;
1310 ULONG AllocationsWithNoTag
;
1313 ULONG AllocationsFailed
;
1314 ULONG AllocationsFailedDeliberately
;
1317 ULONG UnTrackedPool
;
1318 ULONG CurrentPagedPoolAllocations
;
1319 ULONG CurrentNonPagedPoolAllocations
;
1320 ULONG PeakPagedPoolAllocations
;
1321 ULONG PeakNonPagedPoolAllocations
;
1322 ULONG PagedPoolUsageInBytes
;
1323 ULONG NonPagedPoolUsageInBytes
;
1324 ULONG PeakPagedPoolUsageInBytes
;
1325 ULONG PeakNonPagedPoolUsageInBytes
;
1326 } SYSTEM_VERIFIER_INFORMATION
, *PSYSTEM_VERIFIER_INFORMATION
;
1331 typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
1335 PVOID Buffer
; // Same format as in SystemProcessInformation
1336 } SYSTEM_SESSION_PROCESS_INFORMATION
, *PSYSTEM_SESSION_PROCESS_INFORMATION
;
1338 // FIXME: Class 54-97
1343 #define RTL_HOTPATCH_SUPPORTED_FLAG 0x01
1344 #define RTL_HOTPATCH_SWAP_OBJECT_NAMES 0x08 << 24
1345 #define RTL_HOTPATCH_SYNC_RENAME_FILES 0x10 << 24
1346 #define RTL_HOTPATCH_PATCH_USER_MODE 0x20 << 24
1347 #define RTL_HOTPATCH_REMAP_SYSTEM_DLL 0x40 << 24
1348 #define RTL_HOTPATCH_PATCH_KERNEL_MODE 0x80 << 24
1352 typedef struct _SYSTEM_HOTPATCH_CODE_INFORMATION
1371 USHORT TargetNameOffset
;
1372 USHORT TargetNameLength
;
1373 UCHAR PatchingFinished
;
1379 USHORT TargetNameOffset
;
1380 USHORT TargetNameLength
;
1381 UCHAR PatchingFinished
;
1382 NTSTATUS ReturnCode
;
1383 HANDLE TargetProcess
;
1388 PIO_STATUS_BLOCK IoStatusBlock1
;
1389 PVOID RenameInformation1
;
1390 PVOID RenameInformationLength1
;
1392 PIO_STATUS_BLOCK IoStatusBlock2
;
1393 PVOID RenameInformation2
;
1394 PVOID RenameInformationLength2
;
1398 HANDLE ParentDirectory
;
1399 HANDLE ObjectHandle1
;
1400 HANDLE ObjectHandle2
;
1403 } SYSTEM_HOTPATCH_CODE_INFORMATION
, *PSYSTEM_HOTPATCH_CODE_INFORMATION
;
1408 #ifdef NTOS_MODE_USER
1409 typedef struct _SYSTEM_FIRMWARE_TABLE_HANDLER
1411 ULONG ProviderSignature
;
1413 PFNFTH FirmwareTableHandler
;
1415 } SYSTEM_FIRMWARE_TABLE_HANDLER
, *PSYSTEM_FIRMWARE_TABLE_HANDLER
;
1420 typedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
1422 ULONG ProviderSignature
;
1423 SYSTEM_FIRMWARE_TABLE_ACTION Action
;
1425 ULONG TableBufferLength
;
1426 UCHAR TableBuffer
[1];
1427 } SYSTEM_FIRMWARE_TABLE_INFORMATION
, *PSYSTEM_FIRMWARE_TABLE_INFORMATION
;