20#define MAX_ENVVAL_SIZE 1024
22#define SIG_ACPI 0x41435049
23#define SIG_FIRM 0x4649524D
24#define SIG_RSMB 0x52534D42
59 &LdrEntry->FullDllName,
101 ULONG ModuleCount = 0;
109 NextEntry = KernelModeList->
Flink;
110 while (NextEntry != KernelModeList)
136 NextEntry = NextEntry->
Flink;
142 NextEntry = UserModeList->
Flink;
143 while (NextEntry != UserModeList)
169 NextEntry = NextEntry->
Flink;
180 Modules->NumberOfModules = ModuleCount;
207 PVOID *MappedSystemVa,
213 *MappedSystemVa =
NULL;
237 if (*MappedSystemVa ==
NULL)
256 PVOID DataBlockObject;
285 DPRINT1(
"Failed to allocate %lu bytes for SMBIOS tables\n", WMIBufSize);
335 *CpuUsage = (
ULONG)(100 - (ScaledIdle / TotalTime));
422 DPRINT1(
"NtQuerySystemEnvironmentValue: Caller requires the SeSystemEnvironmentPrivilege privilege!\n");
437 if (AnsiValueBuffer ==
NULL)
459 RtlInitEmptyUnicodeString(&WValue, ValueBuffer, (
USHORT)ValueBufferLength);
540 DPRINT1(
"NtSetSystemEnvironmentValue: Caller requires the SeSystemEnvironmentPrivilege privilege!\n");
597#define QSI_USE(n) QSI##n
599static NTSTATUS QSI_USE(n) (PVOID Buffer, ULONG Size, PULONG ReqSize)
601#define SSI_USE(n) SSI##n
603static NTSTATUS SSI_USE(n) (PVOID Buffer, ULONG Size)
662#if (NTDDI_VERSION < NTDDI_WIN8)
679 ULONG IdleUser, IdleKernel;
872 DPRINT1(
"EX: SystemPathInformation now available via SharedUserData\n");
887 USHORT ImageNameMaximumLength;
890 ULONG TotalSize = 0, ThreadsCount;
891 ULONG TotalUser, TotalKernel;
929 if ((
Process->ProcessExiting) &&
930 (
Process->Pcb.Header.SignalState) &&
934 DPRINT1(
"Process %p (%s:%p) is a zombie\n",
937 ImageNameMaximumLength = 0;
946 CurrentEntry =
Process->Pcb.ThreadListHead.Flink;
947 while (CurrentEntry != &
Process->Pcb.ThreadListHead)
950 CurrentEntry = CurrentEntry->
Flink;
957 ProcessImageName = TempProcessImageName;
961 szSrc = (
PWCHAR)((
PCHAR)ProcessImageName->Buffer + ProcessImageName->Length);
963 while (szSrc > ProcessImageName->Buffer)
973 ImageNameLength +=
sizeof(
WCHAR);
983 if (ImageNameLength > 0)
984 ImageNameMaximumLength =
ROUND_UP(ImageNameLength +
sizeof(
WCHAR), 8);
986 ImageNameMaximumLength = 0;
988 TotalSize += CurrentSize + ImageNameMaximumLength;
991 if (TotalSize >
Size)
1050 CurrentEntry =
Process->Pcb.ThreadListHead.Flink;
1051 while (CurrentEntry != &
Process->Pcb.ThreadListHead)
1068 CurrentEntry = CurrentEntry->
Flink;
1077 if (ProcessImageName)
1081 ProcessImageName =
NULL;
1101 Current += CurrentSize + ImageNameMaximumLength;
1112 if (ProcessImageName)
1125 *ReqSize = TotalSize;
1133 DPRINT1(
"NtQuerySystemInformation - SystemCallCountInformation not implemented\n");
1177 if (
Size < *ReqSize)
1204#if (NTDDI_VERSION >= NTDDI_VISTA)
1214#if (NTDDI_VERSION < NTDDI_VISTA)
1230#if (NTDDI_VERSION < NTDDI_WIN7)
1245 DPRINT1(
"NtQuerySystemInformation - SystemCallTimeInformation not implemented\n");
1275 DPRINT1(
"NtQuerySystemInformation - SystemLocksInformation not implemented\n");
1283 DPRINT1(
"NtQuerySystemInformation - SystemStackTraceInformation not implemented\n");
1291 DPRINT1(
"NtQuerySystemInformation - SystemPagedPoolInformation not implemented\n");
1299 DPRINT1(
"NtQuerySystemInformation - SystemNonPagedPoolInformation not implemented\n");
1316 DPRINT(
"NtQuerySystemInformation - SystemHandleInformation\n");
1322 if (
Size < *ReqSize)
1352 NextTableEntry = NextTableEntry->
Flink)
1362 if ((HandleTableEntry->
Object) &&
1375 if (*ReqSize >
Size)
1436 DPRINT1(
"NtQuerySystemInformation - SystemObjectInformation not implemented\n");
1468 DPRINT1(
"NtQuerySystemInformation - SystemVdmInstemulInformation not implemented\n");
1476 DPRINT1(
"NtQuerySystemInformation - SystemVdmBopInformation not implemented\n");
1487 if (
Size < *ReqSize)
1514 DPRINT1(
"NtSetSystemInformation - SystemFileCacheInformation not implemented\n");
1576 DPRINT1(
"NtSetSystemInformation - SystemDpcBehaviourInformation not implemented\n");
1587 *ReqSize =
sizeof(
ULONG);
1594 DPRINT(
"SystemFullMemoryInformation\n");
1598 DPRINT(
"PID: %p, KernelTime: %u PFFree: %lu PFUsed: %lu\n",
1615 PVOID SectionPointer;
1748 DPRINT1(
"NtQuerySystemInformation - SystemSummaryMemoryInformation not implemented\n");
1756 DPRINT1(
"NtQuerySystemInformation - SystemNextEventIdInformation not implemented\n");
1764 DPRINT1(
"NtQuerySystemInformation - SystemPerformanceTraceInformation not implemented\n");
1772 DPRINT1(
"NtQuerySystemInformation - SystemCrashDumpInformation not implemented\n");
1782 ULONG AlignmentFixupCount = 0, ExceptionDispatchCount = 0;
1783 ULONG FloatingEmulationCount = 0, ByteWordEmulationCount = 0;
1799 FloatingEmulationCount += Prcb->KeFloatingEmulationCount;
1817 DPRINT1(
"NtQuerySystemInformation - SystemCrashDumpStateInformation not implemented\n");
1826#if (NTDDI_VERSION >= NTDDI_VISTA)
1838#if (NTDDI_VERSION < NTDDI_VISTA)
1850 ULONG ContextSwitches;
1859 ContextSwitches = 0;
1872 ContextSwitchInformation->
FindAny = 0;
1873 ContextSwitchInformation->
FindLast = 0;
1874 ContextSwitchInformation->
FindIdeal = 0;
1875 ContextSwitchInformation->
IdleAny = 0;
1877 ContextSwitchInformation->
IdleLast = 0;
1878 ContextSwitchInformation->
IdleIdeal = 0;
1898 DPRINT1(
"Faking max registry size of 32 MB\n");
1909 DPRINT1(
"NtSetSystemInformation - SystemRegistryQuotaInformation not implemented\n");
1966 sizeof(Win32kName));
1974 (
PVOID)&ModuleObject,
2032 DPRINT1(
"NtQuerySystemInformation - SystemVerifierAddDriverInformation not implemented\n");
2040 DPRINT1(
"NtQuerySystemInformation - SystemVerifierRemoveDriverInformation not implemented\n");
2055 DPRINT1(
"NtQuerySystemInformation - SystemPowerInformation not implemented\n");
2063 DPRINT1(
"NtQuerySystemInformation - SystemLegacyDriverInformation not implemented\n");
2111 Info = *InfoPointer;
2112 Remaining = *RemainingPointer;
2115 for (ListEntry = ListHead->
Flink;
2116 (ListEntry != ListHead) && (Remaining > 0);
2117 ListEntry = ListEntry->
Flink, Remaining--)
2148 *InfoPointer =
Info;
2149 *RemainingPointer = Remaining;
2158 ULONG MaxCount, Remaining;
2247 DPRINT1(
"NtSetSystemInformation - SystemTimeSlipNotification not implemented\n");
2309 DPRINT1(
"NtQuerySystemInformation - SystemSessionInformation not implemented\n");
2321 if (ReqSize) *ReqSize =
sizeof(
ULONG_PTR);
2330 DPRINT1(
"NtQuerySystemInformation - SystemVerifierInformation not implemented\n");
2337 DPRINT1(
"NtSetSystemInformation - SystemVerifierInformation not implemented\n");
2345 DPRINT1(
"NtSetSystemInformation - SystemVerifierThunkExtend not implemented\n");
2353 DPRINT1(
"NtQuerySystemInformation - SystemSessionProcessInformation not implemented\n");
2361 DPRINT1(
"NtSetSystemInformation - SystemLoadGdiDriverInSystemSpaceInformation not implemented\n");
2405 *ReqSize =
sizeof(
ULONG);
2415 DPRINT1(
"NtQuerySystemInformation - SystemPrefetcherInformation not implemented\n");
2423 DPRINT1(
"NtQuerySystemInformation - SystemExtendedProcessInformation not implemented\n");
2431 DPRINT1(
"NtQuerySystemInformation - SystemRecommendedSharedDataAlignment not implemented\n");
2467 if (MaxEntries == 1)
2483 *ReqSize =
sizeof(
ULONG);
2502 DPRINT(
"NtQuerySystemInformation - SystemExtendedHandleInformation\n");
2508 if (
Size < *ReqSize)
2538 NextTableEntry = NextTableEntry->
Flink)
2548 if ((HandleTableEntry->
Object) &&
2561 if (*ReqSize >
Size)
2654 if ((CurrentProc & 1) &&
2691 }
while (CurrentProc != 0);
2727 ULONG TableCount = 0;
2729 DPRINT(
"NtQuerySystemInformation - SystemFirmwareTableInformation\n");
2735 if (
Size < *ReqSize)
2750 DPRINT1(
"ACPI provider not implemented\n");
2757 DPRINT1(
"FIRM provider not implemented\n");
2786 DPRINT1(
"SystemFirmwareTableInformation: Unsupported provider (0x%x)\n",
2794 switch (SysFirmwareInfo->
Action)
2807 DPRINT1(
"SystemFirmwareTableInformation: Unsupported action (0x%x)\n",
2808 SysFirmwareInfo->
Action);
2833#define SI_QS(n) {QSI_USE(n),SSI_USE(n)}
2834#define SI_QX(n) {QSI_USE(n),NULL}
2835#define SI_XS(n) {NULL,SSI_USE(n)}
2836#define SI_XX(n) {NULL,NULL}
2882 SI_QX(SystemVerifierAddDriverInformation),
2883 SI_QX(SystemVerifierRemoveDriverInformation),
2884 SI_QX(SystemProcessorIdleInformation),
2885 SI_QX(SystemLegacyDriverInformation),
2894 SI_XS(SystemVerifierThunkExtend),
2922#define MIN_SYSTEM_INFO_CLASS (SystemBasicInformation)
2923#define MAX_SYSTEM_INFO_CLASS RTL_NUMBER_OF(CallQS)
2938 ULONG CapturedResultLength = 0;
2948#if (NTDDI_VERSION >= NTDDI_VISTA)
2973#if (NTDDI_VERSION < NTDDI_VISTA)
2988 SystemInformationLength,
2989 &CapturedResultLength);
3040 SystemInformationLength);
3061#undef ExGetPreviousMode
#define STATUS_PRIVILEGE_NOT_HELD
#define SystemLoadGdiDriverInformation
#define SystemExtendServiceTableInformation
ACPI_SIZE strlen(const char *String)
ACPI_BUFFER *RetBuffer ACPI_BUFFER *RetBuffer char ACPI_WALK_RESOURCE_CALLBACK void *Context ACPI_BUFFER *RetBuffer UINT16 ACPI_RESOURCE **ResourcePtr ACPI_GENERIC_ADDRESS *Reg UINT32 *ReturnValue UINT8 UINT8 *Slp_TypB ACPI_PHYSICAL_ADDRESS PhysicalAddress64 UINT32 UINT32 *TimeElapsed UINT32 ACPI_STATUS const char UINT32 ACPI_STATUS const char UINT32 const char const char * ModuleName
#define OBJ_NAME_PATH_SEPARATOR
_In_ ULONG _Out_writes_bytes_opt_ InformationLength PAUX_MODULE_EXTENDED_INFO ModuleInfo
BOOL Query(LPCTSTR *ServiceArgs, DWORD ArgCount, BOOL bExtended)
#define NT_SUCCESS(StatCode)
#define IMAGE_DIRECTORY_ENTRY_EXPORT
#define RtlImageDirectoryEntryToData
IN CINT OUT PVOID IN ULONG OUT PULONG ReturnLength
UNICODE_STRING * PUNICODE_STRING
#define ExAllocatePoolWithTag(hernya, size, tag)
#define IsListEmpty(ListHead)
#define KeReleaseSpinLock(sl, irql)
#define KeAcquireSpinLock(sl, irql)
#define KeQuerySystemTime(t)
#define KeGetCurrentIrql()
#define ExAcquireResourceExclusiveLite(res, wait)
#define ROUND_UP(n, align)
NTSTATUS NTAPI ExGetPoolTagInfo(IN PSYSTEM_POOLTAG_INFORMATION SystemInformation, IN ULONG SystemInformationLength, IN OUT PULONG ReturnLength OPTIONAL)
#define ExGetPreviousMode
FORCEINLINE VOID ExAcquirePushLockShared(PEX_PUSH_LOCK PushLock)
FORCEINLINE VOID ExReleasePushLockShared(PEX_PUSH_LOCK PushLock)
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
struct _FileName FileName
@ SystemCurrentTimeZoneInformation
@ SystemKernelDebuggerInformation
@ SystemTimeOfDayInformation
@ SystemProcessorInformation
@ SystemModuleInformation
@ SystemExceptionInformation
@ SystemVdmInstemulInformation
@ SystemLookasideInformation
@ SystemRegistryQuotaInformation
@ SystemNonPagedPoolInformation
@ SystemCrashDumpInformation
@ SystemInterruptInformation
@ SystemNextEventIdInformation
@ SystemUnloadGdiDriverInformation
@ SystemFileCacheInformation
@ SystemHandleInformation
@ SystemProcessInformation
@ SystemVdmBopInformation
@ SystemCallTimeInformation
@ SystemContextSwitchInformation
@ SystemTimeAdjustmentInformation
@ SystemFullMemoryInformation
@ SystemPrioritySeperation
@ SystemPageFileInformation
@ SystemStackTraceInformation
@ SystemObjectInformation
@ SystemDeviceInformation
@ SystemSummaryMemoryInformation
@ SystemPagedPoolInformation
@ SystemCrashDumpStateInformation
@ SystemProcessorPerformanceInformation
@ SystemCallCountInformation
@ SystemPoolTagInformation
enum _SYSTEM_INFORMATION_CLASS SYSTEM_INFORMATION_CLASS
_Must_inspect_result_ _In_ LPCGUID _In_ ULONG _In_ FSRTL_ALLOCATE_ECP_FLAGS _In_opt_ PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK _Inout_ PVOID LookasideList
_In_ FILTER_INFORMATION_CLASS InformationClass
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
LONG NTAPI ExSystemExceptionFilter(VOID)
static XMS_HANDLE HandleTable[XMS_MAX_HANDLES]
const GUID MSSmBios_RawSMBiosTables_GUID
#define EXCEPTION_EXECUTE_HANDLER
NTSYSAPI ULONG WINAPI NtGetCurrentProcessorNumber(void)
@ SystemWatchdogTimerHandler
@ SystemWatchdogTimerInformation
@ SystemWow64SharedInformation
@ SystemDpcBehaviourInformation
#define UInt32x32To64(a, b)
ULONG IoWriteOperationCount
LARGE_INTEGER IoReadTransferCount
LARGE_INTEGER IoWriteTransferCount
ULONG IoOtherOperationCount
LARGE_INTEGER IoOtherTransferCount
ULONG IoReadOperationCount
PCONFIGURATION_INFORMATION NTAPI IoGetConfigurationInformation(VOID)
Returns a pointer to the I/O manager's global configuration information structure.
#define KeLeaveCriticalRegion()
#define KeEnterCriticalRegion()
KSPIN_LOCK ExpPagedLookasideListLock
LIST_ENTRY ExPoolLookasideListHead
KSPIN_LOCK ExpNonPagedLookasideListLock
LIST_ENTRY ExpPagedLookasideListHead
LIST_ENTRY ExSystemLookasideListHead
LIST_ENTRY ExpNonPagedLookasideListHead
PFN_NUMBER MmLowestPhysicalPage
PFN_NUMBER MmHighestPhysicalPage
struct _SYSTEM_PERFORMANCE_INFORMATION * PSYSTEM_PERFORMANCE_INFORMATION
#define SystemPerformanceInformation
struct _SYSTEM_PERFORMANCE_INFORMATION SYSTEM_PERFORMANCE_INFORMATION
#define memcpy(s1, s2, n)
VOID NTAPI MmProbeAndLockPages(IN PMDL Mdl, IN KPROCESSOR_MODE AccessMode, IN LOCK_OPERATION Operation)
VOID NTAPI MmUnlockPages(IN PMDL Mdl)
struct _ThreadInfo ThreadInfo
#define ExFreePoolWithTag(_P, _T)
static const char * ImageName
#define _In_reads_bytes_(size)
#define _Out_writes_bytes_to_opt_(size, count)
#define _In_reads_bytes_opt_(size)
_In_ NDIS_STATUS _In_ ULONG _In_ USHORT _In_opt_ PVOID _In_ ULONG DataSize
FORCEINLINE struct _KPRCB * KeGetCurrentPrcb(VOID)
#define KeGetPreviousMode()
NTSYSAPI NTSTATUS NTAPI ZwSetSystemInformation(_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass, _In_reads_bytes_(SystemInformationLength) PVOID SystemInformation, _In_ ULONG SystemInformationLength)
struct _SYSTEM_PAGEFILE_INFORMATION SYSTEM_PAGEFILE_INFORMATION
struct _SYSTEM_FILECACHE_INFORMATION SYSTEM_FILECACHE_INFORMATION
struct _SYSTEM_DPC_BEHAVIOR_INFORMATION * PSYSTEM_DPC_BEHAVIOR_INFORMATION
struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX
struct _SYSTEM_SET_TIME_ADJUST_INFORMATION * PSYSTEM_SET_TIME_ADJUST_INFORMATION
struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
struct _SYSTEM_LOOKASIDE_INFORMATION SYSTEM_LOOKASIDE_INFORMATION
struct _SYSTEM_REGISTRY_QUOTA_INFORMATION SYSTEM_REGISTRY_QUOTA_INFORMATION
struct _SYSTEM_THREAD_INFORMATION * PSYSTEM_THREAD_INFORMATION
struct _SYSTEM_NUMA_INFORMATION * PSYSTEM_NUMA_INFORMATION
struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO SYSTEM_HANDLE_TABLE_ENTRY_INFO
struct _SYSTEM_CONTEXT_SWITCH_INFORMATION * PSYSTEM_CONTEXT_SWITCH_INFORMATION
struct _SYSTEM_DEVICE_INFORMATION * PSYSTEM_DEVICE_INFORMATION
struct _SYSTEM_INTERRUPT_INFORMATION * PSYSTEM_INTERRUPT_INFORMATION
struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION SYSTEM_KERNEL_DEBUGGER_INFORMATION
struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION * PSYSTEM_QUERY_TIME_ADJUST_INFORMATION
struct _SYSTEM_PROCESSOR_INFORMATION * PSYSTEM_PROCESSOR_INFORMATION
struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION SYSTEM_QUERY_TIME_ADJUST_INFORMATION
struct _SYSTEM_FLAGS_INFORMATION SYSTEM_FLAGS_INFORMATION
struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION * PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
struct _SYSTEM_PROCESS_INFORMATION * PSYSTEM_PROCESS_INFORMATION
struct _SYSTEM_REGISTRY_QUOTA_INFORMATION * PSYSTEM_REGISTRY_QUOTA_INFORMATION
@ SystemSessionInformation
@ SystemTimeSlipNotification
@ SystemProcessorPowerInformation
@ SystemFirmwareTableInformation
@ SystemLogicalProcessorInformation
@ SystemVerifierInformation
@ SystemEmulationBasicInformation
@ SystemBigPoolInformation
@ SystemSessionProcessesInformation
@ SystemLostDelayedWriteInformation
@ SystemRecommendedSharedDataAlignment
@ SystemExtendedHandleInformation
@ SystemSessionMappedViewInformation
@ SystemEmulationProcessorInformation
@ SystemExtendedProcessInformation
@ SystemRangeStartInformation
@ SystemObjectSecurityMode
@ SystemRegisterFirmwareTableInformationHandler
@ SystemLoadGdiDriverInSystemSpaceInformation
@ SystemSessionPoolTagInformation
@ SystemHotpatchInformation
@ SystemPerformanceTraceInformation
@ SystemNumaAvailableMemory
@ SystemPrefetcherInformation
struct _SYSTEM_EXCEPTION_INFORMATION * PSYSTEM_EXCEPTION_INFORMATION
struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION * PSYSTEM_KERNEL_DEBUGGER_INFORMATION
struct _SYSTEM_FLAGS_INFORMATION * PSYSTEM_FLAGS_INFORMATION
struct _SYSTEM_PROCESS_INFORMATION SYSTEM_PROCESS_INFORMATION
struct _SYSTEM_PROCESSOR_INFORMATION SYSTEM_PROCESSOR_INFORMATION
struct _SYSTEM_DEVICE_INFORMATION SYSTEM_DEVICE_INFORMATION
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
struct _RTL_PROCESS_MODULE_INFORMATION RTL_PROCESS_MODULE_INFORMATION
struct _RTL_TIME_ZONE_INFORMATION RTL_TIME_ZONE_INFORMATION
DRIVER_INFORMATION DriverInfo
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToAnsiString(PANSI_STRING DestinationString, PUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSYSAPI VOID NTAPI RtlFreeAnsiString(PANSI_STRING AnsiString)
NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING DestinationString, PANSI_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
NTSYSAPI VOID NTAPI RtlInitAnsiString(PANSI_STRING DestinationString, PCSZ SourceString)
#define TYPE_ALIGNMENT(t)
struct _SYSTEM_FIRMWARE_TABLE_INFORMATION * PSYSTEM_FIRMWARE_TABLE_INFORMATION
@ SystemFirmwareTable_Enumerate
@ SystemFirmwareTable_Get
_In_ ULONG _In_ ULONG _In_ ULONG Length
ULONG CcPinMappedDataCount
PHANDLE_TABLE_ENTRY NTAPI ExpLookupHandleTableEntry(IN PHANDLE_TABLE HandleTable, IN EXHANDLE Handle)
BOOLEAN NTAPI ExpLockHandleTableEntry(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
VOID NTAPI ExUnlockHandleTableEntry(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
VOID FASTCALL ExReleaseResourceLite(IN PERESOURCE Resource)
BOOLEAN NTAPI ExIsProcessorFeaturePresent(IN ULONG ProcessorFeature)
NTSTATUS NTAPI NtQuerySystemEnvironmentValue(IN PUNICODE_STRING VariableName, OUT PWSTR ValueBuffer, IN ULONG ValueBufferLength, IN OUT PULONG ReturnLength OPTIONAL)
NTSTATUS NTAPI MmSessionCreate(OUT PULONG SessionId)
VOID NTAPI ExQueryPoolUsage(OUT PULONG PagedPoolPages, OUT PULONG NonPagedPoolPages, OUT PULONG PagedPoolAllocs, OUT PULONG PagedPoolFrees, OUT PULONG PagedPoolLookasideHits, OUT PULONG NonPagedPoolAllocs, OUT PULONG NonPagedPoolFrees, OUT PULONG NonPagedPoolLookasideHits)
VOID NTAPI ExUnlockUserBuffer(PMDL Mdl)
LIST_ENTRY ExpFirmwareTableProviderListHead
VOID NTAPI ExGetCurrentProcessorCounts(PULONG IdleTime, PULONG KernelAndUserTime, PULONG ProcessorNumber)
__kernel_entry NTSTATUS NTAPI NtSetSystemInformation(_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass, _In_reads_bytes_(SystemInformationLength) PVOID SystemInformation, _In_ ULONG SystemInformationLength)
#define MAX_SYSTEM_INFO_CLASS
struct _QSSI_CALLS QSSI_CALLS
FAST_MUTEX ExpEnvironmentLock
NTSTATUS NTAPI NtEnumerateSystemEnvironmentValuesEx(IN ULONG InformationClass, IN PVOID Buffer, IN ULONG BufferLength)
NTSTATUS NTAPI NtSetSystemEnvironmentValueEx(_In_ PUNICODE_STRING VariableName, _In_ LPGUID VendorGuid, _In_reads_bytes_opt_(ValueLength) PVOID Value, _In_ ULONG ValueLength, _In_ ULONG Attributes)
EX_PUSH_LOCK HandleTableListLock
#define MIN_SYSTEM_INFO_CLASS
NTSTATUS NTAPI MmSessionDelete(IN ULONG SessionId)
BOOLEAN NTAPI ExVerifySuite(SUITE_TYPE SuiteType)
LIST_ENTRY HandleTableListHead
NTSTATUS NTAPI NtQuerySystemEnvironmentValueEx(_In_ PUNICODE_STRING VariableName, _In_ LPGUID VendorGuid, _Out_opt_ PVOID Value, _Inout_ PULONG ReturnLength, _Out_opt_ PULONG Attributes)
ERESOURCE ExpFirmwareTableResource
static QSSI_CALLS CallQS[]
NTSTATUS NTAPI ExpQueryModuleInformation(IN PLIST_ENTRY KernelModeList, IN PLIST_ENTRY UserModeList, OUT PRTL_PROCESS_MODULES Modules, IN ULONG Length, OUT PULONG ReturnLength)
NTSTATUS NTAPI ExpGetRawSMBiosTable(_Out_opt_ PVOID Buffer, _Out_ ULONG *OutSize, _In_ ULONG BufferSize)
NTSTATUS NTAPI ExLockUserBuffer(PVOID BaseAddress, ULONG Length, KPROCESSOR_MODE AccessMode, LOCK_OPERATION Operation, PVOID *MappedSystemVa, PMDL *OutMdl)
static VOID ExpCopyLookasideInformation(PSYSTEM_LOOKASIDE_INFORMATION *InfoPointer, PULONG RemainingPointer, PLIST_ENTRY ListHead, BOOLEAN ListUsesMisses)
NTSTATUS NTAPI NtSetSystemEnvironmentValue(IN PUNICODE_STRING VariableName, IN PUNICODE_STRING Value)
VOID NTAPI ExGetCurrentProcessorCpuUsage(PULONG CpuUsage)
FORCEINLINE NTSTATUS ExpConvertLdrModuleToRtlModule(IN ULONG ModuleCount, IN PLDR_DATA_TABLE_ENTRY LdrEntry, OUT PRTL_PROCESS_MODULE_INFORMATION ModuleInfo)
LARGE_INTEGER ExpTimeZoneBias
RTL_TIME_ZONE_INFORMATION ExpTimeZoneInfo
NTSTATUS ExpSetTimeZoneInformation(PRTL_TIME_ZONE_INFORMATION TimeZoneInformation)
#define KeGetContextSwitches(Prcb)
#define MmSystemRangeStart
BOOLEAN KiTimeAdjustmentEnabled
ULONG KiAdjustDpcThreshold
PKPRCB KiProcessorBlock[]
ULONG KiMaximumDpcQueueDepth
ULONG NTAPI KeQueryRuntimeProcess(IN PKPROCESS Process, OUT PULONG UserTime)
KAFFINITY KeActiveProcessors
USHORT KeProcessorRevision
USHORT KeProcessorArchitecture
NTSTATUS NTAPI MmLoadSystemImage(IN PUNICODE_STRING FileName, IN PUNICODE_STRING NamePrefix OPTIONAL, IN PUNICODE_STRING LoadedName OPTIONAL, IN ULONG Flags, OUT PVOID *ModuleObject, OUT PVOID *ImageBaseAddress)
MM_MEMORY_CONSUMER MiMemoryConsumers[MC_MAXIMUM]
LIST_ENTRY MmLoadedUserImageList
PFN_COUNT MmNumberOfPhysicalPages
#define MM_VIRTMEM_GRANULARITY
PFN_COUNT MiFreeSwapPages
NTSTATUS NTAPI MmUnloadSystemImage(IN PVOID ImageHandle)
PFN_NUMBER MmAvailablePages
SIZE_T MmTotalCommittedPages
PFN_COUNT MiUsedSwapPages
const LUID SeDebugPrivilege
const LUID SeSystemtimePrivilege
const LUID SeTcbPrivilege
const LUID SeLoadDriverPrivilege
const LUID SeSystemEnvironmentPrivilege
ULONG NTAPI KeQueryTimeIncrement(VOID)
NTSTATUS NTAPI SeLocateProcessImageName(_In_ PEPROCESS Process, _Out_ PUNICODE_STRING *ProcessImageName)
Finds the process image name of a specific process.
BOOLEAN NTAPI SeSinglePrivilegeCheck(_In_ LUID PrivilegeValue, _In_ KPROCESSOR_MODE PreviousMode)
Checks if a single privilege is present in the context of the calling thread.
NTSTATUS NTAPI IoWMIOpenBlock(_In_ LPCGUID DataBlockGuid, _In_ ULONG DesiredAccess, _Out_ PVOID *DataBlockObject)
NTSTATUS NTAPI IoWMIQueryAllData(IN PVOID DataBlockObject, IN OUT ULONG *InOutBufferSize, OUT PVOID OutBuffer)
struct _PROCESSOR_POWER_INFORMATION PROCESSOR_POWER_INFORMATION
#define STATUS_INVALID_IMAGE_FORMAT
#define STATUS_INVALID_PARAMETER_2
#define STATUS_ACCESS_VIOLATION
#define STATUS_NOT_IMPLEMENTED
#define STATUS_INVALID_INFO_CLASS
#define STATUS_ILLEGAL_FUNCTION
ULONG NTAPI ObGetProcessHandleCount(IN PEPROCESS Process)
#define OBJ_HANDLE_ATTRIBUTES
#define ObpGetHandleObject(x)
ULONG ObpObjectSecurityMode
LIST_ENTRY PsLoadedModuleList
ERESOURCE PsLoadedModuleResource
VOID NTAPI PsChangeQuantumTable(IN BOOLEAN Immediate, IN ULONG PrioritySeparation)
PEPROCESS NTAPI PsGetNextProcess(IN PEPROCESS OldProcess OPTIONAL)
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
#define _SEH2_YIELD(__stmt)
ARC_STATUS NTAPI HalGetEnvironmentVariable(IN PCH Name, IN USHORT ValueLength, IN PCH Value)
ARC_STATUS NTAPI HalSetEnvironmentVariable(IN PCH Name, IN PCH Value)
PVOID MmHighestUserAddress
static __inline NTSTATUS ProbeAndCaptureUnicodeString(OUT PUNICODE_STRING Dest, IN KPROCESSOR_MODE CurrentMode, IN const UNICODE_STRING *UnsafeSrc)
static __inline VOID ReleaseCapturedUnicodeString(IN PUNICODE_STRING CapturedString, IN KPROCESSOR_MODE CurrentMode)
#define ProbeForWriteUlong(Ptr)
FORCEINLINE ULONG KeGetCurrentProcessorNumber(VOID)
#define STATUS_BUFFER_TOO_SMALL
#define STATUS_BUFFER_OVERFLOW
PULONG MinorVersion OPTIONAL
struct _SYSTEM_BASIC_INFORMATION * PSYSTEM_BASIC_INFORMATION
struct _SYSTEM_BASIC_INFORMATION SYSTEM_BASIC_INFORMATION
NTSYSAPI NTSTATUS NTAPI NtQuerySystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInfoClass, OUT PVOID SystemInfoBuffer, IN ULONG SystemInfoBufferSize, OUT PULONG BytesReturned OPTIONAL)
CHAR FullPathName[AUX_KLIB_MODULE_PATH_LEN]
PKSTART_ROUTINE StartAddress
LIST_ENTRY ThreadListEntry
struct _KTHREAD * IdleThread
struct _KPRCB * MultiThreadSetMaster
ULONG KeExceptionDispatchCount
LARGE_INTEGER IoReadTransferCount
LARGE_INTEGER IoOtherTransferCount
LONG IoReadOperationCount
LONG IoWriteOperationCount
LONG IoOtherOperationCount
UINT64 MultiThreadProcessorSet
LARGE_INTEGER IoWriteTransferCount
ULONG KeAlignmentFixupCount
struct _LIST_ENTRY * Flink
NTSTATUS(* Query)(PVOID, ULONG, PULONG)
NTSTATUS(* Set)(PVOID, ULONG)
UNICODE_STRING PageFileName
#define RTL_CONSTANT_STRING(s)
#define FIELD_OFFSET(t, f)
#define RtlCopyMemory(Destination, Source, Length)
#define RtlZeroMemory(Destination, Length)
#define RtlMoveMemory(Destination, Source, Length)
#define CONTAINING_RECORD(address, type, field)
#define STATUS_ACCESS_DENIED
#define STATUS_UNSUCCESSFUL
#define STATUS_INFO_LENGTH_MISMATCH
#define STATUS_INSUFFICIENT_RESOURCES
_Must_inspect_result_ _In_ WDFCHILDLIST _In_ PWDF_CHILD_LIST_ITERATOR _Out_ WDFDEVICE _Inout_opt_ PWDF_CHILD_RETRIEVE_INFO Info
_In_ WDFCOLLECTION _In_ ULONG Index
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG BufferLength
_In_ WDFDEVICE _In_ PVOID _In_opt_ PMDL Mdl
_In_ WDFMEMORY _Out_opt_ size_t * BufferSize
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _In_ ULONG ValueLength
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _Out_opt_ PUSHORT _Inout_opt_ PUNICODE_STRING Value
_In_ ULONG _Out_opt_ PULONG RequiredLength
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
struct LOOKASIDE_ALIGN _GENERAL_LOOKASIDE GENERAL_LOOKASIDE
struct LOOKASIDE_ALIGN _GENERAL_LOOKASIDE * PGENERAL_LOOKASIDE
enum _SUITE_TYPE SUITE_TYPE
DRIVER_INITIALIZE * PDRIVER_INITIALIZE
#define KD_DEBUGGER_ENABLED
#define KD_DEBUGGER_NOT_PRESENT
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
#define PROCESSOR_FEATURE_MAX
enum _LOCK_OPERATION LOCK_OPERATION
struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION SYSTEM_LOGICAL_PROCESSOR_INFORMATION
#define MmGetSystemAddressForMdlSafe(_Mdl, _Priority)
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
_In_ ACCESS_MASK _In_opt_ POBJECT_TYPE _In_ KPROCESSOR_MODE _Out_ PVOID _Out_opt_ POBJECT_HANDLE_INFORMATION HandleInformation
#define ObDereferenceObject
_In_ KPROCESSOR_MODE PreviousMode