reactos/include/ndk/pstypes.h

   1 /*++ NDK Version: 0098
   2
   3 Copyright (c) Alex Ionescu.  All rights reserved.
   4
   5 Header Name:
   6
   7     pstypes.h
   8
   9 Abstract:
  10
  11     Type definitions for the Process Manager
  12
  13 Author:
  14
  15     Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
  16
  17 --*/
  18
  19 #ifndef _PSTYPES_H
  20 #define _PSTYPES_H
  21
  22 //
  23 // Dependencies
  24 //
  25 #include <umtypes.h>
  26 #include <ldrtypes.h>
  27 #include <mmtypes.h>
  28 #include <obtypes.h>
  29 #ifndef NTOS_MODE_USER
  30 #include <extypes.h>
  31 #include <setypes.h>
  32 #endif
  33
  34 //
  35 // KUSER_SHARED_DATA location in User Mode
  36 //
  37 #define USER_SHARED_DATA                        (0x7FFE0000)
  38
  39 //
  40 // Global Flags
  41 //
  42 #define FLG_STOP_ON_EXCEPTION                   0x00000001
  43 #define FLG_SHOW_LDR_SNAPS                      0x00000002
  44 #define FLG_DEBUG_INITIAL_COMMAND               0x00000004
  45 #define FLG_STOP_ON_HUNG_GUI                    0x00000008
  46 #define FLG_HEAP_ENABLE_TAIL_CHECK              0x00000010
  47 #define FLG_HEAP_ENABLE_FREE_CHECK              0x00000020
  48 #define FLG_HEAP_VALIDATE_PARAMETERS            0x00000040
  49 #define FLG_HEAP_VALIDATE_ALL                   0x00000080
  50 #define FLG_POOL_ENABLE_TAIL_CHECK              0x00000100
  51 #define FLG_POOL_ENABLE_FREE_CHECK              0x00000200
  52 #define FLG_POOL_ENABLE_TAGGING                 0x00000400
  53 #define FLG_HEAP_ENABLE_TAGGING                 0x00000800
  54 #define FLG_USER_STACK_TRACE_DB                 0x00001000
  55 #define FLG_KERNEL_STACK_TRACE_DB               0x00002000
  56 #define FLG_MAINTAIN_OBJECT_TYPELIST            0x00004000
  57 #define FLG_HEAP_ENABLE_TAG_BY_DLL              0x00008000
  58 #define FLG_IGNORE_DEBUG_PRIV                   0x00010000
  59 #define FLG_ENABLE_CSRDEBUG                     0x00020000
  60 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD           0x00040000
  61 #define FLG_DISABLE_PAGE_KERNEL_STACKS          0x00080000
  62 #define FLG_HEAP_ENABLE_CALL_TRACING            0x00100000
  63 #define FLG_HEAP_DISABLE_COALESCING             0x00200000
  64 #define FLG_ENABLE_CLOSE_EXCEPTIONS             0x00400000
  65 #define FLG_ENABLE_EXCEPTION_LOGGING            0x00800000
  66 #define FLG_ENABLE_HANDLE_TYPE_TAGGING          0x01000000
  67 #define FLG_HEAP_PAGE_ALLOCS                    0x02000000
  68 #define FLG_DEBUG_INITIAL_COMMAND_EX            0x04000000
  69 #define FLG_VALID_BITS                          0x07FFFFFF
  70
  71 //
  72 // Process priority classes
  73 //
  74 #define PROCESS_PRIORITY_CLASS_INVALID          0
  75 #define PROCESS_PRIORITY_CLASS_IDLE             1
  76 #define PROCESS_PRIORITY_CLASS_NORMAL           2
  77 #define PROCESS_PRIORITY_CLASS_HIGH             3
  78 #define PROCESS_PRIORITY_CLASS_REALTIME         4
  79 #define PROCESS_PRIORITY_CLASS_BELOW_NORMAL     5
  80 #define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL     6
  81
  82 //
  83 // NtCreateProcessEx flags
  84 //
  85 #define PS_REQUEST_BREAKAWAY                    1
  86 #define PS_NO_DEBUG_INHERIT                     2
  87 #define PS_INHERIT_HANDLES                      4
  88 #define PS_LARGE_PAGES                          8
  89 #define PS_ALL_FLAGS                            (PS_REQUEST_BREAKAWAY | \
  90                                                  PS_NO_DEBUG_INHERIT  | \
  91                                                  PS_INHERIT_HANDLES   | \
  92                                                  PS_LARGE_PAGES)
  93
  94 //
  95 // Process base priorities
  96 //
  97 #define PROCESS_PRIORITY_IDLE                   3
  98 #define PROCESS_PRIORITY_NORMAL                 8
  99 #define PROCESS_PRIORITY_NORMAL_FOREGROUND      9
 100
 101 //
 102 // Process memory priorities
 103 //
 104 #define MEMORY_PRIORITY_BACKGROUND             0
 105 #define MEMORY_PRIORITY_UNKNOWN                1
 106 #define MEMORY_PRIORITY_FOREGROUND             2
 107
 108 //
 109 // Process Priority Separation Values (OR)
 110 //
 111 #define PSP_VARIABLE_QUANTUMS                   4
 112 #define PSP_LONG_QUANTUMS                       16
 113
 114 #ifndef NTOS_MODE_USER
 115
 116 //
 117 // Thread Access Types
 118 //
 119 #define THREAD_QUERY_INFORMATION                0x0040
 120 #define THREAD_SET_THREAD_TOKEN                 0x0080
 121 #define THREAD_IMPERSONATE                      0x0100
 122 #define THREAD_DIRECT_IMPERSONATION             0x0200
 123
 124 //
 125 // Process Access Types
 126 //
 127 #define PROCESS_TERMINATE                       0x0001
 128 #define PROCESS_CREATE_THREAD                   0x0002
 129 #define PROCESS_SET_SESSIONID                   0x0004
 130 #define PROCESS_VM_OPERATION                    0x0008
 131 #define PROCESS_VM_READ                         0x0010
 132 #define PROCESS_VM_WRITE                        0x0020
 133 #define PROCESS_CREATE_PROCESS                  0x0080
 134 #define PROCESS_SET_QUOTA                       0x0100
 135 #define PROCESS_SET_INFORMATION                 0x0200
 136 #define PROCESS_QUERY_INFORMATION               0x0400
 137 #define PROCESS_SUSPEND_RESUME                  0x0800
 138 #define PROCESS_QUERY_LIMITED_INFORMATION       0x1000
 139 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 140 #define PROCESS_ALL_ACCESS                      (STANDARD_RIGHTS_REQUIRED | \
 141                                                  SYNCHRONIZE | \
 142                                                  0xFFFF)
 143 #else
 144 #define PROCESS_ALL_ACCESS                      (STANDARD_RIGHTS_REQUIRED | \
 145                                                  SYNCHRONIZE | \
 146                                                  0xFFF)
 147
 148 //
 149 // Thread Base Priorities
 150 //
 151 #define THREAD_BASE_PRIORITY_LOWRT              15
 152 #define THREAD_BASE_PRIORITY_MAX                2
 153 #define THREAD_BASE_PRIORITY_MIN                -2
 154 #define THREAD_BASE_PRIORITY_IDLE               -15
 155
 156 //
 157 // TLS Slots
 158 //
 159 #define TLS_MINIMUM_AVAILABLE                   64
 160 #endif
 161
 162 //
 163 // Job Access Types
 164 //
 165 #define JOB_OBJECT_ASSIGN_PROCESS               0x1
 166 #define JOB_OBJECT_SET_ATTRIBUTES               0x2
 167 #define JOB_OBJECT_QUERY                        0x4
 168 #define JOB_OBJECT_TERMINATE                    0x8
 169 #define JOB_OBJECT_SET_SECURITY_ATTRIBUTES      0x10
 170 #define JOB_OBJECT_ALL_ACCESS                   (STANDARD_RIGHTS_REQUIRED | \
 171                                                  SYNCHRONIZE | \
 172                                                  31)
 173
 174 //
 175 // Job Limit Flags
 176 //
 177 #define JOB_OBJECT_LIMIT_WORKINGSET             0x1
 178 #define JOB_OBJECT_LIMIT_PROCESS_TIME           0x2
 179 #define JOB_OBJECT_LIMIT_JOB_TIME               0x4
 180 #define JOB_OBJECT_LIMIT_ACTIVE_PROCESS         0x8
 181 #define JOB_OBJECT_LIMIT_AFFINITY               0x10
 182 #define JOB_OBJECT_LIMIT_PRIORITY_CLASS         0x20
 183 #define JOB_OBJECT_LIMIT_PRESERVE_JOB_TIME      0x40
 184 #define JOB_OBJECT_LIMIT_SCHEDULING_CLASS       0x80
 185 #define JOB_OBJECT_LIMIT_PROCESS_MEMORY         0x100
 186 #define JOB_OBJECT_LIMIT_JOB_MEMORY             0x200
 187 #define JOB_OBJECT_LIMIT_DIE_ON_UNHANDLED_EXCEPTION 0x400
 188 #define JOB_OBJECT_LIMIT_BREAKAWAY_OK           0x800
 189 #define JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK    0x1000
 190 #define JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE      0x2000
 191
 192
 193 //
 194 // Cross Thread Flags
 195 //
 196 #define CT_TERMINATED_BIT                       0x1
 197 #define CT_DEAD_THREAD_BIT                      0x2
 198 #define CT_HIDE_FROM_DEBUGGER_BIT               0x4
 199 #define CT_ACTIVE_IMPERSONATION_INFO_BIT        0x8
 200 #define CT_SYSTEM_THREAD_BIT                    0x10
 201 #define CT_HARD_ERRORS_ARE_DISABLED_BIT         0x20
 202 #define CT_BREAK_ON_TERMINATION_BIT             0x40
 203 #define CT_SKIP_CREATION_MSG_BIT                0x80
 204 #define CT_SKIP_TERMINATION_MSG_BIT             0x100
 205
 206 //
 207 // Same Thread Passive Flags
 208 //
 209 #define STP_ACTIVE_EX_WORKER_BIT                0x1
 210 #define STP_EX_WORKER_CAN_WAIT_USER_BIT         0x2
 211 #define STP_MEMORY_MAKER_BIT                    0x4
 212 #define STP_KEYED_EVENT_IN_USE_BIT              0x8
 213
 214 //
 215 // Same Thread APC Flags
 216 //
 217 #define STA_LPC_RECEIVED_MSG_ID_VALID_BIT       0x1
 218 #define STA_LPC_EXIT_THREAD_CALLED_BIT          0x2
 219 #define STA_ADDRESS_SPACE_OWNER_BIT             0x4
 220 #define STA_OWNS_WORKING_SET_BITS               0x1F8
 221 #endif
 222
 223 #define TLS_EXPANSION_SLOTS                     1024
 224 //
 225 // Process Flags
 226 //
 227 #define PSF_CREATE_REPORTED_BIT                 0x1
 228 #define PSF_NO_DEBUG_INHERIT_BIT                0x2
 229 #define PSF_PROCESS_EXITING_BIT                 0x4
 230 #define PSF_PROCESS_DELETE_BIT                  0x8
 231 #define PSF_WOW64_SPLIT_PAGES_BIT               0x10
 232 #define PSF_VM_DELETED_BIT                      0x20
 233 #define PSF_OUTSWAP_ENABLED_BIT                 0x40
 234 #define PSF_OUTSWAPPED_BIT                      0x80
 235 #define PSF_FORK_FAILED_BIT                     0x100
 236 #define PSF_WOW64_VA_SPACE_4GB_BIT              0x200
 237 #define PSF_ADDRESS_SPACE_INITIALIZED_BIT       0x400
 238 #define PSF_SET_TIMER_RESOLUTION_BIT            0x1000
 239 #define PSF_BREAK_ON_TERMINATION_BIT            0x2000
 240 #define PSF_SESSION_CREATION_UNDERWAY_BIT       0x4000
 241 #define PSF_WRITE_WATCH_BIT                     0x8000
 242 #define PSF_PROCESS_IN_SESSION_BIT              0x10000
 243 #define PSF_OVERRIDE_ADDRESS_SPACE_BIT          0x20000
 244 #define PSF_HAS_ADDRESS_SPACE_BIT               0x40000
 245 #define PSF_LAUNCH_PREFETCHED_BIT               0x80000
 246 #define PSF_INJECT_INPAGE_ERRORS_BIT            0x100000
 247 #define PSF_VM_TOP_DOWN_BIT                     0x200000
 248 #define PSF_IMAGE_NOTIFY_DONE_BIT               0x400000
 249 #define PSF_PDE_UPDATE_NEEDED_BIT               0x800000
 250 #define PSF_VDM_ALLOWED_BIT                     0x1000000
 251 #define PSF_SWAP_ALLOWED_BIT                    0x2000000
 252 #define PSF_CREATE_FAILED_BIT                   0x4000000
 253 #define PSF_DEFAULT_IO_PRIORITY_BIT             0x8000000
 254
 255 //
 256 // Vista Process Flags
 257 //
 258 #define PSF2_PROTECTED_BIT                      0x800
 259
 260 #ifdef NTOS_MODE_USER
 261 //
 262 // Current Process/Thread built-in 'special' handles
 263 //
 264 #define NtCurrentProcess()                      ((HANDLE)(LONG_PTR)-1)
 265 #define ZwCurrentProcess()                      NtCurrentProcess()
 266 #define NtCurrentThread()                       ((HANDLE)(LONG_PTR)-2)
 267 #define ZwCurrentThread()                       NtCurrentThread()
 268
 269 //
 270 // Process/Thread/Job Information Classes for NtQueryInformationProcess/Thread/Job
 271 //
 272 typedef enum _PROCESSINFOCLASS
 273 {
 274     ProcessBasicInformation,
 275     ProcessQuotaLimits,
 276     ProcessIoCounters,
 277     ProcessVmCounters,
 278     ProcessTimes,
 279     ProcessBasePriority,
 280     ProcessRaisePriority,
 281     ProcessDebugPort,
 282     ProcessExceptionPort,
 283     ProcessAccessToken,
 284     ProcessLdtInformation,
 285     ProcessLdtSize,
 286     ProcessDefaultHardErrorMode,
 287     ProcessIoPortHandlers,
 288     ProcessPooledUsageAndLimits,
 289     ProcessWorkingSetWatch,
 290     ProcessUserModeIOPL,
 291     ProcessEnableAlignmentFaultFixup,
 292     ProcessPriorityClass,
 293     ProcessWx86Information,
 294     ProcessHandleCount,
 295     ProcessAffinityMask,
 296     ProcessPriorityBoost,
 297     ProcessDeviceMap,
 298     ProcessSessionInformation,
 299     ProcessForegroundInformation,
 300     ProcessWow64Information,
 301     ProcessImageFileName,
 302     ProcessLUIDDeviceMapsEnabled,
 303     ProcessBreakOnTermination,
 304     ProcessDebugObjectHandle,
 305     ProcessDebugFlags,
 306     ProcessHandleTracing,
 307     ProcessIoPriority,
 308     ProcessExecuteFlags,
 309     ProcessTlsInformation,
 310     ProcessCookie,
 311     ProcessImageInformation,
 312     ProcessCycleTime,
 313     ProcessPagePriority,
 314     ProcessInstrumentationCallback,
 315     ProcessThreadStackAllocation,
 316     ProcessWorkingSetWatchEx,
 317     ProcessImageFileNameWin32,
 318     ProcessImageFileMapping,
 319     ProcessAffinityUpdateMode,
 320     ProcessMemoryAllocationMode,
 321     MaxProcessInfoClass
 322 } PROCESSINFOCLASS;
 323
 324 typedef enum _THREADINFOCLASS
 325 {
 326     ThreadBasicInformation,
 327     ThreadTimes,
 328     ThreadPriority,
 329     ThreadBasePriority,
 330     ThreadAffinityMask,
 331     ThreadImpersonationToken,
 332     ThreadDescriptorTableEntry,
 333     ThreadEnableAlignmentFaultFixup,
 334     ThreadEventPair_Reusable,
 335     ThreadQuerySetWin32StartAddress,
 336     ThreadZeroTlsCell,
 337     ThreadPerformanceCount,
 338     ThreadAmILastThread,
 339     ThreadIdealProcessor,
 340     ThreadPriorityBoost,
 341     ThreadSetTlsArrayAddress,
 342     ThreadIsIoPending,
 343     ThreadHideFromDebugger,
 344     ThreadBreakOnTermination,
 345     ThreadSwitchLegacyState,
 346     ThreadIsTerminated,
 347     ThreadLastSystemCall,
 348     ThreadIoPriority,
 349     ThreadCycleTime,
 350     ThreadPagePriority,
 351     ThreadActualBasePriority,
 352     ThreadTebInformation,
 353     ThreadCSwitchMon,
 354     MaxThreadInfoClass
 355 } THREADINFOCLASS;
 356
 357 #else
 358
 359 typedef enum _PSPROCESSPRIORITYMODE
 360 {
 361     PsProcessPriorityForeground,
 362     PsProcessPriorityBackground,
 363     PsProcessPrioritySpinning
 364 } PSPROCESSPRIORITYMODE;
 365
 366 typedef enum _JOBOBJECTINFOCLASS
 367 {
 368     JobObjectBasicAccountingInformation = 1,
 369     JobObjectBasicLimitInformation,
 370     JobObjectBasicProcessIdList,
 371     JobObjectBasicUIRestrictions,
 372     JobObjectSecurityLimitInformation,
 373     JobObjectEndOfJobTimeInformation,
 374     JobObjectAssociateCompletionPortInformation,
 375     JobObjectBasicAndIoAccountingInformation,
 376     JobObjectExtendedLimitInformation,
 377     JobObjectJobSetInformation,
 378     MaxJobObjectInfoClass
 379 } JOBOBJECTINFOCLASS;
 380
 381 //
 382 // Power Event Events for Win32K Power Event Callback
 383 //
 384 typedef enum _PSPOWEREVENTTYPE
 385 {
 386     PsW32FullWake = 0,
 387     PsW32EventCode = 1,
 388     PsW32PowerPolicyChanged = 2,
 389     PsW32SystemPowerState = 3,
 390     PsW32SystemTime = 4,
 391     PsW32DisplayState = 5,
 392     PsW32CapabilitiesChanged = 6,
 393     PsW32SetStateFailed = 7,
 394     PsW32GdiOff = 8,
 395     PsW32GdiOn = 9,
 396     PsW32GdiPrepareResumeUI = 10,
 397     PsW32GdiOffRequest = 11,
 398     PsW32MonitorOff = 12,
 399 } PSPOWEREVENTTYPE;
 400
 401 //
 402 // Power State Tasks for Win32K Power State Callback
 403 //
 404 typedef enum _POWERSTATETASK
 405 {
 406     PowerState_BlockSessionSwitch = 0,
 407     PowerState_Init = 1,
 408     PowerState_QueryApps = 2,
 409     PowerState_QueryServices = 3,
 410     PowerState_QueryAppsFailed = 4,
 411     PowerState_QueryServicesFailed = 5,
 412     PowerState_SuspendApps = 6,
 413     PowerState_SuspendServices = 7,
 414     PowerState_ShowUI = 8,
 415     PowerState_NotifyWL = 9,
 416     PowerState_ResumeApps = 10,
 417     PowerState_ResumeServices = 11,
 418     PowerState_UnBlockSessionSwitch = 12,
 419     PowerState_End = 13,
 420     PowerState_BlockInput = 14,
 421     PowerState_UnblockInput = 15,
 422 } POWERSTATETASK;
 423
 424 //
 425 // Win32K Job Callback Types
 426 //
 427 typedef enum _PSW32JOBCALLOUTTYPE
 428 {
 429    PsW32JobCalloutSetInformation = 0,
 430    PsW32JobCalloutAddProcess = 1,
 431    PsW32JobCalloutTerminate = 2,
 432 } PSW32JOBCALLOUTTYPE;
 433
 434 //
 435 // Win32K Thread Callback Types
 436 //
 437 typedef enum _PSW32THREADCALLOUTTYPE
 438 {
 439     PsW32ThreadCalloutInitialize,
 440     PsW32ThreadCalloutExit,
 441 } PSW32THREADCALLOUTTYPE;
 442
 443 //
 444 // Declare empty structure definitions so that they may be referenced by
 445 // routines before they are defined
 446 //
 447 struct _W32THREAD;
 448 struct _W32PROCESS;
 449 //struct _ETHREAD;
 450 struct _WIN32_POWEREVENT_PARAMETERS;
 451 struct _WIN32_POWERSTATE_PARAMETERS;
 452 struct _WIN32_JOBCALLOUT_PARAMETERS;
 453 struct _WIN32_OPENMETHOD_PARAMETERS;
 454 struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS;
 455 struct _WIN32_CLOSEMETHOD_PARAMETERS;
 456 struct _WIN32_DELETEMETHOD_PARAMETERS;
 457 struct _WIN32_PARSEMETHOD_PARAMETERS;
 458
 459 //
 460 // Win32K Process and Thread Callbacks
 461 //
 462 typedef
 463 NTSTATUS
 464 (NTAPI *PKWIN32_PROCESS_CALLOUT)(
 465     struct _EPROCESS *Process,
 466     BOOLEAN Create
 467 );
 468
 469 typedef
 470 NTSTATUS
 471 (NTAPI *PKWIN32_THREAD_CALLOUT)(
 472     struct _ETHREAD *Thread,
 473     PSW32THREADCALLOUTTYPE Type
 474 );
 475
 476 typedef
 477 NTSTATUS
 478 (NTAPI *PKWIN32_GLOBALATOMTABLE_CALLOUT)(
 479     VOID
 480 );
 481
 482 typedef
 483 NTSTATUS
 484 (NTAPI *PKWIN32_POWEREVENT_CALLOUT)(
 485     struct _WIN32_POWEREVENT_PARAMETERS *Parameters
 486 );
 487
 488 typedef
 489 NTSTATUS
 490 (NTAPI *PKWIN32_POWERSTATE_CALLOUT)(
 491     struct _WIN32_POWERSTATE_PARAMETERS *Parameters
 492 );
 493
 494 typedef
 495 NTSTATUS
 496 (NTAPI *PKWIN32_JOB_CALLOUT)(
 497     struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters
 498 );
 499
 500 typedef
 501 NTSTATUS
 502 (NTAPI *PGDI_BATCHFLUSH_ROUTINE)(
 503     VOID
 504 );
 505
 506 typedef
 507 NTSTATUS
 508 (NTAPI *PKWIN32_OPENMETHOD_CALLOUT)(
 509     struct _WIN32_OPENMETHOD_PARAMETERS *Parameters
 510 );
 511
 512 typedef
 513 NTSTATUS
 514 (NTAPI *PKWIN32_OKTOCLOSEMETHOD_CALLOUT)(
 515     struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters
 516 );
 517
 518 typedef
 519 NTSTATUS
 520 (NTAPI *PKWIN32_CLOSEMETHOD_CALLOUT)(
 521     struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters
 522 );
 523
 524 typedef
 525 VOID
 526 (NTAPI *PKWIN32_DELETEMETHOD_CALLOUT)(
 527     struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters
 528 );
 529
 530 typedef
 531 NTSTATUS
 532 (NTAPI *PKWIN32_PARSEMETHOD_CALLOUT)(
 533     struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters
 534 );
 535
 536 typedef
 537 NTSTATUS
 538 (NTAPI *PKWIN32_WIN32DATACOLLECTION_CALLOUT)(
 539     struct _EPROCESS *Process,
 540     PVOID Callback,
 541     PVOID Context
 542 );
 543
 544 //
 545 // Lego Callback
 546 //
 547 typedef
 548 VOID
 549 (NTAPI *PLEGO_NOTIFY_ROUTINE)(
 550     IN PKTHREAD Thread
 551 );
 552
 553 #endif
 554
 555 typedef NTSTATUS
 556 (NTAPI *PPOST_PROCESS_INIT_ROUTINE)(
 557     VOID
 558 );
 559
 560 //
 561 // Descriptor Table Entry Definition
 562 //
 563 #if (_M_IX86)
 564 #define _DESCRIPTOR_TABLE_ENTRY_DEFINED
 565 typedef struct _DESCRIPTOR_TABLE_ENTRY
 566 {
 567     ULONG Selector;
 568     LDT_ENTRY Descriptor;
 569 } DESCRIPTOR_TABLE_ENTRY, *PDESCRIPTOR_TABLE_ENTRY;
 570 #endif
 571
 572 //
 573 // PEB Lock Routine
 574 //
 575 typedef VOID
 576 (NTAPI *PPEBLOCKROUTINE)(
 577     PVOID PebLock
 578 );
 579
 580 //
 581 // PEB Free Block Descriptor
 582 //
 583 typedef struct _PEB_FREE_BLOCK
 584 {
 585     struct _PEB_FREE_BLOCK* Next;
 586     ULONG Size;
 587 } PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
 588
 589 //
 590 // Process Environment Block (PEB)
 591 //
 592 typedef struct _PEB
 593 {
 594     UCHAR InheritedAddressSpace;
 595     UCHAR ReadImageFileExecOptions;
 596     UCHAR BeingDebugged;
 597 #if (NTDDI_VERSION >= NTDDI_WS03)
 598     union
 599     {
 600         UCHAR BitField;
 601         struct
 602         {
 603             UCHAR ImageUsesLargePages:1;
 604     #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 605             UCHAR IsProtectedProcess:1;
 606             UCHAR IsLegacyProcess:1;
 607             UCHAR IsImageDynamicallyRelocated:1;
 608             UCHAR SkipPatchingUser32Forwarders:1;
 609             UCHAR SpareBits:3;
 610     #else
 611             UCHAR SpareBits:7;
 612     #endif
 613         };
 614     };
 615 #else
 616     BOOLEAN SpareBool;
 617 #endif
 618     HANDLE Mutant;
 619     PVOID ImageBaseAddress;
 620     PPEB_LDR_DATA Ldr;
 621     struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters;
 622     PVOID SubSystemData;
 623     PVOID ProcessHeap;
 624 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 625     struct _RTL_CRITICAL_SECTION *FastPebLock;
 626     PVOID AltThunkSListPtr;
 627     PVOID IFEOKey;
 628     union
 629     {
 630         ULONG CrossProcessFlags;
 631         struct
 632         {
 633             ULONG ProcessInJob:1;
 634             ULONG ProcessInitializing:1;
 635             ULONG ProcessUsingVEH:1;
 636             ULONG ProcessUsingVCH:1;
 637             ULONG ReservedBits0:28;
 638         };
 639     };
 640     union
 641     {
 642         PVOID* KernelCallbackTable;
 643         PVOID UserSharedInfoPtr;
 644     };
 645     ULONG SystemReserved[1];
 646     ULONG SpareUlong;
 647     ULONG_PTR SparePebPtr0;
 648 #else
 649     PVOID FastPebLock;
 650     PPEBLOCKROUTINE FastPebLockRoutine;
 651     PPEBLOCKROUTINE FastPebUnlockRoutine;
 652     ULONG EnvironmentUpdateCount;
 653     PVOID* KernelCallbackTable;
 654     PVOID EventLogSection;
 655     PVOID EventLog;
 656     PPEB_FREE_BLOCK FreeList;
 657 #endif
 658     ULONG TlsExpansionCounter;
 659     PVOID TlsBitmap;
 660     ULONG TlsBitmapBits[0x2];
 661     PVOID ReadOnlySharedMemoryBase;
 662 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 663     PVOID HotpatchInformation;
 664 #else
 665     PVOID ReadOnlySharedMemoryHeap;
 666 #endif
 667     PVOID* ReadOnlyStaticServerData;
 668     PVOID AnsiCodePageData;
 669     PVOID OemCodePageData;
 670     PVOID UnicodeCaseTableData;
 671     ULONG NumberOfProcessors;
 672     ULONG NtGlobalFlag;
 673     LARGE_INTEGER CriticalSectionTimeout;
 674     ULONG_PTR HeapSegmentReserve;
 675     ULONG_PTR HeapSegmentCommit;
 676     ULONG_PTR HeapDeCommitTotalFreeThreshold;
 677     ULONG_PTR HeapDeCommitFreeBlockThreshold;
 678     ULONG NumberOfHeaps;
 679     ULONG MaximumNumberOfHeaps;
 680     PVOID* ProcessHeaps;
 681     PVOID GdiSharedHandleTable;
 682     PVOID ProcessStarterHelper;
 683     ULONG GdiDCAttributeList;
 684 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 685     struct _RTL_CRITICAL_SECTION *LoaderLock;
 686 #else
 687     PVOID LoaderLock;
 688 #endif
 689     ULONG OSMajorVersion;
 690     ULONG OSMinorVersion;
 691     USHORT OSBuildNumber;
 692     USHORT OSCSDVersion;
 693     ULONG OSPlatformId;
 694     ULONG ImageSubSystem;
 695     ULONG ImageSubSystemMajorVersion;
 696     ULONG ImageSubSystemMinorVersion;
 697     ULONG ImageProcessAffinityMask;
 698 #ifdef _WIN64
 699     ULONG GdiHandleBuffer[0x3c];
 700 #else
 701     ULONG GdiHandleBuffer[0x22];
 702 #endif
 703     PPOST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
 704     struct _RTL_BITMAP *TlsExpansionBitmap;
 705     ULONG TlsExpansionBitmapBits[0x20];
 706     ULONG SessionId;
 707 #if (NTDDI_VERSION >= NTDDI_WINXP)
 708     ULARGE_INTEGER AppCompatFlags;
 709     ULARGE_INTEGER AppCompatFlagsUser;
 710     PVOID pShimData;
 711     PVOID AppCompatInfo;
 712     UNICODE_STRING CSDVersion;
 713     struct _ACTIVATION_CONTEXT_DATA *ActivationContextData;
 714     struct _ASSEMBLY_STORAGE_MAP *ProcessAssemblyStorageMap;
 715     struct _ACTIVATION_CONTEXT_DATA *SystemDefaultActivationContextData;
 716     struct _ASSEMBLY_STORAGE_MAP *SystemAssemblyStorageMap;
 717     ULONG_PTR MinimumStackCommit;
 718 #endif
 719 #if (NTDDI_VERSION >= NTDDI_WS03)
 720     PVOID *FlsCallback;
 721     LIST_ENTRY FlsListHead;
 722     struct _RTL_BITMAP *FlsBitmap;
 723     ULONG FlsBitmapBits[4];
 724     ULONG FlsHighIndex;
 725 #endif
 726 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 727     PVOID WerRegistrationData;
 728     PVOID WerShipAssertPtr;
 729 #endif
 730 } PEB, *PPEB;
 731
 732 //
 733 // GDI Batch Descriptor
 734 //
 735 typedef struct _GDI_TEB_BATCH
 736 {
 737     ULONG Offset;
 738     HANDLE HDC;
 739     ULONG Buffer[0x136];
 740 } GDI_TEB_BATCH, *PGDI_TEB_BATCH;
 741
 742 //
 743 // Initial TEB
 744 //
 745 typedef struct _INITIAL_TEB
 746 {
 747     PVOID PreviousStackBase;
 748     PVOID PreviousStackLimit;
 749     PVOID StackBase;
 750     PVOID StackLimit;
 751     PVOID AllocatedStackBase;
 752 } INITIAL_TEB, *PINITIAL_TEB;
 753
 754 //
 755 // TEB Active Frame Structures
 756 //
 757 typedef struct _TEB_ACTIVE_FRAME_CONTEXT
 758 {
 759     ULONG Flags;
 760     LPSTR FrameName;
 761 } TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;
 762
 763 typedef struct _TEB_ACTIVE_FRAME
 764 {
 765     ULONG Flags;
 766     struct _TEB_ACTIVE_FRAME *Previous;
 767     PTEB_ACTIVE_FRAME_CONTEXT Context;
 768 } TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
 769
 770 //
 771 // Thread Environment Block (TEB)
 772 //
 773 typedef struct _TEB
 774 {
 775     NT_TIB Tib;
 776     PVOID EnvironmentPointer;
 777     CLIENT_ID ClientId;
 778     PVOID ActiveRpcHandle;
 779     PVOID ThreadLocalStoragePointer;
 780     struct _PEB *ProcessEnvironmentBlock;
 781     ULONG LastErrorValue;
 782     ULONG CountOfOwnedCriticalSections;
 783     PVOID CsrClientThread;
 784     struct _W32THREAD* Win32ThreadInfo;
 785     ULONG User32Reserved[0x1A];
 786     ULONG UserReserved[5];
 787     PVOID WOW32Reserved;
 788     LCID CurrentLocale;
 789     ULONG FpSoftwareStatusRegister;
 790     PVOID SystemReserved1[0x36];
 791     LONG ExceptionCode;
 792     struct _ACTIVATION_CONTEXT_STACK *ActivationContextStackPointer;
 793 #ifdef _WIN64
 794     UCHAR SpareBytes1[24];
 795 #else
 796     UCHAR SpareBytes1[0x24];
 797 #endif
 798     ULONG TxFsContext;
 799     GDI_TEB_BATCH GdiTebBatch;
 800     CLIENT_ID RealClientId;
 801     PVOID GdiCachedProcessHandle;
 802     ULONG GdiClientPID;
 803     ULONG GdiClientTID;
 804     PVOID GdiThreadLocalInfo;
 805     SIZE_T Win32ClientInfo[62];
 806     PVOID glDispatchTable[0xE9];
 807     SIZE_T glReserved1[0x1D];
 808     PVOID glReserved2;
 809     PVOID glSectionInfo;
 810     PVOID glSection;
 811     PVOID glTable;
 812     PVOID glCurrentRC;
 813     PVOID glContext;
 814     NTSTATUS LastStatusValue;
 815     UNICODE_STRING StaticUnicodeString;
 816     WCHAR StaticUnicodeBuffer[0x105];
 817     PVOID DeallocationStack;
 818     PVOID TlsSlots[0x40];
 819     LIST_ENTRY TlsLinks;
 820     PVOID Vdm;
 821     PVOID ReservedForNtRpc;
 822     PVOID DbgSsReserved[0x2];
 823     ULONG HardErrorDisabled;
 824 #ifdef _WIN64
 825     PVOID Instrumentation[11];
 826 #else
 827     PVOID Instrumentation[9];
 828 #endif
 829     GUID ActivityId;
 830     PVOID SubProcessTag;
 831     PVOID EtwTraceData;
 832 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 833     PVOID EtwLocalData;
 834 #endif
 835     PVOID WinSockData;
 836     ULONG GdiBatchCount;
 837 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 838     BOOLEAN SpareBool0;
 839     BOOLEAN SpareBool1;
 840     BOOLEAN SpareBool2;
 841 #else
 842     BOOLEAN InDbgPrint;
 843     BOOLEAN FreeStackOnTermination;
 844     BOOLEAN HasFiberData;
 845 #endif
 846     UCHAR IdealProcessor;
 847     ULONG GuaranteedStackBytes;
 848     PVOID ReservedForPerf;
 849     PVOID ReservedForOle;
 850     ULONG WaitingOnLoaderLock;
 851 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 852     PVOID SavedPriorityState;
 853 #else
 854     ULONG SparePointer1;
 855 #endif
 856     ULONG SoftPatchPtr1;
 857     ULONG SoftPatchPtr2;
 858     PVOID *TlsExpansionSlots;
 859     ULONG ImpersonationLocale;
 860     ULONG IsImpersonating;
 861     PVOID NlsCache;
 862     PVOID pShimData;
 863     ULONG HeapVirualAffinity;
 864     PVOID CurrentTransactionHandle;
 865     PTEB_ACTIVE_FRAME ActiveFrame;
 866 #if (NTDDI_VERSION >= NTDDI_WS03)
 867     PVOID FlsData;
 868 #endif
 869 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 870     PVOID PreferredLangauges;
 871     PVOID UserPrefLanguages;
 872     PVOID MergedPrefLanguages;
 873     ULONG MuiImpersonation;
 874     union
 875     {
 876         struct
 877         {
 878             USHORT SpareCrossTebFlags:16;
 879         };
 880         USHORT CrossTebFlags;
 881     };
 882     union
 883     {
 884         struct
 885         {
 886             USHORT DbgSafeThunkCall:1;
 887             USHORT DbgInDebugPrint:1;
 888             USHORT DbgHasFiberData:1;
 889             USHORT DbgSkipThreadAttach:1;
 890             USHORT DbgWerInShipAssertCode:1;
 891             USHORT DbgIssuedInitialBp:1;
 892             USHORT DbgClonedThread:1;
 893             USHORT SpareSameTebBits:9;
 894         };
 895         USHORT SameTebFlags;
 896     };
 897     PVOID TxnScopeEntercallback;
 898     PVOID TxnScopeExitCAllback;
 899     PVOID TxnScopeContext;
 900     ULONG LockCount;
 901     ULONG ProcessRundown;
 902     ULONGLONG LastSwitchTime;
 903     ULONGLONG TotalSwitchOutTime;
 904     LARGE_INTEGER WaitReasonBitMap;
 905 #else
 906     UCHAR SafeThunkCall;
 907     UCHAR BooleanSpare[3];
 908 #endif
 909 } TEB, *PTEB;
 910
 911 #ifdef NTOS_MODE_USER
 912
 913 //
 914 // Process Information Structures for NtQueryProcessInformation
 915 //
 916 typedef struct _PROCESS_BASIC_INFORMATION
 917 {
 918     NTSTATUS ExitStatus;
 919     PPEB PebBaseAddress;
 920     ULONG_PTR AffinityMask;
 921     KPRIORITY BasePriority;
 922     ULONG_PTR UniqueProcessId;
 923     ULONG_PTR InheritedFromUniqueProcessId;
 924 } PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION;
 925
 926 typedef struct _PROCESS_ACCESS_TOKEN
 927 {
 928     HANDLE Token;
 929     HANDLE Thread;
 930 } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
 931
 932 typedef struct _PROCESS_DEVICEMAP_INFORMATION
 933 {
 934     union
 935     {
 936         struct
 937         {
 938             HANDLE DirectoryHandle;
 939         } Set;
 940         struct
 941         {
 942             ULONG DriveMap;
 943             UCHAR DriveType[32];
 944         } Query;
 945     };
 946 } PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION;
 947
 948 typedef struct _KERNEL_USER_TIMES
 949 {
 950     LARGE_INTEGER CreateTime;
 951     LARGE_INTEGER ExitTime;
 952     LARGE_INTEGER KernelTime;
 953     LARGE_INTEGER UserTime;
 954 } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
 955
 956 typedef struct _PROCESS_SESSION_INFORMATION
 957 {
 958     ULONG SessionId;
 959 } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
 960
 961 #endif
 962
 963 typedef struct _PROCESS_PRIORITY_CLASS
 964 {
 965     BOOLEAN Foreground;
 966     UCHAR PriorityClass;
 967 } PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;
 968
 969 //
 970 // Thread Information Structures for NtQueryProcessInformation
 971 //
 972 typedef struct _THREAD_BASIC_INFORMATION
 973 {
 974     NTSTATUS ExitStatus;
 975     PVOID TebBaseAddress;
 976     CLIENT_ID ClientId;
 977     KAFFINITY AffinityMask;
 978     KPRIORITY Priority;
 979     KPRIORITY BasePriority;
 980 } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
 981
 982 #ifndef NTOS_MODE_USER
 983
 984 //
 985 // Job Set Array
 986 //
 987 typedef struct _JOB_SET_ARRAY
 988 {
 989     HANDLE JobHandle;
 990     ULONG MemberLevel;
 991     ULONG Flags;
 992 } JOB_SET_ARRAY, *PJOB_SET_ARRAY;
 993
 994 //
 995 // EPROCESS Quota Structures
 996 //
 997 typedef struct _EPROCESS_QUOTA_ENTRY
 998 {
 999     SIZE_T Usage;
1000     SIZE_T Limit;
1001     SIZE_T Peak;
1002     SIZE_T Return;
1003 } EPROCESS_QUOTA_ENTRY, *PEPROCESS_QUOTA_ENTRY;
1004
1005 typedef struct _EPROCESS_QUOTA_BLOCK
1006 {
1007     EPROCESS_QUOTA_ENTRY QuotaEntry[3];
1008     LIST_ENTRY QuotaList;
1009     ULONG ReferenceCount;
1010     ULONG ProcessCount;
1011 } EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;
1012
1013 //
1014 // Process Pagefault History
1015 //
1016 typedef struct _PAGEFAULT_HISTORY
1017 {
1018     ULONG CurrentIndex;
1019     ULONG MapIndex;
1020     KSPIN_LOCK SpinLock;
1021     PVOID Reserved;
1022     PROCESS_WS_WATCH_INFORMATION WatchInfo[1];
1023 } PAGEFAULT_HISTORY, *PPAGEFAULT_HISTORY;
1024
1025 //
1026 // Process Impersonation Information
1027 //
1028 typedef struct _PS_IMPERSONATION_INFORMATION
1029 {
1030     PACCESS_TOKEN Token;
1031     BOOLEAN CopyOnOpen;
1032     BOOLEAN EffectiveOnly;
1033     SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
1034 } PS_IMPERSONATION_INFORMATION, *PPS_IMPERSONATION_INFORMATION;
1035
1036 //
1037 // Process Termination Port
1038 //
1039 typedef struct _TERMINATION_PORT
1040 {
1041     struct _TERMINATION_PORT *Next;
1042     PVOID Port;
1043 } TERMINATION_PORT, *PTERMINATION_PORT;
1044
1045 //
1046 // Per-Process APC Rate Limiting
1047 //
1048 typedef struct _PSP_RATE_APC
1049 {
1050     union
1051     {
1052         SINGLE_LIST_ENTRY NextApc;
1053         ULONGLONG ExcessCycles;
1054     };
1055     ULONGLONG TargetGEneration;
1056     KAPC RateApc;
1057 } PSP_RATE_APC, *PPSP_RATE_APC;
1058
1059 //
1060 // Executive Thread (ETHREAD)
1061 //
1062 typedef struct _ETHREAD
1063 {
1064     KTHREAD Tcb;
1065     LARGE_INTEGER CreateTime;
1066     union
1067     {
1068         LARGE_INTEGER ExitTime;
1069         LIST_ENTRY LpcReplyChain;
1070         LIST_ENTRY KeyedWaitChain;
1071     };
1072     union
1073     {
1074         NTSTATUS ExitStatus;
1075         PVOID OfsChain;
1076     };
1077     LIST_ENTRY PostBlockList;
1078     union
1079     {
1080         struct _TERMINATION_PORT *TerminationPort;
1081         struct _ETHREAD *ReaperLink;
1082         PVOID KeyedWaitValue;
1083 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1084         PVOID Win32StartParameter;
1085 #endif
1086     };
1087     KSPIN_LOCK ActiveTimerListLock;
1088     LIST_ENTRY ActiveTimerListHead;
1089     CLIENT_ID Cid;
1090 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1091     KSEMAPHORE KeyedWaitSemaphore;
1092 #else
1093     union
1094     {
1095         KSEMAPHORE LpcReplySemaphore;
1096         KSEMAPHORE KeyedReplySemaphore;
1097     };
1098     union
1099     {
1100         PVOID LpcReplyMessage;
1101         PVOID LpcWaitingOnPort;
1102     };
1103 #endif
1104     PPS_IMPERSONATION_INFORMATION ImpersonationInfo;
1105     LIST_ENTRY IrpList;
1106     ULONG_PTR TopLevelIrp;
1107     PDEVICE_OBJECT DeviceToVerify;
1108 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1109     PPSP_RATE_APC RateControlApc;
1110 #else
1111     struct _EPROCESS *ThreadsProcess;
1112 #endif
1113     PVOID Win32StartAddress;
1114     union
1115     {
1116         PKSTART_ROUTINE StartAddress;
1117         ULONG LpcReceivedMessageId;
1118     };
1119     LIST_ENTRY ThreadListEntry;
1120     EX_RUNDOWN_REF RundownProtect;
1121     EX_PUSH_LOCK ThreadLock;
1122 #if (NTDDI_VERSION < NTDDI_LONGHORN)
1123     ULONG LpcReplyMessageId;
1124 #endif
1125     ULONG ReadClusterSize;
1126 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1127     ULONG SpareUlong0;
1128 #else
1129     ACCESS_MASK GrantedAccess;
1130 #endif
1131     union
1132     {
1133         struct
1134         {
1135            ULONG Terminated:1;
1136 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1137            ULONG ThreadInserted:1;
1138 #else
1139            ULONG DeadThread:1;
1140 #endif
1141            ULONG HideFromDebugger:1;
1142            ULONG ActiveImpersonationInfo:1;
1143            ULONG SystemThread:1;
1144            ULONG HardErrorsAreDisabled:1;
1145            ULONG BreakOnTermination:1;
1146            ULONG SkipCreationMsg:1;
1147            ULONG SkipTerminationMsg:1;
1148 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1149            ULONG CreateMsgSent:1;
1150            ULONG ThreadIoPriority:3;
1151            ULONG ThreadPagePriority:3;
1152            ULONG PendingRatecontrol:1;
1153 #endif
1154         };
1155         ULONG CrossThreadFlags;
1156     };
1157     union
1158     {
1159         struct
1160         {
1161            ULONG ActiveExWorker:1;
1162            ULONG ExWorkerCanWaitUser:1;
1163            ULONG MemoryMaker:1;
1164            ULONG KeyedEventInUse:1;
1165 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1166            ULONG RateApcState:2;
1167 #endif
1168         };
1169         ULONG SameThreadPassiveFlags;
1170     };
1171     union
1172     {
1173         struct
1174         {
1175            ULONG LpcReceivedMsgIdValid:1;
1176            ULONG LpcExitThreadCalled:1;
1177 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1178            ULONG Spare:1;
1179 #else
1180            ULONG AddressSpaceOwner:1;
1181 #endif
1182            ULONG OwnsProcessWorkingSetExclusive:1;
1183            ULONG OwnsProcessWorkingSetShared:1;
1184            ULONG OwnsSystemWorkingSetExclusive:1;
1185            ULONG OwnsSystemWorkingSetShared:1;
1186            ULONG OwnsSessionWorkingSetExclusive:1;
1187            ULONG OwnsSessionWorkingSetShared:1;
1188 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1189            ULONG SupressSymbolLoad:1;
1190            ULONG Spare1:3;
1191            ULONG PriorityRegionActive:4;
1192 #else
1193            ULONG ApcNeeded:1;
1194 #endif
1195         };
1196         ULONG SameThreadApcFlags;
1197     };
1198 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1199     UCHAR CacheManagerActive;
1200 #else
1201     UCHAR ForwardClusterOnly;
1202 #endif
1203     UCHAR DisablePageFaultClustering;
1204     UCHAR ActiveFaultCount;
1205 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1206     ULONG AlpcMessageId;
1207     union
1208     {
1209         PVOID AlpcMessage;
1210         ULONG AlpcReceiveAttributeSet;
1211     };
1212     LIST_ENTRY AlpcWaitListEntry;
1213     KSEMAPHORE AlpcWaitSemaphore;
1214     ULONG CacheManagerCount;
1215 #endif
1216 } ETHREAD;
1217
1218 //
1219 // Executive Process (EPROCESS)
1220 //
1221 typedef struct _EPROCESS
1222 {
1223     KPROCESS Pcb;
1224     EX_PUSH_LOCK ProcessLock;
1225     LARGE_INTEGER CreateTime;
1226     LARGE_INTEGER ExitTime;
1227     EX_RUNDOWN_REF RundownProtect;
1228     HANDLE UniqueProcessId;
1229     LIST_ENTRY ActiveProcessLinks;
1230     ULONG QuotaUsage[3]; /* 0=PagedPool, 1=NonPagedPool, 2=Pagefile */
1231     ULONG QuotaPeak[3];  /* ditto */
1232     ULONG CommitCharge;
1233     ULONG PeakVirtualSize;
1234     ULONG VirtualSize;
1235     LIST_ENTRY SessionProcessLinks;
1236     PVOID DebugPort;
1237 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1238     union
1239     {
1240         PVOID ExceptionPortData;
1241         ULONG ExceptionPortValue;
1242         UCHAR ExceptionPortState:3;
1243     };
1244 #else
1245     PVOID ExceptionPort;
1246 #endif
1247     PHANDLE_TABLE ObjectTable;
1248     EX_FAST_REF Token;
1249     ULONG WorkingSetPage;
1250 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1251     EX_PUSH_LOCK AddressCreationLock;
1252     PETHREAD RotateInProgress;
1253 #else
1254     KGUARDED_MUTEX AddressCreationLock;
1255     KSPIN_LOCK HyperSpaceLock;
1256 #endif
1257     PETHREAD ForkInProgress;
1258     ULONG HardwareTrigger;
1259     PMM_AVL_TABLE PhysicalVadRoot;
1260     PVOID CloneRoot;
1261     ULONG NumberOfPrivatePages;
1262     ULONG NumberOfLockedPages;
1263     PVOID *Win32Process;
1264     struct _EJOB *Job;
1265     PVOID SectionObject;
1266     PVOID SectionBaseAddress;
1267     PEPROCESS_QUOTA_BLOCK QuotaBlock;
1268     PPAGEFAULT_HISTORY WorkingSetWatch;
1269     PVOID Win32WindowStation;
1270     HANDLE InheritedFromUniqueProcessId;
1271     PVOID LdtInformation;
1272     PVOID VadFreeHint;
1273     PVOID VdmObjects;
1274     PVOID DeviceMap;
1275 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1276     PVOID EtwDataSource;
1277     PVOID FreeTebHint;
1278 #else
1279     PVOID Spare0[3];
1280 #endif
1281     union
1282     {
1283         HARDWARE_PTE PageDirectoryPte;
1284         ULONGLONG Filler;
1285     };
1286     PVOID Session;
1287     CHAR ImageFileName[16];
1288     LIST_ENTRY JobLinks;
1289     PVOID LockedPagesList;
1290     LIST_ENTRY ThreadListHead;
1291     PVOID SecurityPort;
1292     PVOID PaeTop;
1293     ULONG ActiveThreads;
1294 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1295     ULONG ImagePathHash;
1296 #else
1297     ACCESS_MASK GrantedAccess;
1298 #endif
1299     ULONG DefaultHardErrorProcessing;
1300     NTSTATUS LastThreadExitStatus;
1301     struct _PEB* Peb;
1302     EX_FAST_REF PrefetchTrace;
1303     LARGE_INTEGER ReadOperationCount;
1304     LARGE_INTEGER WriteOperationCount;
1305     LARGE_INTEGER OtherOperationCount;
1306     LARGE_INTEGER ReadTransferCount;
1307     LARGE_INTEGER WriteTransferCount;
1308     LARGE_INTEGER OtherTransferCount;
1309     ULONG CommitChargeLimit;
1310     ULONG CommitChargePeak;
1311     PVOID AweInfo;
1312     SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;
1313     MMSUPPORT Vm;
1314     LIST_ENTRY MmProcessLinks;
1315     ULONG ModifiedPageCount;
1316 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1317     union
1318     {
1319         struct
1320         {
1321             ULONG JobNotReallyActive:1;
1322             ULONG AccountingFolded:1;
1323             ULONG NewProcessReported:1;
1324             ULONG ExitProcessReported:1;
1325             ULONG ReportCommitChanges:1;
1326             ULONG LastReportMemory:1;
1327             ULONG ReportPhysicalPageChanges:1;
1328             ULONG HandleTableRundown:1;
1329             ULONG NeedsHandleRundown:1;
1330             ULONG RefTraceEnabled:1;
1331             ULONG NumaAware:1;
1332             ULONG ProtectedProcess:1;
1333             ULONG DefaultPagePriority:3;
1334             ULONG ProcessDeleteSelf:1;
1335             ULONG ProcessVerifierTarget:1;
1336         };
1337         ULONG Flags2;
1338     };
1339 #else
1340     ULONG JobStatus;
1341 #endif
1342     union
1343     {
1344         struct
1345         {
1346             ULONG CreateReported:1;
1347             ULONG NoDebugInherit:1;
1348             ULONG ProcessExiting:1;
1349             ULONG ProcessDelete:1;
1350             ULONG Wow64SplitPages:1;
1351             ULONG VmDeleted:1;
1352             ULONG OutswapEnabled:1;
1353             ULONG Outswapped:1;
1354             ULONG ForkFailed:1;
1355             ULONG Wow64VaSpace4Gb:1;
1356             ULONG AddressSpaceInitialized:2;
1357             ULONG SetTimerResolution:1;
1358             ULONG BreakOnTermination:1;
1359 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1360             ULONG DeprioritizeViews:1;
1361 #else
1362             ULONG SessionCreationUnderway:1;
1363 #endif
1364             ULONG WriteWatch:1;
1365             ULONG ProcessInSession:1;
1366             ULONG OverrideAddressSpace:1;
1367             ULONG HasAddressSpace:1;
1368             ULONG LaunchPrefetched:1;
1369             ULONG InjectInpageErrors:1;
1370             ULONG VmTopDown:1;
1371             ULONG ImageNotifyDone:1;
1372             ULONG PdeUpdateNeeded:1;
1373             ULONG VdmAllowed:1;
1374             ULONG SmapAllowed:1;
1375 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1376             ULONG ProcessInserted:1;
1377 #else
1378             ULONG CreateFailed:1;
1379 #endif
1380             ULONG DefaultIoPriority:3;
1381 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1382             ULONG SparePsFlags1:2;
1383 #else
1384             ULONG Spare1:1;
1385             ULONG Spare2:1;
1386 #endif
1387         };
1388         ULONG Flags;
1389     };
1390     NTSTATUS ExitStatus;
1391 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1392     USHORT Spare7;
1393 #else
1394     USHORT NextPageColor;
1395 #endif
1396     union
1397     {
1398         struct
1399         {
1400             UCHAR SubSystemMinorVersion;
1401             UCHAR SubSystemMajorVersion;
1402         };
1403         USHORT SubSystemVersion;
1404     };
1405     UCHAR PriorityClass;
1406     MM_AVL_TABLE VadRoot;
1407     ULONG Cookie;
1408 } EPROCESS;
1409
1410 //
1411 // Job Token Filter Data
1412 //
1413 #include <pshpack1.h>
1414 typedef struct _PS_JOB_TOKEN_FILTER
1415 {
1416     ULONG CapturedSidCount;
1417     PSID_AND_ATTRIBUTES CapturedSids;
1418     ULONG CapturedSidsLength;
1419     ULONG CapturedGroupCount;
1420     PSID_AND_ATTRIBUTES CapturedGroups;
1421     ULONG CapturedGroupsLength;
1422     ULONG CapturedPrivilegeCount;
1423     PLUID_AND_ATTRIBUTES CapturedPrivileges;
1424     ULONG CapturedPrivilegesLength;
1425 } PS_JOB_TOKEN_FILTER, *PPS_JOB_TOKEN_FILTER;
1426
1427 //
1428 // Executive Job (EJOB)
1429 //
1430 typedef struct _EJOB
1431 {
1432     KEVENT Event;
1433     LIST_ENTRY JobLinks;
1434     LIST_ENTRY ProcessListHead;
1435     ERESOURCE JobLock;
1436     LARGE_INTEGER TotalUserTime;
1437     LARGE_INTEGER TotalKernelTime;
1438     LARGE_INTEGER ThisPeriodTotalUserTime;
1439     LARGE_INTEGER ThisPeriodTotalKernelTime;
1440     ULONG TotalPageFaultCount;
1441     ULONG TotalProcesses;
1442     ULONG ActiveProcesses;
1443     ULONG TotalTerminatedProcesses;
1444     LARGE_INTEGER PerProcessUserTimeLimit;
1445     LARGE_INTEGER PerJobUserTimeLimit;
1446     ULONG LimitFlags;
1447     ULONG MinimumWorkingSetSize;
1448     ULONG MaximumWorkingSetSize;
1449     ULONG ActiveProcessLimit;
1450     ULONG Affinity;
1451     UCHAR PriorityClass;
1452     ULONG UIRestrictionsClass;
1453     ULONG SecurityLimitFlags;
1454     PVOID Token;
1455     PPS_JOB_TOKEN_FILTER Filter;
1456     ULONG EndOfJobTimeAction;
1457     PVOID CompletionPort;
1458     PVOID CompletionKey;
1459     ULONG SessionId;
1460     ULONG SchedulingClass;
1461     ULONGLONG ReadOperationCount;
1462     ULONGLONG WriteOperationCount;
1463     ULONGLONG OtherOperationCount;
1464     ULONGLONG ReadTransferCount;
1465     ULONGLONG WriteTransferCount;
1466     ULONGLONG OtherTransferCount;
1467     IO_COUNTERS IoInfo;
1468     ULONG ProcessMemoryLimit;
1469     ULONG JobMemoryLimit;
1470     ULONG PeakProcessMemoryUsed;
1471     ULONG PeakJobMemoryUsed;
1472     ULONG CurrentJobMemoryUsed;
1473 #if (NTDDI_VERSION >= NTDDI_WINXP) && (NTDDI_VERSION < NTDDI_WS03)
1474     FAST_MUTEX MemoryLimitsLock;
1475 #elif (NTDDI_VERSION >= NTDDI_WS03) && (NTDDI_VERSION < NTDDI_LONGHORN)
1476     KGUARDED_MUTEX MemoryLimitsLock;
1477 #elif (NTDDI_VERSION >= NTDDI_LONGHORN)
1478     EX_PUSH_LOCK MemoryLimitsLock;
1479 #endif
1480     LIST_ENTRY JobSetLinks;
1481     ULONG MemberLevel;
1482     ULONG JobFlags;
1483 } EJOB, *PEJOB;
1484 #include <poppack.h>
1485
1486 //
1487 // Win32K Callback Registration Data
1488 //
1489 typedef struct _WIN32_POWEREVENT_PARAMETERS
1490 {
1491     PSPOWEREVENTTYPE EventNumber;
1492     ULONG Code;
1493 } WIN32_POWEREVENT_PARAMETERS, *PWIN32_POWEREVENT_PARAMETERS;
1494
1495 typedef struct _WIN32_POWERSTATE_PARAMETERS
1496 {
1497     UCHAR Promotion;
1498     POWER_ACTION SystemAction;
1499     SYSTEM_POWER_STATE MinSystemState;
1500     ULONG Flags;
1501     POWERSTATETASK PowerStateTask;
1502 } WIN32_POWERSTATE_PARAMETERS, *PWIN32_POWERSTATE_PARAMETERS;
1503
1504 typedef struct _WIN32_JOBCALLOUT_PARAMETERS
1505 {
1506     PVOID Job;
1507     PSW32JOBCALLOUTTYPE CalloutType;
1508     PVOID Data;
1509 } WIN32_JOBCALLOUT_PARAMETERS, *PWIN32_JOBCALLOUT_PARAMETERS;
1510
1511 typedef struct _WIN32_OPENMETHOD_PARAMETERS
1512 {
1513     OB_OPEN_REASON OpenReason;
1514     PEPROCESS Process;
1515     PVOID Object;
1516     ULONG GrantedAccess;
1517     ULONG HandleCount;
1518 } WIN32_OPENMETHOD_PARAMETERS, *PWIN32_OPENMETHOD_PARAMETERS;
1519
1520 typedef struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS
1521 {
1522     PEPROCESS Process;
1523     PVOID Object;
1524     HANDLE Handle;
1525     KPROCESSOR_MODE PreviousMode;
1526 } WIN32_OKAYTOCLOSEMETHOD_PARAMETERS, *PWIN32_OKAYTOCLOSEMETHOD_PARAMETERS;
1527
1528 typedef struct _WIN32_CLOSEMETHOD_PARAMETERS
1529 {
1530     PEPROCESS Process;
1531     PVOID Object;
1532     ACCESS_MASK AccessMask;
1533     ULONG ProcessHandleCount;
1534     ULONG SystemHandleCount;
1535 } WIN32_CLOSEMETHOD_PARAMETERS, *PWIN32_CLOSEMETHOD_PARAMETERS;
1536
1537 typedef struct _WIN32_DELETEMETHOD_PARAMETERS
1538 {
1539     PVOID Object;
1540 } WIN32_DELETEMETHOD_PARAMETERS, *PWIN32_DELETEMETHOD_PARAMETERS;
1541
1542 typedef struct _WIN32_PARSEMETHOD_PARAMETERS
1543 {
1544     PVOID ParseObject;
1545     PVOID ObjectType;
1546     PACCESS_STATE AccessState;
1547     KPROCESSOR_MODE AccessMode;
1548     ULONG Attributes;
1549     OUT PUNICODE_STRING CompleteName;
1550     PUNICODE_STRING RemainingName;
1551     PVOID Context;
1552     PSECURITY_QUALITY_OF_SERVICE SecurityQos;
1553     PVOID *Object;
1554 } WIN32_PARSEMETHOD_PARAMETERS, *PWIN32_PARSEMETHOD_PARAMETERS;
1555
1556 typedef struct _WIN32_CALLOUTS_FPNS
1557 {
1558     PKWIN32_PROCESS_CALLOUT ProcessCallout;
1559     PKWIN32_THREAD_CALLOUT ThreadCallout;
1560     PKWIN32_GLOBALATOMTABLE_CALLOUT GlobalAtomTableCallout;
1561     PKWIN32_POWEREVENT_CALLOUT PowerEventCallout;
1562     PKWIN32_POWERSTATE_CALLOUT PowerStateCallout;
1563     PKWIN32_JOB_CALLOUT JobCallout;
1564     PGDI_BATCHFLUSH_ROUTINE BatchFlushRoutine;
1565     PKWIN32_OPENMETHOD_CALLOUT DesktopOpenProcedure;
1566     PKWIN32_OKTOCLOSEMETHOD_CALLOUT DesktopOkToCloseProcedure;
1567     PKWIN32_CLOSEMETHOD_CALLOUT DesktopCloseProcedure;
1568     PKWIN32_DELETEMETHOD_CALLOUT DesktopDeleteProcedure;
1569     PKWIN32_OKTOCLOSEMETHOD_CALLOUT WindowStationOkToCloseProcedure;
1570     PKWIN32_CLOSEMETHOD_CALLOUT WindowStationCloseProcedure;
1571     PKWIN32_DELETEMETHOD_CALLOUT WindowStationDeleteProcedure;
1572     PKWIN32_PARSEMETHOD_CALLOUT WindowStationParseProcedure;
1573     PKWIN32_OPENMETHOD_CALLOUT WindowStationOpenProcedure;
1574     PKWIN32_WIN32DATACOLLECTION_CALLOUT Win32DataCollectionProcedure;
1575 } WIN32_CALLOUTS_FPNS, *PWIN32_CALLOUTS_FPNS;
1576
1577 #endif // !NTOS_MODE_USER
1578
1579 #endif // _PSTYPES_H