reactos/include/ndk/pstypes.h

   1 /*++ NDK Version: 0098
   2
   3 Copyright (c) Alex Ionescu.  All rights reserved.
   4
   5 Header Name:
   6
   7     pstypes.h
   8
   9 Abstract:
  10
  11     Type definitions for the Process Manager
  12
  13 Author:
  14
  15     Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
  16
  17 --*/
  18
  19 #ifndef _PSTYPES_H
  20 #define _PSTYPES_H
  21
  22 //
  23 // Dependencies
  24 //
  25 #include <umtypes.h>
  26 #include <ldrtypes.h>
  27 #include <mmtypes.h>
  28 #include <obtypes.h>
  29 #ifndef NTOS_MODE_USER
  30 #include <extypes.h>
  31 #include <setypes.h>
  32 #endif
  33
  34 //
  35 // KUSER_SHARED_DATA location in User Mode
  36 //
  37 #define USER_SHARED_DATA                        (0x7FFE0000)
  38
  39 //
  40 // Kernel Exports
  41 //
  42 #ifndef NTOS_MODE_USER
  43
  44 extern NTSYSAPI struct _EPROCESS* PsInitialSystemProcess;
  45 extern NTSYSAPI POBJECT_TYPE PsProcessType;
  46
  47 #endif
  48
  49 //
  50 // Global Flags
  51 //
  52 #define FLG_STOP_ON_EXCEPTION                   0x00000001
  53 #define FLG_SHOW_LDR_SNAPS                      0x00000002
  54 #define FLG_DEBUG_INITIAL_COMMAND               0x00000004
  55 #define FLG_STOP_ON_HUNG_GUI                    0x00000008
  56 #define FLG_HEAP_ENABLE_TAIL_CHECK              0x00000010
  57 #define FLG_HEAP_ENABLE_FREE_CHECK              0x00000020
  58 #define FLG_HEAP_VALIDATE_PARAMETERS            0x00000040
  59 #define FLG_HEAP_VALIDATE_ALL                   0x00000080
  60 #define FLG_POOL_ENABLE_TAIL_CHECK              0x00000100
  61 #define FLG_POOL_ENABLE_FREE_CHECK              0x00000200
  62 #define FLG_POOL_ENABLE_TAGGING                 0x00000400
  63 #define FLG_HEAP_ENABLE_TAGGING                 0x00000800
  64 #define FLG_USER_STACK_TRACE_DB                 0x00001000
  65 #define FLG_KERNEL_STACK_TRACE_DB               0x00002000
  66 #define FLG_MAINTAIN_OBJECT_TYPELIST            0x00004000
  67 #define FLG_HEAP_ENABLE_TAG_BY_DLL              0x00008000
  68 #define FLG_IGNORE_DEBUG_PRIV                   0x00010000
  69 #define FLG_ENABLE_CSRDEBUG                     0x00020000
  70 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD           0x00040000
  71 #define FLG_DISABLE_PAGE_KERNEL_STACKS          0x00080000
  72 #define FLG_HEAP_ENABLE_CALL_TRACING            0x00100000
  73 #define FLG_HEAP_DISABLE_COALESCING             0x00200000
  74 #define FLG_ENABLE_CLOSE_EXCEPTIONS             0x00400000
  75 #define FLG_ENABLE_EXCEPTION_LOGGING            0x00800000
  76 #define FLG_ENABLE_HANDLE_TYPE_TAGGING          0x01000000
  77 #define FLG_HEAP_PAGE_ALLOCS                    0x02000000
  78 #define FLG_DEBUG_INITIAL_COMMAND_EX            0x04000000
  79 #define FLG_VALID_BITS                          0x07FFFFFF
  80
  81 //
  82 // Process priority classes
  83 //
  84 #define PROCESS_PRIORITY_CLASS_INVALID          0
  85 #define PROCESS_PRIORITY_CLASS_IDLE             1
  86 #define PROCESS_PRIORITY_CLASS_NORMAL           2
  87 #define PROCESS_PRIORITY_CLASS_HIGH             3
  88 #define PROCESS_PRIORITY_CLASS_REALTIME         4
  89 #define PROCESS_PRIORITY_CLASS_BELOW_NORMAL     5
  90 #define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL     6
  91
  92 //
  93 // NtCreateProcessEx flags
  94 //
  95 #define PS_REQUEST_BREAKAWAY                    1
  96 #define PS_NO_DEBUG_INHERIT                     2
  97 #define PS_INHERIT_HANDLES                      4
  98 #define PS_UNKNOWN_VALUE                        8
  99 #define PS_ALL_FLAGS                            (PS_REQUEST_BREAKAWAY | \
 100                                                  PS_NO_DEBUG_INHERIT |  \
 101                                                  PS_INHERIT_HANDLES |   \
 102                                                  PS_UNKNOWN_VALUE)
 103
 104 //
 105 // Process base priorities
 106 //
 107 #define PROCESS_PRIORITY_IDLE                   3
 108 #define PROCESS_PRIORITY_NORMAL                 8
 109 #define PROCESS_PRIORITY_NORMAL_FOREGROUND      9
 110
 111 //
 112 // Number of TLS expansion slots
 113 //
 114 #define TLS_EXPANSION_SLOTS                     64
 115
 116 //
 117 // Process Access Types
 118 //
 119 #ifndef NTOS_MODE_USER
 120 #define PROCESS_TERMINATE                       0x0001
 121 #define PROCESS_CREATE_THREAD                   0x0002
 122 #define PROCESS_SET_SESSIONID                   0x0004
 123 #define PROCESS_VM_OPERATION                    0x0008
 124 #define PROCESS_VM_READ                         0x0010
 125 #define PROCESS_VM_WRITE                        0x0020
 126 #define PROCESS_CREATE_PROCESS                  0x0080
 127 #define PROCESS_SET_QUOTA                       0x0100
 128 #define PROCESS_SET_INFORMATION                 0x0200
 129 #define PROCESS_QUERY_INFORMATION               0x0400
 130 #define PROCESS_SUSPEND_RESUME                  0x0800
 131 #define PROCESS_QUERY_LIMITED_INFORMATION       0x1000
 132 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 133 #define PROCESS_ALL_ACCESS                      (STANDARD_RIGHTS_REQUIRED | \
 134                                                  SYNCHRONIZE | \
 135                                                  0xFFFF)
 136 #else
 137 #define PROCESS_ALL_ACCESS                      (STANDARD_RIGHTS_REQUIRED | \
 138                                                  SYNCHRONIZE | \
 139                                                  0xFFF)
 140 #endif
 141
 142
 143 //
 144 // Job Access Types
 145 //
 146 #define JOB_OBJECT_ASSIGN_PROCESS               0x1
 147 #define JOB_OBJECT_SET_ATTRIBUTES               0x2
 148 #define JOB_OBJECT_QUERY                        0x4
 149 #define JOB_OBJECT_TERMINATE                    0x8
 150 #define JOB_OBJECT_SET_SECURITY_ATTRIBUTES      0x10
 151 #define JOB_OBJECT_ALL_ACCESS                   (STANDARD_RIGHTS_REQUIRED | \
 152                                                  SYNCHRONIZE | \
 153                                                  31)
 154 #endif
 155
 156 #ifdef NTOS_MODE_USER
 157 //
 158 // Current Process/Thread built-in 'special' handles
 159 //
 160 #define NtCurrentProcess()                      ((HANDLE)(LONG_PTR)-1)
 161 #define ZwCurrentProcess()                      NtCurrentProcess()
 162 #define NtCurrentThread()                       ((HANDLE)(LONG_PTR)-2)
 163 #define ZwCurrentThread()                       NtCurrentThread()
 164
 165 //
 166 // Process/Thread/Job Information Classes for NtQueryInformationProcess/Thread/Job
 167 //
 168 typedef enum _PROCESSINFOCLASS
 169 {
 170     ProcessBasicInformation,
 171     ProcessQuotaLimits,
 172     ProcessIoCounters,
 173     ProcessVmCounters,
 174     ProcessTimes,
 175     ProcessBasePriority,
 176     ProcessRaisePriority,
 177     ProcessDebugPort,
 178     ProcessExceptionPort,
 179     ProcessAccessToken,
 180     ProcessLdtInformation,
 181     ProcessLdtSize,
 182     ProcessDefaultHardErrorMode,
 183     ProcessIoPortHandlers,
 184     ProcessPooledUsageAndLimits,
 185     ProcessWorkingSetWatch,
 186     ProcessUserModeIOPL,
 187     ProcessEnableAlignmentFaultFixup,
 188     ProcessPriorityClass,
 189     ProcessWx86Information,
 190     ProcessHandleCount,
 191     ProcessAffinityMask,
 192     ProcessPriorityBoost,
 193     ProcessDeviceMap,
 194     ProcessSessionInformation,
 195     ProcessForegroundInformation,
 196     ProcessWow64Information,
 197     ProcessImageFileName,
 198     ProcessLUIDDeviceMapsEnabled,
 199     ProcessBreakOnTermination,
 200     ProcessDebugObjectHandle,
 201     ProcessDebugFlags,
 202     ProcessHandleTracing,
 203     ProcessIoPriority,
 204     ProcessExecuteFlags,
 205     ProcessTlsInformation,
 206     ProcessCookie,
 207     ProcessImageInformation,
 208     ProcessCycleTime,
 209     ProcessPagePriority,
 210     ProcessInstrumentationCallback,
 211     MaxProcessInfoClass
 212 } PROCESSINFOCLASS;
 213
 214 typedef enum _THREADINFOCLASS
 215 {
 216     ThreadBasicInformation,
 217     ThreadTimes,
 218     ThreadPriority,
 219     ThreadBasePriority,
 220     ThreadAffinityMask,
 221     ThreadImpersonationToken,
 222     ThreadDescriptorTableEntry,
 223     ThreadEnableAlignmentFaultFixup,
 224     ThreadEventPair_Reusable,
 225     ThreadQuerySetWin32StartAddress,
 226     ThreadZeroTlsCell,
 227     ThreadPerformanceCount,
 228     ThreadAmILastThread,
 229     ThreadIdealProcessor,
 230     ThreadPriorityBoost,
 231     ThreadSetTlsArrayAddress,
 232     ThreadIsIoPending,
 233     ThreadHideFromDebugger,
 234     ThreadBreakOnTermination,
 235     ThreadSwitchLegacyState,
 236     ThreadIsTerminated,
 237     ThreadLastSystemCall,
 238     ThreadIoPriority,
 239     ThreadCycleTime,
 240     ThreadPagePriority,
 241     ThreadActualBasePriority,
 242     ThreadTebInformation,
 243     ThreadCSwitchMon,
 244     MaxThreadInfoClass
 245 } THREADINFOCLASS;
 246
 247 #else
 248
 249 typedef enum _JOBOBJECTINFOCLASS
 250 {
 251     JobObjectBasicAccountingInformation = 1,
 252     JobObjectBasicLimitInformation,
 253     JobObjectBasicProcessIdList,
 254     JobObjectBasicUIRestrictions,
 255     JobObjectSecurityLimitInformation,
 256     JobObjectEndOfJobTimeInformation,
 257     JobObjectAssociateCompletionPortInformation,
 258     JobObjectBasicAndIoAccountingInformation,
 259     JobObjectExtendedLimitInformation,
 260     JobObjectJobSetInformation,
 261     MaxJobObjectInfoClass
 262 } JOBOBJECTINFOCLASS;
 263
 264 //
 265 // Power Event Events for Win32K Power Event Callback
 266 //
 267 typedef enum _PSPOWEREVENTTYPE
 268 {
 269     PsW32FullWake = 0,
 270     PsW32EventCode = 1,
 271     PsW32PowerPolicyChanged = 2,
 272     PsW32SystemPowerState = 3,
 273     PsW32SystemTime = 4,
 274     PsW32DisplayState = 5,
 275     PsW32CapabilitiesChanged = 6,
 276     PsW32SetStateFailed = 7,
 277     PsW32GdiOff = 8,
 278     PsW32GdiOn = 9,
 279     PsW32GdiPrepareResumeUI = 10,
 280     PsW32GdiOffRequest = 11,
 281     PsW32MonitorOff = 12,
 282 } PSPOWEREVENTTYPE;
 283
 284 //
 285 // Power State Tasks for Win32K Power State Callback
 286 //
 287 typedef enum _POWERSTATETASK
 288 {
 289     PowerState_BlockSessionSwitch = 0,
 290     PowerState_Init = 1,
 291     PowerState_QueryApps = 2,
 292     PowerState_QueryServices = 3,
 293     PowerState_QueryAppsFailed = 4,
 294     PowerState_QueryServicesFailed = 5,
 295     PowerState_SuspendApps = 6,
 296     PowerState_SuspendServices = 7,
 297     PowerState_ShowUI = 8,
 298     PowerState_NotifyWL = 9,
 299     PowerState_ResumeApps = 10,
 300     PowerState_ResumeServices = 11,
 301     PowerState_UnBlockSessionSwitch = 12,
 302     PowerState_End = 13,
 303     PowerState_BlockInput = 14,
 304     PowerState_UnblockInput = 15,
 305 } POWERSTATETASK;
 306
 307 //
 308 // Win32K Job Callback Types
 309 //
 310 typedef enum _PSW32JOBCALLOUTTYPE
 311 {
 312    PsW32JobCalloutSetInformation = 0,
 313    PsW32JobCalloutAddProcess = 1,
 314    PsW32JobCalloutTerminate = 2,
 315 } PSW32JOBCALLOUTTYPE;
 316
 317 //
 318 // Win32K Thread Callback Types
 319 //
 320 typedef enum _PSW32THREADCALLOUTTYPE
 321 {
 322     PsW32ThreadCalloutInitialize,
 323     PsW32ThreadCalloutExit,
 324 } PSW32THREADCALLOUTTYPE;
 325
 326 //
 327 // Declare empty structure definitions so that they may be referenced by
 328 // routines before they are defined
 329 //
 330 struct _W32THREAD;
 331 struct _W32PROCESS;
 332 struct _ETHREAD;
 333 struct _WIN32_POWEREVENT_PARAMETERS;
 334 struct _WIN32_POWERSTATE_PARAMETERS;
 335 struct _WIN32_JOBCALLOUT_PARAMETERS;
 336 struct _WIN32_OPENMETHOD_PARAMETERS;
 337 struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS;
 338 struct _WIN32_CLOSEMETHOD_PARAMETERS;
 339 struct _WIN32_DELETEMETHOD_PARAMETERS;
 340 struct _WIN32_PARSEMETHOD_PARAMETERS;
 341
 342 //
 343 // Win32K Process and Thread Callbacks
 344 //
 345 typedef
 346 NTSTATUS
 347 (NTAPI *PKWIN32_PROCESS_CALLOUT)(
 348     struct _EPROCESS *Process,
 349     BOOLEAN Create
 350 );
 351
 352 typedef
 353 NTSTATUS
 354 (NTAPI *PKWIN32_THREAD_CALLOUT)(
 355     struct _ETHREAD *Thread,
 356     PSW32THREADCALLOUTTYPE Type
 357 );
 358
 359 typedef
 360 NTSTATUS
 361 (NTAPI *PKWIN32_GLOBALATOMTABLE_CALLOUT)(
 362     VOID
 363 );
 364
 365 typedef
 366 NTSTATUS
 367 (NTAPI *PKWIN32_POWEREVENT_CALLOUT)(
 368     struct _WIN32_POWEREVENT_PARAMETERS *Parameters
 369 );
 370
 371 typedef
 372 NTSTATUS
 373 (NTAPI *PKWIN32_POWERSTATE_CALLOUT)(
 374     struct _WIN32_POWERSTATE_PARAMETERS *Parameters
 375 );
 376
 377 typedef
 378 NTSTATUS
 379 (NTAPI *PKWIN32_JOB_CALLOUT)(
 380     struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters
 381 );
 382
 383 typedef
 384 NTSTATUS
 385 (NTAPI *PGDI_BATCHFLUSH_ROUTINE)(
 386     VOID
 387 );
 388
 389 typedef
 390 NTSTATUS
 391 (NTAPI *PKWIN32_OPENMETHOD_CALLOUT)(
 392     struct _WIN32_OPENMETHOD_PARAMETERS *Parameters
 393 );
 394
 395 typedef
 396 NTSTATUS
 397 (NTAPI *PKWIN32_OKTOCLOSEMETHOD_CALLOUT)(
 398     struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters
 399 );
 400
 401 typedef
 402 NTSTATUS
 403 (NTAPI *PKWIN32_CLOSEMETHOD_CALLOUT)(
 404     struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters
 405 );
 406
 407 typedef
 408 VOID
 409 (NTAPI *PKWIN32_DELETEMETHOD_CALLOUT)(
 410     struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters
 411 );
 412
 413 typedef
 414 NTSTATUS
 415 (NTAPI *PKWIN32_PARSEMETHOD_CALLOUT)(
 416     struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters
 417 );
 418
 419 typedef
 420 NTSTATUS
 421 (NTAPI *PKWIN32_WIN32DATACOLLECTION_CALLOUT)(
 422     struct _EPROCESS *Process,
 423     PVOID Callback,
 424     PVOID Context
 425 );
 426
 427 #endif
 428
 429 typedef NTSTATUS
 430 (NTAPI *PPOST_PROCESS_INIT_ROUTINE)(
 431     VOID
 432 );
 433
 434 #ifdef NTOS_MODE_USER
 435
 436 //
 437 // ClientID Structure
 438 //
 439 typedef struct _CLIENT_ID
 440 {
 441     HANDLE UniqueProcess;
 442     HANDLE UniqueThread;
 443 } CLIENT_ID, *PCLIENT_ID;
 444
 445 #endif
 446
 447 //
 448 // Descriptor Table Entry Definition
 449 //
 450 #define _DESCRIPTOR_TABLE_ENTRY_DEFINED
 451 typedef struct _DESCRIPTOR_TABLE_ENTRY
 452 {
 453     ULONG Selector;
 454     LDT_ENTRY Descriptor;
 455 } DESCRIPTOR_TABLE_ENTRY, *PDESCRIPTOR_TABLE_ENTRY;
 456
 457 //
 458 // PEB Lock Routine
 459 //
 460 typedef VOID
 461 (NTAPI *PPEBLOCKROUTINE)(
 462     PVOID PebLock
 463 );
 464
 465 //
 466 // PEB Free Block Descriptor
 467 //
 468 typedef struct _PEB_FREE_BLOCK
 469 {
 470     struct _PEB_FREE_BLOCK* Next;
 471     ULONG Size;
 472 } PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
 473
 474 //
 475 // Process Environment Block (PEB)
 476 //
 477 typedef struct _PEB
 478 {
 479     UCHAR InheritedAddressSpace;
 480     UCHAR ReadImageFileExecOptions;
 481     UCHAR BeingDebugged;
 482 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 483     struct
 484     {
 485         UCHAR ImageUsesLargePages:1;
 486         UCHAR IsProtectedProcess:1;
 487         UCHAR IsLegacyProcess:1;
 488         UCHAR SpareBits:5;
 489     };
 490 #else
 491     BOOLEAN SpareBool;
 492 #endif
 493     HANDLE Mutant;
 494     PVOID ImageBaseAddress;
 495     PPEB_LDR_DATA Ldr;
 496     struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters;
 497     PVOID SubSystemData;
 498     PVOID ProcessHeap;
 499 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 500     struct _RTL_CRITICAL_SECTION *FastPebLock;
 501     PVOID AltThunkSListPtr;
 502     PVOID IFEOKey;
 503     ULONG Spare;
 504     union
 505     {
 506         PVOID* KernelCallbackTable;
 507         PVOID UserSharedInfoPtr;
 508     };
 509     ULONG SystemReserved[1];
 510     ULONG SpareUlong;
 511 #else
 512     PVOID FastPebLock;
 513     PPEBLOCKROUTINE FastPebLockRoutine;
 514     PPEBLOCKROUTINE FastPebUnlockRoutine;
 515     ULONG EnvironmentUpdateCount;
 516     PVOID* KernelCallbackTable;
 517     PVOID EventLogSection;
 518     PVOID EventLog;
 519 #endif
 520     PPEB_FREE_BLOCK FreeList;
 521     ULONG TlsExpansionCounter;
 522     PVOID TlsBitmap;
 523     ULONG TlsBitmapBits[0x2];
 524     PVOID ReadOnlySharedMemoryBase;
 525     PVOID ReadOnlySharedMemoryHeap;
 526     PVOID* ReadOnlyStaticServerData;
 527     PVOID AnsiCodePageData;
 528     PVOID OemCodePageData;
 529     PVOID UnicodeCaseTableData;
 530     ULONG NumberOfProcessors;
 531     ULONG NtGlobalFlag;
 532     LARGE_INTEGER CriticalSectionTimeout;
 533     ULONG HeapSegmentReserve;
 534     ULONG HeapSegmentCommit;
 535     ULONG HeapDeCommitTotalFreeThreshold;
 536     ULONG HeapDeCommitFreeBlockThreshold;
 537     ULONG NumberOfHeaps;
 538     ULONG MaximumNumberOfHeaps;
 539     PVOID* ProcessHeaps;
 540     PVOID GdiSharedHandleTable;
 541     PVOID ProcessStarterHelper;
 542     PVOID GdiDCAttributeList;
 543 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 544     struct _RTL_CRITICAL_SECTION *LoaderLock;
 545 #else
 546     PVOID LoaderLock;
 547 #endif
 548     ULONG OSMajorVersion;
 549     ULONG OSMinorVersion;
 550     USHORT OSBuildNumber;
 551     USHORT OSCSDVersion;
 552     ULONG OSPlatformId;
 553     ULONG ImageSubSystem;
 554     ULONG ImageSubSystemMajorVersion;
 555     ULONG ImageSubSystemMinorVersion;
 556     ULONG ImageProcessAffinityMask;
 557     ULONG GdiHandleBuffer[0x22];
 558     PPOST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
 559     struct _RTL_BITMAP *TlsExpansionBitmap;
 560     ULONG TlsExpansionBitmapBits[0x20];
 561     ULONG SessionId;
 562 #if (NTDDI_VERSION >= NTDDI_WINXP)
 563     ULARGE_INTEGER AppCompatFlags;
 564     ULARGE_INTEGER AppCompatFlagsUser;
 565     PVOID pShimData;
 566     PVOID AppCompatInfo;
 567     UNICODE_STRING CSDVersion;
 568     struct _ACTIVATION_CONTEXT_DATA *ActivationContextData;
 569     struct _ASSEMBLY_STORAGE_MAP *ProcessAssemblyStorageMap;
 570     struct _ACTIVATION_CONTEXT_DATA *SystemDefaultActivationContextData;
 571     struct _ASSEMBLY_STORAGE_MAP *SystemAssemblyStorageMap;
 572     ULONG MinimumStackCommit;
 573 #endif
 574 #if (NTDDI_VERSION >= NTDDI_WS03)
 575     PVOID *FlsCallback;
 576     LIST_ENTRY FlsListHead;
 577     struct _RTL_BITMAP *FlsBitmap;
 578     ULONG FlsBitmapBits[4];
 579     ULONG FlsHighIndex;
 580 #endif
 581 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 582     PVOID WerRegistrationData;
 583     PVOID WerShipAssertPtr;
 584 #endif
 585 } PEB, *PPEB;
 586
 587 //
 588 // GDI Batch Descriptor
 589 //
 590 typedef struct _GDI_TEB_BATCH
 591 {
 592     ULONG Offset;
 593     ULONG HDC;
 594     ULONG Buffer[0x136];
 595 } GDI_TEB_BATCH, *PGDI_TEB_BATCH;
 596
 597 //
 598 // Initial TEB
 599 //
 600 typedef struct _INITIAL_TEB
 601 {
 602     PVOID PreviousStackBase;
 603     PVOID PreviousStackLimit;
 604     PVOID StackBase;
 605     PVOID StackLimit;
 606     PVOID AllocatedStackBase;
 607 } INITIAL_TEB, *PINITIAL_TEB;
 608
 609 //
 610 // TEB Active Frame Structures
 611 //
 612 typedef struct _TEB_ACTIVE_FRAME_CONTEXT
 613 {
 614     ULONG Flags;
 615     LPSTR FrameName;
 616 } TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;
 617
 618 typedef struct _TEB_ACTIVE_FRAME
 619 {
 620     ULONG Flags;
 621     struct _TEB_ACTIVE_FRAME *Previous;
 622     PTEB_ACTIVE_FRAME_CONTEXT Context;
 623 } TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
 624
 625 //
 626 // Thread Environment Block (TEB)
 627 //
 628 typedef struct _TEB
 629 {
 630     NT_TIB Tib;
 631     PVOID EnvironmentPointer;
 632     CLIENT_ID Cid;
 633     PVOID ActiveRpcHandle;
 634     PVOID ThreadLocalStoragePointer;
 635     struct _PEB *ProcessEnvironmentBlock;
 636     ULONG LastErrorValue;
 637     ULONG CountOfOwnedCriticalSections;
 638     PVOID CsrClientThread;
 639     struct _W32THREAD* Win32ThreadInfo;
 640     ULONG User32Reserved[0x1A];
 641     ULONG UserReserved[5];
 642     PVOID WOW32Reserved;
 643     LCID CurrentLocale;
 644     ULONG FpSoftwareStatusRegister;
 645     PVOID SystemReserved1[0x36];
 646     LONG ExceptionCode;
 647     struct _ACTIVATION_CONTEXT_STACK *ActivationContextStackPointer;
 648     UCHAR SpareBytes1[0x24];
 649     ULONG TxFsContext;
 650     GDI_TEB_BATCH GdiTebBatch;
 651     CLIENT_ID RealClientId;
 652     PVOID GdiCachedProcessHandle;
 653     ULONG GdiClientPID;
 654     ULONG GdiClientTID;
 655     PVOID GdiThreadLocalInfo;
 656     ULONG Win32ClientInfo[62];
 657     PVOID glDispatchTable[0xE9];
 658     ULONG glReserved1[0x1D];
 659     PVOID glReserved2;
 660     PVOID glSectionInfo;
 661     PVOID glSection;
 662     PVOID glTable;
 663     PVOID glCurrentRC;
 664     PVOID glContext;
 665     NTSTATUS LastStatusValue;
 666     UNICODE_STRING StaticUnicodeString;
 667     WCHAR StaticUnicodeBuffer[0x105];
 668     PVOID DeallocationStack;
 669     PVOID TlsSlots[0x40];
 670     LIST_ENTRY TlsLinks;
 671     PVOID Vdm;
 672     PVOID ReservedForNtRpc;
 673     PVOID DbgSsReserved[0x2];
 674     ULONG HardErrorDisabled;
 675     PVOID Instrumentation[9];
 676     GUID ActivityId;
 677     PVOID SubProcessTag;
 678     PVOID EtwTraceData;
 679     PVOID WinSockData;
 680     ULONG GdiBatchCount;
 681 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 682     BOOLEAN SpareBool0;
 683     BOOLEAN SpareBool1;
 684     BOOLEAN SpareBool2;
 685 #else
 686     BOOLEAN InDbgPrint;
 687     BOOLEAN FreeStackOnTermination;
 688     BOOLEAN HasFiberData;
 689 #endif
 690     UCHAR IdealProcessor;
 691     ULONG GuaranteedStackBytes;
 692     PVOID ReservedForPerf;
 693     PVOID ReservedForOle;
 694     ULONG WaitingOnLoaderLock;
 695 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 696     PVOID SavedPriorityState;
 697 #else
 698     ULONG SparePointer1;
 699 #endif
 700     ULONG SoftPatchPtr1;
 701     ULONG SoftPatchPtr2;
 702     PVOID *TlsExpansionSlots;
 703     ULONG ImpersionationLocale;
 704     ULONG IsImpersonating;
 705     PVOID NlsCache;
 706     PVOID pShimData;
 707     ULONG HeapVirualAffinity;
 708     PVOID CurrentTransactionHandle;
 709     PTEB_ACTIVE_FRAME ActiveFrame;
 710 #if (NTDDI_VERSION >= NTDDI_WS03)
 711     PVOID FlsData;
 712 #endif
 713 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 714     PVOID PreferredLangauges;
 715     PVOID UserPrefLanguages;
 716     PVOID MergedPrefLanguages;
 717     ULONG MuiImpersonation;
 718     union
 719     {
 720         struct
 721         {
 722             USHORT SpareCrossTebFlags:16;
 723         };
 724         USHORT CrossTebFlags;
 725     };
 726     union
 727     {
 728         struct
 729         {
 730             USHORT DbgSafeThunkCall:1;
 731             USHORT DbgInDebugPrint:1;
 732             USHORT DbgHasFiberData:1;
 733             USHORT DbgSkipThreadAttach:1;
 734             USHORT DbgWerInShipAssertCode:1;
 735             USHORT DbgIssuedInitialBp:1;
 736             USHORT DbgClonedThread:1;
 737             USHORT SpareSameTebBits:9;
 738         };
 739         USHORT SameTebFlags;
 740     };
 741     PVOID TxnScopeEntercallback;
 742     PVOID TxnScopeExitCAllback;
 743     PVOID TxnScopeContext;
 744     ULONG LockCount;
 745     ULONG ProcessRundown;
 746     ULONGLONG LastSwitchTime;
 747     ULONGLONG TotalSwitchOutTime;
 748     LARGE_INTEGER WaitReasonBitMap;
 749 #else
 750     UCHAR SafeThunkCall;
 751     UCHAR BooleanSpare[3];
 752 #endif
 753 } TEB, *PTEB;
 754
 755 #ifdef NTOS_MODE_USER
 756
 757 //
 758 // Process Information Structures for NtQueryProcessInformation
 759 //
 760 typedef struct _PROCESS_BASIC_INFORMATION
 761 {
 762     NTSTATUS ExitStatus;
 763     PPEB PebBaseAddress;
 764     ULONG_PTR AffinityMask;
 765     KPRIORITY BasePriority;
 766     ULONG_PTR UniqueProcessId;
 767     ULONG_PTR InheritedFromUniqueProcessId;
 768 } PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION;
 769
 770 typedef struct _PROCESS_ACCESS_TOKEN
 771 {
 772     HANDLE Token;
 773     HANDLE Thread;
 774 } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
 775
 776 typedef struct _PROCESS_DEVICEMAP_INFORMATION
 777 {
 778     union
 779     {
 780         struct
 781         {
 782             HANDLE DirectoryHandle;
 783         } Set;
 784         struct
 785         {
 786             ULONG DriveMap;
 787             UCHAR DriveType[32];
 788         } Query;
 789     };
 790 } PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION;
 791
 792 typedef struct _KERNEL_USER_TIMES
 793 {
 794     LARGE_INTEGER CreateTime;
 795     LARGE_INTEGER ExitTime;
 796     LARGE_INTEGER KernelTime;
 797     LARGE_INTEGER UserTime;
 798 } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
 799
 800 typedef struct _PROCESS_SESSION_INFORMATION
 801 {
 802     ULONG SessionId;
 803 } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
 804
 805 #endif
 806
 807 typedef struct _PROCESS_PRIORITY_CLASS
 808 {
 809     BOOLEAN Foreground;
 810     UCHAR PriorityClass;
 811 } PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;
 812
 813 //
 814 // Thread Information Structures for NtQueryProcessInformation
 815 //
 816 typedef struct _THREAD_BASIC_INFORMATION
 817 {
 818     NTSTATUS ExitStatus;
 819     PVOID TebBaseAddress;
 820     CLIENT_ID ClientId;
 821     KAFFINITY AffinityMask;
 822     KPRIORITY Priority;
 823     KPRIORITY BasePriority;
 824 } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
 825
 826 #ifndef NTOS_MODE_USER
 827
 828 //
 829 // EPROCESS Quota Structures
 830 //
 831 typedef struct _EPROCESS_QUOTA_ENTRY
 832 {
 833     SIZE_T Usage;
 834     SIZE_T Limit;
 835     SIZE_T Peak;
 836     SIZE_T Return;
 837 } EPROCESS_QUOTA_ENTRY, *PEPROCESS_QUOTA_ENTRY;
 838
 839 typedef struct _EPROCESS_QUOTA_BLOCK
 840 {
 841     EPROCESS_QUOTA_ENTRY QuotaEntry[3];
 842     LIST_ENTRY QuotaList;
 843     ULONG ReferenceCount;
 844     ULONG ProcessCount;
 845 } EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;
 846
 847 //
 848 // Process Pagefault History
 849 //
 850 typedef struct _PAGEFAULT_HISTORY
 851 {
 852     ULONG CurrentIndex;
 853     ULONG MapIndex;
 854     KSPIN_LOCK SpinLock;
 855     PVOID Reserved;
 856     PROCESS_WS_WATCH_INFORMATION WatchInfo[1];
 857 } PAGEFAULT_HISTORY, *PPAGEFAULT_HISTORY;
 858
 859 //
 860 // Process Impersonation Information
 861 //
 862 typedef struct _PS_IMPERSONATION_INFORMATION
 863 {
 864     PACCESS_TOKEN Token;
 865     BOOLEAN CopyOnOpen;
 866     BOOLEAN EffectiveOnly;
 867     SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
 868 } PS_IMPERSONATION_INFORMATION, *PPS_IMPERSONATION_INFORMATION;
 869
 870 //
 871 // Process Termination Port
 872 //
 873 typedef struct _TERMINATION_PORT
 874 {
 875     struct _TERMINATION_PORT *Next;
 876     PVOID Port;
 877 } TERMINATION_PORT, *PTERMINATION_PORT;
 878
 879 //
 880 // Per-Process APC Rate Limiting
 881 //
 882 typedef struct _PSP_RATE_APC
 883 {
 884     union
 885     {
 886         SINGLE_LIST_ENTRY NextApc;
 887         ULONGLONG ExcessCycles;
 888     };
 889     ULONGLONG TargetGEneration;
 890     KAPC RateApc;
 891 } PSP_RATE_APC, *PPSP_RATE_APC;
 892
 893 //
 894 // Executive Thread (ETHREAD)
 895 //
 896 #include <pshpack4.h>
 897 typedef struct _ETHREAD
 898 {
 899     KTHREAD Tcb;
 900     PVOID Padding;
 901     LARGE_INTEGER CreateTime;
 902     union
 903     {
 904         LARGE_INTEGER ExitTime;
 905         LIST_ENTRY LpcReplyChain;
 906         LIST_ENTRY KeyedWaitChain;
 907     };
 908     union
 909     {
 910         NTSTATUS ExitStatus;
 911         PVOID OfsChain;
 912     };
 913     LIST_ENTRY PostBlockList;
 914     union
 915     {
 916         struct _TERMINATION_PORT *TerminationPort;
 917         struct _ETHREAD *ReaperLink;
 918         PVOID KeyedWaitValue;
 919 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 920         PVOID Win32StartParameter;
 921 #endif
 922     };
 923     KSPIN_LOCK ActiveTimerListLock;
 924     LIST_ENTRY ActiveTimerListHead;
 925     CLIENT_ID Cid;
 926 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 927     KSEMAPHORE KeyedWaitSemaphore;
 928 #else
 929     union
 930     {
 931         KSEMAPHORE LpcReplySemaphore;
 932         KSEMAPHORE KeyedReplySemaphore;
 933     };
 934     union
 935     {
 936         PVOID LpcReplyMessage;
 937         PVOID LpcWaitingOnPort;
 938     };
 939 #endif
 940     PPS_IMPERSONATION_INFORMATION ImpersonationInfo;
 941     LIST_ENTRY IrpList;
 942     ULONG TopLevelIrp;
 943     PDEVICE_OBJECT DeviceToVerify;
 944 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 945     PPSP_RATE_APC RateControlApc;
 946 #else
 947     struct _EPROCESS *ThreadsProcess;
 948 #endif
 949     PVOID Win32StartAddress;
 950     union
 951     {
 952         PKSTART_ROUTINE StartAddress;
 953         ULONG LpcReceivedMessageId;
 954     };
 955     LIST_ENTRY ThreadListEntry;
 956     EX_RUNDOWN_REF RundownProtect;
 957     EX_PUSH_LOCK ThreadLock;
 958 #if (NTDDI_VERSION < NTDDI_LONGHORN)
 959     ULONG LpcReplyMessageId;
 960 #endif
 961     ULONG ReadClusterSize;
 962 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 963     ULONG SpareUlong0;
 964 #else
 965     ACCESS_MASK GrantedAccess;
 966 #endif
 967     union
 968     {
 969         struct
 970         {
 971            ULONG Terminated:1;
 972 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 973            ULONG ThreadInserted:1;
 974 #else
 975            ULONG DeadThread:1;
 976 #endif
 977            ULONG HideFromDebugger:1;
 978            ULONG ActiveImpersonationInfo:1;
 979            ULONG SystemThread:1;
 980            ULONG HardErrorsAreDisabled:1;
 981            ULONG BreakOnTermination:1;
 982            ULONG SkipCreationMsg:1;
 983            ULONG SkipTerminationMsg:1;
 984 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 985            ULONG CreateMsgSent:1;
 986            ULONG ThreadIoPriority:3;
 987            ULONG ThreadPagePriority:3;
 988            ULONG PendingRatecontrol:1;
 989 #endif
 990         };
 991         ULONG CrossThreadFlags;
 992     };
 993     union
 994     {
 995         struct
 996         {
 997            ULONG ActiveExWorker:1;
 998            ULONG ExWorkerCanWaitUser:1;
 999            ULONG MemoryMaker:1;
1000            ULONG KeyedEventInUse:1;
1001 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1002            ULONG RateApcState:2;
1003 #endif
1004         };
1005         ULONG SameThreadPassiveFlags;
1006     };
1007     union
1008     {
1009         struct
1010         {
1011            ULONG LpcReceivedMsgIdValid:1;
1012            ULONG LpcExitThreadCalled:1;
1013 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1014            ULONG Spare:1;
1015 #else
1016            ULONG AddressSpaceOwner:1;
1017 #endif
1018            ULONG OwnsProcessWorkingSetExclusive:1;
1019            ULONG OwnsProcessWorkingSetShared:1;
1020            ULONG OwnsSystemWorkingSetExclusive:1;
1021            ULONG OwnsSystemWorkingSetShared:1;
1022            ULONG OwnsSessionWorkingSetExclusive:1;
1023            ULONG OwnsSessionWorkingSetShared:1;
1024 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1025            ULONG SupressSymbolLoad:1;
1026            ULONG Spare1:3;
1027            ULONG PriorityRegionActive:4;
1028 #else
1029            ULONG ApcNeeded:1;
1030 #endif
1031         };
1032         ULONG SameThreadApcFlags;
1033     };
1034 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1035     UCHAR CacheManagerActive;
1036 #else
1037     UCHAR ForwardClusterOnly;
1038 #endif
1039     UCHAR DisablePageFaultClustering;
1040     UCHAR ActiveFaultCount;
1041 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1042     ULONG AlpcMessageId;
1043     union
1044     {
1045         PVOID AlpcMessage;
1046         ULONG AlpcReceiveAttributeSet;
1047     };
1048     LIST_ENTRY AlpcWaitListEntry;
1049     KSEMAPHORE AlpcWaitSemaphore;
1050     ULONG CacheManagerCount;
1051 #endif
1052 } ETHREAD;
1053
1054 //
1055 // Executive Process (EPROCESS)
1056 //
1057 typedef struct _EPROCESS
1058 {
1059     KPROCESS Pcb;
1060     EX_PUSH_LOCK ProcessLock;
1061     LARGE_INTEGER CreateTime;
1062     LARGE_INTEGER ExitTime;
1063     EX_RUNDOWN_REF RundownProtect;
1064     HANDLE UniqueProcessId;
1065     LIST_ENTRY ActiveProcessLinks;
1066     ULONG QuotaUsage[3];
1067     ULONG QuotaPeak[3];
1068     ULONG CommitCharge;
1069     ULONG PeakVirtualSize;
1070     ULONG VirtualSize;
1071     LIST_ENTRY SessionProcessLinks;
1072     PVOID DebugPort;
1073 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1074     union
1075     {
1076         PVOID ExceptionPortData;
1077         ULONG ExceptionPortValue;
1078         UCHAR ExceptionPortState:3;
1079     };
1080 #else
1081     PVOID ExceptionPort;
1082 #endif
1083     PHANDLE_TABLE ObjectTable;
1084     EX_FAST_REF Token;
1085     ULONG WorkingSetPage;
1086 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1087     EX_PUSH_LOCK AddressCreationLock;
1088     PETHREAD RotateInProgress;
1089 #else
1090     FAST_MUTEX AddressCreationLock; // FIXME: FAST_MUTEX for XP, KGUARDED_MUTEX for 2K3
1091     KSPIN_LOCK HyperSpaceLock;
1092 #endif
1093     PETHREAD ForkInProgress;
1094     ULONG HardwareTrigger;
1095     MM_AVL_TABLE PhysicalVadroot;
1096     PVOID CloneRoot;
1097     ULONG NumberOfPrivatePages;
1098     ULONG NumberOfLockedPages;
1099     PVOID *Win32Process;
1100     struct _EJOB *Job;
1101     PVOID SectionObject;
1102     PVOID SectionBaseAddress;
1103     PEPROCESS_QUOTA_BLOCK QuotaBlock;
1104     PPAGEFAULT_HISTORY WorkingSetWatch;
1105     PVOID Win32WindowStation;
1106     HANDLE InheritedFromUniqueProcessId;
1107     PVOID LdtInformation;
1108     PVOID VadFreeHint;
1109     PVOID VdmObjects;
1110     PVOID DeviceMap;
1111 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1112     ULONG AlpcPagedPoolQuotaCache;
1113     PVOID EtwDataSource;
1114     PVOID FreeTebHint;
1115 #else
1116     PVOID Spare0[3];
1117 #endif
1118     union
1119     {
1120 #ifdef _M_IX86
1121         HARDWARE_PTE_X86 PagedirectoryPte;
1122 #else
1123         HARDWARE_PTE_PPC PagedirectoryPte;
1124 #endif
1125         ULONGLONG Filler;
1126     };
1127     ULONG Session;
1128     CHAR ImageFileName[16];
1129     LIST_ENTRY JobLinks;
1130     PVOID LockedPagesList;
1131     LIST_ENTRY ThreadListHead;
1132     PVOID SecurityPort;
1133     PVOID PaeTop;
1134     ULONG ActiveThreads;
1135 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1136     ULONG ImagePathHash;
1137 #else
1138     ACCESS_MASK GrantedAccess;
1139 #endif
1140     ULONG DefaultHardErrorProcessing;
1141     NTSTATUS LastThreadExitStatus;
1142     struct _PEB* Peb;
1143     EX_FAST_REF PrefetchTrace;
1144     LARGE_INTEGER ReadOperationCount;
1145     LARGE_INTEGER WriteOperationCount;
1146     LARGE_INTEGER OtherOperationCount;
1147     LARGE_INTEGER ReadTransferCount;
1148     LARGE_INTEGER WriteTransferCount;
1149     LARGE_INTEGER OtherTransferCount;
1150     ULONG CommitChargeLimit;
1151     ULONG CommitChargePeak;
1152     PVOID AweInfo;
1153     SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;
1154     MMSUPPORT Vm;
1155     LIST_ENTRY MmProcessLinks;
1156     ULONG ModifiedPageCount;
1157 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1158     union
1159     {
1160         struct
1161         {
1162             ULONG JobNotReallyActive:1;
1163             ULONG AccountingFolded:1;
1164             ULONG NewProcessReported:1;
1165             ULONG ExitProcessReported:1;
1166             ULONG ReportCommitChanges:1;
1167             ULONG LastReportMemory:1;
1168             ULONG ReportPhysicalPageChanges:1;
1169             ULONG HandleTableRundown:1;
1170             ULONG NeedsHandleRundown:1;
1171             ULONG RefTraceEnabled:1;
1172             ULONG NumaAware:1;
1173             ULONG ProtectedProcess:1;
1174             ULONG DefaultPagePriority:3;
1175             ULONG ProcessDeleteSelf:1;
1176             ULONG ProcessVerifierTarget:1;
1177         };
1178         ULONG Flags2;
1179     };
1180 #else
1181     ULONG JobStatus;
1182 #endif
1183     union
1184     {
1185         struct
1186         {
1187             ULONG CreateReported:1;
1188             ULONG NoDebugInherit:1;
1189             ULONG ProcessExiting:1;
1190             ULONG ProcessDelete:1;
1191             ULONG Wow64SplitPages:1;
1192             ULONG VmDeleted:1;
1193             ULONG OutswapEnabled:1;
1194             ULONG Outswapped:1;
1195             ULONG ForkFailed:1;
1196             ULONG Wow64VaSpace4Gb:1;
1197             ULONG AddressSpaceInitialized:2;
1198             ULONG SetTimerResolution:1;
1199             ULONG BreakOnTermination:1;
1200 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1201             ULONG DeprioritizeViews:1;
1202 #else
1203             ULONG SessionCreationUnderway:1;
1204 #endif
1205             ULONG WriteWatch:1;
1206             ULONG ProcessInSession:1;
1207             ULONG OverrideAddressSpace:1;
1208             ULONG HasAddressSpace:1;
1209             ULONG LaunchPrefetched:1;
1210             ULONG InjectInpageErrors:1;
1211             ULONG VmTopDown:1;
1212             ULONG ImageNotifyDone:1;
1213             ULONG PdeUpdateNeeded:1;
1214             ULONG VdmAllowed:1;
1215             ULONG SmapAllowed:1;
1216 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1217             ULONG ProcessInserted:1;
1218 #else
1219             ULONG CreateFailed:1;
1220 #endif
1221             ULONG DefaultIoPriority:3;
1222 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1223             ULONG SparePsFlags1:2;
1224 #else
1225             ULONG Spare1:1;
1226             ULONG Spare2:1;
1227 #endif
1228         };
1229         ULONG Flags;
1230     };
1231     NTSTATUS ExitStatus;
1232 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1233     USHORT Spare7;
1234 #else
1235     USHORT NextPageColor;
1236 #endif
1237     union
1238     {
1239         struct
1240         {
1241             UCHAR SubSystemMinorVersion;
1242             UCHAR SubSystemMajorVersion;
1243         };
1244         USHORT SubSystemVersion;
1245     };
1246     UCHAR PriorityClass;
1247     MM_AVL_TABLE VadRoot;
1248     ULONG Cookie;
1249 } EPROCESS;
1250 #include <poppack.h>
1251
1252 //
1253 // Job Token Filter Data
1254 //
1255 #include <pshpack1.h>
1256 typedef struct _PS_JOB_TOKEN_FILTER
1257 {
1258     ULONG CapturedSidCount;
1259     PSID_AND_ATTRIBUTES CapturedSids;
1260     ULONG CapturedSidsLength;
1261     ULONG CapturedGroupCount;
1262     PSID_AND_ATTRIBUTES CapturedGroups;
1263     ULONG CapturedGroupsLength;
1264     ULONG CapturedPrivilegeCount;
1265     PLUID_AND_ATTRIBUTES CapturedPrivileges;
1266     ULONG CapturedPrivilegesLength;
1267 } PS_JOB_TOKEN_FILTER, *PPS_JOB_TOKEN_FILTER;
1268
1269 //
1270 // Executive Job (EJOB)
1271 //
1272 typedef struct _EJOB
1273 {
1274     KEVENT Event;
1275     LIST_ENTRY JobLinks;
1276     LIST_ENTRY ProcessListHead;
1277     ERESOURCE JobLock;
1278     LARGE_INTEGER TotalUserTime;
1279     LARGE_INTEGER TotalKernelTime;
1280     LARGE_INTEGER ThisPeriodTotalUserTime;
1281     LARGE_INTEGER ThisPeriodTotalKernelTime;
1282     ULONG TotalPageFaultCount;
1283     ULONG TotalProcesses;
1284     ULONG ActiveProcesses;
1285     ULONG TotalTerminatedProcesses;
1286     LARGE_INTEGER PerProcessUserTimeLimit;
1287     LARGE_INTEGER PerJobUserTimeLimit;
1288     ULONG LimitFlags;
1289     ULONG MinimumWorkingSetSize;
1290     ULONG MaximumWorkingSetSize;
1291     ULONG ActiveProcessLimit;
1292     ULONG Affinity;
1293     UCHAR PriorityClass;
1294     ULONG UIRestrictionsClass;
1295     ULONG SecurityLimitFlags;
1296     PVOID Token;
1297     PPS_JOB_TOKEN_FILTER Filter;
1298     ULONG EndOfJobTimeAction;
1299     PVOID CompletionPort;
1300     PVOID CompletionKey;
1301     ULONG SessionId;
1302     ULONG SchedulingClass;
1303     ULONGLONG ReadOperationCount;
1304     ULONGLONG WriteOperationCount;
1305     ULONGLONG OtherOperationCount;
1306     ULONGLONG ReadTransferCount;
1307     ULONGLONG WriteTransferCount;
1308     ULONGLONG OtherTransferCount;
1309     IO_COUNTERS IoInfo;
1310     ULONG ProcessMemoryLimit;
1311     ULONG JobMemoryLimit;
1312     ULONG PeakProcessMemoryUsed;
1313     ULONG PeakJobMemoryUsed;
1314     ULONG CurrentJobMemoryUsed;
1315 #if (NTDDI_VERSION == NTDDI_WINXP)
1316     FAST_MUTEX MemoryLimitsLock;
1317 #elif (NTDDI_VERSION == NTDDI_WS03)
1318     KGUARDED_MUTEX MemoryLimitsLock;
1319 #elif (NTDDI_VERSION >= NTDDI_LONGHORN)
1320     EX_PUSH_LOCK MemoryLimitsLock;
1321 #endif
1322     LIST_ENTRY JobSetLinks;
1323     ULONG MemberLevel;
1324     ULONG JobFlags;
1325 } EJOB, *PEJOB;
1326 #include <poppack.h>
1327
1328 //
1329 // Win32K Callback Registration Data
1330 //
1331 typedef struct _WIN32_POWEREVENT_PARAMETERS
1332 {
1333     PSPOWEREVENTTYPE EventNumber;
1334     ULONG Code;
1335 } WIN32_POWEREVENT_PARAMETERS, *PWIN32_POWEREVENT_PARAMETERS;
1336
1337 typedef struct _WIN32_POWERSTATE_PARAMETERS
1338 {
1339     UCHAR Promotion;
1340     POWER_ACTION SystemAction;
1341     SYSTEM_POWER_STATE MinSystemState;
1342     ULONG Flags;
1343     POWERSTATETASK PowerStateTask;
1344 } WIN32_POWERSTATE_PARAMETERS, *PWIN32_POWERSTATE_PARAMETERS;
1345
1346 typedef struct _WIN32_JOBCALLOUT_PARAMETERS
1347 {
1348     PVOID Job;
1349     PSW32JOBCALLOUTTYPE CalloutType;
1350     PVOID Data;
1351 } WIN32_JOBCALLOUT_PARAMETERS, *PWIN32_JOBCALLOUT_PARAMETERS;
1352
1353 typedef struct _WIN32_OPENMETHOD_PARAMETERS
1354 {
1355     OB_OPEN_REASON OpenReason;
1356     PEPROCESS Process;
1357     PVOID Object;
1358     ULONG GrantedAccess;
1359     ULONG HandleCount;
1360 } WIN32_OPENMETHOD_PARAMETERS, *PWIN32_OPENMETHOD_PARAMETERS;
1361
1362 typedef struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS
1363 {
1364     PEPROCESS Process;
1365     PVOID Object;
1366     HANDLE Handle;
1367     KPROCESSOR_MODE PreviousMode;
1368 } WIN32_OKAYTOCLOSEMETHOD_PARAMETERS, *PWIN32_OKAYTOCLOSEMETHOD_PARAMETERS;
1369
1370 typedef struct _WIN32_CLOSEMETHOD_PARAMETERS
1371 {
1372     PEPROCESS Process;
1373     PVOID Object;
1374     ACCESS_MASK AccessMask;
1375     ULONG ProcessHandleCount;
1376     ULONG SystemHandleCount;
1377 } WIN32_CLOSEMETHOD_PARAMETERS, *PWIN32_CLOSEMETHOD_PARAMETERS;
1378
1379 typedef struct _WIN32_DELETEMETHOD_PARAMETERS
1380 {
1381     PVOID Object;
1382 } WIN32_DELETEMETHOD_PARAMETERS, *PWIN32_DELETEMETHOD_PARAMETERS;
1383
1384 typedef struct _WIN32_PARSEMETHOD_PARAMETERS
1385 {
1386     PVOID ParseObject;
1387     PVOID ObjectType;
1388     PACCESS_STATE AccessState;
1389     KPROCESSOR_MODE AccessMode;
1390     ULONG Attributes;
1391     OUT PUNICODE_STRING CompleteName;
1392     PUNICODE_STRING RemainingName;
1393     PVOID Context;
1394     PSECURITY_QUALITY_OF_SERVICE SecurityQos;
1395     PVOID *Object;
1396 } WIN32_PARSEMETHOD_PARAMETERS, *PWIN32_PARSEMETHOD_PARAMETERS;
1397
1398 typedef struct _WIN32_CALLOUTS_FPNS
1399 {
1400     PKWIN32_PROCESS_CALLOUT ProcessCallout;
1401     PKWIN32_THREAD_CALLOUT ThreadCallout;
1402     PKWIN32_GLOBALATOMTABLE_CALLOUT GlobalAtomTableCallout;
1403     PKWIN32_POWEREVENT_CALLOUT PowerEventCallout;
1404     PKWIN32_POWERSTATE_CALLOUT PowerStateCallout;
1405     PKWIN32_JOB_CALLOUT JobCallout;
1406     PGDI_BATCHFLUSH_ROUTINE BatchFlushRoutine;
1407     PKWIN32_OPENMETHOD_CALLOUT DesktopOpenProcedure;
1408     PKWIN32_OKTOCLOSEMETHOD_CALLOUT DesktopOkToCloseProcedure;
1409     PKWIN32_CLOSEMETHOD_CALLOUT DesktopCloseProcedure;
1410     PKWIN32_DELETEMETHOD_CALLOUT DesktopDeleteProcedure;
1411     PKWIN32_OKTOCLOSEMETHOD_CALLOUT WindowStationOkToCloseProcedure;
1412     PKWIN32_CLOSEMETHOD_CALLOUT WindowStationCloseProcedure;
1413     PKWIN32_DELETEMETHOD_CALLOUT WindowStationDeleteProcedure;
1414     PKWIN32_PARSEMETHOD_CALLOUT WindowStationParseProcedure;
1415     PKWIN32_OPENMETHOD_CALLOUT WindowStationOpenProcedure;
1416     PKWIN32_WIN32DATACOLLECTION_CALLOUT Win32DataCollectionProcedure;
1417 } WIN32_CALLOUTS_FPNS, *PWIN32_CALLOUTS_FPNS;
1418
1419 #endif // !NTOS_MODE_USER
1420
1421 #endif // _PSTYPES_H