3 Copyright (c) Alex Ionescu. All rights reserved.
11 Type definitions for the Process Manager
15 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
29 #ifndef NTOS_MODE_USER
35 // KUSER_SHARED_DATA location in User Mode
37 #define USER_SHARED_DATA (0x7FFE0000)
42 #define FLG_STOP_ON_EXCEPTION 0x00000001
43 #define FLG_SHOW_LDR_SNAPS 0x00000002
44 #define FLG_DEBUG_INITIAL_COMMAND 0x00000004
45 #define FLG_STOP_ON_HUNG_GUI 0x00000008
46 #define FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010
47 #define FLG_HEAP_ENABLE_FREE_CHECK 0x00000020
48 #define FLG_HEAP_VALIDATE_PARAMETERS 0x00000040
49 #define FLG_HEAP_VALIDATE_ALL 0x00000080
50 #define FLG_POOL_ENABLE_TAIL_CHECK 0x00000100
51 #define FLG_POOL_ENABLE_FREE_CHECK 0x00000200
52 #define FLG_POOL_ENABLE_TAGGING 0x00000400
53 #define FLG_HEAP_ENABLE_TAGGING 0x00000800
54 #define FLG_USER_STACK_TRACE_DB 0x00001000
55 #define FLG_KERNEL_STACK_TRACE_DB 0x00002000
56 #define FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000
57 #define FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000
58 #define FLG_IGNORE_DEBUG_PRIV 0x00010000
59 #define FLG_ENABLE_CSRDEBUG 0x00020000
60 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000
61 #define FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000
62 #define FLG_HEAP_ENABLE_CALL_TRACING 0x00100000
63 #define FLG_HEAP_DISABLE_COALESCING 0x00200000
64 #define FLG_ENABLE_CLOSE_EXCEPTIONS 0x00400000
65 #define FLG_ENABLE_EXCEPTION_LOGGING 0x00800000
66 #define FLG_ENABLE_HANDLE_TYPE_TAGGING 0x01000000
67 #define FLG_HEAP_PAGE_ALLOCS 0x02000000
68 #define FLG_DEBUG_INITIAL_COMMAND_EX 0x04000000
69 #define FLG_VALID_BITS 0x07FFFFFF
72 // Process priority classes
74 #define PROCESS_PRIORITY_CLASS_INVALID 0
75 #define PROCESS_PRIORITY_CLASS_IDLE 1
76 #define PROCESS_PRIORITY_CLASS_NORMAL 2
77 #define PROCESS_PRIORITY_CLASS_HIGH 3
78 #define PROCESS_PRIORITY_CLASS_REALTIME 4
79 #define PROCESS_PRIORITY_CLASS_BELOW_NORMAL 5
80 #define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL 6
83 // NtCreateProcessEx flags
85 #define PS_REQUEST_BREAKAWAY 1
86 #define PS_NO_DEBUG_INHERIT 2
87 #define PS_INHERIT_HANDLES 4
88 #define PS_LARGE_PAGES 8
89 #define PS_ALL_FLAGS (PS_REQUEST_BREAKAWAY | \
90 PS_NO_DEBUG_INHERIT | \
91 PS_INHERIT_HANDLES | \
95 // Process base priorities
97 #define PROCESS_PRIORITY_IDLE 3
98 #define PROCESS_PRIORITY_NORMAL 8
99 #define PROCESS_PRIORITY_NORMAL_FOREGROUND 9
102 // Process memory priorities
104 #define MEMORY_PRIORITY_BACKGROUND 0
105 #define MEMORY_PRIORITY_UNKNOWN 1
106 #define MEMORY_PRIORITY_FOREGROUND 2
109 // Process Priority Separation Values (OR)
111 #define PSP_VARIABLE_QUANTUMS 4
112 #define PSP_LONG_QUANTUMS 16
114 #ifndef NTOS_MODE_USER
117 // Thread Access Types
119 #define THREAD_QUERY_INFORMATION 0x0040
120 #define THREAD_SET_THREAD_TOKEN 0x0080
121 #define THREAD_IMPERSONATE 0x0100
122 #define THREAD_DIRECT_IMPERSONATION 0x0200
125 // Process Access Types
127 #define PROCESS_TERMINATE 0x0001
128 #define PROCESS_CREATE_THREAD 0x0002
129 #define PROCESS_SET_SESSIONID 0x0004
130 #define PROCESS_VM_OPERATION 0x0008
131 #define PROCESS_VM_READ 0x0010
132 #define PROCESS_VM_WRITE 0x0020
133 #define PROCESS_CREATE_PROCESS 0x0080
134 #define PROCESS_SET_QUOTA 0x0100
135 #define PROCESS_SET_INFORMATION 0x0200
136 #define PROCESS_QUERY_INFORMATION 0x0400
137 #define PROCESS_SUSPEND_RESUME 0x0800
138 #define PROCESS_QUERY_LIMITED_INFORMATION 0x1000
139 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
140 #define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
144 #define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
149 // Thread Base Priorities
151 #define THREAD_BASE_PRIORITY_LOWRT 15
152 #define THREAD_BASE_PRIORITY_MAX 2
153 #define THREAD_BASE_PRIORITY_MIN -2
154 #define THREAD_BASE_PRIORITY_IDLE -15
159 #define TLS_MINIMUM_AVAILABLE 64
165 #define JOB_OBJECT_ASSIGN_PROCESS 0x1
166 #define JOB_OBJECT_SET_ATTRIBUTES 0x2
167 #define JOB_OBJECT_QUERY 0x4
168 #define JOB_OBJECT_TERMINATE 0x8
169 #define JOB_OBJECT_SET_SECURITY_ATTRIBUTES 0x10
170 #define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
175 // Cross Thread Flags
177 #define CT_TERMINATED_BIT 0x1
178 #define CT_DEAD_THREAD_BIT 0x2
179 #define CT_HIDE_FROM_DEBUGGER_BIT 0x4
180 #define CT_ACTIVE_IMPERSONATION_INFO_BIT 0x8
181 #define CT_SYSTEM_THREAD_BIT 0x10
182 #define CT_HARD_ERRORS_ARE_DISABLED_BIT 0x20
183 #define CT_BREAK_ON_TERMINATION_BIT 0x40
184 #define CT_SKIP_CREATION_MSG_BIT 0x80
185 #define CT_SKIP_TERMINATION_MSG_BIT 0x100
188 // Same Thread Passive Flags
190 #define STP_ACTIVE_EX_WORKER_BIT 0x1
191 #define STP_EX_WORKER_CAN_WAIT_USER_BIT 0x2
192 #define STP_MEMORY_MAKER_BIT 0x4
193 #define STP_KEYED_EVENT_IN_USE_BIT 0x8
196 // Same Thread APC Flags
198 #define STA_LPC_RECEIVED_MSG_ID_VALID_BIT 0x1
199 #define STA_LPC_EXIT_THREAD_CALLED_BIT 0x2
200 #define STA_ADDRESS_SPACE_OWNER_BIT 0x4
201 #define STA_OWNS_WORKING_SET_BITS 0x1F8
204 #define TLS_EXPANSION_SLOTS 1024
208 #define PSF_CREATE_REPORTED_BIT 0x1
209 #define PSF_NO_DEBUG_INHERIT_BIT 0x2
210 #define PSF_PROCESS_EXITING_BIT 0x4
211 #define PSF_PROCESS_DELETE_BIT 0x8
212 #define PSF_WOW64_SPLIT_PAGES_BIT 0x10
213 #define PSF_VM_DELETED_BIT 0x20
214 #define PSF_OUTSWAP_ENABLED_BIT 0x40
215 #define PSF_OUTSWAPPED_BIT 0x80
216 #define PSF_FORK_FAILED_BIT 0x100
217 #define PSF_WOW64_VA_SPACE_4GB_BIT 0x200
218 #define PSF_ADDRESS_SPACE_INITIALIZED_BIT 0x400
219 #define PSF_SET_TIMER_RESOLUTION_BIT 0x1000
220 #define PSF_BREAK_ON_TERMINATION_BIT 0x2000
221 #define PSF_SESSION_CREATION_UNDERWAY_BIT 0x4000
222 #define PSF_WRITE_WATCH_BIT 0x8000
223 #define PSF_PROCESS_IN_SESSION_BIT 0x10000
224 #define PSF_OVERRIDE_ADDRESS_SPACE_BIT 0x20000
225 #define PSF_HAS_ADDRESS_SPACE_BIT 0x40000
226 #define PSF_LAUNCH_PREFETCHED_BIT 0x80000
227 #define PSF_INJECT_INPAGE_ERRORS_BIT 0x100000
228 #define PSF_VM_TOP_DOWN_BIT 0x200000
229 #define PSF_IMAGE_NOTIFY_DONE_BIT 0x400000
230 #define PSF_PDE_UPDATE_NEEDED_BIT 0x800000
231 #define PSF_VDM_ALLOWED_BIT 0x1000000
232 #define PSF_SWAP_ALLOWED_BIT 0x2000000
233 #define PSF_CREATE_FAILED_BIT 0x4000000
234 #define PSF_DEFAULT_IO_PRIORITY_BIT 0x8000000
237 // Vista Process Flags
239 #define PSF2_PROTECTED_BIT 0x800
241 #ifdef NTOS_MODE_USER
243 // Current Process/Thread built-in 'special' handles
245 #define NtCurrentProcess() ((HANDLE)(LONG_PTR)-1)
246 #define ZwCurrentProcess() NtCurrentProcess()
247 #define NtCurrentThread() ((HANDLE)(LONG_PTR)-2)
248 #define ZwCurrentThread() NtCurrentThread()
251 // Process/Thread/Job Information Classes for NtQueryInformationProcess/Thread/Job
253 typedef enum _PROCESSINFOCLASS
255 ProcessBasicInformation
,
261 ProcessRaisePriority
,
263 ProcessExceptionPort
,
265 ProcessLdtInformation
,
267 ProcessDefaultHardErrorMode
,
268 ProcessIoPortHandlers
,
269 ProcessPooledUsageAndLimits
,
270 ProcessWorkingSetWatch
,
272 ProcessEnableAlignmentFaultFixup
,
273 ProcessPriorityClass
,
274 ProcessWx86Information
,
277 ProcessPriorityBoost
,
279 ProcessSessionInformation
,
280 ProcessForegroundInformation
,
281 ProcessWow64Information
,
282 ProcessImageFileName
,
283 ProcessLUIDDeviceMapsEnabled
,
284 ProcessBreakOnTermination
,
285 ProcessDebugObjectHandle
,
287 ProcessHandleTracing
,
290 ProcessTlsInformation
,
292 ProcessImageInformation
,
295 ProcessInstrumentationCallback
,
296 ProcessThreadStackAllocation
,
297 ProcessWorkingSetWatchEx
,
298 ProcessImageFileNameWin32
,
299 ProcessImageFileMapping
,
300 ProcessAffinityUpdateMode
,
301 ProcessMemoryAllocationMode
,
305 typedef enum _THREADINFOCLASS
307 ThreadBasicInformation
,
312 ThreadImpersonationToken
,
313 ThreadDescriptorTableEntry
,
314 ThreadEnableAlignmentFaultFixup
,
315 ThreadEventPair_Reusable
,
316 ThreadQuerySetWin32StartAddress
,
318 ThreadPerformanceCount
,
320 ThreadIdealProcessor
,
322 ThreadSetTlsArrayAddress
,
324 ThreadHideFromDebugger
,
325 ThreadBreakOnTermination
,
326 ThreadSwitchLegacyState
,
328 ThreadLastSystemCall
,
332 ThreadActualBasePriority
,
333 ThreadTebInformation
,
340 typedef enum _PSPROCESSPRIORITYMODE
342 PsProcessPriorityForeground
,
343 PsProcessPriorityBackground
,
344 PsProcessPrioritySpinning
345 } PSPROCESSPRIORITYMODE
;
347 typedef enum _JOBOBJECTINFOCLASS
349 JobObjectBasicAccountingInformation
= 1,
350 JobObjectBasicLimitInformation
,
351 JobObjectBasicProcessIdList
,
352 JobObjectBasicUIRestrictions
,
353 JobObjectSecurityLimitInformation
,
354 JobObjectEndOfJobTimeInformation
,
355 JobObjectAssociateCompletionPortInformation
,
356 JobObjectBasicAndIoAccountingInformation
,
357 JobObjectExtendedLimitInformation
,
358 JobObjectJobSetInformation
,
359 MaxJobObjectInfoClass
360 } JOBOBJECTINFOCLASS
;
363 // Power Event Events for Win32K Power Event Callback
365 typedef enum _PSPOWEREVENTTYPE
369 PsW32PowerPolicyChanged
= 2,
370 PsW32SystemPowerState
= 3,
372 PsW32DisplayState
= 5,
373 PsW32CapabilitiesChanged
= 6,
374 PsW32SetStateFailed
= 7,
377 PsW32GdiPrepareResumeUI
= 10,
378 PsW32GdiOffRequest
= 11,
379 PsW32MonitorOff
= 12,
383 // Power State Tasks for Win32K Power State Callback
385 typedef enum _POWERSTATETASK
387 PowerState_BlockSessionSwitch
= 0,
389 PowerState_QueryApps
= 2,
390 PowerState_QueryServices
= 3,
391 PowerState_QueryAppsFailed
= 4,
392 PowerState_QueryServicesFailed
= 5,
393 PowerState_SuspendApps
= 6,
394 PowerState_SuspendServices
= 7,
395 PowerState_ShowUI
= 8,
396 PowerState_NotifyWL
= 9,
397 PowerState_ResumeApps
= 10,
398 PowerState_ResumeServices
= 11,
399 PowerState_UnBlockSessionSwitch
= 12,
401 PowerState_BlockInput
= 14,
402 PowerState_UnblockInput
= 15,
406 // Win32K Job Callback Types
408 typedef enum _PSW32JOBCALLOUTTYPE
410 PsW32JobCalloutSetInformation
= 0,
411 PsW32JobCalloutAddProcess
= 1,
412 PsW32JobCalloutTerminate
= 2,
413 } PSW32JOBCALLOUTTYPE
;
416 // Win32K Thread Callback Types
418 typedef enum _PSW32THREADCALLOUTTYPE
420 PsW32ThreadCalloutInitialize
,
421 PsW32ThreadCalloutExit
,
422 } PSW32THREADCALLOUTTYPE
;
425 // Declare empty structure definitions so that they may be referenced by
426 // routines before they are defined
431 struct _WIN32_POWEREVENT_PARAMETERS
;
432 struct _WIN32_POWERSTATE_PARAMETERS
;
433 struct _WIN32_JOBCALLOUT_PARAMETERS
;
434 struct _WIN32_OPENMETHOD_PARAMETERS
;
435 struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS
;
436 struct _WIN32_CLOSEMETHOD_PARAMETERS
;
437 struct _WIN32_DELETEMETHOD_PARAMETERS
;
438 struct _WIN32_PARSEMETHOD_PARAMETERS
;
441 // Win32K Process and Thread Callbacks
445 (NTAPI
*PKWIN32_PROCESS_CALLOUT
)(
446 struct _EPROCESS
*Process
,
452 (NTAPI
*PKWIN32_THREAD_CALLOUT
)(
453 struct _ETHREAD
*Thread
,
454 PSW32THREADCALLOUTTYPE Type
459 (NTAPI
*PKWIN32_GLOBALATOMTABLE_CALLOUT
)(
465 (NTAPI
*PKWIN32_POWEREVENT_CALLOUT
)(
466 struct _WIN32_POWEREVENT_PARAMETERS
*Parameters
471 (NTAPI
*PKWIN32_POWERSTATE_CALLOUT
)(
472 struct _WIN32_POWERSTATE_PARAMETERS
*Parameters
477 (NTAPI
*PKWIN32_JOB_CALLOUT
)(
478 struct _WIN32_JOBCALLOUT_PARAMETERS
*Parameters
483 (NTAPI
*PGDI_BATCHFLUSH_ROUTINE
)(
489 (NTAPI
*PKWIN32_OPENMETHOD_CALLOUT
)(
490 struct _WIN32_OPENMETHOD_PARAMETERS
*Parameters
495 (NTAPI
*PKWIN32_OKTOCLOSEMETHOD_CALLOUT
)(
496 struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS
*Parameters
501 (NTAPI
*PKWIN32_CLOSEMETHOD_CALLOUT
)(
502 struct _WIN32_CLOSEMETHOD_PARAMETERS
*Parameters
507 (NTAPI
*PKWIN32_DELETEMETHOD_CALLOUT
)(
508 struct _WIN32_DELETEMETHOD_PARAMETERS
*Parameters
513 (NTAPI
*PKWIN32_PARSEMETHOD_CALLOUT
)(
514 struct _WIN32_PARSEMETHOD_PARAMETERS
*Parameters
519 (NTAPI
*PKWIN32_WIN32DATACOLLECTION_CALLOUT
)(
520 struct _EPROCESS
*Process
,
530 (NTAPI
*PLEGO_NOTIFY_ROUTINE
)(
537 (NTAPI
*PPOST_PROCESS_INIT_ROUTINE
)(
542 // Descriptor Table Entry Definition
545 #define _DESCRIPTOR_TABLE_ENTRY_DEFINED
546 typedef struct _DESCRIPTOR_TABLE_ENTRY
549 LDT_ENTRY Descriptor
;
550 } DESCRIPTOR_TABLE_ENTRY
, *PDESCRIPTOR_TABLE_ENTRY
;
557 (NTAPI
*PPEBLOCKROUTINE
)(
562 // PEB Free Block Descriptor
564 typedef struct _PEB_FREE_BLOCK
566 struct _PEB_FREE_BLOCK
* Next
;
568 } PEB_FREE_BLOCK
, *PPEB_FREE_BLOCK
;
571 // Process Environment Block (PEB)
575 UCHAR InheritedAddressSpace
;
576 UCHAR ReadImageFileExecOptions
;
578 #if (NTDDI_VERSION >= NTDDI_WS03)
581 UCHAR ImageUsesLargePages
:1;
582 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
583 UCHAR IsProtectedProcess
:1;
584 UCHAR IsLegacyProcess
:1;
594 PVOID ImageBaseAddress
;
596 struct _RTL_USER_PROCESS_PARAMETERS
*ProcessParameters
;
599 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
600 struct _RTL_CRITICAL_SECTION
*FastPebLock
;
601 PVOID AltThunkSListPtr
;
606 PVOID
* KernelCallbackTable
;
607 PVOID UserSharedInfoPtr
;
609 ULONG SystemReserved
[1];
613 PPEBLOCKROUTINE FastPebLockRoutine
;
614 PPEBLOCKROUTINE FastPebUnlockRoutine
;
615 ULONG EnvironmentUpdateCount
;
616 PVOID
* KernelCallbackTable
;
617 PVOID EventLogSection
;
620 PPEB_FREE_BLOCK FreeList
;
621 ULONG TlsExpansionCounter
;
623 ULONG TlsBitmapBits
[0x2];
624 PVOID ReadOnlySharedMemoryBase
;
625 PVOID ReadOnlySharedMemoryHeap
;
626 PVOID
* ReadOnlyStaticServerData
;
627 PVOID AnsiCodePageData
;
628 PVOID OemCodePageData
;
629 PVOID UnicodeCaseTableData
;
630 ULONG NumberOfProcessors
;
632 LARGE_INTEGER CriticalSectionTimeout
;
633 ULONG HeapSegmentReserve
;
634 ULONG HeapSegmentCommit
;
635 ULONG HeapDeCommitTotalFreeThreshold
;
636 ULONG HeapDeCommitFreeBlockThreshold
;
638 ULONG MaximumNumberOfHeaps
;
640 PVOID GdiSharedHandleTable
;
641 PVOID ProcessStarterHelper
;
642 ULONG GdiDCAttributeList
;
643 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
644 struct _RTL_CRITICAL_SECTION
*LoaderLock
;
648 ULONG OSMajorVersion
;
649 ULONG OSMinorVersion
;
650 USHORT OSBuildNumber
;
653 ULONG ImageSubSystem
;
654 ULONG ImageSubSystemMajorVersion
;
655 ULONG ImageSubSystemMinorVersion
;
656 ULONG ImageProcessAffinityMask
;
657 ULONG GdiHandleBuffer
[0x22];
658 PPOST_PROCESS_INIT_ROUTINE PostProcessInitRoutine
;
659 struct _RTL_BITMAP
*TlsExpansionBitmap
;
660 ULONG TlsExpansionBitmapBits
[0x20];
662 #if (NTDDI_VERSION >= NTDDI_WINXP)
663 ULARGE_INTEGER AppCompatFlags
;
664 ULARGE_INTEGER AppCompatFlagsUser
;
667 UNICODE_STRING CSDVersion
;
668 struct _ACTIVATION_CONTEXT_DATA
*ActivationContextData
;
669 struct _ASSEMBLY_STORAGE_MAP
*ProcessAssemblyStorageMap
;
670 struct _ACTIVATION_CONTEXT_DATA
*SystemDefaultActivationContextData
;
671 struct _ASSEMBLY_STORAGE_MAP
*SystemAssemblyStorageMap
;
672 ULONG MinimumStackCommit
;
674 #if (NTDDI_VERSION >= NTDDI_WS03)
676 LIST_ENTRY FlsListHead
;
677 struct _RTL_BITMAP
*FlsBitmap
;
678 ULONG FlsBitmapBits
[4];
681 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
682 PVOID WerRegistrationData
;
683 PVOID WerShipAssertPtr
;
688 // GDI Batch Descriptor
690 typedef struct _GDI_TEB_BATCH
695 } GDI_TEB_BATCH
, *PGDI_TEB_BATCH
;
700 typedef struct _INITIAL_TEB
702 PVOID PreviousStackBase
;
703 PVOID PreviousStackLimit
;
706 PVOID AllocatedStackBase
;
707 } INITIAL_TEB
, *PINITIAL_TEB
;
710 // TEB Active Frame Structures
712 typedef struct _TEB_ACTIVE_FRAME_CONTEXT
716 } TEB_ACTIVE_FRAME_CONTEXT
, *PTEB_ACTIVE_FRAME_CONTEXT
;
718 typedef struct _TEB_ACTIVE_FRAME
721 struct _TEB_ACTIVE_FRAME
*Previous
;
722 PTEB_ACTIVE_FRAME_CONTEXT Context
;
723 } TEB_ACTIVE_FRAME
, *PTEB_ACTIVE_FRAME
;
726 // Thread Environment Block (TEB)
731 PVOID EnvironmentPointer
;
733 PVOID ActiveRpcHandle
;
734 PVOID ThreadLocalStoragePointer
;
735 struct _PEB
*ProcessEnvironmentBlock
;
736 ULONG LastErrorValue
;
737 ULONG CountOfOwnedCriticalSections
;
738 PVOID CsrClientThread
;
739 struct _W32THREAD
* Win32ThreadInfo
;
740 ULONG User32Reserved
[0x1A];
741 ULONG UserReserved
[5];
744 ULONG FpSoftwareStatusRegister
;
745 PVOID SystemReserved1
[0x36];
747 struct _ACTIVATION_CONTEXT_STACK
*ActivationContextStackPointer
;
749 UCHAR SpareBytes1
[24];
751 UCHAR SpareBytes1
[0x24];
754 GDI_TEB_BATCH GdiTebBatch
;
755 CLIENT_ID RealClientId
;
756 PVOID GdiCachedProcessHandle
;
759 PVOID GdiThreadLocalInfo
;
760 SIZE_T Win32ClientInfo
[62];
761 PVOID glDispatchTable
[0xE9];
762 SIZE_T glReserved1
[0x1D];
769 NTSTATUS LastStatusValue
;
770 UNICODE_STRING StaticUnicodeString
;
771 WCHAR StaticUnicodeBuffer
[0x105];
772 PVOID DeallocationStack
;
773 PVOID TlsSlots
[0x40];
776 PVOID ReservedForNtRpc
;
777 PVOID DbgSsReserved
[0x2];
778 ULONG HardErrorDisabled
;
780 PVOID Instrumentation
[11];
782 PVOID Instrumentation
[9];
787 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
792 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
798 BOOLEAN FreeStackOnTermination
;
799 BOOLEAN HasFiberData
;
801 UCHAR IdealProcessor
;
802 ULONG GuaranteedStackBytes
;
803 PVOID ReservedForPerf
;
804 PVOID ReservedForOle
;
805 ULONG WaitingOnLoaderLock
;
806 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
807 PVOID SavedPriorityState
;
813 PVOID
*TlsExpansionSlots
;
814 ULONG ImpersonationLocale
;
815 ULONG IsImpersonating
;
818 ULONG HeapVirualAffinity
;
819 PVOID CurrentTransactionHandle
;
820 PTEB_ACTIVE_FRAME ActiveFrame
;
821 #if (NTDDI_VERSION >= NTDDI_WS03)
824 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
825 PVOID PreferredLangauges
;
826 PVOID UserPrefLanguages
;
827 PVOID MergedPrefLanguages
;
828 ULONG MuiImpersonation
;
833 USHORT SpareCrossTebFlags
:16;
835 USHORT CrossTebFlags
;
841 USHORT DbgSafeThunkCall
:1;
842 USHORT DbgInDebugPrint
:1;
843 USHORT DbgHasFiberData
:1;
844 USHORT DbgSkipThreadAttach
:1;
845 USHORT DbgWerInShipAssertCode
:1;
846 USHORT DbgIssuedInitialBp
:1;
847 USHORT DbgClonedThread
:1;
848 USHORT SpareSameTebBits
:9;
852 PVOID TxnScopeEntercallback
;
853 PVOID TxnScopeExitCAllback
;
854 PVOID TxnScopeContext
;
856 ULONG ProcessRundown
;
857 ULONGLONG LastSwitchTime
;
858 ULONGLONG TotalSwitchOutTime
;
859 LARGE_INTEGER WaitReasonBitMap
;
862 UCHAR BooleanSpare
[3];
866 #ifdef NTOS_MODE_USER
869 // Process Information Structures for NtQueryProcessInformation
871 typedef struct _PROCESS_BASIC_INFORMATION
875 ULONG_PTR AffinityMask
;
876 KPRIORITY BasePriority
;
877 ULONG_PTR UniqueProcessId
;
878 ULONG_PTR InheritedFromUniqueProcessId
;
879 } PROCESS_BASIC_INFORMATION
,*PPROCESS_BASIC_INFORMATION
;
881 typedef struct _PROCESS_ACCESS_TOKEN
885 } PROCESS_ACCESS_TOKEN
, *PPROCESS_ACCESS_TOKEN
;
887 typedef struct _PROCESS_DEVICEMAP_INFORMATION
893 HANDLE DirectoryHandle
;
901 } PROCESS_DEVICEMAP_INFORMATION
, *PPROCESS_DEVICEMAP_INFORMATION
;
903 typedef struct _KERNEL_USER_TIMES
905 LARGE_INTEGER CreateTime
;
906 LARGE_INTEGER ExitTime
;
907 LARGE_INTEGER KernelTime
;
908 LARGE_INTEGER UserTime
;
909 } KERNEL_USER_TIMES
, *PKERNEL_USER_TIMES
;
911 typedef struct _PROCESS_SESSION_INFORMATION
914 } PROCESS_SESSION_INFORMATION
, *PPROCESS_SESSION_INFORMATION
;
918 typedef struct _PROCESS_PRIORITY_CLASS
922 } PROCESS_PRIORITY_CLASS
, *PPROCESS_PRIORITY_CLASS
;
925 // Thread Information Structures for NtQueryProcessInformation
927 typedef struct _THREAD_BASIC_INFORMATION
930 PVOID TebBaseAddress
;
932 KAFFINITY AffinityMask
;
934 KPRIORITY BasePriority
;
935 } THREAD_BASIC_INFORMATION
, *PTHREAD_BASIC_INFORMATION
;
937 #ifndef NTOS_MODE_USER
942 typedef struct _JOB_SET_ARRAY
947 } JOB_SET_ARRAY
, *PJOB_SET_ARRAY
;
950 // EPROCESS Quota Structures
952 typedef struct _EPROCESS_QUOTA_ENTRY
958 } EPROCESS_QUOTA_ENTRY
, *PEPROCESS_QUOTA_ENTRY
;
960 typedef struct _EPROCESS_QUOTA_BLOCK
962 EPROCESS_QUOTA_ENTRY QuotaEntry
[3];
963 LIST_ENTRY QuotaList
;
964 ULONG ReferenceCount
;
966 } EPROCESS_QUOTA_BLOCK
, *PEPROCESS_QUOTA_BLOCK
;
969 // Process Pagefault History
971 typedef struct _PAGEFAULT_HISTORY
977 PROCESS_WS_WATCH_INFORMATION WatchInfo
[1];
978 } PAGEFAULT_HISTORY
, *PPAGEFAULT_HISTORY
;
981 // Process Impersonation Information
983 typedef struct _PS_IMPERSONATION_INFORMATION
987 BOOLEAN EffectiveOnly
;
988 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
;
989 } PS_IMPERSONATION_INFORMATION
, *PPS_IMPERSONATION_INFORMATION
;
992 // Process Termination Port
994 typedef struct _TERMINATION_PORT
996 struct _TERMINATION_PORT
*Next
;
998 } TERMINATION_PORT
, *PTERMINATION_PORT
;
1001 // Per-Process APC Rate Limiting
1003 typedef struct _PSP_RATE_APC
1007 SINGLE_LIST_ENTRY NextApc
;
1008 ULONGLONG ExcessCycles
;
1010 ULONGLONG TargetGEneration
;
1012 } PSP_RATE_APC
, *PPSP_RATE_APC
;
1015 // Executive Thread (ETHREAD)
1017 typedef struct _ETHREAD
1021 LARGE_INTEGER CreateTime
;
1024 LARGE_INTEGER ExitTime
;
1025 LIST_ENTRY LpcReplyChain
;
1026 LIST_ENTRY KeyedWaitChain
;
1030 NTSTATUS ExitStatus
;
1033 LIST_ENTRY PostBlockList
;
1036 struct _TERMINATION_PORT
*TerminationPort
;
1037 struct _ETHREAD
*ReaperLink
;
1038 PVOID KeyedWaitValue
;
1039 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1040 PVOID Win32StartParameter
;
1043 KSPIN_LOCK ActiveTimerListLock
;
1044 LIST_ENTRY ActiveTimerListHead
;
1046 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1047 KSEMAPHORE KeyedWaitSemaphore
;
1051 KSEMAPHORE LpcReplySemaphore
;
1052 KSEMAPHORE KeyedReplySemaphore
;
1056 PVOID LpcReplyMessage
;
1057 PVOID LpcWaitingOnPort
;
1060 PPS_IMPERSONATION_INFORMATION ImpersonationInfo
;
1063 PDEVICE_OBJECT DeviceToVerify
;
1064 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1065 PPSP_RATE_APC RateControlApc
;
1067 struct _EPROCESS
*ThreadsProcess
;
1069 PVOID Win32StartAddress
;
1072 PKSTART_ROUTINE StartAddress
;
1073 ULONG LpcReceivedMessageId
;
1075 LIST_ENTRY ThreadListEntry
;
1076 EX_RUNDOWN_REF RundownProtect
;
1077 EX_PUSH_LOCK ThreadLock
;
1078 #if (NTDDI_VERSION < NTDDI_LONGHORN)
1079 ULONG LpcReplyMessageId
;
1081 ULONG ReadClusterSize
;
1082 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1085 ACCESS_MASK GrantedAccess
;
1092 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1093 ULONG ThreadInserted
:1;
1097 ULONG HideFromDebugger
:1;
1098 ULONG ActiveImpersonationInfo
:1;
1099 ULONG SystemThread
:1;
1100 ULONG HardErrorsAreDisabled
:1;
1101 ULONG BreakOnTermination
:1;
1102 ULONG SkipCreationMsg
:1;
1103 ULONG SkipTerminationMsg
:1;
1104 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1105 ULONG CreateMsgSent
:1;
1106 ULONG ThreadIoPriority
:3;
1107 ULONG ThreadPagePriority
:3;
1108 ULONG PendingRatecontrol
:1;
1111 ULONG CrossThreadFlags
;
1117 ULONG ActiveExWorker
:1;
1118 ULONG ExWorkerCanWaitUser
:1;
1119 ULONG MemoryMaker
:1;
1120 ULONG KeyedEventInUse
:1;
1121 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1122 ULONG RateApcState
:2;
1125 ULONG SameThreadPassiveFlags
;
1131 ULONG LpcReceivedMsgIdValid
:1;
1132 ULONG LpcExitThreadCalled
:1;
1133 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1136 ULONG AddressSpaceOwner
:1;
1138 ULONG OwnsProcessWorkingSetExclusive
:1;
1139 ULONG OwnsProcessWorkingSetShared
:1;
1140 ULONG OwnsSystemWorkingSetExclusive
:1;
1141 ULONG OwnsSystemWorkingSetShared
:1;
1142 ULONG OwnsSessionWorkingSetExclusive
:1;
1143 ULONG OwnsSessionWorkingSetShared
:1;
1144 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1145 ULONG SupressSymbolLoad
:1;
1147 ULONG PriorityRegionActive
:4;
1152 ULONG SameThreadApcFlags
;
1154 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1155 UCHAR CacheManagerActive
;
1157 UCHAR ForwardClusterOnly
;
1159 UCHAR DisablePageFaultClustering
;
1160 UCHAR ActiveFaultCount
;
1161 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1162 ULONG AlpcMessageId
;
1166 ULONG AlpcReceiveAttributeSet
;
1168 LIST_ENTRY AlpcWaitListEntry
;
1169 KSEMAPHORE AlpcWaitSemaphore
;
1170 ULONG CacheManagerCount
;
1172 } ETHREAD
, *PETHREAD
;
1175 // Executive Process (EPROCESS)
1177 typedef struct _EPROCESS
1180 EX_PUSH_LOCK ProcessLock
;
1181 LARGE_INTEGER CreateTime
;
1182 LARGE_INTEGER ExitTime
;
1183 EX_RUNDOWN_REF RundownProtect
;
1184 HANDLE UniqueProcessId
;
1185 LIST_ENTRY ActiveProcessLinks
;
1186 ULONG QuotaUsage
[3]; /* 0=PagedPool, 1=NonPagedPool, 2=Pagefile */
1187 ULONG QuotaPeak
[3]; /* ditto */
1189 ULONG PeakVirtualSize
;
1191 LIST_ENTRY SessionProcessLinks
;
1193 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1196 PVOID ExceptionPortData
;
1197 ULONG ExceptionPortValue
;
1198 UCHAR ExceptionPortState
:3;
1201 PVOID ExceptionPort
;
1203 PHANDLE_TABLE ObjectTable
;
1205 ULONG WorkingSetPage
;
1206 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1207 EX_PUSH_LOCK AddressCreationLock
;
1208 PETHREAD RotateInProgress
;
1210 KGUARDED_MUTEX AddressCreationLock
;
1211 KSPIN_LOCK HyperSpaceLock
;
1213 PETHREAD ForkInProgress
;
1214 ULONG HardwareTrigger
;
1215 PMM_AVL_TABLE PhysicalVadRoot
;
1217 ULONG NumberOfPrivatePages
;
1218 ULONG NumberOfLockedPages
;
1219 PVOID
*Win32Process
;
1221 PVOID SectionObject
;
1222 PVOID SectionBaseAddress
;
1223 PEPROCESS_QUOTA_BLOCK QuotaBlock
;
1224 PPAGEFAULT_HISTORY WorkingSetWatch
;
1225 PVOID Win32WindowStation
;
1226 HANDLE InheritedFromUniqueProcessId
;
1227 PVOID LdtInformation
;
1231 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1232 PVOID EtwDataSource
;
1239 HARDWARE_PTE PageDirectoryPte
;
1243 CHAR ImageFileName
[16];
1244 LIST_ENTRY JobLinks
;
1245 PVOID LockedPagesList
;
1246 LIST_ENTRY ThreadListHead
;
1249 ULONG ActiveThreads
;
1250 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1251 ULONG ImagePathHash
;
1253 ACCESS_MASK GrantedAccess
;
1255 ULONG DefaultHardErrorProcessing
;
1256 NTSTATUS LastThreadExitStatus
;
1258 EX_FAST_REF PrefetchTrace
;
1259 LARGE_INTEGER ReadOperationCount
;
1260 LARGE_INTEGER WriteOperationCount
;
1261 LARGE_INTEGER OtherOperationCount
;
1262 LARGE_INTEGER ReadTransferCount
;
1263 LARGE_INTEGER WriteTransferCount
;
1264 LARGE_INTEGER OtherTransferCount
;
1265 ULONG CommitChargeLimit
;
1266 ULONG CommitChargePeak
;
1268 SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo
;
1270 LIST_ENTRY MmProcessLinks
;
1271 ULONG ModifiedPageCount
;
1272 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1277 ULONG JobNotReallyActive
:1;
1278 ULONG AccountingFolded
:1;
1279 ULONG NewProcessReported
:1;
1280 ULONG ExitProcessReported
:1;
1281 ULONG ReportCommitChanges
:1;
1282 ULONG LastReportMemory
:1;
1283 ULONG ReportPhysicalPageChanges
:1;
1284 ULONG HandleTableRundown
:1;
1285 ULONG NeedsHandleRundown
:1;
1286 ULONG RefTraceEnabled
:1;
1288 ULONG ProtectedProcess
:1;
1289 ULONG DefaultPagePriority
:3;
1290 ULONG ProcessDeleteSelf
:1;
1291 ULONG ProcessVerifierTarget
:1;
1302 ULONG CreateReported
:1;
1303 ULONG NoDebugInherit
:1;
1304 ULONG ProcessExiting
:1;
1305 ULONG ProcessDelete
:1;
1306 ULONG Wow64SplitPages
:1;
1308 ULONG OutswapEnabled
:1;
1311 ULONG Wow64VaSpace4Gb
:1;
1312 ULONG AddressSpaceInitialized
:2;
1313 ULONG SetTimerResolution
:1;
1314 ULONG BreakOnTermination
:1;
1315 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1316 ULONG DeprioritizeViews
:1;
1318 ULONG SessionCreationUnderway
:1;
1321 ULONG ProcessInSession
:1;
1322 ULONG OverrideAddressSpace
:1;
1323 ULONG HasAddressSpace
:1;
1324 ULONG LaunchPrefetched
:1;
1325 ULONG InjectInpageErrors
:1;
1327 ULONG ImageNotifyDone
:1;
1328 ULONG PdeUpdateNeeded
:1;
1330 ULONG SmapAllowed
:1;
1331 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1332 ULONG ProcessInserted
:1;
1334 ULONG CreateFailed
:1;
1336 ULONG DefaultIoPriority
:3;
1337 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1338 ULONG SparePsFlags1
:2;
1346 NTSTATUS ExitStatus
;
1347 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1350 USHORT NextPageColor
;
1356 UCHAR SubSystemMinorVersion
;
1357 UCHAR SubSystemMajorVersion
;
1359 USHORT SubSystemVersion
;
1361 UCHAR PriorityClass
;
1362 MM_AVL_TABLE VadRoot
;
1364 } EPROCESS
, *PEPROCESS
;
1367 // Job Token Filter Data
1369 #include <pshpack1.h>
1370 typedef struct _PS_JOB_TOKEN_FILTER
1372 ULONG CapturedSidCount
;
1373 PSID_AND_ATTRIBUTES CapturedSids
;
1374 ULONG CapturedSidsLength
;
1375 ULONG CapturedGroupCount
;
1376 PSID_AND_ATTRIBUTES CapturedGroups
;
1377 ULONG CapturedGroupsLength
;
1378 ULONG CapturedPrivilegeCount
;
1379 PLUID_AND_ATTRIBUTES CapturedPrivileges
;
1380 ULONG CapturedPrivilegesLength
;
1381 } PS_JOB_TOKEN_FILTER
, *PPS_JOB_TOKEN_FILTER
;
1384 // Executive Job (EJOB)
1386 typedef struct _EJOB
1389 LIST_ENTRY JobLinks
;
1390 LIST_ENTRY ProcessListHead
;
1392 LARGE_INTEGER TotalUserTime
;
1393 LARGE_INTEGER TotalKernelTime
;
1394 LARGE_INTEGER ThisPeriodTotalUserTime
;
1395 LARGE_INTEGER ThisPeriodTotalKernelTime
;
1396 ULONG TotalPageFaultCount
;
1397 ULONG TotalProcesses
;
1398 ULONG ActiveProcesses
;
1399 ULONG TotalTerminatedProcesses
;
1400 LARGE_INTEGER PerProcessUserTimeLimit
;
1401 LARGE_INTEGER PerJobUserTimeLimit
;
1403 ULONG MinimumWorkingSetSize
;
1404 ULONG MaximumWorkingSetSize
;
1405 ULONG ActiveProcessLimit
;
1407 UCHAR PriorityClass
;
1408 ULONG UIRestrictionsClass
;
1409 ULONG SecurityLimitFlags
;
1411 PPS_JOB_TOKEN_FILTER Filter
;
1412 ULONG EndOfJobTimeAction
;
1413 PVOID CompletionPort
;
1414 PVOID CompletionKey
;
1416 ULONG SchedulingClass
;
1417 ULONGLONG ReadOperationCount
;
1418 ULONGLONG WriteOperationCount
;
1419 ULONGLONG OtherOperationCount
;
1420 ULONGLONG ReadTransferCount
;
1421 ULONGLONG WriteTransferCount
;
1422 ULONGLONG OtherTransferCount
;
1424 ULONG ProcessMemoryLimit
;
1425 ULONG JobMemoryLimit
;
1426 ULONG PeakProcessMemoryUsed
;
1427 ULONG PeakJobMemoryUsed
;
1428 ULONG CurrentJobMemoryUsed
;
1429 #if (NTDDI_VERSION >= NTDDI_WINXP) && (NTDDI_VERSION < NTDDI_WS03)
1430 FAST_MUTEX MemoryLimitsLock
;
1431 #elif (NTDDI_VERSION >= NTDDI_WS03) && (NTDDI_VERSION < NTDDI_LONGHORN)
1432 KGUARDED_MUTEX MemoryLimitsLock
;
1433 #elif (NTDDI_VERSION >= NTDDI_LONGHORN)
1434 EX_PUSH_LOCK MemoryLimitsLock
;
1436 LIST_ENTRY JobSetLinks
;
1440 #include <poppack.h>
1443 // Win32K Callback Registration Data
1445 typedef struct _WIN32_POWEREVENT_PARAMETERS
1447 PSPOWEREVENTTYPE EventNumber
;
1449 } WIN32_POWEREVENT_PARAMETERS
, *PWIN32_POWEREVENT_PARAMETERS
;
1451 typedef struct _WIN32_POWERSTATE_PARAMETERS
1454 POWER_ACTION SystemAction
;
1455 SYSTEM_POWER_STATE MinSystemState
;
1457 POWERSTATETASK PowerStateTask
;
1458 } WIN32_POWERSTATE_PARAMETERS
, *PWIN32_POWERSTATE_PARAMETERS
;
1460 typedef struct _WIN32_JOBCALLOUT_PARAMETERS
1463 PSW32JOBCALLOUTTYPE CalloutType
;
1465 } WIN32_JOBCALLOUT_PARAMETERS
, *PWIN32_JOBCALLOUT_PARAMETERS
;
1467 typedef struct _WIN32_OPENMETHOD_PARAMETERS
1469 OB_OPEN_REASON OpenReason
;
1472 ULONG GrantedAccess
;
1474 } WIN32_OPENMETHOD_PARAMETERS
, *PWIN32_OPENMETHOD_PARAMETERS
;
1476 typedef struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS
1481 KPROCESSOR_MODE PreviousMode
;
1482 } WIN32_OKAYTOCLOSEMETHOD_PARAMETERS
, *PWIN32_OKAYTOCLOSEMETHOD_PARAMETERS
;
1484 typedef struct _WIN32_CLOSEMETHOD_PARAMETERS
1488 ACCESS_MASK AccessMask
;
1489 ULONG ProcessHandleCount
;
1490 ULONG SystemHandleCount
;
1491 } WIN32_CLOSEMETHOD_PARAMETERS
, *PWIN32_CLOSEMETHOD_PARAMETERS
;
1493 typedef struct _WIN32_DELETEMETHOD_PARAMETERS
1496 } WIN32_DELETEMETHOD_PARAMETERS
, *PWIN32_DELETEMETHOD_PARAMETERS
;
1498 typedef struct _WIN32_PARSEMETHOD_PARAMETERS
1502 PACCESS_STATE AccessState
;
1503 KPROCESSOR_MODE AccessMode
;
1505 OUT PUNICODE_STRING CompleteName
;
1506 PUNICODE_STRING RemainingName
;
1508 PSECURITY_QUALITY_OF_SERVICE SecurityQos
;
1510 } WIN32_PARSEMETHOD_PARAMETERS
, *PWIN32_PARSEMETHOD_PARAMETERS
;
1512 typedef struct _WIN32_CALLOUTS_FPNS
1514 PKWIN32_PROCESS_CALLOUT ProcessCallout
;
1515 PKWIN32_THREAD_CALLOUT ThreadCallout
;
1516 PKWIN32_GLOBALATOMTABLE_CALLOUT GlobalAtomTableCallout
;
1517 PKWIN32_POWEREVENT_CALLOUT PowerEventCallout
;
1518 PKWIN32_POWERSTATE_CALLOUT PowerStateCallout
;
1519 PKWIN32_JOB_CALLOUT JobCallout
;
1520 PGDI_BATCHFLUSH_ROUTINE BatchFlushRoutine
;
1521 PKWIN32_OPENMETHOD_CALLOUT DesktopOpenProcedure
;
1522 PKWIN32_OKTOCLOSEMETHOD_CALLOUT DesktopOkToCloseProcedure
;
1523 PKWIN32_CLOSEMETHOD_CALLOUT DesktopCloseProcedure
;
1524 PKWIN32_DELETEMETHOD_CALLOUT DesktopDeleteProcedure
;
1525 PKWIN32_OKTOCLOSEMETHOD_CALLOUT WindowStationOkToCloseProcedure
;
1526 PKWIN32_CLOSEMETHOD_CALLOUT WindowStationCloseProcedure
;
1527 PKWIN32_DELETEMETHOD_CALLOUT WindowStationDeleteProcedure
;
1528 PKWIN32_PARSEMETHOD_CALLOUT WindowStationParseProcedure
;
1529 PKWIN32_OPENMETHOD_CALLOUT WindowStationOpenProcedure
;
1530 PKWIN32_WIN32DATACOLLECTION_CALLOUT Win32DataCollectionProcedure
;
1531 } WIN32_CALLOUTS_FPNS
, *PWIN32_CALLOUTS_FPNS
;
1533 #endif // !NTOS_MODE_USER
1535 #endif // _PSTYPES_H