[ { "path": ".github/workflows/build.yml", "content": "name: Build with WDK 7.1.0\n\non: \n workflow_dispatch:\n workflow_call:\n\njobs:\n build:\n name: Build\n runs-on: windows-latest\n\n steps:\n - name: Cache WDK\n id: cache-wdk-installed\n uses: actions/cache@v3\n env:\n cache-name: cache-wdk-7.1.0-installed\n with:\n path: C:\\WinDDK\\7600.16385.1\n key: ${{ env.cache-name }}\n - if: ${{ steps.cache-wdk-installed.outputs.cache-hit != 'true' }}\n name: Download WDK 7.1.0.7600\n run: (New-Object Net.WebClient).DownloadFile(\"https://download.microsoft.com/download/4/A/2/4A25C7D5-EFBE-4182-B6A9-AE6850409A78/GRMWDK_EN_7600_1.ISO\", \"${{ github.workspace }}\\GRMWDK_EN_7600_1.ISO\")\n - if: ${{ steps.cache-wdk-installed.outputs.cache-hit != 'true' }}\n name: Install 7zip\n run: choco install 7zip\n - if: ${{ steps.cache-wdk-installed.outputs.cache-hit != 'true' }}\n name: Unpack ISO\n run: 7z.exe x -y -o\"${{ github.workspace }}\" \"${{ github.workspace }}\\GRMWDK_EN_7600_1.ISO\"\n - if: ${{ steps.cache-wdk-installed.outputs.cache-hit != 'true' }}\n name: Setup WDK 7.1.0.7600\n run: .\\KitSetup.exe /install ALL /ui-level EXPRESS\n shell: cmd \n - name: Checkout code\n uses: actions/checkout@v4\n with:\n path: 'srcdir'\n - name: Build project x86\n run: |\n C:\\WinDDK\\7600.16385.1\\bin\\setenv.bat C:\\WinDDK\\7600.16385.1 fre x86 WXP && D: && cd ${{ github.workspace }}\\srcdir && build /g /w\n shell: cmd\n - name: Build project x64\n run: |\n C:\\WinDDK\\7600.16385.1\\bin\\setenv.bat C:\\WinDDK\\7600.16385.1 fre x64 WIN7 && D: && cd ${{ github.workspace }}\\srcdir && build /g /w\n shell: cmd\n - name: Upload artifact i386\n uses: actions/upload-artifact@v4\n with:\n name: nativeshell-i386\n path: |\n ${{ github.workspace }}\\srcdir\\objfre_wxp_x86\\i386\\native.exe\n ${{ github.workspace }}\\srcdir\\install\\*\n ${{ github.workspace }}\\srcdir\\README.md\n retention-days: 1\n - name: Upload artifact amd64\n uses: actions/upload-artifact@v4\n with:\n name: nativeshell-amd64\n path: |\n ${{ github.workspace }}\\srcdir\\objfre_win7_amd64\\amd64\\native.exe\n ${{ github.workspace }}\\srcdir\\install\\*\n ${{ github.workspace }}\\srcdir\\README.md\n retention-days: 1\n " }, { "path": ".github/workflows/release.yml", "content": "name: Release\n\non:\n push:\n tags:\n - 'v*'\n\njobs:\n build:\n uses: ./.github/workflows/build.yml\n \n release:\n needs: build\n name: Release\n runs-on: ubuntu-latest\n steps:\n - name: Create release\n uses: actions/create-release@v1\n id: create_release\n with:\n draft: false\n prerelease: false\n release_name: Release ${{ github.ref }}\n tag_name: ${{ github.ref }}\n body: NT native executable and install files\n env:\n GITHUB_TOKEN: ${{ github.token }}\n - name: Download i386 binary \n uses: actions/download-artifact@v4\n with:\n name: nativeshell-i386\n path: ${{ github.workspace }}/i386\n - name: Prepare release i386 binary\n working-directory: ${{ github.workspace }}/i386\n run: zip -r --junk-paths nativeshell.zip ./*\n - name: Release i386 binary \n uses: actions/upload-release-asset@v1\n env:\n GITHUB_TOKEN: ${{ github.token }}\n with:\n upload_url: ${{ steps.create_release.outputs.upload_url }}\n asset_path: ${{ github.workspace }}/i386/nativeshell.zip\n asset_name: nativeshell-${{ github.ref_name }}.i386.zip\n asset_content_type: application/zip\n - name: Download amd64 binary \n uses: actions/download-artifact@v4\n with:\n name: nativeshell-amd64\n path: ${{ github.workspace }}/amd64\n - name: Prepare release amd64 binary\n working-directory: ${{ github.workspace }}/amd64\n run: zip -r --junk-paths nativeshell.zip ./*\n - name: Release amd64 binary \n uses: actions/upload-release-asset@v1\n env:\n GITHUB_TOKEN: ${{ github.token }}\n with:\n upload_url: ${{ steps.create_release.outputs.upload_url }}\n asset_path: ${{ github.workspace }}/amd64/nativeshell.zip\n asset_name: nativeshell-${{ github.ref_name }}.amd64.zip\n asset_content_type: application/zip\n \n" }, { "path": ".gitignore", "content": ".vscode\n*.log\nobjfre_wxp_x86\nobjfre_win7_amd64\n*.err\n*.wrn\n*.cmd" }, { "path": "CONTRIBUTORS.md", "content": "- Alex Ionescu (the original creator)\n- amdf\n- ReactOS Team (keyboard translation code parts)\n- Dmitri Arkhangelski (code parts from ZenWINX library)\n" }, { "path": "LICENSE", "content": " GNU LESSER GENERAL PUBLIC LICENSE\n Version 2.1, February 1999\n\n Copyright (C) 1991, 1999 Free Software Foundation, Inc.\n 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed.\n\n[This is the first released version of the Lesser GPL. It also counts\n as the successor of the GNU Library Public License, version 2, hence\n the version number 2.1.]\n\n Preamble\n\n The licenses for most software are designed to take away your\nfreedom to share and change it. By contrast, the GNU General Public\nLicenses are intended to guarantee your freedom to share and change\nfree software--to make sure the software is free for all its users.\n\n This license, the Lesser General Public License, applies to some\nspecially designated software packages--typically libraries--of the\nFree Software Foundation and other authors who decide to use it. You\ncan use it too, but we suggest you first think carefully about whether\nthis license or the ordinary General Public License is the better\nstrategy to use in any particular case, based on the explanations below.\n\n When we speak of free software, we are referring to freedom of use,\nnot price. Our General Public Licenses are designed to make sure that\nyou have the freedom to distribute copies of free software (and charge\nfor this service if you wish); that you receive source code or can get\nit if you want it; that you can change the software and use pieces of\nit in new free programs; and that you are informed that you can do\nthese things.\n\n To protect your rights, we need to make restrictions that forbid\ndistributors to deny you these rights or to ask you to surrender these\nrights. These restrictions translate to certain responsibilities for\nyou if you distribute copies of the library or if you modify it.\n\n For example, if you distribute copies of the library, whether gratis\nor for a fee, you must give the recipients all the rights that we gave\nyou. You must make sure that they, too, receive or can get the source\ncode. If you link other code with the library, you must provide\ncomplete object files to the recipients, so that they can relink them\nwith the library after making changes to the library and recompiling\nit. And you must show them these terms so they know their rights.\n\n We protect your rights with a two-step method: (1) we copyright the\nlibrary, and (2) we offer you this license, which gives you legal\npermission to copy, distribute and/or modify the library.\n\n To protect each distributor, we want to make it very clear that\nthere is no warranty for the free library. Also, if the library is\nmodified by someone else and passed on, the recipients should know\nthat what they have is not the original version, so that the original\nauthor's reputation will not be affected by problems that might be\nintroduced by others.\n\n Finally, software patents pose a constant threat to the existence of\nany free program. We wish to make sure that a company cannot\neffectively restrict the users of a free program by obtaining a\nrestrictive license from a patent holder. Therefore, we insist that\nany patent license obtained for a version of the library must be\nconsistent with the full freedom of use specified in this license.\n\n Most GNU software, including some libraries, is covered by the\nordinary GNU General Public License. This license, the GNU Lesser\nGeneral Public License, applies to certain designated libraries, and\nis quite different from the ordinary General Public License. We use\nthis license for certain libraries in order to permit linking those\nlibraries into non-free programs.\n\n When a program is linked with a library, whether statically or using\na shared library, the combination of the two is legally speaking a\ncombined work, a derivative of the original library. The ordinary\nGeneral Public License therefore permits such linking only if the\nentire combination fits its criteria of freedom. The Lesser General\nPublic License permits more lax criteria for linking other code with\nthe library.\n\n We call this license the \"Lesser\" General Public License because it\ndoes Less to protect the user's freedom than the ordinary General\nPublic License. It also provides other free software developers Less\nof an advantage over competing non-free programs. These disadvantages\nare the reason we use the ordinary General Public License for many\nlibraries. However, the Lesser license provides advantages in certain\nspecial circumstances.\n\n For example, on rare occasions, there may be a special need to\nencourage the widest possible use of a certain library, so that it becomes\na de-facto standard. To achieve this, non-free programs must be\nallowed to use the library. A more frequent case is that a free\nlibrary does the same job as widely used non-free libraries. In this\ncase, there is little to gain by limiting the free library to free\nsoftware only, so we use the Lesser General Public License.\n\n In other cases, permission to use a particular library in non-free\nprograms enables a greater number of people to use a large body of\nfree software. For example, permission to use the GNU C Library in\nnon-free programs enables many more people to use the whole GNU\noperating system, as well as its variant, the GNU/Linux operating\nsystem.\n\n Although the Lesser General Public License is Less protective of the\nusers' freedom, it does ensure that the user of a program that is\nlinked with the Library has the freedom and the wherewithal to run\nthat program using a modified version of the Library.\n\n The precise terms and conditions for copying, distribution and\nmodification follow. Pay close attention to the difference between a\n\"work based on the library\" and a \"work that uses the library\". The\nformer contains code derived from the library, whereas the latter must\nbe combined with the library in order to run.\n\n GNU LESSER GENERAL PUBLIC LICENSE\n TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n 0. This License Agreement applies to any software library or other\nprogram which contains a notice placed by the copyright holder or\nother authorized party saying it may be distributed under the terms of\nthis Lesser General Public License (also called \"this License\").\nEach licensee is addressed as \"you\".\n\n A \"library\" means a collection of software functions and/or data\nprepared so as to be conveniently linked with application programs\n(which use some of those functions and data) to form executables.\n\n The \"Library\", below, refers to any such software library or work\nwhich has been distributed under these terms. A \"work based on the\nLibrary\" means either the Library or any derivative work under\ncopyright law: that is to say, a work containing the Library or a\nportion of it, either verbatim or with modifications and/or translated\nstraightforwardly into another language. (Hereinafter, translation is\nincluded without limitation in the term \"modification\".)\n\n \"Source code\" for a work means the preferred form of the work for\nmaking modifications to it. For a library, complete source code means\nall the source code for all modules it contains, plus any associated\ninterface definition files, plus the scripts used to control compilation\nand installation of the library.\n\n Activities other than copying, distribution and modification are not\ncovered by this License; they are outside its scope. The act of\nrunning a program using the Library is not restricted, and output from\nsuch a program is covered only if its contents constitute a work based\non the Library (independent of the use of the Library in a tool for\nwriting it). Whether that is true depends on what the Library does\nand what the program that uses the Library does.\n\n 1. You may copy and distribute verbatim copies of the Library's\ncomplete source code as you receive it, in any medium, provided that\nyou conspicuously and appropriately publish on each copy an\nappropriate copyright notice and disclaimer of warranty; keep intact\nall the notices that refer to this License and to the absence of any\nwarranty; and distribute a copy of this License along with the\nLibrary.\n\n You may charge a fee for the physical act of transferring a copy,\nand you may at your option offer warranty protection in exchange for a\nfee.\n\n 2. You may modify your copy or copies of the Library or any portion\nof it, thus forming a work based on the Library, and copy and\ndistribute such modifications or work under the terms of Section 1\nabove, provided that you also meet all of these conditions:\n\n a) The modified work must itself be a software library.\n\n b) You must cause the files modified to carry prominent notices\n stating that you changed the files and the date of any change.\n\n c) You must cause the whole of the work to be licensed at no\n charge to all third parties under the terms of this License.\n\n d) If a facility in the modified Library refers to a function or a\n table of data to be supplied by an application program that uses\n the facility, other than as an argument passed when the facility\n is invoked, then you must make a good faith effort to ensure that,\n in the event an application does not supply such function or\n table, the facility still operates, and performs whatever part of\n its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has\n a purpose that is entirely well-defined independent of the\n application. Therefore, Subsection 2d requires that any\n application-supplied function or table used by this function must\n be optional: if the application does not supply it, the square\n root function must still compute square roots.)\n\nThese requirements apply to the modified work as a whole. If\nidentifiable sections of that work are not derived from the Library,\nand can be reasonably considered independent and separate works in\nthemselves, then this License, and its terms, do not apply to those\nsections when you distribute them as separate works. But when you\ndistribute the same sections as part of a whole which is a work based\non the Library, the distribution of the whole must be on the terms of\nthis License, whose permissions for other licensees extend to the\nentire whole, and thus to each and every part regardless of who wrote\nit.\n\nThus, it is not the intent of this section to claim rights or contest\nyour rights to work written entirely by you; rather, the intent is to\nexercise the right to control the distribution of derivative or\ncollective works based on the Library.\n\nIn addition, mere aggregation of another work not based on the Library\nwith the Library (or with a work based on the Library) on a volume of\na storage or distribution medium does not bring the other work under\nthe scope of this License.\n\n 3. You may opt to apply the terms of the ordinary GNU General Public\nLicense instead of this License to a given copy of the Library. To do\nthis, you must alter all the notices that refer to this License, so\nthat they refer to the ordinary GNU General Public License, version 2,\ninstead of to this License. (If a newer version than version 2 of the\nordinary GNU General Public License has appeared, then you can specify\nthat version instead if you wish.) Do not make any other change in\nthese notices.\n\n Once this change is made in a given copy, it is irreversible for\nthat copy, so the ordinary GNU General Public License applies to all\nsubsequent copies and derivative works made from that copy.\n\n This option is useful when you wish to copy part of the code of\nthe Library into a program that is not a library.\n\n 4. You may copy and distribute the Library (or a portion or\nderivative of it, under Section 2) in object code or executable form\nunder the terms of Sections 1 and 2 above provided that you accompany\nit with the complete corresponding machine-readable source code, which\nmust be distributed under the terms of Sections 1 and 2 above on a\nmedium customarily used for software interchange.\n\n If distribution of object code is made by offering access to copy\nfrom a designated place, then offering equivalent access to copy the\nsource code from the same place satisfies the requirement to\ndistribute the source code, even though third parties are not\ncompelled to copy the source along with the object code.\n\n 5. A program that contains no derivative of any portion of the\nLibrary, but is designed to work with the Library by being compiled or\nlinked with it, is called a \"work that uses the Library\". Such a\nwork, in isolation, is not a derivative work of the Library, and\ntherefore falls outside the scope of this License.\n\n However, linking a \"work that uses the Library\" with the Library\ncreates an executable that is a derivative of the Library (because it\ncontains portions of the Library), rather than a \"work that uses the\nlibrary\". The executable is therefore covered by this License.\nSection 6 states terms for distribution of such executables.\n\n When a \"work that uses the Library\" uses material from a header file\nthat is part of the Library, the object code for the work may be a\nderivative work of the Library even though the source code is not.\nWhether this is true is especially significant if the work can be\nlinked without the Library, or if the work is itself a library. The\nthreshold for this to be true is not precisely defined by law.\n\n If such an object file uses only numerical parameters, data\nstructure layouts and accessors, and small macros and small inline\nfunctions (ten lines or less in length), then the use of the object\nfile is unrestricted, regardless of whether it is legally a derivative\nwork. (Executables containing this object code plus portions of the\nLibrary will still fall under Section 6.)\n\n Otherwise, if the work is a derivative of the Library, you may\ndistribute the object code for the work under the terms of Section 6.\nAny executables containing that work also fall under Section 6,\nwhether or not they are linked directly with the Library itself.\n\n 6. As an exception to the Sections above, you may also combine or\nlink a \"work that uses the Library\" with the Library to produce a\nwork containing portions of the Library, and distribute that work\nunder terms of your choice, provided that the terms permit\nmodification of the work for the customer's own use and reverse\nengineering for debugging such modifications.\n\n You must give prominent notice with each copy of the work that the\nLibrary is used in it and that the Library and its use are covered by\nthis License. You must supply a copy of this License. If the work\nduring execution displays copyright notices, you must include the\ncopyright notice for the Library among them, as well as a reference\ndirecting the user to the copy of this License. Also, you must do one\nof these things:\n\n a) Accompany the work with the complete corresponding\n machine-readable source code for the Library including whatever\n changes were used in the work (which must be distributed under\n Sections 1 and 2 above); and, if the work is an executable linked\n with the Library, with the complete machine-readable \"work that\n uses the Library\", as object code and/or source code, so that the\n user can modify the Library and then relink to produce a modified\n executable containing the modified Library. (It is understood\n that the user who changes the contents of definitions files in the\n Library will not necessarily be able to recompile the application\n to use the modified definitions.)\n\n b) Use a suitable shared library mechanism for linking with the\n Library. A suitable mechanism is one that (1) uses at run time a\n copy of the library already present on the user's computer system,\n rather than copying library functions into the executable, and (2)\n will operate properly with a modified version of the library, if\n the user installs one, as long as the modified version is\n interface-compatible with the version that the work was made with.\n\n c) Accompany the work with a written offer, valid for at\n least three years, to give the same user the materials\n specified in Subsection 6a, above, for a charge no more\n than the cost of performing this distribution.\n\n d) If distribution of the work is made by offering access to copy\n from a designated place, offer equivalent access to copy the above\n specified materials from the same place.\n\n e) Verify that the user has already received a copy of these\n materials or that you have already sent this user a copy.\n\n For an executable, the required form of the \"work that uses the\nLibrary\" must include any data and utility programs needed for\nreproducing the executable from it. However, as a special exception,\nthe materials to be distributed need not include anything that is\nnormally distributed (in either source or binary form) with the major\ncomponents (compiler, kernel, and so on) of the operating system on\nwhich the executable runs, unless that component itself accompanies\nthe executable.\n\n It may happen that this requirement contradicts the license\nrestrictions of other proprietary libraries that do not normally\naccompany the operating system. Such a contradiction means you cannot\nuse both them and the Library together in an executable that you\ndistribute.\n\n 7. You may place library facilities that are a work based on the\nLibrary side-by-side in a single library together with other library\nfacilities not covered by this License, and distribute such a combined\nlibrary, provided that the separate distribution of the work based on\nthe Library and of the other library facilities is otherwise\npermitted, and provided that you do these two things:\n\n a) Accompany the combined library with a copy of the same work\n based on the Library, uncombined with any other library\n facilities. This must be distributed under the terms of the\n Sections above.\n\n b) Give prominent notice with the combined library of the fact\n that part of it is a work based on the Library, and explaining\n where to find the accompanying uncombined form of the same work.\n\n 8. You may not copy, modify, sublicense, link with, or distribute\nthe Library except as expressly provided under this License. Any\nattempt otherwise to copy, modify, sublicense, link with, or\ndistribute the Library is void, and will automatically terminate your\nrights under this License. However, parties who have received copies,\nor rights, from you under this License will not have their licenses\nterminated so long as such parties remain in full compliance.\n\n 9. You are not required to accept this License, since you have not\nsigned it. However, nothing else grants you permission to modify or\ndistribute the Library or its derivative works. These actions are\nprohibited by law if you do not accept this License. Therefore, by\nmodifying or distributing the Library (or any work based on the\nLibrary), you indicate your acceptance of this License to do so, and\nall its terms and conditions for copying, distributing or modifying\nthe Library or works based on it.\n\n 10. Each time you redistribute the Library (or any work based on the\nLibrary), the recipient automatically receives a license from the\noriginal licensor to copy, distribute, link with or modify the Library\nsubject to these terms and conditions. You may not impose any further\nrestrictions on the recipients' exercise of the rights granted herein.\nYou are not responsible for enforcing compliance by third parties with\nthis License.\n\n 11. If, as a consequence of a court judgment or allegation of patent\ninfringement or for any other reason (not limited to patent issues),\nconditions are imposed on you (whether by court order, agreement or\notherwise) that contradict the conditions of this License, they do not\nexcuse you from the conditions of this License. If you cannot\ndistribute so as to satisfy simultaneously your obligations under this\nLicense and any other pertinent obligations, then as a consequence you\nmay not distribute the Library at all. For example, if a patent\nlicense would not permit royalty-free redistribution of the Library by\nall those who receive copies directly or indirectly through you, then\nthe only way you could satisfy both it and this License would be to\nrefrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any\nparticular circumstance, the balance of the section is intended to apply,\nand the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any\npatents or other property right claims or to contest validity of any\nsuch claims; this section has the sole purpose of protecting the\nintegrity of the free software distribution system which is\nimplemented by public license practices. Many people have made\ngenerous contributions to the wide range of software distributed\nthrough that system in reliance on consistent application of that\nsystem; it is up to the author/donor to decide if he or she is willing\nto distribute software through any other system and a licensee cannot\nimpose that choice.\n\nThis section is intended to make thoroughly clear what is believed to\nbe a consequence of the rest of this License.\n\n 12. If the distribution and/or use of the Library is restricted in\ncertain countries either by patents or by copyrighted interfaces, the\noriginal copyright holder who places the Library under this License may add\nan explicit geographical distribution limitation excluding those countries,\nso that distribution is permitted only in or among countries not thus\nexcluded. In such case, this License incorporates the limitation as if\nwritten in the body of this License.\n\n 13. The Free Software Foundation may publish revised and/or new\nversions of the Lesser General Public License from time to time.\nSuch new versions will be similar in spirit to the present version,\nbut may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library\nspecifies a version number of this License which applies to it and\n\"any later version\", you have the option of following the terms and\nconditions either of that version or of any later version published by\nthe Free Software Foundation. If the Library does not specify a\nlicense version number, you may choose any version ever published by\nthe Free Software Foundation.\n\n 14. If you wish to incorporate parts of the Library into other free\nprograms whose distribution conditions are incompatible with these,\nwrite to the author to ask for permission. For software which is\ncopyrighted by the Free Software Foundation, write to the Free\nSoftware Foundation; we sometimes make exceptions for this. Our\ndecision will be guided by the two goals of preserving the free status\nof all derivatives of our free software and of promoting the sharing\nand reuse of software generally.\n\n NO WARRANTY\n\n 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO\nWARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.\nEXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR\nOTHER PARTIES PROVIDE THE LIBRARY \"AS IS\" WITHOUT WARRANTY OF ANY\nKIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\nPURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE\nLIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME\nTHE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN\nWRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY\nAND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU\nFOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR\nCONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE\nLIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING\nRENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A\nFAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF\nSUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGES.\n\n END OF TERMS AND CONDITIONS\n\n How to Apply These Terms to Your New Libraries\n\n If you develop a new library, and you want it to be of the greatest\npossible use to the public, we recommend making it free software that\neveryone can redistribute and change. You can do so by permitting\nredistribution under these terms (or, alternatively, under the terms of the\nordinary General Public License).\n\n To apply these terms, attach the following notices to the library. It is\nsafest to attach them to the start of each source file to most effectively\nconvey the exclusion of warranty; and each file should have at least the\n\"copyright\" line and a pointer to where the full notice is found.\n\n \n Copyright (C) \n\n This library is free software; you can redistribute it and/or\n modify it under the terms of the GNU Lesser General Public\n License as published by the Free Software Foundation; either\n version 2.1 of the License, or (at your option) any later version.\n\n This library is distributed in the hope that it will be useful,\n but WITHOUT ANY WARRANTY; without even the implied warranty of\n MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\n Lesser General Public License for more details.\n\n You should have received a copy of the GNU Lesser General Public\n License along with this library; if not, write to the Free Software\n Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301\n USA\n\nAlso add information on how to contact you by electronic and paper mail.\n\nYou should also get your employer (if you work as a programmer) or your\nschool, if any, to sign a \"copyright disclaimer\" for the library, if\nnecessary. Here is a sample; alter the names:\n\n Yoyodyne, Inc., hereby disclaims all copyright interest in the\n library `Frob' (a library for tweaking knobs) written by James Random\n Hacker.\n\n , 1 April 1990\n Ty Coon, President of Vice\n\nThat's all there is to it!\n" }, { "path": "README.md", "content": "# NativeShell\nCommand line interface for Windows Native Mode.\nIt can perform some basic operations with Windows files and directories. \nProgram runs before starting of main Windows components, so it has access to the entire file system and registry without many restrictions. \nAll operations are implemented through the Native API (ntdll.dll). \n\nThe sources are based on NCLI (Native Command Line Interface) from the TinyKRNL Project. A code from ZenWINX library partially used. \n\n## Requirements\nWindows Driver Kit Version 7.1.0\n\n## Build\n\nBuild command for WDK x86 Free Build Environment:\n\n`build /g /w`\n\nBuild output is native.exe.\n\n# Install\n\nCopy native.exe to %systemroot%\\system32\\\n\nUse add.reg from `install` directory.\n\n# Uninstall\nUse remove.reg from `install` directory.\n\nDelete %systemroot%\\system32\\native.exe" }, { "path": "display.c", "content": "/**\n * PROJECT: Native Shell\n * COPYRIGHT: LGPL; See LICENSE in the top level directory\n * FILE: display.c\n * DESCRIPTION: This module handles displaying output to screen.\n * DEVELOPERS: See CONTRIBUTORS.md in the top level directory\n */\n\n#include \"precomp.h\"\n\nWCHAR DisplayBuffer[1024];\nUSHORT LinePos = 0;\nWCHAR PutChar[2] = L\" \";\nUNICODE_STRING CharString = {2, 2, PutChar};\n\n/*++\n * @name RtlCliPrintString\n *\n * The RtlCliPrintString routine display a unicode string on the display device\n *\n * @param Message\n * Pointer to a unicode string containing the message to print.\n *\n * @return STATUS_SUCCESS or failure code.\n *\n * @remarks None.\n *\n *--*/\nNTSTATUS\nRtlCliPrintString(IN PUNICODE_STRING Message)\n{\n ULONG i;\n NTSTATUS Status;\n\n for (i = 0; i < (Message->Length / sizeof(WCHAR)); i++)\n {\n Status = RtlCliPutChar(Message->Buffer[i]);\n }\n\n return Status;\n}\n\n/*++\n * @name RtlCliPutChar\n *\n * The RtlCliPutChar routine displays a character.\n *\n * @param Char\n * Character to print out.\n *\n * @return STATUS_SUCCESS or failure code.\n *\n * @remarks None.\n *\n *--*/\nNTSTATUS\nRtlCliPutChar(IN WCHAR Char)\n{\n // Initialize the string\n CharString.Buffer[0] = Char;\n\n // Make sure that this isn't backspace\n if (Char != '\\r')\n {\n // Check if it's a new line\n if (Char == '\\n')\n {\n // Reset the display buffer\n LinePos = 0;\n DisplayBuffer[LinePos] = UNICODE_NULL;\n }\n else\n {\n // Add the character in our buffer\n DisplayBuffer[LinePos] = Char;\n LinePos++;\n }\n }\n\n // Print the character\n return NtDisplayString(&CharString);\n}\n\n/*++\n * @name RtlClipBackspace\n *\n * The RtlClipBackspace routine handles a backspace command.\n *\n * @param None.\n *\n * @return STATUS_SUCCESS or failure code if printing failed.\n *\n * @remarks Backspace is handled by printing the previous string minus the last\n * two characters.\n *\n *--*/\nNTSTATUS\nRtlClipBackspace(VOID)\n{\n UNICODE_STRING BackString;\n\n // Update the line position\n LinePos--;\n\n // Finalize this buffer and make it unicode\n DisplayBuffer[LinePos] = ANSI_NULL;\n RtlInitUnicodeString(&BackString, DisplayBuffer);\n\n // Display the buffer\n return NtDisplayString(&BackString);\n}\n\nNTSTATUS\n__cdecl RtlCliDisplayString(IN PCH Message, ...)\n{\n va_list MessageList;\n PCHAR MessageBuffer;\n UNICODE_STRING MessageString;\n NTSTATUS Status;\n\n MessageBuffer = RtlAllocateHeap(RtlGetProcessHeap(), 0, 512);\n\n // First, combine the message\n va_start(MessageList, Message);\n _vsnprintf(MessageBuffer, 512, Message, MessageList);\n va_end(MessageList);\n\n // Now make it a unicode string\n RtlCreateUnicodeStringFromAsciiz(&MessageString, MessageBuffer);\n\n // Display it on screen\n Status = RtlCliPrintString(&MessageString);\n\n // Free Memory\n RtlFreeHeap(RtlGetProcessHeap(), 0, MessageBuffer);\n RtlFreeUnicodeString(&MessageString);\n\n return Status;\n}\n" }, { "path": "file.c", "content": "/**\n * PROJECT: Native Shell\n * COPYRIGHT: LGPL; See LICENSE in the top level directory\n * FILE: file.c\n * DESCRIPTION: This module implements commands for dealing with files and directories.\n * DEVELOPERS: See CONTRIBUTORS.md in the top level directory\n */\n\n#include \"precomp.h\"\n\n/*++\n * @name RtlCliGetCurrentDirectory\n *\n * The RtlCliGetCurrentDirectory routine provides a way to get the current\n * directory.\n *\n * @param CurrentDirectory\n * The current directory.\n *\n * @return ULONG\n *\n * @remarks Documentation for this routine needs to be completed.\n *\n *--*/\nULONG\nRtlCliGetCurrentDirectory(IN OUT PWSTR CurrentDirectory)\n{\n return RtlGetCurrentDirectory_U(MAX_PATH * sizeof(WCHAR),\n CurrentDirectory);\n}\n\n/*++\n * @name RtlCliSetCurrentDirectory\n *\n * The RtlCliSetCurrentDirectory routine provides a way to change the current\n * directory.\n *\n * @param Directory\n * The directory to change to.\n *\n * @return NTSTATUS\n *\n * @remarks Documentation for this routine needs to be completed.\n *\n *--*/\n\nNTSTATUS\nRtlCliSetCurrentDirectory(PCHAR Directory)\n{\n WCHAR buf[MAX_PATH];\n UNICODE_STRING us;\n\n if (NULL == Directory)\n {\n return STATUS_UNSUCCESSFUL;\n }\n\n // Full path contains at least two symbols, the second is ':'\n if (strnlen(Directory, MAX_PATH) >= 2 && Directory[1] == ':')\n {\n RtlCreateUnicodeStringFromAsciiz(&us, Directory);\n RtlSetCurrentDirectory_U(&us);\n RtlFreeUnicodeString(&us);\n return STATUS_SUCCESS;\n }\n\n GetFullPath(Directory, buf, TRUE);\n RtlInitUnicodeString(&us, buf);\n RtlSetCurrentDirectory_U(&us);\n\n return STATUS_SUCCESS;\n}\n\nVOID RtlCliDumpFileInfo(PFILE_BOTH_DIR_INFORMATION DirInfo)\n{\n PWCHAR Null;\n WCHAR Save;\n TIME_FIELDS Time;\n CHAR SizeString[16];\n WCHAR ShortString[12 + 1];\n WCHAR FileString[MAX_PATH + 1];\n\n WCHAR FileStringSize[100];\n WCHAR ShortStringSize[100];\n\n UINT file_size = 0;\n UINT short_size = 0;\n\n // The filename isn't null-terminated, and the next structure follows\n // right after it. So, we save the next char (which ends up being the\n // NextEntryOffset of the next structure), then temporarly clear it so\n // that the RtlCliDisplayString can treat it as a null-terminated string\n\n Null = (PWCHAR)((PBYTE)DirInfo->FileName + DirInfo->FileNameLength);\n Save = *Null;\n *Null = 0;\n\n // Get the last access time\n RtlSystemTimeToLocalTime(&DirInfo->CreationTime, &DirInfo->CreationTime);\n RtlTimeToTimeFields(&DirInfo->CreationTime, &Time);\n\n // Don't display sizes for directories\n if (!(DirInfo->FileAttributes & FILE_ATTRIBUTE_DIRECTORY))\n {\n sprintf(SizeString, \"%d\", DirInfo->AllocationSize.LowPart);\n }\n else\n {\n sprintf(SizeString, \" \", DirInfo->AllocationSize.LowPart);\n }\n\n // Display this entry\n file_size = DirInfo->FileNameLength / sizeof(WCHAR);\n short_size = DirInfo->ShortNameLength / sizeof(WCHAR);\n\n swprintf(ShortStringSize, L\"%d\", short_size);\n swprintf(FileStringSize, L\"%d\", file_size);\n\n if (DirInfo->ShortNameLength)\n {\n memset(ShortString, 0x00, (12 + 1) * sizeof(WCHAR));\n wcsncpy(ShortString, DirInfo->ShortName, short_size);\n }\n else\n {\n swprintf(ShortString, L\" \");\n }\n\n if (DirInfo->FileNameLength)\n {\n memset(FileString, 0x00, (MAX_PATH + 1) * sizeof(WCHAR));\n wcsncpy(FileString, DirInfo->FileName, file_size);\n }\n else\n {\n swprintf(FileString, L\" \");\n }\n\n RtlCliDisplayString(\"%02d.%02d.%04d %02d:%02d %s %9s %-28S %12S\\n\",\n Time.Day,\n Time.Month,\n Time.Year,\n Time.Hour,\n Time.Minute,\n DirInfo->FileAttributes & FILE_ATTRIBUTE_DIRECTORY ? \"\" : \" \",\n SizeString,\n FileString,\n ShortString);\n\n // Restore the character that was here before\n *Null = Save;\n}\n\n/*++\n * @name RtlCliListDirectory\n *\n * The RtlCliListDirectory routine lists the current directory contents.\n *\n * @param None.\n *\n * @return NTSTATUS\n *\n * @remarks Documentation for this routine needs to be completed.\n *\n *--*/\nNTSTATUS\nRtlCliListDirectory(PWCHAR CurrentDirectory)\n{\n UNICODE_STRING DirectoryString;\n OBJECT_ATTRIBUTES ObjectAttributes;\n HANDLE DirectoryHandle;\n NTSTATUS Status;\n IO_STATUS_BLOCK IoStatusBlock;\n BOOLEAN FirstQuery = TRUE;\n\n PFILE_BOTH_DIR_INFORMATION DirectoryInfo, Entry;\n HANDLE EventHandle;\n CHAR i, c;\n\n // Convert dir to NT Format\n if (!RtlDosPathNameToNtPathName_U(CurrentDirectory,\n &DirectoryString,\n NULL,\n NULL))\n {\n return STATUS_UNSUCCESSFUL;\n }\n\n // Initialize the object attributes\n RtlCliDisplayString(\" Directory of %S\\n\\n\", CurrentDirectory);\n InitializeObjectAttributes(&ObjectAttributes,\n &DirectoryString,\n OBJ_CASE_INSENSITIVE,\n NULL,\n NULL);\n\n // Open the directory\n Status = ZwCreateFile(&DirectoryHandle,\n FILE_LIST_DIRECTORY,\n &ObjectAttributes,\n &IoStatusBlock,\n NULL,\n 0,\n FILE_SHARE_READ | FILE_SHARE_WRITE,\n FILE_OPEN,\n FILE_DIRECTORY_FILE,\n NULL,\n 0);\n\n if (!NT_SUCCESS(Status))\n {\n return Status;\n }\n\n // Allocate space for directory entry information\n DirectoryInfo = RtlAllocateHeap(RtlGetProcessHeap(), 0, 4096);\n\n if (!DirectoryInfo)\n {\n return STATUS_INSUFFICIENT_RESOURCES;\n }\n\n // Create the event to wait on\n InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);\n Status = NtCreateEvent(&EventHandle,\n EVENT_ALL_ACCESS,\n &ObjectAttributes,\n SynchronizationEvent,\n FALSE);\n\n if (!NT_SUCCESS(Status))\n {\n return Status;\n }\n\n // Start loop\n\n i = 0;\n for (;;)\n {\n // Get the contents of the directory, adding up the size as we go\n Status = ZwQueryDirectoryFile(DirectoryHandle,\n EventHandle,\n NULL,\n 0,\n &IoStatusBlock,\n DirectoryInfo,\n 4096,\n FileBothDirectoryInformation,\n FALSE,\n NULL,\n FirstQuery);\n if (Status == STATUS_PENDING)\n {\n // Wait on the event\n NtWaitForSingleObject(EventHandle, FALSE, NULL);\n Status = IoStatusBlock.Status;\n }\n\n // Check for success\n if (!NT_SUCCESS(Status))\n {\n // Nothing left to enumerate. Close handles and free memory\n ZwClose(DirectoryHandle);\n RtlFreeHeap(RtlGetProcessHeap(), 0, DirectoryInfo);\n return STATUS_SUCCESS;\n }\n\n // Loop every directory\n Entry = DirectoryInfo;\n\n while (Entry)\n {\n // List the file\n RtlCliDumpFileInfo(Entry);\n\n if (++i > 20)\n {\n i = 0;\n RtlCliDisplayString(\"Continue listing (y/n):\");\n while (TRUE)\n {\n c = RtlCliGetChar(hKeyboard);\n if (c == 'n' || c == 'N')\n {\n RtlCliDisplayString(\"\\n\");\n return STATUS_SUCCESS;\n }\n if (c == 'y' || c == 'Y')\n {\n break;\n }\n }\n RtlCliDisplayString(\"\\n\");\n }\n\n // Make sure we still have a file\n if (!Entry->NextEntryOffset)\n break;\n\n // Move to the next one\n Entry = (PFILE_BOTH_DIR_INFORMATION)((ULONG_PTR)Entry +\n Entry->NextEntryOffset);\n }\n\n // This isn't the first scan anymore\n FirstQuery = FALSE;\n }\n}\n" }, { "path": "hardware.c", "content": "/**\n * PROJECT: Native Shell\n * COPYRIGHT: LGPL; See LICENSE in the top level directory\n * FILE: hardware.c\n * DESCRIPTION: Device tree routines.\n * DEVELOPERS: See CONTRIBUTORS.md in the top level directory\n */\n\n#include \"precomp.h\"\n\n#define MAX_DEVICE_ID_LEN 200\n#define ROOT_NAME L\"HTREE\\\\ROOT\\\\0\"\n\nULONG Level = 0;\nHANDLE RootKey = 0;\n\nNTSTATUS\nRtlCliGetEnumKey(OUT PHANDLE KeyHandle)\n{\n OBJECT_ATTRIBUTES ObjectAttributes;\n UNICODE_STRING KeyName = RTL_CONSTANT_STRING(L\"\\\\Registry\\\\Machine\\\\System\"\n L\"\\\\CurrentControlSet\\\\Enum\");\n\n // Initialize the object attributes\n InitializeObjectAttributes(&ObjectAttributes,\n &KeyName,\n OBJ_CASE_INSENSITIVE,\n NULL,\n NULL);\n\n // Open the key for read access\n return NtOpenKey(KeyHandle, KEY_READ, &ObjectAttributes);\n}\n\nNTSTATUS\nRtlCliGetChildOrSibling(IN PWCHAR Name,\n OUT PWCHAR ChildName,\n IN ULONG Type)\n{\n NTSTATUS Status;\n PLUGPLAY_CONTROL_RELATED_DEVICE_DATA PlugPlayData;\n\n // Initialize the Root Device Node name\n RtlInitUnicodeString(&PlugPlayData.TargetDeviceInstance, Name);\n\n // Initialize the request\n PlugPlayData.Relation = Type;\n PlugPlayData.RelatedDeviceInstanceLength = MAX_DEVICE_ID_LEN;\n PlugPlayData.RelatedDeviceInstance = ChildName;\n\n // Get the root child node\n Status = NtPlugPlayControl(PlugPlayControlGetRelatedDevice,\n (PVOID)&PlugPlayData,\n sizeof(PLUGPLAY_CONTROL_RELATED_DEVICE_DATA));\n return Status;\n}\n\nNTSTATUS\nRtlCliPrintDeviceName(IN PWCHAR Name)\n{\n NTSTATUS Status = STATUS_SUCCESS;\n HANDLE RegHandle;\n OBJECT_ATTRIBUTES ObjectAttributes;\n UNICODE_STRING KeyName;\n PKEY_VALUE_FULL_INFORMATION FullInformation;\n ULONG ResultLength;\n WCHAR Buffer[MAX_DEVICE_ID_LEN];\n ULONG i;\n\n // If we don't already have a root key, get it now\n if (!RootKey)\n Status = RtlCliGetEnumKey(&RootKey);\n if (NT_SUCCESS(Status))\n {\n // Root key opened, now initialize the device instance key name\n RtlInitUnicodeString(&KeyName, Name);\n\n // Setup the object attributes and open the key\n InitializeObjectAttributes(&ObjectAttributes,\n &KeyName,\n 0,\n RootKey,\n NULL);\n Status = NtOpenKey(&RegHandle, KEY_READ, &ObjectAttributes);\n if (NT_SUCCESS(Status))\n {\n // Setup and allocate the key data structure\n ResultLength = sizeof(*FullInformation) + 256;\n FullInformation = RtlAllocateHeap(RtlGetProcessHeap(),\n 0,\n ResultLength);\n\n // Now check for a friendly name\n RtlInitUnicodeString(&KeyName, L\"FriendlyName\");\n Status = NtQueryValueKey(RegHandle,\n &KeyName,\n KeyValueFullInformation,\n FullInformation,\n ResultLength,\n &ResultLength);\n if (!NT_SUCCESS(Status))\n {\n // No friendly name found, try the device description key\n RtlInitUnicodeString(&KeyName, L\"DeviceDesc\");\n Status = NtQueryValueKey(RegHandle,\n &KeyName,\n KeyValueFullInformation,\n FullInformation,\n ResultLength,\n &ResultLength);\n }\n\n // Check if we have success until here\n if (NT_SUCCESS(Status))\n {\n // Get the pointer to the name\n Name = (PWCHAR)((ULONG_PTR)FullInformation +\n FullInformation->DataOffset);\n\n // Indent the name to create the appeareance of a tree\n for (i = 0; i < (Level * 2); i++)\n Buffer[i] = ' ';\n Buffer[i] = UNICODE_NULL;\n\n // Add the device name or description, and display it\n wcscat(Buffer, Name);\n RtlCliDisplayString(\"%S\\n\", Buffer);\n DbgPrint(\"%S\\n\", Buffer);\n }\n\n // Close the key to the device instance name\n NtClose(RegHandle);\n }\n }\n\n // Return status to caller\n return Status;\n}\n\nNTSTATUS\nRtlCliListSubNodes(IN PWCHAR Parent,\n IN PWCHAR Sibling,\n IN PWCHAR Current)\n{\n NTSTATUS Status;\n WCHAR FoundSibling[MAX_DEVICE_ID_LEN];\n WCHAR FoundChild[MAX_DEVICE_ID_LEN];\n\n // Start looping\n do\n {\n // Get the first sibling\n Status = RtlCliGetChildOrSibling(Current, FoundSibling, PNP_GET_SIBLING_DEVICE);\n if (!NT_SUCCESS(Status))\n *FoundSibling = UNICODE_NULL;\n\n // Print its name\n Status = RtlCliPrintDeviceName(Current);\n\n // Get its children\n Status = RtlCliGetChildOrSibling(Current, FoundChild, PNP_GET_CHILD_DEVICE);\n if (NT_SUCCESS(Status))\n {\n // Get it's children's subnodes\n Level++;\n RtlCliListSubNodes(Current, NULL, FoundChild);\n Level--;\n }\n\n // Move to the next sibling\n Current = FoundSibling;\n } while (*Current);\n\n // Return status\n return Status;\n}\n\nNTSTATUS\nRtlCliListHardwareTree(VOID)\n{\n NTSTATUS Status;\n WCHAR Buffer[MAX_DEVICE_ID_LEN];\n\n // Get the root node's child\n Status = RtlCliGetChildOrSibling(ROOT_NAME, Buffer, PNP_GET_CHILD_DEVICE);\n if (!NT_SUCCESS(Status))\n {\n RtlCliDisplayString(\"NtPlugPlayControl get root node failed.\\n\");\n }\n\n // Now get the entire tree\n Status = RtlCliListSubNodes(ROOT_NAME, NULL, Buffer);\n if (!NT_SUCCESS(Status))\n {\n RtlCliDisplayString(\"NtPlugPlayControl get child nodes failed.\\n\");\n }\n return Status;\n}\n" }, { "path": "input.c", "content": "/**\n * PROJECT: Native Shell\n * COPYRIGHT: LGPL; See LICENSE in the top level directory\n * FILE: input.c\n * DESCRIPTION: This module deals with device input (such as mouse or keyboard).\n * DEVELOPERS: See CONTRIBUTORS.md in the top level directory\n */\n\n#include \"precomp.h\"\n\n// FIXME: Temporary here\n\nNTSTATUS\nRtlClipBackspace(\n VOID);\n\n// Event to wait on for keyboard input\nHANDLE hEvent;\n\n// Raw keyboard character buffer\n\nULONG CurrentChar = 0;\n\n// Input buffer\nCHAR Line[1024];\nCHAR CurrentPosition = 0;\n\n/*++\n * @name RtlCliOpenInputDevice\n *\n * The RtlCliOpenInputDevice routine opens an input device.\n *\n * @param Handle\n * Pointer where the handle for the input device will be returned.\n *\n * @param Type\n * Type of the input device to use.\n *\n * @return STATUS_SUCCESS or error code when attemping to open the device.\n *\n * @remarks This routine supports both mouse and keyboard input devices.\n *\n *--*/\nNTSTATUS\nRtlCliOpenInputDevice(OUT PHANDLE Handle,\n IN CON_DEVICE_TYPE Type)\n{\n UNICODE_STRING Driver;\n OBJECT_ATTRIBUTES ObjectAttributes;\n IO_STATUS_BLOCK Iosb;\n HANDLE hDriver;\n NTSTATUS Status;\n\n // Chose the driver to use\n // FIXME: Support MouseType later\n // FIXME: Don't hardcode keyboard path\n\n if (Type == KeyboardType)\n {\n RtlInitUnicodeString(&Driver, L\"\\\\Device\\\\KeyboardClass0\");\n }\n\n // Initialize the object attributes\n InitializeObjectAttributes(&ObjectAttributes,\n &Driver,\n OBJ_CASE_INSENSITIVE,\n NULL,\n NULL);\n\n // Open a handle to it\n Status = NtCreateFile(&hDriver,\n SYNCHRONIZE | GENERIC_READ | FILE_READ_ATTRIBUTES,\n &ObjectAttributes,\n &Iosb,\n NULL,\n FILE_ATTRIBUTE_NORMAL,\n 0,\n FILE_OPEN,\n FILE_DIRECTORY_FILE,\n NULL,\n 0);\n\n // Now create an event that will be used to wait on the device\n InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);\n Status = NtCreateEvent(&hEvent, EVENT_ALL_ACCESS, &ObjectAttributes, 1, 0);\n\n // Return the handle\n *Handle = hDriver;\n return Status;\n}\n\n/*++\n * @name RtlClipWaitForInput\n *\n * The RtlClipWaitForInput routine waits for input from an input device.\n *\n * @param hDriver\n * Handle of the driver/device to get input from.\n *\n * @param Buffer\n * Input buffer.\n *\n * @param BufferSize\n * Size of the input buffer.\n *\n * @return STATUS_SUCCESS or error code from the read operation.\n *\n * @remarks This routine waits for input to be available.\n *\n *--*/\nNTSTATUS\nRtlClipWaitForInput(IN HANDLE hDriver,\n IN PVOID Buffer,\n IN OUT PULONG BufferSize)\n{\n IO_STATUS_BLOCK Iosb;\n LARGE_INTEGER ByteOffset;\n NTSTATUS Status;\n\n // Clean up the I/O Status block and read from byte 0\n\n RtlZeroMemory(&Iosb, sizeof(Iosb));\n RtlZeroMemory(&ByteOffset, sizeof(ByteOffset));\n\n // Try to read the data\n\n Status = NtReadFile(hDriver,\n hEvent,\n NULL,\n NULL,\n &Iosb,\n Buffer,\n *BufferSize,\n &ByteOffset,\n NULL);\n\n // Check if data is pending\n\n if (Status == STATUS_PENDING)\n {\n\n // Wait on the data to be read\n\n Status = NtWaitForSingleObject(hEvent, TRUE, NULL);\n }\n\n // Return status and how much data was read\n\n *BufferSize = (ULONG)Iosb.Information;\n return Status;\n}\n\nCHAR RtlCliGetChar(IN HANDLE hDriver)\n{\n KEYBOARD_INPUT_DATA KeyboardData;\n KBD_RECORD kbd_rec;\n ULONG BufferLength = sizeof(KEYBOARD_INPUT_DATA);\n\n RtlClipWaitForInput(hDriver, &KeyboardData, &BufferLength);\n\n IntTranslateKey(&KeyboardData, &kbd_rec);\n\n if (!kbd_rec.bKeyDown)\n {\n return (-1);\n }\n return kbd_rec.AsciiChar;\n}\n\n/*++\n * @name RtlCliGetLine\n *\n * The RtlCliGetLine routine gets line from keyboard.\n *\n * @param hDriver\n * Keyboard handle.\n *\n * @return PCHAR\n *\n * @remarks Because we don't currently have a thread to display on screen\n * whatever is typed, we handle this in the same thread and display\n * a character only if someone is actually waiting for it. This\n * will be changed later.\n */\nPCHAR\nRtlCliGetLine(IN HANDLE hDriver)\n{\n CHAR Char;\n BOOLEAN First = FALSE;\n\n // Wait for a new character\n\n while (TRUE)\n {\n // Get the character that was pressed\n Char = RtlCliGetChar(hDriver);\n\n // Check if this was ENTER\n if (Char == '\\r')\n {\n // First, null-terminate the line buffer\n Line[CurrentPosition] = ANSI_NULL;\n CurrentPosition = 0;\n\n // Return it\n return Line;\n }\n else if (Char == '\\b')\n {\n // Make sure we don't back-space beyond the limit\n if (CurrentPosition)\n {\n // NtDisplayString does not properly handle backspace, so\n // we unfortunately have to rely on a hack.\n\n // We have to call in the display subsystem to redisplay the\n // current text buffer and replace last character with space.\n\n RtlCliPutChar('\\r');\n RtlClipBackspace();\n\n RtlCliPutChar(' ');\n\n RtlCliPutChar('\\r');\n RtlClipBackspace();\n\n // Now we do the only thing we're supposed to do, which is to\n // remove a character in the command buffer as well.\n CurrentPosition--;\n }\n\n // Continue listening for chars.\n continue;\n }\n\n // We got another character. Make sure it's not NULL.\n if (!Char || Char == -1)\n continue;\n\n // Add it to our line buffer\n Line[CurrentPosition] = Char;\n CurrentPosition++;\n\n // Again, as noted earlier, we combine input with display in a very\n // unholy way, so we also have to display it on screen.\n RtlCliPutChar(Char);\n }\n}\n" }, { "path": "install/add.reg", "content": "REGEDIT4\n\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager]\n\"BootExecute\"=hex(7):61,75,74,6f,63,68,65,63,6b,20,61,75,74,6f,63,68,6b,20,2a,\\\n 00,6e,61,74,69,76,65,20,48,65,6c,6c,6f,20,57,6f,72,6c,64,21,00,00\n" }, { "path": "install/remove.reg", "content": "REGEDIT4\n\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager]\n\"BootExecute\"=hex(7):61,75,74,6f,63,68,65,63,6b,20,61,75,74,6f,63,68,6b,20,2a,\\\n 00,00\n" }, { "path": "keytrans.c", "content": "/**\n * PROJECT: Native Shell\n * COPYRIGHT: LGPL; See LICENSE in the top level directory\n * FILE: keytrans.c\n * DESCRIPTION: Keyboard codes translation.\n * DEVELOPERS: See CONTRIBUTORS.md in the top level directory\n */\n\n#include \"precomp.h\"\n\ntypedef struct _SCANTOASCII\n{\n USHORT ScanCode;\n UCHAR Normal;\n UCHAR Shift;\n} SCANTOASCII, *PSCANTOASCII;\n\nSCANTOASCII ScanToAscii[] = {\n {0x1e, 'a', 'A'},\n {0x30, 'b', 'B'},\n {0x2e, 'c', 'C'},\n {0x20, 'd', 'D'},\n {0x12, 'e', 'E'},\n {0x21, 'f', 'F'},\n {0x22, 'g', 'G'},\n {0x23, 'h', 'H'},\n {0x17, 'i', 'I'},\n {0x24, 'j', 'J'},\n {0x25, 'k', 'K'},\n {0x26, 'l', 'L'},\n {0x32, 'm', 'M'},\n {0x31, 'n', 'N'},\n {0x18, 'o', 'O'},\n {0x19, 'p', 'P'},\n {0x10, 'q', 'Q'},\n {0x13, 'r', 'R'},\n {0x1f, 's', 'S'},\n {0x14, 't', 'T'},\n {0x16, 'u', 'U'},\n {0x2f, 'v', 'V'},\n {0x11, 'w', 'W'},\n {0x2d, 'x', 'X'},\n {0x15, 'y', 'Y'},\n {0x2c, 'z', 'Z'},\n\n {0x02, '1', '!'},\n {0x03, '2', '@'},\n {0x04, '3', '#'},\n {0x05, '4', '$'},\n {0x06, '5', '%'},\n {0x07, '6', '^'},\n {0x08, '7', '&'},\n {0x09, '8', '*'},\n {0x0a, '9', '('},\n {0x0b, '0', ')'},\n\n {0x29, '\\'', '~'},\n {0x0c, '-', '_'},\n {0x0d, '=', '+'},\n {0x1a, '[', '{'},\n {0x1b, ']', '}'},\n {0x2b, '\\\\', '|'},\n {0x27, ';', ':'},\n {0x28, '\\'', '\"'},\n {0x33, ',', '<'},\n {0x34, '.', '>'},\n {0x35, '/', '?'},\n\n {0x4a, '-', '-'},\n {0x4e, '+', '+'},\n {0x37, '*', '*'},\n\n {0x39, ' ', ' '},\n\n {0x1c, '\\r', '\\r'},\n {0x0e, 0x08, 0x08}, /* backspace */\n\n {0, 0, 0}};\n\nstatic void IntUpdateControlKeyState(LPDWORD State, PKEYBOARD_INPUT_DATA InputData)\n{\n DWORD Value = 0;\n\n if (InputData->Flags & KEY_E1) /* Only the pause key has E1 */\n return;\n\n if (!(InputData->Flags & KEY_E0))\n {\n switch (InputData->MakeCode)\n {\n case 0x2a:\n case 0x36:\n Value = SHIFT_PRESSED;\n break;\n case 0x1d:\n Value = LEFT_CTRL_PRESSED;\n break;\n case 0x38:\n Value = LEFT_ALT_PRESSED;\n break;\n case 0x45:\n Value = NUMLOCK_ON;\n if (!(InputData->Flags & KEY_BREAK))\n *State ^= Value;\n return;\n default:\n return;\n }\n }\n else\n {\n switch (InputData->MakeCode)\n {\n case 0x1d:\n Value = RIGHT_CTRL_PRESSED;\n break;\n case 0x38:\n Value = RIGHT_ALT_PRESSED;\n break;\n default:\n return;\n }\n }\n\n if (InputData->Flags & KEY_BREAK)\n *State &= ~Value;\n else\n *State |= Value;\n}\n\nstatic UCHAR IntAsciiFromInput(PKEYBOARD_INPUT_DATA InputData, DWORD KeyState)\n{\n UINT Counter = 0;\n\n while (ScanToAscii[Counter].ScanCode != 0)\n {\n if (ScanToAscii[Counter].ScanCode == InputData->MakeCode)\n {\n if (KeyState & SHIFT_PRESSED)\n return ScanToAscii[Counter].Shift;\n return ScanToAscii[Counter].Normal;\n }\n Counter++;\n }\n return 0;\n}\n\n/*\n * Only the bKeyDown and AsciiChar members are used in the zenwinx library.\n */\nvoid IntTranslateKey(PKEYBOARD_INPUT_DATA InputData, KBD_RECORD *kbd_rec)\n{\n static DWORD dwControlKeyState;\n\n kbd_rec->wVirtualScanCode = InputData->MakeCode;\n kbd_rec->bKeyDown = (InputData->Flags & KEY_BREAK) ? FALSE : TRUE;\n\n IntUpdateControlKeyState(&dwControlKeyState, InputData);\n kbd_rec->dwControlKeyState = dwControlKeyState;\n\n if (InputData->Flags & KEY_E0)\n kbd_rec->dwControlKeyState |= ENHANCED_KEY;\n\n kbd_rec->AsciiChar = IntAsciiFromInput(InputData, kbd_rec->dwControlKeyState);\n}\n" }, { "path": "main.c", "content": "/**\n * PROJECT: Native Shell\n * COPYRIGHT: LGPL; See LICENSE in the top level directory\n * FILE: main.c\n * DESCRIPTION: This module handles the main command line interface and command parsing.\n * DEVELOPERS: See CONTRIBUTORS.md in the top level directory\n */\n\n#include \"precomp.h\"\n\nHANDLE hKeyboard;\nHANDLE hHeap;\nHANDLE hKey;\n\n#define __APP_VER__ \"0.14.1\"\n#if defined(_M_AMD64) || defined(_AMD64_)\n#define __NCLI_VER__ __APP_VER__ \" x64\"\n#else\n#define __NCLI_VER__ __APP_VER__ \" x86\"\n#endif\n\nWCHAR *helpstr[] =\n {\n {L\"\\n\"\n L\"cd X - Change directory to X md X - Make directory X\\n\"\n L\"copy X Y - Copy file X to Y poweroff - Power off PC\\n\"\n L\"dir X - Show directory contents pwd - Print working directory\\n\"\n L\"del X - Delete file X reboot - Reboot PC\\n\"\n L\"devtree - Dump device tree shutdown - Shutdown PC\\n\"\n L\"\\x0000\"},\n {L\"exit - Exit shell sysinfo - Dump system information\\n\"\n L\"lm - List modules drawtext X - Draw string X\\n\"\n L\"lp - List processes move X Y - Move file X to Y\\n\"\n L\"testvid - Test screen output testarg X Y - Test argument parsing\\n\"\n L\"\\n\"\n L\"X: - change drive letter to X\\n\"\n L\"If a command is not in the list, it is treated as an executable name\\n\"\n L\"\\n\"\n L\"\\x0000\"}};\n\nVOID RtlClipProcessMessage(PCHAR Command)\n{\n WCHAR CurrentDirectory[MAX_PATH] = {0};\n UNICODE_STRING CurrentDirectoryString;\n CHAR CommandBuf[BUFFER_SIZE] = {0};\n UINT argc;\n CHAR **argv;\n\n strncpy(CommandBuf, Command, strnlen(Command, BUFFER_SIZE));\n\n argv = StringToArguments(&CommandBuf[0], &argc);\n\n if (0 == argc)\n return;\n\n if (!_strnicmp(argv[0], CMDSTR(\"exit\")))\n {\n // Exit from shell\n DeinitHeapMemory(hHeap);\n NtTerminateProcess(NtCurrentProcess(), 0);\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"testarg\")))\n {\n UINT i = 0;\n\n RtlCliDisplayString(\"Args: %d\\n\", argc);\n\n if (argc > 1)\n {\n for (i = 1; i < argc; i++)\n {\n if (NULL != argv[i])\n RtlCliDisplayString(\"Arg %d: %s\\n\", i, argv[i]);\n else\n {\n RtlCliDisplayString(\"Arg %d: NULL\\n\", i);\n break;\n }\n }\n }\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"help\")))\n {\n RtlCliDisplayString(\"%S\", helpstr[0]);\n RtlCliDisplayString(\"%S\", helpstr[1]);\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"lm\")))\n {\n // List Modules (!lm)\n RtlCliListDrivers();\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"lp\")))\n {\n // List Processes (!lp)\n RtlCliListProcesses();\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"sysinfo\")))\n {\n // Dump System Information (sysinfo)\n RtlCliDumpSysInfo();\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"cd\")))\n {\n // Set the current directory\n RtlCliSetCurrentDirectory(&Command[3]);\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"drawtext\")))\n {\n#if (NTDDI_VERSION >= NTDDI_WIN7)\n UNICODE_STRING us;\n ANSI_STRING as;\n RtlInitAnsiString(&as, &Command[9]);\n RtlAnsiStringToUnicodeString(&us, &as, TRUE);\n NtDrawText(&us);\n RtlFreeUnicodeString(&us);\n#else\n RtlCliDisplayString(\"\\nNot supported prior to Win7\\n\");\n#endif\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"pwd\")))\n {\n // Get the current directory\n RtlCliGetCurrentDirectory(CurrentDirectory);\n\n // Display it\n RtlInitUnicodeString(&CurrentDirectoryString, CurrentDirectory);\n RtlCliPrintString(&CurrentDirectoryString);\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"dir\")))\n {\n WCHAR Dir[MAX_PATH];\n WCHAR ArgDir[MAX_PATH];\n RtlCliGetCurrentDirectory(Dir);\n if (argc > 1)\n {\n UNICODE_STRING us;\n ANSI_STRING as;\n RtlInitAnsiString(&as, argv[1]);\n RtlAnsiStringToUnicodeString(&us, &as, TRUE);\n\n AppendString(Dir, L\"\\\\\");\n AppendString(Dir, us.Buffer);\n\n RtlFreeUnicodeString(&us);\n }\n\n // List directory\n RtlCliListDirectory(Dir);\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"devtree\")))\n {\n // Dump hardware tree\n RtlCliListHardwareTree();\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"shutdown\")))\n {\n RtlCliShutdown();\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"reboot\")))\n {\n RtlCliReboot();\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"poweroff\")))\n {\n RtlCliPowerOff();\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"testvid\")))\n {\n UINT j;\n WCHAR i, w;\n UNICODE_STRING us;\n\n LARGE_INTEGER delay;\n memset(&delay, 0x00, sizeof(LARGE_INTEGER));\n delay.LowPart = 100000000;\n\n RtlInitUnicodeString(&us, L\" \");\n\n // 75x23\n RtlCliDisplayString(\"\\nVid mode is 75x23\\n\\nCharacter test:\");\n\n j = 0;\n for (w = L'A'; w < 0xFFFF; w++)\n {\n j++;\n NtDelayExecution(FALSE, &delay);\n // w = i;\n if (w != L'\\n' && w != L'\\r')\n {\n RtlCliPutChar(w);\n }\n else\n {\n RtlCliPutChar(L' ');\n }\n if (j > 70)\n {\n j = 0;\n RtlCliPutChar(L'\\n');\n }\n }\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"copy\")))\n {\n // Copy file\n if (argc > 2)\n {\n WCHAR buf1[MAX_PATH] = {0};\n WCHAR buf2[MAX_PATH] = {0};\n GetFullPath(argv[1], buf1, FALSE);\n GetFullPath(argv[2], buf2, FALSE);\n RtlCliDisplayString(\"\\nCopy %S to %S\\n\", buf1, buf2);\n if (FileExists(buf1))\n {\n if (!NtFileCopyFile(buf1, buf2))\n {\n RtlCliDisplayString(\"Failed.\\n\");\n }\n }\n else\n {\n RtlCliDisplayString(\"File does not exist.\\n\");\n }\n }\n else\n {\n RtlCliDisplayString(\"Not enough arguments.\\n\");\n }\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"move\")))\n {\n // Move/rename file\n if (argc > 2)\n {\n WCHAR buf1[MAX_PATH] = {0};\n WCHAR buf2[MAX_PATH] = {0};\n GetFullPath(argv[1], buf1, FALSE);\n GetFullPath(argv[2], buf2, FALSE);\n RtlCliDisplayString(\"\\nMove %S to %S\\n\", buf1, buf2);\n if (FileExists(buf1))\n {\n if (!NtFileMoveFile(buf1, buf2, FALSE))\n {\n RtlCliDisplayString(\"Failed.\\n\");\n }\n }\n else\n {\n RtlCliDisplayString(\"File does not exist.\\n\");\n }\n }\n else\n {\n RtlCliDisplayString(\"Not enough arguments.\\n\");\n }\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"del\")))\n {\n // Delete file\n if (argc > 1)\n {\n WCHAR buf1[MAX_PATH] = {0};\n GetFullPath(argv[1], buf1, FALSE);\n if (FileExists(buf1))\n {\n RtlCliDisplayString(\"\\nDelete %S\\n\", buf1);\n\n if (!NtFileDeleteFile(buf1))\n {\n RtlCliDisplayString(\"Failed.\\n\");\n }\n }\n else\n {\n RtlCliDisplayString(\"File does not exist.\\n\");\n }\n }\n else\n {\n RtlCliDisplayString(\"Not enough arguments.\\n\");\n }\n }\n else if (!_strnicmp(argv[0], CMDSTR(\"md\")))\n {\n // Make directory\n if (argc > 1)\n {\n WCHAR buf1[MAX_PATH] = {0};\n GetFullPath(argv[1], buf1, FALSE);\n\n RtlCliDisplayString(\"\\nCreate directory %S\\n\", buf1);\n\n if (!NtFileCreateDirectory(buf1))\n {\n RtlCliDisplayString(\"Failed.\\n\");\n }\n }\n else\n {\n RtlCliDisplayString(\"Not enough arguments.\\n\");\n }\n }\n else if ((strlen(argv[0]) == 2) && (argv[0][1] == ':'))\n {\n // Change disk\n RtlCliSetCurrentDirectory(argv[0]);\n return;\n }\n else\n {\n // Unknown command, try to find an executable and run it.\n WCHAR filename[MAX_PATH] = {0};\n BOOL bExist = FALSE;\n\n GetFullPath(argv[0], filename, FALSE);\n\n bExist = FileExists(filename);\n if (!bExist)\n {\n wcscat(filename, L\".exe\");\n bExist = FileExists(filename);\n }\n\n if (bExist)\n {\n HANDLE hProcess;\n NTSTATUS status;\n ANSI_STRING as;\n UNICODE_STRING us;\n RtlInitAnsiString(&as, Command);\n RtlAnsiStringToUnicodeString(&us, &as, TRUE);\n\n NtClose(hKeyboard);\n\n status = CreateNativeProcess(filename, us.Buffer, &hProcess);\n if (NT_SUCCESS(status))\n {\n NtWaitForSingleObject(hProcess, FALSE, NULL);\n }\n else\n {\n RtlCliDisplayString(\"Failed to execute %s\\n\", Command);\n }\n RtlCliOpenInputDevice(&hKeyboard, KeyboardType);\n RtlFreeUnicodeString(&us);\n }\n else\n {\n RtlCliDisplayString(\"%s is not recognized as a command or an executable file name\\n\"\n \"\\nType \\\"help\\\" for the list of commands.\\n\",\n Command);\n }\n }\n}\n\n/*++\n * @name RtlClipDisplayPrompt\n *\n * The RtlClipDisplayPrompt routine\n *\n * @param None.\n *\n * @return None.\n *\n * @remarks Documentation for this routine needs to be completed.\n *\n *--*/\nVOID RtlClipDisplayPrompt(VOID)\n{\n WCHAR CurrentDirectory[MAX_PATH];\n UNICODE_STRING DirString;\n\n RtlCliGetCurrentDirectory(CurrentDirectory);\n\n if (!RtlDosPathNameToNtPathName_U(CurrentDirectory, &DirString, NULL, NULL))\n {\n RtlCliDisplayString(\"%S>\", CurrentDirectory);\n return;\n }\n\n RtlCliPrintString(&DirString);\n RtlCliPutChar(L'>');\n}\n\nNTSTATUS\n__cdecl main(INT argc,\n PCHAR argv[],\n PCHAR envp[],\n ULONG DebugFlag OPTIONAL)\n{\n PPEB Peb = NtCurrentPeb();\n NTSTATUS Status;\n PCHAR Command;\n\n hHeap = InitHeapMemory();\n hKey = NULL;\n\n // Show banner\n RtlCliDisplayString(\"Native Shell v\" __NCLI_VER__ \" (build \" __DATE__ \" \" __TIME__ \")\\n\\n\");\n\n // Setup keyboard input\n Status = RtlCliOpenInputDevice(&hKeyboard, KeyboardType);\n\n // Show initial prompt\n RtlClipDisplayPrompt();\n\n // Wait for a new line\n while (TRUE)\n {\n // Get the line that was entered and display a new line\n Command = RtlCliGetLine(hKeyboard);\n RtlCliDisplayString(\"\\n\");\n\n // Make sure there's actually a command\n if (*Command)\n {\n // Process the command and do a new line again.\n RtlClipProcessMessage(Command);\n RtlCliDisplayString(\"\\n\");\n }\n\n // Display the prompt, and restart the loop\n RtlClipDisplayPrompt();\n continue;\n }\n\n DeinitHeapMemory(hHeap);\n NtTerminateProcess(NtCurrentProcess(), 0);\n\n return STATUS_SUCCESS;\n}\n" }, { "path": "makefile", "content": "#\n# DO NOT EDIT THIS FILE!!! Edit .\\sources. if you want to add a new source\n# file to this component. This file merely indirects to the real make file\n# that is shared by all the driver components of the Windows NT DDK\n#\n\n!INCLUDE $(NTMAKEENV)\\makefile.def\n" }, { "path": "ndk/arch/ketypes.h", "content": "/*++ NDK Version: 0095\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n ketypes.h (ARCH)\n\nAbstract:\n\n Portability file to choose the correct Architecture-specific file.\n\nAuthor:\n\n Alex Ionescu (alex.ionescu@reactos.com) 06-Oct-2004\n\n--*/\n\n#ifndef _ARCH_KETYPES_H\n#define _ARCH_KETYPES_H\n\n//\n// Include the right file for this architecture.\n//\n#ifdef _M_IX86\n#include \n#elif defined(_M_PPC)\n#include \n#else\n#error \"Unknown processor\"\n#endif\n\n#endif\n" }, { "path": "ndk/arch/mmtypes.h", "content": "/*++ NDK Version: 0095\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n mmtypes.h (ARCH)\n\nAbstract:\n\n Portability file to choose the correct Architecture-specific file.\n\nAuthor:\n\n Alex Ionescu (alex.ionescu@reactos.com) 06-Oct-2004\n\n--*/\n\n#ifndef _ARCH_MMTYPES_H\n#define _ARCH_MMTYPES_H\n\n//\n// Include the right file for this architecture.\n//\n#if defined(_M_IX86) || defined(_M_AMD64)\n#include \n#elif defined(_M_PPC)\n#include \n#else\n#error \"Unknown processor\"\n#endif\n\n#endif\n" }, { "path": "ndk/asm.h", "content": "/*++ NDK Version: 0095\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n asm.h\n\nAbstract:\n\n ASM Offsets for dealing with de-referencing structures in registers.\n C-compatible version of the file ks386.inc present in the newest WDK.\n\nAuthor:\n\n Alex Ionescu (alex.ionescu@reactos.com) 06-Oct-2004\n\n--*/\n\n#ifndef _ASM_H\n#define _ASM_H\n\n#define NEW_SCHEDULER\n\n//\n// PCR Access\n//\n#ifdef __ASM__\n#ifdef CONFIG_SMP\n#define PCR fs:\n#else\n#define PCR ds:[0xFFDFF000]\n#endif\n#endif\n\n//\n// CPU Modes\n//\n#define KernelMode 0x0\n#define UserMode 0x1\n\n//\n// CPU Types\n//\n#define CPU_INTEL 0x1\n#define CPU_AMD 0x2\n\n//\n// Selector Names\n//\n#ifdef __ASM__\n#define RPL_MASK 0x0003\n#define MODE_MASK 0x0001\n#define KGDT_R0_CODE (0x8)\n#define KGDT_R0_DATA (0x10)\n#define KGDT_R3_CODE (0x18)\n#define KGDT_R3_DATA (0x20)\n#define KGDT_TSS (0x28)\n#define KGDT_R0_PCR (0x30)\n#define KGDT_R3_TEB (0x38)\n#define KGDT_LDT (0x48)\n#define KGDT_DF_TSS (0x50)\n#define KGDT_NMI_TSS (0x58)\n#endif\n\n//\n// KV86M_REGISTERS Offsets\n//\n#define KV86M_REGISTERS_EBP 0x0\n#define KV86M_REGISTERS_EDI 0x4\n#define KV86M_REGISTERS_ESI 0x8\n#define KV86M_REGISTERS_EDX 0xC\n#define KV86M_REGISTERS_ECX 0x10\n#define KV86M_REGISTERS_EBX 0x14\n#define KV86M_REGISTERS_EAX 0x18\n#define KV86M_REGISTERS_DS 0x1C\n#define KV86M_REGISTERS_ES 0x20\n#define KV86M_REGISTERS_FS 0x24\n#define KV86M_REGISTERS_GS 0x28\n#define KV86M_REGISTERS_EIP 0x2C\n#define KV86M_REGISTERS_CS 0x30\n#define KV86M_REGISTERS_EFLAGS 0x34\n#define KV86M_REGISTERS_ESP 0x38\n#define KV86M_REGISTERS_SS 0x3C\n#define TF_SAVED_EXCEPTION_STACK 0x8C\n#define TF_REGS 0x90\n#define TF_ORIG_EBP 0x94\n\n//\n// TSS Offsets\n//\n#define KTSS_ESP0 0x4\n#define KTSS_CR3 0x1C\n#define KTSS_EFLAGS 0x24\n#define KTSS_IOMAPBASE 0x66\n#define KTSS_IO_MAPS 0x68\n\n//\n// KTHREAD Offsets\n//\n#define KTHREAD_DEBUG_ACTIVE 0x03\n#define KTHREAD_INITIAL_STACK 0x18\n#define KTHREAD_STACK_LIMIT 0x1C\n#define KTHREAD_TEB 0x74\n#define KTHREAD_KERNEL_STACK 0x20\n#define KTHREAD_ALERTED 0x5E\n#define KTHREAD_APCSTATE_PROCESS 0x28 + 0x10\n#define KTHREAD_PENDING_USER_APC 0x28 + 0x16\n#define KTHREAD_PENDING_KERNEL_APC 0x28 + 0x15\n#define KTHREAD_CONTEXT_SWITCHES 0x48\n#define KTHREAD_STATE_ 0x4C\n#define KTHREAD_NPX_STATE 0x4D\n#define KTHREAD_WAIT_IRQL 0x4E\n#define KTHREAD_NEXT_PROCESSOR 0x40\n#define KTHREAD_WAIT_REASON 0x5A\n#define KTHREAD_PRIORITY 0x5B\n#define KTHREAD_SWAP_BUSY 0x5D\n#define KTHREAD_SERVICE_TABLE 0x118\n#define KTHREAD_PREVIOUS_MODE 0xD7\n#define KTHREAD_COMBINED_APC_DISABLE 0x70\n#define KTHREAD_SPECIAL_APC_DISABLE 0x72\n#define KTHREAD_LARGE_STACK 0x107\n#define KTHREAD_TRAP_FRAME 0x110\n#define KTHREAD_CALLBACK_STACK 0x114\n#define KTHREAD_APC_STATE_INDEX 0x11C\n#define KTHREAD_STACK_BASE 0x158\n#define KTHREAD_QUANTUM 0x15D\n#define KTHREAD_KERNEL_TIME 0x160\n#define KTHREAD_USER_TIME 0x18C\n\n//\n// KPROCESS Offsets\n//\n#define KPROCESS_DIRECTORY_TABLE_BASE 0x18\n#define KPROCESS_LDT_DESCRIPTOR0 0x20\n#define KPROCESS_LDT_DESCRIPTOR1 0x24\n#define KPROCESS_INT21_DESCRIPTOR0 0x28\n#define KPROCESS_INT21_DESCRIPTOR1 0x2C\n#define KPROCESS_IOPM_OFFSET 0x30\n#define KPROCESS_ACTIVE_PROCESSORS 0x34\n#define EPROCESS_VDM_OBJECTS 0x144\n\n//\n// KTIMER_TABLE Offsets\n//\n#ifdef __ASM__\n#define KTIMER_TABLE_ENTRY 0x00\n#define KTIMER_TABLE_TIME 0x08\n#define TIMER_ENTRY_SIZE 0x10\n#define TIMER_TABLE_SIZE 0x200\n#endif\n\n//\n// KPRCB Offsets\n//\n#define KPRCB_DR0 0x2F8\n#define KPRCB_DR1 0x2FC\n#define KPRCB_DR2 0x300\n#define KPRCB_DR3 0x304\n#define KPRCB_DR6 0x308\n#define KPRCB_DR7 0x30C\n#define KPRCB_TIMER_HAND 0x964\n#define KPRCB_TIMER_REQUEST 0x968\n\n//\n// KPCR Offsets\n//\n#define KPCR_EXCEPTION_LIST 0x0\n#define KPCR_INITIAL_STACK 0x4\n#define KPCR_STACK_LIMIT 0x8\n#define KPCR_PERF_GLOBAL_GROUP_MASK 0x8\n#define KPCR_CONTEXT_SWITCHES 0x10\n#define KPCR_SET_MEMBER_COPY 0x14\n#define KPCR_TEB 0x18\n#define KPCR_SELF 0x1C\n#define KPCR_PRCB 0x20\n#define KPCR_IRQL 0x24\n#define KPCR_IRR 0x28\n#define KPCR_IRR_ACTIVE 0x2C\n#define KPCR_IDR 0x30\n#define KPCR_KD_VERSION_BLOCK 0x34\n#define KPCR_IDT 0x38\n#define KPCR_GDT 0x3C\n#define KPCR_TSS 0x40\n#define KPCR_STALL_SCALE_FACTOR 0x4C\n#define KPCR_SET_MEMBER 0x48\n#define KPCR_NUMBER 0x51\n#define KPCR_VDM_ALERT 0x54\n#define KPCR_PRCB_DATA 0x120\n#define KPCR_CURRENT_THREAD 0x124\n#define KPCR_PRCB_NEXT_THREAD 0x128\n#define KPCR_PRCB_IDLE_THREAD 0x12C\n#define KPCR_PROCESSOR_NUMBER 0x130\n#define KPCR_PRCB_SET_MEMBER 0x134\n#define KPCR_PRCB_CPU_TYPE 0x138\n#define KPCR_NPX_THREAD 0x640\n#define KPCR_DR6 0x428\n#define KPCR_DR7 0x42C\n#define KPCR_PRCB_INTERRUPT_COUNT 0x644\n#define KPCR_PRCB_KERNEL_TIME 0x648\n#define KPCR_PRCB_USER_TIME 0x64C\n#define KPCR_PRCB_DPC_TIME 0x650\n#define KPCR_PRCB_DEBUG_DPC_TIME 0x654\n#define KPCR_PRCB_INTERRUPT_TIME 0x658\n#define KPCR_PRCB_ADJUST_DPC_THRESHOLD 0x65C\n#define KPCR_PRCB_SKIP_TICK 0x664\n#define KPCR_SYSTEM_CALLS 0x6B8\n#define KPCR_PRCB_DPC_QUEUE_DEPTH 0xA4C\n#define KPCR_PRCB_DPC_COUNT 0xA50\n#define KPCR_PRCB_DPC_STACK 0xA68\n#define KPCR_PRCB_MAXIMUM_DPC_QUEUE_DEPTH 0xA6C\n#define KPCR_PRCB_DPC_REQUEST_RATE 0xA70\n#define KPCR_PRCB_DPC_INTERRUPT_REQUESTED 0xA78\n#define KPCR_PRCB_DPC_ROUTINE_ACTIVE 0xA7A\n#define KPCR_PRCB_DPC_LAST_COUNT 0xA80\n#define KPCR_PRCB_TIMER_REQUEST 0xA88\n#define KPCR_PRCB_QUANTUM_END 0xAA1\n#define KPCR_PRCB_DEFERRED_READY_LIST_HEAD 0xC10\n#define KPCR_PRCB_POWER_STATE_IDLE_FUNCTION 0xEC0\n\n//\n// KINTERRUPT Offsets\n//\n#define KINTERRUPT_SERVICE_ROUTINE 0x0C\n#define KINTERRUPT_SERVICE_CONTEXT 0x10\n#define KINTERRUPT_TICK_COUNT 0x18\n#define KINTERRUPT_ACTUAL_LOCK 0x1C\n#define KINTERRUPT_IRQL 0x20\n#define KINTERRUPT_VECTOR 0x24\n#define KINTERRUPT_SYNCHRONIZE_IRQL 0x29\n#define KINTERRUPT_DISPATCH_COUNT 0x38\n\n//\n// KGDTENTRY Offsets\n//\n#define KGDT_BASE_LOW 0x2\n#define KGDT_BASE_MID 0x4\n#define KGDT_BASE_HI 0x7\n#define KGDT_LIMIT_HI 0x6\n#define KGDT_LIMIT_LOW 0x0\n\n//\n// FPU Save Area Offsets\n//\n#define FP_CONTROL_WORD 0x0\n#define FP_STATUS_WORD 0x4\n#define FP_TAG_WORD 0x8\n#define FP_ERROR_OFFSET 0xC\n#define FP_ERROR_SELECTOR 0x10\n#define FP_DATA_OFFSET 0x14\n#define FP_DATA_SELECTOR 0x18\n#define FN_CR0_NPX_STATE 0x20C\n#define SIZEOF_FX_SAVE_AREA 528\n#define NPX_FRAME_LENGTH 0x210\n\n//\n// FX Save Area Offsets\n//\n#define FX_CONTROL_WORD 0x0\n#define FX_STATUS_WORD 0x2\n#define FX_TAG_WORD 0x4\n#define FX_ERROR_OPCODE 0x6\n#define FX_ERROR_OFFSET 0x8\n#define FX_ERROR_SELECTOR 0xC\n#define FX_DATA_OFFSET 0x10\n#define FX_DATA_SELECTOR 0x14\n#define FX_MXCSR 0x18\n\n//\n// NPX States\n//\n#define NPX_STATE_NOT_LOADED 0xA\n#define NPX_STATE_LOADED 0x0\n\n//\n// Trap Frame Offsets\n//\n#define KTRAP_FRAME_DEBUGEBP 0x0\n#define KTRAP_FRAME_DEBUGEIP 0x4\n#define KTRAP_FRAME_DEBUGARGMARK 0x8\n#define KTRAP_FRAME_DEBUGPOINTER 0xC\n#define KTRAP_FRAME_TEMPCS 0x10\n#define KTRAP_FRAME_TEMPESP 0x14\n#define KTRAP_FRAME_DR0 0x18\n#define KTRAP_FRAME_DR1 0x1C\n#define KTRAP_FRAME_DR2 0x20\n#define KTRAP_FRAME_DR3 0x24\n#define KTRAP_FRAME_DR6 0x28\n#define KTRAP_FRAME_DR7 0x2C\n#define KTRAP_FRAME_GS 0x30\n#define KTRAP_FRAME_RESERVED1 0x32\n#define KTRAP_FRAME_ES 0x34\n#define KTRAP_FRAME_RESERVED2 0x36\n#define KTRAP_FRAME_DS 0x38\n#define KTRAP_FRAME_RESERVED3 0x3A\n#define KTRAP_FRAME_EDX 0x3C\n#define KTRAP_FRAME_ECX 0x40\n#define KTRAP_FRAME_EAX 0x44\n#define KTRAP_FRAME_PREVIOUS_MODE 0x48\n#define KTRAP_FRAME_EXCEPTION_LIST 0x4C\n#define KTRAP_FRAME_FS 0x50\n#define KTRAP_FRAME_RESERVED4 0x52\n#define KTRAP_FRAME_EDI 0x54\n#define KTRAP_FRAME_ESI 0x58\n#define KTRAP_FRAME_EBX 0x5C\n#define KTRAP_FRAME_EBP 0x60\n#define KTRAP_FRAME_ERROR_CODE 0x64\n#define KTRAP_FRAME_EIP 0x68\n#define KTRAP_FRAME_CS 0x6C\n#define KTRAP_FRAME_EFLAGS 0x70\n#define KTRAP_FRAME_ESP 0x74\n#define KTRAP_FRAME_SS 0x78\n#define KTRAP_FRAME_RESERVED5 0x7A\n#define KTRAP_FRAME_V86_ES 0x7C\n#define KTRAP_FRAME_RESERVED6 0x7E\n#define KTRAP_FRAME_V86_DS 0x80\n#define KTRAP_FRAME_RESERVED7 0x82\n#define KTRAP_FRAME_V86_FS 0x84\n#define KTRAP_FRAME_RESERVED8 0x86\n#define KTRAP_FRAME_V86_GS 0x88\n#define KTRAP_FRAME_RESERVED9 0x8A\n#define KTRAP_FRAME_SIZE 0x8C\n#define KTRAP_FRAME_LENGTH 0x8C\n#define KTRAP_FRAME_ALIGN 0x04\n#define FRAME_EDITED 0xFFF8\n\n//\n// KUSER_SHARED_DATA Offsets\n//\n#ifdef __ASM__\n#define USER_SHARED_DATA 0xFFDF0000\n#endif\n#define USER_SHARED_DATA_INTERRUPT_TIME 0x8\n#define USER_SHARED_DATA_SYSTEM_TIME 0x14\n#define USER_SHARED_DATA_TICK_COUNT 0x320\n\n//\n// KUSER_SHARED_DATA Offsets (this stuff is trash)\n//\n#define KERNEL_USER_SHARED_DATA 0x7FFE0000\n#define KUSER_SHARED_PROCESSOR_FEATURES KERNEL_USER_SHARED_DATA + 0x274\n#define KUSER_SHARED_SYSCALL KERNEL_USER_SHARED_DATA + 0x300\n#define KUSER_SHARED_SYSCALL_RET KERNEL_USER_SHARED_DATA + 0x304\n#define PROCESSOR_FEATURE_FXSR KUSER_SHARED_PROCESSOR_FEATURES + 0x4\n\n//\n// CONTEXT Offsets\n//\n#define CONTEXT_FLAGS 0x0\n#define CONTEXT_DR6 0x14\n#define CONTEXT_FLOAT_SAVE 0x1C\n#define CONTEXT_SEGGS 0x8C\n#define CONTEXT_SEGFS 0x90\n#define CONTEXT_SEGES 0x94\n#define CONTEXT_SEGDS 0x98\n#define CONTEXT_EDI 0x9C\n#define CONTEXT_ESI 0xA0\n#define CONTEXT_EBX 0xA4\n#define CONTEXT_EDX 0xA8\n#define CONTEXT_ECX 0xAC\n#define CONTEXT_EAX 0xB0\n#define CONTEXT_EBP 0xB4\n#define CONTEXT_EIP 0xB8\n#define CONTEXT_SEGCS 0xBC\n#define CONTEXT_EFLAGS 0xC0\n#define CONTEXT_ESP 0xC4\n#define CONTEXT_SEGSS 0xC8\n#define CONTEXT_FLOAT_SAVE_CONTROL_WORD CONTEXT_FLOAT_SAVE + FP_CONTROL_WORD\n#define CONTEXT_FLOAT_SAVE_STATUS_WORD CONTEXT_FLOAT_SAVE + FP_STATUS_WORD\n#define CONTEXT_FLOAT_SAVE_TAG_WORD CONTEXT_FLOAT_SAVE + FP_TAG_WORD\n#define CONTEXT_ALIGNED_SIZE 0x2CC\n\n//\n// EXCEPTION_RECORD Offsets\n//\n#define EXCEPTION_RECORD_EXCEPTION_CODE 0x0\n#define EXCEPTION_RECORD_EXCEPTION_FLAGS 0x4\n#define EXCEPTION_RECORD_EXCEPTION_RECORD 0x8\n#define EXCEPTION_RECORD_EXCEPTION_ADDRESS 0xC\n#define EXCEPTION_RECORD_NUMBER_PARAMETERS 0x10\n#define SIZEOF_EXCEPTION_RECORD 0x14\n#define EXCEPTION_RECORD_LENGTH 0x50\n\n//\n// Exception types\n//\n#ifdef __ASM__\n#define EXCEPTION_NONCONTINUABLE 0x0001\n#define EXCEPTION_UNWINDING 0x0002\n#define EXCEPTION_EXIT_UNWIND 0x0004\n#define EXCEPTION_STACK_INVALID 0x0008\n#define EXCEPTION_NESTED_CALL 0x00010\n#define EXCEPTION_TARGET_UNWIND 0x00020\n#define EXCEPTION_COLLIDED_UNWIND 0x00040\n#define EXCEPTION_UNWIND 0x00066\n#define EXCEPTION_EXECUTE_HANDLER 0x00001\n#define EXCEPTION_CONTINUE_SEARCH 0x00000\n#define EXCEPTION_CONTINUE_EXECUTION 0xFFFFFFFF\n#define EXCEPTION_CHAIN_END 0xFFFFFFFF\n#endif\n\n//\n// TEB Offsets\n//\n#define TEB_EXCEPTION_LIST 0x0\n#define TEB_STACK_BASE 0x4\n#define TEB_STACK_LIMIT 0x8\n#define TEB_FIBER_DATA 0x10\n#define TEB_PEB 0x30\n#define TEB_EXCEPTION_CODE 0x1A4\n#define TEB_ACTIVATION_CONTEXT_STACK_POINTER 0x1A8\n#define TEB_DEALLOCATION_STACK 0xE0C\n#define TEB_GDI_BATCH_COUNT 0xF70\n#define TEB_GUARANTEED_STACK_BYTES 0xF78\n#define TEB_FLS_DATA 0xFB4\n\n//\n// PEB Offsets\n//\n#define PEB_KERNEL_CALLBACK_TABLE 0x2C\n\n//\n// FIBER Offsets\n//\n#define FIBER_PARAMETER 0x0\n#define FIBER_EXCEPTION_LIST 0x4\n#define FIBER_STACK_BASE 0x8\n#define FIBER_STACK_LIMIT 0xC\n#define FIBER_DEALLOCATION_STACK 0x10\n#define FIBER_CONTEXT 0x14\n#define FIBER_GUARANTEED_STACK_BYTES 0x2E0\n#define FIBER_FLS_DATA 0x2E4\n#define FIBER_ACTIVATION_CONTEXT_STACK 0x2E8\n#define FIBER_CONTEXT_FLAGS FIBER_CONTEXT + CONTEXT_FLAGS\n#define FIBER_CONTEXT_EAX FIBER_CONTEXT + CONTEXT_EAX\n#define FIBER_CONTEXT_EBX FIBER_CONTEXT + CONTEXT_EBX\n#define FIBER_CONTEXT_ECX FIBER_CONTEXT + CONTEXT_ECX\n#define FIBER_CONTEXT_EDX FIBER_CONTEXT + CONTEXT_EDX\n#define FIBER_CONTEXT_ESI FIBER_CONTEXT + CONTEXT_ESI\n#define FIBER_CONTEXT_EDI FIBER_CONTEXT + CONTEXT_EDI\n#define FIBER_CONTEXT_EBP FIBER_CONTEXT + CONTEXT_EBP\n#define FIBER_CONTEXT_ESP FIBER_CONTEXT + CONTEXT_ESP\n#define FIBER_CONTEXT_DR6 FIBER_CONTEXT + CONTEXT_DR6\n#define FIBER_CONTEXT_FLOAT_SAVE_STATUS_WORD FIBER_CONTEXT + CONTEXT_FLOAT_SAVE_STATUS_WORD\n#define FIBER_CONTEXT_FLOAT_SAVE_CONTROL_WORD FIBER_CONTEXT + CONTEXT_FLOAT_SAVE_CONTROL_WORD\n#define FIBER_CONTEXT_FLOAT_SAVE_TAG_WORD FIBER_CONTEXT + CONTEXT_FLOAT_SAVE_TAG_WORD\n\n//\n// EFLAGS\n//\n#ifdef __ASM__\n#define EFLAGS_TF 0x100\n#define EFLAGS_INTERRUPT_MASK 0x200\n#define EFLAGS_NESTED_TASK 0x4000\n#define EFLAGS_V86_MASK 0x20000\n#define EFLAGS_ALIGN_CHECK 0x40000\n#define EFLAGS_VIF 0x80000\n#define EFLAGS_VIP 0x100000\n#define EFLAG_SIGN 0x8000\n#define EFLAG_ZERO 0x4000\n#define EFLAG_SELECT (EFLAG_SIGN + EFLAG_ZERO)\n#endif\n#define EFLAGS_USER_SANITIZE 0x3F4DD7\n\n//\n// CR0\n//\n#define CR0_PE 0x1\n#define CR0_MP 0x2\n#define CR0_EM 0x4\n#define CR0_TS 0x8\n#define CR0_ET 0x10\n#define CR0_NE 0x20\n#define CR0_WP 0x10000\n#define CR0_AM 0x40000\n#define CR0_NW 0x20000000\n#define CR0_CD 0x40000000\n#define CR0_PG 0x80000000\n\n//\n// CR4\n//\n#ifdef __ASM__\n#define CR4_VME 0x1\n#define CR4_PVI 0x2\n#define CR4_TSD 0x4\n#define CR4_DE 0x8\n#define CR4_PSE 0x10\n#define CR4_PAE 0x20\n#define CR4_MCE 0x40\n#define CR4_PGE 0x80\n#define CR4_FXSR 0x200\n#define CR4_XMMEXCPT 0x400\n#endif\n\n//\n// DR6 and 7 Masks\n//\n#define DR6_LEGAL 0xE00F\n#define DR7_LEGAL 0xFFFF0155\n#define DR7_ACTIVE 0x55\n#define DR7_OVERRIDE_V 0x04\n#define DR7_RESERVED_MASK 0xDC00\n#define DR7_OVERRIDE_MASK 0xF0000\n\n//\n// Usermode callout frame definitions\n//\n#define CBSTACK_STACK 0x0\n#define CBSTACK_TRAP_FRAME 0x4\n#define CBSTACK_CALLBACK_STACK 0x8\n#define CBSTACK_EBP 0x18\n#define CBSTACK_RESULT 0x20\n#define CBSTACK_RESULT_LENGTH 0x24\n\n//\n// NTSTATUS and Bugcheck Codes\n//\n#ifdef __ASM__\n#define STATUS_ACCESS_VIOLATION 0xC0000005\n#define STATUS_IN_PAGE_ERROR 0xC0000006\n#define STATUS_GUARD_PAGE_VIOLATION 0x80000001\n#define STATUS_PRIVILEGED_INSTRUCTION 0xC0000096\n#define STATUS_STACK_OVERFLOW 0xC00000FD\n#define KI_EXCEPTION_ACCESS_VIOLATION 0x10000004\n#define STATUS_INVALID_SYSTEM_SERVICE 0xC000001C\n#define STATUS_NO_CALLBACK_ACTIVE 0xC0000258\n#define STATUS_CALLBACK_POP_STACK 0xC0000423\n#define STATUS_ARRAY_BOUNDS_EXCEEDED 0xC000008C\n#define STATUS_ILLEGAL_INSTRUCTION 0xC000001D\n#define STATUS_INVALID_LOCK_SEQUENCE 0xC000001E\n#define STATUS_BREAKPOINT 0x80000003\n#define STATUS_SINGLE_STEP 0x80000004\n#define STATUS_INTEGER_DIVIDE_BY_ZERO 0xC0000094\n#define STATUS_INTEGER_OVERFLOW 0xC0000095\n#define STATUS_FLOAT_DENORMAL_OPERAND 0xC000008D\n#define STATUS_FLOAT_DIVIDE_BY_ZERO 0xC000008E\n#define STATUS_FLOAT_INEXACT_RESULT 0xC000008F\n#define STATUS_FLOAT_INVALID_OPERATION 0xC0000090\n#define STATUS_FLOAT_OVERFLOW 0xC0000091\n#define STATUS_FLOAT_STACK_CHECK 0xC0000092\n#define STATUS_FLOAT_UNDERFLOW 0xC0000093\n#define STATUS_FLOAT_MULTIPLE_FAULTS 0xC00002B4\n#define STATUS_FLOAT_MULTIPLE_TRAPS 0xC00002B5\n#define APC_INDEX_MISMATCH 0x01\n#define IRQL_NOT_GREATER_OR_EQUAL 0x09\n#define IRQL_NOT_LESS_OR_EQUAL 0x0A\n#define TRAP_CAUSE_UNKNOWN 0x12\n#define KMODE_EXCEPTION_NOT_HANDLED 0x13\n#define IRQL_GT_ZERO_AT_SYSTEM_SERVICE 0x4A\n#define UNEXPECTED_KERNEL_MODE_TRAP 0x7F\n#define ATTEMPTED_SWITCH_FROM_DPC 0xB8\n#define HARDWARE_INTERRUPT_STORM 0xF2\n\n//\n// IRQL Levels\n//\n#define PASSIVE_LEVEL 0x0\n#define APC_LEVEL 0x1\n#define DISPATCH_LEVEL 0x2\n#define CLOCK2_LEVEL 0x1C\n#define HIGH_LEVEL 0x1F\n\n//\n// Quantum Decrements\n//\n#define CLOCK_QUANTUM_DECREMENT 0x3\n#endif\n\n//\n// System Call Table definitions\n//\n#define NUMBER_SERVICE_TABLES 0x0002\n#define SERVICE_NUMBER_MASK 0x0FFF\n#define SERVICE_TABLE_SHIFT 0x0008\n#define SERVICE_TABLE_MASK 0x0010\n#define SERVICE_TABLE_TEST 0x0010\n#define SERVICE_DESCRIPTOR_BASE 0x0000\n#define SERVICE_DESCRIPTOR_COUNT 0x0004\n#define SERVICE_DESCRIPTOR_LIMIT 0x0008\n#define SERVICE_DESCRIPTOR_NUMBER 0x000C\n#define SERVICE_DESCRIPTOR_LENGTH 0x0010\n\n//\n// VDM State Pointer\n//\n#define FIXED_NTVDMSTATE_LINEAR_PC_AT 0x714\n\n//\n// Machine types\n//\n#ifdef __ASM__\n#define MACHINE_TYPE_ISA 0x0000\n#define MACHINE_TYPE_EISA 0x0001\n#define MACHINE_TYPE_MCA 0x0002\n\n//\n// Kernel Feature Bits\n//\n#define KF_RDTSC 0x00000002\n\n//\n// Kernel Stack Size\n//\n#define KERNEL_STACK_SIZE 0x3000\n#endif\n\n//\n// Generic Definitions\n//\n#define PRIMARY_VECTOR_BASE 0x30 // FIXME: HACK\n#define MAXIMUM_IDTVECTOR 0xFF\n#endif // !_ASM_H\n\n\n\n\n\n" }, { "path": "ndk/cctypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n cctypes.h\n\nAbstract:\n\n Type definitions for the Cache Controller.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _CCTYPES_H\n#define _CCTYPES_H\n\n//\n// Dependencies\n//\n#include \n\n#ifndef NTOS_MODE_USER\n\n//\n// Kernel Exported CcData\n//\nextern ULONG NTSYSAPI CcFastReadNotPossible;\nextern ULONG NTSYSAPI CcFastReadWait;\nextern ULONG NTSYSAPI CcFastReadResourceMiss;\nextern ULONG NTSYSAPI CcFastReadNoWait;\nextern ULONG NTSYSAPI CcFastMdlReadNotPossible;\n\n//\n// Virtual Address Control BLock\n//\ntypedef struct _VACB\n{\n PVOID BaseAddress;\n struct _SHARED_CACHE_MAP *SharedCacheMap;\n union\n {\n LARGE_INTEGER FileOffset;\n USHORT ActiveCount;\n } Overlay;\n LIST_ENTRY LruList;\n} VACB, *PVACB;\n\n//\n// Private Cache Map Structure and Flags\n//\ntypedef struct _PRIVATE_CACHE_MAP_FLAGS\n{\n ULONG DontUse:16;\n ULONG ReadAheadActive:1;\n ULONG ReadAheadEnabled:1;\n ULONG Available:14;\n} PRIVATE_CACHE_MAP_FLAGS;\n\ntypedef struct _PRIVATE_CACHE_MAP\n{\n union\n {\n CSHORT NodeTypeCode;\n PRIVATE_CACHE_MAP_FLAGS Flags;\n ULONG UlongFlags;\n };\n ULONG ReadAheadMask;\n PFILE_OBJECT FileObject;\n LARGE_INTEGER FileOffset1;\n LARGE_INTEGER BeyondLastByte1;\n LARGE_INTEGER FileOffset2;\n LARGE_INTEGER BeyondLastByte2;\n LARGE_INTEGER ReadAheadOffset[2];\n ULONG ReadAheadLength[2];\n KSPIN_LOCK ReadAheadSpinLock;\n LIST_ENTRY PrivateLinks;\n} PRIVATE_CACHE_MAP, *PPRIVATE_CACHE_MAP;\n\n#ifdef _NTIFS_INCLUDED_\n\n//\n// Shared Cache Map\n//\ntypedef struct _SHARED_CACHE_MAP\n{\n SHORT NodeTypeCode;\n SHORT NodeByteSize;\n ULONG OpenCount;\n LARGE_INTEGER FileSize;\n LIST_ENTRY BcbList;\n LARGE_INTEGER SectionSize;\n LARGE_INTEGER ValidDataLength;\n LARGE_INTEGER ValidDataGoal;\n PVACB InitialVacbs[4];\n PVACB Vacbs;\n PFILE_OBJECT FileObject;\n PVACB ActiveVacb;\n PVOID NeedToZero;\n ULONG ActivePage;\n ULONG NeedToZeroPage;\n ULONG ActiveVacbSpinLock;\n ULONG VacbActiveCount;\n ULONG DirtyPages;\n LIST_ENTRY SharedCacheMapLinks;\n ULONG Flags;\n ULONG Status;\n PMCB Mbcb;\n PVOID Section;\n PKEVENT CreateEvent;\n PKEVENT WaitOnActiveCount;\n ULONG PagesToWrite;\n LONGLONG BeyondLastFlush;\n PCACHE_MANAGER_CALLBACKS Callbacks;\n PVOID LazyWriteContext;\n PLIST_ENTRY PrivateList;\n PVOID LogHandle;\n PVOID FlushToLsnRoutine;\n ULONG DirtyPageThreshold;\n ULONG LazyWritePassCount;\n PCACHE_UNINITIALIZE_EVENT UninitializeEvent;\n PVACB NeedToZeroVacb;\n ULONG BcbSpinLock;\n PVOID Reserved;\n KEVENT Event;\n PEX_PUSH_LOCK VacbPushLock;\n PPRIVATE_CACHE_MAP PrivateCacheMap;\n} SHARED_CACHE_MAP;\n\n#endif /* _NTIFS_INCLUDED_ */\n#endif /* NTOS_MODE_USER */\n#endif /* _CCTYPES_H */\n\n" }, { "path": "ndk/cmfuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n cmfuncs.h\n\nAbstract:\n\n Function definitions for the Configuration Manager.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _CMFUNCS_H\n#define _CMFUNCS_H\n\n//\n// Dependencies\n//\n#include \n#include \n\n//\n// Native calls\n//\nNTSTATUS\nNTAPI\nNtCompactKeys(\n IN ULONG Count,\n IN PHANDLE KeyArray\n);\n\nNTSTATUS\nNTAPI\nNtCompressKey(\n IN HANDLE Key\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateKey(\n OUT PHANDLE KeyHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN ULONG TitleIndex,\n IN PUNICODE_STRING Class OPTIONAL,\n IN ULONG CreateOptions,\n IN PULONG Disposition OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteKey(\n IN HANDLE KeyHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteValueKey(\n IN HANDLE KeyHandle,\n IN PUNICODE_STRING ValueName\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtEnumerateKey(\n IN HANDLE KeyHandle,\n IN ULONG Index,\n IN KEY_INFORMATION_CLASS KeyInformationClass,\n OUT PVOID KeyInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtEnumerateValueKey(\n IN HANDLE KeyHandle,\n IN ULONG Index,\n IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,\n OUT PVOID KeyValueInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFlushKey(\n IN HANDLE KeyHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtGetPlugPlayEvent(\n IN ULONG Reserved1,\n IN ULONG Reserved2,\n OUT PPLUGPLAY_EVENT_BLOCK Buffer,\n IN ULONG BufferSize\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtInitializeRegistry(\n USHORT Flag\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtLoadKey(\n IN POBJECT_ATTRIBUTES KeyObjectAttributes,\n IN POBJECT_ATTRIBUTES FileObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtLoadKey2(\n IN POBJECT_ATTRIBUTES KeyObjectAttributes,\n IN POBJECT_ATTRIBUTES FileObjectAttributes,\n IN ULONG Flags\n);\n\nNTSTATUS\nNTAPI\nNtLoadKeyEx(\n IN POBJECT_ATTRIBUTES TargetKey,\n IN POBJECT_ATTRIBUTES SourceFile,\n IN ULONG Flags,\n IN HANDLE TrustClassKey\n);\n\nNTSTATUS\nNTAPI\nNtLockProductActivationKeys(\n IN PULONG pPrivateVer,\n IN PULONG pSafeMode\n);\n\nNTSTATUS\nNTAPI\nNtLockRegistryKey(\n IN HANDLE KeyHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtNotifyChangeKey(\n IN HANDLE KeyHandle,\n IN HANDLE Event,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG CompletionFilter,\n IN BOOLEAN Asynchroneous,\n OUT PVOID ChangeBuffer,\n IN ULONG Length,\n IN BOOLEAN WatchSubtree\n);\n\nNTSTATUS\nNTAPI\nNtNotifyChangeMultipleKeys(\n IN HANDLE MasterKeyHandle,\n IN ULONG Count,\n IN POBJECT_ATTRIBUTES SlaveObjects,\n IN HANDLE Event,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG CompletionFilter,\n IN BOOLEAN WatchTree,\n OUT PVOID Buffer,\n IN ULONG Length,\n IN BOOLEAN Asynchronous\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenKey(\n OUT PHANDLE KeyHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPlugPlayControl(\n IN PLUGPLAY_CONTROL_CLASS PlugPlayControlClass,\n IN OUT PVOID Buffer,\n IN ULONG BufferSize\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryKey(\n IN HANDLE KeyHandle,\n IN KEY_INFORMATION_CLASS KeyInformationClass,\n OUT PVOID KeyInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryMultipleValueKey(\n IN HANDLE KeyHandle,\n IN OUT PKEY_VALUE_ENTRY ValueList,\n IN ULONG NumberOfValues,\n OUT PVOID Buffer,\n IN OUT PULONG Length,\n OUT PULONG ReturnLength\n);\n\nNTSTATUS\nNTAPI\nNtQueryOpenSubKeys(\n IN POBJECT_ATTRIBUTES TargetKey,\n IN ULONG HandleCount\n);\n\nNTSTATUS\nNTAPI\nNtQueryOpenSubKeysEx(\n IN POBJECT_ATTRIBUTES TargetKey,\n IN ULONG BufferLength,\n IN PVOID Buffer,\n IN PULONG RequiredSize\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryValueKey(\n IN HANDLE KeyHandle,\n IN PUNICODE_STRING ValueName,\n IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,\n OUT PVOID KeyValueInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRenameKey(\n IN HANDLE KeyHandle,\n IN PUNICODE_STRING ReplacementName\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReplaceKey(\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN HANDLE Key,\n IN POBJECT_ATTRIBUTES ReplacedObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRestoreKey(\n IN HANDLE KeyHandle,\n IN HANDLE FileHandle,\n IN ULONG RestoreFlags\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSaveKey(\n IN HANDLE KeyHandle,\n IN HANDLE FileHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSaveKeyEx(\n IN HANDLE KeyHandle,\n IN HANDLE FileHandle,\n IN ULONG Flags\n);\n\n\nNTSTATUS\nNTAPI\nNtSaveMergedKeys(\n IN HANDLE HighPrecedenceKeyHandle,\n IN HANDLE LowPrecedenceKeyHandle,\n IN HANDLE FileHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationKey(\n IN HANDLE KeyHandle,\n IN KEY_SET_INFORMATION_CLASS KeyInformationClass,\n IN PVOID KeyInformation,\n IN ULONG KeyInformationLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetValueKey(\n IN HANDLE KeyHandle,\n IN PUNICODE_STRING ValueName,\n IN ULONG TitleIndex OPTIONAL,\n IN ULONG Type,\n IN PVOID Data,\n IN ULONG DataSize\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnloadKey(\n IN POBJECT_ATTRIBUTES KeyObjectAttributes\n);\n\nNTSTATUS\nNTAPI\nNtUnloadKey2(\n IN POBJECT_ATTRIBUTES TargetKey,\n IN ULONG Flags\n);\n\nNTSTATUS\nNTAPI\nNtUnloadKeyEx(\n IN POBJECT_ATTRIBUTES TargetKey,\n IN HANDLE Event\n);\n\n#ifdef NTOS_MODE_USER\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateKey(\n OUT PHANDLE KeyHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN ULONG TitleIndex,\n IN PUNICODE_STRING Class OPTIONAL,\n IN ULONG CreateOptions,\n IN PULONG Disposition OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDeleteKey(\n IN HANDLE KeyHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDeleteValueKey(\n IN HANDLE KeyHandle,\n IN PUNICODE_STRING ValueName\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwEnumerateKey(\n IN HANDLE KeyHandle,\n IN ULONG Index,\n IN KEY_INFORMATION_CLASS KeyInformationClass,\n OUT PVOID KeyInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwEnumerateValueKey(\n IN HANDLE KeyHandle,\n IN ULONG Index,\n IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,\n OUT PVOID KeyValueInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwFlushKey(\n IN HANDLE KeyHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwGetPlugPlayEvent(\n IN ULONG Reserved1,\n IN ULONG Reserved2,\n OUT PPLUGPLAY_EVENT_BLOCK Buffer,\n IN ULONG BufferSize\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwLoadKey(\n IN POBJECT_ATTRIBUTES KeyObjectAttributes,\n IN POBJECT_ATTRIBUTES FileObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwLoadKey2(\n IN POBJECT_ATTRIBUTES KeyObjectAttributes,\n IN POBJECT_ATTRIBUTES FileObjectAttributes,\n IN ULONG Flags\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwNotifyChangeKey(\n IN HANDLE KeyHandle,\n IN HANDLE Event,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG CompletionFilter,\n IN BOOLEAN Asynchroneous,\n OUT PVOID ChangeBuffer,\n IN ULONG Length,\n IN BOOLEAN WatchSubtree\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenKey(\n OUT PHANDLE KeyHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwPlugPlayControl(\n IN PLUGPLAY_CONTROL_CLASS PlugPlayControlClass,\n IN OUT PVOID Buffer,\n IN ULONG BufferSize\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryKey(\n IN HANDLE KeyHandle,\n IN KEY_INFORMATION_CLASS KeyInformationClass,\n OUT PVOID KeyInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryMultipleValueKey(\n IN HANDLE KeyHandle,\n IN OUT PKEY_VALUE_ENTRY ValueList,\n IN ULONG NumberOfValues,\n OUT PVOID Buffer,\n IN OUT PULONG Length,\n OUT PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryValueKey(\n IN HANDLE KeyHandle,\n IN PUNICODE_STRING ValueName,\n IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,\n OUT PVOID KeyValueInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwReplaceKey(\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN HANDLE Key,\n IN POBJECT_ATTRIBUTES ReplacedObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwRestoreKey(\n IN HANDLE KeyHandle,\n IN HANDLE FileHandle,\n IN ULONG RestoreFlags\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSaveKey(\n IN HANDLE KeyHandle,\n IN HANDLE FileHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSaveKeyEx(\n IN HANDLE KeyHandle,\n IN HANDLE FileHandle,\n IN ULONG Flags\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetInformationKey(\n IN HANDLE KeyHandle,\n IN KEY_SET_INFORMATION_CLASS KeyInformationClass,\n IN PVOID KeyInformation,\n IN ULONG KeyInformationLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetValueKey(\n IN HANDLE KeyHandle,\n IN PUNICODE_STRING ValueName,\n IN ULONG TitleIndex OPTIONAL,\n IN ULONG Type,\n IN PVOID Data,\n IN ULONG DataSize\n);\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwInitializeRegistry(\n USHORT Flag\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwUnloadKey(\n IN POBJECT_ATTRIBUTES KeyObjectAttributes\n);\n\n#endif\n" }, { "path": "ndk/cmtypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n cmtypes.h\n\nAbstract:\n\n Type definitions for the Configuration Manager.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _CMTYPES_H\n#define _CMTYPES_H\n\n//\n// Dependencies\n//\n#include \n#include \n#include \n\n#define MAX_BUS_NAME 24\n\n//\n// PLUGPLAY_CONTROL_RELATED_DEVICE_DATA.Relations\n//\n#define PNP_GET_PARENT_DEVICE 1\n#define PNP_GET_CHILD_DEVICE 2\n#define PNP_GET_SIBLING_DEVICE 3\n\n//\n// PLUGPLAY_CONTROL_STATUS_DATA Operations\n//\n#define PNP_GET_DEVICE_STATUS 0\n#define PNP_SET_DEVICE_STATUS 1\n#define PNP_CLEAR_DEVICE_STATUS 2\n\n#ifdef NTOS_MODE_USER\n\n//\n// Resource Type\n//\n#define CmResourceTypeNull 0\n#define CmResourceTypePort 1\n#define CmResourceTypeInterrupt 2\n#define CmResourceTypeMemory 3\n#define CmResourceTypeDma 4\n#define CmResourceTypeDeviceSpecific 5\n#define CmResourceTypeBusNumber 6\n#define CmResourceTypeMaximum 7\n#define CmResourceTypeNonArbitrated 128\n#define CmResourceTypeConfigData 128\n#define CmResourceTypeDevicePrivate 129\n#define CmResourceTypePcCardConfig 130\n#define CmResourceTypeMfCardConfig 131\n\n\n//\n// Resource Descriptor Share Dispositions\n//\ntypedef enum _CM_SHARE_DISPOSITION\n{\n CmResourceShareUndetermined,\n CmResourceShareDeviceExclusive,\n CmResourceShareDriverExclusive,\n CmResourceShareShared\n} CM_SHARE_DISPOSITION;\n\n#endif\n\n//\n// Port Resource Descriptor Flags\n//\n#define CM_RESOURCE_PORT_MEMORY 0x0000\n#define CM_RESOURCE_PORT_IO 0x0001\n#define CM_RESOURCE_PORT_10_BIT_DECODE 0x0004\n#define CM_RESOURCE_PORT_12_BIT_DECODE 0x0008\n#define CM_RESOURCE_PORT_16_BIT_DECODE 0x0010\n#define CM_RESOURCE_PORT_POSITIVE_DECODE 0x0020\n#define CM_RESOURCE_PORT_PASSIVE_DECODE 0x0040\n#define CM_RESOURCE_PORT_WINDOW_DECODE 0x0080\n\n//\n// Memory Resource Descriptor Flags\n//\n#define CM_RESOURCE_MEMORY_READ_WRITE 0x0000\n#define CM_RESOURCE_MEMORY_READ_ONLY 0x0001\n#define CM_RESOURCE_MEMORY_WRITE_ONLY 0x0002\n#define CM_RESOURCE_MEMORY_PREFETCHABLE 0x0004\n#define CM_RESOURCE_MEMORY_COMBINEDWRITE 0x0008\n#define CM_RESOURCE_MEMORY_24 0x0010\n#define CM_RESOURCE_MEMORY_CACHEABLE 0x0020\n\n//\n// DMA Resource Descriptor Flags\n//\n#define CM_RESOURCE_DMA_8 0x0000\n#define CM_RESOURCE_DMA_16 0x0001\n#define CM_RESOURCE_DMA_32 0x0002\n#define CM_RESOURCE_DMA_8_AND_16 0x0004\n#define CM_RESOURCE_DMA_BUS_MASTER 0x0008\n#define CM_RESOURCE_DMA_TYPE_A 0x0010\n#define CM_RESOURCE_DMA_TYPE_B 0x0020\n#define CM_RESOURCE_DMA_TYPE_F 0x0040\n\n//\n// NtInitializeRegistry Flags\n//\n#define CM_BOOT_FLAG_SMSS 0x0000\n#define CM_BOOT_FLAG_SETUP 0x0001\n#define CM_BOOT_FLAG_ACCEPTED 0x0002\n#define CM_BOOT_FLAG_MAX 0x03E9\n\n#ifdef NTOS_MODE_USER\n\n//\n// Information Classes for NtQueryKey\n//\ntypedef enum _KEY_INFORMATION_CLASS\n{\n KeyBasicInformation,\n KeyNodeInformation,\n KeyFullInformation,\n KeyNameInformation,\n KeyCachedInformation,\n KeyFlagsInformation\n} KEY_INFORMATION_CLASS;\n\ntypedef enum _KEY_VALUE_INFORMATION_CLASS\n{\n KeyValueBasicInformation,\n KeyValueFullInformation,\n KeyValuePartialInformation,\n KeyValueFullInformationAlign64,\n KeyValuePartialInformationAlign64\n} KEY_VALUE_INFORMATION_CLASS;\n\ntypedef enum _KEY_SET_INFORMATION_CLASS\n{\n KeyWriteTimeInformation,\n KeyUserFlagsInformation,\n MaxKeySetInfoClass\n} KEY_SET_INFORMATION_CLASS;\n\n#endif\n\n//\n// Plag and Play Classes\n//\ntypedef enum _PLUGPLAY_CONTROL_CLASS\n{\n PlugPlayControlUserResponse = 0x07,\n PlugPlayControlProperty = 0x0A,\n PlugPlayControlGetRelatedDevice = 0x0C,\n PlugPlayControlDeviceStatus = 0x0E,\n PlugPlayControlGetDeviceDepth,\n PlugPlayControlResetDevice = 0x14\n} PLUGPLAY_CONTROL_CLASS;\n\ntypedef enum _PLUGPLAY_BUS_CLASS\n{\n SystemBus,\n PlugPlayVirtualBus,\n MaxPlugPlayBusClass\n} PLUGPLAY_BUS_CLASS, *PPLUGPLAY_BUS_CLASS;\n\n//\n// Plag and Play Bus Types\n//\ntypedef enum _PLUGPLAY_VIRTUAL_BUS_TYPE\n{\n Root,\n MaxPlugPlayVirtualBusType\n} PLUGPLAY_VIRTUAL_BUS_TYPE, *PPLUGPLAY_VIRTUAL_BUS_TYPE;\n\n//\n// Plag and Play Event Categories\n//\ntypedef enum _PLUGPLAY_EVENT_CATEGORY\n{\n HardwareProfileChangeEvent,\n TargetDeviceChangeEvent,\n DeviceClassChangeEvent,\n CustomDeviceEvent,\n DeviceInstallEvent,\n DeviceArrivalEvent,\n PowerEvent,\n VetoEvent,\n BlockedDriverEvent,\n MaxPlugEventCategory\n} PLUGPLAY_EVENT_CATEGORY;\n\n#ifdef NTOS_MODE_USER\n\n//\n// Information Structures for NtQueryKeyInformation\n//\ntypedef struct _KEY_WRITE_TIME_INFORMATION\n{\n LARGE_INTEGER LastWriteTime;\n} KEY_WRITE_TIME_INFORMATION, *PKEY_WRITE_TIME_INFORMATION;\n\ntypedef struct _KEY_USER_FLAGS_INFORMATION\n{\n ULONG UserFlags;\n} KEY_USER_FLAGS_INFORMATION, *PKEY_USER_FLAGS_INFORMATION;\n\ntypedef struct _KEY_FULL_INFORMATION\n{\n LARGE_INTEGER LastWriteTime;\n ULONG TitleIndex;\n ULONG ClassOffset;\n ULONG ClassLength;\n ULONG SubKeys;\n ULONG MaxNameLen;\n ULONG MaxClassLen;\n ULONG Values;\n ULONG MaxValueNameLen;\n ULONG MaxValueDataLen;\n WCHAR Class[1];\n} KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION;\n\ntypedef struct _KEY_NAME_INFORMATION\n{\n WCHAR Name[1];\n} KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;\n\n\ntypedef struct _KEY_NODE_INFORMATION\n{\n LARGE_INTEGER LastWriteTime;\n ULONG TitleIndex;\n ULONG ClassOffset;\n ULONG ClassLength;\n ULONG NameLength;\n WCHAR Name[1];\n} KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION;\n\ntypedef struct _KEY_VALUE_ENTRY\n{\n PUNICODE_STRING ValueName;\n ULONG DataLength;\n ULONG DataOffset;\n ULONG Type;\n} KEY_VALUE_ENTRY, *PKEY_VALUE_ENTRY;\n\ntypedef struct _KEY_VALUE_PARTIAL_INFORMATION\n{\n ULONG TitleIndex;\n ULONG Type;\n ULONG DataLength;\n UCHAR Data[1];\n} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;\n\ntypedef struct _KEY_VALUE_BASIC_INFORMATION\n{\n ULONG TitleIndex;\n ULONG Type;\n ULONG NameLength;\n WCHAR Name[1];\n} KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION;\n\ntypedef struct _KEY_VALUE_FULL_INFORMATION\n{\n ULONG TitleIndex;\n ULONG Type;\n ULONG DataOffset;\n ULONG DataLength;\n ULONG NameLength;\n WCHAR Name[1];\n} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;\n\ntypedef struct _KEY_BASIC_INFORMATION\n{\n LARGE_INTEGER LastWriteTime;\n ULONG TitleIndex;\n ULONG NameLength;\n WCHAR Name[1];\n} KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;\n\n#endif\n\n//\n// Plug and Play Event Block\n//\ntypedef struct _PLUGPLAY_EVENT_BLOCK\n{\n GUID EventGuid;\n PLUGPLAY_EVENT_CATEGORY EventCategory;\n PULONG Result;\n ULONG Flags;\n ULONG TotalSize;\n PVOID DeviceObject;\n union\n {\n struct\n {\n GUID ClassGuid;\n WCHAR SymbolicLinkName[ANYSIZE_ARRAY];\n } DeviceClass;\n struct\n {\n WCHAR DeviceIds[ANYSIZE_ARRAY];\n } TargetDevice;\n struct\n {\n WCHAR DeviceId[ANYSIZE_ARRAY];\n } InstallDevice;\n struct\n {\n PVOID NotificationStructure;\n WCHAR DeviceIds[ANYSIZE_ARRAY];\n } CustomNotification;\n struct\n {\n PVOID Notification;\n } ProfileNotification;\n struct\n {\n ULONG NotificationCode;\n ULONG NotificationData;\n } PowerNotification;\n struct\n {\n PNP_VETO_TYPE VetoType;\n WCHAR DeviceIdVetoNameBuffer[ANYSIZE_ARRAY];\n } VetoNotification;\n struct\n {\n GUID BlockedDriverGuid;\n } BlockedDriverNotification;\n };\n} PLUGPLAY_EVENT_BLOCK, *PPLUGPLAY_EVENT_BLOCK;\n\n//\n// Plug and Play Control Classes\n//\n\n//Class 0x0A\ntypedef struct _PLUGPLAY_CONTROL_PROPERTY_DATA\n{\n UNICODE_STRING DeviceInstance;\n ULONG Property;\n PVOID Buffer;\n ULONG BufferSize;\n} PLUGPLAY_CONTROL_PROPERTY_DATA, *PPLUGPLAY_CONTROL_PROPERTY_DATA;\n\n// Class 0x0C\ntypedef struct _PLUGPLAY_CONTROL_RELATED_DEVICE_DATA\n{\n UNICODE_STRING TargetDeviceInstance;\n ULONG Relation;\n PWCHAR RelatedDeviceInstance;\n ULONG RelatedDeviceInstanceLength;\n} PLUGPLAY_CONTROL_RELATED_DEVICE_DATA, *PPLUGPLAY_CONTROL_RELATED_DEVICE_DATA;\n\n// Class 0x0E\ntypedef struct _PLUGPLAY_CONTOL_STATUS_DATA\n{\n UNICODE_STRING DeviceInstance;\n ULONG Operation;\n ULONG DeviceStatus;\n ULONG DeviceProblem;\n} PLUGPLAY_CONTROL_STATUS_DATA, *PPLUGPLAY_CONTROL_STATUS_DATA;\n\n// Class 0x0F\ntypedef struct _PLUGPLAY_CONTROL_DEPTH_DATA\n{\n UNICODE_STRING DeviceInstance;\n ULONG Depth;\n} PLUGPLAY_CONTROL_DEPTH_DATA, *PPLUGPLAY_CONTROL_DEPTH_DATA;\n\n// Class 0x14\ntypedef struct _PLUGPLAY_CONTROL_RESET_DEVICE_DATA\n{\n UNICODE_STRING DeviceInstance;\n} PLUGPLAY_CONTROL_RESET_DEVICE_DATA, *PPLUGPLAY_CONTROL_RESET_DEVICE_DATA;\n\n//\n// Plug and Play Bus Type Definition\n//\ntypedef struct _PLUGPLAY_BUS_TYPE\n{\n PLUGPLAY_BUS_CLASS BusClass;\n union\n {\n INTERFACE_TYPE SystemBusType;\n PLUGPLAY_VIRTUAL_BUS_TYPE PlugPlayVirtualBusType;\n };\n} PLUGPLAY_BUS_TYPE, *PPLUGPLAY_BUS_TYPE;\n\n//\n// Plug and Play Bus Instance Definition\n//\ntypedef struct _PLUGPLAY_BUS_INSTANCE\n{\n PLUGPLAY_BUS_TYPE BusType;\n ULONG BusNumber;\n WCHAR BusName[MAX_BUS_NAME];\n} PLUGPLAY_BUS_INSTANCE, *PPLUGPLAY_BUS_INSTANCE;\n\n#ifdef NTOS_MODE_USER\n\n//\n// Partial Resource Descriptor and List for Hardware\n//\n#include \ntypedef struct _CM_PARTIAL_RESOURCE_DESCRIPTOR\n{\n UCHAR Type;\n UCHAR ShareDisposition;\n USHORT Flags;\n union\n {\n struct\n {\n PHYSICAL_ADDRESS Start;\n ULONG Length;\n } Generic;\n struct\n {\n PHYSICAL_ADDRESS Start;\n ULONG Length;\n } Port;\n struct\n {\n ULONG Level;\n ULONG Vector;\n ULONG Affinity;\n } Interrupt;\n struct\n {\n PHYSICAL_ADDRESS Start;\n ULONG Length;\n } Memory;\n struct\n {\n ULONG Channel;\n ULONG Port;\n ULONG Reserved1;\n } Dma;\n struct\n {\n ULONG Data[3];\n } DevicePrivate;\n struct\n {\n ULONG Start;\n ULONG Length;\n ULONG Reserved;\n } BusNumber;\n struct\n {\n ULONG DataSize;\n ULONG Reserved1;\n ULONG Reserved2;\n } DeviceSpecificData;\n } u;\n} CM_PARTIAL_RESOURCE_DESCRIPTOR, *PCM_PARTIAL_RESOURCE_DESCRIPTOR;\n\ntypedef struct _CM_PARTIAL_RESOURCE_LIST\n{\n USHORT Version;\n USHORT Revision;\n ULONG Count;\n CM_PARTIAL_RESOURCE_DESCRIPTOR PartialDescriptors[1];\n} CM_PARTIAL_RESOURCE_LIST, *PCM_PARTIAL_RESOURCE_LIST;\n\n//\n// Full Resource Descriptor and List for Hardware\n//\ntypedef struct _CM_FULL_RESOURCE_DESCRIPTOR\n{\n INTERFACE_TYPE InterfaceType;\n ULONG BusNumber;\n CM_PARTIAL_RESOURCE_LIST PartialResourceList;\n} CM_FULL_RESOURCE_DESCRIPTOR, *PCM_FULL_RESOURCE_DESCRIPTOR;\n\ntypedef struct _CM_RESOURCE_LIST\n{\n ULONG Count;\n CM_FULL_RESOURCE_DESCRIPTOR List[1];\n} CM_RESOURCE_LIST, *PCM_RESOURCE_LIST;\n\n//\n// ROM Block Structure\n//\ntypedef struct _CM_ROM_BLOCK\n{\n ULONG Address;\n ULONG Size;\n} CM_ROM_BLOCK, *PCM_ROM_BLOCK;\n\n//\n// Disk/INT13 Structures\n//\ntypedef struct _CM_INT13_DRIVE_PARAMETER\n{\n USHORT DriveSelect;\n ULONG MaxCylinders;\n USHORT SectorsPerTrack;\n USHORT MaxHeads;\n USHORT NumberDrives;\n} CM_INT13_DRIVE_PARAMETER, *PCM_INT13_DRIVE_PARAMETER;\n\ntypedef struct _CM_DISK_GEOMETRY_DEVICE_DATA\n{\n ULONG BytesPerSector;\n ULONG NumberOfCylinders;\n ULONG SectorsPerTrack;\n ULONG NumberOfHeads;\n} CM_DISK_GEOMETRY_DEVICE_DATA, *PCM_DISK_GEOMETRY_DEVICE_DATA;\n\n#include \n\n#endif // _!NTOS_MODE_USER\n\n#endif // _CMTYPES_H\n\n\n\n" }, { "path": "ndk/dbgkfuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n dbgkfuncs.h\n\nAbstract:\n\n Function definitions for the User Mode Debugging Facility.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _DBGKFUNCS_H\n#define _DBGKFUNCS_H\n\n//\n// Dependencies\n//\n#include \n#include \n\n//\n// Native calls\n//\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDebugActiveProcess(\n IN HANDLE Process,\n IN HANDLE DebugObject\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateDebugObject(\n OUT PHANDLE DebugHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN BOOLEAN KillProcessOnExit\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDebugContinue(\n IN HANDLE DebugObject,\n IN PCLIENT_ID AppClientId,\n IN NTSTATUS ContinueStatus\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitForDebugEvent(\n IN HANDLE DebugObject,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Timeout OPTIONAL,\n OUT PDBGUI_WAIT_STATE_CHANGE StateChange\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRemoveProcessDebug(\n IN HANDLE Process,\n IN HANDLE DebugObject\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationDebugObject(\n IN HANDLE DebugObject,\n IN DEBUGOBJECTINFOCLASS InformationClass,\n IN PVOID Information,\n IN ULONG InformationLength,\n OUT PULONG ReturnLength OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDebugActiveProcess(\n IN HANDLE Process,\n IN HANDLE DebugObject\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateDebugObject(\n OUT PHANDLE DebugHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN BOOLEAN KillProcessOnExit\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDebugContinue(\n IN HANDLE DebugObject,\n IN PCLIENT_ID AppClientId,\n IN NTSTATUS ContinueStatus\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwRemoveProcessDebug(\n IN HANDLE Process,\n IN HANDLE DebugObject\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwWaitForDebugEvent(\n IN HANDLE DebugObject,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Timeout OPTIONAL,\n OUT PDBGUI_WAIT_STATE_CHANGE StateChange\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetInformationDebugObject(\n IN HANDLE DebugObject,\n IN DEBUGOBJECTINFOCLASS InformationClass,\n IN PVOID Information,\n IN ULONG InformationLength,\n OUT PULONG ReturnLength OPTIONAL\n);\n#endif\n" }, { "path": "ndk/dbgktypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n dbgktypes.h\n\nAbstract:\n\n Type definitions for the User Mode Debugging Facility.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _DBGKTYPES_H\n#define _DBGKTYPES_H\n\n//\n// Dependencies\n//\n#include \n#include \n\n//\n// Debug Object Access Masks\n//\n#define DEBUG_OBJECT_WAIT_STATE_CHANGE 0x0001\n#define DEBUG_OBJECT_ADD_REMOVE_PROCESS 0x0002\n#define DEBUG_OBJECT_SET_INFORMATION 0x0004\n#define DEBUG_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x0F)\n\n//\n// Debug Object Information Classes for NtQueryDebugObject\n//\ntypedef enum _DEBUGOBJECTINFOCLASS\n{\n DebugObjectUnusedInformation,\n DebugObjectKillProcessOnExitInformation\n} DEBUGOBJECTINFOCLASS, *PDEBUGOBJECTINFOCLASS;\n\n//\n// Debug Message API Number\n//\ntypedef enum _DBGKM_APINUMBER\n{\n DbgKmExceptionApi = 0,\n DbgKmCreateThreadApi = 1,\n DbgKmCreateProcessApi = 2,\n DbgKmExitThreadApi = 3,\n DbgKmExitProcessApi = 4,\n DbgKmLoadDllApi = 5,\n DbgKmUnloadDllApi = 6,\n DbgKmErrorReportApi = 7,\n DbgKmMaxApiNumber = 8,\n} DBGKM_APINUMBER;\n\n//\n// Debug Object Information Structures\n//\ntypedef struct _DEBUG_OBJECT_KILL_PROCESS_ON_EXIT_INFORMATION\n{\n ULONG KillProcessOnExit;\n} DEBUG_OBJECT_KILL_PROCESS_ON_EXIT_INFORMATION, *PDEBUG_OBJECT_KILL_PROCESS_ON_EXIT_INFORMATION;\n\n#ifndef NTOS_MODE_USER\n\n//\n// Debug Object\n//\ntypedef struct _DEBUG_OBJECT\n{\n KEVENT EventsPresent;\n FAST_MUTEX Mutex;\n LIST_ENTRY EventList;\n union\n {\n ULONG Flags;\n struct\n {\n UCHAR DebuggerInactive:1;\n UCHAR KillProcessOnExit:1;\n };\n };\n} DEBUG_OBJECT, *PDEBUG_OBJECT;\n\n#endif\n\n//\n// Debug States\n//\ntypedef enum _DBG_STATE\n{\n DbgIdle,\n DbgReplyPending,\n DbgCreateThreadStateChange,\n DbgCreateProcessStateChange,\n DbgExitThreadStateChange,\n DbgExitProcessStateChange,\n DbgExceptionStateChange,\n DbgBreakpointStateChange,\n DbgSingleStepStateChange,\n DbgLoadDllStateChange,\n DbgUnloadDllStateChange\n} DBG_STATE, *PDBG_STATE;\n\n//\n// Debug Message Structures\n//\ntypedef struct _DBGKM_EXCEPTION\n{\n EXCEPTION_RECORD ExceptionRecord;\n ULONG FirstChance;\n} DBGKM_EXCEPTION, *PDBGKM_EXCEPTION;\n\ntypedef struct _DBGKM_CREATE_THREAD\n{\n ULONG SubSystemKey;\n PVOID StartAddress;\n} DBGKM_CREATE_THREAD, *PDBGKM_CREATE_THREAD;\n\ntypedef struct _DBGKM_CREATE_PROCESS\n{\n ULONG SubSystemKey;\n HANDLE FileHandle;\n PVOID BaseOfImage;\n ULONG DebugInfoFileOffset;\n ULONG DebugInfoSize;\n DBGKM_CREATE_THREAD InitialThread;\n} DBGKM_CREATE_PROCESS, *PDBGKM_CREATE_PROCESS;\n\ntypedef struct _DBGKM_EXIT_THREAD\n{\n NTSTATUS ExitStatus;\n} DBGKM_EXIT_THREAD, *PDBGKM_EXIT_THREAD;\n\ntypedef struct _DBGKM_EXIT_PROCESS\n{\n NTSTATUS ExitStatus;\n} DBGKM_EXIT_PROCESS, *PDBGKM_EXIT_PROCESS;\n\ntypedef struct _DBGKM_LOAD_DLL\n{\n HANDLE FileHandle;\n PVOID BaseOfDll;\n ULONG DebugInfoFileOffset;\n ULONG DebugInfoSize;\n PVOID NamePointer;\n} DBGKM_LOAD_DLL, *PDBGKM_LOAD_DLL;\n\ntypedef struct _DBGKM_UNLOAD_DLL\n{\n PVOID BaseAddress;\n} DBGKM_UNLOAD_DLL, *PDBGKM_UNLOAD_DLL;\n\n//\n// User-Mode Debug State Change Structure\n//\ntypedef struct _DBGUI_WAIT_STATE_CHANGE\n{\n DBG_STATE NewState;\n CLIENT_ID AppClientId;\n union\n {\n struct\n {\n HANDLE HandleToThread;\n DBGKM_CREATE_THREAD NewThread;\n } CreateThread;\n struct\n {\n HANDLE HandleToProcess;\n HANDLE HandleToThread;\n DBGKM_CREATE_PROCESS NewProcess;\n } CreateProcessInfo;\n DBGKM_EXIT_THREAD ExitThread;\n DBGKM_EXIT_PROCESS ExitProcess;\n DBGKM_EXCEPTION Exception;\n DBGKM_LOAD_DLL LoadDll;\n DBGKM_UNLOAD_DLL UnloadDll;\n } StateInfo;\n} DBGUI_WAIT_STATE_CHANGE, *PDBGUI_WAIT_STATE_CHANGE;\n\n//\n// LPC Debug Message\n//\ntypedef struct _DBGKM_MSG\n{\n PORT_MESSAGE h;\n DBGKM_APINUMBER ApiNumber;\n ULONG ReturnedStatus;\n union\n {\n DBGKM_EXCEPTION Exception;\n DBGKM_CREATE_THREAD CreateThread;\n DBGKM_CREATE_PROCESS CreateProcess;\n DBGKM_EXIT_THREAD ExitThread;\n DBGKM_EXIT_PROCESS ExitProcess;\n DBGKM_LOAD_DLL LoadDll;\n DBGKM_UNLOAD_DLL UnloadDll;\n };\n} DBGKM_MSG, *PDBGKM_MSG;\n\n#ifndef NTOS_MODE_USER\n\n//\n// Debug Event\n//\ntypedef struct _DEBUG_EVENT\n{\n LIST_ENTRY EventList;\n KEVENT ContinueEvent;\n CLIENT_ID ClientId;\n PEPROCESS Process;\n PETHREAD Thread;\n NTSTATUS Status;\n ULONG Flags;\n PETHREAD BackoutThread;\n DBGKM_MSG ApiMsg;\n} DEBUG_EVENT, *PDEBUG_EVENT;\n\n\n#endif\n\n#endif\n" }, { "path": "ndk/exfuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n exfuncs.h\n\nAbstract:\n\n Function definitions for the Executive.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _EXFUNCS_H\n#define _EXFUNCS_H\n\n//\n// Dependencies\n//\n#include \n#include \n#include \n\n//\n// Don't include WMI headers just for one define\n//\ntypedef struct _EVENT_TRACE_HEADER *PEVENT_TRACE_HEADER;\n\n#ifndef NTOS_MODE_USER\n//\n// Fast Mutex functions\n//\nVOID\nFASTCALL\nExEnterCriticalRegionAndAcquireFastMutexUnsafe(\n PFAST_MUTEX FastMutex\n);\n\nVOID\nFASTCALL\nExReleaseFastMutexUnsafeAndLeaveCriticalRegion(\n PFAST_MUTEX FastMutex\n);\n\n//\n// Pushlock functions\n//\nVOID\nFASTCALL\nExfAcquirePushLockExclusive(\n PEX_PUSH_LOCK PushLock\n);\n\nVOID\nFASTCALL\nExfAcquirePushLockShared(\n PEX_PUSH_LOCK PushLock\n);\n\nVOID\nFASTCALL\nExfReleasePushLock(\n PEX_PUSH_LOCK PushLock\n);\n\nVOID\nFASTCALL\nExfReleasePushLockExclusive(\n PEX_PUSH_LOCK PushLock\n);\n\nVOID\nFASTCALL\nExfReleasePushLockShared(\n PEX_PUSH_LOCK PushLock\n);\n\nVOID\nFASTCALL\nExfTryToWakePushLock(\n PEX_PUSH_LOCK PushLock\n);\n\nVOID\nFASTCALL\nExfUnblockPushLock(\n PEX_PUSH_LOCK PushLock,\n PVOID CurrentWaitBlock\n);\n\n//\n// Resource Functions\n//\nNTKERNELAPI\nBOOLEAN\nNTAPI\nExTryToAcquireResourceExclusiveLite(\n IN PERESOURCE Resource\n);\n\n//\n// Handle Table Functions\n//\nNTKERNELAPI\nBOOLEAN\nNTAPI\nExEnumHandleTable(\n IN PHANDLE_TABLE HandleTable,\n IN PEX_ENUM_HANDLE_CALLBACK EnumHandleProcedure,\n IN OUT PVOID Context,\n OUT PHANDLE Handle OPTIONAL\n);\n\n#endif\n\n//\n// Native Calls\n//\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAddAtom(\n IN PWSTR AtomName,\n IN ULONG AtomNameLength,\n IN OUT PRTL_ATOM Atom\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCancelTimer(\n IN HANDLE TimerHandle,\n OUT PBOOLEAN CurrentState OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtClearEvent(\n IN HANDLE EventHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateEvent(\n OUT PHANDLE EventHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN EVENT_TYPE EventType,\n IN BOOLEAN InitialState\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateEventPair(\n OUT PHANDLE EventPairHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateKeyedEvent(\n OUT PHANDLE KeyedEventHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN ULONG Flags\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateMutant(\n OUT PHANDLE MutantHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN BOOLEAN InitialOwner\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateSemaphore(\n OUT PHANDLE SemaphoreHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN LONG InitialCount,\n IN LONG MaximumCount\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateTimer(\n OUT PHANDLE TimerHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN TIMER_TYPE TimerType\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteAtom(\n IN RTL_ATOM Atom\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDisplayString(\n IN PUNICODE_STRING DisplayString\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDrawText(\n IN PUNICODE_STRING DisplayString\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtEnumerateSystemEnvironmentValuesEx(\n IN ULONG InformationClass,\n IN PVOID Buffer,\n IN ULONG BufferLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFindAtom(\n IN PWSTR AtomName,\n IN ULONG AtomNameLength,\n OUT PRTL_ATOM Atom OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenEvent(\n OUT PHANDLE EventHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenKeyedEvent(\n OUT PHANDLE EventHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenEventPair(\n OUT PHANDLE EventPairHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenMutant(\n OUT PHANDLE MutantHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenSemaphore(\n OUT PHANDLE SemaphoreHandle,\n IN ACCESS_MASK DesiredAcces,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenTimer(\n OUT PHANDLE TimerHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPulseEvent(\n IN HANDLE EventHandle,\n IN PLONG PulseCount OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryDefaultLocale(\n IN BOOLEAN UserProfile,\n OUT PLCID DefaultLocaleId\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryDefaultUILanguage(\n PLANGID LanguageId\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryEvent(\n IN HANDLE EventHandle,\n IN EVENT_INFORMATION_CLASS EventInformationClass,\n OUT PVOID EventInformation,\n IN ULONG EventInformationLength,\n OUT PULONG ReturnLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationAtom(\n IN RTL_ATOM Atom,\n IN ATOM_INFORMATION_CLASS AtomInformationClass,\n OUT PVOID AtomInformation,\n IN ULONG AtomInformationLength,\n OUT PULONG ReturnLength OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInstallUILanguage(\n PLANGID LanguageId\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryMutant(\n IN HANDLE MutantHandle,\n IN MUTANT_INFORMATION_CLASS MutantInformationClass,\n OUT PVOID MutantInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySemaphore(\n IN HANDLE SemaphoreHandle,\n IN SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,\n OUT PVOID SemaphoreInformation,\n IN ULONG Length,\n OUT PULONG ReturnLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySystemEnvironmentValue(\n IN PUNICODE_STRING Name,\n OUT PWSTR Value,\n ULONG Length,\n PULONG ReturnLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySystemEnvironmentValueEx(\n IN PUNICODE_STRING VariableName,\n IN LPGUID VendorGuid,\n IN PVOID Value,\n IN OUT PULONG ReturnLength,\n IN OUT PULONG Attributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySystemInformation(\n IN SYSTEM_INFORMATION_CLASS SystemInformationClass,\n OUT PVOID SystemInformation,\n IN SIZE_T Length,\n OUT PSIZE_T ResultLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryTimer(\n IN HANDLE TimerHandle,\n IN TIMER_INFORMATION_CLASS TimerInformationClass,\n OUT PVOID TimerInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRaiseHardError(\n IN NTSTATUS ErrorStatus,\n IN ULONG NumberOfParameters,\n IN ULONG UnicodeStringParameterMask,\n IN PULONG_PTR Parameters,\n IN ULONG ValidResponseOptions,\n OUT PULONG Response\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReleaseMutant(\n IN HANDLE MutantHandle,\n IN PLONG ReleaseCount OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReleaseKeyedEvent(\n IN HANDLE EventHandle,\n IN PVOID Key,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Timeout OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReleaseSemaphore(\n IN HANDLE SemaphoreHandle,\n IN LONG ReleaseCount,\n OUT PLONG PreviousCount\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtResetEvent(\n IN HANDLE EventHandle,\n OUT PLONG NumberOfWaitingThreads OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetDefaultLocale(\n IN BOOLEAN UserProfile,\n IN LCID DefaultLocaleId\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetDefaultUILanguage(\n LANGID LanguageId\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetDefaultHardErrorPort(\n IN HANDLE PortHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetEvent(\n IN HANDLE EventHandle,\n OUT PLONG PreviousState OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetEventBoostPriority(\n IN HANDLE EventHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetHighEventPair(\n IN HANDLE EventPairHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetHighWaitLowEventPair(\n IN HANDLE EventPairHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetLowEventPair(\n HANDLE EventPair\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetLowWaitHighEventPair(\n HANDLE EventPair\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetSystemEnvironmentValue(\n IN PUNICODE_STRING VariableName,\n IN PUNICODE_STRING Value\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetSystemEnvironmentValueEx(\n IN PUNICODE_STRING VariableName,\n IN LPGUID VendorGuid\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetSystemInformation(\n IN SYSTEM_INFORMATION_CLASS SystemInformationClass,\n IN PVOID SystemInformation,\n IN SIZE_T SystemInformationLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetTimer(\n IN HANDLE TimerHandle,\n IN PLARGE_INTEGER DueTime,\n IN PTIMER_APC_ROUTINE TimerApcRoutine,\n IN PVOID TimerContext,\n IN BOOLEAN WakeTimer,\n IN LONG Period OPTIONAL,\n OUT PBOOLEAN PreviousState OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetUuidSeed(\n IN PUCHAR UuidSeed\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtShutdownSystem(\n IN SHUTDOWN_ACTION Action\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitForKeyedEvent(\n IN HANDLE EventHandle,\n IN PVOID Key,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Timeout OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitHighEventPair(\n IN HANDLE EventPairHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitLowEventPair(\n IN HANDLE EventPairHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtTraceEvent(\n IN ULONG TraceHandle,\n IN ULONG Flags,\n IN ULONG TraceHeaderLength,\n IN PEVENT_TRACE_HEADER TraceHeader\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAddAtom(\n IN PWSTR AtomName,\n IN ULONG AtomNameLength,\n IN OUT PRTL_ATOM Atom\n);\n\n#ifdef NTOS_MODE_USER\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCancelTimer(\n IN HANDLE TimerHandle,\n OUT PBOOLEAN CurrentState OPTIONAL\n);\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwClearEvent(\n IN HANDLE EventHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateEvent(\n OUT PHANDLE EventHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN EVENT_TYPE EventType,\n IN BOOLEAN InitialState\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateEventPair(\n OUT PHANDLE EventPairHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateMutant(\n OUT PHANDLE MutantHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN BOOLEAN InitialOwner\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateSemaphore(\n OUT PHANDLE SemaphoreHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN LONG InitialCount,\n IN LONG MaximumCount\n);\n\n#ifdef NTOS_MODE_USER\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateTimer(\n OUT PHANDLE TimerHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN TIMER_TYPE TimerType\n);\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDeleteAtom(\n IN RTL_ATOM Atom\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDisplayString(\n IN PUNICODE_STRING DisplayString\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwFindAtom(\n IN PWSTR AtomName,\n IN ULONG AtomNameLength,\n OUT PRTL_ATOM Atom OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenEvent(\n OUT PHANDLE EventHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenEventPair(\n OUT PHANDLE EventPairHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenMutant(\n OUT PHANDLE MutantHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenSemaphore(\n OUT PHANDLE SemaphoreHandle,\n IN ACCESS_MASK DesiredAcces,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\n#ifdef NTOS_MODE_USER\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenTimer(\n OUT PHANDLE TimerHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwPulseEvent(\n IN HANDLE EventHandle,\n IN PLONG PulseCount OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryDefaultLocale(\n IN BOOLEAN UserProfile,\n OUT PLCID DefaultLocaleId\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryDefaultUILanguage(\n PLANGID LanguageId\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryEvent(\n IN HANDLE EventHandle,\n IN EVENT_INFORMATION_CLASS EventInformationClass,\n OUT PVOID EventInformation,\n IN ULONG EventInformationLength,\n OUT PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryInformationAtom(\n IN RTL_ATOM Atom,\n IN ATOM_INFORMATION_CLASS AtomInformationClass,\n OUT PVOID AtomInformation,\n IN ULONG AtomInformationLength,\n OUT PULONG ReturnLength OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryInstallUILanguage(\n PLANGID LanguageId\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryMutant(\n IN HANDLE MutantHandle,\n IN MUTANT_INFORMATION_CLASS MutantInformationClass,\n OUT PVOID MutantInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQuerySemaphore(\n IN HANDLE SemaphoreHandle,\n IN SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,\n OUT PVOID SemaphoreInformation,\n IN ULONG Length,\n OUT PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQuerySystemEnvironmentValue(\n IN PUNICODE_STRING Name,\n OUT PWSTR Value,\n ULONG Length,\n PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQuerySystemInformation(\n IN SYSTEM_INFORMATION_CLASS SystemInformationClass,\n OUT PVOID SystemInformation,\n IN SIZE_T Length,\n OUT PSIZE_T ResultLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryTimer(\n IN HANDLE TimerHandle,\n IN TIMER_INFORMATION_CLASS TimerInformationClass,\n OUT PVOID TimerInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwRaiseHardError(\n IN NTSTATUS ErrorStatus,\n IN ULONG NumberOfParameters,\n IN ULONG UnicodeStringParameterMask,\n IN PULONG_PTR Parameters,\n IN ULONG ValidResponseOptions,\n OUT PULONG Response\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwReleaseMutant(\n IN HANDLE MutantHandle,\n IN PLONG ReleaseCount OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwReleaseSemaphore(\n IN HANDLE SemaphoreHandle,\n IN LONG ReleaseCount,\n OUT PLONG PreviousCount\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwResetEvent(\n IN HANDLE EventHandle,\n OUT PLONG NumberOfWaitingThreads OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetDefaultLocale(\n IN BOOLEAN UserProfile,\n IN LCID DefaultLocaleId\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetDefaultUILanguage(\n LANGID LanguageId\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetDefaultHardErrorPort(\n IN HANDLE PortHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetEvent(\n IN HANDLE EventHandle,\n OUT PLONG PreviousState OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetHighEventPair(\n IN HANDLE EventPairHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetHighWaitLowEventPair(\n IN HANDLE EventPairHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetLowEventPair(\n HANDLE EventPair\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetLowWaitHighEventPair(\n HANDLE EventPair\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetSystemEnvironmentValue(\n IN PUNICODE_STRING VariableName,\n IN PUNICODE_STRING Value\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetSystemInformation(\n IN SYSTEM_INFORMATION_CLASS SystemInformationClass,\n IN PVOID SystemInformation,\n IN SIZE_T SystemInformationLength\n);\n\n#ifdef NTOS_MODE_USER\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetTimer(\n IN HANDLE TimerHandle,\n IN PLARGE_INTEGER DueTime,\n IN PTIMER_APC_ROUTINE TimerApcRoutine,\n IN PVOID TimerContext,\n IN BOOLEAN WakeTimer,\n IN LONG Period OPTIONAL,\n OUT PBOOLEAN PreviousState OPTIONAL\n);\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetUuidSeed(\n IN PUCHAR UuidSeed\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwShutdownSystem(\n IN SHUTDOWN_ACTION Action\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwWaitHighEventPair(\n IN HANDLE EventPairHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwWaitLowEventPair(\n IN HANDLE EventPairHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwTraceEvent(\n IN ULONG TraceHandle,\n IN ULONG Flags,\n IN ULONG TraceHeaderLength,\n IN PEVENT_TRACE_HEADER TraceHeader\n);\n#endif\n" }, { "path": "ndk/extypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n extypes.h\n\nAbstract:\n\n Type definitions for the Executive.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _EXTYPES_H\n#define _EXTYPES_H\n\n//\n// Dependencies\n//\n#include \n#include \n#if defined(_MSC_VER) && !defined(NTOS_MODE_USER)\n#include \n#endif\n#include \n#include \n#include \n#include \n#ifdef NTOS_MODE_USER\n#include \n#endif\n\n//\n// GCC compatibility\n//\n#if defined(__GNUC__)\n#define __ALIGNED(n) __attribute__((aligned (n)))\n#elif defined(_MSC_VER)\n#define __ALIGNED(n) __declspec(align(n))\n#else\n//#error __ALIGNED not defined for your compiler!\n#define __ALIGNED(n)\n#warning __ALIGNED not defined for your compiler!\n#endif\n\n//\n// Atom and Language IDs\n//\ntypedef USHORT LANGID, *PLANGID;\ntypedef USHORT RTL_ATOM, *PRTL_ATOM;\n\n#ifndef NTOS_MODE_USER\n\n//\n// Kernel Exported Object Types\n//\nextern POBJECT_TYPE NTSYSAPI ExDesktopObjectType;\nextern POBJECT_TYPE NTSYSAPI ExWindowStationObjectType;\nextern POBJECT_TYPE NTSYSAPI ExIoCompletionType;\nextern POBJECT_TYPE NTSYSAPI ExMutantObjectType;\nextern POBJECT_TYPE NTSYSAPI ExTimerType;\n\n//\n// Exported NT Build Number\n//\nextern ULONG NtBuildNumber;\n\n//\n// Invalid Handle Value Constant\n//\n#define INVALID_HANDLE_VALUE (HANDLE)-1\n\n#endif\n\n//\n// Increments\n//\n#define MUTANT_INCREMENT 1\n\n//\n// Callback Object Access Mask\n//\n#define CALLBACK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x0001)\n#define CALLBACK_EXECUTE (STANDARD_RIGHTS_EXECUTE|SYNCHRONIZE|0x0001)\n#define CALLBACK_WRITE (STANDARD_RIGHTS_WRITE|SYNCHRONIZE|0x0001)\n#define CALLBACK_READ (STANDARD_RIGHTS_READ|SYNCHRONIZE|0x0001)\n\n//\n// Event Object Access Masks\n//\n#ifdef NTOS_MODE_USER\n#define EVENT_QUERY_STATE 0x0001\n\n//\n// Semaphore Object Access Masks\n//\n#define SEMAPHORE_QUERY_STATE 0x0001\n#else\n\n//\n// Mutant Object Access Masks\n//\n#define MUTANT_QUERY_STATE 0x0001\n#define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \\\n SYNCHRONIZE | \\\n MUTANT_QUERY_STATE)\n\n#define TIMER_QUERY_STATE 0x0001\n#define TIMER_MODIFY_STATE 0x0002\n#define TIMER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \\\n SYNCHRONIZE | \\\n TIMER_QUERY_STATE | \\\n TIMER_MODIFY_STATE)\n#endif\n\n//\n// Event Pair Access Masks\n//\n#define EVENT_PAIR_ALL_ACCESS 0x1F0000L\n\n//\n// Profile Object Access Masks\n//\n#define PROFILE_CONTROL 0x0001\n#define PROFILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | PROFILE_CONTROL)\n\n//\n// Maximum Parameters for NtRaiseHardError\n//\n#define MAXIMUM_HARDERROR_PARAMETERS 4\n\n//\n// Pushlock bits\n//\n#define EX_PUSH_LOCK_LOCK_V ((ULONG_PTR)0x0)\n#define EX_PUSH_LOCK_LOCK ((ULONG_PTR)0x1)\n#define EX_PUSH_LOCK_WAITING ((ULONG_PTR)0x2)\n#define EX_PUSH_LOCK_WAKING ((ULONG_PTR)0x4)\n#define EX_PUSH_LOCK_MULTIPLE_SHARED ((ULONG_PTR)0x8)\n#define EX_PUSH_LOCK_SHARE_INC ((ULONG_PTR)0x10)\n#define EX_PUSH_LOCK_PTR_BITS ((ULONG_PTR)0xf)\n\n//\n// Pushlock Wait Block Flags\n//\n#define EX_PUSH_LOCK_FLAGS_EXCLUSIVE 1\n#define EX_PUSH_LOCK_FLAGS_WAIT 2\n\n//\n// Resource (ERESOURCE) Flags\n//\n#define ResourceHasDisabledPriorityBoost 0x08\n\n//\n// Shutdown types for NtShutdownSystem\n//\ntypedef enum _SHUTDOWN_ACTION\n{\n ShutdownNoReboot,\n ShutdownReboot,\n ShutdownPowerOff\n} SHUTDOWN_ACTION;\n\n//\n// Responses for NtRaiseHardError\n//\ntypedef enum _HARDERROR_RESPONSE_OPTION\n{\n OptionAbortRetryIgnore,\n OptionOk,\n OptionOkCancel,\n OptionRetryCancel,\n OptionYesNo,\n OptionYesNoCancel,\n OptionShutdownSystem\n} HARDERROR_RESPONSE_OPTION, *PHARDERROR_RESPONSE_OPTION;\n\ntypedef enum _HARDERROR_RESPONSE\n{\n ResponseReturnToCaller,\n ResponseNotHandled,\n ResponseAbort,\n ResponseCancel,\n ResponseIgnore,\n ResponseNo,\n ResponseOk,\n ResponseRetry,\n ResponseYes,\n ResponseTryAgain,\n ResponseContinue\n} HARDERROR_RESPONSE, *PHARDERROR_RESPONSE;\n\n//\n// System Information Classes for NtQuerySystemInformation\n//\ntypedef enum _SYSTEM_INFORMATION_CLASS\n{\n SystemBasicInformation,\n SystemProcessorInformation,\n SystemPerformanceInformation,\n SystemTimeOfDayInformation,\n SystemPathInformation, /// Obsolete: Use KUSER_SHARED_DATA\n SystemProcessInformation,\n SystemCallCountInformation,\n SystemDeviceInformation,\n SystemProcessorPerformanceInformation,\n SystemFlagsInformation,\n SystemCallTimeInformation,\n SystemModuleInformation,\n SystemLocksInformation,\n SystemStackTraceInformation,\n SystemPagedPoolInformation,\n SystemNonPagedPoolInformation,\n SystemHandleInformation,\n SystemObjectInformation,\n SystemPageFileInformation,\n SystemVdmInstemulInformation,\n SystemVdmBopInformation,\n SystemFileCacheInformation,\n SystemPoolTagInformation,\n SystemInterruptInformation,\n SystemDpcBehaviorInformation,\n SystemFullMemoryInformation,\n SystemLoadGdiDriverInformation,\n SystemUnloadGdiDriverInformation,\n SystemTimeAdjustmentInformation,\n SystemSummaryMemoryInformation,\n SystemMirrorMemoryInformation,\n SystemPerformanceTraceInformation,\n SystemObsolete0,\n SystemExceptionInformation,\n SystemCrashDumpStateInformation,\n SystemKernelDebuggerInformation,\n SystemContextSwitchInformation,\n SystemRegistryQuotaInformation,\n SystemExtendServiceTableInformation,\n SystemPrioritySeperation,\n SystemPlugPlayBusInformation,\n SystemDockInformation,\n SystemPowerInformationNative,\n SystemProcessorSpeedInformation,\n SystemCurrentTimeZoneInformation,\n SystemLookasideInformation,\n SystemTimeSlipNotification,\n SystemSessionCreate,\n SystemSessionDetach,\n SystemSessionInformation,\n SystemRangeStartInformation,\n SystemVerifierInformation,\n SystemAddVerifier,\n SystemSessionProcessesInformation,\n SystemLoadGdiDriverInSystemSpaceInformation,\n SystemNumaProcessorMap,\n SystemPrefetcherInformation,\n SystemExtendedProcessInformation,\n SystemRecommendedSharedDataAlignment,\n SystemComPlusPackage,\n SystemNumaAvailableMemory,\n SystemProcessorPowerInformation,\n SystemEmulationBasicInformation,\n SystemEmulationProcessorInformation,\n SystemExtendedHanfleInformation,\n SystemLostDelayedWriteInformation,\n SystemBigPoolInformation,\n SystemSessionPoolTagInformation,\n SystemSessionMappedViewInformation,\n SystemHotpatchInformation,\n SystemObjectSecurityMode,\n SystemWatchDogTimerHandler,\n SystemWatchDogTimerInformation,\n SystemLogicalProcessorInformation,\n SystemWo64SharedInformationObosolete,\n SystemRegisterFirmwareTableInformationHandler,\n SystemFirmwareTableInformation,\n SystemModuleInformationEx,\n SystemVerifierTriageInformation,\n SystemSuperfetchInformation,\n SystemMemoryListInformation,\n SystemFileCacheInformationEx,\n SystemThreadPriorityClientIdInformation,\n SystemProcessorIdleCycleTimeInformation,\n SystemVerifierCancellationInformation,\n SystemProcessorPowerInformationEx,\n SystemRefTraceInformation,\n SystemSpecialPoolInformation,\n SystemProcessIdInformation,\n SystemErrorPortInformation,\n SystemBootEnvironmentInformation,\n SystemHypervisorInformation,\n SystemVerifierInformationEx,\n SystemTimeZoneInformation,\n SystemImageFileExecutionOptionsInformation,\n SystemCoverageInformation,\n SystemPrefetchPathInformation,\n SystemVerifierFaultsInformation,\n MaxSystemInfoClass,\n} SYSTEM_INFORMATION_CLASS;\n\n//\n// System Information Classes for NtQueryMutant\n//\ntypedef enum _MUTANT_INFORMATION_CLASS\n{\n MutantBasicInformation,\n MutantOwnerInformation\n} MUTANT_INFORMATION_CLASS;\n\n//\n// System Information Classes for NtQueryAtom\n//\ntypedef enum _ATOM_INFORMATION_CLASS\n{\n AtomBasicInformation,\n AtomTableInformation,\n} ATOM_INFORMATION_CLASS;\n\n//\n// System Information Classes for NtQueryTimer\n//\ntypedef enum _TIMER_INFORMATION_CLASS\n{\n TimerBasicInformation\n} TIMER_INFORMATION_CLASS;\n\n//\n// System Information Classes for NtQuerySemaphore\n//\ntypedef enum _SEMAPHORE_INFORMATION_CLASS\n{\n SemaphoreBasicInformation\n} SEMAPHORE_INFORMATION_CLASS;\n\n//\n// System Information Classes for NtQueryEvent\n//\ntypedef enum _EVENT_INFORMATION_CLASS\n{\n EventBasicInformation\n} EVENT_INFORMATION_CLASS;\n\n#ifdef NTOS_MODE_USER\n\n//\n// Firmware Table Actions for SystemFirmwareTableInformation\n//\ntypedef enum _SYSTEM_FIRMWARE_TABLE_ACTION\n{\n SystemFirmwareTable_Enumerate = 0,\n SystemFirmwareTable_Get = 1,\n} SYSTEM_FIRMWARE_TABLE_ACTION, *PSYSTEM_FIRMWARE_TABLE_ACTION;\n\n//\n// Firmware Handler Callback\n//\nstruct _SYSTEM_FIRMWARE_TABLE_INFORMATION;\ntypedef\nNTSTATUS\n(__cdecl *PFNFTH)(\n IN struct _SYSTEM_FIRMWARE_TABLE_INFORMATION *FirmwareTableInformation\n);\n\n#else\n\n//\n// Handle Enumeration Callback\n//\nstruct _HANDLE_TABLE_ENTRY;\ntypedef BOOLEAN\n(NTAPI *PEX_ENUM_HANDLE_CALLBACK)(\n IN struct _HANDLE_TABLE_ENTRY *HandleTableEntry,\n IN HANDLE Handle,\n IN PVOID Context\n);\n\n//\n// Compatibility with Windows XP Drivers using ERESOURCE\n//\ntypedef struct _ERESOURCE_XP\n{\n LIST_ENTRY SystemResourcesList;\n POWNER_ENTRY OwnerTable;\n SHORT ActiveCount;\n USHORT Flag;\n PKSEMAPHORE SharedWaiters;\n PKEVENT ExclusiveWaiters;\n OWNER_ENTRY OwnerThreads[2];\n ULONG ContentionCount;\n USHORT NumberOfSharedWaiters;\n USHORT NumberOfExclusiveWaiters;\n union\n {\n PVOID Address;\n ULONG_PTR CreatorBackTraceIndex;\n };\n KSPIN_LOCK SpinLock;\n} ERESOURCE_XP, *PERESOURCE_XP;\n\n//\n// Executive Work Queue Structures\n//\ntypedef struct _EX_QUEUE_WORKER_INFO\n{\n ULONG QueueDisabled:1;\n ULONG MakeThreadsAsNecessary:1;\n ULONG WaitMode:1;\n ULONG WorkerCount:29;\n} EX_QUEUE_WORKER_INFO, *PEX_QUEUE_WORKER_INFO;\n\ntypedef struct _EX_WORK_QUEUE\n{\n KQUEUE WorkerQueue;\n LONG DynamicThreadCount;\n ULONG WorkItemsProcessed;\n ULONG WorkItemsProcessedLastPass;\n ULONG QueueDepthLastPass;\n EX_QUEUE_WORKER_INFO Info;\n} EX_WORK_QUEUE, *PEX_WORK_QUEUE;\n\n//\n// Executive Fast Reference Structure\n//\ntypedef struct _EX_FAST_REF\n{\n union\n {\n PVOID Object;\n ULONG_PTR RefCnt:3;\n ULONG_PTR Value;\n };\n} EX_FAST_REF, *PEX_FAST_REF;\n\n//\n// Executive Cache-Aware Rundown Reference Descriptor\n//\ntypedef struct _EX_RUNDOWN_REF_CACHE_AWARE\n{\n PEX_RUNDOWN_REF RunRefs;\n PVOID PoolToFree;\n ULONG RunRefSize;\n ULONG Number;\n} EX_RUNDOWN_REF_CACHE_AWARE, *PEX_RUNDOWN_REF_CACHE_AWARE;\n\n//\n// Executive Rundown Wait Block\n//\ntypedef struct _EX_RUNDOWN_WAIT_BLOCK\n{\n ULONG_PTR Count;\n KEVENT WakeEvent;\n} EX_RUNDOWN_WAIT_BLOCK, *PEX_RUNDOWN_WAIT_BLOCK;\n\n//\n// Executive Pushlock\n//\n#undef EX_PUSH_LOCK\n#undef PEX_PUSH_LOCK\ntypedef struct _EX_PUSH_LOCK\n{\n union\n {\n struct\n {\n ULONG_PTR Locked:1;\n ULONG_PTR Waiting:1;\n ULONG_PTR Waking:1;\n ULONG_PTR MultipleShared:1;\n ULONG_PTR Shared:sizeof (ULONG_PTR) * 8 - 4;\n };\n ULONG_PTR Value;\n PVOID Ptr;\n };\n} EX_PUSH_LOCK, *PEX_PUSH_LOCK;\n\n//\n// Executive Pushlock Wait Block\n//\ntypedef __ALIGNED(16) struct _EX_PUSH_LOCK_WAIT_BLOCK\n{\n union\n {\n KGATE WakeGate;\n KEVENT WakeEvent;\n };\n struct _EX_PUSH_LOCK_WAIT_BLOCK *Next;\n struct _EX_PUSH_LOCK_WAIT_BLOCK *Last;\n struct _EX_PUSH_LOCK_WAIT_BLOCK *Previous;\n LONG ShareCount;\n LONG Flags;\n#if DBG\n BOOLEAN Signaled;\n EX_PUSH_LOCK NewValue;\n EX_PUSH_LOCK OldValue;\n PEX_PUSH_LOCK PushLock;\n#endif\n} EX_PUSH_LOCK_WAIT_BLOCK, *PEX_PUSH_LOCK_WAIT_BLOCK;\n\n//\n// Callback Object\n//\ntypedef struct _CALLBACK_OBJECT\n{\n ULONG Signature;\n KSPIN_LOCK Lock;\n LIST_ENTRY RegisteredCallbacks;\n BOOLEAN AllowMultipleCallbacks;\n UCHAR reserved[3];\n} CALLBACK_OBJECT, *PCALLBACK_OBJECT;\n\n//\n// Callback Handle\n//\ntypedef struct _CALLBACK_REGISTRATION\n{\n LIST_ENTRY Link;\n PCALLBACK_OBJECT CallbackObject;\n PCALLBACK_FUNCTION CallbackFunction;\n PVOID CallbackContext;\n ULONG Busy;\n BOOLEAN UnregisterWaiting;\n} CALLBACK_REGISTRATION, *PCALLBACK_REGISTRATION;\n\n//\n// Internal Callback Object\n//\ntypedef struct _EX_CALLBACK_ROUTINE_BLOCK\n{\n EX_RUNDOWN_REF RundownProtect;\n PEX_CALLBACK_FUNCTION Function;\n PVOID Context;\n} EX_CALLBACK_ROUTINE_BLOCK, *PEX_CALLBACK_ROUTINE_BLOCK;\n\n//\n// Internal Callback Handle\n//\ntypedef struct _EX_CALLBACK\n{\n EX_FAST_REF RoutineBlock;\n} EX_CALLBACK, *PEX_CALLBACK;\n\n//\n// Profile Object\n//\ntypedef struct _EPROFILE\n{\n PEPROCESS Process;\n PVOID RangeBase;\n SIZE_T RangeSize;\n PVOID Buffer;\n ULONG BufferSize;\n ULONG BucketSize;\n PKPROFILE ProfileObject;\n PVOID LockedBufferAddress;\n PMDL Mdl;\n ULONG Segment;\n KPROFILE_SOURCE ProfileSource;\n KAFFINITY Affinity;\n} EPROFILE, *PEPROFILE;\n\n//\n// Handle Table Structures\n//\ntypedef struct _HANDLE_TRACE_DB_ENTRY\n{\n CLIENT_ID ClientId;\n HANDLE Handle;\n ULONG Type;\n PVOID StackTrace[16];\n} HANDLE_TRACE_DB_ENTRY, *PHANDLE_TRACE_DB_ENTRY;\n\ntypedef struct _HANDLE_TRACE_DEBUG_INFO\n{\n LONG RefCount;\n ULONG TableSize;\n ULONG BitMaskFlags;\n FAST_MUTEX CloseCompatcionLock;\n ULONG CurrentStackIndex;\n HANDLE_TRACE_DB_ENTRY TraceDb[1];\n} HANDLE_TRACE_DEBUG_INFO, *PHANDLE_TRACE_DEBUG_INFO;\n\ntypedef struct _HANDLE_TABLE_ENTRY_INFO\n{\n ULONG AuditMask;\n} HANDLE_TABLE_ENTRY_INFO, *PHANDLE_TABLE_ENTRY_INFO;\n\ntypedef struct _HANDLE_TABLE_ENTRY\n{\n union\n {\n PVOID Object;\n ULONG_PTR ObAttributes;\n PHANDLE_TABLE_ENTRY_INFO InfoTable;\n ULONG_PTR Value;\n };\n union\n {\n ULONG GrantedAccess;\n struct\n {\n USHORT GrantedAccessIndex;\n USHORT CreatorBackTraceIndex;\n };\n LONG NextFreeTableEntry;\n };\n} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;\n\ntypedef struct _HANDLE_TABLE\n{\n#if (NTDDI_VERSION >= NTDDI_WINXP)\n ULONG TableCode;\n#else\n PHANDLE_TABLE_ENTRY **Table;\n#endif\n PEPROCESS QuotaProcess;\n PVOID UniqueProcessId;\n#if (NTDDI_VERSION >= NTDDI_WINXP)\n EX_PUSH_LOCK HandleTableLock[4];\n LIST_ENTRY HandleTableList;\n EX_PUSH_LOCK HandleContentionEvent;\n#else\n ERESOURCE HandleLock;\n LIST_ENTRY HandleTableList;\n KEVENT HandleContentionEvent;\n#endif\n PHANDLE_TRACE_DEBUG_INFO DebugInfo;\n LONG ExtraInfoPages;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n union\n {\n ULONG Flags;\n UCHAR StrictFIFO:1;\n };\n LONG FirstFreeHandle;\n PHANDLE_TABLE_ENTRY LastFreeHandleEntry;\n LONG HandleCount;\n ULONG NextHandleNeedingPool;\n#else\n ULONG FirstFree;\n ULONG LastFree;\n ULONG NextHandleNeedingPool;\n LONG HandleCount;\n union\n {\n ULONG Flags;\n UCHAR StrictFIFO:1;\n };\n#endif\n} HANDLE_TABLE, *PHANDLE_TABLE;\n\n#endif\n\n//\n// Hard Error LPC Message\n//\ntypedef struct _HARDERROR_MSG\n{\n PORT_MESSAGE h;\n NTSTATUS Status;\n LARGE_INTEGER ErrorTime;\n ULONG ValidResponseOptions;\n ULONG Response;\n ULONG NumberOfParameters;\n ULONG UnicodeStringParameterMask;\n ULONG Parameters[MAXIMUM_HARDERROR_PARAMETERS];\n} HARDERROR_MSG, *PHARDERROR_MSG;\n\n//\n// Information Structures for NtQueryMutant\n//\ntypedef struct _MUTANT_BASIC_INFORMATION\n{\n LONG CurrentCount;\n BOOLEAN OwnedByCaller;\n BOOLEAN AbandonedState;\n} MUTANT_BASIC_INFORMATION, *PMUTANT_BASIC_INFORMATION;\n\ntypedef struct _MUTANT_OWNER_INFORMATION\n{\n CLIENT_ID ClientId;\n} MUTANT_OWNER_INFORMATION, *PMUTANT_OWNER_INFORMATION;\n\n//\n// Information Structures for NtQueryAtom\n//\ntypedef struct _ATOM_BASIC_INFORMATION\n{\n USHORT UsageCount;\n USHORT Flags;\n USHORT NameLength;\n WCHAR Name[1];\n} ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION;\n\ntypedef struct _ATOM_TABLE_INFORMATION\n{\n ULONG NumberOfAtoms;\n USHORT Atoms[1];\n} ATOM_TABLE_INFORMATION, *PATOM_TABLE_INFORMATION;\n\n//\n// Information Structures for NtQueryTimer\n//\ntypedef struct _TIMER_BASIC_INFORMATION\n{\n LARGE_INTEGER TimeRemaining;\n BOOLEAN SignalState;\n} TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION;\n\n//\n// Information Structures for NtQuerySemaphore\n//\ntypedef struct _SEMAPHORE_BASIC_INFORMATION\n{\n LONG CurrentCount;\n LONG MaximumCount;\n} SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;\n\n//\n// Information Structures for NtQueryEvent\n//\ntypedef struct _EVENT_BASIC_INFORMATION\n{\n EVENT_TYPE EventType;\n LONG EventState;\n} EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;\n\n//\n// Information Structures for NtQuerySystemInformation\n//\ntypedef struct _SYSTEM_BASIC_INFORMATION\n{\n ULONG Reserved;\n ULONG TimerResolution;\n ULONG PageSize;\n ULONG NumberOfPhysicalPages;\n ULONG LowestPhysicalPageNumber;\n ULONG HighestPhysicalPageNumber;\n ULONG AllocationGranularity;\n ULONG_PTR MinimumUserModeAddress;\n ULONG_PTR MaximumUserModeAddress;\n ULONG_PTR ActiveProcessorsAffinityMask;\n CCHAR NumberOfProcessors;\n} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;\n\n// Class 1\ntypedef struct _SYSTEM_PROCESSOR_INFORMATION\n{\n USHORT ProcessorArchitecture;\n USHORT ProcessorLevel;\n USHORT ProcessorRevision;\n USHORT Reserved;\n ULONG ProcessorFeatureBits;\n} SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION;\n\n// Class 2\ntypedef struct _SYSTEM_PERFORMANCE_INFORMATION\n{\n LARGE_INTEGER IdleProcessTime;\n LARGE_INTEGER IoReadTransferCount;\n LARGE_INTEGER IoWriteTransferCount;\n LARGE_INTEGER IoOtherTransferCount;\n ULONG IoReadOperationCount;\n ULONG IoWriteOperationCount;\n ULONG IoOtherOperationCount;\n ULONG AvailablePages;\n ULONG CommittedPages;\n ULONG CommitLimit;\n ULONG PeakCommitment;\n ULONG PageFaultCount;\n ULONG CopyOnWriteCount;\n ULONG TransitionCount;\n ULONG CacheTransitionCount;\n ULONG DemandZeroCount;\n ULONG PageReadCount;\n ULONG PageReadIoCount;\n ULONG CacheReadCount;\n ULONG CacheIoCount;\n ULONG DirtyPagesWriteCount;\n ULONG DirtyWriteIoCount;\n ULONG MappedPagesWriteCount;\n ULONG MappedWriteIoCount;\n ULONG PagedPoolPages;\n ULONG NonPagedPoolPages;\n ULONG PagedPoolAllocs;\n ULONG PagedPoolFrees;\n ULONG NonPagedPoolAllocs;\n ULONG NonPagedPoolFrees;\n ULONG FreeSystemPtes;\n ULONG ResidentSystemCodePage;\n ULONG TotalSystemDriverPages;\n ULONG TotalSystemCodePages;\n ULONG NonPagedPoolLookasideHits;\n ULONG PagedPoolLookasideHits;\n ULONG Spare3Count;\n ULONG ResidentSystemCachePage;\n ULONG ResidentPagedPoolPage;\n ULONG ResidentSystemDriverPage;\n ULONG CcFastReadNoWait;\n ULONG CcFastReadWait;\n ULONG CcFastReadResourceMiss;\n ULONG CcFastReadNotPossible;\n ULONG CcFastMdlReadNoWait;\n ULONG CcFastMdlReadWait;\n ULONG CcFastMdlReadResourceMiss;\n ULONG CcFastMdlReadNotPossible;\n ULONG CcMapDataNoWait;\n ULONG CcMapDataWait;\n ULONG CcMapDataNoWaitMiss;\n ULONG CcMapDataWaitMiss;\n ULONG CcPinMappedDataCount;\n ULONG CcPinReadNoWait;\n ULONG CcPinReadWait;\n ULONG CcPinReadNoWaitMiss;\n ULONG CcPinReadWaitMiss;\n ULONG CcCopyReadNoWait;\n ULONG CcCopyReadWait;\n ULONG CcCopyReadNoWaitMiss;\n ULONG CcCopyReadWaitMiss;\n ULONG CcMdlReadNoWait;\n ULONG CcMdlReadWait;\n ULONG CcMdlReadNoWaitMiss;\n ULONG CcMdlReadWaitMiss;\n ULONG CcReadAheadIos;\n ULONG CcLazyWriteIos;\n ULONG CcLazyWritePages;\n ULONG CcDataFlushes;\n ULONG CcDataPages;\n ULONG ContextSwitches;\n ULONG FirstLevelTbFills;\n ULONG SecondLevelTbFills;\n ULONG SystemCalls;\n} SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;\n\n// Class 3\ntypedef struct _SYSTEM_TIMEOFDAY_INFORMATION\n{\n LARGE_INTEGER BootTime;\n LARGE_INTEGER CurrentTime;\n LARGE_INTEGER TimeZoneBias;\n ULONG TimeZoneId;\n ULONG Reserved;\n LARGE_INTEGER BootTimeBias;\n LARGE_INTEGER SleepTimeBias;\n} SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION;\n\n// Class 4\n// This class is obsolete, please use KUSER_SHARED_DATA instead\n\n// Class 5\ntypedef struct _SYSTEM_THREAD_INFORMATION\n{\n LARGE_INTEGER KernelTime;\n LARGE_INTEGER UserTime;\n LARGE_INTEGER CreateTime;\n ULONG WaitTime;\n PVOID StartAddress;\n CLIENT_ID ClientId;\n KPRIORITY Priority;\n LONG BasePriority;\n ULONG ContextSwitches;\n ULONG ThreadState;\n ULONG WaitReason;\n} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;\n\ntypedef struct _SYSTEM_PROCESS_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG NumberOfThreads;\n LARGE_INTEGER SpareLi1;\n LARGE_INTEGER SpareLi2;\n LARGE_INTEGER SpareLi3;\n LARGE_INTEGER CreateTime;\n LARGE_INTEGER UserTime;\n LARGE_INTEGER KernelTime;\n UNICODE_STRING ImageName;\n KPRIORITY BasePriority;\n HANDLE UniqueProcessId;\n HANDLE InheritedFromUniqueProcessId;\n ULONG HandleCount;\n ULONG SessionId;\n ULONG_PTR PageDirectoryBase;\n\n //\n // This part corresponds to VM_COUNTERS_EX.\n // NOTE: *NOT* THE SAME AS VM_COUNTERS!\n //\n SIZE_T PeakVirtualSize;\n ULONG VirtualSize;\n SIZE_T PageFaultCount;\n SIZE_T PeakWorkingSetSize;\n SIZE_T WorkingSetSize;\n SIZE_T QuotaPeakPagedPoolUsage;\n SIZE_T QuotaPagedPoolUsage;\n SIZE_T QuotaPeakNonPagedPoolUsage;\n SIZE_T QuotaNonPagedPoolUsage;\n SIZE_T PagefileUsage;\n SIZE_T PeakPagefileUsage;\n SIZE_T PrivatePageCount;\n\n //\n // This part corresponds to IO_COUNTERS\n //\n LARGE_INTEGER ReadOperationCount;\n LARGE_INTEGER WriteOperationCount;\n LARGE_INTEGER OtherOperationCount;\n LARGE_INTEGER ReadTransferCount;\n LARGE_INTEGER WriteTransferCount;\n LARGE_INTEGER OtherTransferCount;\n\n //SYSTEM_THREAD_INFORMATION TH[1];\n} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;\n\n// Class 6\ntypedef struct _SYSTEM_CALL_COUNT_INFORMATION\n{\n ULONG Length;\n ULONG NumberOfTables;\n} SYSTEM_CALL_COUNT_INFORMATION, *PSYSTEM_CALL_COUNT_INFORMATION;\n\n// Class 7\ntypedef struct _SYSTEM_DEVICE_INFORMATION\n{\n ULONG NumberOfDisks;\n ULONG NumberOfFloppies;\n ULONG NumberOfCdRoms;\n ULONG NumberOfTapes;\n ULONG NumberOfSerialPorts;\n ULONG NumberOfParallelPorts;\n} SYSTEM_DEVICE_INFORMATION, *PSYSTEM_DEVICE_INFORMATION;\n\n// Class 8\ntypedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION\n{\n LARGE_INTEGER IdleTime;\n LARGE_INTEGER KernelTime;\n LARGE_INTEGER UserTime;\n LARGE_INTEGER DpcTime;\n LARGE_INTEGER InterruptTime;\n ULONG InterruptCount;\n} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;\n\n// Class 9\ntypedef struct _SYSTEM_FLAGS_INFORMATION\n{\n ULONG Flags;\n} SYSTEM_FLAGS_INFORMATION, *PSYSTEM_FLAGS_INFORMATION;\n\n// Class 10\ntypedef struct _SYSTEM_CALL_TIME_INFORMATION\n{\n ULONG Length;\n ULONG TotalCalls;\n LARGE_INTEGER TimeOfCalls[1];\n} SYSTEM_CALL_TIME_INFORMATION, *PSYSTEM_CALL_TIME_INFORMATION;\n\n// Class 11 - See RTL_PROCESS_MODULES\n\n// Class 12 - See RTL_PROCESS_LOCKS\n\n// Class 13 - See RTL_PROCESS_BACKTRACES\n\n// Class 14 - 15\ntypedef struct _SYSTEM_POOL_ENTRY\n{\n BOOLEAN Allocated;\n BOOLEAN Spare0;\n USHORT AllocatorBackTraceIndex;\n ULONG Size;\n union\n {\n UCHAR Tag[4];\n ULONG TagUlong;\n PVOID ProcessChargedQuota;\n };\n} SYSTEM_POOL_ENTRY, *PSYSTEM_POOL_ENTRY;\n\ntypedef struct _SYSTEM_POOL_INFORMATION\n{\n ULONG TotalSize;\n PVOID FirstEntry;\n USHORT EntryOverhead;\n BOOLEAN PoolTagPresent;\n BOOLEAN Spare0;\n ULONG NumberOfEntries;\n SYSTEM_POOL_ENTRY Entries[1];\n} SYSTEM_POOL_INFORMATION, *PSYSTEM_POOL_INFORMATION;\n\n// Class 16\ntypedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO\n{\n USHORT UniqueProcessId;\n USHORT CreatorBackTraceIndex;\n UCHAR ObjectTypeIndex;\n UCHAR HandleAttributes;\n USHORT HandleValue;\n PVOID Object;\n ULONG GrantedAccess;\n} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;\n\ntypedef struct _SYSTEM_HANDLE_INFORMATION\n{\n ULONG NumberOfHandles;\n SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];\n} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;\n\n// Class 17\ntypedef struct _SYSTEM_OBJECTTYPE_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG NumberOfObjects;\n ULONG NumberOfHandles;\n ULONG TypeIndex;\n ULONG InvalidAttributes;\n GENERIC_MAPPING GenericMapping;\n ULONG ValidAccessMask;\n ULONG PoolType;\n BOOLEAN SecurityRequired;\n BOOLEAN WaitableObject;\n UNICODE_STRING TypeName;\n} SYSTEM_OBJECTTYPE_INFORMATION, *PSYSTEM_OBJECTTYPE_INFORMATION;\n\ntypedef struct _SYSTEM_OBJECT_INFORMATION\n{\n ULONG NextEntryOffset;\n PVOID Object;\n HANDLE CreatorUniqueProcess;\n USHORT CreatorBackTraceIndex;\n USHORT Flags;\n LONG PointerCount;\n LONG HandleCount;\n ULONG PagedPoolCharge;\n ULONG NonPagedPoolCharge;\n HANDLE ExclusiveProcessId;\n PVOID SecurityDescriptor;\n OBJECT_NAME_INFORMATION NameInfo;\n} SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION;\n\n// Class 18\ntypedef struct _SYSTEM_PAGEFILE_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG TotalSize;\n ULONG TotalInUse;\n ULONG PeakUsage;\n UNICODE_STRING PageFileName;\n} SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION;\n\n// Class 19\ntypedef struct _SYSTEM_VDM_INSTEMUL_INFO\n{\n ULONG SegmentNotPresent;\n ULONG VdmOpcode0F;\n ULONG OpcodeESPrefix;\n ULONG OpcodeCSPrefix;\n ULONG OpcodeSSPrefix;\n ULONG OpcodeDSPrefix;\n ULONG OpcodeFSPrefix;\n ULONG OpcodeGSPrefix;\n ULONG OpcodeOPER32Prefix;\n ULONG OpcodeADDR32Prefix;\n ULONG OpcodeINSB;\n ULONG OpcodeINSW;\n ULONG OpcodeOUTSB;\n ULONG OpcodeOUTSW;\n ULONG OpcodePUSHF;\n ULONG OpcodePOPF;\n ULONG OpcodeINTnn;\n ULONG OpcodeINTO;\n ULONG OpcodeIRET;\n ULONG OpcodeINBimm;\n ULONG OpcodeINWimm;\n ULONG OpcodeOUTBimm;\n ULONG OpcodeOUTWimm ;\n ULONG OpcodeINB;\n ULONG OpcodeINW;\n ULONG OpcodeOUTB;\n ULONG OpcodeOUTW;\n ULONG OpcodeLOCKPrefix;\n ULONG OpcodeREPNEPrefix;\n ULONG OpcodeREPPrefix;\n ULONG OpcodeHLT;\n ULONG OpcodeCLI;\n ULONG OpcodeSTI;\n ULONG BopCount;\n} SYSTEM_VDM_INSTEMUL_INFO, *PSYSTEM_VDM_INSTEMUL_INFO;\n\n// Class 20 - ULONG VDMBOPINFO\n\n// Class 21\ntypedef struct _SYSTEM_FILECACHE_INFORMATION\n{\n ULONG CurrentSize;\n ULONG PeakSize;\n ULONG PageFaultCount;\n ULONG MinimumWorkingSet;\n ULONG MaximumWorkingSet;\n ULONG CurrentSizeIncludingTransitionInPages;\n ULONG PeakSizeIncludingTransitionInPages;\n ULONG TransitionRePurposeCount;\n ULONG Flags;\n} SYSTEM_FILECACHE_INFORMATION, *PSYSTEM_FILECACHE_INFORMATION;\n\n// Class 22\ntypedef struct _SYSTEM_POOLTAG\n{\n union\n {\n UCHAR Tag[4];\n ULONG TagUlong;\n };\n ULONG PagedAllocs;\n ULONG PagedFrees;\n ULONG PagedUsed;\n ULONG NonPagedAllocs;\n ULONG NonPagedFrees;\n ULONG NonPagedUsed;\n} SYSTEM_POOLTAG, *PSYSTEM_POOLTAG;\ntypedef struct _SYSTEM_POOLTAG_INFORMATION\n{\n ULONG Count;\n SYSTEM_POOLTAG TagInfo[1];\n} SYSTEM_POOLTAG_INFORMATION, *PSYSTEM_POOLTAG_INFORMATION;\n\n// Class 23\ntypedef struct _SYSTEM_INTERRUPT_INFORMATION\n{\n ULONG ContextSwitches;\n ULONG DpcCount;\n ULONG DpcRate;\n ULONG TimeIncrement;\n ULONG DpcBypassCount;\n ULONG ApcBypassCount;\n} SYSTEM_INTERRUPT_INFORMATION, *PSYSTEM_INTERRUPT_INFORMATION;\n\n// Class 24\ntypedef struct _SYSTEM_DPC_BEHAVIOR_INFORMATION\n{\n ULONG Spare;\n ULONG DpcQueueDepth;\n ULONG MinimumDpcRate;\n ULONG AdjustDpcThreshold;\n ULONG IdealDpcRate;\n} SYSTEM_DPC_BEHAVIOR_INFORMATION, *PSYSTEM_DPC_BEHAVIOR_INFORMATION;\n\n// Class 25\ntypedef struct _SYSTEM_MEMORY_INFO\n{\n PUCHAR StringOffset;\n USHORT ValidCount;\n USHORT TransitionCount;\n USHORT ModifiedCount;\n USHORT PageTableCount;\n} SYSTEM_MEMORY_INFO, *PSYSTEM_MEMORY_INFO;\n\ntypedef struct _SYSTEM_MEMORY_INFORMATION\n{\n ULONG InfoSize;\n ULONG StringStart;\n SYSTEM_MEMORY_INFO Memory[1];\n} SYSTEM_MEMORY_INFORMATION, *PSYSTEM_MEMORY_INFORMATION;\n\n// Class 26\ntypedef struct _SYSTEM_GDI_DRIVER_INFORMATION\n{\n UNICODE_STRING DriverName;\n PVOID ImageAddress;\n PVOID SectionPointer;\n PVOID EntryPoint;\n PIMAGE_EXPORT_DIRECTORY ExportSectionPointer;\n ULONG ImageLength;\n} SYSTEM_GDI_DRIVER_INFORMATION, *PSYSTEM_GDI_DRIVER_INFORMATION;\n\n// Class 27\n// Not an actually class, simply a PVOID to the ImageAddress\n\n// Class 28\ntypedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION\n{\n ULONG TimeAdjustment;\n ULONG TimeIncrement;\n BOOLEAN Enable;\n} SYSTEM_QUERY_TIME_ADJUST_INFORMATION, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION;\n\ntypedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION\n{\n ULONG TimeAdjustment;\n BOOLEAN Enable;\n} SYSTEM_SET_TIME_ADJUST_INFORMATION, *PSYSTEM_SET_TIME_ADJUST_INFORMATION;\n\n// Class 29 - Same as 25\n\n// FIXME: Class 30\n\n// Class 31\ntypedef struct _SYSTEM_REF_TRACE_INFORMATION\n{\n UCHAR TraceEnable;\n UCHAR TracePermanent;\n UNICODE_STRING TraceProcessName;\n UNICODE_STRING TracePoolTags;\n} SYSTEM_REF_TRACE_INFORMATION, *PSYSTEM_REF_TRACE_INFORMATION;\n\n// Class 32 - OBSOLETE\n\n// Class 33\ntypedef struct _SYSTEM_EXCEPTION_INFORMATION\n{\n ULONG AlignmentFixupCount;\n ULONG ExceptionDispatchCount;\n ULONG FloatingEmulationCount;\n ULONG ByteWordEmulationCount;\n} SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION;\n\n// Class 34\ntypedef struct _SYSTEM_CRASH_STATE_INFORMATION\n{\n ULONG ValidCrashDump;\n} SYSTEM_CRASH_STATE_INFORMATION, *PSYSTEM_CRASH_STATE_INFORMATION;\n\n// Class 35\ntypedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION\n{\n BOOLEAN KernelDebuggerEnabled;\n BOOLEAN KernelDebuggerNotPresent;\n} SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION;\n\n// Class 36\ntypedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION\n{\n ULONG ContextSwitches;\n ULONG FindAny;\n ULONG FindLast;\n ULONG FindIdeal;\n ULONG IdleAny;\n ULONG IdleCurrent;\n ULONG IdleLast;\n ULONG IdleIdeal;\n ULONG PreemptAny;\n ULONG PreemptCurrent;\n ULONG PreemptLast;\n ULONG SwitchToIdle;\n} SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION;\n\n// Class 37\ntypedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION\n{\n ULONG RegistryQuotaAllowed;\n ULONG RegistryQuotaUsed;\n ULONG PagedPoolSize;\n} SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;\n\n// Class 38\n// Not a structure, simply send the UNICODE_STRING\n\n// Class 39\n// Not a structure, simply send a ULONG containing the new separation\n\n// Class 40\ntypedef struct _SYSTEM_PLUGPLAY_BUS_INFORMATION\n{\n ULONG BusCount;\n PLUGPLAY_BUS_INSTANCE BusInstance[1];\n} SYSTEM_PLUGPLAY_BUS_INFORMATION, *PSYSTEM_PLUGPLAY_BUS_INFORMATION;\n\n// Class 41\ntypedef struct _SYSTEM_DOCK_INFORMATION\n{\n SYSTEM_DOCK_STATE DockState;\n INTERFACE_TYPE DeviceBusType;\n ULONG DeviceBusNumber;\n ULONG SlotNumber;\n} SYSTEM_DOCK_INFORMATION, *PSYSTEM_DOCK_INFORMATION;\n\n// Class 42\ntypedef struct _SYSTEM_POWER_INFORMATION_NATIVE\n{\n BOOLEAN SystemSuspendSupported;\n BOOLEAN SystemHibernateSupported;\n BOOLEAN ResumeTimerSupportsSuspend;\n BOOLEAN ResumeTimerSupportsHibernate;\n BOOLEAN LidSupported;\n BOOLEAN TurboSettingSupported;\n BOOLEAN TurboMode;\n BOOLEAN SystemAcOrDc;\n BOOLEAN PowerDownDisabled;\n LARGE_INTEGER SpindownDrives;\n} SYSTEM_POWER_INFORMATION_NATIVE, *PSYSTEM_POWER_INFORMATION_NATIVE;\n\n// Class 43\ntypedef struct _SYSTEM_LEGACY_DRIVER_INFORMATION\n{\n PNP_VETO_TYPE VetoType;\n UNICODE_STRING VetoDriver;\n // CHAR Buffer[0];\n} SYSTEM_LEGACY_DRIVER_INFORMATION, *PSYSTEM_LEGACY_DRIVER_INFORMATION;\n\n// Class 44\n//typedef struct _TIME_ZONE_INFORMATION RTL_TIME_ZONE_INFORMATION;\n\n// Class 45\ntypedef struct _SYSTEM_LOOKASIDE_INFORMATION\n{\n USHORT CurrentDepth;\n USHORT MaximumDepth;\n ULONG TotalAllocates;\n ULONG AllocateMisses;\n ULONG TotalFrees;\n ULONG FreeMisses;\n ULONG Type;\n ULONG Tag;\n ULONG Size;\n} SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION;\n\n// Class 46\n// Not a structure. Only a HANDLE for the SlipEvent;\n\n// Class 47\n// Not a structure. Only a ULONG for the SessionId;\n\n// Class 48\n// Not a structure. Only a ULONG for the SessionId;\n\n// FIXME: Class 49\n\n// Class 50\n// Not a structure. Only a ULONG_PTR for the SystemRangeStart\n\n// Class 51\ntypedef struct _SYSTEM_VERIFIER_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG Level;\n UNICODE_STRING DriverName;\n ULONG RaiseIrqls;\n ULONG AcquireSpinLocks;\n ULONG SynchronizeExecutions;\n ULONG AllocationsAttempted;\n ULONG AllocationsSucceeded;\n ULONG AllocationsSucceededSpecialPool;\n ULONG AllocationsWithNoTag;\n ULONG TrimRequests;\n ULONG Trims;\n ULONG AllocationsFailed;\n ULONG AllocationsFailedDeliberately;\n ULONG Loads;\n ULONG Unloads;\n ULONG UnTrackedPool;\n ULONG CurrentPagedPoolAllocations;\n ULONG CurrentNonPagedPoolAllocations;\n ULONG PeakPagedPoolAllocations;\n ULONG PeakNonPagedPoolAllocations;\n ULONG PagedPoolUsageInBytes;\n ULONG NonPagedPoolUsageInBytes;\n ULONG PeakPagedPoolUsageInBytes;\n ULONG PeakNonPagedPoolUsageInBytes;\n} SYSTEM_VERIFIER_INFORMATION, *PSYSTEM_VERIFIER_INFORMATION;\n\n// FIXME: Class 52\n\n// Class 53\ntypedef struct _SYSTEM_SESSION_PROCESS_INFORMATION\n{\n ULONG SessionId;\n ULONG SizeOfBuf;\n PVOID Buffer; // Same format as in SystemProcessInformation\n} SYSTEM_SESSION_PROCESS_INFORMATION, *PSYSTEM_SESSION_PROCESS_INFORMATION;\n\n// FIXME: Class 54-97\n\n//\n// Hotpatch flags\n//\n#define RTL_HOTPATCH_SUPPORTED_FLAG 0x01\n#define RTL_HOTPATCH_SWAP_OBJECT_NAMES 0x08 << 24\n#define RTL_HOTPATCH_SYNC_RENAME_FILES 0x10 << 24\n#define RTL_HOTPATCH_PATCH_USER_MODE 0x20 << 24\n#define RTL_HOTPATCH_REMAP_SYSTEM_DLL 0x40 << 24\n#define RTL_HOTPATCH_PATCH_KERNEL_MODE 0x80 << 24\n\n\n// Class 69\ntypedef struct _SYSTEM_HOTPATCH_CODE_INFORMATION\n{\n ULONG Flags;\n ULONG InfoSize;\n union\n {\n struct\n {\n ULONG Foo;\n } CodeInfo;\n struct\n {\n USHORT NameOffset;\n USHORT NameLength;\n } KernelInfo;\n struct\n {\n USHORT NameOffset;\n USHORT NameLength;\n USHORT TargetNameOffset;\n USHORT TargetNameLength;\n UCHAR PatchingFinished;\n } UserModeInfo;\n struct\n {\n USHORT NameOffset;\n USHORT NameLength;\n USHORT TargetNameOffset;\n USHORT TargetNameLength;\n UCHAR PatchingFinished;\n NTSTATUS ReturnCode;\n HANDLE TargetProcess;\n } InjectionInfo;\n struct\n {\n HANDLE FileHandle1;\n PIO_STATUS_BLOCK IoStatusBlock1;\n PVOID RenameInformation1;\n PVOID RenameInformationLength1;\n HANDLE FileHandle2;\n PIO_STATUS_BLOCK IoStatusBlock2;\n PVOID RenameInformation2;\n PVOID RenameInformationLength2;\n } RenameInfo;\n struct\n {\n HANDLE ParentDirectory;\n HANDLE ObjectHandle1;\n HANDLE ObjectHandle2;\n } AtomicSwap;\n };\n} SYSTEM_HOTPATCH_CODE_INFORMATION, *PSYSTEM_HOTPATCH_CODE_INFORMATION;\n\n//\n// Class 75\n//\n#ifdef NTOS_MODE_USER\ntypedef struct _SYSTEM_FIRMWARE_TABLE_HANDLER\n{\n ULONG ProviderSignature;\n BOOLEAN Register;\n PFNFTH FirmwareTableHandler;\n PVOID DriverObject;\n} SYSTEM_FIRMWARE_TABLE_HANDLER, *PSYSTEM_FIRMWARE_TABLE_HANDLER;\n\n//\n// Class 76\n//\ntypedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION\n{\n ULONG ProviderSignature;\n SYSTEM_FIRMWARE_TABLE_ACTION Action;\n ULONG TableID;\n ULONG TableBufferLength;\n UCHAR TableBuffer[1];\n} SYSTEM_FIRMWARE_TABLE_INFORMATION, *PSYSTEM_FIRMWARE_TABLE_INFORMATION;\n\n//\n// Class 81\n//\ntypedef struct _SYSTEM_MEMORY_LIST_INFORMATION\n{\n SIZE_T ZeroPageCount;\n SIZE_T FreePageCount;\n SIZE_T ModifiedPageCount;\n SIZE_T ModifiedNoWritePageCount;\n SIZE_T BadPageCount;\n SIZE_T PageCountByPriority[8];\n SIZE_T RepurposedPagesByPriority[8];\n} SYSTEM_MEMORY_LIST_INFORMATION, *PSYSTEM_MEMORY_LIST_INFORMATION;\n\n#endif\n#endif\n" }, { "path": "ndk/halfuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n halfuncs.h\n\nAbstract:\n\n Function definitions for the HAL.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _HALFUNCS_H\n#define _HALFUNCS_H\n\n//\n// Dependencies\n//\n#include \n#include \n#include \n\n#ifndef NTOS_MODE_USER\n\n//\n// Private HAL Callbacks\n//\n#define HalHandlerForBus HALPRIVATEDISPATCH->HalHandlerForBus\n#define HalHandlerForConfigSpace HALPRIVATEDISPATCH->HalHandlerForConfigSpace\n#define HalLocateHiberRanges HALPRIVATEDISPATCH->HalLocateHiberRanges\n#define HalRegisterBusHandler HALPRIVATEDISPATCH->HalRegisterBusHandler\n#define HalSetWakeEnable HALPRIVATEDISPATCH->HalSetWakeEnable\n#define HalSetWakeAlarm HALPRIVATEDISPATCH->HalSetWakeAlarm\n#define HalPciTranslateBusAddress HALPRIVATEDISPATCH->HalPciTranslateBusAddress\n#define HalPciAssignSlotResources HALPRIVATEDISPATCH->HalPciAssignSlotResources\n#define HalHaltSystem HALPRIVATEDISPATCH->HalHaltSystem\n#define HalFindBusAddressTranslation HALPRIVATEDISPATCH->HalFindBusAddressTranslation\n#define HalResetDisplay HALPRIVATEDISPATCH->HalResetDisplay\n#define HalAllocateMapRegisters HALPRIVATEDISPATCH->HalAllocateMapRegisters\n#define KdSetupPciDeviceForDebugging HALPRIVATEDISPATCH->KdSetupPciDeviceForDebugging\n#define KdReleasePciDeviceforDebugging HALPRIVATEDISPATCH->KdReleasePciDeviceforDebugging\n#define KdGetAcpiTablePhase0 HALPRIVATEDISPATCH->KdGetAcpiTablePhase0\n#define KdCheckPowerButton HALPRIVATEDISPATCH->KdCheckPowerButton\n#define HalVectorToIDTEntry HALPRIVATEDISPATCH->HalVectorToIDTEntry\n#define KdMapPhysicalMemory64 HALPRIVATEDISPATCH->KdMapPhysicalMemory64\n#define KdUnmapVirtualAddress HALPRIVATEDISPATCH->KdUnmapVirtualAddress\n\n//\n// The DDK steals these away from you.\n//\n#ifdef _MSC_VER\nvoid __cdecl _enable(void);\nvoid __cdecl _disable(void);\n#pragma intrinsic(_enable)\n#pragma intrinsic(_disable)\n#endif\n\n//\n// Display Functions\n//\nNTHALAPI\nVOID\nNTAPI\nHalDisplayString(\n IN PCHAR String\n);\n\n//\n// Initialization Functions\n//\nNTHALAPI\nBOOLEAN\nNTAPI\nHalAllProcessorsStarted(\n VOID\n);\n\n#ifdef _ARC_\nNTHALAPI\nVOID\nNTAPI\nHalInitializeProcessor(\n ULONG ProcessorNumber,\n struct _LOADER_PARAMETER_BLOCK *LoaderBlock\n);\n\nNTHALAPI\nBOOLEAN\nNTAPI\nHalInitSystem(\n ULONG BootPhase,\n struct _LOADER_PARAMETER_BLOCK *LoaderBlock\n);\n\nNTHALAPI\nBOOLEAN\nNTAPI\nHalStartNextProcessor(\n IN struct _LOADER_PARAMETER_BLOCK *LoaderBlock,\n IN PKPROCESSOR_STATE ProcessorState\n);\n\n#endif\n\nNTHALAPI\nVOID\nNTAPI\nHalReturnToFirmware(\n FIRMWARE_REENTRY Action\n);\n\n//\n// CPU Routines\n//\nNTHALAPI\nVOID\nNTAPI\nHalProcessorIdle(\n VOID\n);\n\n//\n// Interrupt Functions\n//\nNTHALAPI\nBOOLEAN\nNTAPI\nHalBeginSystemInterrupt(\n KIRQL Irql,\n ULONG Vector,\n PKIRQL OldIrql\n);\n\nNTHALAPI\nBOOLEAN\nNTAPI\nHalDisableSystemInterrupt(\n ULONG Vector,\n KIRQL Irql\n);\n\nNTHALAPI\nBOOLEAN\nNTAPI\nHalEnableSystemInterrupt(\n ULONG Vector,\n KIRQL Irql,\n KINTERRUPT_MODE InterruptMode\n);\n\nNTHALAPI\nVOID\nNTAPI\nHalEndSystemInterrupt(\n KIRQL Irql,\n ULONG Vector\n);\n\nNTHALAPI\nVOID\nNTAPI\nHalReportResourceUsage(\n VOID\n);\n\nNTHALAPI\nVOID\nFASTCALL\nHalRequestSoftwareInterrupt(\n KIRQL SoftwareInterruptRequested\n);\n\nNTHALAPI\nVOID\nNTAPI\nHalRequestIpi(\n KAFFINITY TargetSet\n);\n\nNTHALAPI\nVOID\nNTAPI\nHalHandleNMI(\n PVOID NmiInfo\n);\n\n//\n// Environment Functions\n//\n#ifdef _ARC_\nNTHALAPI\nARC_STATUS\nNTAPI\nHalSetEnvironmentVariable(\n IN PCH Name,\n IN PCH Value\n);\n\nNTHALAPI\nARC_STATUS\nNTAPI\nHalGetEnvironmentVariable(\n IN PCH Variable,\n IN USHORT Length,\n OUT PCH Buffer\n);\n#endif\n\n//\n// Time Functions\n//\nNTHALAPI\nBOOLEAN\nNTAPI\nHalQueryRealTimeClock(\n IN PTIME_FIELDS RtcTime\n);\n\nNTHALAPI\nBOOLEAN\nNTAPI\nHalSetRealTimeClock(\n IN PTIME_FIELDS RtcTime\n);\n\n#endif\n#endif\n" }, { "path": "ndk/haltypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n haltypes.h\n\nAbstract:\n\n Type definitions for the HAL.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _HALTYPES_H\n#define _HALTYPES_H\n\n//\n// Dependencies\n//\n#include \n\n#ifndef NTOS_MODE_USER\n\n//\n// HalShutdownSystem Types\n//\ntypedef enum _FIRMWARE_REENTRY\n{\n HalHaltRoutine,\n HalPowerDownRoutine,\n HalRestartRoutine,\n HalRebootRoutine,\n HalInteractiveModeRoutine,\n HalMaximumRoutine\n} FIRMWARE_REENTRY, *PFIRMWARE_REENTRY;\n\n//\n// HAL Private function Types\n//\ntypedef\nPBUS_HANDLER\n(NTAPI *pHalHandlerForConfigSpace)(\n IN BUS_DATA_TYPE ConfigSpace,\n IN ULONG BusNumber\n);\n\ntypedef\nNTSTATUS\n(NTAPI *PINSTALL_BUS_HANDLER)(\n IN PBUS_HANDLER Bus\n);\n\ntypedef\nNTSTATUS\n(NTAPI *pHalRegisterBusHandler)(\n IN INTERFACE_TYPE InterfaceType,\n IN BUS_DATA_TYPE ConfigSpace,\n IN ULONG BusNumber,\n IN INTERFACE_TYPE ParentInterfaceType,\n IN ULONG ParentBusNumber,\n IN ULONG ContextSize,\n IN PINSTALL_BUS_HANDLER InstallCallback,\n OUT PBUS_HANDLER *BusHandler\n);\n\ntypedef\nVOID\n(NTAPI *pHalSetWakeEnable)(\n IN BOOLEAN Enable\n);\n\ntypedef\nVOID\n(NTAPI *pHalSetWakeAlarm)(\n IN ULONGLONG AlartTime,\n IN PTIME_FIELDS TimeFields\n);\n\ntypedef\nVOID\n(NTAPI *pHalLocateHiberRanges)(\n IN PVOID MemoryMap\n);\n\ntypedef\nBOOLEAN\n(NTAPI *pHalAllocateMapRegisters)(\n IN PADAPTER_OBJECT AdapterObject,\n IN ULONG Unknown,\n IN ULONG Unknown2,\n PMAP_REGISTER_ENTRY Registers\n);\n\n//\n// HAL Bus Handler Callback Types\n//\ntypedef\nNTSTATUS\n(NTAPI *pAdjustResourceList)(\n IN PBUS_HANDLER BusHandler,\n IN ULONG BusNumber,\n IN OUT PCM_RESOURCE_LIST Resources\n);\n\ntypedef\nNTSTATUS\n(NTAPI *pAssignSlotResources)(\n IN PBUS_HANDLER BusHandler,\n IN PBUS_HANDLER RootHandler,\n IN PUNICODE_STRING RegistryPath,\n IN PUNICODE_STRING DriverClassName,\n IN PDRIVER_OBJECT DriverObject,\n IN PDEVICE_OBJECT DeviceObject,\n IN ULONG SlotNumber,\n IN OUT PCM_RESOURCE_LIST *AllocatedResources\n);\n\ntypedef\nULONG\n(NTAPI *pGetSetBusData)(\n IN PBUS_HANDLER BusHandler,\n IN PBUS_HANDLER RootHandler,\n IN PCI_SLOT_NUMBER SlotNumber,\n OUT PUCHAR Buffer,\n IN ULONG Offset,\n IN ULONG Length\n);\n\ntypedef\nULONG\n(NTAPI *pGetInterruptVector)(\n IN PBUS_HANDLER BusHandler,\n IN ULONG BusNumber,\n IN ULONG BusInterruptLevel,\n IN ULONG BusInterruptVector,\n OUT PKIRQL Irql,\n OUT PKAFFINITY Affinity\n);\n\ntypedef\nULONG\n(NTAPI *pTranslateBusAddress)(\n IN PBUS_HANDLER BusHandler,\n IN ULONG BusNumber,\n IN PHYSICAL_ADDRESS BusAddress,\n IN OUT PULONG AddressSpace,\n OUT PPHYSICAL_ADDRESS TranslatedAddress\n);\n\n//\n// Hal Private dispatch Table\n//\n#define HAL_PRIVATE_DISPATCH_VERSION 2\ntypedef struct _HAL_PRIVATE_DISPATCH\n{\n ULONG Version;\n pHalHandlerForBus HalHandlerForBus;\n pHalHandlerForConfigSpace HalHandlerForConfigSpace;\n pHalLocateHiberRanges HalLocateHiberRanges;\n pHalRegisterBusHandler HalRegisterBusHandler;\n pHalSetWakeEnable HalSetWakeEnable;\n pHalSetWakeAlarm HalSetWakeAlarm;\n pHalTranslateBusAddress HalPciTranslateBusAddress;\n pHalAssignSlotResources HalPciAssignSlotResources;\n pHalHaltSystem HalHaltSystem;\n pHalFindBusAddressTranslation HalFindBusAddressTranslation;\n pHalResetDisplay HalResetDisplay;\n pHalAllocateMapRegisters HalAllocateMapRegisters;\n pKdSetupPciDeviceForDebugging KdSetupPciDeviceForDebugging;\n pKdReleasePciDeviceForDebugging KdReleasePciDeviceforDebugging;\n pKdGetAcpiTablePhase0 KdGetAcpiTablePhase0;\n pKdCheckPowerButton KdCheckPowerButton;\n pHalVectorToIDTEntry HalVectorToIDTEntry;\n pKdMapPhysicalMemory64 KdMapPhysicalMemory64;\n pKdUnmapVirtualAddress KdUnmapVirtualAddress;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n pKdGetPciDataByOffset KdGetPciDataByOffset;\n pKdSetPciDataByOffset KdSetPciDataByOffset;\n PVOID HalGetInterruptVectorOverride;\n PVOID HalGetVectorInputOverride;\n#endif\n} HAL_PRIVATE_DISPATCH, *PHAL_PRIVATE_DISPATCH;\n\n//\n// HAL Bus Handler\n//\ntypedef struct _BUS_HANDLER\n{\n ULONG Version;\n INTERFACE_TYPE InterfaceType;\n BUS_DATA_TYPE ConfigurationType;\n ULONG BusNumber;\n PDEVICE_OBJECT DeviceObject;\n struct _BUS_HANDLER *ParentHandler;\n PVOID BusData;\n ULONG DeviceControlExtensionSize;\n //PSUPPORTED_RANGES BusAddresses;\n ULONG Reserved[4];\n pGetSetBusData GetBusData;\n pGetSetBusData SetBusData;\n pAdjustResourceList AdjustResourceList;\n pAssignSlotResources AssignSlotResources;\n pGetInterruptVector GetInterruptVector;\n pTranslateBusAddress TranslateBusAddress;\n} BUS_HANDLER;\n\n//\n// Kernel Exports\n//\n#if defined(_NTDRIVER_) || defined(_NTHAL_)\nextern NTSYSAPI PHAL_PRIVATE_DISPATCH HalPrivateDispatchTable;\n#define HALPRIVATEDISPATCH ((PHAL_PRIVATE_DISPATCH)&HalPrivateDispatchTable)\n#else\nextern NTSYSAPI HAL_PRIVATE_DISPATCH HalPrivateDispatchTable;\n#define HALPRIVATEDISPATCH (&HalPrivateDispatchTable)\n#endif\n\n//\n// HAL Exports\n//\n#ifndef _NTHAL_\nextern NTHALAPI PUCHAR *KdComPortInUse;\n#endif\n\n#endif\n#endif\n\n\n\n" }, { "path": "ndk/i386/ketypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n ketypes.h (X86)\n\nAbstract:\n\n i386 Type definitions for the Kernel services.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _I386_KETYPES_H\n#define _I386_KETYPES_H\n\n//\n// Dependencies\n//\n\n//\n// Machine Types\n//\n#define MACHINE_TYPE_ISA 0x0000\n#define MACHINE_TYPE_EISA 0x0001\n#define MACHINE_TYPE_MCA 0x0002\n\n//\n// X86 80386 Segment Types\n//\n#define I386_TASK_GATE 0x5\n#define I386_TSS 0x9\n#define I386_ACTIVE_TSS 0xB\n#define I386_CALL_GATE 0xC\n#define I386_INTERRUPT_GATE 0xE\n#define I386_TRAP_GATE 0xF\n\n//\n// Selector Names\n//\n#define RPL_MASK 0x0003\n#define MODE_MASK 0x0001\n#define KGDT_R0_CODE 0x8\n#define KGDT_R0_DATA 0x10\n#define KGDT_R3_CODE 0x18\n#define KGDT_R3_DATA 0x20\n#define KGDT_TSS 0x28\n#define KGDT_R0_PCR 0x30\n#define KGDT_R3_TEB 0x38\n#define KGDT_LDT 0x48\n#define KGDT_DF_TSS 0x50\n#define KGDT_NMI_TSS 0x58\n\n//\n// CR4\n//\n#define CR4_VME 0x1\n#define CR4_PVI 0x2\n#define CR4_TSD 0x4\n#define CR4_DE 0x8\n#define CR4_PSE 0x10\n#define CR4_PAE 0x20\n#define CR4_MCE 0x40\n#define CR4_PGE 0x80\n#define CR4_FXSR 0x200\n#define CR4_XMMEXCPT 0x400\n\n//\n// EFlags\n//\n#define EFLAGS_CF 0x01L\n#define EFLAGS_ZF 0x40L\n#define EFLAGS_TF 0x100L\n#define EFLAGS_INTERRUPT_MASK 0x200L\n#define EFLAGS_DF 0x400L\n#define EFLAGS_NESTED_TASK 0x4000L\n#define EFLAGS_V86_MASK 0x20000\n#define EFLAGS_ALIGN_CHECK 0x40000\n#define EFLAGS_VIF 0x80000\n#define EFLAGS_VIP 0x100000\n#define EFLAGS_USER_SANITIZE 0x3F4DD7\n#define EFLAG_SIGN 0x8000\n#define EFLAG_ZERO 0x4000\n\n//\n// IPI Types\n//\n#define IPI_APC 1\n#define IPI_DPC 2\n#define IPI_FREEZE 4\n#define IPI_PACKET_READY 8\n#define IPI_SYNCH_REQUEST 16\n\n//\n// PRCB Flags\n//\n#define PRCB_MAJOR_VERSION 1\n#define PRCB_BUILD_DEBUG 1\n#define PRCB_BUILD_UNIPROCESSOR 2\n\n//\n// HAL Variables\n//\n#define INITIAL_STALL_COUNT 0x64\n\n//\n// IOPM Definitions\n//\n#define IO_ACCESS_MAP_NONE 0\n#define IOPM_OFFSET FIELD_OFFSET(KTSS, IoMaps[0].IoMap)\n#define KiComputeIopmOffset(MapNumber) \\\n (MapNumber == IO_ACCESS_MAP_NONE) ? \\\n (USHORT)(sizeof(KTSS)) : \\\n (USHORT)(FIELD_OFFSET(KTSS, IoMaps[MapNumber-1].IoMap))\n\n//\n// Static Kernel-Mode Address start (use MM_KSEG0_BASE for actual)\n//\n#define KSEG0_BASE 0x80000000\n\n//\n// Synchronization-level IRQL\n//\n#ifndef CONFIG_SMP\n#define SYNCH_LEVEL DISPATCH_LEVEL\n#else\n#define SYNCH_LEVEL (IPI_LEVEL - 1)\n#endif\n\n//\n// Trap Frame Definition\n//\ntypedef struct _KTRAP_FRAME\n{\n ULONG DbgEbp;\n ULONG DbgEip;\n ULONG DbgArgMark;\n ULONG DbgArgPointer;\n ULONG TempSegCs;\n ULONG TempEsp;\n ULONG Dr0;\n ULONG Dr1;\n ULONG Dr2;\n ULONG Dr3;\n ULONG Dr6;\n ULONG Dr7;\n ULONG SegGs;\n ULONG SegEs;\n ULONG SegDs;\n ULONG Edx;\n ULONG Ecx;\n ULONG Eax;\n ULONG PreviousPreviousMode;\n struct _EXCEPTION_REGISTRATION_RECORD FAR *ExceptionList;\n ULONG SegFs;\n ULONG Edi;\n ULONG Esi;\n ULONG Ebx;\n ULONG Ebp;\n ULONG ErrCode;\n ULONG Eip;\n ULONG SegCs;\n ULONG EFlags;\n ULONG HardwareEsp;\n ULONG HardwareSegSs;\n ULONG V86Es;\n ULONG V86Ds;\n ULONG V86Fs;\n ULONG V86Gs;\n} KTRAP_FRAME, *PKTRAP_FRAME;\n\n//\n// LDT Entry Definition\n//\n#ifndef _LDT_ENTRY_DEFINED\n#define _LDT_ENTRY_DEFINED\ntypedef struct _LDT_ENTRY\n{\n USHORT LimitLow;\n USHORT BaseLow;\n union\n {\n struct\n {\n UCHAR BaseMid;\n UCHAR Flags1;\n UCHAR Flags2;\n UCHAR BaseHi;\n } Bytes;\n struct\n {\n ULONG BaseMid:8;\n ULONG Type:5;\n ULONG Dpl:2;\n ULONG Pres:1;\n ULONG LimitHi:4;\n ULONG Sys:1;\n ULONG Reserved_0:1;\n ULONG Default_Big:1;\n ULONG Granularity:1;\n ULONG BaseHi:8;\n } Bits;\n } HighWord;\n} LDT_ENTRY, *PLDT_ENTRY, *LPLDT_ENTRY;\n#endif\n\n//\n// GDT Entry Definition\n//\ntypedef struct _KGDTENTRY\n{\n USHORT LimitLow;\n USHORT BaseLow;\n union\n {\n struct\n {\n UCHAR BaseMid;\n UCHAR Flags1;\n UCHAR Flags2;\n UCHAR BaseHi;\n } Bytes;\n struct\n {\n ULONG BaseMid:8;\n ULONG Type:5;\n ULONG Dpl:2;\n ULONG Pres:1;\n ULONG LimitHi:4;\n ULONG Sys:1;\n ULONG Reserved_0:1;\n ULONG Default_Big:1;\n ULONG Granularity:1;\n ULONG BaseHi:8;\n } Bits;\n } HighWord;\n} KGDTENTRY, *PKGDTENTRY;\n\n//\n// IDT Entry Access Definition\n//\ntypedef struct _KIDT_ACCESS\n{\n union\n {\n struct\n {\n UCHAR Reserved;\n UCHAR SegmentType:4;\n UCHAR SystemSegmentFlag:1;\n UCHAR Dpl:2;\n UCHAR Present:1;\n };\n USHORT Value;\n };\n} KIDT_ACCESS, *PKIDT_ACCESS;\n\n//\n// IDT Entry Definition\n//\ntypedef struct _KIDTENTRY\n{\n USHORT Offset;\n USHORT Selector;\n USHORT Access;\n USHORT ExtendedOffset;\n} KIDTENTRY, *PKIDTENTRY;\n\ntypedef struct _DESCRIPTOR\n{\n USHORT Pad;\n USHORT Limit;\n ULONG Base;\n} KDESCRIPTOR, *PKDESCRIPTOR;\n\n#ifndef NTOS_MODE_USER\n//\n// Macro to get current KPRCB\n//\nFORCEINLINE\nstruct _KPRCB *\nKeGetCurrentPrcb(VOID)\n{\n return (struct _KPRCB *)(ULONG_PTR)__readfsdword(FIELD_OFFSET(KPCR, Prcb));\n}\n\n//\n// FN/FX (FPU) Save Area Structures\n//\ntypedef struct _FNSAVE_FORMAT\n{\n ULONG ControlWord;\n ULONG StatusWord;\n ULONG TagWord;\n ULONG ErrorOffset;\n ULONG ErrorSelector;\n ULONG DataOffset;\n ULONG DataSelector;\n UCHAR RegisterArea[80];\n} FNSAVE_FORMAT, *PFNSAVE_FORMAT;\n\ntypedef struct _FXSAVE_FORMAT\n{\n USHORT ControlWord;\n USHORT StatusWord;\n USHORT TagWord;\n USHORT ErrorOpcode;\n ULONG ErrorOffset;\n ULONG ErrorSelector;\n ULONG DataOffset;\n ULONG DataSelector;\n ULONG MXCsr;\n ULONG MXCsrMask;\n UCHAR RegisterArea[128];\n UCHAR Reserved3[128];\n UCHAR Reserved4[224];\n UCHAR Align16Byte[8];\n} FXSAVE_FORMAT, *PFXSAVE_FORMAT;\n\ntypedef struct _FX_SAVE_AREA\n{\n union\n {\n FNSAVE_FORMAT FnArea;\n FXSAVE_FORMAT FxArea;\n } U;\n ULONG NpxSavedCpu;\n ULONG Cr0NpxState;\n} FX_SAVE_AREA, *PFX_SAVE_AREA;\n\n//\n// Special Registers Structure (outside of CONTEXT)\n//\ntypedef struct _KSPECIAL_REGISTERS\n{\n ULONG Cr0;\n ULONG Cr2;\n ULONG Cr3;\n ULONG Cr4;\n ULONG KernelDr0;\n ULONG KernelDr1;\n ULONG KernelDr2;\n ULONG KernelDr3;\n ULONG KernelDr6;\n ULONG KernelDr7;\n KDESCRIPTOR Gdtr;\n KDESCRIPTOR Idtr;\n USHORT Tr;\n USHORT Ldtr;\n ULONG Reserved[6];\n} KSPECIAL_REGISTERS, *PKSPECIAL_REGISTERS;\n\n//\n// Processor State Data\n//\ntypedef struct _KPROCESSOR_STATE\n{\n CONTEXT ContextFrame;\n KSPECIAL_REGISTERS SpecialRegisters;\n} KPROCESSOR_STATE, *PKPROCESSOR_STATE;\n\n//\n// Processor Region Control Block\n//\n#pragma pack(push,4)\ntypedef struct _KPRCB\n{\n USHORT MinorVersion;\n USHORT MajorVersion;\n struct _KTHREAD *CurrentThread;\n struct _KTHREAD *NextThread;\n struct _KTHREAD *IdleThread;\n UCHAR Number;\n UCHAR Reserved;\n USHORT BuildType;\n KAFFINITY SetMember;\n UCHAR CpuType;\n UCHAR CpuID;\n USHORT CpuStep;\n KPROCESSOR_STATE ProcessorState;\n ULONG KernelReserved[16];\n ULONG HalReserved[16];\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG CFlushSize;\n UCHAR PrcbPad0[88];\n#else\n UCHAR PrcbPad0[92];\n#endif\n KSPIN_LOCK_QUEUE LockQueue[LockQueueMaximumLock];\n struct _KTHREAD *NpxThread;\n ULONG InterruptCount;\n ULONG KernelTime;\n ULONG UserTime;\n ULONG DpcTime;\n ULONG DebugDpcTime;\n ULONG InterruptTime;\n ULONG AdjustDpcThreshold;\n ULONG PageColor;\n UCHAR SkipTick;\n UCHAR DebuggerSavedIRQL;\n#if (NTDDI_VERSION >= NTDDI_WS03)\n UCHAR NodeColor;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n UCHAR PollSlot;\n#else\n UCHAR Spare1;\n#endif\n ULONG NodeShiftedColor;\n#else\n UCHAR Spare1[6];\n#endif\n struct _KNODE *ParentNode;\n ULONG MultiThreadProcessorSet;\n struct _KPRCB *MultiThreadSetMaster;\n#if (NTDDI_VERSION >= NTDDI_WS03)\n ULONG SecondaryColorMask;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG DpcTimeLimit;\n#else\n LONG Sleeping;\n#endif\n#else\n ULONG ThreadStartCount[2];\n#endif\n ULONG CcFastReadNoWait;\n ULONG CcFastReadWait;\n ULONG CcFastReadNotPossible;\n ULONG CcCopyReadNoWait;\n ULONG CcCopyReadWait;\n ULONG CcCopyReadNoWaitMiss;\n#if (NTDDI_VERSION < NTDDI_LONGHORN)\n ULONG KeAlignmentFixupCount;\n#endif\n ULONG SpareCounter0;\n#if (NTDDI_VERSION < NTDDI_LONGHORN)\n ULONG KeDcacheFlushCount;\n ULONG KeExceptionDispatchCount;\n ULONG KeFirstLevelTbFills;\n ULONG KeFloatingEmulationCount;\n ULONG KeIcacheFlushCount;\n ULONG KeSecondLevelTbFills;\n ULONG KeSystemCalls;\n#endif\n volatile ULONG IoReadOperationCount;\n volatile ULONG IoWriteOperationCount;\n volatile ULONG IoOtherOperationCount;\n LARGE_INTEGER IoReadTransferCount;\n LARGE_INTEGER IoWriteTransferCount;\n LARGE_INTEGER IoOtherTransferCount;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG CcFastMdlReadNoWait;\n ULONG CcFastMdlReadWait;\n ULONG CcFastMdlReadNotPossible;\n ULONG CcMapDataNoWait;\n ULONG CcMapDataWait;\n ULONG CcPinMappedDataCount;\n ULONG CcPinReadNoWait;\n ULONG CcPinReadWait;\n ULONG CcMdlReadNoWait;\n ULONG CcMdlReadWait;\n ULONG CcLazyWriteHotSpots;\n ULONG CcLazyWriteIos;\n ULONG CcLazyWritePages;\n ULONG CcDataFlushes;\n ULONG CcDataPages;\n ULONG CcLostDelayedWrites;\n ULONG CcFastReadResourceMiss;\n ULONG CcCopyReadWaitMiss;\n ULONG CcFastMdlReadResourceMiss;\n ULONG CcMapDataNoWaitMiss;\n ULONG CcMapDataWaitMiss;\n ULONG CcPinReadNoWaitMiss;\n ULONG CcPinReadWaitMiss;\n ULONG CcMdlReadNoWaitMiss;\n ULONG CcMdlReadWaitMiss;\n ULONG CcReadAheadIos;\n ULONG KeAlignmentFixupCount;\n ULONG KeExceptionDispatchCount;\n ULONG KeSystemCalls;\n ULONG PrcbPad1[3];\n#else\n ULONG SpareCounter1[8];\n#endif\n PP_LOOKASIDE_LIST PPLookasideList[16];\n PP_LOOKASIDE_LIST PPNPagedLookasideList[32];\n PP_LOOKASIDE_LIST PPPagedLookasideList[32];\n volatile ULONG PacketBarrier;\n volatile ULONG ReverseStall;\n PVOID IpiFrame;\n UCHAR PrcbPad2[52];\n volatile PVOID CurrentPacket[3];\n volatile ULONG TargetSet;\n volatile PKIPI_WORKER WorkerRoutine;\n volatile ULONG IpiFrozen;\n UCHAR PrcbPad3[40];\n volatile ULONG RequestSummary;\n volatile struct _KPRCB *SignalDone;\n UCHAR PrcbPad4[56];\n struct _KDPC_DATA DpcData[2];\n PVOID DpcStack;\n ULONG MaximumDpcQueueDepth;\n ULONG DpcRequestRate;\n ULONG MinimumDpcRate;\n volatile UCHAR DpcInterruptRequested;\n volatile UCHAR DpcThreadRequested;\n volatile UCHAR DpcRoutineActive;\n volatile UCHAR DpcThreadActive;\n ULONG PrcbLock;\n ULONG DpcLastCount;\n volatile ULONG TimerHand;\n volatile ULONG TimerRequest;\n PVOID DpcThread;\n KEVENT DpcEvent;\n UCHAR ThreadDpcEnable;\n volatile BOOLEAN QuantumEnd;\n UCHAR PrcbPad50;\n volatile UCHAR IdleSchedule;\n LONG DpcSetEventRequest;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n LONG Sleeping;\n ULONG PeriodicCount;\n ULONG PeriodicBias;\n UCHAR PrcbPad5[6];\n#else\n UCHAR PrcbPad5[18];\n#endif\n LONG TickOffset;\n KDPC CallDpc;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n LONG ClockKeepAlive;\n UCHAR ClockCheckSlot;\n UCHAR ClockPollCycle;\n UCHAR PrcbPad6[2];\n LONG DpcWatchdogPeriod;\n LONG DpcWatchDogCount;\n LONG ThreadWatchdogPeriod;\n LONG ThreadWatchDogCount;\n ULONG PrcbPad70[2];\n#else\n ULONG PrcbPad7[8];\n#endif\n LIST_ENTRY WaitListHead;\n ULONG ReadySummary;\n ULONG QueueIndex;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n SINGLE_LIST_ENTRY DeferredReadyListHead;\n ULONGLONG StartCycles;\n ULONGLONG CycleTime;\n ULONGLONG PrcbPad71[3];\n LIST_ENTRY DispatcherReadyListHead[32];\n#else\n LIST_ENTRY DispatcherReadyListHead[32];\n SINGLE_LIST_ENTRY DeferredReadyListHead;\n ULONG PrcbPad72[11];\n#endif\n PVOID ChainedInterruptList;\n LONG LookasideIrpFloat;\n volatile LONG MmPageFaultCount;\n volatile LONG MmCopyOnWriteCount;\n volatile LONG MmTransitionCount;\n volatile LONG MmCacheTransitionCount;\n volatile LONG MmDemandZeroCount;\n volatile LONG MmPageReadCount;\n volatile LONG MmPageReadIoCount;\n volatile LONG MmCacheReadCount;\n volatile LONG MmCacheIoCount;\n volatile LONG MmDirtyPagesWriteCount;\n volatile LONG MmDirtyWriteIoCount;\n volatile LONG MmMappedPagesWriteCount;\n volatile LONG MmMappedWriteIoCount;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG CachedCommit;\n ULONG CachedResidentAvailable;\n PVOID HyperPte;\n UCHAR CpuVendor;\n UCHAR PrcbPad9[3];\n#else\n ULONG SpareFields0[1];\n#endif\n CHAR VendorString[13];\n UCHAR InitialApicId;\n UCHAR LogicalProcessorsPerPhysicalProcessor;\n ULONG MHz;\n ULONG FeatureBits;\n LARGE_INTEGER UpdateSignature;\n volatile LARGE_INTEGER IsrTime;\n LARGE_INTEGER SpareField1;\n FX_SAVE_AREA NpxSaveArea;\n PROCESSOR_POWER_STATE PowerState;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n KDPC DpcWatchdogDoc;\n KTIMER DpcWatchdogTimer;\n PVOID WheaInfo;\n PVOID EtwSupport;\n SLIST_HEADER InterruptObjectPool;\n LARGE_INTEGER HyperCallPagePhysical;\n LARGE_INTEGER HyperCallPageVirtual;\n PVOID RateControl;\n CACHE_DESCRIPTOR Cache[5];\n ULONG CacheCount;\n ULONG CacheProcessorMask[5];\n UCHAR LogicalProcessorsPerCore;\n UCHAR PrcbPad8[3];\n ULONG PackageProcessorSet;\n ULONG CoreProcessorSet;\n#endif\n} KPRCB, *PKPRCB;\n\n//\n// Processor Control Region\n//\ntypedef struct _KIPCR\n{\n union\n {\n NT_TIB NtTib;\n struct\n {\n struct _EXCEPTION_REGISTRATION_RECORD *Used_ExceptionList;\n PVOID Used_StackBase;\n PVOID PerfGlobalGroupMask;\n PVOID TssCopy;\n ULONG ContextSwitches;\n KAFFINITY SetMemberCopy;\n PVOID Used_Self;\n };\n };\n struct _KPCR *Self;\n struct _KPRCB *Prcb;\n KIRQL Irql;\n ULONG IRR;\n ULONG IrrActive;\n ULONG IDR;\n PVOID KdVersionBlock;\n PKIDTENTRY IDT;\n#ifdef __REACTOS__\n PUSHORT GDT;\n#else\n PKGDTENTRY GDT;\n#endif\n struct _KTSS *TSS;\n USHORT MajorVersion;\n USHORT MinorVersion;\n KAFFINITY SetMember;\n ULONG StallScaleFactor;\n UCHAR SparedUnused;\n UCHAR Number;\n UCHAR Reserved;\n UCHAR L2CacheAssociativity;\n ULONG VdmAlert;\n ULONG KernelReserved[14];\n ULONG SecondLevelCacheSize;\n ULONG HalReserved[16];\n ULONG InterruptMode;\n UCHAR Spare1;\n ULONG KernelReserved2[17];\n KPRCB PrcbData;\n} KIPCR, *PKIPCR;\n#pragma pack(pop)\n\n//\n// TSS Definition\n//\ntypedef struct _KiIoAccessMap\n{\n UCHAR DirectionMap[32];\n UCHAR IoMap[8196];\n} KIIO_ACCESS_MAP;\n\ntypedef struct _KTSS\n{\n USHORT Backlink;\n USHORT Reserved0;\n ULONG Esp0;\n USHORT Ss0;\n USHORT Reserved1;\n ULONG NotUsed1[4];\n ULONG CR3;\n ULONG Eip;\n ULONG EFlags;\n ULONG Eax;\n ULONG Ecx;\n ULONG Edx;\n ULONG Ebx;\n ULONG Esp;\n ULONG Ebp;\n ULONG Esi;\n ULONG Edi;\n USHORT Es;\n USHORT Reserved2;\n USHORT Cs;\n USHORT Reserved3;\n USHORT Ss;\n USHORT Reserved4;\n USHORT Ds;\n USHORT Reserved5;\n USHORT Fs;\n USHORT Reserved6;\n USHORT Gs;\n USHORT Reserved7;\n USHORT LDT;\n USHORT Reserved8;\n USHORT Flags;\n USHORT IoMapBase;\n KIIO_ACCESS_MAP IoMaps[1];\n UCHAR IntDirectionMap[32];\n} KTSS, *PKTSS;\n\n//\n// i386 CPUs don't have exception frames\n//\ntypedef struct _KEXCEPTION_FRAME KEXCEPTION_FRAME, *PKEXCEPTION_FRAME;\n#endif\n#endif\n" }, { "path": "ndk/i386/mmtypes.h", "content": "/*++ NDK Version: 0095\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n mmtypes.h (X86)\n\nAbstract:\n\n i386 Type definitions for the Memory Manager\n\nAuthor:\n\n Alex Ionescu (alex.ionescu@reactos.com) 06-Oct-2004\n\n--*/\n\n#ifndef _I386_MMTYPES_H\n#define _I386_MMTYPES_H\n\n//\n// Dependencies\n//\n\n//\n// Page-related Macros\n//\n#define PAGE_SIZE 0x1000\n#define PAGE_SHIFT 12L\n#define MM_ALLOCATION_GRANULARITY 0x10000\n#define MM_ALLOCATION_GRANULARITY_SHIFT 16L\n\n//\n// Sanity checks for Paging Macros\n//\n#ifdef C_ASSERT\nC_ASSERT(PAGE_SIZE == (1 << PAGE_SHIFT));\nC_ASSERT(MM_ALLOCATION_GRANULARITY == (1 << MM_ALLOCATION_GRANULARITY_SHIFT));\nC_ASSERT(MM_ALLOCATION_GRANULARITY &&\n !(MM_ALLOCATION_GRANULARITY & (MM_ALLOCATION_GRANULARITY - 1)));\nC_ASSERT(MM_ALLOCATION_GRANULARITY >= PAGE_SIZE);\n#endif\n\n//\n// PAE SEG0 Base?\n//\n#define KSEG0_BASE_PAE 0xE0000000\n\n//\n// Page Table Entry Definitions\n//\ntypedef struct _HARDWARE_PTE_X86\n{\n ULONG Valid:1;\n ULONG Write:1;\n ULONG Owner:1;\n ULONG WriteThrough:1;\n ULONG CacheDisable:1;\n ULONG Accessed:1;\n ULONG Dirty:1;\n ULONG LargePage:1;\n ULONG Global:1;\n ULONG CopyOnWrite:1;\n ULONG Prototype: 1;\n ULONG reserved: 1;\n ULONG PageFrameNumber:20;\n} HARDWARE_PTE_X86, *PHARDWARE_PTE_X86;\n\ntypedef struct _MMPTE_SOFTWARE\n{\n ULONG Valid:1;\n ULONG PageFileLow:4;\n ULONG Protection:5;\n ULONG Prototype:1;\n ULONG Transition:1;\n ULONG PageFileHigh:20;\n} MMPTE_SOFTWARE;\n\ntypedef struct _MMPTE_TRANSITION\n{\n ULONG Valid:1;\n ULONG Write:1;\n ULONG Owner:1;\n ULONG WriteThrough:1;\n ULONG CacheDisable:1;\n ULONG Protection:5;\n ULONG Prototype:1;\n ULONG Transition:1;\n ULONG PageFrameNumber:20;\n} MMPTE_TRANSITION;\n\ntypedef struct _MMPTE_PROTOTYPE\n{\n ULONG Valid:1;\n ULONG ProtoAddressLow:7;\n ULONG ReadOnly:1;\n ULONG WhichPool:1;\n ULONG Prototype:1;\n ULONG ProtoAddressHigh:21;\n} MMPTE_PROTOTYPE;\n\ntypedef struct _MMPTE_SUBSECTION\n{\n ULONG Valid:1;\n ULONG SubsectionAddressLow:4;\n ULONG Protection:5;\n ULONG Prototype:1;\n ULONG SubsectionAddressHigh:20;\n ULONG WhichPool:1;\n} MMPTE_SUBSECTION;\n\ntypedef struct _MMPTE_LIST\n{\n ULONG Valid:1;\n ULONG OneEntry:1;\n ULONG filler0:8;\n ULONG NextEntry:20;\n ULONG Prototype:1;\n ULONG filler1:1;\n} MMPTE_LIST;\n\n#ifndef CONFIG_SMP\n\ntypedef struct _MMPTE_HARDWARE\n{\n ULONG Valid:1;\n ULONG Write:1;\n ULONG Owner:1;\n ULONG WriteThrough:1;\n ULONG CacheDisable:1;\n ULONG Accessed:1;\n ULONG Dirty:1;\n ULONG LargePage:1;\n ULONG Global:1;\n ULONG CopyOnWrite:1;\n ULONG Prototype:1;\n ULONG reserved:1;\n ULONG PageFrameNumber:20;\n} MMPTE_HARDWARE, *PMMPTE_HARDWARE;\n\n#else\n\ntypedef struct _MMPTE_HARDWARE\n{\n ULONG Valid:1;\n ULONG Writable:1;\n ULONG Owner:1;\n ULONG WriteThrough:1;\n ULONG CacheDisable:1;\n ULONG Accessed:1;\n ULONG Dirty:1;\n ULONG LargePage:1;\n ULONG Global:1;\n ULONG CopyOnWrite:1;\n ULONG Prototype:1;\n ULONG Write:1;\n ULONG PageFrameNumber:20;\n} MMPTE_HARDWARE, *PMMPTE_HARDWARE;\n\n#endif\n\n//\n// Use the right PTE structure\n//\n#define HARDWARE_PTE HARDWARE_PTE_X86\n#define PHARDWARE_PTE PHARDWARE_PTE_X86\n\n#endif\n" }, { "path": "ndk/ifssupp.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n ifssupp.h\n\nAbstract:\n\n NDK Support for usage without the IFS. Will be deprecated at WDK Release.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n#ifndef _NTIFS_\n#ifndef NTOS_MODE_USER\n#define _NTIFS_\n\n#define TOKEN_SOURCE_LENGTH 8\n\ntypedef enum _TOKEN_TYPE\n{\n TokenPrimary = 1,\n TokenImpersonation\n} TOKEN_TYPE, *PTOKEN_TYPE;\n\ntypedef PVOID PRTL_HEAP_PARAMETERS;\ntypedef PVOID PFS_FILTER_CALLBACKS;\ntypedef USHORT SECURITY_DESCRIPTOR_CONTROL, *PSECURITY_DESCRIPTOR_CONTROL;\n\ntypedef struct _RTL_SPLAY_LINKS\n{\n struct _RTL_SPLAY_LINKS *Parent;\n struct _RTL_SPLAY_LINKS *LeftChild;\n struct _RTL_SPLAY_LINKS *RightChild;\n} RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;\n\ntypedef struct _RTL_GENERIC_TABLE RTL_GENERIC_TABLE, *PRTL_GENERIC_TABLE;\ntypedef ULONG TABLE_SEARCH_RESULT;\n\n#if defined(USE_LPC6432)\n#define LPC_CLIENT_ID CLIENT_ID64\n#define LPC_SIZE_T ULONGLONG\n#define LPC_PVOID ULONGLONG\n#define LPC_HANDLE ULONGLONG\n#else\n#define LPC_CLIENT_ID CLIENT_ID\n#define LPC_SIZE_T SIZE_T\n#define LPC_PVOID PVOID\n#define LPC_HANDLE HANDLE\n#endif\n\ntypedef struct _PORT_MESSAGE\n{\n union\n {\n struct\n {\n CSHORT DataLength;\n CSHORT TotalLength;\n } s1;\n ULONG Length;\n } u1;\n union\n {\n struct\n {\n CSHORT Type;\n CSHORT DataInfoOffset;\n } s2;\n ULONG ZeroInit;\n } u2;\n union\n {\n LPC_CLIENT_ID ClientId;\n double DoNotUseThisField;\n };\n ULONG MessageId;\n union\n {\n LPC_SIZE_T ClientViewSize;\n ULONG CallbackId;\n };\n} PORT_MESSAGE, *PPORT_MESSAGE;\n\ntypedef struct _PORT_VIEW\n{\n ULONG Length;\n LPC_HANDLE SectionHandle;\n ULONG SectionOffset;\n LPC_SIZE_T ViewSize;\n LPC_PVOID ViewBase;\n LPC_PVOID ViewRemoteBase;\n} PORT_VIEW, *PPORT_VIEW;\n\ntypedef struct _REMOTE_PORT_VIEW\n{\n ULONG Length;\n LPC_SIZE_T ViewSize;\n LPC_PVOID ViewBase;\n} REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW;\n\ntypedef struct _KAPC_STATE\n{\n LIST_ENTRY ApcListHead[2];\n struct _KPROCESS *Process;\n BOOLEAN KernelApcInProgress;\n BOOLEAN KernelApcPending;\n BOOLEAN UserApcPending;\n} KAPC_STATE, *PKAPC_STATE, *RESTRICTED_POINTER PRKAPC_STATE;\n\ntypedef struct _KQUEUE\n{\n DISPATCHER_HEADER Header;\n LIST_ENTRY EntryListHead;\n ULONG CurrentCount;\n ULONG MaximumCount;\n LIST_ENTRY ThreadListHead;\n} KQUEUE, *PKQUEUE, *RESTRICTED_POINTER PRKQUEUE;\n\ntypedef struct _ACE_HEADER\n{\n UCHAR AceType;\n UCHAR AceFlags;\n USHORT AceSize;\n} ACE_HEADER, *PACE_HEADER;\n\ntypedef enum _RTL_GENERIC_COMPARE_RESULTS\n{\n GenericLessThan,\n GenericGreaterThan,\n GenericEqual\n} RTL_GENERIC_COMPARE_RESULTS;\n\ntypedef struct _SID_IDENTIFIER_AUTHORITY\n{\n UCHAR Value[6];\n} SID_IDENTIFIER_AUTHORITY, *PSID_IDENTIFIER_AUTHORITY;\n\ntypedef struct _SID_AND_ATTRIBUTES\n{\n PSID Sid;\n ULONG Attributes;\n} SID_AND_ATTRIBUTES, * PSID_AND_ATTRIBUTES;\n\ntypedef struct _TOKEN_SOURCE\n{\n CHAR SourceName[TOKEN_SOURCE_LENGTH];\n LUID SourceIdentifier;\n} TOKEN_SOURCE, *PTOKEN_SOURCE;\n\ntypedef struct _TOKEN_CONTROL\n{\n LUID TokenId;\n LUID AuthenticationId;\n LUID ModifiedId;\n TOKEN_SOURCE TokenSource;\n} TOKEN_CONTROL, *PTOKEN_CONTROL;\n\ntypedef struct _SECURITY_CLIENT_CONTEXT\n{\n SECURITY_QUALITY_OF_SERVICE SecurityQos;\n PACCESS_TOKEN ClientToken;\n BOOLEAN DirectlyAccessClientToken;\n BOOLEAN DirectAccessEffectiveOnly;\n BOOLEAN ServerIsRemote;\n TOKEN_CONTROL ClientTokenControl;\n} SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;\n\ntypedef struct _SECURITY_DESCRIPTOR_RELATIVE\n{\n UCHAR Revision;\n UCHAR Sbz1;\n SECURITY_DESCRIPTOR_CONTROL Control;\n ULONG Owner;\n ULONG Group;\n ULONG Sacl;\n ULONG Dacl;\n} SECURITY_DESCRIPTOR_RELATIVE, *PISECURITY_DESCRIPTOR_RELATIVE;\n\ntypedef struct _TOKEN_GROUPS\n{\n ULONG GroupCount;\n SID_AND_ATTRIBUTES Groups[ANYSIZE_ARRAY];\n} TOKEN_GROUPS, *PTOKEN_GROUPS;\n\ntypedef struct _TOKEN_PRIVILEGES\n{\n ULONG PrivilegeCount;\n LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];\n} TOKEN_PRIVILEGES, *PTOKEN_PRIVILEGES;\n\ntypedef struct _TOKEN_USER\n{\n SID_AND_ATTRIBUTES User;\n} TOKEN_USER, *PTOKEN_USER;\n\ntypedef enum _TOKEN_INFORMATION_CLASS\n{\n TokenUser = 1,\n TokenGroups,\n TokenPrivileges,\n TokenOwner,\n TokenPrimaryGroup,\n TokenDefaultDacl,\n TokenSource,\n TokenType,\n TokenImpersonationLevel,\n TokenStatistics,\n TokenRestrictedSids,\n TokenSessionId,\n TokenGroupsAndPrivileges,\n TokenSessionReference,\n TokenSandBoxInert,\n TokenAuditPolicy,\n TokenOrigin,\n TokenElevationType,\n TokenLinkedToken,\n TokenElevation,\n TokenIsRestricted,\n TokenAccessInformation,\n TokenVirtualization,\n TokenIntegrityLevel,\n TokenIntegrityLevelDesktop,\n TokenMandatoryPolicy,\n MaxTokenInfoClass\n} TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;\n\ntypedef struct _TOKEN_OWNER\n{\n PSID Owner;\n} TOKEN_OWNER, *PTOKEN_OWNER;\n\ntypedef struct _TOKEN_PRIMARY_GROUP\n{\n PSID PrimaryGroup;\n} TOKEN_PRIMARY_GROUP, *PTOKEN_PRIMARY_GROUP;\n\ntypedef struct _TOKEN_DEFAULT_DACL\n{\n PACL DefaultDacl;\n} TOKEN_DEFAULT_DACL, *PTOKEN_DEFAULT_DACL;\n\n#endif // !NTOS_MODE_USER\n#endif // _NTIFS_\n" }, { "path": "ndk/inbvfuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n inbvfuncs.h\n\nAbstract:\n\n Function definitions for the Boot Video Driver.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _INBVFUNCS_H\n#define _INBVFUNCS_H\n\n//\n// Dependencies\n//\n#include \n#include \n\n#ifndef NTOS_MODE_USER\n//\n// Ownership Functions\n//\nVOID\nNTAPI\nInbvAcquireDisplayOwnership(\n VOID\n);\n\nBOOLEAN\nNTAPI\nInbvCheckDisplayOwnership(\n VOID\n);\n\nVOID\nNTAPI\nInbvNotifyDisplayOwnershipLost(\n IN INBV_RESET_DISPLAY_PARAMETERS Callback\n);\n\n//\n// Installation Functions\n//\nVOID\nNTAPI\nInbvEnableBootDriver(\n IN BOOLEAN Enable\n);\n\nVOID\nNTAPI\nInbvInstallDisplayStringFilter(\n IN INBV_DISPLAY_STRING_FILTER DisplayFilter\n);\n\nBOOLEAN\nNTAPI\nInbvIsBootDriverInstalled(\n VOID\n);\n\n//\n// Display Functions\n//\nBOOLEAN\nNTAPI\nInbvDisplayString(\n IN PCHAR String\n);\n\nBOOLEAN\nNTAPI\nInbvEnableDisplayString(\n IN BOOLEAN Enable\n);\n\nBOOLEAN\nNTAPI\nInbvResetDisplay(\n VOID\n);\n\nVOID\nNTAPI\nInbvSetScrollRegion(\n IN ULONG Left,\n IN ULONG Top,\n IN ULONG Width,\n IN ULONG Height\n);\n\nVOID\nNTAPI\nInbvSetTextColor(\n IN ULONG Color\n);\n\nVOID\nNTAPI\nInbvSolidColorFill(\n IN ULONG Left,\n IN ULONG Top,\n IN ULONG Width,\n IN ULONG Height,\n IN ULONG Color\n);\n\nVOID\nNTAPI\nInbvSetProgressBarSubset(\n IN ULONG Floor,\n IN ULONG Ceiling\n);\n\n#endif\n#endif\n" }, { "path": "ndk/inbvtypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n inbvtypes.h\n\nAbstract:\n\n Type definitions for the Boot Video Driver.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Created - 02-Feb-2007\n\n--*/\n\n#ifndef _INBVTYPES_H\n#define _INBVTYPES_H\n\n//\n// Dependencies\n//\n#include \n#ifndef NTOS_MODE_USER\n\n//\n// Boot Video Display Ownership Status\n//\ntypedef enum _INBV_DISPLAY_STATE\n{\n INBV_DISPLAY_STATE_OWNED,\n INBV_DISPLAY_STATE_DISABLED,\n INBV_DISPLAY_STATE_LOST\n} INBV_DISPLAY_STATE;\n\n//\n// Function Callbacks\n//\ntypedef\nBOOLEAN\n(NTAPI *INBV_RESET_DISPLAY_PARAMETERS)(\n ULONG Cols,\n ULONG Rows\n);\n\ntypedef\nVOID\n(NTAPI *INBV_DISPLAY_STRING_FILTER)(\n PCHAR *Str\n);\n\n#endif\n#endif\n" }, { "path": "ndk/iofuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n iofuncs.h\n\nAbstract:\n\n Function definitions for the I/O Manager.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _IOFUNCS_H\n#define _IOFUNCS_H\n\n//\n// Dependencies\n//\n#include \n#include \n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n\n//\n// I/O Functions\n//\n#ifndef NTOS_MODE_USER\nVOID\nFASTCALL\nIoAssignDriveLetters(\n IN struct _LOADER_PARAMETER_BLOCK *LoaderBlock,\n IN PSTRING NtDeviceName,\n OUT PUCHAR NtSystemPath,\n OUT PSTRING NtSystemPathString\n);\n#endif\n\n//\n// Native calls\n//\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAddBootEntry(\n IN PBOOT_ENTRY BootEntry,\n IN ULONG Id\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAddDriverEntry(\n IN PEFI_DRIVER_ENTRY BootEntry,\n IN ULONG Id\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCancelIoFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateFile(\n OUT PHANDLE FileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PLARGE_INTEGER AllocationSize OPTIONAL,\n IN ULONG FileAttributes,\n IN ULONG ShareAccess,\n IN ULONG CreateDisposition,\n IN ULONG CreateOptions,\n IN PVOID EaBuffer OPTIONAL,\n IN ULONG EaLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateIoCompletion(\n OUT PHANDLE IoCompletionHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN ULONG NumberOfConcurrentThreads\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateMailslotFile(\n OUT PHANDLE MailSlotFileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG FileAttributes,\n IN ULONG ShareAccess,\n IN ULONG MaxMessageSize,\n IN PLARGE_INTEGER TimeOut\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateNamedPipeFile(\n OUT PHANDLE NamedPipeFileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG ShareAccess,\n IN ULONG CreateDisposition,\n IN ULONG CreateOptions,\n IN ULONG WriteModeMessage,\n IN ULONG ReadModeMessage,\n IN ULONG NonBlocking,\n IN ULONG MaxInstances,\n IN ULONG InBufferSize,\n IN ULONG OutBufferSize,\n IN PLARGE_INTEGER DefaultTimeOut\n);\n\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteDriverEntry(\n IN ULONG Id\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteBootEntry(\n IN ULONG Id\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteFile(\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeviceIoControlFile(\n IN HANDLE DeviceHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,\n IN PVOID UserApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG IoControlCode,\n IN PVOID InputBuffer,\n IN ULONG InputBufferSize,\n OUT PVOID OutputBuffer,\n IN ULONG OutputBufferSize\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtEnumerateBootEntries(\n IN PVOID Buffer,\n IN PULONG BufferLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtEnumerateDriverEntries(\n IN PVOID Buffer,\n IN PULONG BufferLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFlushBuffersFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFlushWriteBuffer(VOID);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFsControlFile(\n IN HANDLE DeviceHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG IoControlCode,\n IN PVOID InputBuffer,\n IN ULONG InputBufferSize,\n OUT PVOID OutputBuffer,\n IN ULONG OutputBufferSize\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtLoadDriver(\n IN PUNICODE_STRING DriverServiceName\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtLockFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PLARGE_INTEGER ByteOffset,\n IN PLARGE_INTEGER Length,\n IN ULONG Key,\n IN BOOLEAN FailImmediatedly,\n IN BOOLEAN ExclusiveLock\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtModifyBootEntry(\n IN PBOOT_ENTRY BootEntry\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtModifyDriverEntry(\n IN PEFI_DRIVER_ENTRY DriverEntry\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtNotifyChangeDirectoryFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID Buffer,\n IN ULONG BufferSize,\n IN ULONG CompletionFilter,\n IN BOOLEAN WatchTree\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenFile(\n OUT PHANDLE FileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG ShareAccess,\n IN ULONG OpenOptions\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenIoCompletion(\n OUT PHANDLE CompetionPort,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryAttributesFile(\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PFILE_BASIC_INFORMATION FileInformation\n);\n\nNTSTATUS\nNTAPI\nNtQueryDriverEntryOrder(\n IN PULONG Ids,\n IN PULONG Count\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryBootEntryOrder(\n IN PULONG Ids,\n IN PULONG Count\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryBootOptions(\n IN PBOOT_OPTIONS BootOptions,\n IN PULONG BootOptionsLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryDirectoryFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID FileInformation,\n IN ULONG Length,\n IN FILE_INFORMATION_CLASS FileInformationClass,\n IN BOOLEAN ReturnSingleEntry,\n IN PUNICODE_STRING FileName OPTIONAL,\n IN BOOLEAN RestartScan\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryEaFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID Buffer,\n IN ULONG Length,\n IN BOOLEAN ReturnSingleEntry,\n IN PVOID EaList OPTIONAL,\n IN ULONG EaListLength,\n IN PULONG EaIndex OPTIONAL,\n IN BOOLEAN RestartScan\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryFullAttributesFile(\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PFILE_NETWORK_OPEN_INFORMATION FileInformation\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID FileInformation,\n IN ULONG Length,\n IN FILE_INFORMATION_CLASS FileInformationClass\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryIoCompletion(\n IN HANDLE IoCompletionHandle,\n IN IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,\n OUT PVOID IoCompletionInformation,\n IN ULONG IoCompletionInformationLength,\n OUT PULONG ResultLength OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryQuotaInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID Buffer,\n IN ULONG Length,\n IN BOOLEAN ReturnSingleEntry,\n IN PVOID SidList OPTIONAL,\n IN ULONG SidListLength,\n IN PSID StartSid OPTIONAL,\n IN BOOLEAN RestartScan\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryVolumeInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID FsInformation,\n IN ULONG Length,\n IN FS_INFORMATION_CLASS FsInformationClass\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReadFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,\n IN PVOID UserApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID Buffer,\n IN ULONG BufferLength,\n IN PLARGE_INTEGER ByteOffset OPTIONAL,\n IN PULONG Key OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReadFileScatter(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,\n IN PVOID UserApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK UserIoStatusBlock,\n IN FILE_SEGMENT_ELEMENT BufferDescription[],\n IN ULONG BufferLength,\n IN PLARGE_INTEGER ByteOffset,\n IN PULONG Key OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRemoveIoCompletion(\n IN HANDLE IoCompletionHandle,\n OUT PVOID *CompletionKey,\n OUT PVOID *CompletionContext,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PLARGE_INTEGER Timeout OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetBootEntryOrder(\n IN PULONG Ids,\n IN PULONG Count\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetBootOptions(\n IN PBOOT_OPTIONS BootOptions,\n IN ULONG FieldsToChange\n);\n\nNTSTATUS\nNTAPI\nNtSetDriverEntryOrder(\n IN PULONG Ids,\n IN PULONG Count\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetEaFile(\n IN HANDLE FileHandle,\n IN PIO_STATUS_BLOCK IoStatusBlock,\n PVOID EaBuffer,\n ULONG EaBufferSize\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationFile(\n IN HANDLE FileHandle,\n IN PIO_STATUS_BLOCK IoStatusBlock,\n IN PVOID FileInformation,\n IN ULONG Length,\n IN FILE_INFORMATION_CLASS FileInformationClass\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetIoCompletion(\n IN HANDLE IoCompletionPortHandle,\n IN PVOID CompletionKey,\n IN PVOID CompletionContext,\n IN NTSTATUS CompletionStatus,\n IN ULONG CompletionInformation\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetQuotaInformationFile(\n HANDLE FileHandle,\n PIO_STATUS_BLOCK IoStatusBlock,\n PVOID Buffer,\n ULONG BufferLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetVolumeInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PVOID FsInformation,\n IN ULONG Length,\n IN FS_INFORMATION_CLASS FsInformationClass\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtTranslateFilePath(\n PFILE_PATH InputFilePath,\n ULONG OutputType,\n PFILE_PATH OutputFilePath,\n ULONG OutputFilePathLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnloadDriver(\n IN PUNICODE_STRING DriverServiceName\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnlockFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PLARGE_INTEGER ByteOffset,\n IN PLARGE_INTEGER Lenght,\n OUT ULONG Key OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWriteFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PVOID Buffer,\n IN ULONG Length,\n IN PLARGE_INTEGER ByteOffset,\n IN PULONG Key OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWriteFileGather(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN FILE_SEGMENT_ELEMENT BufferDescription[],\n IN ULONG BufferLength,\n IN PLARGE_INTEGER ByteOffset,\n IN PULONG Key OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAddBootEntry(\n IN PUNICODE_STRING EntryName,\n IN PUNICODE_STRING EntryValue\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCancelIoFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateFile(\n OUT PHANDLE FileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PLARGE_INTEGER AllocationSize OPTIONAL,\n IN ULONG FileAttributes,\n IN ULONG ShareAccess,\n IN ULONG CreateDisposition,\n IN ULONG CreateOptions,\n IN PVOID EaBuffer OPTIONAL,\n IN ULONG EaLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateIoCompletion(\n OUT PHANDLE IoCompletionHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN ULONG NumberOfConcurrentThreads\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateMailslotFile(\n OUT PHANDLE MailSlotFileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG FileAttributes,\n IN ULONG ShareAccess,\n IN ULONG MaxMessageSize,\n IN PLARGE_INTEGER TimeOut\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateNamedPipeFile(\n OUT PHANDLE NamedPipeFileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG ShareAccess,\n IN ULONG CreateDisposition,\n IN ULONG CreateOptions,\n IN ULONG WriteModeMessage,\n IN ULONG ReadModeMessage,\n IN ULONG NonBlocking,\n IN ULONG MaxInstances,\n IN ULONG InBufferSize,\n IN ULONG OutBufferSize,\n IN PLARGE_INTEGER DefaultTimeOut\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDeleteBootEntry(\n IN PUNICODE_STRING EntryName,\n IN PUNICODE_STRING EntryValue\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDeleteFile(\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDeviceIoControlFile(\n IN HANDLE DeviceHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,\n IN PVOID UserApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG IoControlCode,\n IN PVOID InputBuffer,\n IN ULONG InputBufferSize,\n OUT PVOID OutputBuffer,\n IN ULONG OutputBufferSize\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwFlushBuffersFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwFlushWriteBuffer(VOID);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwFsControlFile(\n IN HANDLE DeviceHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG IoControlCode,\n IN PVOID InputBuffer,\n IN ULONG InputBufferSize,\n OUT PVOID OutputBuffer,\n IN ULONG OutputBufferSize\n);\n\n#ifdef NTOS_MODE_USER\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwLoadDriver(\n IN PUNICODE_STRING DriverServiceName\n);\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwLockFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PLARGE_INTEGER ByteOffset,\n IN PLARGE_INTEGER Length,\n IN ULONG Key,\n IN BOOLEAN FailImmediatedly,\n IN BOOLEAN ExclusiveLock\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwNotifyChangeDirectoryFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID Buffer,\n IN ULONG BufferSize,\n IN ULONG CompletionFilter,\n IN BOOLEAN WatchTree\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenFile(\n OUT PHANDLE FileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG ShareAccess,\n IN ULONG OpenOptions\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenIoCompletion(\n OUT PHANDLE CompetionPort,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryAttributesFile(\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PFILE_BASIC_INFORMATION FileInformation\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryDirectoryFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID FileInformation,\n IN ULONG Length,\n IN FILE_INFORMATION_CLASS FileInformationClass,\n IN BOOLEAN ReturnSingleEntry,\n IN PUNICODE_STRING FileName OPTIONAL,\n IN BOOLEAN RestartScan\n);\n\n#ifdef NTOS_MODE_USER\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryEaFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID Buffer,\n IN ULONG Length,\n IN BOOLEAN ReturnSingleEntry,\n IN PVOID EaList OPTIONAL,\n IN ULONG EaListLength,\n IN PULONG EaIndex OPTIONAL,\n IN BOOLEAN RestartScan\n);\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryFullAttributesFile(\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PFILE_NETWORK_OPEN_INFORMATION FileInformation\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID FileInformation,\n IN ULONG Length,\n IN FILE_INFORMATION_CLASS FileInformationClass\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryIoCompletion(\n IN HANDLE IoCompletionHandle,\n IN IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,\n OUT PVOID IoCompletionInformation,\n IN ULONG IoCompletionInformationLength,\n OUT PULONG ResultLength OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryQuotaInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID Buffer,\n IN ULONG Length,\n IN BOOLEAN ReturnSingleEntry,\n IN PVOID SidList OPTIONAL,\n IN ULONG SidListLength,\n IN PSID StartSid OPTIONAL,\n IN BOOLEAN RestartScan\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryVolumeInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID FsInformation,\n IN ULONG Length,\n IN FS_INFORMATION_CLASS FsInformationClass\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwReadFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,\n IN PVOID UserApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID Buffer,\n IN ULONG BufferLength,\n IN PLARGE_INTEGER ByteOffset OPTIONAL,\n IN PULONG Key OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwReadFileScatter(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,\n IN PVOID UserApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK UserIoStatusBlock,\n IN FILE_SEGMENT_ELEMENT BufferDescription[],\n IN ULONG BufferLength,\n IN PLARGE_INTEGER ByteOffset,\n IN PULONG Key OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwRemoveIoCompletion(\n IN HANDLE IoCompletionHandle,\n OUT PVOID *CompletionKey,\n OUT PVOID *CompletionContext,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PLARGE_INTEGER Timeout OPTIONAL\n);\n\n#ifdef NTOS_MODE_USER\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetEaFile(\n IN HANDLE FileHandle,\n IN PIO_STATUS_BLOCK IoStatusBlock,\n PVOID EaBuffer,\n ULONG EaBufferSize\n);\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetInformationFile(\n IN HANDLE FileHandle,\n IN PIO_STATUS_BLOCK IoStatusBlock,\n IN PVOID FileInformation,\n IN ULONG Length,\n IN FILE_INFORMATION_CLASS FileInformationClass\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetIoCompletion(\n IN HANDLE IoCompletionPortHandle,\n IN PVOID CompletionKey,\n IN PVOID CompletionContext,\n IN NTSTATUS CompletionStatus,\n IN ULONG CompletionInformation\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetQuotaInformationFile(\n HANDLE FileHandle,\n PIO_STATUS_BLOCK IoStatusBlock,\n PVOID Buffer,\n ULONG BufferLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetVolumeInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PVOID FsInformation,\n IN ULONG Length,\n IN FS_INFORMATION_CLASS FsInformationClass\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwUnloadDriver(\n IN PUNICODE_STRING DriverServiceName\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwUnlockFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PLARGE_INTEGER ByteOffset,\n IN PLARGE_INTEGER Lenght,\n OUT ULONG Key OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwWriteFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PVOID Buffer,\n IN ULONG Length,\n IN PLARGE_INTEGER ByteOffset,\n IN PULONG Key OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwWriteFileGather(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN FILE_SEGMENT_ELEMENT BufferDescription[],\n IN ULONG BufferLength,\n IN PLARGE_INTEGER ByteOffset,\n IN PULONG Key OPTIONAL\n);\n\n#ifdef __cplusplus\n}\n#endif\n\n#endif\n\n\n" }, { "path": "ndk/iotypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n iotypes.h\n\nAbstract:\n\n Type definitions for the I/O Manager.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n#ifndef _IOTYPES_H\n#define _IOTYPES_H\n\n//\n// Dependencies\n//\n#include \n#include \n\n//\n// I/O Completion Access Rights\n//\n#define IO_COMPLETION_QUERY_STATE 0x0001\n#ifndef NTOS_MODE_USER\n#define IO_COMPLETION_MODIFY_STATE 0x0002\n#define IO_COMPLETION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \\\n SYNCHRONIZE | \\\n 0x3)\n\n//\n// Kernel Exported Object Types\n//\nextern POBJECT_TYPE NTSYSAPI IoAdapterObjectType;\nextern POBJECT_TYPE NTSYSAPI IoDeviceHandlerObjectType;\nextern POBJECT_TYPE NTSYSAPI IoDeviceObjectType;\nextern POBJECT_TYPE NTSYSAPI IoDriverObjectType;\n\n#else\n\n//\n// Symbolic Link Access Rights\n//\n#define SYMBOLIC_LINK_QUERY 0x0001\n#define SYMBOLIC_LINK_ALL_ACCESS STANDARD_RIGHTS_REQUIRED | 0x0001\n#endif\n\n//\n// NtCreateFile Result Flags\n//\n#define FILE_SUPERSEDED 0x00000000\n#define FILE_OPENED 0x00000001\n#define FILE_CREATED 0x00000002\n#define FILE_OVERWRITTEN 0x00000003\n#define FILE_EXISTS 0x00000004\n#define FILE_DOES_NOT_EXIST 0x00000005\n\n//\n// Pipe Flags\n//\n#define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000\n#define FILE_PIPE_MESSAGE_TYPE 0x00000001\n#define FILE_PIPE_BYTE_STREAM_MODE 0x00000000\n#define FILE_PIPE_MESSAGE_MODE 0x00000001\n#define FILE_PIPE_QUEUE_OPERATION 0x00000000\n#define FILE_PIPE_COMPLETE_OPERATION 0x00000001\n#define FILE_PIPE_INBOUND 0x00000000\n#define FILE_PIPE_OUTBOUND 0x00000001\n#define FILE_PIPE_FULL_DUPLEX 0x00000002\n#define FILE_PIPE_CLIENT_END 0x00000000\n#define FILE_PIPE_SERVER_END 0x00000001\n\n//\n// NtCreateFile Attributes\n//\n#define FILE_ATTRIBUTE_VALID_FLAGS 0x00007fb7\n#define FILE_ATTRIBUTE_VALID_SET_FLAGS 0x000031a7\n\n//\n// NtCreateFile OpenType Flags\n//\n#define FILE_SUPERSEDE 0x00000000\n#define FILE_OPEN 0x00000001\n#define FILE_CREATE 0x00000002\n#define FILE_OPEN_IF 0x00000003\n#define FILE_OVERWRITE 0x00000004\n#define FILE_OVERWRITE_IF 0x00000005\n#define FILE_MAXIMUM_DISPOSITION 0x00000005\n\n//\n// NtCreateFile Flags\n//\n#define FILE_DIRECTORY_FILE 0x00000001\n#define FILE_WRITE_THROUGH 0x00000002\n#define FILE_SEQUENTIAL_ONLY 0x00000004\n#define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008\n#define FILE_SYNCHRONOUS_IO_ALERT 0x00000010\n#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020\n#define FILE_NON_DIRECTORY_FILE 0x00000040\n#define FILE_CREATE_TREE_CONNECTION 0x00000080\n#define FILE_COMPLETE_IF_OPLOCKED 0x00000100\n#define FILE_NO_EA_KNOWLEDGE 0x00000200\n#define FILE_OPEN_FOR_RECOVERY 0x00000400\n#define FILE_RANDOM_ACCESS 0x00000800\n#define FILE_DELETE_ON_CLOSE 0x00001000\n#define FILE_OPEN_BY_FILE_ID 0x00002000\n#define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000\n#define FILE_NO_COMPRESSION 0x00008000\n#define FILE_RESERVE_OPFILTER 0x00100000\n#define FILE_OPEN_REPARSE_POINT 0x00200000\n#define FILE_OPEN_NO_RECALL 0x00400000\n#define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000\n\n//\n// Device Charactertics\n//\n#define FILE_REMOVABLE_MEDIA 0x00000001\n#define FILE_REMOTE_DEVICE 0x00000010\n\n//\n// File Object Flags\n//\n#define FO_FILE_OBJECT_HAS_EXTENSION 0x00800000\n\n//\n// Device Object Extension Flags\n//\n#define DOE_UNLOAD_PENDING 0x1\n#define DOE_DELETE_PENDING 0x2\n#define DOE_REMOVE_PENDING 0x4\n#define DOE_REMOVE_PROCESSED 0x8\n#define DOE_START_PENDING 0x10\n\n//\n// Device Object StartIo Flags\n//\n#define DOE_SIO_NO_KEY 0x20\n#define DOE_SIO_WITH_KEY 0x40\n#define DOE_SIO_CANCELABLE 0x80\n#define DOE_SIO_DEFERRED 0x100\n#define DOE_SIO_NO_CANCEL 0x200\n\n//\n// Device Node Flags\n//\n#define DNF_PROCESSED 0x00000001\n#define DNF_STARTED 0x00000002\n#define DNF_START_FAILED 0x00000004\n#define DNF_ENUMERATED 0x00000008\n#define DNF_DELETED 0x00000010\n#define DNF_MADEUP 0x00000020\n#define DNF_START_REQUEST_PENDING 0x00000040\n#define DNF_NO_RESOURCE_REQUIRED 0x00000080\n#define DNF_INSUFFICIENT_RESOURCES 0x00000100\n#define DNF_RESOURCE_ASSIGNED 0x00000200\n#define DNF_RESOURCE_REPORTED 0x00000400\n#define DNF_HAL_NODE 0x00000800 // ???\n#define DNF_ADDED 0x00001000\n#define DNF_ADD_FAILED 0x00002000\n#define DNF_LEGACY_DRIVER 0x00004000\n#define DNF_STOPPED 0x00008000\n#define DNF_WILL_BE_REMOVED 0x00010000\n#define DNF_NEED_TO_ENUM 0x00020000\n#define DNF_NOT_CONFIGURED 0x00040000\n#define DNF_REINSTALL 0x00080000\n#define DNF_RESOURCE_REQUIREMENTS_NEED_FILTERED 0x00100000 // ???\n#define DNF_DISABLED 0x00200000\n#define DNF_RESTART_OK 0x00400000\n#define DNF_NEED_RESTART 0x00800000\n#define DNF_VISITED 0x01000000\n#define DNF_ASSIGNING_RESOURCES 0x02000000\n#define DNF_BEEING_ENUMERATED 0x04000000\n#define DNF_NEED_ENUMERATION_ONLY 0x08000000\n#define DNF_LOCKED 0x10000000\n#define DNF_HAS_BOOT_CONFIG 0x20000000\n#define DNF_BOOT_CONFIG_RESERVED 0x40000000\n#define DNF_HAS_PROBLEM 0x80000000 // ???\n\n//\n// Device Node User Flags\n//\n#define DNUF_DONT_SHOW_IN_UI 0x0002\n#define DNUF_NOT_DISABLEABLE 0x0008\n\n//\n// Internal Option Flags\n//\n#define IO_ATTACH_DEVICE_API 0x80000000\n\n//\n// Undocumented WMI Registration Flags\n//\n#define WMIREG_FLAG_TRACE_PROVIDER 0x00010000\n#define WMIREG_FLAG_TRACE_NOTIFY_MASK 0x00F00000\n#define WMIREG_NOTIFY_DISK_IO 0x00100000\n#define WMIREG_NOTIFY_TDI_IO 0x00200000\n\n//\n// I/O Completion Information Class for NtQueryIoCompletionInformation\n//\ntypedef enum _IO_COMPLETION_INFORMATION_CLASS\n{\n IoCompletionBasicInformation\n} IO_COMPLETION_INFORMATION_CLASS;\n\n#ifdef NTOS_MODE_USER\n\n//\n// Hardware Interface Type\n//\ntypedef enum _INTERFACE_TYPE\n{\n InterfaceTypeUndefined = -1,\n Internal,\n Isa,\n Eisa,\n MicroChannel,\n TurboChannel,\n PCIBus,\n VMEBus,\n NuBus,\n PCMCIABus,\n CBus,\n MPIBus,\n MPSABus,\n ProcessorInternal,\n InternalPowerBus,\n PNPISABus,\n PNPBus,\n MaximumInterfaceType\n}INTERFACE_TYPE, *PINTERFACE_TYPE;\n\ntypedef enum _BUS_DATA_TYPE\n{\n ConfigurationSpaceUndefined = -1,\n Cmos,\n EisaConfiguration,\n Pos,\n CbusConfiguration,\n PCIConfiguration,\n VMEConfiguration,\n NuBusConfiguration,\n PCMCIAConfiguration,\n MPIConfiguration,\n MPSAConfiguration,\n PNPISAConfiguration,\n SgiInternalConfiguration,\n MaximumBusDataType\n} BUS_DATA_TYPE, *PBUS_DATA_TYPE;\n\n//\n// File Information Classes for NtQueryInformationFile\n//\ntypedef enum _FILE_INFORMATION_CLASS\n{\n FileDirectoryInformation = 1,\n FileFullDirectoryInformation,\n FileBothDirectoryInformation,\n FileBasicInformation,\n FileStandardInformation,\n FileInternalInformation,\n FileEaInformation,\n FileAccessInformation,\n FileNameInformation,\n FileRenameInformation,\n FileLinkInformation,\n FileNamesInformation,\n FileDispositionInformation,\n FilePositionInformation,\n FileFullEaInformation,\n FileModeInformation,\n FileAlignmentInformation,\n FileAllInformation,\n FileAllocationInformation,\n FileEndOfFileInformation,\n FileAlternateNameInformation,\n FileStreamInformation,\n FilePipeInformation,\n FilePipeLocalInformation,\n FilePipeRemoteInformation,\n FileMailslotQueryInformation,\n FileMailslotSetInformation,\n FileCompressionInformation,\n FileObjectIdInformation,\n FileCompletionInformation,\n FileMoveClusterInformation,\n FileQuotaInformation,\n FileReparsePointInformation,\n FileNetworkOpenInformation,\n FileAttributeTagInformation,\n FileTrackingInformation,\n FileIdBothDirectoryInformation,\n FileIdFullDirectoryInformation,\n FileValidDataLengthInformation,\n FileShortNameInformation,\n FileIoCompletionNotificationInformation,\n FileIoStatusBlockRangeInformation,\n FileIoPriorityHintInformation,\n FileSfioReserveInformation,\n FileSfioVolumeInformation,\n FileHardLinkInformation,\n FileProcessIdsUsingFileInformation,\n FileNormalizedNameInformation,\n FileNetworkPhysicalNameInformation,\n FileIdGlobalTxDirectoryInformation,\n FileMaximumInformation\n} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;\n\n//\n// File Information Classes for NtQueryInformationFileSystem\n//\ntypedef enum _FSINFOCLASS\n{\n FileFsVolumeInformation = 1,\n FileFsLabelInformation,\n FileFsSizeInformation,\n FileFsDeviceInformation,\n FileFsAttributeInformation,\n FileFsControlInformation,\n FileFsFullSizeInformation,\n FileFsObjectIdInformation,\n FileFsDriverPathInformation,\n FileFsMaximumInformation\n} FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;\n\n#endif\n\n//\n// Device Node States\n//\ntypedef enum _PNP_DEVNODE_STATE\n{\n DeviceNodeUnspecified = 0x300,\n DeviceNodeUninitialized = 0x301,\n DeviceNodeInitialized = 0x302,\n DeviceNodeDriversAdded = 0x303,\n DeviceNodeResourcesAssigned = 0x304,\n DeviceNodeStartPending = 0x305,\n DeviceNodeStartCompletion = 0x306,\n DeviceNodeStartPostWork = 0x307,\n DeviceNodeStarted = 0x308,\n DeviceNodeQueryStopped = 0x309,\n DeviceNodeStopped = 0x30a,\n DeviceNodeRestartCompletion = 0x30b,\n DeviceNodeEnumeratePending = 0x30c,\n DeviceNodeEnumerateCompletion = 0x30d,\n DeviceNodeAwaitingQueuedDeletion = 0x30e,\n DeviceNodeAwaitingQueuedRemoval = 0x30f,\n DeviceNodeQueryRemoved = 0x310,\n DeviceNodeRemovePendingCloses = 0x311,\n DeviceNodeRemoved = 0x312,\n DeviceNodeDeletePendingCloses = 0x313,\n DeviceNodeDeleted = 0x314,\n MaxDeviceNodeState = 0x315,\n} PNP_DEVNODE_STATE;\n\n#ifdef NTOS_MODE_USER\n\n//\n// I/O Status Block\n//\ntypedef struct _IO_STATUS_BLOCK\n{\n union\n {\n NTSTATUS Status;\n PVOID Pointer;\n };\n ULONG_PTR Information;\n} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;\n\n//\n// File Information structures for NtQueryInformationFile\n//\ntypedef struct _FILE_BASIC_INFORMATION\n{\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n ULONG FileAttributes;\n} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;\n\ntypedef struct _FILE_STANDARD_INFORMATION\n{\n LARGE_INTEGER AllocationSize;\n LARGE_INTEGER EndOfFile;\n ULONG NumberOfLinks;\n BOOLEAN DeletePending;\n BOOLEAN Directory;\n} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;\n\ntypedef struct _FILE_STREAM_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG StreamNameLength;\n LARGE_INTEGER StreamSize;\n LARGE_INTEGER StreamAllocationSize;\n WCHAR StreamName[1];\n} FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;\n\ntypedef struct _FILE_NETWORK_OPEN_INFORMATION\n{\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER AllocationSize;\n LARGE_INTEGER EndOfFile;\n ULONG FileAttributes;\n} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;\n\ntypedef struct _FILE_EA_INFORMATION\n{\n ULONG EaSize;\n} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;\n\ntypedef struct _FILE_COMPRESSION_INFORMATION\n{\n LARGE_INTEGER CompressedFileSize;\n USHORT CompressionFormat;\n UCHAR CompressionUnitShift;\n UCHAR ChunkShift;\n UCHAR ClusterShift;\n UCHAR Reserved[3];\n} FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;\n\ntypedef struct _FILE_POSITION_INFORMATION\n{\n LARGE_INTEGER CurrentByteOffset;\n} FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;\n\ntypedef struct _FILE_DISPOSITION_INFORMATION\n{\n BOOLEAN DeleteFile;\n} FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;\n\ntypedef struct _FILE_FULL_EA_INFORMATION\n{\n ULONG NextEntryOffset;\n UCHAR Flags;\n UCHAR EaNameLength;\n USHORT EaValueLength;\n CHAR EaName[1];\n} FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;\n\ntypedef struct _FILE_QUOTA_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG SidLength;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER QuotaUsed;\n LARGE_INTEGER QuotaThreshold;\n LARGE_INTEGER QuotaLimit;\n SID Sid;\n} FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION;\n\ntypedef struct _FILE_INTERNAL_INFORMATION\n{\n LARGE_INTEGER IndexNumber;\n} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;\n\ntypedef struct _FILE_RENAME_INFORMATION\n{\n BOOLEAN ReplaceIfExists;\n HANDLE RootDirectory;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;\n\ntypedef struct _FILE_PIPE_INFORMATION\n{\n ULONG ReadMode;\n ULONG CompletionMode;\n} FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;\n\ntypedef struct _FILE_PIPE_LOCAL_INFORMATION\n{\n ULONG NamedPipeType;\n ULONG NamedPipeConfiguration;\n ULONG MaximumInstances;\n ULONG CurrentInstances;\n ULONG InboundQuota;\n ULONG ReadDataAvailable;\n ULONG OutboundQuota;\n ULONG WriteQuotaAvailable;\n ULONG NamedPipeState;\n ULONG NamedPipeEnd;\n} FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;\n\ntypedef struct _FILE_PIPE_REMOTE_INFORMATION\n{\n LARGE_INTEGER CollectDataTime;\n ULONG MaximumCollectionCount;\n} FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;\n\ntypedef struct _FILE_MAILSLOT_QUERY_INFORMATION\n{\n ULONG MaximumMessageSize;\n ULONG MailslotQuota;\n ULONG NextMessageSize;\n ULONG MessagesAvailable;\n LARGE_INTEGER ReadTimeout;\n} FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;\n\ntypedef struct _FILE_MAILSLOT_SET_INFORMATION\n{\n PLARGE_INTEGER ReadTimeout;\n} FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;\n\ntypedef struct _FILE_BOTH_DIR_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n CCHAR ShortNameLength;\n WCHAR ShortName[12];\n WCHAR FileName[1];\n} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;\n\ntypedef struct _FILE_COMPLETION_INFORMATION\n{\n HANDLE Port;\n PVOID Key;\n} FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;\n\ntypedef struct _FILE_LINK_INFORMATION\n{\n BOOLEAN ReplaceIfExists;\n HANDLE RootDirectory;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;\n\ntypedef struct _FILE_NAME_INFORMATION\n{\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;\n\ntypedef struct _FILE_ALLOCATION_INFORMATION\n{\n LARGE_INTEGER AllocationSize;\n} FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;\n\ntypedef struct _FILE_END_OF_FILE_INFORMATION\n{\n LARGE_INTEGER EndOfFile;\n} FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;\n\ntypedef struct _FILE_VALID_DATA_LENGTH_INFORMATION\n{\n LARGE_INTEGER ValidDataLength;\n} FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION;\n\ntypedef struct _FILE_DIRECTORY_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;\n\ntypedef struct _FILE_IO_COMPLETION_INFORMATION\n{\n PVOID KeyContext;\n PVOID ApcContext;\n IO_STATUS_BLOCK IoStatusBlock;\n} FILE_IO_COMPLETION_INFORMATION, *PFILE_IO_COMPLETION_INFORMATION;\n\n//\n// File System Information structures for NtQueryInformationFile\n//\ntypedef struct _FILE_FS_DEVICE_INFORMATION\n{\n DEVICE_TYPE DeviceType;\n ULONG Characteristics;\n} FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;\n\ntypedef struct _FILE_FS_ATTRIBUTE_INFORMATION\n{\n ULONG FileSystemAttributes;\n ULONG MaximumComponentNameLength;\n ULONG FileSystemNameLength;\n WCHAR FileSystemName[1];\n} FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;\n\ntypedef struct _FILE_FS_SIZE_INFORMATION\n{\n LARGE_INTEGER TotalAllocationUnits;\n LARGE_INTEGER AvailableAllocationUnits;\n ULONG SectorsPerAllocationUnit;\n ULONG BytesPerSector;\n} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;\n\ntypedef struct _FILE_FS_FULL_SIZE_INFORMATION\n{\n LARGE_INTEGER TotalAllocationUnits;\n LARGE_INTEGER CallerAvailableAllocationUnits;\n LARGE_INTEGER ActualAvailableAllocationUnits;\n ULONG SectorsPerAllocationUnit;\n ULONG BytesPerSector;\n} FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;\n\ntypedef struct _FILE_FS_LABEL_INFORMATION\n{\n ULONG VolumeLabelLength;\n WCHAR VolumeLabel[1];\n} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;\n\ntypedef struct _FILE_FS_VOLUME_INFORMATION\n{\n LARGE_INTEGER VolumeCreationTime;\n ULONG VolumeSerialNumber;\n ULONG VolumeLabelLength;\n BOOLEAN SupportsObjects;\n WCHAR VolumeLabel[1];\n} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;\n\n//\n// Pipe Structures for IOCTL_PIPE_XXX\n//\ntypedef struct _FILE_PIPE_WAIT_FOR_BUFFER\n{\n LARGE_INTEGER Timeout;\n ULONG NameLength;\n BOOLEAN TimeoutSpecified;\n WCHAR Name[1];\n} FILE_PIPE_WAIT_FOR_BUFFER, *PFILE_PIPE_WAIT_FOR_BUFFER;\n\ntypedef struct _FILE_PIPE_PEEK_BUFFER\n{\n ULONG NamedPipeState;\n ULONG ReadDataAvailable;\n ULONG NumberOfMessages;\n ULONG MessageLength;\n CHAR Data[1];\n} FILE_PIPE_PEEK_BUFFER, *PFILE_PIPE_PEEK_BUFFER;\n\n//\n// I/O Error Log Structures\n//\ntypedef struct _IO_ERROR_LOG_PACKET\n{\n UCHAR MajorFunctionCode;\n UCHAR RetryCount;\n USHORT DumpDataSize;\n USHORT NumberOfStrings;\n USHORT StringOffset;\n USHORT EventCategory;\n NTSTATUS ErrorCode;\n ULONG UniqueErrorValue;\n NTSTATUS FinalStatus;\n ULONG SequenceNumber;\n ULONG IoControlCode;\n LARGE_INTEGER DeviceOffset;\n ULONG DumpData[1];\n}IO_ERROR_LOG_PACKET, *PIO_ERROR_LOG_PACKET;\n\ntypedef struct _IO_ERROR_LOG_MESSAGE\n{\n USHORT Type;\n USHORT Size;\n USHORT DriverNameLength;\n LARGE_INTEGER TimeStamp;\n ULONG DriverNameOffset;\n IO_ERROR_LOG_PACKET EntryData;\n} IO_ERROR_LOG_MESSAGE, *PIO_ERROR_LOG_MESSAGE;\n\n#endif\n\n//\n// I/O Completion Information structures\n//\ntypedef struct _IO_COMPLETION_BASIC_INFORMATION\n{\n LONG Depth;\n} IO_COMPLETION_BASIC_INFORMATION, *PIO_COMPLETION_BASIC_INFORMATION;\n\n//\n// Parameters for NtCreateMailslotFile/NtCreateNamedPipeFile\n//\ntypedef struct _MAILSLOT_CREATE_PARAMETERS\n{\n ULONG MailslotQuota;\n ULONG MaximumMessageSize;\n LARGE_INTEGER ReadTimeout;\n BOOLEAN TimeoutSpecified;\n} MAILSLOT_CREATE_PARAMETERS, *PMAILSLOT_CREATE_PARAMETERS;\n\ntypedef struct _NAMED_PIPE_CREATE_PARAMETERS\n{\n ULONG NamedPipeType;\n ULONG ReadMode;\n ULONG CompletionMode;\n ULONG MaximumInstances;\n ULONG InboundQuota;\n ULONG OutboundQuota;\n LARGE_INTEGER DefaultTimeout;\n BOOLEAN TimeoutSpecified;\n} NAMED_PIPE_CREATE_PARAMETERS, *PNAMED_PIPE_CREATE_PARAMETERS;\n\n#ifndef NTOS_MODE_USER\n\n//\n// I/O Timer Object\n//\ntypedef struct _IO_TIMER\n{\n USHORT Type;\n USHORT TimerEnabled;\n LIST_ENTRY IoTimerList;\n PIO_TIMER_ROUTINE TimerRoutine;\n PVOID Context;\n PDEVICE_OBJECT DeviceObject;\n} IO_TIMER, *PIO_TIMER;\n\n//\n// Driver Extension\n//\ntypedef struct _IO_CLIENT_EXTENSION\n{\n struct _IO_CLIENT_EXTENSION *NextExtension;\n PVOID ClientIdentificationAddress;\n} IO_CLIENT_EXTENSION, *PIO_CLIENT_EXTENSION;\n\n//\n// Device Node\n//\ntypedef struct _DEVICE_NODE\n{\n struct _DEVICE_NODE *Parent;\n struct _DEVICE_NODE *PrevSibling;\n struct _DEVICE_NODE *NextSibling;\n struct _DEVICE_NODE *Child;\n ULONG Level;\n struct _PO_DEVICE_NOTIFY *Notify;\n PNP_DEVNODE_STATE State;\n PNP_DEVNODE_STATE PreviousState;\n PNP_DEVNODE_STATE StateHistory[20];\n ULONG StateHistoryEntry;\n INT CompletionStatus;\n PIRP PendingIrp;\n ULONG Flags;\n ULONG UserFlags;\n ULONG Problem;\n PDEVICE_OBJECT PhysicalDeviceObject;\n PCM_RESOURCE_LIST ResourceList;\n PCM_RESOURCE_LIST ResourceListTranslated;\n UNICODE_STRING InstancePath;\n UNICODE_STRING ServiceName;\n PDEVICE_OBJECT DuplicatePDO;\n PIO_RESOURCE_REQUIREMENTS_LIST ResourceRequirements;\n INTERFACE_TYPE InterfaceType;\n ULONG BusNumber;\n INTERFACE_TYPE ChildInterfaceType;\n ULONG ChildBusNumber;\n USHORT ChildBusTypeIndex;\n UCHAR RemovalPolicy;\n UCHAR HardwareRemovalPolicy;\n LIST_ENTRY TargetDeviceNotify;\n LIST_ENTRY DeviceArbiterList;\n LIST_ENTRY DeviceTranslatorList;\n USHORT NoTranslatorMask;\n USHORT QueryTranslatorMask;\n USHORT NoArbiterMask;\n USHORT QueryArbiterMask;\n union\n {\n struct _DEVICE_NODE *LegacyDeviceNode;\n PDEVICE_RELATIONS PendingDeviceRelations;\n } OverUsed1;\n union\n {\n struct _DEVICE_NODE *NextResourceDeviceNode;\n } OverUsed2;\n PCM_RESOURCE_LIST BootResources;\n ULONG CapabilityFlags;\n struct\n {\n ULONG DockStatus;\n LIST_ENTRY ListEntry;\n WCHAR *SerialNumber;\n } DockInfo;\n ULONG DisableableDepends;\n LIST_ENTRY PendedSetInterfaceState;\n LIST_ENTRY LegacyBusListEntry;\n ULONG DriverUnloadRetryCount;\n struct _DEVICE_NODE *PreviousParent;\n ULONG DeletedChidren;\n} DEVICE_NODE, *PDEVICE_NODE;\n\n//\n// Resource Aribtrer Entry\n//\ntypedef struct _PI_RESOURCE_ARBITER_ENTRY\n{\n LIST_ENTRY DeviceArbiterList;\n UCHAR ResourceType;\n PARBITER_INTERFACE ArbiterInterface;\n ULONG Level;\n LIST_ENTRY ResourceList;\n LIST_ENTRY BestResourceList;\n LIST_ENTRY BestConfig;\n LIST_ENTRY ActiveArbiterList;\n UCHAR State;\n UCHAR ResourcesChanged;\n} PI_RESOURCE_ARBITER_ENTRY, *PPI_RESOURCE_ARBITER_ENTRY;\n\n//\n// Extended Device Object Extension Structure\n//\ntypedef struct _EXTENDED_DEVOBJ_EXTENSION\n{\n CSHORT Type;\n USHORT Size;\n PDEVICE_OBJECT DeviceObject;\n ULONG PowerFlags;\n struct DEVICE_OBJECT_POWER_EXTENSION *Dope;\n ULONG ExtensionFlags;\n struct _DEVICE_NODE *DeviceNode;\n PDEVICE_OBJECT AttachedTo;\n LONG StartIoCount;\n LONG StartIoKey;\n ULONG StartIoFlags;\n struct _VPB *Vpb;\n} EXTENDED_DEVOBJ_EXTENSION, *PEXTENDED_DEVOBJ_EXTENSION;\n\n//\n// Extended Driver Object Extension Structure\n//\ntypedef struct _EXTENDED_DRIVER_EXTENSION\n{\n struct _DRIVER_OBJECT *DriverObject;\n PDRIVER_ADD_DEVICE AddDevice;\n ULONG Count;\n UNICODE_STRING ServiceKeyName;\n PIO_CLIENT_EXTENSION ClientDriverExtension;\n PFS_FILTER_CALLBACKS FsFilterCallbacks;\n} EXTENDED_DRIVER_EXTENSION, *PEXTENDED_DRIVER_EXTENSION;\n\n//\n// Extended I/O Stack Location Structure\n//\n#if !defined(_ALPHA_)\n#include \n#endif\ntypedef struct _EXTENDED_IO_STACK_LOCATION\n{\n UCHAR MajorFunction;\n UCHAR MinorFunction;\n UCHAR Flags;\n UCHAR Control;\n union\n {\n struct\n {\n PIO_SECURITY_CONTEXT SecurityContext;\n ULONG Options;\n USHORT FileAttributes;\n USHORT ShareAccess;\n ULONG EaLength;\n } Create;\n struct\n {\n PIO_SECURITY_CONTEXT SecurityContext;\n ULONG Options;\n USHORT Reserved;\n USHORT ShareAccess;\n struct _NAMED_PIPE_CREATE_PARAMETERS *Parameters;\n } CreatePipe;\n struct\n {\n PIO_SECURITY_CONTEXT SecurityContext;\n ULONG Options;\n USHORT Reserved;\n USHORT ShareAccess;\n struct _MAILSLOT_CREATE_PARAMETERS *Parameters;\n } CreateMailslot;\n struct\n {\n ULONG Length;\n ULONG Key;\n LARGE_INTEGER ByteOffset;\n } Read;\n struct\n {\n ULONG Length;\n ULONG Key;\n LARGE_INTEGER ByteOffset;\n } Write;\n struct\n {\n ULONG Length;\n PUNICODE_STRING FileName;\n FILE_INFORMATION_CLASS FileInformationClass;\n ULONG FileIndex;\n } QueryDirectory;\n struct\n {\n ULONG Length;\n ULONG CompletionFilter;\n } NotifyDirectory;\n struct\n {\n ULONG Length;\n FILE_INFORMATION_CLASS FileInformationClass;\n } QueryFile;\n struct\n {\n ULONG Length;\n FILE_INFORMATION_CLASS FileInformationClass;\n PFILE_OBJECT FileObject;\n union\n {\n struct\n {\n BOOLEAN ReplaceIfExists;\n BOOLEAN AdvanceOnly;\n };\n ULONG ClusterCount;\n HANDLE DeleteHandle;\n };\n } SetFile;\n struct\n {\n ULONG Length;\n PVOID EaList;\n ULONG EaListLength;\n ULONG EaIndex;\n } QueryEa;\n struct\n {\n ULONG Length;\n } SetEa;\n struct\n {\n ULONG Length;\n FS_INFORMATION_CLASS FsInformationClass;\n } QueryVolume;\n struct\n {\n ULONG Length;\n FS_INFORMATION_CLASS FsInformationClass;\n } SetVolume;\n struct\n {\n ULONG OutputBufferLength;\n ULONG InputBufferLength;\n ULONG FsControlCode;\n PVOID Type3InputBuffer;\n } FileSystemControl;\n struct\n {\n PLARGE_INTEGER Length;\n ULONG Key;\n LARGE_INTEGER ByteOffset;\n } LockControl;\n struct\n {\n ULONG OutputBufferLength;\n ULONG InputBufferLength;\n ULONG IoControlCode;\n PVOID Type3InputBuffer;\n } DeviceIoControl;\n struct\n {\n SECURITY_INFORMATION SecurityInformation;\n ULONG POINTER_ALIGNMENT Length;\n } QuerySecurity;\n struct\n {\n SECURITY_INFORMATION SecurityInformation;\n PSECURITY_DESCRIPTOR SecurityDescriptor;\n } SetSecurity;\n struct\n {\n PVPB Vpb;\n PDEVICE_OBJECT DeviceObject;\n } MountVolume;\n struct\n {\n PVPB Vpb;\n PDEVICE_OBJECT DeviceObject;\n } VerifyVolume;\n struct\n {\n struct _SCSI_REQUEST_BLOCK *Srb;\n } Scsi;\n struct\n {\n ULONG Length;\n PSID StartSid;\n struct _FILE_GET_QUOTA_INFORMATION *SidList;\n ULONG SidListLength;\n } QueryQuota;\n struct\n {\n ULONG Length;\n } SetQuota;\n struct\n {\n DEVICE_RELATION_TYPE Type;\n } QueryDeviceRelations;\n struct\n {\n CONST GUID *InterfaceType;\n USHORT Size;\n USHORT Version;\n PINTERFACE Interface;\n PVOID InterfaceSpecificData;\n } QueryInterface;\n struct\n {\n PDEVICE_CAPABILITIES Capabilities;\n } DeviceCapabilities;\n struct\n {\n PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;\n } FilterResourceRequirements;\n struct\n {\n ULONG WhichSpace;\n PVOID Buffer;\n ULONG Offset;\n ULONG Length;\n } ReadWriteConfig;\n struct\n {\n BOOLEAN Lock;\n } SetLock;\n struct\n {\n BUS_QUERY_ID_TYPE IdType;\n } QueryId;\n struct\n {\n DEVICE_TEXT_TYPE DeviceTextType;\n LCID LocaleId;\n } QueryDeviceText;\n struct\n {\n BOOLEAN InPath;\n BOOLEAN Reserved[3];\n DEVICE_USAGE_NOTIFICATION_TYPE Type;\n } UsageNotification;\n struct\n {\n SYSTEM_POWER_STATE PowerState;\n } WaitWake;\n struct\n {\n PPOWER_SEQUENCE PowerSequence;\n } PowerSequence;\n struct\n {\n ULONG SystemContext;\n POWER_STATE_TYPE Type;\n POWER_STATE State;\n POWER_ACTION ShutdownType;\n } Power;\n struct\n {\n PCM_RESOURCE_LIST AllocatedResources;\n PCM_RESOURCE_LIST AllocatedResourcesTranslated;\n } StartDevice;\n struct\n {\n ULONG_PTR ProviderId;\n PVOID DataPath;\n ULONG BufferSize;\n PVOID Buffer;\n } WMI;\n struct\n {\n PVOID Argument1;\n PVOID Argument2;\n PVOID Argument3;\n PVOID Argument4;\n } Others;\n } Parameters;\n PDEVICE_OBJECT DeviceObject;\n PFILE_OBJECT FileObject;\n PIO_COMPLETION_ROUTINE CompletionRoutine;\n PVOID Context;\n} EXTENDED_IO_STACK_LOCATION, *PEXTENDED_IO_STACK_LOCATION;\n#if !defined(_ALPHA_)\n#include \n#endif\n#endif\n\n//\n// Firmware Boot File Path\n//\ntypedef struct _FILE_PATH\n{\n ULONG Version;\n ULONG Length;\n ULONG Type;\n CHAR FilePath[1];\n} FILE_PATH, *PFILE_PATH;\n\n//\n// Firmware Boot Options\n//\ntypedef struct _BOOT_OPTIONS\n{\n ULONG Version;\n ULONG Length;\n ULONG Timeout;\n ULONG CurrentBootEntryId;\n ULONG NextBootEntryId;\n WCHAR HeadlessRedirection[1];\n} BOOT_OPTIONS, *PBOOT_OPTIONS;\n\n//\n// Firmware Boot Entry\n//\ntypedef struct _BOOT_ENTRY\n{\n ULONG Version;\n ULONG Length;\n ULONG Id;\n ULONG Attributes;\n ULONG FriendlyNameOffset;\n ULONG BootFilePathOffset;\n ULONG OsOptionsLength;\n CHAR OsOptions[1];\n} BOOT_ENTRY, *PBOOT_ENTRY;\n\n//\n// Firmware Driver Entry\n//\ntypedef struct _EFI_DRIVER_ENTRY\n{\n ULONG Version;\n ULONG Length;\n ULONG Id;\n ULONG Attributes;\n ULONG FriendlyNameOffset;\n ULONG DriverFilePathOffset;\n} EFI_DRIVER_ENTRY, *PEFI_DRIVER_ENTRY;\n\n//\n// APC Callback for NtCreateFile\n//\ntypedef VOID\n(NTAPI *PIO_APC_ROUTINE)(\n IN PVOID ApcContext,\n IN PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG Reserved);\n\n#ifdef NTOS_MODE_USER\n\n//\n// Mailslot IOCTL Codes\n//\n#define FSCTL_MAILSLOT_PEEK \\\n CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)\n\n//\n// Pipe IOCTL Codes\n//\n#define FSCTL_PIPE_ASSIGN_EVENT \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_DISCONNECT \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_LISTEN \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_PEEK \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)\n#define FSCTL_PIPE_QUERY_EVENT \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_TRANSCEIVE \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)\n#define FSCTL_PIPE_WAIT \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_IMPERSONATE \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_SET_CLIENT_PROCESS \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_QUERY_CLIENT_PROCESS \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_INTERNAL_READ \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)\n#define FSCTL_PIPE_INTERNAL_WRITE \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)\n#define FSCTL_PIPE_INTERNAL_TRANSCEIVE \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)\n#define FSCTL_PIPE_INTERNAL_READ_OVFLOW \\\n CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)\n\n//\n// Tape IOCTL Codes\n//\n#define IOCTL_TAPE_ERASE \\\n CTL_CODE(FILE_DEVICE_TAPE, 0, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)\n#define IOCTL_TAPE_PREPARE \\\n CTL_CODE(FILE_DEVICE_TAPE, 1, METHOD_BUFFERED, FILE_READ_ACCESS)\n#define IOCTL_TAPE_WRITE_MARKS \\\n CTL_CODE(FILE_DEVICE_TAPE, 2, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)\n#define IOCTL_TAPE_GET_POSITION \\\n CTL_CODE(FILE_DEVICE_TAPE, 3, METHOD_BUFFERED, FILE_READ_ACCESS)\n#define IOCTL_TAPE_SET_POSITION \\\n CTL_CODE(FILE_DEVICE_TAPE, 4, METHOD_BUFFERED, FILE_READ_ACCESS)\n#define IOCTL_TAPE_GET_DRIVE_PARAMS \\\n CTL_CODE(FILE_DEVICE_TAPE, 5, METHOD_BUFFERED, FILE_READ_ACCESS)\n#define IOCTL_TAPE_SET_DRIVE_PARAMS \\\n CTL_CODE(FILE_DEVICE_TAPE, 6, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)\n#define IOCTL_TAPE_GET_MEDIA_PARAMS \\\n CTL_CODE(FILE_DEVICE_TAPE, 7, METHOD_BUFFERED, FILE_READ_ACCESS)\n#define IOCTL_TAPE_SET_MEDIA_PARAMS \\\n CTL_CODE(FILE_DEVICE_TAPE, 8, METHOD_BUFFERED, FILE_READ_ACCESS)\n#define IOCTL_TAPE_GET_STATUS \\\n CTL_CODE(FILE_DEVICE_TAPE, 9, METHOD_BUFFERED, FILE_READ_ACCESS)\n#define IOCTL_TAPE_CREATE_PARTITION \\\n CTL_CODE(FILE_DEVICE_TAPE, 10, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)\n\n#endif // NTOS_MODE_USER\n\n#endif\n" }, { "path": "ndk/kdfuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n kdfuncs.h\n\nAbstract:\n\n Function definitions for the Kernel Debugger.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _KDFUNCS_H\n#define _KDFUNCS_H\n\n//\n// Dependencies\n//\n#include \n#include \n\n#ifndef NTOS_MODE_USER\n\n//\n// Debugger API\n//\nNTSTATUS\nNTAPI\nKdSystemDebugControl(\n SYSDBG_COMMAND Command,\n PVOID InputBuffer,\n ULONG InputBufferLength,\n PVOID OutputBuffer,\n ULONG OutputBufferLength,\n PULONG ReturnLength,\n KPROCESSOR_MODE PreviousMode\n);\n\nBOOLEAN\nNTAPI\nKdPollBreakIn(\n VOID\n);\n\n#endif\n\n//\n// Native Calls\n//\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryDebugFilterState(\n ULONG ComponentId,\n ULONG Level\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetDebugFilterState(\n ULONG ComponentId,\n ULONG Level,\n BOOLEAN State\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSystemDebugControl(\n SYSDBG_COMMAND ControlCode,\n PVOID InputBuffer,\n ULONG InputBufferLength,\n PVOID OutputBuffer,\n ULONG OutputBufferLength,\n PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryDebugFilterState(\n ULONG ComponentId,\n ULONG Level\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetDebugFilterState(\n ULONG ComponentId,\n ULONG Level,\n BOOLEAN State\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSystemDebugControl(\n SYSDBG_COMMAND ControlCode,\n PVOID InputBuffer,\n ULONG InputBufferLength,\n PVOID OutputBuffer,\n ULONG OutputBufferLength,\n PULONG ReturnLength\n);\n#endif\n" }, { "path": "ndk/kdtypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n kdtypes.h\n\nAbstract:\n\n Type definitions for the Kernel Debugger.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _KDTYPES_H\n#define _KDTYPES_H\n\n//\n// Dependencies\n//\n#include \n\n//\n// Debug Filter Levels\n//\n#define DPFLTR_ERROR_LEVEL 0\n#define DPFLTR_WARNING_LEVEL 1\n#define DPFLTR_TRACE_LEVEL 2\n#define DPFLTR_INFO_LEVEL 3\n#define DPFLTR_MASK 0x80000000\n\n//\n// Debug Status Codes\n//\n#define DBG_STATUS_CONTROL_C 1\n#define DBG_STATUS_SYSRQ 2\n#define DBG_STATUS_BUGCHECK_FIRST 3\n#define DBG_STATUS_BUGCHECK_SECOND 4\n#define DBG_STATUS_FATAL 5\n#define DBG_STATUS_DEBUG_CONTROL 6\n#define DBG_STATUS_WORKER 7\n\n//\n// DebugService Control Types\n//\n#define BREAKPOINT_BREAK 0\n#define BREAKPOINT_PRINT 1\n#define BREAKPOINT_PROMPT 2\n#define BREAKPOINT_LOAD_SYMBOLS 3\n#define BREAKPOINT_UNLOAD_SYMBOLS 4\n#define BREAKPOINT_COMMAND_STRING 5\n\n//\n// Debug Control Codes for NtSystemDebugcontrol\n//\ntypedef enum _SYSDBG_COMMAND\n{\n SysDbgQueryModuleInformation = 0,\n SysDbgQueryTraceInformation = 1,\n SysDbgSetTracepoint = 2,\n SysDbgSetSpecialCall = 3,\n SysDbgClearSpecialCalls = 4,\n SysDbgQuerySpecialCalls = 5,\n SysDbgBreakPoint = 6,\n SysDbgQueryVersion = 7,\n SysDbgReadVirtual = 8,\n SysDbgWriteVirtual = 9,\n SysDbgReadPhysical = 10,\n SysDbgWritePhysical = 11,\n SysDbgReadControlSpace = 12,\n SysDbgWriteControlSpace = 13,\n SysDbgReadIoSpace = 14,\n SysDbgWriteIoSpace = 15,\n SysDbgReadMsr = 16,\n SysDbgWriteMsr = 17,\n SysDbgReadBusData = 18,\n SysDbgWriteBusData = 19,\n SysDbgCheckLowMemory = 20,\n SysDbgEnableKernelDebugger = 21,\n SysDbgDisableKernelDebugger = 22,\n SysDbgGetAutoKdEnable = 23,\n SysDbgSetAutoKdEnable = 24,\n SysDbgGetPrintBufferSize = 25,\n SysDbgSetPrintBufferSize = 26,\n SysDbgGetKdUmExceptionEnable = 27,\n SysDbgSetKdUmExceptionEnable = 28,\n SysDbgGetTriageDump = 29,\n SysDbgGetKdBlockEnable = 30,\n SysDbgSetKdBlockEnable = 31,\n SysDbgRegisterForUmBreakInfo = 32,\n SysDbgGetUmBreakPid = 33,\n SysDbgClearUmBreakPid = 34,\n SysDbgGetUmAttachPid = 35,\n SysDbgClearUmAttachPid = 36,\n} SYSDBG_COMMAND;\n\n//\n// System Debugger Types\n//\ntypedef struct _SYSDBG_PHYSICAL\n{\n PHYSICAL_ADDRESS Address;\n PVOID Buffer;\n ULONG Request;\n} SYSDBG_PHYSICAL, *PSYSDBG_PHYSICAL;\n\ntypedef struct _SYSDBG_VIRTUAL\n{\n PVOID Address;\n PVOID Buffer;\n ULONG Request;\n} SYSDBG_VIRTUAL, *PSYSDBG_VIRTUAL;\n\ntypedef struct _SYSDBG_CONTROL_SPACE\n{\n ULONGLONG Address;\n PVOID Buffer;\n ULONG Request;\n ULONG Processor;\n} SYSDBG_CONTROL_SPACE, *PSYSDBG_CONTROL_SPACE;\n\ntypedef struct _SYSDBG_IO_SPACE\n{\n ULONGLONG Address;\n PVOID Buffer;\n ULONG Request;\n INTERFACE_TYPE InterfaceType;\n ULONG BusNumber;\n ULONG AddressSpace;\n} SYSDBG_IO_SPACE, *PSYSDBG_IO_SPACE;\n\ntypedef struct _SYSDBG_BUS_DATA\n{\n ULONG Address;\n PVOID Buffer;\n ULONG Request;\n BUS_DATA_TYPE BusDataType;\n ULONG BusNumber;\n ULONG SlotNumber;\n} SYSDBG_BUS_DATA, *PSYSDBG_BUS_DATA;\n\ntypedef struct _SYSDBG_MSR\n{\n ULONG Address;\n ULONGLONG Data;\n} SYSDBG_MSR, *PSYSDBG_MSR;\n\ntypedef struct _SYSDBG_TRIAGE_DUMP\n{\n ULONG Flags;\n ULONG BugCheckCode;\n ULONG_PTR BugCheckParam1;\n ULONG_PTR BugCheckParam2;\n ULONG_PTR BugCheckParam3;\n ULONG_PTR BugCheckParam4;\n ULONG ProcessHandles;\n ULONG ThreadHandles;\n PHANDLE Handles;\n} SYSDBG_TRIAGE_DUMP, *PSYSDBG_TRIAGE_DUMP;\n\n//\n// KD Structures\n//\ntypedef struct _KD_SYMBOLS_INFO\n{\n PVOID BaseOfDll;\n ULONG_PTR ProcessId;\n ULONG CheckSum;\n ULONG SizeOfImage;\n} KD_SYMBOLS_INFO, *PKD_SYMBOLS_INFO;\n\n#endif // _KDTYPES_H\n" }, { "path": "ndk/kefuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n kefuncs.h\n\nAbstract:\n\n Functions definitions for the Kernel services.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _KEFUNCS_H\n#define _KEFUNCS_H\n\n//\n// Dependencies\n//\n#include \n#include \n\n#ifndef NTOS_MODE_USER\n\n//\n// APC Functions\n//\nVOID\nNTAPI\nKeInitializeApc(\n IN PKAPC Apc,\n IN PKTHREAD Thread,\n IN KAPC_ENVIRONMENT TargetEnvironment,\n IN PKKERNEL_ROUTINE KernelRoutine,\n IN PKRUNDOWN_ROUTINE RundownRoutine OPTIONAL,\n IN PKNORMAL_ROUTINE NormalRoutine,\n IN KPROCESSOR_MODE Mode,\n IN PVOID Context\n);\n\nBOOLEAN\nNTAPI\nKeInsertQueueApc(\n IN PKAPC Apc,\n IN PVOID SystemArgument1,\n IN PVOID SystemArgument2,\n IN KPRIORITY PriorityBoost\n);\n\nVOID\nNTAPI\nKiDeliverApc(\n IN KPROCESSOR_MODE PreviousMode,\n IN PKEXCEPTION_FRAME ExceptionFrame,\n IN PKTRAP_FRAME TrapFrame\n);\n\n//\n// Process/Thread Functions\n//\nVOID\nNTAPI\nKeTerminateThread(\n IN KPRIORITY Increment\n);\n\nBOOLEAN\nNTAPI\nKeIsAttachedProcess(\n VOID\n);\n\nVOID\nNTAPI\nKeSetEventBoostPriority(\n IN PKEVENT Event,\n IN PKTHREAD *Thread OPTIONAL\n);\n\nKAFFINITY\nNTAPI\nKeSetAffinityThread(\n PKTHREAD Thread,\n KAFFINITY Affinity\n);\n\nPKPROCESS\nNTAPI\nKeGetCurrentProcess(\n VOID\n);\n\nBOOLEAN\nNTAPI\nKeAddSystemServiceTable(\n PULONG_PTR Base,\n PULONG Count OPTIONAL,\n ULONG Limit,\n PUCHAR Number,\n ULONG Index\n);\n\n//\n// Spinlock Functions\n//\nVOID\nFASTCALL\nKiAcquireSpinLock(\n PKSPIN_LOCK SpinLock\n);\n\nVOID\nFASTCALL\nKiReleaseSpinLock(\n PKSPIN_LOCK SpinLock\n);\n\nKIRQL\nFASTCALL\nKeAcquireQueuedSpinLockRaiseToSynch(\n IN KSPIN_LOCK_QUEUE_NUMBER LockNumber\n);\n\nVOID\nFASTCALL\nKeAcquireInStackQueuedSpinLockRaiseToSynch(\n IN PKSPIN_LOCK SpinLock,\n IN PKLOCK_QUEUE_HANDLE LockHandle\n);\n\n//\n// Interrupt Functions\n//\nVOID\nNTAPI\nKeInitializeInterrupt(\n PKINTERRUPT InterruptObject,\n PKSERVICE_ROUTINE ServiceRoutine,\n PVOID ServiceContext,\n PKSPIN_LOCK SpinLock,\n ULONG Vector,\n KIRQL Irql,\n KIRQL SynchronizeIrql,\n KINTERRUPT_MODE InterruptMode,\n BOOLEAN ShareVector,\n CHAR ProcessorNumber,\n BOOLEAN FloatingSave\n);\n\nBOOLEAN\nNTAPI\nKeConnectInterrupt(\n PKINTERRUPT InterruptObject\n);\n\nBOOLEAN\nNTAPI\nKeDisconnectInterrupt(\n PKINTERRUPT InterruptObject\n);\n\nVOID\nNTAPI\nKiDispatchInterrupt(\n VOID\n);\n\nVOID\nNTAPI\nKiCoprocessorError(\n VOID\n);\n\nVOID\nNTAPI\nKiUnexpectedInterrupt(\n VOID\n);\n\nVOID\nNTAPI\nKeEnterKernelDebugger(\n VOID\n);\n\nBOOLEAN\nNTAPI\nKeIsExecutingDpc(\n VOID\n);\n\nBOOLEAN\nNTAPI\nKiIpiServiceRoutine(\n IN PKTRAP_FRAME TrapFrame,\n IN PVOID ExceptionFrame\n);\n\n//\n// ARC Configuration Functions. Only enabled if you have ARC Support\n//\n#ifdef _ARC_\nPCONFIGURATION_COMPONENT_DATA\nNTAPI\nKeFindConfigurationNextEntry(\n IN PCONFIGURATION_COMPONENT_DATA Child,\n IN CONFIGURATION_CLASS Class,\n IN CONFIGURATION_TYPE Type,\n IN PULONG ComponentKey OPTIONAL,\n IN PCONFIGURATION_COMPONENT_DATA *NextLink\n);\n\nPCONFIGURATION_COMPONENT_DATA\nNTAPI\nKeFindConfigurationEntry(\n IN PCONFIGURATION_COMPONENT_DATA Child,\n IN CONFIGURATION_CLASS Class,\n IN CONFIGURATION_TYPE Type,\n IN PULONG ComponentKey OPTIONAL\n);\n#endif\n\n//\n// Low-level Hardware/CPU Control Functions\n//\nVOID\nNTAPI\nKeFlushEntireTb(\n IN BOOLEAN Invalid,\n IN BOOLEAN AllProcessors\n);\n\nVOID\nNTAPI\nKeUpdateSystemTime(\n PKTRAP_FRAME TrapFrame,\n KIRQL Irql,\n ULONG Increment\n);\n\nVOID\nNTAPI\nKeUpdateRunTime(\n PKTRAP_FRAME TrapFrame,\n KIRQL Irql\n);\n\nVOID\nNTAPI\nKeSetDmaIoCoherency(\n IN ULONG Coherency\n);\n\nVOID\nKeSetGdtSelector(\n ULONG Entry,\n ULONG Value1,\n ULONG Value2\n);\n\nVOID\nNTAPI\nKeSetProfileIrql(\n IN KIRQL ProfileIrql\n);\n\nVOID\nNTAPI\nKeSetTimeIncrement(\n IN ULONG MaxIncrement,\n IN ULONG MinIncrement\n);\n\nNTSTATUS\nNTAPI\nKe386CallBios(\n IN ULONG BiosCommand,\n IN OUT PCONTEXT BiosArguments\n);\n\n//\n// Misc. Functions\n//\nNTSTATUS\nNTAPI\nKeUserModeCallback(\n IN ULONG FunctionID,\n IN PVOID InputBuffer,\n IN ULONG InputLength,\n OUT PVOID *OutputBuffer,\n OUT PULONG OutputLength\n);\n\nNTSTATUS\nNTAPI\nKeRaiseUserException(\n IN NTSTATUS ExceptionCode\n);\n\n#endif\n\n//\n// Native Calls\n//\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtContinue(\n IN PCONTEXT Context,\n IN BOOLEAN TestAlert\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCallbackReturn(\n PVOID Result,\n ULONG ResultLength,\n NTSTATUS Status\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateProfile(\n OUT PHANDLE ProfileHandle,\n IN HANDLE ProcessHandle,\n IN PVOID ImageBase,\n IN ULONG ImageSize,\n IN ULONG Granularity,\n OUT PVOID Buffer,\n IN ULONG ProfilingSize,\n IN KPROFILE_SOURCE Source,\n IN KAFFINITY ProcessorMask\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDelayExecution(\n IN BOOLEAN Alertable,\n IN LARGE_INTEGER *Interval\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFlushInstructionCache(\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress,\n IN ULONG NumberOfBytesToFlush\n);\n\nULONG\nNTAPI\nNtGetCurrentProcessorNumber(\n VOID\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtGetContextThread(\n IN HANDLE ThreadHandle,\n OUT PCONTEXT Context\n);\n\nNTSYSCALLAPI\nULONG\nNTAPI\nNtGetTickCount(\n VOID\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryIntervalProfile(\n IN KPROFILE_SOURCE ProfileSource,\n OUT PULONG Interval\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryPerformanceCounter(\n IN PLARGE_INTEGER Counter,\n IN PLARGE_INTEGER Frequency\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySystemTime(\n OUT PLARGE_INTEGER CurrentTime\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryTimerResolution(\n OUT PULONG MinimumResolution,\n OUT PULONG MaximumResolution,\n OUT PULONG ActualResolution\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueueApcThread(\n HANDLE ThreadHandle,\n PKNORMAL_ROUTINE ApcRoutine,\n PVOID NormalContext,\n PVOID SystemArgument1,\n PVOID SystemArgument2\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRaiseException(\n IN PEXCEPTION_RECORD ExceptionRecord,\n IN PCONTEXT Context,\n IN BOOLEAN SearchFrames\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetContextThread(\n IN HANDLE ThreadHandle,\n IN PCONTEXT Context\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetIntervalProfile(\n ULONG Interval,\n KPROFILE_SOURCE ClockSource\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetLdtEntries(\n ULONG Selector1,\n LDT_ENTRY LdtEntry1,\n ULONG Selector2,\n LDT_ENTRY LdtEntry2\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetSystemTime(\n IN PLARGE_INTEGER SystemTime,\n IN PLARGE_INTEGER NewSystemTime OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetTimerResolution(\n IN ULONG RequestedResolution,\n IN BOOLEAN SetOrUnset,\n OUT PULONG ActualResolution\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtStartProfile(\n IN HANDLE ProfileHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtStopProfile(\n IN HANDLE ProfileHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtTestAlert(\n VOID\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtVdmControl(\n ULONG ControlCode,\n PVOID ControlData\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtW32Call(\n IN ULONG RoutineIndex,\n IN PVOID Argument,\n IN ULONG ArgumentLength,\n OUT PVOID* Result OPTIONAL,\n OUT PULONG ResultLength OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtYieldExecution(\n VOID\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwContinue(\n IN PCONTEXT Context,\n IN BOOLEAN TestAlert\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCallbackReturn(\n PVOID Result,\n ULONG ResultLength,\n NTSTATUS Status\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateProfile(\n OUT PHANDLE ProfileHandle,\n IN HANDLE ProcessHandle,\n IN PVOID ImageBase,\n IN ULONG ImageSize,\n IN ULONG Granularity,\n OUT PVOID Buffer,\n IN ULONG ProfilingSize,\n IN KPROFILE_SOURCE Source,\n IN KAFFINITY ProcessorMask\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDelayExecution(\n IN BOOLEAN Alertable,\n IN LARGE_INTEGER *Interval\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwFlushInstructionCache(\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress,\n IN ULONG NumberOfBytesToFlush\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwGetContextThread(\n IN HANDLE ThreadHandle,\n OUT PCONTEXT Context\n);\n\nNTSYSAPI\nULONG\nNTAPI\nZwGetTickCount(\n VOID\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryIntervalProfile(\n IN KPROFILE_SOURCE ProfileSource,\n OUT PULONG Interval\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryPerformanceCounter(\n IN PLARGE_INTEGER Counter,\n IN PLARGE_INTEGER Frequency\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQuerySystemTime(\n OUT PLARGE_INTEGER CurrentTime\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryTimerResolution(\n OUT PULONG MinimumResolution,\n OUT PULONG MaximumResolution,\n OUT PULONG ActualResolution\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueueApcThread(\n HANDLE ThreadHandle,\n PKNORMAL_ROUTINE ApcRoutine,\n PVOID NormalContext,\n PVOID SystemArgument1,\n PVOID SystemArgument2\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwRaiseException(\n IN PEXCEPTION_RECORD ExceptionRecord,\n IN PCONTEXT Context,\n IN BOOLEAN SearchFrames\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetContextThread(\n IN HANDLE ThreadHandle,\n IN PCONTEXT Context\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetIntervalProfile(\n ULONG Interval,\n KPROFILE_SOURCE ClockSource\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetLdtEntries(\n ULONG Selector1,\n LDT_ENTRY LdtEntry1,\n ULONG Selector2,\n LDT_ENTRY LdtEntry2\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetSystemTime(\n IN PLARGE_INTEGER SystemTime,\n IN PLARGE_INTEGER NewSystemTime OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetTimerResolution(\n IN ULONG RequestedResolution,\n IN BOOLEAN SetOrUnset,\n OUT PULONG ActualResolution\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwStartProfile(\n IN HANDLE ProfileHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwStopProfile(\n IN HANDLE ProfileHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwTestAlert(\n VOID\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwVdmControl(\n ULONG ControlCode,\n PVOID ControlData\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwW32Call(\n IN ULONG RoutineIndex,\n IN PVOID Argument,\n IN ULONG ArgumentLength,\n OUT PVOID* Result OPTIONAL,\n OUT PULONG ResultLength OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwYieldExecution(\n VOID\n);\n#endif\n" }, { "path": "ndk/ketypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n lpctypes.h\n\nAbstract:\n\n Type definitions for the Loader.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _KETYPES_H\n#define _KETYPES_H\n\n//\n// Dependencies\n//\n#include \n#ifndef NTOS_MODE_USER\n#include \n#include \n#include \n#endif\n\n//\n// Context Record Flags\n//\n#define CONTEXT_DEBUGGER (CONTEXT_FULL | CONTEXT_FLOATING_POINT)\n\n//\n// Maximum System Descriptor Table Entries\n//\n#define SSDT_MAX_ENTRIES 2\n\n//\n// Processor Architectures\n//\n#define PROCESSOR_ARCHITECTURE_INTEL 0\n\n//\n// Object Type Mask for Kernel Dispatcher Objects\n//\n#define KOBJECT_TYPE_MASK 0x7F\n#define KOBJECT_LOCK_BIT 0x80\n\n//\n// Dispatcher Priority increments\n//\n#define THREAD_ALERT_INCREMENT 2\n\n//\n// User Shared Data in Kernel-Mode\n//\n#define KI_USER_SHARED_DATA 0xffdf0000\n\n//\n// Physical memory offset of KUSER_SHARED_DATA\n//\n#define KI_USER_SHARED_DATA_PHYSICAL 0x41000\n\n//\n// Quantum values and decrements\n//\n#define MAX_QUANTUM 0x7F\n#define WAIT_QUANTUM_DECREMENT 1\n#define CLOCK_QUANTUM_DECREMENT 3\n\n//\n// Kernel Feature Bits\n//\n#define KF_V86_VIS 0x00000001\n#define KF_RDTSC 0x00000002\n#define KF_CR4 0x00000004\n#define KF_CMOV 0x00000008\n#define KF_GLOBAL_PAGE 0x00000010\n#define KF_LARGE_PAGE 0x00000020\n#define KF_MTRR 0x00000040\n#define KF_CMPXCHG8B 0x00000080\n#define KF_MMX 0x00000100\n#define KF_WORKING_PTE 0x00000200\n#define KF_PAT 0x00000400\n#define KF_FXSR 0x00000800\n#define KF_FAST_SYSCALL 0x00001000\n#define KF_XMMI 0x00002000\n#define KF_3DNOW 0x00004000\n#define KF_AMDK6MTRR 0x00008000\n#define KF_XMMI64 0x00010000\n#define KF_DTS 0x00020000\n#define KF_NX_BIT 0x20000000\n#define KF_NX_DISABLED 0x40000000\n#define KF_NX_ENABLED 0x80000000\n\n//\n// Internal Exception Codes\n//\n#define KI_EXCEPTION_INTERNAL 0x10000000\n#define KI_EXCEPTION_ACCESS_VIOLATION (KI_EXCEPTION_INTERNAL | 0x04)\n\n//\n// KPCR Access for non-IA64 builds\n//\n#define K0IPCR ((ULONG_PTR)(KIP0PCRADDRESS))\n#define PCR ((volatile KPCR * const)K0IPCR)\n#if !defined(CONFIG_SMP) && !defined(NT_BUILD)\n#define KeGetPcr() PCR\n#else\n#define KeGetPcr() ((volatile KPCR * const)__readfsdword(0x1C))\n#endif\n\n//\n// Number of dispatch codes supported by KINTERRUPT\n//\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n#define KINTERRUPT_DISPATCH_CODES 135\n#else\n#define KINTERRUPT_DISPATCH_CODES 106\n#endif\n\n#ifdef NTOS_MODE_USER\n\n//\n// KPROCESSOR_MODE Type\n//\ntypedef CCHAR KPROCESSOR_MODE;\n\n//\n// Dereferencable pointer to KUSER_SHARED_DATA in User-Mode\n//\n#define SharedUserData ((KUSER_SHARED_DATA *CONST)USER_SHARED_DATA)\n\n//\n// Maximum WOW64 Entries in KUSER_SHARED_DATA\n//\n#define MAX_WOW64_SHARED_ENTRIES 16\n\n//\n// Maximum Processor Features supported in KUSER_SHARED_DATA\n//\n#define PROCESSOR_FEATURE_MAX 64\n\n//\n// Event Types\n//\ntypedef enum _EVENT_TYPE\n{\n NotificationEvent,\n SynchronizationEvent\n} EVENT_TYPE;\n\n//\n// Timer Types\n//\ntypedef enum _TIMER_TYPE\n{\n NotificationTimer,\n SynchronizationTimer\n} TIMER_TYPE;\n\n//\n// Wait Types\n//\ntypedef enum _WAIT_TYPE\n{\n WaitAll,\n WaitAny\n} WAIT_TYPE;\n\n//\n// Processor Execution Modes\n//\ntypedef enum _MODE\n{\n KernelMode,\n UserMode,\n MaximumMode\n} MODE;\n\n//\n// Wait Reasons\n//\ntypedef enum _KWAIT_REASON\n{\n Executive,\n FreePage,\n PageIn,\n PoolAllocation,\n DelayExecution,\n Suspended,\n UserRequest,\n WrExecutive,\n WrFreePage,\n WrPageIn,\n WrPoolAllocation,\n WrDelayExecution,\n WrSuspended,\n WrUserRequest,\n WrEventPair,\n WrQueue,\n WrLpcReceive,\n WrLpcReply,\n WrVirtualMemory,\n WrPageOut,\n WrRendezvous,\n Spare2,\n WrGuardedMutex,\n Spare4,\n Spare5,\n Spare6,\n WrKernel,\n WrResource,\n WrPushLock,\n WrMutex,\n WrQuantumEnd,\n WrDispatchInt,\n WrPreempted,\n WrYieldExecution,\n MaximumWaitReason\n} KWAIT_REASON;\n\n//\n// Profiling Sources\n//\ntypedef enum _KPROFILE_SOURCE\n{\n ProfileTime,\n ProfileAlignmentFixup,\n ProfileTotalIssues,\n ProfilePipelineDry,\n ProfileLoadInstructions,\n ProfilePipelineFrozen,\n ProfileBranchInstructions,\n ProfileTotalNonissues,\n ProfileDcacheMisses,\n ProfileIcacheMisses,\n ProfileCacheMisses,\n ProfileBranchMispredictions,\n ProfileStoreInstructions,\n ProfileFpInstructions,\n ProfileIntegerInstructions,\n Profile2Issue,\n Profile3Issue,\n Profile4Issue,\n ProfileSpecialInstructions,\n ProfileTotalCycles,\n ProfileIcacheIssues,\n ProfileDcacheAccesses,\n ProfileMemoryBarrierCycles,\n ProfileLoadLinkedIssues,\n ProfileMaximum\n} KPROFILE_SOURCE;\n\n//\n// NT Product and Architecture Types\n//\ntypedef enum _NT_PRODUCT_TYPE\n{\n NtProductWinNt = 1,\n NtProductLanManNt,\n NtProductServer\n} NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;\n\ntypedef enum _ALTERNATIVE_ARCHITECTURE_TYPE\n{\n StandardDesign,\n NEC98x86,\n EndAlternatives\n} ALTERNATIVE_ARCHITECTURE_TYPE;\n\n#endif\n\n//\n// Thread States\n//\ntypedef enum _KTHREAD_STATE\n{\n Initialized,\n Ready,\n Running,\n Standby,\n Terminated,\n Waiting,\n Transition,\n DeferredReady,\n#if (NTDDI_VERSION >= NTDDI_WS03)\n GateWait\n#endif\n} KTHREAD_STATE, *PKTHREAD_STATE;\n\n//\n// Kernel Object Types\n//\ntypedef enum _KOBJECTS\n{\n EventNotificationObject = 0,\n EventSynchronizationObject = 1,\n MutantObject = 2,\n ProcessObject = 3,\n QueueObject = 4,\n SemaphoreObject = 5,\n ThreadObject = 6,\n GateObject = 7,\n TimerNotificationObject = 8,\n TimerSynchronizationObject = 9,\n Spare2Object = 10,\n Spare3Object = 11,\n Spare4Object = 12,\n Spare5Object = 13,\n Spare6Object = 14,\n Spare7Object = 15,\n Spare8Object = 16,\n Spare9Object = 17,\n ApcObject = 18,\n DpcObject = 19,\n DeviceQueueObject = 20,\n EventPairObject = 21,\n InterruptObject = 22,\n ProfileObject = 23,\n ThreadedDpcObject = 24,\n MaximumKernelObject = 25\n} KOBJECTS;\n\n//\n// Adjust reasons\n//\ntypedef enum _ADJUST_REASON\n{\n AdjustNone = 0,\n AdjustUnwait = 1,\n AdjustBoost = 2\n} ADJUST_REASON;\n\n//\n// Continue Status\n//\ntypedef enum _KCONTINUE_STATUS\n{\n ContinueError = 0,\n ContinueSuccess,\n ContinueProcessorReselected,\n ContinueNextProcessor\n} KCONTINUE_STATUS;\n\n//\n// Process States\n//\ntypedef enum _KPROCESS_STATE\n{\n ProcessInMemory,\n ProcessOutOfMemory,\n ProcessInTransition,\n ProcessInSwap,\n ProcessOutSwap,\n} KPROCESS_STATE, *PKPROCESS_STATE;\n\n//\n// NtVdmControl Classes\n//\ntypedef enum _VDMSERVICECLASS\n{\n VdmStartExecution = 0,\n VdmQueueInterrupt = 1,\n VdmDelayInterrupt = 2,\n VdmInitialize = 3,\n VdmFeatures = 4,\n VdmSetInt21Handler = 5,\n VdmQueryDir = 6,\n VdmPrinterDirectIoOpen = 7,\n VdmPrinterDirectIoClose = 8,\n VdmPrinterInitialize = 9,\n VdmSetLdtEntries = 10,\n VdmSetProcessLdtInfo = 11,\n VdmAdlibEmulation = 12,\n VdmPMCliControl = 13,\n VdmQueryVdmProcess = 14,\n} VDMSERVICECLASS;\n\n#ifdef NTOS_MODE_USER\n\n//\n// APC Normal Routine\n//\ntypedef VOID\n(NTAPI *PKNORMAL_ROUTINE)(\n IN PVOID NormalContext,\n IN PVOID SystemArgument1,\n IN PVOID SystemArgument2\n);\n\n//\n// Timer Routine\n//\ntypedef VOID\n(NTAPI *PTIMER_APC_ROUTINE)(\n IN PVOID TimerContext,\n IN ULONG TimerLowValue,\n IN LONG TimerHighValue\n);\n\n//\n// System Time Structure\n//\ntypedef struct _KSYSTEM_TIME\n{\n ULONG LowPart;\n LONG High1Time;\n LONG High2Time;\n} KSYSTEM_TIME, *PKSYSTEM_TIME;\n\n//\n// Shared Kernel User Data\n//\ntypedef struct _KUSER_SHARED_DATA\n{\n ULONG TickCountLowDeprecated;\n ULONG TickCountMultiplier;\n volatile KSYSTEM_TIME InterruptTime;\n volatile KSYSTEM_TIME SystemTime;\n volatile KSYSTEM_TIME TimeZoneBias;\n USHORT ImageNumberLow;\n USHORT ImageNumberHigh;\n WCHAR NtSystemRoot[260];\n ULONG MaxStackTraceDepth;\n ULONG CryptoExponent;\n ULONG TimeZoneId;\n ULONG LargePageMinimum;\n ULONG Reserved2[7];\n NT_PRODUCT_TYPE NtProductType;\n BOOLEAN ProductTypeIsValid;\n ULONG NtMajorVersion;\n ULONG NtMinorVersion;\n BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];\n ULONG Reserved1;\n ULONG Reserved3;\n volatile ULONG TimeSlip;\n ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;\n LARGE_INTEGER SystemExpirationDate;\n ULONG SuiteMask;\n BOOLEAN KdDebuggerEnabled;\n#if (NTDDI_VERSION >= NTDDI_WINXPSP2)\n UCHAR NXSupportPolicy;\n#endif\n volatile ULONG ActiveConsoleId;\n volatile ULONG DismountCount;\n ULONG ComPlusPackage;\n ULONG LastSystemRITEventTickCount;\n ULONG NumberOfPhysicalPages;\n BOOLEAN SafeBootMode;\n ULONG TraceLogging;\n ULONG Fill0;\n ULONGLONG TestRetInstruction;\n ULONG SystemCall;\n ULONG SystemCallReturn;\n ULONGLONG SystemCallPad[3];\n union {\n volatile KSYSTEM_TIME TickCount;\n volatile ULONG64 TickCountQuad;\n };\n ULONG Cookie;\n#if (NTDDI_VERSION >= NTDDI_WS03)\n LONGLONG ConsoleSessionForegroundProcessId;\n ULONG Wow64SharedInformation[MAX_WOW64_SHARED_ENTRIES];\n#endif\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n USHORT UserModeGlobalLogger[8];\n ULONG HeapTracingPid[2];\n ULONG CritSecTracingPid[2];\n union\n {\n ULONG SharedDataFlags;\n struct\n {\n ULONG DbgErrorPortPresent:1;\n ULONG DbgElevationEnabled:1;\n ULONG DbgVirtEnabled:1;\n ULONG DbgInstallerDetectEnabled:1;\n ULONG SpareBits:28;\n };\n };\n ULONG ImageFileExecutionOptions;\n KAFFINITY ActiveProcessorAffinity;\n#endif\n} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;\n\n//\n// VDM Structures\n//\n#include \"pshpack1.h\"\ntypedef struct _VdmVirtualIca\n{\n LONG ica_count[8];\n LONG ica_int_line;\n LONG ica_cpu_int;\n USHORT ica_base;\n USHORT ica_hipiri;\n USHORT ica_mode;\n UCHAR ica_master;\n UCHAR ica_irr;\n UCHAR ica_isr;\n UCHAR ica_imr;\n UCHAR ica_ssr;\n} VDMVIRTUALICA, *PVDMVIRTUALICA;\n#include \"poppack.h\"\n\ntypedef struct _VdmIcaUserData\n{\n PVOID pIcaLock;\n PVDMVIRTUALICA pIcaMaster;\n PVDMVIRTUALICA pIcaSlave;\n PULONG pDelayIrq;\n PULONG pUndelayIrq;\n PULONG pDelayIret;\n PULONG pIretHooked;\n PULONG pAddrIretBopTable;\n PHANDLE phWowIdleEvent;\n PLARGE_INTEGER pIcaTimeout;\n PHANDLE phMainThreadSuspended;\n} VDMICAUSERDATA, *PVDMICAUSERDATA;\n\ntypedef struct _VDM_INITIALIZE_DATA\n{\n PVOID TrapcHandler;\n PVDMICAUSERDATA IcaUserData;\n} VDM_INITIALIZE_DATA, *PVDM_INITIALIZE_DATA;\n\n#else\n\n//\n// System Thread Start Routine\n//\ntypedef\nVOID\n(NTAPI *PKSYSTEM_ROUTINE)(\n PKSTART_ROUTINE StartRoutine,\n PVOID StartContext\n);\n\n//\n// APC Environment Types\n//\ntypedef enum _KAPC_ENVIRONMENT\n{\n OriginalApcEnvironment,\n AttachedApcEnvironment,\n CurrentApcEnvironment,\n InsertApcEnvironment\n} KAPC_ENVIRONMENT;\n\n//\n// CPU Cache Types\n//\ntypedef enum _PROCESSOR_CACHE_TYPE\n{\n CacheUnified,\n CacheInstruction,\n CacheData,\n CacheTrace,\n} PROCESSOR_CACHE_TYPE;\n\n//\n// PRCB DPC Data\n//\ntypedef struct _KDPC_DATA\n{\n LIST_ENTRY DpcListHead;\n ULONG DpcLock;\n volatile ULONG DpcQueueDepth;\n ULONG DpcCount;\n} KDPC_DATA, *PKDPC_DATA;\n\n//\n// Per-Processor Lookaside List\n//\ntypedef struct _PP_LOOKASIDE_LIST\n{\n struct _GENERAL_LOOKASIDE *P;\n struct _GENERAL_LOOKASIDE *L;\n} PP_LOOKASIDE_LIST, *PPP_LOOKASIDE_LIST;\n\n//\n// CPU Cache Descriptor\n//\ntypedef struct _CACHE_DESCRIPTOR\n{\n UCHAR Level;\n UCHAR Associativity;\n USHORT LineSize;\n ULONG Size;\n PROCESSOR_CACHE_TYPE Type;\n} CACHE_DESCRIPTOR, *PCACHE_DESCRIPTOR;\n\n//\n// Architectural Types\n//\n#include \n\n//\n// Kernel Memory Node\n//\n#include \ntypedef struct _KNODE\n{\n SLIST_HEADER DeadStackList;\n SLIST_HEADER PfnDereferenceSListHead;\n KAFFINITY ProcessorMask;\n ULONG Color;\n UCHAR Seed;\n UCHAR NodeNumber;\n ULONG Flags;\n ULONG MmShiftedColor;\n ULONG FreeCount[2];\n struct _SINGLE_LIST_ENTRY *PfnDeferredList;\n} KNODE, *PKNODE;\n#include \n\n//\n// Kernel Profile Object\n//\ntypedef struct _KPROFILE\n{\n CSHORT Type;\n CSHORT Size;\n LIST_ENTRY ProfileListEntry;\n struct _KPROCESS *Process;\n PVOID RangeBase;\n PVOID RangeLimit;\n ULONG BucketShift;\n PVOID Buffer;\n ULONG Segment;\n KAFFINITY Affinity;\n KPROFILE_SOURCE Source;\n BOOLEAN Started;\n} KPROFILE, *PKPROFILE;\n\n//\n// Kernel Interrupt Object\n//\ntypedef struct _KINTERRUPT\n{\n CSHORT Type;\n CSHORT Size;\n LIST_ENTRY InterruptListEntry;\n PKSERVICE_ROUTINE ServiceRoutine;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PKSERVICE_ROUTINE MessageServiceRoutine;\n ULONG MessageIndex;\n#endif\n PVOID ServiceContext;\n KSPIN_LOCK SpinLock;\n ULONG TickCount;\n PKSPIN_LOCK ActualLock;\n PKINTERRUPT_ROUTINE DispatchAddress;\n ULONG Vector;\n KIRQL Irql;\n KIRQL SynchronizeIrql;\n BOOLEAN FloatingSave;\n BOOLEAN Connected;\n CCHAR Number;\n BOOLEAN ShareVector;\n KINTERRUPT_MODE Mode;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n KINTERRUPT_POLARITY Polarity;\n#endif\n ULONG ServiceCount;\n ULONG DispatchCount;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONGLONG Rsvd1;\n#endif\n ULONG DispatchCode[KINTERRUPT_DISPATCH_CODES];\n} KINTERRUPT, *PKINTERRUPT;\n\n//\n// Kernel Event Pair Object\n//\ntypedef struct _KEVENT_PAIR\n{\n CSHORT Type;\n CSHORT Size;\n KEVENT LowEvent;\n KEVENT HighEvent;\n} KEVENT_PAIR, *PKEVENT_PAIR;\n\n//\n// Kernel No Execute Options\n//\ntypedef struct _KEXECUTE_OPTIONS\n{\n UCHAR ExecuteDisable:1;\n UCHAR ExecuteEnable:1;\n UCHAR DisableThunkEmulation:1;\n UCHAR Permanent:1;\n UCHAR ExecuteDispatchEnable:1;\n UCHAR ImageDispatchEnable:1;\n UCHAR Spare:2;\n} KEXECUTE_OPTIONS, *PKEXECUTE_OPTIONS;\n\n//\n// Kernel Thread (KTHREAD)\n//\ntypedef struct _KTHREAD\n{\n DISPATCHER_HEADER DispatcherHeader;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONGLONG CycleTime;\n ULONG HighCycleTime;\n ULONGLONG QuantumTarget;\n#else\n LIST_ENTRY MutantListHead;\n#endif\n PVOID InitialStack;\n ULONG_PTR StackLimit;\n PVOID KernelStack;\n KSPIN_LOCK ThreadLock;\n union\n {\n KAPC_STATE ApcState;\n struct\n {\n UCHAR ApcStateFill[23];\n UCHAR ApcQueueable;\n volatile UCHAR NextProcessor;\n volatile UCHAR DeferredProcessor;\n UCHAR AdjustReason;\n SCHAR AdjustIncrement;\n };\n };\n KSPIN_LOCK ApcQueueLock;\n ULONG ContextSwitches;\n volatile UCHAR State;\n UCHAR NpxState;\n KIRQL WaitIrql;\n KPROCESSOR_MODE WaitMode;\n LONG_PTR WaitStatus;\n union\n {\n PKWAIT_BLOCK WaitBlockList;\n PKGATE GateObject;\n };\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n union\n {\n struct\n {\n ULONG KernelStackResident:1;\n ULONG ReadyTransition:1;\n ULONG ProcessReadyQueue:1;\n ULONG WaitNext:1;\n ULONG SystemAffinityActive:1;\n ULONG Alertable:1;\n ULONG GdiFlushActive:1;\n ULONG Reserved:25;\n };\n LONG MiscFlags;\n };\n#else\n BOOLEAN Alertable;\n BOOLEAN WaitNext;\n#endif\n UCHAR WaitReason;\n SCHAR Priority;\n BOOLEAN EnableStackSwap;\n volatile UCHAR SwapBusy;\n BOOLEAN Alerted[MaximumMode];\n union\n {\n LIST_ENTRY WaitListEntry;\n SINGLE_LIST_ENTRY SwapListEntry;\n };\n PKQUEUE Queue;\n ULONG WaitTime;\n union\n {\n struct\n {\n SHORT KernelApcDisable;\n SHORT SpecialApcDisable;\n };\n ULONG CombinedApcDisable;\n };\n struct _TEB *Teb;\n union\n {\n KTIMER Timer;\n struct\n {\n UCHAR TimerFill[40];\n union\n {\n struct\n {\n LONG AutoAlignment:1;\n LONG DisableBoost:1;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n LONG EtwStackTrace1ApcInserted:1;\n LONG EtwStackTrace2ApcInserted:1;\n LONG CycleChargePending:1;\n LONG ReservedFlags:27;\n#else\n LONG ReservedFlags:30;\n#endif\n };\n LONG ThreadFlags;\n };\n };\n };\n union\n {\n KWAIT_BLOCK WaitBlock[THREAD_WAIT_OBJECTS + 1];\n struct\n {\n UCHAR WaitBlockFill0[23];\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n UCHAR IdealProcessor;\n#else\n BOOLEAN SystemAffinityActive;\n#endif\n };\n struct\n {\n UCHAR WaitBlockFill1[47];\n CCHAR PreviousMode;\n };\n struct\n {\n UCHAR WaitBlockFill2[71];\n UCHAR ResourceIndex;\n };\n struct\n {\n UCHAR WaitBlockFill3[95];\n UCHAR LargeStack;\n };\n };\n LIST_ENTRY QueueListEntry;\n PKTRAP_FRAME TrapFrame;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PVOID FirstArgument;\n#endif\n PVOID CallbackStack;\n PVOID ServiceTable;\n UCHAR ApcStateIndex;\n#if (NTDDI_VERSION < NTDDI_LONGHORN)\n UCHAR IdealProcessor;\n#endif\n BOOLEAN Preempted;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n BOOLEAN CalloutActive;\n#else\n BOOLEAN ProcessReadyQueue;\n BOOLEAN KernelStackResident;\n#endif\n SCHAR BasePriority;\n SCHAR PriorityDecrement;\n CHAR Saturation;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG SystemCallNumber;\n ULONG Spare2;\n#endif\n KAFFINITY UserAffinity;\n struct _KPROCESS *Process;\n KAFFINITY Affinity;\n PKAPC_STATE ApcStatePointer[2];\n union\n {\n KAPC_STATE SavedApcState;\n struct\n {\n UCHAR SavedApcStateFill[23];\n CCHAR FreezeCount;\n CCHAR SuspendCount;\n UCHAR UserIdealProcessor;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n union\n {\n struct\n {\n UCHAR ReservedBits0:1;\n UCHAR SegmentsPresent:1;\n UCHAR Reservedbits1:1;\n };\n UCHAR NestedStateFlags;\n };\n#else\n UCHAR CalloutActive;\n#endif\n UCHAR Iopl;\n };\n };\n PVOID Win32Thread;\n PVOID StackBase;\n union\n {\n KAPC SuspendApc;\n struct\n {\n UCHAR SuspendApcFill0[1];\n SCHAR Quantum;\n };\n struct\n {\n UCHAR SuspendApcFill1[3];\n UCHAR QuantumReset;\n };\n struct\n {\n UCHAR SuspendApcFill2[4];\n ULONG KernelTime;\n };\n struct\n {\n UCHAR SuspendApcFill3[36];\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PKPRCB WaitPrcb;\n#else\n PVOID TlsArray;\n#endif\n };\n struct\n {\n UCHAR SuspendApcFill4[40];\n PVOID LegoData;\n };\n struct\n {\n UCHAR SuspendApcFill5[47];\n UCHAR PowerState;\n ULONG UserTime;\n };\n };\n union\n {\n KSEMAPHORE SuspendSemaphore;\n struct\n {\n UCHAR SuspendSemaphorefill[20];\n ULONG SListFaultCount;\n };\n };\n LIST_ENTRY ThreadListEntry;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n LIST_ENTRY MutantListHead;\n#endif\n PVOID SListFaultAddress;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PVOID MdlForLockedteb;\n#endif\n} KTHREAD, *PKTHREAD;\n\n#define ASSERT_THREAD(object) \\\n ASSERT((((object)->DispatcherHeader.Type & KOBJECT_TYPE_MASK) == ThreadObject))\n\n//\n// Kernel Process (KPROCESS)\n//\ntypedef struct _KPROCESS\n{\n DISPATCHER_HEADER Header;\n LIST_ENTRY ProfileListHead;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG DirectoryTableBase;\n ULONG Unused0;\n#else\n LARGE_INTEGER DirectoryTableBase;\n#endif\n#if defined(_M_IX86)\n KGDTENTRY LdtDescriptor;\n KIDTENTRY Int21Descriptor;\n USHORT IopmOffset;\n UCHAR Iopl;\n UCHAR Unused;\n#endif\n volatile ULONG ActiveProcessors;\n ULONG KernelTime;\n ULONG UserTime;\n LIST_ENTRY ReadyListHead;\n SINGLE_LIST_ENTRY SwapListEntry;\n PVOID VdmTrapcHandler;\n LIST_ENTRY ThreadListHead;\n KSPIN_LOCK ProcessLock;\n KAFFINITY Affinity;\n union\n {\n struct\n {\n LONG AutoAlignment:1;\n LONG DisableBoost:1;\n LONG DisableQuantum:1;\n LONG ReservedFlags:29;\n };\n LONG ProcessFlags;\n };\n SCHAR BasePriority;\n SCHAR QuantumReset;\n UCHAR State;\n UCHAR ThreadSeed;\n UCHAR PowerState;\n UCHAR IdealNode;\n UCHAR Visited;\n union\n {\n KEXECUTE_OPTIONS Flags;\n UCHAR ExecuteOptions;\n };\n ULONG StackCount;\n LIST_ENTRY ProcessListEntry;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONGLONG CycleTime;\n#endif\n} KPROCESS, *PKPROCESS;\n\n#define ASSERT_PROCESS(object) \\\n ASSERT((((object)->Header.Type & KOBJECT_TYPE_MASK) == ProcessObject))\n\n//\n// System Service Table Descriptor\n//\ntypedef struct _KSERVICE_TABLE_DESCRIPTOR\n{\n PULONG_PTR Base;\n PULONG Count;\n ULONG Limit;\n#if defined(_IA64_)\n LONG TableBaseGpOffset;\n#endif\n PUCHAR Number;\n} KSERVICE_TABLE_DESCRIPTOR, *PKSERVICE_TABLE_DESCRIPTOR;\n\n//\n// Exported Loader Parameter Block\n//\nextern struct _LOADER_PARAMETER_BLOCK NTSYSAPI *KeLoaderBlock;\n\n//\n// Exported Hardware Data\n//\nextern KAFFINITY NTSYSAPI KeActiveProcessors;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\nextern volatile CCHAR NTSYSAPI KeNumberProcessors;\n#else\n#if (NTDDI_VERSION >= NTDDI_WINXP)\nextern CCHAR NTSYSAPI KeNumberProcessors;\n#else\n//extern PCCHAR KeNumberProcessors;\nextern NTSYSAPI CCHAR KeNumberProcessors; //FIXME: Note to Alex: I won't fix this atm, since I prefer to discuss this with you first.\n#endif\n#endif\nextern ULONG NTSYSAPI KiDmaIoCoherency;\nextern ULONG NTSYSAPI KeMaximumIncrement;\nextern ULONG NTSYSAPI KeMinimumIncrement;\nextern ULONG NTSYSAPI KeDcacheFlushCount;\nextern ULONG NTSYSAPI KeIcacheFlushCount;\n\n//\n// Exported System Service Descriptor Tables\n//\nextern KSERVICE_TABLE_DESCRIPTOR NTSYSAPI KeServiceDescriptorTable[SSDT_MAX_ENTRIES];\nextern KSERVICE_TABLE_DESCRIPTOR NTSYSAPI KeServiceDescriptorTableShadow[SSDT_MAX_ENTRIES];\n\n#endif // !NTOS_MODE_USER\n\n#endif // _KETYPES_H\n" }, { "path": "ndk/ldrfuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n ldrfuncs.h\n\nAbstract:\n\n Functions definitions for the Loader.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _LDRFUNCS_H\n#define _LDRFUNCS_H\n\n//\n// Dependencies\n//\n#include \n#include \n#if defined(_MSC_VER) && !defined(NTOS_MODE_USER)\n#include \n#endif\n\n//\n// Resource Functions\n//\nNTSTATUS\nNTAPI\nLdrAccessResource(\n IN PVOID BaseAddress,\n IN PIMAGE_RESOURCE_DATA_ENTRY ResourceDataEntry,\n OUT PVOID *Resource OPTIONAL,\n OUT PULONG Size OPTIONAL\n);\n\nNTSTATUS\nNTAPI\nLdrFindResource_U(\n IN PVOID BaseAddress,\n IN PLDR_RESOURCE_INFO ResourceInfo,\n IN ULONG Level,\n OUT PIMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry\n);\n\nNTSTATUS\nNTAPI\nLdrFindResourceDirectory_U(\n IN PVOID BaseAddress,\n IN PLDR_RESOURCE_INFO ResourceInfo,\n IN ULONG Level,\n OUT PIMAGE_RESOURCE_DIRECTORY *ResourceDirectory\n);\n\nBOOLEAN\nLdrUnloadAlternateResourceModule(\n IN PVOID BaseAddress\n);\n\n//\n// Misc. Functions\n//\nNTSTATUS\nNTAPI\nLdrGetProcedureAddress(\n IN PVOID BaseAddress,\n IN PANSI_STRING Name,\n IN ULONG Ordinal,\n OUT PVOID *ProcedureAddress\n);\n\nULONG\nNTAPI\nLdrRelocateImage(\n IN PVOID NewBase,\n IN PUCHAR LoaderName,\n IN ULONG Success,\n IN ULONG Conflict,\n IN ULONG Invalid\n);\n\nNTSTATUS\nLdrLockLoaderLock(\n IN ULONG Flags,\n OUT PULONG Disposition OPTIONAL,\n OUT PULONG Cookie OPTIONAL\n);\n\nNTSTATUS\nNTAPI\nLdrUnlockLoaderLock(\n IN ULONG Flags,\n IN ULONG Cookie OPTIONAL\n);\n\nBOOLEAN\nNTAPI\nLdrVerifyMappedImageMatchesChecksum(\n IN PVOID BaseAddress,\n IN ULONG NumberOfBytes,\n IN ULONG FileLength\n);\n\n#endif\n" }, { "path": "ndk/ldrtypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n ldrtypes.h\n\nAbstract:\n\n Type definitions for the Loader.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _LDRTYPES_H\n#define _LDRTYPES_H\n\n//\n// Dependencies\n//\n#include \n\n//\n// Resource Type Levels\n//\n#define RESOURCE_TYPE_LEVEL 0\n#define RESOURCE_NAME_LEVEL 1\n#define RESOURCE_LANGUAGE_LEVEL 2\n#define RESOURCE_DATA_LEVEL 3\n\n//\n// Loader Data Table Entry Flags\n//\n#define LDRP_STATIC_LINK 0x00000002\n#define LDRP_IMAGE_DLL 0x00000004\n#define LDRP_LOAD_IN_PROGRESS 0x00001000\n#define LDRP_UNLOAD_IN_PROGRESS 0x00002000\n#define LDRP_ENTRY_PROCESSED 0x00004000\n#define LDRP_ENTRY_INSERTED 0x00008000\n#define LDRP_CURRENT_LOAD 0x00010000\n#define LDRP_FAILED_BUILTIN_LOAD 0x00020000\n#define LDRP_DONT_CALL_FOR_THREADS 0x00040000\n#define LDRP_PROCESS_ATTACH_CALLED 0x00080000\n#define LDRP_DEBUG_SYMBOLS_LOADED 0x00100000\n#define LDRP_IMAGE_NOT_AT_BASE 0x00200000\n#define LDRP_COR_IMAGE 0x00400000\n#define LDR_COR_OWNS_UNMAP 0x00800000\n#define LDRP_SYSTEM_MAPPED 0x01000000\n#define LDRP_IMAGE_VERIFYING 0x02000000\n#define LDRP_DRIVER_DEPENDENT_DLL 0x04000000\n#define LDRP_ENTRY_NATIVE 0x08800000\n#define LDRP_REDIRECTED 0x10000000\n#define LDRP_NON_PAGED_DEBUG_INFO 0x20000000\n#define LDRP_MM_LOADED 0x40000000\n#define LDRP_COMPAT_DATABASE_PROCESSED 0x80000000\n\n//\n// Dll Characteristics for LdrLoadDll\n//\n#define LDR_IGNORE_CODE_AUTHZ_LEVEL 0x00001000\n\n//\n// LdrAddRef Flags\n//\n#define LDR_PIN_MODULE 0x00000001\n\n//\n// LdrLockLoaderLock Flags\n//\n#define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_STATUS 0x00000001\n#define LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY 0x00000002\n\n//\n// FIXME: THIS SHOULD *NOT* BE USED!\n//\n#define IMAGE_SCN_TYPE_NOLOAD 0x00000002\n\n//\n// Loader Data stored in the PEB\n//\ntypedef struct _PEB_LDR_DATA\n{\n ULONG Length;\n BOOLEAN Initialized;\n PVOID SsHandle;\n LIST_ENTRY InLoadOrderModuleList;\n LIST_ENTRY InMemoryOrderModuleList;\n LIST_ENTRY InInitializationOrderModuleList;\n PVOID EntryInProgress;\n} PEB_LDR_DATA, *PPEB_LDR_DATA;\n\n//\n// Loader Data Table Entry\n//\ntypedef struct _LDR_DATA_TABLE_ENTRY\n{\n LIST_ENTRY InLoadOrderLinks;\n LIST_ENTRY InMemoryOrderModuleList;\n LIST_ENTRY InInitializationOrderModuleList;\n PVOID DllBase;\n PVOID EntryPoint;\n ULONG SizeOfImage;\n UNICODE_STRING FullDllName;\n UNICODE_STRING BaseDllName;\n ULONG Flags;\n USHORT LoadCount;\n USHORT TlsIndex;\n union\n {\n LIST_ENTRY HashLinks;\n PVOID SectionPointer;\n };\n ULONG CheckSum;\n union\n {\n ULONG TimeDateStamp;\n PVOID LoadedImports;\n };\n PVOID EntryPointActivationContext;\n PVOID PatchInformation;\n} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;\n\n//\n// Loaded Imports Reference Counting in Kernel\n//\ntypedef struct _LOAD_IMPORTS\n{\n SIZE_T Count;\n PLDR_DATA_TABLE_ENTRY Entry[1];\n} LOAD_IMPORTS, *PLOAD_IMPORTS;\n\n//\n// Loader Resource Information\n//\ntypedef struct _LDR_RESOURCE_INFO\n{\n ULONG Type;\n ULONG Name;\n ULONG Language;\n} LDR_RESOURCE_INFO, *PLDR_RESOURCE_INFO;\n\n//\n// DLL Notifications\n//\ntypedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA\n{\n ULONG Flags;\n PUNICODE_STRING FullDllName;\n PUNICODE_STRING BaseDllName;\n PVOID DllBase;\n ULONG SizeOfImage;\n} LDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_LOADED_NOTIFICATION_DATA;\n\ntypedef VOID\n(*PLDR_DLL_LOADED_NOTIFICATION_CALLBACK)(\n IN BOOLEAN Type,\n IN struct _LDR_DLL_LOADED_NOTIFICATION_DATA *Data\n);\n\ntypedef struct _LDR_DLL_LOADED_NOTIFICATION_ENTRY\n{\n LIST_ENTRY NotificationListEntry;\n PLDR_DLL_LOADED_NOTIFICATION_CALLBACK Callback;\n} LDR_DLL_LOADED_NOTIFICATION_ENTRY, *PLDR_DLL_LOADED_NOTIFICATION_ENTRY;\n\n//\n// Alternate Resources Support\n//\ntypedef struct _ALT_RESOURCE_MODULE\n{\n LANGID LangId;\n PVOID ModuleBase;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PVOID ModuleManifest;\n#endif\n PVOID AlternateModule;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n HANDLE AlternateFileHandle;\n ULONG ModuleCheckSum;\n ULONG ErrorCode;\n#endif\n} ALT_RESOURCE_MODULE, *PALT_RESOURCE_MODULE;\n\n#endif\n" }, { "path": "ndk/lpcfuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n lpcfuncs.h\n\nAbstract:\n\n Function definitions for the Executive.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _LPCFUNCS_H\n#define _LPCFUNCS_H\n\n//\n// Dependencies\n//\n#include \n\n//\n// LPC Exports\n//\n#ifndef NTOS_MODE_USER\nNTKERNELAPI\nNTSTATUS\nNTAPI\nLpcRequestWaitReplyPort(\n IN PVOID Port,\n IN PPORT_MESSAGE LpcMessageRequest,\n OUT PPORT_MESSAGE LpcMessageReply\n);\n\nNTSTATUS\nNTAPI\nLpcRequestPort(\n IN PVOID Port,\n IN PPORT_MESSAGE LpcMessage\n);\n#endif\n\n//\n// Native calls\n//\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAcceptConnectPort(\n PHANDLE PortHandle,\n PVOID PortContext OPTIONAL,\n PPORT_MESSAGE ConnectionRequest,\n BOOLEAN AcceptConnection,\n PPORT_VIEW ServerView OPTIONAL,\n PREMOTE_PORT_VIEW ClientView OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCompleteConnectPort(\n HANDLE PortHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtConnectPort(\n PHANDLE PortHandle,\n PUNICODE_STRING PortName,\n PSECURITY_QUALITY_OF_SERVICE SecurityQos,\n PPORT_VIEW ClientView OPTIONAL,\n PREMOTE_PORT_VIEW ServerView OPTIONAL,\n PULONG MaxMessageLength OPTIONAL,\n PVOID ConnectionInformation OPTIONAL,\n PULONG ConnectionInformationLength OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreatePort(\n PHANDLE PortHandle,\n POBJECT_ATTRIBUTES ObjectAttributes,\n ULONG MaxConnectionInfoLength,\n ULONG MaxMessageLength,\n ULONG MaxPoolUsage\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateWaitablePort(\n PHANDLE PortHandle,\n POBJECT_ATTRIBUTES ObjectAttributes,\n ULONG MaxConnectInfoLength,\n ULONG MaxDataLength,\n ULONG NPMessageQueueSize OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtImpersonateClientOfPort(\n HANDLE PortHandle,\n PPORT_MESSAGE ClientMessage\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtListenPort(\n HANDLE PortHandle,\n PPORT_MESSAGE ConnectionRequest\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationPort(\n HANDLE PortHandle,\n PORT_INFORMATION_CLASS PortInformationClass,\n PVOID PortInformation,\n ULONG PortInformationLength,\n PULONG ReturnLength\n);\n\nNTSTATUS\nNTAPI\nNtQueryPortInformationProcess(\n VOID\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReadRequestData(\n HANDLE PortHandle,\n PPORT_MESSAGE Message,\n ULONG Index,\n PVOID Buffer,\n ULONG BufferLength,\n PULONG ReturnLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReplyPort(\n IN HANDLE PortHandle,\n IN PPORT_MESSAGE LpcReply\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReplyWaitReceivePort(\n IN HANDLE PortHandle,\n OUT PVOID *PortContext OPTIONAL,\n IN PPORT_MESSAGE ReplyMessage OPTIONAL,\n OUT PPORT_MESSAGE ReceiveMessage\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReplyWaitReceivePortEx(\n IN HANDLE PortHandle,\n OUT PVOID *PortContext OPTIONAL,\n IN PPORT_MESSAGE ReplyMessage OPTIONAL,\n OUT PPORT_MESSAGE ReceiveMessage,\n IN PLARGE_INTEGER Timeout OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReplyWaitReplyPort(\n IN HANDLE PortHandle,\n OUT PPORT_MESSAGE ReplyMessage\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRequestPort(\n IN HANDLE PortHandle,\n IN PPORT_MESSAGE LpcMessage\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRequestWaitReplyPort(\n IN HANDLE PortHandle,\n OUT PPORT_MESSAGE LpcReply,\n IN PPORT_MESSAGE LpcRequest\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSecureConnectPort(\n PHANDLE PortHandle,\n PUNICODE_STRING PortName,\n PSECURITY_QUALITY_OF_SERVICE SecurityQos,\n PPORT_VIEW ClientView OPTIONAL,\n PSID Sid OPTIONAL,\n PREMOTE_PORT_VIEW ServerView OPTIONAL,\n PULONG MaxMessageLength OPTIONAL,\n PVOID ConnectionInformation OPTIONAL,\n PULONG ConnectionInformationLength OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWriteRequestData(\n HANDLE PortHandle,\n PPORT_MESSAGE Message,\n ULONG Index,\n PVOID Buffer,\n ULONG BufferLength,\n PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAcceptConnectPort(\n PHANDLE PortHandle,\n PVOID PortContext OPTIONAL,\n PPORT_MESSAGE ConnectionRequest,\n BOOLEAN AcceptConnection,\n PPORT_VIEW ServerView OPTIONAL,\n PREMOTE_PORT_VIEW ClientView OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCompleteConnectPort(\n HANDLE PortHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwConnectPort(\n PHANDLE PortHandle,\n PUNICODE_STRING PortName,\n PSECURITY_QUALITY_OF_SERVICE SecurityQos,\n PPORT_VIEW ClientView OPTIONAL,\n PREMOTE_PORT_VIEW ServerView OPTIONAL,\n PULONG MaxMessageLength OPTIONAL,\n PVOID ConnectionInformation OPTIONAL,\n PULONG ConnectionInformationLength OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreatePort(\n PHANDLE PortHandle,\n POBJECT_ATTRIBUTES ObjectAttributes,\n ULONG MaxConnectionInfoLength,\n ULONG MaxMessageLength,\n ULONG MaxPoolUsage\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateWaitablePort(\n PHANDLE PortHandle,\n POBJECT_ATTRIBUTES ObjectAttributes,\n ULONG MaxConnectInfoLength,\n ULONG MaxDataLength,\n ULONG NPMessageQueueSize OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwImpersonateClientOfPort(\n HANDLE PortHandle,\n PPORT_MESSAGE ClientMessage\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwListenPort(\n HANDLE PortHandle,\n PPORT_MESSAGE ConnectionRequest\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryInformationPort(\n HANDLE PortHandle,\n PORT_INFORMATION_CLASS PortInformationClass,\n PVOID PortInformation,\n ULONG PortInformationLength,\n PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwReadRequestData(\n HANDLE PortHandle,\n PPORT_MESSAGE Message,\n ULONG Index,\n PVOID Buffer,\n ULONG BufferLength,\n PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwReplyPort(\n IN HANDLE PortHandle,\n IN PPORT_MESSAGE LpcReply\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwReplyWaitReceivePort(\n IN HANDLE PortHandle,\n OUT PVOID *PortContext OPTIONAL,\n IN PPORT_MESSAGE ReplyMessage OPTIONAL,\n OUT PPORT_MESSAGE ReceiveMessage\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwReplyWaitReceivePortEx(\n IN HANDLE PortHandle,\n OUT PVOID *PortContext OPTIONAL,\n IN PPORT_MESSAGE ReplyMessage OPTIONAL,\n OUT PPORT_MESSAGE ReceiveMessage,\n IN PLARGE_INTEGER Timeout OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwReplyWaitReplyPort(\n IN HANDLE PortHandle,\n OUT PPORT_MESSAGE ReplyMessage\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwRequestPort(\n IN HANDLE PortHandle,\n IN PPORT_MESSAGE LpcMessage\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwRequestWaitReplyPort(\n IN HANDLE PortHandle,\n OUT PPORT_MESSAGE LpcReply,\n IN PPORT_MESSAGE LpcRequest\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSecureConnectPort(\n PHANDLE PortHandle,\n PUNICODE_STRING PortName,\n PSECURITY_QUALITY_OF_SERVICE SecurityQos,\n PPORT_VIEW ClientView OPTIONAL,\n PSID Sid OPTIONAL,\n PREMOTE_PORT_VIEW ServerView OPTIONAL,\n PULONG MaxMessageLength OPTIONAL,\n PVOID ConnectionInformation OPTIONAL,\n PULONG ConnectionInformationLength OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwWriteRequestData(\n HANDLE PortHandle,\n PPORT_MESSAGE Message,\n ULONG Index,\n PVOID Buffer,\n ULONG BufferLength,\n PULONG ReturnLength\n);\n\n#endif\n" }, { "path": "ndk/lpctypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n lpctypes.h\n\nAbstract:\n\n Type definitions for the Loader.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _LPCTYPES_H\n#define _LPCTYPES_H\n\n//\n// Dependencies\n//\n#include \n//#include \n\n//\n// Internal helper macro\n//\n#define N_ROUND_UP(x,s) \\\n (((ULONG)(x)+(s)-1) & ~((ULONG)(s)-1))\n\n//\n// Maximum message size that can be sent through an LPC Port without a section\n//\n#define PORT_MAXIMUM_MESSAGE_LENGTH 256\n\n//\n// Port Object Access Masks\n//\n#define PORT_CONNECT 0x1\n#define PORT_ALL_ACCESS 0x1\n\n//\n// Port Object Flags\n//\n#define LPCP_CONNECTION_PORT 0x00000001\n#define LPCP_UNCONNECTED_PORT 0x00000002\n#define LPCP_COMMUNICATION_PORT 0x00000003\n#define LPCP_CLIENT_PORT 0x00000004\n#define LPCP_PORT_TYPE_MASK 0x0000000F\n#define LPCP_PORT_DELETED 0x10000000\n#define LPCP_WAITABLE_PORT 0x20000000\n#define LPCP_NAME_DELETED 0x40000000\n#define LPCP_SECURITY_DYNAMIC 0x80000000\n\n//\n// LPC Message Types\n//\ntypedef enum _LPC_TYPE\n{\n LPC_NEW_MESSAGE,\n LPC_REQUEST,\n LPC_REPLY,\n LPC_DATAGRAM,\n LPC_LOST_REPLY,\n LPC_PORT_CLOSED,\n LPC_CLIENT_DIED,\n LPC_EXCEPTION,\n LPC_DEBUG_EVENT,\n LPC_ERROR_EVENT,\n LPC_CONNECTION_REQUEST,\n LPC_CONNECTION_REFUSED,\n LPC_MAXIMUM\n} LPC_TYPE;\n\n//\n// Information Classes for NtQueryInformationPort\n//\ntypedef enum _PORT_INFORMATION_CLASS\n{\n PortNoInformation\n} PORT_INFORMATION_CLASS;\n\n#ifdef NTOS_MODE_USER\n\n//\n// Portable LPC Types for 32/64-bit compatibility\n//\n#ifdef USE_LPC6432\n#define LPC_CLIENT_ID CLIENT_ID64\n#define LPC_SIZE_T ULONGLONG\n#define LPC_PVOID ULONGLONG\n#define LPC_HANDLE ULONGLONG\n#else\n#define LPC_CLIENT_ID CLIENT_ID\n#define LPC_SIZE_T SIZE_T\n#define LPC_PVOID PVOID\n#define LPC_HANDLE HANDLE\n#endif\n\n//\n// LPC Port Message\n//\ntypedef struct _PORT_MESSAGE\n{\n union\n {\n struct\n {\n CSHORT DataLength;\n CSHORT TotalLength;\n } s1;\n ULONG Length;\n } u1;\n union\n {\n struct\n {\n CSHORT Type;\n CSHORT DataInfoOffset;\n } s2;\n ULONG ZeroInit;\n } u2;\n union\n {\n LPC_CLIENT_ID ClientId;\n double DoNotUseThisField;\n };\n ULONG MessageId;\n union\n {\n LPC_SIZE_T ClientViewSize;\n ULONG CallbackId;\n };\n} PORT_MESSAGE, *PPORT_MESSAGE;\n\n//\n// Local and Remove Port Views\n//\ntypedef struct _PORT_VIEW\n{\n ULONG Length;\n LPC_HANDLE SectionHandle;\n ULONG SectionOffset;\n LPC_SIZE_T ViewSize;\n LPC_PVOID ViewBase;\n LPC_PVOID ViewRemoteBase;\n} PORT_VIEW, *PPORT_VIEW;\n\ntypedef struct _REMOTE_PORT_VIEW\n{\n ULONG Length;\n LPC_SIZE_T ViewSize;\n LPC_PVOID ViewBase;\n} REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW;\n\n//\n// LPC Kernel-Mode Message Structures defined for size only\n//\ntypedef struct _LPCP_MESSAGE\n{\n UCHAR Data[0x14];\n PORT_MESSAGE Request;\n} LPCP_MESSAGE;\n\ntypedef struct _LPCP_CONNECTION_MESSAGE\n{\n UCHAR Data[0x2C];\n} LPCP_CONNECTION_MESSAGE;\n\n#else\n\n//\n// LPC Paged and Non-Paged Port Queues\n//\ntypedef struct _LPCP_NONPAGED_PORT_QUEUE\n{\n KSEMAPHORE Semaphore;\n struct _LPCP_PORT_OBJECT *BackPointer;\n} LPCP_NONPAGED_PORT_QUEUE, *PLPCP_NONPAGED_PORT_QUEUE;\n\ntypedef struct _LPCP_PORT_QUEUE\n{\n PLPCP_NONPAGED_PORT_QUEUE NonPagedPortQueue;\n PKSEMAPHORE Semaphore;\n LIST_ENTRY ReceiveHead;\n} LPCP_PORT_QUEUE, *PLPCP_PORT_QUEUE;\n\n//\n// LPC Port Object\n//\ntypedef struct _LPCP_PORT_OBJECT\n{\n struct _LPCP_PORT_OBJECT *ConnectionPort;\n struct _LPCP_PORT_OBJECT *ConnectedPort;\n LPCP_PORT_QUEUE MsgQueue;\n CLIENT_ID Creator;\n PVOID ClientSectionBase;\n PVOID ServerSectionBase;\n PVOID PortContext;\n PETHREAD ClientThread;\n SECURITY_QUALITY_OF_SERVICE SecurityQos;\n SECURITY_CLIENT_CONTEXT StaticSecurity;\n LIST_ENTRY LpcReplyChainHead;\n LIST_ENTRY LpcDataInfoChainHead;\n PEPROCESS ServerProcess;\n PEPROCESS MappingProcess;\n ULONG MaxMessageLength;\n ULONG MaxConnectionInfoLength;\n ULONG Flags;\n KEVENT WaitEvent;\n} LPCP_PORT_OBJECT, *PLPCP_PORT_OBJECT;\n\n//\n// LPC Kernel-Mode Message Structures\n//\ntypedef struct _LPCP_MESSAGE\n{\n union\n {\n LIST_ENTRY Entry;\n struct\n {\n SINGLE_LIST_ENTRY FreeEntry;\n ULONG Reserved0;\n };\n };\n PLPCP_PORT_OBJECT SenderPort;\n PETHREAD RepliedToThread;\n PVOID PortContext;\n PORT_MESSAGE Request;\n} LPCP_MESSAGE, *PLPCP_MESSAGE;\n\ntypedef struct _LPCP_CONNECTION_MESSAGE\n{\n PORT_VIEW ClientView;\n PLPCP_PORT_OBJECT ClientPort;\n PVOID SectionToMap;\n REMOTE_PORT_VIEW ServerView;\n} LPCP_CONNECTION_MESSAGE, *PLPCP_CONNECTION_MESSAGE;\n\n#endif\n\n//\n// Client Died LPC Message\n//\ntypedef struct _CLIENT_DIED_MSG\n{\n PORT_MESSAGE h;\n LARGE_INTEGER CreateTime;\n} CLIENT_DIED_MSG, *PCLIENT_DIED_MSG;\n\n//\n// Maximum total Kernel-Mode LPC Message Structure Size\n//\n#define LPCP_MAX_MESSAGE_SIZE \\\n N_ROUND_UP(PORT_MAXIMUM_MESSAGE_LENGTH + \\\n sizeof(LPCP_MESSAGE) + \\\n sizeof(LPCP_CONNECTION_MESSAGE), 16)\n\n//\n// Maximum actual LPC Message Length\n//\n#define LPC_MAX_MESSAGE_LENGTH \\\n (LPCP_MAX_MESSAGE_SIZE - \\\n FIELD_OFFSET(LPCP_MESSAGE, Request))\n\n//\n// Maximum actual size of LPC Message Data\n//\n#define LPC_MAX_DATA_LENGTH \\\n (LPC_MAX_MESSAGE_LENGTH - \\\n sizeof(PORT_MESSAGE) - \\\n sizeof(LPCP_CONNECTION_MESSAGE))\n\n#endif // _LPCTYPES_H\n" }, { "path": "ndk/mmfuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n mmfuncs.h\n\nAbstract:\n\n Functions definitions for the Memory Manager.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _MMFUNCS_H\n#define _MMFUNCS_H\n\n//\n// Dependencies\n//\n#include \n\n#ifndef NTOS_MODE_USER\n\n//\n// Section Functions\n//\nNTSTATUS\nNTAPI\nMmCreateSection(\n OUT PVOID *SectionObject,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN PLARGE_INTEGER MaximumSize,\n IN ULONG SectionPageProtection,\n IN ULONG AllocationAttributes,\n IN HANDLE FileHandle OPTIONAL,\n IN PFILE_OBJECT File OPTIONAL\n);\n\nNTSTATUS\nNTAPI\nMmMapViewOfSection(\n IN PVOID SectionObject,\n IN PEPROCESS Process,\n IN OUT PVOID *BaseAddress,\n IN ULONG ZeroBits,\n IN ULONG CommitSize,\n IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,\n IN OUT PULONG ViewSize,\n IN SECTION_INHERIT InheritDisposition,\n IN ULONG AllocationType,\n IN ULONG Protect\n);\n\nNTSTATUS\nNTAPI\nMmUnmapViewOfSection(\n struct _EPROCESS* Process,\n PVOID BaseAddress\n);\n\n#endif\n\n//\n// Native calls\n//\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAreMappedFilesTheSame(\n IN PVOID File1MappedAsAnImage,\n IN PVOID File2MappedAsFile\n);\n\nNTSTATUS\nNTAPI\nNtAllocateUserPhysicalPages(\n IN HANDLE ProcessHandle,\n IN OUT PULONG NumberOfPages,\n IN OUT PULONG UserPfnArray\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAllocateVirtualMemory(\n IN HANDLE ProcessHandle,\n IN OUT PVOID *BaseAddress,\n IN ULONG ZeroBits,\n IN OUT PSIZE_T RegionSize,\n IN ULONG AllocationType,\n IN ULONG Protect\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreatePagingFile(\n IN PUNICODE_STRING FileName,\n IN PLARGE_INTEGER InitialSize,\n IN PLARGE_INTEGER MaxiumSize,\n IN ULONG Reserved\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateSection(\n OUT PHANDLE SectionHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN PLARGE_INTEGER MaximumSize OPTIONAL,\n IN ULONG SectionPageProtection OPTIONAL,\n IN ULONG AllocationAttributes,\n IN HANDLE FileHandle OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtExtendSection(\n IN HANDLE SectionHandle,\n IN PLARGE_INTEGER NewMaximumSize\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFlushVirtualMemory(\n IN HANDLE ProcessHandle,\n IN OUT PVOID *BaseAddress,\n IN OUT PSIZE_T RegionSize,\n OUT PIO_STATUS_BLOCK IoStatus\n);\n\nNTSTATUS\nNTAPI\nNtFreeUserPhysicalPages(\n IN HANDLE ProcessHandle,\n IN OUT PULONG NumberOfPages,\n IN OUT PULONG UserPfnArray\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFreeVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID *BaseAddress,\n IN PSIZE_T RegionSize,\n IN ULONG FreeType\n);\n\n\nNTSTATUS\nNTAPI\nNtGetWriteWatch(\n IN HANDLE ProcessHandle,\n IN ULONG Flags,\n IN PVOID BaseAddress,\n IN ULONG RegionSize,\n IN PVOID *UserAddressArray,\n OUT PULONG EntriesInUserAddressArray,\n OUT PULONG Granularity\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtLockVirtualMemory(\n HANDLE ProcessHandle,\n PVOID BaseAddress,\n ULONG NumberOfBytesToLock,\n PULONG NumberOfBytesLocked\n);\n\nNTSTATUS\nNTAPI\nNtMapUserPhysicalPages(\n IN PVOID *VirtualAddresses,\n IN ULONG NumberOfPages,\n IN OUT PULONG UserPfnArray\n);\n\nNTSTATUS\nNTAPI\nNtMapUserPhysicalPagesScatter(\n IN PVOID *VirtualAddresses,\n IN ULONG NumberOfPages,\n IN OUT PULONG UserPfnArray\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtMapViewOfSection(\n IN HANDLE SectionHandle,\n IN HANDLE ProcessHandle,\n IN OUT PVOID *BaseAddress,\n IN ULONG ZeroBits,\n IN ULONG CommitSize,\n IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,\n IN OUT PSIZE_T ViewSize,\n IN SECTION_INHERIT InheritDisposition,\n IN ULONG AllocationType,\n IN ULONG AccessProtection\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenSection(\n OUT PHANDLE SectionHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtProtectVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID *BaseAddress,\n IN ULONG *NumberOfBytesToProtect,\n IN ULONG NewAccessProtection,\n OUT PULONG OldAccessProtection\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySection(\n IN HANDLE SectionHandle,\n IN SECTION_INFORMATION_CLASS SectionInformationClass,\n OUT PVOID SectionInformation,\n IN SIZE_T Length,\n OUT PSIZE_T ResultLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID Address,\n IN MEMORY_INFORMATION_CLASS VirtualMemoryInformationClass,\n OUT PVOID VirtualMemoryInformation,\n IN SIZE_T Length,\n OUT PSIZE_T ResultLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReadVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress,\n OUT PVOID Buffer,\n IN SIZE_T NumberOfBytesToRead,\n OUT PSIZE_T NumberOfBytesRead\n);\n\nNTSTATUS\nNTAPI\nNtResetWriteWatch(\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress,\n IN SIZE_T RegionSize\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnlockVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress,\n IN SIZE_T NumberOfBytesToUnlock,\n OUT PSIZE_T NumberOfBytesUnlocked OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnmapViewOfSection(\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWriteVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress,\n IN PVOID Buffer,\n IN SIZE_T NumberOfBytesToWrite,\n OUT PSIZE_T NumberOfBytesWritten\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAreMappedFilesTheSame(\n IN PVOID File1MappedAsAnImage,\n IN PVOID File2MappedAsFile\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAllocateVirtualMemory(\n IN HANDLE ProcessHandle,\n IN OUT PVOID *BaseAddress,\n IN ULONG ZeroBits,\n IN OUT PSIZE_T RegionSize,\n IN ULONG AllocationType,\n IN ULONG Protect\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreatePagingFile(\n IN PUNICODE_STRING FileName,\n IN PLARGE_INTEGER InitialSize,\n IN PLARGE_INTEGER MaxiumSize,\n IN ULONG Reserved\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateSection(\n OUT PHANDLE SectionHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN PLARGE_INTEGER MaximumSize OPTIONAL,\n IN ULONG SectionPageProtection OPTIONAL,\n IN ULONG AllocationAttributes,\n IN HANDLE FileHandle OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwExtendSection(\n IN HANDLE SectionHandle,\n IN PLARGE_INTEGER NewMaximumSize\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwFreeVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID *BaseAddress,\n IN PSIZE_T RegionSize,\n IN ULONG FreeType\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwLockVirtualMemory(\n HANDLE ProcessHandle,\n PVOID BaseAddress,\n SIZE_T NumberOfBytesToLock,\n PSIZE_T NumberOfBytesLocked\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwMapViewOfSection(\n IN HANDLE SectionHandle,\n IN HANDLE ProcessHandle,\n IN OUT PVOID *BaseAddress,\n IN ULONG ZeroBits,\n IN ULONG CommitSize,\n IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,\n IN OUT PSIZE_T ViewSize,\n IN SECTION_INHERIT InheritDisposition,\n IN ULONG AllocationType,\n IN ULONG AccessProtection\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenSection(\n OUT PHANDLE SectionHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwProtectVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID *BaseAddress,\n IN ULONG *NumberOfBytesToProtect,\n IN ULONG NewAccessProtection,\n OUT PULONG OldAccessProtection\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQuerySection(\n IN HANDLE SectionHandle,\n IN SECTION_INFORMATION_CLASS SectionInformationClass,\n OUT PVOID SectionInformation,\n IN SIZE_T Length,\n OUT PSIZE_T ResultLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID Address,\n IN MEMORY_INFORMATION_CLASS VirtualMemoryInformationClass,\n OUT PVOID VirtualMemoryInformation,\n IN SIZE_T Length,\n OUT PSIZE_T ResultLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwReadVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress,\n OUT PVOID Buffer,\n IN SIZE_T NumberOfBytesToRead,\n OUT PSIZE_T NumberOfBytesRead\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwUnlockVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress,\n IN SIZE_T NumberOfBytesToUnlock,\n OUT PSIZE_T NumberOfBytesUnlocked OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwUnmapViewOfSection(\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwWriteVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress,\n IN PVOID Buffer,\n IN ULONG NumberOfBytesToWrite,\n OUT PULONG NumberOfBytesWritten\n);\n\n#endif\n" }, { "path": "ndk/mmtypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n mmtypes.h\n\nAbstract:\n\n Type definitions for the Memory Manager\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _MMTYPES_H\n#define _MMTYPES_H\n\n//\n// Dependencies\n//\n#include \n#include \n#include \n\n//\n// Page-Rounding Macros\n//\n#define PAGE_ROUND_DOWN(x) \\\n (((ULONG_PTR)(x))&(~(PAGE_SIZE-1)))\n#define PAGE_ROUND_UP(x) \\\n ( (((ULONG_PTR)(x)) + PAGE_SIZE-1) & (~(PAGE_SIZE-1)) )\n#ifdef NTOS_MODE_USER\n#define ROUND_TO_PAGES(Size) \\\n (((ULONG_PTR)(Size) + PAGE_SIZE - 1) & ~(PAGE_SIZE - 1))\n#endif\n#define ROUND_TO_ALLOCATION_GRANULARITY(Size) \\\n (((ULONG_PTR)(Size) + MM_ALLOCATION_GRANULARITY - 1) \\\n & ~(MM_ALLOCATION_GRANULARITY - 1))\n\n//\n// Macro for generating pool tags\n//\n#define TAG(A, B, C, D) \\\n (ULONG)(((A)<<0) + ((B)<<8) + ((C)<<16) + ((D)<<24))\n\n//\n// PFN Identity Uses\n//\n#define MMPFNUSE_PROCESSPRIVATE 0\n#define MMPFNUSE_FILE 1\n#define MMPFNUSE_PAGEFILEMAPPED 2\n#define MMPFNUSE_PAGETABLE 3\n#define MMPFNUSE_PAGEDPOOL 4\n#define MMPFNUSE_NONPAGEDPOOL 5\n#define MMPFNUSE_SYSTEMPTE 6\n#define MMPFNUSE_SESSIONPRIVATE 7\n#define MMPFNUSE_METAFILE 8\n#define MMPFNUSE_AWEPAGE 9\n#define MMPFNUSE_DRIVERLOCKPAGE 10\n#define MMPFNUSE_KERNELSTACK 11\n\n#ifndef NTOS_MODE_USER\n\n//\n// Virtual Memory Flags\n//\n#define MEM_WRITE_WATCH 0x200000\n#define MEM_PHYSICAL 0x400000\n#define MEM_ROTATE 0x800000\n#define MEM_IMAGE SEC_IMAGE\n#define MEM_DOS_LIM 0x40000000\n\n//\n// Section Flags for NtCreateSection\n//\n#define SEC_NO_CHANGE 0x400000\n#define SEC_FILE 0x800000\n#define SEC_IMAGE 0x1000000\n#define SEC_PROTECTED_IMAGE 0x2000000\n#define SEC_RESERVE 0x4000000\n#define SEC_COMMIT 0x8000000\n#define SEC_NOCACHE 0x10000000\n#define SEC_WRITECOMBINE 0x40000000\n#define SEC_LARGE_PAGES 0x80000000\n#else\n#define SEC_BASED 0x200000\n\n//\n// Section Inherit Flags for NtCreateSection\n//\ntypedef enum _SECTION_INHERIT\n{\n ViewShare = 1,\n ViewUnmap = 2\n} SECTION_INHERIT;\n\n//\n// Pool Types\n//\ntypedef enum _POOL_TYPE\n{\n NonPagedPool,\n PagedPool,\n NonPagedPoolMustSucceed,\n DontUseThisType,\n NonPagedPoolCacheAligned,\n PagedPoolCacheAligned,\n NonPagedPoolCacheAlignedMustS,\n MaxPoolType,\n NonPagedPoolSession = 32,\n PagedPoolSession,\n NonPagedPoolMustSucceedSession,\n DontUseThisTypeSession,\n NonPagedPoolCacheAlignedSession,\n PagedPoolCacheAlignedSession,\n NonPagedPoolCacheAlignedMustSSession\n} POOL_TYPE;\n#endif\n\n//\n// Memory Manager Page Lists\n//\ntypedef enum _MMLISTS\n{\n ZeroedPageList = 0,\n FreePageList = 1,\n StandbyPageList = 2,\n ModifiedPageList = 3,\n ModifiedNoWritePageList = 4,\n BadPageList = 5,\n ActiveAndValid = 6,\n TransitionPage = 7\n} MMLISTS;\n\n//\n// Per Processor Non Paged Lookaside List IDs\n//\ntypedef enum _PP_NPAGED_LOOKASIDE_NUMBER\n{\n LookasideSmallIrpList = 0,\n LookasideLargeIrpList = 1,\n LookasideMdlList = 2,\n LookasideCreateInfoList = 3,\n LookasideNameBufferList = 4,\n LookasideTwilightList = 5,\n LookasideCompletionList = 6,\n LookasideMaximumList = 7\n} PP_NPAGED_LOOKASIDE_NUMBER;\n\n//\n// Memory Information Classes for NtQueryVirtualMemory\n//\ntypedef enum _MEMORY_INFORMATION_CLASS\n{\n MemoryBasicInformation,\n MemoryWorkingSetList,\n MemorySectionName,\n MemoryBasicVlmInformation\n} MEMORY_INFORMATION_CLASS;\n\n//\n// Section Information Clasess for NtQuerySection\n//\ntypedef enum _SECTION_INFORMATION_CLASS\n{\n SectionBasicInformation,\n SectionImageInformation,\n} SECTION_INFORMATION_CLASS;\n\n#ifdef NTOS_MODE_USER\n\n//\n// Virtual Memory Counters\n//\ntypedef struct _VM_COUNTERS\n{\n SIZE_T PeakVirtualSize;\n SIZE_T VirtualSize;\n ULONG PageFaultCount;\n SIZE_T PeakWorkingSetSize;\n SIZE_T WorkingSetSize;\n SIZE_T QuotaPeakPagedPoolUsage;\n SIZE_T QuotaPagedPoolUsage;\n SIZE_T QuotaPeakNonPagedPoolUsage;\n SIZE_T QuotaNonPagedPoolUsage;\n SIZE_T PagefileUsage;\n SIZE_T PeakPagefileUsage;\n} VM_COUNTERS, *PVM_COUNTERS;\n\ntypedef struct _VM_COUNTERS_EX\n{\n SIZE_T PeakVirtualSize;\n SIZE_T VirtualSize;\n ULONG PageFaultCount;\n SIZE_T PeakWorkingSetSize;\n SIZE_T WorkingSetSize;\n SIZE_T QuotaPeakPagedPoolUsage;\n SIZE_T QuotaPagedPoolUsage;\n SIZE_T QuotaPeakNonPagedPoolUsage;\n SIZE_T QuotaNonPagedPoolUsage;\n SIZE_T PagefileUsage;\n SIZE_T PeakPagefileUsage;\n SIZE_T PrivateUsage;\n} VM_COUNTERS_EX, *PVM_COUNTERS_EX;\n#endif\n\n//\n// Sub-Information Types for PFN Identity\n//\ntypedef struct _MEMORY_FRAME_INFORMATION\n{\n ULONGLONG UseDescription:4;\n ULONGLONG ListDescription:3;\n ULONGLONG Reserved0:1;\n ULONGLONG Pinned:1;\n ULONGLONG DontUse:48;\n ULONGLONG Priority:3;\n ULONGLONG Reserved:4;\n} MEMORY_FRAME_INFORMATION, *PMEMORY_FRAME_INFORMATION;\n\ntypedef struct _FILEOFFSET_INFORMATION\n{\n ULONGLONG DontUse:9;\n ULONGLONG Offset:48;\n ULONGLONG Reserved:7;\n} FILEOFFSET_INFORMATION, *PFILEOFFSET_INFORMATION;\n\ntypedef struct _PAGEDIR_INFORMATION\n{\n ULONGLONG DontUse:9;\n ULONGLONG PageDirectoryBase:48;\n ULONGLONG Reserved:7;\n} PAGEDIR_INFORMATION, *PPAGEDIR_INFORMATION;\n\ntypedef struct _UNIQUE_PROCESS_INFORMATION\n{\n ULONGLONG DontUse:9;\n ULONGLONG UniqueProcessKey:48;\n ULONGLONG Reserved:7;\n} UNIQUE_PROCESS_INFORMATION, *PUNIQUE_PROCESS_INFORMATION;\n\n//\n// PFN Identity Data Structure\n//\ntypedef struct _MMPFN_IDENTITY\n{\n union\n {\n MEMORY_FRAME_INFORMATION e1;\n FILEOFFSET_INFORMATION e2;\n PAGEDIR_INFORMATION e3;\n UNIQUE_PROCESS_INFORMATION e4;\n } u1;\n SIZE_T PageFrameIndex;\n union\n {\n struct\n {\n ULONG Image:1;\n ULONG Mismatch:1;\n } e1;\n PVOID FileObject;\n PVOID UniqueFileObjectKey;\n PVOID ProtoPteAddress;\n PVOID VirtualAddress;\n } u2;\n} MMPFN_IDENTITY, *PMMPFN_IDENTITY;\n\n//\n// List of Working Sets\n//\ntypedef struct _MEMORY_WORKING_SET_LIST\n{\n ULONG NumberOfPages;\n ULONG WorkingSetList[1];\n} MEMORY_WORKING_SET_LIST, *PMEMORY_WORKING_SET_LIST;\n\n//\n// Memory Information Structures for NtQueryVirtualMemory\n//\ntypedef struct\n{\n UNICODE_STRING SectionFileName;\n WCHAR NameBuffer[ANYSIZE_ARRAY];\n} MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;\n\n//\n// Section Information Structures for NtQuerySection\n//\ntypedef struct _SECTION_BASIC_INFORMATION\n{\n PVOID BaseAddress;\n ULONG Attributes;\n LARGE_INTEGER Size;\n} SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;\n\ntypedef struct _SECTION_IMAGE_INFORMATION\n{\n PVOID TransferAddress;\n ULONG ZeroBits;\n SIZE_T MaximumStackSize;\n SIZE_T CommittedStackSize;\n ULONG SubSystemType;\n union\n {\n struct\n {\n USHORT SubSystemMinorVersion;\n USHORT SubSystemMajorVersion;\n };\n ULONG SubSystemVersion;\n };\n union\n {\n struct\n {\n USHORT MajorOperatingSystemVersion;\n USHORT MinorOperatingSystemVersion;\n };\n ULONG OperatingSystemVersion;\n };\n USHORT ImageCharacteristics;\n USHORT DllCharacteristics;\n USHORT Machine;\n BOOLEAN ImageContainsCode;\n union\n {\n UCHAR ImageFlags;\n struct\n {\n UCHAR ComPlusNativeReady : 1;\n UCHAR ComPlusILOnly : 1;\n UCHAR ImageDynamicallyRelocated : 1;\n UCHAR ImageMappedFlat : 1;\n UCHAR BaseBelow4gb : 1;\n UCHAR ComPlusPrefer32bit : 1;\n UCHAR Reserved : 2;\n };\n };\n ULONG LoaderFlags;\n ULONG ImageFileSize;\n ULONG CheckSum;\n} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;\n\n#ifndef NTOS_MODE_USER\n\n//\n// PTE Structures\n//\ntypedef struct _MMPTE\n{\n union\n {\n ULONG Long;\n HARDWARE_PTE Flush;\n MMPTE_HARDWARE Hard;\n MMPTE_PROTOTYPE Proto;\n MMPTE_SOFTWARE Soft;\n MMPTE_TRANSITION Trans;\n MMPTE_SUBSECTION Subsect;\n MMPTE_LIST List;\n } u;\n} MMPTE, *PMMPTE;\n\n//\n// Section Extension Information\n//\ntypedef struct _MMEXTEND_INFO\n{\n ULONGLONG CommittedSize;\n ULONG ReferenceCount;\n} MMEXTEND_INFO, *PMMEXTEND_INFO;\n\n//\n// Segment and Segment Flags\n//\ntypedef struct _SEGMENT_FLAGS\n{\n ULONG TotalNumberOfPtes4132:10;\n ULONG ExtraSharedWowSubsections:1;\n ULONG LargePages:1;\n ULONG Spare:20;\n} SEGMENT_FLAGS, *PSEGMENT_FLAGS;\n\ntypedef struct _SEGMENT\n{\n struct _CONTROL_AREA *ControlArea;\n ULONG TotalNumberOfPtes;\n ULONG NonExtendedPtes;\n ULONG Spare0;\n ULONGLONG SizeOfSegment;\n MMPTE SegmentPteTemplate;\n ULONG NumberOfCommittedPages;\n PMMEXTEND_INFO ExtendInfo;\n SEGMENT_FLAGS SegmentFlags;\n PVOID BaseAddress;\n union\n {\n SIZE_T ImageCommitment;\n PEPROCESS CreatingProcess;\n } u1;\n union\n {\n PSECTION_IMAGE_INFORMATION ImageInformation;\n PVOID FirstMappedVa;\n } u2;\n PMMPTE PrototypePte;\n MMPTE ThePtes[1];\n} SEGMENT, *PSEGMENT;\n\n//\n// Event Counter Structure\n//\ntypedef struct _EVENT_COUNTER\n{\n ULONG RefCount;\n KEVENT Event;\n LIST_ENTRY ListEntry;\n} EVENT_COUNTER, *PEVENT_COUNTER;\n\n//\n// Flags\n//\ntypedef struct _MMSECTION_FLAGS\n{\n ULONG BeingDeleted:1;\n ULONG BeingCreated:1;\n ULONG BeingPurged:1;\n ULONG NoModifiedWriting:1;\n ULONG FailAllIo:1;\n ULONG Image:1;\n ULONG Based:1;\n ULONG File:1;\n ULONG Networked:1;\n ULONG NoCache:1;\n ULONG PhysicalMemory:1;\n ULONG CopyOnWrite:1;\n ULONG Reserve:1;\n ULONG Commit:1;\n ULONG FloppyMedia:1;\n ULONG WasPurged:1;\n ULONG UserReference:1;\n ULONG GlobalMemory:1;\n ULONG DeleteOnClose:1;\n ULONG FilePointerNull:1;\n ULONG DebugSymbolsLoaded:1;\n ULONG SetMappedFileIoComplete:1;\n ULONG CollidedFlush:1;\n ULONG NoChange:1;\n ULONG filler0:1;\n ULONG ImageMappedInSystemSpace:1;\n ULONG UserWritable:1;\n ULONG Accessed:1;\n ULONG GlobalOnlyPerSession:1;\n ULONG Rom:1;\n ULONG WriteCombined:1;\n ULONG filler:1;\n} MMSECTION_FLAGS, *PMMSECTION_FLAGS;\n\ntypedef struct _MMSUBSECTION_FLAGS\n{\n ULONG ReadOnly:1;\n ULONG ReadWrite:1;\n ULONG SubsectionStatic:1;\n ULONG GlobalMemory:1;\n ULONG Protection:5;\n ULONG Spare:1;\n ULONG StartingSector4132:10;\n ULONG SectorEndOffset:12;\n} MMSUBSECTION_FLAGS, *PMMSUBSECTION_FLAGS;\n\ntypedef struct _MMSUBSECTION_FLAGS2\n{\n ULONG SubsectionAccessed:1;\n ULONG SubsectionConverted:1;\n ULONG Reserved:30;\n} MMSUBSECTION_FLAGS2;\n\n//\n// Control Area Structures\n//\ntypedef struct _CONTROL_AREA\n{\n PSEGMENT Segment;\n LIST_ENTRY DereferenceList;\n ULONG NumberOfSectionReferences;\n ULONG NumberOfPfnReferences;\n ULONG NumberOfMappedViews;\n ULONG NumberOfSystemCacheViews;\n ULONG NumberOfUserReferences;\n union\n {\n ULONG LongFlags;\n MMSECTION_FLAGS Flags;\n } u;\n PFILE_OBJECT FilePointer;\n PEVENT_COUNTER WaitingForDeletion;\n USHORT ModifiedWriteCount;\n USHORT FlushInProgressCount;\n ULONG WritableUserReferences;\n ULONG QuadwordPad;\n} CONTROL_AREA, *PCONTROL_AREA;\n\ntypedef struct _LARGE_CONTROL_AREA\n{\n PSEGMENT Segment;\n LIST_ENTRY DereferenceList;\n ULONG NumberOfSectionReferences;\n ULONG NumberOfPfnReferences;\n ULONG NumberOfMappedViews;\n ULONG NumberOfSystemCacheViews;\n ULONG NumberOfUserReferences;\n union\n {\n ULONG LongFlags;\n MMSECTION_FLAGS Flags;\n } u;\n PFILE_OBJECT FilePointer;\n PEVENT_COUNTER WaitingForDeletion;\n USHORT ModifiedWriteCount;\n USHORT FlushInProgressCount;\n ULONG WritableUserReferences;\n ULONG QuadwordPad;\n ULONG StartingFrame;\n LIST_ENTRY UserGlobalList;\n ULONG SessionId;\n} LARGE_CONTROL_AREA, *PLARGE_CONTROL_AREA;\n\n//\n// Subsection and Mapped Subsection\n//\ntypedef struct _SUBSECTION\n{\n PCONTROL_AREA ControlArea;\n union\n {\n ULONG LongFlags;\n MMSUBSECTION_FLAGS SubsectionFlags;\n } u;\n ULONG StartingSector;\n ULONG NumberOfFullSectors;\n PMMPTE SubsectionBase;\n ULONG UnusedPtes;\n ULONG PtesInSubsection;\n struct _SUBSECTION *NextSubsection;\n} SUBSECTION, *PSUBSECTION;\n\ntypedef struct _MSUBSECTION\n{\n PCONTROL_AREA ControlArea;\n union\n {\n ULONG LongFlags;\n MMSUBSECTION_FLAGS SubsectionFlags;\n } u;\n ULONG StartingSector;\n ULONG NumberOfFullSectors;\n PMMPTE SubsectionBase;\n ULONG UnusedPtes;\n ULONG PtesInSubsection;\n struct _SUBSECTION *NextSubsection;\n LIST_ENTRY DereferenceList;\n ULONG_PTR NumberOfMappedViews;\n union\n {\n ULONG LongFlags2;\n MMSUBSECTION_FLAGS2 SubsectionFlags2;\n } u2;\n} MSUBSECTION, *PMSUBSECTION;\n\n//\n// Segment Object\n//\ntypedef struct _SEGMENT_OBJECT\n{\n PVOID BaseAddress;\n ULONG TotalNumberOfPtes;\n LARGE_INTEGER SizeOfSegment;\n ULONG NonExtendedPtes;\n ULONG ImageCommitment;\n PCONTROL_AREA ControlArea;\n PSUBSECTION Subsection;\n PLARGE_CONTROL_AREA LargeControlArea;\n PMMSECTION_FLAGS MmSectionFlags;\n PMMSUBSECTION_FLAGS MmSubSectionFlags;\n} SEGMENT_OBJECT, *PSEGMENT_OBJECT;\n\n//\n// Section Object\n//\ntypedef struct _SECTION_OBJECT\n{\n PVOID StartingVa;\n PVOID EndingVa;\n PVOID LeftChild;\n PVOID RightChild;\n PSEGMENT_OBJECT Segment;\n} SECTION_OBJECT, *PSECTION_OBJECT;\n\n//\n// Generic Address Range Structure\n//\ntypedef struct _ADDRESS_RANGE\n{\n ULONG BaseAddrLow;\n ULONG BaseAddrHigh;\n ULONG LengthLow;\n ULONG LengthHigh;\n ULONG Type;\n} ADDRESS_RANGE, *PADDRESS_RANGE;\n\n//\n// Node in Memory Manager's AVL Table\n//\ntypedef struct _MMADDRESS_NODE\n{\n union\n {\n ULONG Balance:2;\n struct _MMADDRESS_NODE *Parent;\n } u1;\n struct _MMADDRESS_NODE *LeftChild;\n struct _MMADDRESS_NODE *RightChild;\n ULONG StartingVpn;\n ULONG EndingVpn;\n} MMADDRESS_NODE, *PMMADDRESS_NODE;\n\n//\n// Memory Manager AVL Table for VADs and other descriptors\n//\ntypedef struct _MM_AVL_TABLE\n{\n MMADDRESS_NODE BalancedRoot;\n ULONG DepthOfTree:5;\n ULONG Unused:3;\n ULONG NumberGenericTableElements:24;\n PVOID NodeHint;\n PVOID NodeFreeHint;\n} MM_AVL_TABLE, *PMM_AVL_TABLE;\n\n//\n// Actual Section Object\n//\ntypedef struct _SECTION\n{\n MMADDRESS_NODE Address;\n PSEGMENT Segment;\n LARGE_INTEGER SizeOfSection;\n union\n {\n ULONG LongFlags;\n MMSECTION_FLAGS Flags;\n } u;\n ULONG InitialPageProtection;\n} SECTION, *PSECTION;\n\n//\n// Memory Manager Working Set Structures\n//\ntypedef struct _MMWSLENTRY\n{\n ULONG Valid:1;\n ULONG LockedInWs:1;\n ULONG LockedInMemory:1;\n ULONG Protection:5;\n ULONG Hashed:1;\n ULONG Direct:1;\n ULONG Age:2;\n ULONG VirtualPageNumber:14;\n} MMWSLENTRY, *PMMWSLENTRY;\n\ntypedef struct _MMWSLE\n{\n union\n {\n PVOID VirtualAddress;\n ULONG Long;\n MMWSLENTRY e1;\n } u1;\n} MMWSLE, *PMMWSLE;\n\ntypedef struct _MMWSLE_HASH\n{\n PVOID Key;\n ULONG Index;\n} MMWSLE_HASH, *PMMWSLE_HASH;\n\ntypedef struct _MMWSL\n{\n ULONG FirstFree;\n ULONG FirstDynamic;\n ULONG LastEntry;\n ULONG NextSlot;\n PMMWSLE Wsle;\n ULONG LastInitializedWsle;\n ULONG NonDirectCount;\n PMMWSLE_HASH HashTable;\n ULONG HashTableSize;\n ULONG NumberOfCommittedPageTables;\n PVOID HashTableStart;\n PVOID HighestPermittedHashAddress;\n ULONG NumberOfImageWaiters;\n ULONG VadBitMapHint;\n USHORT UsedPageTableEntries[768];\n ULONG CommittedPageTables[24];\n} MMWSL, *PMMWSL;\n\n//\n// Flags for Memory Support Structure\n//\ntypedef struct _MMSUPPORT_FLAGS\n{\n ULONG SessionSpace:1;\n ULONG BeingTrimmed:1;\n ULONG SessionLeader:1;\n ULONG TrimHard:1;\n ULONG MaximumWorkingSetHard:1;\n ULONG ForceTrim:1;\n ULONG MinimumworkingSetHard:1;\n ULONG Available0:1;\n ULONG MemoryPriority:8;\n ULONG GrowWsleHash:1;\n ULONG AcquiredUnsafe:1;\n ULONG Available:14;\n} MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;\n\n//\n// Per-Process Memory Manager Data\n//\ntypedef struct _MMSUPPORT\n{\n#if (NTDDI_VERSION >= NTDDI_WS03)\n LIST_ENTRY WorkingSetExpansionLinks;\n#endif\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n USHORT LastTrimpStamp;\n USHORT NextPageColor;\n#else\n LARGE_INTEGER LastTrimTime;\n#endif\n MMSUPPORT_FLAGS Flags;\n ULONG PageFaultCount;\n ULONG PeakWorkingSetSize;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG Spare0;\n#else\n ULONG GrowthSinceLastEstimate;\n#endif\n ULONG MinimumWorkingSetSize;\n ULONG MaximumWorkingSetSize;\n PMMWSL VmWorkingSetList;\n#if (NTDDI_VERSION < NTDDI_WS03)\n LIST_ENTRY WorkingSetExpansionLinks;\n#endif\n ULONG Claim;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG Spare;\n ULONG WorkingSetPrivateSize;\n ULONG WorkingSetSizeOverhead;\n#else\n ULONG NextEstimationSlot;\n ULONG NextAgingSlot;\n ULONG EstimatedAvailable;\n#endif\n ULONG WorkingSetSize;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PKEVENT ExitEvent;\n#endif\n EX_PUSH_LOCK WorkingSetMutex;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PVOID AccessLog;\n#endif\n} MMSUPPORT, *PMMSUPPORT;\n\n//\n// Memory Information Types\n//\ntypedef struct _MEMORY_BASIC_INFORMATION\n{\n PVOID BaseAddress;\n PVOID AllocationBase;\n ULONG AllocationProtect;\n ULONG RegionSize;\n ULONG State;\n ULONG Protect;\n ULONG Type;\n} MEMORY_BASIC_INFORMATION,*PMEMORY_BASIC_INFORMATION;\n\n//\n// Driver Verifier Data\n//\ntypedef struct _MM_DRIVER_VERIFIER_DATA\n{\n ULONG Level;\n ULONG RaiseIrqls;\n ULONG AcquireSpinLocks;\n ULONG SynchronizeExecutions;\n ULONG AllocationsAttempted;\n ULONG AllocationsSucceeded;\n ULONG AllocationsSucceededSpecialPool;\n ULONG AllocationsWithNoTag;\n ULONG TrimRequests;\n ULONG Trims;\n ULONG AllocationsFailed;\n ULONG AllocationsFailedDeliberately;\n ULONG Loads;\n ULONG Unloads;\n ULONG UnTrackedPool;\n ULONG UserTrims;\n ULONG CurrentPagedPoolAllocations;\n ULONG CurrentNonPagedPoolAllocations;\n ULONG PeakPagedPoolAllocations;\n ULONG PeakNonPagedPoolAllocations;\n ULONG PagedBytes;\n ULONG NonPagedBytes;\n ULONG PeakPagedBytes;\n ULONG PeakNonPagedBytes;\n ULONG BurstAllocationsFailedDeliberately;\n ULONG SessionTrims;\n ULONG Reserved[2];\n} MM_DRIVER_VERIFIER_DATA, *PMM_DRIVER_VERIFIER_DATA;\n\n//\n// Internal Driver Verifier Table Data\n//\ntypedef struct _DRIVER_SPECIFIED_VERIFIER_THUNKS\n{\n LIST_ENTRY ListEntry;\n struct _LDR_DATA_TABLE_ENTRY *DataTableEntry;\n ULONG NumberOfThunks;\n} DRIVER_SPECIFIED_VERIFIER_THUNKS, *PDRIVER_SPECIFIED_VERIFIER_THUNKS;\n\n//\n// Default heap size values. For user mode, these values are copied to a new\n// process's PEB by the kernel in MmCreatePeb. In kernel mode, RtlCreateHeap\n// reads these variables directly.\n//\n// These variables should be considered \"const\"; they are written only once,\n// during MmInitSystem.\n//\nextern SIZE_T MmHeapSegmentReserve;\nextern SIZE_T MmHeapSegmentCommit;\nextern SIZE_T MmHeapDeCommitTotalFreeThreshold;\nextern SIZE_T MmHeapDeCommitFreeBlockThreshold;\n\n//\n// Section Object Type\n//\nextern POBJECT_TYPE MmSectionObjectType;\n\n#endif // !NTOS_MODE_USER\n\n#endif // _MMTYPES_H\n" }, { "path": "ndk/ntndk.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n ntndk.h\n\nAbstract:\n\n Master include file for the Native Development Kit.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _NTNDK_\n#define _NTNDK_\n\n//\n// Disable some warnings that we'd get on /W4.\n// Only active for compilers which support this feature.\n//\n#ifdef _MSC_VER\n#pragma warning(push)\n#pragma warning(disable:4001)\n#pragma warning(disable:4201)\n#pragma warning(disable:4115)\n#pragma warning(disable:4214)\n#endif\n\n//\n// Headers needed for NDK\n//\n#include // C Standard Header\n#include // C Standard Header\n#include // C Standard Header\n#include // General Definitions\n\n//\n// Type Headers\n//\n#include // Cache Manager Types\n#include // Configuration Manager Types\n#include // User-Mode Kernel Debugging Types\n#include // Executive Types\n#include // Kernel Debugger Types\n#include // Kernel Types\n#include // Hardware Abstraction Layer Types\n#include // IFS Support Header\n#include // Input/Output Manager Types\n#include // Loader Types\n#include // Local Procedure Call Types\n#include // Memory Manager Types\n#include // Object Manager Types\n#include // Power Manager Types\n#include // Process Manager Types\n#include // Runtime Library Types\n#include // Security Subsystem Types\n\n//\n// Function Headers\n//\n#include // Configuration Manager Functions\n#include // User-Mode Kernel Debugging Functions\n#include // Kernel Debugger Functions\n#include // Kernel Functions\n#include // Executive Functions\n#include // Hardware Abstraction Layer Functions\n#include // Input/Output Manager Functions\n#include // Initialization Boot Video Functions\n#include // Loader Functions\n#include // Local Procedure Call Functions\n#include // Memory Manager Functions\n#include // Object Manager Functions\n#include // Power Manager Functions\n#include // Process Manager Functions\n#include // Runtime Library Functions\n#include // Security Subsystem Functions\n#include // User-Mode NT Library Functions\n\n//\n// Assembly Support\n//\n#include // Assembly Offsets\n\n#ifdef _MSC_VER\n#pragma warning(pop)\n#endif\n#endif // _NTNDK_\n" }, { "path": "ndk/ntnls.h", "content": "/*++\n\nCopyright (c) Microsoft Corporation. All rights reserved.\n\nModule Name:\n\n ntnls.h\n\nAbstract:\n\n NLS file formats and data types\n\n\nRevision History:\n\n--*/\n\n#ifndef _NTNLS_\n#define _NTNLS_\n\n#if _MSC_VER > 1000\n#pragma once\n#endif\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n\n#define MAXIMUM_LEADBYTES 12\n\ntypedef struct _CPTABLEINFO {\n USHORT CodePage; // code page number\n USHORT MaximumCharacterSize; // max length (bytes) of a char\n USHORT DefaultChar; // default character (MB)\n USHORT UniDefaultChar; // default character (Unicode)\n USHORT TransDefaultChar; // translation of default char (Unicode)\n USHORT TransUniDefaultChar; // translation of Unic default char (MB)\n USHORT DBCSCodePage; // Non 0 for DBCS code pages\n UCHAR LeadByte[MAXIMUM_LEADBYTES]; // lead byte ranges\n PUSHORT MultiByteTable; // pointer to MB translation table\n PVOID WideCharTable; // pointer to WC translation table\n PUSHORT DBCSRanges; // pointer to DBCS ranges\n PUSHORT DBCSOffsets; // pointer to DBCS offsets\n} CPTABLEINFO, *PCPTABLEINFO;\n\ntypedef struct _NLSTABLEINFO {\n CPTABLEINFO OemTableInfo;\n CPTABLEINFO AnsiTableInfo;\n PUSHORT UpperCaseTable; // 844 format upcase table\n PUSHORT LowerCaseTable; // 844 format lower case table\n} NLSTABLEINFO, *PNLSTABLEINFO;\n\n#ifdef __cplusplus\n}\n#endif\n\n#endif // _NTNLS_\n\n" }, { "path": "ndk/obfuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n obtypes.h\n\nAbstract:\n\n Type definitions for the Object Manager\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _OBFUNCS_H\n#define _OBFUNCS_H\n\n//\n// Dependencies\n//\n#include \n#include \n#include \n\n#ifndef NTOS_MODE_USER\n\n//\n// Object Functions\n//\nNTKERNELAPI\nNTSTATUS\nNTAPI\nObAssignSecurity(\n IN PACCESS_STATE AccessState,\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN PVOID Object,\n IN POBJECT_TYPE Type\n);\n\nNTKERNELAPI\nNTSTATUS\nNTAPI\nObCloseHandle(\n IN HANDLE Handle,\n IN KPROCESSOR_MODE AccessMode\n);\n\nNTKERNELAPI\nNTSTATUS\nNTAPI\nObCreateObject(\n IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL,\n IN POBJECT_TYPE ObjectType,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN KPROCESSOR_MODE AccessMode,\n IN OUT PVOID ParseContext OPTIONAL,\n IN ULONG ObjectSize,\n IN ULONG PagedPoolCharge OPTIONAL,\n IN ULONG NonPagedPoolCharge OPTIONAL,\n OUT PVOID *Object\n);\n\nNTKERNELAPI\nNTSTATUS\nNTAPI\nObCreateObjectType(\n IN PUNICODE_STRING TypeName,\n IN POBJECT_TYPE_INITIALIZER ObjectTypeInitializer,\n IN PVOID Reserved,\n OUT POBJECT_TYPE *ObjectType\n);\n\nNTKERNELAPI\nULONG\nNTAPI\nObGetObjectPointerCount(\n IN PVOID Object\n);\n\nNTKERNELAPI\nNTSTATUS\nNTAPI\nObOpenObjectByName(\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN POBJECT_TYPE ObjectType,\n IN KPROCESSOR_MODE AccessMode,\n IN PACCESS_STATE PassedAccessState,\n IN ACCESS_MASK DesiredAccess,\n IN OUT PVOID ParseContext,\n OUT PHANDLE Handle\n);\n\nNTKERNELAPI\nNTSTATUS\nNTAPI\nObReferenceObjectByName(\n IN PUNICODE_STRING ObjectName,\n IN ULONG Attributes,\n IN PACCESS_STATE PassedAccessState OPTIONAL,\n IN ACCESS_MASK DesiredAccess OPTIONAL,\n IN POBJECT_TYPE ObjectType,\n IN KPROCESSOR_MODE AccessMode,\n IN OUT PVOID ParseContext OPTIONAL,\n OUT PVOID *Object\n);\n\nNTKERNELAPI\nBOOLEAN\nNTAPI\nObFindHandleForObject(\n IN PEPROCESS Process,\n IN PVOID Object,\n IN POBJECT_TYPE ObjectType,\n IN POBJECT_HANDLE_INFORMATION HandleInformation,\n OUT PHANDLE Handle\n);\n\n#endif\n\n//\n// Native Calls\n//\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtClose(\n IN HANDLE Handle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCloseObjectAuditAlarm(\n IN PUNICODE_STRING SubsystemName,\n IN PVOID HandleId,\n IN BOOLEAN GenerateOnClose\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateDirectoryObject(\n OUT PHANDLE DirectoryHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateSymbolicLinkObject(\n OUT PHANDLE SymbolicLinkHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN PUNICODE_STRING Name\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteObjectAuditAlarm(\n IN PUNICODE_STRING SubsystemName,\n IN PVOID HandleId,\n IN BOOLEAN GenerateOnClose\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDuplicateObject(\n IN HANDLE SourceProcessHandle,\n IN HANDLE SourceHandle,\n IN HANDLE TargetProcessHandle,\n OUT PHANDLE TargetHandle,\n IN ACCESS_MASK DesiredAccess,\n IN ULONG HandleAttributes,\n IN ULONG Options\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtMakePermanentObject(\n IN HANDLE Object\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtMakeTemporaryObject(\n IN HANDLE Handle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenDirectoryObject(\n OUT PHANDLE FileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenJobObject(\n PHANDLE JobHandle,\n ACCESS_MASK DesiredAccess,\n POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenSymbolicLinkObject(\n OUT PHANDLE SymbolicLinkHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryDirectoryObject(\n IN HANDLE DirectoryHandle,\n OUT PVOID Buffer,\n IN ULONG BufferLength,\n IN BOOLEAN ReturnSingleEntry,\n IN BOOLEAN RestartScan,\n IN OUT PULONG Context,\n OUT PULONG ReturnLength OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryObject(\n IN HANDLE ObjectHandle,\n IN OBJECT_INFORMATION_CLASS ObjectInformationClass,\n OUT PVOID ObjectInformation,\n IN ULONG Length,\n OUT PULONG ResultLength OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySecurityObject(\n IN HANDLE Handle,\n IN SECURITY_INFORMATION SecurityInformation,\n OUT PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySymbolicLinkObject(\n IN HANDLE SymLinkObjHandle,\n OUT PUNICODE_STRING LinkTarget,\n OUT PULONG DataWritten OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationObject(\n IN HANDLE ObjectHandle,\n IN OBJECT_INFORMATION_CLASS ObjectInformationClass,\n IN PVOID ObjectInformation,\n IN ULONG Length\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetSecurityObject(\n IN HANDLE Handle,\n IN SECURITY_INFORMATION SecurityInformation,\n IN PSECURITY_DESCRIPTOR SecurityDescriptor\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSignalAndWaitForSingleObject(\n IN HANDLE SignalObject,\n IN HANDLE WaitObject,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Time\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitForMultipleObjects(\n IN ULONG Count,\n IN HANDLE Object[],\n IN WAIT_TYPE WaitType,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Time\n);\n\nNTSTATUS\nNTAPI\nNtWaitForMultipleObjects32(\n IN ULONG ObjectCount,\n IN PLONG Handles,\n IN WAIT_TYPE WaitType,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER TimeOut OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitForSingleObject(\n IN HANDLE Object,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Time\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwClose(\n IN HANDLE Handle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCloseObjectAuditAlarm(\n IN PUNICODE_STRING SubsystemName,\n IN PVOID HandleId,\n IN BOOLEAN GenerateOnClose\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateDirectoryObject(\n OUT PHANDLE DirectoryHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateSymbolicLinkObject(\n OUT PHANDLE SymbolicLinkHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN PUNICODE_STRING Name\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDeleteObjectAuditAlarm(\n IN PUNICODE_STRING SubsystemName,\n IN PVOID HandleId,\n IN BOOLEAN GenerateOnClose\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDuplicateObject(\n IN HANDLE SourceProcessHandle,\n IN HANDLE SourceHandle,\n IN HANDLE TargetProcessHandle,\n OUT PHANDLE TargetHandle,\n IN ACCESS_MASK DesiredAccess,\n IN ULONG HandleAttributes,\n IN ULONG Options\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwMakePermanentObject(\n IN HANDLE Object\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwMakeTemporaryObject(\n IN HANDLE Handle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenDirectoryObject(\n OUT PHANDLE FileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenJobObject(\n PHANDLE JobHandle,\n ACCESS_MASK DesiredAccess,\n POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenSymbolicLinkObject(\n OUT PHANDLE SymbolicLinkHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryDirectoryObject(\n IN HANDLE DirectoryHandle,\n OUT PVOID Buffer,\n IN ULONG BufferLength,\n IN BOOLEAN ReturnSingleEntry,\n IN BOOLEAN RestartScan,\n IN OUT PULONG Context,\n OUT PULONG ReturnLength OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryObject(\n IN HANDLE ObjectHandle,\n IN OBJECT_INFORMATION_CLASS ObjectInformationClass,\n OUT PVOID ObjectInformation,\n IN ULONG Length,\n OUT PULONG ResultLength OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQuerySecurityObject(\n IN HANDLE Handle,\n IN SECURITY_INFORMATION SecurityInformation,\n OUT PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN ULONG Length,\n OUT PULONG ResultLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQuerySymbolicLinkObject(\n IN HANDLE SymLinkObjHandle,\n OUT PUNICODE_STRING LinkTarget,\n OUT PULONG DataWritten OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetInformationObject(\n IN HANDLE ObjectHandle,\n IN OBJECT_INFORMATION_CLASS ObjectInformationClass,\n IN PVOID ObjectInformation,\n IN ULONG Length\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetSecurityObject(\n IN HANDLE Handle,\n IN SECURITY_INFORMATION SecurityInformation,\n IN PSECURITY_DESCRIPTOR SecurityDescriptor\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSignalAndWaitForSingleObject(\n IN HANDLE SignalObject,\n IN HANDLE WaitObject,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Time\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwWaitForMultipleObjects(\n IN ULONG Count,\n IN HANDLE Object[],\n IN WAIT_TYPE WaitType,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Time\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwWaitForSingleObject(\n IN HANDLE Object,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Time\n);\n\n#endif\n" }, { "path": "ndk/obtypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n obtypes.h\n\nAbstract:\n\n Type definitions for the Object Manager\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _OBTYPES_H\n#define _OBTYPES_H\n\n//\n// Dependencies\n//\n#include \n#ifndef NTOS_MODE_USER\n#include \n#endif\n\n#ifdef NTOS_MODE_USER\n//\n// Definitions for Object Creation\n//\n#define OBJ_INHERIT 0x00000002L\n#define OBJ_PERMANENT 0x00000010L\n#define OBJ_EXCLUSIVE 0x00000020L\n#define OBJ_CASE_INSENSITIVE 0x00000040L\n#define OBJ_OPENIF 0x00000080L\n#define OBJ_OPENLINK 0x00000100L\n#define OBJ_KERNEL_HANDLE 0x00000200L\n#define OBJ_FORCE_ACCESS_CHECK 0x00000400L\n#define OBJ_VALID_ATTRIBUTES 0x000007F2L\n\n#define InitializeObjectAttributes(p,n,a,r,s) { \\\n (p)->Length = sizeof(OBJECT_ATTRIBUTES); \\\n (p)->RootDirectory = (r); \\\n (p)->Attributes = (a); \\\n (p)->ObjectName = (n); \\\n (p)->SecurityDescriptor = (s); \\\n (p)->SecurityQualityOfService = NULL; \\\n}\n\n//\n// Number of custom-defined bits that can be attached to a handle\n//\n#define OBJ_HANDLE_TAGBITS 0x3\n\n//\n// Directory Object Access Rights\n//\n#define DIRECTORY_QUERY 0x0001\n#define DIRECTORY_TRAVERSE 0x0002\n#define DIRECTORY_CREATE_OBJECT 0x0004\n#define DIRECTORY_CREATE_SUBDIRECTORY 0x0008\n#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)\n\n//\n// Slash separator used in the OB Namespace (and Registry)\n//\n#define OBJ_NAME_PATH_SEPARATOR L'\\\\'\n\n//\n// Object Information Classes for NtQueryInformationObject\n//\ntypedef enum _OBJECT_INFORMATION_CLASS\n{\n ObjectBasicInformation,\n ObjectNameInformation,\n ObjectTypeInformation,\n ObjectTypesInformation,\n ObjectHandleFlagInformation,\n ObjectSessionInformation,\n MaxObjectInfoClass\n} OBJECT_INFORMATION_CLASS;\n\n#else\n\n#if (NTDDI_VERSION < NTDDI_VISTASP1)\ntypedef enum _OBJECT_INFORMATION_CLASS\n{\n ObjectBasicInformation,\n ObjectNameInformation,\n ObjectTypeInformation,\n ObjectTypesInformation,\n ObjectHandleFlagInformation,\n ObjectSessionInformation,\n MaxObjectInfoClass\n} OBJECT_INFORMATION_CLASS;\n#endif\n\n//\n// Object Flags\n//\n#define OB_FLAG_CREATE_INFO 0x01\n#define OB_FLAG_KERNEL_MODE 0x02\n#define OB_FLAG_CREATOR_INFO 0x04\n#define OB_FLAG_EXCLUSIVE 0x08\n#define OB_FLAG_PERMANENT 0x10\n#define OB_FLAG_SECURITY 0x20\n#define OB_FLAG_SINGLE_PROCESS 0x40\n#define OB_FLAG_DEFER_DELETE 0x80\n\n#define OBJECT_TO_OBJECT_HEADER(o) \\\n CONTAINING_RECORD((o), OBJECT_HEADER, Body)\n\n#define OBJECT_HEADER_TO_NAME_INFO(h) \\\n ((POBJECT_HEADER_NAME_INFO)(!(h)->NameInfoOffset ? \\\n NULL: ((PCHAR)(h) - (h)->NameInfoOffset)))\n\n#define OBJECT_HEADER_TO_HANDLE_INFO(h) \\\n ((POBJECT_HEADER_HANDLE_INFO)(!(h)->HandleInfoOffset ? \\\n NULL: ((PCHAR)(h) - (h)->HandleInfoOffset)))\n\n#define OBJECT_HEADER_TO_QUOTA_INFO(h) \\\n ((POBJECT_HEADER_QUOTA_INFO)(!(h)->QuotaInfoOffset ? \\\n NULL: ((PCHAR)(h) - (h)->QuotaInfoOffset)))\n\n#define OBJECT_HEADER_TO_CREATOR_INFO(h) \\\n ((POBJECT_HEADER_CREATOR_INFO)(!((h)->Flags & \\\n OB_FLAG_CREATOR_INFO) ? NULL: ((PCHAR)(h) - \\\n sizeof(OBJECT_HEADER_CREATOR_INFO))))\n\n#define OBJECT_HEADER_TO_EXCLUSIVE_PROCESS(h) \\\n ((!((h)->Flags & OB_FLAG_EXCLUSIVE)) ? \\\n NULL: (((POBJECT_HEADER_QUOTA_INFO)((PCHAR)(h) - \\\n (h)->QuotaInfoOffset))->ExclusiveProcess))\n\n//\n// Reasons for Open Callback\n//\ntypedef enum _OB_OPEN_REASON\n{\n ObCreateHandle,\n ObOpenHandle,\n ObDuplicateHandle,\n ObInheritHandle,\n ObMaxOpenReason\n} OB_OPEN_REASON;\n\n#endif\n\n//\n// Object Duplication Flags\n//\n#define DUPLICATE_SAME_ATTRIBUTES 0x00000004\n\n//\n// Number of hash entries in an Object Directory\n//\n#define NUMBER_HASH_BUCKETS 37\n\n//\n// Types for DosDeviceDriveType\n//\n#define DOSDEVICE_DRIVE_UNKNOWN 0\n#define DOSDEVICE_DRIVE_CALCULATE 1\n#define DOSDEVICE_DRIVE_REMOVABLE 2\n#define DOSDEVICE_DRIVE_FIXED 3\n#define DOSDEVICE_DRIVE_REMOTE 4\n#define DOSDEVICE_DRIVE_CDROM 5\n#define DOSDEVICE_DRIVE_RAMDISK 6\n\n//\n// Dump Control Structure for Object Debugging\n//\ntypedef struct _OB_DUMP_CONTROL\n{\n PVOID Stream;\n ULONG Detail;\n} OB_DUMP_CONTROL, *POB_DUMP_CONTROL;\n\n#ifndef NTOS_MODE_USER\n\n//\n// Object Type Callbacks\n//\ntypedef VOID\n(NTAPI *OB_DUMP_METHOD)(\n IN PVOID Object,\n IN POB_DUMP_CONTROL Control OPTIONAL\n);\n\ntypedef NTSTATUS\n(NTAPI *OB_OPEN_METHOD)(\n IN OB_OPEN_REASON Reason,\n IN PEPROCESS Process OPTIONAL,\n IN PVOID ObjectBody,\n IN ACCESS_MASK GrantedAccess,\n IN ULONG HandleCount\n);\n\ntypedef VOID\n(NTAPI *OB_CLOSE_METHOD)(\n IN PEPROCESS Process OPTIONAL,\n IN PVOID Object,\n IN ACCESS_MASK GrantedAccess,\n IN ULONG ProcessHandleCount,\n IN ULONG SystemHandleCount\n);\n\ntypedef VOID\n(NTAPI *OB_DELETE_METHOD)(\n IN PVOID Object\n);\n\ntypedef NTSTATUS\n(NTAPI *OB_PARSE_METHOD)(\n IN PVOID ParseObject,\n IN PVOID ObjectType,\n IN OUT PACCESS_STATE AccessState,\n IN KPROCESSOR_MODE AccessMode,\n IN ULONG Attributes,\n IN OUT PUNICODE_STRING CompleteName,\n IN OUT PUNICODE_STRING RemainingName,\n IN OUT PVOID Context OPTIONAL,\n IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,\n OUT PVOID *Object\n);\n\ntypedef NTSTATUS\n(NTAPI *OB_SECURITY_METHOD)(\n IN PVOID Object,\n IN SECURITY_OPERATION_CODE OperationType,\n IN PSECURITY_INFORMATION SecurityInformation,\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN OUT PULONG CapturedLength,\n IN OUT PSECURITY_DESCRIPTOR *ObjectSecurityDescriptor,\n IN POOL_TYPE PoolType,\n IN PGENERIC_MAPPING GenericMapping\n);\n\ntypedef NTSTATUS\n(NTAPI *OB_QUERYNAME_METHOD)(\n IN PVOID Object,\n IN BOOLEAN HasObjectName,\n OUT POBJECT_NAME_INFORMATION ObjectNameInfo,\n IN ULONG Length,\n OUT PULONG ReturnLength,\n IN KPROCESSOR_MODE AccessMode\n);\n\ntypedef NTSTATUS\n(NTAPI *OB_OKAYTOCLOSE_METHOD)(\n IN PEPROCESS Process OPTIONAL,\n IN PVOID Object,\n IN HANDLE Handle,\n IN KPROCESSOR_MODE AccessMode\n);\n\n#else\n\n//\n// Object Information Types for NtQueryInformationObject\n//\ntypedef struct _OBJECT_NAME_INFORMATION\n{\n UNICODE_STRING Name;\n} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;\n\n#endif\n\ntypedef struct _OBJECT_HANDLE_ATTRIBUTE_INFORMATION\n{\n BOOLEAN Inherit;\n BOOLEAN ProtectFromClose;\n} OBJECT_HANDLE_ATTRIBUTE_INFORMATION, *POBJECT_HANDLE_ATTRIBUTE_INFORMATION;\n\ntypedef struct _OBJECT_DIRECTORY_INFORMATION\n{\n UNICODE_STRING Name;\n UNICODE_STRING TypeName;\n} OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION;\n\n//\n// Object Type Information\n//\ntypedef struct _OBJECT_TYPE_INFORMATION\n{\n UNICODE_STRING TypeName;\n ULONG TotalNumberOfObjects;\n ULONG TotalNumberOfHandles;\n ULONG TotalPagedPoolUsage;\n ULONG TotalNonPagedPoolUsage;\n ULONG TotalNamePoolUsage;\n ULONG TotalHandleTableUsage;\n ULONG HighWaterNumberOfObjects;\n ULONG HighWaterNumberOfHandles;\n ULONG HighWaterPagedPoolUsage;\n ULONG HighWaterNonPagedPoolUsage;\n ULONG HighWaterNamePoolUsage;\n ULONG HighWaterHandleTableUsage;\n ULONG InvalidAttributes;\n GENERIC_MAPPING GenericMapping;\n ULONG ValidAccessMask;\n BOOLEAN SecurityRequired;\n BOOLEAN MaintainHandleCount;\n ULONG PoolType;\n ULONG DefaultPagedPoolCharge;\n ULONG DefaultNonPagedPoolCharge;\n} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;\n\n#ifdef NTOS_MODE_USER\n\ntypedef struct _OBJECT_BASIC_INFORMATION\n{\n ULONG Attributes;\n ACCESS_MASK GrantedAccess;\n ULONG HandleCount;\n ULONG PointerCount;\n ULONG PagedPoolUsage;\n ULONG NonPagedPoolUsage;\n ULONG Reserved[3];\n ULONG NameInformationLength;\n ULONG TypeInformationLength;\n ULONG SecurityDescriptorLength;\n LARGE_INTEGER CreateTime;\n} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;\n\n#else\n\ntypedef struct _OBJECT_CREATE_INFORMATION\n{\n ULONG Attributes;\n HANDLE RootDirectory;\n PVOID ParseContext;\n KPROCESSOR_MODE ProbeMode;\n ULONG PagedPoolCharge;\n ULONG NonPagedPoolCharge;\n ULONG SecurityDescriptorCharge;\n PSECURITY_DESCRIPTOR SecurityDescriptor;\n PSECURITY_QUALITY_OF_SERVICE SecurityQos;\n SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;\n} OBJECT_CREATE_INFORMATION, *POBJECT_CREATE_INFORMATION;\n\n//\n// Object Type Initialize for ObCreateObjectType\n//\ntypedef struct _OBJECT_TYPE_INITIALIZER\n{\n USHORT Length;\n BOOLEAN UseDefaultObject;\n BOOLEAN CaseInsensitive;\n ULONG InvalidAttributes;\n GENERIC_MAPPING GenericMapping;\n ULONG ValidAccessMask;\n BOOLEAN SecurityRequired;\n BOOLEAN MaintainHandleCount;\n BOOLEAN MaintainTypeList;\n POOL_TYPE PoolType;\n ULONG DefaultPagedPoolCharge;\n ULONG DefaultNonPagedPoolCharge;\n OB_DUMP_METHOD DumpProcedure;\n OB_OPEN_METHOD OpenProcedure;\n OB_CLOSE_METHOD CloseProcedure;\n OB_DELETE_METHOD DeleteProcedure;\n OB_PARSE_METHOD ParseProcedure;\n OB_SECURITY_METHOD SecurityProcedure;\n OB_QUERYNAME_METHOD QueryNameProcedure;\n OB_OKAYTOCLOSE_METHOD OkayToCloseProcedure;\n} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;\n\n//\n// Object Type Object\n//\ntypedef struct _OBJECT_TYPE\n{\n ERESOURCE Mutex;\n LIST_ENTRY TypeList;\n UNICODE_STRING Name;\n PVOID DefaultObject;\n ULONG Index;\n ULONG TotalNumberOfObjects;\n ULONG TotalNumberOfHandles;\n ULONG HighWaterNumberOfObjects;\n ULONG HighWaterNumberOfHandles;\n OBJECT_TYPE_INITIALIZER TypeInfo;\n ULONG Key;\n ERESOURCE ObjectLocks[4];\n} OBJECT_TYPE;\n\n//\n// Object Directory Structures\n//\ntypedef struct _OBJECT_DIRECTORY_ENTRY\n{\n struct _OBJECT_DIRECTORY_ENTRY *ChainLink;\n PVOID Object;\n#if (NTDDI_VERSION >= NTDDI_WS03)\n ULONG HashValue;\n#endif\n} OBJECT_DIRECTORY_ENTRY, *POBJECT_DIRECTORY_ENTRY;\n\ntypedef struct _OBJECT_DIRECTORY\n{\n struct _OBJECT_DIRECTORY_ENTRY *HashBuckets[NUMBER_HASH_BUCKETS];\n#if (NTDDI_VERSION < NTDDI_WINXP)\n ERESOURCE Lock;\n#else\n EX_PUSH_LOCK Lock;\n#endif\n#if (NTDDI_VERSION < NTDDI_WINXP)\n BOOLEAN CurrentEntryValid;\n#else\n struct _DEVICE_MAP *DeviceMap;\n#endif\n ULONG SessionId;\n#if (NTDDI_VERSION == NTDDI_WINXP)\n USHORT Reserved;\n USHORT SymbolicLinkUsageCount;\n#endif\n} OBJECT_DIRECTORY, *POBJECT_DIRECTORY;\n\n//\n// Object Header Addon Information\n//\ntypedef struct _OBJECT_HEADER_NAME_INFO\n{\n POBJECT_DIRECTORY Directory;\n UNICODE_STRING Name;\n ULONG QueryReferences;\n ULONG Reserved2;\n ULONG DbgReferenceCount;\n} OBJECT_HEADER_NAME_INFO, *POBJECT_HEADER_NAME_INFO;\n\ntypedef struct _OBJECT_HANDLE_COUNT_ENTRY\n{\n struct _EPROCESS *Process;\n ULONG HandleCount;\n} OBJECT_HANDLE_COUNT_ENTRY, *POBJECT_HANDLE_COUNT_ENTRY;\n\ntypedef struct _OBJECT_HANDLE_COUNT_DATABASE\n{\n ULONG CountEntries;\n OBJECT_HANDLE_COUNT_ENTRY HandleCountEntries[1];\n} OBJECT_HANDLE_COUNT_DATABASE, *POBJECT_HANDLE_COUNT_DATABASE;\n\ntypedef struct _OBJECT_HEADER_HANDLE_INFO\n{\n union\n {\n POBJECT_HANDLE_COUNT_DATABASE HandleCountDatabase;\n OBJECT_HANDLE_COUNT_ENTRY SingleEntry;\n };\n} OBJECT_HEADER_HANDLE_INFO, *POBJECT_HEADER_HANDLE_INFO;\n\ntypedef struct _OBJECT_HEADER_CREATOR_INFO\n{\n LIST_ENTRY TypeList;\n PVOID CreatorUniqueProcess;\n USHORT CreatorBackTraceIndex;\n USHORT Reserved;\n} OBJECT_HEADER_CREATOR_INFO, *POBJECT_HEADER_CREATOR_INFO;\n\ntypedef struct _OBJECT_HEADER_QUOTA_INFO\n{\n ULONG PagedPoolCharge;\n ULONG NonPagedPoolCharge;\n ULONG SecurityDescriptorCharge;\n PEPROCESS ExclusiveProcess;\n} OBJECT_HEADER_QUOTA_INFO, *POBJECT_HEADER_QUOTA_INFO;\n\n//\n// Object Header\n//\ntypedef struct _OBJECT_HEADER\n{\n LONG PointerCount;\n union\n {\n LONG HandleCount;\n volatile PVOID NextToFree;\n };\n POBJECT_TYPE Type;\n UCHAR NameInfoOffset;\n UCHAR HandleInfoOffset;\n UCHAR QuotaInfoOffset;\n UCHAR Flags;\n union\n {\n POBJECT_CREATE_INFORMATION ObjectCreateInfo;\n PVOID QuotaBlockCharged;\n };\n PSECURITY_DESCRIPTOR SecurityDescriptor;\n QUAD Body;\n} OBJECT_HEADER, *POBJECT_HEADER;\n\n//\n// Object Lookup Context\n//\ntypedef struct _OBP_LOOKUP_CONTEXT\n{\n POBJECT_DIRECTORY Directory;\n PVOID Object;\n ULONG HashValue;\n USHORT HashIndex;\n BOOLEAN DirectoryLocked;\n ULONG LockStateSignature;\n} OBP_LOOKUP_CONTEXT, *POBP_LOOKUP_CONTEXT;\n\n//\n// Device Map\n//\ntypedef struct _DEVICE_MAP\n{\n POBJECT_DIRECTORY DosDevicesDirectory;\n POBJECT_DIRECTORY GlobalDosDevicesDirectory;\n ULONG ReferenceCount;\n ULONG DriveMap;\n UCHAR DriveType[32];\n} DEVICE_MAP, *PDEVICE_MAP;\n\n//\n// Symbolic Link Object\n//\ntypedef struct _OBJECT_SYMBOLIC_LINK\n{\n LARGE_INTEGER CreationTime;\n UNICODE_STRING LinkTarget;\n UNICODE_STRING LinkTargetRemaining;\n PVOID LinkTargetObject;\n ULONG DosDeviceDriveIndex;\n} OBJECT_SYMBOLIC_LINK, *POBJECT_SYMBOLIC_LINK;\n\n//\n// Kernel Exports\n//\nextern POBJECT_TYPE NTSYSAPI ObDirectoryType;\nextern PDEVICE_MAP NTSYSAPI ObSystemDeviceMap;\n\n#endif // !NTOS_MODE_USER\n\n#endif // _OBTYPES_H\n" }, { "path": "ndk/pofuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n pofuncs.h\n\nAbstract:\n\n Function definitions for the Power Subsystem.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _POFUNCS_H\n#define _POFUNCS_H\n\n//\n// Dependencies\n//\n#include \n\n//\n// Native Calls\n//\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtInitiatePowerAction(\n POWER_ACTION SystemAction,\n SYSTEM_POWER_STATE MinSystemState,\n ULONG Flags,\n BOOLEAN Asynchronous\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPowerInformation(\n POWER_INFORMATION_LEVEL PowerInformationLevel,\n PVOID InputBuffer,\n ULONG InputBufferLength,\n PVOID OutputBuffer,\n ULONG OutputBufferLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetSystemPowerState(\n IN POWER_ACTION SystemAction,\n IN SYSTEM_POWER_STATE MinSystemState,\n IN ULONG Flags\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwInitiatePowerAction(\n POWER_ACTION SystemAction,\n SYSTEM_POWER_STATE MinSystemState,\n ULONG Flags,\n BOOLEAN Asynchronous\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwPowerInformation(\n POWER_INFORMATION_LEVEL PowerInformationLevel,\n PVOID InputBuffer,\n ULONG InputBufferLength,\n PVOID OutputBuffer,\n ULONG OutputBufferLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetSystemPowerState(\n IN POWER_ACTION SystemAction,\n IN SYSTEM_POWER_STATE MinSystemState,\n IN ULONG Flags\n);\n#endif\n" }, { "path": "ndk/potypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n potypes.h\n\nAbstract:\n\n Type definitions for the Power Subystem\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _POTYPES_H\n#define _POTYPES_H\n\n//\n// Dependencies\n//\n#include \n#ifndef NTOS_MODE_USER\n#include \n#endif\n\n//\n// Docking states\n//\ntypedef enum _SYSTEM_DOCK_STATE\n{\n SystemDockStateUnknown,\n SystemUndocked,\n SystemDocked\n} SYSTEM_DOCK_STATE, *PSYSTEM_DOCK_STATE;\n\n#ifndef NTOS_MODE_USER\n\n//\n// Processor Power State Data\n//\ntypedef struct _PROCESSOR_POWER_STATE\n{\n PVOID IdleFunction;\n ULONG Idle0KernelTimeLimit;\n ULONG Idle0LastTime;\n PVOID IdleHandlers;\n PVOID IdleState;\n ULONG IdleHandlersCount;\n ULONGLONG LastCheck;\n PROCESSOR_IDLE_TIMES IdleTimes;\n ULONG IdleTime1;\n ULONG PromotionCheck;\n ULONG IdleTime2;\n UCHAR CurrentThrottle;\n UCHAR ThermalThrottleLimit;\n UCHAR CurrentThrottleIndex;\n UCHAR ThermalThrottleIndex;\n ULONG LastKernelUserTime;\n ULONG PerfIdleTime;\n ULONG DebugDelta;\n ULONG DebugCount;\n ULONG LastSysTime;\n ULONG TotalIdleStateTime[3];\n ULONG TotalIdleTransitions[3];\n ULONGLONG PreviousC3StateTime;\n UCHAR KneeThrottleIndex;\n UCHAR ThrottleLimitIndex;\n UCHAR PerfStatesCount;\n UCHAR ProcessorMinThrottle;\n UCHAR ProcessorMaxThrottle;\n UCHAR LastBusyPercentage;\n UCHAR LastC3Percentage;\n UCHAR LastAdjustedBusyPercentage;\n ULONG PromotionCount;\n ULONG DemotionCount;\n ULONG ErrorCount;\n ULONG RetryCount;\n ULONG Flags;\n LARGE_INTEGER PerfCounterFrequency;\n ULONG PerfTickCount;\n KTIMER PerfTimer;\n KDPC PerfDpc;\n PROCESSOR_PERF_STATE *PerfStates;\n PVOID PerfSetThrottle;\n ULONG LastC3KernelUserTime;\n ULONG Spare1[1];\n} PROCESSOR_POWER_STATE, *PPROCESSOR_POWER_STATE;\n\n//\n// Device Notification Structure\n//\ntypedef struct _PO_DEVICE_NOTIFY\n{\n LIST_ENTRY Link;\n PDEVICE_OBJECT TargetDevice;\n UCHAR WakeNeeded;\n UCHAR OrderLevel;\n PDEVICE_OBJECT DeviceObject;\n PVOID Node;\n PUSHORT DeviceName;\n PUSHORT DriverName;\n ULONG ChildCount;\n ULONG ActiveChild;\n} PO_DEVICE_NOTIFY, *PPO_DEVICE_NOTIFY;\n\n#endif // !NTOS_MODE_USER\n\n#endif // _POTYPES_H\n" }, { "path": "ndk/powerpc/ketypes.h", "content": "/*++ NDK Version: 0095\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n ketypes.h (PPC)\n\nAbstract:\n\n PowerPC Type definitions for the Kernel services.\n\nAuthor:\n\n Alex Ionescu (alex.ionescu@reactos.com) 06-Oct-2004\n\n--*/\n\n#ifndef _POWERPC_KETYPES_H\n#define _POWERPC_KETYPES_H\n\n//\n// Dependencies\n//\n\n//\n// IPI Types\n//\n#define IPI_APC 1\n#define IPI_DPC 2\n#define IPI_FREEZE 3\n#define IPI_PACKET_READY 4\n#define IPI_SYNCH_REQUEST 10\n#define MAXIMUM_VECTOR 0x100\n\n#define KSEG0_BASE 0x80000000\n\n#define PRCB_MAJOR_VERSION 1\n#define PRCB_BUILD_DEBUG 1\n\n#ifndef ROUND_UP\n#define ROUND_UP(x,y) (((x) + ((y)-1)) & ~((y)-1))\n#endif\n\ntypedef double DOUBLE;\n\ntypedef struct _FX_SAVE_AREA {\n ULONG Fr[32];\n} FX_SAVE_AREA, *PFX_SAVE_AREA;\n\ntypedef struct _FXSAVE_FORMAT\n{\n ULONG Xer,Fpscr;\n} FXSAVE_FORMAT, *PFXSAVE_FORMAT;\n\ntypedef struct _LDT_ENTRY {\n USHORT LimitLow;\n USHORT BaseLow;\n union\n {\n struct\n {\n UCHAR BaseMid;\n UCHAR Flags1;\n UCHAR Flags2;\n UCHAR BaseHi;\n } Bytes;\n struct\n {\n ULONG BaseMid : 8;\n ULONG Type : 5;\n ULONG Dpl : 2;\n ULONG Pres : 1;\n ULONG LimitHi : 4;\n ULONG Sys : 1;\n ULONG Reserved_0 : 1;\n ULONG Default_Big : 1;\n ULONG Granularity : 1;\n ULONG BaseHi : 8;\n } Bits;\n } HighWord;\n} LDT_ENTRY;\n\n#ifndef CONFIG_SMP\n#define SYNCH_LEVEL DISPATCH_LEVEL\n#else\n#define SYNCH_LEVEL (IPI_LEVEL - 1)\n#endif\n\n//\n// Trap Frame Definition\n//\ntypedef struct _KTRAP_FRAME\n{\n PVOID TrapFrame;\n UCHAR OldIrql;\n UCHAR PreviousMode;\n UCHAR SavedApcStateIndex;\n UCHAR SavedKernelApcDisable;\n UCHAR ExceptionRecord[ROUND_UP(sizeof(EXCEPTION_RECORD), sizeof(ULONGLONG))];\n ULONG FILL2;\n ULONG Gpr0;\n ULONG Gpr1;\n ULONG Gpr2;\n ULONG Gpr3;\n ULONG Gpr4;\n ULONG Gpr5;\n ULONG Gpr6;\n ULONG Gpr7;\n ULONG Gpr8;\n ULONG Gpr9;\n ULONG Gpr10;\n ULONG Gpr11;\n ULONG Gpr12;\n DOUBLE Fpr0;\n DOUBLE Fpr1;\n DOUBLE Fpr2;\n DOUBLE Fpr3;\n DOUBLE Fpr4;\n DOUBLE Fpr5;\n DOUBLE Fpr6;\n DOUBLE Fpr7;\n DOUBLE Fpr8;\n DOUBLE Fpr9;\n DOUBLE Fpr10;\n DOUBLE Fpr11;\n DOUBLE Fpr12;\n DOUBLE Fpr13;\n DOUBLE Fpscr;\n ULONG Cr;\n ULONG Xer;\n ULONG Msr;\n ULONG Iar;\n ULONG Lr;\n ULONG Ctr;\n ULONG Dr0;\n ULONG Dr1;\n ULONG Dr2;\n ULONG Dr3;\n ULONG Dr4;\n ULONG Dr5;\n ULONG Dr6;\n ULONG Dr7;\n} KTRAP_FRAME, *PKTRAP_FRAME;\n\n//\n// GDT Entry Definition\n//\ntypedef struct _KGDTENTRY\n{\n USHORT LimitLow;\n USHORT BaseLow;\n union\n {\n struct\n {\n UCHAR BaseMid;\n UCHAR Flags1;\n UCHAR Flags2;\n UCHAR BaseHi;\n } Bytes;\n struct\n {\n ULONG BaseMid:8;\n ULONG Type:5;\n ULONG Dpl:2;\n ULONG Pres:1;\n ULONG LimitHi:4;\n ULONG Sys:1;\n ULONG Reserved_0:1;\n ULONG Default_Big:1;\n ULONG Granularity:1;\n ULONG BaseHi:8;\n } Bits;\n } HighWord;\n} KGDTENTRY, *PKGDTENTRY;\n\n//\n// IDT Entry Definition\n//\ntypedef struct _KIDTENTRY\n{\n USHORT Offset;\n USHORT Selector;\n USHORT Access;\n USHORT ExtendedOffset;\n} KIDTENTRY, *PKIDTENTRY;\n\ntypedef struct _DESCRIPTOR\n{\n USHORT Pad;\n USHORT Limit;\n ULONG Base;\n} KDESCRIPTOR, *PKDESCRIPTOR;\n\n//\n// Special Registers Structure (outside of CONTEXT)\n//\ntypedef struct _KSPECIAL_REGISTERS\n{\n ULONG KernelDr0;\n ULONG KernelDr1;\n ULONG KernelDr2;\n ULONG KernelDr3;\n ULONG KernelDr4;\n ULONG KernelDr5;\n ULONG KernelDr6;\n ULONG KernelDr7;\n ULONG Sprg0;\n ULONG Sprg1;\n ULONG Sr0;\n ULONG Sr1;\n ULONG Sr2;\n ULONG Sr3;\n ULONG Sr4;\n ULONG Sr5;\n ULONG Sr6;\n ULONG Sr7;\n ULONG Sr8;\n ULONG Sr9;\n ULONG Sr10;\n ULONG Sr11;\n ULONG Sr12;\n ULONG Sr13;\n ULONG Sr14;\n ULONG Sr15;\n ULONG DBAT0L;\n ULONG DBAT0U;\n ULONG DBAT1L;\n ULONG DBAT1U;\n ULONG DBAT2L;\n ULONG DBAT2U;\n ULONG DBAT3L;\n ULONG DBAT3U;\n ULONG IBAT0L;\n ULONG IBAT0U;\n ULONG IBAT1L;\n ULONG IBAT1U;\n ULONG IBAT2L;\n ULONG IBAT2U;\n ULONG IBAT3L;\n ULONG IBAT3U;\n ULONG Sdr1;\n ULONG Reserved[9];\n} KSPECIAL_REGISTERS, *PKSPECIAL_REGISTERS;\n\n//\n// Processor State Data\n//\n#pragma pack(push,4)\ntypedef struct _KPROCESSOR_STATE\n{\n CONTEXT ContextFrame;\n KSPECIAL_REGISTERS SpecialRegisters;\n} KPROCESSOR_STATE, *PKPROCESSOR_STATE;\n\n//\n// Processor Region Control Block\n//\ntypedef struct _KPRCB\n{\n USHORT MinorVersion;\n USHORT MajorVersion;\n struct _KTHREAD *CurrentThread;\n struct _KTHREAD *NextThread;\n struct _KTHREAD *IdleThread;\n UCHAR Number;\n UCHAR Reserved;\n USHORT BuildType;\n KAFFINITY SetMember;\n UCHAR CpuType;\n UCHAR CpuID;\n USHORT CpuStep;\n KPROCESSOR_STATE ProcessorState;\n ULONG KernelReserved[16];\n ULONG HalReserved[16];\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG CFlushSize;\n UCHAR PrcbPad0[88];\n#else\n UCHAR PrcbPad0[92];\n#endif\n KSPIN_LOCK_QUEUE LockQueue[LockQueueMaximumLock];\n struct _KTHREAD *NpxThread;\n ULONG InterruptCount;\n ULONG KernelTime;\n ULONG UserTime;\n ULONG DpcTime;\n ULONG DebugDpcTime;\n ULONG InterruptTime;\n ULONG AdjustDpcThreshold;\n ULONG PageColor;\n UCHAR SkipTick;\n UCHAR DebuggerSavedIRQL;\n#if (NTDDI_VERSION >= NTDDI_WS03)\n UCHAR NodeColor;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n UCHAR PollSlot;\n#else\n UCHAR Spare1;\n#endif\n ULONG NodeShiftedColor;\n#else\n UCHAR Spare1[6];\n#endif\n struct _KNODE *ParentNode;\n ULONG MultiThreadProcessorSet;\n struct _KPRCB *MultiThreadSetMaster;\n#if (NTDDI_VERSION >= NTDDI_WS03)\n ULONG SecondaryColorMask;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG DpcTimeLimit;\n#else\n LONG Sleeping;\n#endif\n#else\n ULONG ThreadStartCount[2];\n#endif\n ULONG CcFastReadNoWait;\n ULONG CcFastReadWait;\n ULONG CcFastReadNotPossible;\n ULONG CcCopyReadNoWait;\n ULONG CcCopyReadWait;\n ULONG CcCopyReadNoWaitMiss;\n#if (NTDDI_VERSION < NTDDI_LONGHORN)\n ULONG KeAlignmentFixupCount;\n#endif\n ULONG SpareCounter0;\n#if (NTDDI_VERSION < NTDDI_LONGHORN)\n ULONG KeDcacheFlushCount;\n ULONG KeExceptionDispatchCount;\n ULONG KeFirstLevelTbFills;\n ULONG KeFloatingEmulationCount;\n ULONG KeIcacheFlushCount;\n ULONG KeSecondLevelTbFills;\n ULONG KeSystemCalls;\n#endif\n volatile ULONG IoReadOperationCount;\n volatile ULONG IoWriteOperationCount;\n volatile ULONG IoOtherOperationCount;\n LARGE_INTEGER IoReadTransferCount;\n LARGE_INTEGER IoWriteTransferCount;\n LARGE_INTEGER IoOtherTransferCount;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG CcFastMdlReadNoWait;\n ULONG CcFastMdlReadWait;\n ULONG CcFastMdlReadNotPossible;\n ULONG CcMapDataNoWait;\n ULONG CcMapDataWait;\n ULONG CcPinMappedDataCount;\n ULONG CcPinReadNoWait;\n ULONG CcPinReadWait;\n ULONG CcMdlReadNoWait;\n ULONG CcMdlReadWait;\n ULONG CcLazyWriteHotSpots;\n ULONG CcLazyWriteIos;\n ULONG CcLazyWritePages;\n ULONG CcDataFlushes;\n ULONG CcDataPages;\n ULONG CcLostDelayedWrites;\n ULONG CcFastReadResourceMiss;\n ULONG CcCopyReadWaitMiss;\n ULONG CcFastMdlReadResourceMiss;\n ULONG CcMapDataNoWaitMiss;\n ULONG CcMapDataWaitMiss;\n ULONG CcPinReadNoWaitMiss;\n ULONG CcPinReadWaitMiss;\n ULONG CcMdlReadNoWaitMiss;\n ULONG CcMdlReadWaitMiss;\n ULONG CcReadAheadIos;\n ULONG KeAlignmentFixupCount;\n ULONG KeExceptionDispatchCount;\n ULONG KeSystemCalls;\n ULONG PrcbPad1[3];\n#else\n ULONG SpareCounter1[8];\n#endif\n PP_LOOKASIDE_LIST PPLookasideList[16];\n PP_LOOKASIDE_LIST PPNPagedLookasideList[32];\n PP_LOOKASIDE_LIST PPPagedLookasideList[32];\n volatile ULONG PacketBarrier;\n volatile ULONG ReverseStall;\n PVOID IpiFrame;\n UCHAR PrcbPad2[52];\n volatile PVOID CurrentPacket[3];\n volatile ULONG TargetSet;\n volatile PKIPI_WORKER WorkerRoutine;\n volatile ULONG IpiFrozen;\n UCHAR PrcbPad3[40];\n volatile ULONG RequestSummary;\n volatile struct _KPRCB *SignalDone;\n UCHAR PrcbPad4[56];\n struct _KDPC_DATA DpcData[2];\n PVOID DpcStack;\n ULONG MaximumDpcQueueDepth;\n ULONG DpcRequestRate;\n ULONG MinimumDpcRate;\n volatile UCHAR DpcInterruptRequested;\n volatile UCHAR DpcThreadRequested;\n volatile UCHAR DpcRoutineActive;\n volatile UCHAR DpcThreadActive;\n ULONG PrcbLock;\n ULONG DpcLastCount;\n volatile ULONG TimerHand;\n volatile ULONG TimerRequest;\n PVOID DpcThread;\n KEVENT DpcEvent;\n UCHAR ThreadDpcEnable;\n volatile BOOLEAN QuantumEnd;\n UCHAR PrcbPad50;\n volatile UCHAR IdleSchedule;\n LONG DpcSetEventRequest;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n LONG Sleeping;\n ULONG PeriodicCount;\n ULONG PeriodicBias;\n UCHAR PrcbPad5[6];\n#else\n UCHAR PrcbPad5[18];\n#endif\n LONG TickOffset;\n KDPC CallDpc;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n LONG ClockKeepAlive;\n UCHAR ClockCheckSlot;\n UCHAR ClockPollCycle;\n UCHAR PrcbPad6[2];\n LONG DpcWatchdogPeriod;\n LONG DpcWatchDogCount;\n LONG ThreadWatchdogPeriod;\n LONG ThreadWatchDogCount;\n ULONG PrcbPad70[2];\n#else\n ULONG PrcbPad7[8];\n#endif\n LIST_ENTRY WaitListHead;\n ULONG ReadySummary;\n ULONG QueueIndex;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n SINGLE_LIST_ENTRY DeferredReadyListHead;\n ULONGLONG StartCycles;\n ULONGLONG CycleTime;\n ULONGLONG PrcbPad71[3];\n LIST_ENTRY DispatcherReadyListHead[32];\n#else\n LIST_ENTRY DispatcherReadyListHead[32];\n SINGLE_LIST_ENTRY DeferredReadyListHead;\n ULONG PrcbPad72[11];\n#endif\n PVOID ChainedInterruptList;\n LONG LookasideIrpFloat;\n volatile LONG MmPageFaultCount;\n volatile LONG MmCopyOnWriteCount;\n volatile LONG MmTransitionCount;\n volatile LONG MmCacheTransitionCount;\n volatile LONG MmDemandZeroCount;\n volatile LONG MmPageReadCount;\n volatile LONG MmPageReadIoCount;\n volatile LONG MmCacheReadCount;\n volatile LONG MmCacheIoCount;\n volatile LONG MmDirtyPagesWriteCount;\n volatile LONG MmDirtyWriteIoCount;\n volatile LONG MmMappedPagesWriteCount;\n volatile LONG MmMappedWriteIoCount;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG CachedCommit;\n ULONG CachedResidentAvailable;\n PVOID HyperPte;\n UCHAR CpuVendor;\n UCHAR PrcbPad9[3];\n#else\n ULONG SpareFields0[1];\n#endif\n CHAR VendorString[13];\n UCHAR InitialApicId;\n UCHAR LogicalProcessorsPerPhysicalProcessor;\n ULONG MHz;\n ULONG FeatureBits;\n LARGE_INTEGER UpdateSignature;\n volatile LARGE_INTEGER IsrTime;\n LARGE_INTEGER SpareField1;\n FX_SAVE_AREA NpxSaveArea;\n PROCESSOR_POWER_STATE PowerState;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n KDPC DpcWatchdogDoc;\n KTIMER DpcWatchdogTimer;\n PVOID WheaInfo;\n PVOID EtwSupport;\n SLIST_HEADER InterruptObjectPool;\n LARGE_INTEGER HyperCallPagePhysical;\n LARGE_INTEGER HyperCallPageVirtual;\n PVOID RateControl;\n CACHE_DESCRIPTOR Cache[5];\n ULONG CacheCount;\n ULONG CacheProcessorMask[5];\n UCHAR LogicalProcessorsPerCore;\n UCHAR PrcbPad8[3];\n ULONG PackageProcessorSet;\n ULONG CoreProcessorSet;\n#endif\n} KPRCB, *PKPRCB;\n\n//\n// Processor Control Region\n//\ntypedef struct _KIPCR\n{\n USHORT MinorVersion;\n USHORT MajorVersion;\n PKINTERRUPT_ROUTINE InterruptRoutine[MAXIMUM_VECTOR];\n ULONG PcrPage2;\n ULONG Kseg0Top;\n ULONG Spare7[30];\n ULONG FirstLevelDcacheSize;\n ULONG FirstLevelDcacheFillSize;\n ULONG FirstLevelIcacheSize;\n ULONG FirstLevelIcacheFillSize;\n ULONG SecondLevelDcacheSize;\n ULONG SecondLevelDcacheFillSize;\n ULONG SecondLevelIcacheSize;\n ULONG SecondLevelIcacheFillSize;\n struct _KPRCB *PrcbData;\n PVOID Teb;\n ULONG DcacheAlignment;\n ULONG DcacheFillSize;\n ULONG IcacheAlignment;\n ULONG IcacheFillSize;\n ULONG ProcessorVersion;\n ULONG ProcessorRevision;\n ULONG ProfileInterval;\n ULONG ProfileCount;\n ULONG StallExecutionCount;\n ULONG StallScaleFactor;\n ULONG Spare;\n union\n {\n ULONG CachePolicy;\n struct\n {\n UCHAR IcacheMode;\n UCHAR DcacheMode;\n USHORT ModeSpare;\n };\n };\n UCHAR IrqlMask[32];\n UCHAR IrqlTable[9];\n UCHAR CurrentIrql;\n CCHAR Number;\n KAFFINITY SetMember;\n ULONG ReservedVectors;\n struct _KTHREAD *CurrentThread;\n ULONG AlignedCachePolicy;\n union\n {\n ULONG SoftwareInterrupt;\n struct\n {\n UCHAR ApcInterrupt;\n UCHAR DispatchInterrupt;\n UCHAR Spare4;\n UCHAR Spare5;\n };\n };\n KAFFINITY NotMember;\n ULONG SystemReserved[16];\n ULONG HalReserved[16];\n ULONG FirstLevelActive;\n ULONG SystemServiceDispatchStart;\n ULONG SystemServiceDispatchEnd;\n ULONG InterruptStack;\n ULONG QuantumEnd;\n PVOID InitialStack;\n PVOID PanicStack;\n ULONG BadVaddr;\n PVOID StackLimit;\n PVOID SavedStackLimit;\n ULONG SavedV0;\n ULONG SavedV1;\n UCHAR DebugActive;\n UCHAR Spare6[3];\n ULONG GprSave[6];\n ULONG SiR0;\n ULONG SiR2;\n ULONG SiR3;\n ULONG SiR4;\n ULONG SiR5;\n ULONG Spare0;\n ULONG Spare8;\n ULONG PgDirRa;\n ULONG OnInterruptStack;\n ULONG SavedInitialStack;\n} KIPCR, *PKIPCR;\n#pragma pack(pop)\n\n//\n// TSS Definition\n//\ntypedef struct _KTSS {\n} KTSS, *PKTSS;\n\n//\n// PowerPC Exception Frame\n//\ntypedef struct _KEXCEPTION_FRAME\n{\n ULONG Fill1;\n ULONG Gpr13;\n ULONG Gpr14;\n ULONG Gpr15;\n ULONG Gpr16;\n ULONG Gpr17;\n ULONG Gpr18;\n ULONG Gpr19;\n ULONG Gpr20;\n ULONG Gpr21;\n ULONG Gpr22;\n ULONG Gpr23;\n ULONG Gpr24;\n ULONG Gpr25;\n ULONG Gpr26;\n ULONG Gpr27;\n ULONG Gpr28;\n ULONG Gpr29;\n ULONG Gpr30;\n ULONG Gpr31;\n DOUBLE Fpr14;\n DOUBLE Fpr15;\n DOUBLE Fpr16;\n DOUBLE Fpr17;\n DOUBLE Fpr18;\n DOUBLE Fpr19;\n DOUBLE Fpr20;\n DOUBLE Fpr21;\n DOUBLE Fpr22;\n DOUBLE Fpr23;\n DOUBLE Fpr24;\n DOUBLE Fpr25;\n DOUBLE Fpr26;\n DOUBLE Fpr27;\n DOUBLE Fpr28;\n DOUBLE Fpr29;\n DOUBLE Fpr30;\n DOUBLE Fpr31;\n} KEXCEPTION_FRAME, *PKEXCEPTION_FRAME;\n\nFORCEINLINE\nstruct _KPRCB *\nKeGetCurrentPrcb(VOID)\n{\n return (struct _KPRCB *)(ULONG_PTR)__readfsdword(FIELD_OFFSET(KIPCR, PrcbData));\n}\n\n#endif\n" }, { "path": "ndk/powerpc/mmtypes.h", "content": "/*++ NDK Version: 0095\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n mmtypes.h (PPC)\n\nAbstract:\n\n PowerPC Type definitions for the Memory Manager\n\nAuthor:\n\n Art Yerkes (ayerkes@speakeasy.net) 04-Dec-2005\n\n--*/\n\n#ifndef _POWERPC_MMTYPES_H\n#define _POWERPC_MMTYPES_H\n\n//\n// Dependencies\n//\n\n//\n// Page-related Macros\n//\n#define PAGE_SIZE 0x1000\n#define PAGE_SHIFT 12L\n\ntypedef unsigned long long MMPTE_HARDWARE;\ntypedef unsigned long long MMPTE_SOFTWARE;\ntypedef unsigned long long MMPTE_PROTOTYPE;\ntypedef unsigned long long MMPTE_SUBSECTION;\ntypedef unsigned long long MMPTE_TRANSITION;\ntypedef unsigned long long MMPTE_LIST;\n\n//\n// Page Table Entry Definition\n//\ntypedef struct _HARDWARE_PTE_PPC\n{\n ULONG Dirty:2;\n ULONG Valid:1;\n ULONG GuardedStorage:1;\n ULONG MemoryCoherence:1;\n ULONG CacheDisable:1;\n ULONG WriteThrough:1;\n ULONG Change:1;\n ULONG Reference:1;\n ULONG Write:1;\n ULONG CopyOnWrite:1;\n ULONG rsvd1:1;\n ULONG PageFrameNumber:20;\n} HARDWARE_PTE_PPC, *PHARDWARE_PTE_PPC;\n\n#ifndef HARDWARE_PTE\n#define HARDWARE_PTE HARDWARE_PTE_PPC\n#define PHARDWARE_PTE PHARDWARE_PTE_PPC\n#endif\n\n#endif/*_POWERPC_MMTYPES_H*/\n" }, { "path": "ndk/psfuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n psfuncs.h\n\nAbstract:\n\n Function definitions for the Process Manager\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _PSFUNCS_H\n#define _PSFUNCS_H\n\n//\n// Dependencies\n//\n#include \n#include \n\n#ifndef NTOS_MODE_USER\n\n//\n// Win32K Process/Thread Functions\n//\nNTKERNELAPI\nstruct _W32THREAD*\nNTAPI\nPsGetCurrentThreadWin32Thread(\n VOID\n);\n\nNTKERNELAPI\nstruct _W32PROCESS*\nNTAPI\nPsGetCurrentProcessWin32Process(\n VOID\n);\n\nNTKERNELAPI\nPVOID\nNTAPI\nPsGetProcessWin32Process(\n PEPROCESS Process\n);\n\nNTKERNELAPI\nVOID\nNTAPI\nPsSetProcessWin32Process(\n PEPROCESS Process,\n PVOID Win32Process\n);\n\nNTKERNELAPI\nVOID\nNTAPI\nPsSetThreadWin32Thread(\n PETHREAD Thread,\n PVOID Win32Thread\n);\n\nNTKERNELAPI\nPVOID\nNTAPI\nPsGetThreadWin32Thread(\n PETHREAD Thread\n);\n\nNTKERNELAPI\nBOOLEAN\nNTAPI\nPsGetThreadHardErrorsAreDisabled(\n PETHREAD Thread\n);\n\nNTKERNELAPI\nVOID\nNTAPI\nPsSetThreadHardErrorsAreDisabled(\n PETHREAD Thread,\n IN BOOLEAN Disabled\n);\n\nNTKERNELAPI\nVOID\nNTAPI\nPsEstablishWin32Callouts(\n PWIN32_CALLOUTS_FPNS CalloutData\n);\n\nNTKERNELAPI\nVOID\nNTAPI\nPsReturnProcessNonPagedPoolQuota(\n IN PEPROCESS Process,\n IN ULONG_PTR Amount\n);\n\n//\n// Process Impersonation Functions\n//\nNTKERNELAPI\nVOID\nNTAPI\nPsRevertThreadToSelf(\n IN PETHREAD Thread\n);\n\n//\n// Misc. Functions\n//\nNTKERNELAPI\nNTSTATUS\nNTAPI\nPsLookupProcessThreadByCid(\n IN PCLIENT_ID Cid,\n OUT PEPROCESS *Process OPTIONAL,\n OUT PETHREAD *Thread\n);\n\nBOOLEAN\nNTAPI\nPsIsProtectedProcess(\n IN PEPROCESS Process\n);\n\n//\n// Quota Functions\n//\nNTKERNELAPI\nVOID\nNTAPI\nPsChargePoolQuota(\n IN PEPROCESS Process,\n IN POOL_TYPE PoolType,\n IN ULONG Amount\n);\n\nNTKERNELAPI\nNTSTATUS\nNTAPI\nPsChargeProcessNonPagedPoolQuota(\n IN PEPROCESS Process,\n IN ULONG_PTR Amount\n);\n\nNTKERNELAPI\nNTSTATUS\nNTAPI\nPsChargeProcessPagedPoolQuota(\n IN PEPROCESS Process,\n IN ULONG_PTR Amount\n);\n\nNTKERNELAPI\nNTSTATUS\nNTAPI\nPsChargeProcessPoolQuota(\n IN PEPROCESS Process,\n IN POOL_TYPE PoolType,\n IN ULONG Amount\n);\n\nNTKERNELAPI\nVOID\nNTAPI\nPsReturnPoolQuota(\n IN PEPROCESS Process,\n IN POOL_TYPE PoolType,\n IN ULONG_PTR Amount\n);\n\nNTKERNELAPI\nVOID\nNTAPI\nPsReturnProcessNonPagedPoolQuota(\n IN PEPROCESS Process,\n IN ULONG_PTR Amount\n);\n\nNTKERNELAPI\nVOID\nNTAPI\nPsReturnProcessPagedPoolQuota(\n IN PEPROCESS Process,\n IN ULONG_PTR Amount\n);\n\n#endif\n\n//\n// Native Calls\n//\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlertResumeThread(\n IN HANDLE ThreadHandle,\n OUT PULONG SuspendCount\n);\n\ntypedef ULONG APPHELPCACHESERVICECLASS;\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtApphelpCacheControl(\n IN APPHELPCACHESERVICECLASS Service,\n IN PVOID ServiceData\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlertThread(\n IN HANDLE ThreadHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAssignProcessToJobObject(\n HANDLE JobHandle,\n HANDLE ProcessHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateJobObject(\n PHANDLE JobHandle,\n ACCESS_MASK DesiredAccess,\n POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSTATUS\nNTAPI\nNtCreateJobSet(\n IN ULONG NumJob,\n IN PJOB_SET_ARRAY UserJobSet,\n IN ULONG Flags\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateProcess(\n OUT PHANDLE ProcessHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN HANDLE ParentProcess,\n IN BOOLEAN InheritObjectTable,\n IN HANDLE SectionHandle OPTIONAL,\n IN HANDLE DebugPort OPTIONAL,\n IN HANDLE ExceptionPort OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateProcessEx(\n OUT PHANDLE ProcessHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN HANDLE ParentProcess,\n IN ULONG Flags,\n IN HANDLE SectionHandle OPTIONAL,\n IN HANDLE DebugPort OPTIONAL,\n IN HANDLE ExceptionPort OPTIONAL,\n IN BOOLEAN InJob\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateThread(\n OUT PHANDLE ThreadHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN HANDLE ProcessHandle,\n OUT PCLIENT_ID ClientId,\n IN PCONTEXT ThreadContext,\n IN PINITIAL_TEB UserStack,\n IN BOOLEAN CreateSuspended\n);\n\n#ifndef NTOS_MODE_USER\n#if defined(_M_IX86)\nFORCEINLINE\nPTEB\nNtCurrentTeb(VOID)\n{\n#ifndef __GNUC__\n return (PTEB)(ULONG_PTR)__readfsdword(0x18);\n#else\n struct _TEB *ret;\n\n __asm__ __volatile__ (\n \"movl %%fs:0x18, %0\\n\"\n : \"=r\" (ret)\n : /* no inputs */\n );\n\n return ret;\n#endif\n}\n#endif\n#else\nstruct _TEB * NtCurrentTeb(void);\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtImpersonateThread(\n IN HANDLE ThreadHandle,\n IN HANDLE ThreadToImpersonate,\n IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtIsProcessInJob(\n IN HANDLE ProcessHandle,\n IN HANDLE JobHandle OPTIONAL\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenProcess(\n OUT PHANDLE ProcessHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN PCLIENT_ID ClientId\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenThread(\n OUT PHANDLE ThreadHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN PCLIENT_ID ClientId\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenThreadToken(\n IN HANDLE ThreadHandle,\n IN ACCESS_MASK DesiredAccess,\n IN BOOLEAN OpenAsSelf,\n OUT PHANDLE TokenHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenThreadTokenEx(\n IN HANDLE ThreadHandle,\n IN ACCESS_MASK DesiredAccess,\n IN BOOLEAN OpenAsSelf,\n IN ULONG HandleAttributes,\n OUT PHANDLE TokenHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationJobObject(\n HANDLE JobHandle,\n JOBOBJECTINFOCLASS JobInformationClass,\n PVOID JobInformation,\n ULONG JobInformationLength,\n PULONG ReturnLength\n);\n\n#ifndef _NTDDK_\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationProcess(\n IN HANDLE ProcessHandle,\n IN PROCESSINFOCLASS ProcessInformationClass,\n OUT PVOID ProcessInformation,\n IN ULONG ProcessInformationLength,\n OUT PULONG ReturnLength OPTIONAL\n);\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationThread(\n IN HANDLE ThreadHandle,\n IN THREADINFOCLASS ThreadInformationClass,\n OUT PVOID ThreadInformation,\n IN ULONG ThreadInformationLength,\n OUT PULONG ReturnLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRegisterThreadTerminatePort(\n HANDLE TerminationPort\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtResumeThread(\n IN HANDLE ThreadHandle,\n OUT PULONG SuspendCount\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtResumeProcess(\n IN HANDLE ProcessHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationJobObject(\n HANDLE JobHandle,\n JOBOBJECTINFOCLASS JobInformationClass,\n PVOID JobInformation,\n ULONG JobInformationLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationProcess(\n IN HANDLE ProcessHandle,\n IN PROCESSINFOCLASS ProcessInformationClass,\n IN PVOID ProcessInformation,\n IN ULONG ProcessInformationLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationThread(\n IN HANDLE ThreadHandle,\n IN THREADINFOCLASS ThreadInformationClass,\n IN PVOID ThreadInformation,\n IN ULONG ThreadInformationLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSuspendProcess(\n IN HANDLE ProcessHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSuspendThread(\n IN HANDLE ThreadHandle,\n IN PULONG PreviousSuspendCount\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtTerminateProcess(\n IN HANDLE ProcessHandle,\n IN NTSTATUS ExitStatus\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtTerminateThread(\n IN HANDLE ThreadHandle,\n IN NTSTATUS ExitStatus\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtTerminateJobObject(\n HANDLE JobHandle,\n NTSTATUS ExitStatus\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAlertResumeThread(\n IN HANDLE ThreadHandle,\n OUT PULONG SuspendCount\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAlertThread(\n IN HANDLE ThreadHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAssignProcessToJobObject(\n HANDLE JobHandle,\n HANDLE ProcessHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateJobObject(\n PHANDLE JobHandle,\n ACCESS_MASK DesiredAccess,\n POBJECT_ATTRIBUTES ObjectAttributes\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateProcess(\n OUT PHANDLE ProcessHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN HANDLE ParentProcess,\n IN BOOLEAN InheritObjectTable,\n IN HANDLE SectionHandle OPTIONAL,\n IN HANDLE DebugPort OPTIONAL,\n IN HANDLE ExceptionPort OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateThread(\n OUT PHANDLE ThreadHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN HANDLE ProcessHandle,\n OUT PCLIENT_ID ClientId,\n IN PCONTEXT ThreadContext,\n IN PINITIAL_TEB UserStack,\n IN BOOLEAN CreateSuspended\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwImpersonateThread(\n IN HANDLE ThreadHandle,\n IN HANDLE ThreadToImpersonate,\n IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwIsProcessInJob(\n IN HANDLE ProcessHandle,\n IN HANDLE JobHandle OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenProcess(\n OUT PHANDLE ProcessHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN PCLIENT_ID ClientId\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenThread(\n OUT PHANDLE ThreadHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN PCLIENT_ID ClientId\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenThreadToken(\n IN HANDLE ThreadHandle,\n IN ACCESS_MASK DesiredAccess,\n IN BOOLEAN OpenAsSelf,\n OUT PHANDLE TokenHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenThreadTokenEx(\n IN HANDLE ThreadHandle,\n IN ACCESS_MASK DesiredAccess,\n IN BOOLEAN OpenAsSelf,\n IN ULONG HandleAttributes,\n OUT PHANDLE TokenHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryInformationJobObject(\n HANDLE JobHandle,\n JOBOBJECTINFOCLASS JobInformationClass,\n PVOID JobInformation,\n ULONG JobInformationLength,\n PULONG ReturnLength\n);\n\n#ifndef _NTDDK_\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryInformationProcess(\n IN HANDLE ProcessHandle,\n IN PROCESSINFOCLASS ProcessInformationClass,\n OUT PVOID ProcessInformation,\n IN ULONG ProcessInformationLength,\n OUT PULONG ReturnLength OPTIONAL\n);\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryInformationThread(\n IN HANDLE ThreadHandle,\n IN THREADINFOCLASS ThreadInformationClass,\n OUT PVOID ThreadInformation,\n IN ULONG ThreadInformationLength,\n OUT PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwRegisterThreadTerminatePort(\n HANDLE TerminationPort\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwResumeThread(\n IN HANDLE ThreadHandle,\n OUT PULONG SuspendCount\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwResumeProcess(\n IN HANDLE ProcessHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetInformationJobObject(\n HANDLE JobHandle,\n JOBOBJECTINFOCLASS JobInformationClass,\n PVOID JobInformation,\n ULONG JobInformationLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetInformationProcess(\n IN HANDLE ProcessHandle,\n IN PROCESSINFOCLASS ProcessInformationClass,\n IN PVOID ProcessInformation,\n IN ULONG ProcessInformationLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetInformationThread(\n IN HANDLE ThreadHandle,\n IN THREADINFOCLASS ThreadInformationClass,\n IN PVOID ThreadInformation,\n IN ULONG ThreadInformationLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSuspendProcess(\n IN HANDLE ProcessHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSuspendThread(\n IN HANDLE ThreadHandle,\n IN PULONG PreviousSuspendCount\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwTerminateProcess(\n IN HANDLE ProcessHandle,\n IN NTSTATUS ExitStatus\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwTerminateThread(\n IN HANDLE ThreadHandle,\n IN NTSTATUS ExitStatus\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwTerminateJobObject(\n HANDLE JobHandle,\n NTSTATUS ExitStatus\n);\n\n#endif\n" }, { "path": "ndk/pstypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n pstypes.h\n\nAbstract:\n\n Type definitions for the Process Manager\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _PSTYPES_H\n#define _PSTYPES_H\n\n//\n// Dependencies\n//\n#include \n#include \n#include \n#include \n#ifndef NTOS_MODE_USER\n#include \n#include \n#endif\n\n//\n// KUSER_SHARED_DATA location in User Mode\n//\n#define USER_SHARED_DATA (0x7FFE0000)\n\n//\n// Global Flags\n//\n#define FLG_STOP_ON_EXCEPTION 0x00000001\n#define FLG_SHOW_LDR_SNAPS 0x00000002\n#define FLG_DEBUG_INITIAL_COMMAND 0x00000004\n#define FLG_STOP_ON_HUNG_GUI 0x00000008\n#define FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010\n#define FLG_HEAP_ENABLE_FREE_CHECK 0x00000020\n#define FLG_HEAP_VALIDATE_PARAMETERS 0x00000040\n#define FLG_HEAP_VALIDATE_ALL 0x00000080\n#define FLG_POOL_ENABLE_TAIL_CHECK 0x00000100\n#define FLG_POOL_ENABLE_FREE_CHECK 0x00000200\n#define FLG_POOL_ENABLE_TAGGING 0x00000400\n#define FLG_HEAP_ENABLE_TAGGING 0x00000800\n#define FLG_USER_STACK_TRACE_DB 0x00001000\n#define FLG_KERNEL_STACK_TRACE_DB 0x00002000\n#define FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000\n#define FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000\n#define FLG_IGNORE_DEBUG_PRIV 0x00010000\n#define FLG_ENABLE_CSRDEBUG 0x00020000\n#define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000\n#define FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000\n#define FLG_HEAP_ENABLE_CALL_TRACING 0x00100000\n#define FLG_HEAP_DISABLE_COALESCING 0x00200000\n#define FLG_ENABLE_CLOSE_EXCEPTIONS 0x00400000\n#define FLG_ENABLE_EXCEPTION_LOGGING 0x00800000\n#define FLG_ENABLE_HANDLE_TYPE_TAGGING 0x01000000\n#define FLG_HEAP_PAGE_ALLOCS 0x02000000\n#define FLG_DEBUG_INITIAL_COMMAND_EX 0x04000000\n#define FLG_VALID_BITS 0x07FFFFFF\n\n//\n// Process priority classes\n//\n#define PROCESS_PRIORITY_CLASS_INVALID 0\n#define PROCESS_PRIORITY_CLASS_IDLE 1\n#define PROCESS_PRIORITY_CLASS_NORMAL 2\n#define PROCESS_PRIORITY_CLASS_HIGH 3\n#define PROCESS_PRIORITY_CLASS_REALTIME 4\n#define PROCESS_PRIORITY_CLASS_BELOW_NORMAL 5\n#define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL 6\n\n//\n// NtCreateProcessEx flags\n//\n#define PS_REQUEST_BREAKAWAY 1\n#define PS_NO_DEBUG_INHERIT 2\n#define PS_INHERIT_HANDLES 4\n#define PS_LARGE_PAGES 8\n#define PS_ALL_FLAGS (PS_REQUEST_BREAKAWAY | \\\n PS_NO_DEBUG_INHERIT | \\\n PS_INHERIT_HANDLES | \\\n PS_LARGE_PAGES)\n\n//\n// Process base priorities\n//\n#define PROCESS_PRIORITY_IDLE 3\n#define PROCESS_PRIORITY_NORMAL 8\n#define PROCESS_PRIORITY_NORMAL_FOREGROUND 9\n\n//\n// Process memory priorities\n//\n#define MEMORY_PRIORITY_BACKGROUND 0\n#define MEMORY_PRIORITY_UNKNOWN 1\n#define MEMORY_PRIORITY_FOREGROUND 2\n\n//\n// Process Priority Separation Values (OR)\n//\n#define PSP_VARIABLE_QUANTUMS 4\n#define PSP_LONG_QUANTUMS 16\n\n#ifndef NTOS_MODE_USER\n\n//\n// Thread Access Types\n//\n#define THREAD_QUERY_INFORMATION 0x0040\n#define THREAD_SET_THREAD_TOKEN 0x0080\n#define THREAD_IMPERSONATE 0x0100\n#define THREAD_DIRECT_IMPERSONATION 0x0200\n\n//\n// Process Access Types\n//\n#define PROCESS_TERMINATE 0x0001\n#define PROCESS_CREATE_THREAD 0x0002\n#define PROCESS_SET_SESSIONID 0x0004\n#define PROCESS_VM_OPERATION 0x0008\n#define PROCESS_VM_READ 0x0010\n#define PROCESS_VM_WRITE 0x0020\n#define PROCESS_CREATE_PROCESS 0x0080\n#define PROCESS_SET_QUOTA 0x0100\n#define PROCESS_SET_INFORMATION 0x0200\n#define PROCESS_QUERY_INFORMATION 0x0400\n#define PROCESS_SUSPEND_RESUME 0x0800\n#define PROCESS_QUERY_LIMITED_INFORMATION 0x1000\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n#define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \\\n SYNCHRONIZE | \\\n 0xFFFF)\n#else\n#define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \\\n SYNCHRONIZE | \\\n 0xFFF)\n\n//\n// Thread Base Priorities\n//\n#define THREAD_BASE_PRIORITY_LOWRT 15\n#define THREAD_BASE_PRIORITY_MAX 2\n#define THREAD_BASE_PRIORITY_MIN -2\n#define THREAD_BASE_PRIORITY_IDLE -15\n\n//\n// TLS Slots\n//\n#define TLS_MINIMUM_AVAILABLE 64\n#endif\n\n//\n// Job Access Types\n//\n#define JOB_OBJECT_ASSIGN_PROCESS 0x1\n#define JOB_OBJECT_SET_ATTRIBUTES 0x2\n#define JOB_OBJECT_QUERY 0x4\n#define JOB_OBJECT_TERMINATE 0x8\n#define JOB_OBJECT_SET_SECURITY_ATTRIBUTES 0x10\n#define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \\\n SYNCHRONIZE | \\\n 31)\n\n//\n// Cross Thread Flags\n//\n#define CT_TERMINATED_BIT 0x1\n#define CT_DEAD_THREAD_BIT 0x2\n#define CT_HIDE_FROM_DEBUGGER_BIT 0x4\n#define CT_ACTIVE_IMPERSONATION_INFO_BIT 0x8\n#define CT_SYSTEM_THREAD_BIT 0x10\n#define CT_HARD_ERRORS_ARE_DISABLED_BIT 0x20\n#define CT_BREAK_ON_TERMINATION_BIT 0x40\n#define CT_SKIP_CREATION_MSG_BIT 0x80\n#define CT_SKIP_TERMINATION_MSG_BIT 0x100\n\n//\n// Same Thread Passive Flags\n//\n#define STP_ACTIVE_EX_WORKER_BIT 0x1\n#define STP_EX_WORKER_CAN_WAIT_USER_BIT 0x2\n#define STP_MEMORY_MAKER_BIT 0x4\n#define STP_KEYED_EVENT_IN_USE_BIT 0x8\n\n//\n// Same Thread APC Flags\n//\n#define STA_LPC_RECEIVED_MSG_ID_VALID_BIT 0x1\n#define STA_LPC_EXIT_THREAD_CALLED_BIT 0x2\n#define STA_ADDRESS_SPACE_OWNER_BIT 0x4\n#define STA_OWNS_WORKING_SET_BITS 0x1F8\n#endif\n\n#define TLS_EXPANSION_SLOTS 1024\n//\n// Process Flags\n//\n#define PSF_CREATE_REPORTED_BIT 0x1\n#define PSF_NO_DEBUG_INHERIT_BIT 0x2\n#define PSF_PROCESS_EXITING_BIT 0x4\n#define PSF_PROCESS_DELETE_BIT 0x8\n#define PSF_WOW64_SPLIT_PAGES_BIT 0x10\n#define PSF_VM_DELETED_BIT 0x20\n#define PSF_OUTSWAP_ENABLED_BIT 0x40\n#define PSF_OUTSWAPPED_BIT 0x80\n#define PSF_FORK_FAILED_BIT 0x100\n#define PSF_WOW64_VA_SPACE_4GB_BIT 0x200\n#define PSF_ADDRESS_SPACE_INITIALIZED_BIT 0x400\n#define PSF_SET_TIMER_RESOLUTION_BIT 0x1000\n#define PSF_BREAK_ON_TERMINATION_BIT 0x2000\n#define PSF_SESSION_CREATION_UNDERWAY_BIT 0x4000\n#define PSF_WRITE_WATCH_BIT 0x8000\n#define PSF_PROCESS_IN_SESSION_BIT 0x10000\n#define PSF_OVERRIDE_ADDRESS_SPACE_BIT 0x20000\n#define PSF_HAS_ADDRESS_SPACE_BIT 0x40000\n#define PSF_LAUNCH_PREFETCHED_BIT 0x80000\n#define PSF_INJECT_INPAGE_ERRORS_BIT 0x100000\n#define PSF_VM_TOP_DOWN_BIT 0x200000\n#define PSF_IMAGE_NOTIFY_DONE_BIT 0x400000\n#define PSF_PDE_UPDATE_NEEDED_BIT 0x800000\n#define PSF_VDM_ALLOWED_BIT 0x1000000\n#define PSF_SWAP_ALLOWED_BIT 0x2000000\n#define PSF_CREATE_FAILED_BIT 0x4000000\n#define PSF_DEFAULT_IO_PRIORITY_BIT 0x8000000\n\n//\n// Vista Process Flags\n//\n#define PSF2_PROTECTED_BIT 0x800\n\n#ifdef NTOS_MODE_USER\n//\n// Current Process/Thread built-in 'special' handles\n//\n#define NtCurrentProcess() ((HANDLE)(LONG_PTR)-1)\n#define ZwCurrentProcess() NtCurrentProcess()\n#define NtCurrentThread() ((HANDLE)(LONG_PTR)-2)\n#define ZwCurrentThread() NtCurrentThread()\n\n//\n// Process/Thread/Job Information Classes for NtQueryInformationProcess/Thread/Job\n//\ntypedef enum _PROCESSINFOCLASS\n{\n ProcessBasicInformation,\n ProcessQuotaLimits,\n ProcessIoCounters,\n ProcessVmCounters,\n ProcessTimes,\n ProcessBasePriority,\n ProcessRaisePriority,\n ProcessDebugPort,\n ProcessExceptionPort,\n ProcessAccessToken,\n ProcessLdtInformation,\n ProcessLdtSize,\n ProcessDefaultHardErrorMode,\n ProcessIoPortHandlers,\n ProcessPooledUsageAndLimits,\n ProcessWorkingSetWatch,\n ProcessUserModeIOPL,\n ProcessEnableAlignmentFaultFixup,\n ProcessPriorityClass,\n ProcessWx86Information,\n ProcessHandleCount,\n ProcessAffinityMask,\n ProcessPriorityBoost,\n ProcessDeviceMap,\n ProcessSessionInformation,\n ProcessForegroundInformation,\n ProcessWow64Information,\n ProcessImageFileName,\n ProcessLUIDDeviceMapsEnabled,\n ProcessBreakOnTermination,\n ProcessDebugObjectHandle,\n ProcessDebugFlags,\n ProcessHandleTracing,\n ProcessIoPriority,\n ProcessExecuteFlags,\n ProcessTlsInformation,\n ProcessCookie,\n ProcessImageInformation,\n ProcessCycleTime,\n ProcessPagePriority,\n ProcessInstrumentationCallback,\n MaxProcessInfoClass\n} PROCESSINFOCLASS;\n\ntypedef enum _THREADINFOCLASS\n{\n ThreadBasicInformation,\n ThreadTimes,\n ThreadPriority,\n ThreadBasePriority,\n ThreadAffinityMask,\n ThreadImpersonationToken,\n ThreadDescriptorTableEntry,\n ThreadEnableAlignmentFaultFixup,\n ThreadEventPair_Reusable,\n ThreadQuerySetWin32StartAddress,\n ThreadZeroTlsCell,\n ThreadPerformanceCount,\n ThreadAmILastThread,\n ThreadIdealProcessor,\n ThreadPriorityBoost,\n ThreadSetTlsArrayAddress,\n ThreadIsIoPending,\n ThreadHideFromDebugger,\n ThreadBreakOnTermination,\n ThreadSwitchLegacyState,\n ThreadIsTerminated,\n ThreadLastSystemCall,\n ThreadIoPriority,\n ThreadCycleTime,\n ThreadPagePriority,\n ThreadActualBasePriority,\n ThreadTebInformation,\n ThreadCSwitchMon,\n MaxThreadInfoClass\n} THREADINFOCLASS;\n\n#else\n\ntypedef enum _PSPROCESSPRIORITYMODE\n{\n PsProcessPriorityForeground,\n PsProcessPriorityBackground,\n PsProcessPrioritySpinning\n} PSPROCESSPRIORITYMODE;\n\ntypedef enum _JOBOBJECTINFOCLASS\n{\n JobObjectBasicAccountingInformation = 1,\n JobObjectBasicLimitInformation,\n JobObjectBasicProcessIdList,\n JobObjectBasicUIRestrictions,\n JobObjectSecurityLimitInformation,\n JobObjectEndOfJobTimeInformation,\n JobObjectAssociateCompletionPortInformation,\n JobObjectBasicAndIoAccountingInformation,\n JobObjectExtendedLimitInformation,\n JobObjectJobSetInformation,\n MaxJobObjectInfoClass\n} JOBOBJECTINFOCLASS;\n\n//\n// Power Event Events for Win32K Power Event Callback\n//\ntypedef enum _PSPOWEREVENTTYPE\n{\n PsW32FullWake = 0,\n PsW32EventCode = 1,\n PsW32PowerPolicyChanged = 2,\n PsW32SystemPowerState = 3,\n PsW32SystemTime = 4,\n PsW32DisplayState = 5,\n PsW32CapabilitiesChanged = 6,\n PsW32SetStateFailed = 7,\n PsW32GdiOff = 8,\n PsW32GdiOn = 9,\n PsW32GdiPrepareResumeUI = 10,\n PsW32GdiOffRequest = 11,\n PsW32MonitorOff = 12,\n} PSPOWEREVENTTYPE;\n\n//\n// Power State Tasks for Win32K Power State Callback\n//\ntypedef enum _POWERSTATETASK\n{\n PowerState_BlockSessionSwitch = 0,\n PowerState_Init = 1,\n PowerState_QueryApps = 2,\n PowerState_QueryServices = 3,\n PowerState_QueryAppsFailed = 4,\n PowerState_QueryServicesFailed = 5,\n PowerState_SuspendApps = 6,\n PowerState_SuspendServices = 7,\n PowerState_ShowUI = 8,\n PowerState_NotifyWL = 9,\n PowerState_ResumeApps = 10,\n PowerState_ResumeServices = 11,\n PowerState_UnBlockSessionSwitch = 12,\n PowerState_End = 13,\n PowerState_BlockInput = 14,\n PowerState_UnblockInput = 15,\n} POWERSTATETASK;\n\n//\n// Win32K Job Callback Types\n//\ntypedef enum _PSW32JOBCALLOUTTYPE\n{\n PsW32JobCalloutSetInformation = 0,\n PsW32JobCalloutAddProcess = 1,\n PsW32JobCalloutTerminate = 2,\n} PSW32JOBCALLOUTTYPE;\n\n//\n// Win32K Thread Callback Types\n//\ntypedef enum _PSW32THREADCALLOUTTYPE\n{\n PsW32ThreadCalloutInitialize,\n PsW32ThreadCalloutExit,\n} PSW32THREADCALLOUTTYPE;\n\n//\n// Declare empty structure definitions so that they may be referenced by\n// routines before they are defined\n//\nstruct _W32THREAD;\nstruct _W32PROCESS;\n//struct _ETHREAD;\nstruct _WIN32_POWEREVENT_PARAMETERS;\nstruct _WIN32_POWERSTATE_PARAMETERS;\nstruct _WIN32_JOBCALLOUT_PARAMETERS;\nstruct _WIN32_OPENMETHOD_PARAMETERS;\nstruct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS;\nstruct _WIN32_CLOSEMETHOD_PARAMETERS;\nstruct _WIN32_DELETEMETHOD_PARAMETERS;\nstruct _WIN32_PARSEMETHOD_PARAMETERS;\n\n//\n// Win32K Process and Thread Callbacks\n//\ntypedef\nNTSTATUS\n(NTAPI *PKWIN32_PROCESS_CALLOUT)(\n struct _EPROCESS *Process,\n BOOLEAN Create\n);\n\ntypedef\nNTSTATUS\n(NTAPI *PKWIN32_THREAD_CALLOUT)(\n struct _ETHREAD *Thread,\n PSW32THREADCALLOUTTYPE Type\n);\n\ntypedef\nNTSTATUS\n(NTAPI *PKWIN32_GLOBALATOMTABLE_CALLOUT)(\n VOID\n);\n\ntypedef\nNTSTATUS\n(NTAPI *PKWIN32_POWEREVENT_CALLOUT)(\n struct _WIN32_POWEREVENT_PARAMETERS *Parameters\n);\n\ntypedef\nNTSTATUS\n(NTAPI *PKWIN32_POWERSTATE_CALLOUT)(\n struct _WIN32_POWERSTATE_PARAMETERS *Parameters\n);\n\ntypedef\nNTSTATUS\n(NTAPI *PKWIN32_JOB_CALLOUT)(\n struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters\n);\n\ntypedef\nNTSTATUS\n(NTAPI *PGDI_BATCHFLUSH_ROUTINE)(\n VOID\n);\n\ntypedef\nNTSTATUS\n(NTAPI *PKWIN32_OPENMETHOD_CALLOUT)(\n struct _WIN32_OPENMETHOD_PARAMETERS *Parameters\n);\n\ntypedef\nNTSTATUS\n(NTAPI *PKWIN32_OKTOCLOSEMETHOD_CALLOUT)(\n struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters\n);\n\ntypedef\nNTSTATUS\n(NTAPI *PKWIN32_CLOSEMETHOD_CALLOUT)(\n struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters\n);\n\ntypedef\nVOID\n(NTAPI *PKWIN32_DELETEMETHOD_CALLOUT)(\n struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters\n);\n\ntypedef\nNTSTATUS\n(NTAPI *PKWIN32_PARSEMETHOD_CALLOUT)(\n struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters\n);\n\ntypedef\nNTSTATUS\n(NTAPI *PKWIN32_WIN32DATACOLLECTION_CALLOUT)(\n struct _EPROCESS *Process,\n PVOID Callback,\n PVOID Context\n);\n\n//\n// Lego Callback\n//\ntypedef\nVOID\n(NTAPI *PLEGO_NOTIFY_ROUTINE)(\n IN PKTHREAD Thread\n);\n\n#endif\n\ntypedef NTSTATUS\n(NTAPI *PPOST_PROCESS_INIT_ROUTINE)(\n VOID\n);\n\n//\n// Descriptor Table Entry Definition\n//\n#define _DESCRIPTOR_TABLE_ENTRY_DEFINED\ntypedef struct _DESCRIPTOR_TABLE_ENTRY\n{\n ULONG Selector;\n LDT_ENTRY Descriptor;\n} DESCRIPTOR_TABLE_ENTRY, *PDESCRIPTOR_TABLE_ENTRY;\n\n//\n// PEB Lock Routine\n//\ntypedef VOID\n(NTAPI *PPEBLOCKROUTINE)(\n PVOID PebLock\n);\n\n//\n// PEB Free Block Descriptor\n//\ntypedef struct _PEB_FREE_BLOCK\n{\n struct _PEB_FREE_BLOCK* Next;\n ULONG Size;\n} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;\n\n//\n// Process Environment Block (PEB)\n//\ntypedef struct _PEB\n{\n UCHAR InheritedAddressSpace;\n UCHAR ReadImageFileExecOptions;\n UCHAR BeingDebugged;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n union\n {\n struct\n {\n UCHAR ImageUsesLargePages:1;\n UCHAR IsProtectedProcess:1;\n UCHAR IsLegacyProcess:1;\n UCHAR IsImageDynamicallyRelocated:1;\n UCHAR SkipPatchingUser32Forwarders:1;\n UCHAR SpareBits:3;\n };\n UCHAR BitField;\n };\n#else\n BOOLEAN SpareBool;\n#endif\n HANDLE Mutant;\n PVOID ImageBaseAddress;\n PPEB_LDR_DATA Ldr;\n struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters;\n PVOID SubSystemData;\n PVOID ProcessHeap;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n struct _RTL_CRITICAL_SECTION *FastPebLock;\n PVOID AltThunkSListPtr;\n PVOID IFEOKey;\n union\n {\n struct\n {\n ULONG ProcessInJob:1;\n ULONG ProcessInitializing:1;\n ULONG ProcessUsingVEH:1;\n ULONG ProcessUsingVCH:1;\n ULONG ReservedBits0:28;\n };\n ULONG CrossProcessFlags;\n };\n union\n {\n PVOID* KernelCallbackTable;\n PVOID UserSharedInfoPtr;\n };\n ULONG SystemReserved[1];\n ULONG SpareUlong;\n ULONG SparePebPtr0;\n#else\n PVOID FastPebLock;\n PPEBLOCKROUTINE FastPebLockRoutine;\n PPEBLOCKROUTINE FastPebUnlockRoutine;\n ULONG EnvironmentUpdateCount;\n PVOID* KernelCallbackTable;\n PVOID EventLogSection;\n PVOID EventLog;\n PPEB_FREE_BLOCK FreeList;\n#endif\n ULONG TlsExpansionCounter;\n PVOID TlsBitmap;\n ULONG TlsBitmapBits[0x2];\n PVOID ReadOnlySharedMemoryBase;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PVOID HotpatchInformation;\n#else\n PVOID ReadOnlySharedMemoryHeap;\n#endif\n PVOID* ReadOnlyStaticServerData;\n PVOID AnsiCodePageData;\n PVOID OemCodePageData;\n PVOID UnicodeCaseTableData;\n ULONG NumberOfProcessors;\n ULONG NtGlobalFlag;\n LARGE_INTEGER CriticalSectionTimeout;\n ULONG HeapSegmentReserve;\n ULONG HeapSegmentCommit;\n ULONG HeapDeCommitTotalFreeThreshold;\n ULONG HeapDeCommitFreeBlockThreshold;\n ULONG NumberOfHeaps;\n ULONG MaximumNumberOfHeaps;\n PVOID* ProcessHeaps;\n PVOID GdiSharedHandleTable;\n PVOID ProcessStarterHelper;\n ULONG GdiDCAttributeList;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n struct _RTL_CRITICAL_SECTION *LoaderLock;\n#else\n PVOID LoaderLock;\n#endif\n ULONG OSMajorVersion;\n ULONG OSMinorVersion;\n USHORT OSBuildNumber;\n USHORT OSCSDVersion;\n ULONG OSPlatformId;\n ULONG ImageSubSystem;\n ULONG ImageSubSystemMajorVersion;\n ULONG ImageSubSystemMinorVersion;\n ULONG ImageProcessAffinityMask;\n ULONG GdiHandleBuffer[0x22];\n PPOST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;\n struct _RTL_BITMAP *TlsExpansionBitmap;\n ULONG TlsExpansionBitmapBits[0x20];\n ULONG SessionId;\n#if (NTDDI_VERSION >= NTDDI_WINXP)\n ULARGE_INTEGER AppCompatFlags;\n ULARGE_INTEGER AppCompatFlagsUser;\n PVOID pShimData;\n PVOID AppCompatInfo;\n UNICODE_STRING CSDVersion;\n struct _ACTIVATION_CONTEXT_DATA *ActivationContextData;\n struct _ASSEMBLY_STORAGE_MAP *ProcessAssemblyStorageMap;\n struct _ACTIVATION_CONTEXT_DATA *SystemDefaultActivationContextData;\n struct _ASSEMBLY_STORAGE_MAP *SystemAssemblyStorageMap;\n ULONG MinimumStackCommit;\n#endif\n#if (NTDDI_VERSION >= NTDDI_WS03)\n PVOID *FlsCallback;\n LIST_ENTRY FlsListHead;\n struct _RTL_BITMAP *FlsBitmap;\n ULONG FlsBitmapBits[4];\n ULONG FlsHighIndex;\n#endif\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PVOID WerRegistrationData;\n PVOID WerShipAssertPtr;\n#endif\n} PEB, *PPEB;\n\n//\n// GDI Batch Descriptor\n//\ntypedef struct _GDI_TEB_BATCH\n{\n ULONG Offset;\n HANDLE HDC;\n ULONG Buffer[0x136];\n} GDI_TEB_BATCH, *PGDI_TEB_BATCH;\n\n//\n// Initial TEB\n//\ntypedef struct _INITIAL_TEB\n{\n PVOID PreviousStackBase;\n PVOID PreviousStackLimit;\n PVOID StackBase;\n PVOID StackLimit;\n PVOID AllocatedStackBase;\n} INITIAL_TEB, *PINITIAL_TEB;\n\n//\n// TEB Active Frame Structures\n//\ntypedef struct _TEB_ACTIVE_FRAME_CONTEXT\n{\n ULONG Flags;\n LPSTR FrameName;\n} TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;\n\ntypedef struct _TEB_ACTIVE_FRAME\n{\n ULONG Flags;\n struct _TEB_ACTIVE_FRAME *Previous;\n PTEB_ACTIVE_FRAME_CONTEXT Context;\n} TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;\n\n//\n// Thread Environment Block (TEB)\n//\ntypedef struct _TEB\n{\n NT_TIB Tib;\n PVOID EnvironmentPointer;\n CLIENT_ID Cid;\n PVOID ActiveRpcHandle;\n PVOID ThreadLocalStoragePointer;\n struct _PEB *ProcessEnvironmentBlock;\n ULONG LastErrorValue;\n ULONG CountOfOwnedCriticalSections;\n PVOID CsrClientThread;\n struct _W32THREAD* Win32ThreadInfo;\n ULONG User32Reserved[0x1A];\n ULONG UserReserved[5];\n PVOID WOW32Reserved;\n LCID CurrentLocale;\n ULONG FpSoftwareStatusRegister;\n PVOID SystemReserved1[0x36];\n LONG ExceptionCode;\n struct _ACTIVATION_CONTEXT_STACK *ActivationContextStackPointer;\n#ifdef _WIN64\n UCHAR SpareBytes1[24];\n#else\n UCHAR SpareBytes1[0x24];\n#endif\n ULONG TxFsContext;\n GDI_TEB_BATCH GdiTebBatch;\n CLIENT_ID RealClientId;\n PVOID GdiCachedProcessHandle;\n ULONG GdiClientPID;\n ULONG GdiClientTID;\n PVOID GdiThreadLocalInfo;\n SIZE_T Win32ClientInfo[62];\n PVOID glDispatchTable[0xE9];\n SIZE_T glReserved1[0x1D];\n PVOID glReserved2;\n PVOID glSectionInfo;\n PVOID glSection;\n PVOID glTable;\n PVOID glCurrentRC;\n PVOID glContext;\n NTSTATUS LastStatusValue;\n UNICODE_STRING StaticUnicodeString;\n WCHAR StaticUnicodeBuffer[0x105];\n PVOID DeallocationStack;\n PVOID TlsSlots[0x40];\n LIST_ENTRY TlsLinks;\n PVOID Vdm;\n PVOID ReservedForNtRpc;\n PVOID DbgSsReserved[0x2];\n ULONG HardErrorDisabled;\n#ifdef _WIN64\n PVOID Instrumentation[11];\n#else\n PVOID Instrumentation[9];\n#endif\n GUID ActivityId;\n PVOID SubProcessTag;\n PVOID EtwTraceData;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PVOID EtwLocalData;\n#endif\n PVOID WinSockData;\n ULONG GdiBatchCount;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n BOOLEAN SpareBool0;\n BOOLEAN SpareBool1;\n BOOLEAN SpareBool2;\n#else\n BOOLEAN InDbgPrint;\n BOOLEAN FreeStackOnTermination;\n BOOLEAN HasFiberData;\n#endif\n UCHAR IdealProcessor;\n ULONG GuaranteedStackBytes;\n PVOID ReservedForPerf;\n PVOID ReservedForOle;\n ULONG WaitingOnLoaderLock;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PVOID SavedPriorityState;\n#else\n ULONG SparePointer1;\n#endif\n ULONG SoftPatchPtr1;\n ULONG SoftPatchPtr2;\n PVOID *TlsExpansionSlots;\n ULONG ImpersonationLocale;\n ULONG IsImpersonating;\n PVOID NlsCache;\n PVOID pShimData;\n ULONG HeapVirualAffinity;\n PVOID CurrentTransactionHandle;\n PTEB_ACTIVE_FRAME ActiveFrame;\n#if (NTDDI_VERSION >= NTDDI_WS03)\n PVOID FlsData;\n#endif\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PVOID PreferredLangauges;\n PVOID UserPrefLanguages;\n PVOID MergedPrefLanguages;\n ULONG MuiImpersonation;\n union\n {\n struct\n {\n USHORT SpareCrossTebFlags:16;\n };\n USHORT CrossTebFlags;\n };\n union\n {\n struct\n {\n USHORT DbgSafeThunkCall:1;\n USHORT DbgInDebugPrint:1;\n USHORT DbgHasFiberData:1;\n USHORT DbgSkipThreadAttach:1;\n USHORT DbgWerInShipAssertCode:1;\n USHORT DbgIssuedInitialBp:1;\n USHORT DbgClonedThread:1;\n USHORT SpareSameTebBits:9;\n };\n USHORT SameTebFlags;\n };\n PVOID TxnScopeEntercallback;\n PVOID TxnScopeExitCAllback;\n PVOID TxnScopeContext;\n ULONG LockCount;\n ULONG ProcessRundown;\n ULONGLONG LastSwitchTime;\n ULONGLONG TotalSwitchOutTime;\n LARGE_INTEGER WaitReasonBitMap;\n#else\n UCHAR SafeThunkCall;\n UCHAR BooleanSpare[3];\n#endif\n} TEB, *PTEB;\n\n#ifdef NTOS_MODE_USER\n\n//\n// Process Information Structures for NtQueryProcessInformation\n//\ntypedef struct _PROCESS_BASIC_INFORMATION\n{\n NTSTATUS ExitStatus;\n PPEB PebBaseAddress;\n ULONG_PTR AffinityMask;\n KPRIORITY BasePriority;\n ULONG_PTR UniqueProcessId;\n ULONG_PTR InheritedFromUniqueProcessId;\n} PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION;\n\ntypedef struct _PROCESS_ACCESS_TOKEN\n{\n HANDLE Token;\n HANDLE Thread;\n} PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;\n\ntypedef struct _PROCESS_DEVICEMAP_INFORMATION\n{\n union\n {\n struct\n {\n HANDLE DirectoryHandle;\n } Set;\n struct\n {\n ULONG DriveMap;\n UCHAR DriveType[32];\n } Query;\n };\n} PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION;\n\ntypedef struct _KERNEL_USER_TIMES\n{\n LARGE_INTEGER CreateTime;\n LARGE_INTEGER ExitTime;\n LARGE_INTEGER KernelTime;\n LARGE_INTEGER UserTime;\n} KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;\n\ntypedef struct _PROCESS_SESSION_INFORMATION\n{\n ULONG SessionId;\n} PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;\n\n#endif\n\ntypedef struct _PROCESS_PRIORITY_CLASS\n{\n BOOLEAN Foreground;\n UCHAR PriorityClass;\n} PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;\n\n//\n// Thread Information Structures for NtQueryProcessInformation\n//\ntypedef struct _THREAD_BASIC_INFORMATION\n{\n NTSTATUS ExitStatus;\n PVOID TebBaseAddress;\n CLIENT_ID ClientId;\n KAFFINITY AffinityMask;\n KPRIORITY Priority;\n KPRIORITY BasePriority;\n} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;\n\n#ifndef NTOS_MODE_USER\n\n//\n// Job Set Array\n//\ntypedef struct _JOB_SET_ARRAY\n{\n HANDLE JobHandle;\n ULONG MemberLevel;\n ULONG Flags;\n} JOB_SET_ARRAY, *PJOB_SET_ARRAY;\n\n//\n// EPROCESS Quota Structures\n//\ntypedef struct _EPROCESS_QUOTA_ENTRY\n{\n SIZE_T Usage;\n SIZE_T Limit;\n SIZE_T Peak;\n SIZE_T Return;\n} EPROCESS_QUOTA_ENTRY, *PEPROCESS_QUOTA_ENTRY;\n\ntypedef struct _EPROCESS_QUOTA_BLOCK\n{\n EPROCESS_QUOTA_ENTRY QuotaEntry[3];\n LIST_ENTRY QuotaList;\n ULONG ReferenceCount;\n ULONG ProcessCount;\n} EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;\n\n//\n// Process Pagefault History\n//\ntypedef struct _PAGEFAULT_HISTORY\n{\n ULONG CurrentIndex;\n ULONG MapIndex;\n KSPIN_LOCK SpinLock;\n PVOID Reserved;\n PROCESS_WS_WATCH_INFORMATION WatchInfo[1];\n} PAGEFAULT_HISTORY, *PPAGEFAULT_HISTORY;\n\n//\n// Process Impersonation Information\n//\ntypedef struct _PS_IMPERSONATION_INFORMATION\n{\n PACCESS_TOKEN Token;\n BOOLEAN CopyOnOpen;\n BOOLEAN EffectiveOnly;\n SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;\n} PS_IMPERSONATION_INFORMATION, *PPS_IMPERSONATION_INFORMATION;\n\n//\n// Process Termination Port\n//\ntypedef struct _TERMINATION_PORT\n{\n struct _TERMINATION_PORT *Next;\n PVOID Port;\n} TERMINATION_PORT, *PTERMINATION_PORT;\n\n//\n// Per-Process APC Rate Limiting\n//\ntypedef struct _PSP_RATE_APC\n{\n union\n {\n SINGLE_LIST_ENTRY NextApc;\n ULONGLONG ExcessCycles;\n };\n ULONGLONG TargetGEneration;\n KAPC RateApc;\n} PSP_RATE_APC, *PPSP_RATE_APC;\n\n//\n// Executive Thread (ETHREAD)\n//\ntypedef struct _ETHREAD\n{\n KTHREAD Tcb;\n PVOID Padding;\n LARGE_INTEGER CreateTime;\n union\n {\n LARGE_INTEGER ExitTime;\n LIST_ENTRY LpcReplyChain;\n LIST_ENTRY KeyedWaitChain;\n };\n union\n {\n NTSTATUS ExitStatus;\n PVOID OfsChain;\n };\n LIST_ENTRY PostBlockList;\n union\n {\n struct _TERMINATION_PORT *TerminationPort;\n struct _ETHREAD *ReaperLink;\n PVOID KeyedWaitValue;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PVOID Win32StartParameter;\n#endif\n };\n KSPIN_LOCK ActiveTimerListLock;\n LIST_ENTRY ActiveTimerListHead;\n CLIENT_ID Cid;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n KSEMAPHORE KeyedWaitSemaphore;\n#else\n union\n {\n KSEMAPHORE LpcReplySemaphore;\n KSEMAPHORE KeyedReplySemaphore;\n };\n union\n {\n PVOID LpcReplyMessage;\n PVOID LpcWaitingOnPort;\n };\n#endif\n PPS_IMPERSONATION_INFORMATION ImpersonationInfo;\n LIST_ENTRY IrpList;\n ULONG TopLevelIrp;\n PDEVICE_OBJECT DeviceToVerify;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PPSP_RATE_APC RateControlApc;\n#else\n struct _EPROCESS *ThreadsProcess;\n#endif\n PVOID Win32StartAddress;\n union\n {\n PKSTART_ROUTINE StartAddress;\n ULONG LpcReceivedMessageId;\n };\n LIST_ENTRY ThreadListEntry;\n EX_RUNDOWN_REF RundownProtect;\n EX_PUSH_LOCK ThreadLock;\n#if (NTDDI_VERSION < NTDDI_LONGHORN)\n ULONG LpcReplyMessageId;\n#endif\n ULONG ReadClusterSize;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG SpareUlong0;\n#else\n ACCESS_MASK GrantedAccess;\n#endif\n union\n {\n struct\n {\n ULONG Terminated:1;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG ThreadInserted:1;\n#else\n ULONG DeadThread:1;\n#endif\n ULONG HideFromDebugger:1;\n ULONG ActiveImpersonationInfo:1;\n ULONG SystemThread:1;\n ULONG HardErrorsAreDisabled:1;\n ULONG BreakOnTermination:1;\n ULONG SkipCreationMsg:1;\n ULONG SkipTerminationMsg:1;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG CreateMsgSent:1;\n ULONG ThreadIoPriority:3;\n ULONG ThreadPagePriority:3;\n ULONG PendingRatecontrol:1;\n#endif\n };\n ULONG CrossThreadFlags;\n };\n union\n {\n struct\n {\n ULONG ActiveExWorker:1;\n ULONG ExWorkerCanWaitUser:1;\n ULONG MemoryMaker:1;\n ULONG KeyedEventInUse:1;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG RateApcState:2;\n#endif\n };\n ULONG SameThreadPassiveFlags;\n };\n union\n {\n struct\n {\n ULONG LpcReceivedMsgIdValid:1;\n ULONG LpcExitThreadCalled:1;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG Spare:1;\n#else\n ULONG AddressSpaceOwner:1;\n#endif\n ULONG OwnsProcessWorkingSetExclusive:1;\n ULONG OwnsProcessWorkingSetShared:1;\n ULONG OwnsSystemWorkingSetExclusive:1;\n ULONG OwnsSystemWorkingSetShared:1;\n ULONG OwnsSessionWorkingSetExclusive:1;\n ULONG OwnsSessionWorkingSetShared:1;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG SupressSymbolLoad:1;\n ULONG Spare1:3;\n ULONG PriorityRegionActive:4;\n#else\n ULONG ApcNeeded:1;\n#endif\n };\n ULONG SameThreadApcFlags;\n };\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n UCHAR CacheManagerActive;\n#else\n UCHAR ForwardClusterOnly;\n#endif\n UCHAR DisablePageFaultClustering;\n UCHAR ActiveFaultCount;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG AlpcMessageId;\n union\n {\n PVOID AlpcMessage;\n ULONG AlpcReceiveAttributeSet;\n };\n LIST_ENTRY AlpcWaitListEntry;\n KSEMAPHORE AlpcWaitSemaphore;\n ULONG CacheManagerCount;\n#endif\n} ETHREAD, *PETHREAD;\n\n//\n// Executive Process (EPROCESS)\n//\ntypedef struct _EPROCESS\n{\n KPROCESS Pcb;\n EX_PUSH_LOCK ProcessLock;\n LARGE_INTEGER CreateTime;\n LARGE_INTEGER ExitTime;\n EX_RUNDOWN_REF RundownProtect;\n HANDLE UniqueProcessId;\n LIST_ENTRY ActiveProcessLinks;\n ULONG QuotaUsage[3]; /* 0=PagedPool, 1=NonPagedPool, 2=Pagefile */\n ULONG QuotaPeak[3]; /* ditto */\n ULONG CommitCharge;\n ULONG PeakVirtualSize;\n ULONG VirtualSize;\n LIST_ENTRY SessionProcessLinks;\n PVOID DebugPort;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n union\n {\n PVOID ExceptionPortData;\n ULONG ExceptionPortValue;\n UCHAR ExceptionPortState:3;\n };\n#else\n PVOID ExceptionPort;\n#endif\n PHANDLE_TABLE ObjectTable;\n EX_FAST_REF Token;\n ULONG WorkingSetPage;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n EX_PUSH_LOCK AddressCreationLock;\n PETHREAD RotateInProgress;\n#else\n KGUARDED_MUTEX AddressCreationLock;\n KSPIN_LOCK HyperSpaceLock;\n#endif\n PETHREAD ForkInProgress;\n ULONG HardwareTrigger;\n PMM_AVL_TABLE PhysicalVadRoot;\n PVOID CloneRoot;\n ULONG NumberOfPrivatePages;\n ULONG NumberOfLockedPages;\n PVOID *Win32Process;\n struct _EJOB *Job;\n PVOID SectionObject;\n PVOID SectionBaseAddress;\n PEPROCESS_QUOTA_BLOCK QuotaBlock;\n PPAGEFAULT_HISTORY WorkingSetWatch;\n PVOID Win32WindowStation;\n HANDLE InheritedFromUniqueProcessId;\n PVOID LdtInformation;\n PVOID VadFreeHint;\n PVOID VdmObjects;\n PVOID DeviceMap;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n PVOID EtwDataSource;\n PVOID FreeTebHint;\n#else\n PVOID Spare0[3];\n#endif\n union\n {\n HARDWARE_PTE PagedirectoryPte;\n ULONGLONG Filler;\n };\n ULONG Session;\n CHAR ImageFileName[16];\n LIST_ENTRY JobLinks;\n PVOID LockedPagesList;\n LIST_ENTRY ThreadListHead;\n PVOID SecurityPort;\n PVOID PaeTop;\n ULONG ActiveThreads;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG ImagePathHash;\n#else\n ACCESS_MASK GrantedAccess;\n#endif\n ULONG DefaultHardErrorProcessing;\n NTSTATUS LastThreadExitStatus;\n struct _PEB* Peb;\n EX_FAST_REF PrefetchTrace;\n LARGE_INTEGER ReadOperationCount;\n LARGE_INTEGER WriteOperationCount;\n LARGE_INTEGER OtherOperationCount;\n LARGE_INTEGER ReadTransferCount;\n LARGE_INTEGER WriteTransferCount;\n LARGE_INTEGER OtherTransferCount;\n ULONG CommitChargeLimit;\n ULONG CommitChargePeak;\n PVOID AweInfo;\n SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;\n MMSUPPORT Vm;\n LIST_ENTRY MmProcessLinks;\n ULONG ModifiedPageCount;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n union\n {\n struct\n {\n ULONG JobNotReallyActive:1;\n ULONG AccountingFolded:1;\n ULONG NewProcessReported:1;\n ULONG ExitProcessReported:1;\n ULONG ReportCommitChanges:1;\n ULONG LastReportMemory:1;\n ULONG ReportPhysicalPageChanges:1;\n ULONG HandleTableRundown:1;\n ULONG NeedsHandleRundown:1;\n ULONG RefTraceEnabled:1;\n ULONG NumaAware:1;\n ULONG ProtectedProcess:1;\n ULONG DefaultPagePriority:3;\n ULONG PrimaryTokenFrozen:1;\n ULONG ProcessVerifierTarget:1;\n ULONG StackRandomizationDisabled:1;\n ULONG Unused01:1;\n ULONG Unused02:1;\n ULONG CrossSectionCreate:1;\n };\n ULONG Flags2;\n };\n#else\n ULONG JobStatus;\n#endif\n union\n {\n struct\n {\n ULONG CreateReported:1;\n ULONG NoDebugInherit:1;\n ULONG ProcessExiting:1;\n ULONG ProcessDelete:1;\n ULONG Wow64SplitPages:1;\n ULONG VmDeleted:1;\n ULONG OutswapEnabled:1;\n ULONG Outswapped:1;\n ULONG ForkFailed:1;\n ULONG Wow64VaSpace4Gb:1;\n ULONG AddressSpaceInitialized:2;\n ULONG SetTimerResolution:1;\n ULONG BreakOnTermination:1;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG DeprioritizeViews:1;\n#else\n ULONG SessionCreationUnderway:1;\n#endif\n ULONG WriteWatch:1;\n ULONG ProcessInSession:1;\n ULONG OverrideAddressSpace:1;\n ULONG HasAddressSpace:1;\n ULONG LaunchPrefetched:1;\n ULONG InjectInpageErrors:1;\n ULONG VmTopDown:1;\n ULONG ImageNotifyDone:1;\n ULONG PdeUpdateNeeded:1;\n ULONG VdmAllowed:1;\n ULONG SmapAllowed:1;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG ProcessInserted:1;\n#else\n ULONG CreateFailed:1;\n#endif\n ULONG DefaultIoPriority:3;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n ULONG SparePsFlags1:2;\n#else\n ULONG Spare1:1;\n ULONG Spare2:1;\n#endif\n };\n ULONG Flags;\n };\n NTSTATUS ExitStatus;\n#if (NTDDI_VERSION >= NTDDI_LONGHORN)\n USHORT Spare7;\n#else\n USHORT NextPageColor;\n#endif\n union\n {\n struct\n {\n UCHAR SubSystemMinorVersion;\n UCHAR SubSystemMajorVersion;\n };\n USHORT SubSystemVersion;\n };\n UCHAR PriorityClass;\n MM_AVL_TABLE VadRoot;\n ULONG Cookie;\n} EPROCESS, *PEPROCESS;\n\n//\n// Job Token Filter Data\n//\n#include \ntypedef struct _PS_JOB_TOKEN_FILTER\n{\n ULONG CapturedSidCount;\n PSID_AND_ATTRIBUTES CapturedSids;\n ULONG CapturedSidsLength;\n ULONG CapturedGroupCount;\n PSID_AND_ATTRIBUTES CapturedGroups;\n ULONG CapturedGroupsLength;\n ULONG CapturedPrivilegeCount;\n PLUID_AND_ATTRIBUTES CapturedPrivileges;\n ULONG CapturedPrivilegesLength;\n} PS_JOB_TOKEN_FILTER, *PPS_JOB_TOKEN_FILTER;\n\n//\n// Executive Job (EJOB)\n//\ntypedef struct _EJOB\n{\n KEVENT Event;\n LIST_ENTRY JobLinks;\n LIST_ENTRY ProcessListHead;\n ERESOURCE JobLock;\n LARGE_INTEGER TotalUserTime;\n LARGE_INTEGER TotalKernelTime;\n LARGE_INTEGER ThisPeriodTotalUserTime;\n LARGE_INTEGER ThisPeriodTotalKernelTime;\n ULONG TotalPageFaultCount;\n ULONG TotalProcesses;\n ULONG ActiveProcesses;\n ULONG TotalTerminatedProcesses;\n LARGE_INTEGER PerProcessUserTimeLimit;\n LARGE_INTEGER PerJobUserTimeLimit;\n ULONG LimitFlags;\n ULONG MinimumWorkingSetSize;\n ULONG MaximumWorkingSetSize;\n ULONG ActiveProcessLimit;\n ULONG Affinity;\n UCHAR PriorityClass;\n ULONG UIRestrictionsClass;\n ULONG SecurityLimitFlags;\n PVOID Token;\n PPS_JOB_TOKEN_FILTER Filter;\n ULONG EndOfJobTimeAction;\n PVOID CompletionPort;\n PVOID CompletionKey;\n ULONG SessionId;\n ULONG SchedulingClass;\n ULONGLONG ReadOperationCount;\n ULONGLONG WriteOperationCount;\n ULONGLONG OtherOperationCount;\n ULONGLONG ReadTransferCount;\n ULONGLONG WriteTransferCount;\n ULONGLONG OtherTransferCount;\n IO_COUNTERS IoInfo;\n ULONG ProcessMemoryLimit;\n ULONG JobMemoryLimit;\n ULONG PeakProcessMemoryUsed;\n ULONG PeakJobMemoryUsed;\n ULONG CurrentJobMemoryUsed;\n#if (NTDDI_VERSION == NTDDI_WINXP)\n FAST_MUTEX MemoryLimitsLock;\n#elif (NTDDI_VERSION == NTDDI_WS03)\n KGUARDED_MUTEX MemoryLimitsLock;\n#elif (NTDDI_VERSION >= NTDDI_LONGHORN)\n EX_PUSH_LOCK MemoryLimitsLock;\n#endif\n LIST_ENTRY JobSetLinks;\n ULONG MemberLevel;\n ULONG JobFlags;\n} EJOB, *PEJOB;\n#include \n\n//\n// Win32K Callback Registration Data\n//\ntypedef struct _WIN32_POWEREVENT_PARAMETERS\n{\n PSPOWEREVENTTYPE EventNumber;\n ULONG Code;\n} WIN32_POWEREVENT_PARAMETERS, *PWIN32_POWEREVENT_PARAMETERS;\n\ntypedef struct _WIN32_POWERSTATE_PARAMETERS\n{\n UCHAR Promotion;\n POWER_ACTION SystemAction;\n SYSTEM_POWER_STATE MinSystemState;\n ULONG Flags;\n POWERSTATETASK PowerStateTask;\n} WIN32_POWERSTATE_PARAMETERS, *PWIN32_POWERSTATE_PARAMETERS;\n\ntypedef struct _WIN32_JOBCALLOUT_PARAMETERS\n{\n PVOID Job;\n PSW32JOBCALLOUTTYPE CalloutType;\n PVOID Data;\n} WIN32_JOBCALLOUT_PARAMETERS, *PWIN32_JOBCALLOUT_PARAMETERS;\n\ntypedef struct _WIN32_OPENMETHOD_PARAMETERS\n{\n OB_OPEN_REASON OpenReason;\n PEPROCESS Process;\n PVOID Object;\n ULONG GrantedAccess;\n ULONG HandleCount;\n} WIN32_OPENMETHOD_PARAMETERS, *PWIN32_OPENMETHOD_PARAMETERS;\n\ntypedef struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS\n{\n PEPROCESS Process;\n PVOID Object;\n HANDLE Handle;\n KPROCESSOR_MODE PreviousMode;\n} WIN32_OKAYTOCLOSEMETHOD_PARAMETERS, *PWIN32_OKAYTOCLOSEMETHOD_PARAMETERS;\n\ntypedef struct _WIN32_CLOSEMETHOD_PARAMETERS\n{\n PEPROCESS Process;\n PVOID Object;\n ACCESS_MASK AccessMask;\n ULONG ProcessHandleCount;\n ULONG SystemHandleCount;\n} WIN32_CLOSEMETHOD_PARAMETERS, *PWIN32_CLOSEMETHOD_PARAMETERS;\n\ntypedef struct _WIN32_DELETEMETHOD_PARAMETERS\n{\n PVOID Object;\n} WIN32_DELETEMETHOD_PARAMETERS, *PWIN32_DELETEMETHOD_PARAMETERS;\n\ntypedef struct _WIN32_PARSEMETHOD_PARAMETERS\n{\n PVOID ParseObject;\n PVOID ObjectType;\n PACCESS_STATE AccessState;\n KPROCESSOR_MODE AccessMode;\n ULONG Attributes;\n OUT PUNICODE_STRING CompleteName;\n PUNICODE_STRING RemainingName;\n PVOID Context;\n PSECURITY_QUALITY_OF_SERVICE SecurityQos;\n PVOID *Object;\n} WIN32_PARSEMETHOD_PARAMETERS, *PWIN32_PARSEMETHOD_PARAMETERS;\n\ntypedef struct _WIN32_CALLOUTS_FPNS\n{\n PKWIN32_PROCESS_CALLOUT ProcessCallout;\n PKWIN32_THREAD_CALLOUT ThreadCallout;\n PKWIN32_GLOBALATOMTABLE_CALLOUT GlobalAtomTableCallout;\n PKWIN32_POWEREVENT_CALLOUT PowerEventCallout;\n PKWIN32_POWERSTATE_CALLOUT PowerStateCallout;\n PKWIN32_JOB_CALLOUT JobCallout;\n PGDI_BATCHFLUSH_ROUTINE BatchFlushRoutine;\n PKWIN32_OPENMETHOD_CALLOUT DesktopOpenProcedure;\n PKWIN32_OKTOCLOSEMETHOD_CALLOUT DesktopOkToCloseProcedure;\n PKWIN32_CLOSEMETHOD_CALLOUT DesktopCloseProcedure;\n PKWIN32_DELETEMETHOD_CALLOUT DesktopDeleteProcedure;\n PKWIN32_OKTOCLOSEMETHOD_CALLOUT WindowStationOkToCloseProcedure;\n PKWIN32_CLOSEMETHOD_CALLOUT WindowStationCloseProcedure;\n PKWIN32_DELETEMETHOD_CALLOUT WindowStationDeleteProcedure;\n PKWIN32_PARSEMETHOD_CALLOUT WindowStationParseProcedure;\n PKWIN32_OPENMETHOD_CALLOUT WindowStationOpenProcedure;\n PKWIN32_WIN32DATACOLLECTION_CALLOUT Win32DataCollectionProcedure;\n} WIN32_CALLOUTS_FPNS, *PWIN32_CALLOUTS_FPNS;\n\n#endif // !NTOS_MODE_USER\n\n#endif // _PSTYPES_H\n" }, { "path": "ndk/readme.txt", "content": "Native Development Kit README\n NDK 1.00\n-----------------------------\n\n0. PREAMBLE\n\n0.1 COPYRIGHT\n\nThe NDK is Copyright 2005-2008 Alex Ionescu.\n\n0.2 CONTACT INFORMATION\n\nThe author, Alex Ionescu, may be reached through the following means:\n\nEmail: \taionescu@gmail.com\nMail:\t1411 du Fort, #1207. H3H 2N7. Montreal, QC. CANADA.\t\nPhone: \t1-(514)-581-7156\n\n1. LICENSE\n\n1.1 OPEN SOURCE USAGE\n\nOpen Source Projects may choose to use the following licenses:\n\nGNU GENERAL PUBLIC LICENSE Version 2, June 1991\n\n\t\tOR\n\nGNU LESSER GENERAL PUBLIC LICENSE Version 2.1, February 1999\n\n OR\n\nEITHER of the aforementioned licenses AND (at your option)\nany later version of the above said licenses.\n\n1.2 LICENSE LIMITATIONS\n\nThe choice is yours to make based on the license which is most compatible with your\nsoftware.\n\nYou MUST read GPL.TXT or LGPL.TXT after your decision. Violating your chosen license\nvoids your usage rights of the NDK and will lead to legal action on the part of the\nauthor. Using this software with any later version of the GNU GPL or LGPL in no way\nchanges your obligations under the versions listed above. You MUST still release the \nNDK and its changes under the terms of the original licenses (either GPLv2 or LGPLv2.1)\nas listed above. This DOES NOT AFFECT the license of a software package released under\na later version and ONLY serves to clarify that using the NDK with a later version is\npermitted provided the aforementioned terms are met.\n\nIf your Open Source product does not use a license which is compatible with the ones\nlisted above, please contact the author to reach a mutual agreement to find a better\nsolution for your product. Alternatively, you may choose to use the Proprietary Usage\nlicense displayed below in section 1.3\n\nIf you are unsure of whether or not your product qualifies as an Open Source product,\nplease contact the Free Software Foundation, or visit their website at www.fsf.org.\n\n1.3 PROPRIETARY USAGE\n\nBecause it may be undesirable or impossible to adapt this software to your commercial\nand/or proprietary product(s) and/or service(s) using a (L)GPL license, proprietary\nproducts are free to use the following license:\n\nNDK LICENSE Version 1, November 2005\n\nYou MUST read NDK.TXT for the full text of this license. Violating your chosen license\nvoids your usage rights of the NDK, constitutes a copyright violation, and will lead to\nlegal action on the part of the author.\n\nIf you are unsure of have any questions about the NDK License, please contact the\nauthor for further clarification.\n\n2. ORIGINS OF NDK MATERIAL, AND ADDING YOUR OWN\n\n2.1 CONTRIBUTIONS AND SOURCES\n\nThe NDK could not exist without the various contributions made by a variety of people\nand sources. The following public sources of information were lawfully used:\n\n- GNU NTIFS.H, Revision 43\n- W32API, Version 2.5\n- Microsoft Windows Driver Kit 6001\n- Microsoft Windows Driver Kit 6000\n- Microsoft Driver Development Kit 2003 SP1\n- Microsoft Driver Development Kit 2000\n- Microsoft Driver Development Kit NT 4\n- Microsoft Driver Development Kit WinME\n- Microsoft Installable File Systems Kit 2003 SP1\n- Microsoft Windows Debugger (WinDBG) 6.5.0003.7 and later\n- Microsoft Public Symbolic Data\n- Microsoft Public Windows Binaries (strings)\n- OSR Technical Articles\n- Undocumented windows 2000 Secrets, a Programmer's Cookbook\n- Windows NT/2000 Native API Reference\n- Windows NT File System Internals\n- Windows Internals I - II\n- Windows Internals 4th Edition\n\nIf the information contained in these sources was copyrighted, the information was not\ncopied, but simply used as a basis for developing a compatible and identical definition.\nNo information protected by a patent or NDA was used. All information was publically\nlocated through the Internet or purchased or licensed for lawful use.\n\nAdditionally, the following people contributed to the NDK:\n\n- Art Yerkes\n- Eric Kohl\n- Filip Navara\n- Steven Edwards\n\n2.2 BECOMING A CONTRIBUTOR\n\nTo contribute information to the NDK, simply contact the author with your new structure,\ndefinition, enumeration, or prototype. Please make sure that your addition is:\n\n1) Actually correct!\n2) Present in Windows NT 5, 5.1, 5.2 and/or 6.0\n3) Not already accessible through another public header in the DDK, IFS, WDK and/or PSDK.\n4) From a publically verifiable source. The author needs to be able to search for your\n addition in a public information location (book, Internet, etc) and locate this definition.\n5) Not Reversed. Reversing a type is STRONGLY discouraged and a reversed type will more then likely\n not be accepted, due to the fact that functionality and naming will be entirely guessed, and things\n like unions are almost impossible to determine. It can also bring up possible legal ramifications\n depending on your location. However, using a tool to dump the strings inside an executable\n for the purpose of locating the actual name or definition of a structure (sometimes possible due\n to ASSERTs or debugging strings) is considered 'fair use' and will be a likely candidate.\n\nIf your addition satsfies these points, then please submit it, and also include whether or not\nyou would like to be credited for it.\n\n3. USAGE\n\n3.1 ORGANIZATION\n\n * The NDK is organized in a main folder (include/ndk) with arch-specific subfolders (ex: include/ndk/i386). \n * The NDK is structured by NT Subsystem Component (ex: ex, ps, rtl, etc). \n * The NDK can either be included on-demand (#include ) or globally (#include ).\n The former is recommended to reduce compile time. \n * The NDK is structured by function and type. Every Subsystem Component has an associated \"xxfuncs.h\" and\n \"xxtypes.h\" header, where \"xx\" is the Subsystem (ex: iofuncs.h, iotypes.h) \n * The NDK has a special file called \"umtypes.h\" which exports to User-Mode or Native-Mode Applications the\n basic NT types which are present in ntdef.h. This file cannot be included since it would conflict with\n winnt.h and/or windef.h. Thus, umtypes.h provides the missing types. This file is automatically included\n in a User-Mode NDK project. \n * The NDK also includes a file called \"umfuncs.h\" which exports to User-Mode or Native-Mode Applications\n undocumented functions which can only be accessed from ntdll.dll. \n * The NDK has another special file called \"ifssupp.h\", which exports to Kernel-Mode drivers a few types which\n are only documented in the IFS kit, and are part of some native definitions. It will be deprecated next year\n with the release of the WDK. \n\n3.2 USING IN YOUR PROJECT\n\n * User Mode Application requiring Native Types: \n\n #define WIN32_NO_STATUS /* Tell Windows headers you'll use ntstatus.s from NDK */\n #include \"windows.h\" /* Declare Windows Headers like you normally would */\n #include \"ntndk.h\" /* Declare the NDK Headers */\n\n * Native Mode Application: \n\n #include \"ntdef.h\" /* Declare basic native types. */\n #include \"ntndk.h\" /* Declare the NDK Headers */\n\n * Kernel Mode Driver: \n\n #include \"ntddk.h\" /* Declare DDK Headers like you normally would */\n #include \"ntndk.h\" /* Declare the NDK Headers */\n\n * You may also include only the files you need (example for User-Mode application):\n\n #define WIN32_NO_STATUS /* Tell Windows headers you'll use ntstatus.s from NDK */\n #include \"windows.h\" /* Declare Windows Headers like you normally would */\n #include \"rtlfuncs.h\" /* Declare the Rtl* Functions */\n\n3.3 CAVEATS\n\n * winternl.h: This header, part of the PSDK, was released by Microsoft as part of one of the governmen\n lawsuits against it, and documents a certain (minimal) part of the Native API and/or types. Unfortunately,\n Microsoft decided to hack the Native Types and to define them incorrectly, replacing real members by \"reserved\"\n ones. As such, you 'cannot include winternl.h in any project that uses the NDK. Note however, that the NDK fully\n replaces it and retains compatibility with any project that used it.\n * You must have the WDK installed if using the WDK, even for non-kernel applications, because ntntls.h is required." }, { "path": "ndk/rtlfuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n rtlfuncs.h\n\nAbstract:\n\n Function definitions for the Run-Time Library\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _RTLFUNCS_H\n#define _RTLFUNCS_H\n\n//\n// Dependencies\n//\n#include \n#include \n#include \n#include \n#include \"in6addr.h\"\n#include \"inaddr.h\"\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n\n#ifdef NTOS_MODE_USER\n\n//\n// List Functions\n//\nFORCEINLINE\nVOID\nInitializeListHead(\n IN PLIST_ENTRY ListHead\n)\n{\n ListHead->Flink = ListHead->Blink = ListHead;\n}\n\nFORCEINLINE\nVOID\nInsertHeadList(\n IN PLIST_ENTRY ListHead,\n IN PLIST_ENTRY Entry\n)\n{\n PLIST_ENTRY OldFlink;\n OldFlink = ListHead->Flink;\n Entry->Flink = OldFlink;\n Entry->Blink = ListHead;\n OldFlink->Blink = Entry;\n ListHead->Flink = Entry;\n}\n\nFORCEINLINE\nVOID\nInsertTailList(\n IN PLIST_ENTRY ListHead,\n IN PLIST_ENTRY Entry\n)\n{\n PLIST_ENTRY OldBlink;\n OldBlink = ListHead->Blink;\n Entry->Flink = ListHead;\n Entry->Blink = OldBlink;\n OldBlink->Flink = Entry;\n ListHead->Blink = Entry;\n}\n\nBOOLEAN\nFORCEINLINE\nIsListEmpty(\n IN const LIST_ENTRY * ListHead\n)\n{\n return (BOOLEAN)(ListHead->Flink == ListHead);\n}\n\nFORCEINLINE\nPSINGLE_LIST_ENTRY\nPopEntryList(\n PSINGLE_LIST_ENTRY ListHead\n)\n{\n PSINGLE_LIST_ENTRY FirstEntry;\n FirstEntry = ListHead->Next;\n if (FirstEntry != NULL) {\n ListHead->Next = FirstEntry->Next;\n }\n\n return FirstEntry;\n}\n\nFORCEINLINE\nVOID\nPushEntryList(\n PSINGLE_LIST_ENTRY ListHead,\n PSINGLE_LIST_ENTRY Entry\n)\n{\n Entry->Next = ListHead->Next;\n ListHead->Next = Entry;\n}\n\nFORCEINLINE\nBOOLEAN\nRemoveEntryList(\n IN PLIST_ENTRY Entry)\n{\n PLIST_ENTRY OldFlink;\n PLIST_ENTRY OldBlink;\n\n OldFlink = Entry->Flink;\n OldBlink = Entry->Blink;\n OldFlink->Blink = OldBlink;\n OldBlink->Flink = OldFlink;\n return (BOOLEAN)(OldFlink == OldBlink);\n}\n\nFORCEINLINE\nPLIST_ENTRY\nRemoveHeadList(\n IN PLIST_ENTRY ListHead)\n{\n PLIST_ENTRY Flink;\n PLIST_ENTRY Entry;\n\n Entry = ListHead->Flink;\n Flink = Entry->Flink;\n ListHead->Flink = Flink;\n Flink->Blink = ListHead;\n return Entry;\n}\n\nFORCEINLINE\nPLIST_ENTRY\nRemoveTailList(\n IN PLIST_ENTRY ListHead)\n{\n PLIST_ENTRY Blink;\n PLIST_ENTRY Entry;\n\n Entry = ListHead->Blink;\n Blink = Entry->Blink;\n ListHead->Blink = Blink;\n Blink->Flink = ListHead;\n return Entry;\n}\n\n//\n// Unicode string macros\n//\nFORCEINLINE\nVOID\nRtlInitEmptyUnicodeString(OUT PUNICODE_STRING UnicodeString,\n IN PWSTR Buffer,\n IN USHORT BufferSize)\n{\n UnicodeString->Length = 0;\n UnicodeString->MaximumLength = BufferSize;\n UnicodeString->Buffer = Buffer;\n}\n\n//\n// LUID Macros\n//\n#define RtlEqualLuid(L1, L2) (((L1)->HighPart == (L2)->HighPart) && \\\n ((L1)->LowPart == (L2)->LowPart))\nFORCEINLINE\nLUID\nNTAPI_INLINE\nRtlConvertUlongToLuid(ULONG Ulong)\n{\n LUID TempLuid;\n\n TempLuid.LowPart = Ulong;\n TempLuid.HighPart = 0;\n return TempLuid;\n}\n\n//\n// ASSERT Macros\n//\n#ifndef ASSERT\n#if DBG\n\n#define ASSERT( exp ) \\\n ((!(exp)) ? \\\n (RtlAssert( #exp, __FILE__, __LINE__, NULL ),FALSE) : \\\n TRUE)\n\n#define ASSERTMSG( msg, exp ) \\\n ((!(exp)) ? \\\n (RtlAssert( #exp, __FILE__, __LINE__, msg ),FALSE) : \\\n TRUE)\n\n#else\n\n#define ASSERT( exp ) ((void) 0)\n#define ASSERTMSG( msg, exp ) ((void) 0)\n\n#endif\n#endif\n\n#ifdef NTOS_KERNEL_RUNTIME\n\n//\n// Executing RTL functions at DISPATCH_LEVEL or higher will result in a\n// bugcheck.\n//\n#define RTL_PAGED_CODE PAGED_CODE\n\n#else\n\n//\n// This macro does nothing in user mode\n//\n#define RTL_PAGED_CODE NOP_FUNCTION\n\n#endif\n\n//\n// RTL Splay Tree Functions\n//\nNTSYSAPI\nPRTL_SPLAY_LINKS\nNTAPI\nRtlSplay(\n IN PRTL_SPLAY_LINKS Links\n);\n\nNTSYSAPI\nPRTL_SPLAY_LINKS\nNTAPI\nRtlDelete(IN PRTL_SPLAY_LINKS Links\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlDeleteNoSplay(\n IN PRTL_SPLAY_LINKS Links,\n OUT PRTL_SPLAY_LINKS *Root\n);\n\nNTSYSAPI\nPRTL_SPLAY_LINKS\nNTAPI\nRtlSubtreeSuccessor(\n IN PRTL_SPLAY_LINKS Links\n);\n\nNTSYSAPI\nPRTL_SPLAY_LINKS\nNTAPI\nRtlSubtreePredecessor(\n IN PRTL_SPLAY_LINKS Links\n);\n\nNTSYSAPI\nPRTL_SPLAY_LINKS\nNTAPI\nRtlRealSuccessor(\n IN PRTL_SPLAY_LINKS Links\n);\n\nNTSYSAPI\nPRTL_SPLAY_LINKS\nNTAPI\nRtlRealPredecessor(\n IN PRTL_SPLAY_LINKS Links\n);\n\n#define RtlIsLeftChild(Links) \\\n (RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))\n\n#define RtlIsRightChild(Links) \\\n (RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))\n\n#define RtlRightChild(Links) \\\n ((PRTL_SPLAY_LINKS)(Links))->RightChild\n\n#define RtlIsRoot(Links) \\\n (RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links))\n\n#define RtlLeftChild(Links) \\\n ((PRTL_SPLAY_LINKS)(Links))->LeftChild\n\n#define RtlParent(Links) \\\n ((PRTL_SPLAY_LINKS)(Links))->Parent\n\n#define RtlInitializeSplayLinks(Links) \\\n { \\\n PRTL_SPLAY_LINKS _SplayLinks; \\\n _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \\\n _SplayLinks->Parent = _SplayLinks; \\\n _SplayLinks->LeftChild = NULL; \\\n _SplayLinks->RightChild = NULL; \\\n }\n\n#define RtlInsertAsLeftChild(ParentLinks,ChildLinks) \\\n { \\\n PRTL_SPLAY_LINKS _SplayParent; \\\n PRTL_SPLAY_LINKS _SplayChild; \\\n _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \\\n _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \\\n _SplayParent->LeftChild = _SplayChild; \\\n _SplayChild->Parent = _SplayParent; \\\n }\n\n#define RtlInsertAsRightChild(ParentLinks,ChildLinks) \\\n { \\\n PRTL_SPLAY_LINKS _SplayParent; \\\n PRTL_SPLAY_LINKS _SplayChild; \\\n _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \\\n _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \\\n _SplayParent->RightChild = _SplayChild; \\\n _SplayChild->Parent = _SplayParent; \\\n }\n#endif\n\n//\n// Error and Exception Functions\n//\nNTSYSAPI\nPVOID\nNTAPI\nRtlAddVectoredExceptionHandler(\n IN ULONG FirstHandler,\n IN PVECTORED_EXCEPTION_HANDLER VectoredHandler\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlAssert(\n IN PVOID FailedAssertion,\n IN PVOID FileName,\n IN ULONG LineNumber,\n IN PCHAR Message\n);\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlSetUnhandledExceptionFilter(\n IN PVOID TopLevelExceptionFilter\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlCaptureContext(\n OUT PCONTEXT ContextRecord\n);\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlEncodePointer(\n IN PVOID Pointer\n);\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlDecodePointer(\n IN PVOID Pointer\n);\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlEncodeSystemPointer(\n IN PVOID Pointer\n);\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlDecodeSystemPointer(\n IN PVOID Pointer\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlDispatchException(\n IN PEXCEPTION_RECORD ExceptionRecord,\n IN PCONTEXT Context\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlNtStatusToDosError(\n IN NTSTATUS Status\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetLastWin32ErrorAndNtStatusFromNtStatus(\n IN NTSTATUS Status\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlRaiseException(\n IN PEXCEPTION_RECORD ExceptionRecord\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlRaiseStatus(\n IN NTSTATUS Status\n);\n\nNTSYSAPI\nLONG\nNTAPI\nRtlUnhandledExceptionFilter(\n IN struct _EXCEPTION_POINTERS* ExceptionInfo\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlUnwind(\n IN PVOID TargetFrame OPTIONAL,\n IN PVOID TargetIp OPTIONAL,\n IN PEXCEPTION_RECORD ExceptionRecord OPTIONAL,\n IN PVOID ReturnValue\n);\n\n//\n// Tracing Functions\n//\nNTSYSAPI\nULONG\nNTAPI\nRtlWalkFrameChain(\n OUT PVOID *Callers,\n IN ULONG Count,\n IN ULONG Flags\n);\n\nNTSYSAPI\nUSHORT\nNTAPI\nRtlLogStackBackTrace(\n VOID\n);\n\n//\n// Heap Functions\n//\nNTSYSAPI\nPVOID\nNTAPI\nRtlAllocateHeap(\n IN HANDLE HeapHandle,\n IN ULONG Flags,\n IN ULONG Size\n);\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlCreateHeap(\n IN ULONG Flags,\n IN PVOID BaseAddress OPTIONAL,\n IN SIZE_T SizeToReserve OPTIONAL,\n IN SIZE_T SizeToCommit OPTIONAL,\n IN PVOID Lock OPTIONAL,\n IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlCreateTagHeap(\n IN HANDLE HeapHandle,\n IN ULONG Flags,\n IN PWSTR TagName,\n IN PWSTR TagSubName\n);\n\nULONG\nNTAPI\nRtlCompactHeap(\n HANDLE Heap,\n ULONG Flags\n);\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlDebugCreateHeap(\n IN ULONG Flags,\n IN PVOID BaseAddress OPTIONAL,\n IN SIZE_T SizeToReserve OPTIONAL,\n IN SIZE_T SizeToCommit OPTIONAL,\n IN PVOID Lock OPTIONAL,\n IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL\n);\n\nNTSYSAPI\nHANDLE\nNTAPI\nRtlDestroyHeap(\n IN HANDLE Heap\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlExtendHeap(\n IN HANDLE Heap,\n IN ULONG Flags,\n IN PVOID P,\n IN ULONG Size\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlFreeHeap(\n IN HANDLE HeapHandle,\n IN ULONG Flags,\n IN PVOID P\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlGetNtGlobalFlags(\n VOID\n);\n\nULONG\nNTAPI\nRtlGetProcessHeaps(\n ULONG HeapCount,\n HANDLE *HeapArray\n);\n\nBOOLEAN\nNTAPI\nRtlGetUserInfoHeap(\n IN PVOID HeapHandle,\n IN ULONG Flags,\n IN PVOID BaseAddress,\n OUT PVOID *UserValue,\n OUT PULONG UserFlags\n);\n\nNTSYSAPI\nPWSTR\nNTAPI\nRtlQueryTagHeap(\n IN PVOID HeapHandle,\n IN ULONG Flags,\n IN USHORT TagIndex,\n IN BOOLEAN ResetCounters,\n OUT PRTL_HEAP_TAG_INFO HeapTagInfo\n);\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlReAllocateHeap(\n HANDLE Heap,\n ULONG Flags,\n PVOID Ptr,\n SIZE_T Size\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlLockHeap(\n IN HANDLE Heap\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUsageHeap(\n IN HANDLE Heap,\n IN ULONG Flags,\n OUT PRTL_HEAP_USAGE Usage\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlUnlockHeap(\n IN HANDLE Heap\n);\n\nBOOLEAN\nNTAPI\nRtlSetUserValueHeap(\n IN PVOID HeapHandle,\n IN ULONG Flags,\n IN PVOID BaseAddress,\n IN PVOID UserValue\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlSizeHeap(\n IN PVOID HeapHandle,\n IN ULONG Flags,\n IN PVOID MemoryPointer\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlValidateHeap(\n HANDLE Heap,\n ULONG Flags,\n PVOID P\n);\n\n#define RtlGetProcessHeap() (NtCurrentPeb()->ProcessHeap)\n\n//\n// Security Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAbsoluteToSelfRelativeSD(\n IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor,\n IN OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,\n IN PULONG BufferLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessAllowedAce(\n PACL Acl,\n ULONG Revision,\n ACCESS_MASK AccessMask,\n PSID Sid\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessAllowedAceEx(\n IN OUT PACL pAcl,\n IN ULONG dwAceRevision,\n IN ULONG AceFlags,\n IN ACCESS_MASK AccessMask,\n IN PSID pSid\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessAllowedObjectAce(\n IN OUT PACL pAcl,\n IN ULONG dwAceRevision,\n IN ULONG AceFlags,\n IN ACCESS_MASK AccessMask,\n IN GUID *ObjectTypeGuid OPTIONAL,\n IN GUID *InheritedObjectTypeGuid OPTIONAL,\n IN PSID pSid\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessDeniedAce(\n PACL Acl,\n ULONG Revision,\n ACCESS_MASK AccessMask,\n PSID Sid\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessDeniedAceEx(\n IN OUT PACL Acl,\n IN ULONG Revision,\n IN ULONG Flags,\n IN ACCESS_MASK AccessMask,\n IN PSID Sid\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessDeniedObjectAce(\n IN OUT PACL pAcl,\n IN ULONG dwAceRevision,\n IN ULONG AceFlags,\n IN ACCESS_MASK AccessMask,\n IN GUID *ObjectTypeGuid OPTIONAL,\n IN GUID *InheritedObjectTypeGuid OPTIONAL,\n IN PSID pSid\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAce(\n PACL Acl,\n ULONG AceRevision,\n ULONG StartingAceIndex,\n PVOID AceList,\n ULONG AceListLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAuditAccessAce(\n PACL Acl,\n ULONG Revision,\n ACCESS_MASK AccessMask,\n PSID Sid,\n BOOLEAN Success,\n BOOLEAN Failure\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAcquirePrivilege(\n IN PULONG Privilege,\n IN ULONG NumPriv,\n IN ULONG Flags,\n OUT PVOID *ReturnedState\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAuditAccessAceEx(\n IN OUT PACL Acl,\n IN ULONG Revision,\n IN ULONG Flags,\n IN ACCESS_MASK AccessMask,\n IN PSID Sid,\n IN BOOLEAN Success,\n IN BOOLEAN Failure\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAuditAccessObjectAce(\n IN OUT PACL Acl,\n IN ULONG Revision,\n IN ULONG Flags,\n IN ACCESS_MASK AccessMask,\n IN GUID *ObjectTypeGuid OPTIONAL,\n IN GUID *InheritedObjectTypeGuid OPTIONAL,\n IN PSID Sid,\n IN BOOLEAN Success,\n IN BOOLEAN Failure\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddMandatoryAce(\n IN OUT PACL Acl,\n IN ULONG Revision,\n IN ULONG Flags,\n IN ULONG MandatoryFlags,\n IN ULONG AceType,\n IN PSID LabelSid);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAdjustPrivilege(\n IN ULONG Privilege,\n IN BOOLEAN NewValue,\n IN BOOLEAN ForThread,\n OUT PBOOLEAN OldValue\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAllocateAndInitializeSid(\n IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,\n IN UCHAR SubAuthorityCount,\n IN ULONG SubAuthority0,\n IN ULONG SubAuthority1,\n IN ULONG SubAuthority2,\n IN ULONG SubAuthority3,\n IN ULONG SubAuthority4,\n IN ULONG SubAuthority5,\n IN ULONG SubAuthority6,\n IN ULONG SubAuthority7,\n OUT PSID *Sid\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlAreAllAccessesGranted(\n ACCESS_MASK GrantedAccess,\n ACCESS_MASK DesiredAccess\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlAreAnyAccessesGranted(\n ACCESS_MASK GrantedAccess,\n ACCESS_MASK DesiredAccess\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlCopyLuid(\n IN PLUID LuidDest,\n IN PLUID LuidSrc\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlCopyLuidAndAttributesArray(\n ULONG Count,\n PLUID_AND_ATTRIBUTES Src,\n PLUID_AND_ATTRIBUTES Dest\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCopySidAndAttributesArray(\n ULONG Count,\n PSID_AND_ATTRIBUTES Src,\n ULONG SidAreaSize,\n PSID_AND_ATTRIBUTES Dest,\n PVOID SidArea,\n PVOID* RemainingSidArea,\n PULONG RemainingSidAreaSize\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlConvertSidToUnicodeString(\n OUT PUNICODE_STRING DestinationString,\n IN PSID Sid,\n IN BOOLEAN AllocateDestinationString\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCopySid(\n IN ULONG Length,\n IN PSID Destination,\n IN PSID Source\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateAcl(\n PACL Acl,\n ULONG AclSize,\n ULONG AclRevision\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateSecurityDescriptor(\n OUT PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN ULONG Revision\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateSecurityDescriptorRelative(\n OUT PISECURITY_DESCRIPTOR_RELATIVE SecurityDescriptor,\n IN ULONG Revision\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCopySecurityDescriptor(\n IN PSECURITY_DESCRIPTOR pSourceSecurityDescriptor,\n OUT PSECURITY_DESCRIPTOR pDestinationSecurityDescriptor\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteAce(\n PACL Acl,\n ULONG AceIndex\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlEqualPrefixSid(\n PSID Sid1,\n PSID Sid2\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlEqualSid (\n IN PSID Sid1,\n IN PSID Sid2\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlFirstFreeAce(\n PACL Acl,\n PACE* Ace\n);\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlFreeSid (\n IN PSID Sid\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetAce(\n PACL Acl,\n ULONG AceIndex,\n PVOID *Ace\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetControlSecurityDescriptor(\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n OUT PSECURITY_DESCRIPTOR_CONTROL Control,\n OUT PULONG Revision\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetDaclSecurityDescriptor(\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n OUT PBOOLEAN DaclPresent,\n OUT PACL *Dacl,\n OUT PBOOLEAN DaclDefaulted\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetSaclSecurityDescriptor(\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n OUT PBOOLEAN SaclPresent,\n OUT PACL* Sacl,\n OUT PBOOLEAN SaclDefaulted\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetGroupSecurityDescriptor(\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n OUT PSID *Group,\n OUT PBOOLEAN GroupDefaulted\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetOwnerSecurityDescriptor(\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n OUT PSID *Owner,\n OUT PBOOLEAN OwnerDefaulted\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlGetSecurityDescriptorRMControl(\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n OUT PUCHAR RMControl\n);\n\nNTSYSAPI\nPSID_IDENTIFIER_AUTHORITY\nNTAPI\nRtlIdentifierAuthoritySid(PSID Sid);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlImpersonateSelf(IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInitializeSid(\n IN OUT PSID Sid,\n IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,\n IN UCHAR SubAuthorityCount\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlLengthRequiredSid(IN ULONG SubAuthorityCount);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlLengthSid(IN PSID Sid);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlMakeSelfRelativeSD(\n IN PSECURITY_DESCRIPTOR AbsoluteSD,\n OUT PSECURITY_DESCRIPTOR SelfRelativeSD,\n IN OUT PULONG BufferLength);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlMapGenericMask(\n PACCESS_MASK AccessMask,\n PGENERIC_MAPPING GenericMapping\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryInformationAcl(\n PACL Acl,\n PVOID Information,\n ULONG InformationLength,\n ACL_INFORMATION_CLASS InformationClass\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlReleasePrivilege(\n IN PVOID ReturnedState\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSelfRelativeToAbsoluteSD(\n IN PSECURITY_DESCRIPTOR SelfRelativeSD,\n OUT PSECURITY_DESCRIPTOR AbsoluteSD,\n IN PULONG AbsoluteSDSize,\n IN PACL Dacl,\n IN PULONG DaclSize,\n IN PACL Sacl,\n IN PULONG SaclSize,\n IN PSID Owner,\n IN PULONG OwnerSize,\n IN PSID PrimaryGroup,\n IN PULONG PrimaryGroupSize\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSelfRelativeToAbsoluteSD2(\n IN OUT PSECURITY_DESCRIPTOR SelfRelativeSD,\n OUT PULONG BufferSize\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetAttributesSecurityDescriptor(\n IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN SECURITY_DESCRIPTOR_CONTROL Control,\n OUT PULONG Revision\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetControlSecurityDescriptor(\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest,\n IN SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetDaclSecurityDescriptor (\n IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN BOOLEAN DaclPresent,\n IN PACL Dacl,\n IN BOOLEAN DaclDefaulted\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetGroupSecurityDescriptor(\n IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN PSID Group,\n IN BOOLEAN GroupDefaulted\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetInformationAcl(\n PACL Acl,\n PVOID Information,\n ULONG InformationLength,\n ACL_INFORMATION_CLASS InformationClass\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetOwnerSecurityDescriptor(\n IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN PSID Owner,\n IN BOOLEAN OwnerDefaulted\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetSaclSecurityDescriptor(\n IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN BOOLEAN SaclPresent,\n IN PACL Sacl,\n IN BOOLEAN SaclDefaulted\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetSecurityDescriptorRMControl(\n IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN PUCHAR RMControl\n);\n\nNTSYSAPI\nPUCHAR\nNTAPI\nRtlSubAuthorityCountSid(\n IN PSID Sid\n);\n\nNTSYSAPI\nPULONG\nNTAPI\nRtlSubAuthoritySid(\n IN PSID Sid,\n IN ULONG SubAuthority\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlValidRelativeSecurityDescriptor(\n IN PSECURITY_DESCRIPTOR SecurityDescriptorInput,\n IN ULONG SecurityDescriptorLength,\n IN SECURITY_INFORMATION RequiredInformation\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlValidSecurityDescriptor(IN PSECURITY_DESCRIPTOR SecurityDescriptor);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlValidSid(IN PSID Sid);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlValidAcl(PACL Acl);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteSecurityObject(\n IN PSECURITY_DESCRIPTOR *ObjectDescriptor\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlNewSecurityObject(\n IN PSECURITY_DESCRIPTOR ParentDescriptor,\n IN PSECURITY_DESCRIPTOR CreatorDescriptor,\n OUT PSECURITY_DESCRIPTOR *NewDescriptor,\n IN BOOLEAN IsDirectoryObject,\n IN HANDLE Token,\n IN PGENERIC_MAPPING GenericMapping\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQuerySecurityObject(\n IN PSECURITY_DESCRIPTOR ObjectDescriptor,\n IN SECURITY_INFORMATION SecurityInformation,\n OUT PSECURITY_DESCRIPTOR ResultantDescriptor,\n IN ULONG DescriptorLength,\n OUT PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetSecurityObject(\n IN SECURITY_INFORMATION SecurityInformation,\n IN PSECURITY_DESCRIPTOR ModificationDescriptor,\n OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,\n IN PGENERIC_MAPPING GenericMapping,\n IN HANDLE Token\n);\n\n//\n// Single-Character Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLargeIntegerToChar(\n IN PLARGE_INTEGER Value,\n IN ULONG Base,\n IN ULONG Length,\n IN OUT PCHAR String\n);\n\nNTSYSAPI\nCHAR\nNTAPI\nRtlUpperChar(CHAR Source);\n\nNTSYSAPI\nWCHAR\nNTAPI\nRtlUpcaseUnicodeChar(WCHAR Source);\n\nNTSYSAPI\nWCHAR\nNTAPI\nRtlDowncaseUnicodeChar(IN WCHAR Source);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIntegerToChar(\n IN ULONG Value,\n IN ULONG Base,\n IN ULONG Length,\n IN OUT PCHAR String\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIntegerToUnicode(\n IN ULONG Value,\n IN ULONG Base OPTIONAL,\n IN ULONG Length OPTIONAL,\n IN OUT LPWSTR String\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIntegerToUnicodeString(\n IN ULONG Value,\n IN ULONG Base,\n IN OUT PUNICODE_STRING String\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCharToInteger(\n PCSZ String,\n ULONG Base,\n PULONG Value\n);\n\n//\n// Byte Swap Functions\n//\n#if (defined(_M_IX86) && (_MSC_FULL_VER > 13009037)) || \\\n ((defined(_M_AMD64) || \\\n defined(_M_IA64)) && (_MSC_FULL_VER > 13009175))\n\nunsigned short __cdecl _byteswap_ushort(unsigned short);\nunsigned long __cdecl _byteswap_ulong (unsigned long);\nunsigned __int64 __cdecl _byteswap_uint64(unsigned __int64);\n#pragma intrinsic(_byteswap_ushort)\n#pragma intrinsic(_byteswap_ulong)\n#pragma intrinsic(_byteswap_uint64)\n#define RtlUshortByteSwap(_x) _byteswap_ushort((USHORT)(_x))\n#define RtlUlongByteSwap(_x) _byteswap_ulong((_x))\n#define RtlUlonglongByteSwap(_x) _byteswap_uint64((_x))\n\n#else\n\nNTSYSAPI\nUSHORT\nFASTCALL\nRtlUshortByteSwap(IN USHORT Source);\n\nNTSYSAPI\nULONG\nFASTCALL\nRtlUlongByteSwap(IN ULONG Source);\n\nNTSYSAPI\nULONGLONG\nFASTCALL\nRtlUlonglongByteSwap(IN ULONGLONG Source);\n\n#endif\n\n//\n// Unicode->Ansi String Functions\n//\nNTSYSAPI\nULONG\nNTAPI\nRtlxUnicodeStringToAnsiSize(IN PCUNICODE_STRING UnicodeString);\n\n#ifdef NTOS_MODE_USER\n\n#define RtlUnicodeStringToAnsiSize(STRING) ( \\\n NLS_MB_CODE_PAGE_TAG ? \\\n RtlxUnicodeStringToAnsiSize(STRING) : \\\n ((STRING)->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR) \\\n)\n\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeStringToAnsiString(\n PANSI_STRING DestinationString,\n PCUNICODE_STRING SourceString,\n BOOLEAN AllocateDestinationString\n);\n\n//\n// Unicode->OEM String Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeStringToOemString(\n POEM_STRING DestinationString,\n PCUNICODE_STRING SourceString,\n BOOLEAN AllocateDestinationString\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeStringToAnsiString(\n PANSI_STRING DestinationString,\n PCUNICODE_STRING SourceString,\n BOOLEAN AllocateDestinationString\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeStringToCountedOemString(\n IN OUT POEM_STRING DestinationString,\n IN PCUNICODE_STRING SourceString,\n IN BOOLEAN AllocateDestinationString\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeStringToOemString(\n POEM_STRING DestinationString,\n PCUNICODE_STRING SourceString,\n BOOLEAN AllocateDestinationString\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeToOemN(\n PCHAR OemString,\n ULONG OemSize,\n PULONG ResultSize,\n PWCHAR UnicodeString,\n ULONG UnicodeSize\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlxUnicodeStringToOemSize(IN PCUNICODE_STRING UnicodeString);\n\n#ifdef NTOS_MODE_USER\n\n#define RtlUnicodeStringToOemSize(STRING) ( \\\n NLS_MB_OEM_CODE_PAGE_TAG ? \\\n RtlxUnicodeStringToOemSize(STRING) : \\\n ((STRING)->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR) \\\n)\n\n#define RtlUnicodeStringToCountedOemSize(STRING) ( \\\n (ULONG)(RtlUnicodeStringToOemSize(STRING) - sizeof(ANSI_NULL)) \\\n)\n\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeToOemN(\n PCHAR OemString,\n ULONG OemSize,\n PULONG ResultSize,\n PWCHAR UnicodeString,\n ULONG UnicodeSize\n);\n\n//\n// Unicode->MultiByte String Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeToMultiByteN(\n PCHAR MbString,\n ULONG MbSize,\n PULONG ResultSize,\n PWCHAR UnicodeString,\n ULONG UnicodeSize\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeToMultiByteN(\n PCHAR MbString,\n ULONG MbSize,\n PULONG ResultSize,\n PWCHAR UnicodeString,\n ULONG UnicodeSize\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeToMultiByteSize(\n PULONG MbSize,\n PWCHAR UnicodeString,\n ULONG UnicodeSize\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlxOemStringToUnicodeSize(IN PCOEM_STRING OemString);\n\n//\n// OEM to Unicode Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlOemStringToUnicodeString(\n PUNICODE_STRING DestinationString,\n PCOEM_STRING SourceString,\n BOOLEAN AllocateDestinationString\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlOemToUnicodeN(\n PWSTR UnicodeString,\n ULONG MaxBytesInUnicodeString,\n PULONG BytesInUnicodeString,\n IN PCHAR OemString,\n ULONG BytesInOemString\n);\n\n#ifdef NTOS_MODE_USER\n\n#define RtlOemStringToUnicodeSize(STRING) ( \\\n NLS_MB_OEM_CODE_PAGE_TAG ? \\\n RtlxOemStringToUnicodeSize(STRING) : \\\n ((STRING)->Length + sizeof(ANSI_NULL)) * sizeof(WCHAR) \\\n)\n\n#define RtlOemStringToCountedUnicodeSize(STRING) ( \\\n (ULONG)(RtlOemStringToUnicodeSize(STRING) - sizeof(UNICODE_NULL)) \\\n)\n\n#endif\n\n//\n// Ansi->Unicode String Functions\n//\nNTSYSAPI\nULONG\nNTAPI\nRtlxAnsiStringToUnicodeSize(\n PCANSI_STRING AnsiString\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAnsiStringToUnicodeString(\n PUNICODE_STRING DestinationString,\n PCANSI_STRING SourceString,\n BOOLEAN AllocateDestinationString\n);\n\n#ifdef NTOS_MODE_USER\n\n#define RtlAnsiStringToUnicodeSize(STRING) ( \\\n NLS_MB_CODE_PAGE_TAG ? \\\n RtlxAnsiStringToUnicodeSize(STRING) : \\\n ((STRING)->Length + sizeof(ANSI_NULL)) * sizeof(WCHAR) \\\n)\n\n#endif\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlCreateUnicodeStringFromAsciiz(\n OUT PUNICODE_STRING Destination,\n IN PCSZ Source\n);\n\n//\n// Unicode String Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAppendUnicodeToString(\n PUNICODE_STRING Destination,\n PCWSTR Source\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAppendUnicodeStringToString(\n PUNICODE_STRING Destination,\n PCUNICODE_STRING Source\n);\n\nNTSYSAPI\nLONG\nNTAPI\nRtlCompareUnicodeString(\n PCUNICODE_STRING String1,\n PCUNICODE_STRING String2,\n BOOLEAN CaseInsensitive\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlCopyUnicodeString(\n PUNICODE_STRING DestinationString,\n PCUNICODE_STRING SourceString\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlCreateUnicodeString(\n PUNICODE_STRING DestinationString,\n PCWSTR SourceString\n);\n\n#ifdef NTOS_MODE_USER\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDowncaseUnicodeString(\n IN OUT PUNICODE_STRING UniDest,\n IN PCUNICODE_STRING UniSource,\n IN BOOLEAN AllocateDestinationString\n);\n\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDuplicateUnicodeString(\n IN ULONG Flags,\n IN PCUNICODE_STRING SourceString,\n OUT PUNICODE_STRING DestinationString\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlEqualUnicodeString(\n PCUNICODE_STRING String1,\n PCUNICODE_STRING String2,\n BOOLEAN CaseInsensitive\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFindCharInUnicodeString(\n IN ULONG Flags,\n IN PUNICODE_STRING SearchString,\n IN PCUNICODE_STRING MatchString,\n OUT PUSHORT Position\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlFreeUnicodeString(IN PUNICODE_STRING UnicodeString);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlHashUnicodeString(\n IN CONST UNICODE_STRING *String,\n IN BOOLEAN CaseInSensitive,\n IN ULONG HashAlgorithm,\n OUT PULONG HashValue\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitUnicodeString(\n IN OUT PUNICODE_STRING DestinationString,\n IN PCWSTR SourceString\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInitUnicodeStringEx(\n OUT PUNICODE_STRING DestinationString,\n IN PCWSTR SourceString OPTIONAL\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlIsTextUnicode(\n PVOID Buffer,\n ULONG Length,\n ULONG *Flags\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlPrefixString(\n PCANSI_STRING String1,\n PCANSI_STRING String2,\n BOOLEAN CaseInsensitive\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlPrefixUnicodeString(\n PCUNICODE_STRING String1,\n PCUNICODE_STRING String2,\n BOOLEAN CaseInsensitive\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeString(\n PUNICODE_STRING DestinationString,\n PCUNICODE_STRING SourceString,\n BOOLEAN AllocateDestinationString\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeStringToInteger(\n PCUNICODE_STRING String,\n ULONG Base,\n PULONG Value\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlValidateUnicodeString(\n IN ULONG Flags,\n IN PCUNICODE_STRING String\n);\n\n//\n// Ansi String Functions\n//\nNTSYSAPI\nVOID\nNTAPI\nRtlFreeAnsiString(IN PANSI_STRING AnsiString);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitAnsiString(\n PANSI_STRING DestinationString,\n PCSZ SourceString\n);\n\n//\n// OEM String Functions\n//\nNTSYSAPI\nVOID\nNTAPI\nRtlFreeOemString(IN POEM_STRING OemString);\n\n//\n// MultiByte->Unicode String Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlMultiByteToUnicodeN(\n PWCHAR UnicodeString,\n ULONG UnicodeSize,\n PULONG ResultSize,\n PCSTR MbString,\n ULONG MbSize\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlMultiByteToUnicodeSize(\n PULONG UnicodeSize,\n PCSTR MbString,\n ULONG MbSize\n);\n\n//\n// Atom Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAtomToAtomTable(\n IN PRTL_ATOM_TABLE AtomTable,\n IN PWSTR AtomName,\n OUT PRTL_ATOM Atom\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateAtomTable(\n IN ULONG TableSize,\n IN OUT PRTL_ATOM_TABLE *AtomTable\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteAtomFromAtomTable(\n IN PRTL_ATOM_TABLE AtomTable,\n IN RTL_ATOM Atom\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDestroyAtomTable(IN PRTL_ATOM_TABLE AtomTable);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryAtomInAtomTable(\n IN PRTL_ATOM_TABLE AtomTable,\n IN RTL_ATOM Atom,\n IN OUT PULONG RefCount OPTIONAL,\n IN OUT PULONG PinCount OPTIONAL,\n IN OUT PWSTR AtomName OPTIONAL,\n IN OUT PULONG NameLength OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlPinAtomInAtomTable(\n IN PRTL_ATOM_TABLE AtomTable,\n IN RTL_ATOM Atom\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLookupAtomInAtomTable(\n IN PRTL_ATOM_TABLE AtomTable,\n IN PWSTR AtomName,\n OUT PRTL_ATOM Atom\n);\n\n//\n// Memory Functions\n//\nNTSYSAPI\nVOID\nNTAPI\nRtlFillMemoryUlong(\n IN PVOID Destination,\n IN ULONG Length,\n IN ULONG Fill\n);\n\n//\n// Process Management Functions\n//\nNTSYSAPI\nVOID\nNTAPI\nRtlAcquirePebLock(VOID);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateProcessParameters (\n OUT PRTL_USER_PROCESS_PARAMETERS *ProcessParameters,\n IN PUNICODE_STRING ImagePathName OPTIONAL,\n IN PUNICODE_STRING DllPath OPTIONAL,\n IN PUNICODE_STRING CurrentDirectory OPTIONAL,\n IN PUNICODE_STRING CommandLine OPTIONAL,\n IN PWSTR Environment OPTIONAL,\n IN PUNICODE_STRING WindowTitle OPTIONAL,\n IN PUNICODE_STRING DesktopInfo OPTIONAL,\n IN PUNICODE_STRING ShellInfo OPTIONAL,\n IN PUNICODE_STRING RuntimeInfo OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateUserProcess(\n IN PUNICODE_STRING ImageFileName,\n IN ULONG Attributes,\n IN PRTL_USER_PROCESS_PARAMETERS ProcessParameters,\n IN PSECURITY_DESCRIPTOR ProcessSecutityDescriptor OPTIONAL,\n IN PSECURITY_DESCRIPTOR ThreadSecurityDescriptor OPTIONAL,\n IN HANDLE ParentProcess OPTIONAL,\n IN BOOLEAN CurrentDirectory,\n IN HANDLE DebugPort OPTIONAL,\n IN HANDLE ExceptionPort OPTIONAL,\n OUT PRTL_USER_PROCESS_INFORMATION ProcessInfo\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateUserThread(\n IN HANDLE ProcessHandle,\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN BOOLEAN CreateSuspended,\n IN ULONG StackZeroBits,\n IN SIZE_T StackReserve,\n IN SIZE_T StackCommit,\n IN PTHREAD_START_ROUTINE StartAddress,\n IN PVOID Parameter,\n IN OUT PHANDLE ThreadHandle,\n IN OUT PCLIENT_ID ClientId\n);\n\nNTSYSAPI\nPRTL_USER_PROCESS_PARAMETERS\nNTAPI\nRtlDeNormalizeProcessParams(IN PRTL_USER_PROCESS_PARAMETERS ProcessParameters);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDestroyProcessParameters(IN PRTL_USER_PROCESS_PARAMETERS ProcessParameters);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlExitUserThread(NTSTATUS Status);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeContext(\n IN HANDLE ProcessHandle,\n OUT PCONTEXT ThreadContext,\n IN PVOID ThreadStartParam OPTIONAL,\n IN PTHREAD_START_ROUTINE ThreadStartAddress,\n IN PINITIAL_TEB InitialTeb\n);\n\nNTSYSAPI\nPRTL_USER_PROCESS_PARAMETERS\nNTAPI\nRtlNormalizeProcessParams(IN PRTL_USER_PROCESS_PARAMETERS ProcessParameters);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlReleasePebLock(VOID);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetProcessIsCritical(\n IN BOOLEAN NewValue,\n OUT PBOOLEAN OldValue OPTIONAL,\n IN BOOLEAN IsWinlogon\n);\n\n#define NtCurrentPeb() (NtCurrentTeb()->ProcessEnvironmentBlock)\n\n//\n// Thread Pool Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueueWorkItem(\n IN WORKERCALLBACKFUNC Function,\n IN PVOID Context OPTIONAL,\n IN ULONG Flags\n);\n\n//\n// Environment/Path Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateEnvironment(\n BOOLEAN Inherit,\n PWSTR *Environment\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlComputePrivatizedDllName_U(\n IN PUNICODE_STRING DllName,\n OUT PUNICODE_STRING RealName,\n OUT PUNICODE_STRING LocalName\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlDestroyEnvironment(\n IN PWSTR Environment\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlDoesFileExists_U(\n IN PCWSTR FileName\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlDoesFileExists_UstrEx(\n IN PCUNICODE_STRING FileName,\n IN BOOLEAN SucceedIfBusy\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlDetermineDosPathNameType_U(\n IN PCWSTR Path\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlDetermineDosPathNameType_Ustr(\n IN PCUNICODE_STRING Path\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlDosSearchPath_U(\n IN PCWSTR Path,\n IN PCWSTR FileName,\n IN PCWSTR Extension,\n IN ULONG BufferSize,\n OUT PWSTR Buffer,\n OUT PWSTR *PartName\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlDosPathNameToNtPathName_U(\n IN PCWSTR DosPathName,\n OUT PUNICODE_STRING NtPathName,\n OUT PCWSTR *NtFileNamePart,\n OUT CURDIR *DirectoryInfo\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlExpandEnvironmentStrings_U(\n PWSTR Environment,\n PUNICODE_STRING Source,\n PUNICODE_STRING Destination,\n PULONG Length\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlGetCurrentDirectory_U(\n ULONG MaximumLength,\n PWSTR Buffer\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlGetFullPathName_U(\n IN PCWSTR FileName,\n IN ULONG Size,\n IN PWSTR Buffer,\n OUT PWSTR *ShortName\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlGetFullPathName_Ustr(\n IN PUNICODE_STRING FileName,\n IN ULONG Size,\n IN PWSTR Buffer,\n OUT PWSTR *ShortName,\n OUT PBOOLEAN InvalidName,\n OUT RTL_PATH_TYPE *PathType\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlIsDosDeviceName_U(\n IN PWSTR Name\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlIsDosDeviceName_Ustr(\n IN PUNICODE_STRING Name\n);\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsNameLegalDOS8Dot3(\n IN PCUNICODE_STRING Name,\n IN OUT POEM_STRING OemName OPTIONAL,\n IN OUT PBOOLEAN NameContainsSpaces OPTIONAL\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryEnvironmentVariable_U(\n PWSTR Environment,\n PUNICODE_STRING Name,\n PUNICODE_STRING Value\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetCurrentDirectory_U(\n IN PUNICODE_STRING name\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetEnvironmentVariable(\n PWSTR *Environment,\n PUNICODE_STRING Name,\n PUNICODE_STRING Value\n);\n\n//\n// Critical Section/Resource Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteCriticalSection (\n IN PRTL_CRITICAL_SECTION CriticalSection\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlEnterCriticalSection(\n IN PRTL_CRITICAL_SECTION CriticalSection\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInitializeCriticalSection(\n IN PRTL_CRITICAL_SECTION CriticalSection\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInitializeCriticalSectionAndSpinCount(\n IN PRTL_CRITICAL_SECTION CriticalSection,\n IN ULONG SpinCount\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLeaveCriticalSection(\n IN PRTL_CRITICAL_SECTION CriticalSection\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlTryEnterCriticalSection(\n IN PRTL_CRITICAL_SECTION CriticalSection\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlpUnWaitCriticalSection(\n IN PRTL_CRITICAL_SECTION CriticalSection\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlpWaitForCriticalSection(\n IN PRTL_CRITICAL_SECTION CriticalSection\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlAcquireResourceExclusive(\n IN PRTL_RESOURCE Resource,\n IN BOOLEAN Wait\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlAcquireResourceShared(\n IN PRTL_RESOURCE Resource,\n IN BOOLEAN Wait\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlConvertExclusiveToShared(\n IN PRTL_RESOURCE Resource\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlConvertSharedToExclusive(\n IN PRTL_RESOURCE Resource\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlDeleteResource(\n IN PRTL_RESOURCE Resource\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlDumpResource(\n IN PRTL_RESOURCE Resource\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeResource(\n IN PRTL_RESOURCE Resource\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlReleaseResource(\n IN PRTL_RESOURCE Resource\n);\n\n//\n// Compression Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCompressBuffer(\n IN USHORT CompressionFormatAndEngine,\n IN PUCHAR UncompressedBuffer,\n IN ULONG UncompressedBufferSize,\n OUT PUCHAR CompressedBuffer,\n IN ULONG CompressedBufferSize,\n IN ULONG UncompressedChunkSize,\n OUT PULONG FinalCompressedSize,\n IN PVOID WorkSpace\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDecompressBuffer(\n IN USHORT CompressionFormat,\n OUT PUCHAR UncompressedBuffer,\n IN ULONG UncompressedBufferSize,\n IN PUCHAR CompressedBuffer,\n IN ULONG CompressedBufferSize,\n OUT PULONG FinalUncompressedSize\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetCompressionWorkSpaceSize(\n IN USHORT CompressionFormatAndEngine,\n OUT PULONG CompressBufferWorkSpaceSize,\n OUT PULONG CompressFragmentWorkSpaceSize\n);\n\n//\n// Debug Info Functions\n//\nNTSYSAPI\nPRTL_DEBUG_INFORMATION\nNTAPI\nRtlCreateQueryDebugBuffer(\n IN ULONG Size,\n IN BOOLEAN EventPair\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDestroyQueryDebugBuffer(IN PRTL_DEBUG_INFORMATION DebugBuffer);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryProcessDebugInformation(\n IN ULONG ProcessId,\n IN ULONG DebugInfoClassMask,\n IN OUT PRTL_DEBUG_INFORMATION DebugBuffer\n);\n\n//\n// Bitmap Functions\n//\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlAreBitsClear(\n IN PRTL_BITMAP BitMapHeader,\n IN ULONG StartingIndex,\n IN ULONG Length\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlAreBitsSet(\n IN PRTL_BITMAP BitMapHeader,\n IN ULONG StartingIndex,\n IN ULONG Length\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlClearBits(\n IN PRTL_BITMAP BitMapHeader,\n IN ULONG StartingIndex,\n IN ULONG NumberToClear\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlFindClearBits(\n IN PRTL_BITMAP BitMapHeader,\n IN ULONG NumberToFind,\n IN ULONG HintIndex\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlFindClearBitsAndSet(\n IN PRTL_BITMAP BitMapHeader,\n IN ULONG NumberToFind,\n IN ULONG HintIndex\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlFindNextForwardRunClear(\n IN PRTL_BITMAP BitMapHeader,\n IN ULONG FromIndex,\n IN PULONG StartingRunIndex\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeBitMap(\n IN PRTL_BITMAP BitMapHeader,\n IN PULONG BitMapBuffer,\n IN ULONG SizeOfBitMap\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlNumberOfSetBits(\n IN PRTL_BITMAP BitMapHeader\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetBit(\n PRTL_BITMAP BitMapHeader,\n ULONG BitNumber\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetBits(\n IN PRTL_BITMAP BitMapHeader,\n IN ULONG StartingIndex,\n IN ULONG NumberToSet\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetAllBits(\n PRTL_BITMAP BitMapHeader\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlTestBit(\n PRTL_BITMAP BitMapHeader,\n ULONG BitNumber\n);\n\n//\n// Timer Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateTimer(\n HANDLE TimerQueue,\n PHANDLE phNewTimer,\n WAITORTIMERCALLBACKFUNC Callback,\n PVOID Parameter,\n ULONG DueTime,\n ULONG Period,\n ULONG Flags\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateTimerQueue(PHANDLE TimerQueue);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteTimer(\n HANDLE TimerQueue,\n HANDLE Timer,\n HANDLE CompletionEvent\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpdateTimer(\n HANDLE TimerQueue,\n HANDLE Timer,\n ULONG DueTime,\n ULONG Period\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteTimerQueueEx(\n HANDLE TimerQueue,\n HANDLE CompletionEvent\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteTimerQueue(HANDLE TimerQueue);\n\n//\n// SList functions\n//\nPSLIST_ENTRY\nFASTCALL\nInterlockedPushListSList(\n IN PSLIST_HEADER ListHead,\n IN PSLIST_ENTRY List,\n IN PSLIST_ENTRY ListEnd,\n IN ULONG Count\n);\n\n//\n// Range List functions\n//\nNTSYSAPI\nVOID\nNTAPI\nRtlFreeRangeList(IN PRTL_RANGE_LIST RangeList);\n\n//\n// Debug Functions\n//\nULONG\n__cdecl\nDbgPrint(\n IN PCCH Format,\n IN ...\n);\n\nNTSYSAPI\nULONG\n__cdecl\nDbgPrintEx(\n IN ULONG ComponentId,\n IN ULONG Level,\n IN PCCH Format,\n IN ...\n);\n\nVOID\nNTAPI\nDbgBreakPoint(\n VOID\n);\n\nNTSTATUS\nNTAPI\nDbgLoadImageSymbols(\n IN PANSI_STRING Name,\n IN PVOID Base,\n IN ULONG_PTR ProcessId\n);\n\nVOID\nNTAPI\nDbgUnLoadImageSymbols(\n IN PANSI_STRING Name,\n IN PVOID Base,\n IN ULONG_PTR ProcessId\n);\n\n//\n// Generic Table Functions\n//\n#if defined(NTOS_MODE_USER) || !defined(_NTIFS_)\nPVOID\nNTAPI\nRtlInsertElementGenericTable(\n IN PRTL_GENERIC_TABLE Table,\n IN PVOID Buffer,\n IN ULONG BufferSize,\n OUT PBOOLEAN NewElement OPTIONAL\n);\n\nPVOID\nNTAPI\nRtlInsertElementGenericTableFull(\n IN PRTL_GENERIC_TABLE Table,\n IN PVOID Buffer,\n IN ULONG BufferSize,\n OUT PBOOLEAN NewElement OPTIONAL,\n IN PVOID NodeOrParent,\n IN TABLE_SEARCH_RESULT SearchResult\n);\n\nBOOLEAN\nNTAPI\nRtlIsGenericTableEmpty(\n IN PRTL_GENERIC_TABLE Table\n);\n\nPVOID\nNTAPI\nRtlLookupElementGenericTableFull(\n IN PRTL_GENERIC_TABLE Table,\n IN PVOID Buffer,\n OUT PVOID *NodeOrParent,\n OUT TABLE_SEARCH_RESULT *SearchResult\n);\n#endif\n\n//\n// Handle Table Functions\n//\nNTSYSAPI\nPRTL_HANDLE_TABLE_ENTRY\nNTAPI\nRtlAllocateHandle(\n IN PRTL_HANDLE_TABLE HandleTable,\n IN OUT PULONG Index\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlDestroyHandleTable(IN PRTL_HANDLE_TABLE HandleTable);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlFreeHandle(\n IN PRTL_HANDLE_TABLE HandleTable,\n IN PRTL_HANDLE_TABLE_ENTRY Handle\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeHandleTable(\n IN ULONG TableSize,\n IN ULONG HandleSize,\n IN PRTL_HANDLE_TABLE HandleTable\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsValidHandle(\n IN PRTL_HANDLE_TABLE HandleTable,\n IN PRTL_HANDLE_TABLE_ENTRY Handle\n);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsValidIndexHandle(\n IN PRTL_HANDLE_TABLE HandleTable,\n IN ULONG Index,\n OUT PRTL_HANDLE_TABLE_ENTRY *Handle\n);\n\n//\n// PE Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFindMessage(\n IN PVOID BaseAddress,\n IN ULONG Type,\n IN ULONG Language,\n IN ULONG MessageId,\n OUT PRTL_MESSAGE_RESOURCE_ENTRY *MessageResourceEntry\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlGetNtGlobalFlags(VOID);\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlImageDirectoryEntryToData(\n PVOID BaseAddress,\n BOOLEAN MappedAsImage,\n USHORT Directory,\n PULONG Size\n);\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlImageRvaToVa(\n PIMAGE_NT_HEADERS NtHeader,\n PVOID BaseAddress,\n ULONG Rva,\n PIMAGE_SECTION_HEADER *SectionHeader\n);\n\nNTSYSAPI\nPIMAGE_NT_HEADERS\nNTAPI\nRtlImageNtHeader(IN PVOID BaseAddress);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlImageNtHeaderEx(\n IN ULONG Flags,\n IN PVOID BaseAddress,\n IN ULONGLONG Size,\n IN PIMAGE_NT_HEADERS *NtHeader\n);\n\nNTSYSAPI\nPIMAGE_SECTION_HEADER\nNTAPI\nRtlImageRvaToSection(\n PIMAGE_NT_HEADERS NtHeader,\n PVOID BaseAddress,\n ULONG Rva\n);\n\nNTSYSAPI\nULONG\nNTAPI\nLdrRelocateImageWithBias(\n IN PVOID NewAddress,\n IN LONGLONG AdditionalBias,\n IN PCCH LoaderName,\n IN ULONG Success,\n IN ULONG Conflict,\n IN ULONG Invalid\n);\n\n//\n// Activation Context Functions\n//\n#ifdef NTOS_MODE_USER\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlActivateActivationContextUnsafeFast(\n IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame,\n IN PVOID Context\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAllocateActivationContextStack(\n IN PVOID *Context\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetActiveActivationContext(\n IN PVOID *Context\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlReleaseActivationContext(\n IN PVOID *Context\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeactivateActivationContextUnsafeFast(\n IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDosApplyFileIsolationRedirection_Ustr(\n IN BOOLEAN Unknown,\n IN PUNICODE_STRING OriginalName,\n IN PUNICODE_STRING Extension,\n IN OUT PUNICODE_STRING RedirectedName,\n IN OUT PUNICODE_STRING RedirectedName2,\n IN OUT PUNICODE_STRING *OriginalName2,\n IN PVOID Unknown1,\n IN PVOID Unknown2,\n IN PVOID Unknown3\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFindActivationContextSectionString(\n IN PVOID Unknown0,\n IN PVOID Unknown1,\n IN ULONG SectionType,\n IN PUNICODE_STRING SectionName,\n IN PVOID Unknown2\n);\n#endif\n\n//\n// Registry Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCheckRegistryKey(\n ULONG RelativeTo,\n PWSTR Path\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateRegistryKey(\n IN ULONG RelativeTo,\n IN PWSTR Path\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFormatCurrentUserKeyPath(\n IN OUT PUNICODE_STRING KeyPath\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlpNtOpenKey(\n OUT HANDLE KeyHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN ULONG Unused\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlOpenCurrentUser(\n IN ACCESS_MASK DesiredAccess,\n OUT PHANDLE KeyHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryRegistryValues(\n IN ULONG RelativeTo,\n IN PCWSTR Path,\n IN PRTL_QUERY_REGISTRY_TABLE QueryTable,\n IN PVOID Context,\n IN PVOID Environment\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlWriteRegistryValue(\n ULONG RelativeTo,\n PCWSTR Path,\n PCWSTR ValueName,\n ULONG ValueType,\n PVOID ValueData,\n ULONG ValueLength\n);\n\n//\n// NLS Functions\n//\nNTSYSAPI\nVOID\nNTAPI\nRtlInitNlsTables(\n IN PUSHORT AnsiTableBase,\n IN PUSHORT OemTableBase,\n IN PUSHORT CaseTableBase,\n OUT PNLSTABLEINFO NlsTable\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitCodePageTable(\n IN PUSHORT TableBase,\n OUT PCPTABLEINFO CodePageTable\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlResetRtlTranslations(IN PNLSTABLEINFO NlsTable);\n\n#if defined(NTOS_MODE_USER) && !defined(NO_RTL_INLINES)\n\n//\n// Misc conversion functions\n//\nstatic __inline\nLARGE_INTEGER\nNTAPI_INLINE\nRtlConvertLongToLargeInteger(\n LONG SignedInteger\n)\n{\n LARGE_INTEGER Result;\n\n Result.QuadPart = SignedInteger;\n return Result;\n}\n\nstatic __inline\nLARGE_INTEGER\nNTAPI_INLINE\nRtlEnlargedIntegerMultiply(\n LONG Multiplicand,\n LONG Multiplier\n)\n{\n LARGE_INTEGER Product;\n\n Product.QuadPart = (LONGLONG)Multiplicand * (ULONGLONG)Multiplier;\n return Product;\n}\n\nstatic __inline\nULONG\nNTAPI_INLINE\nRtlEnlargedUnsignedDivide(\n IN ULARGE_INTEGER Dividend,\n IN ULONG Divisor,\n IN PULONG Remainder OPTIONAL\n)\n{\n ULONG Quotient;\n\n Quotient = (ULONG)(Dividend.QuadPart / Divisor);\n if (Remainder) {\n *Remainder = (ULONG)(Dividend.QuadPart % Divisor);\n }\n\n return Quotient;\n}\n\nstatic __inline\nLARGE_INTEGER\nNTAPI_INLINE\nRtlEnlargedUnsignedMultiply(\n ULONG Multiplicand,\n ULONG Multiplier\n)\n{\n LARGE_INTEGER Product;\n\n Product.QuadPart = (ULONGLONG)Multiplicand * (ULONGLONG)Multiplier;\n return Product;\n}\n#endif\n\nNTSYSAPI\nULONG\nNTAPI\nRtlUniform(\n IN PULONG Seed\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlRandom(\n IN OUT PULONG Seed\n);\n\nNTSYSAPI\nULONG\nNTAPI\nRtlComputeCrc32(\n IN USHORT PartialCrc,\n IN PUCHAR Buffer,\n IN ULONG Length\n);\n\n//\n// Network Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIpv4StringToAddressW(\n IN PWCHAR String,\n IN UCHAR Strict,\n OUT PWCHAR Terminator,\n OUT struct in_addr *Addr\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIpv6StringToAddressA(\n IN PCHAR Name,\n OUT PCHAR *Terminator,\n OUT struct in6_addr *Addr\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIpv6StringToAddressW(\n IN PWCHAR Name,\n OUT PCHAR *Terminator,\n OUT struct in6_addr *Addr\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIpv6StringToAddressExA(\n IN PCHAR AddressString,\n IN struct in6_addr *Address,\n IN PULONG ScopeId,\n IN PUSHORT Port\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIpv6StringToAddressExW(\n IN PWCHAR AddressName,\n IN struct in6_addr *Address,\n IN PULONG ScopeId,\n IN PUSHORT Port\n);\n\n\n//\n// Time Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryTimeZoneInformation(PRTL_TIME_ZONE_INFORMATION TimeZoneInformation);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSecondsSince1970ToTime(\n IN ULONG SecondsSince1970,\n OUT PLARGE_INTEGER Time\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetTimeZoneInformation(PRTL_TIME_ZONE_INFORMATION TimeZoneInformation);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlTimeFieldsToTime(\n PTIME_FIELDS TimeFields,\n PLARGE_INTEGER Time\n);\n\nNTSYSAPI\nVOID\nNTAPI\nRtlTimeToTimeFields(\n PLARGE_INTEGER Time,\n PTIME_FIELDS TimeFields\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSystemTimeToLocalTime(\n IN PLARGE_INTEGER SystemTime,\n OUT PLARGE_INTEGER LocalTime\n);\n\n//\n// Version Functions\n//\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlVerifyVersionInfo(\n IN PRTL_OSVERSIONINFOEXW VersionInfo,\n IN ULONG TypeMask,\n IN ULONGLONG ConditionMask\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetVersion(IN OUT PRTL_OSVERSIONINFOW lpVersionInformation);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlGetNtProductType(OUT PNT_PRODUCT_TYPE ProductType);\n\n//\n// Secure Memory Functions\n//\n#ifdef NTOS_MODE_USER\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlRegisterSecureMemoryCacheCallback(\n IN PRTL_SECURE_MEMORY_CACHE_CALLBACK Callback);\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlFlushSecureMemoryCache(\n IN PVOID MemoryCache,\n IN OPTIONAL SIZE_T MemoryLength\n);\n#endif\n\n#ifdef __cplusplus\n}\n#endif\n\n#endif\n" }, { "path": "ndk/rtltypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n rtltypes.h\n\nAbstract:\n\n Type definitions for the Run-Time Library\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _RTLTYPES_H\n#define _RTLTYPES_H\n\n//\n// Dependencies\n//\n#include \n#include \n\n//\n// Maximum Atom Length\n//\n#define RTL_MAXIMUM_ATOM_LENGTH 255\n\n//\n// Process Parameters Flags\n//\n#define RTL_USER_PROCESS_PARAMETERS_NORMALIZED 0x01\n#define RTL_USER_PROCESS_PARAMETERS_PROFILE_USER 0x02\n#define RTL_USER_PROCESS_PARAMETERS_PROFILE_SERVER 0x04\n#define RTL_USER_PROCESS_PARAMETERS_PROFILE_KERNEL 0x08\n#define RTL_USER_PROCESS_PARAMETERS_UNKNOWN 0x10\n#define RTL_USER_PROCESS_PARAMETERS_RESERVE_1MB 0x20\n#define RTL_USER_PROCESS_PARAMETERS_DISABLE_HEAP_CHECKS 0x100\n#define RTL_USER_PROCESS_PARAMETERS_PROCESS_OR_1 0x200\n#define RTL_USER_PROCESS_PARAMETERS_PROCESS_OR_2 0x400\n#define RTL_USER_PROCESS_PARAMETERS_PRIVATE_DLL_PATH 0x1000\n#define RTL_USER_PROCESS_PARAMETERS_LOCAL_DLL_PATH 0x2000\n#define RTL_USER_PROCESS_PARAMETERS_NX 0x20000\n\n//\n// Exception Flags\n//\n#define EXCEPTION_CHAIN_END ((PEXCEPTION_REGISTRATION_RECORD)-1)\n#define EXCEPTION_UNWINDING 0x02\n#define EXCEPTION_EXIT_UNWIND 0x04\n#define EXCEPTION_STACK_INVALID 0x08\n#define EXCEPTION_UNWIND (EXCEPTION_UNWINDING + EXCEPTION_EXIT_UNWIND)\n#define EXCEPTION_NESTED_CALL 0x10\n#define EXCEPTION_TARGET_UNWIND 0x20\n#define EXCEPTION_COLLIDED_UNWIND 0x20\n\n//\n// Range and Range List Flags\n//\n#define RTL_RANGE_LIST_ADD_IF_CONFLICT 0x00000001\n#define RTL_RANGE_LIST_ADD_SHARED 0x00000002\n\n#define RTL_RANGE_SHARED 0x01\n#define RTL_RANGE_CONFLICT 0x02\n\n//\n// Activation Context Frame Flags\n//\n#define RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER \\\n 0x1\n\n//\n// Public Heap Flags\n//\n#if !defined(NTOS_MODE_USER) && !defined(_NTIFS_)\n#define HEAP_NO_SERIALIZE 0x00000001\n#define HEAP_GROWABLE 0x00000002\n#define HEAP_GENERATE_EXCEPTIONS 0x00000004\n#define HEAP_ZERO_MEMORY 0x00000008\n#define HEAP_REALLOC_IN_PLACE_ONLY 0x00000010\n#define HEAP_TAIL_CHECKING_ENABLED 0x00000020\n#define HEAP_FREE_CHECKING_ENABLED 0x00000040\n#define HEAP_DISABLE_COALESCE_ON_FREE 0x00000080\n#define HEAP_CREATE_ALIGN_16 0x00010000\n#define HEAP_CREATE_ENABLE_TRACING 0x00020000\n#define HEAP_CREATE_ENABLE_EXECUTE 0x00040000\n#endif\n\n//\n// User-Defined Heap Flags and Classes\n//\n#define HEAP_SETTABLE_USER_VALUE 0x00000100\n#define HEAP_SETTABLE_USER_FLAG1 0x00000200\n#define HEAP_SETTABLE_USER_FLAG2 0x00000400\n#define HEAP_SETTABLE_USER_FLAG3 0x00000800\n#define HEAP_SETTABLE_USER_FLAGS 0x00000E00\n#define HEAP_CLASS_0 0x00000000\n#define HEAP_CLASS_1 0x00001000\n#define HEAP_CLASS_2 0x00002000\n#define HEAP_CLASS_3 0x00003000\n#define HEAP_CLASS_4 0x00004000\n#define HEAP_CLASS_5 0x00005000\n#define HEAP_CLASS_6 0x00006000\n#define HEAP_CLASS_7 0x00007000\n#define HEAP_CLASS_8 0x00008000\n#define HEAP_CLASS_MASK 0x0000F000\n\n//\n// Internal HEAP Structure Flags\n//\n#define HEAP_FLAG_PAGE_ALLOCS 0x01000000\n#define HEAP_PROTECTION_ENABLED 0x02000000\n#define HEAP_BREAK_WHEN_OUT_OF_VM 0x04000000\n#define HEAP_NO_ALIGNMENT 0x08000000\n#define HEAP_CAPTURE_STACK_BACKTRACES 0x08000000\n#define HEAP_SKIP_VALIDATION_CHECKS 0x10000000\n#define HEAP_VALIDATE_ALL_ENABLED 0x20000000\n#define HEAP_VALIDATE_PARAMETERS_ENABLED 0x40000000\n#define HEAP_LOCK_USER_ALLOCATED 0x80000000\n\n//\n// Heap Validation Flags\n//\n#define HEAP_CREATE_VALID_MASK \\\n (HEAP_NO_SERIALIZE | \\\n HEAP_GROWABLE | \\\n HEAP_GENERATE_EXCEPTIONS | \\\n HEAP_ZERO_MEMORY | \\\n HEAP_REALLOC_IN_PLACE_ONLY | \\\n HEAP_TAIL_CHECKING_ENABLED | \\\n HEAP_FREE_CHECKING_ENABLED | \\\n HEAP_DISABLE_COALESCE_ON_FREE | \\\n HEAP_CLASS_MASK | \\\n HEAP_CREATE_ALIGN_16 | \\\n HEAP_CREATE_ENABLE_TRACING | \\\n HEAP_CREATE_ENABLE_EXECUTE)\n#ifdef C_ASSERT\nC_ASSERT(HEAP_CREATE_VALID_MASK == 0x0007F0FF);\n#endif\n\n//\n// Registry Keys\n//\n#define RTL_REGISTRY_ABSOLUTE 0\n#define RTL_REGISTRY_SERVICES 1\n#define RTL_REGISTRY_CONTROL 2\n#define RTL_REGISTRY_WINDOWS_NT 3\n#define RTL_REGISTRY_DEVICEMAP 4\n#define RTL_REGISTRY_USER 5\n#define RTL_REGISTRY_MAXIMUM 6\n#define RTL_REGISTRY_HANDLE 0x40000000\n#define RTL_REGISTRY_OPTIONAL 0x80000000\n#define RTL_QUERY_REGISTRY_SUBKEY 0x00000001\n#define RTL_QUERY_REGISTRY_TOPKEY 0x00000002\n#define RTL_QUERY_REGISTRY_REQUIRED 0x00000004\n#define RTL_QUERY_REGISTRY_NOVALUE 0x00000008\n#define RTL_QUERY_REGISTRY_NOEXPAND 0x00000010\n#define RTL_QUERY_REGISTRY_DIRECT 0x00000020\n#define RTL_QUERY_REGISTRY_DELETE 0x00000040\n\n//\n// Versioning\n//\n#define VER_MINORVERSION 0x0000001\n#define VER_MAJORVERSION 0x0000002\n#define VER_BUILDNUMBER 0x0000004\n#define VER_PLATFORMID 0x0000008\n#define VER_SERVICEPACKMINOR 0x0000010\n#define VER_SERVICEPACKMAJOR 0x0000020\n#define VER_SUITENAME 0x0000040\n#define VER_PRODUCT_TYPE 0x0000080\n#define VER_PLATFORM_WIN32s 0\n#define VER_PLATFORM_WIN32_WINDOWS 1\n#define VER_PLATFORM_WIN32_NT 2\n#define VER_EQUAL 1\n#define VER_GREATER 2\n#define VER_GREATER_EQUAL 3\n#define VER_LESS 4\n#define VER_LESS_EQUAL 5\n#define VER_AND 6\n#define VER_OR 7\n#define VER_CONDITION_MASK 7\n#define VER_NUM_BITS_PER_CONDITION_MASK 3\n\n//\n// Timezone IDs\n//\n#define TIME_ZONE_ID_UNKNOWN 0\n#define TIME_ZONE_ID_STANDARD 1\n#define TIME_ZONE_ID_DAYLIGHT 2\n\n//\n// Maximum Path Length\n//\n#define MAX_PATH 260\n\n//\n// RTL Lock Type (Critical Section or Resource)\n//\n#define RTL_CRITSECT_TYPE 0\n#define RTL_RESOURCE_TYPE 1\n\n//\n// RtlAcquirePrivileges Flags\n//\n#define RTL_ACQUIRE_PRIVILEGE_IMPERSONATE 1\n#define RTL_ACQUIRE_PRIVILEGE_PROCESS 2\n\n#ifdef NTOS_MODE_USER\n\n//\n// String Hash Algorithms\n//\n#define HASH_STRING_ALGORITHM_DEFAULT 0\n#define HASH_STRING_ALGORITHM_X65599 1\n#define HASH_STRING_ALGORITHM_INVALID 0xffffffff\n\n//\n// RtlDuplicateString Flags\n//\n#define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE 1\n#define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING 2\n\n//\n// RtlFindCharInUnicodeString Flags\n//\n#define RTL_FIND_CHAR_IN_UNICODE_STRING_CASE_INSENSITIVE 4\n\n//\n// Codepages\n//\n#define NLS_MB_CODE_PAGE_TAG NlsMbCodePageTag\n#define NLS_MB_OEM_CODE_PAGE_TAG NlsMbOemCodePageTag\n#define NLS_OEM_LEAD_BYTE_INFO NlsOemLeadByteInfo\n\n//\n// C++ CONST casting\n//\n#if defined(__cplusplus)\n#define RTL_CONST_CAST(type) const_cast\n#else\n#define RTL_CONST_CAST(type) (type)\n#endif\n\n//\n// Constant String Macro\n//\n#define RTL_CONSTANT_STRING(__SOURCE_STRING__) \\\n{ \\\n sizeof(__SOURCE_STRING__) - sizeof((__SOURCE_STRING__)[0]), \\\n sizeof(__SOURCE_STRING__), \\\n (__SOURCE_STRING__) \\\n}\n\n//\n// Constant Object Attributes Macro\n//\n#define RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a) \\\n{ \\\n sizeof(OBJECT_ATTRIBUTES), \\\n NULL, \\\n RTL_CONST_CAST(PUNICODE_STRING)(n), \\\n a, \\\n NULL, \\\n NULL \\\n}\n\n#define RTL_INIT_OBJECT_ATTRIBUTES(n, a) \\\n RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a)\n\n#else\n//\n// Message Resource Flag\n//\n#define MESSAGE_RESOURCE_UNICODE 0x0001\n\n#endif\n#define MAXIMUM_LEADBYTES 12\n\n//\n// RTL Debug Queries\n//\n#define RTL_DEBUG_QUERY_MODULES 0x01\n#define RTL_DEBUG_QUERY_BACKTRACES 0x02\n#define RTL_DEBUG_QUERY_HEAPS 0x04\n#define RTL_DEBUG_QUERY_HEAP_TAGS 0x08\n#define RTL_DEBUG_QUERY_HEAP_BLOCKS 0x10\n#define RTL_DEBUG_QUERY_LOCKS 0x20\n\n//\n// RTL Handle Flags\n//\n#define RTL_HANDLE_VALID 0x1\n\n//\n// RTL Atom Flags\n//\n#define RTL_ATOM_IS_PINNED 0x1\n\n//\n// Critical section lock bits\n//\n#define CS_LOCK_BIT 0x1\n#define CS_LOCK_BIT_V 0x0\n#define CS_LOCK_WAITER_WOKEN 0x2\n#define CS_LOCK_WAITER_INC 0x4\n\n//\n// Codepage Tags\n//\n#ifdef NTOS_MODE_USER\nextern BOOLEAN NTSYSAPI NLS_MB_CODE_PAGE_TAG;\nextern BOOLEAN NTSYSAPI NLS_MB_OEM_CODE_PAGE_TAG;\n\n//\n// Constant String Macro\n//\n#define RTL_CONSTANT_STRING(__SOURCE_STRING__) \\\n{ \\\n sizeof(__SOURCE_STRING__) - sizeof((__SOURCE_STRING__)[0]), \\\n sizeof(__SOURCE_STRING__), \\\n (__SOURCE_STRING__) \\\n}\n\n#endif\n\n#ifdef NTOS_MODE_USER\n\n//\n// Table and Compare result types\n//\ntypedef enum _TABLE_SEARCH_RESULT\n{\n TableEmptyTree,\n TableFoundNode,\n TableInsertAsLeft,\n TableInsertAsRight\n} TABLE_SEARCH_RESULT;\n\ntypedef enum _RTL_GENERIC_COMPARE_RESULTS\n{\n GenericLessThan,\n GenericGreaterThan,\n GenericEqual\n} RTL_GENERIC_COMPARE_RESULTS;\n\n#else\n\n//\n// ACL Query Information Classes\n//\ntypedef enum _ACL_INFORMATION_CLASS\n{\n AclRevisionInformation = 1,\n AclSizeInformation\n} ACL_INFORMATION_CLASS;\n\n#endif\n\n//\n// RTL Path Types\n//\ntypedef enum _RTL_PATH_TYPE\n{\n RtlPathTypeUnknown,\n RtlPathTypeUncAbsolute,\n RtlPathTypeDriveAbsolute,\n RtlPathTypeDriveRelative,\n RtlPathTypeRooted,\n RtlPathTypeRelative,\n RtlPathTypeLocalDevice,\n RtlPathTypeRootLocalDevice,\n} RTL_PATH_TYPE;\n\n#ifndef NTOS_MODE_USER\n\n//\n// Callback function for RTL Timers or Registered Waits\n//\ntypedef VOID\n(NTAPI *WAITORTIMERCALLBACKFUNC)(\n PVOID pvContext,\n BOOLEAN fTimerOrWaitFired\n);\n\n//\n// Handler during Vectored RTL Exceptions\n//\ntypedef LONG\n(NTAPI *PVECTORED_EXCEPTION_HANDLER)(\n PEXCEPTION_POINTERS ExceptionPointers\n);\n\n//\n// Worker Thread Callback for Rtl\n//\ntypedef VOID\n(NTAPI *WORKERCALLBACKFUNC)(\n IN PVOID Context\n);\n\n#else\n\n//\n// Handler during regular RTL Exceptions\n//\ntypedef EXCEPTION_DISPOSITION\n(NTAPI *PEXCEPTION_ROUTINE)(\n IN struct _EXCEPTION_RECORD *ExceptionRecord,\n IN PVOID EstablisherFrame,\n IN OUT struct _CONTEXT *ContextRecord,\n IN OUT PVOID DispatcherContext\n);\n\n//\n// RTL Library Allocation/Free Routines\n//\ntypedef PVOID\n(NTAPI *PRTL_ALLOCATE_STRING_ROUTINE)(\n SIZE_T NumberOfBytes\n);\n\ntypedef PVOID\n(NTAPI *PRTL_REALLOCATE_STRING_ROUTINE)(\n SIZE_T NumberOfBytes,\n PVOID Buffer\n);\n\ntypedef\nVOID\n(NTAPI *PRTL_FREE_STRING_ROUTINE)(\n PVOID Buffer\n);\n\nextern const PRTL_ALLOCATE_STRING_ROUTINE RtlAllocateStringRoutine;\nextern const PRTL_FREE_STRING_ROUTINE RtlFreeStringRoutine;\nextern const PRTL_REALLOCATE_STRING_ROUTINE RtlReallocateStringRoutine;\n\n#endif\n\n//\n// Callback for RTL Heap Enumeration\n//\ntypedef NTSTATUS\n(*PHEAP_ENUMERATION_ROUTINE)(\n IN PVOID HeapHandle,\n IN PVOID UserParam\n);\n\n//\n// Thread and Process Start Routines for RtlCreateUserThread/Process\n//\ntypedef ULONG (NTAPI *PTHREAD_START_ROUTINE)(\n PVOID Parameter\n);\n\ntypedef VOID\n(NTAPI *PRTL_BASE_PROCESS_START_ROUTINE)(\n PTHREAD_START_ROUTINE StartAddress,\n PVOID Parameter\n);\n\n//\n// Declare empty structure definitions so that they may be referenced by\n// routines before they are defined\n//\nstruct _RTL_AVL_TABLE;\nstruct _RTL_GENERIC_TABLE;\nstruct _RTL_RANGE;\ntypedef struct _COMPRESSED_DATA_INFO COMPRESSED_DATA_INFO, *PCOMPRESSED_DATA_INFO;\n\n//\n// Routines and callbacks for the RTL AVL/Generic Table package\n//\n#if defined(NTOS_MODE_USER) || (!defined(NTOS_MODE_USER) && !defined(_NTIFS_))\ntypedef NTSTATUS\n(NTAPI *PRTL_AVL_MATCH_FUNCTION)(\n struct _RTL_AVL_TABLE *Table,\n PVOID UserData,\n PVOID MatchData\n);\n\ntypedef RTL_GENERIC_COMPARE_RESULTS\n(NTAPI *PRTL_AVL_COMPARE_ROUTINE) (\n struct _RTL_AVL_TABLE *Table,\n PVOID FirstStruct,\n PVOID SecondStruct\n);\n\ntypedef RTL_GENERIC_COMPARE_RESULTS\n(NTAPI *PRTL_GENERIC_COMPARE_ROUTINE) (\n struct _RTL_GENERIC_TABLE *Table,\n PVOID FirstStruct,\n PVOID SecondStruct\n);\n\ntypedef PVOID\n(NTAPI *PRTL_GENERIC_ALLOCATE_ROUTINE) (\n struct _RTL_GENERIC_TABLE *Table,\n CLONG ByteSize\n);\n\ntypedef VOID\n(NTAPI *PRTL_GENERIC_FREE_ROUTINE) (\n struct _RTL_GENERIC_TABLE *Table,\n PVOID Buffer\n);\n\ntypedef PVOID\n(NTAPI *PRTL_AVL_ALLOCATE_ROUTINE) (\n struct _RTL_AVL_TABLE *Table,\n CLONG ByteSize\n);\n\ntypedef VOID\n(NTAPI *PRTL_AVL_FREE_ROUTINE) (\n struct _RTL_AVL_TABLE *Table,\n PVOID Buffer\n);\n#endif\n\n//\n// RTL Query Registry callback\n//\ntypedef NTSTATUS\n(NTAPI *PRTL_QUERY_REGISTRY_ROUTINE)(\n IN PWSTR ValueName,\n IN ULONG ValueType,\n IN PVOID ValueData,\n IN ULONG ValueLength,\n IN PVOID Context,\n IN PVOID EntryContext\n);\n\n//\n// RTL Secure Memory callbacks\n//\n#ifdef NTOS_MODE_USER\ntypedef NTSTATUS\n(NTAPI *PRTL_SECURE_MEMORY_CACHE_CALLBACK)(\n IN PVOID Address,\n IN SIZE_T Length\n);\n#endif\n\n//\n// RTL Range List callbacks\n//\n#ifdef NTOS_MODE_USER\ntypedef BOOLEAN\n(NTAPI *PRTL_CONFLICT_RANGE_CALLBACK)(\n PVOID Context,\n struct _RTL_RANGE *Range\n);\n\n//\n// Custom Heap Commit Routine for RtlCreateHeap\n//\ntypedef NTSTATUS\n(NTAPI * PRTL_HEAP_COMMIT_ROUTINE)(\n IN PVOID Base,\n IN OUT PVOID *CommitAddress,\n IN OUT PSIZE_T CommitSize\n);\n\n//\n// Version Info redefinitions\n//\ntypedef OSVERSIONINFOW RTL_OSVERSIONINFOW;\ntypedef LPOSVERSIONINFOW PRTL_OSVERSIONINFOW;\ntypedef OSVERSIONINFOEXW RTL_OSVERSIONINFOEXW;\ntypedef LPOSVERSIONINFOEXW PRTL_OSVERSIONINFOEXW;\n\n//\n// Simple pointer definitions\n//\ntypedef ACL_REVISION_INFORMATION *PACL_REVISION_INFORMATION;\ntypedef ACL_SIZE_INFORMATION *PACL_SIZE_INFORMATION;\n\n//\n// Parameters for RtlCreateHeap\n// FIXME: Determine whether Length is SIZE_T or ULONG\n//\ntypedef struct _RTL_HEAP_PARAMETERS\n{\n ULONG Length;\n SIZE_T SegmentReserve;\n SIZE_T SegmentCommit;\n SIZE_T DeCommitFreeBlockThreshold;\n SIZE_T DeCommitTotalFreeThreshold;\n SIZE_T MaximumAllocationSize;\n SIZE_T VirtualMemoryThreshold;\n SIZE_T InitialCommit;\n SIZE_T InitialReserve;\n PRTL_HEAP_COMMIT_ROUTINE CommitRoutine;\n SIZE_T Reserved[2];\n} RTL_HEAP_PARAMETERS, *PRTL_HEAP_PARAMETERS;\n\n//\n// RTL Bitmap structures\n//\ntypedef struct _RTL_BITMAP\n{\n ULONG SizeOfBitMap;\n PULONG Buffer;\n} RTL_BITMAP, *PRTL_BITMAP;\n\ntypedef struct _RTL_BITMAP_RUN\n{\n ULONG StartingIndex;\n ULONG NumberOfBits;\n} RTL_BITMAP_RUN, *PRTL_BITMAP_RUN;\n\n//\n// RtlGenerateXxxName context\n//\ntypedef struct _GENERATE_NAME_CONTEXT\n{\n USHORT Checksum;\n BOOLEAN CheckSumInserted;\n UCHAR NameLength;\n WCHAR NameBuffer[8];\n ULONG ExtensionLength;\n WCHAR ExtensionBuffer[4];\n ULONG LastIndexValue;\n} GENERATE_NAME_CONTEXT, *PGENERATE_NAME_CONTEXT;\n\n//\n// RTL Splay and Balanced Links structures\n//\ntypedef struct _RTL_SPLAY_LINKS\n{\n struct _RTL_SPLAY_LINKS *Parent;\n struct _RTL_SPLAY_LINKS *LeftChild;\n struct _RTL_SPLAY_LINKS *RightChild;\n} RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;\n\ntypedef struct _RTL_BALANCED_LINKS\n{\n struct _RTL_BALANCED_LINKS *Parent;\n struct _RTL_BALANCED_LINKS *LeftChild;\n struct _RTL_BALANCED_LINKS *RightChild;\n CHAR Balance;\n UCHAR Reserved[3];\n} RTL_BALANCED_LINKS, *PRTL_BALANCED_LINKS;\n\n//\n// RTL Avl/Generic Tables\n//\ntypedef struct _RTL_GENERIC_TABLE\n{\n PRTL_SPLAY_LINKS TableRoot;\n LIST_ENTRY InsertOrderList;\n PLIST_ENTRY OrderedPointer;\n ULONG WhichOrderedElement;\n ULONG NumberGenericTableElements;\n PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine;\n PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine;\n PRTL_GENERIC_FREE_ROUTINE FreeRoutine;\n PVOID TableContext;\n} RTL_GENERIC_TABLE, *PRTL_GENERIC_TABLE;\n\ntypedef struct _RTL_AVL_TABLE\n{\n RTL_BALANCED_LINKS BalancedRoot;\n PVOID OrderedPointer;\n ULONG WhichOrderedElement;\n ULONG NumberGenericTableElements;\n ULONG DepthOfTree;\n PRTL_BALANCED_LINKS RestartKey;\n ULONG DeleteCount;\n PRTL_AVL_COMPARE_ROUTINE CompareRoutine;\n PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine;\n PRTL_AVL_FREE_ROUTINE FreeRoutine;\n PVOID TableContext;\n} RTL_AVL_TABLE, *PRTL_AVL_TABLE;\n\n//\n// RtlQueryRegistry Data\n//\ntypedef struct _RTL_QUERY_REGISTRY_TABLE\n{\n PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine;\n ULONG Flags;\n PWSTR Name;\n PVOID EntryContext;\n ULONG DefaultType;\n PVOID DefaultData;\n ULONG DefaultLength;\n} RTL_QUERY_REGISTRY_TABLE, *PRTL_QUERY_REGISTRY_TABLE;\n\n//\n// RTL Unicode Table Structures\n//\ntypedef struct _UNICODE_PREFIX_TABLE_ENTRY\n{\n CSHORT NodeTypeCode;\n CSHORT NameLength;\n struct _UNICODE_PREFIX_TABLE_ENTRY *NextPrefixTree;\n struct _UNICODE_PREFIX_TABLE_ENTRY *CaseMatch;\n RTL_SPLAY_LINKS Links;\n PUNICODE_STRING Prefix;\n} UNICODE_PREFIX_TABLE_ENTRY, *PUNICODE_PREFIX_TABLE_ENTRY;\n\ntypedef struct _UNICODE_PREFIX_TABLE\n{\n CSHORT NodeTypeCode;\n CSHORT NameLength;\n PUNICODE_PREFIX_TABLE_ENTRY NextPrefixTree;\n PUNICODE_PREFIX_TABLE_ENTRY LastNextEntry;\n} UNICODE_PREFIX_TABLE, *PUNICODE_PREFIX_TABLE;\n\n//\n// Time Structure for RTL Time calls\n//\ntypedef struct _TIME_FIELDS\n{\n CSHORT Year;\n CSHORT Month;\n CSHORT Day;\n CSHORT Hour;\n CSHORT Minute;\n CSHORT Second;\n CSHORT Milliseconds;\n CSHORT Weekday;\n} TIME_FIELDS, *PTIME_FIELDS;\n\n//\n// Activation Context\n//\ntypedef PVOID PACTIVATION_CONTEXT;\n\n//\n// Activation Context Frame\n//\ntypedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME\n{\n struct __RTL_ACTIVATION_CONTEXT_STACK_FRAME *Previous;\n PACTIVATION_CONTEXT ActivationContext;\n ULONG Flags;\n} RTL_ACTIVATION_CONTEXT_STACK_FRAME,\n *PRTL_ACTIVATION_CONTEXT_STACK_FRAME;\n\ntypedef struct _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED\n{\n ULONG Size;\n ULONG Format;\n RTL_ACTIVATION_CONTEXT_STACK_FRAME Frame;\n PVOID Extra1;\n PVOID Extra2;\n PVOID Extra3;\n PVOID Extra4;\n} RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED,\n *PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED;\n\n#endif\n\n//\n// ACE Structure\n//\ntypedef struct _ACE\n{\n ACE_HEADER Header;\n ACCESS_MASK AccessMask;\n} ACE, *PACE;\n\n//\n// Information Structures for RTL Debug Functions\n//\ntypedef struct _RTL_PROCESS_MODULE_INFORMATION\n{\n ULONG Section;\n PVOID MappedBase;\n PVOID ImageBase;\n ULONG ImageSize;\n ULONG Flags;\n USHORT LoadOrderIndex;\n USHORT InitOrderIndex;\n USHORT LoadCount;\n USHORT OffsetToFileName;\n CHAR FullPathName[256];\n} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;\n\ntypedef struct _RTL_PROCESS_MODULES\n{\n ULONG NumberOfModules;\n RTL_PROCESS_MODULE_INFORMATION Modules[1];\n} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;\n\ntypedef struct _RTL_PROCESS_MODULE_INFORMATION_EX\n{\n ULONG NextOffset;\n RTL_PROCESS_MODULE_INFORMATION BaseInfo;\n ULONG ImageCheckSum;\n ULONG TimeDateStamp;\n PVOID DefaultBase;\n} RTL_PROCESS_MODULE_INFORMATION_EX, *PRTL_PROCESS_MODULE_INFORMATION_EX;\n\ntypedef struct _RTL_HEAP_TAG_INFO\n{\n ULONG NumberOfAllocations;\n ULONG NumberOfFrees;\n ULONG BytesAllocated;\n} RTL_HEAP_TAG_INFO, *PRTL_HEAP_TAG_INFO;\n\ntypedef struct _RTL_HEAP_USAGE_ENTRY\n{\n struct _RTL_HEAP_USAGE_ENTRY *Next;\n} RTL_HEAP_USAGE_ENTRY, *PRTL_HEAP_USAGE_ENTRY;\n\ntypedef struct _RTL_HEAP_USAGE\n{\n ULONG Length;\n ULONG BytesAllocated;\n ULONG BytesCommitted;\n ULONG BytesReserved;\n ULONG BytesReservedMaximum;\n PRTL_HEAP_USAGE_ENTRY Entries;\n PRTL_HEAP_USAGE_ENTRY AddedEntries;\n PRTL_HEAP_USAGE_ENTRY RemovedEntries;\n UCHAR Reserved[32];\n} RTL_HEAP_USAGE, *PRTL_HEAP_USAGE;\n\ntypedef struct _RTL_HEAP_INFORMATION\n{\n PVOID BaseAddress;\n ULONG Flags;\n USHORT EntryOverhead;\n USHORT CreatorBackTraceIndex;\n ULONG BytesAllocated;\n ULONG BytesCommitted;\n ULONG NumberOfTags;\n ULONG NumberOfEntries;\n ULONG NumberOfPseudoTags;\n ULONG PseudoTagGranularity;\n ULONG Reserved[4];\n PVOID Tags;\n PVOID Entries;\n} RTL_HEAP_INFORMATION, *PRTL_HEAP_INFORMATION;\n\ntypedef struct _RTL_PROCESS_HEAPS\n{\n ULONG NumberOfHeaps;\n RTL_HEAP_INFORMATION Heaps[1];\n} RTL_PROCESS_HEAPS, *PRTL_PROCESS_HEAPS;\n\ntypedef struct _RTL_PROCESS_LOCK_INFORMATION\n{\n PVOID Address;\n USHORT Type;\n USHORT CreatorBackTraceIndex;\n ULONG OwnerThreadId;\n ULONG ActiveCount;\n ULONG ContentionCount;\n ULONG EntryCount;\n ULONG RecursionCount;\n ULONG NumberOfSharedWaiters;\n ULONG NumberOfExclusiveWaiters;\n} RTL_PROCESS_LOCK_INFORMATION, *PRTL_PROCESS_LOCK_INFORMATION;\n\ntypedef struct _RTL_PROCESS_LOCKS\n{\n ULONG NumberOfLocks;\n RTL_PROCESS_LOCK_INFORMATION Locks[1];\n} RTL_PROCESS_LOCKS, *PRTL_PROCESS_LOCKS;\n\ntypedef struct _RTL_PROCESS_BACKTRACE_INFORMATION\n{\n PVOID SymbolicBackTrace;\n ULONG TraceCount;\n USHORT Index;\n USHORT Depth;\n PVOID BackTrace[16];\n} RTL_PROCESS_BACKTRACE_INFORMATION, *PRTL_PROCESS_BACKTRACE_INFORMATION;\n\ntypedef struct _RTL_PROCESS_BACKTRACES\n{\n ULONG CommittedMemory;\n ULONG ReservedMemory;\n ULONG NumberOfBackTraceLookups;\n ULONG NumberOfBackTraces;\n RTL_PROCESS_BACKTRACE_INFORMATION BackTraces[1];\n} RTL_PROCESS_BACKTRACES, *PRTL_PROCESS_BACKTRACES;\n\ntypedef struct _RTL_PROCESS_VERIFIER_OPTIONS\n{\n ULONG SizeStruct;\n ULONG Option;\n UCHAR OptionData[1];\n //\n // Option array continues below\n //\n} RTL_PROCESS_VERIFIER_OPTIONS, *PRTL_PROCESS_VERIFIER_OPTIONS;\n\ntypedef struct _RTL_DEBUG_INFORMATION\n{\n HANDLE SectionHandleClient;\n PVOID ViewBaseClient;\n PVOID ViewBaseTarget;\n ULONG ViewBaseDelta;\n HANDLE EventPairClient;\n PVOID EventPairTarget;\n HANDLE TargetProcessId;\n HANDLE TargetThreadHandle;\n ULONG Flags;\n ULONG OffsetFree;\n ULONG CommitSize;\n ULONG ViewSize;\n union\n {\n PRTL_PROCESS_MODULES Modules;\n PRTL_PROCESS_MODULE_INFORMATION_EX ModulesEx;\n };\n PRTL_PROCESS_BACKTRACES BackTraces;\n PRTL_PROCESS_HEAPS Heaps;\n PRTL_PROCESS_LOCKS Locks;\n HANDLE SpecificHeap;\n HANDLE TargetProcessHandle;\n RTL_PROCESS_VERIFIER_OPTIONS VerifierOptions;\n HANDLE ProcessHeap;\n HANDLE CriticalSectionHandle;\n HANDLE CriticalSectionOwnerThread;\n PVOID Reserved[4];\n} RTL_DEBUG_INFORMATION, *PRTL_DEBUG_INFORMATION;\n\n//\n// Unload Event Trace Structure for RtlGetUnloadEventTrace\n//\ntypedef struct _RTL_UNLOAD_EVENT_TRACE\n{\n PVOID BaseAddress;\n ULONG SizeOfImage;\n ULONG Sequence;\n ULONG TimeDateStamp;\n ULONG CheckSum;\n WCHAR ImageName[32];\n} RTL_UNLOAD_EVENT_TRACE, *PRTL_UNLOAD_EVENT_TRACE;\n\n//\n// RTL Handle Structures\n//\ntypedef struct _RTL_HANDLE_TABLE_ENTRY\n{\n ULONG Flags;\n struct _RTL_HANDLE_TABLE_ENTRY *NextFree;\n} RTL_HANDLE_TABLE_ENTRY, *PRTL_HANDLE_TABLE_ENTRY;\n\ntypedef struct _RTL_HANDLE_TABLE\n{\n ULONG MaximumNumberOfHandles;\n ULONG SizeOfHandleTableEntry;\n ULONG Reserved[2];\n PRTL_HANDLE_TABLE_ENTRY FreeHandles;\n PRTL_HANDLE_TABLE_ENTRY CommittedHandles;\n PRTL_HANDLE_TABLE_ENTRY UnCommittedHandles;\n PRTL_HANDLE_TABLE_ENTRY MaxReservedHandles;\n} RTL_HANDLE_TABLE, *PRTL_HANDLE_TABLE;\n\n//\n// Exception Record\n//\ntypedef struct _EXCEPTION_REGISTRATION_RECORD\n{\n struct _EXCEPTION_REGISTRATION_RECORD *Next;\n PEXCEPTION_ROUTINE Handler;\n} EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;\n\n//\n// Current Directory Structures\n//\ntypedef struct _CURDIR\n{\n UNICODE_STRING DosPath;\n HANDLE Handle;\n} CURDIR, *PCURDIR;\n\ntypedef struct RTL_DRIVE_LETTER_CURDIR\n{\n USHORT Flags;\n USHORT Length;\n ULONG TimeStamp;\n UNICODE_STRING DosPath;\n} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;\n\n//\n// Private State structure for RtlAcquirePrivilege/RtlReleasePrivilege\n//\ntypedef struct _RTL_ACQUIRE_STATE\n{\n HANDLE Token;\n HANDLE OldImpersonationToken;\n PTOKEN_PRIVILEGES OldPrivileges;\n PTOKEN_PRIVILEGES NewPrivileges;\n ULONG Flags;\n UCHAR OldPrivBuffer[1024];\n} RTL_ACQUIRE_STATE, *PRTL_ACQUIRE_STATE;\n\n#ifndef NTOS_MODE_USER\n\n//\n// RTL Critical Section Structures\n//\ntypedef struct _RTL_CRITICAL_SECTION_DEBUG\n{\n USHORT Type;\n USHORT CreatorBackTraceIndex;\n struct _RTL_CRITICAL_SECTION *CriticalSection;\n LIST_ENTRY ProcessLocksList;\n ULONG EntryCount;\n ULONG ContentionCount;\n ULONG Spare[2];\n} RTL_CRITICAL_SECTION_DEBUG, *PRTL_CRITICAL_SECTION_DEBUG, RTL_RESOURCE_DEBUG, *PRTL_RESOURCE_DEBUG;\n\ntypedef struct _RTL_CRITICAL_SECTION\n{\n PRTL_CRITICAL_SECTION_DEBUG DebugInfo;\n LONG LockCount;\n LONG RecursionCount;\n HANDLE OwningThread;\n HANDLE LockSemaphore;\n ULONG_PTR SpinCount;\n} RTL_CRITICAL_SECTION, *PRTL_CRITICAL_SECTION;\n\n#endif\n\n//\n// RTL Range List Structures\n//\ntypedef struct _RTL_RANGE_LIST\n{\n LIST_ENTRY ListHead;\n ULONG Flags;\n ULONG Count;\n ULONG Stamp;\n} RTL_RANGE_LIST, *PRTL_RANGE_LIST;\n\ntypedef struct _RTL_RANGE\n{\n ULONGLONG Start;\n ULONGLONG End;\n PVOID UserData;\n PVOID Owner;\n UCHAR Attributes;\n UCHAR Flags;\n} RTL_RANGE, *PRTL_RANGE;\n\ntypedef struct _RANGE_LIST_ITERATOR\n{\n PLIST_ENTRY RangeListHead;\n PLIST_ENTRY MergedHead;\n PVOID Current;\n ULONG Stamp;\n} RTL_RANGE_LIST_ITERATOR, *PRTL_RANGE_LIST_ITERATOR;\n\n//\n// RTL Resource\n//\ntypedef struct _RTL_RESOURCE\n{\n RTL_CRITICAL_SECTION Lock;\n HANDLE SharedSemaphore;\n ULONG SharedWaiters;\n HANDLE ExclusiveSemaphore;\n ULONG ExclusiveWaiters;\n LONG NumberActive;\n HANDLE OwningThread;\n ULONG TimeoutBoost;\n PVOID DebugInfo;\n} RTL_RESOURCE, *PRTL_RESOURCE;\n\n//\n// RTL Message Structures for PE Resources\n//\ntypedef struct _RTL_MESSAGE_RESOURCE_ENTRY\n{\n USHORT Length;\n USHORT Flags;\n CHAR Text[1];\n} RTL_MESSAGE_RESOURCE_ENTRY, *PRTL_MESSAGE_RESOURCE_ENTRY;\n\ntypedef struct _RTL_MESSAGE_RESOURCE_BLOCK\n{\n ULONG LowId;\n ULONG HighId;\n ULONG OffsetToEntries;\n} RTL_MESSAGE_RESOURCE_BLOCK, *PRTL_MESSAGE_RESOURCE_BLOCK;\n\ntypedef struct _RTL_MESSAGE_RESOURCE_DATA\n{\n ULONG NumberOfBlocks;\n RTL_MESSAGE_RESOURCE_BLOCK Blocks[1];\n} RTL_MESSAGE_RESOURCE_DATA, *PRTL_MESSAGE_RESOURCE_DATA;\n\n//\n// Structures for RtlCreateUserProcess\n//\ntypedef struct _RTL_USER_PROCESS_PARAMETERS\n{\n ULONG MaximumLength;\n ULONG Length;\n ULONG Flags;\n ULONG DebugFlags;\n HANDLE ConsoleHandle;\n ULONG ConsoleFlags;\n HANDLE StandardInput;\n HANDLE StandardOutput;\n HANDLE StandardError;\n CURDIR CurrentDirectory;\n UNICODE_STRING DllPath;\n UNICODE_STRING ImagePathName;\n UNICODE_STRING CommandLine;\n PWSTR Environment;\n ULONG StartingX;\n ULONG StartingY;\n ULONG CountX;\n ULONG CountY;\n ULONG CountCharsX;\n ULONG CountCharsY;\n ULONG FillAttribute;\n ULONG WindowFlags;\n ULONG ShowWindowFlags;\n UNICODE_STRING WindowTitle;\n UNICODE_STRING DesktopInfo;\n UNICODE_STRING ShellInfo;\n UNICODE_STRING RuntimeData;\n RTL_DRIVE_LETTER_CURDIR CurrentDirectories[32];\n} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;\n\ntypedef struct _RTL_USER_PROCESS_INFORMATION\n{\n ULONG Size;\n HANDLE ProcessHandle;\n HANDLE ThreadHandle;\n CLIENT_ID ClientId;\n SECTION_IMAGE_INFORMATION ImageInformation;\n} RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION;\n\n//\n// RTL Atom Table Structures\n//\ntypedef struct _RTL_ATOM_TABLE_ENTRY\n{\n struct _RTL_ATOM_TABLE_ENTRY *HashLink;\n USHORT HandleIndex;\n USHORT Atom;\n USHORT ReferenceCount;\n UCHAR Flags;\n UCHAR NameLength;\n WCHAR Name[1];\n} RTL_ATOM_TABLE_ENTRY, *PRTL_ATOM_TABLE_ENTRY;\n\ntypedef struct _RTL_ATOM_TABLE\n{\n ULONG Signature;\n union\n {\n#ifdef NTOS_MODE_USER\n RTL_CRITICAL_SECTION CriticalSection;\n#else\n FAST_MUTEX FastMutex;\n#endif\n };\n union\n {\n#ifdef NTOS_MODE_USER\n RTL_HANDLE_TABLE RtlHandleTable;\n#else\n PHANDLE_TABLE ExHandleTable;\n#endif\n };\n ULONG NumberOfBuckets;\n PRTL_ATOM_TABLE_ENTRY Buckets[1];\n} RTL_ATOM_TABLE, *PRTL_ATOM_TABLE;\n\n#ifndef _WINBASE_\n//\n// System Time and Timezone Structures\n//\ntypedef struct _SYSTEMTIME\n{\n USHORT wYear;\n USHORT wMonth;\n USHORT wDayOfWeek;\n USHORT wDay;\n USHORT wHour;\n USHORT wMinute;\n USHORT wSecond;\n USHORT wMilliseconds;\n} SYSTEMTIME, *PSYSTEMTIME, *LPSYSTEMTIME;\n\ntypedef struct _TIME_ZONE_INFORMATION\n{\n LONG Bias;\n WCHAR StandardName[32];\n SYSTEMTIME StandardDate;\n LONG StandardBias;\n WCHAR DaylightName[32];\n SYSTEMTIME DaylightDate;\n LONG DaylightBias;\n} TIME_ZONE_INFORMATION, *PTIME_ZONE_INFORMATION, *LPTIME_ZONE_INFORMATION;\n#endif\n\n//\n// Native version of Timezone Structure\n//\ntypedef LPTIME_ZONE_INFORMATION PRTL_TIME_ZONE_INFORMATION;\n\n//\n// Hotpatch Header\n//\ntypedef struct _RTL_PATCH_HEADER\n{\n LIST_ENTRY PatchList;\n PVOID PatchImageBase;\n struct _RTL_PATCH_HEADER *NextPath;\n ULONG PatchFlags;\n LONG PatchRefCount;\n struct _HOTPATCH_HEADER *HotpatchHeader;\n UNICODE_STRING TargetDllName;\n PVOID TargetDllBase;\n PLDR_DATA_TABLE_ENTRY TargetLdrDataTableEntry;\n PLDR_DATA_TABLE_ENTRY PatchLdrDataTableEntry;\n struct _SYSTEM_HOTPATCH_CODE_INFORMATION *CodeInfo;\n} RTL_PATCH_HEADER, *PRTL_PATCH_HEADER;\n\n//\n// Header for NLS Files\n//\ntypedef struct _NLS_FILE_HEADER\n{\n USHORT HeaderSize;\n USHORT CodePage;\n USHORT MaximumCharacterSize;\n USHORT DefaultChar;\n USHORT UniDefaultChar;\n USHORT TransDefaultChar;\n USHORT TransUniDefaultChar;\n USHORT DBCSCodePage;\n UCHAR LeadByte[MAXIMUM_LEADBYTES];\n} NLS_FILE_HEADER, *PNLS_FILE_HEADER;\n\n//\n// Stack Traces\n//\ntypedef struct _RTL_STACK_TRACE_ENTRY\n{\n struct _RTL_STACK_TRACE_ENTRY *HashChain;\n ULONG TraceCount;\n USHORT Index;\n USHORT Depth;\n PVOID BackTrace[32];\n} RTL_STACK_TRACE_ENTRY, *PRTL_STACK_TRACE_ENTRY;\n\ntypedef struct _STACK_TRACE_DATABASE\n{\n RTL_CRITICAL_SECTION CriticalSection;\n} STACK_TRACE_DATABASE, *PSTACK_TRACE_DATABASE;\n\n#ifndef NTOS_MODE_USER\n\n//\n// Message Resource Entry, Block and Data\n//\ntypedef struct _MESSAGE_RESOURCE_ENTRY\n{\n USHORT Length;\n USHORT Flags;\n UCHAR Text[ANYSIZE_ARRAY];\n} MESSAGE_RESOURCE_ENTRY, *PMESSAGE_RESOURCE_ENTRY;\n\ntypedef struct _MESSAGE_RESOURCE_BLOCK\n{\n ULONG LowId;\n ULONG HighId;\n ULONG OffsetToEntries;\n} MESSAGE_RESOURCE_BLOCK, *PMESSAGE_RESOURCE_BLOCK;\n\ntypedef struct _MESSAGE_RESOURCE_DATA\n{\n ULONG NumberOfBlocks;\n MESSAGE_RESOURCE_BLOCK Blocks[ANYSIZE_ARRAY];\n} MESSAGE_RESOURCE_DATA, *PMESSAGE_RESOURCE_DATA;\n\n#endif\n#endif\n" }, { "path": "ndk/sefuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n sefuncs.h\n\nAbstract:\n\n Function definitions for the security manager.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _SEFUNCS_H\n#define _SEFUNCS_H\n\n//\n// Dependencies\n//\n#include \n\n#ifndef NTOS_MODE_USER\n\n//\n// Security Descriptors\n//\nNTKERNELAPI\nNTSTATUS\nNTAPI\nSeCaptureSecurityDescriptor(\n IN PSECURITY_DESCRIPTOR OriginalSecurityDescriptor,\n IN KPROCESSOR_MODE CurrentMode,\n IN POOL_TYPE PoolType,\n IN BOOLEAN CaptureIfKernel,\n OUT PSECURITY_DESCRIPTOR *CapturedSecurityDescriptor\n);\n\nNTKERNELAPI\nNTSTATUS\nNTAPI\nSeReleaseSecurityDescriptor(\n IN PSECURITY_DESCRIPTOR CapturedSecurityDescriptor,\n IN KPROCESSOR_MODE CurrentMode,\n IN BOOLEAN CaptureIfKernelMode\n);\n\n//\n// Access States\n//\nNTKERNELAPI\nNTSTATUS\nNTAPI\nSeCreateAccessState(\n PACCESS_STATE AccessState,\n PAUX_DATA AuxData,\n ACCESS_MASK Access,\n PGENERIC_MAPPING GenericMapping\n);\n\nNTKERNELAPI\nVOID\nNTAPI\nSeDeleteAccessState(\n IN PACCESS_STATE AccessState\n);\n\n//\n// Impersonation\n//\nNTKERNELAPI\nSECURITY_IMPERSONATION_LEVEL\nNTAPI\nSeTokenImpersonationLevel(\n IN PACCESS_TOKEN Token\n);\n\n#endif\n\n//\n// Native Calls\n//\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAccessCheck(\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN HANDLE ClientToken,\n IN ACCESS_MASK DesiredAccess,\n IN PGENERIC_MAPPING GenericMapping,\n OUT PPRIVILEGE_SET PrivilegeSet,\n OUT PULONG ReturnLength,\n OUT PACCESS_MASK GrantedAccess,\n OUT PNTSTATUS AccessStatus\n);\n\nNTSTATUS\nNTAPI\nNtAccessCheckByType(\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN PSID PrincipalSelfSid,\n IN HANDLE ClientToken,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_TYPE_LIST ObjectTypeList,\n IN ULONG ObjectTypeLength,\n IN PGENERIC_MAPPING GenericMapping,\n IN PPRIVILEGE_SET PrivilegeSet,\n IN ULONG PrivilegeSetLength,\n OUT PACCESS_MASK GrantedAccess,\n OUT PNTSTATUS AccessStatus\n);\n\nNTSTATUS\nNTAPI\nNtAccessCheckByTypeResultList(\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN PSID PrincipalSelfSid,\n IN HANDLE ClientToken,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_TYPE_LIST ObjectTypeList,\n IN ULONG ObjectTypeLength,\n IN PGENERIC_MAPPING GenericMapping,\n IN PPRIVILEGE_SET PrivilegeSet,\n IN ULONG PrivilegeSetLength,\n OUT PACCESS_MASK GrantedAccess,\n OUT PNTSTATUS AccessStatus\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAccessCheckAndAuditAlarm(\n IN PUNICODE_STRING SubsystemName,\n IN PVOID HandleId,\n IN PUNICODE_STRING ObjectTypeName,\n IN PUNICODE_STRING ObjectName,\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN ACCESS_MASK DesiredAccess,\n IN PGENERIC_MAPPING GenericMapping,\n IN BOOLEAN ObjectCreation,\n OUT PACCESS_MASK GrantedAccess,\n OUT PNTSTATUS AccessStatus,\n OUT PBOOLEAN GenerateOnClose\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAdjustGroupsToken(\n IN HANDLE TokenHandle,\n IN BOOLEAN ResetToDefault,\n IN PTOKEN_GROUPS NewState,\n IN ULONG BufferLength,\n OUT PTOKEN_GROUPS PreviousState OPTIONAL,\n OUT PULONG ReturnLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAdjustPrivilegesToken(\n IN HANDLE TokenHandle,\n IN BOOLEAN DisableAllPrivileges,\n IN PTOKEN_PRIVILEGES NewState,\n IN ULONG BufferLength,\n OUT PTOKEN_PRIVILEGES PreviousState,\n OUT PULONG ReturnLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAllocateLocallyUniqueId(\n OUT LUID *LocallyUniqueId\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAllocateUuids(\n PULARGE_INTEGER Time,\n PULONG Range,\n PULONG Sequence,\n PUCHAR Seed\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCompareTokens(\n IN HANDLE FirstTokenHandle,\n IN HANDLE SecondTokenHandle,\n OUT PBOOLEAN Equal);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateToken(\n OUT PHANDLE TokenHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN TOKEN_TYPE TokenType,\n IN PLUID AuthenticationId,\n IN PLARGE_INTEGER ExpirationTime,\n IN PTOKEN_USER TokenUser,\n IN PTOKEN_GROUPS TokenGroups,\n IN PTOKEN_PRIVILEGES TokenPrivileges,\n IN PTOKEN_OWNER TokenOwner,\n IN PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,\n IN PTOKEN_DEFAULT_DACL TokenDefaultDacl,\n IN PTOKEN_SOURCE TokenSource\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDuplicateToken(\n IN HANDLE ExistingTokenHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN BOOLEAN EffectiveOnly,\n IN TOKEN_TYPE TokenType,\n OUT PHANDLE NewTokenHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtImpersonateAnonymousToken(\n IN HANDLE Thread\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenObjectAuditAlarm(\n IN PUNICODE_STRING SubsystemName,\n IN PVOID HandleId,\n IN PUNICODE_STRING ObjectTypeName,\n IN PUNICODE_STRING ObjectName,\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN HANDLE ClientToken,\n IN ULONG DesiredAccess,\n IN ULONG GrantedAccess,\n IN PPRIVILEGE_SET Privileges,\n IN BOOLEAN ObjectCreation,\n IN BOOLEAN AccessGranted,\n OUT PBOOLEAN GenerateOnClose\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenProcessToken(\n IN HANDLE ProcessHandle,\n IN ACCESS_MASK DesiredAccess,\n OUT PHANDLE TokenHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenProcessTokenEx(\n IN HANDLE ProcessHandle,\n IN ACCESS_MASK DesiredAccess,\n IN ULONG HandleAttributes,\n OUT PHANDLE TokenHandle\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPrivilegeCheck(\n IN HANDLE ClientToken,\n IN PPRIVILEGE_SET RequiredPrivileges,\n IN PBOOLEAN Result\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPrivilegedServiceAuditAlarm(\n IN PUNICODE_STRING SubsystemName,\n IN PUNICODE_STRING ServiceName,\n IN HANDLE ClientToken,\n IN PPRIVILEGE_SET Privileges,\n IN BOOLEAN AccessGranted\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPrivilegeObjectAuditAlarm(\n IN PUNICODE_STRING SubsystemName,\n IN PVOID HandleId,\n IN HANDLE ClientToken,\n IN ULONG DesiredAccess,\n IN PPRIVILEGE_SET Privileges,\n IN BOOLEAN AccessGranted\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationToken(\n IN HANDLE TokenHandle,\n IN TOKEN_INFORMATION_CLASS TokenInformationClass,\n OUT PVOID TokenInformation,\n IN ULONG TokenInformationLength,\n OUT PULONG ReturnLength\n);\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationToken(\n IN HANDLE TokenHandle,\n IN TOKEN_INFORMATION_CLASS TokenInformationClass,\n OUT PVOID TokenInformation,\n IN ULONG TokenInformationLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAccessCheck(\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN HANDLE ClientToken,\n IN ACCESS_MASK DesiredAccess,\n IN PGENERIC_MAPPING GenericMapping,\n OUT PPRIVILEGE_SET PrivilegeSet,\n OUT PULONG ReturnLength,\n OUT PACCESS_MASK GrantedAccess,\n OUT PNTSTATUS AccessStatus\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAdjustGroupsToken(\n IN HANDLE TokenHandle,\n IN BOOLEAN ResetToDefault,\n IN PTOKEN_GROUPS NewState,\n IN ULONG BufferLength,\n OUT PTOKEN_GROUPS PreviousState OPTIONAL,\n OUT PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAdjustPrivilegesToken(\n IN HANDLE TokenHandle,\n IN BOOLEAN DisableAllPrivileges,\n IN PTOKEN_PRIVILEGES NewState,\n IN ULONG BufferLength,\n OUT PTOKEN_PRIVILEGES PreviousState,\n OUT PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAllocateLocallyUniqueId(\n OUT LUID *LocallyUniqueId\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAllocateUuids(\n PULARGE_INTEGER Time,\n PULONG Range,\n PULONG Sequence,\n PUCHAR Seed\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateToken(\n OUT PHANDLE TokenHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN TOKEN_TYPE TokenType,\n IN PLUID AuthenticationId,\n IN PLARGE_INTEGER ExpirationTime,\n IN PTOKEN_USER TokenUser,\n IN PTOKEN_GROUPS TokenGroups,\n IN PTOKEN_PRIVILEGES TokenPrivileges,\n IN PTOKEN_OWNER TokenOwner,\n IN PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,\n IN PTOKEN_DEFAULT_DACL TokenDefaultDacl,\n IN PTOKEN_SOURCE TokenSource\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDuplicateToken(\n IN HANDLE ExistingTokenHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN BOOLEAN EffectiveOnly,\n IN TOKEN_TYPE TokenType,\n OUT PHANDLE NewTokenHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwImpersonateAnonymousToken(\n IN HANDLE Thread\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenObjectAuditAlarm(\n IN PUNICODE_STRING SubsystemName,\n IN PVOID HandleId,\n IN PUNICODE_STRING ObjectTypeName,\n IN PUNICODE_STRING ObjectName,\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN HANDLE ClientToken,\n IN ULONG DesiredAccess,\n IN ULONG GrantedAccess,\n IN PPRIVILEGE_SET Privileges,\n IN BOOLEAN ObjectCreation,\n IN BOOLEAN AccessGranted,\n OUT PBOOLEAN GenerateOnClose\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenProcessToken(\n IN HANDLE ProcessHandle,\n IN ACCESS_MASK DesiredAccess,\n OUT PHANDLE TokenHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenProcessTokenEx(\n IN HANDLE ProcessHandle,\n IN ACCESS_MASK DesiredAccess,\n IN ULONG HandleAttributes,\n OUT PHANDLE TokenHandle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwPrivilegeCheck(\n IN HANDLE ClientToken,\n IN PPRIVILEGE_SET RequiredPrivileges,\n IN PBOOLEAN Result\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwPrivilegedServiceAuditAlarm(\n IN PUNICODE_STRING SubsystemName,\n IN PUNICODE_STRING ServiceName,\n IN HANDLE ClientToken,\n IN PPRIVILEGE_SET Privileges,\n IN BOOLEAN AccessGranted\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwPrivilegeObjectAuditAlarm(\n IN PUNICODE_STRING SubsystemName,\n IN PVOID HandleId,\n IN HANDLE ClientToken,\n IN ULONG DesiredAccess,\n IN PPRIVILEGE_SET Privileges,\n IN BOOLEAN AccessGranted\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryInformationToken(\n IN HANDLE TokenHandle,\n IN TOKEN_INFORMATION_CLASS TokenInformationClass,\n OUT PVOID TokenInformation,\n IN ULONG TokenInformationLength,\n OUT PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetInformationToken(\n IN HANDLE TokenHandle,\n IN TOKEN_INFORMATION_CLASS TokenInformationClass,\n OUT PVOID TokenInformation,\n IN ULONG TokenInformationLength\n);\n#endif\n" }, { "path": "ndk/setypes.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n setypes.h\n\nAbstract:\n\n Type definitions for the security manager.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _SETYPES_H\n#define _SETYPES_H\n\n//\n// Dependencies\n//\n#include \n\n//\n// Well Known SIDs\n//\n#define SECURITY_INTERNETSITE_AUTHORITY {0,0,0,0,0,7}\n\n#ifdef NTOS_MODE_USER\n//\n// Privilege constants\n//\n#define SE_MIN_WELL_KNOWN_PRIVILEGE (2L)\n#define SE_CREATE_TOKEN_PRIVILEGE (2L)\n#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L)\n#define SE_LOCK_MEMORY_PRIVILEGE (4L)\n#define SE_INCREASE_QUOTA_PRIVILEGE (5L)\n#define SE_UNSOLICITED_INPUT_PRIVILEGE (6L)\n#define SE_MACHINE_ACCOUNT_PRIVILEGE (6L)\n#define SE_TCB_PRIVILEGE (7L)\n#define SE_SECURITY_PRIVILEGE (8L)\n#define SE_TAKE_OWNERSHIP_PRIVILEGE (9L)\n#define SE_LOAD_DRIVER_PRIVILEGE (10L)\n#define SE_SYSTEM_PROFILE_PRIVILEGE (11L)\n#define SE_SYSTEMTIME_PRIVILEGE (12L)\n#define SE_PROF_SINGLE_PROCESS_PRIVILEGE (13L)\n#define SE_INC_BASE_PRIORITY_PRIVILEGE (14L)\n#define SE_CREATE_PAGEFILE_PRIVILEGE (15L)\n#define SE_CREATE_PERMANENT_PRIVILEGE (16L)\n#define SE_BACKUP_PRIVILEGE (17L)\n#define SE_RESTORE_PRIVILEGE (18L)\n#define SE_SHUTDOWN_PRIVILEGE (19L)\n#define SE_DEBUG_PRIVILEGE (20L)\n#define SE_AUDIT_PRIVILEGE (21L)\n#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE (22L)\n#define SE_CHANGE_NOTIFY_PRIVILEGE (23L)\n#define SE_REMOTE_SHUTDOWN_PRIVILEGE (24L)\n#define SE_MAX_WELL_KNOWN_PRIVILEGE (SE_REMOTE_SHUTDOWN_PRIVILEGE)\n\n#else\n\n//\n// User and Group-related SID Attributes\n//\n#define SE_GROUP_MANDATORY 0x00000001\n#define SE_GROUP_ENABLED_BY_DEFAULT 0x00000002\n#define SE_GROUP_ENABLED 0x00000004\n#define SE_GROUP_OWNER 0x00000008\n#define SE_GROUP_USE_FOR_DENY_ONLY 0x00000010\n#define SE_GROUP_INTEGRITY 0x00000020\n#define SE_GROUP_INTEGRITY_ENABLED 0x00000040\n#define SE_GROUP_RESOURCE 0x20000000\n#define SE_GROUP_LOGON_ID 0xC0000000\n\n#define SE_GROUP_VALID_ATTRIBUTES \\\n (SE_GROUP_MANDATORY | \\\n SE_GROUP_ENABLED_BY_DEFAULT | \\\n SE_GROUP_ENABLED | \\\n SE_GROUP_OWNER | \\\n SE_GROUP_USE_FOR_DENY_ONLY | \\\n SE_GROUP_LOGON_ID | \\\n SE_GROUP_RESOURCE | \\\n SE_GROUP_INTEGRITY | \\\n SE_GROUP_INTEGRITY_ENABLED)\n\n//\n// Audit and Policy Structures\n//\ntypedef struct _SEP_AUDIT_POLICY_CATEGORIES\n{\n UCHAR System:4;\n UCHAR Logon:4;\n UCHAR ObjectAccess:4;\n UCHAR PrivilegeUse:4;\n UCHAR DetailedTracking:4;\n UCHAR PolicyChange:4;\n UCHAR AccountManagement:4;\n UCHAR DirectoryServiceAccess:4;\n UCHAR AccountLogon:4;\n} SEP_AUDIT_POLICY_CATEGORIES, *PSEP_AUDIT_POLICY_CATEGORIES;\n\ntypedef struct _SEP_AUDIT_POLICY_OVERLAY\n{\n ULONGLONG PolicyBits:36;\n UCHAR SetBit:1;\n} SEP_AUDIT_POLICY_OVERLAY, *PSEP_AUDIT_POLICY_OVERLAY;\n\ntypedef struct _SEP_AUDIT_POLICY\n{\n union\n {\n SEP_AUDIT_POLICY_CATEGORIES PolicyElements;\n SEP_AUDIT_POLICY_OVERLAY PolicyOverlay;\n ULONGLONG Overlay;\n };\n} SEP_AUDIT_POLICY, *PSEP_AUDIT_POLICY;\n\ntypedef struct _SE_AUDIT_PROCESS_CREATION_INFO\n{\n POBJECT_NAME_INFORMATION ImageFileName;\n} SE_AUDIT_PROCESS_CREATION_INFO, *PSE_AUDIT_PROCESS_CREATION_INFO;\n\n//\n// Token and auxiliary data\n//\ntypedef struct _TOKEN\n{\n TOKEN_SOURCE TokenSource; /* 0x00 */\n LUID TokenId; /* 0x10 */\n LUID AuthenticationId; /* 0x18 */\n LUID ParentTokenId; /* 0x20 */\n LARGE_INTEGER ExpirationTime; /* 0x28 */\n struct _ERESOURCE *TokenLock; /* 0x30 */\n SEP_AUDIT_POLICY AuditPolicy; /* 0x38 */\n LUID ModifiedId; /* 0x40 */\n ULONG SessionId; /* 0x48 */\n ULONG UserAndGroupCount; /* 0x4C */\n ULONG RestrictedSidCount; /* 0x50 */\n ULONG PrivilegeCount; /* 0x54 */\n ULONG VariableLength; /* 0x58 */\n ULONG DynamicCharged; /* 0x5C */\n ULONG DynamicAvailable; /* 0x60 */\n ULONG DefaultOwnerIndex; /* 0x64 */\n PSID_AND_ATTRIBUTES UserAndGroups; /* 0x68 */\n PSID_AND_ATTRIBUTES RestrictedSids; /* 0x6C */\n PSID PrimaryGroup; /* 0x70 */\n PLUID_AND_ATTRIBUTES Privileges; /* 0x74 */\n PULONG DynamicPart; /* 0x78 */\n PACL DefaultDacl; /* 0x7C */\n TOKEN_TYPE TokenType; /* 0x80 */\n SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; /* 0x84 */\n ULONG TokenFlags; /* 0x88 */\n BOOLEAN TokenInUse; /* 0x8C */\n PVOID ProxyData; /* 0x90 */\n PVOID AuditData; /* 0x94 */\n LUID OriginatingLogonSession; /* 0x98 */\n ULONG VariablePart; /* 0xA0 */\n} TOKEN, *PTOKEN;\n\ntypedef struct _AUX_DATA\n{\n PPRIVILEGE_SET PrivilegeSet;\n GENERIC_MAPPING GenericMapping;\n ULONG Reserved;\n} AUX_DATA, *PAUX_DATA;\n\n//\n// External SRM Data\n//\nextern PACL SePublicDefaultDacl;\nextern PACL SeSystemDefaultDacl;\n\n#endif\n#endif\n" }, { "path": "ndk/umfuncs.h", "content": "/*++ NDK Version: 0098\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n umfuncs.h\n\nAbstract:\n\n Function definitions for Native DLL (ntdll) APIs exclusive to User Mode.\n\nAuthor:\n\n Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006\n\n--*/\n\n#ifndef _UMFUNCS_H\n#define _UMFUNCS_H\n\n//\n// Dependencies\n//\n#include \n#include \n\n//\n// Don't force inclusion of csrss header, leave this opaque.\n//\nstruct _CSR_API_MESSAGE;\nstruct _CSR_CAPTURE_BUFFER;\n\n//\n// CSR Functions\n//\nPVOID\nNTAPI\nCsrAllocateCaptureBuffer(\n ULONG ArgumentCount,\n ULONG BufferSize\n);\n\nULONG\nNTAPI\nCsrAllocateMessagePointer(\n struct _CSR_CAPTURE_BUFFER *CaptureBuffer,\n ULONG MessageLength,\n PVOID *CaptureData\n);\n\nVOID\nNTAPI\nCsrCaptureMessageBuffer(\n struct _CSR_CAPTURE_BUFFER *CaptureBuffer,\n PVOID MessageString,\n ULONG StringLength,\n PVOID *CapturedData\n);\n\nNTSTATUS\nNTAPI\nCsrClientConnectToServer(\n PWSTR ObjectDirectory,\n ULONG ServerId,\n PVOID ConnectionInfo,\n PULONG ConnectionInfoSize,\n PBOOLEAN ServerToServerCall\n);\n\nNTSTATUS\nNTAPI\nCsrClientCallServer(\n struct _CSR_API_MESSAGE *Request,\n struct _CSR_CAPTURE_BUFFER *CaptureBuffer OPTIONAL,\n ULONG ApiNumber,\n ULONG RequestLength\n);\n\nNTSTATUS\nNTAPI\nCsrIdentifyAlertableThread(\n VOID\n);\n\nVOID\nNTAPI\nCsrFreeCaptureBuffer(\n struct _CSR_CAPTURE_BUFFER *CaptureBuffer\n);\n\nHANDLE\nNTAPI\nCsrGetProcessId(\n VOID\n);\n\nNTSTATUS\nNTAPI\nCsrNewThread(VOID);\n\nNTSTATUS\nNTAPI\nCsrSetPriorityClass(\n HANDLE Process,\n PULONG PriorityClass\n);\n\nVOID\nNTAPI\nCsrProbeForRead(\n IN PVOID Address,\n IN ULONG Length,\n IN ULONG Alignment\n);\n\nVOID\nNTAPI\nCsrProbeForWrite(\n IN PVOID Address,\n IN ULONG Length,\n IN ULONG Alignment\n);\n\n//\n// Debug Functions\n//\nNTSYSAPI\nVOID\nNTAPI\nDbgBreakPointWithStatus(\n IN ULONG Status\n);\n\nNTSTATUS\nNTAPI\nDbgUiConnectToDbg(\n VOID\n);\n\nNTSTATUS\nNTAPI\nDbgUiContinue(\n IN PCLIENT_ID ClientId,\n IN NTSTATUS ContinueStatus\n);\n\nNTSTATUS\nNTAPI\nDbgUiDebugActiveProcess(\n IN HANDLE Process\n);\n\nNTSTATUS\nNTAPI\nDbgUiStopDebugging(\n IN HANDLE Process\n);\n\nNTSTATUS\nNTAPI\nDbgUiWaitStateChange(\n IN PDBGUI_WAIT_STATE_CHANGE DbgUiWaitStateCange,\n IN PLARGE_INTEGER TimeOut\n);\n\nNTSTATUS\nNTAPI\nDbgUiConvertStateChangeStructure(\n IN PDBGUI_WAIT_STATE_CHANGE WaitStateChange,\n IN PVOID DebugEvent\n);\n\nVOID\nNTAPI\nDbgUiRemoteBreakin(\n VOID\n);\n\nNTSTATUS\nNTAPI\nDbgUiIssueRemoteBreakin(\n IN HANDLE Process\n);\n\nHANDLE\nNTAPI\nDbgUiGetThreadDebugObject(\n VOID\n);\n\n//\n// Loader Functions\n//\n\nNTSTATUS\nNTAPI\nLdrAddRefDll(\n IN ULONG Flags,\n IN PVOID BaseAddress\n);\n\nNTSTATUS\nNTAPI\nLdrDisableThreadCalloutsForDll(\n IN PVOID BaseAddress\n);\n\nNTSTATUS\nNTAPI\nLdrGetDllHandle(\n IN PWSTR DllPath OPTIONAL,\n IN PULONG DllCharacteristics,\n IN PUNICODE_STRING DllName,\n OUT PVOID *DllHandle\n);\n\nNTSTATUS\nNTAPI\nLdrFindEntryForAddress(\n IN PVOID Address,\n OUT PLDR_DATA_TABLE_ENTRY *Module\n);\n\nNTSTATUS\nNTAPI\nLdrGetProcedureAddress(\n IN PVOID BaseAddress,\n IN PANSI_STRING Name,\n IN ULONG Ordinal,\n OUT PVOID *ProcedureAddress\n);\n\nVOID\nNTAPI\nLdrInitializeThunk(\n ULONG Unknown1,\n ULONG Unknown2,\n ULONG Unknown3,\n ULONG Unknown4\n);\n\nNTSTATUS\nNTAPI\nLdrLoadDll(\n IN PWSTR SearchPath OPTIONAL,\n IN PULONG LoadFlags OPTIONAL,\n IN PUNICODE_STRING Name,\n OUT PVOID *BaseAddress OPTIONAL\n);\n\nPIMAGE_BASE_RELOCATION\nNTAPI\nLdrProcessRelocationBlock(\n IN ULONG_PTR Address,\n IN ULONG Count,\n IN PUSHORT TypeOffset,\n IN LONG_PTR Delta\n);\n\nNTSTATUS\nNTAPI\nLdrQueryImageFileExecutionOptions(\n IN PUNICODE_STRING SubKey,\n IN PCWSTR ValueName,\n IN ULONG ValueSize,\n OUT PVOID Buffer,\n IN ULONG BufferSize,\n OUT PULONG RetunedLength OPTIONAL\n);\n\nNTSTATUS\nNTAPI\nLdrQueryProcessModuleInformation(\n IN PRTL_PROCESS_MODULES ModuleInformation OPTIONAL,\n IN ULONG Size OPTIONAL,\n OUT PULONG ReturnedSize\n);\n\nNTSTATUS\nNTAPI\nLdrShutdownProcess(\n VOID\n);\n\nNTSTATUS\nNTAPI\nLdrShutdownThread(\n VOID\n);\n\nNTSTATUS\nNTAPI\nLdrUnloadDll(\n IN PVOID BaseAddress\n);\n\nNTSTATUS\nNTAPI\nLdrVerifyImageMatchesChecksum(\n IN HANDLE FileHandle,\n ULONG Unknown1,\n ULONG Unknown2,\n ULONG Unknown3\n);\n\n#endif\n" }, { "path": "ndk/umtypes.h", "content": "/*++ NDK Version: 0095\n\nCopyright (c) Alex Ionescu. All rights reserved.\n\nHeader Name:\n\n umtypes.h\n\nAbstract:\n\n Type definitions for the basic native types.\n\nAuthor:\n\n Alex Ionescu (alex.ionescu@reactos.com) 06-Oct-2004\n\n--*/\n\n#if !defined(_NTDEF_) && !defined(_NTDEF_H)\n#define _NTDEF_\n#define _NTDEF_H\n\n//\n// NDK Applications must use Unicode\n//\n#ifndef UNICODE\n#define UNICODE\n#endif\n\n//\n// Don't use the SDK status values\n//\n#ifndef WIN32_NO_STATUS\n#define WIN32_NO_STATUS\n#endif\n\n//\n// Let the NDK know we're in Application Mode\n//\n#define NTOS_MODE_USER\n\n//\n// Dependencies\n//\n#include \n#undef WIN32_NO_STATUS\n#include \n#include \n#include \n\n//\n// Compiler Definitions\n//\n#ifndef _MANAGED\n#if defined(_M_IX86)\n#define FASTCALL _fastcall\n#else\n#define FASTCALL\n#endif\n#else\n#define FASTCALL NTAPI\n#endif\n\n#if !defined(_M_CEE_PURE)\n#define NTAPI_INLINE NTAPI\n#else\n#define NTAPI_INLINE\n#endif\n\n//\n// Alignment Macros\n//\n#define ALIGN_DOWN(s, t) \\\n ((ULONG)(s) & ~(sizeof(t) - 1))\n\n#define ALIGN_UP(s, t) \\\n (ALIGN_DOWN(((ULONG)(s) + sizeof(t) - 1), t))\n\n#define ALIGN_DOWN_POINTER(p, t) \\\n ((PVOID)((ULONG_PTR)(p) & ~((ULONG_PTR)sizeof(t) - 1)))\n\n#define ALIGN_UP_POINTER(p, t) \\\n (ALIGN_DOWN_POINTER(((ULONG_PTR)(p) + sizeof(t) - 1), t))\n\n//\n// Native API Return Value Macros\n//\n#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)\n#define NT_INFORMATION(Status) ((((ULONG)(Status)) >> 30) == 1)\n#define NT_WARNING(Status) ((((ULONG)(Status)) >> 30) == 2)\n#define NT_ERROR(Status) ((((ULONG)(Status)) >> 30) == 3)\n\n//\n// Limits\n//\n#define MINCHAR 0x80\n#define MAXCHAR 0x7f\n#define MINSHORT 0x8000\n#define MAXSHORT 0x7fff\n#define MINLONG 0x80000000\n#define MAXLONG 0x7fffffff\n#define MAXUCHAR 0xff\n#define MAXUSHORT 0xffff\n#define MAXULONG 0xffffffff\n\n//\n// CSR Macros\n//\n#define CSR_MAKE_OPCODE(s,m) ((s) << 16) | (m)\n#define CSR_API_ID_FROM_OPCODE(n) ((ULONG)((USHORT)(n)))\n#define CSR_SERVER_ID_FROM_OPCODE(n) (ULONG)((n) >> 16)\n\n//\n// Basic Types that aren't defined in User-Mode Headers\n//\ntypedef CONST int CINT;\ntypedef CONST char *PCSZ;\ntypedef ULONG CLONG;\ntypedef short CSHORT;\ntypedef CSHORT *PCSHORT;\ntypedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;\ntypedef LONG KPRIORITY;\ntypedef LONG NTSTATUS, *PNTSTATUS;\n\n//\n// Basic NT Types\n//\n#if !defined(_NTSECAPI_H) && !defined(_SUBAUTH_H) && !defined(_NTSECAPI_)\n\ntypedef struct _UNICODE_STRING\n{\n USHORT Length;\n USHORT MaximumLength;\n PWSTR Buffer;\n} UNICODE_STRING, *PUNICODE_STRING;\n\ntypedef struct _STRING\n{\n USHORT Length;\n USHORT MaximumLength;\n PCHAR Buffer;\n} STRING, *PSTRING;\n\ntypedef struct _CSTRING\n{\n USHORT Length;\n USHORT MaximumLength;\n CONST CHAR *Buffer;\n} CSTRING, *PCSTRING;\n\n#endif\n\ntypedef struct _OBJECT_ATTRIBUTES\n{\n ULONG Length;\n HANDLE RootDirectory;\n PUNICODE_STRING ObjectName;\n ULONG Attributes;\n PVOID SecurityDescriptor;\n PVOID SecurityQualityOfService;\n} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;\n\n//\n// ClientID Structure\n//\ntypedef struct _CLIENT_ID\n{\n HANDLE UniqueProcess;\n HANDLE UniqueThread;\n} CLIENT_ID, *PCLIENT_ID;\n\ntypedef const UNICODE_STRING* PCUNICODE_STRING;\ntypedef STRING ANSI_STRING;\ntypedef PSTRING PANSI_STRING;\ntypedef STRING OEM_STRING;\ntypedef PSTRING POEM_STRING;\ntypedef CONST STRING* PCOEM_STRING;\ntypedef STRING CANSI_STRING;\ntypedef PSTRING PCANSI_STRING;\n\n#endif\n" }, { "path": "ntfile.c", "content": "/**\n * PROJECT: Native Shell\n * COPYRIGHT: LGPL; See LICENSE in the top level directory\n * FILE: ntfile.c\n * DESCRIPTION: File operations.\n * DEVELOPERS: See CONTRIBUTORS.md in the top level directory\n */\n\n#include \"precomp.h\"\n#include \"ntfile.h\"\n\nBOOLEAN NtFileOpenDirectory(HANDLE *phRetFile, WCHAR *pwszFileName, BOOLEAN bWrite, BOOLEAN bOverwrite)\n{\n HANDLE hFile;\n UNICODE_STRING ustrFileName;\n IO_STATUS_BLOCK IoStatusBlock;\n ULONG CreateDisposition = 0;\n WCHAR wszFileName[1024] = L\"\\\\??\\\\\";\n OBJECT_ATTRIBUTES ObjectAttributes;\n\n wcscat(wszFileName, pwszFileName);\n\n RtlInitUnicodeString(&ustrFileName, wszFileName);\n\n InitializeObjectAttributes(&ObjectAttributes,\n &ustrFileName,\n OBJ_CASE_INSENSITIVE,\n NULL,\n NULL);\n\n if (bWrite)\n {\n if (bOverwrite)\n {\n CreateDisposition = FILE_OVERWRITE_IF;\n }\n else\n {\n CreateDisposition = FILE_OPEN_IF;\n }\n }\n else\n {\n CreateDisposition = FILE_OPEN;\n }\n\n NtCreateFile(&hFile,\n FILE_LIST_DIRECTORY | SYNCHRONIZE | FILE_OPEN_FOR_BACKUP_INTENT,\n &ObjectAttributes,\n &IoStatusBlock,\n 0,\n FILE_ATTRIBUTE_NORMAL,\n FILE_SHARE_READ | FILE_SHARE_WRITE,\n FILE_CREATE,\n FILE_SYNCHRONOUS_IO_NONALERT | FILE_DIRECTORY_FILE,\n NULL,\n 0);\n\n *phRetFile = hFile;\n\n return TRUE;\n}\n\nBOOLEAN NtFileOpenFile(HANDLE *phRetFile, WCHAR *pwszFileName, BOOLEAN bWrite, BOOLEAN bOverwrite)\n{\n HANDLE hFile;\n UNICODE_STRING ustrFileName;\n IO_STATUS_BLOCK IoStatusBlock;\n ULONG CreateDisposition = 0;\n WCHAR wszFileName[1024] = L\"\\\\??\\\\\";\n OBJECT_ATTRIBUTES ObjectAttributes;\n NTSTATUS ntStatus;\n\n wcscat(wszFileName, pwszFileName);\n\n RtlInitUnicodeString(&ustrFileName, wszFileName);\n\n InitializeObjectAttributes(&ObjectAttributes,\n &ustrFileName,\n OBJ_CASE_INSENSITIVE,\n NULL,\n NULL);\n\n if (bWrite)\n {\n if (bOverwrite)\n {\n CreateDisposition = FILE_OVERWRITE_IF;\n }\n else\n {\n CreateDisposition = FILE_OPEN_IF;\n }\n }\n else\n {\n CreateDisposition = FILE_OPEN;\n }\n\n ntStatus = NtCreateFile(&hFile, GENERIC_WRITE | SYNCHRONIZE | GENERIC_READ,\n &ObjectAttributes, &IoStatusBlock, 0, FILE_ATTRIBUTE_NORMAL, 0,\n CreateDisposition, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);\n\n if (!NT_SUCCESS(ntStatus))\n {\n RtlCliDisplayString(\"NtCreateFile() failed 0x%.8X\\n\", ntStatus);\n return FALSE;\n }\n\n *phRetFile = hFile;\n\n return TRUE;\n}\n\nBOOLEAN NtFileWriteFile(HANDLE hFile, LPVOID lpData, DWORD dwBufferSize, DWORD *pRetWrittenSize)\n{\n IO_STATUS_BLOCK sIoStatus;\n NTSTATUS ntStatus = 0;\n\n memset(&sIoStatus, 0, sizeof(IO_STATUS_BLOCK));\n\n ntStatus = NtWriteFile(hFile, NULL, NULL, NULL, &sIoStatus, lpData, dwBufferSize, NULL, NULL);\n\n if (ntStatus == STATUS_SUCCESS)\n {\n if (pRetWrittenSize)\n {\n *pRetWrittenSize = sIoStatus.Information & MAXULONG;\n }\n return TRUE;\n }\n\n return FALSE;\n}\n\nBOOLEAN NtFileCopyFile(WCHAR *pszSrc, WCHAR *pszDst)\n{\n HANDLE hSrc = NULL;\n HANDLE hDst = NULL;\n BYTE byData[8192];\n LONGLONG lFileSize = 0;\n LONGLONG lWrittenSizeTotal = 0;\n DWORD dwReadSize = 0;\n DWORD dwWrittenSize = 0;\n BOOLEAN bResult = 0;\n\n bResult = NtFileOpenFile(&hSrc, pszSrc, FALSE, FALSE);\n if (bResult == FALSE)\n {\n return FALSE;\n }\n\n bResult = NtFileOpenFile(&hDst, pszDst, TRUE, TRUE);\n\n if (bResult == FALSE)\n {\n NtFileCloseFile(hSrc);\n return FALSE;\n }\n\n if (NtFileGetFileSize(hSrc, &lFileSize) == FALSE)\n {\n NtFileCloseFile(hSrc);\n NtFileCloseFile(hDst);\n return FALSE;\n }\n\n lWrittenSizeTotal = 0;\n while (1)\n {\n dwReadSize = 0;\n\n if (NtFileReadFile(hSrc, byData, 8192, &dwReadSize) == FALSE)\n {\n NtFileCloseFile(hSrc);\n NtFileCloseFile(hDst);\n return FALSE;\n }\n\n if (NtFileWriteFile(hDst, byData, dwReadSize, &dwWrittenSize) == FALSE)\n {\n NtFileCloseFile(hSrc);\n NtFileCloseFile(hDst);\n return FALSE;\n }\n\n if (dwReadSize != dwWrittenSize)\n {\n NtFileCloseFile(hSrc);\n NtFileCloseFile(hDst);\n return FALSE;\n }\n\n lWrittenSizeTotal += dwWrittenSize;\n if (lWrittenSizeTotal == lFileSize)\n {\n // End of File...\n break;\n }\n }\n\n NtFileCloseFile(hSrc);\n NtFileCloseFile(hDst);\n\n return TRUE;\n}\n\nBOOLEAN NtFileReadFile(HANDLE hFile, LPVOID pOutBuffer, DWORD dwOutBufferSize, DWORD *pRetReadSize)\n{\n IO_STATUS_BLOCK sIoStatus;\n NTSTATUS ntStatus = 0;\n\n memset(&sIoStatus, 0, sizeof(IO_STATUS_BLOCK));\n\n ntStatus = NtReadFile(hFile, NULL, NULL, NULL, &sIoStatus, pOutBuffer, dwOutBufferSize, NULL, NULL);\n if (ntStatus == STATUS_SUCCESS)\n {\n if (pRetReadSize)\n {\n *pRetReadSize = sIoStatus.Information & MAXULONG;\n }\n\n return TRUE;\n }\n return FALSE;\n}\n\nBOOLEAN NtFileGetFilePosition(HANDLE hFile, LONGLONG *pRetCurrentPosition)\n{\n IO_STATUS_BLOCK sIoStatus;\n FILE_POSITION_INFORMATION sFilePosition;\n NTSTATUS ntStatus = 0;\n\n memset(&sIoStatus, 0, sizeof(IO_STATUS_BLOCK));\n memset(&sFilePosition, 0, sizeof(FILE_POSITION_INFORMATION));\n\n ntStatus = NtQueryInformationFile(hFile, &sIoStatus, &sFilePosition,\n sizeof(FILE_POSITION_INFORMATION), FilePositionInformation);\n if (ntStatus == STATUS_SUCCESS)\n {\n if (pRetCurrentPosition)\n {\n *pRetCurrentPosition = (sFilePosition.CurrentByteOffset.QuadPart);\n }\n return TRUE;\n }\n\n return FALSE;\n}\n\nBOOLEAN NtFileGetFileSize(HANDLE hFile, LONGLONG *pRetFileSize)\n{\n IO_STATUS_BLOCK sIoStatus;\n FILE_STANDARD_INFORMATION sFileInfo;\n NTSTATUS ntStatus = 0;\n\n memset(&sIoStatus, 0, sizeof(IO_STATUS_BLOCK));\n memset(&sFileInfo, 0, sizeof(FILE_STANDARD_INFORMATION));\n\n ntStatus = NtQueryInformationFile(hFile, &sIoStatus, &sFileInfo,\n sizeof(FILE_STANDARD_INFORMATION), FileStandardInformation);\n if (ntStatus == STATUS_SUCCESS)\n {\n if (pRetFileSize)\n {\n *pRetFileSize = (sFileInfo.EndOfFile.QuadPart);\n }\n return TRUE;\n }\n\n return FALSE;\n}\nBOOLEAN NtFileSeekFile(HANDLE hFile, LONGLONG lAmount)\n{\n IO_STATUS_BLOCK sIoStatus;\n FILE_POSITION_INFORMATION sFilePosition;\n NTSTATUS ntStatus = 0;\n\n memset(&sIoStatus, 0, sizeof(IO_STATUS_BLOCK));\n\n sFilePosition.CurrentByteOffset.QuadPart = lAmount;\n ntStatus = NtSetInformationFile(hFile, &sIoStatus, &sFilePosition,\n sizeof(FILE_POSITION_INFORMATION), FilePositionInformation);\n if (ntStatus == STATUS_SUCCESS)\n {\n return TRUE;\n }\n\n return FALSE;\n}\n\nBOOLEAN NtFileCloseFile(HANDLE hFile)\n{\n NTSTATUS ntStatus = 0;\n\n ntStatus = NtClose(hFile);\n\n if (ntStatus == STATUS_SUCCESS)\n {\n return TRUE;\n }\n\n return FALSE;\n}\n\n// filename - full path in DOS format\nBOOLEAN NtFileDeleteFile(PCWSTR filename)\n{\n UNICODE_STRING us;\n NTSTATUS status;\n OBJECT_ATTRIBUTES oa;\n\n RtlInitUnicodeString(&us, filename);\n\n if (!RtlDosPathNameToNtPathName_U(filename, &us, NULL, NULL))\n {\n return FALSE;\n }\n\n InitializeObjectAttributes(&oa, &us, OBJ_CASE_INSENSITIVE, NULL, NULL);\n status = NtDeleteFile(&oa);\n\n if (!NT_SUCCESS(status))\n {\n return FALSE;\n }\n\n return TRUE;\n}\n\nBOOLEAN NtFileCreateDirectory(PCWSTR dirname)\n{\n UNICODE_STRING us;\n NTSTATUS status;\n HANDLE hFile;\n OBJECT_ATTRIBUTES oa;\n IO_STATUS_BLOCK iosb;\n\n if (!RtlDosPathNameToNtPathName_U(dirname, &us, NULL, NULL))\n {\n return FALSE;\n }\n\n InitializeObjectAttributes(&oa, &us, OBJ_CASE_INSENSITIVE, NULL, NULL);\n\n status = NtCreateFile(&hFile,\n FILE_LIST_DIRECTORY | SYNCHRONIZE | FILE_OPEN_FOR_BACKUP_INTENT,\n &oa,\n &iosb,\n NULL,\n FILE_ATTRIBUTE_NORMAL,\n FILE_SHARE_READ | FILE_SHARE_WRITE,\n FILE_CREATE,\n FILE_SYNCHRONOUS_IO_NONALERT | FILE_DIRECTORY_FILE,\n NULL,\n 0);\n\n if (NT_SUCCESS(status))\n {\n NtClose(hFile);\n return TRUE;\n }\n\n /* if it already exists then return success */\n if (status == STATUS_OBJECT_NAME_COLLISION)\n {\n return TRUE;\n }\n\n return FALSE;\n}\n\n/*\nlpExistingFileName - full path in DOS format\nlpNewFileName - full path in DOS format, or filename\n*/\n\nBOOLEAN NtFileMoveFile(IN LPCWSTR lpExistingFileName, IN LPCWSTR lpNewFileName, BOOLEAN ReplaceIfExists)\n{\n PFILE_RENAME_INFORMATION FileRenameInfo;\n OBJECT_ATTRIBUTES ObjectAttributes;\n IO_STATUS_BLOCK IoStatusBlock;\n UNICODE_STRING ExistingFileNameU;\n WCHAR NewFileName[MAX_PATH] = L\"\\\\??\\\\\";\n HANDLE FileHandle;\n DWORD FileNameSize;\n\n NTSTATUS Status;\n\n if (!lpExistingFileName || !lpNewFileName)\n {\n return FALSE;\n }\n\n RtlDosPathNameToNtPathName_U(lpExistingFileName, &ExistingFileNameU, NULL, NULL);\n\n if ((wcslen(lpNewFileName) > 2) && L':' == lpNewFileName[1])\n {\n wcsncat(NewFileName, lpNewFileName, MAX_PATH);\n }\n else\n {\n wcsncpy(NewFileName, lpNewFileName, MAX_PATH);\n }\n\n RtlCliDisplayString(\"NtFileMoveFile (%S, %S)\\n\", ExistingFileNameU.Buffer, NewFileName);\n\n InitializeObjectAttributes(&ObjectAttributes,\n &ExistingFileNameU,\n OBJ_CASE_INSENSITIVE,\n NULL,\n NULL);\n\n Status = NtCreateFile(&FileHandle,\n FILE_ALL_ACCESS,\n &ObjectAttributes,\n &IoStatusBlock,\n NULL,\n FILE_ATTRIBUTE_NORMAL,\n FILE_SHARE_READ | FILE_SHARE_WRITE,\n FILE_OPEN,\n FILE_SYNCHRONOUS_IO_NONALERT,\n NULL,\n 0);\n\n if (!NT_SUCCESS(Status))\n {\n RtlCliDisplayString(\"NtCreateFile() failed (Status %lx)\\n\", Status);\n return FALSE;\n }\n\n FileNameSize = wcslen(NewFileName) * sizeof(*NewFileName);\n\n FileRenameInfo = RtlAllocateHeap(RtlGetProcessHeap(),\n HEAP_ZERO_MEMORY, sizeof(FILE_RENAME_INFORMATION) + FileNameSize);\n\n if (!FileRenameInfo)\n {\n RtlCliDisplayString(\"RtlAllocateHeap failed\\n\");\n NtClose(FileHandle);\n return FALSE;\n }\n\n FileRenameInfo->RootDirectory = NULL;\n FileRenameInfo->ReplaceIfExists = ReplaceIfExists;\n FileRenameInfo->FileNameLength = FileNameSize;\n RtlCopyMemory(FileRenameInfo->FileName, NewFileName, FileNameSize);\n\n Status = NtSetInformationFile(\n FileHandle,\n &IoStatusBlock,\n FileRenameInfo,\n sizeof(FILE_RENAME_INFORMATION) + FileNameSize,\n FileRenameInformation);\n\n RtlFreeHeap(RtlGetProcessHeap(), 0, FileRenameInfo);\n\n NtClose(FileHandle);\n\n return TRUE;\n}\n" }, { "path": "ntfile.h", "content": "\n#ifndef NATIVEFILE_FUNCTIONS_H\n#define NATIVEFILE_FUNCTIONS_H 1\n\n#include \n\nBOOLEAN NtFileOpenFile(HANDLE *phRetFile, WCHAR *pwszFileName, BOOLEAN bWrite, BOOLEAN bOverwrite);\nBOOLEAN NtFileOpenDirectory(HANDLE *phRetFile, WCHAR *pwszFileName, BOOLEAN bWrite, BOOLEAN bOverwrite);\n\nBOOLEAN NtFileReadFile(HANDLE hFile, LPVOID pOutBuffer, DWORD dwOutBufferSize, DWORD *pRetReadSize);\nBOOLEAN NtFileWriteFile(HANDLE hFile, LPVOID lpData, DWORD dwBufferSize, DWORD *pRetWrittenSize);\n\nBOOLEAN NtFileSeekFile(HANDLE hFile, LONGLONG lAmount);\nBOOLEAN NtFileGetFilePosition(HANDLE hFile, LONGLONG *pRetCurrentPosition);\nBOOLEAN NtFileGetFileSize(HANDLE hFile, LONGLONG *pRetFileSize);\n\nBOOLEAN NtFileCloseFile(HANDLE hFile);\n\nBOOLEAN NtFileCopyFile(WCHAR *pszSrc, WCHAR *pszDst);\n\nBOOLEAN NtFileDeleteFile(PCWSTR filename);\nBOOLEAN NtFileCreateDirectory(PCWSTR dirname);\n\nBOOLEAN NtFileMoveFile(IN LPCWSTR lpExistingFileName, IN LPCWSTR lpNewFileName, BOOLEAN ReplaceIfExists);\n\n#endif\n" }, { "path": "ntreg.c", "content": "/**\n * PROJECT: Native Shell\n * COPYRIGHT: LGPL; See LICENSE in the top level directory\n * FILE: ntreg.c\n * DESCRIPTION: Registry operations.\n * DEVELOPERS: See CONTRIBUTORS.md in the top level directory\n */\n\n#include \"ntreg.h\"\n#include \"precomp.h\"\n\nWCHAR *NtRegGetRootPath(H_KEY hkRoot)\n{\n if (hkRoot == HKEY_LOCAL_MACHINE)\n {\n return L\"\\\\Registry\\\\Machine\";\n }\n else if (hkRoot == HKEY_CLASSES_ROOT)\n {\n return L\"\\\\Registry\\\\Machine\\\\SOFTWARE\\\\Classes\";\n }\n else if (hkRoot == HKEY_CURRENT_CONFIG)\n {\n return L\"\\\\Registry\\\\Machine\\\\System\\\\CurrentControlSet\\\\Hardware \"\n L\"Profiles\\\\Current\";\n }\n else if (hkRoot == HKEY_USERS)\n {\n return L\"\\\\Registry\\\\User\";\n }\n return NULL;\n}\n\nBOOLEAN\nNtRegOpenKey(HANDLE *phKey, H_KEY hkRoot, WCHAR *pwszSubKey, ACCESS_MASK DesiredAccess)\n{\n NTSTATUS nRet = 0;\n HANDLE hReg = 0;\n UNICODE_STRING ustrKeyName;\n WCHAR wszKeyName[4096] = {\n 0,\n };\n WCHAR *pwszRootKey = NULL;\n OBJECT_ATTRIBUTES ObjectAttributes;\n\n pwszRootKey = NtRegGetRootPath(hkRoot);\n if (!pwszRootKey)\n {\n return FALSE;\n }\n\n // Set RootKey\n AppendString(wszKeyName, pwszRootKey);\n\n // Set SubKey\n AppendString(wszKeyName, L\"\\\\\");\n AppendString(wszKeyName, pwszSubKey);\n\n // Setup Unicode String\n SetUnicodeString(&ustrKeyName, wszKeyName);\n\n // printf(\"'%S'\\n\", ustrKeyName.Buffer);\n InitializeObjectAttributes(&ObjectAttributes, &ustrKeyName, OBJ_CASE_INSENSITIVE, NULL, NULL);\n\n nRet = NtOpenKey(phKey, DesiredAccess, &ObjectAttributes);\n\n if (!NT_SUCCESS(nRet))\n {\n RtlCliDisplayString(\"NtOpenKey Error : %X\\n\", nRet);\n return FALSE;\n }\n return TRUE;\n}\n\nBOOLEAN\nNtRegWriteValue(HANDLE hKey, WCHAR *pwszValueName, PVOID pData, ULONG uLength, DWORD dwRegType)\n{\n UNICODE_STRING ustrValueName;\n NTSTATUS nRet;\n\n SetUnicodeString(&ustrValueName, pwszValueName);\n\n nRet = NtSetValueKey(hKey, &ustrValueName, 0,\n dwRegType, // i.e. REG_BINARY\n pData, uLength);\n\n // printf(\"NtRegWriteValue : %X\\n\", nRet);\n if (!NT_SUCCESS(nRet))\n {\n return FALSE;\n }\n\n return TRUE;\n}\n\nBOOLEAN\nNtRegWriteString(HANDLE hKey, WCHAR *pwszValueName, WCHAR *pwszValue)\n{\n BOOLEAN bRet = FALSE;\n\n bRet = NtRegWriteValue(hKey, pwszValueName, pwszValue, (GetStringLength(pwszValue) + 1) * sizeof(WCHAR), REG_SZ);\n\n return bRet;\n}\n\nBOOLEAN\nNtRegDeleteValue(HANDLE hKey, WCHAR *pwszValueName)\n{\n UNICODE_STRING ustrValueName;\n int nRet = 0;\n\n SetUnicodeString(&ustrValueName, pwszValueName);\n\n nRet = NtDeleteValueKey(hKey, &ustrValueName);\n if (!NT_SUCCESS(nRet))\n {\n return FALSE;\n }\n\n return TRUE;\n}\n\nBOOLEAN\nNtRegReadValue(HANDLE hKey, HANDLE hHeapHandle, WCHAR *pszValueName, PKEY_VALUE_PARTIAL_INFORMATION *pRetBuffer,\n ULONG *pRetBufferSize)\n{\n UNICODE_STRING ustrValueName;\n BYTE *pBuffer = NULL;\n ULONG uSize = 1024;\n ULONG uRetSize;\n NTSTATUS ntStatus = 0;\n int i = 0;\n\n SetUnicodeString(&ustrValueName, pszValueName);\n\n for (i = 0; i < 4096; i++)\n {\n pBuffer = kmalloc(hHeapHandle, uSize);\n\n ntStatus = NtQueryValueKey(hKey, &ustrValueName, KeyValuePartialInformation, pBuffer, uSize, &uRetSize);\n\n if (ntStatus == STATUS_SUCCESS)\n {\n break;\n }\n else if (ntStatus == STATUS_INVALID_PARAMETER)\n {\n kfree(hHeapHandle, pBuffer);\n pBuffer = NULL;\n\n return FALSE;\n }\n\n kfree(hHeapHandle, pBuffer);\n pBuffer = NULL;\n\n uSize += 4;\n }\n\n *pRetBuffer = (PKEY_VALUE_PARTIAL_INFORMATION)pBuffer;\n *pRetBufferSize = uSize;\n\n return TRUE;\n}\n\nBOOLEAN\nNtRegCloseKey(HANDLE hKey)\n{\n int nRet = 0;\n\n nRet = NtClose(hKey);\n\n if (!NT_SUCCESS(nRet))\n {\n return FALSE;\n }\n\n return TRUE;\n}\n\nvoid NtEnumKey(HANDLE hKey)\n{\n NTSTATUS nRet = 0;\n char buf[BUFFER_SIZE];\n PKEY_VALUE_BASIC_INFORMATION pbi;\n PKEY_NODE_INFORMATION pki;\n ULONG ResultLength;\n UINT i;\n\n RtlCliDisplayString(\"=========\\n\");\n\n i = 0;\n memset(buf, 0x00, BUFFER_SIZE);\n pki = (PKEY_NODE_INFORMATION)buf;\n\n while (STATUS_SUCCESS == NtEnumerateKey(hKey, i++, KeyNodeInformation, pki, BUFFER_SIZE, &ResultLength))\n {\n if (pki->NameLength)\n {\n RtlCliDisplayString(\"[%S]\\n\", pki->Name);\n }\n else\n {\n RtlCliDisplayString(\"[null]\\n\");\n }\n memset(buf, 0x00, BUFFER_SIZE);\n }\n\n RtlCliDisplayString(\"---------\\n\");\n\n i = 0;\n memset(buf, 0x00, BUFFER_SIZE);\n pbi = (PKEY_VALUE_BASIC_INFORMATION)buf;\n\n while (STATUS_SUCCESS == NtEnumerateValueKey(hKey, i++, KeyValueBasicInformation, pbi, BUFFER_SIZE, &ResultLength))\n {\n RtlCliDisplayString((pbi->Type == REG_SZ) ? \" REG_SZ\"\n : (pbi->Type == REG_MULTI_SZ) ? \" REG_MULTI_SZ\"\n : (pbi->Type == REG_DWORD) ? \" REG_DWORD\"\n : \"Other type (%d)\",\n pbi->Type);\n if (pbi->NameLength)\n {\n RtlCliDisplayString(\" %S\\n\", pbi->Name);\n }\n else\n {\n RtlCliDisplayString(\" (null)\\n\");\n }\n memset(buf, 0x00, BUFFER_SIZE);\n }\n\n RtlCliDisplayString(\"=========\\n\");\n\n return;\n}\n" }, { "path": "ntreg.h", "content": "\n#ifndef NATIVEREGISTRY_FUNCTIONS_H\n#define NATIVEREGISTRY_FUNCTIONS_H 1\n\n#include \n\n#define HKEY_CLASSES_ROOT 0x80000000\n#define HKEY_CURRENT_USER 0x80000001\n#define HKEY_LOCAL_MACHINE 0x80000002\n#define HKEY_USERS 0x80000003\n#define HKEY_PERFORMANCE_DATA 0x80000004\n#define HKEY_PERFORMANCE_TEXT 0x80000050\n#define HKEY_PERFORMANCE_NLSTEXT 0x80000060\n#define HKEY_CURRENT_CONFIG 0x80000005\n#define HKEY_DYN_DATA 0x80000006\n\ntypedef ULONG H_KEY;\n\nWCHAR *NtRegGetRootPath(H_KEY hkRoot);\nBOOLEAN NtRegOpenKey(HANDLE *phKey, H_KEY hkRoot, WCHAR *pwszSubKey, ACCESS_MASK DesiredAccess);\nBOOLEAN NtRegWriteValue(HANDLE H_KEY, WCHAR *pwszValueName, PVOID pData, ULONG uLength, DWORD dwRegType);\nBOOLEAN NtRegWriteString(HANDLE H_KEY, WCHAR *pwszValueName, WCHAR *pwszValue);\nBOOLEAN NtRegDeleteValue(HANDLE H_KEY, WCHAR *pwszValueName);\nBOOLEAN NtRegCloseKey(HANDLE H_KEY);\nBOOLEAN NtRegReadValue(HANDLE H_KEY, HANDLE hHeapHandle, WCHAR *pszValueName, PKEY_VALUE_PARTIAL_INFORMATION *pRetBuffer, ULONG *pRetBufferSize);\nvoid NtEnumKey(HANDLE hKey);\n\n#endif" }, { "path": "precomp.h", "content": "/**\n * PROJECT: Native Shell\n * COPYRIGHT: LGPL; See LICENSE in the top level directory\n * FILE: precomp.h\n * DESCRIPTION: Precompiled header.\n * DEVELOPERS: See CONTRIBUTORS.md in the top level directory\n */\n\n#define WIN32_NO_STATUS\n#define NTOS_MODE_USER\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \"ntfile.h\"\n#include \"ntreg.h\"\n\n// Device type for input/output\n\ntypedef enum _CON_DEVICE_TYPE\n{\n KeyboardType,\n MouseType\n} CON_DEVICE_TYPE;\n\n// Display functions\n\nNTSTATUS\n__cdecl RtlCliDisplayString(\n IN PCH Message,\n ...);\n\nNTSTATUS\nRtlCliPrintString(\n IN PUNICODE_STRING Message);\n\nNTSTATUS\nRtlCliPutChar(\n IN WCHAR Char);\n\n// Input functions\n\nNTSTATUS\nRtlCliOpenInputDevice(\n OUT PHANDLE Handle,\n IN CON_DEVICE_TYPE Type);\n\nCHAR RtlCliGetChar(\n IN HANDLE hDriver);\n\nPCHAR\nRtlCliGetLine(\n IN HANDLE hDriver);\n\n// System information functions\n\nNTSTATUS\nRtlCliListDrivers(\n VOID);\n\nNTSTATUS\nRtlCliListProcesses(\n VOID);\n\nNTSTATUS\nRtlCliDumpSysInfo(\n VOID);\n\nNTSTATUS\nRtlCliShutdown(\n VOID);\n\nNTSTATUS\nRtlCliReboot(\n VOID);\n\nNTSTATUS\nRtlCliPowerOff(\n VOID);\n\n// Hardware functions\n\nNTSTATUS\nRtlCliListHardwareTree(\n VOID);\n\n// File functions\n\nNTSTATUS\nRtlCliListDirectory(\n PWCHAR CurrentDirectory);\n\nNTSTATUS\nRtlCliSetCurrentDirectory(\n PCHAR Directory);\n\nULONG\nRtlCliGetCurrentDirectory(\n IN OUT PWSTR CurrentDirectory);\n\n// Keyboard:\n\nHANDLE hKeyboard;\n\ntypedef struct _KBD_RECORD\n{\n WORD wVirtualScanCode;\n DWORD dwControlKeyState;\n UCHAR AsciiChar;\n BOOL bKeyDown;\n} KBD_RECORD, *PKBD_RECORD;\n\nvoid IntTranslateKey(PKEYBOARD_INPUT_DATA InputData, KBD_RECORD *kbd_rec);\n\n#define RIGHT_ALT_PRESSED 0x0001 // the right alt key is pressed.\n#define LEFT_ALT_PRESSED 0x0002 // the left alt key is pressed.\n#define RIGHT_CTRL_PRESSED 0x0004 // the right ctrl key is pressed.\n#define LEFT_CTRL_PRESSED 0x0008 // the left ctrl key is pressed.\n#define SHIFT_PRESSED 0x0010 // the shift key is pressed.\n#define NUMLOCK_ON 0x0020 // the numlock light is on.\n#define SCROLLLOCK_ON 0x0040 // the scrolllock light is on.\n#define CAPSLOCK_ON 0x0080 // the capslock light is on.\n#define ENHANCED_KEY 0x0100 // the key is enhanced.\n\n// Process:\n\nNTSTATUS CreateNativeProcess(IN PCWSTR file_name, IN PCWSTR cmd_line, OUT PHANDLE hProcess);\n\n#define BUFFER_SIZE 1024\n#define NUM_ARGS 256\n\n// Command processing:\n#define CMDSTR(x) x, strlen(x)\nCHAR **StringToArguments(CHAR *string, UINT *argc);\n\nBOOL GetFullPath(IN PCSTR filename, OUT PWSTR out, IN BOOL add_slash);\nBOOL FileExists(PCWSTR fname);\n\n// Registry\n\nNTSTATUS OpenKey(OUT PHANDLE pHandle, IN PWCHAR key);\nNTSTATUS RegWrite(HANDLE hKey, INT type, PWCHAR key_name, PVOID data, DWORD size);\n\nNTSTATUS RegReadValue(HANDLE hKey, PWCHAR key_name, OUT PULONG type, OUT PVOID data, IN ULONG buf_size, OUT PULONG out_size);\n\n//===========================================================\n\n// Helper Functions for ntreg.c\n\n//===========================================================\n\nBOOLEAN SetUnicodeString(\n UNICODE_STRING *pustrRet,\n WCHAR *pwszData);\nBOOLEAN\nDisplayString(\n WCHAR *pwszData);\nHANDLE\nInitHeapMemory(void);\nBOOLEAN\nDeinitHeapMemory(\n HANDLE hHeap);\nPVOID\nkmalloc(\n HANDLE hHeap,\n int nSize);\nBOOLEAN\nkfree(\n HANDLE hHeap,\n PVOID pMemory);\nBOOLEAN\nAppendString(\n WCHAR *pszInput,\n WCHAR *pszAppend);\nUINT GetStringLength(\n WCHAR *pszInput);\n" }, { "path": "process.c", "content": "/**\n * PROJECT: Native Shell\n * COPYRIGHT: LGPL; See LICENSE in the top level directory\n * FILE: process.c\n * DESCRIPTION: Create process implementation.\n * DEVELOPERS: See CONTRIBUTORS.md in the top level directory\n */\n\n#include \"precomp.h\"\n\n/*\n *****************************************************************************\n * CreateNativeProcess - Create a native process\n * file_name: full path to .exe, in DOS format\n * cmd_line: arguments for process\n *\n * Returns: STATUS_SUCCESS or STATUS_UNSUCCESSFUL\n *****************************************************************************\n */\n\nNTSTATUS CreateNativeProcess(IN PCWSTR file_name, IN PCWSTR cmd_line, OUT PHANDLE hProcess)\n{\n UNICODE_STRING fname, nt_file;\n PCWSTR file_part;\n UNICODE_STRING EnvString, NullString, UnicodeSystemDriveString;\n NTSTATUS status; // Status\n UNICODE_STRING imgname; // ImageName\n UNICODE_STRING imgpath; // Nt ImagePath\n UNICODE_STRING dllpath; // Nt DllPath (DOS Name)\n UNICODE_STRING cmdline; // Nt CommandLine\n PRTL_USER_PROCESS_PARAMETERS processparameters; // ProcessParameters\n RTL_USER_PROCESS_INFORMATION processinformation = {0}; // ProcessInformation\n WCHAR Env[2] = {0, 0}; // Process Envirnoment\n PKUSER_SHARED_DATA SharedData = (PKUSER_SHARED_DATA)USER_SHARED_DATA; // Kernel Shared Data\n\n *hProcess = NULL;\n\n RtlDosPathNameToNtPathName_U(file_name, &nt_file, &file_part, NULL);\n\n RtlInitUnicodeString(&imgpath, nt_file.Buffer); // Image path\n RtlInitUnicodeString(&imgname, file_part); // Image name\n RtlInitUnicodeString(&dllpath, SharedData->NtSystemRoot); // DLL Path is %SystemRoot%\n RtlInitUnicodeString(&cmdline, cmd_line); // Command Line parameters\n\n status = RtlCreateProcessParameters(&processparameters, &imgname, &dllpath, &dllpath, &cmdline, Env, 0, 0, 0, 0);\n\n if (!NT_SUCCESS(status))\n {\n RtlCliDisplayString(\"RtlCreateProcessParameters failed\\n\");\n return STATUS_UNSUCCESSFUL;\n }\n\n DbgPrint(\"Launching Process: %s, DllPath=%s, CmdLine=%s\", &imgname, &dllpath, &cmdline);\n status = RtlCreateUserProcess(&imgpath, OBJ_CASE_INSENSITIVE, processparameters,\n NULL, NULL, NULL, FALSE, NULL, NULL, &processinformation);\n\n if (!NT_SUCCESS(status))\n {\n RtlCliDisplayString(\"RtlCreateUserProcess failed\\n\");\n return STATUS_UNSUCCESSFUL;\n }\n\n if (processinformation.ImageInformation.SubSystemType != IMAGE_SUBSYSTEM_NATIVE)\n {\n RtlCliDisplayString(\"\\nThe %S application cannot be run in native mode.\\n\", file_name);\n return STATUS_UNSUCCESSFUL;\n }\n\n status = NtResumeThread(processinformation.ThreadHandle, NULL);\n\n if (!NT_SUCCESS(status))\n {\n RtlCliDisplayString(\"NtResumeThread failed\\n\");\n return STATUS_UNSUCCESSFUL;\n }\n\n *hProcess = processinformation.ProcessHandle;\n\n return STATUS_SUCCESS;\n}\n" }, { "path": "shell.c", "content": "/**\n * PROJECT: Native Shell\n * COPYRIGHT: LGPL; See LICENSE in the top level directory\n * FILE: shell.c\n * DESCRIPTION: Shell helper functions.\n * DEVELOPERS: See CONTRIBUTORS.md in the top level directory\n */\n\n#include \"precomp.h\"\n\n/*\n *****************************************************************************\n * GetFullPath - Get a full path.\n *\n * filename: File name\n * out: String for full path\n * add_slash: Add slash to the end of string\n *\n * Returns: TRUE or FALSE\n *****************************************************************************\n */\n\nBOOL GetFullPath(IN PCSTR filename, OUT PWSTR out, IN BOOL add_slash)\n{\n UNICODE_STRING us;\n ANSI_STRING as;\n WCHAR cur_path[MAX_PATH];\n RtlCliGetCurrentDirectory(cur_path);\n\n if (NULL == filename || NULL == cur_path || NULL == out)\n {\n return FALSE;\n }\n\n if ((strlen(filename) > 1) && filename[1] == ':')\n {\n RtlInitAnsiString(&as, filename);\n RtlAnsiStringToUnicodeString(&us, &as, TRUE);\n\n wcscpy(out, us.Buffer);\n if (add_slash)\n {\n wcscat(out, L\"\\\\\");\n }\n\n RtlFreeUnicodeString(&us);\n }\n else\n {\n RtlInitAnsiString(&as, filename);\n RtlAnsiStringToUnicodeString(&us, &as, TRUE);\n\n wcscpy(out, cur_path);\n if (out[wcslen(out) - 1] != L'\\\\')\n {\n wcscat(out, L\"\\\\\");\n }\n wcscat(out, us.Buffer);\n if (add_slash)\n {\n wcscat(out, L\"\\\\\");\n }\n\n RtlFreeUnicodeString(&us);\n }\n return TRUE;\n}\n\n// Argument processing functions:\nstatic CHAR *xargv[NUM_ARGS];\n\nCHAR **StringToArguments(CHAR *string, UINT *argc)\n{\n /* Extract whitespace- and quotes- delimited tokens from the given string\n and put them into the tokens array. Returns number of tokens\n extracted. Length specifies the current size of tokens[].\n THIS METHOD MODIFIES string. */\n\n const char *whitespace = \" \\t\\r\\n\";\n char *tokenEnd;\n const char *quoteCharacters = \"\\\"\\'\";\n char *end = string + strlen(string);\n UINT length = NUM_ARGS;\n\n if ((NULL == string) || (NULL == argc) || (0 == length))\n return NULL;\n\n *argc = 0;\n\n while (1)\n {\n const char *q;\n /* Skip over initial whitespace. */\n string += strspn(string, whitespace);\n if (!*string)\n break;\n\n for (q = quoteCharacters; *q; ++q)\n {\n if (*string == *q)\n break;\n }\n if (*q)\n {\n /* Token is quoted. */\n char quote = *string++;\n tokenEnd = strchr(string, quote);\n /* If there is no endquote, the token is the rest of the string. */\n if (!tokenEnd)\n tokenEnd = end;\n }\n else\n {\n tokenEnd = string + strcspn(string, whitespace);\n }\n\n *tokenEnd = 0;\n\n xargv[*argc] = string;\n\n *argc = *argc + 1;\n\n if ((tokenEnd == end) || (*argc >= length))\n break;\n string = tokenEnd + 1;\n }\n\n return xargv;\n}\n\n/******************************************************************************\\\n * GetFileAttributesNt - Get File Attributes\n * fname: File name\n\\******************************************************************************/\n\nULONG GetFileAttributesNt(PCWSTR filename)\n{\n OBJECT_ATTRIBUTES oa;\n FILE_BASIC_INFORMATION fbi;\n UNICODE_STRING nt_filename;\n\n RtlDosPathNameToNtPathName_U(filename, &nt_filename, NULL, NULL);\n InitializeObjectAttributes(&oa, &nt_filename, OBJ_CASE_INSENSITIVE, 0, 0);\n\n fbi.FileAttributes = 0;\n NtQueryAttributesFile(&oa, &fbi);\n\n return fbi.FileAttributes;\n}\n\n/******************************************************************************\\\n * FolderExists - Check if folder exists\n * fFile: Folder\n\\******************************************************************************/\n\nBOOL FolderExists(PCWSTR foldername)\n{\n BOOL retval = FALSE;\n UNICODE_STRING u_filename, nt_filename;\n FILE_BASIC_INFORMATION fbi;\n OBJECT_ATTRIBUTES oa;\n NTSTATUS st;\n\n RtlInitUnicodeString(&u_filename, foldername);\n RtlDosPathNameToNtPathName_U(u_filename.Buffer, &nt_filename, NULL, NULL);\n\n InitializeObjectAttributes(&oa, &nt_filename, OBJ_CASE_INSENSITIVE, 0, 0);\n st = NtQueryAttributesFile(&oa, &fbi);\n\n retval = NT_SUCCESS(st);\n\n if (retval && (fbi.FileAttributes & FILE_ATTRIBUTE_DIRECTORY))\n {\n return TRUE;\n }\n return FALSE;\n}\n\n/******************************************************************************\\\n * FileExists - Checks if file exists\n * filename: File name\n\\******************************************************************************/\n\nBOOL FileExists(PCWSTR filename)\n{\n UNICODE_STRING u_filename, nt_filename;\n FILE_BASIC_INFORMATION fbi;\n OBJECT_ATTRIBUTES oa;\n NTSTATUS st;\n\n RtlInitUnicodeString(&u_filename, filename);\n RtlDosPathNameToNtPathName_U(u_filename.Buffer, &nt_filename, NULL, NULL);\n\n InitializeObjectAttributes(&oa, &nt_filename, OBJ_CASE_INSENSITIVE, 0, 0);\n st = NtQueryAttributesFile(&oa, &fbi);\n\n return NT_SUCCESS(st);\n}\n\nBOOLEAN DisplayString(WCHAR *pwszData)\n{\n UNICODE_STRING ustrData;\n BOOLEAN bRet;\n\n bRet = SetUnicodeString(&ustrData, pwszData);\n\n if (bRet == FALSE)\n return FALSE;\n\n NtDisplayString(&ustrData);\n\n return TRUE;\n}\n\nBOOLEAN SetUnicodeString(UNICODE_STRING *pustrRet, WCHAR *pwszData)\n{\n if (pustrRet == NULL || pwszData == NULL)\n {\n return FALSE;\n }\n\n pustrRet->Buffer = pwszData;\n pustrRet->Length = wcslen(pwszData) * sizeof(WCHAR);\n pustrRet->MaximumLength = pustrRet->Length + sizeof(WCHAR);\n\n return TRUE;\n}\n\nHANDLE InitHeapMemory(void)\n{\n RTL_HEAP_PARAMETERS sHeapDef;\n HANDLE hHeap;\n\n // Init Heap Memory\n memset(&sHeapDef, 0, sizeof(RTL_HEAP_PARAMETERS));\n sHeapDef.Length = sizeof(RTL_HEAP_PARAMETERS);\n hHeap = RtlCreateHeap(HEAP_GROWABLE, NULL, 0x100000, 0x1000, NULL, &sHeapDef);\n\n return hHeap;\n}\n\nBOOLEAN DeinitHeapMemory(HANDLE hHeap)\n{\n PVOID pRet;\n\n pRet = RtlDestroyHeap(hHeap);\n if (pRet == NULL)\n return TRUE;\n\n return FALSE;\n}\n\nPVOID kmalloc(HANDLE hHeap, int nSize)\n{\n // if you wanna set new memory to zero, use HEAP_ZERO_MEMORY.\n PVOID pRet = RtlAllocateHeap(hHeap, 0, nSize);\n\n return pRet;\n}\n\nBOOLEAN kfree(HANDLE hHeap, PVOID pMemory)\n{\n BOOLEAN bRet = RtlFreeHeap(hHeap, 0, pMemory);\n\n return bRet;\n}\n\nBOOLEAN AppendString(WCHAR *pszInput, WCHAR *pszAppend)\n{\n int i, nAppendIndex;\n\n for (i = 0;; i++)\n {\n if (pszInput[i] == 0x0000)\n {\n break;\n }\n }\n\n nAppendIndex = 0;\n for (;;)\n {\n if (pszAppend[nAppendIndex] == 0x0000)\n {\n break;\n }\n pszInput[i] = pszAppend[nAppendIndex];\n\n nAppendIndex++;\n i++;\n }\n\n pszInput[i] = 0x0000; // set end of string.\n\n return TRUE;\n}\n\nUINT GetStringLength(WCHAR *pszInput)\n{\n int i;\n\n for (i = 0;; i++)\n {\n if (pszInput[i] == 0x0000)\n {\n break;\n }\n }\n\n return i;\n}\n" }, { "path": "sources", "content": "TARGETNAME=native\nTARGETTYPE=PROGRAM\nUMTYPE=nt\n\nMINWIN_SDK_LIB_PATH=$(SDK_LIB_PATH)\nINCLUDES=$(DDK_INC_PATH);./ndk\n\nSOURCES=display.c \\\n file.c \\\n hardware.c \\\n input.c \\\n main.c \\\n sysinfo.c \\\n keytrans.c \\\n shell.c \\\n process.c \\\n ntfile.c \\\n ntreg.c\n\nPRECOMPILED_INCLUDE=precomp.h\n\nTARGETLIBS= \\\n$(DDK_LIB_PATH)\\ntdll.lib \\\n$(DDK_LIB_PATH)\\nt.lib\n\nUSE_NTDLL=1" }, { "path": "sysinfo.c", "content": "/**\n * PROJECT: Native Shell\n * COPYRIGHT: LGPL; See LICENSE in the top level directory\n * FILE: sysinfo.c\n * DESCRIPTION: This module implements commands for displaying system information.\n * DEVELOPERS: See CONTRIBUTORS.md in the top level directory\n */\n\n#include \"precomp.h\"\n\nNTSTATUS\nRtlCliShutdown(VOID)\n{\n BOOLEAN Old;\n\n // Get the shutdown privilege and shutdown the system\n RtlAdjustPrivilege(SE_SHUTDOWN_PRIVILEGE, TRUE, FALSE, &Old);\n return ZwShutdownSystem(ShutdownNoReboot);\n}\n\nNTSTATUS\nRtlCliReboot(VOID)\n{\n BOOLEAN Old;\n\n // Get the shutdown privilege and shutdown the system\n RtlAdjustPrivilege(SE_SHUTDOWN_PRIVILEGE, TRUE, FALSE, &Old);\n return ZwShutdownSystem(ShutdownReboot);\n}\n\nNTSTATUS\nRtlCliPowerOff(VOID)\n{\n BOOLEAN Old;\n\n // Get the shutdown privilege and shutdown the system\n RtlAdjustPrivilege(SE_SHUTDOWN_PRIVILEGE, TRUE, FALSE, &Old);\n return ZwShutdownSystem(ShutdownPowerOff);\n}\n\nNTSTATUS\nRtlCliListDrivers(VOID)\n{\n PRTL_PROCESS_MODULES ModuleInfo;\n PRTL_PROCESS_MODULE_INFORMATION ModuleEntry;\n NTSTATUS Status;\n ULONG Size = 1024*1024;\n ULONG i;\n\n // Allocate it\n ModuleInfo = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, Size);\n\n // Query the buffer\n Status = NtQuerySystemInformation(SystemModuleInformation,\n ModuleInfo,\n Size,\n NULL);\n\n // Display Header\n RtlCliDisplayString(\"*** ACTIVE MODULE LIST - DUMPING %d MODULES\\n\",\n ModuleInfo->NumberOfModules);\n\n // Now walk every module in it\n for (i = 0; i < ModuleInfo->NumberOfModules; i++)\n {\n // Check if we've displayed 20\n // BUGBUG: Should be natively handled by our display routines\n if (i && !(i % 20))\n {\n // Hold for more input\n RtlCliDisplayString(\"--- PRESS SPACE TO CONTINUE ---\\n\");\n while (RtlCliGetChar(hKeyboard) != ' ')\n ;\n }\n\n // Get this entry\n ModuleEntry = &ModuleInfo->Modules[i];\n\n // Display basic data\n RtlCliDisplayString(\"%s - Base: %p Size: 0x%lx\\n\",\n ModuleEntry->FullPathName,\n ModuleEntry->ImageBase,\n ModuleEntry->ImageSize);\n }\n\n RtlFreeHeap(RtlGetProcessHeap(), 0, ModuleInfo);\n\n // Return error code\n return Status;\n}\n\n/*++\n * @name RtlCliListProcesses\n *\n * The RtlCliListProcesses routine provides a way to list the current\n * processes.\n *\n * @param None.\n *\n * @return NTSTATUS\n *\n * @remarks Documentation for this routine needs to be completed.\n *\n *--*/\nNTSTATUS\nRtlCliListProcesses(VOID)\n{\n PSYSTEM_PROCESS_INFORMATION ModuleInfo;\n NTSTATUS Status;\n ULONG Size = 0x10000;\n\n // Allocate a static buffer that should be large enough\n ModuleInfo = RtlAllocateHeap(RtlGetProcessHeap(), 0, Size);\n if (!ModuleInfo)\n return STATUS_INSUFFICIENT_RESOURCES;\n\n // Query the buffer\n Status = NtQuerySystemInformation(SystemProcessInformation,\n ModuleInfo,\n Size,\n NULL);\n if (!NT_SUCCESS(Status))\n return Status;\n\n // Display Header\n RtlCliDisplayString(\"*** ACTIVE PROCESS LIST\\n\");\n\n // Now walk every module in it\n while (TRUE)\n {\n // Display basic data\n RtlCliDisplayString(\"[%lx] %S - WS/PF/V:[%dK/%dK/%dK] Threads: %d\\n\",\n ModuleInfo->UniqueProcessId,\n ModuleInfo->ImageName.Buffer,\n ModuleInfo->WorkingSetSize / 1024,\n ModuleInfo->PagefileUsage / 1024,\n ModuleInfo->VirtualSize / 1024,\n ModuleInfo->NumberOfThreads);\n\n // Break out if we're done\n if (!ModuleInfo->NextEntryOffset)\n break;\n\n // Get next entry\n ModuleInfo = (PSYSTEM_PROCESS_INFORMATION)((ULONG_PTR)ModuleInfo +\n ModuleInfo->NextEntryOffset);\n }\n\n // Return error code\n return Status;\n}\n\n/*++\n * @name RtlCliDumpSysInfo\n *\n * The RtlCliDumpSysInfo routine queries a large amount of system information\n * and displays it on screen.\n *\n * @param None.\n *\n * @return NTSTATUS\n *\n * @remarks Documentation for this routine needs to be completed.\n *\n *--*/\nNTSTATUS\nRtlCliDumpSysInfo(VOID)\n{\n NTSTATUS Status;\n SYSTEM_BASIC_INFORMATION BasicInfo;\n SYSTEM_PROCESSOR_INFORMATION ProcInfo;\n SYSTEM_PERFORMANCE_INFORMATION PerfInfo;\n SYSTEM_TIMEOFDAY_INFORMATION TimeInfo;\n SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION ProcPerfInfo[2];\n SYSTEM_FILECACHE_INFORMATION CacheInfo;\n PKUSER_SHARED_DATA SharedData = (PKUSER_SHARED_DATA)USER_SHARED_DATA;\n TIME_FIELDS BootTime, IdleTime, KernelTime, UserTime, DpcTime;\n\n // Query basic system information\n Status = NtQuerySystemInformation(SystemBasicInformation,\n &BasicInfo,\n sizeof(BasicInfo),\n NULL);\n if (!NT_SUCCESS(Status))\n return Status;\n\n // Query basic processor information\n Status = NtQuerySystemInformation(SystemProcessorInformation,\n &ProcInfo,\n sizeof(ProcInfo),\n NULL);\n if (!NT_SUCCESS(Status))\n return Status;\n\n // Query basic system information\n Status = NtQuerySystemInformation(SystemPerformanceInformation,\n &PerfInfo,\n sizeof(PerfInfo),\n NULL);\n if (!NT_SUCCESS(Status))\n return Status;\n\n // Query basic system information\n Status = NtQuerySystemInformation(SystemTimeOfDayInformation,\n &TimeInfo,\n sizeof(TimeInfo),\n NULL);\n if (!NT_SUCCESS(Status))\n return Status;\n\n // Query basic system information\n Status = NtQuerySystemInformation(SystemProcessorPerformanceInformation,\n &ProcPerfInfo,\n sizeof(ProcPerfInfo),\n NULL);\n if (!NT_SUCCESS(Status))\n return Status;\n\n // Display Header\n // FIXME: Center it\n RtlTimeToTimeFields(&TimeInfo.BootTime, &BootTime);\n RtlCliDisplayString(\"Native shell running in %S booted on %02d-%02d-%02d \"\n \"at %02d:%02d. CPUs: %d\\n\",\n SharedData->NtSystemRoot,\n BootTime.Day,\n BootTime.Month,\n BootTime.Year,\n BootTime.Hour,\n BootTime.Minute,\n BasicInfo.NumberOfProcessors);\n\n // Display System Flags\n RtlCliDisplayString(\"Version: %x.%x. Debug Mode: %x. Safe Mode: %x \"\n \"Product Type: %x. Suite Mask: %x\\n\",\n SharedData->NtMajorVersion,\n SharedData->NtMinorVersion,\n SharedData->KdDebuggerEnabled,\n SharedData->SafeBootMode,\n SharedData->NtProductType,\n SharedData->SuiteMask);\n RtlCliDisplayString(\"-------------------------------------\"\n \"-------------------------------------\\n\");\n\n // Display CPU Information\n RtlCliDisplayString(\"[CPU] %s Family %d Model %x Stepping %x. \"\n \"Feature Bits: 0x%X NX: 0x%x\\n\",\n (ProcInfo.ProcessorArchitecture ==\n PROCESSOR_ARCHITECTURE_INTEL)\n ? \"x86\"\n : \"Unknown\",\n ProcInfo.ProcessorLevel,\n ProcInfo.ProcessorRevision >> 8,\n ProcInfo.ProcessorRevision & 0xFF,\n ProcInfo.ProcessorFeatureBits,\n SharedData->NXSupportPolicy);\n\n // Display RAM Information\n RtlCliDisplayString(\"[RAM] Page Size: %dKB. Physical Pages: 0x%X. \"\n \"Total Physical RAM: %dKB\\n\",\n BasicInfo.PageSize / 1024,\n BasicInfo.NumberOfPhysicalPages,\n BasicInfo.NumberOfPhysicalPages * PAGE_SIZE / 1024);\n\n // Display User-Mode Virtual Memory Information\n RtlCliDisplayString(\"[USR] User-Mode Range: 0x%08X-0x%X. \"\n \"Allocation Granularity: %dKB\\n\",\n BasicInfo.MinimumUserModeAddress,\n BasicInfo.MaximumUserModeAddress,\n BasicInfo.AllocationGranularity / 1024);\n\n // Display System Virtual Memory Information\n RtlCliDisplayString(\"[VRAM] Free: %dKB. Committed: %dKB. \"\n \"Total: %dKB. Peak: %dKB\\n\",\n PerfInfo.AvailablePages * PAGE_SIZE / 1024,\n PerfInfo.CommittedPages * PAGE_SIZE / 1024,\n PerfInfo.CommitLimit * PAGE_SIZE / 1024,\n PerfInfo.PeakCommitment * PAGE_SIZE / 1024);\n\n // Display Kernel Memory/Pool Information\n RtlCliDisplayString(\"[KRNL] Paged: %dKB. Non-Paged: %dKB. \"\n \"Drivers: %dKB Code: %dKB\\n\",\n PerfInfo.PagedPoolPages * PAGE_SIZE / 1024,\n PerfInfo.NonPagedPoolPages * PAGE_SIZE / 1024,\n PerfInfo.TotalSystemDriverPages * PAGE_SIZE / 1024,\n PerfInfo.TotalSystemCodePages * PAGE_SIZE / 1024);\n\n // Check if we have two CPUs\n if (BasicInfo.NumberOfProcessors > 1)\n {\n // Handle two CPU case by adding all of CPU 2's times into CPU 1's\n // FIXME: This should be improved to support 2+ CPUs later\n\n ProcPerfInfo[0].IdleTime.QuadPart +=\n ProcPerfInfo[1].IdleTime.QuadPart;\n ProcPerfInfo[0].KernelTime.QuadPart +=\n ProcPerfInfo[1].KernelTime.QuadPart;\n ProcPerfInfo[0].UserTime.QuadPart +=\n ProcPerfInfo[1].UserTime.QuadPart;\n ProcPerfInfo[0].DpcTime.QuadPart +=\n ProcPerfInfo[1].DpcTime.QuadPart;\n ProcPerfInfo[0].InterruptCount += ProcPerfInfo[1].InterruptCount;\n }\n\n // Convert all 64-bit times into a readable format\n RtlTimeToTimeFields(&ProcPerfInfo[0].IdleTime, &IdleTime);\n RtlTimeToTimeFields(&ProcPerfInfo[0].KernelTime, &KernelTime);\n RtlTimeToTimeFields(&ProcPerfInfo[0].UserTime, &UserTime);\n RtlTimeToTimeFields(&ProcPerfInfo[0].DpcTime, &DpcTime);\n\n // Display System Times\n RtlCliDisplayString(\"[TIME] Kernel: %02d:%02d:%02d. User: %02d:%02d:%02d. \"\n \"DPC: %02d:%02d:%02d. Idle: %02d:%02d:%02d.\\n\",\n KernelTime.Hour, KernelTime.Minute, KernelTime.Second,\n UserTime.Hour, UserTime.Minute, UserTime.Second,\n DpcTime.Hour, DpcTime.Minute, DpcTime.Second,\n IdleTime.Hour, IdleTime.Minute, IdleTime.Second);\n\n // Display Core Performance Information\n RtlCliDisplayString(\"[PERF] INTs: %d. SysCalls: %d. PFs: %d. \"\n \"Ctx Switches: %d\\n\",\n ProcPerfInfo[0].InterruptCount,\n PerfInfo.SystemCalls,\n PerfInfo.PageFaultCount,\n PerfInfo.ContextSwitches);\n\n // Display I/O Information\n RtlCliDisplayString(\"[I/O] Reads: %d/%I64dKB. Writes: %d/%I64dKB. \"\n \"Others: %d/%I64dKB\\n\",\n PerfInfo.IoReadOperationCount,\n PerfInfo.IoReadTransferCount.QuadPart / 1024,\n PerfInfo.IoWriteOperationCount,\n PerfInfo.IoWriteTransferCount.QuadPart / 1024,\n PerfInfo.IoOtherOperationCount,\n PerfInfo.IoOtherTransferCount.QuadPart / 1024);\n\n // Display FileSystem Cache Information\n Status = NtQuerySystemInformation(SystemFileCacheInformation,\n &CacheInfo,\n sizeof(CacheInfo),\n NULL);\n if (NT_SUCCESS(Status))\n {\n RtlCliDisplayString(\"[CACHE] Size: %dKB. Peak: %dKB. \"\n \"Min WS: %dKB. Max WS: %dKB\\n\",\n CacheInfo.CurrentSize / 1024,\n CacheInfo.PeakSize / 1024,\n CacheInfo.MinimumWorkingSet,\n CacheInfo.MaximumWorkingSet);\n }\n\n return STATUS_SUCCESS;\n}\n" } ]