51#define USER_SHARED_DATA (0x7FFE0000)
56#define FLG_STOP_ON_EXCEPTION 0x00000001
57#define FLG_SHOW_LDR_SNAPS 0x00000002
58#define FLG_DEBUG_INITIAL_COMMAND 0x00000004
59#define FLG_STOP_ON_HUNG_GUI 0x00000008
60#define FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010
61#define FLG_HEAP_ENABLE_FREE_CHECK 0x00000020
62#define FLG_HEAP_VALIDATE_PARAMETERS 0x00000040
63#define FLG_HEAP_VALIDATE_ALL 0x00000080
64#define FLG_APPLICATION_VERIFIER 0x00000100
65#define FLG_POOL_ENABLE_TAGGING 0x00000400
66#define FLG_HEAP_ENABLE_TAGGING 0x00000800
67#define FLG_USER_STACK_TRACE_DB 0x00001000
68#define FLG_KERNEL_STACK_TRACE_DB 0x00002000
69#define FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000
70#define FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000
71#define FLG_DISABLE_STACK_EXTENSION 0x00010000
72#define FLG_ENABLE_CSRDEBUG 0x00020000
73#define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000
74#define FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000
75#if (NTDDI_VERSION < NTDDI_WINXP)
76#define FLG_HEAP_ENABLE_CALL_TRACING 0x00100000
78#define FLG_ENABLE_SYSTEM_CRIT_BREAKS 0x00100000
80#define FLG_HEAP_DISABLE_COALESCING 0x00200000
81#define FLG_ENABLE_CLOSE_EXCEPTIONS 0x00400000
82#define FLG_ENABLE_EXCEPTION_LOGGING 0x00800000
83#define FLG_ENABLE_HANDLE_TYPE_TAGGING 0x01000000
84#define FLG_HEAP_PAGE_ALLOCS 0x02000000
85#define FLG_DEBUG_INITIAL_COMMAND_EX 0x04000000
86#define FLG_DISABLE_DEBUG_PROMPTS 0x08000000
87#define FLG_VALID_BITS 0x0FFFFFFF
92#define PROCESS_CREATE_FLAGS_BREAKAWAY 0x00000001
93#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT 0x00000002
94#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004
95#define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008
96#define PROCESS_CREATE_FLAGS_LARGE_PAGES 0x00000010
97#define PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS PROCESS_CREATE_FLAGS_LARGE_PAGES
98#define PROCESS_CREATE_FLAGS_LEGAL_MASK (PROCESS_CREATE_FLAGS_BREAKAWAY | \
99 PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT | \
100 PROCESS_CREATE_FLAGS_INHERIT_HANDLES | \
101 PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE | \
102 PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS)
107#define PROCESS_PRIORITY_CLASS_INVALID 0
108#define PROCESS_PRIORITY_CLASS_IDLE 1
109#define PROCESS_PRIORITY_CLASS_NORMAL 2
110#define PROCESS_PRIORITY_CLASS_HIGH 3
111#define PROCESS_PRIORITY_CLASS_REALTIME 4
112#define PROCESS_PRIORITY_CLASS_BELOW_NORMAL 5
113#define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL 6
118#define PROCESS_PRIORITY_IDLE 3
119#define PROCESS_PRIORITY_NORMAL 8
120#define PROCESS_PRIORITY_NORMAL_FOREGROUND 9
125#define MEMORY_PRIORITY_BACKGROUND 0
126#define MEMORY_PRIORITY_UNKNOWN 1
127#define MEMORY_PRIORITY_FOREGROUND 2
132#define PSP_DEFAULT_QUANTUMS 0x00
133#define PSP_VARIABLE_QUANTUMS 0x04
134#define PSP_FIXED_QUANTUMS 0x08
135#define PSP_LONG_QUANTUMS 0x10
136#define PSP_SHORT_QUANTUMS 0x20
141#define PROCESS_HANDLE_TRACE_TYPE_OPEN 1
142#define PROCESS_HANDLE_TRACE_TYPE_CLOSE 2
143#define PROCESS_HANDLE_TRACE_TYPE_BADREF 3
144#define PROCESS_HANDLE_TRACING_MAX_STACKS 16
146#ifndef NTOS_MODE_USER
150#define THREAD_QUERY_INFORMATION 0x0040
151#define THREAD_SET_THREAD_TOKEN 0x0080
152#define THREAD_IMPERSONATE 0x0100
153#define THREAD_DIRECT_IMPERSONATION 0x0200
158#define PROCESS_TERMINATE 0x0001
159#define PROCESS_CREATE_THREAD 0x0002
160#define PROCESS_SET_SESSIONID 0x0004
161#define PROCESS_VM_OPERATION 0x0008
162#define PROCESS_VM_READ 0x0010
163#define PROCESS_VM_WRITE 0x0020
164#define PROCESS_CREATE_PROCESS 0x0080
165#define PROCESS_SET_QUOTA 0x0100
166#define PROCESS_SET_INFORMATION 0x0200
167#define PROCESS_QUERY_INFORMATION 0x0400
168#define PROCESS_SUSPEND_RESUME 0x0800
169#define PROCESS_QUERY_LIMITED_INFORMATION 0x1000
170#if (NTDDI_VERSION >= NTDDI_LONGHORN)
171#define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
175#define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
183#define THREAD_BASE_PRIORITY_LOWRT 15
184#define THREAD_BASE_PRIORITY_MAX 2
185#define THREAD_BASE_PRIORITY_MIN -2
186#define THREAD_BASE_PRIORITY_IDLE -15
191#define TLS_MINIMUM_AVAILABLE 64
196#define TEB_ACTIVE_FRAME_CONTEXT_FLAG_EXTENDED 0x1
201#define JOB_OBJECT_ASSIGN_PROCESS 0x1
202#define JOB_OBJECT_SET_ATTRIBUTES 0x2
203#define JOB_OBJECT_QUERY 0x4
204#define JOB_OBJECT_TERMINATE 0x8
205#define JOB_OBJECT_SET_SECURITY_ATTRIBUTES 0x10
206#define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
213#define JOB_OBJECT_LIMIT_WORKINGSET 0x1
214#define JOB_OBJECT_LIMIT_PROCESS_TIME 0x2
215#define JOB_OBJECT_LIMIT_JOB_TIME 0x4
216#define JOB_OBJECT_LIMIT_ACTIVE_PROCESS 0x8
217#define JOB_OBJECT_LIMIT_AFFINITY 0x10
218#define JOB_OBJECT_LIMIT_PRIORITY_CLASS 0x20
219#define JOB_OBJECT_LIMIT_PRESERVE_JOB_TIME 0x40
220#define JOB_OBJECT_LIMIT_SCHEDULING_CLASS 0x80
221#define JOB_OBJECT_LIMIT_PROCESS_MEMORY 0x100
222#define JOB_OBJECT_LIMIT_JOB_MEMORY 0x200
223#define JOB_OBJECT_LIMIT_DIE_ON_UNHANDLED_EXCEPTION 0x400
224#define JOB_OBJECT_LIMIT_BREAKAWAY_OK 0x800
225#define JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK 0x1000
226#define JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE 0x2000
231#define JOB_OBJECT_SECURITY_NO_ADMIN 0x0001
232#define JOB_OBJECT_SECURITY_RESTRICTED_TOKEN 0x0002
233#define JOB_OBJECT_SECURITY_ONLY_TOKEN 0x0004
234#define JOB_OBJECT_SECURITY_FILTER_TOKENS 0x0008
239#define CT_TERMINATED_BIT 0x1
240#define CT_DEAD_THREAD_BIT 0x2
241#define CT_HIDE_FROM_DEBUGGER_BIT 0x4
242#define CT_ACTIVE_IMPERSONATION_INFO_BIT 0x8
243#define CT_SYSTEM_THREAD_BIT 0x10
244#define CT_HARD_ERRORS_ARE_DISABLED_BIT 0x20
245#define CT_BREAK_ON_TERMINATION_BIT 0x40
246#define CT_SKIP_CREATION_MSG_BIT 0x80
247#define CT_SKIP_TERMINATION_MSG_BIT 0x100
252#define STP_ACTIVE_EX_WORKER_BIT 0x1
253#define STP_EX_WORKER_CAN_WAIT_USER_BIT 0x2
254#define STP_MEMORY_MAKER_BIT 0x4
255#define STP_KEYED_EVENT_IN_USE_BIT 0x8
260#define STA_LPC_RECEIVED_MSG_ID_VALID_BIT 0x1
261#define STA_LPC_EXIT_THREAD_CALLED_BIT 0x2
262#define STA_ADDRESS_SPACE_OWNER_BIT 0x4
263#define STA_OWNS_WORKING_SET_BITS 0x1F8
268#define KPSF_AUTO_ALIGNMENT_BIT 0
269#define KPSF_DISABLE_BOOST_BIT 1
274#define PSF_CREATE_REPORTED_BIT 0x1
275#define PSF_NO_DEBUG_INHERIT_BIT 0x2
276#define PSF_PROCESS_EXITING_BIT 0x4
277#define PSF_PROCESS_DELETE_BIT 0x8
278#define PSF_WOW64_SPLIT_PAGES_BIT 0x10
279#define PSF_VM_DELETED_BIT 0x20
280#define PSF_OUTSWAP_ENABLED_BIT 0x40
281#define PSF_OUTSWAPPED_BIT 0x80
282#define PSF_FORK_FAILED_BIT 0x100
283#define PSF_WOW64_VA_SPACE_4GB_BIT 0x200
284#define PSF_ADDRESS_SPACE_INITIALIZED_BIT 0x400
285#define PSF_SET_TIMER_RESOLUTION_BIT 0x1000
286#define PSF_BREAK_ON_TERMINATION_BIT 0x2000
287#define PSF_SESSION_CREATION_UNDERWAY_BIT 0x4000
288#define PSF_WRITE_WATCH_BIT 0x8000
289#define PSF_PROCESS_IN_SESSION_BIT 0x10000
290#define PSF_OVERRIDE_ADDRESS_SPACE_BIT 0x20000
291#define PSF_HAS_ADDRESS_SPACE_BIT 0x40000
292#define PSF_LAUNCH_PREFETCHED_BIT 0x80000
293#define PSF_INJECT_INPAGE_ERRORS_BIT 0x100000
294#define PSF_VM_TOP_DOWN_BIT 0x200000
295#define PSF_IMAGE_NOTIFY_DONE_BIT 0x400000
296#define PSF_PDE_UPDATE_NEEDED_BIT 0x800000
297#define PSF_VDM_ALLOWED_BIT 0x1000000
298#define PSF_SWAP_ALLOWED_BIT 0x2000000
299#define PSF_CREATE_FAILED_BIT 0x4000000
300#define PSF_DEFAULT_IO_PRIORITY_BIT 0x8000000
305#define PSF2_PROTECTED_BIT 0x800
311#define TLS_EXPANSION_SLOTS 1024
317#define LOW_PRIORITY 0
318#define LOW_REALTIME_PRIORITY 16
319#define HIGH_PRIORITY 31
320#define MAXIMUM_PRIORITY 32
325#define NtCurrentProcess() ((HANDLE)(LONG_PTR)-1)
326#define ZwCurrentProcess() NtCurrentProcess()
327#define NtCurrentThread() ((HANDLE)(LONG_PTR)-2)
328#define ZwCurrentThread() NtCurrentThread()
603#if (NTDDI_VERSION >= NTDDI_LONGHORN)
633#define _DESCRIPTOR_TABLE_ENTRY_DEFINED
634typedef struct _DESCRIPTOR_TABLE_ENTRY
638} DESCRIPTOR_TABLE_ENTRY, *PDESCRIPTOR_TABLE_ENTRY;
669#if (NTDDI_VERSION >= NTDDI_WS03)
673#if (NTDDI_VERSION >= NTDDI_LONGHORN)
744#if (NTDDI_VERSION < NTDDI_WS03)
745typedef struct _Wx86ThreadState
748 PVOID DeallocationCpu;
751} Wx86ThreadState, *PWx86ThreadState;
845#define EXPLICIT_32BIT
852#define EXPLICIT_64BIT
1005#ifndef NTOS_MODE_USER
1025#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1028#if (NTDDI_VERSION == NTDDI_LONGHORN)
1123#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1130#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1140 PVOID LpcReplyMessage;
1141 PVOID LpcWaitingOnPort;
1148#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1162#if (NTDDI_VERSION < NTDDI_LONGHORN)
1163 ULONG LpcReplyMessageId;
1166#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1176#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1188#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1205#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1217#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1220 ULONG AddressSpaceOwner:1;
1228#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1238#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1241 UCHAR ForwardClusterOnly;
1245#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1277#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1285 PVOID ExceptionPort;
1290#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1315#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1338#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1364#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1407#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1410 ULONG SessionCreationUnderway:1;
1423#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1426 ULONG CreateFailed:1;
1429#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1439#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1461#include <pshpack1.h>
1521#if (NTDDI_VERSION >= NTDDI_WINXP) && (NTDDI_VERSION < NTDDI_WS03)
1523#elif (NTDDI_VERSION >= NTDDI_WS03) && (NTDDI_VERSION < NTDDI_LONGHORN)
1525#elif (NTDDI_VERSION >= NTDDI_LONGHORN)
1700#if (NTDDI_VERSION >= NTDDI_LONGHORN)
@ ThreadEnableAlignmentFaultFixup
@ ThreadDescriptorTableEntry
@ ThreadEventPair_Reusable
@ ThreadActualBasePriority
@ ThreadSwitchLegacyState
@ ThreadQuerySetWin32StartAddress
@ ThreadBreakOnTermination
@ ThreadImpersonationToken
@ ThreadSetTlsArrayAddress
enum _THREADINFOCLASS THREADINFOCLASS
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
struct _PAGEFAULT_HISTORY * PPAGEFAULT_HISTORY
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
struct _WIN32_JOBCALLOUT_PARAMETERS WIN32_JOBCALLOUT_PARAMETERS
struct _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION * PJOBOBJECT_BASIC_ACCOUNTING_INFORMATION
struct _EPROCESS EPROCESS
struct _INITIAL_TEB INITIAL_TEB
const struct _TEB_ACTIVE_FRAME_CONTEXT * PCTEB_ACTIVE_FRAME_CONTEXT
@ PsW32PowerPolicyChanged
@ PsW32GdiPrepareResumeUI
@ PsW32CapabilitiesChanged
struct _WIN32_CLOSEMETHOD_PARAMETERS * PWIN32_CLOSEMETHOD_PARAMETERS
struct _JOBOBJECT_END_OF_JOB_TIME_INFORMATION PJOBOBJECT_END_OF_JOB_TIME_INFORMATION
enum _APPCOMPAT_USERFLAGS_HIGHPART APPCOMPAT_USERFLAGS_HIGHPART
struct _TERMINATION_PORT * PTERMINATION_PORT
NTSTATUS(NTAPI * PKWIN32_SESSION_CALLOUT)(_In_ PVOID Parameter)
struct _EPROCESS_QUOTA_ENTRY * PEPROCESS_QUOTA_ENTRY
struct _JOBOBJECT_BASIC_UI_RESTRICTIONS JOBOBJECT_BASIC_UI_RESTRICTIONS
struct _THREAD_BASIC_INFORMATION THREAD_BASIC_INFORMATION
struct _PS_JOB_TOKEN_FILTER PS_JOB_TOKEN_FILTER
struct _TERMINATION_PORT TERMINATION_PORT
_APPCOMPAT_USERFLAGS_HIGHPART
@ ReorderWaveForCommunications
@ DisableWindowArrangement
struct _PSP_RATE_APC * PPSP_RATE_APC
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
VOID(NTAPI * PLEGO_NOTIFY_ROUTINE)(_In_ PKTHREAD Thread)
struct _PS_IMPERSONATION_INFORMATION * PPS_IMPERSONATION_INFORMATION
struct _PAGEFAULT_HISTORY PAGEFAULT_HISTORY
const struct _TEB_ACTIVE_FRAME * PCTEB_ACTIVE_FRAME
NTSTATUS(NTAPI * PKWIN32_PROCESS_CALLOUT)(_In_ struct _EPROCESS *Process, _In_ BOOLEAN Create)
struct _EPROCESS_QUOTA_BLOCK * PEPROCESS_QUOTA_BLOCK
struct _CLIENT_ID32 CLIENT_ID32
const struct _TEB_ACTIVE_FRAME_CONTEXT_EX * PCTEB_ACTIVE_FRAME_CONTEXT_EX
struct _INITIAL_PEB * PINITIAL_PEB
struct _TEB_ACTIVE_FRAME_EX TEB_ACTIVE_FRAME_EX
enum _PSW32THREADCALLOUTTYPE PSW32THREADCALLOUTTYPE
struct _WIN32_POWERSTATE_PARAMETERS WIN32_POWERSTATE_PARAMETERS
struct _JOBOBJECT_BASIC_PROCESS_ID_LIST JOBOBJECT_BASIC_PROCESS_ID_LIST
@ PsW32JobCalloutTerminate
@ PsW32JobCalloutAddProcess
@ PsW32JobCalloutSetInformation
struct _WIN32_PARSEMETHOD_PARAMETERS * PWIN32_PARSEMETHOD_PARAMETERS
enum _PSW32JOBCALLOUTTYPE PSW32JOBCALLOUTTYPE
struct _WIN32_DELETEMETHOD_PARAMETERS WIN32_DELETEMETHOD_PARAMETERS
enum _JOBOBJECTINFOCLASS JOBOBJECTINFOCLASS
struct _PROCESS_LDT_INFORMATION PROCESS_LDT_INFORMATION
struct _WIN32_POWEREVENT_PARAMETERS WIN32_POWEREVENT_PARAMETERS
struct _TEB_ACTIVE_FRAME_CONTEXT * PTEB_ACTIVE_FRAME_CONTEXT
struct _TEB_ACTIVE_FRAME * PTEB_ACTIVE_FRAME
NTSTATUS(NTAPI * PKWIN32_PARSEMETHOD_CALLOUT)(_In_ struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters)
@ UserDisableForwarderPatch
@ EnableLegacyNTFSFlagsForDocfileOpens
@ DisallowCOMBindingNotifications
@ DisableMaybeNULLSizeisConsistencycheck
@ DisableAdvancedRPCrangeCheck
@ EnableLegacyExceptionHandlinginOLE
@ DisableNDRIIDConsistencyCheck
@ DisableNewWMPAINTDispatchInOLE
@ Ole32EnableAsyncDocFile
@ DisableAdvanceRPCClientHardening
@ EnableLegacyExceptionHandlingInRPC
enum _APPHELPCACHESERVICECLASS APPHELPCACHESERVICECLASS
struct _WIN32_CALLOUTS_FPNS WIN32_CALLOUTS_FPNS
struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS * PWIN32_OKAYTOCLOSEMETHOD_PARAMETERS
struct _JOBOBJECT_BASIC_LIMIT_INFORMATION * PJOBOBJECT_BASIC_LIMIT_INFORMATION
struct _WIN32_DELETEMETHOD_PARAMETERS * PWIN32_DELETEMETHOD_PARAMETERS
struct _TEB_ACTIVE_FRAME TEB_ACTIVE_FRAME
struct _CLIENT_ID64 CLIENT_ID64
NTSTATUS(NTAPI * PKWIN32_JOB_CALLOUT)(_In_ struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters)
enum _PSPROCESSPRIORITYMODE PSPROCESSPRIORITYMODE
struct _CLIENT_ID32 * PCLIENT_ID32
struct _JOBOBJECT_SECURITY_LIMIT_INFORMATION JOBOBJECT_SECURITY_LIMIT_INFORMATION
struct _PROCESS_LDT_SIZE PROCESS_LDT_SIZE
struct _WIN32_JOBCALLOUT_PARAMETERS * PWIN32_JOBCALLOUT_PARAMETERS
struct _APPHELP_CACHE_SERVICE_LOOKUP APPHELP_CACHE_SERVICE_LOOKUP
NTSTATUS(NTAPI * PPOST_PROCESS_INIT_ROUTINE)(VOID)
enum _APPCOMPAT_USERFLAGS APPCOMPAT_USERFLAGS
struct _JOB_SET_ARRAY * PJOB_SET_ARRAY
struct _WIN32_OPENMETHOD_PARAMETERS * PWIN32_OPENMETHOD_PARAMETERS
_APPHELPCACHESERVICECLASS
@ ApphelpCacheServiceLookup
@ ApphelpCacheServiceRemove
@ ApphelpCacheServiceUpdate
@ ApphelpCacheServiceDump
@ ApphelpDBGWriteRegistry
@ ApphelpCacheServiceFlush
struct _JOBOBJECT_BASIC_PROCESS_ID_LIST * PJOBOBJECT_BASIC_PROCESS_ID_LIST
struct _JOBOBJECT_END_OF_JOB_TIME_INFORMATION JOBOBJECT_END_OF_JOB_TIME_INFORMATION
struct _TEB_ACTIVE_FRAME_EX * PTEB_ACTIVE_FRAME_EX
struct _APPHELP_CACHE_SERVICE_LOOKUP * PAPPHELP_CACHE_SERVICE_LOOKUP
struct _PSP_RATE_APC PSP_RATE_APC
struct _PROCESS_LDT_SIZE * PPROCESS_LDT_SIZE
NTSTATUS(NTAPI * PKWIN32_OPENMETHOD_CALLOUT)(_In_ struct _WIN32_OPENMETHOD_PARAMETERS *Parameters)
struct JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION * PJOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION
@ PsProcessPrioritySpinning
@ PsProcessPriorityForeground
@ PsProcessPriorityBackground
enum _PS_QUOTA_TYPE PS_QUOTA_TYPE
struct _EPROCESS_QUOTA_ENTRY EPROCESS_QUOTA_ENTRY
struct _INITIAL_TEB * PINITIAL_TEB
struct _WIN32_POWERSTATE_PARAMETERS * PWIN32_POWERSTATE_PARAMETERS
NTSTATUS(NTAPI * PKWIN32_GLOBALATOMTABLE_CALLOUT)(VOID)
struct _WIN32_OPENMETHOD_PARAMETERS WIN32_OPENMETHOD_PARAMETERS
@ JobObjectAssociateCompletionPortInformation
@ JobObjectBasicLimitInformation
@ JobObjectBasicAndIoAccountingInformation
@ JobObjectBasicAccountingInformation
@ JobObjectSecurityLimitInformation
@ JobObjectExtendedLimitInformation
@ JobObjectEndOfJobTimeInformation
@ JobObjectBasicUIRestrictions
@ JobObjectBasicProcessIdList
@ JobObjectJobSetInformation
struct _THREAD_BASIC_INFORMATION * PTHREAD_BASIC_INFORMATION
enum _APPCOMPAT_FLAGS APPCOMPAT_FLAGS
struct _JOBOBJECT_EXTENDED_LIMIT_INFORMATION JOBOBJECT_EXTENDED_LIMIT_INFORMATION
struct _CLIENT_ID64 * PCLIENT_ID64
struct _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION JOBOBJECT_BASIC_ACCOUNTING_INFORMATION
struct _PROCESS_LDT_INFORMATION * PPROCESS_LDT_INFORMATION
POBJECT_TYPE NTSYSAPI PsJobType
enum _PSPOWEREVENTTYPE PSPOWEREVENTTYPE
@ No50StylebitsInSetWindowLong
@ EnableTransparantBltMirror
@ No50StylebitsInCreateWindow
@ NoTryExceptForWindowProc
@ DisableSWCursorOnMoveSize
@ NoDDETerminateDuringDestroy
@ NoTimerCallbackProtection
@ NoInitInsertReplaceFlags
struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS WIN32_OKAYTOCLOSEMETHOD_PARAMETERS
struct _TEB_ACTIVE_FRAME_CONTEXT TEB_ACTIVE_FRAME_CONTEXT
struct _WIN32_CLOSEMETHOD_PARAMETERS WIN32_CLOSEMETHOD_PARAMETERS
@ PsW32ThreadCalloutInitialize
NTSTATUS(NTAPI * PKWIN32_WIN32DATACOLLECTION_CALLOUT)(_In_ struct _EPROCESS *Process, _In_ PVOID Callback, _In_ PVOID Context)
struct _JOBOBJECT_BASIC_LIMIT_INFORMATION JOBOBJECT_BASIC_LIMIT_INFORMATION
NTSTATUS(NTAPI * PKWIN32_POWERSTATE_CALLOUT)(_In_ struct _WIN32_POWERSTATE_PARAMETERS *Parameters)
struct _JOBOBJECT_SECURITY_LIMIT_INFORMATION * PJOBOBJECT_SECURITY_LIMIT_INFORMATION
NTSTATUS(NTAPI * PKWIN32_POWEREVENT_CALLOUT)(_In_ struct _WIN32_POWEREVENT_PARAMETERS *Parameters)
const struct _TEB_ACTIVE_FRAME_EX * PCTEB_ACTIVE_FRAME_EX
struct _PS_JOB_TOKEN_FILTER * PPS_JOB_TOKEN_FILTER
VOID(NTAPI * PPEBLOCKROUTINE)(PVOID PebLock)
struct _JOBOBJECT_EXTENDED_LIMIT_INFORMATION * PJOBOBJECT_EXTENDED_LIMIT_INFORMATION
struct _PEB_FREE_BLOCK PEB_FREE_BLOCK
struct _PEB_FREE_BLOCK * PPEB_FREE_BLOCK
struct _INITIAL_PEB INITIAL_PEB
NTSTATUS(NTAPI * PKWIN32_OKTOCLOSEMETHOD_CALLOUT)(_In_ struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters)
struct _TEB_ACTIVE_FRAME_CONTEXT_EX * PTEB_ACTIVE_FRAME_CONTEXT_EX
struct _JOBOBJECT_ASSOCIATE_COMPLETION_PORT * PJOBOBJECT_ASSOCIATE_COMPLETION_PORT
NTSTATUS(NTAPI * PKWIN32_DELETEMETHOD_CALLOUT)(_In_ struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters)
struct _EPROCESS_QUOTA_BLOCK EPROCESS_QUOTA_BLOCK
struct _PROCESS_FOREGROUND_BACKGROUND * PPROCESS_FOREGROUND_BACKGROUND
struct _WIN32_PARSEMETHOD_PARAMETERS WIN32_PARSEMETHOD_PARAMETERS
struct _PS_IMPERSONATION_INFORMATION PS_IMPERSONATION_INFORMATION
struct _JOB_SET_ARRAY JOB_SET_ARRAY
struct _WIN32_POWEREVENT_PARAMETERS * PWIN32_POWEREVENT_PARAMETERS
enum _POWERSTATETASK POWERSTATETASK
@ PowerState_QueryServices
@ PowerState_QueryAppsFailed
@ PowerState_ResumeServices
@ PowerState_BlockSessionSwitch
@ PowerState_UnblockInput
@ PowerState_SuspendServices
@ PowerState_UnBlockSessionSwitch
@ PowerState_QueryServicesFailed
NTSTATUS(NTAPI * PGDI_BATCHFLUSH_ROUTINE)(VOID)
struct _TEB_ACTIVE_FRAME_CONTEXT_EX TEB_ACTIVE_FRAME_CONTEXT_EX
struct _PROCESS_FOREGROUND_BACKGROUND PROCESS_FOREGROUND_BACKGROUND
NTSTATUS(NTAPI * PKWIN32_THREAD_CALLOUT)(_In_ struct _ETHREAD *Thread, _In_ PSW32THREADCALLOUTTYPE Type)
struct _JOBOBJECT_BASIC_UI_RESTRICTIONS * PJOBOBJECT_BASIC_UI_RESTRICTIONS
struct _WIN32_CALLOUTS_FPNS * PWIN32_CALLOUTS_FPNS
NTSTATUS(NTAPI * PKWIN32_CLOSEMETHOD_CALLOUT)(_In_ struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters)
struct _JOBOBJECT_ASSOCIATE_COMPLETION_PORT JOBOBJECT_ASSOCIATE_COMPLETION_PORT
@ ProcessBreakOnTermination
@ ProcessBasicInformation
@ ProcessWow64Information
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
enum _PROCESSINFOCLASS PROCESSINFOCLASS
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
@ ProcessLUIDDeviceMapsEnabled
@ ProcessMemoryAllocationMode
@ ProcessSessionInformation
@ ProcessWorkingSetWatchEx
@ ProcessInstrumentationCallback
@ ProcessImageFileMapping
@ ProcessImageInformation
@ ProcessPooledUsageAndLimits
@ ProcessImageFileNameWin32
@ ProcessDefaultHardErrorMode
@ ProcessAffinityUpdateMode
@ ProcessEnableAlignmentFaultFixup
@ ProcessThreadStackAllocation
@ ProcessForegroundInformation
@ ProcessDebugObjectHandle
struct _PROCESS_HANDLE_TRACING_ENTRY * PPROCESS_HANDLE_TRACING_ENTRY
struct _PROCESS_ACCESS_TOKEN PROCESS_ACCESS_TOKEN
struct _PROCESS_DEVICEMAP_INFORMATION PROCESS_DEVICEMAP_INFORMATION
struct _PROCESS_DEVICEMAP_INFORMATION * PPROCESS_DEVICEMAP_INFORMATION
struct _PROCESS_ACCESS_TOKEN * PPROCESS_ACCESS_TOKEN
struct _PROCESS_WS_WATCH_INFORMATION PROCESS_WS_WATCH_INFORMATION
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
#define PROCESS_HANDLE_TRACING_MAX_STACKS
struct _PROCESS_WS_WATCH_INFORMATION * PPROCESS_WS_WATCH_INFORMATION
struct _POOLED_USAGE_AND_LIMITS * PPOOLED_USAGE_AND_LIMITS
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
struct _PROCESS_HANDLE_TRACING_QUERY * PPROCESS_HANDLE_TRACING_QUERY
struct _PROCESS_HANDLE_TRACING_QUERY PROCESS_HANDLE_TRACING_QUERY
struct _PROCESS_HANDLE_TRACING_ENTRY PROCESS_HANDLE_TRACING_ENTRY
struct _POOLED_USAGE_AND_LIMITS POOLED_USAGE_AND_LIMITS
enum _SECURITY_IMPERSONATION_LEVEL SECURITY_IMPERSONATION_LEVEL
enum _OB_OPEN_REASON OB_OPEN_REASON
enum _SYSTEM_POWER_STATE SYSTEM_POWER_STATE
LARGE_INTEGER ThisPeriodTotalUserTime
ULONGLONG OtherTransferCount
LARGE_INTEGER TotalKernelTime
ULONG CurrentJobMemoryUsed
LIST_ENTRY ProcessListHead
ULONG UIRestrictionsClass
ULONGLONG OtherOperationCount
LARGE_INTEGER PerJobUserTimeLimit
ULONG PeakProcessMemoryUsed
ULONGLONG ReadTransferCount
ULONG TotalPageFaultCount
ULONG MinimumWorkingSetSize
ULONG TotalTerminatedProcesses
ULONG MaximumWorkingSetSize
LARGE_INTEGER TotalUserTime
ULONGLONG ReadOperationCount
LARGE_INTEGER ThisPeriodTotalKernelTime
ULONGLONG WriteOperationCount
EX_PUSH_LOCK MemoryLimitsLock
PPS_JOB_TOKEN_FILTER Filter
ULONGLONG WriteTransferCount
LARGE_INTEGER PerProcessUserTimeLimit
EPROCESS_QUOTA_ENTRY QuotaEntry[PsQuotaTypes]
ULONG ExitProcessReported
LIST_ENTRY ActiveProcessLinks
EX_FAST_REF PrefetchTrace
UCHAR SubSystemMinorVersion
LIST_ENTRY ThreadListHead
UCHAR SubSystemMajorVersion
PMM_AVL_TABLE PhysicalVadRoot
ULONG ProcessVerifierTarget
PFN_NUMBER NumberOfPrivatePages
LARGE_INTEGER WriteTransferCount
ULONG DefaultPagePriority
HANDLE InheritedFromUniqueProcessId
ULONG OverrideAddressSpace
HARDWARE_PTE PageDirectoryPte
PEPROCESS_QUOTA_BLOCK QuotaBlock
LIST_ENTRY MmProcessLinks
EX_PUSH_LOCK AddressCreationLock
PFN_NUMBER NumberOfLockedPages
ULONG_PTR HardwareTrigger
PHANDLE_TABLE ObjectTable
ULONG ReportPhysicalPageChanges
PETHREAD RotateInProgress
NTSTATUS LastThreadExitStatus
SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo
LARGE_INTEGER ReadTransferCount
ULONG AddressSpaceInitialized
LARGE_INTEGER ReadOperationCount
PPAGEFAULT_HISTORY WorkingSetWatch
LIST_ENTRY SessionProcessLinks
LARGE_INTEGER OtherTransferCount
ULONG DefaultHardErrorProcessing
SIZE_T QuotaUsage[PsQuotaTypes]
LARGE_INTEGER WriteOperationCount
PFN_NUMBER WorkingSetPage
SIZE_T QuotaPeak[PsQuotaTypes]
EX_RUNDOWN_REF RundownProtect
ULONG ReportCommitChanges
LARGE_INTEGER OtherOperationCount
PKSTART_ROUTINE StartAddress
PPS_IMPERSONATION_INFORMATION ImpersonationInfo
ULONG AlpcReceiveAttributeSet
ULONG OwnsSessionWorkingSetExclusive
EX_RUNDOWN_REF RundownProtect
ULONG ExWorkerCanWaitUser
ULONG OwnsSessionWorkingSetShared
UCHAR DisablePageFaultClustering
struct _TERMINATION_PORT * TerminationPort
ULONG LpcReceivedMsgIdValid
LIST_ENTRY ActiveTimerListHead
ULONG PriorityRegionActive
KSPIN_LOCK ActiveTimerListLock
ULONG OwnsSystemWorkingSetShared
PDEVICE_OBJECT DeviceToVerify
LIST_ENTRY AlpcWaitListEntry
ULONG LpcReceivedMessageId
ULONG OwnsProcessWorkingSetShared
ULONG ActiveImpersonationInfo
ULONG SameThreadPassiveFlags
ULONG LpcExitThreadCalled
ULONG OwnsProcessWorkingSetExclusive
PPSP_RATE_APC RateControlApc
KSEMAPHORE KeyedWaitSemaphore
LIST_ENTRY KeyedWaitChain
ULONG HardErrorsAreDisabled
KSEMAPHORE AlpcWaitSemaphore
struct _ETHREAD * ReaperLink
PVOID Win32StartParameter
LIST_ENTRY ThreadListEntry
ULONG OwnsSystemWorkingSetExclusive
BOOLEAN ImageUsesLargePages
BOOLEAN IsProtectedProcess
BOOLEAN InheritedAddressSpace
BOOLEAN ReadImageFileExecOptions
ULONG NumberOfProcessIdsInList
ULONG NumberOfAssignedProcesses
ULONG_PTR ProcessIdList[1]
ULONG UIRestrictionsClass
PROCESS_WS_WATCH_INFORMATION WatchInfo[1]
struct _PEB_FREE_BLOCK * Next
SIZE_T PeakNonPagedPoolUsage
SIZE_T PeakPagedPoolUsage
PVOID Stacks[PROCESS_HANDLE_TRACING_MAX_STACKS]
PROCESS_HANDLE_TRACING_ENTRY HandleTrace[1]
ULONGLONG TargetGEneration
SINGLE_LIST_ENTRY NextApc
PSID_AND_ATTRIBUTES CapturedSids
ULONG CapturedGroupsLength
PSID_AND_ATTRIBUTES CapturedGroups
ULONG CapturedPrivilegeCount
PLUID_AND_ATTRIBUTES CapturedPrivileges
ULONG CapturedPrivilegesLength
TEB_ACTIVE_FRAME_CONTEXT BasicContext
TEB_ACTIVE_FRAME BasicFrame
PVOID ExtensionIdentifier
PCTEB_ACTIVE_FRAME_CONTEXT Context
struct _TEB_ACTIVE_FRAME * Previous
struct _TERMINATION_PORT * Next
PKWIN32_POWEREVENT_CALLOUT PowerEventCallout
PKWIN32_SESSION_CALLOUT WindowStationOkToCloseProcedure
PKWIN32_PROCESS_CALLOUT ProcessCallout
PKWIN32_SESSION_CALLOUT WindowStationDeleteProcedure
PKWIN32_SESSION_CALLOUT WindowStationParseProcedure
PKWIN32_SESSION_CALLOUT DesktopOkToCloseProcedure
PKWIN32_WIN32DATACOLLECTION_CALLOUT Win32DataCollectionProcedure
PKWIN32_POWERSTATE_CALLOUT PowerStateCallout
PKWIN32_SESSION_CALLOUT DesktopOpenProcedure
PKWIN32_SESSION_CALLOUT DesktopDeleteProcedure
PKWIN32_SESSION_CALLOUT DesktopCloseProcedure
PKWIN32_GLOBALATOMTABLE_CALLOUT GlobalAtomTableCallout
PKWIN32_SESSION_CALLOUT WindowStationOpenProcedure
PKWIN32_THREAD_CALLOUT ThreadCallout
PGDI_BATCHFLUSH_ROUTINE BatchFlushRoutine
PKWIN32_SESSION_CALLOUT WindowStationCloseProcedure
PKWIN32_JOB_CALLOUT JobCallout
PSW32JOBCALLOUTTYPE CalloutType
KPROCESSOR_MODE PreviousMode
OB_OPEN_REASON OpenReason
PACCESS_STATE AccessState
PUNICODE_STRING RemainingName
_Out_ PUNICODE_STRING CompleteName
PSECURITY_QUALITY_OF_SERVICE SecurityQos
KPROCESSOR_MODE AccessMode
PSPOWEREVENTTYPE EventNumber
SYSTEM_POWER_STATE MinSystemState
POWER_ACTION SystemAction
POWERSTATETASK PowerStateTask
_In_ WDFINTERRUPT _In_ PFN_WDF_INTERRUPT_SYNCHRONIZE Callback
_Must_inspect_result_ _In_ WDFQUEUE _In_opt_ WDFREQUEST _In_opt_ WDFFILEOBJECT _Inout_opt_ PWDF_REQUEST_PARAMETERS Parameters
_Must_inspect_result_ _In_ WDFIORESLIST _In_ PIO_RESOURCE_DESCRIPTOR Descriptor
KSTART_ROUTINE * PKSTART_ROUTINE
_Inout_opt_ PVOID Parameter
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK GrantedAccess