sdk/include/ndk/pstypes.h

   1 /*++ NDK Version: 0098
   2
   3 Copyright (c) Alex Ionescu.  All rights reserved.
   4
   5 Header Name:
   6
   7     pstypes.h
   8
   9 Abstract:
  10
  11     Type definitions for the Process Manager
  12
  13 Author:
  14
  15     Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
  16
  17 --*/
  18
  19 #ifndef _PSTYPES_H
  20 #define _PSTYPES_H
  21
  22 //
  23 // Dependencies
  24 //
  25 #include <umtypes.h>
  26 #include <ldrtypes.h>
  27 #include <mmtypes.h>
  28 #include <obtypes.h>
  29 #include <rtltypes.h>
  30 #ifndef NTOS_MODE_USER
  31 #include <extypes.h>
  32 #include <setypes.h>
  33 #endif
  34
  35 #ifdef __cplusplus
  36 extern "C" {
  37 #endif
  38
  39 #ifndef NTOS_MODE_USER
  40
  41 //
  42 // Kernel Exported Object Types
  43 //
  44 extern POBJECT_TYPE NTSYSAPI PsJobType;
  45
  46 #endif // !NTOS_MODE_USER
  47
  48 //
  49 // KUSER_SHARED_DATA location in User Mode
  50 //
  51 #define USER_SHARED_DATA                        (0x7FFE0000)
  52
  53 //
  54 // Global Flags
  55 //
  56 #define FLG_STOP_ON_EXCEPTION                   0x00000001
  57 #define FLG_SHOW_LDR_SNAPS                      0x00000002
  58 #define FLG_DEBUG_INITIAL_COMMAND               0x00000004
  59 #define FLG_STOP_ON_HUNG_GUI                    0x00000008
  60 #define FLG_HEAP_ENABLE_TAIL_CHECK              0x00000010
  61 #define FLG_HEAP_ENABLE_FREE_CHECK              0x00000020
  62 #define FLG_HEAP_VALIDATE_PARAMETERS            0x00000040
  63 #define FLG_HEAP_VALIDATE_ALL                   0x00000080
  64 #define FLG_APPLICATION_VERIFIER                0x00000100
  65 #define FLG_POOL_ENABLE_TAGGING                 0x00000400
  66 #define FLG_HEAP_ENABLE_TAGGING                 0x00000800
  67 #define FLG_USER_STACK_TRACE_DB                 0x00001000
  68 #define FLG_KERNEL_STACK_TRACE_DB               0x00002000
  69 #define FLG_MAINTAIN_OBJECT_TYPELIST            0x00004000
  70 #define FLG_HEAP_ENABLE_TAG_BY_DLL              0x00008000
  71 #define FLG_DISABLE_STACK_EXTENSION             0x00010000
  72 #define FLG_ENABLE_CSRDEBUG                     0x00020000
  73 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD           0x00040000
  74 #define FLG_DISABLE_PAGE_KERNEL_STACKS          0x00080000
  75 #if (NTDDI_VERSION < NTDDI_WINXP)
  76 #define FLG_HEAP_ENABLE_CALL_TRACING            0x00100000
  77 #else
  78 #define FLG_ENABLE_SYSTEM_CRIT_BREAKS           0x00100000
  79 #endif
  80 #define FLG_HEAP_DISABLE_COALESCING             0x00200000
  81 #define FLG_ENABLE_CLOSE_EXCEPTIONS             0x00400000
  82 #define FLG_ENABLE_EXCEPTION_LOGGING            0x00800000
  83 #define FLG_ENABLE_HANDLE_TYPE_TAGGING          0x01000000
  84 #define FLG_HEAP_PAGE_ALLOCS                    0x02000000
  85 #define FLG_DEBUG_INITIAL_COMMAND_EX            0x04000000
  86 #define FLG_VALID_BITS                          0x07FFFFFF
  87
  88 //
  89 // Flags for NtCreateProcessEx
  90 //
  91 #define PROCESS_CREATE_FLAGS_BREAKAWAY              0x00000001
  92 #define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT       0x00000002
  93 #define PROCESS_CREATE_FLAGS_INHERIT_HANDLES        0x00000004
  94 #define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008
  95 #define PROCESS_CREATE_FLAGS_LARGE_PAGES            0x00000010
  96 #define PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS   PROCESS_CREATE_FLAGS_LARGE_PAGES
  97 #define PROCESS_CREATE_FLAGS_LEGAL_MASK             (PROCESS_CREATE_FLAGS_BREAKAWAY | \
  98                                                      PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT | \
  99                                                      PROCESS_CREATE_FLAGS_INHERIT_HANDLES | \
 100                                                      PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE | \
 101                                                      PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS)
 102
 103 //
 104 // Process priority classes
 105 //
 106 #define PROCESS_PRIORITY_CLASS_INVALID          0
 107 #define PROCESS_PRIORITY_CLASS_IDLE             1
 108 #define PROCESS_PRIORITY_CLASS_NORMAL           2
 109 #define PROCESS_PRIORITY_CLASS_HIGH             3
 110 #define PROCESS_PRIORITY_CLASS_REALTIME         4
 111 #define PROCESS_PRIORITY_CLASS_BELOW_NORMAL     5
 112 #define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL     6
 113
 114 //
 115 // Process base priorities
 116 //
 117 #define PROCESS_PRIORITY_IDLE                   3
 118 #define PROCESS_PRIORITY_NORMAL                 8
 119 #define PROCESS_PRIORITY_NORMAL_FOREGROUND      9
 120
 121 //
 122 // Process memory priorities
 123 //
 124 #define MEMORY_PRIORITY_BACKGROUND             0
 125 #define MEMORY_PRIORITY_UNKNOWN                1
 126 #define MEMORY_PRIORITY_FOREGROUND             2
 127
 128 //
 129 // Process Priority Separation Values (OR)
 130 //
 131 #define PSP_DEFAULT_QUANTUMS                    0x00
 132 #define PSP_VARIABLE_QUANTUMS                   0x04
 133 #define PSP_FIXED_QUANTUMS                      0x08
 134 #define PSP_LONG_QUANTUMS                       0x10
 135 #define PSP_SHORT_QUANTUMS                      0x20
 136
 137 #ifndef NTOS_MODE_USER
 138 //
 139 // Thread Access Types
 140 //
 141 #define THREAD_QUERY_INFORMATION                0x0040
 142 #define THREAD_SET_THREAD_TOKEN                 0x0080
 143 #define THREAD_IMPERSONATE                      0x0100
 144 #define THREAD_DIRECT_IMPERSONATION             0x0200
 145
 146 //
 147 // Process Access Types
 148 //
 149 #define PROCESS_TERMINATE                       0x0001
 150 #define PROCESS_CREATE_THREAD                   0x0002
 151 #define PROCESS_SET_SESSIONID                   0x0004
 152 #define PROCESS_VM_OPERATION                    0x0008
 153 #define PROCESS_VM_READ                         0x0010
 154 #define PROCESS_VM_WRITE                        0x0020
 155 #define PROCESS_CREATE_PROCESS                  0x0080
 156 #define PROCESS_SET_QUOTA                       0x0100
 157 #define PROCESS_SET_INFORMATION                 0x0200
 158 #define PROCESS_QUERY_INFORMATION               0x0400
 159 #define PROCESS_SUSPEND_RESUME                  0x0800
 160 #define PROCESS_QUERY_LIMITED_INFORMATION       0x1000
 161 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 162 #define PROCESS_ALL_ACCESS                      (STANDARD_RIGHTS_REQUIRED | \
 163                                                  SYNCHRONIZE | \
 164                                                  0xFFFF)
 165 #else
 166 #define PROCESS_ALL_ACCESS                      (STANDARD_RIGHTS_REQUIRED | \
 167                                                  SYNCHRONIZE | \
 168                                                  0xFFF)
 169 #endif
 170
 171 //
 172 // Thread Base Priorities
 173 //
 174 #define THREAD_BASE_PRIORITY_LOWRT              15
 175 #define THREAD_BASE_PRIORITY_MAX                2
 176 #define THREAD_BASE_PRIORITY_MIN                -2
 177 #define THREAD_BASE_PRIORITY_IDLE               -15
 178
 179 //
 180 // TLS Slots
 181 //
 182 #define TLS_MINIMUM_AVAILABLE                   64
 183
 184 //
 185 // TEB Active Frame Flags
 186 //
 187 #define TEB_ACTIVE_FRAME_CONTEXT_FLAG_EXTENDED  0x1
 188
 189 //
 190 // Job Access Types
 191 //
 192 #define JOB_OBJECT_ASSIGN_PROCESS               0x1
 193 #define JOB_OBJECT_SET_ATTRIBUTES               0x2
 194 #define JOB_OBJECT_QUERY                        0x4
 195 #define JOB_OBJECT_TERMINATE                    0x8
 196 #define JOB_OBJECT_SET_SECURITY_ATTRIBUTES      0x10
 197 #define JOB_OBJECT_ALL_ACCESS                   (STANDARD_RIGHTS_REQUIRED | \
 198                                                  SYNCHRONIZE | \
 199                                                  31)
 200
 201 //
 202 // Job Limit Flags
 203 //
 204 #define JOB_OBJECT_LIMIT_WORKINGSET             0x1
 205 #define JOB_OBJECT_LIMIT_PROCESS_TIME           0x2
 206 #define JOB_OBJECT_LIMIT_JOB_TIME               0x4
 207 #define JOB_OBJECT_LIMIT_ACTIVE_PROCESS         0x8
 208 #define JOB_OBJECT_LIMIT_AFFINITY               0x10
 209 #define JOB_OBJECT_LIMIT_PRIORITY_CLASS         0x20
 210 #define JOB_OBJECT_LIMIT_PRESERVE_JOB_TIME      0x40
 211 #define JOB_OBJECT_LIMIT_SCHEDULING_CLASS       0x80
 212 #define JOB_OBJECT_LIMIT_PROCESS_MEMORY         0x100
 213 #define JOB_OBJECT_LIMIT_JOB_MEMORY             0x200
 214 #define JOB_OBJECT_LIMIT_DIE_ON_UNHANDLED_EXCEPTION 0x400
 215 #define JOB_OBJECT_LIMIT_BREAKAWAY_OK           0x800
 216 #define JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK    0x1000
 217 #define JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE      0x2000
 218
 219 //
 220 // Cross Thread Flags
 221 //
 222 #define CT_TERMINATED_BIT                       0x1
 223 #define CT_DEAD_THREAD_BIT                      0x2
 224 #define CT_HIDE_FROM_DEBUGGER_BIT               0x4
 225 #define CT_ACTIVE_IMPERSONATION_INFO_BIT        0x8
 226 #define CT_SYSTEM_THREAD_BIT                    0x10
 227 #define CT_HARD_ERRORS_ARE_DISABLED_BIT         0x20
 228 #define CT_BREAK_ON_TERMINATION_BIT             0x40
 229 #define CT_SKIP_CREATION_MSG_BIT                0x80
 230 #define CT_SKIP_TERMINATION_MSG_BIT             0x100
 231
 232 //
 233 // Same Thread Passive Flags
 234 //
 235 #define STP_ACTIVE_EX_WORKER_BIT                0x1
 236 #define STP_EX_WORKER_CAN_WAIT_USER_BIT         0x2
 237 #define STP_MEMORY_MAKER_BIT                    0x4
 238 #define STP_KEYED_EVENT_IN_USE_BIT              0x8
 239
 240 //
 241 // Same Thread APC Flags
 242 //
 243 #define STA_LPC_RECEIVED_MSG_ID_VALID_BIT       0x1
 244 #define STA_LPC_EXIT_THREAD_CALLED_BIT          0x2
 245 #define STA_ADDRESS_SPACE_OWNER_BIT             0x4
 246 #define STA_OWNS_WORKING_SET_BITS               0x1F8
 247
 248 //
 249 // Kernel Process flags (maybe in ketypes.h?)
 250 //
 251 #define KPSF_AUTO_ALIGNMENT_BIT                 0
 252 #define KPSF_DISABLE_BOOST_BIT                  1
 253
 254 //
 255 // Process Flags
 256 //
 257 #define PSF_CREATE_REPORTED_BIT                 0x1
 258 #define PSF_NO_DEBUG_INHERIT_BIT                0x2
 259 #define PSF_PROCESS_EXITING_BIT                 0x4
 260 #define PSF_PROCESS_DELETE_BIT                  0x8
 261 #define PSF_WOW64_SPLIT_PAGES_BIT               0x10
 262 #define PSF_VM_DELETED_BIT                      0x20
 263 #define PSF_OUTSWAP_ENABLED_BIT                 0x40
 264 #define PSF_OUTSWAPPED_BIT                      0x80
 265 #define PSF_FORK_FAILED_BIT                     0x100
 266 #define PSF_WOW64_VA_SPACE_4GB_BIT              0x200
 267 #define PSF_ADDRESS_SPACE_INITIALIZED_BIT       0x400
 268 #define PSF_SET_TIMER_RESOLUTION_BIT            0x1000
 269 #define PSF_BREAK_ON_TERMINATION_BIT            0x2000
 270 #define PSF_SESSION_CREATION_UNDERWAY_BIT       0x4000
 271 #define PSF_WRITE_WATCH_BIT                     0x8000
 272 #define PSF_PROCESS_IN_SESSION_BIT              0x10000
 273 #define PSF_OVERRIDE_ADDRESS_SPACE_BIT          0x20000
 274 #define PSF_HAS_ADDRESS_SPACE_BIT               0x40000
 275 #define PSF_LAUNCH_PREFETCHED_BIT               0x80000
 276 #define PSF_INJECT_INPAGE_ERRORS_BIT            0x100000
 277 #define PSF_VM_TOP_DOWN_BIT                     0x200000
 278 #define PSF_IMAGE_NOTIFY_DONE_BIT               0x400000
 279 #define PSF_PDE_UPDATE_NEEDED_BIT               0x800000
 280 #define PSF_VDM_ALLOWED_BIT                     0x1000000
 281 #define PSF_SWAP_ALLOWED_BIT                    0x2000000
 282 #define PSF_CREATE_FAILED_BIT                   0x4000000
 283 #define PSF_DEFAULT_IO_PRIORITY_BIT             0x8000000
 284
 285 //
 286 // Vista Process Flags
 287 //
 288 #define PSF2_PROTECTED_BIT                      0x800
 289 #endif
 290
 291 //
 292 // TLS/FLS Defines
 293 //
 294 #define TLS_EXPANSION_SLOTS                     1024
 295
 296 #ifdef NTOS_MODE_USER
 297 //
 298 // Thread Native Base Priorities
 299 //
 300 #define LOW_PRIORITY                            0
 301 #define LOW_REALTIME_PRIORITY                   16
 302 #define HIGH_PRIORITY                           31
 303 #define MAXIMUM_PRIORITY                        32
 304
 305 //
 306 // Current Process/Thread built-in 'special' handles
 307 //
 308 #define NtCurrentProcess()                      ((HANDLE)(LONG_PTR)-1)
 309 #define ZwCurrentProcess()                      NtCurrentProcess()
 310 #define NtCurrentThread()                       ((HANDLE)(LONG_PTR)-2)
 311 #define ZwCurrentThread()                       NtCurrentThread()
 312
 313 //
 314 // Process/Thread/Job Information Classes for NtQueryInformationProcess/Thread/Job
 315 //
 316 typedef enum _PROCESSINFOCLASS
 317 {
 318     ProcessBasicInformation,
 319     ProcessQuotaLimits,
 320     ProcessIoCounters,
 321     ProcessVmCounters,
 322     ProcessTimes,
 323     ProcessBasePriority,
 324     ProcessRaisePriority,
 325     ProcessDebugPort,
 326     ProcessExceptionPort,
 327     ProcessAccessToken,
 328     ProcessLdtInformation,
 329     ProcessLdtSize,
 330     ProcessDefaultHardErrorMode,
 331     ProcessIoPortHandlers,
 332     ProcessPooledUsageAndLimits,
 333     ProcessWorkingSetWatch,
 334     ProcessUserModeIOPL,
 335     ProcessEnableAlignmentFaultFixup,
 336     ProcessPriorityClass,
 337     ProcessWx86Information,
 338     ProcessHandleCount,
 339     ProcessAffinityMask,
 340     ProcessPriorityBoost,
 341     ProcessDeviceMap,
 342     ProcessSessionInformation,
 343     ProcessForegroundInformation,
 344     ProcessWow64Information,
 345     ProcessImageFileName,
 346     ProcessLUIDDeviceMapsEnabled,
 347     ProcessBreakOnTermination,
 348     ProcessDebugObjectHandle,
 349     ProcessDebugFlags,
 350     ProcessHandleTracing,
 351     ProcessIoPriority,
 352     ProcessExecuteFlags,
 353     ProcessTlsInformation,
 354     ProcessCookie,
 355     ProcessImageInformation,
 356     ProcessCycleTime,
 357     ProcessPagePriority,
 358     ProcessInstrumentationCallback,
 359     ProcessThreadStackAllocation,
 360     ProcessWorkingSetWatchEx,
 361     ProcessImageFileNameWin32,
 362     ProcessImageFileMapping,
 363     ProcessAffinityUpdateMode,
 364     ProcessMemoryAllocationMode,
 365     MaxProcessInfoClass
 366 } PROCESSINFOCLASS;
 367
 368 typedef enum _THREADINFOCLASS
 369 {
 370     ThreadBasicInformation,
 371     ThreadTimes,
 372     ThreadPriority,
 373     ThreadBasePriority,
 374     ThreadAffinityMask,
 375     ThreadImpersonationToken,
 376     ThreadDescriptorTableEntry,
 377     ThreadEnableAlignmentFaultFixup,
 378     ThreadEventPair_Reusable,
 379     ThreadQuerySetWin32StartAddress,
 380     ThreadZeroTlsCell,
 381     ThreadPerformanceCount,
 382     ThreadAmILastThread,
 383     ThreadIdealProcessor,
 384     ThreadPriorityBoost,
 385     ThreadSetTlsArrayAddress,
 386     ThreadIsIoPending,
 387     ThreadHideFromDebugger,
 388     ThreadBreakOnTermination,
 389     ThreadSwitchLegacyState,
 390     ThreadIsTerminated,
 391     ThreadLastSystemCall,
 392     ThreadIoPriority,
 393     ThreadCycleTime,
 394     ThreadPagePriority,
 395     ThreadActualBasePriority,
 396     ThreadTebInformation,
 397     ThreadCSwitchMon,
 398     MaxThreadInfoClass
 399 } THREADINFOCLASS;
 400
 401 #else
 402
 403 typedef enum _PSPROCESSPRIORITYMODE
 404 {
 405     PsProcessPriorityForeground,
 406     PsProcessPriorityBackground,
 407     PsProcessPrioritySpinning
 408 } PSPROCESSPRIORITYMODE;
 409
 410 typedef enum _JOBOBJECTINFOCLASS
 411 {
 412     JobObjectBasicAccountingInformation = 1,
 413     JobObjectBasicLimitInformation,
 414     JobObjectBasicProcessIdList,
 415     JobObjectBasicUIRestrictions,
 416     JobObjectSecurityLimitInformation,
 417     JobObjectEndOfJobTimeInformation,
 418     JobObjectAssociateCompletionPortInformation,
 419     JobObjectBasicAndIoAccountingInformation,
 420     JobObjectExtendedLimitInformation,
 421     JobObjectJobSetInformation,
 422     MaxJobObjectInfoClass
 423 } JOBOBJECTINFOCLASS;
 424
 425 //
 426 // Power Event Events for Win32K Power Event Callback
 427 //
 428 typedef enum _PSPOWEREVENTTYPE
 429 {
 430     PsW32FullWake = 0,
 431     PsW32EventCode = 1,
 432     PsW32PowerPolicyChanged = 2,
 433     PsW32SystemPowerState = 3,
 434     PsW32SystemTime = 4,
 435     PsW32DisplayState = 5,
 436     PsW32CapabilitiesChanged = 6,
 437     PsW32SetStateFailed = 7,
 438     PsW32GdiOff = 8,
 439     PsW32GdiOn = 9,
 440     PsW32GdiPrepareResumeUI = 10,
 441     PsW32GdiOffRequest = 11,
 442     PsW32MonitorOff = 12,
 443 } PSPOWEREVENTTYPE;
 444
 445 //
 446 // Power State Tasks for Win32K Power State Callback
 447 //
 448 typedef enum _POWERSTATETASK
 449 {
 450     PowerState_BlockSessionSwitch = 0,
 451     PowerState_Init = 1,
 452     PowerState_QueryApps = 2,
 453     PowerState_QueryServices = 3,
 454     PowerState_QueryAppsFailed = 4,
 455     PowerState_QueryServicesFailed = 5,
 456     PowerState_SuspendApps = 6,
 457     PowerState_SuspendServices = 7,
 458     PowerState_ShowUI = 8,
 459     PowerState_NotifyWL = 9,
 460     PowerState_ResumeApps = 10,
 461     PowerState_ResumeServices = 11,
 462     PowerState_UnBlockSessionSwitch = 12,
 463     PowerState_End = 13,
 464     PowerState_BlockInput = 14,
 465     PowerState_UnblockInput = 15,
 466 } POWERSTATETASK;
 467
 468 //
 469 // Win32K Job Callback Types
 470 //
 471 typedef enum _PSW32JOBCALLOUTTYPE
 472 {
 473    PsW32JobCalloutSetInformation = 0,
 474    PsW32JobCalloutAddProcess = 1,
 475    PsW32JobCalloutTerminate = 2,
 476 } PSW32JOBCALLOUTTYPE;
 477
 478 //
 479 // Win32K Thread Callback Types
 480 //
 481 typedef enum _PSW32THREADCALLOUTTYPE
 482 {
 483     PsW32ThreadCalloutInitialize,
 484     PsW32ThreadCalloutExit,
 485 } PSW32THREADCALLOUTTYPE;
 486
 487 //
 488 // Declare empty structure definitions so that they may be referenced by
 489 // routines before they are defined
 490 //
 491 struct _W32THREAD;
 492 struct _W32PROCESS;
 493 //struct _ETHREAD;
 494 struct _WIN32_POWEREVENT_PARAMETERS;
 495 struct _WIN32_POWERSTATE_PARAMETERS;
 496 struct _WIN32_JOBCALLOUT_PARAMETERS;
 497 struct _WIN32_OPENMETHOD_PARAMETERS;
 498 struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS;
 499 struct _WIN32_CLOSEMETHOD_PARAMETERS;
 500 struct _WIN32_DELETEMETHOD_PARAMETERS;
 501 struct _WIN32_PARSEMETHOD_PARAMETERS;
 502
 503 //
 504 // Win32K Process and Thread Callbacks
 505 //
 506 typedef
 507 NTSTATUS
 508 (NTAPI *PKWIN32_PROCESS_CALLOUT)(
 509     _In_ struct _EPROCESS *Process,
 510     _In_ BOOLEAN Create
 511 );
 512
 513 typedef
 514 NTSTATUS
 515 (NTAPI *PKWIN32_THREAD_CALLOUT)(
 516     _In_ struct _ETHREAD *Thread,
 517     _In_ PSW32THREADCALLOUTTYPE Type
 518 );
 519
 520 typedef
 521 NTSTATUS
 522 (NTAPI *PKWIN32_GLOBALATOMTABLE_CALLOUT)(
 523     VOID
 524 );
 525
 526 typedef
 527 NTSTATUS
 528 (NTAPI *PKWIN32_POWEREVENT_CALLOUT)(
 529     _In_ struct _WIN32_POWEREVENT_PARAMETERS *Parameters
 530 );
 531
 532 typedef
 533 NTSTATUS
 534 (NTAPI *PKWIN32_POWERSTATE_CALLOUT)(
 535     _In_ struct _WIN32_POWERSTATE_PARAMETERS *Parameters
 536 );
 537
 538 typedef
 539 NTSTATUS
 540 (NTAPI *PKWIN32_JOB_CALLOUT)(
 541     _In_ struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters
 542 );
 543
 544 typedef
 545 NTSTATUS
 546 (NTAPI *PGDI_BATCHFLUSH_ROUTINE)(
 547     VOID
 548 );
 549
 550 typedef
 551 NTSTATUS
 552 (NTAPI *PKWIN32_OPENMETHOD_CALLOUT)(
 553     _In_ struct _WIN32_OPENMETHOD_PARAMETERS *Parameters
 554 );
 555
 556 typedef
 557 NTSTATUS
 558 (NTAPI *PKWIN32_OKTOCLOSEMETHOD_CALLOUT)(
 559     _In_ struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters
 560 );
 561
 562 typedef
 563 NTSTATUS
 564 (NTAPI *PKWIN32_CLOSEMETHOD_CALLOUT)(
 565     _In_ struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters
 566 );
 567
 568 typedef
 569 NTSTATUS
 570 (NTAPI *PKWIN32_DELETEMETHOD_CALLOUT)(
 571     _In_ struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters
 572 );
 573
 574 typedef
 575 NTSTATUS
 576 (NTAPI *PKWIN32_PARSEMETHOD_CALLOUT)(
 577     _In_ struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters
 578 );
 579
 580 typedef
 581 NTSTATUS
 582 (NTAPI *PKWIN32_SESSION_CALLOUT)(
 583     _In_ PVOID Parameter
 584 );
 585
 586 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 587 typedef
 588 NTSTATUS
 589 (NTAPI *PKWIN32_WIN32DATACOLLECTION_CALLOUT)(
 590     _In_ struct _EPROCESS *Process,
 591     _In_ PVOID Callback,
 592     _In_ PVOID Context
 593 );
 594 #endif
 595
 596 //
 597 // Lego Callback
 598 //
 599 typedef
 600 VOID
 601 (NTAPI *PLEGO_NOTIFY_ROUTINE)(
 602     _In_ PKTHREAD Thread
 603 );
 604
 605 #endif
 606
 607 typedef NTSTATUS
 608 (NTAPI *PPOST_PROCESS_INIT_ROUTINE)(
 609     VOID
 610 );
 611
 612 //
 613 // Descriptor Table Entry Definition
 614 //
 615 #if (_M_IX86)
 616 #define _DESCRIPTOR_TABLE_ENTRY_DEFINED
 617 typedef struct _DESCRIPTOR_TABLE_ENTRY
 618 {
 619     ULONG Selector;
 620     LDT_ENTRY Descriptor;
 621 } DESCRIPTOR_TABLE_ENTRY, *PDESCRIPTOR_TABLE_ENTRY;
 622 #endif
 623
 624 //
 625 // PEB Lock Routine
 626 //
 627 typedef VOID
 628 (NTAPI *PPEBLOCKROUTINE)(
 629     PVOID PebLock
 630 );
 631
 632 //
 633 // PEB Free Block Descriptor
 634 //
 635 typedef struct _PEB_FREE_BLOCK
 636 {
 637     struct _PEB_FREE_BLOCK* Next;
 638     ULONG Size;
 639 } PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
 640
 641 //
 642 // Initial PEB
 643 //
 644 typedef struct _INITIAL_PEB
 645 {
 646     BOOLEAN InheritedAddressSpace;
 647     BOOLEAN ReadImageFileExecOptions;
 648     BOOLEAN BeingDebugged;
 649     union
 650     {
 651         BOOLEAN BitField;
 652 #if (NTDDI_VERSION >= NTDDI_WS03)
 653         struct
 654         {
 655             BOOLEAN ImageUsesLargePages:1;
 656 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
 657             BOOLEAN IsProtectedProcess:1;
 658             BOOLEAN IsLegacyProcess:1;
 659             BOOLEAN SpareBits:5;
 660 #else
 661             BOOLEAN SpareBits:7;
 662 #endif
 663         };
 664 #else
 665         BOOLEAN SpareBool;
 666 #endif
 667     };
 668     HANDLE Mutant;
 669 } INITIAL_PEB, *PINITIAL_PEB;
 670
 671 //
 672 // Initial TEB
 673 //
 674 typedef struct _INITIAL_TEB
 675 {
 676     PVOID PreviousStackBase;
 677     PVOID PreviousStackLimit;
 678     PVOID StackBase;
 679     PVOID StackLimit;
 680     PVOID AllocatedStackBase;
 681 } INITIAL_TEB, *PINITIAL_TEB;
 682
 683 //
 684 // TEB Active Frame Structures
 685 //
 686 typedef struct _TEB_ACTIVE_FRAME_CONTEXT
 687 {
 688     ULONG Flags;
 689     LPSTR FrameName;
 690 } TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;
 691 typedef const struct _TEB_ACTIVE_FRAME_CONTEXT *PCTEB_ACTIVE_FRAME_CONTEXT;
 692
 693 typedef struct _TEB_ACTIVE_FRAME_CONTEXT_EX
 694 {
 695     TEB_ACTIVE_FRAME_CONTEXT BasicContext;
 696     PCSTR SourceLocation;
 697 } TEB_ACTIVE_FRAME_CONTEXT_EX, *PTEB_ACTIVE_FRAME_CONTEXT_EX;
 698 typedef const struct _TEB_ACTIVE_FRAME_CONTEXT_EX *PCTEB_ACTIVE_FRAME_CONTEXT_EX;
 699
 700 typedef struct _TEB_ACTIVE_FRAME
 701 {
 702     ULONG Flags;
 703     struct _TEB_ACTIVE_FRAME *Previous;
 704     PCTEB_ACTIVE_FRAME_CONTEXT Context;
 705 } TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
 706 typedef const struct _TEB_ACTIVE_FRAME *PCTEB_ACTIVE_FRAME;
 707
 708 typedef struct _TEB_ACTIVE_FRAME_EX
 709 {
 710     TEB_ACTIVE_FRAME BasicFrame;
 711     PVOID ExtensionIdentifier;
 712 } TEB_ACTIVE_FRAME_EX, *PTEB_ACTIVE_FRAME_EX;
 713 typedef const struct _TEB_ACTIVE_FRAME_EX *PCTEB_ACTIVE_FRAME_EX;
 714
 715 typedef struct _CLIENT_ID32
 716 {
 717     ULONG UniqueProcess;
 718     ULONG UniqueThread;
 719 } CLIENT_ID32, *PCLIENT_ID32;
 720
 721 typedef struct _CLIENT_ID64
 722 {
 723     ULONG64 UniqueProcess;
 724     ULONG64 UniqueThread;
 725 } CLIENT_ID64, *PCLIENT_ID64;
 726
 727 #if (NTDDI_VERSION < NTDDI_WS03)
 728 typedef struct _Wx86ThreadState
 729 {
 730     PULONG  CallBx86Eip;
 731     PVOID   DeallocationCpu;
 732     BOOLEAN UseKnownWx86Dll;
 733     CHAR    OleStubInvoked;
 734 } Wx86ThreadState, *PWx86ThreadState;
 735 #endif
 736
 737 //
 738 // PEB.AppCompatFlags
 739 // Tag FLAG_MASK_KERNEL
 740 //
 741 typedef enum _APPCOMPAT_FLAGS
 742 {
 743     GetShortPathNameNT4 = 0x1,
 744     GetDiskFreeSpace2GB = 0x8,
 745     FTMFromCurrentAPI = 0x20,
 746     DisallowCOMBindingNotifications = 0x40,
 747     Ole32ValidatePointers = 0x80,
 748     DisableCicero = 0x100,
 749     Ole32EnableAsyncDocFile = 0x200,
 750     EnableLegacyExceptionHandlinginOLE = 0x400,
 751     DisableAdvanceRPCClientHardening = 0x800,
 752     DisableMaybeNULLSizeisConsistencycheck = 0x1000,
 753     DisableAdvancedRPCrangeCheck = 0x4000,
 754     EnableLegacyExceptionHandlingInRPC = 0x8000,
 755     EnableLegacyNTFSFlagsForDocfileOpens = 0x10000,
 756     DisableNDRIIDConsistencyCheck = 0x20000,
 757     UserDisableForwarderPatch = 0x40000,
 758     DisableNewWMPAINTDispatchInOLE = 0x100000,
 759     DoNotAddToCache = 0x80000000,
 760 } APPCOMPAT_FLAGS;
 761
 762
 763 //
 764 // PEB.AppCompatFlagsUser.LowPart
 765 // Tag FLAG_MASK_USER
 766 //
 767 typedef enum _APPCOMPAT_USERFLAGS
 768 {
 769     DisableAnimation = 0x1,
 770     DisableKeyboardCues = 0x2,
 771     No50StylebitsInSetWindowLong = 0x4,
 772     DisableDrawPatternRect = 0x8,
 773     MSShellDialog = 0x10,
 774     NoDDETerminateDuringDestroy = 0x20,
 775     GiveupForeground = 0x40,
 776     AlwaysActiveMenus = 0x80,
 777     NoMouseHideInEdit = 0x100,
 778     NoGdiBatching = 0x200,
 779     FontSubstitution = 0x400,
 780     No50StylebitsInCreateWindow = 0x800,
 781     NoCustomPaperSizes = 0x1000,
 782     AllTheDdeHacks = 0x2000,
 783     UseDefaultCharset = 0x4000,
 784     NoCharDeadKey = 0x8000,
 785     NoTryExceptForWindowProc = 0x10000,
 786     NoInitInsertReplaceFlags = 0x20000,
 787     NoDdeSync = 0x40000,
 788     NoGhost = 0x80000,
 789     NoDdeAsyncReg = 0x100000,
 790     StrictLLHook = 0x200000,
 791     NoShadow = 0x400000,
 792     NoTimerCallbackProtection = 0x1000000,
 793     HighDpiAware = 0x2000000,
 794     OpenGLEmfAware = 0x4000000,
 795     EnableTransparantBltMirror = 0x8000000,
 796     NoPaddedBorder = 0x10000000,
 797     ForceLegacyResizeCM = 0x20000000,
 798     HardwareAudioMixer = 0x40000000,
 799     DisableSWCursorOnMoveSize = 0x80000000,
 800 #if 0
 801     DisableWindowArrangement = 0x100000000,
 802     ReorderWaveForCommunications = 0x200000000,
 803     NoGdiHwAcceleration = 0x400000000,
 804 #endif
 805 } APPCOMPAT_USERFLAGS;
 806
 807 //
 808 // PEB.AppCompatFlagsUser.HighPart
 809 // Tag FLAG_MASK_USER
 810 //
 811 typedef enum _APPCOMPAT_USERFLAGS_HIGHPART
 812 {
 813     DisableWindowArrangement = 0x1,
 814     ReorderWaveForCommunications = 0x2,
 815     NoGdiHwAcceleration = 0x4,
 816 } APPCOMPAT_USERFLAGS_HIGHPART;
 817
 818 //
 819 // Process Environment Block (PEB)
 820 // Thread Environment Block (TEB)
 821 //
 822 #include "peb_teb.h"
 823
 824 #ifdef _WIN64
 825 //
 826 // Explicit 32 bit PEB/TEB
 827 //
 828 #define EXPLICIT_32BIT
 829 #include "peb_teb.h"
 830 #undef EXPLICIT_32BIT
 831
 832 //
 833 // Explicit 64 bit PEB/TEB
 834 //
 835 #define EXPLICIT_64BIT
 836 #include "peb_teb.h"
 837 #undef EXPLICIT_64BIT
 838 #endif
 839
 840 #ifdef NTOS_MODE_USER
 841
 842 //
 843 // Process Information Structures for NtQueryProcessInformation
 844 //
 845 typedef struct _PROCESS_BASIC_INFORMATION
 846 {
 847     NTSTATUS ExitStatus;
 848     PPEB PebBaseAddress;
 849     ULONG_PTR AffinityMask;
 850     KPRIORITY BasePriority;
 851     ULONG_PTR UniqueProcessId;
 852     ULONG_PTR InheritedFromUniqueProcessId;
 853 } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
 854
 855 typedef struct _PROCESS_ACCESS_TOKEN
 856 {
 857     HANDLE Token;
 858     HANDLE Thread;
 859 } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
 860
 861 typedef struct _PROCESS_DEVICEMAP_INFORMATION
 862 {
 863     union
 864     {
 865         struct
 866         {
 867             HANDLE DirectoryHandle;
 868         } Set;
 869         struct
 870         {
 871             ULONG DriveMap;
 872             UCHAR DriveType[32];
 873         } Query;
 874     };
 875 } PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION;
 876
 877 typedef struct _KERNEL_USER_TIMES
 878 {
 879     LARGE_INTEGER CreateTime;
 880     LARGE_INTEGER ExitTime;
 881     LARGE_INTEGER KernelTime;
 882     LARGE_INTEGER UserTime;
 883 } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
 884
 885 typedef struct _POOLED_USAGE_AND_LIMITS
 886 {
 887     SIZE_T PeakPagedPoolUsage;
 888     SIZE_T PagedPoolUsage;
 889     SIZE_T PagedPoolLimit;
 890     SIZE_T PeakNonPagedPoolUsage;
 891     SIZE_T NonPagedPoolUsage;
 892     SIZE_T NonPagedPoolLimit;
 893     SIZE_T PeakPagefileUsage;
 894     SIZE_T PagefileUsage;
 895     SIZE_T PagefileLimit;
 896 } POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS;
 897
 898 typedef struct _PROCESS_SESSION_INFORMATION
 899 {
 900     ULONG SessionId;
 901 } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
 902
 903 #endif
 904
 905 typedef struct DECLSPEC_ALIGN(4) _PROCESS_PRIORITY_CLASS
 906 {
 907     BOOLEAN Foreground;
 908     UCHAR PriorityClass;
 909 } PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;
 910
 911 typedef struct _PROCESS_FOREGROUND_BACKGROUND
 912 {
 913     BOOLEAN Foreground;
 914 } PROCESS_FOREGROUND_BACKGROUND, *PPROCESS_FOREGROUND_BACKGROUND;
 915
 916 //
 917 // Apphelp SHIM Cache
 918 //
 919 typedef enum _APPHELPCACHESERVICECLASS
 920 {
 921     ApphelpCacheServiceLookup = 0,
 922     ApphelpCacheServiceRemove = 1,
 923     ApphelpCacheServiceUpdate = 2,
 924     ApphelpCacheServiceFlush = 3,
 925     ApphelpCacheServiceDump = 4,
 926
 927     ApphelpDBGReadRegistry = 0x100,
 928     ApphelpDBGWriteRegistry = 0x101,
 929 } APPHELPCACHESERVICECLASS;
 930
 931
 932 typedef struct _APPHELP_CACHE_SERVICE_LOOKUP
 933 {
 934     UNICODE_STRING ImageName;
 935     HANDLE ImageHandle;
 936 } APPHELP_CACHE_SERVICE_LOOKUP, *PAPPHELP_CACHE_SERVICE_LOOKUP;
 937
 938
 939 //
 940 // Thread Information Structures for NtQueryProcessInformation
 941 //
 942 typedef struct _THREAD_BASIC_INFORMATION
 943 {
 944     NTSTATUS ExitStatus;
 945     PVOID TebBaseAddress;
 946     CLIENT_ID ClientId;
 947     KAFFINITY AffinityMask;
 948     KPRIORITY Priority;
 949     KPRIORITY BasePriority;
 950 } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
 951
 952 #ifndef NTOS_MODE_USER
 953
 954 //
 955 // Job Set Array
 956 //
 957 typedef struct _JOB_SET_ARRAY
 958 {
 959     HANDLE JobHandle;
 960     ULONG MemberLevel;
 961     ULONG Flags;
 962 } JOB_SET_ARRAY, *PJOB_SET_ARRAY;
 963
 964 //
 965 // EPROCESS Quota Structures
 966 //
 967 typedef struct _EPROCESS_QUOTA_ENTRY
 968 {
 969     SIZE_T Usage;
 970     SIZE_T Limit;
 971     SIZE_T Peak;
 972     SIZE_T Return;
 973 } EPROCESS_QUOTA_ENTRY, *PEPROCESS_QUOTA_ENTRY;
 974
 975 typedef struct _EPROCESS_QUOTA_BLOCK
 976 {
 977     EPROCESS_QUOTA_ENTRY QuotaEntry[3];
 978     LIST_ENTRY QuotaList;
 979     ULONG ReferenceCount;
 980     ULONG ProcessCount;
 981 } EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;
 982
 983 //
 984 // Process Pagefault History
 985 //
 986 typedef struct _PAGEFAULT_HISTORY
 987 {
 988     ULONG CurrentIndex;
 989     ULONG MapIndex;
 990     KSPIN_LOCK SpinLock;
 991     PVOID Reserved;
 992     PROCESS_WS_WATCH_INFORMATION WatchInfo[1];
 993 } PAGEFAULT_HISTORY, *PPAGEFAULT_HISTORY;
 994
 995 //
 996 // Process Impersonation Information
 997 //
 998 typedef struct _PS_IMPERSONATION_INFORMATION
 999 {
1000     PACCESS_TOKEN Token;
1001     BOOLEAN CopyOnOpen;
1002     BOOLEAN EffectiveOnly;
1003     SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
1004 } PS_IMPERSONATION_INFORMATION, *PPS_IMPERSONATION_INFORMATION;
1005
1006 //
1007 // Process Termination Port
1008 //
1009 typedef struct _TERMINATION_PORT
1010 {
1011     struct _TERMINATION_PORT *Next;
1012     PVOID Port;
1013 } TERMINATION_PORT, *PTERMINATION_PORT;
1014
1015 //
1016 // Per-Process APC Rate Limiting
1017 //
1018 typedef struct _PSP_RATE_APC
1019 {
1020     union
1021     {
1022         SINGLE_LIST_ENTRY NextApc;
1023         ULONGLONG ExcessCycles;
1024     };
1025     ULONGLONG TargetGEneration;
1026     KAPC RateApc;
1027 } PSP_RATE_APC, *PPSP_RATE_APC;
1028
1029 //
1030 // Executive Thread (ETHREAD)
1031 //
1032 typedef struct _ETHREAD
1033 {
1034     KTHREAD Tcb;
1035     LARGE_INTEGER CreateTime;
1036     union
1037     {
1038         LARGE_INTEGER ExitTime;
1039         LIST_ENTRY LpcReplyChain;
1040         LIST_ENTRY KeyedWaitChain;
1041     };
1042     union
1043     {
1044         NTSTATUS ExitStatus;
1045         PVOID OfsChain;
1046     };
1047     LIST_ENTRY PostBlockList;
1048     union
1049     {
1050         struct _TERMINATION_PORT *TerminationPort;
1051         struct _ETHREAD *ReaperLink;
1052         PVOID KeyedWaitValue;
1053 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1054         PVOID Win32StartParameter;
1055 #endif
1056     };
1057     KSPIN_LOCK ActiveTimerListLock;
1058     LIST_ENTRY ActiveTimerListHead;
1059     CLIENT_ID Cid;
1060 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1061     KSEMAPHORE KeyedWaitSemaphore;
1062 #else
1063     union
1064     {
1065         KSEMAPHORE LpcReplySemaphore;
1066         KSEMAPHORE KeyedWaitSemaphore;
1067     };
1068     union
1069     {
1070         PVOID LpcReplyMessage;
1071         PVOID LpcWaitingOnPort;
1072     };
1073 #endif
1074     PPS_IMPERSONATION_INFORMATION ImpersonationInfo;
1075     LIST_ENTRY IrpList;
1076     ULONG_PTR TopLevelIrp;
1077     PDEVICE_OBJECT DeviceToVerify;
1078 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1079     PPSP_RATE_APC RateControlApc;
1080 #else
1081     struct _EPROCESS *ThreadsProcess;
1082 #endif
1083     PVOID Win32StartAddress;
1084     union
1085     {
1086         PKSTART_ROUTINE StartAddress;
1087         ULONG LpcReceivedMessageId;
1088     };
1089     LIST_ENTRY ThreadListEntry;
1090     EX_RUNDOWN_REF RundownProtect;
1091     EX_PUSH_LOCK ThreadLock;
1092 #if (NTDDI_VERSION < NTDDI_LONGHORN)
1093     ULONG LpcReplyMessageId;
1094 #endif
1095     ULONG ReadClusterSize;
1096 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1097     ULONG SpareUlong0;
1098 #else
1099     ACCESS_MASK GrantedAccess;
1100 #endif
1101     union
1102     {
1103         struct
1104         {
1105            ULONG Terminated:1;
1106 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1107            ULONG ThreadInserted:1;
1108 #else
1109            ULONG DeadThread:1;
1110 #endif
1111            ULONG HideFromDebugger:1;
1112            ULONG ActiveImpersonationInfo:1;
1113            ULONG SystemThread:1;
1114            ULONG HardErrorsAreDisabled:1;
1115            ULONG BreakOnTermination:1;
1116            ULONG SkipCreationMsg:1;
1117            ULONG SkipTerminationMsg:1;
1118 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1119            ULONG CreateMsgSent:1;
1120            ULONG ThreadIoPriority:3;
1121            ULONG ThreadPagePriority:3;
1122            ULONG PendingRatecontrol:1;
1123 #endif
1124         };
1125         ULONG CrossThreadFlags;
1126     };
1127     union
1128     {
1129         struct
1130         {
1131            ULONG ActiveExWorker:1;
1132            ULONG ExWorkerCanWaitUser:1;
1133            ULONG MemoryMaker:1;
1134            ULONG KeyedEventInUse:1;
1135 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1136            ULONG RateApcState:2;
1137 #endif
1138         };
1139         ULONG SameThreadPassiveFlags;
1140     };
1141     union
1142     {
1143         struct
1144         {
1145            ULONG LpcReceivedMsgIdValid:1;
1146            ULONG LpcExitThreadCalled:1;
1147 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1148            ULONG Spare:1;
1149 #else
1150            ULONG AddressSpaceOwner:1;
1151 #endif
1152            ULONG OwnsProcessWorkingSetExclusive:1;
1153            ULONG OwnsProcessWorkingSetShared:1;
1154            ULONG OwnsSystemWorkingSetExclusive:1;
1155            ULONG OwnsSystemWorkingSetShared:1;
1156            ULONG OwnsSessionWorkingSetExclusive:1;
1157            ULONG OwnsSessionWorkingSetShared:1;
1158 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1159            ULONG SuppressSymbolLoad:1;
1160            ULONG Spare1:3;
1161            ULONG PriorityRegionActive:4;
1162 #else
1163            ULONG ApcNeeded:1;
1164 #endif
1165         };
1166         ULONG SameThreadApcFlags;
1167     };
1168 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1169     UCHAR CacheManagerActive;
1170 #else
1171     UCHAR ForwardClusterOnly;
1172 #endif
1173     UCHAR DisablePageFaultClustering;
1174     UCHAR ActiveFaultCount;
1175 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1176     ULONG AlpcMessageId;
1177     union
1178     {
1179         PVOID AlpcMessage;
1180         ULONG AlpcReceiveAttributeSet;
1181     };
1182     LIST_ENTRY AlpcWaitListEntry;
1183     KSEMAPHORE AlpcWaitSemaphore;
1184     ULONG CacheManagerCount;
1185 #endif
1186 } ETHREAD;
1187
1188 //
1189 // Executive Process (EPROCESS)
1190 //
1191 typedef struct _EPROCESS
1192 {
1193     KPROCESS Pcb;
1194     EX_PUSH_LOCK ProcessLock;
1195     LARGE_INTEGER CreateTime;
1196     LARGE_INTEGER ExitTime;
1197     EX_RUNDOWN_REF RundownProtect;
1198     HANDLE UniqueProcessId;
1199     LIST_ENTRY ActiveProcessLinks;
1200     SIZE_T QuotaUsage[3]; /* 0=PagedPool, 1=NonPagedPool, 2=Pagefile */
1201     SIZE_T QuotaPeak[3];  /* ditto */
1202     SIZE_T CommitCharge;
1203     SIZE_T PeakVirtualSize;
1204     SIZE_T VirtualSize;
1205     LIST_ENTRY SessionProcessLinks;
1206     PVOID DebugPort;
1207 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1208     union
1209     {
1210         PVOID ExceptionPortData;
1211         ULONG ExceptionPortValue;
1212         UCHAR ExceptionPortState:3;
1213     };
1214 #else
1215     PVOID ExceptionPort;
1216 #endif
1217     PHANDLE_TABLE ObjectTable;
1218     EX_FAST_REF Token;
1219     PFN_NUMBER WorkingSetPage;
1220 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1221     EX_PUSH_LOCK AddressCreationLock;
1222     PETHREAD RotateInProgress;
1223 #else
1224     KGUARDED_MUTEX AddressCreationLock;
1225     KSPIN_LOCK HyperSpaceLock;
1226 #endif
1227     PETHREAD ForkInProgress;
1228     ULONG_PTR HardwareTrigger;
1229     PMM_AVL_TABLE PhysicalVadRoot;
1230     PVOID CloneRoot;
1231     PFN_NUMBER NumberOfPrivatePages;
1232     PFN_NUMBER NumberOfLockedPages;
1233     PVOID *Win32Process;
1234     struct _EJOB *Job;
1235     PVOID SectionObject;
1236     PVOID SectionBaseAddress;
1237     PEPROCESS_QUOTA_BLOCK QuotaBlock;
1238     PPAGEFAULT_HISTORY WorkingSetWatch;
1239     PVOID Win32WindowStation;
1240     HANDLE InheritedFromUniqueProcessId;
1241     PVOID LdtInformation;
1242     PVOID VadFreeHint;
1243     PVOID VdmObjects;
1244     PVOID DeviceMap;
1245 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1246     PVOID EtwDataSource;
1247     PVOID FreeTebHint;
1248 #else
1249     PVOID Spare0[3];
1250 #endif
1251     union
1252     {
1253         HARDWARE_PTE PageDirectoryPte;
1254         ULONGLONG Filler;
1255     };
1256     PVOID Session;
1257     CHAR ImageFileName[16];
1258     LIST_ENTRY JobLinks;
1259     PVOID LockedPagesList;
1260     LIST_ENTRY ThreadListHead;
1261     PVOID SecurityPort;
1262 #ifdef _M_AMD64
1263     struct _WOW64_PROCESS *Wow64Process;
1264 #else
1265     PVOID PaeTop;
1266 #endif
1267     ULONG ActiveThreads;
1268 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1269     ULONG ImagePathHash;
1270 #else
1271     ACCESS_MASK GrantedAccess;
1272 #endif
1273     ULONG DefaultHardErrorProcessing;
1274     NTSTATUS LastThreadExitStatus;
1275     struct _PEB* Peb;
1276     EX_FAST_REF PrefetchTrace;
1277     LARGE_INTEGER ReadOperationCount;
1278     LARGE_INTEGER WriteOperationCount;
1279     LARGE_INTEGER OtherOperationCount;
1280     LARGE_INTEGER ReadTransferCount;
1281     LARGE_INTEGER WriteTransferCount;
1282     LARGE_INTEGER OtherTransferCount;
1283     SIZE_T CommitChargeLimit;
1284     SIZE_T CommitChargePeak;
1285     PVOID AweInfo;
1286     SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;
1287     MMSUPPORT Vm;
1288 #ifdef _M_AMD64
1289     ULONG Spares[2];
1290 #else
1291     LIST_ENTRY MmProcessLinks;
1292 #endif
1293     ULONG ModifiedPageCount;
1294 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1295     union
1296     {
1297         struct
1298         {
1299             ULONG JobNotReallyActive:1;
1300             ULONG AccountingFolded:1;
1301             ULONG NewProcessReported:1;
1302             ULONG ExitProcessReported:1;
1303             ULONG ReportCommitChanges:1;
1304             ULONG LastReportMemory:1;
1305             ULONG ReportPhysicalPageChanges:1;
1306             ULONG HandleTableRundown:1;
1307             ULONG NeedsHandleRundown:1;
1308             ULONG RefTraceEnabled:1;
1309             ULONG NumaAware:1;
1310             ULONG ProtectedProcess:1;
1311             ULONG DefaultPagePriority:3;
1312             ULONG ProcessDeleteSelf:1;
1313             ULONG ProcessVerifierTarget:1;
1314         };
1315         ULONG Flags2;
1316     };
1317 #else
1318     ULONG JobStatus;
1319 #endif
1320     union
1321     {
1322         struct
1323         {
1324             ULONG CreateReported:1;
1325             ULONG NoDebugInherit:1;
1326             ULONG ProcessExiting:1;
1327             ULONG ProcessDelete:1;
1328             ULONG Wow64SplitPages:1;
1329             ULONG VmDeleted:1;
1330             ULONG OutswapEnabled:1;
1331             ULONG Outswapped:1;
1332             ULONG ForkFailed:1;
1333             ULONG Wow64VaSpace4Gb:1;
1334             ULONG AddressSpaceInitialized:2;
1335             ULONG SetTimerResolution:1;
1336             ULONG BreakOnTermination:1;
1337 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1338             ULONG DeprioritizeViews:1;
1339 #else
1340             ULONG SessionCreationUnderway:1;
1341 #endif
1342             ULONG WriteWatch:1;
1343             ULONG ProcessInSession:1;
1344             ULONG OverrideAddressSpace:1;
1345             ULONG HasAddressSpace:1;
1346             ULONG LaunchPrefetched:1;
1347             ULONG InjectInpageErrors:1;
1348             ULONG VmTopDown:1;
1349             ULONG ImageNotifyDone:1;
1350             ULONG PdeUpdateNeeded:1;
1351             ULONG VdmAllowed:1;
1352             ULONG SmapAllowed:1;
1353 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1354             ULONG ProcessInserted:1;
1355 #else
1356             ULONG CreateFailed:1;
1357 #endif
1358             ULONG DefaultIoPriority:3;
1359 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1360             ULONG SparePsFlags1:2;
1361 #else
1362             ULONG Spare1:1;
1363             ULONG Spare2:1;
1364 #endif
1365         };
1366         ULONG Flags;
1367     };
1368     NTSTATUS ExitStatus;
1369 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1370     USHORT Spare7;
1371 #else
1372     USHORT NextPageColor;
1373 #endif
1374     union
1375     {
1376         struct
1377         {
1378             UCHAR SubSystemMinorVersion;
1379             UCHAR SubSystemMajorVersion;
1380         };
1381         USHORT SubSystemVersion;
1382     };
1383     UCHAR PriorityClass;
1384     MM_AVL_TABLE VadRoot;
1385     ULONG Cookie;
1386 } EPROCESS;
1387
1388 //
1389 // Job Token Filter Data
1390 //
1391 #include <pshpack1.h>
1392 typedef struct _PS_JOB_TOKEN_FILTER
1393 {
1394     ULONG CapturedSidCount;
1395     PSID_AND_ATTRIBUTES CapturedSids;
1396     ULONG CapturedSidsLength;
1397     ULONG CapturedGroupCount;
1398     PSID_AND_ATTRIBUTES CapturedGroups;
1399     ULONG CapturedGroupsLength;
1400     ULONG CapturedPrivilegeCount;
1401     PLUID_AND_ATTRIBUTES CapturedPrivileges;
1402     ULONG CapturedPrivilegesLength;
1403 } PS_JOB_TOKEN_FILTER, *PPS_JOB_TOKEN_FILTER;
1404
1405 //
1406 // Executive Job (EJOB)
1407 //
1408 typedef struct _EJOB
1409 {
1410     KEVENT Event;
1411     LIST_ENTRY JobLinks;
1412     LIST_ENTRY ProcessListHead;
1413     ERESOURCE JobLock;
1414     LARGE_INTEGER TotalUserTime;
1415     LARGE_INTEGER TotalKernelTime;
1416     LARGE_INTEGER ThisPeriodTotalUserTime;
1417     LARGE_INTEGER ThisPeriodTotalKernelTime;
1418     ULONG TotalPageFaultCount;
1419     ULONG TotalProcesses;
1420     ULONG ActiveProcesses;
1421     ULONG TotalTerminatedProcesses;
1422     LARGE_INTEGER PerProcessUserTimeLimit;
1423     LARGE_INTEGER PerJobUserTimeLimit;
1424     ULONG LimitFlags;
1425     ULONG MinimumWorkingSetSize;
1426     ULONG MaximumWorkingSetSize;
1427     ULONG ActiveProcessLimit;
1428     ULONG Affinity;
1429     UCHAR PriorityClass;
1430     ULONG UIRestrictionsClass;
1431     ULONG SecurityLimitFlags;
1432     PVOID Token;
1433     PPS_JOB_TOKEN_FILTER Filter;
1434     ULONG EndOfJobTimeAction;
1435     PVOID CompletionPort;
1436     PVOID CompletionKey;
1437     ULONG SessionId;
1438     ULONG SchedulingClass;
1439     ULONGLONG ReadOperationCount;
1440     ULONGLONG WriteOperationCount;
1441     ULONGLONG OtherOperationCount;
1442     ULONGLONG ReadTransferCount;
1443     ULONGLONG WriteTransferCount;
1444     ULONGLONG OtherTransferCount;
1445     IO_COUNTERS IoInfo;
1446     ULONG ProcessMemoryLimit;
1447     ULONG JobMemoryLimit;
1448     ULONG PeakProcessMemoryUsed;
1449     ULONG PeakJobMemoryUsed;
1450     ULONG CurrentJobMemoryUsed;
1451 #if (NTDDI_VERSION >= NTDDI_WINXP) && (NTDDI_VERSION < NTDDI_WS03)
1452     FAST_MUTEX MemoryLimitsLock;
1453 #elif (NTDDI_VERSION >= NTDDI_WS03) && (NTDDI_VERSION < NTDDI_LONGHORN)
1454     KGUARDED_MUTEX MemoryLimitsLock;
1455 #elif (NTDDI_VERSION >= NTDDI_LONGHORN)
1456     EX_PUSH_LOCK MemoryLimitsLock;
1457 #endif
1458     LIST_ENTRY JobSetLinks;
1459     ULONG MemberLevel;
1460     ULONG JobFlags;
1461 } EJOB, *PEJOB;
1462 #include <poppack.h>
1463
1464 //
1465 // Job Information Structures for NtQueryInformationJobObject
1466 //
1467
1468 typedef struct _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION
1469 {
1470     LARGE_INTEGER TotalUserTime;
1471     LARGE_INTEGER TotalKernelTime;
1472     LARGE_INTEGER ThisPeriodTotalUserTime;
1473     LARGE_INTEGER ThisPeriodTotalKernelTime;
1474     ULONG TotalPageFaultCount;
1475     ULONG TotalProcesses;
1476     ULONG ActiveProcesses;
1477     ULONG TotalTerminatedProcesses;
1478 } JOBOBJECT_BASIC_ACCOUNTING_INFORMATION, *PJOBOBJECT_BASIC_ACCOUNTING_INFORMATION;
1479
1480 typedef struct _JOBOBJECT_BASIC_LIMIT_INFORMATION
1481 {
1482     LARGE_INTEGER PerProcessUserTimeLimit;
1483     LARGE_INTEGER PerJobUserTimeLimit;
1484     ULONG LimitFlags;
1485     SIZE_T MinimumWorkingSetSize;
1486     SIZE_T MaximumWorkingSetSize;
1487     ULONG ActiveProcessLimit;
1488     ULONG_PTR Affinity;
1489     ULONG PriorityClass;
1490     ULONG SchedulingClass;
1491 } JOBOBJECT_BASIC_LIMIT_INFORMATION, *PJOBOBJECT_BASIC_LIMIT_INFORMATION;
1492
1493 typedef struct _JOBOBJECT_BASIC_PROCESS_ID_LIST
1494 {
1495     ULONG NumberOfAssignedProcesses;
1496     ULONG NumberOfProcessIdsInList;
1497     ULONG_PTR ProcessIdList[1];
1498 } JOBOBJECT_BASIC_PROCESS_ID_LIST, *PJOBOBJECT_BASIC_PROCESS_ID_LIST;
1499
1500 typedef struct _JOBOBJECT_BASIC_UI_RESTRICTIONS
1501 {
1502     ULONG UIRestrictionsClass;
1503 } JOBOBJECT_BASIC_UI_RESTRICTIONS, *PJOBOBJECT_BASIC_UI_RESTRICTIONS;
1504
1505 typedef struct _JOBOBJECT_SECURITY_LIMIT_INFORMATION
1506 {
1507     ULONG SecurityLimitFlags;
1508     HANDLE JobToken;
1509     PTOKEN_GROUPS SidsToDisable;
1510     PTOKEN_PRIVILEGES PrivilegesToDelete;
1511     PTOKEN_GROUPS RestrictedSids;
1512 } JOBOBJECT_SECURITY_LIMIT_INFORMATION, *PJOBOBJECT_SECURITY_LIMIT_INFORMATION;
1513
1514 typedef struct _JOBOBJECT_END_OF_JOB_TIME_INFORMATION
1515 {
1516     ULONG EndOfJobTimeAction;
1517 } JOBOBJECT_END_OF_JOB_TIME_INFORMATION, PJOBOBJECT_END_OF_JOB_TIME_INFORMATION;
1518
1519 typedef struct _JOBOBJECT_ASSOCIATE_COMPLETION_PORT
1520 {
1521     PVOID CompletionKey;
1522     HANDLE CompletionPort;
1523 } JOBOBJECT_ASSOCIATE_COMPLETION_PORT, *PJOBOBJECT_ASSOCIATE_COMPLETION_PORT;
1524
1525 typedef struct JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION
1526 {
1527     JOBOBJECT_BASIC_ACCOUNTING_INFORMATION BasicInfo;
1528     IO_COUNTERS IoInfo;
1529 } JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION, *PJOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION;
1530
1531 typedef struct _JOBOBJECT_EXTENDED_LIMIT_INFORMATION
1532 {
1533     JOBOBJECT_BASIC_LIMIT_INFORMATION BasicLimitInformation;
1534     IO_COUNTERS IoInfo;
1535     SIZE_T ProcessMemoryLimit;
1536     SIZE_T JobMemoryLimit;
1537     SIZE_T PeakProcessMemoryUsed;
1538     SIZE_T PeakJobMemoryUsed;
1539 } JOBOBJECT_EXTENDED_LIMIT_INFORMATION, *PJOBOBJECT_EXTENDED_LIMIT_INFORMATION;
1540
1541
1542 //
1543 // Win32K Callback Registration Data
1544 //
1545 typedef struct _WIN32_POWEREVENT_PARAMETERS
1546 {
1547     PSPOWEREVENTTYPE EventNumber;
1548     ULONG Code;
1549 } WIN32_POWEREVENT_PARAMETERS, *PWIN32_POWEREVENT_PARAMETERS;
1550
1551 typedef struct _WIN32_POWERSTATE_PARAMETERS
1552 {
1553     UCHAR Promotion;
1554     POWER_ACTION SystemAction;
1555     SYSTEM_POWER_STATE MinSystemState;
1556     ULONG Flags;
1557     POWERSTATETASK PowerStateTask;
1558 } WIN32_POWERSTATE_PARAMETERS, *PWIN32_POWERSTATE_PARAMETERS;
1559
1560 typedef struct _WIN32_JOBCALLOUT_PARAMETERS
1561 {
1562     PVOID Job;
1563     PSW32JOBCALLOUTTYPE CalloutType;
1564     PVOID Data;
1565 } WIN32_JOBCALLOUT_PARAMETERS, *PWIN32_JOBCALLOUT_PARAMETERS;
1566
1567 typedef struct _WIN32_OPENMETHOD_PARAMETERS
1568 {
1569     OB_OPEN_REASON OpenReason;
1570     PEPROCESS Process;
1571     PVOID Object;
1572     ULONG GrantedAccess;
1573     ULONG HandleCount;
1574 } WIN32_OPENMETHOD_PARAMETERS, *PWIN32_OPENMETHOD_PARAMETERS;
1575
1576 typedef struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS
1577 {
1578     PEPROCESS Process;
1579     PVOID Object;
1580     HANDLE Handle;
1581     KPROCESSOR_MODE PreviousMode;
1582 } WIN32_OKAYTOCLOSEMETHOD_PARAMETERS, *PWIN32_OKAYTOCLOSEMETHOD_PARAMETERS;
1583
1584 typedef struct _WIN32_CLOSEMETHOD_PARAMETERS
1585 {
1586     PEPROCESS Process;
1587     PVOID Object;
1588     ACCESS_MASK AccessMask;
1589     ULONG ProcessHandleCount;
1590     ULONG SystemHandleCount;
1591 } WIN32_CLOSEMETHOD_PARAMETERS, *PWIN32_CLOSEMETHOD_PARAMETERS;
1592
1593 typedef struct _WIN32_DELETEMETHOD_PARAMETERS
1594 {
1595     PVOID Object;
1596 } WIN32_DELETEMETHOD_PARAMETERS, *PWIN32_DELETEMETHOD_PARAMETERS;
1597
1598 typedef struct _WIN32_PARSEMETHOD_PARAMETERS
1599 {
1600     PVOID ParseObject;
1601     PVOID ObjectType;
1602     PACCESS_STATE AccessState;
1603     KPROCESSOR_MODE AccessMode;
1604     ULONG Attributes;
1605     _Out_ PUNICODE_STRING CompleteName;
1606     PUNICODE_STRING RemainingName;
1607     PVOID Context;
1608     PSECURITY_QUALITY_OF_SERVICE SecurityQos;
1609     PVOID *Object;
1610 } WIN32_PARSEMETHOD_PARAMETERS, *PWIN32_PARSEMETHOD_PARAMETERS;
1611
1612 typedef struct _WIN32_CALLOUTS_FPNS
1613 {
1614     PKWIN32_PROCESS_CALLOUT ProcessCallout;
1615     PKWIN32_THREAD_CALLOUT ThreadCallout;
1616     PKWIN32_GLOBALATOMTABLE_CALLOUT GlobalAtomTableCallout;
1617     PKWIN32_POWEREVENT_CALLOUT PowerEventCallout;
1618     PKWIN32_POWERSTATE_CALLOUT PowerStateCallout;
1619     PKWIN32_JOB_CALLOUT JobCallout;
1620     PGDI_BATCHFLUSH_ROUTINE BatchFlushRoutine;
1621     PKWIN32_SESSION_CALLOUT DesktopOpenProcedure;
1622     PKWIN32_SESSION_CALLOUT DesktopOkToCloseProcedure;
1623     PKWIN32_SESSION_CALLOUT DesktopCloseProcedure;
1624     PKWIN32_SESSION_CALLOUT DesktopDeleteProcedure;
1625     PKWIN32_SESSION_CALLOUT WindowStationOkToCloseProcedure;
1626     PKWIN32_SESSION_CALLOUT WindowStationCloseProcedure;
1627     PKWIN32_SESSION_CALLOUT WindowStationDeleteProcedure;
1628     PKWIN32_SESSION_CALLOUT WindowStationParseProcedure;
1629     PKWIN32_SESSION_CALLOUT WindowStationOpenProcedure;
1630 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1631     PKWIN32_WIN32DATACOLLECTION_CALLOUT Win32DataCollectionProcedure;
1632 #endif
1633 } WIN32_CALLOUTS_FPNS, *PWIN32_CALLOUTS_FPNS;
1634
1635 #endif // !NTOS_MODE_USER
1636
1637 #ifdef __cplusplus
1638 }; // extern "C"
1639 #endif
1640
1641 #endif // _PSTYPES_H