5 #define PASSIVE_LEVEL 0 8 #define DISPATCH_LEVEL 2 10 #define CLOCK_LEVEL 13 13 #define POWER_LEVEL 14 14 #define PROFILE_LEVEL 15 17 #define KI_USER_SHARED_DATA 0xFFFFF78000000000ULL 18 #define SharedUserData ((KUSER_SHARED_DATA * const)KI_USER_SHARED_DATA) 19 #define SharedInterruptTime (KI_USER_SHARED_DATA + 0x8) 20 #define SharedSystemTime (KI_USER_SHARED_DATA + 0x14) 21 #define SharedTickCount (KI_USER_SHARED_DATA + 0x320) 23 #define PAGE_SIZE 0x1000 24 #define PAGE_SHIFT 12L 26 #define EFLAG_SIGN 0x8000 27 #define EFLAG_ZERO 0x4000 28 #define EFLAG_SELECT (EFLAG_SIGN | EFLAG_ZERO) 37 #define KeQueryInterruptTime() \ 38 (*(volatile ULONG64*)SharedInterruptTime) 40 #define KeQuerySystemTime(CurrentCount) \ 41 *(ULONG64*)(CurrentCount) = *(volatile ULONG64*)SharedSystemTime 43 #define KeQueryTickCount(CurrentCount) \ 44 *(ULONG64*)(CurrentCount) = *(volatile ULONG64*)SharedTickCount 46 #define KeGetDcacheFillSize() 1L 48 #define YieldProcessor _mm_pause 49 #define MemoryBarrier __faststorefence 50 #define FastFence __faststorefence 51 #define LoadFence _mm_lfence 52 #define MemoryFence _mm_mfence 53 #define StoreFence _mm_sfence 54 #define LFENCE_ACQUIRE() LoadFence() 66 #define KeMemoryBarrierWithoutFence() _ReadWriteBarrier() 74 return (
KIRQL)__readcr8();
102 #define KeRaiseIrql(a,b) *(b) = KfRaiseIrql(a) 126 return (
struct _KTHREAD *)__readgsqword(0x188);
155 #if (NTDDI_VERSION >= NTDDI_WIN7) 160 return __readgsdword(0x1a4);
170 #define KeFlushIoBuffers(_Mdl, _ReadOperation, _DmaOperation) 173 #define DbgRaiseAssertionFailure __int2c 178 #define PAUSE_PROCESSOR YieldProcessor(); 180 #define KERNEL_STACK_SIZE 0x6000 181 #define KERNEL_LARGE_STACK_SIZE 0x12000 182 #define KERNEL_LARGE_STACK_COMMIT KERNEL_STACK_SIZE 184 #define KERNEL_MCA_EXCEPTION_STACK_SIZE 0x2000 186 #define EXCEPTION_READ_FAULT 0 187 #define EXCEPTION_WRITE_FAULT 1 188 #define EXCEPTION_EXECUTE_FAULT 8 190 #if !defined(RC_INVOKED) 192 #define CONTEXT_AMD64 0x100000 194 #define CONTEXT_CONTROL (CONTEXT_AMD64 | 0x1L) 195 #define CONTEXT_INTEGER (CONTEXT_AMD64 | 0x2L) 196 #define CONTEXT_SEGMENTS (CONTEXT_AMD64 | 0x4L) 197 #define CONTEXT_FLOATING_POINT (CONTEXT_AMD64 | 0x8L) 198 #define CONTEXT_DEBUG_REGISTERS (CONTEXT_AMD64 | 0x10L) 200 #define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_FLOATING_POINT) 201 #define CONTEXT_ALL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS) 203 #define CONTEXT_XSTATE (CONTEXT_AMD64 | 0x40L) 205 #define CONTEXT_EXCEPTION_ACTIVE 0x8000000 206 #define CONTEXT_SERVICE_ACTIVE 0x10000000 207 #define CONTEXT_EXCEPTION_REQUEST 0x40000000 208 #define CONTEXT_EXCEPTION_REPORTING 0x80000000 212 #define INITIAL_MXCSR 0x1f80 213 #define INITIAL_FPCSR 0x027f 277 M128A VectorRegister[26];
286 #define PCR_MINOR_VERSION 1 287 #define PCR_MAJOR_VERSION 1 332 #if (NTDDI_VERSION >= NTDDI_WIN7) 333 _CRT_DEPRECATE_TEXT(
"KeGetCurrentProcessorNumber is deprecated. Use KeGetCurrentProcessorNumberEx or KeGetCurrentProcessorIndex instead.")
339 return __readgsbyte(0x184);
#define KeGetCurrentIrql()
PKSPIN_LOCK_QUEUE LockArray
struct _KFLOATING_SAVE KFLOATING_SAVE
#define _Must_inspect_result_
struct _KFLOATING_SAVE * PKFLOATING_SAVE
#define UNREFERENCED_PARAMETER(P)
$if(_WDMDDK_) typedef struct _KFLOATING_SAVE
FORCEINLINE KIRQL KeRaiseIrqlToSynchLevel(VOID)
#define _Kernel_acquires_resource_(kind)
union _KIDTENTRY64 * IdtBase
union _KGDTENTRY64 * GdtBase
#define DECLSPEC_ALIGN(x)
_Kernel_requires_resource_held_(FloatState) _Kernel_releases_resource_(FloatState)) FORCEINLINE NTSTATUS KeRestoreFloatingPointState(_In_ PKFLOATING_SAVE FloatSave)
#define _IRQL_raises_(irql)
ULONG SecondLevelCacheSize
FORCEINLINE ULONG KeGetCurrentProcessorNumber(VOID)
#define _CRT_DEPRECATE_TEXT(_Text)
NTKERNELAPI KIRQL NTAPI KfRaiseIrql(IN KIRQL NewIrql)
FORCEINLINE PRKTHREAD KeGetCurrentThread(VOID)
XSAVE_FORMAT * PXMM_SAVE_AREA32
FORCEINLINE ULONG KeGetCurrentProcessorIndex(VOID)
$endif(_WDMDDK_) $if(_NTDDK_) typedef struct _NEON128
#define _Kernel_float_restored_
#define KeRestoreFloatingPointState(x)
struct _KPRCB * CurrentPrcb
_Kernel_requires_resource_not_held_(FloatState) _Kernel_acquires_resource_(FloatState)) FORCEINLINE NTSTATUS KeSaveFloatingPointState(_Out_ PKFLOATING_SAVE FloatSave)
_Always_(_Post_satisfies_(return<=0)) _Must_inspect_result_ _IRQL_requires_max_(DISPATCH_LEVEL) _Kernel_float_saved_ _At_(*FloatSave
#define _Post_satisfies_(e)
#define _Kernel_float_saved_
#define KeSaveFloatingPointState(x)
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
_Success_(1) _Kernel_float_restored_ _At_(*FloatSave
#define _ANONYMOUS_STRUCT
_IRQL_requires_max_(HIGH_LEVEL) _IRQL_saves_ FORCEINLINE KIRQL KeGetCurrentIrql(VOID)
#define _Kernel_releases_resource_(kind)
FORCEINLINE PKPCR KeGetPcr(VOID)
UCHAR SecondLevelCacheAssociativity
#define FIELD_OFFSET(t, f)
XSAVE_FORMAT XMM_SAVE_AREA32
NTKERNELAPI KIRQL NTAPI KeRaiseIrqlToDpcLevel(VOID)
FORCEINLINE VOID KeMemoryBarrier(VOID)
_Requires_lock_held_ SpinLock _Releases_lock_ SpinLock _In_ _IRQL_restores_ KIRQL NewIrql