#include <setypes.h>
#endif
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef NTOS_MODE_USER
+
+//
+// Kernel Exported Object Types
+//
+extern POBJECT_TYPE NTSYSAPI PsJobType;
+
+#endif // !NTOS_MODE_USER
+
//
// KUSER_SHARED_DATA location in User Mode
//
#define FLG_KERNEL_STACK_TRACE_DB 0x00002000
#define FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000
#define FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000
-#define FLG_IGNORE_DEBUG_PRIV 0x00010000
+#define FLG_DISABLE_STACK_EXTENSION 0x00010000
#define FLG_ENABLE_CSRDEBUG 0x00020000
#define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000
#define FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000
#define FLG_DEBUG_INITIAL_COMMAND_EX 0x04000000
#define FLG_VALID_BITS 0x07FFFFFF
+//
+// Flags for NtCreateProcessEx
+//
+#define PROCESS_CREATE_FLAGS_BREAKAWAY 0x00000001
+#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT 0x00000002
+#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004
+#define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008
+#define PROCESS_CREATE_FLAGS_LARGE_PAGES 0x00000010
+#define PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS PROCESS_CREATE_FLAGS_LARGE_PAGES
+#define PROCESS_CREATE_FLAGS_LEGAL_MASK (PROCESS_CREATE_FLAGS_BREAKAWAY | \
+ PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT | \
+ PROCESS_CREATE_FLAGS_INHERIT_HANDLES | \
+ PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE | \
+ PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS)
+
//
// Process priority classes
//
#define PROCESS_PRIORITY_CLASS_BELOW_NORMAL 5
#define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL 6
-//
-// NtCreateProcessEx flags
-//
-#define PS_REQUEST_BREAKAWAY 1
-#define PS_NO_DEBUG_INHERIT 2
-#define PS_INHERIT_HANDLES 4
-#define PS_LARGE_PAGES 8
-#define PS_ALL_FLAGS (PS_REQUEST_BREAKAWAY | \
- PS_NO_DEBUG_INHERIT | \
- PS_INHERIT_HANDLES | \
- PS_LARGE_PAGES)
-
//
// Process base priorities
//
#define STA_ADDRESS_SPACE_OWNER_BIT 0x4
#define STA_OWNS_WORKING_SET_BITS 0x1F8
+//
+// Kernel Process flags (maybe in ketypes.h?)
+//
+#define KPSF_AUTO_ALIGNMENT_BIT 0
+#define KPSF_DISABLE_BOOST_BIT 1
+
//
// Process Flags
//
typedef
NTSTATUS
(NTAPI *PKWIN32_PROCESS_CALLOUT)(
- struct _EPROCESS *Process,
- BOOLEAN Create
+ _In_ struct _EPROCESS *Process,
+ _In_ BOOLEAN Create
);
typedef
NTSTATUS
(NTAPI *PKWIN32_THREAD_CALLOUT)(
- struct _ETHREAD *Thread,
- PSW32THREADCALLOUTTYPE Type
+ _In_ struct _ETHREAD *Thread,
+ _In_ PSW32THREADCALLOUTTYPE Type
);
typedef
typedef
NTSTATUS
(NTAPI *PKWIN32_POWEREVENT_CALLOUT)(
- struct _WIN32_POWEREVENT_PARAMETERS *Parameters
+ _In_ struct _WIN32_POWEREVENT_PARAMETERS *Parameters
);
typedef
NTSTATUS
(NTAPI *PKWIN32_POWERSTATE_CALLOUT)(
- struct _WIN32_POWERSTATE_PARAMETERS *Parameters
+ _In_ struct _WIN32_POWERSTATE_PARAMETERS *Parameters
);
typedef
NTSTATUS
(NTAPI *PKWIN32_JOB_CALLOUT)(
- struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters
+ _In_ struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters
);
typedef
typedef
NTSTATUS
(NTAPI *PKWIN32_OPENMETHOD_CALLOUT)(
- struct _WIN32_OPENMETHOD_PARAMETERS *Parameters
+ _In_ struct _WIN32_OPENMETHOD_PARAMETERS *Parameters
);
typedef
NTSTATUS
(NTAPI *PKWIN32_OKTOCLOSEMETHOD_CALLOUT)(
- struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters
+ _In_ struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters
);
typedef
NTSTATUS
(NTAPI *PKWIN32_CLOSEMETHOD_CALLOUT)(
- struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters
+ _In_ struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters
);
typedef
VOID
(NTAPI *PKWIN32_DELETEMETHOD_CALLOUT)(
- struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters
+ _In_ struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters
);
typedef
NTSTATUS
(NTAPI *PKWIN32_PARSEMETHOD_CALLOUT)(
- struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters
+ _In_ struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters
);
typedef
NTSTATUS
(NTAPI *PKWIN32_WIN32DATACOLLECTION_CALLOUT)(
- struct _EPROCESS *Process,
- PVOID Callback,
- PVOID Context
+ _In_ struct _EPROCESS *Process,
+ _In_ PVOID Callback,
+ _In_ PVOID Context
);
//
typedef
VOID
(NTAPI *PLEGO_NOTIFY_ROUTINE)(
- IN PKTHREAD Thread
+ _In_ PKTHREAD Thread
);
#endif
LARGE_INTEGER UserTime;
} KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
+typedef struct _POOLED_USAGE_AND_LIMITS
+{
+ SIZE_T PeakPagedPoolUsage;
+ SIZE_T PagedPoolUsage;
+ SIZE_T PagedPoolLimit;
+ SIZE_T PeakNonPagedPoolUsage;
+ SIZE_T NonPagedPoolUsage;
+ SIZE_T NonPagedPoolLimit;
+ SIZE_T PeakPagefileUsage;
+ SIZE_T PagefileUsage;
+ SIZE_T PagefileLimit;
+} POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS;
+
typedef struct _PROCESS_SESSION_INFORMATION
{
ULONG SessionId;
UCHAR PriorityClass;
} PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;
+typedef struct _PROCESS_FOREGROUND_BACKGROUND
+{
+ BOOLEAN Foreground;
+} PROCESS_FOREGROUND_BACKGROUND, *PPROCESS_FOREGROUND_BACKGROUND;
+
//
// Thread Information Structures for NtQueryProcessInformation
//
union
{
KSEMAPHORE LpcReplySemaphore;
- KSEMAPHORE KeyedReplySemaphore;
+ KSEMAPHORE KeyedWaitSemaphore;
};
union
{
EX_RUNDOWN_REF RundownProtect;
HANDLE UniqueProcessId;
LIST_ENTRY ActiveProcessLinks;
- ULONG QuotaUsage[3]; /* 0=PagedPool, 1=NonPagedPool, 2=Pagefile */
- ULONG QuotaPeak[3]; /* ditto */
- ULONG CommitCharge;
- ULONG PeakVirtualSize;
- ULONG VirtualSize;
+ SIZE_T QuotaUsage[3]; /* 0=PagedPool, 1=NonPagedPool, 2=Pagefile */
+ SIZE_T QuotaPeak[3]; /* ditto */
+ SIZE_T CommitCharge;
+ SIZE_T PeakVirtualSize;
+ SIZE_T VirtualSize;
LIST_ENTRY SessionProcessLinks;
PVOID DebugPort;
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
#endif
PHANDLE_TABLE ObjectTable;
EX_FAST_REF Token;
- ULONG WorkingSetPage;
+ PFN_NUMBER WorkingSetPage;
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
EX_PUSH_LOCK AddressCreationLock;
PETHREAD RotateInProgress;
KSPIN_LOCK HyperSpaceLock;
#endif
PETHREAD ForkInProgress;
- ULONG HardwareTrigger;
+ ULONG_PTR HardwareTrigger;
PMM_AVL_TABLE PhysicalVadRoot;
PVOID CloneRoot;
- ULONG NumberOfPrivatePages;
- ULONG NumberOfLockedPages;
+ PFN_NUMBER NumberOfPrivatePages;
+ PFN_NUMBER NumberOfLockedPages;
PVOID *Win32Process;
struct _EJOB *Job;
PVOID SectionObject;
HARDWARE_PTE PageDirectoryPte;
ULONGLONG Filler;
};
- ULONG Session;
+ PVOID Session;
CHAR ImageFileName[16];
LIST_ENTRY JobLinks;
PVOID LockedPagesList;
LIST_ENTRY ThreadListHead;
PVOID SecurityPort;
+#ifdef _M_AMD64
+ struct _WOW64_PROCESS *Wow64Process;
+#else
PVOID PaeTop;
+#endif
ULONG ActiveThreads;
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
ULONG ImagePathHash;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
- ULONG CommitChargeLimit;
- ULONG CommitChargePeak;
+ SIZE_T CommitChargeLimit;
+ SIZE_T CommitChargePeak;
PVOID AweInfo;
SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;
MMSUPPORT Vm;
+#ifdef _M_AMD64
+ ULONG Spares[2];
+#else
LIST_ENTRY MmProcessLinks;
+#endif
ULONG ModifiedPageCount;
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
union
PACCESS_STATE AccessState;
KPROCESSOR_MODE AccessMode;
ULONG Attributes;
- OUT PUNICODE_STRING CompleteName;
+ _Out_ PUNICODE_STRING CompleteName;
PUNICODE_STRING RemainingName;
PVOID Context;
PSECURITY_QUALITY_OF_SERVICE SecurityQos;
#endif // !NTOS_MODE_USER
+#ifdef __cplusplus
+}; // extern "C"
+#endif
+
#endif // _PSTYPES_H