diff --git a/sdk/xtdk/amd64/mmtypes.h b/sdk/xtdk/amd64/mmtypes.h index d6f50c4..bdbc144 100644 --- a/sdk/xtdk/amd64/mmtypes.h +++ b/sdk/xtdk/amd64/mmtypes.h @@ -352,5 +352,62 @@ typedef struct _POOL_DESCRIPTOR SIZE_T Reserved; } POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR; +/* Working set list entry structure definition */ +typedef struct _MMWSLENTRY +{ + ULONG_PTR Valid:1; + ULONG_PTR LockedInWs:1; + ULONG_PTR LockedInMemory:1; + ULONG_PTR Protection:5; + ULONG_PTR Hashed:1; + ULONG_PTR Direct:1; + ULONG_PTR Age:2; + ULONG_PTR VirtualPageNumber:52; +} MMWSLENTRY, *PMMWSLENTRY; + +/* Working set free entry structure definition */ +typedef struct _MMWSLE_FREE_ENTRY +{ + ULONG MustBeZero:1; + ULONG PreviousFree:31; + LONG NextFree; +} MMWSLE_FREE_ENTRY, *PMMWSLE_FREE_ENTRY; + +/* Working set list entry union definition */ +typedef union _MMWSLE +{ + PVOID VirtualAddress; + ULONG_PTR Long; + MMWSLENTRY e1; + MMWSLE_FREE_ENTRY Free; +} MMWSLE, *PMMWSLE; + +/* Working set list structure definition */ +typedef struct _MMWSL +{ + ULONG FirstFree; + ULONG FirstDynamic; + ULONG LastEntry; + ULONG NextSlot; + PMMWSLE Wsle; + ULONG LastInitializedWsle; + ULONG NonDirectCount; + PMMWSLE_HASH HashTable; + ULONG HashTableSize; + ULONG NumberOfCommittedPageTables; + PVOID HashTableStart; + PVOID HighestPermittedHashAddress; + ULONG NumberOfImageWaiters; + ULONG VadBitMapHint; + PVOID HighestUserAddress; + ULONG MaximumUserPageTablePages; + ULONG MaximumUserPageDirectoryPages; + PULONG CommittedPageTables; + ULONG NumberOfCommittedPageDirectories; + PULONG CommittedPageDirectories; + ULONG NumberOfCommittedPageDirectoryParents; + ULONGLONG CommittedPageDirectoryParents[1]; +} MMWSL, *PMMWSL; + #endif /* __XTOS_ASSEMBLER__ */ #endif /* __XTDK_AMD64_MMTYPES_H */ diff --git a/sdk/xtdk/amd64/xtstruct.h b/sdk/xtdk/amd64/xtstruct.h index de212bc..e087880 100644 --- a/sdk/xtdk/amd64/xtstruct.h +++ b/sdk/xtdk/amd64/xtstruct.h @@ -72,6 +72,9 @@ typedef struct _MMPTE_PROTOTYPE MMPTE_PROTOTYPE, *PMMPTE_PROTOTYPE; typedef struct _MMPTE_SOFTWARE MMPTE_SOFTWARE, *PMMPTE_SOFTWARE; typedef struct _MMPTE_SUBSECTION MMPTE_SUBSECTION, *PMMPTE_SUBSECTION; typedef struct _MMPTE_TRANSITION MMPTE_TRANSITION, *PMMPTE_TRANSITION; +typedef struct _MMWSL MMWSL, *PMMWSL; +typedef struct _MMWSLE_FREE_ENTRY MMWSLE_FREE_ENTRY, *PMMWSLE_FREE_ENTRY; +typedef struct _MMWSLENTRY MMWSLENTRY, *PMMWSLENTRY; typedef struct _POOL_DESCRIPTOR POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR; typedef struct _THREAD_ENVIRONMENT_BLOCK THREAD_ENVIRONMENT_BLOCK, *PTHREAD_ENVIRONMENT_BLOCK; typedef struct _TIMER_CAPABILITIES TIMER_CAPABILITIES, *PTIMER_CAPABILITIES; @@ -87,6 +90,7 @@ typedef union _MMPTE MMPDE, *PMMPDE; typedef union _MMPTE MMPPE, *PMMPPE; typedef union _MMPTE MMPTE, *PMMPTE; typedef union _MMPTE MMPXE, *PMMPXE; +typedef union _MMWSLE MMWSLE, *PMMWSLE; typedef union _PIC_I8259_ICW1 PIC_I8259_ICW1, *PPIC_I8259_ICW1; typedef union _PIC_I8259_ICW2 PIC_I8259_ICW2, *PPIC_I8259_ICW2; typedef union _PIC_I8259_ICW3 PIC_I8259_ICW3, *PPIC_I8259_ICW3; diff --git a/sdk/xtdk/i686/mmtypes.h b/sdk/xtdk/i686/mmtypes.h index eb20aa6..0f80573 100644 --- a/sdk/xtdk/i686/mmtypes.h +++ b/sdk/xtdk/i686/mmtypes.h @@ -444,5 +444,56 @@ typedef struct _POOL_DESCRIPTOR SIZE_T Reserved; } POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR; +/* Working set list entry structure definition */ +typedef struct _MMWSLENTRY +{ + ULONG_PTR Valid:1; + ULONG_PTR LockedInWs:1; + ULONG_PTR LockedInMemory:1; + ULONG_PTR Protection:5; + ULONG_PTR Hashed:1; + ULONG_PTR Direct:1; + ULONG_PTR Age:2; + ULONG_PTR VirtualPageNumber:20; +} MMWSLENTRY, *PMMWSLENTRY; + +/* Working set free entry structure definition */ +typedef struct _MMWSLE_FREE_ENTRY +{ + ULONG MustBeZero:1; + ULONG PreviousFree:11; + LONG NextFree:20; +} MMWSLE_FREE_ENTRY, *PMMWSLE_FREE_ENTRY; + +/* Working set list entry union definition */ +typedef union _MMWSLE +{ + PVOID VirtualAddress; + ULONG_PTR Long; + MMWSLENTRY e1; + MMWSLE_FREE_ENTRY Free; +} MMWSLE, *PMMWSLE; + +/* Working set list structure definition */ +typedef struct _MMWSL +{ + ULONG FirstFree; + ULONG FirstDynamic; + ULONG LastEntry; + ULONG NextSlot; + PMMWSLE Wsle; + ULONG LastInitializedWsle; + ULONG NonDirectCount; + PMMWSLE_HASH HashTable; + ULONG HashTableSize; + ULONG NumberOfCommittedPageTables; + PVOID HashTableStart; + PVOID HighestPermittedHashAddress; + ULONG NumberOfImageWaiters; + ULONG VadBitMapHint; + USHORT UsedPageTableEntries[768]; + ULONG CommittedPageTables[24]; +} MMWSL, *PMMWSL; + #endif /* __XTOS_ASSEMBLER__ */ #endif /* __XTDK_I686_MMTYPES_H */ diff --git a/sdk/xtdk/i686/xtstruct.h b/sdk/xtdk/i686/xtstruct.h index 4d26ce4..5644a28 100644 --- a/sdk/xtdk/i686/xtstruct.h +++ b/sdk/xtdk/i686/xtstruct.h @@ -81,6 +81,9 @@ typedef struct _MMPML3_PTE_PROTOTYPE MMPML3_PTE_PROTOTYPE, *PMMPML3_PTE_PROTOTYP typedef struct _MMPML3_PTE_SOFTWARE MMPML3_PTE_SOFTWARE, *PMMPML3_PTE_SOFTWARE; typedef struct _MMPML3_PTE_SUBSECTION MMPML3_PTE_SUBSECTION, *PMMPML3_PTE_SUBSECTION; typedef struct _MMPML3_PTE_TRANSITION MMPML3_PTE_TRANSITION, *PMMPML3_PTE_TRANSITION; +typedef struct _MMWSL MMWSL, *PMMWSL; +typedef struct _MMWSLE_FREE_ENTRY MMWSLE_FREE_ENTRY, *PMMWSLE_FREE_ENTRY; +typedef struct _MMWSLENTRY MMWSLENTRY, *PMMWSLENTRY; typedef struct _POOL_DESCRIPTOR POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR; typedef struct _THREAD_ENVIRONMENT_BLOCK THREAD_ENVIRONMENT_BLOCK, *PTHREAD_ENVIRONMENT_BLOCK; typedef struct _TIMER_CAPABILITIES TIMER_CAPABILITIES, *PTIMER_CAPABILITIES; @@ -97,6 +100,7 @@ typedef union _MMPML3_PTE MMPML3_PTE, *PMMPML3_PTE; typedef union _MMPTE MMPDE, *PMMPDE; typedef union _MMPTE MMPPE, *PMMPPE; typedef union _MMPTE MMPTE, *PMMPTE; +typedef union _MMWSLE MMWSLE, *PMMWSLE; typedef union _PIC_I8259_ICW1 PIC_I8259_ICW1, *PPIC_I8259_ICW1; typedef union _PIC_I8259_ICW2 PIC_I8259_ICW2, *PPIC_I8259_ICW2; typedef union _PIC_I8259_ICW3 PIC_I8259_ICW3, *PPIC_I8259_ICW3; diff --git a/sdk/xtdk/ldrtypes.h b/sdk/xtdk/ldrtypes.h index c015612..40650c4 100644 --- a/sdk/xtdk/ldrtypes.h +++ b/sdk/xtdk/ldrtypes.h @@ -74,5 +74,18 @@ typedef struct _LDR_DATA_TABLE_ENTRY PVOID PatchInformation; } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; +typedef struct _LDR_PEB_DATA +{ + ULONG Length; + BOOLEAN Initialized; + PVOID SsHandle; + LIST_ENTRY InLoadOrderModuleList; + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + PVOID EntryInProgress; + UCHAR ShutdownInProgress; + PVOID ShutdownThreadId; +} LDR_PEB_DATA, *PLDR_PEB_DATA; + #endif /* __XTOS_ASSEMBLER__ */ #endif /* __XTDK_LDRTYPES_H */ diff --git a/sdk/xtdk/mmtypes.h b/sdk/xtdk/mmtypes.h index 13d816e..f3454b3 100644 --- a/sdk/xtdk/mmtypes.h +++ b/sdk/xtdk/mmtypes.h @@ -11,6 +11,7 @@ #define __XTDK_MMTYPES_H #include +#include #include ARCH_HEADER(xtstruct.h) @@ -282,5 +283,52 @@ typedef struct _POOL_TRACKING_TABLE ULONG Tag; } POOL_TRACKING_TABLE, *PPOOL_TRACKING_TABLE; +/* Memory manager support flags structure definition */ +typedef struct _MMSUPPORT_FLAGS +{ + ULONG SessionSpace:1; + ULONG BeingTrimmed:1; + ULONG SessionLeader:1; + ULONG TrimHard:1; + ULONG MaximumWorkingSetHard:1; + ULONG ForceTrim:1; + ULONG MinimumWorkingSetHard:1; + ULONG Available0:1; + ULONG MemoryPriority:8; + ULONG GrowWsleHash:1; + ULONG AcquiredUnsafe:1; + ULONG Available:14; +} MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS; + +/* Memory manager support structure definition */ +typedef struct _MMSUPPORT +{ + LIST_ENTRY WorkingSetExpansionLinks; + USHORT LastTrimpStamp; + USHORT NextPageColor; + MMSUPPORT_FLAGS Flags; + ULONG PageFaultCount; + ULONG PeakWorkingSetSize; + ULONG GrowthSinceLastEstimate; + ULONG MinimumWorkingSetSize; + ULONG MaximumWorkingSetSize; + PMMWSL VmWorkingSetList; + ULONG Claim; + ULONG NextEstimationSlot; + ULONG NextAgingSlot; + ULONG EstimatedAvailable; + ULONG WorkingSetSize; + PKEVENT ExitEvent; + KPUSH_LOCK WorkingSetMutex; + PVOID AccessLog; +} MMSUPPORT, *PMMSUPPORT; + +/* Working Set List Entry Hash structure definition */ +typedef struct _MMWSLE_HASH +{ + PVOID Key; + ULONG Index; +} MMWSLE_HASH, *PMMWSLE_HASH; + #endif /* __XTOS_ASSEMBLER__ */ #endif /* __XTDK_MMTYPES_H */ diff --git a/sdk/xtdk/pstypes.h b/sdk/xtdk/pstypes.h index 11db20d..2be3001 100644 --- a/sdk/xtdk/pstypes.h +++ b/sdk/xtdk/pstypes.h @@ -12,6 +12,8 @@ #include #include #include +#include +#include /* Quota bypass marker */ @@ -74,11 +76,62 @@ typedef struct _EPROCESS LARGE_INTEGER ExitTime; EX_RUNDOWN_REFERENCE RundownProtect; HANDLE UniqueProcessId; + LIST_ENTRY ActiveProcessLinks; SIZE_T QuotaUsage[PsQuotaTypes]; SIZE_T QuotaPeak[PsQuotaTypes]; + PVOID DebugPort; + PVOID ExceptionPort; PHANDLE_TABLE ObjectTable; + PVOID Job; + PVOID SectionObject; + PVOID SectionBaseAddress; PEPROCESS_QUOTA_BLOCK QuotaBlock; + HANDLE InheritedFromUniqueProcessId; + CHAR ImageFileName[16]; + LIST_ENTRY ThreadListHead; ACCESS_MASK GrantedAccess; + ULONG DefaultHardErrorProcessing; + PPEB ProcessEnvironmentBlock; + SECURITY_AUDIT_PROCESS_CREATION_INFO AuditProcessCreationInfo; + MMSUPPORT Vm; + union + { + struct + { + ULONG CreateReported:1; + ULONG NoDebugInherit:1; + ULONG ProcessExiting:1; + ULONG ProcessDelete:1; + ULONG Reserved1:1; + ULONG VmDeleted:1; + ULONG OutswapEnabled:1; + ULONG Outswapped:1; + ULONG ForkFailed:1; + ULONG Reserved2:1; + ULONG AddressSpaceInitialized:2; + ULONG SetTimerResolution:1; + ULONG BreakOnTermination:1; + ULONG DeprioritizeViews:1; + ULONG WriteWatch:1; + ULONG ProcessInSession:1; + ULONG OverrideAddressSpace:1; + ULONG HasAddressSpace:1; + ULONG LaunchPrefetched:1; + ULONG InjectInpageErrors:1; + ULONG VmTopDown:1; + ULONG ImageNotifyDone:1; + ULONG PdeUpdateNeeded:1; + ULONG Reserved3:1; + ULONG SmapAllowed:1; + ULONG ProcessInserted:1; + ULONG DefaultIoPriority:3; + ULONG Reserved4:1; + ULONG Reserved5:1; + }; + ULONG Flags; + }; + XTSTATUS ExitStatus; + UCHAR PriorityClass; } EPROCESS, *PEPROCESS; /* Kernel's representation of a process quota entry*/ @@ -106,5 +159,90 @@ typedef struct _ETHREAD ACCESS_MASK GrantedAccess; } ETHREAD, *PETHREAD; +/* Kernel's representation of a process environment block */ +typedef struct _PEB +{ + BOOLEAN InheritedAddressSpace; + BOOLEAN ReadImageFileExecOptions; + BOOLEAN BeingDebugged; + union + { + BOOLEAN BitField; + struct + { + BOOLEAN ImageUsesLargePages:1; + BOOLEAN IsProtectedProcess:1; + BOOLEAN IsLegacyProcess:1; + BOOLEAN IsImageDynamicallyRelocated:1; + BOOLEAN SkipPatchingUser32Forwarders:1; + BOOLEAN SpareBits:3; + }; + }; + HANDLE Mutant; + PVOID ImageBaseAddress; + PLDR_PEB_DATA Ldr; + PVOID SubSystemData; + PVOID ProcessHeap; + PVOID AltThunkSListPtr; + PVOID SparePtr2; + ULONG EnvironmentUpdateCount; + PVOID KernelCallbackTable; + ULONG SystemReserved[1]; + ULONG SpareUlong; + PPEB_FREE_BLOCK FreeList; + ULONG TlsExpansionCounter; + PVOID TlsBitmap; + ULONG TlsBitmapBits[2]; + PVOID ReadOnlySharedMemoryBase; + PVOID HotpatchInformation; + PVOID* ReadOnlyStaticServerData; + PVOID AnsiCodePageData; + PVOID OemCodePageData; + PVOID UnicodeCaseTableData; + ULONG NumberOfProcessors; + ULONG NtGlobalFlag; + LARGE_INTEGER CriticalSectionTimeout; + ULONG_PTR HeapSegmentReserve; + ULONG_PTR HeapSegmentCommit; + ULONG_PTR HeapDeCommitTotalFreeThreshold; + ULONG_PTR HeapDeCommitFreeBlockThreshold; + ULONG NumberOfHeaps; + ULONG MaximumNumberOfHeaps; + PVOID* ProcessHeaps; + PVOID GdiSharedHandleTable; + PVOID ProcessStarterHelper; + ULONG GdiDCAttributeList; + ULONG OSMajorVersion; + ULONG OSMinorVersion; + USHORT OSBuildNumber; + USHORT OSCSDVersion; + ULONG OSPlatformId; + ULONG ImageSubsystem; + ULONG ImageSubsystemMajorVersion; + ULONG ImageSubsystemMinorVersion; + ULONG_PTR ImageProcessAffinityMask; + PVOID TlsExpansionBitmap; + ULONG TlsExpansionBitmapBits[32]; + ULONG SessionId; + ULARGE_INTEGER AppCompatFlags; + ULARGE_INTEGER AppCompatFlagsUser; + PVOID pShimData; + PVOID AppCompatInfo; + UNICODE_STRING CSDVersion; + ULONG_PTR MinimumStackCommit; + PVOID* FlsCallback; + LIST_ENTRY FlsListHead; + PVOID FlsBitmap; + ULONG FlsBitmapBits[4]; + ULONG FlsHighIndex; +} PEB, *PPEB; + +/* Process Environment Block Free Block structure definition */ +typedef struct _PEB_FREE_BLOCK +{ + PPEB_FREE_BLOCK Next; + ULONG Size; +} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK; + #endif /* __XTOS_ASSEMBLER__ */ #endif /* __XTDK_PSTYPES_H */ diff --git a/sdk/xtdk/setypes.h b/sdk/xtdk/setypes.h index 4426ade..3fe3e25 100644 --- a/sdk/xtdk/setypes.h +++ b/sdk/xtdk/setypes.h @@ -169,6 +169,12 @@ typedef struct _PRIVILEGE_SET LUID_AND_ATTRIBUTES Privilege[1]; } PRIVILEGE_SET, *PPRIVILEGE_SET; +/* Security audit process creation information structure definition */ +typedef struct _SECURITY_AUDIT_PROCESS_CREATION_INFO +{ + POBJECT_NAME_INFORMATION ImageFileName; +} SECURITY_AUDIT_PROCESS_CREATION_INFO, *PSECURITY_AUDIT_PROCESS_CREATION_INFO; + /* Identifier authority structure definition */ typedef struct _SID_IDENTIFIER_AUTHORITY { diff --git a/sdk/xtdk/xtstruct.h b/sdk/xtdk/xtstruct.h index 8ae09ef..cd35639 100644 --- a/sdk/xtdk/xtstruct.h +++ b/sdk/xtdk/xtstruct.h @@ -347,6 +347,7 @@ typedef struct _KUBSAN_TYPE_MISMATCH_DATA KUBSAN_TYPE_MISMATCH_DATA, *PKUBSAN_TY typedef struct _KUBSAN_TYPE_MISMATCH_DATA_V1 KUBSAN_TYPE_MISMATCH_DATA_V1, *PKUBSAN_TYPE_MISMATCH_DATA_V1; typedef struct _KWAIT_BLOCK KWAIT_BLOCK, *PKWAIT_BLOCK; typedef struct _LDR_DATA_TABLE_ENTRY LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; +typedef struct _LDR_PEB_DATA LDR_PEB_DATA, *PLDR_PEB_DATA; typedef struct _LIST_ENTRY LIST_ENTRY, *PLIST_ENTRY; typedef struct _LIST_ENTRY32 LIST_ENTRY32, *PLIST_ENTRY32; typedef struct _LIST_ENTRY64 LIST_ENTRY64, *PLIST_ENTRY64; @@ -368,6 +369,9 @@ typedef struct _MMFREE_POOL_ENTRY MMFREE_POOL_ENTRY, *PMMFREE_POOL_ENTRY; typedef struct _MMMEMORY_LAYOUT MMMEMORY_LAYOUT, *PMMMEMORY_LAYOUT; typedef struct _MMPFNENTRY MMPFNENTRY, *PMMPFNENTRY; typedef struct _MMPFNLIST MMPFNLIST, *PMMPFNLIST; +typedef struct _MMSUPPORT MMSUPPORT, *PMMSUPPORT; +typedef struct _MMSUPPORT_FLAGS MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS; +typedef struct _MMWSLE_HASH MMWSLE_HASH, *PMMWSLE_HASH; typedef struct _NAMED_PIPE_CREATE_PARAMETERS NAMED_PIPE_CREATE_PARAMETERS, *PNAMED_PIPE_CREATE_PARAMETERS; typedef struct _NLSTABLE_INFO NLSTABLE_INFO, *PNLSTABLE_INFO; typedef struct _NONPAGED_LOOKASIDE_LIST NONPAGED_LOOKASIDE_LIST, *PNONPAGED_LOOKASIDE_LIST; @@ -404,6 +408,8 @@ typedef struct _PCI_DEVICE_HEADER_TYPE_REGION PCI_DEVICE_HEADER_TYPE_REGION, *PP typedef struct _PCI_DEVICE_INDEPENDENT_REGION PCI_DEVICE_INDEPENDENT_REGION, *PPCI_DEVICE_INDEPENDENT_REGION; typedef struct _PCI_TYPE0_DEVICE PCI_TYPE0_DEVICE, *PPCI_TYPE0_DEVICE; typedef struct _PCI_TYPE1_DEVICE PCI_TYPE1_DEVICE, *PPCI_TYPE1_DEVICE; +typedef struct _PEB PEB, *PPEB; +typedef struct _PEB_FREE_BLOCK PEB_FREE_BLOCK, *PPEB_FREE_BLOCK; typedef struct _PECOFF_IMAGE_BASE_RELOCATION PECOFF_IMAGE_BASE_RELOCATION, *PPECOFF_IMAGE_BASE_RELOCATION; typedef struct _PECOFF_IMAGE_DATA PECOFF_IMAGE_DATA, *PPECOFF_IMAGE_DATA; typedef struct _PECOFF_IMAGE_DATA_DIRECTORY PECOFF_IMAGE_DATA_DIRECTORY, *PPECOFF_IMAGE_DATA_DIRECTORY; @@ -441,6 +447,7 @@ typedef struct _RTL_PRINT_FORMAT_PROPERTIES RTL_PRINT_FORMAT_PROPERTIES, *PRTL_P typedef struct _RTL_RB_TREE RTL_RB_TREE, *PRTL_RB_TREE; typedef struct _SCSI_REQUEST_BLOCK SCSI_REQUEST_BLOCK, *PSCSI_REQUEST_BLOCK; typedef struct _SECTION_OBJECT_POINTERS SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS; +typedef struct _SECURITY_AUDIT_PROCESS_CREATION_INFO SECURITY_AUDIT_PROCESS_CREATION_INFO, *PSECURITY_AUDIT_PROCESS_CREATION_INFO; typedef struct _SECURITY_CLIENT_CONTEXT SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT; typedef struct _SECURITY_QUALITY_OF_SERVICE SECURITY_QUALITY_OF_SERVICE, *PSECURITY_QUALITY_OF_SERVICE; typedef struct _SECURITY_SUBJECT_CONTEXT SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;