reactos/sdk/include/ndk/pstypes.h

   1 /*++ NDK Version: 0098
   2
   3 Copyright (c) Alex Ionescu.  All rights reserved.
   4
   5 Header Name:
   6
   7     pstypes.h
   8
   9 Abstract:
  10
  11     Type definitions for the Process Manager
  12
  13 Author:
  14
  15     Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
  16
  17 --*/
  18
  19 #ifndef _PSTYPES_H
  20 #define _PSTYPES_H
  21
  22 //
  23 // Dependencies
  24 //
  25 #include <umtypes.h>
  26 #include <ldrtypes.h>
  27 #include <mmtypes.h>
  28 #include <obtypes.h>
  29 #include <rtltypes.h>
  30 #ifndef NTOS_MODE_USER
  31 #include <extypes.h>
  32 #include <setypes.h>
  33 #endif
  34
  35 #ifdef __cplusplus
  36 extern "C" {
  37 #endif
  38
  39 #ifndef NTOS_MODE_USER
  40
  41 //
  42 // Kernel Exported Object Types
  43 //
  44 extern POBJECT_TYPE NTSYSAPI PsJobType;
  45
  46 #endif // !NTOS_MODE_USER
  47
  48 //
  49 // KUSER_SHARED_DATA location in User Mode
  50 //
  51 #define USER_SHARED_DATA                        (0x7FFE0000)
  52
  53 //
  54 // Global Flags
  55 //
  56 #define FLG_STOP_ON_EXCEPTION                   0x00000001
  57 #define FLG_SHOW_LDR_SNAPS                      0x00000002
  58 #define FLG_DEBUG_INITIAL_COMMAND               0x00000004
  59 #define FLG_STOP_ON_HUNG_GUI                    0x00000008
  60 #define FLG_HEAP_ENABLE_TAIL_CHECK              0x00000010
  61 #define FLG_HEAP_ENABLE_FREE_CHECK              0x00000020
  62 #define FLG_HEAP_VALIDATE_PARAMETERS            0x00000040
  63 #define FLG_HEAP_VALIDATE_ALL                   0x00000080
  64 #define FLG_POOL_ENABLE_TAIL_CHECK              0x00000100
  65 #define FLG_POOL_ENABLE_FREE_CHECK              0x00000200
  66 #define FLG_POOL_ENABLE_TAGGING                 0x00000400
  67 #define FLG_HEAP_ENABLE_TAGGING                 0x00000800
  68 #define FLG_USER_STACK_TRACE_DB                 0x00001000
  69 #define FLG_KERNEL_STACK_TRACE_DB               0x00002000
  70 #define FLG_MAINTAIN_OBJECT_TYPELIST            0x00004000
  71 #define FLG_HEAP_ENABLE_TAG_BY_DLL              0x00008000
  72 #define FLG_DISABLE_STACK_EXTENSION             0x00010000
  73 #define FLG_ENABLE_CSRDEBUG                     0x00020000
  74 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD           0x00040000
  75 #define FLG_DISABLE_PAGE_KERNEL_STACKS          0x00080000
  76 #if (NTDDI_VERSION < NTDDI_WINXP)
  77 #define FLG_HEAP_ENABLE_CALL_TRACING            0x00100000
  78 #else
  79 #define FLG_ENABLE_SYSTEM_CRIT_BREAKS           0x00100000
  80 #endif
  81 #define FLG_HEAP_DISABLE_COALESCING             0x00200000
  82 #define FLG_ENABLE_CLOSE_EXCEPTIONS             0x00400000
  83 #define FLG_ENABLE_EXCEPTION_LOGGING            0x00800000
  84 #define FLG_ENABLE_HANDLE_TYPE_TAGGING          0x01000000
  85 #define FLG_HEAP_PAGE_ALLOCS                    0x02000000
  86 #define FLG_DEBUG_INITIAL_COMMAND_EX            0x04000000
  87 #define FLG_VALID_BITS                          0x07FFFFFF
  88
  89 //
  90 // Flags for NtCreateProcessEx
  91 //
  92 #define PROCESS_CREATE_FLAGS_BREAKAWAY              0x00000001
  93 #define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT       0x00000002
  94 #define PROCESS_CREATE_FLAGS_INHERIT_HANDLES        0x00000004
  95 #define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008
  96 #define PROCESS_CREATE_FLAGS_LARGE_PAGES            0x00000010
  97 #define PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS   PROCESS_CREATE_FLAGS_LARGE_PAGES
  98 #define PROCESS_CREATE_FLAGS_LEGAL_MASK             (PROCESS_CREATE_FLAGS_BREAKAWAY | \
  99                                                      PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT | \
 100                                                      PROCESS_CREATE_FLAGS_INHERIT_HANDLES | \
 101                                                      PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE | \
 102                                                      PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS)
 103
 104 //
 105 // Process priority classes
 106 //
 107 #define PROCESS_PRIORITY_CLASS_INVALID          0
 108 #define PROCESS_PRIORITY_CLASS_IDLE             1
 109 #define PROCESS_PRIORITY_CLASS_NORMAL           2
 110 #define PROCESS_PRIORITY_CLASS_HIGH             3
 111 #define PROCESS_PRIORITY_CLASS_REALTIME         4
 112 #define PROCESS_PRIORITY_CLASS_BELOW_NORMAL     5
 113 #define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL     6
 114
 115 //
 116 // Process base priorities
 117 //
 118 #define PROCESS_PRIORITY_IDLE                   3
 119 #define PROCESS_PRIORITY_NORMAL                 8
 120 #define PROCESS_PRIORITY_NORMAL_FOREGROUND      9
 121
 122 //
 123 // Process memory priorities
 124 //
 125 #define MEMORY_PRIORITY_BACKGROUND             0
 126 #define MEMORY_PRIORITY_UNKNOWN                1
 127 #define MEMORY_PRIORITY_FOREGROUND             2
 128
 129 //
 130 // Process Priority Separation Values (OR)
 131 //
 132 #define PSP_DEFAULT_QUANTUMS                    0x00
 133 #define PSP_VARIABLE_QUANTUMS                   0x04
 134 #define PSP_FIXED_QUANTUMS                      0x08
 135 #define PSP_LONG_QUANTUMS                       0x10
 136 #define PSP_SHORT_QUANTUMS                      0x20
 137
 138 #ifndef NTOS_MODE_USER
 139 //
 140 // Thread Access Types
 141 //
 142 #define THREAD_QUERY_INFORMATION                0x0040
 143 #define THREAD_SET_THREAD_TOKEN                 0x0080
 144 #define THREAD_IMPERSONATE                      0x0100
 145 #define THREAD_DIRECT_IMPERSONATION             0x0200
 146
 147 //
 148 // Process Access Types
 149 //
 150 #define PROCESS_TERMINATE                       0x0001
 151 #define PROCESS_CREATE_THREAD                   0x0002
 152 #define PROCESS_SET_SESSIONID                   0x0004
 153 #define PROCESS_VM_OPERATION                    0x0008
 154 #define PROCESS_VM_READ                         0x0010
 155 #define PROCESS_VM_WRITE                        0x0020
 156 #define PROCESS_CREATE_PROCESS                  0x0080
 157 #define PROCESS_SET_QUOTA                       0x0100
 158 #define PROCESS_SET_INFORMATION                 0x0200
 159 #define PROCESS_QUERY_INFORMATION               0x0400
 160 #define PROCESS_SUSPEND_RESUME                  0x0800
 161 #define PROCESS_QUERY_LIMITED_INFORMATION       0x1000
 162 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 163 #define PROCESS_ALL_ACCESS                      (STANDARD_RIGHTS_REQUIRED | \
 164                                                  SYNCHRONIZE | \
 165                                                  0xFFFF)
 166 #else
 167 #define PROCESS_ALL_ACCESS                      (STANDARD_RIGHTS_REQUIRED | \
 168                                                  SYNCHRONIZE | \
 169                                                  0xFFF)
 170 #endif
 171
 172 //
 173 // Thread Base Priorities
 174 //
 175 #define THREAD_BASE_PRIORITY_LOWRT              15
 176 #define THREAD_BASE_PRIORITY_MAX                2
 177 #define THREAD_BASE_PRIORITY_MIN                -2
 178 #define THREAD_BASE_PRIORITY_IDLE               -15
 179
 180 //
 181 // TLS Slots
 182 //
 183 #define TLS_MINIMUM_AVAILABLE                   64
 184
 185 //
 186 // TEB Active Frame Flags
 187 //
 188 #define TEB_ACTIVE_FRAME_CONTEXT_FLAG_EXTENDED  0x1
 189
 190 //
 191 // Job Access Types
 192 //
 193 #define JOB_OBJECT_ASSIGN_PROCESS               0x1
 194 #define JOB_OBJECT_SET_ATTRIBUTES               0x2
 195 #define JOB_OBJECT_QUERY                        0x4
 196 #define JOB_OBJECT_TERMINATE                    0x8
 197 #define JOB_OBJECT_SET_SECURITY_ATTRIBUTES      0x10
 198 #define JOB_OBJECT_ALL_ACCESS                   (STANDARD_RIGHTS_REQUIRED | \
 199                                                  SYNCHRONIZE | \
 200                                                  31)
 201
 202 //
 203 // Job Limit Flags
 204 //
 205 #define JOB_OBJECT_LIMIT_WORKINGSET             0x1
 206 #define JOB_OBJECT_LIMIT_PROCESS_TIME           0x2
 207 #define JOB_OBJECT_LIMIT_JOB_TIME               0x4
 208 #define JOB_OBJECT_LIMIT_ACTIVE_PROCESS         0x8
 209 #define JOB_OBJECT_LIMIT_AFFINITY               0x10
 210 #define JOB_OBJECT_LIMIT_PRIORITY_CLASS         0x20
 211 #define JOB_OBJECT_LIMIT_PRESERVE_JOB_TIME      0x40
 212 #define JOB_OBJECT_LIMIT_SCHEDULING_CLASS       0x80
 213 #define JOB_OBJECT_LIMIT_PROCESS_MEMORY         0x100
 214 #define JOB_OBJECT_LIMIT_JOB_MEMORY             0x200
 215 #define JOB_OBJECT_LIMIT_DIE_ON_UNHANDLED_EXCEPTION 0x400
 216 #define JOB_OBJECT_LIMIT_BREAKAWAY_OK           0x800
 217 #define JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK    0x1000
 218 #define JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE      0x2000
 219
 220 //
 221 // Cross Thread Flags
 222 //
 223 #define CT_TERMINATED_BIT                       0x1
 224 #define CT_DEAD_THREAD_BIT                      0x2
 225 #define CT_HIDE_FROM_DEBUGGER_BIT               0x4
 226 #define CT_ACTIVE_IMPERSONATION_INFO_BIT        0x8
 227 #define CT_SYSTEM_THREAD_BIT                    0x10
 228 #define CT_HARD_ERRORS_ARE_DISABLED_BIT         0x20
 229 #define CT_BREAK_ON_TERMINATION_BIT             0x40
 230 #define CT_SKIP_CREATION_MSG_BIT                0x80
 231 #define CT_SKIP_TERMINATION_MSG_BIT             0x100
 232
 233 //
 234 // Same Thread Passive Flags
 235 //
 236 #define STP_ACTIVE_EX_WORKER_BIT                0x1
 237 #define STP_EX_WORKER_CAN_WAIT_USER_BIT         0x2
 238 #define STP_MEMORY_MAKER_BIT                    0x4
 239 #define STP_KEYED_EVENT_IN_USE_BIT              0x8
 240
 241 //
 242 // Same Thread APC Flags
 243 //
 244 #define STA_LPC_RECEIVED_MSG_ID_VALID_BIT       0x1
 245 #define STA_LPC_EXIT_THREAD_CALLED_BIT          0x2
 246 #define STA_ADDRESS_SPACE_OWNER_BIT             0x4
 247 #define STA_OWNS_WORKING_SET_BITS               0x1F8
 248
 249 //
 250 // Kernel Process flags (maybe in ketypes.h?)
 251 //
 252 #define KPSF_AUTO_ALIGNMENT_BIT                 0
 253 #define KPSF_DISABLE_BOOST_BIT                  1
 254
 255 //
 256 // Process Flags
 257 //
 258 #define PSF_CREATE_REPORTED_BIT                 0x1
 259 #define PSF_NO_DEBUG_INHERIT_BIT                0x2
 260 #define PSF_PROCESS_EXITING_BIT                 0x4
 261 #define PSF_PROCESS_DELETE_BIT                  0x8
 262 #define PSF_WOW64_SPLIT_PAGES_BIT               0x10
 263 #define PSF_VM_DELETED_BIT                      0x20
 264 #define PSF_OUTSWAP_ENABLED_BIT                 0x40
 265 #define PSF_OUTSWAPPED_BIT                      0x80
 266 #define PSF_FORK_FAILED_BIT                     0x100
 267 #define PSF_WOW64_VA_SPACE_4GB_BIT              0x200
 268 #define PSF_ADDRESS_SPACE_INITIALIZED_BIT       0x400
 269 #define PSF_SET_TIMER_RESOLUTION_BIT            0x1000
 270 #define PSF_BREAK_ON_TERMINATION_BIT            0x2000
 271 #define PSF_SESSION_CREATION_UNDERWAY_BIT       0x4000
 272 #define PSF_WRITE_WATCH_BIT                     0x8000
 273 #define PSF_PROCESS_IN_SESSION_BIT              0x10000
 274 #define PSF_OVERRIDE_ADDRESS_SPACE_BIT          0x20000
 275 #define PSF_HAS_ADDRESS_SPACE_BIT               0x40000
 276 #define PSF_LAUNCH_PREFETCHED_BIT               0x80000
 277 #define PSF_INJECT_INPAGE_ERRORS_BIT            0x100000
 278 #define PSF_VM_TOP_DOWN_BIT                     0x200000
 279 #define PSF_IMAGE_NOTIFY_DONE_BIT               0x400000
 280 #define PSF_PDE_UPDATE_NEEDED_BIT               0x800000
 281 #define PSF_VDM_ALLOWED_BIT                     0x1000000
 282 #define PSF_SWAP_ALLOWED_BIT                    0x2000000
 283 #define PSF_CREATE_FAILED_BIT                   0x4000000
 284 #define PSF_DEFAULT_IO_PRIORITY_BIT             0x8000000
 285
 286 //
 287 // Vista Process Flags
 288 //
 289 #define PSF2_PROTECTED_BIT                      0x800
 290 #endif
 291
 292 //
 293 // TLS/FLS Defines
 294 //
 295 #define TLS_EXPANSION_SLOTS                     1024
 296
 297 #ifdef NTOS_MODE_USER
 298 //
 299 // Thread Native Base Priorities
 300 //
 301 #define LOW_PRIORITY                            0
 302 #define LOW_REALTIME_PRIORITY                   16
 303 #define HIGH_PRIORITY                           31
 304 #define MAXIMUM_PRIORITY                        32
 305
 306 //
 307 // Current Process/Thread built-in 'special' handles
 308 //
 309 #define NtCurrentProcess()                      ((HANDLE)(LONG_PTR)-1)
 310 #define ZwCurrentProcess()                      NtCurrentProcess()
 311 #define NtCurrentThread()                       ((HANDLE)(LONG_PTR)-2)
 312 #define ZwCurrentThread()                       NtCurrentThread()
 313
 314 //
 315 // Process/Thread/Job Information Classes for NtQueryInformationProcess/Thread/Job
 316 //
 317 typedef enum _PROCESSINFOCLASS
 318 {
 319     ProcessBasicInformation,
 320     ProcessQuotaLimits,
 321     ProcessIoCounters,
 322     ProcessVmCounters,
 323     ProcessTimes,
 324     ProcessBasePriority,
 325     ProcessRaisePriority,
 326     ProcessDebugPort,
 327     ProcessExceptionPort,
 328     ProcessAccessToken,
 329     ProcessLdtInformation,
 330     ProcessLdtSize,
 331     ProcessDefaultHardErrorMode,
 332     ProcessIoPortHandlers,
 333     ProcessPooledUsageAndLimits,
 334     ProcessWorkingSetWatch,
 335     ProcessUserModeIOPL,
 336     ProcessEnableAlignmentFaultFixup,
 337     ProcessPriorityClass,
 338     ProcessWx86Information,
 339     ProcessHandleCount,
 340     ProcessAffinityMask,
 341     ProcessPriorityBoost,
 342     ProcessDeviceMap,
 343     ProcessSessionInformation,
 344     ProcessForegroundInformation,
 345     ProcessWow64Information,
 346     ProcessImageFileName,
 347     ProcessLUIDDeviceMapsEnabled,
 348     ProcessBreakOnTermination,
 349     ProcessDebugObjectHandle,
 350     ProcessDebugFlags,
 351     ProcessHandleTracing,
 352     ProcessIoPriority,
 353     ProcessExecuteFlags,
 354     ProcessTlsInformation,
 355     ProcessCookie,
 356     ProcessImageInformation,
 357     ProcessCycleTime,
 358     ProcessPagePriority,
 359     ProcessInstrumentationCallback,
 360     ProcessThreadStackAllocation,
 361     ProcessWorkingSetWatchEx,
 362     ProcessImageFileNameWin32,
 363     ProcessImageFileMapping,
 364     ProcessAffinityUpdateMode,
 365     ProcessMemoryAllocationMode,
 366     MaxProcessInfoClass
 367 } PROCESSINFOCLASS;
 368
 369 typedef enum _THREADINFOCLASS
 370 {
 371     ThreadBasicInformation,
 372     ThreadTimes,
 373     ThreadPriority,
 374     ThreadBasePriority,
 375     ThreadAffinityMask,
 376     ThreadImpersonationToken,
 377     ThreadDescriptorTableEntry,
 378     ThreadEnableAlignmentFaultFixup,
 379     ThreadEventPair_Reusable,
 380     ThreadQuerySetWin32StartAddress,
 381     ThreadZeroTlsCell,
 382     ThreadPerformanceCount,
 383     ThreadAmILastThread,
 384     ThreadIdealProcessor,
 385     ThreadPriorityBoost,
 386     ThreadSetTlsArrayAddress,
 387     ThreadIsIoPending,
 388     ThreadHideFromDebugger,
 389     ThreadBreakOnTermination,
 390     ThreadSwitchLegacyState,
 391     ThreadIsTerminated,
 392     ThreadLastSystemCall,
 393     ThreadIoPriority,
 394     ThreadCycleTime,
 395     ThreadPagePriority,
 396     ThreadActualBasePriority,
 397     ThreadTebInformation,
 398     ThreadCSwitchMon,
 399     MaxThreadInfoClass
 400 } THREADINFOCLASS;
 401
 402 #else
 403
 404 typedef enum _PSPROCESSPRIORITYMODE
 405 {
 406     PsProcessPriorityForeground,
 407     PsProcessPriorityBackground,
 408     PsProcessPrioritySpinning
 409 } PSPROCESSPRIORITYMODE;
 410
 411 typedef enum _JOBOBJECTINFOCLASS
 412 {
 413     JobObjectBasicAccountingInformation = 1,
 414     JobObjectBasicLimitInformation,
 415     JobObjectBasicProcessIdList,
 416     JobObjectBasicUIRestrictions,
 417     JobObjectSecurityLimitInformation,
 418     JobObjectEndOfJobTimeInformation,
 419     JobObjectAssociateCompletionPortInformation,
 420     JobObjectBasicAndIoAccountingInformation,
 421     JobObjectExtendedLimitInformation,
 422     JobObjectJobSetInformation,
 423     MaxJobObjectInfoClass
 424 } JOBOBJECTINFOCLASS;
 425
 426 //
 427 // Power Event Events for Win32K Power Event Callback
 428 //
 429 typedef enum _PSPOWEREVENTTYPE
 430 {
 431     PsW32FullWake = 0,
 432     PsW32EventCode = 1,
 433     PsW32PowerPolicyChanged = 2,
 434     PsW32SystemPowerState = 3,
 435     PsW32SystemTime = 4,
 436     PsW32DisplayState = 5,
 437     PsW32CapabilitiesChanged = 6,
 438     PsW32SetStateFailed = 7,
 439     PsW32GdiOff = 8,
 440     PsW32GdiOn = 9,
 441     PsW32GdiPrepareResumeUI = 10,
 442     PsW32GdiOffRequest = 11,
 443     PsW32MonitorOff = 12,
 444 } PSPOWEREVENTTYPE;
 445
 446 //
 447 // Power State Tasks for Win32K Power State Callback
 448 //
 449 typedef enum _POWERSTATETASK
 450 {
 451     PowerState_BlockSessionSwitch = 0,
 452     PowerState_Init = 1,
 453     PowerState_QueryApps = 2,
 454     PowerState_QueryServices = 3,
 455     PowerState_QueryAppsFailed = 4,
 456     PowerState_QueryServicesFailed = 5,
 457     PowerState_SuspendApps = 6,
 458     PowerState_SuspendServices = 7,
 459     PowerState_ShowUI = 8,
 460     PowerState_NotifyWL = 9,
 461     PowerState_ResumeApps = 10,
 462     PowerState_ResumeServices = 11,
 463     PowerState_UnBlockSessionSwitch = 12,
 464     PowerState_End = 13,
 465     PowerState_BlockInput = 14,
 466     PowerState_UnblockInput = 15,
 467 } POWERSTATETASK;
 468
 469 //
 470 // Win32K Job Callback Types
 471 //
 472 typedef enum _PSW32JOBCALLOUTTYPE
 473 {
 474    PsW32JobCalloutSetInformation = 0,
 475    PsW32JobCalloutAddProcess = 1,
 476    PsW32JobCalloutTerminate = 2,
 477 } PSW32JOBCALLOUTTYPE;
 478
 479 //
 480 // Win32K Thread Callback Types
 481 //
 482 typedef enum _PSW32THREADCALLOUTTYPE
 483 {
 484     PsW32ThreadCalloutInitialize,
 485     PsW32ThreadCalloutExit,
 486 } PSW32THREADCALLOUTTYPE;
 487
 488 //
 489 // Declare empty structure definitions so that they may be referenced by
 490 // routines before they are defined
 491 //
 492 struct _W32THREAD;
 493 struct _W32PROCESS;
 494 //struct _ETHREAD;
 495 struct _WIN32_POWEREVENT_PARAMETERS;
 496 struct _WIN32_POWERSTATE_PARAMETERS;
 497 struct _WIN32_JOBCALLOUT_PARAMETERS;
 498 struct _WIN32_OPENMETHOD_PARAMETERS;
 499 struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS;
 500 struct _WIN32_CLOSEMETHOD_PARAMETERS;
 501 struct _WIN32_DELETEMETHOD_PARAMETERS;
 502 struct _WIN32_PARSEMETHOD_PARAMETERS;
 503
 504 //
 505 // Win32K Process and Thread Callbacks
 506 //
 507 typedef
 508 NTSTATUS
 509 (NTAPI *PKWIN32_PROCESS_CALLOUT)(
 510     _In_ struct _EPROCESS *Process,
 511     _In_ BOOLEAN Create
 512 );
 513
 514 typedef
 515 NTSTATUS
 516 (NTAPI *PKWIN32_THREAD_CALLOUT)(
 517     _In_ struct _ETHREAD *Thread,
 518     _In_ PSW32THREADCALLOUTTYPE Type
 519 );
 520
 521 typedef
 522 NTSTATUS
 523 (NTAPI *PKWIN32_GLOBALATOMTABLE_CALLOUT)(
 524     VOID
 525 );
 526
 527 typedef
 528 NTSTATUS
 529 (NTAPI *PKWIN32_POWEREVENT_CALLOUT)(
 530     _In_ struct _WIN32_POWEREVENT_PARAMETERS *Parameters
 531 );
 532
 533 typedef
 534 NTSTATUS
 535 (NTAPI *PKWIN32_POWERSTATE_CALLOUT)(
 536     _In_ struct _WIN32_POWERSTATE_PARAMETERS *Parameters
 537 );
 538
 539 typedef
 540 NTSTATUS
 541 (NTAPI *PKWIN32_JOB_CALLOUT)(
 542     _In_ struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters
 543 );
 544
 545 typedef
 546 NTSTATUS
 547 (NTAPI *PGDI_BATCHFLUSH_ROUTINE)(
 548     VOID
 549 );
 550
 551 typedef
 552 NTSTATUS
 553 (NTAPI *PKWIN32_OPENMETHOD_CALLOUT)(
 554     _In_ struct _WIN32_OPENMETHOD_PARAMETERS *Parameters
 555 );
 556
 557 typedef
 558 NTSTATUS
 559 (NTAPI *PKWIN32_OKTOCLOSEMETHOD_CALLOUT)(
 560     _In_ struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters
 561 );
 562
 563 typedef
 564 NTSTATUS
 565 (NTAPI *PKWIN32_CLOSEMETHOD_CALLOUT)(
 566     _In_ struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters
 567 );
 568
 569 typedef
 570 NTSTATUS
 571 (NTAPI *PKWIN32_DELETEMETHOD_CALLOUT)(
 572     _In_ struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters
 573 );
 574
 575 typedef
 576 NTSTATUS
 577 (NTAPI *PKWIN32_PARSEMETHOD_CALLOUT)(
 578     _In_ struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters
 579 );
 580
 581 typedef
 582 NTSTATUS
 583 (NTAPI *PKWIN32_SESSION_CALLOUT)(
 584     _In_ PVOID Parameter
 585 );
 586
 587 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 588 typedef
 589 NTSTATUS
 590 (NTAPI *PKWIN32_WIN32DATACOLLECTION_CALLOUT)(
 591     _In_ struct _EPROCESS *Process,
 592     _In_ PVOID Callback,
 593     _In_ PVOID Context
 594 );
 595 #endif
 596
 597 //
 598 // Lego Callback
 599 //
 600 typedef
 601 VOID
 602 (NTAPI *PLEGO_NOTIFY_ROUTINE)(
 603     _In_ PKTHREAD Thread
 604 );
 605
 606 #endif
 607
 608 typedef NTSTATUS
 609 (NTAPI *PPOST_PROCESS_INIT_ROUTINE)(
 610     VOID
 611 );
 612
 613 //
 614 // Descriptor Table Entry Definition
 615 //
 616 #if (_M_IX86)
 617 #define _DESCRIPTOR_TABLE_ENTRY_DEFINED
 618 typedef struct _DESCRIPTOR_TABLE_ENTRY
 619 {
 620     ULONG Selector;
 621     LDT_ENTRY Descriptor;
 622 } DESCRIPTOR_TABLE_ENTRY, *PDESCRIPTOR_TABLE_ENTRY;
 623 #endif
 624
 625 //
 626 // PEB Lock Routine
 627 //
 628 typedef VOID
 629 (NTAPI *PPEBLOCKROUTINE)(
 630     PVOID PebLock
 631 );
 632
 633 //
 634 // PEB Free Block Descriptor
 635 //
 636 typedef struct _PEB_FREE_BLOCK
 637 {
 638     struct _PEB_FREE_BLOCK* Next;
 639     ULONG Size;
 640 } PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
 641
 642 //
 643 // Initial PEB
 644 //
 645 typedef struct _INITIAL_PEB
 646 {
 647     BOOLEAN InheritedAddressSpace;
 648     BOOLEAN ReadImageFileExecOptions;
 649     BOOLEAN BeingDebugged;
 650     union
 651     {
 652         BOOLEAN BitField;
 653 #if (NTDDI_VERSION >= NTDDI_WS03)
 654         struct
 655         {
 656             BOOLEAN ImageUsesLargePages:1;
 657 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 658             BOOLEAN IsProtectedProcess:1;
 659             BOOLEAN IsLegacyProcess:1;
 660             BOOLEAN SpareBits:5;
 661 #else
 662             BOOLEAN SpareBits:7;
 663 #endif
 664         };
 665 #else
 666         BOOLEAN SpareBool;
 667 #endif
 668     };
 669     HANDLE Mutant;
 670 } INITIAL_PEB, *PINITIAL_PEB;
 671
 672 //
 673 // Initial TEB
 674 //
 675 typedef struct _INITIAL_TEB
 676 {
 677     PVOID PreviousStackBase;
 678     PVOID PreviousStackLimit;
 679     PVOID StackBase;
 680     PVOID StackLimit;
 681     PVOID AllocatedStackBase;
 682 } INITIAL_TEB, *PINITIAL_TEB;
 683
 684 //
 685 // TEB Active Frame Structures
 686 //
 687 typedef struct _TEB_ACTIVE_FRAME_CONTEXT
 688 {
 689     ULONG Flags;
 690     LPSTR FrameName;
 691 } TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;
 692 typedef const struct _TEB_ACTIVE_FRAME_CONTEXT *PCTEB_ACTIVE_FRAME_CONTEXT;
 693
 694 typedef struct _TEB_ACTIVE_FRAME_CONTEXT_EX
 695 {
 696     TEB_ACTIVE_FRAME_CONTEXT BasicContext;
 697     PCSTR SourceLocation;
 698 } TEB_ACTIVE_FRAME_CONTEXT_EX, *PTEB_ACTIVE_FRAME_CONTEXT_EX;
 699 typedef const struct _TEB_ACTIVE_FRAME_CONTEXT_EX *PCTEB_ACTIVE_FRAME_CONTEXT_EX;
 700
 701 typedef struct _TEB_ACTIVE_FRAME
 702 {
 703     ULONG Flags;
 704     struct _TEB_ACTIVE_FRAME *Previous;
 705     PCTEB_ACTIVE_FRAME_CONTEXT Context;
 706 } TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
 707 typedef const struct _TEB_ACTIVE_FRAME *PCTEB_ACTIVE_FRAME;
 708
 709 typedef struct _TEB_ACTIVE_FRAME_EX
 710 {
 711     TEB_ACTIVE_FRAME BasicFrame;
 712     PVOID ExtensionIdentifier;
 713 } TEB_ACTIVE_FRAME_EX, *PTEB_ACTIVE_FRAME_EX;
 714 typedef const struct _TEB_ACTIVE_FRAME_EX *PCTEB_ACTIVE_FRAME_EX;
 715
 716 typedef struct _CLIENT_ID32
 717 {
 718     ULONG UniqueProcess;
 719     ULONG UniqueThread;
 720 } CLIENT_ID32, *PCLIENT_ID32;
 721
 722 typedef struct _CLIENT_ID64
 723 {
 724     ULONG64 UniqueProcess;
 725     ULONG64 UniqueThread;
 726 } CLIENT_ID64, *PCLIENT_ID64;
 727
 728 #if (NTDDI_VERSION < NTDDI_WS03)
 729 typedef struct _Wx86ThreadState
 730 {
 731     PULONG  CallBx86Eip;
 732     PVOID   DeallocationCpu;
 733     BOOLEAN UseKnownWx86Dll;
 734     CHAR    OleStubInvoked;
 735 } Wx86ThreadState, *PWx86ThreadState;
 736 #endif
 737
 738 //
 739 // PEB.AppCompatFlags
 740 // Tag FLAG_MASK_KERNEL
 741 //
 742 typedef enum _APPCOMPAT_FLAGS
 743 {
 744     GetShortPathNameNT4 = 0x1,
 745     GetDiskFreeSpace2GB = 0x8,
 746     FTMFromCurrentAPI = 0x20,
 747     DisallowCOMBindingNotifications = 0x40,
 748     Ole32ValidatePointers = 0x80,
 749     DisableCicero = 0x100,
 750     Ole32EnableAsyncDocFile = 0x200,
 751     EnableLegacyExceptionHandlinginOLE = 0x400,
 752     DisableAdvanceRPCClientHardening = 0x800,
 753     DisableMaybeNULLSizeisConsistencycheck = 0x1000,
 754     DisableAdvancedRPCrangeCheck = 0x4000,
 755     EnableLegacyExceptionHandlingInRPC = 0x8000,
 756     EnableLegacyNTFSFlagsForDocfileOpens = 0x10000,
 757     DisableNDRIIDConsistencyCheck = 0x20000,
 758     UserDisableForwarderPatch = 0x40000,
 759     DisableNewWMPAINTDispatchInOLE = 0x100000,
 760     DoNotAddToCache = 0x80000000,
 761 } APPCOMPAT_FLAGS;
 762
 763
 764 //
 765 // PEB.AppCompatFlagsUser.LowPart
 766 // Tag FLAG_MASK_USER
 767 //
 768 typedef enum _APPCOMPAT_USERFLAGS
 769 {
 770     DisableAnimation = 0x1,
 771     DisableKeyboardCues = 0x2,
 772     No50StylebitsInSetWindowLong = 0x4,
 773     DisableDrawPatternRect = 0x8,
 774     MSShellDialog = 0x10,
 775     NoDDETerminateDuringDestroy = 0x20,
 776     GiveupForeground = 0x40,
 777     AlwaysActiveMenus = 0x80,
 778     NoMouseHideInEdit = 0x100,
 779     NoGdiBatching = 0x200,
 780     FontSubstitution = 0x400,
 781     No50StylebitsInCreateWindow = 0x800,
 782     NoCustomPaperSizes = 0x1000,
 783     AllTheDdeHacks = 0x2000,
 784     UseDefaultCharset = 0x4000,
 785     NoCharDeadKey = 0x8000,
 786     NoTryExceptForWindowProc = 0x10000,
 787     NoInitInsertReplaceFlags = 0x20000,
 788     NoDdeSync = 0x40000,
 789     NoGhost = 0x80000,
 790     NoDdeAsyncReg = 0x100000,
 791     StrictLLHook = 0x200000,
 792     NoShadow = 0x400000,
 793     NoTimerCallbackProtection = 0x1000000,
 794     HighDpiAware = 0x2000000,
 795     OpenGLEmfAware = 0x4000000,
 796     EnableTransparantBltMirror = 0x8000000,
 797     NoPaddedBorder = 0x10000000,
 798     ForceLegacyResizeCM = 0x20000000,
 799     HardwareAudioMixer = 0x40000000,
 800     DisableSWCursorOnMoveSize = 0x80000000,
 801 #if 0
 802     DisableWindowArrangement = 0x100000000,
 803     ReorderWaveForCommunications = 0x200000000,
 804     NoGdiHwAcceleration = 0x400000000,
 805 #endif
 806 } APPCOMPAT_USERFLAGS;
 807
 808 //
 809 // PEB.AppCompatFlagsUser.HighPart
 810 // Tag FLAG_MASK_USER
 811 //
 812 typedef enum _APPCOMPAT_USERFLAGS_HIGHPART
 813 {
 814     DisableWindowArrangement = 0x1,
 815     ReorderWaveForCommunications = 0x2,
 816     NoGdiHwAcceleration = 0x4,
 817 } APPCOMPAT_USERFLAGS_HIGHPART;
 818
 819 //
 820 // Process Environment Block (PEB)
 821 // Thread Environment Block (TEB)
 822 //
 823 #include "peb_teb.h"
 824
 825 #ifdef _WIN64
 826 //
 827 // Explicit 32 bit PEB/TEB
 828 //
 829 #define EXPLICIT_32BIT
 830 #include "peb_teb.h"
 831 #undef EXPLICIT_32BIT
 832
 833 //
 834 // Explicit 64 bit PEB/TEB
 835 //
 836 #define EXPLICIT_64BIT
 837 #include "peb_teb.h"
 838 #undef EXPLICIT_64BIT
 839 #endif
 840
 841 #ifdef NTOS_MODE_USER
 842
 843 //
 844 // Process Information Structures for NtQueryProcessInformation
 845 //
 846 typedef struct _PROCESS_BASIC_INFORMATION
 847 {
 848     NTSTATUS ExitStatus;
 849     PPEB PebBaseAddress;
 850     ULONG_PTR AffinityMask;
 851     KPRIORITY BasePriority;
 852     ULONG_PTR UniqueProcessId;
 853     ULONG_PTR InheritedFromUniqueProcessId;
 854 } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
 855
 856 typedef struct _PROCESS_ACCESS_TOKEN
 857 {
 858     HANDLE Token;
 859     HANDLE Thread;
 860 } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
 861
 862 typedef struct _PROCESS_DEVICEMAP_INFORMATION
 863 {
 864     union
 865     {
 866         struct
 867         {
 868             HANDLE DirectoryHandle;
 869         } Set;
 870         struct
 871         {
 872             ULONG DriveMap;
 873             UCHAR DriveType[32];
 874         } Query;
 875     };
 876 } PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION;
 877
 878 typedef struct _KERNEL_USER_TIMES
 879 {
 880     LARGE_INTEGER CreateTime;
 881     LARGE_INTEGER ExitTime;
 882     LARGE_INTEGER KernelTime;
 883     LARGE_INTEGER UserTime;
 884 } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
 885
 886 typedef struct _POOLED_USAGE_AND_LIMITS
 887 {
 888     SIZE_T PeakPagedPoolUsage;
 889     SIZE_T PagedPoolUsage;
 890     SIZE_T PagedPoolLimit;
 891     SIZE_T PeakNonPagedPoolUsage;
 892     SIZE_T NonPagedPoolUsage;
 893     SIZE_T NonPagedPoolLimit;
 894     SIZE_T PeakPagefileUsage;
 895     SIZE_T PagefileUsage;
 896     SIZE_T PagefileLimit;
 897 } POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS;
 898
 899 typedef struct _PROCESS_SESSION_INFORMATION
 900 {
 901     ULONG SessionId;
 902 } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
 903
 904 #endif
 905
 906 typedef struct _PROCESS_PRIORITY_CLASS
 907 {
 908     BOOLEAN Foreground;
 909     UCHAR PriorityClass;
 910 } PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;
 911
 912 typedef struct _PROCESS_FOREGROUND_BACKGROUND
 913 {
 914     BOOLEAN Foreground;
 915 } PROCESS_FOREGROUND_BACKGROUND, *PPROCESS_FOREGROUND_BACKGROUND;
 916
 917 //
 918 // Apphelp SHIM Cache
 919 //
 920 typedef enum _APPHELPCACHESERVICECLASS
 921 {
 922     ApphelpCacheServiceLookup = 0,
 923     ApphelpCacheServiceRemove = 1,
 924     ApphelpCacheServiceUpdate = 2,
 925     ApphelpCacheServiceFlush = 3,
 926     ApphelpCacheServiceDump = 4,
 927
 928     ApphelpDBGReadRegistry = 0x100,
 929     ApphelpDBGWriteRegistry = 0x101,
 930 } APPHELPCACHESERVICECLASS;
 931
 932
 933 typedef struct _APPHELP_CACHE_SERVICE_LOOKUP
 934 {
 935     UNICODE_STRING ImageName;
 936     HANDLE ImageHandle;
 937 } APPHELP_CACHE_SERVICE_LOOKUP, *PAPPHELP_CACHE_SERVICE_LOOKUP;
 938
 939
 940 //
 941 // Thread Information Structures for NtQueryProcessInformation
 942 //
 943 typedef struct _THREAD_BASIC_INFORMATION
 944 {
 945     NTSTATUS ExitStatus;
 946     PVOID TebBaseAddress;
 947     CLIENT_ID ClientId;
 948     KAFFINITY AffinityMask;
 949     KPRIORITY Priority;
 950     KPRIORITY BasePriority;
 951 } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
 952
 953 #ifndef NTOS_MODE_USER
 954
 955 //
 956 // Job Set Array
 957 //
 958 typedef struct _JOB_SET_ARRAY
 959 {
 960     HANDLE JobHandle;
 961     ULONG MemberLevel;
 962     ULONG Flags;
 963 } JOB_SET_ARRAY, *PJOB_SET_ARRAY;
 964
 965 //
 966 // EPROCESS Quota Structures
 967 //
 968 typedef struct _EPROCESS_QUOTA_ENTRY
 969 {
 970     SIZE_T Usage;
 971     SIZE_T Limit;
 972     SIZE_T Peak;
 973     SIZE_T Return;
 974 } EPROCESS_QUOTA_ENTRY, *PEPROCESS_QUOTA_ENTRY;
 975
 976 typedef struct _EPROCESS_QUOTA_BLOCK
 977 {
 978     EPROCESS_QUOTA_ENTRY QuotaEntry[3];
 979     LIST_ENTRY QuotaList;
 980     ULONG ReferenceCount;
 981     ULONG ProcessCount;
 982 } EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;
 983
 984 //
 985 // Process Pagefault History
 986 //
 987 typedef struct _PAGEFAULT_HISTORY
 988 {
 989     ULONG CurrentIndex;
 990     ULONG MapIndex;
 991     KSPIN_LOCK SpinLock;
 992     PVOID Reserved;
 993     PROCESS_WS_WATCH_INFORMATION WatchInfo[1];
 994 } PAGEFAULT_HISTORY, *PPAGEFAULT_HISTORY;
 995
 996 //
 997 // Process Impersonation Information
 998 //
 999 typedef struct _PS_IMPERSONATION_INFORMATION
1000 {
1001     PACCESS_TOKEN Token;
1002     BOOLEAN CopyOnOpen;
1003     BOOLEAN EffectiveOnly;
1004     SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
1005 } PS_IMPERSONATION_INFORMATION, *PPS_IMPERSONATION_INFORMATION;
1006
1007 //
1008 // Process Termination Port
1009 //
1010 typedef struct _TERMINATION_PORT
1011 {
1012     struct _TERMINATION_PORT *Next;
1013     PVOID Port;
1014 } TERMINATION_PORT, *PTERMINATION_PORT;
1015
1016 //
1017 // Per-Process APC Rate Limiting
1018 //
1019 typedef struct _PSP_RATE_APC
1020 {
1021     union
1022     {
1023         SINGLE_LIST_ENTRY NextApc;
1024         ULONGLONG ExcessCycles;
1025     };
1026     ULONGLONG TargetGEneration;
1027     KAPC RateApc;
1028 } PSP_RATE_APC, *PPSP_RATE_APC;
1029
1030 //
1031 // Executive Thread (ETHREAD)
1032 //
1033 typedef struct _ETHREAD
1034 {
1035     KTHREAD Tcb;
1036     LARGE_INTEGER CreateTime;
1037     union
1038     {
1039         LARGE_INTEGER ExitTime;
1040         LIST_ENTRY LpcReplyChain;
1041         LIST_ENTRY KeyedWaitChain;
1042     };
1043     union
1044     {
1045         NTSTATUS ExitStatus;
1046         PVOID OfsChain;
1047     };
1048     LIST_ENTRY PostBlockList;
1049     union
1050     {
1051         struct _TERMINATION_PORT *TerminationPort;
1052         struct _ETHREAD *ReaperLink;
1053         PVOID KeyedWaitValue;
1054 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1055         PVOID Win32StartParameter;
1056 #endif
1057     };
1058     KSPIN_LOCK ActiveTimerListLock;
1059     LIST_ENTRY ActiveTimerListHead;
1060     CLIENT_ID Cid;
1061 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1062     KSEMAPHORE KeyedWaitSemaphore;
1063 #else
1064     union
1065     {
1066         KSEMAPHORE LpcReplySemaphore;
1067         KSEMAPHORE KeyedWaitSemaphore;
1068     };
1069     union
1070     {
1071         PVOID LpcReplyMessage;
1072         PVOID LpcWaitingOnPort;
1073     };
1074 #endif
1075     PPS_IMPERSONATION_INFORMATION ImpersonationInfo;
1076     LIST_ENTRY IrpList;
1077     ULONG_PTR TopLevelIrp;
1078     PDEVICE_OBJECT DeviceToVerify;
1079 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1080     PPSP_RATE_APC RateControlApc;
1081 #else
1082     struct _EPROCESS *ThreadsProcess;
1083 #endif
1084     PVOID Win32StartAddress;
1085     union
1086     {
1087         PKSTART_ROUTINE StartAddress;
1088         ULONG LpcReceivedMessageId;
1089     };
1090     LIST_ENTRY ThreadListEntry;
1091     EX_RUNDOWN_REF RundownProtect;
1092     EX_PUSH_LOCK ThreadLock;
1093 #if (NTDDI_VERSION < NTDDI_LONGHORN)
1094     ULONG LpcReplyMessageId;
1095 #endif
1096     ULONG ReadClusterSize;
1097 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1098     ULONG SpareUlong0;
1099 #else
1100     ACCESS_MASK GrantedAccess;
1101 #endif
1102     union
1103     {
1104         struct
1105         {
1106            ULONG Terminated:1;
1107 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1108            ULONG ThreadInserted:1;
1109 #else
1110            ULONG DeadThread:1;
1111 #endif
1112            ULONG HideFromDebugger:1;
1113            ULONG ActiveImpersonationInfo:1;
1114            ULONG SystemThread:1;
1115            ULONG HardErrorsAreDisabled:1;
1116            ULONG BreakOnTermination:1;
1117            ULONG SkipCreationMsg:1;
1118            ULONG SkipTerminationMsg:1;
1119 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1120            ULONG CreateMsgSent:1;
1121            ULONG ThreadIoPriority:3;
1122            ULONG ThreadPagePriority:3;
1123            ULONG PendingRatecontrol:1;
1124 #endif
1125         };
1126         ULONG CrossThreadFlags;
1127     };
1128     union
1129     {
1130         struct
1131         {
1132            ULONG ActiveExWorker:1;
1133            ULONG ExWorkerCanWaitUser:1;
1134            ULONG MemoryMaker:1;
1135            ULONG KeyedEventInUse:1;
1136 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1137            ULONG RateApcState:2;
1138 #endif
1139         };
1140         ULONG SameThreadPassiveFlags;
1141     };
1142     union
1143     {
1144         struct
1145         {
1146            ULONG LpcReceivedMsgIdValid:1;
1147            ULONG LpcExitThreadCalled:1;
1148 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1149            ULONG Spare:1;
1150 #else
1151            ULONG AddressSpaceOwner:1;
1152 #endif
1153            ULONG OwnsProcessWorkingSetExclusive:1;
1154            ULONG OwnsProcessWorkingSetShared:1;
1155            ULONG OwnsSystemWorkingSetExclusive:1;
1156            ULONG OwnsSystemWorkingSetShared:1;
1157            ULONG OwnsSessionWorkingSetExclusive:1;
1158            ULONG OwnsSessionWorkingSetShared:1;
1159 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1160            ULONG SuppressSymbolLoad:1;
1161            ULONG Spare1:3;
1162            ULONG PriorityRegionActive:4;
1163 #else
1164            ULONG ApcNeeded:1;
1165 #endif
1166         };
1167         ULONG SameThreadApcFlags;
1168     };
1169 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1170     UCHAR CacheManagerActive;
1171 #else
1172     UCHAR ForwardClusterOnly;
1173 #endif
1174     UCHAR DisablePageFaultClustering;
1175     UCHAR ActiveFaultCount;
1176 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1177     ULONG AlpcMessageId;
1178     union
1179     {
1180         PVOID AlpcMessage;
1181         ULONG AlpcReceiveAttributeSet;
1182     };
1183     LIST_ENTRY AlpcWaitListEntry;
1184     KSEMAPHORE AlpcWaitSemaphore;
1185     ULONG CacheManagerCount;
1186 #endif
1187 } ETHREAD;
1188
1189 //
1190 // Executive Process (EPROCESS)
1191 //
1192 typedef struct _EPROCESS
1193 {
1194     KPROCESS Pcb;
1195     EX_PUSH_LOCK ProcessLock;
1196     LARGE_INTEGER CreateTime;
1197     LARGE_INTEGER ExitTime;
1198     EX_RUNDOWN_REF RundownProtect;
1199     HANDLE UniqueProcessId;
1200     LIST_ENTRY ActiveProcessLinks;
1201     SIZE_T QuotaUsage[3]; /* 0=PagedPool, 1=NonPagedPool, 2=Pagefile */
1202     SIZE_T QuotaPeak[3];  /* ditto */
1203     SIZE_T CommitCharge;
1204     SIZE_T PeakVirtualSize;
1205     SIZE_T VirtualSize;
1206     LIST_ENTRY SessionProcessLinks;
1207     PVOID DebugPort;
1208 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1209     union
1210     {
1211         PVOID ExceptionPortData;
1212         ULONG ExceptionPortValue;
1213         UCHAR ExceptionPortState:3;
1214     };
1215 #else
1216     PVOID ExceptionPort;
1217 #endif
1218     PHANDLE_TABLE ObjectTable;
1219     EX_FAST_REF Token;
1220     PFN_NUMBER WorkingSetPage;
1221 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1222     EX_PUSH_LOCK AddressCreationLock;
1223     PETHREAD RotateInProgress;
1224 #else
1225     KGUARDED_MUTEX AddressCreationLock;
1226     KSPIN_LOCK HyperSpaceLock;
1227 #endif
1228     PETHREAD ForkInProgress;
1229     ULONG_PTR HardwareTrigger;
1230     PMM_AVL_TABLE PhysicalVadRoot;
1231     PVOID CloneRoot;
1232     PFN_NUMBER NumberOfPrivatePages;
1233     PFN_NUMBER NumberOfLockedPages;
1234     PVOID *Win32Process;
1235     struct _EJOB *Job;
1236     PVOID SectionObject;
1237     PVOID SectionBaseAddress;
1238     PEPROCESS_QUOTA_BLOCK QuotaBlock;
1239     PPAGEFAULT_HISTORY WorkingSetWatch;
1240     PVOID Win32WindowStation;
1241     HANDLE InheritedFromUniqueProcessId;
1242     PVOID LdtInformation;
1243     PVOID VadFreeHint;
1244     PVOID VdmObjects;
1245     PVOID DeviceMap;
1246 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1247     PVOID EtwDataSource;
1248     PVOID FreeTebHint;
1249 #else
1250     PVOID Spare0[3];
1251 #endif
1252     union
1253     {
1254         HARDWARE_PTE PageDirectoryPte;
1255         ULONGLONG Filler;
1256     };
1257     PVOID Session;
1258     CHAR ImageFileName[16];
1259     LIST_ENTRY JobLinks;
1260     PVOID LockedPagesList;
1261     LIST_ENTRY ThreadListHead;
1262     PVOID SecurityPort;
1263 #ifdef _M_AMD64
1264     struct _WOW64_PROCESS *Wow64Process;
1265 #else
1266     PVOID PaeTop;
1267 #endif
1268     ULONG ActiveThreads;
1269 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1270     ULONG ImagePathHash;
1271 #else
1272     ACCESS_MASK GrantedAccess;
1273 #endif
1274     ULONG DefaultHardErrorProcessing;
1275     NTSTATUS LastThreadExitStatus;
1276     struct _PEB* Peb;
1277     EX_FAST_REF PrefetchTrace;
1278     LARGE_INTEGER ReadOperationCount;
1279     LARGE_INTEGER WriteOperationCount;
1280     LARGE_INTEGER OtherOperationCount;
1281     LARGE_INTEGER ReadTransferCount;
1282     LARGE_INTEGER WriteTransferCount;
1283     LARGE_INTEGER OtherTransferCount;
1284     SIZE_T CommitChargeLimit;
1285     SIZE_T CommitChargePeak;
1286     PVOID AweInfo;
1287     SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;
1288     MMSUPPORT Vm;
1289 #ifdef _M_AMD64
1290     ULONG Spares[2];
1291 #else
1292     LIST_ENTRY MmProcessLinks;
1293 #endif
1294     ULONG ModifiedPageCount;
1295 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1296     union
1297     {
1298         struct
1299         {
1300             ULONG JobNotReallyActive:1;
1301             ULONG AccountingFolded:1;
1302             ULONG NewProcessReported:1;
1303             ULONG ExitProcessReported:1;
1304             ULONG ReportCommitChanges:1;
1305             ULONG LastReportMemory:1;
1306             ULONG ReportPhysicalPageChanges:1;
1307             ULONG HandleTableRundown:1;
1308             ULONG NeedsHandleRundown:1;
1309             ULONG RefTraceEnabled:1;
1310             ULONG NumaAware:1;
1311             ULONG ProtectedProcess:1;
1312             ULONG DefaultPagePriority:3;
1313             ULONG ProcessDeleteSelf:1;
1314             ULONG ProcessVerifierTarget:1;
1315         };
1316         ULONG Flags2;
1317     };
1318 #else
1319     ULONG JobStatus;
1320 #endif
1321     union
1322     {
1323         struct
1324         {
1325             ULONG CreateReported:1;
1326             ULONG NoDebugInherit:1;
1327             ULONG ProcessExiting:1;
1328             ULONG ProcessDelete:1;
1329             ULONG Wow64SplitPages:1;
1330             ULONG VmDeleted:1;
1331             ULONG OutswapEnabled:1;
1332             ULONG Outswapped:1;
1333             ULONG ForkFailed:1;
1334             ULONG Wow64VaSpace4Gb:1;
1335             ULONG AddressSpaceInitialized:2;
1336             ULONG SetTimerResolution:1;
1337             ULONG BreakOnTermination:1;
1338 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1339             ULONG DeprioritizeViews:1;
1340 #else
1341             ULONG SessionCreationUnderway:1;
1342 #endif
1343             ULONG WriteWatch:1;
1344             ULONG ProcessInSession:1;
1345             ULONG OverrideAddressSpace:1;
1346             ULONG HasAddressSpace:1;
1347             ULONG LaunchPrefetched:1;
1348             ULONG InjectInpageErrors:1;
1349             ULONG VmTopDown:1;
1350             ULONG ImageNotifyDone:1;
1351             ULONG PdeUpdateNeeded:1;
1352             ULONG VdmAllowed:1;
1353             ULONG SmapAllowed:1;
1354 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1355             ULONG ProcessInserted:1;
1356 #else
1357             ULONG CreateFailed:1;
1358 #endif
1359             ULONG DefaultIoPriority:3;
1360 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1361             ULONG SparePsFlags1:2;
1362 #else
1363             ULONG Spare1:1;
1364             ULONG Spare2:1;
1365 #endif
1366         };
1367         ULONG Flags;
1368     };
1369     NTSTATUS ExitStatus;
1370 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1371     USHORT Spare7;
1372 #else
1373     USHORT NextPageColor;
1374 #endif
1375     union
1376     {
1377         struct
1378         {
1379             UCHAR SubSystemMinorVersion;
1380             UCHAR SubSystemMajorVersion;
1381         };
1382         USHORT SubSystemVersion;
1383     };
1384     UCHAR PriorityClass;
1385     MM_AVL_TABLE VadRoot;
1386     ULONG Cookie;
1387 } EPROCESS;
1388
1389 //
1390 // Job Token Filter Data
1391 //
1392 #include <pshpack1.h>
1393 typedef struct _PS_JOB_TOKEN_FILTER
1394 {
1395     ULONG CapturedSidCount;
1396     PSID_AND_ATTRIBUTES CapturedSids;
1397     ULONG CapturedSidsLength;
1398     ULONG CapturedGroupCount;
1399     PSID_AND_ATTRIBUTES CapturedGroups;
1400     ULONG CapturedGroupsLength;
1401     ULONG CapturedPrivilegeCount;
1402     PLUID_AND_ATTRIBUTES CapturedPrivileges;
1403     ULONG CapturedPrivilegesLength;
1404 } PS_JOB_TOKEN_FILTER, *PPS_JOB_TOKEN_FILTER;
1405
1406 //
1407 // Executive Job (EJOB)
1408 //
1409 typedef struct _EJOB
1410 {
1411     KEVENT Event;
1412     LIST_ENTRY JobLinks;
1413     LIST_ENTRY ProcessListHead;
1414     ERESOURCE JobLock;
1415     LARGE_INTEGER TotalUserTime;
1416     LARGE_INTEGER TotalKernelTime;
1417     LARGE_INTEGER ThisPeriodTotalUserTime;
1418     LARGE_INTEGER ThisPeriodTotalKernelTime;
1419     ULONG TotalPageFaultCount;
1420     ULONG TotalProcesses;
1421     ULONG ActiveProcesses;
1422     ULONG TotalTerminatedProcesses;
1423     LARGE_INTEGER PerProcessUserTimeLimit;
1424     LARGE_INTEGER PerJobUserTimeLimit;
1425     ULONG LimitFlags;
1426     ULONG MinimumWorkingSetSize;
1427     ULONG MaximumWorkingSetSize;
1428     ULONG ActiveProcessLimit;
1429     ULONG Affinity;
1430     UCHAR PriorityClass;
1431     ULONG UIRestrictionsClass;
1432     ULONG SecurityLimitFlags;
1433     PVOID Token;
1434     PPS_JOB_TOKEN_FILTER Filter;
1435     ULONG EndOfJobTimeAction;
1436     PVOID CompletionPort;
1437     PVOID CompletionKey;
1438     ULONG SessionId;
1439     ULONG SchedulingClass;
1440     ULONGLONG ReadOperationCount;
1441     ULONGLONG WriteOperationCount;
1442     ULONGLONG OtherOperationCount;
1443     ULONGLONG ReadTransferCount;
1444     ULONGLONG WriteTransferCount;
1445     ULONGLONG OtherTransferCount;
1446     IO_COUNTERS IoInfo;
1447     ULONG ProcessMemoryLimit;
1448     ULONG JobMemoryLimit;
1449     ULONG PeakProcessMemoryUsed;
1450     ULONG PeakJobMemoryUsed;
1451     ULONG CurrentJobMemoryUsed;
1452 #if (NTDDI_VERSION >= NTDDI_WINXP) && (NTDDI_VERSION < NTDDI_WS03)
1453     FAST_MUTEX MemoryLimitsLock;
1454 #elif (NTDDI_VERSION >= NTDDI_WS03) && (NTDDI_VERSION < NTDDI_LONGHORN)
1455     KGUARDED_MUTEX MemoryLimitsLock;
1456 #elif (NTDDI_VERSION >= NTDDI_LONGHORN)
1457     EX_PUSH_LOCK MemoryLimitsLock;
1458 #endif
1459     LIST_ENTRY JobSetLinks;
1460     ULONG MemberLevel;
1461     ULONG JobFlags;
1462 } EJOB, *PEJOB;
1463 #include <poppack.h>
1464
1465 //
1466 // Win32K Callback Registration Data
1467 //
1468 typedef struct _WIN32_POWEREVENT_PARAMETERS
1469 {
1470     PSPOWEREVENTTYPE EventNumber;
1471     ULONG Code;
1472 } WIN32_POWEREVENT_PARAMETERS, *PWIN32_POWEREVENT_PARAMETERS;
1473
1474 typedef struct _WIN32_POWERSTATE_PARAMETERS
1475 {
1476     UCHAR Promotion;
1477     POWER_ACTION SystemAction;
1478     SYSTEM_POWER_STATE MinSystemState;
1479     ULONG Flags;
1480     POWERSTATETASK PowerStateTask;
1481 } WIN32_POWERSTATE_PARAMETERS, *PWIN32_POWERSTATE_PARAMETERS;
1482
1483 typedef struct _WIN32_JOBCALLOUT_PARAMETERS
1484 {
1485     PVOID Job;
1486     PSW32JOBCALLOUTTYPE CalloutType;
1487     PVOID Data;
1488 } WIN32_JOBCALLOUT_PARAMETERS, *PWIN32_JOBCALLOUT_PARAMETERS;
1489
1490 typedef struct _WIN32_OPENMETHOD_PARAMETERS
1491 {
1492     OB_OPEN_REASON OpenReason;
1493     PEPROCESS Process;
1494     PVOID Object;
1495     ULONG GrantedAccess;
1496     ULONG HandleCount;
1497 } WIN32_OPENMETHOD_PARAMETERS, *PWIN32_OPENMETHOD_PARAMETERS;
1498
1499 typedef struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS
1500 {
1501     PEPROCESS Process;
1502     PVOID Object;
1503     HANDLE Handle;
1504     KPROCESSOR_MODE PreviousMode;
1505 } WIN32_OKAYTOCLOSEMETHOD_PARAMETERS, *PWIN32_OKAYTOCLOSEMETHOD_PARAMETERS;
1506
1507 typedef struct _WIN32_CLOSEMETHOD_PARAMETERS
1508 {
1509     PEPROCESS Process;
1510     PVOID Object;
1511     ACCESS_MASK AccessMask;
1512     ULONG ProcessHandleCount;
1513     ULONG SystemHandleCount;
1514 } WIN32_CLOSEMETHOD_PARAMETERS, *PWIN32_CLOSEMETHOD_PARAMETERS;
1515
1516 typedef struct _WIN32_DELETEMETHOD_PARAMETERS
1517 {
1518     PVOID Object;
1519 } WIN32_DELETEMETHOD_PARAMETERS, *PWIN32_DELETEMETHOD_PARAMETERS;
1520
1521 typedef struct _WIN32_PARSEMETHOD_PARAMETERS
1522 {
1523     PVOID ParseObject;
1524     PVOID ObjectType;
1525     PACCESS_STATE AccessState;
1526     KPROCESSOR_MODE AccessMode;
1527     ULONG Attributes;
1528     _Out_ PUNICODE_STRING CompleteName;
1529     PUNICODE_STRING RemainingName;
1530     PVOID Context;
1531     PSECURITY_QUALITY_OF_SERVICE SecurityQos;
1532     PVOID *Object;
1533 } WIN32_PARSEMETHOD_PARAMETERS, *PWIN32_PARSEMETHOD_PARAMETERS;
1534
1535 typedef struct _WIN32_CALLOUTS_FPNS
1536 {
1537     PKWIN32_PROCESS_CALLOUT ProcessCallout;
1538     PKWIN32_THREAD_CALLOUT ThreadCallout;
1539     PKWIN32_GLOBALATOMTABLE_CALLOUT GlobalAtomTableCallout;
1540     PKWIN32_POWEREVENT_CALLOUT PowerEventCallout;
1541     PKWIN32_POWERSTATE_CALLOUT PowerStateCallout;
1542     PKWIN32_JOB_CALLOUT JobCallout;
1543     PGDI_BATCHFLUSH_ROUTINE BatchFlushRoutine;
1544     PKWIN32_SESSION_CALLOUT DesktopOpenProcedure;
1545     PKWIN32_SESSION_CALLOUT DesktopOkToCloseProcedure;
1546     PKWIN32_SESSION_CALLOUT DesktopCloseProcedure;
1547     PKWIN32_SESSION_CALLOUT DesktopDeleteProcedure;
1548     PKWIN32_SESSION_CALLOUT WindowStationOkToCloseProcedure;
1549     PKWIN32_SESSION_CALLOUT WindowStationCloseProcedure;
1550     PKWIN32_SESSION_CALLOUT WindowStationDeleteProcedure;
1551     PKWIN32_SESSION_CALLOUT WindowStationParseProcedure;
1552     PKWIN32_SESSION_CALLOUT WindowStationOpenProcedure;
1553 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1554     PKWIN32_WIN32DATACOLLECTION_CALLOUT Win32DataCollectionProcedure;
1555 #endif
1556 } WIN32_CALLOUTS_FPNS, *PWIN32_CALLOUTS_FPNS;
1557
1558 #endif // !NTOS_MODE_USER
1559
1560 #ifdef __cplusplus
1561 }; // extern "C"
1562 #endif
1563
1564 #endif // _PSTYPES_H