reactos/include/ndk/pstypes.h

   1 /*++ NDK Version: 0098
   2
   3 Copyright (c) Alex Ionescu.  All rights reserved.
   4
   5 Header Name:
   6
   7     pstypes.h
   8
   9 Abstract:
  10
  11     Type definitions for the Process Manager
  12
  13 Author:
  14
  15     Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
  16
  17 --*/
  18
  19 #ifndef _PSTYPES_H
  20 #define _PSTYPES_H
  21
  22 //
  23 // Dependencies
  24 //
  25 #include <umtypes.h>
  26 #include <ldrtypes.h>
  27 #include <mmtypes.h>
  28 #include <obtypes.h>
  29 #ifndef NTOS_MODE_USER
  30 #include <extypes.h>
  31 #include <setypes.h>
  32 #endif
  33
  34 //
  35 // KUSER_SHARED_DATA location in User Mode
  36 //
  37 #define USER_SHARED_DATA                        (0x7FFE0000)
  38
  39 //
  40 // Kernel Exports
  41 //
  42 #ifndef NTOS_MODE_USER
  43
  44 //extern NTSYSAPI struct _EPROCESS* PsInitialSystemProcess;
  45 //extern NTSYSAPI POBJECT_TYPE PsProcessType;
  46
  47 #endif
  48
  49 //
  50 // Global Flags
  51 //
  52 #define FLG_STOP_ON_EXCEPTION                   0x00000001
  53 #define FLG_SHOW_LDR_SNAPS                      0x00000002
  54 #define FLG_DEBUG_INITIAL_COMMAND               0x00000004
  55 #define FLG_STOP_ON_HUNG_GUI                    0x00000008
  56 #define FLG_HEAP_ENABLE_TAIL_CHECK              0x00000010
  57 #define FLG_HEAP_ENABLE_FREE_CHECK              0x00000020
  58 #define FLG_HEAP_VALIDATE_PARAMETERS            0x00000040
  59 #define FLG_HEAP_VALIDATE_ALL                   0x00000080
  60 #define FLG_POOL_ENABLE_TAIL_CHECK              0x00000100
  61 #define FLG_POOL_ENABLE_FREE_CHECK              0x00000200
  62 #define FLG_POOL_ENABLE_TAGGING                 0x00000400
  63 #define FLG_HEAP_ENABLE_TAGGING                 0x00000800
  64 #define FLG_USER_STACK_TRACE_DB                 0x00001000
  65 #define FLG_KERNEL_STACK_TRACE_DB               0x00002000
  66 #define FLG_MAINTAIN_OBJECT_TYPELIST            0x00004000
  67 #define FLG_HEAP_ENABLE_TAG_BY_DLL              0x00008000
  68 #define FLG_IGNORE_DEBUG_PRIV                   0x00010000
  69 #define FLG_ENABLE_CSRDEBUG                     0x00020000
  70 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD           0x00040000
  71 #define FLG_DISABLE_PAGE_KERNEL_STACKS          0x00080000
  72 #define FLG_HEAP_ENABLE_CALL_TRACING            0x00100000
  73 #define FLG_HEAP_DISABLE_COALESCING             0x00200000
  74 #define FLG_ENABLE_CLOSE_EXCEPTIONS             0x00400000
  75 #define FLG_ENABLE_EXCEPTION_LOGGING            0x00800000
  76 #define FLG_ENABLE_HANDLE_TYPE_TAGGING          0x01000000
  77 #define FLG_HEAP_PAGE_ALLOCS                    0x02000000
  78 #define FLG_DEBUG_INITIAL_COMMAND_EX            0x04000000
  79 #define FLG_VALID_BITS                          0x07FFFFFF
  80
  81 //
  82 // Process priority classes
  83 //
  84 #define PROCESS_PRIORITY_CLASS_INVALID          0
  85 #define PROCESS_PRIORITY_CLASS_IDLE             1
  86 #define PROCESS_PRIORITY_CLASS_NORMAL           2
  87 #define PROCESS_PRIORITY_CLASS_HIGH             3
  88 #define PROCESS_PRIORITY_CLASS_REALTIME         4
  89 #define PROCESS_PRIORITY_CLASS_BELOW_NORMAL     5
  90 #define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL     6
  91
  92 //
  93 // NtCreateProcessEx flags
  94 //
  95 #define PS_REQUEST_BREAKAWAY                    1
  96 #define PS_NO_DEBUG_INHERIT                     2
  97 #define PS_INHERIT_HANDLES                      4
  98 #define PS_UNKNOWN_VALUE                        8
  99 #define PS_ALL_FLAGS                            (PS_REQUEST_BREAKAWAY | \
 100                                                  PS_NO_DEBUG_INHERIT  | \
 101                                                  PS_INHERIT_HANDLES   | \
 102                                                  PS_UNKNOWN_VALUE)
 103
 104 //
 105 // Process base priorities
 106 //
 107 #define PROCESS_PRIORITY_IDLE                   3
 108 #define PROCESS_PRIORITY_NORMAL                 8
 109 #define PROCESS_PRIORITY_NORMAL_FOREGROUND      9
 110
 111 //
 112 // Process Priority Separation Values (OR)
 113 //
 114 #define PSP_VARIABLE_QUANTUMS                   4
 115 #define PSP_LONG_QUANTUMS                       16
 116
 117 #ifndef NTOS_MODE_USER
 118
 119 //
 120 // Thread Access Types
 121 //
 122 #define THREAD_QUERY_INFORMATION                0x0040
 123 #define THREAD_SET_THREAD_TOKEN                 0x0080
 124 #define THREAD_IMPERSONATE                      0x0100
 125 #define THREAD_DIRECT_IMPERSONATION             0x0200
 126
 127 //
 128 // Process Access Types
 129 //
 130 #define PROCESS_TERMINATE                       0x0001
 131 #define PROCESS_CREATE_THREAD                   0x0002
 132 #define PROCESS_SET_SESSIONID                   0x0004
 133 #define PROCESS_VM_OPERATION                    0x0008
 134 #define PROCESS_VM_READ                         0x0010
 135 #define PROCESS_VM_WRITE                        0x0020
 136 #define PROCESS_CREATE_PROCESS                  0x0080
 137 #define PROCESS_SET_QUOTA                       0x0100
 138 #define PROCESS_SET_INFORMATION                 0x0200
 139 #define PROCESS_QUERY_INFORMATION               0x0400
 140 #define PROCESS_SUSPEND_RESUME                  0x0800
 141 #define PROCESS_QUERY_LIMITED_INFORMATION       0x1000
 142 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 143 #define PROCESS_ALL_ACCESS                      (STANDARD_RIGHTS_REQUIRED | \
 144                                                  SYNCHRONIZE | \
 145                                                  0xFFFF)
 146 #else
 147 #define PROCESS_ALL_ACCESS                      (STANDARD_RIGHTS_REQUIRED | \
 148                                                  SYNCHRONIZE | \
 149                                                  0xFFF)
 150
 151 //
 152 // Thread Base Priorities
 153 //
 154 #define THREAD_BASE_PRIORITY_LOWRT              15
 155 #define THREAD_BASE_PRIORITY_MAX                2
 156 #define THREAD_BASE_PRIORITY_MIN                -2
 157 #define THREAD_BASE_PRIORITY_IDLE               -15
 158
 159 //
 160 // TLS Slots
 161 //
 162 #define TLS_MINIMUM_AVAILABLE                   64
 163 #define TLS_EXPANSION_SLOTS                     1024
 164 #endif
 165
 166 //
 167 // Job Access Types
 168 //
 169 #define JOB_OBJECT_ASSIGN_PROCESS               0x1
 170 #define JOB_OBJECT_SET_ATTRIBUTES               0x2
 171 #define JOB_OBJECT_QUERY                        0x4
 172 #define JOB_OBJECT_TERMINATE                    0x8
 173 #define JOB_OBJECT_SET_SECURITY_ATTRIBUTES      0x10
 174 #define JOB_OBJECT_ALL_ACCESS                   (STANDARD_RIGHTS_REQUIRED | \
 175                                                  SYNCHRONIZE | \
 176                                                  31)
 177
 178 //
 179 // Cross Thread Flags
 180 //
 181 #define CT_TERMINATED_BIT                       0x1
 182 #define CT_DEAD_THREAD_BIT                      0x2
 183 #define CT_HIDE_FROM_DEBUGGER_BIT               0x4
 184 #define CT_ACTIVE_IMPERSONATION_INFO_BIT        0x8
 185 #define CT_SYSTEM_THREAD_BIT                    0x10
 186 #define CT_HARD_ERRORS_ARE_DISABLED_BIT         0x20
 187 #define CT_BREAK_ON_TERMINATION_BIT             0x40
 188 #define CT_SKIP_CREATION_MSG_BIT                0x80
 189 #define CT_SKIP_TERMINATION_MSG_BIT             0x100
 190
 191 //
 192 // Same Thread Passive Flags
 193 //
 194 #define STP_ACTIVE_EX_WORKER_BIT                0x1
 195 #define STP_EX_WORKER_CAN_WAIT_USER_BIT         0x2
 196 #define STP_MEMORY_MAKER_BIT                    0x4
 197 #define STP_KEYED_EVENT_IN_USE_BIT              0x8
 198
 199 //
 200 // Same Thread APC Flags
 201 //
 202 #define STA_LPC_RECEIVED_MSG_ID_VALID_BIT       0x1
 203 #define STA_LPC_EXIT_THREAD_CALLED_BIT          0x2
 204 #define STA_ADDRESS_SPACE_OWNER_BIT             0x4
 205 #endif
 206
 207 //
 208 // Process Flags
 209 //
 210 #define PSF_CREATE_REPORTED_BIT                 0x1
 211 #define PSF_NO_DEBUG_INHERIT_BIT                0x2
 212 #define PSF_PROCESS_EXITING_BIT                 0x4
 213 #define PSF_PROCESS_DELETE_BIT                  0x8
 214 #define PSF_WOW64_SPLIT_PAGES_BIT               0x10
 215 #define PSF_VM_DELETED_BIT                      0x20
 216 #define PSF_OUTSWAP_ENABLED_BIT                 0x40
 217 #define PSF_OUTSWAPPED_BIT                      0x80
 218 #define PSF_FORK_FAILED_BIT                     0x100
 219 #define PSF_WOW64_VA_SPACE_4GB_BIT              0x200
 220 #define PSF_ADDRESS_SPACE_INITIALIZED_BIT       0x400
 221 #define PSF_SET_TIMER_RESOLUTION_BIT            0x1000
 222 #define PSF_BREAK_ON_TERMINATION_BIT            0x2000
 223 #define PSF_SESSION_CREATION_UNDERWAY_BIT       0x4000
 224 #define PSF_WRITE_WATCH_BIT                     0x8000
 225 #define PSF_PROCESS_IN_SESSION_BIT              0x10000
 226 #define PSF_OVERRIDE_ADDRESS_SPACE_BIT          0x20000
 227 #define PSF_HAS_ADDRESS_SPACE_BIT               0x40000
 228 #define PSF_LAUNCH_PREFETCHED_BIT               0x80000
 229 #define PSF_INJECT_INPAGE_ERRORS_BIT            0x100000
 230 #define PSF_VM_TOP_DOWN_BIT                     0x200000
 231 #define PSF_IMAGE_NOTIFY_DONE_BIT               0x400000
 232 #define PSF_PDE_UPDATE_NEEDED_BIT               0x800000
 233 #define PSF_VDM_ALLOWED_BIT                     0x1000000
 234 #define PSF_SWAP_ALLOWED_BIT                    0x2000000
 235 #define PSF_CREATE_FAILED_BIT                   0x4000000
 236 #define PSF_DEFAULT_IO_PRIORITY_BIT             0x8000000
 237
 238 #ifdef NTOS_MODE_USER
 239 //
 240 // Current Process/Thread built-in 'special' handles
 241 //
 242 #define NtCurrentProcess()                      ((HANDLE)(LONG_PTR)-1)
 243 #define ZwCurrentProcess()                      NtCurrentProcess()
 244 #define NtCurrentThread()                       ((HANDLE)(LONG_PTR)-2)
 245 #define ZwCurrentThread()                       NtCurrentThread()
 246
 247 //
 248 // Process/Thread/Job Information Classes for NtQueryInformationProcess/Thread/Job
 249 //
 250 typedef enum _PROCESSINFOCLASS
 251 {
 252     ProcessBasicInformation,
 253     ProcessQuotaLimits,
 254     ProcessIoCounters,
 255     ProcessVmCounters,
 256     ProcessTimes,
 257     ProcessBasePriority,
 258     ProcessRaisePriority,
 259     ProcessDebugPort,
 260     ProcessExceptionPort,
 261     ProcessAccessToken,
 262     ProcessLdtInformation,
 263     ProcessLdtSize,
 264     ProcessDefaultHardErrorMode,
 265     ProcessIoPortHandlers,
 266     ProcessPooledUsageAndLimits,
 267     ProcessWorkingSetWatch,
 268     ProcessUserModeIOPL,
 269     ProcessEnableAlignmentFaultFixup,
 270     ProcessPriorityClass,
 271     ProcessWx86Information,
 272     ProcessHandleCount,
 273     ProcessAffinityMask,
 274     ProcessPriorityBoost,
 275     ProcessDeviceMap,
 276     ProcessSessionInformation,
 277     ProcessForegroundInformation,
 278     ProcessWow64Information,
 279     ProcessImageFileName,
 280     ProcessLUIDDeviceMapsEnabled,
 281     ProcessBreakOnTermination,
 282     ProcessDebugObjectHandle,
 283     ProcessDebugFlags,
 284     ProcessHandleTracing,
 285     ProcessIoPriority,
 286     ProcessExecuteFlags,
 287     ProcessTlsInformation,
 288     ProcessCookie,
 289     ProcessImageInformation,
 290     ProcessCycleTime,
 291     ProcessPagePriority,
 292     ProcessInstrumentationCallback,
 293     MaxProcessInfoClass
 294 } PROCESSINFOCLASS;
 295
 296 typedef enum _THREADINFOCLASS
 297 {
 298     ThreadBasicInformation,
 299     ThreadTimes,
 300     ThreadPriority,
 301     ThreadBasePriority,
 302     ThreadAffinityMask,
 303     ThreadImpersonationToken,
 304     ThreadDescriptorTableEntry,
 305     ThreadEnableAlignmentFaultFixup,
 306     ThreadEventPair_Reusable,
 307     ThreadQuerySetWin32StartAddress,
 308     ThreadZeroTlsCell,
 309     ThreadPerformanceCount,
 310     ThreadAmILastThread,
 311     ThreadIdealProcessor,
 312     ThreadPriorityBoost,
 313     ThreadSetTlsArrayAddress,
 314     ThreadIsIoPending,
 315     ThreadHideFromDebugger,
 316     ThreadBreakOnTermination,
 317     ThreadSwitchLegacyState,
 318     ThreadIsTerminated,
 319     ThreadLastSystemCall,
 320     ThreadIoPriority,
 321     ThreadCycleTime,
 322     ThreadPagePriority,
 323     ThreadActualBasePriority,
 324     ThreadTebInformation,
 325     ThreadCSwitchMon,
 326     MaxThreadInfoClass
 327 } THREADINFOCLASS;
 328
 329 #else
 330
 331 typedef enum _PSPROCESSPRIORITYMODE
 332 {
 333     PsProcessPriorityForeground,
 334     PsProcessPriorityBackground,
 335     PsProcessPrioritySpinning
 336 } PSPROCESSPRIORITYMODE;
 337
 338 typedef enum _JOBOBJECTINFOCLASS
 339 {
 340     JobObjectBasicAccountingInformation = 1,
 341     JobObjectBasicLimitInformation,
 342     JobObjectBasicProcessIdList,
 343     JobObjectBasicUIRestrictions,
 344     JobObjectSecurityLimitInformation,
 345     JobObjectEndOfJobTimeInformation,
 346     JobObjectAssociateCompletionPortInformation,
 347     JobObjectBasicAndIoAccountingInformation,
 348     JobObjectExtendedLimitInformation,
 349     JobObjectJobSetInformation,
 350     MaxJobObjectInfoClass
 351 } JOBOBJECTINFOCLASS;
 352
 353 //
 354 // Power Event Events for Win32K Power Event Callback
 355 //
 356 typedef enum _PSPOWEREVENTTYPE
 357 {
 358     PsW32FullWake = 0,
 359     PsW32EventCode = 1,
 360     PsW32PowerPolicyChanged = 2,
 361     PsW32SystemPowerState = 3,
 362     PsW32SystemTime = 4,
 363     PsW32DisplayState = 5,
 364     PsW32CapabilitiesChanged = 6,
 365     PsW32SetStateFailed = 7,
 366     PsW32GdiOff = 8,
 367     PsW32GdiOn = 9,
 368     PsW32GdiPrepareResumeUI = 10,
 369     PsW32GdiOffRequest = 11,
 370     PsW32MonitorOff = 12,
 371 } PSPOWEREVENTTYPE;
 372
 373 //
 374 // Power State Tasks for Win32K Power State Callback
 375 //
 376 typedef enum _POWERSTATETASK
 377 {
 378     PowerState_BlockSessionSwitch = 0,
 379     PowerState_Init = 1,
 380     PowerState_QueryApps = 2,
 381     PowerState_QueryServices = 3,
 382     PowerState_QueryAppsFailed = 4,
 383     PowerState_QueryServicesFailed = 5,
 384     PowerState_SuspendApps = 6,
 385     PowerState_SuspendServices = 7,
 386     PowerState_ShowUI = 8,
 387     PowerState_NotifyWL = 9,
 388     PowerState_ResumeApps = 10,
 389     PowerState_ResumeServices = 11,
 390     PowerState_UnBlockSessionSwitch = 12,
 391     PowerState_End = 13,
 392     PowerState_BlockInput = 14,
 393     PowerState_UnblockInput = 15,
 394 } POWERSTATETASK;
 395
 396 //
 397 // Win32K Job Callback Types
 398 //
 399 typedef enum _PSW32JOBCALLOUTTYPE
 400 {
 401    PsW32JobCalloutSetInformation = 0,
 402    PsW32JobCalloutAddProcess = 1,
 403    PsW32JobCalloutTerminate = 2,
 404 } PSW32JOBCALLOUTTYPE;
 405
 406 //
 407 // Win32K Thread Callback Types
 408 //
 409 typedef enum _PSW32THREADCALLOUTTYPE
 410 {
 411     PsW32ThreadCalloutInitialize,
 412     PsW32ThreadCalloutExit,
 413 } PSW32THREADCALLOUTTYPE;
 414
 415 //
 416 // Declare empty structure definitions so that they may be referenced by
 417 // routines before they are defined
 418 //
 419 struct _W32THREAD;
 420 struct _W32PROCESS;
 421 struct _ETHREAD;
 422 struct _WIN32_POWEREVENT_PARAMETERS;
 423 struct _WIN32_POWERSTATE_PARAMETERS;
 424 struct _WIN32_JOBCALLOUT_PARAMETERS;
 425 struct _WIN32_OPENMETHOD_PARAMETERS;
 426 struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS;
 427 struct _WIN32_CLOSEMETHOD_PARAMETERS;
 428 struct _WIN32_DELETEMETHOD_PARAMETERS;
 429 struct _WIN32_PARSEMETHOD_PARAMETERS;
 430
 431 //
 432 // Win32K Process and Thread Callbacks
 433 //
 434 typedef
 435 NTSTATUS
 436 (NTAPI *PKWIN32_PROCESS_CALLOUT)(
 437     struct _EPROCESS *Process,
 438     BOOLEAN Create
 439 );
 440
 441 typedef
 442 NTSTATUS
 443 (NTAPI *PKWIN32_THREAD_CALLOUT)(
 444     struct _ETHREAD *Thread,
 445     PSW32THREADCALLOUTTYPE Type
 446 );
 447
 448 typedef
 449 NTSTATUS
 450 (NTAPI *PKWIN32_GLOBALATOMTABLE_CALLOUT)(
 451     VOID
 452 );
 453
 454 typedef
 455 NTSTATUS
 456 (NTAPI *PKWIN32_POWEREVENT_CALLOUT)(
 457     struct _WIN32_POWEREVENT_PARAMETERS *Parameters
 458 );
 459
 460 typedef
 461 NTSTATUS
 462 (NTAPI *PKWIN32_POWERSTATE_CALLOUT)(
 463     struct _WIN32_POWERSTATE_PARAMETERS *Parameters
 464 );
 465
 466 typedef
 467 NTSTATUS
 468 (NTAPI *PKWIN32_JOB_CALLOUT)(
 469     struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters
 470 );
 471
 472 typedef
 473 NTSTATUS
 474 (NTAPI *PGDI_BATCHFLUSH_ROUTINE)(
 475     VOID
 476 );
 477
 478 typedef
 479 NTSTATUS
 480 (NTAPI *PKWIN32_OPENMETHOD_CALLOUT)(
 481     struct _WIN32_OPENMETHOD_PARAMETERS *Parameters
 482 );
 483
 484 typedef
 485 NTSTATUS
 486 (NTAPI *PKWIN32_OKTOCLOSEMETHOD_CALLOUT)(
 487     struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters
 488 );
 489
 490 typedef
 491 NTSTATUS
 492 (NTAPI *PKWIN32_CLOSEMETHOD_CALLOUT)(
 493     struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters
 494 );
 495
 496 typedef
 497 VOID
 498 (NTAPI *PKWIN32_DELETEMETHOD_CALLOUT)(
 499     struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters
 500 );
 501
 502 typedef
 503 NTSTATUS
 504 (NTAPI *PKWIN32_PARSEMETHOD_CALLOUT)(
 505     struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters
 506 );
 507
 508 typedef
 509 NTSTATUS
 510 (NTAPI *PKWIN32_WIN32DATACOLLECTION_CALLOUT)(
 511     struct _EPROCESS *Process,
 512     PVOID Callback,
 513     PVOID Context
 514 );
 515
 516 //
 517 // Lego Callback
 518 //
 519 typedef
 520 VOID
 521 (NTAPI *PLEGO_NOTIFY_ROUTINE)(
 522     IN PKTHREAD Thread
 523 );
 524
 525 #endif
 526
 527 typedef NTSTATUS
 528 (NTAPI *PPOST_PROCESS_INIT_ROUTINE)(
 529     VOID
 530 );
 531
 532 #ifdef NTOS_MODE_USER
 533
 534 //
 535 // ClientID Structure
 536 //
 537 typedef struct _CLIENT_ID
 538 {
 539     HANDLE UniqueProcess;
 540     HANDLE UniqueThread;
 541 } CLIENT_ID, *PCLIENT_ID;
 542
 543 #endif
 544
 545 //
 546 // Descriptor Table Entry Definition
 547 //
 548 #define _DESCRIPTOR_TABLE_ENTRY_DEFINED
 549 typedef struct _DESCRIPTOR_TABLE_ENTRY
 550 {
 551     ULONG Selector;
 552     LDT_ENTRY Descriptor;
 553 } DESCRIPTOR_TABLE_ENTRY, *PDESCRIPTOR_TABLE_ENTRY;
 554
 555 //
 556 // PEB Lock Routine
 557 //
 558 typedef VOID
 559 (NTAPI *PPEBLOCKROUTINE)(
 560     PVOID PebLock
 561 );
 562
 563 //
 564 // PEB Free Block Descriptor
 565 //
 566 typedef struct _PEB_FREE_BLOCK
 567 {
 568     struct _PEB_FREE_BLOCK* Next;
 569     ULONG Size;
 570 } PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
 571
 572 //
 573 // Process Environment Block (PEB)
 574 //
 575 typedef struct _PEB
 576 {
 577     UCHAR InheritedAddressSpace;
 578     UCHAR ReadImageFileExecOptions;
 579     UCHAR BeingDebugged;
 580 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 581     struct
 582     {
 583         UCHAR ImageUsesLargePages:1;
 584         UCHAR IsProtectedProcess:1;
 585         UCHAR IsLegacyProcess:1;
 586         UCHAR SpareBits:5;
 587     };
 588 #else
 589     BOOLEAN SpareBool;
 590 #endif
 591     HANDLE Mutant;
 592     PVOID ImageBaseAddress;
 593     PPEB_LDR_DATA Ldr;
 594     struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters;
 595     PVOID SubSystemData;
 596     PVOID ProcessHeap;
 597 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 598     struct _RTL_CRITICAL_SECTION *FastPebLock;
 599     PVOID AltThunkSListPtr;
 600     PVOID IFEOKey;
 601     ULONG Spare;
 602     union
 603     {
 604         PVOID* KernelCallbackTable;
 605         PVOID UserSharedInfoPtr;
 606     };
 607     ULONG SystemReserved[1];
 608     ULONG SpareUlong;
 609 #else
 610     PVOID FastPebLock;
 611     PPEBLOCKROUTINE FastPebLockRoutine;
 612     PPEBLOCKROUTINE FastPebUnlockRoutine;
 613     ULONG EnvironmentUpdateCount;
 614     PVOID* KernelCallbackTable;
 615     PVOID EventLogSection;
 616     PVOID EventLog;
 617 #endif
 618     PPEB_FREE_BLOCK FreeList;
 619     ULONG TlsExpansionCounter;
 620     PVOID TlsBitmap;
 621     ULONG TlsBitmapBits[0x2];
 622     PVOID ReadOnlySharedMemoryBase;
 623     PVOID ReadOnlySharedMemoryHeap;
 624     PVOID* ReadOnlyStaticServerData;
 625     PVOID AnsiCodePageData;
 626     PVOID OemCodePageData;
 627     PVOID UnicodeCaseTableData;
 628     ULONG NumberOfProcessors;
 629     ULONG NtGlobalFlag;
 630     LARGE_INTEGER CriticalSectionTimeout;
 631     ULONG HeapSegmentReserve;
 632     ULONG HeapSegmentCommit;
 633     ULONG HeapDeCommitTotalFreeThreshold;
 634     ULONG HeapDeCommitFreeBlockThreshold;
 635     ULONG NumberOfHeaps;
 636     ULONG MaximumNumberOfHeaps;
 637     PVOID* ProcessHeaps;
 638     PVOID GdiSharedHandleTable;
 639     PVOID ProcessStarterHelper;
 640     PVOID GdiDCAttributeList;
 641 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 642     struct _RTL_CRITICAL_SECTION *LoaderLock;
 643 #else
 644     PVOID LoaderLock;
 645 #endif
 646     ULONG OSMajorVersion;
 647     ULONG OSMinorVersion;
 648     USHORT OSBuildNumber;
 649     USHORT OSCSDVersion;
 650     ULONG OSPlatformId;
 651     ULONG ImageSubSystem;
 652     ULONG ImageSubSystemMajorVersion;
 653     ULONG ImageSubSystemMinorVersion;
 654     ULONG ImageProcessAffinityMask;
 655     ULONG GdiHandleBuffer[0x22];
 656     PPOST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
 657     struct _RTL_BITMAP *TlsExpansionBitmap;
 658     ULONG TlsExpansionBitmapBits[0x20];
 659     ULONG SessionId;
 660 #if (NTDDI_VERSION >= NTDDI_WINXP)
 661     ULARGE_INTEGER AppCompatFlags;
 662     ULARGE_INTEGER AppCompatFlagsUser;
 663     PVOID pShimData;
 664     PVOID AppCompatInfo;
 665     UNICODE_STRING CSDVersion;
 666     struct _ACTIVATION_CONTEXT_DATA *ActivationContextData;
 667     struct _ASSEMBLY_STORAGE_MAP *ProcessAssemblyStorageMap;
 668     struct _ACTIVATION_CONTEXT_DATA *SystemDefaultActivationContextData;
 669     struct _ASSEMBLY_STORAGE_MAP *SystemAssemblyStorageMap;
 670     ULONG MinimumStackCommit;
 671 #endif
 672 #if (NTDDI_VERSION >= NTDDI_WS03)
 673     PVOID *FlsCallback;
 674     LIST_ENTRY FlsListHead;
 675     struct _RTL_BITMAP *FlsBitmap;
 676     ULONG FlsBitmapBits[4];
 677     ULONG FlsHighIndex;
 678 #endif
 679 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 680     PVOID WerRegistrationData;
 681     PVOID WerShipAssertPtr;
 682 #endif
 683 } PEB, *PPEB;
 684
 685 //
 686 // GDI Batch Descriptor
 687 //
 688 typedef struct _GDI_TEB_BATCH
 689 {
 690     ULONG Offset;
 691     ULONG HDC;
 692     ULONG Buffer[0x136];
 693 } GDI_TEB_BATCH, *PGDI_TEB_BATCH;
 694
 695 //
 696 // Initial TEB
 697 //
 698 typedef struct _INITIAL_TEB
 699 {
 700     PVOID PreviousStackBase;
 701     PVOID PreviousStackLimit;
 702     PVOID StackBase;
 703     PVOID StackLimit;
 704     PVOID AllocatedStackBase;
 705 } INITIAL_TEB, *PINITIAL_TEB;
 706
 707 //
 708 // TEB Active Frame Structures
 709 //
 710 typedef struct _TEB_ACTIVE_FRAME_CONTEXT
 711 {
 712     ULONG Flags;
 713     LPSTR FrameName;
 714 } TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;
 715
 716 typedef struct _TEB_ACTIVE_FRAME
 717 {
 718     ULONG Flags;
 719     struct _TEB_ACTIVE_FRAME *Previous;
 720     PTEB_ACTIVE_FRAME_CONTEXT Context;
 721 } TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
 722
 723 //
 724 // Thread Environment Block (TEB)
 725 //
 726 typedef struct _TEB
 727 {
 728     NT_TIB Tib;
 729     PVOID EnvironmentPointer;
 730     CLIENT_ID Cid;
 731     PVOID ActiveRpcHandle;
 732     PVOID ThreadLocalStoragePointer;
 733     struct _PEB *ProcessEnvironmentBlock;
 734     ULONG LastErrorValue;
 735     ULONG CountOfOwnedCriticalSections;
 736     PVOID CsrClientThread;
 737     struct _W32THREAD* Win32ThreadInfo;
 738     ULONG User32Reserved[0x1A];
 739     ULONG UserReserved[5];
 740     PVOID WOW32Reserved;
 741     LCID CurrentLocale;
 742     ULONG FpSoftwareStatusRegister;
 743     PVOID SystemReserved1[0x36];
 744     LONG ExceptionCode;
 745     struct _ACTIVATION_CONTEXT_STACK *ActivationContextStackPointer;
 746     UCHAR SpareBytes1[0x24];
 747     ULONG TxFsContext;
 748     GDI_TEB_BATCH GdiTebBatch;
 749     CLIENT_ID RealClientId;
 750     PVOID GdiCachedProcessHandle;
 751     ULONG GdiClientPID;
 752     ULONG GdiClientTID;
 753     PVOID GdiThreadLocalInfo;
 754     ULONG Win32ClientInfo[62];
 755     PVOID glDispatchTable[0xE9];
 756     ULONG glReserved1[0x1D];
 757     PVOID glReserved2;
 758     PVOID glSectionInfo;
 759     PVOID glSection;
 760     PVOID glTable;
 761     PVOID glCurrentRC;
 762     PVOID glContext;
 763     NTSTATUS LastStatusValue;
 764     UNICODE_STRING StaticUnicodeString;
 765     WCHAR StaticUnicodeBuffer[0x105];
 766     PVOID DeallocationStack;
 767     PVOID TlsSlots[0x40];
 768     LIST_ENTRY TlsLinks;
 769     PVOID Vdm;
 770     PVOID ReservedForNtRpc;
 771     PVOID DbgSsReserved[0x2];
 772     ULONG HardErrorDisabled;
 773     PVOID Instrumentation[9];
 774     GUID ActivityId;
 775     PVOID SubProcessTag;
 776     PVOID EtwTraceData;
 777     PVOID WinSockData;
 778     ULONG GdiBatchCount;
 779 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 780     BOOLEAN SpareBool0;
 781     BOOLEAN SpareBool1;
 782     BOOLEAN SpareBool2;
 783 #else
 784     BOOLEAN InDbgPrint;
 785     BOOLEAN FreeStackOnTermination;
 786     BOOLEAN HasFiberData;
 787 #endif
 788     UCHAR IdealProcessor;
 789     ULONG GuaranteedStackBytes;
 790     PVOID ReservedForPerf;
 791     PVOID ReservedForOle;
 792     ULONG WaitingOnLoaderLock;
 793 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 794     PVOID SavedPriorityState;
 795 #else
 796     ULONG SparePointer1;
 797 #endif
 798     ULONG SoftPatchPtr1;
 799     ULONG SoftPatchPtr2;
 800     PVOID *TlsExpansionSlots;
 801     ULONG ImpersonationLocale;
 802     ULONG IsImpersonating;
 803     PVOID NlsCache;
 804     PVOID pShimData;
 805     ULONG HeapVirualAffinity;
 806     PVOID CurrentTransactionHandle;
 807     PTEB_ACTIVE_FRAME ActiveFrame;
 808 #if (NTDDI_VERSION >= NTDDI_WS03)
 809     PVOID FlsData;
 810 #endif
 811 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 812     PVOID PreferredLangauges;
 813     PVOID UserPrefLanguages;
 814     PVOID MergedPrefLanguages;
 815     ULONG MuiImpersonation;
 816     union
 817     {
 818         struct
 819         {
 820             USHORT SpareCrossTebFlags:16;
 821         };
 822         USHORT CrossTebFlags;
 823     };
 824     union
 825     {
 826         struct
 827         {
 828             USHORT DbgSafeThunkCall:1;
 829             USHORT DbgInDebugPrint:1;
 830             USHORT DbgHasFiberData:1;
 831             USHORT DbgSkipThreadAttach:1;
 832             USHORT DbgWerInShipAssertCode:1;
 833             USHORT DbgIssuedInitialBp:1;
 834             USHORT DbgClonedThread:1;
 835             USHORT SpareSameTebBits:9;
 836         };
 837         USHORT SameTebFlags;
 838     };
 839     PVOID TxnScopeEntercallback;
 840     PVOID TxnScopeExitCAllback;
 841     PVOID TxnScopeContext;
 842     ULONG LockCount;
 843     ULONG ProcessRundown;
 844     ULONGLONG LastSwitchTime;
 845     ULONGLONG TotalSwitchOutTime;
 846     LARGE_INTEGER WaitReasonBitMap;
 847 #else
 848     UCHAR SafeThunkCall;
 849     UCHAR BooleanSpare[3];
 850 #endif
 851 } TEB, *PTEB;
 852
 853 #ifdef NTOS_MODE_USER
 854
 855 //
 856 // Process Information Structures for NtQueryProcessInformation
 857 //
 858 typedef struct _PROCESS_BASIC_INFORMATION
 859 {
 860     NTSTATUS ExitStatus;
 861     PPEB PebBaseAddress;
 862     ULONG_PTR AffinityMask;
 863     KPRIORITY BasePriority;
 864     ULONG_PTR UniqueProcessId;
 865     ULONG_PTR InheritedFromUniqueProcessId;
 866 } PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION;
 867
 868 typedef struct _PROCESS_ACCESS_TOKEN
 869 {
 870     HANDLE Token;
 871     HANDLE Thread;
 872 } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
 873
 874 typedef struct _PROCESS_DEVICEMAP_INFORMATION
 875 {
 876     union
 877     {
 878         struct
 879         {
 880             HANDLE DirectoryHandle;
 881         } Set;
 882         struct
 883         {
 884             ULONG DriveMap;
 885             UCHAR DriveType[32];
 886         } Query;
 887     };
 888 } PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION;
 889
 890 typedef struct _KERNEL_USER_TIMES
 891 {
 892     LARGE_INTEGER CreateTime;
 893     LARGE_INTEGER ExitTime;
 894     LARGE_INTEGER KernelTime;
 895     LARGE_INTEGER UserTime;
 896 } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
 897
 898 typedef struct _PROCESS_SESSION_INFORMATION
 899 {
 900     ULONG SessionId;
 901 } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
 902
 903 #endif
 904
 905 typedef struct _PROCESS_PRIORITY_CLASS
 906 {
 907     BOOLEAN Foreground;
 908     UCHAR PriorityClass;
 909 } PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;
 910
 911 //
 912 // Thread Information Structures for NtQueryProcessInformation
 913 //
 914 typedef struct _THREAD_BASIC_INFORMATION
 915 {
 916     NTSTATUS ExitStatus;
 917     PVOID TebBaseAddress;
 918     CLIENT_ID ClientId;
 919     KAFFINITY AffinityMask;
 920     KPRIORITY Priority;
 921     KPRIORITY BasePriority;
 922 } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
 923
 924 #ifndef NTOS_MODE_USER
 925
 926 //
 927 // Job Set Array
 928 //
 929 typedef struct _JOB_SET_ARRAY
 930 {
 931     HANDLE JobHandle;
 932     ULONG MemberLevel;
 933     ULONG Flags;
 934 } JOB_SET_ARRAY, *PJOB_SET_ARRAY;
 935
 936 //
 937 // EPROCESS Quota Structures
 938 //
 939 typedef struct _EPROCESS_QUOTA_ENTRY
 940 {
 941     SIZE_T Usage;
 942     SIZE_T Limit;
 943     SIZE_T Peak;
 944     SIZE_T Return;
 945 } EPROCESS_QUOTA_ENTRY, *PEPROCESS_QUOTA_ENTRY;
 946
 947 typedef struct _EPROCESS_QUOTA_BLOCK
 948 {
 949     EPROCESS_QUOTA_ENTRY QuotaEntry[3];
 950     LIST_ENTRY QuotaList;
 951     ULONG ReferenceCount;
 952     ULONG ProcessCount;
 953 } EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;
 954
 955 //
 956 // Process Pagefault History
 957 //
 958 typedef struct _PAGEFAULT_HISTORY
 959 {
 960     ULONG CurrentIndex;
 961     ULONG MapIndex;
 962     KSPIN_LOCK SpinLock;
 963     PVOID Reserved;
 964     PROCESS_WS_WATCH_INFORMATION WatchInfo[1];
 965 } PAGEFAULT_HISTORY, *PPAGEFAULT_HISTORY;
 966
 967 //
 968 // Process Impersonation Information
 969 //
 970 typedef struct _PS_IMPERSONATION_INFORMATION
 971 {
 972     PACCESS_TOKEN Token;
 973     BOOLEAN CopyOnOpen;
 974     BOOLEAN EffectiveOnly;
 975     SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
 976 } PS_IMPERSONATION_INFORMATION, *PPS_IMPERSONATION_INFORMATION;
 977
 978 //
 979 // Process Termination Port
 980 //
 981 typedef struct _TERMINATION_PORT
 982 {
 983     struct _TERMINATION_PORT *Next;
 984     PVOID Port;
 985 } TERMINATION_PORT, *PTERMINATION_PORT;
 986
 987 //
 988 // Per-Process APC Rate Limiting
 989 //
 990 typedef struct _PSP_RATE_APC
 991 {
 992     union
 993     {
 994         SINGLE_LIST_ENTRY NextApc;
 995         ULONGLONG ExcessCycles;
 996     };
 997     ULONGLONG TargetGEneration;
 998     KAPC RateApc;
 999 } PSP_RATE_APC, *PPSP_RATE_APC;
1000
1001 //
1002 // Executive Thread (ETHREAD)
1003 //
1004 #include <pshpack4.h>
1005 typedef struct _ETHREAD
1006 {
1007     KTHREAD Tcb;
1008     PVOID Padding;
1009     LARGE_INTEGER CreateTime;
1010     union
1011     {
1012         LARGE_INTEGER ExitTime;
1013         LIST_ENTRY LpcReplyChain;
1014         LIST_ENTRY KeyedWaitChain;
1015     };
1016     union
1017     {
1018         NTSTATUS ExitStatus;
1019         PVOID OfsChain;
1020     };
1021     LIST_ENTRY PostBlockList;
1022     union
1023     {
1024         struct _TERMINATION_PORT *TerminationPort;
1025         struct _ETHREAD *ReaperLink;
1026         PVOID KeyedWaitValue;
1027 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1028         PVOID Win32StartParameter;
1029 #endif
1030     };
1031     KSPIN_LOCK ActiveTimerListLock;
1032     LIST_ENTRY ActiveTimerListHead;
1033     CLIENT_ID Cid;
1034 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1035     KSEMAPHORE KeyedWaitSemaphore;
1036 #else
1037     union
1038     {
1039         KSEMAPHORE LpcReplySemaphore;
1040         KSEMAPHORE KeyedReplySemaphore;
1041     };
1042     union
1043     {
1044         PVOID LpcReplyMessage;
1045         PVOID LpcWaitingOnPort;
1046     };
1047 #endif
1048     PPS_IMPERSONATION_INFORMATION ImpersonationInfo;
1049     LIST_ENTRY IrpList;
1050     ULONG TopLevelIrp;
1051     PDEVICE_OBJECT DeviceToVerify;
1052 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1053     PPSP_RATE_APC RateControlApc;
1054 #else
1055     struct _EPROCESS *ThreadsProcess;
1056 #endif
1057     PVOID Win32StartAddress;
1058     union
1059     {
1060         PKSTART_ROUTINE StartAddress;
1061         ULONG LpcReceivedMessageId;
1062     };
1063     LIST_ENTRY ThreadListEntry;
1064     EX_RUNDOWN_REF RundownProtect;
1065     EX_PUSH_LOCK ThreadLock;
1066 #if (NTDDI_VERSION < NTDDI_LONGHORN)
1067     ULONG LpcReplyMessageId;
1068 #endif
1069     ULONG ReadClusterSize;
1070 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1071     ULONG SpareUlong0;
1072 #else
1073     ACCESS_MASK GrantedAccess;
1074 #endif
1075     union
1076     {
1077         struct
1078         {
1079            ULONG Terminated:1;
1080 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1081            ULONG ThreadInserted:1;
1082 #else
1083            ULONG DeadThread:1;
1084 #endif
1085            ULONG HideFromDebugger:1;
1086            ULONG ActiveImpersonationInfo:1;
1087            ULONG SystemThread:1;
1088            ULONG HardErrorsAreDisabled:1;
1089            ULONG BreakOnTermination:1;
1090            ULONG SkipCreationMsg:1;
1091            ULONG SkipTerminationMsg:1;
1092 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1093            ULONG CreateMsgSent:1;
1094            ULONG ThreadIoPriority:3;
1095            ULONG ThreadPagePriority:3;
1096            ULONG PendingRatecontrol:1;
1097 #endif
1098         };
1099         ULONG CrossThreadFlags;
1100     };
1101     union
1102     {
1103         struct
1104         {
1105            ULONG ActiveExWorker:1;
1106            ULONG ExWorkerCanWaitUser:1;
1107            ULONG MemoryMaker:1;
1108            ULONG KeyedEventInUse:1;
1109 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1110            ULONG RateApcState:2;
1111 #endif
1112         };
1113         ULONG SameThreadPassiveFlags;
1114     };
1115     union
1116     {
1117         struct
1118         {
1119            ULONG LpcReceivedMsgIdValid:1;
1120            ULONG LpcExitThreadCalled:1;
1121 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1122            ULONG Spare:1;
1123 #else
1124            ULONG AddressSpaceOwner:1;
1125 #endif
1126            ULONG OwnsProcessWorkingSetExclusive:1;
1127            ULONG OwnsProcessWorkingSetShared:1;
1128            ULONG OwnsSystemWorkingSetExclusive:1;
1129            ULONG OwnsSystemWorkingSetShared:1;
1130            ULONG OwnsSessionWorkingSetExclusive:1;
1131            ULONG OwnsSessionWorkingSetShared:1;
1132 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1133            ULONG SupressSymbolLoad:1;
1134            ULONG Spare1:3;
1135            ULONG PriorityRegionActive:4;
1136 #else
1137            ULONG ApcNeeded:1;
1138 #endif
1139         };
1140         ULONG SameThreadApcFlags;
1141     };
1142 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1143     UCHAR CacheManagerActive;
1144 #else
1145     UCHAR ForwardClusterOnly;
1146 #endif
1147     UCHAR DisablePageFaultClustering;
1148     UCHAR ActiveFaultCount;
1149 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1150     ULONG AlpcMessageId;
1151     union
1152     {
1153         PVOID AlpcMessage;
1154         ULONG AlpcReceiveAttributeSet;
1155     };
1156     LIST_ENTRY AlpcWaitListEntry;
1157     KSEMAPHORE AlpcWaitSemaphore;
1158     ULONG CacheManagerCount;
1159 #endif
1160 } ETHREAD;
1161
1162 //
1163 // Executive Process (EPROCESS)
1164 //
1165 typedef struct _EPROCESS
1166 {
1167     KPROCESS Pcb;
1168     EX_PUSH_LOCK ProcessLock;
1169     LARGE_INTEGER CreateTime;
1170     LARGE_INTEGER ExitTime;
1171     EX_RUNDOWN_REF RundownProtect;
1172     HANDLE UniqueProcessId;
1173     LIST_ENTRY ActiveProcessLinks;
1174     ULONG QuotaUsage[3];
1175     ULONG QuotaPeak[3];
1176     ULONG CommitCharge;
1177     ULONG PeakVirtualSize;
1178     ULONG VirtualSize;
1179     LIST_ENTRY SessionProcessLinks;
1180     PVOID DebugPort;
1181 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1182     union
1183     {
1184         PVOID ExceptionPortData;
1185         ULONG ExceptionPortValue;
1186         UCHAR ExceptionPortState:3;
1187     };
1188 #else
1189     PVOID ExceptionPort;
1190 #endif
1191     PHANDLE_TABLE ObjectTable;
1192     EX_FAST_REF Token;
1193     ULONG WorkingSetPage;
1194 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1195     EX_PUSH_LOCK AddressCreationLock;
1196     PETHREAD RotateInProgress;
1197 #else
1198     FAST_MUTEX AddressCreationLock; // FIXME: FAST_MUTEX for XP, KGUARDED_MUTEX for 2K3
1199     KSPIN_LOCK HyperSpaceLock;
1200 #endif
1201     PETHREAD ForkInProgress;
1202     ULONG HardwareTrigger;
1203     MM_AVL_TABLE PhysicalVadroot;
1204     PVOID CloneRoot;
1205     ULONG NumberOfPrivatePages;
1206     ULONG NumberOfLockedPages;
1207     PVOID *Win32Process;
1208     struct _EJOB *Job;
1209     PVOID SectionObject;
1210     PVOID SectionBaseAddress;
1211     PEPROCESS_QUOTA_BLOCK QuotaBlock;
1212     PPAGEFAULT_HISTORY WorkingSetWatch;
1213     PVOID Win32WindowStation;
1214     HANDLE InheritedFromUniqueProcessId;
1215     PVOID LdtInformation;
1216     PVOID VadFreeHint;
1217     PVOID VdmObjects;
1218     PVOID DeviceMap;
1219 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1220     ULONG AlpcPagedPoolQuotaCache;
1221     PVOID EtwDataSource;
1222     PVOID FreeTebHint;
1223 #else
1224     PVOID Spare0[3];
1225 #endif
1226     union
1227     {
1228         HARDWARE_PTE PagedirectoryPte;
1229         ULONGLONG Filler;
1230     };
1231     ULONG Session;
1232     CHAR ImageFileName[16];
1233     LIST_ENTRY JobLinks;
1234     PVOID LockedPagesList;
1235     LIST_ENTRY ThreadListHead;
1236     PVOID SecurityPort;
1237     PVOID PaeTop;
1238     ULONG ActiveThreads;
1239 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1240     ULONG ImagePathHash;
1241 #else
1242     ACCESS_MASK GrantedAccess;
1243 #endif
1244     ULONG DefaultHardErrorProcessing;
1245     NTSTATUS LastThreadExitStatus;
1246     struct _PEB* Peb;
1247     EX_FAST_REF PrefetchTrace;
1248     LARGE_INTEGER ReadOperationCount;
1249     LARGE_INTEGER WriteOperationCount;
1250     LARGE_INTEGER OtherOperationCount;
1251     LARGE_INTEGER ReadTransferCount;
1252     LARGE_INTEGER WriteTransferCount;
1253     LARGE_INTEGER OtherTransferCount;
1254     ULONG CommitChargeLimit;
1255     ULONG CommitChargePeak;
1256     PVOID AweInfo;
1257     SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;
1258     MMSUPPORT Vm;
1259     LIST_ENTRY MmProcessLinks;
1260     ULONG ModifiedPageCount;
1261 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1262     union
1263     {
1264         struct
1265         {
1266             ULONG JobNotReallyActive:1;
1267             ULONG AccountingFolded:1;
1268             ULONG NewProcessReported:1;
1269             ULONG ExitProcessReported:1;
1270             ULONG ReportCommitChanges:1;
1271             ULONG LastReportMemory:1;
1272             ULONG ReportPhysicalPageChanges:1;
1273             ULONG HandleTableRundown:1;
1274             ULONG NeedsHandleRundown:1;
1275             ULONG RefTraceEnabled:1;
1276             ULONG NumaAware:1;
1277             ULONG ProtectedProcess:1;
1278             ULONG DefaultPagePriority:3;
1279             ULONG ProcessDeleteSelf:1;
1280             ULONG ProcessVerifierTarget:1;
1281         };
1282         ULONG Flags2;
1283     };
1284 #else
1285     ULONG JobStatus;
1286 #endif
1287     union
1288     {
1289         struct
1290         {
1291             ULONG CreateReported:1;
1292             ULONG NoDebugInherit:1;
1293             ULONG ProcessExiting:1;
1294             ULONG ProcessDelete:1;
1295             ULONG Wow64SplitPages:1;
1296             ULONG VmDeleted:1;
1297             ULONG OutswapEnabled:1;
1298             ULONG Outswapped:1;
1299             ULONG ForkFailed:1;
1300             ULONG Wow64VaSpace4Gb:1;
1301             ULONG AddressSpaceInitialized:2;
1302             ULONG SetTimerResolution:1;
1303             ULONG BreakOnTermination:1;
1304 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1305             ULONG DeprioritizeViews:1;
1306 #else
1307             ULONG SessionCreationUnderway:1;
1308 #endif
1309             ULONG WriteWatch:1;
1310             ULONG ProcessInSession:1;
1311             ULONG OverrideAddressSpace:1;
1312             ULONG HasAddressSpace:1;
1313             ULONG LaunchPrefetched:1;
1314             ULONG InjectInpageErrors:1;
1315             ULONG VmTopDown:1;
1316             ULONG ImageNotifyDone:1;
1317             ULONG PdeUpdateNeeded:1;
1318             ULONG VdmAllowed:1;
1319             ULONG SmapAllowed:1;
1320 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1321             ULONG ProcessInserted:1;
1322 #else
1323             ULONG CreateFailed:1;
1324 #endif
1325             ULONG DefaultIoPriority:3;
1326 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1327             ULONG SparePsFlags1:2;
1328 #else
1329             ULONG Spare1:1;
1330             ULONG Spare2:1;
1331 #endif
1332         };
1333         ULONG Flags;
1334     };
1335     NTSTATUS ExitStatus;
1336 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1337     USHORT Spare7;
1338 #else
1339     USHORT NextPageColor;
1340 #endif
1341     union
1342     {
1343         struct
1344         {
1345             UCHAR SubSystemMinorVersion;
1346             UCHAR SubSystemMajorVersion;
1347         };
1348         USHORT SubSystemVersion;
1349     };
1350     UCHAR PriorityClass;
1351     MM_AVL_TABLE VadRoot;
1352     ULONG Cookie;
1353 } EPROCESS;
1354 #include <poppack.h>
1355
1356 //
1357 // Job Token Filter Data
1358 //
1359 #include <pshpack1.h>
1360 typedef struct _PS_JOB_TOKEN_FILTER
1361 {
1362     ULONG CapturedSidCount;
1363     PSID_AND_ATTRIBUTES CapturedSids;
1364     ULONG CapturedSidsLength;
1365     ULONG CapturedGroupCount;
1366     PSID_AND_ATTRIBUTES CapturedGroups;
1367     ULONG CapturedGroupsLength;
1368     ULONG CapturedPrivilegeCount;
1369     PLUID_AND_ATTRIBUTES CapturedPrivileges;
1370     ULONG CapturedPrivilegesLength;
1371 } PS_JOB_TOKEN_FILTER, *PPS_JOB_TOKEN_FILTER;
1372
1373 //
1374 // Executive Job (EJOB)
1375 //
1376 typedef struct _EJOB
1377 {
1378     KEVENT Event;
1379     LIST_ENTRY JobLinks;
1380     LIST_ENTRY ProcessListHead;
1381     ERESOURCE JobLock;
1382     LARGE_INTEGER TotalUserTime;
1383     LARGE_INTEGER TotalKernelTime;
1384     LARGE_INTEGER ThisPeriodTotalUserTime;
1385     LARGE_INTEGER ThisPeriodTotalKernelTime;
1386     ULONG TotalPageFaultCount;
1387     ULONG TotalProcesses;
1388     ULONG ActiveProcesses;
1389     ULONG TotalTerminatedProcesses;
1390     LARGE_INTEGER PerProcessUserTimeLimit;
1391     LARGE_INTEGER PerJobUserTimeLimit;
1392     ULONG LimitFlags;
1393     ULONG MinimumWorkingSetSize;
1394     ULONG MaximumWorkingSetSize;
1395     ULONG ActiveProcessLimit;
1396     ULONG Affinity;
1397     UCHAR PriorityClass;
1398     ULONG UIRestrictionsClass;
1399     ULONG SecurityLimitFlags;
1400     PVOID Token;
1401     PPS_JOB_TOKEN_FILTER Filter;
1402     ULONG EndOfJobTimeAction;
1403     PVOID CompletionPort;
1404     PVOID CompletionKey;
1405     ULONG SessionId;
1406     ULONG SchedulingClass;
1407     ULONGLONG ReadOperationCount;
1408     ULONGLONG WriteOperationCount;
1409     ULONGLONG OtherOperationCount;
1410     ULONGLONG ReadTransferCount;
1411     ULONGLONG WriteTransferCount;
1412     ULONGLONG OtherTransferCount;
1413     IO_COUNTERS IoInfo;
1414     ULONG ProcessMemoryLimit;
1415     ULONG JobMemoryLimit;
1416     ULONG PeakProcessMemoryUsed;
1417     ULONG PeakJobMemoryUsed;
1418     ULONG CurrentJobMemoryUsed;
1419 #if (NTDDI_VERSION == NTDDI_WINXP)
1420     FAST_MUTEX MemoryLimitsLock;
1421 #elif (NTDDI_VERSION == NTDDI_WS03)
1422     KGUARDED_MUTEX MemoryLimitsLock;
1423 #elif (NTDDI_VERSION >= NTDDI_LONGHORN)
1424     EX_PUSH_LOCK MemoryLimitsLock;
1425 #endif
1426     LIST_ENTRY JobSetLinks;
1427     ULONG MemberLevel;
1428     ULONG JobFlags;
1429 } EJOB, *PEJOB;
1430 #include <poppack.h>
1431
1432 //
1433 // Win32K Callback Registration Data
1434 //
1435 typedef struct _WIN32_POWEREVENT_PARAMETERS
1436 {
1437     PSPOWEREVENTTYPE EventNumber;
1438     ULONG Code;
1439 } WIN32_POWEREVENT_PARAMETERS, *PWIN32_POWEREVENT_PARAMETERS;
1440
1441 typedef struct _WIN32_POWERSTATE_PARAMETERS
1442 {
1443     UCHAR Promotion;
1444     POWER_ACTION SystemAction;
1445     SYSTEM_POWER_STATE MinSystemState;
1446     ULONG Flags;
1447     POWERSTATETASK PowerStateTask;
1448 } WIN32_POWERSTATE_PARAMETERS, *PWIN32_POWERSTATE_PARAMETERS;
1449
1450 typedef struct _WIN32_JOBCALLOUT_PARAMETERS
1451 {
1452     PVOID Job;
1453     PSW32JOBCALLOUTTYPE CalloutType;
1454     PVOID Data;
1455 } WIN32_JOBCALLOUT_PARAMETERS, *PWIN32_JOBCALLOUT_PARAMETERS;
1456
1457 typedef struct _WIN32_OPENMETHOD_PARAMETERS
1458 {
1459     OB_OPEN_REASON OpenReason;
1460     PEPROCESS Process;
1461     PVOID Object;
1462     ULONG GrantedAccess;
1463     ULONG HandleCount;
1464 } WIN32_OPENMETHOD_PARAMETERS, *PWIN32_OPENMETHOD_PARAMETERS;
1465
1466 typedef struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS
1467 {
1468     PEPROCESS Process;
1469     PVOID Object;
1470     HANDLE Handle;
1471     KPROCESSOR_MODE PreviousMode;
1472 } WIN32_OKAYTOCLOSEMETHOD_PARAMETERS, *PWIN32_OKAYTOCLOSEMETHOD_PARAMETERS;
1473
1474 typedef struct _WIN32_CLOSEMETHOD_PARAMETERS
1475 {
1476     PEPROCESS Process;
1477     PVOID Object;
1478     ACCESS_MASK AccessMask;
1479     ULONG ProcessHandleCount;
1480     ULONG SystemHandleCount;
1481 } WIN32_CLOSEMETHOD_PARAMETERS, *PWIN32_CLOSEMETHOD_PARAMETERS;
1482
1483 typedef struct _WIN32_DELETEMETHOD_PARAMETERS
1484 {
1485     PVOID Object;
1486 } WIN32_DELETEMETHOD_PARAMETERS, *PWIN32_DELETEMETHOD_PARAMETERS;
1487
1488 typedef struct _WIN32_PARSEMETHOD_PARAMETERS
1489 {
1490     PVOID ParseObject;
1491     PVOID ObjectType;
1492     PACCESS_STATE AccessState;
1493     KPROCESSOR_MODE AccessMode;
1494     ULONG Attributes;
1495     OUT PUNICODE_STRING CompleteName;
1496     PUNICODE_STRING RemainingName;
1497     PVOID Context;
1498     PSECURITY_QUALITY_OF_SERVICE SecurityQos;
1499     PVOID *Object;
1500 } WIN32_PARSEMETHOD_PARAMETERS, *PWIN32_PARSEMETHOD_PARAMETERS;
1501
1502 typedef struct _WIN32_CALLOUTS_FPNS
1503 {
1504     PKWIN32_PROCESS_CALLOUT ProcessCallout;
1505     PKWIN32_THREAD_CALLOUT ThreadCallout;
1506     PKWIN32_GLOBALATOMTABLE_CALLOUT GlobalAtomTableCallout;
1507     PKWIN32_POWEREVENT_CALLOUT PowerEventCallout;
1508     PKWIN32_POWERSTATE_CALLOUT PowerStateCallout;
1509     PKWIN32_JOB_CALLOUT JobCallout;
1510     PGDI_BATCHFLUSH_ROUTINE BatchFlushRoutine;
1511     PKWIN32_OPENMETHOD_CALLOUT DesktopOpenProcedure;
1512     PKWIN32_OKTOCLOSEMETHOD_CALLOUT DesktopOkToCloseProcedure;
1513     PKWIN32_CLOSEMETHOD_CALLOUT DesktopCloseProcedure;
1514     PKWIN32_DELETEMETHOD_CALLOUT DesktopDeleteProcedure;
1515     PKWIN32_OKTOCLOSEMETHOD_CALLOUT WindowStationOkToCloseProcedure;
1516     PKWIN32_CLOSEMETHOD_CALLOUT WindowStationCloseProcedure;
1517     PKWIN32_DELETEMETHOD_CALLOUT WindowStationDeleteProcedure;
1518     PKWIN32_PARSEMETHOD_CALLOUT WindowStationParseProcedure;
1519     PKWIN32_OPENMETHOD_CALLOUT WindowStationOpenProcedure;
1520     PKWIN32_WIN32DATACOLLECTION_CALLOUT Win32DataCollectionProcedure;
1521 } WIN32_CALLOUTS_FPNS, *PWIN32_CALLOUTS_FPNS;
1522
1523 #endif // !NTOS_MODE_USER
1524
1525 #endif // _PSTYPES_H