3 Copyright (c) Alex Ionescu. All rights reserved.
11 Type definitions for the Executive.
15 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
27 #if defined(_MSC_VER) && !defined(NTOS_MODE_USER)
39 #define __ALIGNED(n) __attribute__((aligned (n)))
40 #elif defined(_MSC_VER)
41 #define __ALIGNED(n) __declspec(align(n))
43 #error __ALIGNED not defined for your compiler!
47 // Atom and Language IDs
49 typedef USHORT LANGID
, *PLANGID
;
50 typedef USHORT RTL_ATOM
, *PRTL_ATOM
;
52 #ifndef NTOS_MODE_USER
55 // Kernel Exported Object Types
57 extern POBJECT_TYPE NTSYSAPI ExDesktopObjectType
;
58 extern POBJECT_TYPE NTSYSAPI ExWindowStationObjectType
;
59 extern POBJECT_TYPE NTSYSAPI ExIoCompletionType
;
60 extern POBJECT_TYPE NTSYSAPI ExMutantObjectType
;
61 extern POBJECT_TYPE NTSYSAPI ExTimerType
;
64 // Exported NT Build Number
66 extern ULONG NtBuildNumber
;
69 // Invalid Handle Value Constant
71 #define INVALID_HANDLE_VALUE (HANDLE)-1
78 #define MUTANT_INCREMENT 1
81 // Callback Object Access Mask
83 #define CALLBACK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x0001)
84 #define CALLBACK_EXECUTE (STANDARD_RIGHTS_EXECUTE|SYNCHRONIZE|0x0001)
85 #define CALLBACK_WRITE (STANDARD_RIGHTS_WRITE|SYNCHRONIZE|0x0001)
86 #define CALLBACK_READ (STANDARD_RIGHTS_READ|SYNCHRONIZE|0x0001)
89 // Event Object Access Masks
92 #define EVENT_QUERY_STATE 0x0001
95 // Semaphore Object Access Masks
97 #define SEMAPHORE_QUERY_STATE 0x0001
101 // Mutant Object Access Masks
103 #define MUTANT_QUERY_STATE 0x0001
104 #define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
108 #define TIMER_QUERY_STATE 0x0001
109 #define TIMER_MODIFY_STATE 0x0002
110 #define TIMER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
112 TIMER_QUERY_STATE | \
117 // Event Pair Access Masks
119 #define EVENT_PAIR_ALL_ACCESS 0x1F0000L
122 // Profile Object Access Masks
124 #define PROFILE_CONTROL 0x0001
125 #define PROFILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | PROFILE_CONTROL)
128 // Maximum Parameters for NtRaiseHardError
130 #define MAXIMUM_HARDERROR_PARAMETERS 4
135 #define EX_PUSH_LOCK_LOCK_V ((ULONG_PTR)0x0)
136 #define EX_PUSH_LOCK_LOCK ((ULONG_PTR)0x1)
137 #define EX_PUSH_LOCK_WAITING ((ULONG_PTR)0x2)
138 #define EX_PUSH_LOCK_WAKING ((ULONG_PTR)0x4)
139 #define EX_PUSH_LOCK_MULTIPLE_SHARED ((ULONG_PTR)0x8)
140 #define EX_PUSH_LOCK_SHARE_INC ((ULONG_PTR)0x10)
141 #define EX_PUSH_LOCK_PTR_BITS ((ULONG_PTR)0xf)
144 // Pushlock Wait Block Flags
146 #define EX_PUSH_LOCK_FLAGS_EXCLUSIVE 1
147 #define EX_PUSH_LOCK_FLAGS_WAIT 2
150 // Resource (ERESOURCE) Flags
152 #define ResourceHasDisabledPriorityBoost 0x08
155 // Shutdown types for NtShutdownSystem
157 typedef enum _SHUTDOWN_ACTION
165 // Responses for NtRaiseHardError
167 typedef enum _HARDERROR_RESPONSE_OPTION
169 OptionAbortRetryIgnore
,
176 } HARDERROR_RESPONSE_OPTION
, *PHARDERROR_RESPONSE_OPTION
;
178 typedef enum _HARDERROR_RESPONSE
180 ResponseReturnToCaller
,
191 } HARDERROR_RESPONSE
, *PHARDERROR_RESPONSE
;
194 // System Information Classes for NtQuerySystemInformation
196 typedef enum _SYSTEM_INFORMATION_CLASS
198 SystemBasicInformation
,
199 SystemProcessorInformation
,
200 SystemPerformanceInformation
,
201 SystemTimeOfDayInformation
,
202 SystemPathInformation
, /// Obsolete: Use KUSER_SHARED_DATA
203 SystemProcessInformation
,
204 SystemCallCountInformation
,
205 SystemDeviceInformation
,
206 SystemProcessorPerformanceInformation
,
207 SystemFlagsInformation
,
208 SystemCallTimeInformation
,
209 SystemModuleInformation
,
210 SystemLocksInformation
,
211 SystemStackTraceInformation
,
212 SystemPagedPoolInformation
,
213 SystemNonPagedPoolInformation
,
214 SystemHandleInformation
,
215 SystemObjectInformation
,
216 SystemPageFileInformation
,
217 SystemVdmInstemulInformation
,
218 SystemVdmBopInformation
,
219 SystemFileCacheInformation
,
220 SystemPoolTagInformation
,
221 SystemInterruptInformation
,
222 SystemDpcBehaviorInformation
,
223 SystemFullMemoryInformation
,
224 SystemLoadGdiDriverInformation
,
225 SystemUnloadGdiDriverInformation
,
226 SystemTimeAdjustmentInformation
,
227 SystemSummaryMemoryInformation
,
228 SystemMirrorMemoryInformation
,
229 SystemPerformanceTraceInformation
,
231 SystemExceptionInformation
,
232 SystemCrashDumpStateInformation
,
233 SystemKernelDebuggerInformation
,
234 SystemContextSwitchInformation
,
235 SystemRegistryQuotaInformation
,
236 SystemExtendServiceTableInformation
,
237 SystemPrioritySeperation
,
238 SystemPlugPlayBusInformation
,
239 SystemDockInformation
,
240 SystemPowerInformationNative
,
241 SystemProcessorSpeedInformation
,
242 SystemCurrentTimeZoneInformation
,
243 SystemLookasideInformation
,
244 SystemTimeSlipNotification
,
247 SystemSessionInformation
,
248 SystemRangeStartInformation
,
249 SystemVerifierInformation
,
251 SystemSessionProcessesInformation
,
252 SystemLoadGdiDriverInSystemSpaceInformation
,
253 SystemNumaProcessorMap
,
254 SystemPrefetcherInformation
,
255 SystemExtendedProcessInformation
,
256 SystemRecommendedSharedDataAlignment
,
257 SystemComPlusPackage
,
258 SystemNumaAvailableMemory
,
259 SystemProcessorPowerInformation
,
260 SystemEmulationBasicInformation
,
261 SystemEmulationProcessorInformation
,
262 SystemExtendedHanfleInformation
,
263 SystemLostDelayedWriteInformation
,
264 SystemBigPoolInformation
,
265 SystemSessionPoolTagInformation
,
266 SystemSessionMappedViewInformation
,
267 SystemHotpatchInformation
,
268 SystemObjectSecurityMode
,
269 SystemWatchDogTimerHandler
,
270 SystemWatchDogTimerInformation
,
271 SystemLogicalProcessorInformation
,
272 SystemWo64SharedInformationObosolete
,
273 SystemRegisterFirmwareTableInformationHandler
,
274 SystemFirmwareTableInformation
,
275 SystemModuleInformationEx
,
276 SystemVerifierTriageInformation
,
277 SystemSuperfetchInformation
,
278 SystemMemoryListInformation
,
279 SystemFileCacheInformationEx
,
280 SystemThreadPriorityClientIdInformation
,
281 SystemProcessorIdleCycleTimeInformation
,
282 SystemVerifierCancellationInformation
,
283 SystemProcessorPowerInformationEx
,
284 SystemRefTraceInformation
,
285 SystemSpecialPoolInformation
,
286 SystemProcessIdInformation
,
287 SystemErrorPortInformation
,
288 SystemBootEnvironmentInformation
,
289 SystemHypervisorInformation
,
290 SystemVerifierInformationEx
,
291 SystemTimeZoneInformation
,
292 SystemImageFileExecutionOptionsInformation
,
293 SystemCoverageInformation
,
294 SystemPrefetchPathInformation
,
295 SystemVerifierFaultsInformation
,
297 } SYSTEM_INFORMATION_CLASS
;
300 // System Information Classes for NtQueryMutant
302 typedef enum _MUTANT_INFORMATION_CLASS
304 MutantBasicInformation
,
305 MutantOwnerInformation
306 } MUTANT_INFORMATION_CLASS
;
309 // System Information Classes for NtQueryAtom
311 typedef enum _ATOM_INFORMATION_CLASS
313 AtomBasicInformation
,
314 AtomTableInformation
,
315 } ATOM_INFORMATION_CLASS
;
318 // System Information Classes for NtQueryTimer
320 typedef enum _TIMER_INFORMATION_CLASS
322 TimerBasicInformation
323 } TIMER_INFORMATION_CLASS
;
326 // System Information Classes for NtQuerySemaphore
328 typedef enum _SEMAPHORE_INFORMATION_CLASS
330 SemaphoreBasicInformation
331 } SEMAPHORE_INFORMATION_CLASS
;
334 // System Information Classes for NtQueryEvent
336 typedef enum _EVENT_INFORMATION_CLASS
338 EventBasicInformation
339 } EVENT_INFORMATION_CLASS
;
341 #ifdef NTOS_MODE_USER
344 // Firmware Table Actions for SystemFirmwareTableInformation
346 typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION
348 SystemFirmwareTable_Enumerate
= 0,
349 SystemFirmwareTable_Get
= 1,
350 } SYSTEM_FIRMWARE_TABLE_ACTION
, *PSYSTEM_FIRMWARE_TABLE_ACTION
;
353 // Firmware Handler Callback
355 struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
;
359 IN
struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
*FirmwareTableInformation
365 // Handle Enumeration Callback
367 struct _HANDLE_TABLE_ENTRY
;
369 (NTAPI
*PEX_ENUM_HANDLE_CALLBACK
)(
370 IN
struct _HANDLE_TABLE_ENTRY
*HandleTableEntry
,
376 // Compatibility with Windows XP Drivers using ERESOURCE
378 typedef struct _ERESOURCE_XP
380 LIST_ENTRY SystemResourcesList
;
381 POWNER_ENTRY OwnerTable
;
384 PKSEMAPHORE SharedWaiters
;
385 PKEVENT ExclusiveWaiters
;
386 OWNER_ENTRY OwnerThreads
[2];
387 ULONG ContentionCount
;
388 USHORT NumberOfSharedWaiters
;
389 USHORT NumberOfExclusiveWaiters
;
393 ULONG_PTR CreatorBackTraceIndex
;
396 } ERESOURCE_XP
, *PERESOURCE_XP
;
399 // Executive Work Queue Structures
401 typedef struct _EX_QUEUE_WORKER_INFO
403 ULONG QueueDisabled
:1;
404 ULONG MakeThreadsAsNecessary
:1;
406 ULONG WorkerCount
:29;
407 } EX_QUEUE_WORKER_INFO
, *PEX_QUEUE_WORKER_INFO
;
409 typedef struct _EX_WORK_QUEUE
412 LONG DynamicThreadCount
;
413 ULONG WorkItemsProcessed
;
414 ULONG WorkItemsProcessedLastPass
;
415 ULONG QueueDepthLastPass
;
416 EX_QUEUE_WORKER_INFO Info
;
417 } EX_WORK_QUEUE
, *PEX_WORK_QUEUE
;
420 // Executive Fast Reference Structure
422 typedef struct _EX_FAST_REF
430 } EX_FAST_REF
, *PEX_FAST_REF
;
433 // Executive Cache-Aware Rundown Reference Descriptor
435 typedef struct _EX_RUNDOWN_REF_CACHE_AWARE
437 PEX_RUNDOWN_REF RunRefs
;
441 } EX_RUNDOWN_REF_CACHE_AWARE
, *PEX_RUNDOWN_REF_CACHE_AWARE
;
444 // Executive Rundown Wait Block
446 typedef struct _EX_RUNDOWN_WAIT_BLOCK
450 } EX_RUNDOWN_WAIT_BLOCK
, *PEX_RUNDOWN_WAIT_BLOCK
;
453 // Executive Pushlock
457 typedef struct _EX_PUSH_LOCK
466 ULONG_PTR MultipleShared
:1;
467 ULONG_PTR Shared
:sizeof (ULONG_PTR
) * 8 - 4;
472 } EX_PUSH_LOCK
, *PEX_PUSH_LOCK
;
475 // Executive Pushlock Wait Block
477 typedef __ALIGNED(16) struct _EX_PUSH_LOCK_WAIT_BLOCK
484 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Next
;
485 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Last
;
486 struct _EX_PUSH_LOCK_WAIT_BLOCK
*Previous
;
491 EX_PUSH_LOCK NewValue
;
492 EX_PUSH_LOCK OldValue
;
493 PEX_PUSH_LOCK PushLock
;
495 } EX_PUSH_LOCK_WAIT_BLOCK
, *PEX_PUSH_LOCK_WAIT_BLOCK
;
500 typedef struct _CALLBACK_OBJECT
504 LIST_ENTRY RegisteredCallbacks
;
505 BOOLEAN AllowMultipleCallbacks
;
507 } CALLBACK_OBJECT
, *PCALLBACK_OBJECT
;
512 typedef struct _CALLBACK_REGISTRATION
515 PCALLBACK_OBJECT CallbackObject
;
516 PCALLBACK_FUNCTION CallbackFunction
;
517 PVOID CallbackContext
;
519 BOOLEAN UnregisterWaiting
;
520 } CALLBACK_REGISTRATION
, *PCALLBACK_REGISTRATION
;
523 // Internal Callback Object
525 typedef struct _EX_CALLBACK_ROUTINE_BLOCK
527 EX_RUNDOWN_REF RundownProtect
;
528 PEX_CALLBACK_FUNCTION Function
;
530 } EX_CALLBACK_ROUTINE_BLOCK
, *PEX_CALLBACK_ROUTINE_BLOCK
;
533 // Internal Callback Handle
535 typedef struct _EX_CALLBACK
537 EX_FAST_REF RoutineBlock
;
538 } EX_CALLBACK
, *PEX_CALLBACK
;
543 typedef struct _EPROFILE
551 PKPROFILE ProfileObject
;
552 PVOID LockedBufferAddress
;
555 KPROFILE_SOURCE ProfileSource
;
557 } EPROFILE
, *PEPROFILE
;
560 // Handle Table Structures
562 typedef struct _HANDLE_TRACE_DB_ENTRY
567 PVOID StackTrace
[16];
568 } HANDLE_TRACE_DB_ENTRY
, *PHANDLE_TRACE_DB_ENTRY
;
570 typedef struct _HANDLE_TRACE_DEBUG_INFO
575 FAST_MUTEX CloseCompatcionLock
;
576 ULONG CurrentStackIndex
;
577 HANDLE_TRACE_DB_ENTRY TraceDb
[1];
578 } HANDLE_TRACE_DEBUG_INFO
, *PHANDLE_TRACE_DEBUG_INFO
;
580 typedef struct _HANDLE_TABLE_ENTRY_INFO
583 } HANDLE_TABLE_ENTRY_INFO
, *PHANDLE_TABLE_ENTRY_INFO
;
585 typedef struct _HANDLE_TABLE_ENTRY
590 ULONG_PTR ObAttributes
;
591 PHANDLE_TABLE_ENTRY_INFO InfoTable
;
599 USHORT GrantedAccessIndex
;
600 USHORT CreatorBackTraceIndex
;
602 LONG NextFreeTableEntry
;
604 } HANDLE_TABLE_ENTRY
, *PHANDLE_TABLE_ENTRY
;
606 typedef struct _HANDLE_TABLE
608 #if (NTDDI_VERSION >= NTDDI_WINXP)
611 PHANDLE_TABLE_ENTRY
**Table
;
613 PEPROCESS QuotaProcess
;
614 PVOID UniqueProcessId
;
615 #if (NTDDI_VERSION >= NTDDI_WINXP)
616 EX_PUSH_LOCK HandleTableLock
[4];
617 LIST_ENTRY HandleTableList
;
618 EX_PUSH_LOCK HandleContentionEvent
;
620 ERESOURCE HandleLock
;
621 LIST_ENTRY HandleTableList
;
622 KEVENT HandleContentionEvent
;
624 PHANDLE_TRACE_DEBUG_INFO DebugInfo
;
626 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
632 LONG FirstFreeHandle
;
633 PHANDLE_TABLE_ENTRY LastFreeHandleEntry
;
635 ULONG NextHandleNeedingPool
;
639 ULONG NextHandleNeedingPool
;
647 } HANDLE_TABLE
, *PHANDLE_TABLE
;
652 // Hard Error LPC Message
654 typedef struct _HARDERROR_MSG
658 LARGE_INTEGER ErrorTime
;
659 ULONG ValidResponseOptions
;
661 ULONG NumberOfParameters
;
662 ULONG UnicodeStringParameterMask
;
663 ULONG Parameters
[MAXIMUM_HARDERROR_PARAMETERS
];
664 } HARDERROR_MSG
, *PHARDERROR_MSG
;
667 // Information Structures for NtQueryMutant
669 typedef struct _MUTANT_BASIC_INFORMATION
672 BOOLEAN OwnedByCaller
;
673 BOOLEAN AbandonedState
;
674 } MUTANT_BASIC_INFORMATION
, *PMUTANT_BASIC_INFORMATION
;
676 typedef struct _MUTANT_OWNER_INFORMATION
679 } MUTANT_OWNER_INFORMATION
, *PMUTANT_OWNER_INFORMATION
;
682 // Information Structures for NtQueryAtom
684 typedef struct _ATOM_BASIC_INFORMATION
690 } ATOM_BASIC_INFORMATION
, *PATOM_BASIC_INFORMATION
;
692 typedef struct _ATOM_TABLE_INFORMATION
696 } ATOM_TABLE_INFORMATION
, *PATOM_TABLE_INFORMATION
;
699 // Information Structures for NtQueryTimer
701 typedef struct _TIMER_BASIC_INFORMATION
703 LARGE_INTEGER TimeRemaining
;
705 } TIMER_BASIC_INFORMATION
, *PTIMER_BASIC_INFORMATION
;
708 // Information Structures for NtQuerySemaphore
710 typedef struct _SEMAPHORE_BASIC_INFORMATION
714 } SEMAPHORE_BASIC_INFORMATION
, *PSEMAPHORE_BASIC_INFORMATION
;
717 // Information Structures for NtQueryEvent
719 typedef struct _EVENT_BASIC_INFORMATION
721 EVENT_TYPE EventType
;
723 } EVENT_BASIC_INFORMATION
, *PEVENT_BASIC_INFORMATION
;
726 // Information Structures for NtQuerySystemInformation
728 typedef struct _SYSTEM_BASIC_INFORMATION
731 ULONG TimerResolution
;
733 ULONG NumberOfPhysicalPages
;
734 ULONG LowestPhysicalPageNumber
;
735 ULONG HighestPhysicalPageNumber
;
736 ULONG AllocationGranularity
;
737 ULONG MinimumUserModeAddress
;
738 ULONG MaximumUserModeAddress
;
739 KAFFINITY ActiveProcessorsAffinityMask
;
740 CCHAR NumberOfProcessors
;
741 } SYSTEM_BASIC_INFORMATION
, *PSYSTEM_BASIC_INFORMATION
;
744 typedef struct _SYSTEM_PROCESSOR_INFORMATION
746 USHORT ProcessorArchitecture
;
747 USHORT ProcessorLevel
;
748 USHORT ProcessorRevision
;
750 ULONG ProcessorFeatureBits
;
751 } SYSTEM_PROCESSOR_INFORMATION
, *PSYSTEM_PROCESSOR_INFORMATION
;
754 typedef struct _SYSTEM_PERFORMANCE_INFORMATION
756 LARGE_INTEGER IdleProcessTime
;
757 LARGE_INTEGER IoReadTransferCount
;
758 LARGE_INTEGER IoWriteTransferCount
;
759 LARGE_INTEGER IoOtherTransferCount
;
760 ULONG IoReadOperationCount
;
761 ULONG IoWriteOperationCount
;
762 ULONG IoOtherOperationCount
;
763 ULONG AvailablePages
;
764 ULONG CommittedPages
;
766 ULONG PeakCommitment
;
767 ULONG PageFaultCount
;
768 ULONG CopyOnWriteCount
;
769 ULONG TransitionCount
;
770 ULONG CacheTransitionCount
;
771 ULONG DemandZeroCount
;
773 ULONG PageReadIoCount
;
774 ULONG CacheReadCount
;
776 ULONG DirtyPagesWriteCount
;
777 ULONG DirtyWriteIoCount
;
778 ULONG MappedPagesWriteCount
;
779 ULONG MappedWriteIoCount
;
780 ULONG PagedPoolPages
;
781 ULONG NonPagedPoolPages
;
782 ULONG PagedPoolAllocs
;
783 ULONG PagedPoolFrees
;
784 ULONG NonPagedPoolAllocs
;
785 ULONG NonPagedPoolFrees
;
786 ULONG FreeSystemPtes
;
787 ULONG ResidentSystemCodePage
;
788 ULONG TotalSystemDriverPages
;
789 ULONG TotalSystemCodePages
;
790 ULONG NonPagedPoolLookasideHits
;
791 ULONG PagedPoolLookasideHits
;
793 ULONG ResidentSystemCachePage
;
794 ULONG ResidentPagedPoolPage
;
795 ULONG ResidentSystemDriverPage
;
796 ULONG CcFastReadNoWait
;
797 ULONG CcFastReadWait
;
798 ULONG CcFastReadResourceMiss
;
799 ULONG CcFastReadNotPossible
;
800 ULONG CcFastMdlReadNoWait
;
801 ULONG CcFastMdlReadWait
;
802 ULONG CcFastMdlReadResourceMiss
;
803 ULONG CcFastMdlReadNotPossible
;
804 ULONG CcMapDataNoWait
;
806 ULONG CcMapDataNoWaitMiss
;
807 ULONG CcMapDataWaitMiss
;
808 ULONG CcPinMappedDataCount
;
809 ULONG CcPinReadNoWait
;
811 ULONG CcPinReadNoWaitMiss
;
812 ULONG CcPinReadWaitMiss
;
813 ULONG CcCopyReadNoWait
;
814 ULONG CcCopyReadWait
;
815 ULONG CcCopyReadNoWaitMiss
;
816 ULONG CcCopyReadWaitMiss
;
817 ULONG CcMdlReadNoWait
;
819 ULONG CcMdlReadNoWaitMiss
;
820 ULONG CcMdlReadWaitMiss
;
821 ULONG CcReadAheadIos
;
822 ULONG CcLazyWriteIos
;
823 ULONG CcLazyWritePages
;
826 ULONG ContextSwitches
;
827 ULONG FirstLevelTbFills
;
828 ULONG SecondLevelTbFills
;
830 } SYSTEM_PERFORMANCE_INFORMATION
, *PSYSTEM_PERFORMANCE_INFORMATION
;
833 typedef struct _SYSTEM_TIMEOFDAY_INFORMATION
835 LARGE_INTEGER BootTime
;
836 LARGE_INTEGER CurrentTime
;
837 LARGE_INTEGER TimeZoneBias
;
840 } SYSTEM_TIMEOFDAY_INFORMATION
, *PSYSTEM_TIMEOFDAY_INFORMATION
;
843 // This class is obsolete, please use KUSER_SHARED_DATA instead
846 typedef struct _SYSTEM_THREAD_INFORMATION
848 LARGE_INTEGER KernelTime
;
849 LARGE_INTEGER UserTime
;
850 LARGE_INTEGER CreateTime
;
856 ULONG ContextSwitches
;
859 } SYSTEM_THREAD_INFORMATION
, *PSYSTEM_THREAD_INFORMATION
;
861 typedef struct _SYSTEM_PROCESS_INFORMATION
863 ULONG NextEntryOffset
;
864 ULONG NumberOfThreads
;
865 LARGE_INTEGER SpareLi1
;
866 LARGE_INTEGER SpareLi2
;
867 LARGE_INTEGER SpareLi3
;
868 LARGE_INTEGER CreateTime
;
869 LARGE_INTEGER UserTime
;
870 LARGE_INTEGER KernelTime
;
871 UNICODE_STRING ImageName
;
872 KPRIORITY BasePriority
;
873 HANDLE UniqueProcessId
;
874 HANDLE InheritedFromUniqueProcessId
;
877 ULONG UniqueProcessKey
;
880 // This part corresponds to VM_COUNTERS_EX.
881 // NOTE: *NOT* THE SAME AS VM_COUNTERS!
883 ULONG PeakVirtualSize
;
885 ULONG PageFaultCount
;
886 ULONG PeakWorkingSetSize
;
887 ULONG WorkingSetSize
;
888 ULONG QuotaPeakPagedPoolUsage
;
889 ULONG QuotaPagedPoolUsage
;
890 ULONG QuotaPeakNonPagedPoolUsage
;
891 ULONG QuotaNonPagedPoolUsage
;
893 ULONG PeakPagefileUsage
;
894 ULONG PrivatePageCount
;
897 // This part corresponds to IO_COUNTERS
899 LARGE_INTEGER ReadOperationCount
;
900 LARGE_INTEGER WriteOperationCount
;
901 LARGE_INTEGER OtherOperationCount
;
902 LARGE_INTEGER ReadTransferCount
;
903 LARGE_INTEGER WriteTransferCount
;
904 LARGE_INTEGER OtherTransferCount
;
906 //SYSTEM_THREAD_INFORMATION TH[1];
907 } SYSTEM_PROCESS_INFORMATION
, *PSYSTEM_PROCESS_INFORMATION
;
910 typedef struct _SYSTEM_CALL_COUNT_INFORMATION
913 ULONG NumberOfTables
;
914 } SYSTEM_CALL_COUNT_INFORMATION
, *PSYSTEM_CALL_COUNT_INFORMATION
;
917 typedef struct _SYSTEM_DEVICE_INFORMATION
920 ULONG NumberOfFloppies
;
921 ULONG NumberOfCdRoms
;
923 ULONG NumberOfSerialPorts
;
924 ULONG NumberOfParallelPorts
;
925 } SYSTEM_DEVICE_INFORMATION
, *PSYSTEM_DEVICE_INFORMATION
;
928 typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
930 LARGE_INTEGER IdleTime
;
931 LARGE_INTEGER KernelTime
;
932 LARGE_INTEGER UserTime
;
933 LARGE_INTEGER DpcTime
;
934 LARGE_INTEGER InterruptTime
;
935 ULONG InterruptCount
;
936 } SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
;
939 typedef struct _SYSTEM_FLAGS_INFORMATION
942 } SYSTEM_FLAGS_INFORMATION
, *PSYSTEM_FLAGS_INFORMATION
;
945 typedef struct _SYSTEM_CALL_TIME_INFORMATION
949 LARGE_INTEGER TimeOfCalls
[1];
950 } SYSTEM_CALL_TIME_INFORMATION
, *PSYSTEM_CALL_TIME_INFORMATION
;
952 // Class 11 - See RTL_PROCESS_MODULES
954 // Class 12 - See RTL_PROCESS_LOCKS
956 // Class 13 - See RTL_PROCESS_BACKTRACES
959 typedef struct _SYSTEM_POOL_ENTRY
963 USHORT AllocatorBackTraceIndex
;
969 PVOID ProcessChargedQuota
;
971 } SYSTEM_POOL_ENTRY
, *PSYSTEM_POOL_ENTRY
;
973 typedef struct _SYSTEM_POOL_INFORMATION
977 USHORT EntryOverhead
;
978 BOOLEAN PoolTagPresent
;
980 ULONG NumberOfEntries
;
981 SYSTEM_POOL_ENTRY Entries
[1];
982 } SYSTEM_POOL_INFORMATION
, *PSYSTEM_POOL_INFORMATION
;
985 typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
987 USHORT UniqueProcessId
;
988 USHORT CreatorBackTraceIndex
;
989 UCHAR ObjectTypeIndex
;
990 UCHAR HandleAttributes
;
994 } SYSTEM_HANDLE_TABLE_ENTRY_INFO
, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO
;
996 typedef struct _SYSTEM_HANDLE_INFORMATION
998 ULONG NumberOfHandles
;
999 SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles
[1];
1000 } SYSTEM_HANDLE_INFORMATION
, *PSYSTEM_HANDLE_INFORMATION
;
1003 typedef struct _SYSTEM_OBJECTTYPE_INFORMATION
1005 ULONG NextEntryOffset
;
1006 ULONG NumberOfObjects
;
1007 ULONG NumberOfHandles
;
1009 ULONG InvalidAttributes
;
1010 GENERIC_MAPPING GenericMapping
;
1011 ULONG ValidAccessMask
;
1013 BOOLEAN SecurityRequired
;
1014 BOOLEAN WaitableObject
;
1015 UNICODE_STRING TypeName
;
1016 } SYSTEM_OBJECTTYPE_INFORMATION
, *PSYSTEM_OBJECTTYPE_INFORMATION
;
1018 typedef struct _SYSTEM_OBJECT_INFORMATION
1020 ULONG NextEntryOffset
;
1022 HANDLE CreatorUniqueProcess
;
1023 USHORT CreatorBackTraceIndex
;
1027 ULONG PagedPoolCharge
;
1028 ULONG NonPagedPoolCharge
;
1029 HANDLE ExclusiveProcessId
;
1030 PVOID SecurityDescriptor
;
1031 OBJECT_NAME_INFORMATION NameInfo
;
1032 } SYSTEM_OBJECT_INFORMATION
, *PSYSTEM_OBJECT_INFORMATION
;
1035 typedef struct _SYSTEM_PAGEFILE_INFORMATION
1037 ULONG NextEntryOffset
;
1041 UNICODE_STRING PageFileName
;
1042 } SYSTEM_PAGEFILE_INFORMATION
, *PSYSTEM_PAGEFILE_INFORMATION
;
1045 typedef struct _SYSTEM_VDM_INSTEMUL_INFO
1047 ULONG SegmentNotPresent
;
1049 ULONG OpcodeESPrefix
;
1050 ULONG OpcodeCSPrefix
;
1051 ULONG OpcodeSSPrefix
;
1052 ULONG OpcodeDSPrefix
;
1053 ULONG OpcodeFSPrefix
;
1054 ULONG OpcodeGSPrefix
;
1055 ULONG OpcodeOPER32Prefix
;
1056 ULONG OpcodeADDR32Prefix
;
1068 ULONG OpcodeOUTBimm
;
1069 ULONG OpcodeOUTWimm
;
1074 ULONG OpcodeLOCKPrefix
;
1075 ULONG OpcodeREPNEPrefix
;
1076 ULONG OpcodeREPPrefix
;
1081 } SYSTEM_VDM_INSTEMUL_INFO
, *PSYSTEM_VDM_INSTEMUL_INFO
;
1083 // Class 20 - ULONG VDMBOPINFO
1086 typedef struct _SYSTEM_FILECACHE_INFORMATION
1090 ULONG PageFaultCount
;
1091 ULONG MinimumWorkingSet
;
1092 ULONG MaximumWorkingSet
;
1093 ULONG CurrentSizeIncludingTransitionInPages
;
1094 ULONG PeakSizeIncludingTransitionInPages
;
1095 ULONG TransitionRePurposeCount
;
1097 } SYSTEM_FILECACHE_INFORMATION
, *PSYSTEM_FILECACHE_INFORMATION
;
1100 typedef struct _SYSTEM_POOLTAG
1110 ULONG NonPagedAllocs
;
1111 ULONG NonPagedFrees
;
1113 } SYSTEM_POOLTAG
, *PSYSTEM_POOLTAG
;
1114 typedef struct _SYSTEM_POOLTAG_INFORMATION
1117 SYSTEM_POOLTAG TagInfo
[1];
1118 } SYSTEM_POOLTAG_INFORMATION
, *PSYSTEM_POOLTAG_INFORMATION
;
1121 typedef struct _SYSTEM_INTERRUPT_INFORMATION
1123 ULONG ContextSwitches
;
1126 ULONG TimeIncrement
;
1127 ULONG DpcBypassCount
;
1128 ULONG ApcBypassCount
;
1129 } SYSTEM_INTERRUPT_INFORMATION
, *PSYSTEM_INTERRUPT_INFORMATION
;
1132 typedef struct _SYSTEM_DPC_BEHAVIOR_INFORMATION
1135 ULONG DpcQueueDepth
;
1136 ULONG MinimumDpcRate
;
1137 ULONG AdjustDpcThreshold
;
1139 } SYSTEM_DPC_BEHAVIOR_INFORMATION
, *PSYSTEM_DPC_BEHAVIOR_INFORMATION
;
1142 typedef struct _SYSTEM_MEMORY_INFO
1144 PUCHAR StringOffset
;
1146 USHORT TransitionCount
;
1147 USHORT ModifiedCount
;
1148 USHORT PageTableCount
;
1149 } SYSTEM_MEMORY_INFO
, *PSYSTEM_MEMORY_INFO
;
1151 typedef struct _SYSTEM_MEMORY_INFORMATION
1155 SYSTEM_MEMORY_INFO Memory
[1];
1156 } SYSTEM_MEMORY_INFORMATION
, *PSYSTEM_MEMORY_INFORMATION
;
1159 typedef struct _SYSTEM_GDI_DRIVER_INFORMATION
1161 UNICODE_STRING DriverName
;
1163 PVOID SectionPointer
;
1165 PIMAGE_EXPORT_DIRECTORY ExportSectionPointer
;
1167 } SYSTEM_GDI_DRIVER_INFORMATION
, *PSYSTEM_GDI_DRIVER_INFORMATION
;
1170 // Not an actually class, simply a PVOID to the ImageAddress
1173 typedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION
1175 ULONG TimeAdjustment
;
1176 ULONG TimeIncrement
;
1178 } SYSTEM_QUERY_TIME_ADJUST_INFORMATION
, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION
;
1180 typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION
1182 ULONG TimeAdjustment
;
1184 } SYSTEM_SET_TIME_ADJUST_INFORMATION
, *PSYSTEM_SET_TIME_ADJUST_INFORMATION
;
1186 // Class 29 - Same as 25
1191 typedef struct _SYSTEM_REF_TRACE_INFORMATION
1194 UCHAR TracePermanent
;
1195 UNICODE_STRING TraceProcessName
;
1196 UNICODE_STRING TracePoolTags
;
1197 } SYSTEM_REF_TRACE_INFORMATION
, *PSYSTEM_REF_TRACE_INFORMATION
;
1199 // Class 32 - OBSOLETE
1202 typedef struct _SYSTEM_EXCEPTION_INFORMATION
1204 ULONG AlignmentFixupCount
;
1205 ULONG ExceptionDispatchCount
;
1206 ULONG FloatingEmulationCount
;
1207 ULONG ByteWordEmulationCount
;
1208 } SYSTEM_EXCEPTION_INFORMATION
, *PSYSTEM_EXCEPTION_INFORMATION
;
1211 typedef struct _SYSTEM_CRASH_STATE_INFORMATION
1213 ULONG ValidCrashDump
;
1214 } SYSTEM_CRASH_STATE_INFORMATION
, *PSYSTEM_CRASH_STATE_INFORMATION
;
1217 typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION
1219 BOOLEAN KernelDebuggerEnabled
;
1220 BOOLEAN KernelDebuggerNotPresent
;
1221 } SYSTEM_KERNEL_DEBUGGER_INFORMATION
, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION
;
1224 typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION
1226 ULONG ContextSwitches
;
1235 ULONG PreemptCurrent
;
1238 } SYSTEM_CONTEXT_SWITCH_INFORMATION
, *PSYSTEM_CONTEXT_SWITCH_INFORMATION
;
1241 typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION
1243 ULONG RegistryQuotaAllowed
;
1244 ULONG RegistryQuotaUsed
;
1245 ULONG PagedPoolSize
;
1246 } SYSTEM_REGISTRY_QUOTA_INFORMATION
, *PSYSTEM_REGISTRY_QUOTA_INFORMATION
;
1249 // Not a structure, simply send the UNICODE_STRING
1252 // Not a structure, simply send a ULONG containing the new separation
1255 typedef struct _SYSTEM_PLUGPLAY_BUS_INFORMATION
1258 PLUGPLAY_BUS_INSTANCE BusInstance
[1];
1259 } SYSTEM_PLUGPLAY_BUS_INFORMATION
, *PSYSTEM_PLUGPLAY_BUS_INFORMATION
;
1262 typedef struct _SYSTEM_DOCK_INFORMATION
1264 SYSTEM_DOCK_STATE DockState
;
1265 INTERFACE_TYPE DeviceBusType
;
1266 ULONG DeviceBusNumber
;
1268 } SYSTEM_DOCK_INFORMATION
, *PSYSTEM_DOCK_INFORMATION
;
1271 typedef struct _SYSTEM_POWER_INFORMATION_NATIVE
1273 BOOLEAN SystemSuspendSupported
;
1274 BOOLEAN SystemHibernateSupported
;
1275 BOOLEAN ResumeTimerSupportsSuspend
;
1276 BOOLEAN ResumeTimerSupportsHibernate
;
1277 BOOLEAN LidSupported
;
1278 BOOLEAN TurboSettingSupported
;
1280 BOOLEAN SystemAcOrDc
;
1281 BOOLEAN PowerDownDisabled
;
1282 LARGE_INTEGER SpindownDrives
;
1283 } SYSTEM_POWER_INFORMATION_NATIVE
, *PSYSTEM_POWER_INFORMATION_NATIVE
;
1286 typedef struct _SYSTEM_LEGACY_DRIVER_INFORMATION
1288 PNP_VETO_TYPE VetoType
;
1289 UNICODE_STRING VetoDriver
;
1291 } SYSTEM_LEGACY_DRIVER_INFORMATION
, *PSYSTEM_LEGACY_DRIVER_INFORMATION
;
1294 //typedef struct _TIME_ZONE_INFORMATION RTL_TIME_ZONE_INFORMATION;
1297 typedef struct _SYSTEM_LOOKASIDE_INFORMATION
1299 USHORT CurrentDepth
;
1300 USHORT MaximumDepth
;
1301 ULONG TotalAllocates
;
1302 ULONG AllocateMisses
;
1308 } SYSTEM_LOOKASIDE_INFORMATION
, *PSYSTEM_LOOKASIDE_INFORMATION
;
1311 // Not a structure. Only a HANDLE for the SlipEvent;
1314 // Not a structure. Only a ULONG for the SessionId;
1317 // Not a structure. Only a ULONG for the SessionId;
1322 // Not a structure. Only a ULONG_PTR for the SystemRangeStart
1325 typedef struct _SYSTEM_VERIFIER_INFORMATION
1327 ULONG NextEntryOffset
;
1329 UNICODE_STRING DriverName
;
1331 ULONG AcquireSpinLocks
;
1332 ULONG SynchronizeExecutions
;
1333 ULONG AllocationsAttempted
;
1334 ULONG AllocationsSucceeded
;
1335 ULONG AllocationsSucceededSpecialPool
;
1336 ULONG AllocationsWithNoTag
;
1339 ULONG AllocationsFailed
;
1340 ULONG AllocationsFailedDeliberately
;
1343 ULONG UnTrackedPool
;
1344 ULONG CurrentPagedPoolAllocations
;
1345 ULONG CurrentNonPagedPoolAllocations
;
1346 ULONG PeakPagedPoolAllocations
;
1347 ULONG PeakNonPagedPoolAllocations
;
1348 ULONG PagedPoolUsageInBytes
;
1349 ULONG NonPagedPoolUsageInBytes
;
1350 ULONG PeakPagedPoolUsageInBytes
;
1351 ULONG PeakNonPagedPoolUsageInBytes
;
1352 } SYSTEM_VERIFIER_INFORMATION
, *PSYSTEM_VERIFIER_INFORMATION
;
1357 typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
1361 PVOID Buffer
; // Same format as in SystemProcessInformation
1362 } SYSTEM_SESSION_PROCESS_INFORMATION
, *PSYSTEM_SESSION_PROCESS_INFORMATION
;
1364 // FIXME: Class 54-97
1369 #define RTL_HOTPATCH_SUPPORTED_FLAG 0x01
1370 #define RTL_HOTPATCH_SWAP_OBJECT_NAMES 0x08 << 24
1371 #define RTL_HOTPATCH_SYNC_RENAME_FILES 0x10 << 24
1372 #define RTL_HOTPATCH_PATCH_USER_MODE 0x20 << 24
1373 #define RTL_HOTPATCH_REMAP_SYSTEM_DLL 0x40 << 24
1374 #define RTL_HOTPATCH_PATCH_KERNEL_MODE 0x80 << 24
1378 typedef struct _SYSTEM_HOTPATCH_CODE_INFORMATION
1397 USHORT TargetNameOffset
;
1398 USHORT TargetNameLength
;
1399 UCHAR PatchingFinished
;
1405 USHORT TargetNameOffset
;
1406 USHORT TargetNameLength
;
1407 UCHAR PatchingFinished
;
1408 NTSTATUS ReturnCode
;
1409 HANDLE TargetProcess
;
1414 PIO_STATUS_BLOCK IoStatusBlock1
;
1415 PVOID RenameInformation1
;
1416 PVOID RenameInformationLength1
;
1418 PIO_STATUS_BLOCK IoStatusBlock2
;
1419 PVOID RenameInformation2
;
1420 PVOID RenameInformationLength2
;
1424 HANDLE ParentDirectory
;
1425 HANDLE ObjectHandle1
;
1426 HANDLE ObjectHandle2
;
1429 } SYSTEM_HOTPATCH_CODE_INFORMATION
, *PSYSTEM_HOTPATCH_CODE_INFORMATION
;
1434 #ifdef NTOS_MODE_USER
1435 typedef struct _SYSTEM_FIRMWARE_TABLE_HANDLER
1437 ULONG ProviderSignature
;
1439 PFNFTH FirmwareTableHandler
;
1441 } SYSTEM_FIRMWARE_TABLE_HANDLER
, *PSYSTEM_FIRMWARE_TABLE_HANDLER
;
1446 typedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
1448 ULONG ProviderSignature
;
1449 SYSTEM_FIRMWARE_TABLE_ACTION Action
;
1451 ULONG TableBufferLength
;
1452 UCHAR TableBuffer
[1];
1453 } SYSTEM_FIRMWARE_TABLE_INFORMATION
, *PSYSTEM_FIRMWARE_TABLE_INFORMATION
;