Princeec13/mql5
Watch
0
0
Fork
You've already forked mql5
 1
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
mql5/Include/WinAPI/winnt.mqh

3642 lines
92 KiB
MQL5
RawPermalinkNormal ViewHistory

new files added
2025-08-05 01:57:33 -04:00
//+------------------------------------------------------------------+
//| winnt.mqh |
//| Copyright 2000-2025, MetaQuotes Ltd. |
//| https://www.mql5.com |
//+------------------------------------------------------------------+
#include <WinAPI\windef.mqh>
//---
#define UNWIND_HISTORY_TABLE_SIZE 12
#define SIZE_OF_80387_REGISTERS 80
#define MAXIMUM_SUPPORTED_EXTENSION 512
#define WOW64_SIZE_OF_80387_REGISTERS 80
#define WOW64_MAXIMUM_SUPPORTED_EXTENSION 512
#define SID_HASH_SIZE 32
#define POLICY_AUDIT_SUBCATEGORY_COUNT 59
#define TOKEN_SOURCE_LENGTH 8
#define MAXIMUM_XSTATE_FEATURES 64
#define POWER_SYSTEM_MAXIMUM 7
#define NUM_DISCHARGE_POLICIES 4
#define HIBERFILE_TYPE_MAX 0x03
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
#define IMAGE_SIZEOF_SHORT_NAME 8
#define IMAGE_ENCLAVE_LONG_ID_LENGTH 32
#define IMAGE_ENCLAVE_SHORT_ID_LENGTH 16
#define RTL_CORRELATION_VECTOR_STRING_LENGTH 129
//---
enum SID_NAME_USE
{
SidTypeUser=1,
SidTypeGroup,
SidTypeDomain,
SidTypeAlias,
SidTypeWellKnownGroup,
SidTypeDeletedAccount,
SidTypeInvalid,
SidTypeUnknown,
SidTypeComputer,
SidTypeLabel,
SidTypeLogonSession
};
//---
enum ACL_INFORMATION_CLASS
{
AclRevisionInformation=1,
AclSizeInformation
};
//---
enum AUDIT_EVENT_TYPE
{
AuditEventObjectAccess,
AuditEventDirectoryServiceAccess
};
//---
enum ACCESS_REASON_TYPE
{
AccessReasonNone=0x00000000,
AccessReasonAllowedAce=0x00010000,
AccessReasonDeniedAce=0x00020000,
AccessReasonAllowedParentAce=0x00030000,
AccessReasonDeniedParentAce=0x00040000,
AccessReasonNotGrantedByCape=0x00050000,
AccessReasonNotGrantedByParentCape=0x00060000,
AccessReasonNotGrantedToAppContainer=0x00070000,
AccessReasonMissingPrivilege=0x00100000,
AccessReasonFromPrivilege=0x00200000,
AccessReasonIntegrityLevel=0x00300000,
AccessReasonOwnership=0x00400000,
AccessReasonNullDacl=0x00500000,
AccessReasonEmptyDacl=0x00600000,
AccessReasonNoSD=0x00700000,
AccessReasonNoGrant=0x00800000,
AccessReasonTrustLabel=0x00900000,
AccessReasonFilterAce=0x00a00000
};
//---
enum SECURITY_IMPERSONATION_LEVEL
{
SecurityAnonymous,
SecurityIdentification,
SecurityImpersonation,
SecurityDelegation
};
//---
enum TOKEN_TYPE
{
TokenPrimary=1,
TokenImpersonation
};
//---
enum TOKEN_ELEVATION_TYPE
{
TokenElevationTypeDefault=1,
TokenElevationTypeFull,
TokenElevationTypeLimited
};
//---
enum TOKEN_INFORMATION_CLASS
{
TokenUser=1,
TokenGroups,
TokenPrivileges,
TokenOwner,
TokenPrimaryGroup,
TokenDefaultDacl,
TokenSource,
TokenType,
TokenImpersonationLevel,
TokenStatistics,
TokenRestrictedSids,
TokenSessionId,
TokenGroupsAndPrivileges,
TokenSessionReference,
TokenSandBoxInert,
TokenAuditPolicy,
TokenOrigin,
TokenElevationType,
TokenLinkedToken,
TokenElevation,
TokenHasRestrictions,
TokenAccessInformation,
TokenVirtualizationAllowed,
TokenVirtualizationEnabled,
TokenIntegrityLevel,
TokenUIAccess,
TokenMandatoryPolicy,
TokenLogonSid,
TokenIsAppContainer,
TokenCapabilities,
TokenAppContainerSid,
TokenAppContainerNumber,
TokenUserClaimAttributes,
TokenDeviceClaimAttributes,
TokenRestrictedUserClaimAttributes,
TokenRestrictedDeviceClaimAttributes,
TokenDeviceGroups,
TokenRestrictedDeviceGroups,
TokenSecurityAttributes,
TokenIsRestricted,
TokenProcessTrustLevel,
TokenPrivateNameSpace,
TokenSingletonAttributes,
TokenBnoIsolation,
TokenChildProcessFlags,
MaxTokenInfoClass
};
//---
enum MANDATORY_LEVEL
{
MandatoryLevelUntrusted=0,
MandatoryLevelLow,
MandatoryLevelMedium,
MandatoryLevelHigh,
MandatoryLevelSystem,
MandatoryLevelSecureProcess,
MandatoryLevelCount
};
//---
enum SE_IMAGE_SIGNATURE_TYPE
{
SeImageSignatureNone=0,
SeImageSignatureEmbedded,
SeImageSignatureCache,
SeImageSignatureCatalogCached,
SeImageSignatureCatalogNotCached,
SeImageSignatureCatalogHint,
SeImageSignaturePackageCatalog
};
//---
enum SE_LEARNING_MODE_DATA_TYPE
{
SeLearningModeInvalidType=0,
SeLearningModeSettings,
SeLearningModeMax
};
//---
enum HARDWARE_COUNTER_TYPE
{
PMCCounter,
MaxHardwareCounterType
};
//---
enum PROCESS_MITIGATION_POLICY
{
ProcessDEPPolicy,
ProcessASLRPolicy,
ProcessDynamicCodePolicy,
ProcessStrictHandleCheckPolicy,
ProcessSystemCallDisablePolicy,
ProcessMitigationOptionsMask,
ProcessExtensionPointDisablePolicy,
ProcessControlFlowGuardPolicy,
ProcessSignaturePolicy,
ProcessFontDisablePolicy,
ProcessImageLoadPolicy,
ProcessSystemCallFilterPolicy,
ProcessPayloadRestrictionPolicy,
ProcessChildProcessPolicy,
MaxProcessMitigationPolicy
};
//---
enum JOBOBJECT_RATE_CONTROL_TOLERANCE
{
ToleranceLow=1,
ToleranceMedium,
ToleranceHigh
};
//---
enum JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL
{
ToleranceIntervalShort=1,
ToleranceIntervalMedium,
ToleranceIntervalLong
};
//---
enum JOB_OBJECT_NET_RATE_CONTROL_FLAGS
{
JOB_OBJECT_NET_RATE_CONTROL_ENABLE=0x1,
JOB_OBJECT_NET_RATE_CONTROL_MAX_BANDWIDTH=0x2,
JOB_OBJECT_NET_RATE_CONTROL_DSCP_TAG=0x4,
JOB_OBJECT_NET_RATE_CONTROL_VALID_FLAGS=0x7
};
//---
enum JOB_OBJECT_IO_RATE_CONTROL_FLAGS
{
JOB_OBJECT_IO_RATE_CONTROL_ENABLE=0x1,
JOB_OBJECT_IO_RATE_CONTROL_STANDALONE_VOLUME=0x2,
JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ALL=0x4,
JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ON_SOFT_CAP=0x8,
JOB_OBJECT_IO_RATE_CONTROL_VALID_FLAGS=JOB_OBJECT_IO_RATE_CONTROL_ENABLE|
JOB_OBJECT_IO_RATE_CONTROL_STANDALONE_VOLUME|
JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ALL|
JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ON_SOFT_CAP
};
//---
enum JOBOBJECT_IO_ATTRIBUTION_CONTROL_FLAGS
{
JOBOBJECT_IO_ATTRIBUTION_CONTROL_ENABLE=0x1,
JOBOBJECT_IO_ATTRIBUTION_CONTROL_DISABLE=0x2,
JOBOBJECT_IO_ATTRIBUTION_CONTROL_VALID_FLAGS=0x3
};
//---
enum JOBOBJECTINFOCLASS
{
JobObjectBasicAccountingInformation=1,
JobObjectBasicLimitInformation,
JobObjectBasicProcessIdList,
JobObjectBasicUIRestrictions,
JobObjectSecurityLimitInformation,
JobObjectEndOfJobTimeInformation,
JobObjectAssociateCompletionPortInformation,
JobObjectBasicAndIoAccountingInformation,
JobObjectExtendedLimitInformation,
JobObjectJobSetInformation,
JobObjectGroupInformation,
JobObjectNotificationLimitInformation,
JobObjectLimitViolationInformation,
JobObjectGroupInformationEx,
JobObjectCpuRateControlInformation,
JobObjectCompletionFilter,
JobObjectCompletionCounter,
JobObjectReserved1Information=18,
JobObjectReserved2Information,
JobObjectReserved3Information,
JobObjectReserved4Information,
JobObjectReserved5Information,
JobObjectReserved6Information,
JobObjectReserved7Information,
JobObjectReserved8Information,
JobObjectReserved9Information,
JobObjectReserved10Information,
JobObjectReserved11Information,
JobObjectReserved12Information,
JobObjectReserved13Information,
JobObjectReserved14Information=31,
JobObjectNetRateControlInformation,
JobObjectNotificationLimitInformation2,
JobObjectLimitViolationInformation2,
JobObjectCreateSilo,
JobObjectSiloBasicInformation,
JobObjectReserved15Information=37,
JobObjectReserved16Information=38,
JobObjectReserved17Information=39,
JobObjectReserved18Information=40,
JobObjectReserved19Information=41,
JobObjectReserved20Information=42,
JobObjectReserved21Information=43,
JobObjectReserved22Information=44,
JobObjectReserved23Information=45,
JobObjectReserved24Information=46,
JobObjectReserved25Information=47,
MaxJobObjectInfoClass
};
//---
enum SERVERSILO_STATE
{
SERVERSILO_INITING=0,
SERVERSILO_STARTED,
SERVERSILO_SHUTTING_DOWN,
SERVERSILO_TERMINATING,
SERVERSILO_TERMINATED
};
//---
enum FIRMWARE_TYPE
{
FirmwareTypeUnknown,
FirmwareTypeBios,
FirmwareTypeUefi,
FirmwareTypeMax
};
//---
enum LOGICAL_PROCESSOR_RELATIONSHIP
{
RelationProcessorCore,
RelationNumaNode,
RelationCache,
RelationProcessorPackage,
RelationGroup,
RelationAll=0xffff
};
//---
enum PROCESSOR_CACHE_TYPE
{
CacheUnified,
CacheInstruction,
CacheData,
CacheTrace
};
//---
enum CPU_SET_INFORMATION_TYPE
{
CpuSetInformation
};
//---
enum MEM_EXTENDED_PARAMETER_TYPE
{
MemExtendedParameterInvalidType=0,
MemExtendedParameterAddressRequirements,
MemExtendedParameterNumaNode,
MemExtendedParameterPartitionHandle,
MemExtendedParameterMax
};
//---
enum SharedVirtualDiskSupportType
{
SharedVirtualDisksUnsupported=0,
SharedVirtualDisksSupported=1,
SharedVirtualDiskSnapshotsSupported=3,
SharedVirtualDiskCDPSnapshotsSupported=7
};
//---
enum SharedVirtualDiskHandleState
{
SharedVirtualDiskHandleStateNone=0,
SharedVirtualDiskHandleStateFileShared=1,
SharedVirtualDiskHandleStateHandleShared=3
};
//---
enum SYSTEM_POWER_STATE
{
PowerSystemUnspecified=0,
PowerSystemWorking=1,
PowerSystemSleeping1=2,
PowerSystemSleeping2=3,
PowerSystemSleeping3=4,
PowerSystemHibernate=5,
PowerSystemShutdown=6,
PowerSystemMaximum=7
};
//---
enum DEVICE_POWER_STATE
{
PowerDeviceUnspecified=0,
PowerDeviceD0,
PowerDeviceD1,
PowerDeviceD2,
PowerDeviceD3,
PowerDeviceMaximum
};
//---
enum MONITOR_DISPLAY_STATE
{
PowerMonitorOff=0,
PowerMonitorOn,
PowerMonitorDim
};
//---
enum USER_ACTIVITY_PRESENCE
{
PowerUserPresent=0,
PowerUserNotPresent,
PowerUserInactive,
PowerUserMaximum,
PowerUserInvalid=PowerUserMaximum
};
//---
enum POWER_REQUEST_TYPE
{
PowerRequestDisplayRequired,
PowerRequestSystemRequired,
PowerRequestAwayModeRequired,
PowerRequestExecutionRequired
};
//---
enum POWER_MONITOR_REQUEST_TYPE
{
MonitorRequestTypeOff,
MonitorRequestTypeOnAndPresent,
MonitorRequestTypeToggleOn
};
//---
enum POWER_PLATFORM_ROLE
{
PlatformRoleUnspecified=0,
PlatformRoleDesktop,
PlatformRoleMobile,
PlatformRoleWorkstation,
PlatformRoleEnterpriseServer,
PlatformRoleSOHOServer,
PlatformRoleAppliancePC,
PlatformRolePerformanceServer,
PlatformRoleSlate,
PlatformRoleMaximum
};
//---
enum HIBERFILE_BUCKET_SIZE
{
HiberFileBucket1GB=0,
HiberFileBucket2GB,
HiberFileBucket4GB,
HiberFileBucket8GB,
HiberFileBucket16GB,
HiberFileBucket32GB,
HiberFileBucketUnlimited,
HiberFileBucketMax
};
//---
enum IMAGE_AUX_SYMBOL_TYPE
{
IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF=1
};
//---
enum IMPORT_OBJECT_TYPE
{
IMPORT_OBJECT_CODE=0,
IMPORT_OBJECT_DATA=1,
IMPORT_OBJECT_CONST=2
};
//---
enum IMPORT_OBJECT_NAME_TYPE
{
IMPORT_OBJECT_ORDINAL=0,
IMPORT_OBJECT_NAME=1,
IMPORT_OBJECT_NAME_NO_PREFIX=2,
IMPORT_OBJECT_NAME_UNDECORATE=3,
IMPORT_OBJECT_NAME_EXPORTAS=4
};
//---
enum ReplacesCorHdrNumericDefines
{
COMIMAGE_FLAGS_ILONLY=0x00000001,
COMIMAGE_FLAGS_32BITREQUIRED=0x00000002,
COMIMAGE_FLAGS_IL_LIBRARY=0x00000004,
COMIMAGE_FLAGS_STRONGNAMESIGNED=0x00000008,
COMIMAGE_FLAGS_NATIVE_ENTRYPOINT=0x00000010,
COMIMAGE_FLAGS_TRACKDEBUGDATA=0x00010000,
COMIMAGE_FLAGS_32BITPREFERRED=0x00020000,
COR_VERSION_MAJOR_V2=2,
COR_VERSION_MAJOR=COR_VERSION_MAJOR_V2,
COR_VERSION_MINOR=5,
COR_DELETED_NAME_LENGTH=8,
COR_VTABLEGAP_NAME_LENGTH=8,
NATIVE_TYPE_MAX_CB=1,
COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE=0xFF,
IMAGE_COR_MIH_METHODRVA=0x01,
IMAGE_COR_MIH_EHRVA=0x02,
IMAGE_COR_MIH_BASICBLOCK=0x08,
COR_VTABLE_32BIT=0x01,
COR_VTABLE_64BIT=0x02,
COR_VTABLE_FROM_UNMANAGED=0x04,
COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN=0x08,
COR_VTABLE_CALL_MOST_DERIVED=0x10,
IMAGE_COR_EATJ_THUNK_SIZE=32,
MAX_CLASS_NAME=1024,
MAX_PACKAGE_NAME=1024
};
//---
enum RTL_UMS_THREAD_INFO_CLASS
{
UmsThreadInvalidInfoClass=0,
UmsThreadUserContext,
UmsThreadPriority,
UmsThreadAffinity,
UmsThreadTeb,
UmsThreadIsSuspended,
UmsThreadIsTerminated,
UmsThreadMaxInfoClass
};
//---
enum RTL_UMS_SCHEDULER_REASON
{
UmsSchedulerStartup=0,
UmsSchedulerThreadBlocked,
UmsSchedulerThreadYield
};
//---
enum OS_DEPLOYEMENT_STATE_VALUES
{
OS_DEPLOYMENT_STANDARD=1,
OS_DEPLOYMENT_COMPACT
};
//---
enum IMAGE_POLICY_ENTRY_TYPE
{
ImagePolicyEntryTypeNone=0,
ImagePolicyEntryTypeBool,
ImagePolicyEntryTypeInt8,
ImagePolicyEntryTypeUInt8,
ImagePolicyEntryTypeInt16,
ImagePolicyEntryTypeUInt16,
ImagePolicyEntryTypeInt32,
ImagePolicyEntryTypeUInt32,
ImagePolicyEntryTypeInt64,
ImagePolicyEntryTypeUInt64,
ImagePolicyEntryTypeAnsiString,
ImagePolicyEntryTypeUnicodeString,
ImagePolicyEntryTypeOverride,
ImagePolicyEntryTypeMaximum
};
//---
enum IMAGE_POLICY_ID
{
ImagePolicyIdNone=0,
ImagePolicyIdEtw,
ImagePolicyIdDebug,
ImagePolicyIdCrashDump,
ImagePolicyIdCrashDumpKey,
ImagePolicyIdCrashDumpKeyGuid,
ImagePolicyIdParentSd,
ImagePolicyIdParentSdRev,
ImagePolicyIdSvn,
ImagePolicyIdDeviceId,
ImagePolicyIdCapability,
ImagePolicyIdScenarioId,
ImagePolicyIdMaximum
};
//---
enum HEAP_INFORMATION_CLASS
{
HeapCompatibilityInformation=0,
HeapEnableTerminationOnCorruption=1,
HeapOptimizeResources=3
};
//---
enum ACTIVATION_CONTEXT_INFO_CLASS
{
ActivationContextBasicInformation=1,
ActivationContextDetailedInformation=2,
AssemblyDetailedInformationInActivationContext=3,
FileInformationInAssemblyOfAssemblyInActivationContext=4,
RunlevelInformationInActivationContext=5,
CompatibilityInformationInActivationContext=6,
ActivationContextManifestResourceName=7,
MaxActivationContextInfoClass,
AssemblyDetailedInformationInActivationContxt=3,
FileInformationInAssemblyOfAssemblyInActivationContxt=4
};
//---
enum SERVICE_NODE_TYPE
{
DriverType=0x00000001,
FileSystemType=0x00000002,
Win32ServiceOwnProcess=0x00000010,
Win32ServiceShareProcess=0x00000020,
AdapterType=0x00000004,
RecognizerType=0x00000008
};
//---
enum SERVICE_LOAD_TYPE
{
BootLoad=0x00000000,
SystemLoad=0x00000001,
AutoLoad=0x00000002,
DemandLoad=0x00000003,
DisableLoad=0x00000004
};
//---
enum SERVICE_ERROR_TYPE
{
IgnoreError=0x00000000,
NormalError=0x00000001,
SevereError=0x00000002,
CriticalError=0x00000003
};
//---
enum TAPE_DRIVE_PROBLEM_TYPE
{
TapeDriveProblemNone,
TapeDriveReadWriteWarning,
TapeDriveReadWriteError,
TapeDriveReadWarning,
TapeDriveWriteWarning,
TapeDriveReadError,
TapeDriveWriteError,
TapeDriveHardwareError,
TapeDriveUnsupportedMedia,
TapeDriveScsiConnectionError,
TapeDriveTimetoClean,
TapeDriveCleanDriveNow,
TapeDriveMediaLifeExpired,
TapeDriveSnappedTape
};
//---
enum TRANSACTION_OUTCOME
{
TransactionOutcomeUndetermined=1,
TransactionOutcomeCommitted,
TransactionOutcomeAborted
};
//---
enum TRANSACTION_STATE
{
TransactionStateNormal=1,
TransactionStateIndoubt,
TransactionStateCommittedNotify
};
//---
enum TRANSACTION_INFORMATION_CLASS
{
TransactionBasicInformation,
TransactionPropertiesInformation,
TransactionEnlistmentInformation,
TransactionSuperiorEnlistmentInformation,
TransactionBindInformation,
TransactionDTCPrivateInformation
};
//---
enum TRANSACTIONMANAGER_INFORMATION_CLASS
{
TransactionManagerBasicInformation,
TransactionManagerLogInformation,
TransactionManagerLogPathInformation,
TransactionManagerRecoveryInformation=4,
TransactionManagerOnlineProbeInformation=3,
TransactionManagerOldestTransactionInformation=5
};
//---
enum RESOURCEMANAGER_INFORMATION_CLASS
{
ResourceManagerBasicInformation,
ResourceManagerCompletionInformation
};
//---
enum ENLISTMENT_INFORMATION_CLASS
{
EnlistmentBasicInformation,
EnlistmentRecoveryInformation,
EnlistmentCrmInformation
};
//---
enum KTMOBJECT_TYPE
{
KTMOBJECT_TRANSACTION,
KTMOBJECT_TRANSACTION_MANAGER,
KTMOBJECT_RESOURCE_MANAGER,
KTMOBJECT_ENLISTMENT,
KTMOBJECT_INVALID
};
//---
enum TP_CALLBACK_PRIORITY
{
TP_CALLBACK_PRIORITY_HIGH,
TP_CALLBACK_PRIORITY_NORMAL,
TP_CALLBACK_PRIORITY_LOW,
TP_CALLBACK_PRIORITY_INVALID,
TP_CALLBACK_PRIORITY_COUNT=TP_CALLBACK_PRIORITY_INVALID
};
//---
enum POWER_USER_PRESENCE_TYPE
{
UserNotPresent=0,
UserPresent=1,
UserUnknown=0xff
};
//---
enum POWER_MONITOR_REQUEST_REASON
{
MonitorRequestReasonUnknown,
MonitorRequestReasonPowerButton,
MonitorRequestReasonRemoteConnection,
MonitorRequestReasonScMonitorpower,
MonitorRequestReasonUserInput,
MonitorRequestReasonAcDcDisplayBurst,
MonitorRequestReasonUserDisplayBurst,
MonitorRequestReasonPoSetSystemState,
MonitorRequestReasonSetThreadExecutionState,
MonitorRequestReasonFullWake,
MonitorRequestReasonSessionUnlock,
MonitorRequestReasonScreenOffRequest,
MonitorRequestReasonIdleTimeout,
MonitorRequestReasonPolicyChange,
MonitorRequestReasonSleepButton,
MonitorRequestReasonLid,
MonitorRequestReasonBatteryCountChange,
MonitorRequestReasonGracePeriod,
MonitorRequestReasonPnP,
MonitorRequestReasonDP,
MonitorRequestReasonSxTransition,
MonitorRequestReasonSystemIdle,
MonitorRequestReasonNearProximity,
MonitorRequestReasonThermalStandby,
MonitorRequestReasonResumePdc,
MonitorRequestReasonResumeS4,
MonitorRequestReasonTerminal,
MonitorRequestReasonPdcSignal,
MonitorRequestReasonAcDcDisplayBurstSuppressed,
MonitorRequestReasonSystemStateEntered,
MonitorRequestReasonWinrt,
MonitorRequestReasonUserInputKeyboard,
MonitorRequestReasonUserInputMouse,
MonitorRequestReasonUserInputTouch,
MonitorRequestReasonUserInputPen,
MonitorRequestReasonUserInputAccelerometer,
MonitorRequestReasonUserInputHid,
MonitorRequestReasonUserInputPoUserPresent,
MonitorRequestReasonUserInputSessionSwitch,
MonitorRequestReasonUserInputInitialization,
MonitorRequestReasonPdcSignalWindowsMobilePwrNotif,
MonitorRequestReasonPdcSignalWindowsMobileShell,
MonitorRequestReasonPdcSignalHeyCortana,
MonitorRequestReasonPdcSignalHolographicShell,
MonitorRequestReasonPdcSignalFingerprint,
MonitorRequestReasonMax
};
//---
enum POWER_ACTION
{
PowerActionNone=0,
PowerActionReserved,
PowerActionSleep,
PowerActionHibernate,
PowerActionShutdown,
PowerActionShutdownReset,
PowerActionShutdownOff,
PowerActionWarmEject,
PowerActionDisplayOff
};
//---
enum ACTCTX_REQUESTED_RUN_LEVEL
{
ACTCTX_RUN_LEVEL_UNSPECIFIED=0,
ACTCTX_RUN_LEVEL_AS_INVOKER,
ACTCTX_RUN_LEVEL_HIGHEST_AVAILABLE,
ACTCTX_RUN_LEVEL_REQUIRE_ADMIN,
ACTCTX_RUN_LEVEL_NUMBERS
};
//---
enum ACTCTX_COMPATIBILITY_ELEMENT_TYPE
{
ACTCTX_COMPATIBILITY_ELEMENT_TYPE_UNKNOWN=0,
ACTCTX_COMPATIBILITY_ELEMENT_TYPE_OS,
ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MITIGATION
};
//+------------------------------------------------------------------+
//| |
//+------------------------------------------------------------------+
//---
struct PROCESSOR_NUMBER
{
ushort Group;
uchar Number;
uchar Reserved;
};
//---
struct GROUP_AFFINITY
{
ulong Mask;
ushort Group;
ushort Reserved[3];
};
//---
struct FLOAT128
{
long LowPart;
long HighPart;
};
//---
struct LARGE_INTEGER
{
long QuadPart;
};
//---
struct ULARGE_INTEGER
{
ulong QuadPart;
};
//---
struct LUID
{
uint LowPart;
int HighPart;
};
//---
struct LIST_ENTRY
{
PVOID Flink;
PVOID Blink;
};
//---
struct SINGLE_LIST_ENTRY
{
PVOID Next;
};
//---
struct LIST_ENTRY32
{
uint Flink;
uint Blink;
};
//---
struct LIST_ENTRY64
{
ulong Flink;
ulong Blink;
};
//---
struct OBJECTID
{
GUID Lineage;
uint Uniquifier;
};
//---
struct M128A
{
ulong Low;
long High;
};
//---
struct XSAVE_FORMAT
{
ushort Controlushort;
ushort Statusushort;
uchar Tagushort;
uchar Reserved1;
ushort ErrorOpcode;
uint ErrorOffset;
ushort ErrorSelector;
ushort Reserved2;
uint DataOffset;
ushort DataSelector;
ushort Reserved3;
uint MxCsr;
uint MxCsr_Mask;
M128A FloatRegisters[8];
M128A XmmRegisters[16];
uchar Reserved4[96];
};
//---
struct XSAVE_AREA_HEADER
{
ulong Mask;
ulong CompactionMask;
ulong Reserved2[6];
};
//---
struct XSAVE_AREA
{
XSAVE_FORMAT LegacyState;
XSAVE_AREA_HEADER Header;
};
//---
struct XSTATE_CONTEXT
{
ulong Mask;
uint Length;
uint Reserved1;
PVOID Area;
uint Reserved2;
PVOID Buffer;
uint Reserved3;
};
//---
struct SCOPE_TABLE_AMD64
{
uint Count;
uint BeginAddress;
uint EndAddress;
uint HandlerAddress;
uint JumpTarget;
};
//---
struct UNWIND_HISTORY_TABLE_ENTRY
{
ulong ImageBase;
PVOID FunctionEntry;
};
//---
struct UNWIND_HISTORY_TABLE
{
uint Count;
uchar LocalHint;
uchar GlobalHint;
uchar Search;
uchar Once;
ulong LowAddress;
ulong HighAddress;
UNWIND_HISTORY_TABLE_ENTRY Entry[UNWIND_HISTORY_TABLE_SIZE];
};
//---
struct SCOPE_TABLE_ARM64
{
uint Count;
uint BeginAddress;
uint EndAddress;
uint HandlerAddress;
uint JumpTarget;
};
//---
struct NEON128
{
ulong Low;
long High;
};
//---
struct DISPATCHER_CONTEXT
{
uint ControlPc;
uint ImageBase;
PVOID FunctionEntry;
uint EstablisherFrame;
uint TargetPc;
PVOID ContextRecord;
PVOID LanguageHandler;
PVOID HandlerData;
PVOID HistoryTable;
uint ScopeIndex;
uchar ControlPcIsUnwound;
PVOID NonVolatileRegisters;
uint Reserved;
};
//---
struct KNONVOLATILE_CONTEXT_POINTERS
{
PVOID FloatingContext[16];
PVOID IntegerContext[16];
};
//---
struct SCOPE_TABLE_ARM
{
uint Count;
uint BeginAddress;
uint EndAddress;
uint HandlerAddress;
uint JumpTarget;
};
//---
struct DISPATCHER_CONTEXT_ARM64
{
ulong ControlPc;
ulong ImageBase;
PVOID FunctionEntry;
ulong EstablisherFrame;
ulong TargetPc;
PVOID ContextRecord;
PVOID LanguageHandler;
PVOID HandlerData;
PVOID HistoryTable;
uint ScopeIndex;
uchar ControlPcIsUnwound;
PVOID NonVolatileRegisters;
};
//---
struct KNONVOLATILE_CONTEXT_POINTERS_ARM64
{
PVOID X19;
PVOID X20;
PVOID X21;
PVOID X22;
PVOID X23;
PVOID X24;
PVOID X25;
PVOID X26;
PVOID X27;
PVOID X28;
PVOID Fp;
PVOID Lr;
PVOID D8;
PVOID D9;
PVOID D10;
PVOID D11;
PVOID D12;
PVOID D13;
PVOID D14;
PVOID D15;
};
//---
struct FLOATING_SAVE_AREA
{
uint Controlushort;
uint Statusushort;
uint Tagushort;
uint ErrorOffset;
uint ErrorSelector;
uint DataOffset;
uint DataSelector;
uchar RegisterArea[SIZE_OF_80387_REGISTERS];
uint Spare0;
};
//---
struct CONTEXT
{
ulong P1Home;
ulong P2Home;
ulong P3Home;
ulong P4Home;
ulong P5Home;
ulong P6Home;
uint ContextFlags;
uint MxCsr;
ushort SegCs;
ushort SegDs;
ushort SegEs;
ushort SegFs;
ushort SegGs;
ushort SegSs;
uint EFlags;
ulong Dr0;
ulong Dr1;
ulong Dr2;
ulong Dr3;
ulong Dr6;
ulong Dr7;
ulong Rax;
ulong Rcx;
ulong Rdx;
ulong Rbx;
ulong Rsp;
ulong Rbp;
ulong Rsi;
ulong Rdi;
ulong R8;
ulong R9;
ulong R10;
ulong R11;
ulong R12;
ulong R13;
ulong R14;
ulong R15;
ulong Rip;
M128A Header[2];
M128A Legacy[8];
M128A Xmm0;
M128A Xmm1;
M128A Xmm2;
M128A Xmm3;
M128A Xmm4;
M128A Xmm5;
M128A Xmm6;
M128A Xmm7;
M128A Xmm8;
M128A Xmm9;
M128A Xmm10;
M128A Xmm11;
M128A Xmm12;
M128A Xmm13;
M128A Xmm14;
M128A Xmm15;
M128A VectorRegister[26];
ulong VectorControl;
ulong DebugControl;
ulong LastBranchToRip;
ulong LastBranchFromRip;
ulong LastExceptionToRip;
ulong LastExceptionFromRip;
};
//---
struct WOW64_FLOATING_SAVE_AREA
{
uint Controlushort;
uint Statusushort;
uint Tagushort;
uint ErrorOffset;
uint ErrorSelector;
uint DataOffset;
uint DataSelector;
uchar RegisterArea[WOW64_SIZE_OF_80387_REGISTERS];
uint Cr0NpxState;
};
//---
struct WOW64_CONTEXT
{
uint ContextFlags;
uint Dr0;
uint Dr1;
uint Dr2;
uint Dr3;
uint Dr6;
uint Dr7;
WOW64_FLOATING_SAVE_AREA FloatSave;
uint SegGs;
uint SegFs;
uint SegEs;
uint SegDs;
uint Edi;
uint Esi;
uint Ebx;
uint Edx;
uint Ecx;
uint Eax;
uint Ebp;
uint Eip;
uint SegCs;
uint EFlags;
uint Esp;
uint SegSs;
uchar ExtendedRegisters[WOW64_MAXIMUM_SUPPORTED_EXTENSION];
};
//---
struct WOW64_LDT_ENTRY
{
uint LimitLow;
uint BaseLow;
uchar BaseMid;
uchar Flags1;
uchar Flags2;
uchar BaseHi;
};
//---
struct WOW64_DESCRIPTOR_TABLE_ENTRY
{
uint Selector;
WOW64_LDT_ENTRY Descriptor;
};
//---
struct EXCEPTION_RECORD
{
uint ExceptionCode;
uint ExceptionFlags;
PVOID ExceptionRecord;
PVOID ExceptionAddress;
uint NumberParameters;
PVOID ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
};
//---
struct EXCEPTION_RECORD32
{
uint ExceptionCode;
uint ExceptionFlags;
uint ExceptionRecord;
uint ExceptionAddress;
uint NumberParameters;
uint ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
};
//---
struct EXCEPTION_RECORD64
{
uint ExceptionCode;
uint ExceptionFlags;
ulong ExceptionRecord;
ulong ExceptionAddress;
uint NumberParameters;
uint __unusedAlignment;
ulong ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
};
//---
struct EXCEPTION_POINTERS
{
PVOID ExceptionRecord;
PVOID ContextRecord;
};
//---
struct GENERIC_MAPPING
{
uint GenericRead;
uint GenericWrite;
uint GenericExecute;
uint GenericAll;
};
//---
struct LUID_AND_ATTRIBUTES
{
LUID Luid;
uint Attributes;
};
//---
struct SID_IDENTIFIER_AUTHORITY
{
uchar Value[6];
};
//---
//---
struct SID
{
uchar Revision;
uchar SubAuthorityCount;
SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
uint SubAuthority[ANYSIZE_ARRAY];
};
//---
struct SID_AND_ATTRIBUTES
{
SID Sid;
uint Attributes;
};
//---
struct SID_AND_ATTRIBUTES_HASH
{
uint SidCount;
PVOID SidAttr;
ulong Hash[SID_HASH_SIZE];
};
//---
struct ACL
{
uchar AclRevision;
uchar Sbz1;
ushort AclSize;
ushort AceCount;
ushort Sbz2;
};
//---
struct ACE_HEADER
{
uchar AceType;
uchar AceFlags;
ushort AceSize;
};
//---
struct ACCESS_ALLOWED_ACE
{
ACE_HEADER Header;
uint Mask;
uint SidStart;
};
//---
struct ACCESS_DENIED_ACE
{
ACE_HEADER Header;
uint Mask;
uint SidStart;
};
//---
struct SYSTEM_AUDIT_ACE
{
ACE_HEADER Header;
uint Mask;
uint SidStart;
};
//---
struct SYSTEM_ALARM_ACE
{
ACE_HEADER Header;
uint Mask;
uint SidStart;
};
//---
struct SYSTEM_RESOURCE_ATTRIBUTE_ACE
{
ACE_HEADER Header;
uint Mask;
uint SidStart;
};
//---
struct SYSTEM_SCOPED_POLICY_ID_ACE
{
ACE_HEADER Header;
uint Mask;
uint SidStart;
};
//---
struct SYSTEM_MANDATORY_LABEL_ACE
{
ACE_HEADER Header;
uint Mask;
uint SidStart;
};
//---
struct SYSTEM_PROCESS_TRUST_LABEL_ACE
{
ACE_HEADER Header;
uint Mask;
uint SidStart;
};
//---
struct SYSTEM_ACCESS_FILTER_ACE
{
ACE_HEADER Header;
uint Mask;
uint SidStart;
};
//---
struct ACCESS_ALLOWED_OBJECT_ACE
{
ACE_HEADER Header;
uint Mask;
uint Flags;
GUID ObjectType;
GUID InheritedObjectType;
uint SidStart;
};
//---
struct ACCESS_DENIED_OBJECT_ACE
{
ACE_HEADER Header;
uint Mask;
uint Flags;
GUID ObjectType;
GUID InheritedObjectType;
uint SidStart;
};
//---
struct SYSTEM_AUDIT_OBJECT_ACE
{
ACE_HEADER Header;
uint Mask;
uint Flags;
GUID ObjectType;
GUID InheritedObjectType;
uint SidStart;
};
//---
struct SYSTEM_ALARM_OBJECT_ACE
{
ACE_HEADER Header;
uint Mask;
uint Flags;
GUID ObjectType;
GUID InheritedObjectType;
uint SidStart;
};
//---
struct ACCESS_ALLOWED_CALLBACK_ACE
{
ACE_HEADER Header;
uint Mask;
uint SidStart;
};
//---
struct ACCESS_DENIED_CALLBACK_ACE
{
ACE_HEADER Header;
uint Mask;
uint SidStart;
};
//---
struct SYSTEM_AUDIT_CALLBACK_ACE
{
ACE_HEADER Header;
uint Mask;
uint SidStart;
};
//---
struct SYSTEM_ALARM_CALLBACK_ACE
{
ACE_HEADER Header;
uint Mask;
uint SidStart;
};
//---
struct ACCESS_ALLOWED_CALLBACK_OBJECT_ACE
{
ACE_HEADER Header;
uint Mask;
uint Flags;
GUID ObjectType;
GUID InheritedObjectType;
uint SidStart;
};
//---
struct ACCESS_DENIED_CALLBACK_OBJECT_ACE
{
ACE_HEADER Header;
uint Mask;
uint Flags;
GUID ObjectType;
GUID InheritedObjectType;
uint SidStart;
};
//---
struct SYSTEM_AUDIT_CALLBACK_OBJECT_ACE
{
ACE_HEADER Header;
uint Mask;
uint Flags;
GUID ObjectType;
GUID InheritedObjectType;
uint SidStart;
};
//---
struct SYSTEM_ALARM_CALLBACK_OBJECT_ACE
{
ACE_HEADER Header;
uint Mask;
uint Flags;
GUID ObjectType;
GUID InheritedObjectType;
uint SidStart;
};
//---
struct ACL_REVISION_INFORMATION
{
uint AclRevision;
};
//---
struct ACL_SIZE_INFORMATION
{
uint AceCount;
uint AclBytesInUse;
uint AclBytesFree;
};
//---
struct SECURITY_DESCRIPTOR_RELATIVE
{
uchar Revision;
uchar Sbz1;
ushort Control;
uint Owner;
uint Group;
uint Sacl;
uint Dacl;
};
//---
struct SECURITY_DESCRIPTOR
{
uchar Revision;
uchar Sbz1;
ushort Control;
uchar offset[4];
PVOID Owner;
PVOID Group;
PVOID Sacl;
PVOID Dacl;
};
//---
struct SECURITY_OBJECT_AI_PARAMS
{
uint Size;
uint ConstraintMask;
};
//---
struct OBJECT_TYPE_LIST
{
ushort Level;
ushort Sbz;
GUID ObjectType;
};
//---
struct PRIVILEGE_SET
{
uint PrivilegeCount;
uint Control;
LUID_AND_ATTRIBUTES Privilege[ANYSIZE_ARRAY];
};
//---
struct ACCESS_REASONS
{
uint Data[32];
};
//---
struct SE_SECURITY_DESCRIPTOR
{
uint Size;
uint Flags;
PVOID SecurityDescriptor;
};
//---
struct SE_ACCESS_REQUEST
{
uint Size;
PVOID SeSecurityDescriptor;
uint DesiredAccess;
uint PreviouslyGrantedAccess;
PVOID PrincipalSelfSid;
PVOID GenericMapping;
uint ObjectTypeListCount;
PVOID ObjectTypeList;
};
//---
struct SE_ACCESS_REPLY
{
uint Size;
uint ResultListCount;
PVOID GrantedAccess;
uint AccessStatus;
PVOID AccessReason;
PVOID Privileges;
};
//---
struct TOKEN_USER
{
SID_AND_ATTRIBUTES User;
};
//---
struct SE_TOKEN_USER
{
TOKEN_USER TokenUser;
SID Sid;
};
//---
struct TOKEN_GROUPS
{
uint GroupCount;
SID_AND_ATTRIBUTES Groups[ANYSIZE_ARRAY];
};
//---
struct TOKEN_PRIVILEGES
{
uint PrivilegeCount;
LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
};
//---
struct TOKEN_OWNER
{
PVOID Owner;
};
//---
struct TOKEN_PRIMARY_GROUP
{
PVOID PrimaryGroup;
};
//---
struct TOKEN_DEFAULT_DACL
{
PVOID DefaultDacl;
};
//---
struct TOKEN_USER_CLAIMS
{
PVOID UserClaims;
};
//---
struct TOKEN_DEVICE_CLAIMS
{
PVOID DeviceClaims;
};
//---
struct TOKEN_GROUPS_AND_PRIVILEGES
{
uint SidCount;
uint SidLength;
PVOID Sids;
uint RestrictedSidCount;
uint RestrictedSidLength;
PVOID RestrictedSids;
uint PrivilegeCount;
uint PrivilegeLength;
PVOID Privileges;
LUID AuthenticationId;
};
//---
struct TOKEN_LINKED_TOKEN
{
HANDLE LinkedToken;
};
//---
struct TOKEN_ELEVATION
{
uint TokenIsElevated;
};
//---
struct TOKEN_MANDATORY_LABEL
{
SID_AND_ATTRIBUTES Label;
};
//---
struct TOKEN_MANDATORY_POLICY
{
uint Policy;
};
//---
struct TOKEN_ACCESS_INFORMATION
{
PVOID SidHash;
PVOID RestrictedSidHash;
PVOID Privileges;
LUID AuthenticationId;
TOKEN_TYPE TokenType;
SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
TOKEN_MANDATORY_POLICY MandatoryPolicy;
uint Flags;
uint AppContainerNumber;
PVOID PackageSid;
PVOID CapabilitiesHash;
PVOID TrustLevelSid;
PVOID SecurityAttributes;
};
//---
struct TOKEN_AUDIT_POLICY
{
uchar PerUserPolicy[((POLICY_AUDIT_SUBCATEGORY_COUNT)>>1)+1];
};
//---
struct TOKEN_SOURCE
{
char SourceName[TOKEN_SOURCE_LENGTH];
LUID SourceIdentifier;
};
//---
struct TOKEN_STATISTICS
{
LUID TokenId;
LUID AuthenticationId;
long ExpirationTime;
TOKEN_TYPE TokenType;
SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
uint DynamicCharged;
uint DynamicAvailable;
uint GroupCount;
uint PrivilegeCount;
LUID ModifiedId;
};
//---
struct TOKEN_CONTROL
{
LUID TokenId;
LUID AuthenticationId;
LUID ModifiedId;
TOKEN_SOURCE TokenSource;
};
//---
struct TOKEN_ORIGIN
{
LUID OriginatingLogonSession;
};
//---
struct TOKEN_APPCONTAINER_INFORMATION
{
PVOID TokenAppContainer;
};
//---
struct TOKEN_SID_INFORMATION
{
PVOID Sid;
};
//---
struct TOKEN_BNO_ISOLATION_INFORMATION
{
string IsolationPrefix;
uchar IsolationEnabled;
};
//---
struct CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE
{
ulong Version;
string Name;
};
//---
struct CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE
{
PVOID pValue;
uint ValueLength;
};
//---
struct CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1
{
uint Name;
ushort ValueType;
ushort Reserved;
uint Flags;
uint ValueCount;
uint pInt64[ANYSIZE_ARRAY];
};
//---
struct Attribute
{
ushort Version;
ushort Reserved;
uint AttributeCount;
PVOID pAttributeV1;
};
//---
struct SECURITY_QUALITY_OF_SERVICE
{
uint Length;
SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
uchar ContextTrackingMode;
uchar EffectiveOnly;
};
//---
struct SE_IMPERSONATION_STATE
{
PVOID Token;
uchar CopyOnOpen;
uchar EffectiveOnly;
SECURITY_IMPERSONATION_LEVEL Level;
};
//---
struct SECURITY_CAPABILITIES
{
PVOID AppContainerSid;
PVOID Capabilities;
uint CapabilityCount;
uint Reserved;
};
//---
struct JOB_SET_ARRAY
{
HANDLE JobHandle;
uint MemberLevel;
uint Flags;
};
//---
struct EXCEPTION_REGISTRATION_RECORD
{
PVOID Next;
PVOID Handler;
};
//---
struct NT_TIB
{
PVOID ExceptionList;
PVOID StackBase;
PVOID StackLimit;
PVOID SubSystemTib;
PVOID FiberData;
PVOID ArbitraryUserPointer;
PVOID Self;
};
//---
struct UMS_CREATE_THREAD_ATTRIBUTES
{
uint UmsVersion;
PVOID UmsContext;
PVOID UmsCompletionList;
};
//---
struct WOW64_ARCHITECTURE_INFORMATION
{
uint Info;
};
//---
struct QUOTA_LIMITS
{
ulong PagedPoolLimit;
ulong NonPagedPoolLimit;
ulong MinimumWorkingSetSize;
ulong MaximumWorkingSetSize;
ulong PagefileLimit;
long TimeLimit;
};
//---
struct QUOTA_LIMITS_EX
{
ulong PagedPoolLimit;
ulong NonPagedPoolLimit;
ulong MinimumWorkingSetSize;
ulong MaximumWorkingSetSize;
ulong PagefileLimit;
long TimeLimit;
ulong WorkingSetLimit;
ulong Reserved2;
ulong Reserved3;
ulong Reserved4;
uint Flags;
uint CpuRateLimit;
};
//---
struct IO_COUNTERS
{
ulong ReadOperationCount;
ulong WriteOperationCount;
ulong OtherOperationCount;
ulong ReadTransferCount;
ulong WriteTransferCount;
ulong OtherTransferCount;
};
//---
struct JOBOBJECT_BASIC_ACCOUNTING_INFORMATION
{
long TotalUserTime;
long TotalKernelTime;
long ThisPeriodTotalUserTime;
long ThisPeriodTotalKernelTime;
uint TotalPageFaultCount;
uint TotalProcesses;
uint ActiveProcesses;
uint TotalTerminatedProcesses;
};
//---
struct JOBOBJECT_BASIC_LIMIT_INFORMATION
{
long PerProcessUserTimeLimit;
long PerJobUserTimeLimit;
uint LimitFlags;
ulong MinimumWorkingSetSize;
ulong MaximumWorkingSetSize;
uint ActiveProcessLimit;
ulong Affinity;
uint PriorityClass;
uint SchedulingClass;
};
//---
struct JOBOBJECT_EXTENDED_LIMIT_INFORMATION
{
JOBOBJECT_BASIC_LIMIT_INFORMATION BasicLimitInformation;
IO_COUNTERS IoInfo;
ulong ProcessMemoryLimit;
ulong JobMemoryLimit;
ulong PeakProcessMemoryUsed;
ulong PeakJobMemoryUsed;
};
//---
struct JOBOBJECT_BASIC_PROCESS_ID_LIST
{
uint NumberOfAssignedProcesses;
uint NumberOfProcessIdsInList;
ulong ProcessIdList[1];
};
//---
struct JOBOBJECT_BASIC_UI_RESTRICTIONS
{
uint UIRestrictionsClass;
};
//---
struct JOBOBJECT_SECURITY_LIMIT_INFORMATION
{
uint SecurityLimitFlags;
HANDLE JobToken;
PVOID SidsToDisable;
PVOID PrivilegesToDelete;
PVOID RestrictedSids;
};
//---
struct JOBOBJECT_END_OF_JOB_TIME_INFORMATION
{
uint EndOfJobTimeAction;
};
//---
struct JOBOBJECT_ASSOCIATE_COMPLETION_PORT
{
PVOID CompletionKey;
HANDLE CompletionPort;
};
//---
struct JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION
{
JOBOBJECT_BASIC_ACCOUNTING_INFORMATION BasicInfo;
IO_COUNTERS IoInfo;
};
//---
struct JOBOBJECT_JOBSET_INFORMATION
{
uint MemberLevel;
};
//---
struct JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION
{
ulong IoReadBytesLimit;
ulong IoWriteBytesLimit;
long PerJobUserTimeLimit;
ulong JobMemoryLimit;
JOBOBJECT_RATE_CONTROL_TOLERANCE RateControlTolerance;
JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL RateControlToleranceInterval;
uint LimitFlags;
};
//---
struct JOBOBJECT_LIMIT_VIOLATION_INFORMATION
{
uint LimitFlags;
uint ViolationLimitFlags;
ulong IoReadBytes;
ulong IoReadBytesLimit;
ulong IoWriteBytes;
ulong IoWriteBytesLimit;
long PerJobUserTime;
long PerJobUserTimeLimit;
ulong JobMemory;
ulong JobMemoryLimit;
JOBOBJECT_RATE_CONTROL_TOLERANCE RateControlTolerance;
JOBOBJECT_RATE_CONTROL_TOLERANCE RateControlToleranceLimit;
};
//---
struct JOBOBJECT_NET_RATE_CONTROL_INFORMATION
{
ulong MaxBandwidth;
JOB_OBJECT_NET_RATE_CONTROL_FLAGS ControlFlags;
uchar DscpTag;
};
//---
struct JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE
{
long MaxIops;
long MaxBandwidth;
long ReservationIops;
string VolumeName;
uint BaseIoSize;
JOB_OBJECT_IO_RATE_CONTROL_FLAGS ControlFlags;
ushort VolumeNameLength;
};
//---
struct JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2
{
long MaxIops;
long MaxBandwidth;
long ReservationIops;
string VolumeName;
uint BaseIoSize;
JOB_OBJECT_IO_RATE_CONTROL_FLAGS ControlFlags;
ushort VolumeNameLength;
long CriticalReservationIops;
long ReservationBandwidth;
long CriticalReservationBandwidth;
long MaxTimePercent;
long ReservationTimePercent;
long CriticalReservationTimePercent;
};
//---
struct JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3
{
long MaxIops;
long MaxBandwidth;
long ReservationIops;
string VolumeName;
uint BaseIoSize;
JOB_OBJECT_IO_RATE_CONTROL_FLAGS ControlFlags;
ushort VolumeNameLength;
long CriticalReservationIops;
long ReservationBandwidth;
long CriticalReservationBandwidth;
long MaxTimePercent;
long ReservationTimePercent;
long CriticalReservationTimePercent;
long SoftMaxIops;
long SoftMaxBandwidth;
long SoftMaxTimePercent;
long LimitExcessNotifyIops;
long LimitExcessNotifyBandwidth;
long LimitExcessNotifyTimePercent;
};
//---
struct JOBOBJECT_IO_ATTRIBUTION_STATS
{
ulong IoCount;
ulong TotalNonOverlappedQueueTime;
ulong TotalNonOverlappedServiceTime;
ulong TotalSize;
};
//---
struct JOBOBJECT_IO_ATTRIBUTION_INFORMATION
{
uint ControlFlags;
JOBOBJECT_IO_ATTRIBUTION_STATS ReadStats;
JOBOBJECT_IO_ATTRIBUTION_STATS WriteStats;
};
//---
struct SILOOBJECT_BASIC_INFORMATION
{
uint SiloId;
uint SiloParentId;
uint NumberOfProcesses;
uchar IsInServerSilo;
uchar Reserved[3];
};
//---
struct SERVERSILO_BASIC_INFORMATION
{
uint ServiceSessionId;
SERVERSILO_STATE State;
uint ExitStatus;
};
//---
struct CACHE_DESCRIPTOR
{
uchar Level;
uchar Associativity;
ushort LineSize;
uint Size;
PROCESSOR_CACHE_TYPE Type;
};
//---
struct ProcessorCore
{
ulong ProcessorMask;
LOGICAL_PROCESSOR_RELATIONSHIP Relationship;
uchar Flags;
};
//---
struct PROCESSOR_RELATIONSHIP
{
uchar Flags;
uchar EfficiencyClass;
uchar Reserved[20];
ushort GroupCount;
GROUP_AFFINITY GroupMask[ANYSIZE_ARRAY];
};
//---
struct NUMA_NODE_RELATIONSHIP
{
uint NodeNumber;
uchar Reserved[20];
GROUP_AFFINITY GroupMask;
};
//---
struct CACHE_RELATIONSHIP
{
uchar Level;
uchar Associativity;
ushort LineSize;
uint CacheSize;
PROCESSOR_CACHE_TYPE Type;
uchar Reserved[20];
GROUP_AFFINITY GroupMask;
};
//---
struct PROCESSOR_GROUP_INFO
{
uchar MaximumProcessorCount;
uchar ActiveProcessorCount;
uchar Reserved[38];
ulong ActiveProcessorMask;
};
//---
struct GROUP_RELATIONSHIP
{
ushort MaximumGroupCount;
ushort ActiveGroupCount;
uchar Reserved[20];
PROCESSOR_GROUP_INFO GroupInfo[ANYSIZE_ARRAY];
};
//---
struct SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION
{
ulong CycleTime;
};
//---
struct XSTATE_FEATURE
{
uint Offset;
uint Size;
};
//---
struct XSTATE_CONFIGURATION
{
ulong EnabledFeatures;
ulong EnabledVolatileFeatures;
uint Size;
uint ControlFlags;
XSTATE_FEATURE Features[MAXIMUM_XSTATE_FEATURES];
ulong EnabledSupervisorFeatures;
ulong AlignedFeatures;
uint AllFeatureSize;
uint AllFeatures[MAXIMUM_XSTATE_FEATURES];
};
//---
struct MEMORY_BASIC_INFORMATION
{
PVOID BaseAddress;
PVOID AllocationBase;
uint AllocationProtect;
ulong RegionSize;
uint State;
uint Protect;
uint Type;
};
//---
struct MEMORY_BASIC_INFORMATION32
{
uint BaseAddress;
uint AllocationBase;
uint AllocationProtect;
uint RegionSize;
uint State;
uint Protect;
uint Type;
};
//---
struct MEMORY_BASIC_INFORMATION64
{
ulong BaseAddress;
ulong AllocationBase;
uint AllocationProtect;
uint __alignment1;
ulong RegionSize;
uint State;
uint Protect;
uint Type;
uint __alignment2;
};
//---
struct CFG_CALL_TARGET_INFO
{
ulong Offset;
ulong Flags;
};
//---
struct MEM_ADDRESS_REQUIREMENTS
{
PVOID LowestStartingAddress;
PVOID HighestEndingAddress;
ulong Alignment;
};
//---
struct ENCLAVE_CREATE_INFO_SGX
{
uchar Secs[4096];
};
//---
struct ENCLAVE_INIT_INFO_SGX
{
uchar SigStruct[1808];
uchar Reserved1[240];
uchar EInitToken[304];
uchar Reserved2[1744];
};
//---
struct ENCLAVE_CREATE_INFO_VBS
{
uint Flags;
uchar OwnerID[32];
};
//---
struct ENCLAVE_INIT_INFO_VBS
{
uint Length;
uint ThreadCount;
};
//---
struct FILE_ID_128
{
uchar Identifier[16];
};
//---
struct FILE_NOTIFY_INFORMATION
{
uint NextEntryOffset;
uint Action;
uint FileNameLength;
short FileName[1];
};
//---
struct FILE_NOTIFY_EXTENDED_INFORMATION
{
uint NextEntryOffset;
uint Action;
long CreationTime;
long LastModificationTime;
long LastChangeTime;
long LastAccessTime;
long AllocatedLength;
long FileSize;
uint FileAttributes;
uint ReparsePointTag;
long FileId;
long ParentFileId;
uint FileNameLength;
short FileName[1];
};
//---
struct GenericReparseBuffer
{
uint ReparseTag;
ushort ReparseDataLength;
ushort Reserved;
GUID ReparseGuid;
uchar DataBuffer[1];
};
//---
struct SCRUB_DATA_INPUT
{
uint Size;
uint Flags;
uint MaximumIos;
uint ObjectId[4];
uint Reserved[13];
uchar ResumeContext[816];
};
//---
struct SCRUB_PARITY_EXTENT
{
long Offset;
ulong Length;
};
//---
struct SCRUB_PARITY_EXTENT_DATA
{
ushort Size;
ushort Flags;
ushort NumberOfParityExtents;
ushort MaximumNumberOfParityExtents;
SCRUB_PARITY_EXTENT ParityExtents[ANYSIZE_ARRAY];
};
//---
struct SCRUB_DATA_OUTPUT
{
uint Size;
uint Flags;
uint Status;
ulong ErrorFileOffset;
ulong ErrorLength;
ulong NumberOfBytesRepaired;
ulong NumberOfBytesFailed;
ulong InternalFileReference;
ushort ResumeContextLength;
ushort ParityExtentDataOffset;
uint Reserved[5];
uchar ResumeContext[816];
};
//---
struct SHARED_VIRTUAL_DISK_SUPPORT
{
SharedVirtualDiskSupportType SharedVirtualDiskSupport;
SharedVirtualDiskHandleState HandleState;
};
//---
struct NETWORK_APP_INSTANCE_EA
{
GUID AppInstanceID;
uint CsvFlags;
};
//---
struct CM_POWER_DATA
{
uint PD_Size;
DEVICE_POWER_STATE PD_MostRecentPowerState;
uint PD_Capabilities;
uint PD_D1Latency;
uint PD_D2Latency;
uint PD_D3Latency;
DEVICE_POWER_STATE PD_PowerStateMapping[POWER_SYSTEM_MAXIMUM];
SYSTEM_POWER_STATE PD_DeepestSystemWake;
};
//---
struct POWER_USER_PRESENCE
{
POWER_USER_PRESENCE_TYPE UserPresence;
};
//---
struct POWER_SESSION_CONNECT
{
uchar Connected;
uchar Console;
};
//---
struct POWER_SESSION_TIMEOUTS
{
uint InputTimeout;
uint DisplayTimeout;
};
//---
struct POWER_SESSION_RIT_STATE
{
uchar Active;
uint LastInputTime;
};
//---
struct POWER_SESSION_WINLOGON
{
uint SessionId;
uchar Console;
uchar Locked;
};
//---
struct POWER_IDLE_RESILIENCY
{
uint CoalescingTimeout;
uint IdleResiliencyPeriod;
};
//---
struct POWER_MONITOR_INVOCATION
{
uchar Console;
POWER_MONITOR_REQUEST_REASON RequestReason;
};
//---
struct RESUME_PERFORMANCE
{
uint PostTimeMs;
ulong TotalResumeTimeMs;
ulong ResumeCompleteTimestamp;
};
//---
struct APPLICATIONLAUNCH_SETTING_VALUE
{
long ActivationTime;
uint Flags;
uint ButtonInstanceID;
};
//---
struct POWER_PLATFORM_INFORMATION
{
uchar AoAc;
};
//---
struct POWER_ACTION_POLICY
{
POWER_ACTION Action;
uint Flags;
uint EventCode;
};
//---
struct SYSTEM_POWER_LEVEL
{
uchar Enable;
uchar Spare[3];
uint BatteryLevel;
POWER_ACTION_POLICY PowerPolicy;
SYSTEM_POWER_STATE MinSystemState;
};
//---
struct SYSTEM_POWER_POLICY
{
uint Revision;
POWER_ACTION_POLICY PowerButton;
POWER_ACTION_POLICY SleepButton;
POWER_ACTION_POLICY LidClose;
SYSTEM_POWER_STATE LidOpenWake;
uint Reserved;
POWER_ACTION_POLICY Idle;
uint IdleTimeout;
uchar IdleSensitivity;
uchar DynamicThrottle;
uchar Spare2[2];
SYSTEM_POWER_STATE MinSleep;
SYSTEM_POWER_STATE MaxSleep;
SYSTEM_POWER_STATE ReducedLatencySleep;
uint WinLogonFlags;
uint Spare3;
uint DozeS4Timeout;
uint BroadcastCapacityResolution;
SYSTEM_POWER_LEVEL DischargePolicy[NUM_DISCHARGE_POLICIES];
uint VideoTimeout;
uchar VideoDimDisplay;
uint VideoReserved[3];
uint SpindownTimeout;
uchar OptimizeForPower;
uchar FanThrottleTolerance;
uchar ForcedThrottle;
uchar MinThrottle;
POWER_ACTION_POLICY OverThrottled;
};
//---
struct PROCESSOR_POWER_POLICY_INFO
{
uint TimeCheck;
uint DemoteLimit;
uint PromoteLimit;
uchar DemotePercent;
uchar PromotePercent;
uchar Spare[2];
uint Flags;
};
//---
struct PROCESSOR_POWER_POLICY
{
uint Revision;
uchar DynamicThrottle;
uchar Spare[3];
uint Flags;
uint PolicyCount;
PROCESSOR_POWER_POLICY_INFO Policy[3];
};
//---
struct ADMINISTRATOR_POWER_POLICY
{
SYSTEM_POWER_STATE MinSleep;
SYSTEM_POWER_STATE MaxSleep;
uint MinVideoTimeout;
uint MaxVideoTimeout;
uint MinSpindownTimeout;
uint MaxSpindownTimeout;
};
//---
struct HIBERFILE_BUCKET
{
ulong MaxPhysicalMemory;
uint PhysicalMemoryPercent[HIBERFILE_TYPE_MAX];
};
//---
struct IMAGE_DOS_HEADER
{
ushort e_magic;
ushort e_cblp;
ushort e_cp;
ushort e_crlc;
ushort e_cparhdr;
ushort e_minalloc;
ushort e_maxalloc;
ushort e_ss;
ushort e_sp;
ushort e_csum;
ushort e_ip;
ushort e_cs;
ushort e_lfarlc;
ushort e_ovno;
ushort e_res[4];
ushort e_oemid;
ushort e_oeminfo;
ushort e_res2[10];
int e_lfanew;
};
//---
struct IMAGE_OS2_HEADER
{
ushort ne_magic;
char ne_ver;
char ne_rev;
ushort ne_enttab;
ushort ne_cbenttab;
int ne_crc;
ushort ne_flags;
ushort ne_autodata;
ushort ne_heap;
ushort ne_stack;
int ne_csip;
int ne_sssp;
ushort ne_cseg;
ushort ne_cmod;
ushort ne_cbnrestab;
ushort ne_segtab;
ushort ne_rsrctab;
ushort ne_restab;
ushort ne_modtab;
ushort ne_imptab;
int ne_nrestab;
ushort ne_cmovent;
ushort ne_align;
ushort ne_cres;
uchar ne_exetyp;
uchar ne_flagsothers;
ushort ne_pretthunks;
ushort ne_psegrefbytes;
ushort ne_swaparea;
ushort ne_expver;
};
//---
struct IMAGE_VXD_HEADER
{
ushort e32_magic;
uchar e32_border;
uchar e32_ushorter;
uint e32_level;
ushort e32_cpu;
ushort e32_os;
uint e32_ver;
uint e32_mflags;
uint e32_mpages;
uint e32_startobj;
uint e32_eip;
uint e32_stackobj;
uint e32_esp;
uint e32_pagesize;
uint e32_lastpagesize;
uint e32_fixupsize;
uint e32_fixupsum;
uint e32_ldrsize;
uint e32_ldrsum;
uint e32_objtab;
uint e32_objcnt;
uint e32_objmap;
uint e32_itermap;
uint e32_rsrctab;
uint e32_rsrccnt;
uint e32_restab;
uint e32_enttab;
uint e32_dirtab;
uint e32_dircnt;
uint e32_fpagetab;
uint e32_frectab;
uint e32_impmod;
uint e32_impmodcnt;
uint e32_impproc;
uint e32_pagesum;
uint e32_datapage;
uint e32_preload;
uint e32_nrestab;
uint e32_cbnrestab;
uint e32_nressum;
uint e32_autodata;
uint e32_debuginfo;
uint e32_debuglen;
uint e32_instpreload;
uint e32_instdemand;
uint e32_heapsize;
uchar e32_res3[12];
uint e32_winresoff;
uint e32_winreslen;
ushort e32_devid;
ushort e32_ddkver;
};
//---
struct IMAGE_FILE_HEADER
{
ushort Machine;
ushort NumberOfSections;
uint TimeDateStamp;
uint PointerToSymbolTable;
uint NumberOfSymbols;
ushort SizeOfOptionalHeader;
ushort Characteristics;
};
//---
struct IMAGE_DATA_DIRECTORY
{
uint VirtualAddress;
uint Size;
};
//---
struct IMAGE_OPTIONAL_HEADER32
{
ushort Magic;
uchar MajorLinkerVersion;
uchar MinorLinkerVersion;
uint SizeOfCode;
uint SizeOfInitializedData;
uint SizeOfUninitializedData;
uint AddressOfEntryPoint;
uint BaseOfCode;
uint BaseOfData;
uint ImageBase;
uint SectionAlignment;
uint FileAlignment;
ushort MajorOperatingSystemVersion;
ushort MinorOperatingSystemVersion;
ushort MajorImageVersion;
ushort MinorImageVersion;
ushort MajorSubsystemVersion;
ushort MinorSubsystemVersion;
uint Win32VersionValue;
uint SizeOfImage;
uint SizeOfHeaders;
uint CheckSum;
ushort Subsystem;
ushort DllCharacteristics;
uint SizeOfStackReserve;
uint SizeOfStackCommit;
uint SizeOfHeapReserve;
uint SizeOfHeapCommit;
uint LoaderFlags;
uint NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
};
//---
struct IMAGE_ROM_OPTIONAL_HEADER
{
ushort Magic;
uchar MajorLinkerVersion;
uchar MinorLinkerVersion;
uint SizeOfCode;
uint SizeOfInitializedData;
uint SizeOfUninitializedData;
uint AddressOfEntryPoint;
uint BaseOfCode;
uint BaseOfData;
uint BaseOfBss;
uint GprMask;
uint CprMask[4];
uint GpValue;
};
//---
struct IMAGE_OPTIONAL_HEADER64
{
ushort Magic;
uchar MajorLinkerVersion;
uchar MinorLinkerVersion;
uint SizeOfCode;
uint SizeOfInitializedData;
uint SizeOfUninitializedData;
uint AddressOfEntryPoint;
uint BaseOfCode;
ulong ImageBase;
uint SectionAlignment;
uint FileAlignment;
ushort MajorOperatingSystemVersion;
ushort MinorOperatingSystemVersion;
ushort MajorImageVersion;
ushort MinorImageVersion;
ushort MajorSubsystemVersion;
ushort MinorSubsystemVersion;
uint Win32VersionValue;
uint SizeOfImage;
uint SizeOfHeaders;
uint CheckSum;
ushort Subsystem;
ushort DllCharacteristics;
ulong SizeOfStackReserve;
ulong SizeOfStackCommit;
ulong SizeOfHeapReserve;
ulong SizeOfHeapCommit;
uint LoaderFlags;
uint NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
};
//---
struct IMAGE_NT_HEADERS64
{
uint Signature;
IMAGE_FILE_HEADER FileHeader;
IMAGE_OPTIONAL_HEADER64 OptionalHeader;
};
//---
struct IMAGE_NT_HEADERS32
{
uint Signature;
IMAGE_FILE_HEADER FileHeader;
IMAGE_OPTIONAL_HEADER32 OptionalHeader;
};
//---
struct IMAGE_ROM_HEADERS
{
IMAGE_FILE_HEADER FileHeader;
IMAGE_ROM_OPTIONAL_HEADER OptionalHeader;
};
//---
struct ANON_OBJECT_HEADER
{
ushort Sig1;
ushort Sig2;
ushort Version;
ushort Machine;
uint TimeDateStamp;
GUID ClassID;
uint SizeOfData;
};
//---
struct ANON_OBJECT_HEADER_V2
{
ushort Sig1;
ushort Sig2;
ushort Version;
ushort Machine;
uint TimeDateStamp;
GUID ClassID;
uint SizeOfData;
uint Flags;
uint MetaDataSize;
uint MetaDataOffset;
};
//---
struct ANON_OBJECT_HEADER_BIGOBJ
{
ushort Sig1;
ushort Sig2;
ushort Version;
ushort Machine;
uint TimeDateStamp;
GUID ClassID;
uint SizeOfData;
uint Flags;
uint MetaDataSize;
uint MetaDataOffset;
uint NumberOfSections;
uint PointerToSymbolTable;
uint NumberOfSymbols;
};
//---
struct IMAGE_SECTION_HEADER
{
uchar Name[IMAGE_SIZEOF_SHORT_NAME];
uint PhysicalAddress;
uint VirtualAddress;
uint SizeOfRawData;
uint PointerToRawData;
uint PointerToRelocations;
uint PointerToLinenumbers;
ushort NumberOfRelocations;
ushort NumberOfLinenumbers;
uint Characteristics;
};
//---
struct IMAGE_SYMBOL
{
uchar ShortName[8];
uint Value;
short SectionNumber;
ushort Type;
uchar StorageClass;
uchar NumberOfAuxSymbols;
};
//---
struct IMAGE_SYMBOL_EX
{
uchar ShortName[8];
uint Value;
int SectionNumber;
ushort Type;
uchar StorageClass;
uchar NumberOfAuxSymbols;
};
//---
struct IMAGE_AUX_SYMBOL_TOKEN_DEF
{
uchar bAuxType;
uchar bReserved;
uint SymbolTableIndex;
uchar rgbReserved[12];
};
//---
struct IMAGE_LINENUMBER
{
uint VirtualAddress;
ushort Linenumber;
};
//---
struct IMAGE_BASE_RELOCATION
{
uint VirtualAddress;
uint SizeOfBlock;
};
//---
struct IMAGE_ARCHIVE_MEMBER_HEADER
{
uchar Name[16];
uchar Date[12];
uchar UserID[6];
uchar GroupID[6];
uchar Mode[8];
uchar Size[10];
uchar EndHeader[2];
};
//---
struct IMAGE_EXPORT_DIRECTORY
{
uint Characteristics;
uint TimeDateStamp;
ushort MajorVersion;
ushort MinorVersion;
uint Name;
uint Base;
uint NumberOfFunctions;
uint NumberOfNames;
uint AddressOfFunctions;
uint AddressOfNames;
uint AddressOfNameOrdinals;
};
//---
struct IMAGE_IMPORT_BY_NAME
{
ushort Hint;
char Name[1];
};
//---
struct IMAGE_THUNK_DATA64
{
ulong Data;
};
//---
struct IMAGE_THUNK_DATA32
{
uint Data;
};
//---
struct IMAGE_BOUND_IMPORT_DESCRIPTOR
{
uint TimeDateStamp;
ushort OffsetModuleName;
ushort NumberOfModuleForwarderRefs;
};
//---
struct IMAGE_BOUND_FORWARDER_REF
{
uint TimeDateStamp;
ushort OffsetModuleName;
ushort Reserved;
};
//---
struct IMAGE_RESOURCE_DIRECTORY
{
uint Characteristics;
uint TimeDateStamp;
ushort MajorVersion;
ushort MinorVersion;
ushort NumberOfNamedEntries;
ushort NumberOfIdEntries;
};
//---
struct IMAGE_RESOURCE_DIRECTORY_STRING
{
ushort Length;
char NameString[1];
};
//---
struct IMAGE_RESOURCE_DIR_STRING_U
{
ushort Length;
short NameString[1];
};
//---
struct IMAGE_RESOURCE_DATA_ENTRY
{
uint OffsetToData;
uint Size;
uint CodePage;
uint Reserved;
};
//---
struct IMAGE_LOAD_CONFIG_CODE_INTEGRITY
{
ushort Flags;
ushort Catalog;
uint CatalogOffset;
uint Reserved;
};
//---
struct IMAGE_DYNAMIC_RELOCATION_TABLE
{
uint Version;
uint Size;
};
//---
struct IMAGE_DYNAMIC_RELOCATION32
{
uint Symbol;
uint BaseRelocSize;
};
//---
struct IMAGE_DYNAMIC_RELOCATION64
{
ulong Symbol;
uint BaseRelocSize;
};
//---
struct IMAGE_DYNAMIC_RELOCATION32_V2
{
uint HeaderSize;
uint FixupInfoSize;
uint Symbol;
uint SymbolGroup;
uint Flags;
};
//---
struct IMAGE_DYNAMIC_RELOCATION64_V2
{
uint HeaderSize;
uint FixupInfoSize;
ulong Symbol;
uint SymbolGroup;
uint Flags;
};
//---
struct IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER
{
uchar PrologueByteCount;
};
//---
struct IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER
{
uint EpilogueCount;
uchar EpilogueByteCount;
uchar BranchDescriptorElementSize;
ushort BranchDescriptorCount;
};
//---
struct IMAGE_LOAD_CONFIG_DIRECTORY32
{
uint Size;
uint TimeDateStamp;
ushort MajorVersion;
ushort MinorVersion;
uint GlobalFlagsClear;
uint GlobalFlagsSet;
uint CriticalSectionDefaultTimeout;
uint DeCommitFreeBlockThreshold;
uint DeCommitTotalFreeThreshold;
uint LockPrefixTable;
uint MaximumAllocationSize;
uint VirtualMemoryThreshold;
uint ProcessHeapFlags;
uint ProcessAffinityMask;
ushort CSDVersion;
ushort DependentLoadFlags;
uint EditList;
uint SecurityCookie;
uint SEHandlerTable;
uint SEHandlerCount;
uint GuardCFCheckFunctionPointer;
uint GuardCFDispatchFunctionPointer;
uint GuardCFFunctionTable;
uint GuardCFFunctionCount;
uint GuardFlags;
IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
uint GuardAddressTakenIatEntryTable;
uint GuardAddressTakenIatEntryCount;
uint GuardLongJumpTargetTable;
uint GuardLongJumpTargetCount;
uint DynamicValueRelocTable;
uint CHPEMetadataPointer;
uint GuardRFFailureRoutine;
uint GuardRFFailureRoutineFunctionPointer;
uint DynamicValueRelocTableOffset;
ushort DynamicValueRelocTableSection;
ushort Reserved2;
uint GuardRFVerifyStackPointerFunctionPointer;
uint HotPatchTableOffset;
uint Reserved3;
uint EnclaveConfigurationPointer;
};
//---
struct IMAGE_LOAD_CONFIG_DIRECTORY64
{
uint Size;
uint TimeDateStamp;
ushort MajorVersion;
ushort MinorVersion;
uint GlobalFlagsClear;
uint GlobalFlagsSet;
uint CriticalSectionDefaultTimeout;
ulong DeCommitFreeBlockThreshold;
ulong DeCommitTotalFreeThreshold;
ulong LockPrefixTable;
ulong MaximumAllocationSize;
ulong VirtualMemoryThreshold;
ulong ProcessAffinityMask;
uint ProcessHeapFlags;
ushort CSDVersion;
ushort DependentLoadFlags;
ulong EditList;
ulong SecurityCookie;
ulong SEHandlerTable;
ulong SEHandlerCount;
ulong GuardCFCheckFunctionPointer;
ulong GuardCFDispatchFunctionPointer;
ulong GuardCFFunctionTable;
ulong GuardCFFunctionCount;
uint GuardFlags;
IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
ulong GuardAddressTakenIatEntryTable;
ulong GuardAddressTakenIatEntryCount;
ulong GuardLongJumpTargetTable;
ulong GuardLongJumpTargetCount;
ulong DynamicValueRelocTable;
ulong CHPEMetadataPointer;
ulong GuardRFFailureRoutine;
ulong GuardRFFailureRoutineFunctionPointer;
uint DynamicValueRelocTableOffset;
ushort DynamicValueRelocTableSection;
ushort Reserved2;
ulong GuardRFVerifyStackPointerFunctionPointer;
uint HotPatchTableOffset;
uint Reserved3;
ulong EnclaveConfigurationPointer;
};
//---
struct IMAGE_HOT_PATCH_INFO
{
uint Version;
uint Size;
uint SequenceNumber;
uint BaseImageList;
uint BaseImageCount;
uint BufferOffset;
};
//---
struct IMAGE_HOT_PATCH_BASE
{
uint SequenceNumber;
uint Flags;
uint OriginalTimeDateStamp;
uint OriginalCheckSum;
uint CodeIntegrityInfo;
uint CodeIntegritySize;
uint PatchTable;
uint BufferOffset;
};
//---
struct IMAGE_HOT_PATCH_HASHES
{
uchar SHA256[32];
uchar SHA1[20];
};
//---
struct IMAGE_CE_RUNTIME_FUNCTION_ENTRY
{
uint FuncStart;
uint Flags;
};
//---
struct IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY
{
ulong BeginAddress;
ulong EndAddress;
ulong ExceptionHandler;
ulong HandlerData;
ulong PrologEndAddress;
};
//---
struct IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY
{
uint BeginAddress;
uint EndAddress;
uint ExceptionHandler;
uint HandlerData;
uint PrologEndAddress;
};
//---
struct IMAGE_ENCLAVE_CONFIG32
{
uint Size;
uint MinimumRequiredConfigSize;
uint PolicyFlags;
uint NumberOfImports;
uint ImportList;
uint ImportEntrySize;
uchar FamilyID[IMAGE_ENCLAVE_SHORT_ID_LENGTH];
uchar ImageID[IMAGE_ENCLAVE_SHORT_ID_LENGTH];
uint ImageVersion;
uint SecurityVersion;
uint EnclaveSize;
uint NumberOfThreads;
uint EnclaveFlags;
};
//---
struct IMAGE_ENCLAVE_CONFIG64
{
uint Size;
uint MinimumRequiredConfigSize;
uint PolicyFlags;
uint NumberOfImports;
uint ImportList;
uint ImportEntrySize;
uchar FamilyID[IMAGE_ENCLAVE_SHORT_ID_LENGTH];
uchar ImageID[IMAGE_ENCLAVE_SHORT_ID_LENGTH];
uint ImageVersion;
uint SecurityVersion;
ulong EnclaveSize;
uint NumberOfThreads;
uint EnclaveFlags;
};
//---
struct IMAGE_ENCLAVE_IMPORT
{
uint MatchType;
uint MinimumSecurityVersion;
uchar UniqueOrAuthorID[IMAGE_ENCLAVE_LONG_ID_LENGTH];
uchar FamilyID[IMAGE_ENCLAVE_SHORT_ID_LENGTH];
uchar ImageID[IMAGE_ENCLAVE_SHORT_ID_LENGTH];
uint ImportName;
uint Reserved;
};
//---
struct IMAGE_DEBUG_DIRECTORY
{
uint Characteristics;
uint TimeDateStamp;
ushort MajorVersion;
ushort MinorVersion;
uint Type;
uint SizeOfData;
uint AddressOfRawData;
uint PointerToRawData;
};
//---
struct IMAGE_COFF_SYMBOLS_HEADER
{
uint NumberOfSymbols;
uint LvaToFirstSymbol;
uint NumberOfLinenumbers;
uint LvaToFirstLinenumber;
uint RvaToFirstByteOfCode;
uint RvaToLastByteOfCode;
uint RvaToFirstByteOfData;
uint RvaToLastByteOfData;
};
//---
struct FPO_DATA
{
uint ulOffStart;
uint cbProcSize;
uint cdwLocals;
ushort cdwParams;
ushort data;
};
//---
struct IMAGE_DEBUG_MISC
{
uint DataType;
uint Length;
uchar Unicode;
uchar Reserved[3];
uchar Data[1];
};
//---
struct IMAGE_FUNCTION_ENTRY
{
uint StartingAddress;
uint EndingAddress;
uint EndOfPrologue;
};
//---
struct IMAGE_SEPARATE_DEBUG_HEADER
{
ushort Signature;
ushort Flags;
ushort Machine;
ushort Characteristics;
uint TimeDateStamp;
uint CheckSum;
uint ImageBase;
uint SizeOfImage;
uint NumberOfSections;
uint ExportedNamesSize;
uint DebugDirectorySize;
uint SectionAlignment;
uint Reserved[2];
};
//---
struct NON_PAGED_DEBUG_INFO
{
ushort Signature;
ushort Flags;
uint Size;
ushort Machine;
ushort Characteristics;
uint TimeDateStamp;
uint CheckSum;
uint SizeOfImage;
ulong ImageBase;
};
//---
struct IMAGE_ARCHITECTURE_HEADER
{
int mask;
uint FirstEntryRVA;
};
//---
struct IMAGE_ARCHITECTURE_ENTRY
{
uint FixupInstRVA;
uint NewInst;
};
//---
struct SLIST_ENTRY
{
PVOID Next;
};
//---
struct RTL_BARRIER
{
uint Reserved1;
uint Reserved2;
ulong Reserved3[2];
uint Reserved4;
uint Reserved5;
};
//---
struct MESSAGE_RESOURCE_ENTRY
{
ushort Length;
ushort Flags;
uchar Text[1];
};
//---
struct MESSAGE_RESOURCE_BLOCK
{
uint LowId;
uint HighId;
uint OffsetToEntries;
};
//---
struct MESSAGE_RESOURCE_DATA
{
uint NumberOfBlocks;
MESSAGE_RESOURCE_BLOCK Blocks[1];
};
//---
struct OSVERSIONINFOW
{
uint dwOSVersionInfoSize;
uint dwMajorVersion;
uint dwMinorVersion;
uint dwBuildNumber;
uint dwPlatformId;
ushort szCSDVersion[128];
};
//---
struct OSVERSIONINFOEXW
{
uint dwOSVersionInfoSize;
uint dwMajorVersion;
uint dwMinorVersion;
uint dwBuildNumber;
uint dwPlatformId;
short szCSDVersion[128];
ushort wServicePackMajor;
ushort wServicePackMinor;
ushort wSuiteMask;
uchar wProductType;
uchar wReserved;
};
//---
struct NV_MEMORY_RANGE
{
PVOID BaseAddress;
ulong Length;
};
//---
struct CORRELATION_VECTOR
{
char Version;
char Vector[RTL_CORRELATION_VECTOR_STRING_LENGTH];
};
//---
struct CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG
{
uint Size;
const string TriggerId;
};
//---
struct IMAGE_POLICY_ENTRY
{
IMAGE_POLICY_ENTRY_TYPE Type;
IMAGE_POLICY_ID PolicyId;
PVOID Value;
};
//---
struct IMAGE_POLICY_METADATA
{
uchar Version;
uchar Reserved0[7];
ulong ApplicationId;
IMAGE_POLICY_ENTRY Policies[];
};
//---
struct RTL_CRITICAL_SECTION_DEBUG
{
ushort Type;
ushort CreatorBackTraceIndex;
PVOID CriticalSection;
LIST_ENTRY ProcessLocksList;
uint EntryCount;
uint ContentionCount;
uint Flags;
ushort CreatorBackTraceIndexHigh;
ushort Spareushort;
};
//---
struct RTL_CRITICAL_SECTION
{
PVOID DebugInfo;
int LockCount;
int RecursionCount;
HANDLE OwningThread;
HANDLE LockSemaphore;
ulong SpinCount;
};
//---
struct RTL_SRWLOCK
{
PVOID Ptr;
};
//---
struct RTL_CONDITION_VARIABLE
{
PVOID Ptr;
};
//---
struct HEAP_OPTIMIZE_RESOURCES_INFORMATION
{
uint Version;
uint Flags;
};
//---
struct ACTIVATION_CONTEXT_QUERY_INDEX
{
uint ulAssemblyIndex;
uint ulFileIndexInAssembly;
};
//---
struct ASSEMBLY_FILE_DETAILED_INFORMATION
{
uint ulFlags;
uint ulFilenameLength;
uint ulPathLength;
const string lpFileName;
const string lpFilePath;
};
//---
struct ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION
{
uint ulFlags;
uint ulEncodedAssemblyIdentityLength;
uint ulManifestPathType;
uint ulManifestPathLength;
long liManifestLastWriteTime;
uint ulPolicyPathType;
uint ulPolicyPathLength;
long liPolicyLastWriteTime;
uint ulMetadataSatelliteRosterIndex;
uint ulManifestVersionMajor;
uint ulManifestVersionMinor;
uint ulPolicyVersionMajor;
uint ulPolicyVersionMinor;
uint ulAssemblyDirectoryNameLength;
const string lpAssemblyEncodedAssemblyIdentity;
const string lpAssemblyManifestPath;
const string lpAssemblyPolicyPath;
const string lpAssemblyDirectoryName;
uint ulFileCount;
};
//---
struct ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION
{
uint ulFlags;
ACTCTX_REQUESTED_RUN_LEVEL RunLevel;
uint UiAccess;
};
//---
struct COMPATIBILITY_CONTEXT_ELEMENT
{
GUID Id;
ACTCTX_COMPATIBILITY_ELEMENT_TYPE Type;
};
//---
struct ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION
{
uint ElementCount;
COMPATIBILITY_CONTEXT_ELEMENT Elements[];
};
//---
struct SUPPORTED_OS_INFO
{
ushort MajorVersion;
ushort MinorVersion;
};
//---
struct ACTIVATION_CONTEXT_DETAILED_INFORMATION
{
uint dwFlags;
uint ulFormatVersion;
uint ulAssemblyCount;
uint ulRootManifestPathType;
uint ulRootManifestPathChars;
uint ulRootConfigurationPathType;
uint ulRootConfigurationPathChars;
uint ulAppDirPathType;
uint ulAppDirPathChars;
const string lpRootManifestPath;
const string lpRootConfigurationPath;
const string lpAppDirPath;
};
//---
struct HARDWARE_COUNTER_DATA
{
HARDWARE_COUNTER_TYPE Type;
uint Reserved;
ulong Value;
};
//---
struct PERFORMANCE_DATA
{
ushort Size;
uchar Version;
uchar HwCountersCount;
uint ContextSwitchCount;
ulong WaitReasonBitMap;
ulong CycleTime;
uint RetryCount;
uint Reserved;
HARDWARE_COUNTER_DATA HwCounters[MAX_HW_COUNTERS];
};
//---
struct EVENTLOGRECORD
{
uint Length;
uint Reserved;
uint RecordNumber;
uint TimeGenerated;
uint TimeWritten;
uint EventID;
ushort EventType;
ushort NumStrings;
ushort EventCategory;
ushort ReservedFlags;
uint ClosingRecordNumber;
uint StringOffset;
uint UserSidLength;
uint UserSidOffset;
uint DataLength;
uint DataOffset;
};
//---
struct TAPE_ERASE
{
uint Type;
uchar Immediate;
};
//---
struct TAPE_PREPARE
{
uint Operation;
uchar Immediate;
};
//---
struct TAPE_WRITE_MARKS
{
uint Type;
uint Count;
uchar Immediate;
};
//---
struct TAPE_GET_POSITION
{
uint Type;
uint Partition;
long Offset;
};
//---
struct TAPE_SET_POSITION
{
uint Method;
uint Partition;
long Offset;
uchar Immediate;
};
//---
struct TAPE_GET_DRIVE_PARAMETERS
{
uchar ECC;
uchar Compression;
uchar DataPadding;
uchar ReportSetmarks;
uint DefaultBlockSize;
uint MaximumBlockSize;
uint MinimumBlockSize;
uint MaximumPartitionCount;
uint FeaturesLow;
uint FeaturesHigh;
uint EOTWarningZoneSize;
};
//---
struct TAPE_SET_DRIVE_PARAMETERS
{
uchar ECC;
uchar Compression;
uchar DataPadding;
uchar ReportSetmarks;
uint EOTWarningZoneSize;
};
//---
struct TAPE_GET_MEDIA_PARAMETERS
{
long Capacity;
long Remaining;
uint BlockSize;
uint PartitionCount;
uchar WriteProtected;
};
//---
struct TAPE_SET_MEDIA_PARAMETERS
{
uint BlockSize;
};
//---
struct TAPE_CREATE_PARTITION
{
uint Method;
uint Count;
uint Size;
};
//---
struct TAPE_WMI_OPERATIONS
{
uint Method;
uint DataBufferSize;
PVOID DataBuffer;
};
//---
struct TRANSACTION_BASIC_INFORMATION
{
GUID TransactionId;
uint State;
uint Outcome;
};
//---
struct TRANSACTIONMANAGER_BASIC_INFORMATION
{
GUID TmIdentity;
long VirtualClock;
};
//---
struct TRANSACTIONMANAGER_LOG_INFORMATION
{
GUID LogIdentity;
};
//---
struct TRANSACTIONMANAGER_LOGPATH_INFORMATION
{
uint LogPathLength;
short LogPath[1];
};
//---
struct TRANSACTIONMANAGER_RECOVERY_INFORMATION
{
ulong LastRecoveredLsn;
};
//---
struct TRANSACTIONMANAGER_OLDEST_INFORMATION
{
GUID OldestTransactionGuid;
};
//---
struct TRANSACTION_PROPERTIES_INFORMATION
{
uint IsolationLevel;
uint IsolationFlags;
long Timeout;
uint Outcome;
uint DescriptionLength;
short Description[1];
};
//---
struct TRANSACTION_BIND_INFORMATION
{
HANDLE TmHandle;
};
//---
struct TRANSACTION_ENLISTMENT_PAIR
{
GUID EnlistmentId;
GUID ResourceManagerId;
};
//---
struct TRANSACTION_ENLISTMENTS_INFORMATION
{
uint NumberOfEnlistments;
TRANSACTION_ENLISTMENT_PAIR EnlistmentPair[1];
};
//---
struct TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION
{
TRANSACTION_ENLISTMENT_PAIR SuperiorEnlistmentPair;
};
//---
struct RESOURCEMANAGER_BASIC_INFORMATION
{
GUID ResourceManagerId;
uint DescriptionLength;
short Description[1];
};
//---
struct RESOURCEMANAGER_COMPLETION_INFORMATION
{
HANDLE IoCompletionPortHandle;
ulong CompletionKey;
};
//---
struct ENLISTMENT_BASIC_INFORMATION
{
GUID EnlistmentId;
GUID TransactionId;
GUID ResourceManagerId;
};
//---
struct ENLISTMENT_CRM_INFORMATION
{
GUID CrmTransactionManagerId;
GUID CrmResourceManagerId;
GUID CrmEnlistmentId;
};
//---
struct TRANSACTION_LIST_ENTRY
{
GUID UOW;
};
//---
struct TRANSACTION_LIST_INFORMATION
{
uint NumberOfTransactions;
TRANSACTION_LIST_ENTRY TransactionInformation[1];
};
//---
struct KTMOBJECT_CURSOR
{
GUID LastQuery;
uint ObjectIdCount;
GUID ObjectIds[1];
};
//---
struct TP_POOL_STACK_INFORMATION
{
ulong StackReserve;
ulong StackCommit;
};
//---
struct TP_CALLBACK_ENVIRON_V3
{
uint Version;
PVOID Pool;
PVOID CleanupGroup;
PVOID CleanupGroupCancelCallback;
PVOID RaceDll;
PVOID ActivationContext;
PVOID FinalizationCallback;
uint Flags;
TP_CALLBACK_PRIORITY CallbackPriority;
uint Size;
};
//---
struct SYSTEM_LOGICAL_PROCESSOR_INFORMATION
{
ulong ProcessorMask;
LOGICAL_PROCESSOR_RELATIONSHIP Relationship;
uchar offset[4];
ulong Reserved[2];
};
//---
struct SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX
{
LOGICAL_PROCESSOR_RELATIONSHIP Relationship;
uint Size;
uchar info[72];
};
//---
struct SYSTEM_CPU_SET_INFORMATION
{
uint Size;
CPU_SET_INFORMATION_TYPE Type;
uint Id;
ushort Group;
uchar LogicalProcessorIndex;
uchar CoreIndex;
uchar LastLevelCacheIndex;
uchar NumaNodeIndex;
uchar EfficiencyClass;
uchar AllFlags;
uint Reserved;
ulong AllocationTag;
};
//+------------------------------------------------------------------+
//| |
//+------------------------------------------------------------------+
#import "kernel32.dll"
ushort RtlCaptureStackBackTrace(uint frames_to_skip,uint frames_to_capture,PVOID &back_trace[],uint &back_trace_hash);
ulong RtlCompareMemory(const uchar &source1[],const uchar &source2[],ulong length);
ulong VerSetConditionMask(ulong condition_mask,uint type_mask,uchar condition);
#import
#import "Win32k.sys"
void RtlCaptureContext(PVOID context_record);
void RtlUnwind(PVOID target_frame,PVOID target_ip,EXCEPTION_RECORD &exception_record,PVOID return_value);
PVOID RtlLookupFunctionEntry(ulong control_pc,PVOID image_base,UNWIND_HISTORY_TABLE &history_table);
void RtlUnwindEx(PVOID target_frame,PVOID target_ip,EXCEPTION_RECORD &exception_record,PVOID return_value,PVOID context_record,UNWIND_HISTORY_TABLE &history_table);
PVOID RtlVirtualUnwind(uint handler_type,ulong image_base,ulong control_pc,PVOID function_entry,PVOID context_record,PVOID &handler_data,PVOID establisher_frame,KNONVOLATILE_CONTEXT_POINTERS &context_pointers);
PVOID RtlLookupFunctionEntry(ulong control_pc,uint &image_base,UNWIND_HISTORY_TABLE &history_table);
void RtlUnwindEx(PVOID target_frame,PVOID target_ip,EXCEPTION_RECORD &exception_record,PVOID return_value,PVOID context_record,UNWIND_HISTORY_TABLE &history_table);
PVOID RtlVirtualUnwind(uint handler_type,uint image_base,uint control_pc,PVOID function_entry,PVOID context_record,PVOID &handler_data,uint &establisher_frame,KNONVOLATILE_CONTEXT_POINTERS &context_pointers);
PVOID RtlLookupFunctionEntry(ulong control_pc,PVOID image_base,UNWIND_HISTORY_TABLE &history_table);
void RtlUnwindEx(PVOID target_frame,PVOID target_ip,EXCEPTION_RECORD &exception_record,PVOID return_value,PVOID context_record,UNWIND_HISTORY_TABLE &history_table);
PVOID RtlVirtualUnwind(uint handler_type,ulong image_base,ulong control_pc,PVOID function_entry,PVOID context_record,PVOID &handler_data,PVOID establisher_frame,KNONVOLATILE_CONTEXT_POINTERS &context_pointers);
void RtlUnwindEx(PVOID target_frame,PVOID target_ip,EXCEPTION_RECORD &exception_record,PVOID return_value,PVOID context_record,PVOID history_table);
PVOID RtlPcToFileHeader(PVOID pc_value,PVOID &base_of_image);
#import
//+------------------------------------------------------------------+
Reference in a new issueCopy permalink