30 #ifndef NTOS_MODE_USER 39 #ifndef NTOS_MODE_USER 46 #endif // !NTOS_MODE_USER 51 #define USER_SHARED_DATA (0x7FFE0000) 56 #define FLG_STOP_ON_EXCEPTION 0x00000001 57 #define FLG_SHOW_LDR_SNAPS 0x00000002 58 #define FLG_DEBUG_INITIAL_COMMAND 0x00000004 59 #define FLG_STOP_ON_HUNG_GUI 0x00000008 60 #define FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010 61 #define FLG_HEAP_ENABLE_FREE_CHECK 0x00000020 62 #define FLG_HEAP_VALIDATE_PARAMETERS 0x00000040 63 #define FLG_HEAP_VALIDATE_ALL 0x00000080 64 #define FLG_APPLICATION_VERIFIER 0x00000100 65 #define FLG_POOL_ENABLE_TAGGING 0x00000400 66 #define FLG_HEAP_ENABLE_TAGGING 0x00000800 67 #define FLG_USER_STACK_TRACE_DB 0x00001000 68 #define FLG_KERNEL_STACK_TRACE_DB 0x00002000 69 #define FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000 70 #define FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000 71 #define FLG_DISABLE_STACK_EXTENSION 0x00010000 72 #define FLG_ENABLE_CSRDEBUG 0x00020000 73 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000 74 #define FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000 75 #if (NTDDI_VERSION < NTDDI_WINXP) 76 #define FLG_HEAP_ENABLE_CALL_TRACING 0x00100000 78 #define FLG_ENABLE_SYSTEM_CRIT_BREAKS 0x00100000 80 #define FLG_HEAP_DISABLE_COALESCING 0x00200000 81 #define FLG_ENABLE_CLOSE_EXCEPTIONS 0x00400000 82 #define FLG_ENABLE_EXCEPTION_LOGGING 0x00800000 83 #define FLG_ENABLE_HANDLE_TYPE_TAGGING 0x01000000 84 #define FLG_HEAP_PAGE_ALLOCS 0x02000000 85 #define FLG_DEBUG_INITIAL_COMMAND_EX 0x04000000 86 #define FLG_VALID_BITS 0x07FFFFFF 91 #define PROCESS_CREATE_FLAGS_BREAKAWAY 0x00000001 92 #define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT 0x00000002 93 #define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004 94 #define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008 95 #define PROCESS_CREATE_FLAGS_LARGE_PAGES 0x00000010 96 #define PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS PROCESS_CREATE_FLAGS_LARGE_PAGES 97 #define PROCESS_CREATE_FLAGS_LEGAL_MASK (PROCESS_CREATE_FLAGS_BREAKAWAY | \ 98 PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT | \ 99 PROCESS_CREATE_FLAGS_INHERIT_HANDLES | \ 100 PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE | \ 101 PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS) 106 #define PROCESS_PRIORITY_CLASS_INVALID 0 107 #define PROCESS_PRIORITY_CLASS_IDLE 1 108 #define PROCESS_PRIORITY_CLASS_NORMAL 2 109 #define PROCESS_PRIORITY_CLASS_HIGH 3 110 #define PROCESS_PRIORITY_CLASS_REALTIME 4 111 #define PROCESS_PRIORITY_CLASS_BELOW_NORMAL 5 112 #define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL 6 117 #define PROCESS_PRIORITY_IDLE 3 118 #define PROCESS_PRIORITY_NORMAL 8 119 #define PROCESS_PRIORITY_NORMAL_FOREGROUND 9 124 #define MEMORY_PRIORITY_BACKGROUND 0 125 #define MEMORY_PRIORITY_UNKNOWN 1 126 #define MEMORY_PRIORITY_FOREGROUND 2 131 #define PSP_DEFAULT_QUANTUMS 0x00 132 #define PSP_VARIABLE_QUANTUMS 0x04 133 #define PSP_FIXED_QUANTUMS 0x08 134 #define PSP_LONG_QUANTUMS 0x10 135 #define PSP_SHORT_QUANTUMS 0x20 137 #ifndef NTOS_MODE_USER 141 #define THREAD_QUERY_INFORMATION 0x0040 142 #define THREAD_SET_THREAD_TOKEN 0x0080 143 #define THREAD_IMPERSONATE 0x0100 144 #define THREAD_DIRECT_IMPERSONATION 0x0200 149 #define PROCESS_TERMINATE 0x0001 150 #define PROCESS_CREATE_THREAD 0x0002 151 #define PROCESS_SET_SESSIONID 0x0004 152 #define PROCESS_VM_OPERATION 0x0008 153 #define PROCESS_VM_READ 0x0010 154 #define PROCESS_VM_WRITE 0x0020 155 #define PROCESS_CREATE_PROCESS 0x0080 156 #define PROCESS_SET_QUOTA 0x0100 157 #define PROCESS_SET_INFORMATION 0x0200 158 #define PROCESS_QUERY_INFORMATION 0x0400 159 #define PROCESS_SUSPEND_RESUME 0x0800 160 #define PROCESS_QUERY_LIMITED_INFORMATION 0x1000 161 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 162 #define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \ 166 #define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \ 174 #define THREAD_BASE_PRIORITY_LOWRT 15 175 #define THREAD_BASE_PRIORITY_MAX 2 176 #define THREAD_BASE_PRIORITY_MIN -2 177 #define THREAD_BASE_PRIORITY_IDLE -15 182 #define TLS_MINIMUM_AVAILABLE 64 187 #define TEB_ACTIVE_FRAME_CONTEXT_FLAG_EXTENDED 0x1 192 #define JOB_OBJECT_ASSIGN_PROCESS 0x1 193 #define JOB_OBJECT_SET_ATTRIBUTES 0x2 194 #define JOB_OBJECT_QUERY 0x4 195 #define JOB_OBJECT_TERMINATE 0x8 196 #define JOB_OBJECT_SET_SECURITY_ATTRIBUTES 0x10 197 #define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \ 204 #define JOB_OBJECT_LIMIT_WORKINGSET 0x1 205 #define JOB_OBJECT_LIMIT_PROCESS_TIME 0x2 206 #define JOB_OBJECT_LIMIT_JOB_TIME 0x4 207 #define JOB_OBJECT_LIMIT_ACTIVE_PROCESS 0x8 208 #define JOB_OBJECT_LIMIT_AFFINITY 0x10 209 #define JOB_OBJECT_LIMIT_PRIORITY_CLASS 0x20 210 #define JOB_OBJECT_LIMIT_PRESERVE_JOB_TIME 0x40 211 #define JOB_OBJECT_LIMIT_SCHEDULING_CLASS 0x80 212 #define JOB_OBJECT_LIMIT_PROCESS_MEMORY 0x100 213 #define JOB_OBJECT_LIMIT_JOB_MEMORY 0x200 214 #define JOB_OBJECT_LIMIT_DIE_ON_UNHANDLED_EXCEPTION 0x400 215 #define JOB_OBJECT_LIMIT_BREAKAWAY_OK 0x800 216 #define JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK 0x1000 217 #define JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE 0x2000 222 #define JOB_OBJECT_SECURITY_NO_ADMIN 0x0001 223 #define JOB_OBJECT_SECURITY_RESTRICTED_TOKEN 0x0002 224 #define JOB_OBJECT_SECURITY_ONLY_TOKEN 0x0004 225 #define JOB_OBJECT_SECURITY_FILTER_TOKENS 0x0008 230 #define CT_TERMINATED_BIT 0x1 231 #define CT_DEAD_THREAD_BIT 0x2 232 #define CT_HIDE_FROM_DEBUGGER_BIT 0x4 233 #define CT_ACTIVE_IMPERSONATION_INFO_BIT 0x8 234 #define CT_SYSTEM_THREAD_BIT 0x10 235 #define CT_HARD_ERRORS_ARE_DISABLED_BIT 0x20 236 #define CT_BREAK_ON_TERMINATION_BIT 0x40 237 #define CT_SKIP_CREATION_MSG_BIT 0x80 238 #define CT_SKIP_TERMINATION_MSG_BIT 0x100 243 #define STP_ACTIVE_EX_WORKER_BIT 0x1 244 #define STP_EX_WORKER_CAN_WAIT_USER_BIT 0x2 245 #define STP_MEMORY_MAKER_BIT 0x4 246 #define STP_KEYED_EVENT_IN_USE_BIT 0x8 251 #define STA_LPC_RECEIVED_MSG_ID_VALID_BIT 0x1 252 #define STA_LPC_EXIT_THREAD_CALLED_BIT 0x2 253 #define STA_ADDRESS_SPACE_OWNER_BIT 0x4 254 #define STA_OWNS_WORKING_SET_BITS 0x1F8 259 #define KPSF_AUTO_ALIGNMENT_BIT 0 260 #define KPSF_DISABLE_BOOST_BIT 1 265 #define PSF_CREATE_REPORTED_BIT 0x1 266 #define PSF_NO_DEBUG_INHERIT_BIT 0x2 267 #define PSF_PROCESS_EXITING_BIT 0x4 268 #define PSF_PROCESS_DELETE_BIT 0x8 269 #define PSF_WOW64_SPLIT_PAGES_BIT 0x10 270 #define PSF_VM_DELETED_BIT 0x20 271 #define PSF_OUTSWAP_ENABLED_BIT 0x40 272 #define PSF_OUTSWAPPED_BIT 0x80 273 #define PSF_FORK_FAILED_BIT 0x100 274 #define PSF_WOW64_VA_SPACE_4GB_BIT 0x200 275 #define PSF_ADDRESS_SPACE_INITIALIZED_BIT 0x400 276 #define PSF_SET_TIMER_RESOLUTION_BIT 0x1000 277 #define PSF_BREAK_ON_TERMINATION_BIT 0x2000 278 #define PSF_SESSION_CREATION_UNDERWAY_BIT 0x4000 279 #define PSF_WRITE_WATCH_BIT 0x8000 280 #define PSF_PROCESS_IN_SESSION_BIT 0x10000 281 #define PSF_OVERRIDE_ADDRESS_SPACE_BIT 0x20000 282 #define PSF_HAS_ADDRESS_SPACE_BIT 0x40000 283 #define PSF_LAUNCH_PREFETCHED_BIT 0x80000 284 #define PSF_INJECT_INPAGE_ERRORS_BIT 0x100000 285 #define PSF_VM_TOP_DOWN_BIT 0x200000 286 #define PSF_IMAGE_NOTIFY_DONE_BIT 0x400000 287 #define PSF_PDE_UPDATE_NEEDED_BIT 0x800000 288 #define PSF_VDM_ALLOWED_BIT 0x1000000 289 #define PSF_SWAP_ALLOWED_BIT 0x2000000 290 #define PSF_CREATE_FAILED_BIT 0x4000000 291 #define PSF_DEFAULT_IO_PRIORITY_BIT 0x8000000 296 #define PSF2_PROTECTED_BIT 0x800 302 #define TLS_EXPANSION_SLOTS 1024 304 #ifdef NTOS_MODE_USER 308 #define LOW_PRIORITY 0 309 #define LOW_REALTIME_PRIORITY 16 310 #define HIGH_PRIORITY 31 311 #define MAXIMUM_PRIORITY 32 316 #define NtCurrentProcess() ((HANDLE)(LONG_PTR)-1) 317 #define ZwCurrentProcess() NtCurrentProcess() 318 #define NtCurrentThread() ((HANDLE)(LONG_PTR)-2) 319 #define ZwCurrentThread() NtCurrentThread() 516 (
NTAPI *PKWIN32_PROCESS_CALLOUT)(
594 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 624 #define _DESCRIPTOR_TABLE_ENTRY_DEFINED 625 typedef struct _DESCRIPTOR_TABLE_ENTRY
629 } DESCRIPTOR_TABLE_ENTRY, *PDESCRIPTOR_TABLE_ENTRY;
660 #if (NTDDI_VERSION >= NTDDI_WS03) 664 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 735 #if (NTDDI_VERSION < NTDDI_WS03) 736 typedef struct _Wx86ThreadState
739 PVOID DeallocationCpu;
742 } Wx86ThreadState, *PWx86ThreadState;
836 #define EXPLICIT_32BIT 838 #undef EXPLICIT_32BIT 843 #define EXPLICIT_64BIT 845 #undef EXPLICIT_64BIT 848 #ifdef NTOS_MODE_USER 963 #ifndef NTOS_MODE_USER 983 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 986 #if (NTDDI_VERSION == NTDDI_LONGHORN) 1081 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1088 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1098 PVOID LpcReplyMessage;
1099 PVOID LpcWaitingOnPort;
1106 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1120 #if (NTDDI_VERSION < NTDDI_LONGHORN) 1121 ULONG LpcReplyMessageId;
1124 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1134 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1146 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1163 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1175 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1178 ULONG AddressSpaceOwner:1;
1186 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1196 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1199 UCHAR ForwardClusterOnly;
1203 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1235 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1243 PVOID ExceptionPort;
1248 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1273 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1296 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1322 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1365 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1368 ULONG SessionCreationUnderway:1;
1381 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1384 ULONG CreateFailed:1;
1387 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1397 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1419 #include <pshpack1.h> 1479 #if (NTDDI_VERSION >= NTDDI_WINXP) && (NTDDI_VERSION < NTDDI_WS03) 1481 #elif (NTDDI_VERSION >= NTDDI_WS03) && (NTDDI_VERSION < NTDDI_LONGHORN) 1483 #elif (NTDDI_VERSION >= NTDDI_LONGHORN) 1490 #include <poppack.h> 1658 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1663 #endif // !NTOS_MODE_USER 1669 #endif // _PSTYPES_H
KSEMAPHORE KeyedWaitSemaphore
LARGE_INTEGER WriteOperationCount
PCTEB_ACTIVE_FRAME_CONTEXT Context
PKWIN32_POWERSTATE_CALLOUT PowerStateCallout
enum _JOBOBJECTINFOCLASS JOBOBJECTINFOCLASS
struct _JOBOBJECT_EXTENDED_LIMIT_INFORMATION * PJOBOBJECT_EXTENDED_LIMIT_INFORMATION
struct _JOBOBJECT_EXTENDED_LIMIT_INFORMATION JOBOBJECT_EXTENDED_LIMIT_INFORMATION
const struct _TEB_ACTIVE_FRAME_CONTEXT * PCTEB_ACTIVE_FRAME_CONTEXT
struct _INITIAL_TEB * PINITIAL_TEB
LIST_ENTRY MmProcessLinks
NTSTATUS(NTAPI * PKWIN32_WIN32DATACOLLECTION_CALLOUT)(_In_ struct _EPROCESS *Process, _In_ PVOID Callback, _In_ PVOID Context)
HARDWARE_PTE PageDirectoryPte
LIST_ENTRY ThreadListEntry
LARGE_INTEGER ReadOperationCount
NTSTATUS(NTAPI * PKWIN32_GLOBALATOMTABLE_CALLOUT)(VOID)
struct _PROCESS_FOREGROUND_BACKGROUND PROCESS_FOREGROUND_BACKGROUND
_Must_inspect_result_ _In_ WDFIORESLIST _In_ PIO_RESOURCE_DESCRIPTOR Descriptor
PVOID Win32StartParameter
struct _WIN32_POWERSTATE_PARAMETERS * PWIN32_POWERSTATE_PARAMETERS
ULONG ReportCommitChanges
_Must_inspect_result_ _In_ WDFQUEUE _In_opt_ WDFREQUEST _In_opt_ WDFFILEOBJECT _Inout_opt_ PWDF_REQUEST_PARAMETERS Parameters
PKWIN32_SESSION_CALLOUT WindowStationOkToCloseProcedure
enum _APPCOMPAT_FLAGS APPCOMPAT_FLAGS
OB_OPEN_REASON OpenReason
SINGLE_LIST_ENTRY NextApc
EPROCESS_QUOTA_ENTRY QuotaEntry[PsQuotaTypes]
SIZE_T PeakPagedPoolUsage
struct _EPROCESS_QUOTA_ENTRY EPROCESS_QUOTA_ENTRY
ULONG OwnsSystemWorkingSetShared
PGDI_BATCHFLUSH_ROUTINE BatchFlushRoutine
LIST_ENTRY KeyedWaitChain
HANDLE InheritedFromUniqueProcessId
PPSP_RATE_APC RateControlApc
LARGE_INTEGER TotalUserTime
struct _PSP_RATE_APC PSP_RATE_APC
struct _JOBOBJECT_SECURITY_LIMIT_INFORMATION JOBOBJECT_SECURITY_LIMIT_INFORMATION
struct _CLIENT_ID64 CLIENT_ID64
PACCESS_STATE AccessState
ULONG CapturedPrivilegesLength
struct _JOBOBJECT_END_OF_JOB_TIME_INFORMATION JOBOBJECT_END_OF_JOB_TIME_INFORMATION
UCHAR SubSystemMajorVersion
ULONG NumberOfProcessIdsInList
LARGE_INTEGER ThisPeriodTotalKernelTime
struct _PS_JOB_TOKEN_FILTER * PPS_JOB_TOKEN_FILTER
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
struct _PROCESS_DEVICEMAP_INFORMATION PROCESS_DEVICEMAP_INFORMATION
struct _PROCESS_ACCESS_TOKEN * PPROCESS_ACCESS_TOKEN
struct _JOBOBJECT_SECURITY_LIMIT_INFORMATION * PJOBOBJECT_SECURITY_LIMIT_INFORMATION
EX_RUNDOWN_REF RundownProtect
struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS WIN32_OKAYTOCLOSEMETHOD_PARAMETERS
PFN_NUMBER NumberOfPrivatePages
PSID_AND_ATTRIBUTES CapturedSids
struct _POOLED_USAGE_AND_LIMITS POOLED_USAGE_AND_LIMITS
ULONG LpcReceivedMessageId
SIZE_T QuotaUsage[PsQuotaTypes]
NTSTATUS(NTAPI * PKWIN32_THREAD_CALLOUT)(_In_ struct _ETHREAD *Thread, _In_ PSW32THREADCALLOUTTYPE Type)
struct JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION
LIST_ENTRY ActiveTimerListHead
ULONG TotalTerminatedProcesses
NTSTATUS(NTAPI * PKWIN32_POWERSTATE_CALLOUT)(_In_ struct _WIN32_POWERSTATE_PARAMETERS *Parameters)
struct _JOBOBJECT_END_OF_JOB_TIME_INFORMATION PJOBOBJECT_END_OF_JOB_TIME_INFORMATION
PKWIN32_POWEREVENT_CALLOUT PowerEventCallout
NTSTATUS(NTAPI * PKWIN32_JOB_CALLOUT)(_In_ struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters)
PFN_NUMBER NumberOfLockedPages
struct _WIN32_POWERSTATE_PARAMETERS WIN32_POWERSTATE_PARAMETERS
ULONG ProcessVerifierTarget
struct _PROCESS_DEVICEMAP_INFORMATION * PPROCESS_DEVICEMAP_INFORMATION
KPROCESSOR_MODE AccessMode
ULONG CapturedGroupsLength
PKWIN32_THREAD_CALLOUT ThreadCallout
struct _PEB_FREE_BLOCK * PPEB_FREE_BLOCK
struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS * PWIN32_OKAYTOCLOSEMETHOD_PARAMETERS
ULONGLONG WriteTransferCount
struct _TERMINATION_PORT * Next
struct _CLIENT_ID32 * PCLIENT_ID32
struct _INITIAL_PEB INITIAL_PEB
struct _WIN32_POWEREVENT_PARAMETERS WIN32_POWEREVENT_PARAMETERS
ULONG PeakProcessMemoryUsed
VOID(NTAPI * PPEBLOCKROUTINE)(PVOID PebLock)
struct _TERMINATION_PORT * PTERMINATION_PORT
enum _SYSTEM_POWER_STATE SYSTEM_POWER_STATE
NTSTATUS LastThreadExitStatus
NTSTATUS(NTAPI * PKWIN32_SESSION_CALLOUT)(_In_ PVOID Parameter)
PKWIN32_SESSION_CALLOUT DesktopCloseProcedure
ULONG_PTR HardwareTrigger
PKSTART_ROUTINE StartAddress
SIZE_T PeakNonPagedPoolUsage
struct _APPHELP_CACHE_SERVICE_LOOKUP * PAPPHELP_CACHE_SERVICE_LOOKUP
_APPHELPCACHESERVICECLASS
struct _ETHREAD * ReaperLink
struct _WIN32_JOBCALLOUT_PARAMETERS * PWIN32_JOBCALLOUT_PARAMETERS
PKWIN32_SESSION_CALLOUT WindowStationDeleteProcedure
ULONG OwnsSessionWorkingSetShared
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
PPS_IMPERSONATION_INFORMATION ImpersonationInfo
KSTART_ROUTINE * PKSTART_ROUTINE
struct _WIN32_CALLOUTS_FPNS WIN32_CALLOUTS_FPNS
const struct _TEB_ACTIVE_FRAME_EX * PCTEB_ACTIVE_FRAME_EX
struct JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION * PJOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION
KSEMAPHORE AlpcWaitSemaphore
enum _SECURITY_IMPERSONATION_LEVEL SECURITY_IMPERSONATION_LEVEL
typedef NTSTATUS(NTAPI *PKWIN32_PROCESS_CALLOUT)(_In_ struct _EPROCESS *Process
ULONG OwnsSessionWorkingSetExclusive
enum _PROCESSINFOCLASS PROCESSINFOCLASS
struct _WIN32_JOBCALLOUT_PARAMETERS WIN32_JOBCALLOUT_PARAMETERS
ULONGLONG ReadTransferCount
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
struct _PROCESS_ACCESS_TOKEN PROCESS_ACCESS_TOKEN
BOOLEAN ReadImageFileExecOptions
PKWIN32_JOB_CALLOUT JobCallout
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
VOID(NTAPI * PLEGO_NOTIFY_ROUTINE)(_In_ PKTHREAD Thread)
BOOLEAN ImageUsesLargePages
TEB_ACTIVE_FRAME BasicFrame
NTSTATUS(NTAPI * PPOST_PROCESS_INIT_ROUTINE)(VOID)
ULONG SameThreadPassiveFlags
LARGE_INTEGER OtherTransferCount
ULONG ReportPhysicalPageChanges
LIST_ENTRY ProcessListHead
struct _WIN32_CLOSEMETHOD_PARAMETERS * PWIN32_CLOSEMETHOD_PARAMETERS
struct _TEB_ACTIVE_FRAME_EX * PTEB_ACTIVE_FRAME_EX
LARGE_INTEGER ThisPeriodTotalUserTime
PKWIN32_SESSION_CALLOUT DesktopOkToCloseProcedure
LIST_ENTRY ThreadListHead
enum _PSW32THREADCALLOUTTYPE PSW32THREADCALLOUTTYPE
ULONG NumberOfAssignedProcesses
LARGE_INTEGER PerProcessUserTimeLimit
PKWIN32_SESSION_CALLOUT DesktopDeleteProcedure
struct _TERMINATION_PORT * TerminationPort
ULONG UIRestrictionsClass
TEB_ACTIVE_FRAME_CONTEXT BasicContext
struct _TEB_ACTIVE_FRAME_CONTEXT_EX * PTEB_ACTIVE_FRAME_CONTEXT_EX
EX_PUSH_LOCK AddressCreationLock
struct _JOBOBJECT_BASIC_PROCESS_ID_LIST * PJOBOBJECT_BASIC_PROCESS_ID_LIST
SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo
ULONG CurrentJobMemoryUsed
struct _PAGEFAULT_HISTORY * PPAGEFAULT_HISTORY
LIST_ENTRY SessionProcessLinks
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
struct _WIN32_PARSEMETHOD_PARAMETERS WIN32_PARSEMETHOD_PARAMETERS
struct _WIN32_DELETEMETHOD_PARAMETERS * PWIN32_DELETEMETHOD_PARAMETERS
struct _TEB_ACTIVE_FRAME * PTEB_ACTIVE_FRAME
ULONG AlpcReceiveAttributeSet
enum _THREADINFOCLASS THREADINFOCLASS
UCHAR SubSystemMinorVersion
struct _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION * PJOBOBJECT_BASIC_ACCOUNTING_INFORMATION
struct _TEB_ACTIVE_FRAME_CONTEXT_EX TEB_ACTIVE_FRAME_CONTEXT_EX
ULONG MaximumWorkingSetSize
struct _PROCESS_FOREGROUND_BACKGROUND * PPROCESS_FOREGROUND_BACKGROUND
EX_PUSH_LOCK MemoryLimitsLock
ULONG ExitProcessReported
SIZE_T QuotaPeak[PsQuotaTypes]
struct _EPROCESS_QUOTA_ENTRY * PEPROCESS_QUOTA_ENTRY
struct _POOLED_USAGE_AND_LIMITS * PPOOLED_USAGE_AND_LIMITS
PKWIN32_GLOBALATOMTABLE_CALLOUT GlobalAtomTableCallout
struct _WIN32_POWEREVENT_PARAMETERS * PWIN32_POWEREVENT_PARAMETERS
struct _EPROCESS EPROCESS
PKWIN32_SESSION_CALLOUT WindowStationCloseProcedure
_APPCOMPAT_USERFLAGS_HIGHPART
struct _THREAD_BASIC_INFORMATION THREAD_BASIC_INFORMATION
struct _JOB_SET_ARRAY JOB_SET_ARRAY
struct _TEB_ACTIVE_FRAME_EX TEB_ACTIVE_FRAME_EX
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
enum _POWERSTATETASK POWERSTATETASK
struct _PS_JOB_TOKEN_FILTER PS_JOB_TOKEN_FILTER
PSPOWEREVENTTYPE EventNumber
NTSTATUS(NTAPI * PKWIN32_POWEREVENT_CALLOUT)(_In_ struct _WIN32_POWEREVENT_PARAMETERS *Parameters)
struct _WIN32_CLOSEMETHOD_PARAMETERS WIN32_CLOSEMETHOD_PARAMETERS
enum _PSPOWEREVENTTYPE PSPOWEREVENTTYPE
ULONG ActiveImpersonationInfo
struct _PAGEFAULT_HISTORY PAGEFAULT_HISTORY
LARGE_INTEGER WriteTransferCount
ULONGLONG TargetGEneration
PLUID_AND_ATTRIBUTES CapturedPrivileges
PEPROCESS_QUOTA_BLOCK QuotaBlock
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
LARGE_INTEGER PerJobUserTimeLimit
PKWIN32_SESSION_CALLOUT DesktopOpenProcedure
LARGE_INTEGER TotalKernelTime
LIST_ENTRY ActiveProcessLinks
PSID_AND_ATTRIBUTES CapturedGroups
PSECURITY_QUALITY_OF_SERVICE SecurityQos
PPS_JOB_TOKEN_FILTER Filter
EX_FAST_REF PrefetchTrace
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
EX_RUNDOWN_REF RundownProtect
PDEVICE_OBJECT DeviceToVerify
ULONGLONG OtherOperationCount
ULONG OwnsSystemWorkingSetExclusive
PVOID ExtensionIdentifier
PPAGEFAULT_HISTORY WorkingSetWatch
struct _PS_IMPERSONATION_INFORMATION PS_IMPERSONATION_INFORMATION
PROCESS_WS_WATCH_INFORMATION WatchInfo[1]
NTSTATUS(NTAPI * PGDI_BATCHFLUSH_ROUTINE)(VOID)
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
struct _EPROCESS_QUOTA_BLOCK EPROCESS_QUOTA_BLOCK
_In_ WDFINTERRUPT _In_ PFN_WDF_INTERRUPT_SYNCHRONIZE Callback
enum _OB_OPEN_REASON OB_OPEN_REASON
ULONG_PTR ProcessIdList[1]
SYSTEM_POWER_STATE MinSystemState
const struct _TEB_ACTIVE_FRAME * PCTEB_ACTIVE_FRAME
struct _INITIAL_PEB * PINITIAL_PEB
PHANDLE_TABLE ObjectTable
PMM_AVL_TABLE PhysicalVadRoot
ULONG OverrideAddressSpace
NTSTATUS(NTAPI * PKWIN32_DELETEMETHOD_CALLOUT)(_In_ struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters)
struct _WIN32_DELETEMETHOD_PARAMETERS WIN32_DELETEMETHOD_PARAMETERS
ULONGLONG OtherTransferCount
ULONG LpcExitThreadCalled
LIST_ENTRY AlpcWaitListEntry
enum _PSW32JOBCALLOUTTYPE PSW32JOBCALLOUTTYPE
struct _JOBOBJECT_ASSOCIATE_COMPLETION_PORT JOBOBJECT_ASSOCIATE_COMPLETION_PORT
struct _TEB_ACTIVE_FRAME_CONTEXT * PTEB_ACTIVE_FRAME_CONTEXT
struct _TEB_ACTIVE_FRAME * Previous
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
KPROCESSOR_MODE PreviousMode
struct _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION JOBOBJECT_BASIC_ACCOUNTING_INFORMATION
ULONG MinimumWorkingSetSize
ULONG UIRestrictionsClass
struct _WIN32_CALLOUTS_FPNS * PWIN32_CALLOUTS_FPNS
NTSTATUS(NTAPI * PKWIN32_CLOSEMETHOD_CALLOUT)(_In_ struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters)
struct _CLIENT_ID64 * PCLIENT_ID64
struct _JOBOBJECT_ASSOCIATE_COMPLETION_PORT * PJOBOBJECT_ASSOCIATE_COMPLETION_PORT
enum _APPHELPCACHESERVICECLASS APPHELPCACHESERVICECLASS
ULONG TotalPageFaultCount
ULONG OwnsProcessWorkingSetShared
struct _APPHELP_CACHE_SERVICE_LOOKUP APPHELP_CACHE_SERVICE_LOOKUP
ULONG CapturedPrivilegeCount
PETHREAD RotateInProgress
struct _JOBOBJECT_BASIC_LIMIT_INFORMATION JOBOBJECT_BASIC_LIMIT_INFORMATION
NTSTATUS(NTAPI * PKWIN32_OPENMETHOD_CALLOUT)(_In_ struct _WIN32_OPENMETHOD_PARAMETERS *Parameters)
struct _EPROCESS_QUOTA_BLOCK * PEPROCESS_QUOTA_BLOCK
ULONGLONG ReadOperationCount
ULONG DefaultHardErrorProcessing
struct _WIN32_OPENMETHOD_PARAMETERS WIN32_OPENMETHOD_PARAMETERS
struct _THREAD_BASIC_INFORMATION * PTHREAD_BASIC_INFORMATION
LARGE_INTEGER OtherOperationCount
LARGE_INTEGER ReadTransferCount
const struct _TEB_ACTIVE_FRAME_CONTEXT_EX * PCTEB_ACTIVE_FRAME_CONTEXT_EX
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
ULONG DefaultPagePriority
struct tagContext Context
ULONGLONG WriteOperationCount
struct _WIN32_OPENMETHOD_PARAMETERS * PWIN32_OPENMETHOD_PARAMETERS
PSW32JOBCALLOUTTYPE CalloutType
struct _INITIAL_TEB INITIAL_TEB
PKWIN32_SESSION_CALLOUT WindowStationOpenProcedure
struct _JOBOBJECT_BASIC_PROCESS_ID_LIST JOBOBJECT_BASIC_PROCESS_ID_LIST
ULONG PriorityRegionActive
struct _PS_IMPERSONATION_INFORMATION * PPS_IMPERSONATION_INFORMATION
ULONG OwnsProcessWorkingSetExclusive
struct _JOBOBJECT_BASIC_LIMIT_INFORMATION * PJOBOBJECT_BASIC_LIMIT_INFORMATION
POWERSTATETASK PowerStateTask
NTSTATUS(NTAPI * PKWIN32_OKTOCLOSEMETHOD_CALLOUT)(_In_ struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters)
PUNICODE_STRING RemainingName
ULONG ExWorkerCanWaitUser
enum _PSPROCESSPRIORITYMODE PSPROCESSPRIORITYMODE
PKWIN32_SESSION_CALLOUT WindowStationParseProcedure
enum _APPCOMPAT_USERFLAGS APPCOMPAT_USERFLAGS
ULONG AddressSpaceInitialized
UCHAR DisablePageFaultClustering
PKWIN32_PROCESS_CALLOUT ProcessCallout
struct _WIN32_PARSEMETHOD_PARAMETERS * PWIN32_PARSEMETHOD_PARAMETERS
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK GrantedAccess
struct _CLIENT_ID32 CLIENT_ID32
ULONG HardErrorsAreDisabled
struct _PEB_FREE_BLOCK * Next
struct _PSP_RATE_APC * PPSP_RATE_APC
_Out_ PUNICODE_STRING CompleteName
enum _APPCOMPAT_USERFLAGS_HIGHPART APPCOMPAT_USERFLAGS_HIGHPART
struct _JOBOBJECT_BASIC_UI_RESTRICTIONS * PJOBOBJECT_BASIC_UI_RESTRICTIONS
enum _PS_QUOTA_TYPE PS_QUOTA_TYPE
POWER_ACTION SystemAction
struct _TERMINATION_PORT TERMINATION_PORT
struct _JOBOBJECT_BASIC_UI_RESTRICTIONS JOBOBJECT_BASIC_UI_RESTRICTIONS
struct _PEB_FREE_BLOCK PEB_FREE_BLOCK
PKWIN32_WIN32DATACOLLECTION_CALLOUT Win32DataCollectionProcedure
POBJECT_TYPE NTSYSAPI PsJobType
BOOLEAN IsProtectedProcess
struct _TEB_ACTIVE_FRAME_CONTEXT TEB_ACTIVE_FRAME_CONTEXT
struct _TEB_ACTIVE_FRAME TEB_ACTIVE_FRAME
ULONG LpcReceivedMsgIdValid
BOOLEAN InheritedAddressSpace
PFN_NUMBER WorkingSetPage
C_ASSERT(sizeof(PROCESS_PRIORITY_CLASS)==2)
struct _JOB_SET_ARRAY * PJOB_SET_ARRAY
NTSTATUS(NTAPI * PKWIN32_PARSEMETHOD_CALLOUT)(_In_ struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters)
KSPIN_LOCK ActiveTimerListLock