Introduce working set list types and extend EPROCESS structure

sdk/xtdk/amd64/mmtypes.h

@@ -352,5 +352,62 @@ typedef struct _POOL_DESCRIPTOR
     SIZE_T Reserved;
 } POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR;
 
+/* Working set list entry structure definition */
+typedef struct _MMWSLENTRY
+{
+    ULONG_PTR Valid:1;
+    ULONG_PTR LockedInWs:1;
+    ULONG_PTR LockedInMemory:1;
+    ULONG_PTR Protection:5;
+    ULONG_PTR Hashed:1;
+    ULONG_PTR Direct:1;
+    ULONG_PTR Age:2;
+    ULONG_PTR VirtualPageNumber:52;
+} MMWSLENTRY, *PMMWSLENTRY;
+
+/* Working set free entry structure definition */
+typedef struct _MMWSLE_FREE_ENTRY
+{
+    ULONG MustBeZero:1;
+    ULONG PreviousFree:31;
+    LONG NextFree;
+} MMWSLE_FREE_ENTRY, *PMMWSLE_FREE_ENTRY;
+
+/* Working set list entry union definition */
+typedef union _MMWSLE
+{
+    PVOID VirtualAddress;
+    ULONG_PTR Long;
+    MMWSLENTRY e1;
+    MMWSLE_FREE_ENTRY Free;
+} MMWSLE, *PMMWSLE;
+
+/* Working set list structure definition */
+typedef struct _MMWSL
+{
+    ULONG FirstFree;
+    ULONG FirstDynamic;
+    ULONG LastEntry;
+    ULONG NextSlot;
+    PMMWSLE Wsle;
+    ULONG LastInitializedWsle;
+    ULONG NonDirectCount;
+    PMMWSLE_HASH HashTable;
+    ULONG HashTableSize;
+    ULONG NumberOfCommittedPageTables;
+    PVOID HashTableStart;
+    PVOID HighestPermittedHashAddress;
+    ULONG NumberOfImageWaiters;
+    ULONG VadBitMapHint;
+    PVOID HighestUserAddress;
+    ULONG MaximumUserPageTablePages;
+    ULONG MaximumUserPageDirectoryPages;
+    PULONG CommittedPageTables;
+    ULONG NumberOfCommittedPageDirectories;
+    PULONG CommittedPageDirectories;
+    ULONG NumberOfCommittedPageDirectoryParents;
+    ULONGLONG CommittedPageDirectoryParents[1];
+} MMWSL, *PMMWSL;
+
 #endif /* __XTOS_ASSEMBLER__ */
 #endif /* __XTDK_AMD64_MMTYPES_H */

sdk/xtdk/amd64/xtstruct.h

@@ -72,6 +72,9 @@ typedef struct _MMPTE_PROTOTYPE MMPTE_PROTOTYPE, *PMMPTE_PROTOTYPE;
 typedef struct _MMPTE_SOFTWARE MMPTE_SOFTWARE, *PMMPTE_SOFTWARE;
 typedef struct _MMPTE_SUBSECTION MMPTE_SUBSECTION, *PMMPTE_SUBSECTION;
 typedef struct _MMPTE_TRANSITION MMPTE_TRANSITION, *PMMPTE_TRANSITION;
+typedef struct _MMWSL MMWSL, *PMMWSL;
+typedef struct _MMWSLE_FREE_ENTRY MMWSLE_FREE_ENTRY, *PMMWSLE_FREE_ENTRY;
+typedef struct _MMWSLENTRY MMWSLENTRY, *PMMWSLENTRY;
 typedef struct _POOL_DESCRIPTOR POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR;
 typedef struct _THREAD_ENVIRONMENT_BLOCK THREAD_ENVIRONMENT_BLOCK, *PTHREAD_ENVIRONMENT_BLOCK;
 typedef struct _TIMER_CAPABILITIES TIMER_CAPABILITIES, *PTIMER_CAPABILITIES;
@@ -87,6 +90,7 @@ typedef union _MMPTE MMPDE, *PMMPDE;
 typedef union _MMPTE MMPPE, *PMMPPE;
 typedef union _MMPTE MMPTE, *PMMPTE;
 typedef union _MMPTE MMPXE, *PMMPXE;
+typedef union _MMWSLE MMWSLE, *PMMWSLE;
 typedef union _PIC_I8259_ICW1 PIC_I8259_ICW1, *PPIC_I8259_ICW1;
 typedef union _PIC_I8259_ICW2 PIC_I8259_ICW2, *PPIC_I8259_ICW2;
 typedef union _PIC_I8259_ICW3 PIC_I8259_ICW3, *PPIC_I8259_ICW3;

sdk/xtdk/i686/mmtypes.h

@@ -444,5 +444,56 @@ typedef struct _POOL_DESCRIPTOR
     SIZE_T Reserved;
 } POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR;
 
+/* Working set list entry structure definition */
+typedef struct _MMWSLENTRY
+{
+    ULONG_PTR Valid:1;
+    ULONG_PTR LockedInWs:1;
+    ULONG_PTR LockedInMemory:1;
+    ULONG_PTR Protection:5;
+    ULONG_PTR Hashed:1;
+    ULONG_PTR Direct:1;
+    ULONG_PTR Age:2;
+    ULONG_PTR VirtualPageNumber:20;
+} MMWSLENTRY, *PMMWSLENTRY;
+
+/* Working set free entry structure definition */
+typedef struct _MMWSLE_FREE_ENTRY
+{
+    ULONG MustBeZero:1;
+    ULONG PreviousFree:11;
+    LONG NextFree:20;
+} MMWSLE_FREE_ENTRY, *PMMWSLE_FREE_ENTRY;
+
+/* Working set list entry union definition */
+typedef union _MMWSLE
+{
+    PVOID VirtualAddress;
+    ULONG_PTR Long;
+    MMWSLENTRY e1;
+    MMWSLE_FREE_ENTRY Free;
+} MMWSLE, *PMMWSLE;
+
+/* Working set list structure definition */
+typedef struct _MMWSL
+{
+    ULONG FirstFree;
+    ULONG FirstDynamic;
+    ULONG LastEntry;
+    ULONG NextSlot;
+    PMMWSLE Wsle;
+    ULONG LastInitializedWsle;
+    ULONG NonDirectCount;
+    PMMWSLE_HASH HashTable;
+    ULONG HashTableSize;
+    ULONG NumberOfCommittedPageTables;
+    PVOID HashTableStart;
+    PVOID HighestPermittedHashAddress;
+    ULONG NumberOfImageWaiters;
+    ULONG VadBitMapHint;
+    USHORT UsedPageTableEntries[768];
+    ULONG CommittedPageTables[24];
+} MMWSL, *PMMWSL;
+
 #endif /* __XTOS_ASSEMBLER__ */
 #endif /* __XTDK_I686_MMTYPES_H */

sdk/xtdk/i686/xtstruct.h

@@ -81,6 +81,9 @@ typedef struct _MMPML3_PTE_PROTOTYPE MMPML3_PTE_PROTOTYPE, *PMMPML3_PTE_PROTOTYP
 typedef struct _MMPML3_PTE_SOFTWARE MMPML3_PTE_SOFTWARE, *PMMPML3_PTE_SOFTWARE;
 typedef struct _MMPML3_PTE_SUBSECTION MMPML3_PTE_SUBSECTION, *PMMPML3_PTE_SUBSECTION;
 typedef struct _MMPML3_PTE_TRANSITION MMPML3_PTE_TRANSITION, *PMMPML3_PTE_TRANSITION;
+typedef struct _MMWSL MMWSL, *PMMWSL;
+typedef struct _MMWSLE_FREE_ENTRY MMWSLE_FREE_ENTRY, *PMMWSLE_FREE_ENTRY;
+typedef struct _MMWSLENTRY MMWSLENTRY, *PMMWSLENTRY;
 typedef struct _POOL_DESCRIPTOR POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR;
 typedef struct _THREAD_ENVIRONMENT_BLOCK THREAD_ENVIRONMENT_BLOCK, *PTHREAD_ENVIRONMENT_BLOCK;
 typedef struct _TIMER_CAPABILITIES TIMER_CAPABILITIES, *PTIMER_CAPABILITIES;
@@ -97,6 +100,7 @@ typedef union _MMPML3_PTE MMPML3_PTE, *PMMPML3_PTE;
 typedef union _MMPTE MMPDE, *PMMPDE;
 typedef union _MMPTE MMPPE, *PMMPPE;
 typedef union _MMPTE MMPTE, *PMMPTE;
+typedef union _MMWSLE MMWSLE, *PMMWSLE;
 typedef union _PIC_I8259_ICW1 PIC_I8259_ICW1, *PPIC_I8259_ICW1;
 typedef union _PIC_I8259_ICW2 PIC_I8259_ICW2, *PPIC_I8259_ICW2;
 typedef union _PIC_I8259_ICW3 PIC_I8259_ICW3, *PPIC_I8259_ICW3;

sdk/xtdk/ldrtypes.h

@@ -74,5 +74,18 @@ typedef struct _LDR_DATA_TABLE_ENTRY
     PVOID PatchInformation;
 } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
 
+typedef struct _LDR_PEB_DATA
+{
+    ULONG Length;
+    BOOLEAN Initialized;
+    PVOID SsHandle;
+    LIST_ENTRY InLoadOrderModuleList;
+    LIST_ENTRY InMemoryOrderModuleList;
+    LIST_ENTRY InInitializationOrderModuleList;
+    PVOID EntryInProgress;
+    UCHAR ShutdownInProgress;
+    PVOID ShutdownThreadId;
+} LDR_PEB_DATA, *PLDR_PEB_DATA;
+
 #endif /* __XTOS_ASSEMBLER__ */
 #endif /* __XTDK_LDRTYPES_H */

sdk/xtdk/mmtypes.h

@@ -11,6 +11,7 @@
 #define __XTDK_MMTYPES_H
 
 #include <xtbase.h>
+#include <ketypes.h>
 #include ARCH_HEADER(xtstruct.h)
 
 
@@ -282,5 +283,52 @@ typedef struct _POOL_TRACKING_TABLE
     ULONG Tag;
 } POOL_TRACKING_TABLE, *PPOOL_TRACKING_TABLE;
 
+/* Memory manager support flags structure definition */
+typedef struct _MMSUPPORT_FLAGS
+{
+    ULONG SessionSpace:1;
+    ULONG BeingTrimmed:1;
+    ULONG SessionLeader:1;
+    ULONG TrimHard:1;
+    ULONG MaximumWorkingSetHard:1;
+    ULONG ForceTrim:1;
+    ULONG MinimumWorkingSetHard:1;
+    ULONG Available0:1;
+    ULONG MemoryPriority:8;
+    ULONG GrowWsleHash:1;
+    ULONG AcquiredUnsafe:1;
+    ULONG Available:14;
+} MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;
+
+/* Memory manager support structure definition */
+typedef struct _MMSUPPORT
+{
+    LIST_ENTRY WorkingSetExpansionLinks;
+    USHORT LastTrimpStamp;
+    USHORT NextPageColor;
+    MMSUPPORT_FLAGS Flags;
+    ULONG PageFaultCount;
+    ULONG PeakWorkingSetSize;
+    ULONG GrowthSinceLastEstimate;
+    ULONG MinimumWorkingSetSize;
+    ULONG MaximumWorkingSetSize;
+    PMMWSL VmWorkingSetList;
+    ULONG Claim;
+    ULONG NextEstimationSlot;
+    ULONG NextAgingSlot;
+    ULONG EstimatedAvailable;
+    ULONG WorkingSetSize;
+    PKEVENT ExitEvent;
+    KPUSH_LOCK WorkingSetMutex;
+    PVOID AccessLog;
+} MMSUPPORT, *PMMSUPPORT;
+
+/* Working Set List Entry Hash structure definition */
+typedef struct _MMWSLE_HASH
+{
+    PVOID Key;
+    ULONG Index;
+} MMWSLE_HASH, *PMMWSLE_HASH;
+
 #endif /* __XTOS_ASSEMBLER__ */
 #endif /* __XTDK_MMTYPES_H */

sdk/xtdk/pstypes.h

@@ -12,6 +12,8 @@
 #include <xttypes.h>
 #include <xtstruct.h>
 #include <extypes.h>
+#include <mmtypes.h>
+#include <setypes.h>
 
 
 /* Quota bypass marker */
@@ -74,11 +76,62 @@ typedef struct _EPROCESS
     LARGE_INTEGER ExitTime;
     EX_RUNDOWN_REFERENCE RundownProtect;
     HANDLE UniqueProcessId;
+    LIST_ENTRY ActiveProcessLinks;
     SIZE_T QuotaUsage[PsQuotaTypes];
     SIZE_T QuotaPeak[PsQuotaTypes];
+    PVOID DebugPort;
+    PVOID ExceptionPort;
     PHANDLE_TABLE ObjectTable;
+    PVOID Job;
+    PVOID SectionObject;
+    PVOID SectionBaseAddress;
     PEPROCESS_QUOTA_BLOCK QuotaBlock;
+    HANDLE InheritedFromUniqueProcessId;
+    CHAR ImageFileName[16];
+    LIST_ENTRY ThreadListHead;
     ACCESS_MASK GrantedAccess;
+    ULONG DefaultHardErrorProcessing;
+    PPEB ProcessEnvironmentBlock;
+    SECURITY_AUDIT_PROCESS_CREATION_INFO AuditProcessCreationInfo;
+    MMSUPPORT Vm;
+    union
+    {
+        struct
+        {
+            ULONG CreateReported:1;
+            ULONG NoDebugInherit:1;
+            ULONG ProcessExiting:1;
+            ULONG ProcessDelete:1;
+            ULONG Reserved1:1;
+            ULONG VmDeleted:1;
+            ULONG OutswapEnabled:1;
+            ULONG Outswapped:1;
+            ULONG ForkFailed:1;
+            ULONG Reserved2:1;
+            ULONG AddressSpaceInitialized:2;
+            ULONG SetTimerResolution:1;
+            ULONG BreakOnTermination:1;
+            ULONG DeprioritizeViews:1;
+            ULONG WriteWatch:1;
+            ULONG ProcessInSession:1;
+            ULONG OverrideAddressSpace:1;
+            ULONG HasAddressSpace:1;
+            ULONG LaunchPrefetched:1;
+            ULONG InjectInpageErrors:1;
+            ULONG VmTopDown:1;
+            ULONG ImageNotifyDone:1;
+            ULONG PdeUpdateNeeded:1;
+            ULONG Reserved3:1;
+            ULONG SmapAllowed:1;
+            ULONG ProcessInserted:1;
+            ULONG DefaultIoPriority:3;
+            ULONG Reserved4:1;
+            ULONG Reserved5:1;
+        };
+        ULONG Flags;
+    };
+    XTSTATUS ExitStatus;
+    UCHAR PriorityClass;
 } EPROCESS, *PEPROCESS;
 
 /* Kernel's representation of a process quota entry*/
@@ -106,5 +159,90 @@ typedef struct _ETHREAD
     ACCESS_MASK GrantedAccess;
 } ETHREAD, *PETHREAD;
 
+/* Kernel's representation of a process environment block */
+typedef struct _PEB
+{
+    BOOLEAN InheritedAddressSpace;
+    BOOLEAN ReadImageFileExecOptions;
+    BOOLEAN BeingDebugged;
+    union
+    {
+        BOOLEAN BitField;
+        struct
+        {
+            BOOLEAN ImageUsesLargePages:1;
+            BOOLEAN IsProtectedProcess:1;
+            BOOLEAN IsLegacyProcess:1;
+            BOOLEAN IsImageDynamicallyRelocated:1;
+            BOOLEAN SkipPatchingUser32Forwarders:1;
+            BOOLEAN SpareBits:3;
+        };
+    };
+    HANDLE Mutant;
+    PVOID ImageBaseAddress;
+    PLDR_PEB_DATA Ldr;
+    PVOID SubSystemData;
+    PVOID ProcessHeap;
+    PVOID AltThunkSListPtr;
+    PVOID SparePtr2;
+    ULONG EnvironmentUpdateCount;
+    PVOID KernelCallbackTable;
+    ULONG SystemReserved[1];
+    ULONG SpareUlong;
+    PPEB_FREE_BLOCK FreeList;
+    ULONG TlsExpansionCounter;
+    PVOID TlsBitmap;
+    ULONG TlsBitmapBits[2];
+    PVOID ReadOnlySharedMemoryBase;
+    PVOID HotpatchInformation;
+    PVOID* ReadOnlyStaticServerData;
+    PVOID AnsiCodePageData;
+    PVOID OemCodePageData;
+    PVOID UnicodeCaseTableData;
+    ULONG NumberOfProcessors;
+    ULONG NtGlobalFlag;
+    LARGE_INTEGER CriticalSectionTimeout;
+    ULONG_PTR HeapSegmentReserve;
+    ULONG_PTR HeapSegmentCommit;
+    ULONG_PTR HeapDeCommitTotalFreeThreshold;
+    ULONG_PTR HeapDeCommitFreeBlockThreshold;
+    ULONG NumberOfHeaps;
+    ULONG MaximumNumberOfHeaps;
+    PVOID* ProcessHeaps;
+    PVOID GdiSharedHandleTable;
+    PVOID ProcessStarterHelper;
+    ULONG GdiDCAttributeList;
+    ULONG OSMajorVersion;
+    ULONG OSMinorVersion;
+    USHORT OSBuildNumber;
+    USHORT OSCSDVersion;
+    ULONG OSPlatformId;
+    ULONG ImageSubsystem;
+    ULONG ImageSubsystemMajorVersion;
+    ULONG ImageSubsystemMinorVersion;
+    ULONG_PTR ImageProcessAffinityMask;
+    PVOID TlsExpansionBitmap;
+    ULONG TlsExpansionBitmapBits[32];
+    ULONG SessionId;
+    ULARGE_INTEGER AppCompatFlags;
+    ULARGE_INTEGER AppCompatFlagsUser;
+    PVOID pShimData;
+    PVOID AppCompatInfo;
+    UNICODE_STRING CSDVersion;
+    ULONG_PTR MinimumStackCommit;
+    PVOID* FlsCallback;
+    LIST_ENTRY FlsListHead;
+    PVOID FlsBitmap;
+    ULONG FlsBitmapBits[4];
+    ULONG FlsHighIndex;
+} PEB, *PPEB;
+
+/* Process Environment Block Free Block structure definition */
+typedef struct _PEB_FREE_BLOCK
+{
+    PPEB_FREE_BLOCK Next;
+    ULONG Size;
+} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
+
 #endif /* __XTOS_ASSEMBLER__ */
 #endif /* __XTDK_PSTYPES_H */

sdk/xtdk/setypes.h

@@ -169,6 +169,12 @@ typedef struct _PRIVILEGE_SET
     LUID_AND_ATTRIBUTES Privilege[1];
 } PRIVILEGE_SET, *PPRIVILEGE_SET;
 
+/* Security audit process creation information structure definition */
+typedef struct _SECURITY_AUDIT_PROCESS_CREATION_INFO
+{
+    POBJECT_NAME_INFORMATION ImageFileName;
+} SECURITY_AUDIT_PROCESS_CREATION_INFO, *PSECURITY_AUDIT_PROCESS_CREATION_INFO;
+
 /* Identifier authority structure definition */
 typedef struct _SID_IDENTIFIER_AUTHORITY
 {

sdk/xtdk/xtstruct.h

@@ -347,6 +347,7 @@ typedef struct _KUBSAN_TYPE_MISMATCH_DATA KUBSAN_TYPE_MISMATCH_DATA, *PKUBSAN_TY
 typedef struct _KUBSAN_TYPE_MISMATCH_DATA_V1 KUBSAN_TYPE_MISMATCH_DATA_V1, *PKUBSAN_TYPE_MISMATCH_DATA_V1;
 typedef struct _KWAIT_BLOCK KWAIT_BLOCK, *PKWAIT_BLOCK;
 typedef struct _LDR_DATA_TABLE_ENTRY LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
+typedef struct _LDR_PEB_DATA LDR_PEB_DATA, *PLDR_PEB_DATA;
 typedef struct _LIST_ENTRY LIST_ENTRY, *PLIST_ENTRY;
 typedef struct _LIST_ENTRY32 LIST_ENTRY32, *PLIST_ENTRY32;
 typedef struct _LIST_ENTRY64 LIST_ENTRY64, *PLIST_ENTRY64;
@@ -368,6 +369,9 @@ typedef struct _MMFREE_POOL_ENTRY MMFREE_POOL_ENTRY, *PMMFREE_POOL_ENTRY;
 typedef struct _MMMEMORY_LAYOUT MMMEMORY_LAYOUT, *PMMMEMORY_LAYOUT;
 typedef struct _MMPFNENTRY MMPFNENTRY, *PMMPFNENTRY;
 typedef struct _MMPFNLIST MMPFNLIST, *PMMPFNLIST;
+typedef struct _MMSUPPORT MMSUPPORT, *PMMSUPPORT;
+typedef struct _MMSUPPORT_FLAGS MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;
+typedef struct _MMWSLE_HASH MMWSLE_HASH, *PMMWSLE_HASH;
 typedef struct _NAMED_PIPE_CREATE_PARAMETERS NAMED_PIPE_CREATE_PARAMETERS, *PNAMED_PIPE_CREATE_PARAMETERS;
 typedef struct _NLSTABLE_INFO NLSTABLE_INFO, *PNLSTABLE_INFO;
 typedef struct _NONPAGED_LOOKASIDE_LIST NONPAGED_LOOKASIDE_LIST, *PNONPAGED_LOOKASIDE_LIST;
@@ -404,6 +408,8 @@ typedef struct _PCI_DEVICE_HEADER_TYPE_REGION PCI_DEVICE_HEADER_TYPE_REGION, *PP
 typedef struct _PCI_DEVICE_INDEPENDENT_REGION PCI_DEVICE_INDEPENDENT_REGION, *PPCI_DEVICE_INDEPENDENT_REGION;
 typedef struct _PCI_TYPE0_DEVICE PCI_TYPE0_DEVICE, *PPCI_TYPE0_DEVICE;
 typedef struct _PCI_TYPE1_DEVICE PCI_TYPE1_DEVICE, *PPCI_TYPE1_DEVICE;
+typedef struct _PEB PEB, *PPEB;
+typedef struct _PEB_FREE_BLOCK PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
 typedef struct _PECOFF_IMAGE_BASE_RELOCATION PECOFF_IMAGE_BASE_RELOCATION, *PPECOFF_IMAGE_BASE_RELOCATION;
 typedef struct _PECOFF_IMAGE_DATA PECOFF_IMAGE_DATA, *PPECOFF_IMAGE_DATA;
 typedef struct _PECOFF_IMAGE_DATA_DIRECTORY PECOFF_IMAGE_DATA_DIRECTORY, *PPECOFF_IMAGE_DATA_DIRECTORY;
@@ -441,6 +447,7 @@ typedef struct _RTL_PRINT_FORMAT_PROPERTIES RTL_PRINT_FORMAT_PROPERTIES, *PRTL_P
 typedef struct _RTL_RB_TREE RTL_RB_TREE, *PRTL_RB_TREE;
 typedef struct _SCSI_REQUEST_BLOCK SCSI_REQUEST_BLOCK, *PSCSI_REQUEST_BLOCK;
 typedef struct _SECTION_OBJECT_POINTERS SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS;
+typedef struct _SECURITY_AUDIT_PROCESS_CREATION_INFO SECURITY_AUDIT_PROCESS_CREATION_INFO, *PSECURITY_AUDIT_PROCESS_CREATION_INFO;
 typedef struct _SECURITY_CLIENT_CONTEXT SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
 typedef struct _SECURITY_QUALITY_OF_SERVICE SECURITY_QUALITY_OF_SERVICE, *PSECURITY_QUALITY_OF_SERVICE;
 typedef struct _SECURITY_SUBJECT_CONTEXT SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;