12 #define WIN32_NO_STATUS 13 #define WIN32_LEAN_AND_MEAN 22 #define DPFLTR_SVCHOST_ID 28 27 #define SvchostDbgPrint(lev, fmt, ...) \ 28 DbgPrintEx(DPFLTR_SVCHOST_ID, \ 30 "[SVCHOST] %lx.%lx: " fmt, \ 31 GetCurrentProcessId(), \ 32 GetCurrentThreadId(), \ 35 #define DBG_ERR(fmt, ...) SvchostDbgPrint(1, fmt, __VA_ARGS__) 36 #define DBG_TRACE(fmt, ...) SvchostDbgPrint(4, fmt, __VA_ARGS__) 91 #define SVCHOST_RPC_INIT_COMPLETE 1 92 #define SVCHOST_NBT_INIT_COMPLETE 2 93 #define SVCHOST_SID_INIT_COMPLETE 4 LONG cServiceActiveThreadCount
struct _SVCHOST_CALLBACK_CONTEXT SVCHOST_CALLBACK_CONTEXT
NTSTATUS NTAPI RpcpStartRpcServer(_In_ LPCWSTR IfName, _In_ RPC_IF_HANDLE IfSpec)
DWORD WINAPI RegQueryDword(_In_ HKEY hKey, _In_ LPCWSTR pszValueName, _Out_ PDWORD pdwValue)
struct _SVCHOST_SERVICE SVCHOST_SERVICE
DWORD AuthenticationLevel
PSVCHOST_SERVICE pService
struct _SVCHOST_CALLBACK_CONTEXT * PSVCHOST_CALLBACK_CONTEXT
struct _SVCHOST_GLOBALS SVCHOST_GLOBALS
PVOID AuthenticatedUserSid
VOID WINAPI SvcNetBiosInit(VOID)
PSVCHOST_STOP_CALLBACK pfnStopCallback
NTSTATUS NTAPI RpcpStopRpcServerEx(_In_ RPC_IF_HANDLE IfSpec)
VOID WINAPI SvchostBuildSharedGlobals(VOID)
struct _SVCHOST_DLL SVCHOST_DLL
SID_IDENTIFIER_AUTHORITY Authority
PVOID RpcpStopRpcServerEx
struct _SVCHOST_GLOBALS * PSVCHOST_GLOBALS
CLIPBOARD_GLOBALS Globals
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
struct _DOMAIN_SID_DATA DOMAIN_SID_DATA
PSVCHOST_GLOBALS g_pSvchostSharedGlobals
enum _SECURITY_IMPERSONATION_LEVEL SECURITY_IMPERSONATION_LEVEL
SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
struct _SVCHOST_DLL * PSVCHOST_DLL
VOID WINAPI SvchostCharLowerW(_In_ LPCWSTR lpSrcStr)
NTSTATUS NTAPI ScCreateWellKnownSids(VOID)
VOID WINAPI MemInit(_In_ HANDLE Heap)
struct _SVCHOST_SERVICE * PSVCHOST_SERVICE
PVOID SvcRegisterStopCallback
DWORD AuthenticationCapabilities
struct _SVCHOST_SERVICE * pService
struct _SID_DATA SID_DATA
struct _SVCHOST_OPTIONS SVCHOST_OPTIONS
DWORD WINAPI SvcNetBiosReset(_In_ UCHAR LanaNum)
VOID WINAPI SvcNetBiosOpen(VOID)
NTSTATUS NTAPI RpcpInitRpcServer(VOID)
DWORD WINAPI SvcRegisterStopCallback(_In_ PHANDLE phNewWaitObject, _In_ LPCWSTR ServiceName, _In_ HANDLE hObject, _In_ PSVCHOST_STOP_CALLBACK pfnStopCallback, _In_ PVOID pContext, _In_ ULONG dwFlags)
_In_ PCCERT_CONTEXT _In_ DWORD dwFlags
BOOL WINAPI InitializeSecurity(_In_ DWORD dwParam, _In_ DWORD dwAuthnLevel, _In_ DWORD dwImpLevel, _In_ DWORD dwCapabilities)
DWORD WINAPI RegQueryStringA(_In_ HKEY hKey, _In_ LPCWSTR pszValueName, _In_ DWORD dwExpectedType, _Out_ LPCSTR *ppszData)
NTSTATUS NTAPI RpcpStopRpcServer(_In_ RPC_IF_HANDLE IfSpec)
PVOID WINAPI MemAlloc(_In_ DWORD dwFlags, _In_ DWORD dwBytes)
VOID(WINAPI * PSVCHOST_INIT_GLOBALS)(_In_ PSVCHOST_GLOBALS Globals)
DWORD DefaultRpcStackSize
VOID WINAPI SvcNetBiosClose(VOID)
DWORD CoInitializeSecurityParam
BOOL WINAPI MemFree(_In_ LPVOID lpMem)
VOID(CALLBACK * PSVCHOST_STOP_CALLBACK)(_In_ PVOID lpParameter, _In_ BOOLEAN TimerOrWaitFired)
DWORD WINAPI RegQueryString(_In_ HKEY hKey, _In_ LPCWSTR pszValueName, _In_ DWORD dwExpectedType, _Out_ PBYTE *ppbData)
struct _SVCHOST_OPTIONS * PSVCHOST_OPTIONS