21#define PASTE2(x,y) x##y
22#define PASTE(x,y) PASTE2(x,y)
25 #define STRUCT(x) PASTE(x,32)
27#elif defined(EXPLICIT_64BIT)
28 #define STRUCT(x) PASTE(x,64)
29 #define PTR(x) ULONG64
35#if (defined(_WIN64) && !defined(EXPLICIT_32BIT)) || defined(EXPLICIT_64BIT)
37 #define _SELECT3264(x32, x64) (x64)
38 #define GDI_HANDLE_BUFFER_SIZE 60
41 #define _SELECT3264(x32, x64) (x32)
42 #define GDI_HANDLE_BUFFER_SIZE 34
45#if defined(_NTDDK_INCLUDED_) || defined(_NTIFS_)
46#define PPEB PPEB_RENAMED
49typedef struct STRUCT(_PEB)
52 BOOLEAN ReadImageFileExecOptions;
54#if (NTDDI_VERSION >= NTDDI_WS03)
61#if (NTDDI_VERSION >= NTDDI_LONGHORN)
64 BOOLEAN IsImageDynamicallyRelocated:1;
65 BOOLEAN SkipPatchingUser32Forwarders:1;
82#if (NTDDI_VERSION >= NTDDI_LONGHORN)
87 ULONG CrossProcessFlags;
91 ULONG ProcessInitializing:1;
92 ULONG ProcessUsingVEH:1;
93 ULONG ProcessUsingVCH:1;
94 ULONG ReservedBits0:28;
102#elif (NTDDI_VERSION >= NTDDI_WS03)
105 ULONG EnvironmentUpdateCount;
110 ULONG EnvironmentUpdateCount;
113 ULONG SystemReserved[1];
116 ULONG TlsExpansionCounter;
118 ULONG TlsBitmapBits[2];
119 PTR(
PVOID) ReadOnlySharedMemoryBase;
120#if (NTDDI_VERSION >= NTDDI_LONGHORN)
123 PTR(
PVOID) ReadOnlySharedMemoryHeap;
125 PTR(
PVOID*) ReadOnlyStaticServerData;
129 ULONG NumberOfProcessors;
137 ULONG MaximumNumberOfHeaps;
141 ULONG GdiDCAttributeList;
143 ULONG OSMajorVersion;
144 ULONG OSMinorVersion;
148 ULONG ImageSubsystem;
149 ULONG ImageSubsystemMajorVersion;
150 ULONG ImageSubsystemMinorVersion;
155 ULONG TlsExpansionBitmapBits[32];
157#if (NTDDI_VERSION >= NTDDI_WINXP)
163 PTR(
struct _ACTIVATION_CONTEXT_DATA*) ActivationContextData;
164 PTR(
struct _ASSEMBLY_STORAGE_MAP*) ProcessAssemblyStorageMap;
165 PTR(
struct _ACTIVATION_CONTEXT_DATA*) SystemDefaultActivationContextData;
166 PTR(
struct _ASSEMBLY_STORAGE_MAP*) SystemAssemblyStorageMap;
169#if (NTDDI_VERSION >= NTDDI_WS03)
173 ULONG FlsBitmapBits[4];
176#if (NTDDI_VERSION >= NTDDI_LONGHORN)
196#if (NTDDI_VERSION >= NTDDI_WS03)
211#if (NTDDI_VERSION >= NTDDI_WS03)
216#define GDI_BATCH_BUFFER_SIZE 0x136
220typedef struct STRUCT(_GDI_TEB_BATCH)
230typedef struct STRUCT(_TEB)
236 PTR(
PVOID) ThreadLocalStoragePointer;
238 ULONG LastErrorValue;
239 ULONG CountOfOwnedCriticalSections;
242 ULONG User32Reserved[26];
243 ULONG UserReserved[5];
246 ULONG FpSoftwareStatusRegister;
248#if (NTDDI_VERSION >= NTDDI_WIN10)
249 PTR(
PVOID) ReservedForDebuggerInstrumentation[16];
259#if (NTDDI_VERSION >= NTDDI_WS03SP1)
265#if (NTDDI_VERSION >= NTDDI_WIN10)
271 UCHAR InstrumentationCallbackDisabled;
274 UCHAR InstrumentationCallbackDisabled;
275 UCHAR SpareBytes[23];
278#elif (NTDDI_VERSION >= NTDDI_WIN7)
281#elif (NTDDI_VERSION >= NTDDI_VISTA)
284#elif (NTDDI_VERSION >= NTDDI_WS03SP1)
305 ULONG LastStatusValue;
310 WCHAR StaticUnicodeBuffer[261];
320#if (NTDDI_VERSION >= NTDDI_WS03)
323 ULONG HardErrorsAreDisabled;
328#if (NTDDI_VERSION >= NTDDI_LONGHORN)
332#if (NTDDI_VERSION >= NTDDI_WIN8)
338#elif (NTDDI_VERSION >= NTDDI_WS03)
347#if (NTDDI_VERSION >= NTDDI_WIN7)
357 UCHAR IdealProcessor;
360#elif (NTDDI_VERSION >= NTDDI_LONGHORN)
364 UCHAR IdealProcessor;
367 BOOLEAN FreeStackOnTermination;
369 UCHAR IdealProcessor;
371#if (NTDDI_VERSION >= NTDDI_WS03)
372 ULONG GuaranteedStackBytes;
381 ULONG WaitingOnLoaderLock;
385#if (NTDDI_VERSION >= NTDDI_LONGHORN)
387#if (NTDDI_VERSION >= NTDDI_WIN8)
393#elif (NTDDI_VERSION >= NTDDI_WS03)
398 Wx86ThreadState Wx86Thread;
405#if (NTDDI_VERSION >= NTDDI_WIN10)
408 ULONG ImpersonationLocale;
410 ULONG IsImpersonating;
413#if (NTDDI_VERSION >= NTDDI_WIN8)
414 USHORT HeapVirtualAffinity;
415 USHORT LowFragHeapDataSlot;
417 ULONG HeapVirtualAffinity;
424#if (NTDDI_VERSION >= NTDDI_WS03)
428#if (NTDDI_VERSION >= NTDDI_LONGHORN)
432 ULONG MuiImpersonation;
438 USHORT SpareCrossTebBits:16;
446 USHORT DbgSafeThunkCall:1;
449 USHORT DbgSkipThreadAttach:1;
450 USHORT DbgWerInShipAssertCode:1;
451 USHORT DbgIssuedInitialBp:1;
453 USHORT SpareSameTebBits:9;
465#if (NTDDI_VERSION >= NTDDI_WIN10)
467#elif (NTDDI_VERSION >= NTDDI_WIN7)
469#elif (NTDDI_VERSION >= NTDDI_LONGHORN)
470 ULONG ProcessRundown;
473#if (NTDDI_VERSION >= NTDDI_WIN7)
475#elif (NTDDI_VERSION >= NTDDI_LONGHORN)
481#if (NTDDI_VERSION >= NTDDI_WIN8)
485#if (NTDDI_VERSION >= NTDDI_WIN10)
487 GUID EffectiveContainerId;
525#undef GDI_HANDLE_BUFFER_SIZE
_Inout_ PIRP _In_ NTSTATUS ExceptionCode
#define GDI_BATCH_BUFFER_SIZE
PGDI_SHARED_HANDLE_TABLE GdiSharedHandleTable
NTSTATUS(NTAPI * PPOST_PROCESS_INIT_ROUTINE)(VOID)
VOID(NTAPI * PPEBLOCKROUTINE)(PVOID PebLock)
RTL_CRITICAL_SECTION FastPebLock
_In_ ULONG _In_ ULONG Offset
#define _SELECT3264(x32, x64)
#define GDI_HANDLE_BUFFER_SIZE
#define FIELD_OFFSET(t, f)
_In_ PCEVENT_DESCRIPTOR _In_opt_ LPCGUID ActivityId
_Out_ PCLIENT_ID ClientId