Introduce working set list types and extend EPROCESS structure
This commit is contained in:
@@ -352,5 +352,62 @@ typedef struct _POOL_DESCRIPTOR
|
|||||||
SIZE_T Reserved;
|
SIZE_T Reserved;
|
||||||
} POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR;
|
} POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR;
|
||||||
|
|
||||||
|
/* Working set list entry structure definition */
|
||||||
|
typedef struct _MMWSLENTRY
|
||||||
|
{
|
||||||
|
ULONG_PTR Valid:1;
|
||||||
|
ULONG_PTR LockedInWs:1;
|
||||||
|
ULONG_PTR LockedInMemory:1;
|
||||||
|
ULONG_PTR Protection:5;
|
||||||
|
ULONG_PTR Hashed:1;
|
||||||
|
ULONG_PTR Direct:1;
|
||||||
|
ULONG_PTR Age:2;
|
||||||
|
ULONG_PTR VirtualPageNumber:52;
|
||||||
|
} MMWSLENTRY, *PMMWSLENTRY;
|
||||||
|
|
||||||
|
/* Working set free entry structure definition */
|
||||||
|
typedef struct _MMWSLE_FREE_ENTRY
|
||||||
|
{
|
||||||
|
ULONG MustBeZero:1;
|
||||||
|
ULONG PreviousFree:31;
|
||||||
|
LONG NextFree;
|
||||||
|
} MMWSLE_FREE_ENTRY, *PMMWSLE_FREE_ENTRY;
|
||||||
|
|
||||||
|
/* Working set list entry union definition */
|
||||||
|
typedef union _MMWSLE
|
||||||
|
{
|
||||||
|
PVOID VirtualAddress;
|
||||||
|
ULONG_PTR Long;
|
||||||
|
MMWSLENTRY e1;
|
||||||
|
MMWSLE_FREE_ENTRY Free;
|
||||||
|
} MMWSLE, *PMMWSLE;
|
||||||
|
|
||||||
|
/* Working set list structure definition */
|
||||||
|
typedef struct _MMWSL
|
||||||
|
{
|
||||||
|
ULONG FirstFree;
|
||||||
|
ULONG FirstDynamic;
|
||||||
|
ULONG LastEntry;
|
||||||
|
ULONG NextSlot;
|
||||||
|
PMMWSLE Wsle;
|
||||||
|
ULONG LastInitializedWsle;
|
||||||
|
ULONG NonDirectCount;
|
||||||
|
PMMWSLE_HASH HashTable;
|
||||||
|
ULONG HashTableSize;
|
||||||
|
ULONG NumberOfCommittedPageTables;
|
||||||
|
PVOID HashTableStart;
|
||||||
|
PVOID HighestPermittedHashAddress;
|
||||||
|
ULONG NumberOfImageWaiters;
|
||||||
|
ULONG VadBitMapHint;
|
||||||
|
PVOID HighestUserAddress;
|
||||||
|
ULONG MaximumUserPageTablePages;
|
||||||
|
ULONG MaximumUserPageDirectoryPages;
|
||||||
|
PULONG CommittedPageTables;
|
||||||
|
ULONG NumberOfCommittedPageDirectories;
|
||||||
|
PULONG CommittedPageDirectories;
|
||||||
|
ULONG NumberOfCommittedPageDirectoryParents;
|
||||||
|
ULONGLONG CommittedPageDirectoryParents[1];
|
||||||
|
} MMWSL, *PMMWSL;
|
||||||
|
|
||||||
#endif /* __XTOS_ASSEMBLER__ */
|
#endif /* __XTOS_ASSEMBLER__ */
|
||||||
#endif /* __XTDK_AMD64_MMTYPES_H */
|
#endif /* __XTDK_AMD64_MMTYPES_H */
|
||||||
|
|||||||
@@ -72,6 +72,9 @@ typedef struct _MMPTE_PROTOTYPE MMPTE_PROTOTYPE, *PMMPTE_PROTOTYPE;
|
|||||||
typedef struct _MMPTE_SOFTWARE MMPTE_SOFTWARE, *PMMPTE_SOFTWARE;
|
typedef struct _MMPTE_SOFTWARE MMPTE_SOFTWARE, *PMMPTE_SOFTWARE;
|
||||||
typedef struct _MMPTE_SUBSECTION MMPTE_SUBSECTION, *PMMPTE_SUBSECTION;
|
typedef struct _MMPTE_SUBSECTION MMPTE_SUBSECTION, *PMMPTE_SUBSECTION;
|
||||||
typedef struct _MMPTE_TRANSITION MMPTE_TRANSITION, *PMMPTE_TRANSITION;
|
typedef struct _MMPTE_TRANSITION MMPTE_TRANSITION, *PMMPTE_TRANSITION;
|
||||||
|
typedef struct _MMWSL MMWSL, *PMMWSL;
|
||||||
|
typedef struct _MMWSLE_FREE_ENTRY MMWSLE_FREE_ENTRY, *PMMWSLE_FREE_ENTRY;
|
||||||
|
typedef struct _MMWSLENTRY MMWSLENTRY, *PMMWSLENTRY;
|
||||||
typedef struct _POOL_DESCRIPTOR POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR;
|
typedef struct _POOL_DESCRIPTOR POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR;
|
||||||
typedef struct _THREAD_ENVIRONMENT_BLOCK THREAD_ENVIRONMENT_BLOCK, *PTHREAD_ENVIRONMENT_BLOCK;
|
typedef struct _THREAD_ENVIRONMENT_BLOCK THREAD_ENVIRONMENT_BLOCK, *PTHREAD_ENVIRONMENT_BLOCK;
|
||||||
typedef struct _TIMER_CAPABILITIES TIMER_CAPABILITIES, *PTIMER_CAPABILITIES;
|
typedef struct _TIMER_CAPABILITIES TIMER_CAPABILITIES, *PTIMER_CAPABILITIES;
|
||||||
@@ -87,6 +90,7 @@ typedef union _MMPTE MMPDE, *PMMPDE;
|
|||||||
typedef union _MMPTE MMPPE, *PMMPPE;
|
typedef union _MMPTE MMPPE, *PMMPPE;
|
||||||
typedef union _MMPTE MMPTE, *PMMPTE;
|
typedef union _MMPTE MMPTE, *PMMPTE;
|
||||||
typedef union _MMPTE MMPXE, *PMMPXE;
|
typedef union _MMPTE MMPXE, *PMMPXE;
|
||||||
|
typedef union _MMWSLE MMWSLE, *PMMWSLE;
|
||||||
typedef union _PIC_I8259_ICW1 PIC_I8259_ICW1, *PPIC_I8259_ICW1;
|
typedef union _PIC_I8259_ICW1 PIC_I8259_ICW1, *PPIC_I8259_ICW1;
|
||||||
typedef union _PIC_I8259_ICW2 PIC_I8259_ICW2, *PPIC_I8259_ICW2;
|
typedef union _PIC_I8259_ICW2 PIC_I8259_ICW2, *PPIC_I8259_ICW2;
|
||||||
typedef union _PIC_I8259_ICW3 PIC_I8259_ICW3, *PPIC_I8259_ICW3;
|
typedef union _PIC_I8259_ICW3 PIC_I8259_ICW3, *PPIC_I8259_ICW3;
|
||||||
|
|||||||
@@ -444,5 +444,56 @@ typedef struct _POOL_DESCRIPTOR
|
|||||||
SIZE_T Reserved;
|
SIZE_T Reserved;
|
||||||
} POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR;
|
} POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR;
|
||||||
|
|
||||||
|
/* Working set list entry structure definition */
|
||||||
|
typedef struct _MMWSLENTRY
|
||||||
|
{
|
||||||
|
ULONG_PTR Valid:1;
|
||||||
|
ULONG_PTR LockedInWs:1;
|
||||||
|
ULONG_PTR LockedInMemory:1;
|
||||||
|
ULONG_PTR Protection:5;
|
||||||
|
ULONG_PTR Hashed:1;
|
||||||
|
ULONG_PTR Direct:1;
|
||||||
|
ULONG_PTR Age:2;
|
||||||
|
ULONG_PTR VirtualPageNumber:20;
|
||||||
|
} MMWSLENTRY, *PMMWSLENTRY;
|
||||||
|
|
||||||
|
/* Working set free entry structure definition */
|
||||||
|
typedef struct _MMWSLE_FREE_ENTRY
|
||||||
|
{
|
||||||
|
ULONG MustBeZero:1;
|
||||||
|
ULONG PreviousFree:11;
|
||||||
|
LONG NextFree:20;
|
||||||
|
} MMWSLE_FREE_ENTRY, *PMMWSLE_FREE_ENTRY;
|
||||||
|
|
||||||
|
/* Working set list entry union definition */
|
||||||
|
typedef union _MMWSLE
|
||||||
|
{
|
||||||
|
PVOID VirtualAddress;
|
||||||
|
ULONG_PTR Long;
|
||||||
|
MMWSLENTRY e1;
|
||||||
|
MMWSLE_FREE_ENTRY Free;
|
||||||
|
} MMWSLE, *PMMWSLE;
|
||||||
|
|
||||||
|
/* Working set list structure definition */
|
||||||
|
typedef struct _MMWSL
|
||||||
|
{
|
||||||
|
ULONG FirstFree;
|
||||||
|
ULONG FirstDynamic;
|
||||||
|
ULONG LastEntry;
|
||||||
|
ULONG NextSlot;
|
||||||
|
PMMWSLE Wsle;
|
||||||
|
ULONG LastInitializedWsle;
|
||||||
|
ULONG NonDirectCount;
|
||||||
|
PMMWSLE_HASH HashTable;
|
||||||
|
ULONG HashTableSize;
|
||||||
|
ULONG NumberOfCommittedPageTables;
|
||||||
|
PVOID HashTableStart;
|
||||||
|
PVOID HighestPermittedHashAddress;
|
||||||
|
ULONG NumberOfImageWaiters;
|
||||||
|
ULONG VadBitMapHint;
|
||||||
|
USHORT UsedPageTableEntries[768];
|
||||||
|
ULONG CommittedPageTables[24];
|
||||||
|
} MMWSL, *PMMWSL;
|
||||||
|
|
||||||
#endif /* __XTOS_ASSEMBLER__ */
|
#endif /* __XTOS_ASSEMBLER__ */
|
||||||
#endif /* __XTDK_I686_MMTYPES_H */
|
#endif /* __XTDK_I686_MMTYPES_H */
|
||||||
|
|||||||
@@ -81,6 +81,9 @@ typedef struct _MMPML3_PTE_PROTOTYPE MMPML3_PTE_PROTOTYPE, *PMMPML3_PTE_PROTOTYP
|
|||||||
typedef struct _MMPML3_PTE_SOFTWARE MMPML3_PTE_SOFTWARE, *PMMPML3_PTE_SOFTWARE;
|
typedef struct _MMPML3_PTE_SOFTWARE MMPML3_PTE_SOFTWARE, *PMMPML3_PTE_SOFTWARE;
|
||||||
typedef struct _MMPML3_PTE_SUBSECTION MMPML3_PTE_SUBSECTION, *PMMPML3_PTE_SUBSECTION;
|
typedef struct _MMPML3_PTE_SUBSECTION MMPML3_PTE_SUBSECTION, *PMMPML3_PTE_SUBSECTION;
|
||||||
typedef struct _MMPML3_PTE_TRANSITION MMPML3_PTE_TRANSITION, *PMMPML3_PTE_TRANSITION;
|
typedef struct _MMPML3_PTE_TRANSITION MMPML3_PTE_TRANSITION, *PMMPML3_PTE_TRANSITION;
|
||||||
|
typedef struct _MMWSL MMWSL, *PMMWSL;
|
||||||
|
typedef struct _MMWSLE_FREE_ENTRY MMWSLE_FREE_ENTRY, *PMMWSLE_FREE_ENTRY;
|
||||||
|
typedef struct _MMWSLENTRY MMWSLENTRY, *PMMWSLENTRY;
|
||||||
typedef struct _POOL_DESCRIPTOR POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR;
|
typedef struct _POOL_DESCRIPTOR POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR;
|
||||||
typedef struct _THREAD_ENVIRONMENT_BLOCK THREAD_ENVIRONMENT_BLOCK, *PTHREAD_ENVIRONMENT_BLOCK;
|
typedef struct _THREAD_ENVIRONMENT_BLOCK THREAD_ENVIRONMENT_BLOCK, *PTHREAD_ENVIRONMENT_BLOCK;
|
||||||
typedef struct _TIMER_CAPABILITIES TIMER_CAPABILITIES, *PTIMER_CAPABILITIES;
|
typedef struct _TIMER_CAPABILITIES TIMER_CAPABILITIES, *PTIMER_CAPABILITIES;
|
||||||
@@ -97,6 +100,7 @@ typedef union _MMPML3_PTE MMPML3_PTE, *PMMPML3_PTE;
|
|||||||
typedef union _MMPTE MMPDE, *PMMPDE;
|
typedef union _MMPTE MMPDE, *PMMPDE;
|
||||||
typedef union _MMPTE MMPPE, *PMMPPE;
|
typedef union _MMPTE MMPPE, *PMMPPE;
|
||||||
typedef union _MMPTE MMPTE, *PMMPTE;
|
typedef union _MMPTE MMPTE, *PMMPTE;
|
||||||
|
typedef union _MMWSLE MMWSLE, *PMMWSLE;
|
||||||
typedef union _PIC_I8259_ICW1 PIC_I8259_ICW1, *PPIC_I8259_ICW1;
|
typedef union _PIC_I8259_ICW1 PIC_I8259_ICW1, *PPIC_I8259_ICW1;
|
||||||
typedef union _PIC_I8259_ICW2 PIC_I8259_ICW2, *PPIC_I8259_ICW2;
|
typedef union _PIC_I8259_ICW2 PIC_I8259_ICW2, *PPIC_I8259_ICW2;
|
||||||
typedef union _PIC_I8259_ICW3 PIC_I8259_ICW3, *PPIC_I8259_ICW3;
|
typedef union _PIC_I8259_ICW3 PIC_I8259_ICW3, *PPIC_I8259_ICW3;
|
||||||
|
|||||||
@@ -74,5 +74,18 @@ typedef struct _LDR_DATA_TABLE_ENTRY
|
|||||||
PVOID PatchInformation;
|
PVOID PatchInformation;
|
||||||
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
|
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
|
||||||
|
|
||||||
|
typedef struct _LDR_PEB_DATA
|
||||||
|
{
|
||||||
|
ULONG Length;
|
||||||
|
BOOLEAN Initialized;
|
||||||
|
PVOID SsHandle;
|
||||||
|
LIST_ENTRY InLoadOrderModuleList;
|
||||||
|
LIST_ENTRY InMemoryOrderModuleList;
|
||||||
|
LIST_ENTRY InInitializationOrderModuleList;
|
||||||
|
PVOID EntryInProgress;
|
||||||
|
UCHAR ShutdownInProgress;
|
||||||
|
PVOID ShutdownThreadId;
|
||||||
|
} LDR_PEB_DATA, *PLDR_PEB_DATA;
|
||||||
|
|
||||||
#endif /* __XTOS_ASSEMBLER__ */
|
#endif /* __XTOS_ASSEMBLER__ */
|
||||||
#endif /* __XTDK_LDRTYPES_H */
|
#endif /* __XTDK_LDRTYPES_H */
|
||||||
|
|||||||
@@ -11,6 +11,7 @@
|
|||||||
#define __XTDK_MMTYPES_H
|
#define __XTDK_MMTYPES_H
|
||||||
|
|
||||||
#include <xtbase.h>
|
#include <xtbase.h>
|
||||||
|
#include <ketypes.h>
|
||||||
#include ARCH_HEADER(xtstruct.h)
|
#include ARCH_HEADER(xtstruct.h)
|
||||||
|
|
||||||
|
|
||||||
@@ -282,5 +283,52 @@ typedef struct _POOL_TRACKING_TABLE
|
|||||||
ULONG Tag;
|
ULONG Tag;
|
||||||
} POOL_TRACKING_TABLE, *PPOOL_TRACKING_TABLE;
|
} POOL_TRACKING_TABLE, *PPOOL_TRACKING_TABLE;
|
||||||
|
|
||||||
|
/* Memory manager support flags structure definition */
|
||||||
|
typedef struct _MMSUPPORT_FLAGS
|
||||||
|
{
|
||||||
|
ULONG SessionSpace:1;
|
||||||
|
ULONG BeingTrimmed:1;
|
||||||
|
ULONG SessionLeader:1;
|
||||||
|
ULONG TrimHard:1;
|
||||||
|
ULONG MaximumWorkingSetHard:1;
|
||||||
|
ULONG ForceTrim:1;
|
||||||
|
ULONG MinimumWorkingSetHard:1;
|
||||||
|
ULONG Available0:1;
|
||||||
|
ULONG MemoryPriority:8;
|
||||||
|
ULONG GrowWsleHash:1;
|
||||||
|
ULONG AcquiredUnsafe:1;
|
||||||
|
ULONG Available:14;
|
||||||
|
} MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;
|
||||||
|
|
||||||
|
/* Memory manager support structure definition */
|
||||||
|
typedef struct _MMSUPPORT
|
||||||
|
{
|
||||||
|
LIST_ENTRY WorkingSetExpansionLinks;
|
||||||
|
USHORT LastTrimpStamp;
|
||||||
|
USHORT NextPageColor;
|
||||||
|
MMSUPPORT_FLAGS Flags;
|
||||||
|
ULONG PageFaultCount;
|
||||||
|
ULONG PeakWorkingSetSize;
|
||||||
|
ULONG GrowthSinceLastEstimate;
|
||||||
|
ULONG MinimumWorkingSetSize;
|
||||||
|
ULONG MaximumWorkingSetSize;
|
||||||
|
PMMWSL VmWorkingSetList;
|
||||||
|
ULONG Claim;
|
||||||
|
ULONG NextEstimationSlot;
|
||||||
|
ULONG NextAgingSlot;
|
||||||
|
ULONG EstimatedAvailable;
|
||||||
|
ULONG WorkingSetSize;
|
||||||
|
PKEVENT ExitEvent;
|
||||||
|
KPUSH_LOCK WorkingSetMutex;
|
||||||
|
PVOID AccessLog;
|
||||||
|
} MMSUPPORT, *PMMSUPPORT;
|
||||||
|
|
||||||
|
/* Working Set List Entry Hash structure definition */
|
||||||
|
typedef struct _MMWSLE_HASH
|
||||||
|
{
|
||||||
|
PVOID Key;
|
||||||
|
ULONG Index;
|
||||||
|
} MMWSLE_HASH, *PMMWSLE_HASH;
|
||||||
|
|
||||||
#endif /* __XTOS_ASSEMBLER__ */
|
#endif /* __XTOS_ASSEMBLER__ */
|
||||||
#endif /* __XTDK_MMTYPES_H */
|
#endif /* __XTDK_MMTYPES_H */
|
||||||
|
|||||||
@@ -12,6 +12,8 @@
|
|||||||
#include <xttypes.h>
|
#include <xttypes.h>
|
||||||
#include <xtstruct.h>
|
#include <xtstruct.h>
|
||||||
#include <extypes.h>
|
#include <extypes.h>
|
||||||
|
#include <mmtypes.h>
|
||||||
|
#include <setypes.h>
|
||||||
|
|
||||||
|
|
||||||
/* Quota bypass marker */
|
/* Quota bypass marker */
|
||||||
@@ -74,11 +76,62 @@ typedef struct _EPROCESS
|
|||||||
LARGE_INTEGER ExitTime;
|
LARGE_INTEGER ExitTime;
|
||||||
EX_RUNDOWN_REFERENCE RundownProtect;
|
EX_RUNDOWN_REFERENCE RundownProtect;
|
||||||
HANDLE UniqueProcessId;
|
HANDLE UniqueProcessId;
|
||||||
|
LIST_ENTRY ActiveProcessLinks;
|
||||||
SIZE_T QuotaUsage[PsQuotaTypes];
|
SIZE_T QuotaUsage[PsQuotaTypes];
|
||||||
SIZE_T QuotaPeak[PsQuotaTypes];
|
SIZE_T QuotaPeak[PsQuotaTypes];
|
||||||
|
PVOID DebugPort;
|
||||||
|
PVOID ExceptionPort;
|
||||||
PHANDLE_TABLE ObjectTable;
|
PHANDLE_TABLE ObjectTable;
|
||||||
|
PVOID Job;
|
||||||
|
PVOID SectionObject;
|
||||||
|
PVOID SectionBaseAddress;
|
||||||
PEPROCESS_QUOTA_BLOCK QuotaBlock;
|
PEPROCESS_QUOTA_BLOCK QuotaBlock;
|
||||||
|
HANDLE InheritedFromUniqueProcessId;
|
||||||
|
CHAR ImageFileName[16];
|
||||||
|
LIST_ENTRY ThreadListHead;
|
||||||
ACCESS_MASK GrantedAccess;
|
ACCESS_MASK GrantedAccess;
|
||||||
|
ULONG DefaultHardErrorProcessing;
|
||||||
|
PPEB ProcessEnvironmentBlock;
|
||||||
|
SECURITY_AUDIT_PROCESS_CREATION_INFO AuditProcessCreationInfo;
|
||||||
|
MMSUPPORT Vm;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG CreateReported:1;
|
||||||
|
ULONG NoDebugInherit:1;
|
||||||
|
ULONG ProcessExiting:1;
|
||||||
|
ULONG ProcessDelete:1;
|
||||||
|
ULONG Reserved1:1;
|
||||||
|
ULONG VmDeleted:1;
|
||||||
|
ULONG OutswapEnabled:1;
|
||||||
|
ULONG Outswapped:1;
|
||||||
|
ULONG ForkFailed:1;
|
||||||
|
ULONG Reserved2:1;
|
||||||
|
ULONG AddressSpaceInitialized:2;
|
||||||
|
ULONG SetTimerResolution:1;
|
||||||
|
ULONG BreakOnTermination:1;
|
||||||
|
ULONG DeprioritizeViews:1;
|
||||||
|
ULONG WriteWatch:1;
|
||||||
|
ULONG ProcessInSession:1;
|
||||||
|
ULONG OverrideAddressSpace:1;
|
||||||
|
ULONG HasAddressSpace:1;
|
||||||
|
ULONG LaunchPrefetched:1;
|
||||||
|
ULONG InjectInpageErrors:1;
|
||||||
|
ULONG VmTopDown:1;
|
||||||
|
ULONG ImageNotifyDone:1;
|
||||||
|
ULONG PdeUpdateNeeded:1;
|
||||||
|
ULONG Reserved3:1;
|
||||||
|
ULONG SmapAllowed:1;
|
||||||
|
ULONG ProcessInserted:1;
|
||||||
|
ULONG DefaultIoPriority:3;
|
||||||
|
ULONG Reserved4:1;
|
||||||
|
ULONG Reserved5:1;
|
||||||
|
};
|
||||||
|
ULONG Flags;
|
||||||
|
};
|
||||||
|
XTSTATUS ExitStatus;
|
||||||
|
UCHAR PriorityClass;
|
||||||
} EPROCESS, *PEPROCESS;
|
} EPROCESS, *PEPROCESS;
|
||||||
|
|
||||||
/* Kernel's representation of a process quota entry*/
|
/* Kernel's representation of a process quota entry*/
|
||||||
@@ -106,5 +159,90 @@ typedef struct _ETHREAD
|
|||||||
ACCESS_MASK GrantedAccess;
|
ACCESS_MASK GrantedAccess;
|
||||||
} ETHREAD, *PETHREAD;
|
} ETHREAD, *PETHREAD;
|
||||||
|
|
||||||
|
/* Kernel's representation of a process environment block */
|
||||||
|
typedef struct _PEB
|
||||||
|
{
|
||||||
|
BOOLEAN InheritedAddressSpace;
|
||||||
|
BOOLEAN ReadImageFileExecOptions;
|
||||||
|
BOOLEAN BeingDebugged;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
BOOLEAN BitField;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
BOOLEAN ImageUsesLargePages:1;
|
||||||
|
BOOLEAN IsProtectedProcess:1;
|
||||||
|
BOOLEAN IsLegacyProcess:1;
|
||||||
|
BOOLEAN IsImageDynamicallyRelocated:1;
|
||||||
|
BOOLEAN SkipPatchingUser32Forwarders:1;
|
||||||
|
BOOLEAN SpareBits:3;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
HANDLE Mutant;
|
||||||
|
PVOID ImageBaseAddress;
|
||||||
|
PLDR_PEB_DATA Ldr;
|
||||||
|
PVOID SubSystemData;
|
||||||
|
PVOID ProcessHeap;
|
||||||
|
PVOID AltThunkSListPtr;
|
||||||
|
PVOID SparePtr2;
|
||||||
|
ULONG EnvironmentUpdateCount;
|
||||||
|
PVOID KernelCallbackTable;
|
||||||
|
ULONG SystemReserved[1];
|
||||||
|
ULONG SpareUlong;
|
||||||
|
PPEB_FREE_BLOCK FreeList;
|
||||||
|
ULONG TlsExpansionCounter;
|
||||||
|
PVOID TlsBitmap;
|
||||||
|
ULONG TlsBitmapBits[2];
|
||||||
|
PVOID ReadOnlySharedMemoryBase;
|
||||||
|
PVOID HotpatchInformation;
|
||||||
|
PVOID* ReadOnlyStaticServerData;
|
||||||
|
PVOID AnsiCodePageData;
|
||||||
|
PVOID OemCodePageData;
|
||||||
|
PVOID UnicodeCaseTableData;
|
||||||
|
ULONG NumberOfProcessors;
|
||||||
|
ULONG NtGlobalFlag;
|
||||||
|
LARGE_INTEGER CriticalSectionTimeout;
|
||||||
|
ULONG_PTR HeapSegmentReserve;
|
||||||
|
ULONG_PTR HeapSegmentCommit;
|
||||||
|
ULONG_PTR HeapDeCommitTotalFreeThreshold;
|
||||||
|
ULONG_PTR HeapDeCommitFreeBlockThreshold;
|
||||||
|
ULONG NumberOfHeaps;
|
||||||
|
ULONG MaximumNumberOfHeaps;
|
||||||
|
PVOID* ProcessHeaps;
|
||||||
|
PVOID GdiSharedHandleTable;
|
||||||
|
PVOID ProcessStarterHelper;
|
||||||
|
ULONG GdiDCAttributeList;
|
||||||
|
ULONG OSMajorVersion;
|
||||||
|
ULONG OSMinorVersion;
|
||||||
|
USHORT OSBuildNumber;
|
||||||
|
USHORT OSCSDVersion;
|
||||||
|
ULONG OSPlatformId;
|
||||||
|
ULONG ImageSubsystem;
|
||||||
|
ULONG ImageSubsystemMajorVersion;
|
||||||
|
ULONG ImageSubsystemMinorVersion;
|
||||||
|
ULONG_PTR ImageProcessAffinityMask;
|
||||||
|
PVOID TlsExpansionBitmap;
|
||||||
|
ULONG TlsExpansionBitmapBits[32];
|
||||||
|
ULONG SessionId;
|
||||||
|
ULARGE_INTEGER AppCompatFlags;
|
||||||
|
ULARGE_INTEGER AppCompatFlagsUser;
|
||||||
|
PVOID pShimData;
|
||||||
|
PVOID AppCompatInfo;
|
||||||
|
UNICODE_STRING CSDVersion;
|
||||||
|
ULONG_PTR MinimumStackCommit;
|
||||||
|
PVOID* FlsCallback;
|
||||||
|
LIST_ENTRY FlsListHead;
|
||||||
|
PVOID FlsBitmap;
|
||||||
|
ULONG FlsBitmapBits[4];
|
||||||
|
ULONG FlsHighIndex;
|
||||||
|
} PEB, *PPEB;
|
||||||
|
|
||||||
|
/* Process Environment Block Free Block structure definition */
|
||||||
|
typedef struct _PEB_FREE_BLOCK
|
||||||
|
{
|
||||||
|
PPEB_FREE_BLOCK Next;
|
||||||
|
ULONG Size;
|
||||||
|
} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
|
||||||
|
|
||||||
#endif /* __XTOS_ASSEMBLER__ */
|
#endif /* __XTOS_ASSEMBLER__ */
|
||||||
#endif /* __XTDK_PSTYPES_H */
|
#endif /* __XTDK_PSTYPES_H */
|
||||||
|
|||||||
@@ -169,6 +169,12 @@ typedef struct _PRIVILEGE_SET
|
|||||||
LUID_AND_ATTRIBUTES Privilege[1];
|
LUID_AND_ATTRIBUTES Privilege[1];
|
||||||
} PRIVILEGE_SET, *PPRIVILEGE_SET;
|
} PRIVILEGE_SET, *PPRIVILEGE_SET;
|
||||||
|
|
||||||
|
/* Security audit process creation information structure definition */
|
||||||
|
typedef struct _SECURITY_AUDIT_PROCESS_CREATION_INFO
|
||||||
|
{
|
||||||
|
POBJECT_NAME_INFORMATION ImageFileName;
|
||||||
|
} SECURITY_AUDIT_PROCESS_CREATION_INFO, *PSECURITY_AUDIT_PROCESS_CREATION_INFO;
|
||||||
|
|
||||||
/* Identifier authority structure definition */
|
/* Identifier authority structure definition */
|
||||||
typedef struct _SID_IDENTIFIER_AUTHORITY
|
typedef struct _SID_IDENTIFIER_AUTHORITY
|
||||||
{
|
{
|
||||||
|
|||||||
@@ -347,6 +347,7 @@ typedef struct _KUBSAN_TYPE_MISMATCH_DATA KUBSAN_TYPE_MISMATCH_DATA, *PKUBSAN_TY
|
|||||||
typedef struct _KUBSAN_TYPE_MISMATCH_DATA_V1 KUBSAN_TYPE_MISMATCH_DATA_V1, *PKUBSAN_TYPE_MISMATCH_DATA_V1;
|
typedef struct _KUBSAN_TYPE_MISMATCH_DATA_V1 KUBSAN_TYPE_MISMATCH_DATA_V1, *PKUBSAN_TYPE_MISMATCH_DATA_V1;
|
||||||
typedef struct _KWAIT_BLOCK KWAIT_BLOCK, *PKWAIT_BLOCK;
|
typedef struct _KWAIT_BLOCK KWAIT_BLOCK, *PKWAIT_BLOCK;
|
||||||
typedef struct _LDR_DATA_TABLE_ENTRY LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
|
typedef struct _LDR_DATA_TABLE_ENTRY LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
|
||||||
|
typedef struct _LDR_PEB_DATA LDR_PEB_DATA, *PLDR_PEB_DATA;
|
||||||
typedef struct _LIST_ENTRY LIST_ENTRY, *PLIST_ENTRY;
|
typedef struct _LIST_ENTRY LIST_ENTRY, *PLIST_ENTRY;
|
||||||
typedef struct _LIST_ENTRY32 LIST_ENTRY32, *PLIST_ENTRY32;
|
typedef struct _LIST_ENTRY32 LIST_ENTRY32, *PLIST_ENTRY32;
|
||||||
typedef struct _LIST_ENTRY64 LIST_ENTRY64, *PLIST_ENTRY64;
|
typedef struct _LIST_ENTRY64 LIST_ENTRY64, *PLIST_ENTRY64;
|
||||||
@@ -368,6 +369,9 @@ typedef struct _MMFREE_POOL_ENTRY MMFREE_POOL_ENTRY, *PMMFREE_POOL_ENTRY;
|
|||||||
typedef struct _MMMEMORY_LAYOUT MMMEMORY_LAYOUT, *PMMMEMORY_LAYOUT;
|
typedef struct _MMMEMORY_LAYOUT MMMEMORY_LAYOUT, *PMMMEMORY_LAYOUT;
|
||||||
typedef struct _MMPFNENTRY MMPFNENTRY, *PMMPFNENTRY;
|
typedef struct _MMPFNENTRY MMPFNENTRY, *PMMPFNENTRY;
|
||||||
typedef struct _MMPFNLIST MMPFNLIST, *PMMPFNLIST;
|
typedef struct _MMPFNLIST MMPFNLIST, *PMMPFNLIST;
|
||||||
|
typedef struct _MMSUPPORT MMSUPPORT, *PMMSUPPORT;
|
||||||
|
typedef struct _MMSUPPORT_FLAGS MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;
|
||||||
|
typedef struct _MMWSLE_HASH MMWSLE_HASH, *PMMWSLE_HASH;
|
||||||
typedef struct _NAMED_PIPE_CREATE_PARAMETERS NAMED_PIPE_CREATE_PARAMETERS, *PNAMED_PIPE_CREATE_PARAMETERS;
|
typedef struct _NAMED_PIPE_CREATE_PARAMETERS NAMED_PIPE_CREATE_PARAMETERS, *PNAMED_PIPE_CREATE_PARAMETERS;
|
||||||
typedef struct _NLSTABLE_INFO NLSTABLE_INFO, *PNLSTABLE_INFO;
|
typedef struct _NLSTABLE_INFO NLSTABLE_INFO, *PNLSTABLE_INFO;
|
||||||
typedef struct _NONPAGED_LOOKASIDE_LIST NONPAGED_LOOKASIDE_LIST, *PNONPAGED_LOOKASIDE_LIST;
|
typedef struct _NONPAGED_LOOKASIDE_LIST NONPAGED_LOOKASIDE_LIST, *PNONPAGED_LOOKASIDE_LIST;
|
||||||
@@ -404,6 +408,8 @@ typedef struct _PCI_DEVICE_HEADER_TYPE_REGION PCI_DEVICE_HEADER_TYPE_REGION, *PP
|
|||||||
typedef struct _PCI_DEVICE_INDEPENDENT_REGION PCI_DEVICE_INDEPENDENT_REGION, *PPCI_DEVICE_INDEPENDENT_REGION;
|
typedef struct _PCI_DEVICE_INDEPENDENT_REGION PCI_DEVICE_INDEPENDENT_REGION, *PPCI_DEVICE_INDEPENDENT_REGION;
|
||||||
typedef struct _PCI_TYPE0_DEVICE PCI_TYPE0_DEVICE, *PPCI_TYPE0_DEVICE;
|
typedef struct _PCI_TYPE0_DEVICE PCI_TYPE0_DEVICE, *PPCI_TYPE0_DEVICE;
|
||||||
typedef struct _PCI_TYPE1_DEVICE PCI_TYPE1_DEVICE, *PPCI_TYPE1_DEVICE;
|
typedef struct _PCI_TYPE1_DEVICE PCI_TYPE1_DEVICE, *PPCI_TYPE1_DEVICE;
|
||||||
|
typedef struct _PEB PEB, *PPEB;
|
||||||
|
typedef struct _PEB_FREE_BLOCK PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
|
||||||
typedef struct _PECOFF_IMAGE_BASE_RELOCATION PECOFF_IMAGE_BASE_RELOCATION, *PPECOFF_IMAGE_BASE_RELOCATION;
|
typedef struct _PECOFF_IMAGE_BASE_RELOCATION PECOFF_IMAGE_BASE_RELOCATION, *PPECOFF_IMAGE_BASE_RELOCATION;
|
||||||
typedef struct _PECOFF_IMAGE_DATA PECOFF_IMAGE_DATA, *PPECOFF_IMAGE_DATA;
|
typedef struct _PECOFF_IMAGE_DATA PECOFF_IMAGE_DATA, *PPECOFF_IMAGE_DATA;
|
||||||
typedef struct _PECOFF_IMAGE_DATA_DIRECTORY PECOFF_IMAGE_DATA_DIRECTORY, *PPECOFF_IMAGE_DATA_DIRECTORY;
|
typedef struct _PECOFF_IMAGE_DATA_DIRECTORY PECOFF_IMAGE_DATA_DIRECTORY, *PPECOFF_IMAGE_DATA_DIRECTORY;
|
||||||
@@ -441,6 +447,7 @@ typedef struct _RTL_PRINT_FORMAT_PROPERTIES RTL_PRINT_FORMAT_PROPERTIES, *PRTL_P
|
|||||||
typedef struct _RTL_RB_TREE RTL_RB_TREE, *PRTL_RB_TREE;
|
typedef struct _RTL_RB_TREE RTL_RB_TREE, *PRTL_RB_TREE;
|
||||||
typedef struct _SCSI_REQUEST_BLOCK SCSI_REQUEST_BLOCK, *PSCSI_REQUEST_BLOCK;
|
typedef struct _SCSI_REQUEST_BLOCK SCSI_REQUEST_BLOCK, *PSCSI_REQUEST_BLOCK;
|
||||||
typedef struct _SECTION_OBJECT_POINTERS SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS;
|
typedef struct _SECTION_OBJECT_POINTERS SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS;
|
||||||
|
typedef struct _SECURITY_AUDIT_PROCESS_CREATION_INFO SECURITY_AUDIT_PROCESS_CREATION_INFO, *PSECURITY_AUDIT_PROCESS_CREATION_INFO;
|
||||||
typedef struct _SECURITY_CLIENT_CONTEXT SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
|
typedef struct _SECURITY_CLIENT_CONTEXT SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
|
||||||
typedef struct _SECURITY_QUALITY_OF_SERVICE SECURITY_QUALITY_OF_SERVICE, *PSECURITY_QUALITY_OF_SERVICE;
|
typedef struct _SECURITY_QUALITY_OF_SERVICE SECURITY_QUALITY_OF_SERVICE, *PSECURITY_QUALITY_OF_SERVICE;
|
||||||
typedef struct _SECURITY_SUBJECT_CONTEXT SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;
|
typedef struct _SECURITY_SUBJECT_CONTEXT SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;
|
||||||
|
|||||||
Reference in New Issue
Block a user