12 #define WIN32_NO_STATUS 13 #define WIN32_LEAN_AND_MEAN 15 #define NTOS_MODE_USER 26 #define SvchostDbgPrint(lev, fmt, ...) \ 27 DbgPrintEx(DPFLTR_SVCHOST_ID, \ 29 "[SVCHOST] %lx.%lx: " fmt, \ 30 GetCurrentProcessId(), \ 31 GetCurrentThreadId(), \ 34 #define DBG_ERR(fmt, ...) SvchostDbgPrint(1, fmt, __VA_ARGS__) 35 #define DBG_TRACE(fmt, ...) SvchostDbgPrint(4, fmt, __VA_ARGS__) 48 #define SVCHOST_RPC_INIT_COMPLETE 1 49 #define SVCHOST_NBT_INIT_COMPLETE 2 50 #define SVCHOST_SID_INIT_COMPLETE 4 LONG cServiceActiveThreadCount
struct _SVCHOST_CALLBACK_CONTEXT SVCHOST_CALLBACK_CONTEXT
DWORD WINAPI RegQueryDword(_In_ HKEY hKey, _In_ LPCWSTR pszValueName, _Out_ PDWORD pdwValue)
struct _SVCHOST_SERVICE SVCHOST_SERVICE
DWORD AuthenticationLevel
PSVCHOST_SERVICE pService
struct _SVCHOST_CALLBACK_CONTEXT * PSVCHOST_CALLBACK_CONTEXT
VOID(WINAPI * PSVCHOST_INIT_GLOBALS)(_In_ PSVCHOST_GLOBAL_DATA Globals)
VOID WINAPI SvcNetBiosInit(VOID)
PSVCHOST_STOP_CALLBACK pfnStopCallback
NTSTATUS NTAPI RpcpStopRpcServerEx(_In_ RPC_IF_HANDLE IfSpec)
VOID WINAPI SvchostBuildSharedGlobals(VOID)
struct _SVCHOST_DLL SVCHOST_DLL
SID_IDENTIFIER_AUTHORITY Authority
CLIPBOARD_GLOBALS Globals
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
struct _DOMAIN_SID_DATA DOMAIN_SID_DATA
enum _SECURITY_IMPERSONATION_LEVEL SECURITY_IMPERSONATION_LEVEL
PSVCHOST_GLOBAL_DATA g_pSvchostSharedGlobals
SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
struct _SVCHOST_DLL * PSVCHOST_DLL
VOID WINAPI SvchostCharLowerW(_In_ LPCWSTR lpSrcStr)
NTSTATUS NTAPI ScCreateWellKnownSids(VOID)
VOID WINAPI MemInit(_In_ HANDLE Heap)
struct _SVCHOST_SERVICE * PSVCHOST_SERVICE
DWORD AuthenticationCapabilities
struct _SVCHOST_SERVICE * pService
struct _SID_DATA SID_DATA
struct _SVCHOST_OPTIONS SVCHOST_OPTIONS
DWORD WINAPI SvcNetBiosReset(_In_ UCHAR LanaNum)
VOID WINAPI SvcNetBiosOpen(VOID)
NTSTATUS NTAPI RpcpInitRpcServer(VOID)
DWORD WINAPI SvcRegisterStopCallback(_Out_ PHANDLE phNewWaitObject, _In_ PCWSTR ServiceName, _In_ HANDLE hObject, _In_ PSVCHOST_STOP_CALLBACK pfnStopCallback, _In_ PVOID pContext, _In_ ULONG dwFlags)
_In_ PCCERT_CONTEXT _In_ DWORD dwFlags
BOOL WINAPI InitializeSecurity(_In_ DWORD dwParam, _In_ DWORD dwAuthnLevel, _In_ DWORD dwImpLevel, _In_ DWORD dwCapabilities)
DWORD WINAPI RegQueryStringA(_In_ HKEY hKey, _In_ LPCWSTR pszValueName, _In_ DWORD dwExpectedType, _Out_ LPCSTR *ppszData)
NTSTATUS NTAPI RpcpStopRpcServer(_In_ RPC_IF_HANDLE IfSpec)
PVOID WINAPI MemAlloc(_In_ DWORD dwFlags, _In_ DWORD dwBytes)
WAITORTIMERCALLBACK PSVCHOST_STOP_CALLBACK
DWORD DefaultRpcStackSize
VOID WINAPI SvcNetBiosClose(VOID)
DWORD CoInitializeSecurityParam
NTSTATUS NTAPI RpcpStartRpcServer(_In_ PCWSTR IfName, _In_ RPC_IF_HANDLE IfSpec)
BOOL WINAPI MemFree(_In_ LPVOID lpMem)
DWORD WINAPI RegQueryString(_In_ HKEY hKey, _In_ LPCWSTR pszValueName, _In_ DWORD dwExpectedType, _Out_ PBYTE *ppbData)
struct _SVCHOST_OPTIONS * PSVCHOST_OPTIONS