SYNCHRONIZE | \
31)
+//
+// Job Limit Flags
+//
+#define JOB_OBJECT_LIMIT_WORKINGSET 0x1
+#define JOB_OBJECT_LIMIT_PROCESS_TIME 0x2
+#define JOB_OBJECT_LIMIT_JOB_TIME 0x4
+#define JOB_OBJECT_LIMIT_ACTIVE_PROCESS 0x8
+#define JOB_OBJECT_LIMIT_AFFINITY 0x10
+#define JOB_OBJECT_LIMIT_PRIORITY_CLASS 0x20
+#define JOB_OBJECT_LIMIT_PRESERVE_JOB_TIME 0x40
+#define JOB_OBJECT_LIMIT_SCHEDULING_CLASS 0x80
+#define JOB_OBJECT_LIMIT_PROCESS_MEMORY 0x100
+#define JOB_OBJECT_LIMIT_JOB_MEMORY 0x200
+#define JOB_OBJECT_LIMIT_DIE_ON_UNHANDLED_EXCEPTION 0x400
+#define JOB_OBJECT_LIMIT_BREAKAWAY_OK 0x800
+#define JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK 0x1000
+#define JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE 0x2000
+
+
//
// Cross Thread Flags
//
UCHAR ReadImageFileExecOptions;
UCHAR BeingDebugged;
#if (NTDDI_VERSION >= NTDDI_WS03)
- struct
+ union
{
- UCHAR ImageUsesLargePages:1;
+ UCHAR BitField;
+ struct
+ {
+ UCHAR ImageUsesLargePages:1;
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
- UCHAR IsProtectedProcess:1;
- UCHAR IsLegacyProcess:1;
- UCHAR SpareBits:5;
+ UCHAR IsProtectedProcess:1;
+ UCHAR IsLegacyProcess:1;
+ UCHAR IsImageDynamicallyRelocated:1;
+ UCHAR SkipPatchingUser32Forwarders:1;
+ UCHAR SpareBits:3;
#else
- UCHAR SpareBits:7;
+ UCHAR SpareBits:7;
#endif
+ };
};
#else
BOOLEAN SpareBool;
struct _RTL_CRITICAL_SECTION *FastPebLock;
PVOID AltThunkSListPtr;
PVOID IFEOKey;
- ULONG Spare;
+ union
+ {
+ ULONG CrossProcessFlags;
+ struct
+ {
+ ULONG ProcessInJob:1;
+ ULONG ProcessInitializing:1;
+ ULONG ProcessUsingVEH:1;
+ ULONG ProcessUsingVCH:1;
+ ULONG ReservedBits0:28;
+ };
+ };
union
{
PVOID* KernelCallbackTable;
};
ULONG SystemReserved[1];
ULONG SpareUlong;
+ ULONG_PTR SparePebPtr0;
#else
PVOID FastPebLock;
PPEBLOCKROUTINE FastPebLockRoutine;
PVOID* KernelCallbackTable;
PVOID EventLogSection;
PVOID EventLog;
-#endif
PPEB_FREE_BLOCK FreeList;
+#endif
ULONG TlsExpansionCounter;
PVOID TlsBitmap;
ULONG TlsBitmapBits[0x2];
PVOID ReadOnlySharedMemoryBase;
+#if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ PVOID HotpatchInformation;
+#else
PVOID ReadOnlySharedMemoryHeap;
+#endif
PVOID* ReadOnlyStaticServerData;
PVOID AnsiCodePageData;
PVOID OemCodePageData;
ULONG NumberOfProcessors;
ULONG NtGlobalFlag;
LARGE_INTEGER CriticalSectionTimeout;
- ULONG HeapSegmentReserve;
- ULONG HeapSegmentCommit;
- ULONG HeapDeCommitTotalFreeThreshold;
- ULONG HeapDeCommitFreeBlockThreshold;
+ ULONG_PTR HeapSegmentReserve;
+ ULONG_PTR HeapSegmentCommit;
+ ULONG_PTR HeapDeCommitTotalFreeThreshold;
+ ULONG_PTR HeapDeCommitFreeBlockThreshold;
ULONG NumberOfHeaps;
ULONG MaximumNumberOfHeaps;
PVOID* ProcessHeaps;
ULONG ImageSubSystemMajorVersion;
ULONG ImageSubSystemMinorVersion;
ULONG ImageProcessAffinityMask;
+#ifdef _WIN64
+ ULONG GdiHandleBuffer[0x3c];
+#else
ULONG GdiHandleBuffer[0x22];
+#endif
PPOST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
struct _RTL_BITMAP *TlsExpansionBitmap;
ULONG TlsExpansionBitmapBits[0x20];
struct _ASSEMBLY_STORAGE_MAP *ProcessAssemblyStorageMap;
struct _ACTIVATION_CONTEXT_DATA *SystemDefaultActivationContextData;
struct _ASSEMBLY_STORAGE_MAP *SystemAssemblyStorageMap;
- ULONG MinimumStackCommit;
+ ULONG_PTR MinimumStackCommit;
#endif
#if (NTDDI_VERSION >= NTDDI_WS03)
PVOID *FlsCallback;
typedef struct _ETHREAD
{
KTHREAD Tcb;
- PVOID Padding;
LARGE_INTEGER CreateTime;
union
{
#endif
PPS_IMPERSONATION_INFORMATION ImpersonationInfo;
LIST_ENTRY IrpList;
- ULONG TopLevelIrp;
+ ULONG_PTR TopLevelIrp;
PDEVICE_OBJECT DeviceToVerify;
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
PPSP_RATE_APC RateControlApc;