30 #ifndef NTOS_MODE_USER 39 #ifndef NTOS_MODE_USER 46 #endif // !NTOS_MODE_USER 51 #define USER_SHARED_DATA (0x7FFE0000) 56 #define FLG_STOP_ON_EXCEPTION 0x00000001 57 #define FLG_SHOW_LDR_SNAPS 0x00000002 58 #define FLG_DEBUG_INITIAL_COMMAND 0x00000004 59 #define FLG_STOP_ON_HUNG_GUI 0x00000008 60 #define FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010 61 #define FLG_HEAP_ENABLE_FREE_CHECK 0x00000020 62 #define FLG_HEAP_VALIDATE_PARAMETERS 0x00000040 63 #define FLG_HEAP_VALIDATE_ALL 0x00000080 64 #define FLG_APPLICATION_VERIFIER 0x00000100 65 #define FLG_POOL_ENABLE_TAGGING 0x00000400 66 #define FLG_HEAP_ENABLE_TAGGING 0x00000800 67 #define FLG_USER_STACK_TRACE_DB 0x00001000 68 #define FLG_KERNEL_STACK_TRACE_DB 0x00002000 69 #define FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000 70 #define FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000 71 #define FLG_DISABLE_STACK_EXTENSION 0x00010000 72 #define FLG_ENABLE_CSRDEBUG 0x00020000 73 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000 74 #define FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000 75 #if (NTDDI_VERSION < NTDDI_WINXP) 76 #define FLG_HEAP_ENABLE_CALL_TRACING 0x00100000 78 #define FLG_ENABLE_SYSTEM_CRIT_BREAKS 0x00100000 80 #define FLG_HEAP_DISABLE_COALESCING 0x00200000 81 #define FLG_ENABLE_CLOSE_EXCEPTIONS 0x00400000 82 #define FLG_ENABLE_EXCEPTION_LOGGING 0x00800000 83 #define FLG_ENABLE_HANDLE_TYPE_TAGGING 0x01000000 84 #define FLG_HEAP_PAGE_ALLOCS 0x02000000 85 #define FLG_DEBUG_INITIAL_COMMAND_EX 0x04000000 86 #define FLG_VALID_BITS 0x07FFFFFF 91 #define PROCESS_CREATE_FLAGS_BREAKAWAY 0x00000001 92 #define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT 0x00000002 93 #define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004 94 #define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008 95 #define PROCESS_CREATE_FLAGS_LARGE_PAGES 0x00000010 96 #define PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS PROCESS_CREATE_FLAGS_LARGE_PAGES 97 #define PROCESS_CREATE_FLAGS_LEGAL_MASK (PROCESS_CREATE_FLAGS_BREAKAWAY | \ 98 PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT | \ 99 PROCESS_CREATE_FLAGS_INHERIT_HANDLES | \ 100 PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE | \ 101 PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS) 106 #define PROCESS_PRIORITY_CLASS_INVALID 0 107 #define PROCESS_PRIORITY_CLASS_IDLE 1 108 #define PROCESS_PRIORITY_CLASS_NORMAL 2 109 #define PROCESS_PRIORITY_CLASS_HIGH 3 110 #define PROCESS_PRIORITY_CLASS_REALTIME 4 111 #define PROCESS_PRIORITY_CLASS_BELOW_NORMAL 5 112 #define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL 6 117 #define PROCESS_PRIORITY_IDLE 3 118 #define PROCESS_PRIORITY_NORMAL 8 119 #define PROCESS_PRIORITY_NORMAL_FOREGROUND 9 124 #define MEMORY_PRIORITY_BACKGROUND 0 125 #define MEMORY_PRIORITY_UNKNOWN 1 126 #define MEMORY_PRIORITY_FOREGROUND 2 131 #define PSP_DEFAULT_QUANTUMS 0x00 132 #define PSP_VARIABLE_QUANTUMS 0x04 133 #define PSP_FIXED_QUANTUMS 0x08 134 #define PSP_LONG_QUANTUMS 0x10 135 #define PSP_SHORT_QUANTUMS 0x20 140 #define PROCESS_HANDLE_TRACE_TYPE_OPEN 1 141 #define PROCESS_HANDLE_TRACE_TYPE_CLOSE 2 142 #define PROCESS_HANDLE_TRACE_TYPE_BADREF 3 143 #define PROCESS_HANDLE_TRACING_MAX_STACKS 16 145 #ifndef NTOS_MODE_USER 149 #define THREAD_QUERY_INFORMATION 0x0040 150 #define THREAD_SET_THREAD_TOKEN 0x0080 151 #define THREAD_IMPERSONATE 0x0100 152 #define THREAD_DIRECT_IMPERSONATION 0x0200 157 #define PROCESS_TERMINATE 0x0001 158 #define PROCESS_CREATE_THREAD 0x0002 159 #define PROCESS_SET_SESSIONID 0x0004 160 #define PROCESS_VM_OPERATION 0x0008 161 #define PROCESS_VM_READ 0x0010 162 #define PROCESS_VM_WRITE 0x0020 163 #define PROCESS_CREATE_PROCESS 0x0080 164 #define PROCESS_SET_QUOTA 0x0100 165 #define PROCESS_SET_INFORMATION 0x0200 166 #define PROCESS_QUERY_INFORMATION 0x0400 167 #define PROCESS_SUSPEND_RESUME 0x0800 168 #define PROCESS_QUERY_LIMITED_INFORMATION 0x1000 169 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 170 #define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \ 174 #define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \ 182 #define THREAD_BASE_PRIORITY_LOWRT 15 183 #define THREAD_BASE_PRIORITY_MAX 2 184 #define THREAD_BASE_PRIORITY_MIN -2 185 #define THREAD_BASE_PRIORITY_IDLE -15 190 #define TLS_MINIMUM_AVAILABLE 64 195 #define TEB_ACTIVE_FRAME_CONTEXT_FLAG_EXTENDED 0x1 200 #define JOB_OBJECT_ASSIGN_PROCESS 0x1 201 #define JOB_OBJECT_SET_ATTRIBUTES 0x2 202 #define JOB_OBJECT_QUERY 0x4 203 #define JOB_OBJECT_TERMINATE 0x8 204 #define JOB_OBJECT_SET_SECURITY_ATTRIBUTES 0x10 205 #define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \ 212 #define JOB_OBJECT_LIMIT_WORKINGSET 0x1 213 #define JOB_OBJECT_LIMIT_PROCESS_TIME 0x2 214 #define JOB_OBJECT_LIMIT_JOB_TIME 0x4 215 #define JOB_OBJECT_LIMIT_ACTIVE_PROCESS 0x8 216 #define JOB_OBJECT_LIMIT_AFFINITY 0x10 217 #define JOB_OBJECT_LIMIT_PRIORITY_CLASS 0x20 218 #define JOB_OBJECT_LIMIT_PRESERVE_JOB_TIME 0x40 219 #define JOB_OBJECT_LIMIT_SCHEDULING_CLASS 0x80 220 #define JOB_OBJECT_LIMIT_PROCESS_MEMORY 0x100 221 #define JOB_OBJECT_LIMIT_JOB_MEMORY 0x200 222 #define JOB_OBJECT_LIMIT_DIE_ON_UNHANDLED_EXCEPTION 0x400 223 #define JOB_OBJECT_LIMIT_BREAKAWAY_OK 0x800 224 #define JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK 0x1000 225 #define JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE 0x2000 230 #define JOB_OBJECT_SECURITY_NO_ADMIN 0x0001 231 #define JOB_OBJECT_SECURITY_RESTRICTED_TOKEN 0x0002 232 #define JOB_OBJECT_SECURITY_ONLY_TOKEN 0x0004 233 #define JOB_OBJECT_SECURITY_FILTER_TOKENS 0x0008 238 #define CT_TERMINATED_BIT 0x1 239 #define CT_DEAD_THREAD_BIT 0x2 240 #define CT_HIDE_FROM_DEBUGGER_BIT 0x4 241 #define CT_ACTIVE_IMPERSONATION_INFO_BIT 0x8 242 #define CT_SYSTEM_THREAD_BIT 0x10 243 #define CT_HARD_ERRORS_ARE_DISABLED_BIT 0x20 244 #define CT_BREAK_ON_TERMINATION_BIT 0x40 245 #define CT_SKIP_CREATION_MSG_BIT 0x80 246 #define CT_SKIP_TERMINATION_MSG_BIT 0x100 251 #define STP_ACTIVE_EX_WORKER_BIT 0x1 252 #define STP_EX_WORKER_CAN_WAIT_USER_BIT 0x2 253 #define STP_MEMORY_MAKER_BIT 0x4 254 #define STP_KEYED_EVENT_IN_USE_BIT 0x8 259 #define STA_LPC_RECEIVED_MSG_ID_VALID_BIT 0x1 260 #define STA_LPC_EXIT_THREAD_CALLED_BIT 0x2 261 #define STA_ADDRESS_SPACE_OWNER_BIT 0x4 262 #define STA_OWNS_WORKING_SET_BITS 0x1F8 267 #define KPSF_AUTO_ALIGNMENT_BIT 0 268 #define KPSF_DISABLE_BOOST_BIT 1 273 #define PSF_CREATE_REPORTED_BIT 0x1 274 #define PSF_NO_DEBUG_INHERIT_BIT 0x2 275 #define PSF_PROCESS_EXITING_BIT 0x4 276 #define PSF_PROCESS_DELETE_BIT 0x8 277 #define PSF_WOW64_SPLIT_PAGES_BIT 0x10 278 #define PSF_VM_DELETED_BIT 0x20 279 #define PSF_OUTSWAP_ENABLED_BIT 0x40 280 #define PSF_OUTSWAPPED_BIT 0x80 281 #define PSF_FORK_FAILED_BIT 0x100 282 #define PSF_WOW64_VA_SPACE_4GB_BIT 0x200 283 #define PSF_ADDRESS_SPACE_INITIALIZED_BIT 0x400 284 #define PSF_SET_TIMER_RESOLUTION_BIT 0x1000 285 #define PSF_BREAK_ON_TERMINATION_BIT 0x2000 286 #define PSF_SESSION_CREATION_UNDERWAY_BIT 0x4000 287 #define PSF_WRITE_WATCH_BIT 0x8000 288 #define PSF_PROCESS_IN_SESSION_BIT 0x10000 289 #define PSF_OVERRIDE_ADDRESS_SPACE_BIT 0x20000 290 #define PSF_HAS_ADDRESS_SPACE_BIT 0x40000 291 #define PSF_LAUNCH_PREFETCHED_BIT 0x80000 292 #define PSF_INJECT_INPAGE_ERRORS_BIT 0x100000 293 #define PSF_VM_TOP_DOWN_BIT 0x200000 294 #define PSF_IMAGE_NOTIFY_DONE_BIT 0x400000 295 #define PSF_PDE_UPDATE_NEEDED_BIT 0x800000 296 #define PSF_VDM_ALLOWED_BIT 0x1000000 297 #define PSF_SWAP_ALLOWED_BIT 0x2000000 298 #define PSF_CREATE_FAILED_BIT 0x4000000 299 #define PSF_DEFAULT_IO_PRIORITY_BIT 0x8000000 304 #define PSF2_PROTECTED_BIT 0x800 310 #define TLS_EXPANSION_SLOTS 1024 312 #ifdef NTOS_MODE_USER 316 #define LOW_PRIORITY 0 317 #define LOW_REALTIME_PRIORITY 16 318 #define HIGH_PRIORITY 31 319 #define MAXIMUM_PRIORITY 32 324 #define NtCurrentProcess() ((HANDLE)(LONG_PTR)-1) 325 #define ZwCurrentProcess() NtCurrentProcess() 326 #define NtCurrentThread() ((HANDLE)(LONG_PTR)-2) 327 #define ZwCurrentThread() NtCurrentThread() 524 (
NTAPI *PKWIN32_PROCESS_CALLOUT)(
602 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 632 #define _DESCRIPTOR_TABLE_ENTRY_DEFINED 633 typedef struct _DESCRIPTOR_TABLE_ENTRY
637 } DESCRIPTOR_TABLE_ENTRY, *PDESCRIPTOR_TABLE_ENTRY;
668 #if (NTDDI_VERSION >= NTDDI_WS03) 672 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 743 #if (NTDDI_VERSION < NTDDI_WS03) 744 typedef struct _Wx86ThreadState
747 PVOID DeallocationCpu;
750 } Wx86ThreadState, *PWx86ThreadState;
844 #define EXPLICIT_32BIT 846 #undef EXPLICIT_32BIT 851 #define EXPLICIT_64BIT 853 #undef EXPLICIT_64BIT 856 #ifdef NTOS_MODE_USER 1004 #ifndef NTOS_MODE_USER 1024 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1027 #if (NTDDI_VERSION == NTDDI_LONGHORN) 1122 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1129 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1139 PVOID LpcReplyMessage;
1140 PVOID LpcWaitingOnPort;
1147 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1161 #if (NTDDI_VERSION < NTDDI_LONGHORN) 1162 ULONG LpcReplyMessageId;
1165 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1175 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1187 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1204 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1216 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1219 ULONG AddressSpaceOwner:1;
1227 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1237 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1240 UCHAR ForwardClusterOnly;
1244 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1276 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1284 PVOID ExceptionPort;
1289 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1314 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1337 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1363 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1406 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1409 ULONG SessionCreationUnderway:1;
1422 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1425 ULONG CreateFailed:1;
1428 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1438 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1460 #include <pshpack1.h> 1520 #if (NTDDI_VERSION >= NTDDI_WINXP) && (NTDDI_VERSION < NTDDI_WS03) 1522 #elif (NTDDI_VERSION >= NTDDI_WS03) && (NTDDI_VERSION < NTDDI_LONGHORN) 1524 #elif (NTDDI_VERSION >= NTDDI_LONGHORN) 1531 #include <poppack.h> 1699 #if (NTDDI_VERSION >= NTDDI_LONGHORN) 1704 #endif // !NTOS_MODE_USER 1710 #endif // _PSTYPES_H
KSEMAPHORE KeyedWaitSemaphore
LARGE_INTEGER WriteOperationCount
PCTEB_ACTIVE_FRAME_CONTEXT Context
PKWIN32_POWERSTATE_CALLOUT PowerStateCallout
enum _JOBOBJECTINFOCLASS JOBOBJECTINFOCLASS
struct _JOBOBJECT_EXTENDED_LIMIT_INFORMATION * PJOBOBJECT_EXTENDED_LIMIT_INFORMATION
struct _JOBOBJECT_EXTENDED_LIMIT_INFORMATION JOBOBJECT_EXTENDED_LIMIT_INFORMATION
const struct _TEB_ACTIVE_FRAME_CONTEXT * PCTEB_ACTIVE_FRAME_CONTEXT
struct _INITIAL_TEB * PINITIAL_TEB
LIST_ENTRY MmProcessLinks
NTSTATUS(NTAPI * PKWIN32_WIN32DATACOLLECTION_CALLOUT)(_In_ struct _EPROCESS *Process, _In_ PVOID Callback, _In_ PVOID Context)
HARDWARE_PTE PageDirectoryPte
LIST_ENTRY ThreadListEntry
LARGE_INTEGER ReadOperationCount
#define PROCESS_HANDLE_TRACING_MAX_STACKS
NTSTATUS(NTAPI * PKWIN32_GLOBALATOMTABLE_CALLOUT)(VOID)
struct _PROCESS_FOREGROUND_BACKGROUND PROCESS_FOREGROUND_BACKGROUND
_Must_inspect_result_ _In_ WDFIORESLIST _In_ PIO_RESOURCE_DESCRIPTOR Descriptor
PVOID Win32StartParameter
struct _WIN32_POWERSTATE_PARAMETERS * PWIN32_POWERSTATE_PARAMETERS
ULONG ReportCommitChanges
_Must_inspect_result_ _In_ WDFQUEUE _In_opt_ WDFREQUEST _In_opt_ WDFFILEOBJECT _Inout_opt_ PWDF_REQUEST_PARAMETERS Parameters
PKWIN32_SESSION_CALLOUT WindowStationOkToCloseProcedure
enum _APPCOMPAT_FLAGS APPCOMPAT_FLAGS
OB_OPEN_REASON OpenReason
SINGLE_LIST_ENTRY NextApc
EPROCESS_QUOTA_ENTRY QuotaEntry[PsQuotaTypes]
SIZE_T PeakPagedPoolUsage
struct _EPROCESS_QUOTA_ENTRY EPROCESS_QUOTA_ENTRY
ULONG OwnsSystemWorkingSetShared
PGDI_BATCHFLUSH_ROUTINE BatchFlushRoutine
LIST_ENTRY KeyedWaitChain
HANDLE InheritedFromUniqueProcessId
PPSP_RATE_APC RateControlApc
LARGE_INTEGER TotalUserTime
struct _PSP_RATE_APC PSP_RATE_APC
struct _JOBOBJECT_SECURITY_LIMIT_INFORMATION JOBOBJECT_SECURITY_LIMIT_INFORMATION
struct _CLIENT_ID64 CLIENT_ID64
PACCESS_STATE AccessState
ULONG CapturedPrivilegesLength
struct _JOBOBJECT_END_OF_JOB_TIME_INFORMATION JOBOBJECT_END_OF_JOB_TIME_INFORMATION
UCHAR SubSystemMajorVersion
ULONG NumberOfProcessIdsInList
LARGE_INTEGER ThisPeriodTotalKernelTime
struct _PS_JOB_TOKEN_FILTER * PPS_JOB_TOKEN_FILTER
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
struct _PROCESS_DEVICEMAP_INFORMATION PROCESS_DEVICEMAP_INFORMATION
struct _PROCESS_ACCESS_TOKEN * PPROCESS_ACCESS_TOKEN
struct _JOBOBJECT_SECURITY_LIMIT_INFORMATION * PJOBOBJECT_SECURITY_LIMIT_INFORMATION
EX_RUNDOWN_REF RundownProtect
struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS WIN32_OKAYTOCLOSEMETHOD_PARAMETERS
PFN_NUMBER NumberOfPrivatePages
PSID_AND_ATTRIBUTES CapturedSids
struct _POOLED_USAGE_AND_LIMITS POOLED_USAGE_AND_LIMITS
ULONG LpcReceivedMessageId
SIZE_T QuotaUsage[PsQuotaTypes]
NTSTATUS(NTAPI * PKWIN32_THREAD_CALLOUT)(_In_ struct _ETHREAD *Thread, _In_ PSW32THREADCALLOUTTYPE Type)
struct JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION
LIST_ENTRY ActiveTimerListHead
ULONG TotalTerminatedProcesses
NTSTATUS(NTAPI * PKWIN32_POWERSTATE_CALLOUT)(_In_ struct _WIN32_POWERSTATE_PARAMETERS *Parameters)
struct _JOBOBJECT_END_OF_JOB_TIME_INFORMATION PJOBOBJECT_END_OF_JOB_TIME_INFORMATION
PKWIN32_POWEREVENT_CALLOUT PowerEventCallout
NTSTATUS(NTAPI * PKWIN32_JOB_CALLOUT)(_In_ struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters)
struct _PROCESS_LDT_SIZE * PPROCESS_LDT_SIZE
struct _PROCESS_LDT_INFORMATION * PPROCESS_LDT_INFORMATION
PFN_NUMBER NumberOfLockedPages
struct _WIN32_POWERSTATE_PARAMETERS WIN32_POWERSTATE_PARAMETERS
ULONG ProcessVerifierTarget
struct _PROCESS_DEVICEMAP_INFORMATION * PPROCESS_DEVICEMAP_INFORMATION
KPROCESSOR_MODE AccessMode
ULONG CapturedGroupsLength
struct _PROCESS_HANDLE_TRACING_QUERY * PPROCESS_HANDLE_TRACING_QUERY
PKWIN32_THREAD_CALLOUT ThreadCallout
struct _PEB_FREE_BLOCK * PPEB_FREE_BLOCK
struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS * PWIN32_OKAYTOCLOSEMETHOD_PARAMETERS
ULONGLONG WriteTransferCount
struct _TERMINATION_PORT * Next
struct _CLIENT_ID32 * PCLIENT_ID32
struct _INITIAL_PEB INITIAL_PEB
struct _WIN32_POWEREVENT_PARAMETERS WIN32_POWEREVENT_PARAMETERS
ULONG PeakProcessMemoryUsed
VOID(NTAPI * PPEBLOCKROUTINE)(PVOID PebLock)
struct _PROCESS_LDT_SIZE PROCESS_LDT_SIZE
struct _TERMINATION_PORT * PTERMINATION_PORT
enum _SYSTEM_POWER_STATE SYSTEM_POWER_STATE
NTSTATUS LastThreadExitStatus
NTSTATUS(NTAPI * PKWIN32_SESSION_CALLOUT)(_In_ PVOID Parameter)
PKWIN32_SESSION_CALLOUT DesktopCloseProcedure
ULONG_PTR HardwareTrigger
PKSTART_ROUTINE StartAddress
SIZE_T PeakNonPagedPoolUsage
struct _APPHELP_CACHE_SERVICE_LOOKUP * PAPPHELP_CACHE_SERVICE_LOOKUP
_APPHELPCACHESERVICECLASS
struct _ETHREAD * ReaperLink
struct _WIN32_JOBCALLOUT_PARAMETERS * PWIN32_JOBCALLOUT_PARAMETERS
PKWIN32_SESSION_CALLOUT WindowStationDeleteProcedure
ULONG OwnsSessionWorkingSetShared
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
PPS_IMPERSONATION_INFORMATION ImpersonationInfo
KSTART_ROUTINE * PKSTART_ROUTINE
struct _WIN32_CALLOUTS_FPNS WIN32_CALLOUTS_FPNS
const struct _TEB_ACTIVE_FRAME_EX * PCTEB_ACTIVE_FRAME_EX
struct JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION * PJOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION
KSEMAPHORE AlpcWaitSemaphore
enum _SECURITY_IMPERSONATION_LEVEL SECURITY_IMPERSONATION_LEVEL
typedef NTSTATUS(NTAPI *PKWIN32_PROCESS_CALLOUT)(_In_ struct _EPROCESS *Process
ULONG OwnsSessionWorkingSetExclusive
enum _PROCESSINFOCLASS PROCESSINFOCLASS
struct _WIN32_JOBCALLOUT_PARAMETERS WIN32_JOBCALLOUT_PARAMETERS
ULONGLONG ReadTransferCount
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
struct _PROCESS_ACCESS_TOKEN PROCESS_ACCESS_TOKEN
BOOLEAN ReadImageFileExecOptions
PKWIN32_JOB_CALLOUT JobCallout
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
VOID(NTAPI * PLEGO_NOTIFY_ROUTINE)(_In_ PKTHREAD Thread)
BOOLEAN ImageUsesLargePages
TEB_ACTIVE_FRAME BasicFrame
NTSTATUS(NTAPI * PPOST_PROCESS_INIT_ROUTINE)(VOID)
ULONG SameThreadPassiveFlags
LARGE_INTEGER OtherTransferCount
ULONG ReportPhysicalPageChanges
LIST_ENTRY ProcessListHead
struct _PROCESS_HANDLE_TRACING_QUERY PROCESS_HANDLE_TRACING_QUERY
struct _WIN32_CLOSEMETHOD_PARAMETERS * PWIN32_CLOSEMETHOD_PARAMETERS
struct _TEB_ACTIVE_FRAME_EX * PTEB_ACTIVE_FRAME_EX
LARGE_INTEGER ThisPeriodTotalUserTime
PKWIN32_SESSION_CALLOUT DesktopOkToCloseProcedure
LIST_ENTRY ThreadListHead
enum _PSW32THREADCALLOUTTYPE PSW32THREADCALLOUTTYPE
ULONG NumberOfAssignedProcesses
LARGE_INTEGER PerProcessUserTimeLimit
PKWIN32_SESSION_CALLOUT DesktopDeleteProcedure
struct _TERMINATION_PORT * TerminationPort
ULONG UIRestrictionsClass
TEB_ACTIVE_FRAME_CONTEXT BasicContext
struct _TEB_ACTIVE_FRAME_CONTEXT_EX * PTEB_ACTIVE_FRAME_CONTEXT_EX
EX_PUSH_LOCK AddressCreationLock
struct _JOBOBJECT_BASIC_PROCESS_ID_LIST * PJOBOBJECT_BASIC_PROCESS_ID_LIST
SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo
ULONG CurrentJobMemoryUsed
struct _PAGEFAULT_HISTORY * PPAGEFAULT_HISTORY
LIST_ENTRY SessionProcessLinks
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
struct _WIN32_PARSEMETHOD_PARAMETERS WIN32_PARSEMETHOD_PARAMETERS
struct _WIN32_DELETEMETHOD_PARAMETERS * PWIN32_DELETEMETHOD_PARAMETERS
struct _TEB_ACTIVE_FRAME * PTEB_ACTIVE_FRAME
ULONG AlpcReceiveAttributeSet
enum _THREADINFOCLASS THREADINFOCLASS
UCHAR SubSystemMinorVersion
struct _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION * PJOBOBJECT_BASIC_ACCOUNTING_INFORMATION
struct _TEB_ACTIVE_FRAME_CONTEXT_EX TEB_ACTIVE_FRAME_CONTEXT_EX
ULONG MaximumWorkingSetSize
struct _PROCESS_FOREGROUND_BACKGROUND * PPROCESS_FOREGROUND_BACKGROUND
EX_PUSH_LOCK MemoryLimitsLock
struct _PROCESS_HANDLE_TRACING_ENTRY PROCESS_HANDLE_TRACING_ENTRY
ULONG ExitProcessReported
SIZE_T QuotaPeak[PsQuotaTypes]
struct _EPROCESS_QUOTA_ENTRY * PEPROCESS_QUOTA_ENTRY
struct _POOLED_USAGE_AND_LIMITS * PPOOLED_USAGE_AND_LIMITS
PKWIN32_GLOBALATOMTABLE_CALLOUT GlobalAtomTableCallout
struct _WIN32_POWEREVENT_PARAMETERS * PWIN32_POWEREVENT_PARAMETERS
struct _EPROCESS EPROCESS
PKWIN32_SESSION_CALLOUT WindowStationCloseProcedure
_APPCOMPAT_USERFLAGS_HIGHPART
struct _THREAD_BASIC_INFORMATION THREAD_BASIC_INFORMATION
struct _JOB_SET_ARRAY JOB_SET_ARRAY
struct _TEB_ACTIVE_FRAME_EX TEB_ACTIVE_FRAME_EX
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
enum _POWERSTATETASK POWERSTATETASK
struct _PS_JOB_TOKEN_FILTER PS_JOB_TOKEN_FILTER
PSPOWEREVENTTYPE EventNumber
NTSTATUS(NTAPI * PKWIN32_POWEREVENT_CALLOUT)(_In_ struct _WIN32_POWEREVENT_PARAMETERS *Parameters)
struct _WIN32_CLOSEMETHOD_PARAMETERS WIN32_CLOSEMETHOD_PARAMETERS
enum _PSPOWEREVENTTYPE PSPOWEREVENTTYPE
ULONG ActiveImpersonationInfo
struct _PAGEFAULT_HISTORY PAGEFAULT_HISTORY
LARGE_INTEGER WriteTransferCount
ULONGLONG TargetGEneration
PLUID_AND_ATTRIBUTES CapturedPrivileges
PEPROCESS_QUOTA_BLOCK QuotaBlock
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
LARGE_INTEGER PerJobUserTimeLimit
PKWIN32_SESSION_CALLOUT DesktopOpenProcedure
LARGE_INTEGER TotalKernelTime
LIST_ENTRY ActiveProcessLinks
PSID_AND_ATTRIBUTES CapturedGroups
PSECURITY_QUALITY_OF_SERVICE SecurityQos
PPS_JOB_TOKEN_FILTER Filter
EX_FAST_REF PrefetchTrace
struct _PROCESS_WS_WATCH_INFORMATION * PPROCESS_WS_WATCH_INFORMATION
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
EX_RUNDOWN_REF RundownProtect
PDEVICE_OBJECT DeviceToVerify
ULONGLONG OtherOperationCount
ULONG OwnsSystemWorkingSetExclusive
PVOID ExtensionIdentifier
PPAGEFAULT_HISTORY WorkingSetWatch
struct _PS_IMPERSONATION_INFORMATION PS_IMPERSONATION_INFORMATION
PROCESS_WS_WATCH_INFORMATION WatchInfo[1]
NTSTATUS(NTAPI * PGDI_BATCHFLUSH_ROUTINE)(VOID)
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
struct _EPROCESS_QUOTA_BLOCK EPROCESS_QUOTA_BLOCK
_In_ WDFINTERRUPT _In_ PFN_WDF_INTERRUPT_SYNCHRONIZE Callback
enum _OB_OPEN_REASON OB_OPEN_REASON
ULONG_PTR ProcessIdList[1]
SYSTEM_POWER_STATE MinSystemState
const struct _TEB_ACTIVE_FRAME * PCTEB_ACTIVE_FRAME
struct _INITIAL_PEB * PINITIAL_PEB
PHANDLE_TABLE ObjectTable
PMM_AVL_TABLE PhysicalVadRoot
ULONG OverrideAddressSpace
struct _PROCESS_WS_WATCH_INFORMATION PROCESS_WS_WATCH_INFORMATION
NTSTATUS(NTAPI * PKWIN32_DELETEMETHOD_CALLOUT)(_In_ struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters)
struct _WIN32_DELETEMETHOD_PARAMETERS WIN32_DELETEMETHOD_PARAMETERS
ULONGLONG OtherTransferCount
ULONG LpcExitThreadCalled
LIST_ENTRY AlpcWaitListEntry
enum _PSW32JOBCALLOUTTYPE PSW32JOBCALLOUTTYPE
struct _JOBOBJECT_ASSOCIATE_COMPLETION_PORT JOBOBJECT_ASSOCIATE_COMPLETION_PORT
struct _TEB_ACTIVE_FRAME_CONTEXT * PTEB_ACTIVE_FRAME_CONTEXT
struct _TEB_ACTIVE_FRAME * Previous
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
KPROCESSOR_MODE PreviousMode
struct _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION JOBOBJECT_BASIC_ACCOUNTING_INFORMATION
ULONG MinimumWorkingSetSize
ULONG UIRestrictionsClass
struct _WIN32_CALLOUTS_FPNS * PWIN32_CALLOUTS_FPNS
NTSTATUS(NTAPI * PKWIN32_CLOSEMETHOD_CALLOUT)(_In_ struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters)
struct _CLIENT_ID64 * PCLIENT_ID64
struct _JOBOBJECT_ASSOCIATE_COMPLETION_PORT * PJOBOBJECT_ASSOCIATE_COMPLETION_PORT
enum _APPHELPCACHESERVICECLASS APPHELPCACHESERVICECLASS
ULONG TotalPageFaultCount
ULONG OwnsProcessWorkingSetShared
struct _APPHELP_CACHE_SERVICE_LOOKUP APPHELP_CACHE_SERVICE_LOOKUP
ULONG CapturedPrivilegeCount
PETHREAD RotateInProgress
struct _JOBOBJECT_BASIC_LIMIT_INFORMATION JOBOBJECT_BASIC_LIMIT_INFORMATION
NTSTATUS(NTAPI * PKWIN32_OPENMETHOD_CALLOUT)(_In_ struct _WIN32_OPENMETHOD_PARAMETERS *Parameters)
PVOID Stacks[PROCESS_HANDLE_TRACING_MAX_STACKS]
struct _EPROCESS_QUOTA_BLOCK * PEPROCESS_QUOTA_BLOCK
ULONGLONG ReadOperationCount
ULONG DefaultHardErrorProcessing
struct _WIN32_OPENMETHOD_PARAMETERS WIN32_OPENMETHOD_PARAMETERS
struct _THREAD_BASIC_INFORMATION * PTHREAD_BASIC_INFORMATION
LARGE_INTEGER OtherOperationCount
LARGE_INTEGER ReadTransferCount
const struct _TEB_ACTIVE_FRAME_CONTEXT_EX * PCTEB_ACTIVE_FRAME_CONTEXT_EX
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
ULONG DefaultPagePriority
struct tagContext Context
ULONGLONG WriteOperationCount
struct _WIN32_OPENMETHOD_PARAMETERS * PWIN32_OPENMETHOD_PARAMETERS
PSW32JOBCALLOUTTYPE CalloutType
struct _INITIAL_TEB INITIAL_TEB
PKWIN32_SESSION_CALLOUT WindowStationOpenProcedure
struct _JOBOBJECT_BASIC_PROCESS_ID_LIST JOBOBJECT_BASIC_PROCESS_ID_LIST
ULONG PriorityRegionActive
struct _PS_IMPERSONATION_INFORMATION * PPS_IMPERSONATION_INFORMATION
ULONG OwnsProcessWorkingSetExclusive
struct _JOBOBJECT_BASIC_LIMIT_INFORMATION * PJOBOBJECT_BASIC_LIMIT_INFORMATION
POWERSTATETASK PowerStateTask
NTSTATUS(NTAPI * PKWIN32_OKTOCLOSEMETHOD_CALLOUT)(_In_ struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters)
PUNICODE_STRING RemainingName
ULONG ExWorkerCanWaitUser
enum _PSPROCESSPRIORITYMODE PSPROCESSPRIORITYMODE
PKWIN32_SESSION_CALLOUT WindowStationParseProcedure
enum _APPCOMPAT_USERFLAGS APPCOMPAT_USERFLAGS
ULONG AddressSpaceInitialized
UCHAR DisablePageFaultClustering
PKWIN32_PROCESS_CALLOUT ProcessCallout
struct _WIN32_PARSEMETHOD_PARAMETERS * PWIN32_PARSEMETHOD_PARAMETERS
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK GrantedAccess
struct _CLIENT_ID32 CLIENT_ID32
ULONG HardErrorsAreDisabled
struct _PEB_FREE_BLOCK * Next
struct _PSP_RATE_APC * PPSP_RATE_APC
_Out_ PUNICODE_STRING CompleteName
enum _APPCOMPAT_USERFLAGS_HIGHPART APPCOMPAT_USERFLAGS_HIGHPART
struct _JOBOBJECT_BASIC_UI_RESTRICTIONS * PJOBOBJECT_BASIC_UI_RESTRICTIONS
enum _PS_QUOTA_TYPE PS_QUOTA_TYPE
POWER_ACTION SystemAction
struct _TERMINATION_PORT TERMINATION_PORT
struct _JOBOBJECT_BASIC_UI_RESTRICTIONS JOBOBJECT_BASIC_UI_RESTRICTIONS
struct _PEB_FREE_BLOCK PEB_FREE_BLOCK
PKWIN32_WIN32DATACOLLECTION_CALLOUT Win32DataCollectionProcedure
POBJECT_TYPE NTSYSAPI PsJobType
BOOLEAN IsProtectedProcess
struct _PROCESS_HANDLE_TRACING_ENTRY * PPROCESS_HANDLE_TRACING_ENTRY
struct _TEB_ACTIVE_FRAME_CONTEXT TEB_ACTIVE_FRAME_CONTEXT
struct _PROCESS_LDT_INFORMATION PROCESS_LDT_INFORMATION
struct _TEB_ACTIVE_FRAME TEB_ACTIVE_FRAME
ULONG LpcReceivedMsgIdValid
BOOLEAN InheritedAddressSpace
PFN_NUMBER WorkingSetPage
C_ASSERT(sizeof(PROCESS_PRIORITY_CLASS)==2)
struct _JOB_SET_ARRAY * PJOB_SET_ARRAY
NTSTATUS(NTAPI * PKWIN32_PARSEMETHOD_CALLOUT)(_In_ struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters)
PROCESS_HANDLE_TRACING_ENTRY HandleTrace[1]
KSPIN_LOCK ActiveTimerListLock