extern NTOSAPI CCHAR KeNumberProcessors;
#define PROCESSOR_FEATURE_MAX 64
+#define MAX_WOW64_SHARED_ENTRIES 16
typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
{
volatile KSYSTEM_TIME TimeZoneBias;
USHORT ImageNumberLow;
USHORT ImageNumberHigh;
- WCHAR NtSystemRoot[ 260 ];
+ WCHAR NtSystemRoot[260];
ULONG MaxStackTraceDepth;
ULONG CryptoExponent;
ULONG TimeZoneId;
ULONG LargePageMinimum;
- ULONG Reserved2[ 7 ];
+ ULONG Reserved2[7];
NT_PRODUCT_TYPE NtProductType;
BOOLEAN ProductTypeIsValid;
ULONG NtMajorVersion;
ULONG NumberOfPhysicalPages;
BOOLEAN SafeBootMode;
ULONG TraceLogging;
- ULONGLONG Fill0;
- ULONGLONG SystemCall[4];
+ ULONG Fill0;
+ ULONGLONG TestRetInstruction;
+ ULONG SystemCall;
+ ULONG SystemCallReturn;
+ ULONGLONG SystemCallPad[3];
union {
volatile KSYSTEM_TIME TickCount;
volatile ULONG64 TickCountQuad;
};
+ ULONG Cookie;
+ LONGLONG ConsoleSessionForegroundProcessId;
+ ULONG Wow64SharedInformation[MAX_WOW64_SHARED_ENTRIES];
+ ULONG UserModeGlobalLogging;
} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;
/*
(DDKAPI *PKTRANSFER_ROUTINE)(
VOID);
-typedef struct _KAPC {
- CSHORT Type;
- CSHORT Size;
- ULONG Spare0;
- struct _KTHREAD *Thread;
- LIST_ENTRY ApcListEntry;
- PKKERNEL_ROUTINE KernelRoutine;
- PKRUNDOWN_ROUTINE RundownRoutine;
- PKNORMAL_ROUTINE NormalRoutine;
- PVOID NormalContext;
- PVOID SystemArgument1;
- PVOID SystemArgument2;
- CCHAR ApcStateIndex;
- KPROCESSOR_MODE ApcMode;
- BOOLEAN Inserted;
+typedef struct _KAPC
+{
+ UCHAR Type;
+ UCHAR SpareByte0;
+ UCHAR Size;
+ UCHAR SpareByte1;
+ ULONG SpareLong0;
+ struct _KTHREAD *Thread;
+ LIST_ENTRY ApcListEntry;
+ PKKERNEL_ROUTINE KernelRoutine;
+ PKRUNDOWN_ROUTINE RundownRoutine;
+ PKNORMAL_ROUTINE NormalRoutine;
+ PVOID NormalContext;
+ PVOID SystemArgument1;
+ PVOID SystemArgument2;
+ CCHAR ApcStateIndex;
+ KPROCESSOR_MODE ApcMode;
+ BOOLEAN Inserted;
} KAPC, *PKAPC, *RESTRICTED_POINTER PRKAPC;
typedef struct _KDEVICE_QUEUE {
PKDPC BufferChainingDpc;
} WAIT_CONTEXT_BLOCK, *PWAIT_CONTEXT_BLOCK;
-typedef struct _DISPATCHER_HEADER {
- UCHAR Type;
- UCHAR Absolute;
- UCHAR Size;
- UCHAR Inserted;
- LONG SignalState;
- LIST_ENTRY WaitListHead;
+typedef struct _DISPATCHER_HEADER
+{
+ union
+ {
+ struct
+ {
+ UCHAR Type;
+ union
+ {
+ UCHAR Absolute;
+ UCHAR NpxIrql;
+ };
+ union
+ {
+ UCHAR Size;
+ UCHAR Hand;
+ };
+ union
+ {
+ UCHAR Inserted;
+ BOOLEAN DebugActive;
+ };
+ };
+ volatile LONG Lock;
+ };
+ LONG SignalState;
+ LIST_ENTRY WaitListHead;
} DISPATCHER_HEADER, *PDISPATCHER_HEADER;
typedef struct _KEVENT {
IN REG_NOTIFY_CLASS Argument1,
IN PVOID Argument2);
+typedef struct _REG_DELETE_KEY_INFORMATION
+{
+ PVOID Object;
+} REG_DELETE_KEY_INFORMATION, *PREG_DELETE_KEY_INFORMATION;
+
+typedef struct _REG_SET_VALUE_KEY_INFORMATION
+{
+ PVOID Object;
+ PUNICODE_STRING ValueName;
+ ULONG TitleIndex;
+ ULONG Type;
+ PVOID Data;
+ ULONG DataSize;
+} REG_SET_VALUE_KEY_INFORMATION, *PREG_SET_VALUE_KEY_INFORMATION;
+
+typedef struct _REG_DELETE_VALUE_KEY_INFORMATION
+{
+ PVOID Object;
+ PUNICODE_STRING ValueName;
+} REG_DELETE_VALUE_KEY_INFORMATION, *PREG_DELETE_VALUE_KEY_INFORMATION;
+
+typedef struct _REG_SET_INFORMATION_KEY_INFORMATION
+{
+ PVOID Object;
+ KEY_SET_INFORMATION_CLASS KeySetInformationClass;
+ PVOID KeySetInformation;
+ ULONG KeySetInformationLength;
+} REG_SET_INFORMATION_KEY_INFORMATION, *PREG_SET_INFORMATION_KEY_INFORMATION;
+typedef struct _REG_ENUMERATE_KEY_INFORMATION
+{
+ PVOID Object;
+ ULONG Index;
+ KEY_INFORMATION_CLASS KeyInformationClass;
+ PVOID KeyInformation;
+ ULONG Length;
+ PULONG ResultLength;
+} REG_ENUMERATE_KEY_INFORMATION, *PREG_ENUMERATE_KEY_INFORMATION;
+
+typedef struct _REG_ENUMERATE_VALUE_KEY_INFORMATION
+{
+ PVOID Object;
+ ULONG Index;
+ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass;
+ PVOID KeyValueInformation;
+ ULONG Length;
+ PULONG ResultLength;
+} REG_ENUMERATE_VALUE_KEY_INFORMATION, *PREG_ENUMERATE_VALUE_KEY_INFORMATION;
+
+typedef struct _REG_QUERY_KEY_INFORMATION
+{
+ PVOID Object;
+ KEY_INFORMATION_CLASS KeyInformationClass;
+ PVOID KeyInformation;
+ ULONG Length;
+ PULONG ResultLength;
+} REG_QUERY_KEY_INFORMATION, *PREG_QUERY_KEY_INFORMATION;
+
+typedef struct _REG_QUERY_VALUE_KEY_INFORMATION
+{
+ PVOID Object;
+ PUNICODE_STRING ValueName;
+ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass;
+ PVOID KeyValueInformation;
+ ULONG Length;
+ PULONG ResultLength;
+} REG_QUERY_VALUE_KEY_INFORMATION, *PREG_QUERY_VALUE_KEY_INFORMATION;
+
+typedef struct _REG_QUERY_MULTIPLE_VALUE_KEY_INFORMATION
+{
+ PVOID Object;
+ PKEY_VALUE_ENTRY ValueEntries;
+ ULONG EntryCount;
+ PVOID ValueBuffer;
+ PULONG BufferLength;
+ PULONG RequiredBufferLength;
+} REG_QUERY_MULTIPLE_VALUE_KEY_INFORMATION, *PREG_QUERY_MULTIPLE_VALUE_KEY_INFORMATION;
+
+typedef struct _REG_PRE_CREATE_KEY_INFORMATION
+{
+ PUNICODE_STRING CompleteName;
+} REG_PRE_CREATE_KEY_INFORMATION, *PREG_PRE_CREATE_KEY_INFORMATION;
+
+typedef struct _REG_POST_CREATE_KEY_INFORMATION
+{
+ PUNICODE_STRING CompleteName;
+ PVOID Object;
+ NTSTATUS Status;
+} REG_POST_CREATE_KEY_INFORMATION, *PREG_POST_CREATE_KEY_INFORMATION;
+
+typedef struct _REG_PRE_OPEN_KEY_INFORMATION
+{
+ PUNICODE_STRING CompleteName;
+} REG_PRE_OPEN_KEY_INFORMATION, *PREG_PRE_OPEN_KEY_INFORMATION;
+
+typedef struct _REG_POST_OPEN_KEY_INFORMATION
+{
+ PUNICODE_STRING CompleteName;
+ PVOID Object;
+ NTSTATUS Status;
+} REG_POST_OPEN_KEY_INFORMATION, *PREG_POST_OPEN_KEY_INFORMATION;
+
+typedef struct _REG_POST_OPERATION_INFORMATION
+{
+ PVOID Object;
+ NTSTATUS Status;
+} REG_POST_OPERATION_INFORMATION,*PREG_POST_OPERATION_INFORMATION;
/*
** Storage structures