nt.h@ 62534

Last change on this file since 62534 was 62474, checked in by vboxsync, 8 years ago
(C) 2016
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 121.0 KB

Line
1	/* $Id: nt.h 62474 2016-07-22 18:16:43Z vboxsync $ */
2	/** @file
3	* IPRT - Header for code using the Native NT API.
4	*/
5
6	/*
7	* Copyright (C) 2010-2016 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27	#ifndef ___iprt_nt_nt_h___
28	#define ___iprt_nt_nt_h___
29
30	/** @def IPRT_NT_MAP_TO_ZW
31	* Map Nt calls to Zw calls. In ring-0 the Zw calls let you pass kernel memory
32	* to the APIs (takes care of the previous context checks).
33	*/
34	#ifdef DOXYGEN_RUNNING
35	# define IPRT_NT_MAP_TO_ZW
36	#endif
37
38	#ifdef IPRT_NT_MAP_TO_ZW
39	# define NtQueryInformationFile ZwQueryInformationFile
40	# define NtQueryInformationProcess ZwQueryInformationProcess
41	# define NtQueryInformationThread ZwQueryInformationThread
42	# define NtQuerySystemInformation ZwQuerySystemInformation
43	# define NtQuerySecurityObject ZwQuerySecurityObject
44	# define NtClose ZwClose
45	# define NtCreateFile ZwCreateFile
46	# define NtReadFile ZwReadFile
47	# define NtWriteFile ZwWriteFile
48	# define NtFlushBuffersFile ZwFlushBuffersFile
49	/** @todo this is very incomplete! */
50	#endif
51
52	#include <ntstatus.h>
53
54	/*
55	* Hacks common to both base header sets.
56	*/
57	#define RtlFreeUnicodeString WrongLinkage_RtlFreeUnicodeString
58	#define NtQueryObject Incomplete_NtQueryObject
59	#define ZwQueryObject Incomplete_ZwQueryObject
60	#define NtSetInformationObject Incomplete_NtSetInformationObject
61	#define _OBJECT_INFORMATION_CLASS Incomplete_OBJECT_INFORMATION_CLASS
62	#define OBJECT_INFORMATION_CLASS Incomplete_OBJECT_INFORMATION_CLASS
63	#define ObjectBasicInformation Incomplete_ObjectBasicInformation
64	#define ObjectTypeInformation Incomplete_ObjectTypeInformation
65	#define _PEB Incomplete__PEB
66	#define PEB Incomplete_PEB
67	#define PPEB Incomplete_PPEB
68	#define _TEB Incomplete__TEB
69	#define TEB Incomplete_TEB
70	#define PTEB Incomplete_PTEB
71	#define _PEB_LDR_DATA Incomplete__PEB_LDR_DATA
72	#define PEB_LDR_DATA Incomplete_PEB_LDR_DATA
73	#define PPEB_LDR_DATA Incomplete_PPEB_LDR_DATA
74	#define _KUSER_SHARED_DATA Incomplete__KUSER_SHARED_DATA
75	#define KUSER_SHARED_DATA Incomplete_KUSER_SHARED_DATA
76	#define PKUSER_SHARED_DATA Incomplete_PKUSER_SHARED_DATA
77
78
79
80	#ifdef IPRT_NT_USE_WINTERNL
81	/*
82	* Use Winternl.h.
83	*/
84	# define _FILE_INFORMATION_CLASS IncompleteWinternl_FILE_INFORMATION_CLASS
85	# define FILE_INFORMATION_CLASS IncompleteWinternl_FILE_INFORMATION_CLASS
86	# define FileDirectoryInformation IncompleteWinternl_FileDirectoryInformation
87
88	# define NtQueryInformationProcess IncompleteWinternl_NtQueryInformationProcess
89	# define NtSetInformationProcess IncompleteWinternl_NtSetInformationProcess
90	# define PROCESSINFOCLASS IncompleteWinternl_PROCESSINFOCLASS
91	# define _PROCESSINFOCLASS IncompleteWinternl_PROCESSINFOCLASS
92	# define PROCESS_BASIC_INFORMATION IncompleteWinternl_PROCESS_BASIC_INFORMATION
93	# define PPROCESS_BASIC_INFORMATION IncompleteWinternl_PPROCESS_BASIC_INFORMATION
94	# define _PROCESS_BASIC_INFORMATION IncompleteWinternl_PROCESS_BASIC_INFORMATION
95	# define ProcessBasicInformation IncompleteWinternl_ProcessBasicInformation
96	# define ProcessDebugPort IncompleteWinternl_ProcessDebugPort
97	# define ProcessWow64Information IncompleteWinternl_ProcessWow64Information
98	# define ProcessImageFileName IncompleteWinternl_ProcessImageFileName
99	# define ProcessBreakOnTermination IncompleteWinternl_ProcessBreakOnTermination
100
101	# define RTL_USER_PROCESS_PARAMETERS IncompleteWinternl_RTL_USER_PROCESS_PARAMETERS
102	# define PRTL_USER_PROCESS_PARAMETERS IncompleteWinternl_PRTL_USER_PROCESS_PARAMETERS
103	# define _RTL_USER_PROCESS_PARAMETERS IncompleteWinternl__RTL_USER_PROCESS_PARAMETERS
104
105	# define NtQueryInformationThread IncompleteWinternl_NtQueryInformationThread
106	# define NtSetInformationThread IncompleteWinternl_NtSetInformationThread
107	# define THREADINFOCLASS IncompleteWinternl_THREADINFOCLASS
108	# define _THREADINFOCLASS IncompleteWinternl_THREADINFOCLASS
109	# define ThreadIsIoPending IncompleteWinternl_ThreadIsIoPending
110
111	# define NtQuerySystemInformation IncompleteWinternl_NtQuerySystemInformation
112	# define NtSetSystemInformation IncompleteWinternl_NtSetSystemInformation
113	# define SYSTEM_INFORMATION_CLASS IncompleteWinternl_SYSTEM_INFORMATION_CLASS
114	# define _SYSTEM_INFORMATION_CLASS IncompleteWinternl_SYSTEM_INFORMATION_CLASS
115	# define SystemBasicInformation IncompleteWinternl_SystemBasicInformation
116	# define SystemPerformanceInformation IncompleteWinternl_SystemPerformanceInformation
117	# define SystemTimeOfDayInformation IncompleteWinternl_SystemTimeOfDayInformation
118	# define SystemProcessInformation IncompleteWinternl_SystemProcessInformation
119	# define SystemProcessorPerformanceInformation IncompleteWinternl_SystemProcessorPerformanceInformation
120	# define SystemInterruptInformation IncompleteWinternl_SystemInterruptInformation
121	# define SystemExceptionInformation IncompleteWinternl_SystemExceptionInformation
122	# define SystemRegistryQuotaInformation IncompleteWinternl_SystemRegistryQuotaInformation
123	# define SystemLookasideInformation IncompleteWinternl_SystemLookasideInformation
124	# define SystemPolicyInformation IncompleteWinternl_SystemPolicyInformation
125
126
127	# define WIN32_NO_STATUS
128	# include <windef.h>
129	# include <winnt.h>
130	# include <winternl.h>
131	# undef WIN32_NO_STATUS
132	# include <ntstatus.h>
133
134
135	# undef _FILE_INFORMATION_CLASS
136	# undef FILE_INFORMATION_CLASS
137	# undef FileDirectoryInformation
138
139	# undef NtQueryInformationProcess
140	# undef NtSetInformationProcess
141	# undef PROCESSINFOCLASS
142	# undef _PROCESSINFOCLASS
143	# undef PROCESS_BASIC_INFORMATION
144	# undef PPROCESS_BASIC_INFORMATION
145	# undef _PROCESS_BASIC_INFORMATION
146	# undef ProcessBasicInformation
147	# undef ProcessDebugPort
148	# undef ProcessWow64Information
149	# undef ProcessImageFileName
150	# undef ProcessBreakOnTermination
151
152	# undef RTL_USER_PROCESS_PARAMETERS
153	# undef PRTL_USER_PROCESS_PARAMETERS
154	# undef _RTL_USER_PROCESS_PARAMETERS
155
156	# undef NtQueryInformationThread
157	# undef NtSetInformationThread
158	# undef THREADINFOCLASS
159	# undef _THREADINFOCLASS
160	# undef ThreadIsIoPending
161
162	# undef NtQuerySystemInformation
163	# undef NtSetSystemInformation
164	# undef SYSTEM_INFORMATION_CLASS
165	# undef _SYSTEM_INFORMATION_CLASS
166	# undef SystemBasicInformation
167	# undef SystemPerformanceInformation
168	# undef SystemTimeOfDayInformation
169	# undef SystemProcessInformation
170	# undef SystemProcessorPerformanceInformation
171	# undef SystemInterruptInformation
172	# undef SystemExceptionInformation
173	# undef SystemRegistryQuotaInformation
174	# undef SystemLookasideInformation
175	# undef SystemPolicyInformation
176
177	#else
178	/*
179	* Use ntifs.h and wdm.h.
180	*/
181	# ifdef RT_ARCH_X86
182	# define _InterlockedAddLargeStatistic _InterlockedAddLargeStatistic_StupidDDKVsCompilerCrap
183	# pragma warning(disable : 4163)
184	# endif
185
186	# include <ntifs.h>
187	# include <wdm.h>
188
189	# ifdef RT_ARCH_X86
190	# pragma warning(default : 4163)
191	# undef _InterlockedAddLargeStatistic
192	# endif
193
194	# define IPRT_NT_NEED_API_GROUP_NTIFS
195	#endif
196
197	#undef RtlFreeUnicodeString
198	#undef NtQueryObject
199	#undef ZwQueryObject
200	#undef NtSetInformationObject
201	#undef _OBJECT_INFORMATION_CLASS
202	#undef OBJECT_INFORMATION_CLASS
203	#undef ObjectBasicInformation
204	#undef ObjectTypeInformation
205	#undef _PEB
206	#undef PEB
207	#undef PPEB
208	#undef _TEB
209	#undef TEB
210	#undef PTEB
211	#undef _PEB_LDR_DATA
212	#undef PEB_LDR_DATA
213	#undef PPEB_LDR_DATA
214	#undef _KUSER_SHARED_DATA
215	#undef KUSER_SHARED_DATA
216	#undef PKUSER_SHARED_DATA
217
218
219	#include <iprt/types.h>
220	#include <iprt/assert.h>
221
222
223	/** @name Useful macros
224	* @{ */
225	/** Indicates that we're targeting native NT in the current source. */
226	#define RTNT_USE_NATIVE_NT 1
227	/** Initializes a IO_STATUS_BLOCK. */
228	#define RTNT_IO_STATUS_BLOCK_INITIALIZER { STATUS_FAILED_DRIVER_ENTRY, ~(uintptr_t)42 }
229	/** Reinitializes a IO_STATUS_BLOCK. */
230	#define RTNT_IO_STATUS_BLOCK_REINIT(a_pIos) \
231	do { (a_pIos)->Status = STATUS_FAILED_DRIVER_ENTRY; (a_pIos)->Information = ~(uintptr_t)42; } while (0)
232	/** Similar to INVALID_HANDLE_VALUE in the Windows environment. */
233	#define RTNT_INVALID_HANDLE_VALUE ( (HANDLE)~(uintptr_t)0 )
234	/** Constant UNICODE_STRING initializer. */
235	#define RTNT_CONSTANT_UNISTR(a_String) { sizeof(a_String) - sizeof(WCHAR), sizeof(a_String), (WCHAR *)a_String }
236	/** @} */
237
238
239	/** @name IPRT helper functions for NT
240	* @{ */
241	RT_C_DECLS_BEGIN
242
243	RTDECL(int) RTNtPathOpen(const char *pszPath, ACCESS_MASK fDesiredAccess, ULONG fFileAttribs, ULONG fShareAccess,
244	ULONG fCreateDisposition, ULONG fCreateOptions, ULONG fObjAttribs,
245	PHANDLE phHandle, PULONG_PTR puDisposition);
246	RTDECL(int) RTNtPathOpenDir(const char *pszPath, ACCESS_MASK fDesiredAccess, ULONG fShareAccess, ULONG fCreateOptions,
247	ULONG fObjAttribs, PHANDLE phHandle, bool *pfObjDir);
248	RTDECL(int) RTNtPathClose(HANDLE hHandle);
249
250	/**
251	* Converts a windows-style path to NT format and encoding.
252	*
253	* @returns IPRT status code.
254	* @param pNtName Where to return the NT name. Free using
255	* RTNtPathFree.
256	* @param phRootDir Where to return the root handle, if applicable.
257	* @param pszPath The UTF-8 path.
258	*/
259	RTDECL(int) RTNtPathFromWinUtf8(struct _UNICODE_STRING pNtName, PHANDLE phRootDir, const char pszPath);
260
261	/**
262	* Converts a UTF-16 windows-style path to NT format.
263	*
264	* @returns IPRT status code.
265	* @param pNtName Where to return the NT name. Free using
266	* RTNtPathFree.
267	* @param phRootDir Where to return the root handle, if applicable.
268	* @param pwszPath The UTF-16 windows-style path.
269	* @param cwcPath The max length of the windows-style path in
270	* RTUTF16 units. Use RTSTR_MAX if unknown and @a
271	* pwszPath is correctly terminated.
272	*/
273	RTDECL(int) RTNtPathFromWinUtf16Ex(struct _UNICODE_STRING pNtName, HANDLE phRootDir, PCRTUTF16 pwszPath, size_t cwcPath);
274
275	/**
276	* Ensures that the NT string has sufficient storage to hold @a cwcMin RTUTF16
277	* chars plus a terminator.
278	*
279	* The NT string must have been returned by RTNtPathFromWinUtf8 or
280	* RTNtPathFromWinUtf16Ex.
281	*
282	* @returns IPRT status code.
283	* @param pNtName The NT path string.
284	* @param cwcMin The minimum number of RTUTF16 chars. Max 32767.
285	* @sa RTNtPathFree
286	*/
287	RTDECL(int) RTNtPathEnsureSpace(struct _UNICODE_STRING *pNtName, size_t cwcMin);
288
289	/**
290	* Frees the native path and root handle.
291	*
292	* @param pNtName The NT path from a successful call to
293	* RTNtPathFromWinUtf8 or RTNtPathFromWinUtf16Ex.
294	* @param phRootDir The root handle variable from the same call.
295	*/
296	RTDECL(void) RTNtPathFree(struct _UNICODE_STRING pNtName, HANDLE phRootDir);
297
298
299	/**
300	* Checks whether the path could be containing alternative 8.3 names generated
301	* by NTFS, FAT, or other similar file systems.
302	*
303	* @returns Pointer to the first component that might be an 8.3 name, NULL if
304	* not 8.3 path.
305	* @param pwszPath The path to check.
306	*
307	* @remarks This is making bad ASSUMPTION wrt to the naming scheme of 8.3 names,
308	* however, non-tilde 8.3 aliases are probably rare enough to not be
309	* worth all the extra code necessary to open each path component and
310	* check if we've got the short name or not.
311	*/
312	RTDECL(PRTUTF16) RTNtPathFindPossible8dot3Name(PCRTUTF16 pwszPath);
313
314	/**
315	* Fixes up a path possibly containing one or more alternative 8-dot-3 style
316	* components.
317	*
318	* The path is fixed up in place. Errors are ignored.
319	*
320	* @returns VINF_SUCCESS if it all went smoothly, informational status codes
321	* indicating the nature of last problem we ran into.
322	*
323	* @param pUniStr The path to fix up. MaximumLength is the max buffer
324	* length.
325	* @param fPathOnly Whether to only process the path and leave the filename
326	* as passed in.
327	*/
328	RTDECL(int) RTNtPathExpand8dot3Path(struct _UNICODE_STRING *pUniStr, bool fPathOnly);
329
330
331	RT_C_DECLS_END
332	/** @} */
333
334
335	/** @name NT API delcarations.
336	* @{ */
337	RT_C_DECLS_BEGIN
338
339	/** @name Process access rights missing in ntddk headers
340	* @{ */
341	#ifndef PROCESS_TERMINATE
342	# define PROCESS_TERMINATE UINT32_C(0x00000001)
343	#endif
344	#ifndef PROCESS_CREATE_THREAD
345	# define PROCESS_CREATE_THREAD UINT32_C(0x00000002)
346	#endif
347	#ifndef PROCESS_SET_SESSIONID
348	# define PROCESS_SET_SESSIONID UINT32_C(0x00000004)
349	#endif
350	#ifndef PROCESS_VM_OPERATION
351	# define PROCESS_VM_OPERATION UINT32_C(0x00000008)
352	#endif
353	#ifndef PROCESS_VM_READ
354	# define PROCESS_VM_READ UINT32_C(0x00000010)
355	#endif
356	#ifndef PROCESS_VM_WRITE
357	# define PROCESS_VM_WRITE UINT32_C(0x00000020)
358	#endif
359	#ifndef PROCESS_DUP_HANDLE
360	# define PROCESS_DUP_HANDLE UINT32_C(0x00000040)
361	#endif
362	#ifndef PROCESS_CREATE_PROCESS
363	# define PROCESS_CREATE_PROCESS UINT32_C(0x00000080)
364	#endif
365	#ifndef PROCESS_SET_QUOTA
366	# define PROCESS_SET_QUOTA UINT32_C(0x00000100)
367	#endif
368	#ifndef PROCESS_SET_INFORMATION
369	# define PROCESS_SET_INFORMATION UINT32_C(0x00000200)
370	#endif
371	#ifndef PROCESS_QUERY_INFORMATION
372	# define PROCESS_QUERY_INFORMATION UINT32_C(0x00000400)
373	#endif
374	#ifndef PROCESS_SUSPEND_RESUME
375	# define PROCESS_SUSPEND_RESUME UINT32_C(0x00000800)
376	#endif
377	#ifndef PROCESS_QUERY_LIMITED_INFORMATION
378	# define PROCESS_QUERY_LIMITED_INFORMATION UINT32_C(0x00001000)
379	#endif
380	#ifndef PROCESS_SET_LIMITED_INFORMATION
381	# define PROCESS_SET_LIMITED_INFORMATION UINT32_C(0x00002000)
382	#endif
383	#define PROCESS_UNKNOWN_4000 UINT32_C(0x00004000)
384	#define PROCESS_UNKNOWN_6000 UINT32_C(0x00008000)
385	#ifndef PROCESS_ALL_ACCESS
386	# define PROCESS_ALL_ACCESS ( STANDARD_RIGHTS_REQUIRED \| SYNCHRONIZE \| UINT32_C(0x0000ffff) )
387	#endif
388	/** @} */
389
390	/** @name Thread access rights missing in ntddk headers
391	* @{ */
392	#ifndef THREAD_QUERY_INFORMATION
393	# define THREAD_QUERY_INFORMATION UINT32_C(0x00000040)
394	#endif
395	#ifndef THREAD_SET_THREAD_TOKEN
396	# define THREAD_SET_THREAD_TOKEN UINT32_C(0x00000080)
397	#endif
398	#ifndef THREAD_IMPERSONATE
399	# define THREAD_IMPERSONATE UINT32_C(0x00000100)
400	#endif
401	#ifndef THREAD_DIRECT_IMPERSONATION
402	# define THREAD_DIRECT_IMPERSONATION UINT32_C(0x00000200)
403	#endif
404	#ifndef THREAD_RESUME
405	# define THREAD_RESUME UINT32_C(0x00001000)
406	#endif
407	#define THREAD_UNKNOWN_2000 UINT32_C(0x00002000)
408	#define THREAD_UNKNOWN_4000 UINT32_C(0x00004000)
409	#define THREAD_UNKNOWN_8000 UINT32_C(0x00008000)
410	/** @} */
411
412	/** @name Special handle values.
413	* @{ */
414	#ifndef NtCurrentProcess
415	# define NtCurrentProcess() ( (HANDLE)-(intptr_t)1 )
416	#endif
417	#ifndef NtCurrentThread
418	# define NtCurrentThread() ( (HANDLE)-(intptr_t)2 )
419	#endif
420	#ifndef ZwCurrentProcess
421	# define ZwCurrentProcess() NtCurrentProcess()
422	#endif
423	#ifndef ZwCurrentThread
424	# define ZwCurrentThread() NtCurrentThread()
425	#endif
426	/** @} */
427
428
429	/** @name Directory object access rights.
430	* @{ */
431	#ifndef DIRECTORY_QUERY
432	# define DIRECTORY_QUERY UINT32_C(0x00000001)
433	#endif
434	#ifndef DIRECTORY_TRAVERSE
435	# define DIRECTORY_TRAVERSE UINT32_C(0x00000002)
436	#endif
437	#ifndef DIRECTORY_CREATE_OBJECT
438	# define DIRECTORY_CREATE_OBJECT UINT32_C(0x00000004)
439	#endif
440	#ifndef DIRECTORY_CREATE_SUBDIRECTORY
441	# define DIRECTORY_CREATE_SUBDIRECTORY UINT32_C(0x00000008)
442	#endif
443	#ifndef DIRECTORY_ALL_ACCESS
444	# define DIRECTORY_ALL_ACCESS ( STANDARD_RIGHTS_REQUIRED \| UINT32_C(0x0000000f) )
445	#endif
446	/** @} */
447
448
449
450	#ifdef IPRT_NT_USE_WINTERNL
451	typedef struct _CLIENT_ID
452	{
453	HANDLE UniqueProcess;
454	HANDLE UniqueThread;
455	} CLIENT_ID;
456	typedef CLIENT_ID *PCLIENT_ID;
457	#endif
458
459	/** Extended affinity type, introduced in Windows 7 (?). */
460	typedef struct _KAFFINITY_EX
461	{
462	/** Count of valid bitmap entries. */
463	uint16_t Count;
464	/** Count of allocated bitmap entries. */
465	uint16_t Size;
466	/** Reserved / aligmment padding. */
467	uint32_t Reserved;
468	/** Bitmap where one bit corresponds to a CPU. */
469	uintptr_t Bitmap[20];
470	} KAFFINITY_EX;
471	typedef KAFFINITY_EX *PKAFFINITY_EX;
472	typedef KAFFINITY_EX const *PCKAFFINITY_EX;
473
474	/** @name User Shared Data
475	* @{ */
476
477	#ifdef IPRT_NT_USE_WINTERNL
478	typedef struct _KSYSTEM_TIME
479	{
480	ULONG LowPart;
481	LONG High1Time;
482	LONG High2Time;
483	} KSYSTEM_TIME;
484	typedef KSYSTEM_TIME *PKSYSTEM_TIME;
485
486	typedef enum _NT_PRODUCT_TYPE
487	{
488	NtProductWinNt = 1,
489	NtProductLanManNt,
490	NtProductServer
491	} NT_PRODUCT_TYPE;
492
493	#define PROCESSOR_FEATURE_MAX 64
494
495	typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
496	{
497	StandardDesign = 0,
498	NEC98x86,
499	EndAlternatives
500	} ALTERNATIVE_ARCHITECTURE_TYPE;
501
502	# if 0
503	typedef struct _XSTATE_FEATURE
504	{
505	ULONG Offset;
506	ULONG Size;
507	} XSTATE_FEATURE;
508	typedef XSTATE_FEATURE *PXSTATE_FEATURE;
509
510	#define MAXIMUM_XSTATE_FEATURES 64
511
512	typedef struct _XSTATE_CONFIGURATION
513	{
514	ULONG64 EnabledFeatures;
515	ULONG Size;
516	ULONG OptimizedSave : 1;
517	XSTATE_FEATURE Features[MAXIMUM_XSTATE_FEATURES];
518	} XSTATE_CONFIGURATION;
519	typedef XSTATE_CONFIGURATION *PXSTATE_CONFIGURATION;
520	# endif
521	#endif /* IPRT_NT_USE_WINTERNL */
522
523	typedef struct _KUSER_SHARED_DATA
524	{
525	ULONG TickCountLowDeprecated; /*< 0x000 /
526	ULONG TickCountMultiplier; /*< 0x004 /
527	KSYSTEM_TIME volatile InterruptTime; /*< 0x008 /
528	KSYSTEM_TIME volatile SystemTime; /*< 0x014 /
529	KSYSTEM_TIME volatile TimeZoneBias; /*< 0x020 /
530	USHORT ImageNumberLow; /*< 0x02c /
531	USHORT ImageNumberHigh; /*< 0x02e /
532	WCHAR NtSystemRoot[260]; /*< 0x030 /
533	ULONG MaxStackTraceDepth; /*< 0x238 /
534	ULONG CryptoExponent; /*< 0x23c /
535	ULONG TimeZoneId; /*< 0x240 /
536	ULONG LargePageMinimum; /*< 0x244 /
537	ULONG AitSamplingValue; /*< 0x248 /
538	ULONG AppCompatFlag; /*< 0x24c /
539	ULONGLONG RNGSeedVersion; /*< 0x250 /
540	ULONG GlobalValidationRunlevel; /*< 0x258 /
541	LONG volatile TimeZoneBiasStamp; /*< 0x25c/
542	ULONG Reserved2; /*< 0x260 /
543	NT_PRODUCT_TYPE NtProductType; /*< 0x264 /
544	BOOLEAN ProductTypeIsValid; /*< 0x268 /
545	BOOLEAN Reserved0[1]; /*< 0x269 /
546	USHORT NativeProcessorArchitecture; /*< 0x26a /
547	ULONG NtMajorVersion; /*< 0x26c /
548	ULONG NtMinorVersion; /*< 0x270 /
549	BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX]; /*< 0x274 /
550	ULONG Reserved1; /*< 0x2b4 /
551	ULONG Reserved3; /*< 0x2b8 /
552	ULONG volatile TimeSlip; /*< 0x2bc /
553	ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture; /*< 0x2c0 /
554	ULONG AltArchitecturePad[1]; /*< 0x2c4 /
555	LARGE_INTEGER SystemExpirationDate; /*< 0x2c8 /
556	ULONG SuiteMask; /*< 0x2d0 /
557	BOOLEAN KdDebuggerEnabled; /*< 0x2d4 /
558	union /*< 0x2d5 /
559	{
560	UCHAR MitigationPolicies; /*< 0x2d5 /
561	struct
562	{
563	UCHAR NXSupportPolicy : 2;
564	UCHAR SEHValidationPolicy : 2;
565	UCHAR CurDirDevicesSkippedForDlls : 2;
566	UCHAR Reserved : 2;
567	};
568	};
569	UCHAR Reserved6[2]; /*< 0x2d6 /
570	ULONG volatile ActiveConsoleId; /*< 0x2d8 /
571	ULONG volatile DismountCount; /*< 0x2dc /
572	ULONG ComPlusPackage; /*< 0x2e0 /
573	ULONG LastSystemRITEventTickCount; /*< 0x2e4 /
574	ULONG NumberOfPhysicalPages; /*< 0x2e8 /
575	BOOLEAN SafeBootMode; /*< 0x2ec /
576	UCHAR Reserved12[3]; /*< 0x2ed /
577	union /*< 0x2f0 /
578	{
579	ULONG SharedDataFlags; /*< 0x2f0 /
580	struct
581	{
582	ULONG DbgErrorPortPresent : 1;
583	ULONG DbgElevationEnabled : 1;
584	ULONG DbgVirtEnabled : 1;
585	ULONG DbgInstallerDetectEnabled : 1;
586	ULONG DbgLkgEnabled : 1;
587	ULONG DbgDynProcessorEnabled : 1;
588	ULONG DbgConsoleBrokerEnabled : 1;
589	ULONG DbgSecureBootEnabled : 1;
590	ULONG SpareBits : 24;
591	};
592	};
593	ULONG DataFlagsPad[1]; /*< 0x2f4 /
594	ULONGLONG TestRetInstruction; /*< 0x2f8 /
595	LONGLONG QpcFrequency; /*< 0x300 /
596	ULONGLONG SystemCallPad[3]; /*< 0x308 /
597	union /*< 0x320 /
598	{
599	ULONG64 volatile TickCountQuad; /*< 0x320 /
600	KSYSTEM_TIME volatile TickCount; /*< 0x320 /
601	struct /*< 0x320 /
602	{
603	ULONG ReservedTickCountOverlay[3]; /*< 0x320 /
604	ULONG TickCountPad[1]; /*< 0x32c /
605	};
606	};
607	ULONG Cookie; /*< 0x330 /
608	ULONG CookiePad[1]; /*< 0x334 /
609	LONGLONG ConsoleSessionForegroundProcessId; /*< 0x338 /
610	ULONGLONG TimeUpdateLock; /*< 0x340 /
611	ULONGLONG BaselineSystemTimeQpc; /*< 0x348 /
612	ULONGLONG BaselineInterruptTimeQpc; /*< 0x350 /
613	ULONGLONG QpcSystemTimeIncrement; /*< 0x358 /
614	ULONGLONG QpcInterruptTimeIncrement; /*< 0x360 /
615	ULONG QpcSystemTimeIncrement32; /*< 0x368 /
616	ULONG QpcInterruptTimeIncrement32; /*< 0x36c /
617	UCHAR QpcSystemTimeIncrementShift; /*< 0x370 /
618	UCHAR QpcInterruptTimeIncrementShift; /*< 0x371 /
619	UCHAR Reserved8[14]; /*< 0x372 /
620	USHORT UserModeGlobalLogger[16]; /*< 0x380 /
621	ULONG ImageFileExecutionOptions; /*< 0x3a0 /
622	ULONG LangGenerationCount; /*< 0x3a4 /
623	ULONGLONG Reserved4; /*< 0x3a8 /
624	ULONGLONG volatile InterruptTimeBias; /*< 0x3b0 /
625	ULONGLONG volatile QpcBias; /*< 0x3b8 /
626	ULONG volatile ActiveProcessorCount; /*< 0x3c0 /
627	UCHAR volatile ActiveGroupCount; /*< 0x3c4 /
628	UCHAR Reserved9; /*< 0x3c5 /
629	union /*< 0x3c6 /
630	{
631	USHORT QpcData; /*< 0x3c6 /
632	struct /*< 0x3c6 /
633	{
634	BOOLEAN volatile QpcBypassEnabled; /*< 0x3c6 /
635	UCHAR QpcShift; /*< 0x3c7 /
636	};
637	};
638	LARGE_INTEGER TimeZoneBiasEffectiveStart; /*< 0x3c8 /
639	LARGE_INTEGER TimeZoneBiasEffectiveEnd; /*< 0x3d0 /
640	XSTATE_CONFIGURATION XState; /*< 0x3d8 /
641	} KUSER_SHARED_DATA;
642	typedef KUSER_SHARED_DATA *PKUSER_SHARED_DATA;
643	AssertCompileMemberOffset(KUSER_SHARED_DATA, InterruptTime, 0x008);
644	AssertCompileMemberOffset(KUSER_SHARED_DATA, SystemTime, 0x014);
645	AssertCompileMemberOffset(KUSER_SHARED_DATA, NtSystemRoot, 0x030);
646	AssertCompileMemberOffset(KUSER_SHARED_DATA, LargePageMinimum, 0x244);
647	AssertCompileMemberOffset(KUSER_SHARED_DATA, Reserved1, 0x2b4);
648	AssertCompileMemberOffset(KUSER_SHARED_DATA, TestRetInstruction, 0x2f8);
649	AssertCompileMemberOffset(KUSER_SHARED_DATA, Cookie, 0x330);
650	AssertCompileMemberOffset(KUSER_SHARED_DATA, ImageFileExecutionOptions, 0x3a0);
651	AssertCompileMemberOffset(KUSER_SHARED_DATA, XState, 0x3d8);
652	/** @def MM_SHARED_USER_DATA_VA
653	* Read only userland mapping of KUSER_SHARED_DATA. */
654	#ifndef MM_SHARED_USER_DATA_VA
655	# if ARCH_BITS == 32
656	# define MM_SHARED_USER_DATA_VA UINT32_C(0x7ffe0000)
657	# elif ARCH_BITS == 64
658	# define MM_SHARED_USER_DATA_VA UINT64_C(0x7ffe0000)
659	# else
660	# error "Unsupported/undefined ARCH_BITS value."
661	# endif
662	#endif
663	/** @def KI_USER_SHARED_DATA
664	* Read write kernel mapping of KUSER_SHARED_DATA. */
665	#ifndef KI_USER_SHARED_DATA
666	# ifdef RT_ARCH_X86
667	# define KI_USER_SHARED_DATA UINT32_C(0xffdf0000)
668	# elif defined(RT_ARCH_AMD64)
669	# define KI_USER_SHARED_DATA UINT64_C(0xfffff78000000000)
670	# else
671	# error "PORT ME - KI_USER_SHARED_DATA"
672	# endif
673	#endif
674	/** @} */
675
676
677	/** @name Process And Thread Environment Blocks
678	* @{ */
679
680	typedef struct _PEB_LDR_DATA
681	{
682	uint32_t Length;
683	BOOLEAN Initialized;
684	BOOLEAN Padding[3];
685	HANDLE SsHandle;
686	LIST_ENTRY InLoadOrderModuleList;
687	LIST_ENTRY InMemoryOrderModuleList;
688	LIST_ENTRY InInitializationOrderModuleList;
689	/* End NT4 */
690	LIST_ENTRY *EntryInProgress;
691	BOOLEAN ShutdownInProgress;
692	HANDLE ShutdownThreadId;
693	} PEB_LDR_DATA;
694	typedef PEB_LDR_DATA *PPEB_LDR_DATA;
695
696	typedef struct _PEB_COMMON
697	{
698	BOOLEAN InheritedAddressSpace; /*< 0x000 / 0x000 /
699	BOOLEAN ReadImageFileExecOptions; /*< 0x001 / 0x001 /
700	BOOLEAN BeingDebugged; /*< 0x002 / 0x002 /
701	union
702	{
703	uint8_t BitField; /*< 0x003 / 0x003 /
704	struct
705	{
706	uint8_t ImageUsesLargePages : 1; /*< 0x003 / 0x003 : Pos 0, 1 Bit /
707	} Common;
708	struct
709	{
710	uint8_t ImageUsesLargePages : 1; /*< 0x003 / 0x003 : Pos 0, 1 Bit /
711	uint8_t IsProtectedProcess : 1; /*< 0x003 / 0x003 : Pos 1, 1 Bit /
712	uint8_t IsImageDynamicallyRelocated : 1; /*< 0x003 / 0x003 : Pos 2, 1 Bit - Differs from W80 /
713	uint8_t SkipPatchingUser32Forwarders : 1; /*< 0x003 / 0x003 : Pos 3, 1 Bit - Differs from W80 /
714	uint8_t IsPackagedProcess : 1; /*< 0x003 / 0x003 : Pos 4, 1 Bit - Differs from W80 /
715	uint8_t IsAppContainer : 1; /*< 0x003 / 0x003 : Pos 5, 1 Bit - Differs from W80 /
716	uint8_t IsProtectedProcessLight : 1; /*< 0x003 / 0x003 : Pos 6, 1 Bit - Differs from W80 /
717	uint8_t SpareBits : 1; /*< 0x003 / 0x003 : Pos 7, 1 Bit /
718	} W81;
719	struct
720	{
721	uint8_t ImageUsesLargePages : 1; /*< 0x003 / 0x003 : Pos 0, 1 Bit /
722	uint8_t IsProtectedProcess : 1; /*< 0x003 / 0x003 : Pos 1, 1 Bit /
723	uint8_t IsLegacyProcess : 1; /*< 0x003 / 0x003 : Pos 2, 1 Bit - Differs from W81 /
724	uint8_t IsImageDynamicallyRelocated : 1; /*< 0x003 / 0x003 : Pos 3, 1 Bit - Differs from W81 /
725	uint8_t SkipPatchingUser32Forwarders : 1; /*< 0x003 / 0x003 : Pos 4, 1 Bit - Differs from W81 /
726	uint8_t IsPackagedProcess : 1; /*< 0x003 / 0x003 : Pos 5, 1 Bit - Differs from W81 /
727	uint8_t IsAppContainer : 1; /*< 0x003 / 0x003 : Pos 6, 1 Bit - Differs from W81 /
728	uint8_t SpareBits : 1; /*< 0x003 / 0x003 : Pos 7, 1 Bit /
729	} W80;
730	struct
731	{
732	uint8_t ImageUsesLargePages : 1; /*< 0x003 / 0x003 : Pos 0, 1 Bit /
733	uint8_t IsProtectedProcess : 1; /*< 0x003 / 0x003 : Pos 1, 1 Bit /
734	uint8_t IsLegacyProcess : 1; /*< 0x003 / 0x003 : Pos 2, 1 Bit - Differs from W81, same as W80 & W6. /
735	uint8_t IsImageDynamicallyRelocated : 1; /*< 0x003 / 0x003 : Pos 3, 1 Bit - Differs from W81, same as W80 & W6. /
736	uint8_t SkipPatchingUser32Forwarders : 1; /*< 0x003 / 0x003 : Pos 4, 1 Bit - Added in W7; Differs from W81, same as W80. /
737	uint8_t SpareBits : 3; /*< 0x003 / 0x003 : Pos 5, 3 Bit - Differs from W81 & W80, more spare bits. /
738	} W7;
739	struct
740	{
741	uint8_t ImageUsesLargePages : 1; /*< 0x003 / 0x003 : Pos 0, 1 Bit /
742	uint8_t IsProtectedProcess : 1; /*< 0x003 / 0x003 : Pos 1, 1 Bit /
743	uint8_t IsLegacyProcess : 1; /*< 0x003 / 0x003 : Pos 2, 1 Bit - Differs from W81, same as W80 & W7. /
744	uint8_t IsImageDynamicallyRelocated : 1; /*< 0x003 / 0x003 : Pos 3, 1 Bit - Differs from W81, same as W80 & W7. /
745	uint8_t SpareBits : 4; /*< 0x003 / 0x003 : Pos 4, 4 Bit - Differs from W81, W80, & W7, more spare bits. /
746	} W6;
747	struct
748	{
749	uint8_t ImageUsesLargePages : 1; /*< 0x003 / 0x003 : Pos 0, 1 Bit /
750	uint8_t SpareBits : 7; /*< 0x003 / 0x003 : Pos 1, 7 Bit - Differs from W81, W80, & W7, more spare bits. /
751	} W52;
752	struct
753	{
754	BOOLEAN SpareBool;
755	} W51;
756	} Diff0;
757	#if ARCH_BITS == 64
758	uint32_t Padding0; /*< 0x004 / NA /
759	#endif
760	HANDLE Mutant; /*< 0x008 / 0x004 /
761	PVOID ImageBaseAddress; /*< 0x010 / 0x008 /
762	PPEB_LDR_DATA Ldr; /*< 0x018 / 0x00c /
763	struct _RTL_USER_PROCESS_PARAMETERS ProcessParameters; /< 0x020 / 0x010 /
764	PVOID SubSystemData; /*< 0x028 / 0x014 /
765	HANDLE ProcessHeap; /*< 0x030 / 0x018 /
766	struct _RTL_CRITICAL_SECTION FastPebLock; /< 0x038 / 0x01c /
767	union
768	{
769	struct
770	{
771	PVOID AtlThunkSListPtr; /*< 0x040 / 0x020 /
772	PVOID IFEOKey; /*< 0x048 / 0x024 /
773	union
774	{
775	ULONG CrossProcessFlags; /*< 0x050 / 0x028 /
776	struct
777	{
778	uint32_t ProcessInJob : 1; /*< 0x050 / 0x028: Pos 0, 1 Bit /
779	uint32_t ProcessInitializing : 1; /*< 0x050 / 0x028: Pos 1, 1 Bit /
780	uint32_t ProcessUsingVEH : 1; /*< 0x050 / 0x028: Pos 2, 1 Bit /
781	uint32_t ProcessUsingVCH : 1; /*< 0x050 / 0x028: Pos 3, 1 Bit /
782	uint32_t ProcessUsingFTH : 1; /*< 0x050 / 0x028: Pos 4, 1 Bit /
783	uint32_t ReservedBits0 : 1; /*< 0x050 / 0x028: Pos 5, 27 Bits /
784	} W7, W8, W80, W81;
785	struct
786	{
787	uint32_t ProcessInJob : 1; /*< 0x050 / 0x028: Pos 0, 1 Bit /
788	uint32_t ProcessInitializing : 1; /*< 0x050 / 0x028: Pos 1, 1 Bit /
789	uint32_t ReservedBits0 : 30; /*< 0x050 / 0x028: Pos 2, 30 Bits /
790	} W6;
791	};
792	#if ARCH_BITS == 64
793	uint32_t Padding1; /*< 0x054 / /
794	#endif
795	} W6, W7, W8, W80, W81;
796	struct
797	{
798	PVOID AtlThunkSListPtr; /*< 0x040 / 0x020 /
799	PVOID SparePtr2; /*< 0x048 / 0x024 /
800	uint32_t EnvironmentUpdateCount; /*< 0x050 / 0x028 /
801	#if ARCH_BITS == 64
802	uint32_t Padding1; /*< 0x054 / /
803	#endif
804	} W52;
805	struct
806	{
807	PVOID FastPebLockRoutine; /*< NA / 0x020 /
808	PVOID FastPebUnlockRoutine; /*< NA / 0x024 /
809	uint32_t EnvironmentUpdateCount; /*< NA / 0x028 /
810	} W51;
811	} Diff1;
812	union
813	{
814	PVOID KernelCallbackTable; /*< 0x058 / 0x02c /
815	PVOID UserSharedInfoPtr; /*< 0x058 / 0x02c - Alternative use in W6./
816	};
817	uint32_t SystemReserved; /*< 0x060 / 0x030 /
818	union
819	{
820	struct
821	{
822	uint32_t AtlThunkSListPtr32; /*< 0x064 / 0x034 /
823	} W7, W8, W80, W81;
824	struct
825	{
826	uint32_t SpareUlong; /*< 0x064 / 0x034 /
827	} W52, W6;
828	struct
829	{
830	uint32_t ExecuteOptions : 2; /*< NA / 0x034: Pos 0, 2 Bits /
831	uint32_t SpareBits : 30; /*< NA / 0x034: Pos 2, 30 Bits /
832	} W51;
833	} Diff2;
834	union
835	{
836	struct
837	{
838	PVOID ApiSetMap; /*< 0x068 / 0x038 /
839	} W7, W8, W80, W81;
840	struct
841	{
842	struct _PEB_FREE_BLOCK FreeList; /< 0x068 / 0x038 /
843	} W52, W6;
844	struct
845	{
846	struct _PEB_FREE_BLOCK FreeList; /< NA / 0x038 /
847	} W51;
848	} Diff3;
849	uint32_t TlsExpansionCounter; /*< 0x070 / 0x03c /
850	#if ARCH_BITS == 64
851	uint32_t Padding2; /*< 0x074 / NA /
852	#endif
853	struct _RTL_BITMAP TlsBitmap; /< 0x078 / 0x040 /
854	uint32_t TlsBitmapBits[2]; /*< 0x080 / 0x044 /
855	PVOID ReadOnlySharedMemoryBase; /*< 0x088 / 0x04c /
856	union
857	{
858	struct
859	{
860	PVOID SparePvoid0; /*< 0x090 / 0x050 - HotpatchInformation before W81. /
861	} W81;
862	struct
863	{
864	PVOID HotpatchInformation; /*< 0x090 / 0x050 - Retired in W81. /
865	} W6, W7, W80;
866	struct
867	{
868	PVOID ReadOnlySharedMemoryHeap;
869	} W52;
870	} Diff4;
871	PVOID ReadOnlyStaticServerData; /< 0x098 / 0x054 /
872	PVOID AnsiCodePageData; /*< 0x0a0 / 0x058 /
873	PVOID OemCodePageData; /*< 0x0a8 / 0x05c /
874	PVOID UnicodeCaseTableData; /*< 0x0b0 / 0x060 /
875	uint32_t NumberOfProcessors; /*< 0x0b8 / 0x064 /
876	uint32_t NtGlobalFlag; /*< 0x0bc / 0x068 /
877	LARGE_INTEGER CriticalSectionTimeout; /*< 0x0c0 / 0x070 /
878	SIZE_T HeapSegmentReserve; /*< 0x0c8 / 0x078 /
879	SIZE_T HeapSegmentCommit; /*< 0x0d0 / 0x07c /
880	SIZE_T HeapDeCommitTotalFreeThreshold; /*< 0x0d8 / 0x080 /
881	SIZE_T HeapDeCommitFreeBlockThreshold; /*< 0x0e0 / 0x084 /
882	uint32_t NumberOfHeaps; /*< 0x0e8 / 0x088 /
883	uint32_t MaximumNumberOfHeaps; /*< 0x0ec / 0x08c /
884	PVOID ProcessHeaps; /< 0x0f0 / 0x090 /
885	PVOID GdiSharedHandleTable; /*< 0x0f8 / 0x094 /
886	PVOID ProcessStarterHelper; /*< 0x100 / 0x098 /
887	uint32_t GdiDCAttributeList; /*< 0x108 / 0x09c /
888	#if ARCH_BITS == 64
889	uint32_t Padding3; /*< 0x10c / NA /
890	#endif
891	struct _RTL_CRITICAL_SECTION LoaderLock; /< 0x110 / 0x0a0 /
892	uint32_t OSMajorVersion; /*< 0x118 / 0x0a4 /
893	uint32_t OSMinorVersion; /*< 0x11c / 0x0a8 /
894	uint16_t OSBuildNumber; /*< 0x120 / 0x0ac /
895	uint16_t OSCSDVersion; /*< 0x122 / 0x0ae /
896	uint32_t OSPlatformId; /*< 0x124 / 0x0b0 /
897	uint32_t ImageSubsystem; /*< 0x128 / 0x0b4 /
898	uint32_t ImageSubsystemMajorVersion; /*< 0x12c / 0x0b8 /
899	uint32_t ImageSubsystemMinorVersion; /*< 0x130 / 0x0bc /
900	#if ARCH_BITS == 64
901	uint32_t Padding4; /*< 0x134 / NA /
902	#endif
903	union
904	{
905	struct
906	{
907	SIZE_T ActiveProcessAffinityMask; /*< 0x138 / 0x0c0 /
908	} W7, W8, W80, W81;
909	struct
910	{
911	SIZE_T ImageProcessAffinityMask; /*< 0x138 / 0x0c0 /
912	} W52, W6;
913	} Diff5;
914	uint32_t GdiHandleBuffer[ARCH_BITS == 64 ? 60 : 34]; /*< 0x140 / 0x0c4 /
915	PVOID PostProcessInitRoutine; /*< 0x230 / 0x14c /
916	PVOID TlsExpansionBitmap; /*< 0x238 / 0x150 /
917	uint32_t TlsExpansionBitmapBits[32]; /*< 0x240 / 0x154 /
918	uint32_t SessionId; /*< 0x2c0 / 0x1d4 /
919	#if ARCH_BITS == 64
920	uint32_t Padding5; /*< 0x2c4 / NA /
921	#endif
922	ULARGE_INTEGER AppCompatFlags; /*< 0x2c8 / 0x1d8 /
923	ULARGE_INTEGER AppCompatFlagsUser; /*< 0x2d0 / 0x1e0 /
924	PVOID pShimData; /*< 0x2d8 / 0x1e8 /
925	PVOID AppCompatInfo; /*< 0x2e0 / 0x1ec /
926	UNICODE_STRING CSDVersion; /*< 0x2e8 / 0x1f0 /
927	struct _ACTIVATION_CONTEXT_DATA ActivationContextData; /< 0x2f8 / 0x1f8 /
928	struct _ASSEMBLY_STORAGE_MAP ProcessAssemblyStorageMap; /< 0x300 / 0x1fc /
929	struct _ACTIVATION_CONTEXT_DATA SystemDefaultActivationContextData; /< 0x308 / 0x200 /
930	struct _ASSEMBLY_STORAGE_MAP SystemAssemblyStorageMap; /< 0x310 / 0x204 /
931	SIZE_T MinimumStackCommit; /*< 0x318 / 0x208 /
932	/* End of PEB in W52 (Windows XP (RTM))! */
933	struct _FLS_CALLBACK_INFO FlsCallback; /< 0x320 / 0x20c /
934	LIST_ENTRY FlsListHead; /*< 0x328 / 0x210 /
935	PVOID FlsBitmap; /*< 0x338 / 0x218 /
936	uint32_t FlsBitmapBits[4]; /*< 0x340 / 0x21c /
937	uint32_t FlsHighIndex; /*< 0x350 / 0x22c /
938	/* End of PEB in W52 (Windows Server 2003)! */
939	PVOID WerRegistrationData; /*< 0x358 / 0x230 /
940	PVOID WerShipAssertPtr; /*< 0x360 / 0x234 /
941	/* End of PEB in W6 (windows Vista)! */
942	union
943	{
944	struct
945	{
946	PVOID pUnused; /*< 0x368 / 0x238 - Was pContextData in W7. /
947	} W8, W80, W81;
948	struct
949	{
950	PVOID pContextData; /*< 0x368 / 0x238 - Retired in W80. /
951	} W7;
952	} Diff6;
953	PVOID pImageHeaderHash; /*< 0x370 / 0x23c /
954	union
955	{
956	uint32_t TracingFlags; /*< 0x378 / 0x240 /
957	struct
958	{
959	uint32_t HeapTracingEnabled : 1; /*< 0x378 / 0x240 : Pos 0, 1 Bit /
960	uint32_t CritSecTracingEnabled : 1; /*< 0x378 / 0x240 : Pos 1, 1 Bit /
961	uint32_t LibLoaderTracingEnabled : 1; /*< 0x378 / 0x240 : Pos 2, 1 Bit /
962	uint32_t SpareTracingBits : 29; /*< 0x378 / 0x240 : Pos 3, 29 Bits /
963	} W8, W80, W81;
964	struct
965	{
966	uint32_t HeapTracingEnabled : 1; /*< 0x378 / 0x240 : Pos 0, 1 Bit /
967	uint32_t CritSecTracingEnabled : 1; /*< 0x378 / 0x240 : Pos 1, 1 Bit /
968	uint32_t SpareTracingBits : 30; /*< 0x378 / 0x240 : Pos 3, 30 Bits - One bit more than W80 /
969	} W7;
970	} Diff7;
971	#if ARCH_BITS == 64
972	uint32_t Padding6; /*< 0x37c / NA /
973	#endif
974	uint64_t CsrServerReadOnlySharedMemoryBase; /*< 0x380 / 0x248 /
975	} PEB_COMMON;
976	typedef PEB_COMMON *PPEB_COMMON;
977
978	AssertCompileMemberOffset(PEB_COMMON, ProcessHeap, ARCH_BITS == 64 ? 0x30 : 0x18);
979	AssertCompileMemberOffset(PEB_COMMON, SystemReserved, ARCH_BITS == 64 ? 0x60 : 0x30);
980	AssertCompileMemberOffset(PEB_COMMON, TlsExpansionCounter, ARCH_BITS == 64 ? 0x70 : 0x3c);
981	AssertCompileMemberOffset(PEB_COMMON, NtGlobalFlag, ARCH_BITS == 64 ? 0xbc : 0x68);
982	AssertCompileMemberOffset(PEB_COMMON, LoaderLock, ARCH_BITS == 64 ? 0x110 : 0xa0);
983	AssertCompileMemberOffset(PEB_COMMON, Diff5.W52.ImageProcessAffinityMask, ARCH_BITS == 64 ? 0x138 : 0xc0);
984	AssertCompileMemberOffset(PEB_COMMON, PostProcessInitRoutine, ARCH_BITS == 64 ? 0x230 : 0x14c);
985	AssertCompileMemberOffset(PEB_COMMON, AppCompatFlags, ARCH_BITS == 64 ? 0x2c8 : 0x1d8);
986	AssertCompileSize(PEB_COMMON, ARCH_BITS == 64 ? 0x388 : 0x250);
987
988	/** The size of the windows 8.1 PEB structure. */
989	#define PEB_SIZE_W81 sizeof(PEB_COMMON)
990	/** The size of the windows 8.0 PEB structure. */
991	#define PEB_SIZE_W80 sizeof(PEB_COMMON)
992	/** The size of the windows 7 PEB structure. */
993	#define PEB_SIZE_W7 RT_UOFFSETOF(PEB_COMMON, CsrServerReadOnlySharedMemoryBase)
994	/** The size of the windows vista PEB structure. */
995	#define PEB_SIZE_W6 RT_UOFFSETOF(PEB_COMMON, Diff3)
996	/** The size of the windows server 2003 PEB structure. */
997	#define PEB_SIZE_W52 RT_UOFFSETOF(PEB_COMMON, WerRegistrationData)
998	/** The size of the windows XP PEB structure. */
999	#define PEB_SIZE_W51 RT_UOFFSETOF(PEB_COMMON, FlsCallback)
1000
1001	#if 0
1002	typedef struct _NT_TIB
1003	{
1004	struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
1005	PVOID StackBase;
1006	PVOID StackLimit;
1007	PVOID SubSystemTib;
1008	union
1009	{
1010	PVOID FiberData;
1011	ULONG Version;
1012	};
1013	PVOID ArbitraryUserPointer;
1014	struct _NT_TIB *Self;
1015	} NT_TIB;
1016	typedef NT_TIB *PNT_TIB;
1017	#endif
1018
1019	typedef struct _ACTIVATION_CONTEXT_STACK
1020	{
1021	uint32_t Flags;
1022	uint32_t NextCookieSequenceNumber;
1023	PVOID ActiveFrame;
1024	LIST_ENTRY FrameListCache;
1025	} ACTIVATION_CONTEXT_STACK;
1026
1027	/* Common TEB. */
1028	typedef struct _TEB_COMMON
1029	{
1030	NT_TIB NtTib; /*< 0x000 / 0x000 /
1031	PVOID EnvironmentPointer; /*< 0x038 / 0x01c /
1032	CLIENT_ID ClientId; /*< 0x040 / 0x020 /
1033	PVOID ActiveRpcHandle; /*< 0x050 / 0x028 /
1034	PVOID ThreadLocalStoragePointer; /*< 0x058 / 0x02c /
1035	PPEB_COMMON ProcessEnvironmentBlock; /*< 0x060 / 0x030 /
1036	uint32_t LastErrorValue; /*< 0x068 / 0x034 /
1037	uint32_t CountOfOwnedCriticalSections; /*< 0x06c / 0x038 /
1038	PVOID CsrClientThread; /*< 0x070 / 0x03c /
1039	PVOID Win32ThreadInfo; /*< 0x078 / 0x040 /
1040	uint32_t User32Reserved[26]; /*< 0x080 / 0x044 /
1041	uint32_t UserReserved[5]; /*< 0x0e8 / 0x0ac /
1042	PVOID WOW32Reserved; /*< 0x100 / 0x0c0 /
1043	uint32_t CurrentLocale; /*< 0x108 / 0x0c4 /
1044	uint32_t FpSoftwareStatusRegister; /*< 0x10c / 0x0c8 /
1045	PVOID SystemReserved1[54]; /*< 0x110 / 0x0cc /
1046	uint32_t ExceptionCode; /*< 0x2c0 / 0x1a4 /
1047	#if ARCH_BITS == 64
1048	uint32_t Padding0; /*< 0x2c4 / NA /
1049	#endif
1050	union
1051	{
1052	struct
1053	{
1054	struct _ACTIVATION_CONTEXT_STACK ActivationContextStackPointer;/< 0x2c8 / 0x1a8 /
1055	uint8_t SpareBytes[ARCH_BITS == 64 ? 24 : 36]; /*< 0x2d0 / 0x1ac /
1056	} W52, W6, W7, W8, W80, W81;
1057	#if ARCH_BITS == 32
1058	struct
1059	{
1060	ACTIVATION_CONTEXT_STACK ActivationContextStack; /*< NA / 0x1a8 /
1061	uint8_t SpareBytes[20]; /*< NA / 0x1bc /
1062	} W51;
1063	#endif
1064	} Diff0;
1065	union
1066	{
1067	struct
1068	{
1069	uint32_t TxFsContext; /*< 0x2e8 / 0x1d0 /
1070	} W6, W7, W8, W80, W81;
1071	struct
1072	{
1073	uint32_t SpareBytesContinues; /*< 0x2e8 / 0x1d0 /
1074	} W52;
1075	} Diff1;
1076	#if ARCH_BITS == 64
1077	uint32_t Padding1; /*< 0x2ec / NA /
1078	#endif
1079	/_GDI_TEB_BATCH/ uint8_t GdiTebBatch[ARCH_BITS == 64 ? 0x4e8 :0x4e0]; /*< 0x2f0 / 0x1d4 /
1080	CLIENT_ID RealClientId; /*< 0x7d8 / 0x6b4 /
1081	HANDLE GdiCachedProcessHandle; /*< 0x7e8 / 0x6bc /
1082	uint32_t GdiClientPID; /*< 0x7f0 / 0x6c0 /
1083	uint32_t GdiClientTID; /*< 0x7f4 / 0x6c4 /
1084	PVOID GdiThreadLocalInfo; /*< 0x7f8 / 0x6c8 /
1085	SIZE_T Win32ClientInfo[62]; /*< 0x800 / 0x6cc /
1086	PVOID glDispatchTable[233]; /*< 0x9f0 / 0x7c4 /
1087	SIZE_T glReserved1[29]; /*< 0x1138 / 0xb68 /
1088	PVOID glReserved2; /*< 0x1220 / 0xbdc /
1089	PVOID glSectionInfo; /*< 0x1228 / 0xbe0 /
1090	PVOID glSection; /*< 0x1230 / 0xbe4 /
1091	PVOID glTable; /*< 0x1238 / 0xbe8 /
1092	PVOID glCurrentRC; /*< 0x1240 / 0xbec /
1093	PVOID glContext; /*< 0x1248 / 0xbf0 /
1094	NTSTATUS LastStatusValue; /*< 0x1250 / 0xbf4 /
1095	#if ARCH_BITS == 64
1096	uint32_t Padding2; /*< 0x1254 / NA /
1097	#endif
1098	UNICODE_STRING StaticUnicodeString; /*< 0x1258 / 0xbf8 /
1099	WCHAR StaticUnicodeBuffer[261]; /*< 0x1268 / 0xc00 /
1100	#if ARCH_BITS == 64
1101	WCHAR Padding3[3]; /*< 0x1472 / NA /
1102	#endif
1103	PVOID DeallocationStack; /*< 0x1478 / 0xe0c /
1104	PVOID TlsSlots[64]; /*< 0x1480 / 0xe10 /
1105	LIST_ENTRY TlsLinks; /*< 0x1680 / 0xf10 /
1106	PVOID Vdm; /*< 0x1690 / 0xf18 /
1107	PVOID ReservedForNtRpc; /*< 0x1698 / 0xf1c /
1108	PVOID DbgSsReserved[2]; /*< 0x16a0 / 0xf20 /
1109	uint32_t HardErrorMode; /*< 0x16b0 / 0xf28 - Called HardErrorsAreDisabled in W51. /
1110	#if ARCH_BITS == 64
1111	uint32_t Padding4; /*< 0x16b4 / NA /
1112	#endif
1113	PVOID Instrumentation[ARCH_BITS == 64 ? 11 : 9]; /*< 0x16b8 / 0xf2c /
1114	union
1115	{
1116	struct
1117	{
1118	GUID ActivityId; /*< 0x1710 / 0xf50 /
1119	PVOID SubProcessTag; /*< 0x1720 / 0xf60 /
1120	} W6, W7, W8, W80, W81;
1121	struct
1122	{
1123	PVOID InstrumentationContinues[ARCH_BITS == 64 ? 3 : 5]; /*< 0x1710 / 0xf50 /
1124	} W52;
1125	} Diff2;
1126	union /*< 0x1728 / 0xf64 /
1127	{
1128	struct
1129	{
1130	PVOID PerflibData; /*< 0x1728 / 0xf64 /
1131	} W8, W80, W81;
1132	struct
1133	{
1134	PVOID EtwLocalData; /*< 0x1728 / 0xf64 /
1135	} W7, W6;
1136	struct
1137	{
1138	PVOID SubProcessTag; /*< 0x1728 / 0xf64 /
1139	} W52;
1140	struct
1141	{
1142	PVOID InstrumentationContinues[1]; /*< 0x1728 / 0xf64 /
1143	} W51;
1144	} Diff3;
1145	union
1146	{
1147	struct
1148	{
1149	PVOID EtwTraceData; /*< 0x1730 / 0xf68 /
1150	} W52, W6, W7, W8, W80, W81;
1151	struct
1152	{
1153	PVOID InstrumentationContinues[1]; /*< 0x1730 / 0xf68 /
1154	} W51;
1155	} Diff4;
1156	PVOID WinSockData; /*< 0x1738 / 0xf6c /
1157	uint32_t GdiBatchCount; /*< 0x1740 / 0xf70 /
1158	union
1159	{
1160	union
1161	{
1162	PROCESSOR_NUMBER CurrentIdealProcessor; /*< 0x1744 / 0xf74 - W7+ /
1163	uint32_t IdealProcessorValue; /*< 0x1744 / 0xf74 - W7+ /
1164	struct
1165	{
1166	uint8_t ReservedPad1; /*< 0x1744 / 0xf74 - Called SpareBool0 in W6 /
1167	uint8_t ReservedPad2; /*< 0x1745 / 0xf75 - Called SpareBool0 in W6 /
1168	uint8_t ReservedPad3; /*< 0x1746 / 0xf76 - Called SpareBool0 in W6 /
1169	uint8_t IdealProcessor; /*< 0x1747 / 0xf77 /
1170	};
1171	} W6, W7, W8, W80, W81;
1172	struct
1173	{
1174	BOOLEAN InDbgPrint; /*< 0x1744 / 0xf74 /
1175	BOOLEAN FreeStackOnTermination; /*< 0x1745 / 0xf75 /
1176	BOOLEAN HasFiberData; /*< 0x1746 / 0xf76 /
1177	uint8_t IdealProcessor; /*< 0x1747 / 0xf77 /
1178	} W51, W52;
1179	} Diff5;
1180	uint32_t GuaranteedStackBytes; /*< 0x1748 / 0xf78 /
1181	#if ARCH_BITS == 64
1182	uint32_t Padding5; /*< 0x174c / NA /
1183	#endif
1184	PVOID ReservedForPerf; /*< 0x1750 / 0xf7c /
1185	PVOID ReservedForOle; /*< 0x1758 / 0xf80 /
1186	uint32_t WaitingOnLoaderLock; /*< 0x1760 / 0xf84 /
1187	#if ARCH_BITS == 64
1188	uint32_t Padding6; /*< 0x1764 / NA /
1189	#endif
1190	union /*< 0x1770 / 0xf8c /
1191	{
1192	struct
1193	{
1194	PVOID SavedPriorityState; /*< 0x1768 / 0xf88 /
1195	SIZE_T ReservedForCodeCoverage; /*< 0x1770 / 0xf8c /
1196	PVOID ThreadPoolData; /*< 0x1778 / 0xf90 /
1197	} W8, W80, W81;
1198	struct
1199	{
1200	PVOID SavedPriorityState; /*< 0x1768 / 0xf88 /
1201	SIZE_T SoftPatchPtr1; /*< 0x1770 / 0xf8c /
1202	PVOID ThreadPoolData; /*< 0x1778 / 0xf90 /
1203	} W6, W7;
1204	struct
1205	{
1206	PVOID SparePointer1; /*< 0x1768 / 0xf88 /
1207	SIZE_T SoftPatchPtr1; /*< 0x1770 / 0xf8c /
1208	PVOID SoftPatchPtr2; /*< 0x1778 / 0xf90 /
1209	} W52;
1210	#if ARCH_BITS == 32
1211	struct _Wx86ThreadState
1212	{
1213	PVOID CallBx86Eip; /*< NA / 0xf88 /
1214	PVOID DeallocationCpu; /*< NA / 0xf8c /
1215	BOOLEAN UseKnownWx86Dll; /*< NA / 0xf90 /
1216	int8_t OleStubInvoked; /*< NA / 0xf91 /
1217	} W51;
1218	#endif
1219	} Diff6;
1220	PVOID TlsExpansionSlots; /*< 0x1780 / 0xf94 /
1221	#if ARCH_BITS == 64
1222	PVOID DallocationBStore; /*< 0x1788 / NA /
1223	PVOID BStoreLimit; /*< 0x1790 / NA /
1224	#endif
1225	union
1226	{
1227	struct
1228	{
1229	uint32_t MuiGeneration; /*< 0x1798 / 0xf98 /
1230	} W7, W8, W80, W81;
1231	struct
1232	{
1233	uint32_t ImpersonationLocale;
1234	} W6;
1235	} Diff7;
1236	uint32_t IsImpersonating; /*< 0x179c / 0xf9c /
1237	PVOID NlsCache; /*< 0x17a0 / 0xfa0 /
1238	PVOID pShimData; /*< 0x17a8 / 0xfa4 /
1239	union /*< 0x17b0 / 0xfa8 /
1240	{
1241	struct
1242	{
1243	uint16_t HeapVirtualAffinity; /*< 0x17b0 / 0xfa8 /
1244	uint16_t LowFragHeapDataSlot; /*< 0x17b2 / 0xfaa /
1245	} W8, W80, W81;
1246	struct
1247	{
1248	uint32_t HeapVirtualAffinity; /*< 0x17b0 / 0xfa8 /
1249	} W7;
1250	} Diff8;
1251	#if ARCH_BITS == 64
1252	uint32_t Padding7; /*< 0x17b4 / NA /
1253	#endif
1254	HANDLE CurrentTransactionHandle; /*< 0x17b8 / 0xfac /
1255	struct _TEB_ACTIVE_FRAME ActiveFrame; /< 0x17c0 / 0xfb0 /
1256	/* End of TEB in W51 (Windows XP)! */
1257	PVOID FlsData; /*< 0x17c8 / 0xfb4 /
1258	union
1259	{
1260	struct
1261	{
1262	PVOID PreferredLanguages; /*< 0x17d0 / 0xfb8 /
1263	} W6, W7, W8, W80, W81;
1264	struct
1265	{
1266	BOOLEAN SafeThunkCall; /*< 0x17d0 / 0xfb8 /
1267	uint8_t BooleanSpare[3]; /*< 0x17d1 / 0xfb9 /
1268	/* End of TEB in W52 (Windows server 2003)! */
1269	} W52;
1270	} Diff9;
1271	PVOID UserPrefLanguages; /*< 0x17d8 / 0xfbc /
1272	PVOID MergedPrefLanguages; /*< 0x17e0 / 0xfc0 /
1273	uint32_t MuiImpersonation; /*< 0x17e8 / 0xfc4 /
1274	union
1275	{
1276	uint16_t CrossTebFlags; /*< 0x17ec / 0xfc8 /
1277	struct
1278	{
1279	uint16_t SpareCrossTebBits : 16; /*< 0x17ec / 0xfc8 : Pos 0, 16 Bits /
1280	};
1281	};
1282	union
1283	{
1284	uint16_t SameTebFlags; /*< 0x17ee / 0xfca /
1285	struct
1286	{
1287	uint16_t SafeThunkCall : 1; /*< 0x17ee / 0xfca : Pos 0, 1 Bit /
1288	uint16_t InDebugPrint : 1; /*< 0x17ee / 0xfca : Pos 1, 1 Bit /
1289	uint16_t HasFiberData : 1; /*< 0x17ee / 0xfca : Pos 2, 1 Bit /
1290	uint16_t SkipThreadAttach : 1; /*< 0x17ee / 0xfca : Pos 3, 1 Bit /
1291	uint16_t WerInShipAssertCode : 1; /*< 0x17ee / 0xfca : Pos 4, 1 Bit /
1292	uint16_t RanProcessInit : 1; /*< 0x17ee / 0xfca : Pos 5, 1 Bit /
1293	uint16_t ClonedThread : 1; /*< 0x17ee / 0xfca : Pos 6, 1 Bit /
1294	uint16_t SuppressDebugMsg : 1; /*< 0x17ee / 0xfca : Pos 7, 1 Bit /
1295	} Common;
1296	struct
1297	{
1298	uint16_t SafeThunkCall : 1; /*< 0x17ee / 0xfca : Pos 0, 1 Bit /
1299	uint16_t InDebugPrint : 1; /*< 0x17ee / 0xfca : Pos 1, 1 Bit /
1300	uint16_t HasFiberData : 1; /*< 0x17ee / 0xfca : Pos 2, 1 Bit /
1301	uint16_t SkipThreadAttach : 1; /*< 0x17ee / 0xfca : Pos 3, 1 Bit /
1302	uint16_t WerInShipAssertCode : 1; /*< 0x17ee / 0xfca : Pos 4, 1 Bit /
1303	uint16_t RanProcessInit : 1; /*< 0x17ee / 0xfca : Pos 5, 1 Bit /
1304	uint16_t ClonedThread : 1; /*< 0x17ee / 0xfca : Pos 6, 1 Bit /
1305	uint16_t SuppressDebugMsg : 1; /*< 0x17ee / 0xfca : Pos 7, 1 Bit /
1306	uint16_t DisableUserStackWalk : 1; /*< 0x17ee / 0xfca : Pos 8, 1 Bit /
1307	uint16_t RtlExceptionAttached : 1; /*< 0x17ee / 0xfca : Pos 9, 1 Bit /
1308	uint16_t InitialThread : 1; /*< 0x17ee / 0xfca : Pos 10, 1 Bit /
1309	uint16_t SessionAware : 1; /*< 0x17ee / 0xfca : Pos 11, 1 Bit - New Since W7. /
1310	uint16_t SpareSameTebBits : 4; /*< 0x17ee / 0xfca : Pos 12, 4 Bits /
1311	} W8, W80, W81;
1312	struct
1313	{
1314	uint16_t SafeThunkCall : 1; /*< 0x17ee / 0xfca : Pos 0, 1 Bit /
1315	uint16_t InDebugPrint : 1; /*< 0x17ee / 0xfca : Pos 1, 1 Bit /
1316	uint16_t HasFiberData : 1; /*< 0x17ee / 0xfca : Pos 2, 1 Bit /
1317	uint16_t SkipThreadAttach : 1; /*< 0x17ee / 0xfca : Pos 3, 1 Bit /
1318	uint16_t WerInShipAssertCode : 1; /*< 0x17ee / 0xfca : Pos 4, 1 Bit /
1319	uint16_t RanProcessInit : 1; /*< 0x17ee / 0xfca : Pos 5, 1 Bit /
1320	uint16_t ClonedThread : 1; /*< 0x17ee / 0xfca : Pos 6, 1 Bit /
1321	uint16_t SuppressDebugMsg : 1; /*< 0x17ee / 0xfca : Pos 7, 1 Bit /
1322	uint16_t DisableUserStackWalk : 1; /*< 0x17ee / 0xfca : Pos 8, 1 Bit /
1323	uint16_t RtlExceptionAttached : 1; /*< 0x17ee / 0xfca : Pos 9, 1 Bit /
1324	uint16_t InitialThread : 1; /*< 0x17ee / 0xfca : Pos 10, 1 Bit /
1325	uint16_t SpareSameTebBits : 5; /*< 0x17ee / 0xfca : Pos 12, 4 Bits /
1326	} W7;
1327	struct
1328	{
1329	uint16_t DbgSafeThunkCall : 1; /*< 0x17ee / 0xfca : Pos 0, 1 Bit /
1330	uint16_t DbgInDebugPrint : 1; /*< 0x17ee / 0xfca : Pos 1, 1 Bit /
1331	uint16_t DbgHasFiberData : 1; /*< 0x17ee / 0xfca : Pos 2, 1 Bit /
1332	uint16_t DbgSkipThreadAttach : 1; /*< 0x17ee / 0xfca : Pos 3, 1 Bit /
1333	uint16_t DbgWerInShipAssertCode : 1; /*< 0x17ee / 0xfca : Pos 4, 1 Bit /
1334	uint16_t DbgRanProcessInit : 1; /*< 0x17ee / 0xfca : Pos 5, 1 Bit /
1335	uint16_t DbgClonedThread : 1; /*< 0x17ee / 0xfca : Pos 6, 1 Bit /
1336	uint16_t DbgSuppressDebugMsg : 1; /*< 0x17ee / 0xfca : Pos 7, 1 Bit /
1337	uint16_t SpareSameTebBits : 8; /*< 0x17ee / 0xfca : Pos 8, 8 Bits /
1338	} W6;
1339	} Diff10;
1340	PVOID TxnScopeEnterCallback; /*< 0x17f0 / 0xfcc /
1341	PVOID TxnScopeExitCallback; /*< 0x17f8 / 0xfd0 /
1342	PVOID TxnScopeContext; /*< 0x1800 / 0xfd4 /
1343	uint32_t LockCount; /*< 0x1808 / 0xfd8 /
1344	union
1345	{
1346	struct
1347	{
1348	uint32_t SpareUlong0; /*< 0x180c / 0xfdc /
1349	} W7, W8, W80, W81;
1350	struct
1351	{
1352	uint32_t ProcessRundown;
1353	} W6;
1354	} Diff11;
1355	union
1356	{
1357	struct
1358	{
1359	PVOID ResourceRetValue; /*< 0x1810 / 0xfe0 /
1360	/* End of TEB in W7 (windows 7)! */
1361	PVOID ReservedForWdf; /*< 0x1818 / 0xfe4 - New Since W7. /
1362	/* End of TEB in W8 (windows 8.0 & 8.1)! */
1363	} W8, W80, W81;
1364	struct
1365	{
1366	PVOID ResourceRetValue; /*< 0x1810 / 0xfe0 /
1367	} W7;
1368	struct
1369	{
1370	uint64_t LastSwitchTime; /*< 0x1810 / 0xfe0 /
1371	uint64_t TotalSwitchOutTime; /*< 0x1818 / 0xfe8 /
1372	LARGE_INTEGER WaitReasonBitMap; /*< 0x1820 / 0xff0 /
1373	/* End of TEB in W6 (windows Vista)! */
1374	} W6;
1375	} Diff12;
1376	} TEB_COMMON;
1377	typedef TEB_COMMON *PTEB_COMMON;
1378	AssertCompileMemberOffset(TEB_COMMON, ExceptionCode, ARCH_BITS == 64 ? 0x2c0 : 0x1a4);
1379	AssertCompileMemberOffset(TEB_COMMON, LastStatusValue, ARCH_BITS == 64 ? 0x1250 : 0xbf4);
1380	AssertCompileMemberOffset(TEB_COMMON, DeallocationStack, ARCH_BITS == 64 ? 0x1478 : 0xe0c);
1381	AssertCompileMemberOffset(TEB_COMMON, ReservedForNtRpc, ARCH_BITS == 64 ? 0x1698 : 0xf1c);
1382	AssertCompileMemberOffset(TEB_COMMON, Instrumentation, ARCH_BITS == 64 ? 0x16b8 : 0xf2c);
1383	AssertCompileMemberOffset(TEB_COMMON, Diff2, ARCH_BITS == 64 ? 0x1710 : 0xf50);
1384	AssertCompileMemberOffset(TEB_COMMON, Diff3, ARCH_BITS == 64 ? 0x1728 : 0xf64);
1385	AssertCompileMemberOffset(TEB_COMMON, Diff4, ARCH_BITS == 64 ? 0x1730 : 0xf68);
1386	AssertCompileMemberOffset(TEB_COMMON, WinSockData, ARCH_BITS == 64 ? 0x1738 : 0xf6c);
1387	AssertCompileMemberOffset(TEB_COMMON, GuaranteedStackBytes, ARCH_BITS == 64 ? 0x1748 : 0xf78);
1388	AssertCompileMemberOffset(TEB_COMMON, MuiImpersonation, ARCH_BITS == 64 ? 0x17e8 : 0xfc4);
1389	AssertCompileMemberOffset(TEB_COMMON, LockCount, ARCH_BITS == 64 ? 0x1808 : 0xfd8);
1390	AssertCompileSize(TEB_COMMON, ARCH_BITS == 64 ? 0x1828 : 0xff8);
1391
1392
1393	/** The size of the windows 8.1 PEB structure. */
1394	#define TEB_SIZE_W81 ( RT_UOFFSETOF(TEB_COMMON, Diff12.W8.ReservedForWdf) + sizeof(PVOID) )
1395	/** The size of the windows 8.0 PEB structure. */
1396	#define TEB_SIZE_W80 ( RT_UOFFSETOF(TEB_COMMON, Diff12.W8.ReservedForWdf) + sizeof(PVOID) )
1397	/** The size of the windows 7 PEB structure. */
1398	#define TEB_SIZE_W7 RT_UOFFSETOF(TEB_COMMON, Diff12.W8.ReservedForWdf)
1399	/** The size of the windows vista PEB structure. */
1400	#define TEB_SIZE_W6 ( RT_UOFFSETOF(TEB_COMMON, Diff12.W6.WaitReasonBitMap) + sizeof(LARGE_INTEGER) )
1401	/** The size of the windows server 2003 PEB structure. */
1402	#define TEB_SIZE_W52 RT_ALIGN_Z(RT_UOFFSETOF(TEB_COMMON, Diff9.W52.BooleanSpare), sizeof(PVOID))
1403	/** The size of the windows XP PEB structure. */
1404	#define TEB_SIZE_W51 RT_UOFFSETOF(TEB_COMMON, FlsData)
1405
1406
1407
1408	#define _PEB _PEB_COMMON
1409	typedef PEB_COMMON PEB;
1410	typedef PPEB_COMMON PPEB;
1411
1412	#define _TEB _TEB_COMMON
1413	typedef TEB_COMMON TEB;
1414	typedef PTEB_COMMON PTEB;
1415
1416	#if !defined(NtCurrentTeb) && !defined(IPRT_NT_HAVE_CURRENT_TEB_MACRO)
1417	# ifdef RT_ARCH_X86
1418	DECL_FORCE_INLINE(PTEB) RTNtCurrentTeb(void) { return (PTEB)__readfsdword(RT_OFFSETOF(TEB_COMMON, NtTib.Self)); }
1419	DECL_FORCE_INLINE(PPEB) RTNtCurrentPeb(void) { return (PPEB)__readfsdword(RT_OFFSETOF(TEB_COMMON, ProcessEnvironmentBlock)); }
1420	DECL_FORCE_INLINE(uint32_t) RTNtCurrentThreadId(void) { return __readfsdword(RT_OFFSETOF(TEB_COMMON, ClientId.UniqueThread)); }
1421	# elif defined(RT_ARCH_AMD64)
1422	DECL_FORCE_INLINE(PTEB) RTNtCurrentTeb(void) { return (PTEB)__readgsqword(RT_OFFSETOF(TEB_COMMON, NtTib.Self)); }
1423	DECL_FORCE_INLINE(PPEB) RTNtCurrentPeb(void) { return (PPEB)__readgsqword(RT_OFFSETOF(TEB_COMMON, ProcessEnvironmentBlock)); }
1424	DECL_FORCE_INLINE(uint32_t) RTNtCurrentThreadId(void) { return (uint32_t)__readgsqword(RT_OFFSETOF(TEB_COMMON, ClientId.UniqueThread)); }
1425	# else
1426	# error "Port me"
1427	# endif
1428	#else
1429	# define RTNtCurrentTeb() ((PTEB)NtCurrentTeb())
1430	# define RTNtCurrentPeb() (RTNtCurrentTeb()->ProcessEnvironmentBlock)
1431	# define RTNtCurrentThreadId() ((uint32_t)(uintptr_t)RTNtCurrentTeb()->ClientId.UniqueThread)
1432	#endif
1433	#define NtCurrentPeb() RTNtCurrentPeb()
1434
1435
1436	/** @} */
1437
1438
1439	#ifdef IPRT_NT_USE_WINTERNL
1440	NTSYSAPI NTSTATUS NTAPI NtCreateSection(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PLARGE_INTEGER, ULONG, ULONG, HANDLE);
1441	NTSYSAPI NTSTATUS NTAPI NtUnmapViewOfSection(HANDLE, PVOID);
1442	typedef enum _SECTION_INHERIT
1443	{
1444	ViewShare = 1,
1445	ViewUnmap
1446	} SECTION_INHERIT;
1447	NTSYSAPI NTSTATUS NTAPI NtMapViewOfSection(HANDLE, HANDLE, PVOID *, ULONG, SIZE_T, PLARGE_INTEGER, PSIZE_T, SECTION_INHERIT,
1448	ULONG, ULONG);
1449
1450
1451	typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
1452	{
1453	ULONG FileSystemAttributes;
1454	LONG MaximumComponentNameLength;
1455	ULONG FileSystemNameLength;
1456	WCHAR FileSystemName[1];
1457	} FILE_FS_ATTRIBUTE_INFORMATION;
1458	typedef FILE_FS_ATTRIBUTE_INFORMATION *PFILE_FS_ATTRIBUTE_INFORMATION;
1459
1460	NTSYSAPI NTSTATUS NTAPI NtOpenProcess(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);
1461	NTSYSAPI NTSTATUS NTAPI NtOpenProcessToken(HANDLE, ACCESS_MASK, PHANDLE);
1462	NTSYSAPI NTSTATUS NTAPI NtOpenThread(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);
1463	NTSYSAPI NTSTATUS NTAPI NtOpenThreadToken(HANDLE, ACCESS_MASK, BOOLEAN, PHANDLE);
1464
1465	typedef enum _FSINFOCLASS
1466	{
1467	FileFsVolumeInformation = 1,
1468	FileFsLabelInformation,
1469	FileFsSizeInformation,
1470	FileFsDeviceInformation,
1471	FileFsAttributeInformation,
1472	FileFsControlInformation,
1473	FileFsFullSizeInformation,
1474	FileFsObjectIdInformation,
1475	FileFsDriverPathInformation,
1476	FileFsVolumeFlagsInformation,
1477	FileFsSectorSizeInformation,
1478	FileFsDataCopyInformation,
1479	FileFsMaximumInformation
1480	} FS_INFORMATION_CLASS;
1481	typedef FS_INFORMATION_CLASS *PFS_INFORMATION_CLASS;
1482	NTSYSAPI NTSTATUS NTAPI NtQueryVolumeInformationFile(HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG, FS_INFORMATION_CLASS);
1483
1484	typedef struct _FILE_BOTH_DIR_INFORMATION
1485	{
1486	ULONG NextEntryOffset;
1487	ULONG FileIndex;
1488	LARGE_INTEGER CreationTime;
1489	LARGE_INTEGER LastAccessTime;
1490	LARGE_INTEGER LastWriteTime;
1491	LARGE_INTEGER ChangeTime;
1492	LARGE_INTEGER EndOfFile;
1493	LARGE_INTEGER AllocationSize;
1494	ULONG FileAttributes;
1495	ULONG FileNameLength;
1496	ULONG EaSize;
1497	CCHAR ShortNameLength;
1498	WCHAR ShortName[12];
1499	WCHAR FileName[1];
1500	} FILE_BOTH_DIR_INFORMATION;
1501	typedef FILE_BOTH_DIR_INFORMATION *PFILE_BOTH_DIR_INFORMATION;
1502	typedef struct _FILE_BASIC_INFORMATION
1503	{
1504	LARGE_INTEGER CreationTime;
1505	LARGE_INTEGER LastAccessTime;
1506	LARGE_INTEGER LastWriteTime;
1507	LARGE_INTEGER ChangeTime;
1508	ULONG FileAttributes;
1509	} FILE_BASIC_INFORMATION;
1510	typedef FILE_BASIC_INFORMATION *PFILE_BASIC_INFORMATION;
1511	typedef struct _FILE_STANDARD_INFORMATION
1512	{
1513	LARGE_INTEGER AllocationSize;
1514	LARGE_INTEGER EndOfFile;
1515	ULONG NumberOfLinks;
1516	BOOLEAN DeletePending;
1517	BOOLEAN Directory;
1518	} FILE_STANDARD_INFORMATION;
1519	typedef FILE_STANDARD_INFORMATION *PFILE_STANDARD_INFORMATION;
1520	typedef struct _FILE_NAME_INFORMATION
1521	{
1522	ULONG FileNameLength;
1523	WCHAR FileName[1];
1524	} FILE_NAME_INFORMATION;
1525	typedef FILE_NAME_INFORMATION *PFILE_NAME_INFORMATION;
1526	typedef enum _FILE_INFORMATION_CLASS
1527	{
1528	FileDirectoryInformation = 1,
1529	FileFullDirectoryInformation,
1530	FileBothDirectoryInformation,
1531	FileBasicInformation,
1532	FileStandardInformation,
1533	FileInternalInformation,
1534	FileEaInformation,
1535	FileAccessInformation,
1536	FileNameInformation,
1537	FileRenameInformation,
1538	FileLinkInformation,
1539	FileNamesInformation,
1540	FileDispositionInformation,
1541	FilePositionInformation,
1542	FileFullEaInformation,
1543	FileModeInformation,
1544	FileAlignmentInformation,
1545	FileAllInformation,
1546	FileAllocationInformation,
1547	FileEndOfFileInformation,
1548	FileAlternateNameInformation,
1549	FileStreamInformation,
1550	FilePipeInformation,
1551	FilePipeLocalInformation,
1552	FilePipeRemoteInformation,
1553	FileMailslotQueryInformation,
1554	FileMailslotSetInformation,
1555	FileCompressionInformation,
1556	FileObjectIdInformation,
1557	FileCompletionInformation,
1558	FileMoveClusterInformation,
1559	FileQuotaInformation,
1560	FileReparsePointInformation,
1561	FileNetworkOpenInformation,
1562	FileAttributeTagInformation,
1563	FileTrackingInformation,
1564	FileIdBothDirectoryInformation,
1565	FileIdFullDirectoryInformation,
1566	FileValidDataLengthInformation,
1567	FileShortNameInformation,
1568	FileIoCompletionNotificationInformation,
1569	FileIoStatusBlockRangeInformation,
1570	FileIoPriorityHintInformation,
1571	FileSfioReserveInformation,
1572	FileSfioVolumeInformation,
1573	FileHardLinkInformation,
1574	FileProcessIdsUsingFileInformation,
1575	FileNormalizedNameInformation,
1576	FileNetworkPhysicalNameInformation,
1577	FileIdGlobalTxDirectoryInformation,
1578	FileIsRemoteDeviceInformation,
1579	FileUnusedInformation,
1580	FileNumaNodeInformation,
1581	FileStandardLinkInformation,
1582	FileRemoteProtocolInformation,
1583	FileRenameInformationBypassAccessCheck,
1584	FileLinkInformationBypassAccessCheck,
1585	FileVolumeNameInformation,
1586	FileIdInformation,
1587	FileIdExtdDirectoryInformation,
1588	FileReplaceCompletionInformation,
1589	FileHardLinkFullIdInformation,
1590	FileMaximumInformation
1591	} FILE_INFORMATION_CLASS;
1592	typedef FILE_INFORMATION_CLASS *PFILE_INFORMATION_CLASS;
1593	NTSYSAPI NTSTATUS NTAPI NtQueryInformationFile(HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG, FILE_INFORMATION_CLASS);
1594	NTSYSAPI NTSTATUS NTAPI NtQueryDirectoryFile(HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, PVOID, ULONG,
1595	FILE_INFORMATION_CLASS, BOOLEAN, PUNICODE_STRING, BOOLEAN);
1596
1597	/** For use with KeyBasicInformation. */
1598	typedef struct _KEY_BASIC_INFORMATION
1599	{
1600	LARGE_INTEGER LastWriteTime;
1601	ULONG TitleIndex;
1602	ULONG NameLength;
1603	WCHAR Name[1];
1604	} KEY_BASIC_INFORMATION;
1605	typedef KEY_BASIC_INFORMATION *PKEY_BASIC_INFORMATION;
1606
1607	/** For use with KeyNodeInformation. */
1608	typedef struct _KEY_NODE_INFORMATION
1609	{
1610	LARGE_INTEGER LastWriteTime;
1611	ULONG TitleIndex;
1612	ULONG ClassOffset; /*< Offset from the start of the structure. /
1613	ULONG ClassLength;
1614	ULONG NameLength;
1615	WCHAR Name[1];
1616	} KEY_NODE_INFORMATION;
1617	typedef KEY_NODE_INFORMATION *PKEY_NODE_INFORMATION;
1618
1619	/** For use with KeyFullInformation. */
1620	typedef struct _KEY_FULL_INFORMATION
1621	{
1622	LARGE_INTEGER LastWriteTime;
1623	ULONG TitleIndex;
1624	ULONG ClassOffset; /*< Offset of the Class member. /
1625	ULONG ClassLength;
1626	ULONG SubKeys;
1627	ULONG MaxNameLen;
1628	ULONG MaxClassLen;
1629	ULONG Values;
1630	ULONG MaxValueNameLen;
1631	ULONG MaxValueDataLen;
1632	WCHAR Class[1];
1633	} KEY_FULL_INFORMATION;
1634	typedef KEY_FULL_INFORMATION *PKEY_FULL_INFORMATION;
1635
1636	/** For use with KeyNameInformation. */
1637	typedef struct _KEY_NAME_INFORMATION
1638	{
1639	ULONG NameLength;
1640	WCHAR Name[1];
1641	} KEY_NAME_INFORMATION;
1642	typedef KEY_NAME_INFORMATION *PKEY_NAME_INFORMATION;
1643
1644	/** For use with KeyCachedInformation. */
1645	typedef struct _KEY_CACHED_INFORMATION
1646	{
1647	LARGE_INTEGER LastWriteTime;
1648	ULONG TitleIndex;
1649	ULONG SubKeys;
1650	ULONG MaxNameLen;
1651	ULONG Values;
1652	ULONG MaxValueNameLen;
1653	ULONG MaxValueDataLen;
1654	ULONG NameLength;
1655	} KEY_CACHED_INFORMATION;
1656	typedef KEY_CACHED_INFORMATION *PKEY_CACHED_INFORMATION;
1657
1658	/** For use with KeyVirtualizationInformation. */
1659	typedef struct _KEY_VIRTUALIZATION_INFORMATION
1660	{
1661	ULONG VirtualizationCandidate : 1;
1662	ULONG VirtualizationEnabled : 1;
1663	ULONG VirtualTarget : 1;
1664	ULONG VirtualStore : 1;
1665	ULONG VirtualSource : 1;
1666	ULONG Reserved : 27;
1667	} KEY_VIRTUALIZATION_INFORMATION;
1668	typedef KEY_VIRTUALIZATION_INFORMATION *PKEY_VIRTUALIZATION_INFORMATION;
1669
1670	typedef enum _KEY_INFORMATION_CLASS
1671	{
1672	KeyBasicInformation = 0,
1673	KeyNodeInformation,
1674	KeyFullInformation,
1675	KeyNameInformation,
1676	KeyCachedInformation,
1677	KeyFlagsInformation,
1678	KeyVirtualizationInformation,
1679	KeyHandleTagsInformation,
1680	MaxKeyInfoClass
1681	} KEY_INFORMATION_CLASS;
1682	NTSYSAPI NTSTATUS NTAPI NtQueryKey(HANDLE, KEY_INFORMATION_CLASS, PVOID, ULONG, PULONG);
1683	NTSYSAPI NTSTATUS NTAPI NtEnumerateKey(HANDLE, ULONG, KEY_INFORMATION_CLASS, PVOID, ULONG, PULONG);
1684
1685	typedef struct _MEMORY_SECTION_NAME
1686	{
1687	UNICODE_STRING SectionFileName;
1688	WCHAR NameBuffer[1];
1689	} MEMORY_SECTION_NAME;
1690
1691	#ifdef IPRT_NT_USE_WINTERNL
1692	typedef struct _PROCESS_BASIC_INFORMATION
1693	{
1694	NTSTATUS ExitStatus;
1695	PPEB PebBaseAddress;
1696	ULONG_PTR AffinityMask;
1697	int32_t BasePriority;
1698	ULONG_PTR UniqueProcessId;
1699	ULONG_PTR InheritedFromUniqueProcessId;
1700	} PROCESS_BASIC_INFORMATION;
1701	typedef PROCESS_BASIC_INFORMATION *PPROCESS_BASIC_INFORMATION;
1702	#endif
1703
1704	typedef enum _PROCESSINFOCLASS
1705	{
1706	ProcessBasicInformation = 0, /*< 0 / 0x00 /
1707	ProcessQuotaLimits, /*< 1 / 0x01 /
1708	ProcessIoCounters, /*< 2 / 0x02 /
1709	ProcessVmCounters, /*< 3 / 0x03 /
1710	ProcessTimes, /*< 4 / 0x04 /
1711	ProcessBasePriority, /*< 5 / 0x05 /
1712	ProcessRaisePriority, /*< 6 / 0x06 /
1713	ProcessDebugPort, /*< 7 / 0x07 /
1714	ProcessExceptionPort, /*< 8 / 0x08 /
1715	ProcessAccessToken, /*< 9 / 0x09 /
1716	ProcessLdtInformation, /*< 10 / 0x0a /
1717	ProcessLdtSize, /*< 11 / 0x0b /
1718	ProcessDefaultHardErrorMode, /*< 12 / 0x0c /
1719	ProcessIoPortHandlers, /*< 13 / 0x0d /
1720	ProcessPooledUsageAndLimits, /*< 14 / 0x0e /
1721	ProcessWorkingSetWatch, /*< 15 / 0x0f /
1722	ProcessUserModeIOPL, /*< 16 / 0x10 /
1723	ProcessEnableAlignmentFaultFixup, /*< 17 / 0x11 /
1724	ProcessPriorityClass, /*< 18 / 0x12 /
1725	ProcessWx86Information, /*< 19 / 0x13 /
1726	ProcessHandleCount, /*< 20 / 0x14 /
1727	ProcessAffinityMask, /*< 21 / 0x15 /
1728	ProcessPriorityBoost, /*< 22 / 0x16 /
1729	ProcessDeviceMap, /*< 23 / 0x17 /
1730	ProcessSessionInformation, /*< 24 / 0x18 /
1731	ProcessForegroundInformation, /*< 25 / 0x19 /
1732	ProcessWow64Information, /*< 26 / 0x1a /
1733	ProcessImageFileName, /*< 27 / 0x1b /
1734	ProcessLUIDDeviceMapsEnabled, /*< 28 / 0x1c /
1735	ProcessBreakOnTermination, /*< 29 / 0x1d /
1736	ProcessDebugObjectHandle, /*< 30 / 0x1e /
1737	ProcessDebugFlags, /*< 31 / 0x1f /
1738	ProcessHandleTracing, /*< 32 / 0x20 /
1739	ProcessIoPriority, /*< 33 / 0x21 /
1740	ProcessExecuteFlags, /*< 34 / 0x22 /
1741	ProcessTlsInformation, /*< 35 / 0x23 /
1742	ProcessCookie, /*< 36 / 0x24 /
1743	ProcessImageInformation, /*< 37 / 0x25 /
1744	ProcessCycleTime, /*< 38 / 0x26 /
1745	ProcessPagePriority, /*< 39 / 0x27 /
1746	ProcessInstrumentationCallbak, /*< 40 / 0x28 /
1747	ProcessThreadStackAllocation, /*< 41 / 0x29 /
1748	ProcessWorkingSetWatchEx, /*< 42 / 0x2a /
1749	ProcessImageFileNameWin32, /*< 43 / 0x2b /
1750	ProcessImageFileMapping, /*< 44 / 0x2c /
1751	ProcessAffinityUpdateMode, /*< 45 / 0x2d /
1752	ProcessMemoryAllocationMode, /*< 46 / 0x2e /
1753	ProcessGroupInformation, /*< 47 / 0x2f /
1754	ProcessTokenVirtualizationEnabled, /*< 48 / 0x30 /
1755	ProcessConsoleHostProcess, /*< 49 / 0x31 /
1756	ProcessWindowsInformation, /*< 50 / 0x32 /
1757	ProcessUnknown51,
1758	ProcessUnknown52,
1759	ProcessUnknown53,
1760	ProcessUnknown54,
1761	ProcessUnknown55,
1762	ProcessUnknown56,
1763	ProcessUnknown57,
1764	ProcessUnknown58,
1765	ProcessUnknown59,
1766	ProcessUnknown60,
1767	ProcessUnknown61,
1768	ProcessUnknown62,
1769	ProcessUnknown63,
1770	ProcessUnknown64,
1771	ProcessUnknown65,
1772	ProcessUnknown66,
1773	ProcessMaybe_KeSetCpuSetsProcess, /*< 67 / 0x43 - is correct, then PROCESS_SET_LIMITED_INFORMATION & audiog.exe; W10. /
1774	MaxProcessInfoClass /*< 68 / 0x44 /
1775	} PROCESSINFOCLASS;
1776	NTSYSAPI NTSTATUS NTAPI NtQueryInformationProcess(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG);
1777
1778	typedef enum _THREADINFOCLASS
1779	{
1780	ThreadBasicInformation = 0,
1781	ThreadTimes,
1782	ThreadPriority,
1783	ThreadBasePriority,
1784	ThreadAffinityMask,
1785	ThreadImpersonationToken,
1786	ThreadDescriptorTableEntry,
1787	ThreadEnableAlignmentFaultFixup,
1788	ThreadEventPair_Reusable,
1789	ThreadQuerySetWin32StartAddress,
1790	ThreadZeroTlsCell,
1791	ThreadPerformanceCount,
1792	ThreadAmILastThread,
1793	ThreadIdealProcessor,
1794	ThreadPriorityBoost,
1795	ThreadSetTlsArrayAddress,
1796	ThreadIsIoPending,
1797	ThreadHideFromDebugger,
1798	ThreadBreakOnTermination,
1799	ThreadSwitchLegacyState,
1800	ThreadIsTerminated,
1801	ThreadLastSystemCall,
1802	ThreadIoPriority,
1803	ThreadCycleTime,
1804	ThreadPagePriority,
1805	ThreadActualBasePriority,
1806	ThreadTebInformation,
1807	ThreadCSwitchMon,
1808	ThreadCSwitchPmu,
1809	ThreadWow64Context,
1810	ThreadGroupInformation,
1811	ThreadUmsInformation,
1812	ThreadCounterProfiling,
1813	ThreadIdealProcessorEx,
1814	ThreadCpuAccountingInformation,
1815	MaxThreadInfoClass
1816	} THREADINFOCLASS;
1817	NTSYSAPI NTSTATUS NTAPI NtSetInformationThread(HANDLE, THREADINFOCLASS, LPCVOID, ULONG);
1818
1819	NTSYSAPI NTSTATUS NTAPI NtQueryInformationToken(HANDLE, TOKEN_INFORMATION_CLASS, PVOID, ULONG, PULONG);
1820
1821	NTSYSAPI NTSTATUS NTAPI NtReadFile(HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER, PULONG);
1822	NTSYSAPI NTSTATUS NTAPI NtWriteFile(HANDLE, HANDLE, PIO_APC_ROUTINE, void const *, PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER, PULONG);
1823	NTSYSAPI NTSTATUS NTAPI NtFlushBuffersFile(HANDLE, PIO_STATUS_BLOCK);
1824
1825	NTSYSAPI NTSTATUS NTAPI NtReadVirtualMemory(HANDLE, PVOID, PVOID, SIZE_T, PSIZE_T);
1826	NTSYSAPI NTSTATUS NTAPI NtWriteVirtualMemory(HANDLE, PVOID, void const *, SIZE_T, PSIZE_T);
1827
1828	NTSYSAPI NTSTATUS NTAPI RtlAddAccessAllowedAce(PACL, ULONG, ULONG, PSID);
1829	NTSYSAPI NTSTATUS NTAPI RtlCopySid(ULONG, PSID, PSID);
1830	NTSYSAPI NTSTATUS NTAPI RtlCreateAcl(PACL, ULONG, ULONG);
1831	NTSYSAPI NTSTATUS NTAPI RtlCreateSecurityDescriptor(PSECURITY_DESCRIPTOR, ULONG);
1832	NTSYSAPI BOOLEAN NTAPI RtlEqualSid(PSID, PSID);
1833	NTSYSAPI NTSTATUS NTAPI RtlGetVersion(PRTL_OSVERSIONINFOW);
1834	NTSYSAPI NTSTATUS NTAPI RtlInitializeSid(PSID, PSID_IDENTIFIER_AUTHORITY, UCHAR);
1835	NTSYSAPI NTSTATUS NTAPI RtlSetDaclSecurityDescriptor(PSECURITY_DESCRIPTOR, BOOLEAN, PACL, BOOLEAN);
1836	NTSYSAPI PULONG NTAPI RtlSubAuthoritySid(PSID, ULONG);
1837
1838	#endif /* IPRT_NT_USE_WINTERNL */
1839
1840	typedef enum _OBJECT_INFORMATION_CLASS
1841	{
1842	ObjectBasicInformation = 0,
1843	ObjectNameInformation,
1844	ObjectTypeInformation,
1845	ObjectAllInformation,
1846	ObjectDataInformation
1847	} OBJECT_INFORMATION_CLASS;
1848	typedef OBJECT_INFORMATION_CLASS *POBJECT_INFORMATION_CLASS;
1849	#ifdef IN_RING0
1850	# define NtQueryObject ZwQueryObject
1851	#endif
1852	NTSYSAPI NTSTATUS NTAPI NtQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
1853	NTSYSAPI NTSTATUS NTAPI NtSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
1854	NTSYSAPI NTSTATUS NTAPI NtDuplicateObject(HANDLE, HANDLE, HANDLE, PHANDLE, ACCESS_MASK, ULONG, ULONG);
1855
1856	NTSYSAPI NTSTATUS NTAPI NtOpenDirectoryObject(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1857
1858	typedef struct _OBJECT_DIRECTORY_INFORMATION
1859	{
1860	UNICODE_STRING Name;
1861	UNICODE_STRING TypeName;
1862	} OBJECT_DIRECTORY_INFORMATION;
1863	typedef OBJECT_DIRECTORY_INFORMATION *POBJECT_DIRECTORY_INFORMATION;
1864	NTSYSAPI NTSTATUS NTAPI NtQueryDirectoryObject(HANDLE, PVOID, ULONG, BOOLEAN, BOOLEAN, PULONG, PULONG);
1865
1866	NTSYSAPI NTSTATUS NTAPI NtSuspendProcess(HANDLE);
1867	NTSYSAPI NTSTATUS NTAPI NtResumeProcess(HANDLE);
1868	/** @name ProcessDefaultHardErrorMode bit definitions.
1869	* @{ */
1870	#define PROCESS_HARDERR_CRITICAL_ERROR UINT32_C(0x00000001) /*< Inverted from the win32 define. /
1871	#define PROCESS_HARDERR_NO_GP_FAULT_ERROR UINT32_C(0x00000002)
1872	#define PROCESS_HARDERR_NO_ALIGNMENT_FAULT_ERROR UINT32_C(0x00000004)
1873	#define PROCESS_HARDERR_NO_OPEN_FILE_ERROR UINT32_C(0x00008000)
1874	/** @} */
1875	NTSYSAPI NTSTATUS NTAPI NtSetInformationProcess(HANDLE, PROCESSINFOCLASS, PVOID, ULONG);
1876	NTSYSAPI NTSTATUS NTAPI NtTerminateProcess(HANDLE, LONG);
1877
1878	/** Retured by ProcessImageInformation as well as NtQuerySection. */
1879	typedef struct _SECTION_IMAGE_INFORMATION
1880	{
1881	PVOID TransferAddress;
1882	ULONG ZeroBits;
1883	SIZE_T MaximumStackSize;
1884	SIZE_T CommittedStackSize;
1885	ULONG SubSystemType;
1886	union
1887	{
1888	struct
1889	{
1890	USHORT SubSystemMinorVersion;
1891	USHORT SubSystemMajorVersion;
1892	};
1893	ULONG SubSystemVersion;
1894	};
1895	ULONG GpValue;
1896	USHORT ImageCharacteristics;
1897	USHORT DllCharacteristics;
1898	USHORT Machine;
1899	BOOLEAN ImageContainsCode;
1900	union /*< Since Vista, used to be a spare BOOLEAN. /
1901	{
1902	struct
1903	{
1904	UCHAR ComPlusNativeRead : 1;
1905	UCHAR ComPlusILOnly : 1;
1906	UCHAR ImageDynamicallyRelocated : 1;
1907	UCHAR ImageMAppedFlat : 1;
1908	UCHAR Reserved : 4;
1909	};
1910	UCHAR ImageFlags;
1911	};
1912	ULONG LoaderFlags;
1913	ULONG ImageFileSize; /*< Since XP? /
1914	ULONG CheckSum; /*< Since Vista, Used to be a reserved/spare ULONG. /
1915	} SECTION_IMAGE_INFORMATION;
1916	typedef SECTION_IMAGE_INFORMATION *PSECTION_IMAGE_INFORMATION;
1917
1918	typedef enum _SECTION_INFORMATION_CLASS
1919	{
1920	SectionBasicInformation = 0,
1921	SectionImageInformation,
1922	MaxSectionInfoClass
1923	} SECTION_INFORMATION_CLASS;
1924	NTSYSAPI NTSTATUS NTAPI NtQuerySection(HANDLE, SECTION_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T);
1925
1926	NTSYSAPI NTSTATUS NTAPI NtCreateSymbolicLinkObject(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PUNICODE_STRING pTarget);
1927	NTSYSAPI NTSTATUS NTAPI NtOpenSymbolicLinkObject(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1928	NTSYSAPI NTSTATUS NTAPI NtQuerySymbolicLinkObject(HANDLE, PUNICODE_STRING, PULONG);
1929	#ifndef SYMBOLIC_LINK_QUERY
1930	# define SYMBOLIC_LINK_QUERY UINT32_C(0x00000001)
1931	#endif
1932	#ifndef SYMBOLIC_LINK_ALL_ACCESS
1933	# define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED \| SYMBOLIC_LINK_QUERY)
1934	#endif
1935
1936	NTSYSAPI NTSTATUS NTAPI NtQueryInformationThread(HANDLE, THREADINFOCLASS, PVOID, ULONG, PULONG);
1937	NTSYSAPI NTSTATUS NTAPI NtResumeThread(HANDLE, PULONG);
1938	NTSYSAPI NTSTATUS NTAPI NtSuspendThread(HANDLE, PULONG);
1939	NTSYSAPI NTSTATUS NTAPI NtTerminateThread(HANDLE, LONG);
1940	NTSYSAPI NTSTATUS NTAPI NtGetContextThread(HANDLE, PCONTEXT);
1941	NTSYSAPI NTSTATUS NTAPI NtSetContextThread(HANDLE, PCONTEXT);
1942
1943
1944	#ifndef SEC_FILE
1945	# define SEC_FILE UINT32_C(0x00800000)
1946	#endif
1947	#ifndef SEC_IMAGE
1948	# define SEC_IMAGE UINT32_C(0x01000000)
1949	#endif
1950	#ifndef SEC_PROTECTED_IMAGE
1951	# define SEC_PROTECTED_IMAGE UINT32_C(0x02000000)
1952	#endif
1953	#ifndef SEC_NOCACHE
1954	# define SEC_NOCACHE UINT32_C(0x10000000)
1955	#endif
1956	#ifndef MEM_ROTATE
1957	# define MEM_ROTATE UINT32_C(0x00800000)
1958	#endif
1959	typedef enum _MEMORY_INFORMATION_CLASS
1960	{
1961	MemoryBasicInformation = 0,
1962	MemoryWorkingSetList,
1963	MemorySectionName,
1964	MemoryBasicVlmInformation
1965	} MEMORY_INFORMATION_CLASS;
1966	#ifdef IN_RING0
1967	typedef struct _MEMORY_BASIC_INFORMATION
1968	{
1969	PVOID BaseAddress;
1970	PVOID AllocationBase;
1971	ULONG AllocationProtect;
1972	SIZE_T RegionSize;
1973	ULONG State;
1974	ULONG Protect;
1975	ULONG Type;
1976	} MEMORY_BASIC_INFORMATION;
1977	typedef MEMORY_BASIC_INFORMATION *PMEMORY_BASIC_INFORMATION;
1978	# define NtQueryVirtualMemory ZwQueryVirtualMemory
1979	#endif
1980	NTSYSAPI NTSTATUS NTAPI NtQueryVirtualMemory(HANDLE, void const *, MEMORY_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T);
1981	#ifdef IPRT_NT_USE_WINTERNL
1982	NTSYSAPI NTSTATUS NTAPI NtAllocateVirtualMemory(HANDLE, PVOID *, ULONG, PSIZE_T, ULONG, ULONG);
1983	#endif
1984	NTSYSAPI NTSTATUS NTAPI NtFreeVirtualMemory(HANDLE, PVOID *, PSIZE_T, ULONG);
1985	NTSYSAPI NTSTATUS NTAPI NtProtectVirtualMemory(HANDLE, PVOID *, PSIZE_T, ULONG, PULONG);
1986
1987	typedef enum _SYSTEM_INFORMATION_CLASS
1988	{
1989	SystemBasicInformation = 0,
1990	SystemCpuInformation,
1991	SystemPerformanceInformation,
1992	SystemTimeOfDayInformation,
1993	SystemInformation_Unknown_4,
1994	SystemProcessInformation,
1995	SystemInformation_Unknown_6,
1996	SystemInformation_Unknown_7,
1997	SystemProcessorPerformanceInformation,
1998	SystemInformation_Unknown_9,
1999	SystemInformation_Unknown_10,
2000	SystemModuleInformation,
2001	SystemInformation_Unknown_12,
2002	SystemInformation_Unknown_13,
2003	SystemInformation_Unknown_14,
2004	SystemInformation_Unknown_15,
2005	SystemHandleInformation,
2006	SystemInformation_Unknown_17,
2007	SystemPageFileInformation,
2008	SystemInformation_Unknown_19,
2009	SystemInformation_Unknown_20,
2010	SystemCacheInformation,
2011	SystemInformation_Unknown_22,
2012	SystemInterruptInformation,
2013	SystemDpcBehaviourInformation,
2014	SystemFullMemoryInformation,
2015	SystemLoadGdiDriverInformation, /* 26 */
2016	SystemUnloadGdiDriverInformation, /* 27 */
2017	SystemTimeAdjustmentInformation,
2018	SystemSummaryMemoryInformation,
2019	SystemInformation_Unknown_30,
2020	SystemInformation_Unknown_31,
2021	SystemInformation_Unknown_32,
2022	SystemExceptionInformation,
2023	SystemCrashDumpStateInformation,
2024	SystemKernelDebuggerInformation,
2025	SystemContextSwitchInformation,
2026	SystemRegistryQuotaInformation,
2027	SystemInformation_Unknown_38,
2028	SystemInformation_Unknown_39,
2029	SystemInformation_Unknown_40,
2030	SystemInformation_Unknown_41,
2031	SystemInformation_Unknown_42,
2032	SystemInformation_Unknown_43,
2033	SystemCurrentTimeZoneInformation,
2034	SystemLookasideInformation,
2035	SystemSetTimeSlipEvent,
2036	SystemCreateSession,
2037	SystemDeleteSession,
2038	SystemInformation_Unknown_49,
2039	SystemRangeStartInformation,
2040	SystemVerifierInformation,
2041	SystemInformation_Unknown_52,
2042	SystemSessionProcessInformation,
2043	SystemLoadGdiDriverInSystemSpaceInformation, /* 54 */
2044	SystemInformation_Unknown_55,
2045	SystemInformation_Unknown_56,
2046	SystemExtendedProcessInformation,
2047	SystemInformation_Unknown_58,
2048	SystemInformation_Unknown_59,
2049	SystemInformation_Unknown_60,
2050	SystemInformation_Unknown_61,
2051	SystemInformation_Unknown_62,
2052	SystemInformation_Unknown_63,
2053	SystemExtendedHandleInformation, /* 64 */
2054	SystemInformation_Unknown_65,
2055	SystemInformation_Unknown_66,
2056	SystemInformation_Unknown_67,
2057	SystemInformation_Unknown_68,
2058	SystemInformation_HotPatchInfo, /* 69 */
2059	SystemInformation_Unknown_70,
2060	SystemInformation_Unknown_71,
2061	SystemInformation_Unknown_72,
2062	SystemInformation_Unknown_73,
2063	SystemInformation_Unknown_74,
2064	SystemInformation_Unknown_75,
2065	SystemInformation_Unknown_76,
2066	SystemInformation_Unknown_77,
2067	SystemInformation_Unknown_78,
2068	SystemInformation_Unknown_79,
2069	SystemInformation_Unknown_80,
2070	SystemInformation_Unknown_81,
2071	SystemInformation_Unknown_82,
2072	SystemInformation_Unknown_83,
2073	SystemInformation_Unknown_84,
2074	SystemInformation_Unknown_85,
2075	SystemInformation_Unknown_86,
2076	SystemInformation_Unknown_87,
2077	SystemInformation_Unknown_88,
2078	SystemInformation_Unknown_89,
2079	SystemInformation_Unknown_90,
2080	SystemInformation_Unknown_91,
2081	SystemInformation_Unknown_92,
2082	SystemInformation_Unknown_93,
2083	SystemInformation_Unknown_94,
2084	SystemInformation_Unknown_95,
2085	SystemInformation_KiOpPrefetchPatchCount,
2086
2087	/** @todo fill gap. they've added a whole bunch of things */
2088	SystemPolicyInformation = 134,
2089	SystemInformationClassMax
2090	} SYSTEM_INFORMATION_CLASS;
2091
2092	#ifdef IPRT_NT_USE_WINTERNL
2093	typedef struct _VM_COUNTERS
2094	{
2095	SIZE_T PeakVirtualSize;
2096	SIZE_T VirtualSize;
2097	ULONG PageFaultCount;
2098	SIZE_T PeakWorkingSetSize;
2099	SIZE_T WorkingSetSize;
2100	SIZE_T QuotaPeakPagedPoolUsage;
2101	SIZE_T QuotaPagedPoolUsage;
2102	SIZE_T QuotaPeakNonPagedPoolUsage;
2103	SIZE_T QuotaNonPagedPoolUsage;
2104	SIZE_T PagefileUsage;
2105	SIZE_T PeakPagefileUsage;
2106	} VM_COUNTERS;
2107	typedef VM_COUNTERS *PVM_COUNTERS;
2108	#endif
2109
2110	#if 0
2111	typedef struct _IO_COUNTERS
2112	{
2113	ULONGLONG ReadOperationCount;
2114	ULONGLONG WriteOperationCount;
2115	ULONGLONG OtherOperationCount;
2116	ULONGLONG ReadTransferCount;
2117	ULONGLONG WriteTransferCount;
2118	ULONGLONG OtherTransferCount;
2119	} IO_COUNTERS;
2120	typedef IO_COUNTERS *PIO_COUNTERS;
2121	#endif
2122
2123	typedef struct _RTNT_SYSTEM_PROCESS_INFORMATION
2124	{
2125	ULONG NextEntryOffset; /*< 0x00 / 0x00 /
2126	ULONG NumberOfThreads; /*< 0x04 / 0x04 /
2127	LARGE_INTEGER Reserved1[3]; /*< 0x08 / 0x08 /
2128	LARGE_INTEGER CreationTime; /*< 0x20 / 0x20 /
2129	LARGE_INTEGER UserTime; /*< 0x28 / 0x28 /
2130	LARGE_INTEGER KernelTime; /*< 0x30 / 0x30 /
2131	UNICODE_STRING ProcessName; /*< 0x38 / 0x38 Clean unicode encoding? /
2132	int32_t BasePriority; /*< 0x40 / 0x48 /
2133	HANDLE UniqueProcessId; /*< 0x44 / 0x50 /
2134	HANDLE ParentProcessId; /*< 0x48 / 0x58 /
2135	ULONG HandleCount; /*< 0x4c / 0x60 /
2136	ULONG Reserved2; /*< 0x50 / 0x64 Session ID? /
2137	ULONG_PTR Reserved3; /*< 0x54 / 0x68 /
2138	VM_COUNTERS VmCounters; /*< 0x58 / 0x70 /
2139	IO_COUNTERS IoCounters; /*< 0x88 / 0xd0 Might not be present in earlier windows versions. /
2140	/* After this follows the threads, then the ProcessName.Buffer. */
2141	} RTNT_SYSTEM_PROCESS_INFORMATION;
2142	typedef RTNT_SYSTEM_PROCESS_INFORMATION *PRTNT_SYSTEM_PROCESS_INFORMATION;
2143	#ifndef IPRT_NT_USE_WINTERNL
2144	typedef RTNT_SYSTEM_PROCESS_INFORMATION SYSTEM_PROCESS_INFORMATION;
2145	typedef SYSTEM_PROCESS_INFORMATION *PSYSTEM_PROCESS_INFORMATION;
2146	#endif
2147
2148	typedef struct _SYSTEM_HANDLE_ENTRY_INFO
2149	{
2150	USHORT UniqueProcessId;
2151	USHORT CreatorBackTraceIndex;
2152	UCHAR ObjectTypeIndex;
2153	UCHAR HandleAttributes;
2154	USHORT HandleValue;
2155	PVOID Object;
2156	ULONG GrantedAccess;
2157	} SYSTEM_HANDLE_ENTRY_INFO;
2158	typedef SYSTEM_HANDLE_ENTRY_INFO *PSYSTEM_HANDLE_ENTRY_INFO;
2159
2160	/** Returned by SystemHandleInformation */
2161	typedef struct _SYSTEM_HANDLE_INFORMATION
2162	{
2163	ULONG NumberOfHandles;
2164	SYSTEM_HANDLE_ENTRY_INFO Handles[1];
2165	} SYSTEM_HANDLE_INFORMATION;
2166	typedef SYSTEM_HANDLE_INFORMATION *PSYSTEM_HANDLE_INFORMATION;
2167
2168	/** Extended handle information entry.
2169	* @remarks 3 x PVOID + 4 x ULONG = 28 bytes on 32-bit / 40 bytes on 64-bit */
2170	typedef struct _SYSTEM_HANDLE_ENTRY_INFO_EX
2171	{
2172	PVOID Object;
2173	HANDLE UniqueProcessId;
2174	HANDLE HandleValue;
2175	ACCESS_MASK GrantedAccess;
2176	USHORT CreatorBackTraceIndex;
2177	USHORT ObjectTypeIndex;
2178	ULONG HandleAttributes;
2179	ULONG Reserved;
2180	} SYSTEM_HANDLE_ENTRY_INFO_EX;
2181	typedef SYSTEM_HANDLE_ENTRY_INFO_EX *PSYSTEM_HANDLE_ENTRY_INFO_EX;
2182
2183	/** Returned by SystemExtendedHandleInformation. */
2184	typedef struct _SYSTEM_HANDLE_INFORMATION_EX
2185	{
2186	ULONG_PTR NumberOfHandles;
2187	ULONG_PTR Reserved;
2188	SYSTEM_HANDLE_ENTRY_INFO_EX Handles[1];
2189	} SYSTEM_HANDLE_INFORMATION_EX;
2190	typedef SYSTEM_HANDLE_INFORMATION_EX *PSYSTEM_HANDLE_INFORMATION_EX;
2191
2192	/** Input to SystemSessionProcessInformation. */
2193	typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
2194	{
2195	ULONG SessionId;
2196	ULONG BufferLength;
2197	/** Return buffer, SYSTEM_PROCESS_INFORMATION entries. */
2198	PVOID Buffer;
2199	} SYSTEM_SESSION_PROCESS_INFORMATION;
2200	typedef SYSTEM_SESSION_PROCESS_INFORMATION *PSYSTEM_SESSION_PROCESS_INFORMATION;
2201
2202	NTSYSAPI NTSTATUS NTAPI NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG);
2203
2204	NTSYSAPI NTSTATUS NTAPI NtDelayExecution(BOOLEAN, PLARGE_INTEGER);
2205	NTSYSAPI NTSTATUS NTAPI NtYieldExecution(void);
2206	#ifndef IPRT_NT_USE_WINTERNL
2207	NTSYSAPI NTSTATUS NTAPI NtWaitForSingleObject(HANDLE, BOOLEAN PLARGE_INTEGER);
2208	#endif
2209	typedef NTSYSAPI NTSTATUS (NTAPI *PFNNTWAITFORSINGLEOBJECT)(HANDLE, BOOLEAN, PLARGE_INTEGER);
2210	typedef enum _OBJECT_WAIT_TYPE { WaitAllObjects = 0, WaitAnyObject = 1, ObjectWaitTypeHack = 0x7fffffff } OBJECT_WAIT_TYPE;
2211	NTSYSAPI NTSTATUS NTAPI NtWaitForMultipleObjects(ULONG, PHANDLE, OBJECT_WAIT_TYPE, BOOLEAN, PLARGE_INTEGER);
2212
2213	NTSYSAPI NTSTATUS NTAPI NtQuerySecurityObject(HANDLE, ULONG, PSECURITY_DESCRIPTOR, ULONG, PULONG);
2214
2215	#ifdef IPRT_NT_USE_WINTERNL
2216	typedef enum _EVENT_TYPE
2217	{
2218	/* Manual reset event. */
2219	NotificationEvent = 0,
2220	/* Automaitc reset event. */
2221	SynchronizationEvent
2222	} EVENT_TYPE;
2223	#endif
2224	NTSYSAPI NTSTATUS NTAPI NtCreateEvent(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, EVENT_TYPE, BOOLEAN);
2225	NTSYSAPI NTSTATUS NTAPI NtOpenEvent(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
2226	typedef NTSYSAPI NTSTATUS (NTAPI *PFNNTCLEAREVENT)(HANDLE);
2227	NTSYSAPI NTSTATUS NTAPI NtClearEvent(HANDLE);
2228	NTSYSAPI NTSTATUS NTAPI NtResetEvent(HANDLE, PULONG);
2229	NTSYSAPI NTSTATUS NTAPI NtSetEvent(HANDLE, PULONG);
2230	typedef NTSYSAPI NTSTATUS (NTAPI *PFNNTSETEVENT)(HANDLE, PULONG);
2231	typedef enum _EVENT_INFORMATION_CLASS
2232	{
2233	EventBasicInformation = 0
2234	} EVENT_INFORMATION_CLASS;
2235	/** Data returned by NtQueryEvent + EventBasicInformation. */
2236	typedef struct EVENT_BASIC_INFORMATION
2237	{
2238	EVENT_TYPE EventType;
2239	ULONG EventState;
2240	} EVENT_BASIC_INFORMATION;
2241	typedef EVENT_BASIC_INFORMATION *PEVENT_BASIC_INFORMATION;
2242	NTSYSAPI NTSTATUS NTAPI NtQueryEvent(HANDLE, EVENT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
2243
2244	#ifdef IPRT_NT_USE_WINTERNL
2245	/** For NtQueryValueKey. */
2246	typedef enum _KEY_VALUE_INFORMATION_CLASS
2247	{
2248	KeyValueBasicInformation = 0,
2249	KeyValueFullInformation,
2250	KeyValuePartialInformation,
2251	KeyValueFullInformationAlign64,
2252	KeyValuePartialInformationAlign64
2253	} KEY_VALUE_INFORMATION_CLASS;
2254
2255	/** KeyValuePartialInformation and KeyValuePartialInformationAlign64 struct. */
2256	typedef struct _KEY_VALUE_PARTIAL_INFORMATION
2257	{
2258	ULONG TitleIndex;
2259	ULONG Type;
2260	ULONG DataLength;
2261	UCHAR Data[1];
2262	} KEY_VALUE_PARTIAL_INFORMATION;
2263	typedef KEY_VALUE_PARTIAL_INFORMATION *PKEY_VALUE_PARTIAL_INFORMATION;
2264	#endif
2265	NTSYSAPI NTSTATUS NTAPI NtOpenKey(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
2266	NTSYSAPI NTSTATUS NTAPI NtQueryValueKey(HANDLE, PUNICODE_STRING, KEY_VALUE_INFORMATION_CLASS, PVOID, ULONG, PULONG);
2267
2268
2269	NTSYSAPI NTSTATUS NTAPI RtlAddAccessDeniedAce(PACL, ULONG, ULONG, PSID);
2270
2271
2272	typedef struct _CURDIR
2273	{
2274	UNICODE_STRING DosPath;
2275	HANDLE Handle;
2276	} CURDIR;
2277	typedef CURDIR *PCURDIR;
2278
2279	typedef struct _RTL_DRIVE_LETTER_CURDIR
2280	{
2281	USHORT Flags;
2282	USHORT Length;
2283	ULONG TimeStamp;
2284	STRING DosPath; /*< Yeah, it's STRING according to dt ntdll!_RTL_DRIVE_LETTER_CURDIR. /
2285	} RTL_DRIVE_LETTER_CURDIR;
2286	typedef RTL_DRIVE_LETTER_CURDIR *PRTL_DRIVE_LETTER_CURDIR;
2287
2288	typedef struct _RTL_USER_PROCESS_PARAMETERS
2289	{
2290	ULONG MaximumLength;
2291	ULONG Length;
2292	ULONG Flags;
2293	ULONG DebugFlags;
2294	HANDLE ConsoleHandle;
2295	ULONG ConsoleFlags;
2296	HANDLE StandardInput;
2297	HANDLE StandardOutput;
2298	HANDLE StandardError;
2299	CURDIR CurrentDirectory;
2300	UNICODE_STRING DllPath;
2301	UNICODE_STRING ImagePathName;
2302	UNICODE_STRING CommandLine;
2303	PWSTR Environment;
2304	ULONG StartingX;
2305	ULONG StartingY;
2306	ULONG CountX;
2307	ULONG CountY;
2308	ULONG CountCharsX;
2309	ULONG CountCharsY;
2310	ULONG FillAttribute;
2311	ULONG WindowFlags;
2312	ULONG ShowWindowFlags;
2313	UNICODE_STRING WindowTitle;
2314	UNICODE_STRING DesktopInfo;
2315	UNICODE_STRING ShellInfo;
2316	UNICODE_STRING RuntimeInfo;
2317	RTL_DRIVE_LETTER_CURDIR CurrentDirectories[0x20];
2318	SIZE_T EnvironmentSize; /*< Added in Vista /
2319	SIZE_T EnvironmentVersion; /*< Added in Windows 7. /
2320	PVOID PackageDependencyData; /*< Added Windows 8? /
2321	ULONG ProcessGroupId; /*< Added Windows 8? /
2322	} RTL_USER_PROCESS_PARAMETERS;
2323	typedef RTL_USER_PROCESS_PARAMETERS *PRTL_USER_PROCESS_PARAMETERS;
2324	#define RTL_USER_PROCESS_PARAMS_FLAG_NORMALIZED 1
2325
2326	typedef struct _RTL_USER_PROCESS_INFORMATION
2327	{
2328	ULONG Size;
2329	HANDLE ProcessHandle;
2330	HANDLE ThreadHandle;
2331	CLIENT_ID ClientId;
2332	SECTION_IMAGE_INFORMATION ImageInformation;
2333	} RTL_USER_PROCESS_INFORMATION;
2334	typedef RTL_USER_PROCESS_INFORMATION *PRTL_USER_PROCESS_INFORMATION;
2335
2336
2337	NTSYSAPI NTSTATUS NTAPI RtlCreateUserProcess(PUNICODE_STRING, ULONG, PRTL_USER_PROCESS_PARAMETERS, PSECURITY_DESCRIPTOR,
2338	PSECURITY_DESCRIPTOR, HANDLE, BOOLEAN, HANDLE, HANDLE, PRTL_USER_PROCESS_INFORMATION);
2339	NTSYSAPI NTSTATUS NTAPI RtlCreateProcessParameters(PRTL_USER_PROCESS_PARAMETERS *, PUNICODE_STRING ImagePathName,
2340	PUNICODE_STRING DllPath, PUNICODE_STRING CurrentDirectory,
2341	PUNICODE_STRING CommandLine, PUNICODE_STRING Environment,
2342	PUNICODE_STRING WindowTitle, PUNICODE_STRING DesktopInfo,
2343	PUNICODE_STRING ShellInfo, PUNICODE_STRING RuntimeInfo);
2344	NTSYSAPI VOID NTAPI RtlDestroyProcessParameters(PRTL_USER_PROCESS_PARAMETERS);
2345	NTSYSAPI NTSTATUS NTAPI RtlCreateUserThread(HANDLE, PSECURITY_DESCRIPTOR, BOOLEAN, ULONG, SIZE_T, SIZE_T,
2346	PFNRT, PVOID, PHANDLE, PCLIENT_ID);
2347
2348	#ifndef RTL_CRITICAL_SECTION_FLAG_NO_DEBUG_INFO
2349	typedef struct _RTL_CRITICAL_SECTION
2350	{
2351	struct _RTL_CRITICAL_SECTION_DEBUG *DebugInfo;
2352	LONG LockCount;
2353	LONG Recursioncount;
2354	HANDLE OwningThread;
2355	HANDLE LockSemaphore;
2356	ULONG_PTR SpinCount;
2357	} RTL_CRITICAL_SECTION;
2358	typedef RTL_CRITICAL_SECTION *PRTL_CRITICAL_SECTION;
2359	#endif
2360
2361	RT_C_DECLS_END
2362	/** @} */
2363
2364
2365	#if defined(IN_RING0) \|\| defined(DOXYGEN_RUNNING)
2366	/** @name NT Kernel APIs
2367	* @{ */
2368	RT_C_DECLS_BEGIN
2369
2370	typedef ULONG KEPROCESSORINDEX; /*< Bitmap indexes != process numbers, apparently. /
2371
2372	NTSYSAPI VOID NTAPI KeInitializeAffinityEx(PKAFFINITY_EX pAffinity);
2373	typedef VOID (NTAPI *PFNKEINITIALIZEAFFINITYEX)(PKAFFINITY_EX pAffinity);
2374	NTSYSAPI VOID NTAPI KeAddProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
2375	typedef VOID (NTAPI *PFNKEADDPROCESSORAFFINITYEX)(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
2376	NTSYSAPI VOID NTAPI KeRemoveProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
2377	typedef VOID (NTAPI *PFNKEREMOVEPROCESSORAFFINITYEX)(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
2378	NTSYSAPI BOOLEAN NTAPI KeInterlockedSetProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
2379	typedef BOOLEAN (NTAPI *PFNKEINTERLOCKEDSETPROCESSORAFFINITYEX)(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
2380	NTSYSAPI BOOLEAN NTAPI KeInterlockedClearProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
2381	typedef BOOLEAN (NTAPI *PFNKEINTERLOCKEDCLEARPROCESSORAFFINITYEX)(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
2382	NTSYSAPI BOOLEAN NTAPI KeCheckProcessorAffinityEx(PCKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
2383	typedef BOOLEAN (NTAPI *PFNKECHECKPROCESSORAFFINITYEX)(PCKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
2384	NTSYSAPI VOID NTAPI KeCopyAffinityEx(PKAFFINITY_EX pDst, PCKAFFINITY_EX pSrc);
2385	typedef VOID (NTAPI *PFNKECOPYAFFINITYEX)(PKAFFINITY_EX pDst, PCKAFFINITY_EX pSrc);
2386	NTSYSAPI VOID NTAPI KeComplementAffinityEx(PKAFFINITY_EX pResult, PCKAFFINITY_EX pIn);
2387	typedef VOID (NTAPI *PFNKECOMPLEMENTAFFINITYEX)(PKAFFINITY_EX pResult, PCKAFFINITY_EX pIn);
2388	NTSYSAPI BOOLEAN NTAPI KeAndAffinityEx(PCKAFFINITY_EX pIn1, PCKAFFINITY_EX pIn2, PKAFFINITY_EX pResult OPTIONAL);
2389	typedef BOOLEAN (NTAPI *PFNKEANDAFFINITYEX)(PCKAFFINITY_EX pIn1, PCKAFFINITY_EX pIn2, PKAFFINITY_EX pResult OPTIONAL);
2390	NTSYSAPI BOOLEAN NTAPI KeOrAffinityEx(PCKAFFINITY_EX pIn1, PCKAFFINITY_EX pIn2, PKAFFINITY_EX pResult OPTIONAL);
2391	typedef BOOLEAN (NTAPI *PFNKEORAFFINITYEX)(PCKAFFINITY_EX pIn1, PCKAFFINITY_EX pIn2, PKAFFINITY_EX pResult OPTIONAL);
2392	/** Works like anding the complemented subtrahend with the minuend. */
2393	NTSYSAPI BOOLEAN NTAPI KeSubtractAffinityEx(PCKAFFINITY_EX pMinuend, PCKAFFINITY_EX pSubtrahend, PKAFFINITY_EX pResult OPTIONAL);
2394	typedef BOOLEAN (NTAPI *PFNKESUBTRACTAFFINITYEX)(PCKAFFINITY_EX pMinuend, PCKAFFINITY_EX pSubtrahend, PKAFFINITY_EX pResult OPTIONAL);
2395	NTSYSAPI BOOLEAN NTAPI KeIsEqualAffinityEx(PCKAFFINITY_EX pLeft, PCKAFFINITY_EX pRight);
2396	typedef BOOLEAN (NTAPI *PFNKEISEQUALAFFINITYEX)(PCKAFFINITY_EX pLeft, PCKAFFINITY_EX pRight);
2397	NTSYSAPI BOOLEAN NTAPI KeIsEmptyAffinityEx(PCKAFFINITY_EX pAffinity);
2398	typedef BOOLEAN (NTAPI *PFNKEISEMPTYAFFINITYEX)(PCKAFFINITY_EX pAffinity);
2399	NTSYSAPI BOOLEAN NTAPI KeIsSubsetAffinityEx(PCKAFFINITY_EX pSubset, PCKAFFINITY_EX pSuperSet);
2400	typedef BOOLEAN (NTAPI *PFNKEISSUBSETAFFINITYEX)(PCKAFFINITY_EX pSubset, PCKAFFINITY_EX pSuperSet);
2401	NTSYSAPI ULONG NTAPI KeCountSetBitsAffinityEx(PCKAFFINITY_EX pAffinity);
2402	typedef ULONG (NTAPI *PFNKECOUNTSETAFFINITYEX)(PCKAFFINITY_EX pAffinity);
2403	NTSYSAPI KEPROCESSORINDEX NTAPI KeFindFirstSetLeftAffinityEx(PCKAFFINITY_EX pAffinity);
2404	typedef KEPROCESSORINDEX (NTAPI *PFNKEFINDFIRSTSETLEFTAFFINITYEX)(PCKAFFINITY_EX pAffinity);
2405	typedef NTSTATUS (NTAPI *PFNKEGETPROCESSORNUMBERFROMINDEX)(KEPROCESSORINDEX idxProcessor, PPROCESSOR_NUMBER pProcNumber);
2406	typedef KEPROCESSORINDEX (NTAPI PFNKEGETPROCESSORINDEXFROMNUMBER)(const PROCESSOR_NUMBER pProcNumber);
2407
2408	NTSYSAPI BOOLEAN NTAPI ObFindHandleForObject(PEPROCESS pProcess, PVOID pvObject, POBJECT_TYPE pObjectType,
2409	PVOID pvOptionalConditions, PHANDLE phFound);
2410	NTSYSAPI NTSTATUS NTAPI ObReferenceObjectByName(PUNICODE_STRING pObjectPath, ULONG fAttributes, PACCESS_STATE pAccessState,
2411	ACCESS_MASK fDesiredAccess, POBJECT_TYPE pObjectType,
2412	KPROCESSOR_MODE enmAccessMode, PVOID pvParseContext, PVOID *ppvObject);
2413	NTSYSAPI HANDLE NTAPI PsGetProcessInheritedFromUniqueProcessId(PEPROCESS);
2414	NTSYSAPI UCHAR * NTAPI PsGetProcessImageFileName(PEPROCESS);
2415	NTSYSAPI BOOLEAN NTAPI PsIsProcessBeingDebugged(PEPROCESS);
2416	NTSYSAPI ULONG NTAPI PsGetProcessSessionId(PEPROCESS);
2417	extern DECLIMPORT(POBJECT_TYPE ) LpcPortObjectType; /< In vista+ this is the ALPC port object type. /
2418	extern DECLIMPORT(POBJECT_TYPE ) LpcWaitablePortObjectType; /< In vista+ this is the ALPC port object type. /
2419
2420	typedef VOID (NTAPI *PFNHALREQUESTIPI_PRE_W7)(KAFFINITY TargetSet);
2421	typedef VOID (NTAPI *PFNHALREQUESTIPI_W7PLUS)(ULONG uUsuallyZero, PCKAFFINITY_EX pTargetSet);
2422
2423	RT_C_DECLS_END
2424	/** @ */
2425	#endif /* IN_RING0 */
2426
2427
2428	#if defined(IN_RING3) \|\| defined(DOXYGEN_RUNNING)
2429	/** @name NT Userland APIs
2430	* @{ */
2431	RT_C_DECLS_BEGIN
2432
2433	#if 0 /** @todo figure this out some time... */
2434	typedef struct CSR_MSG_DATA_CREATED_PROCESS
2435	{
2436	HANDLE hProcess;
2437	HANDLE hThread;
2438	CLIENT_ID
2439	DWORD idProcess;
2440	DWORD idThread;
2441	DWORD fCreate;
2442
2443	} CSR_MSG_DATA_CREATED_PROCESS;
2444
2445	#define CSR_MSG_NO_CREATED_PROCESS UINT32_C(0x10000)
2446	#define CSR_MSG_NO_CREATED_THREAD UINT32_C(0x10001)
2447	NTSYSAPI NTSTATUS NTAPI CsrClientCallServer(PVOID, PVOID, ULONG, SIZE_T);
2448	#endif
2449
2450	NTSYSAPI VOID NTAPI LdrInitializeThunk(PVOID, PVOID, PVOID);
2451
2452	typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA
2453	{
2454	ULONG Flags;
2455	PCUNICODE_STRING FullDllName;
2456	PCUNICODE_STRING BaseDllName;
2457	PVOID DllBase;
2458	ULONG SizeOfImage;
2459	} LDR_DLL_LOADED_NOTIFICATION_DATA, LDR_DLL_UNLOADED_NOTIFICATION_DATA;
2460	typedef LDR_DLL_LOADED_NOTIFICATION_DATA PLDR_DLL_LOADED_NOTIFICATION_DATA, PLDR_DLL_UNLOADED_NOTIFICATION_DATA;
2461	typedef LDR_DLL_LOADED_NOTIFICATION_DATA const PCLDR_DLL_LOADED_NOTIFICATION_DATA, PCLDR_DLL_UNLOADED_NOTIFICATION_DATA;
2462
2463	typedef union _LDR_DLL_NOTIFICATION_DATA
2464	{
2465	LDR_DLL_LOADED_NOTIFICATION_DATA Loaded;
2466	LDR_DLL_UNLOADED_NOTIFICATION_DATA Unloaded;
2467	} LDR_DLL_NOTIFICATION_DATA;
2468	typedef LDR_DLL_NOTIFICATION_DATA *PLDR_DLL_NOTIFICATION_DATA;
2469	typedef LDR_DLL_NOTIFICATION_DATA const *PCLDR_DLL_NOTIFICATION_DATA;
2470
2471	typedef VOID (NTAPI *PLDR_DLL_NOTIFICATION_FUNCTION)(ULONG ulReason, PCLDR_DLL_NOTIFICATION_DATA pData, PVOID pvUser);
2472
2473	#define LDR_DLL_NOTIFICATION_REASON_LOADED UINT32_C(1)
2474	#define LDR_DLL_NOTIFICATION_REASON_UNLOADED UINT32_C(2)
2475	NTSYSAPI NTSTATUS NTAPI LdrRegisterDllNotification(ULONG fFlags, PLDR_DLL_NOTIFICATION_FUNCTION pfnCallback, PVOID pvUser,
2476	PVOID *pvCookie);
2477	typedef NTSTATUS (NTAPI PFNLDRREGISTERDLLNOTIFICATION)(ULONG, PLDR_DLL_NOTIFICATION_FUNCTION, PVOID, PVOID );
2478	NTSYSAPI NTSTATUS NTAPI LdrUnregisterDllNotification(PVOID pvCookie);
2479	typedef NTSTATUS (NTAPI *PFNLDRUNREGISTERDLLNOTIFICATION)(PVOID);
2480
2481	NTSYSAPI NTSTATUS NTAPI LdrLoadDll(IN PWSTR pwszSearchPathOrFlags OPTIONAL, IN PULONG pfFlags OPTIONAL,
2482	IN PCUNICODE_STRING pName, OUT PHANDLE phMod);
2483	typedef NTSTATUS (NTAPI *PFNLDRLOADDLL)(IN PWSTR pwszSearchPathOrFlags OPTIONAL, IN PULONG pfFlags OPTIONAL,
2484	IN PCUNICODE_STRING pName, OUT PHANDLE phMod);
2485	NTSYSAPI NTSTATUS NTAPI LdrUnloadDll(IN HANDLE hMod);
2486	typedef NTSTATUS (NTAPI *PFNLDRUNLOADDLL)(IN HANDLE hMod);
2487	NTSYSAPI NTSTATUS NTAPI LdrGetDllHandle(IN PCWSTR pwszDllPath OPTIONAL, IN PULONG pfFlags OPTIONAL,
2488	IN PCUNICODE_STRING pName, OUT PHANDLE phDll);
2489	typedef NTSTATUS (NTAPI *PFNLDRGETDLLHANDLE)(IN PCWSTR pwszDllPath OPTIONAL, IN PULONG pfFlags OPTIONAL,
2490	IN PCUNICODE_STRING pName, OUT PHANDLE phDll);
2491	#define LDRGETDLLHANDLEEX_F_UNCHANGED_REFCOUNT RT_BIT_32(0)
2492	#define LDRGETDLLHANDLEEX_F_PIN RT_BIT_32(1)
2493	/** @since Windows XP. */
2494	NTSYSAPI NTSTATUS NTAPI LdrGetDllHandleEx(IN ULONG fFlags, IN PCWSTR pwszDllPath OPTIONAL, IN PULONG pfFlags OPTIONAL,
2495	IN PCUNICODE_STRING pName, OUT PHANDLE phDll);
2496	/** @since Windows XP. */
2497	typedef NTSTATUS (NTAPI *PFNLDRGETDLLHANDLEEX)(IN ULONG fFlags, IN PCWSTR pwszDllPath OPTIONAL, IN PULONG pfFlags OPTIONAL,
2498	IN PCUNICODE_STRING pName, OUT PHANDLE phDll);
2499	/** @since Windows 7. */
2500	NTSYSAPI NTSTATUS NTAPI LdrGetDllHandleByMapping(IN PVOID pvBase, OUT PHANDLE phDll);
2501	/** @since Windows 7. */
2502	typedef NTSTATUS (NTAPI *PFNLDRGETDLLHANDLEBYMAPPING)(IN PVOID pvBase, OUT PHANDLE phDll);
2503	/** @since Windows 7. */
2504	NTSYSAPI NTSTATUS NTAPI LdrGetDllHandleByName(IN PCUNICODE_STRING pName OPTIONAL, IN PCUNICODE_STRING pFullName OPTIONAL,
2505	OUT PHANDLE phDll);
2506	/** @since Windows 7. */
2507	typedef NTSTATUS (NTAPI *PFNLDRGETDLLHANDLEBYNAME)(IN PCUNICODE_STRING pName OPTIONAL, IN PCUNICODE_STRING pFullName OPTIONAL,
2508	OUT PHANDLE phDll);
2509	#define LDRADDREFDLL_F_PIN RT_BIT_32(0)
2510	NTSYSAPI NTSTATUS NTAPI LdrAddRefDll(IN ULONG fFlags, IN HANDLE hDll);
2511	typedef NTSTATUS (NTAPI *PFNLDRADDREFDLL)(IN ULONG fFlags, IN HANDLE hDll);
2512	NTSYSAPI NTSTATUS NTAPI LdrGetProcedureAddress(IN HANDLE hDll, IN ANSI_STRING const *pSymbol OPTIONAL,
2513	IN ULONG uOrdinal OPTIONAL, OUT PVOID *ppvSymbol);
2514	typedef NTSTATUS (NTAPI *PFNLDRGETPROCEDUREADDRESS)(IN HANDLE hDll, IN PCANSI_STRING pSymbol OPTIONAL,
2515	IN ULONG uOrdinal OPTIONAL, OUT PVOID *ppvSymbol);
2516	#define LDRGETPROCEDUREADDRESSEX_F_DONT_RECORD_FORWARDER RT_BIT_32(0)
2517	/** @since Windows Vista. */
2518	NTSYSAPI NTSTATUS NTAPI LdrGetProcedureAddressEx(IN HANDLE hDll, IN ANSI_STRING const *pSymbol OPTIONAL,
2519	IN ULONG uOrdinal OPTIONAL, OUT PVOID *ppvSymbol, ULONG fFlags);
2520	/** @since Windows Vista. */
2521	typedef NTSTATUS (NTAPI PFNLDRGETPROCEDUREADDRESSEX)(IN HANDLE hDll, IN ANSI_STRING const pSymbol OPTIONAL,
2522	IN ULONG uOrdinal OPTIONAL, OUT PVOID *ppvSymbol, ULONG fFlags);
2523	#define LDRLOCKLOADERLOCK_F_RAISE_ERRORS RT_BIT_32(0)
2524	#define LDRLOCKLOADERLOCK_F_NO_WAIT RT_BIT_32(1)
2525	#define LDRLOCKLOADERLOCK_DISP_INVALID UINT32_C(0)
2526	#define LDRLOCKLOADERLOCK_DISP_ACQUIRED UINT32_C(1)
2527	#define LDRLOCKLOADERLOCK_DISP_NOT_ACQUIRED UINT32_C(2)
2528	/** @since Windows XP. */
2529	NTSYSAPI NTSTATUS NTAPI LdrLockLoaderLock(IN ULONG fFlags, OUT PULONG puDisposition OPTIONAL, OUT PVOID *ppvCookie);
2530	/** @since Windows XP. */
2531	typedef NTSTATUS (NTAPI PFNLDRLOCKLOADERLOCK)(IN ULONG fFlags, OUT PULONG puDisposition OPTIONAL, OUT PVOID ppvCookie);
2532	#define LDRUNLOCKLOADERLOCK_F_RAISE_ERRORS RT_BIT_32(0)
2533	/** @since Windows XP. */
2534	NTSYSAPI NTSTATUS NTAPI LdrUnlockLoaderLock(IN ULONG fFlags, OUT PVOID pvCookie);
2535	/** @since Windows XP. */
2536	typedef NTSTATUS (NTAPI *PFNLDRUNLOCKLOADERLOCK)(IN ULONG fFlags, OUT PVOID pvCookie);
2537
2538	NTSYSAPI NTSTATUS NTAPI RtlExpandEnvironmentStrings_U(PVOID, PUNICODE_STRING, PUNICODE_STRING, PULONG);
2539	NTSYSAPI VOID NTAPI RtlExitUserProcess(NTSTATUS rcExitCode); /*< Vista and later. /
2540	NTSYSAPI VOID NTAPI RtlExitUserThread(NTSTATUS rcExitCode);
2541	NTSYSAPI NTSTATUS NTAPI RtlDosApplyFileIsolationRedirection_Ustr(IN ULONG fFlags,
2542	IN PCUNICODE_STRING pOrgName,
2543	IN PUNICODE_STRING pDefaultSuffix,
2544	IN OUT PUNICODE_STRING pStaticString,
2545	IN OUT PUNICODE_STRING pDynamicString,
2546	IN OUT PUNICODE_STRING *ppResultString,
2547	IN PULONG pfNewFlags OPTIONAL,
2548	IN PSIZE_T pcbFilename OPTIONAL,
2549	IN PSIZE_T pcbNeeded OPTIONAL);
2550
2551	# ifdef IPRT_NT_USE_WINTERNL
2552	typedef NTSTATUS NTAPI RTL_HEAP_COMMIT_ROUTINE(PVOID, PVOID *, PSIZE_T);
2553	typedef RTL_HEAP_COMMIT_ROUTINE *PRTL_HEAP_COMMIT_ROUTINE;
2554	typedef struct _RTL_HEAP_PARAMETERS
2555	{
2556	ULONG Length;
2557	SIZE_T SegmentReserve;
2558	SIZE_T SegmentCommit;
2559	SIZE_T DeCommitFreeBlockThreshold;
2560	SIZE_T DeCommitTotalFreeThreshold;
2561	SIZE_T MaximumAllocationSize;
2562	SIZE_T VirtualMemoryThreshold;
2563	SIZE_T InitialCommit;
2564	SIZE_T InitialReserve;
2565	PRTL_HEAP_COMMIT_ROUTINE CommitRoutine;
2566	SIZE_T Reserved[2];
2567	} RTL_HEAP_PARAMETERS;
2568	typedef RTL_HEAP_PARAMETERS *PRTL_HEAP_PARAMETERS;
2569	NTSYSAPI PVOID NTAPI RtlCreateHeap(ULONG fFlags, PVOID pvHeapBase, SIZE_T cbReserve, SIZE_T cbCommit, PVOID pvLock,
2570	PRTL_HEAP_PARAMETERS pParameters);
2571	/** @name Heap flags (for RtlCreateHeap).
2572	* @{ */
2573	/*# define HEAP_NO_SERIALIZE UINT32_C(0x00000001)
2574	# define HEAP_GROWABLE UINT32_C(0x00000002)
2575	# define HEAP_GENERATE_EXCEPTIONS UINT32_C(0x00000004)
2576	# define HEAP_ZERO_MEMORY UINT32_C(0x00000008)
2577	# define HEAP_REALLOC_IN_PLACE_ONLY UINT32_C(0x00000010)
2578	# define HEAP_TAIL_CHECKING_ENABLED UINT32_C(0x00000020)
2579	# define HEAP_FREE_CHECKING_ENABLED UINT32_C(0x00000040)
2580	# define HEAP_DISABLE_COALESCE_ON_FREE UINT32_C(0x00000080)*/
2581	# define HEAP_SETTABLE_USER_VALUE UINT32_C(0x00000100)
2582	# define HEAP_SETTABLE_USER_FLAG1 UINT32_C(0x00000200)
2583	# define HEAP_SETTABLE_USER_FLAG2 UINT32_C(0x00000400)
2584	# define HEAP_SETTABLE_USER_FLAG3 UINT32_C(0x00000800)
2585	# define HEAP_SETTABLE_USER_FLAGS UINT32_C(0x00000e00)
2586	# define HEAP_CLASS_0 UINT32_C(0x00000000)
2587	# define HEAP_CLASS_1 UINT32_C(0x00001000)
2588	# define HEAP_CLASS_2 UINT32_C(0x00002000)
2589	# define HEAP_CLASS_3 UINT32_C(0x00003000)
2590	# define HEAP_CLASS_4 UINT32_C(0x00004000)
2591	# define HEAP_CLASS_5 UINT32_C(0x00005000)
2592	# define HEAP_CLASS_6 UINT32_C(0x00006000)
2593	# define HEAP_CLASS_7 UINT32_C(0x00007000)
2594	# define HEAP_CLASS_8 UINT32_C(0x00008000)
2595	# define HEAP_CLASS_MASK UINT32_C(0x0000f000)
2596	# endif
2597	# define HEAP_CLASS_PROCESS HEAP_CLASS_0
2598	# define HEAP_CLASS_PRIVATE HEAP_CLASS_1
2599	# define HEAP_CLASS_KERNEL HEAP_CLASS_2
2600	# define HEAP_CLASS_GDI HEAP_CLASS_3
2601	# define HEAP_CLASS_USER HEAP_CLASS_4
2602	# define HEAP_CLASS_CONSOLE HEAP_CLASS_5
2603	# define HEAP_CLASS_USER_DESKTOP HEAP_CLASS_6
2604	# define HEAP_CLASS_CSRSS_SHARED HEAP_CLASS_7
2605	# define HEAP_CLASS_CSRSS_PORT HEAP_CLASS_8
2606	# ifdef IPRT_NT_USE_WINTERNL
2607	/*# define HEAP_CREATE_ALIGN_16 UINT32_C(0x00010000)
2608	# define HEAP_CREATE_ENABLE_TRACING UINT32_C(0x00020000)
2609	# define HEAP_CREATE_ENABLE_EXECUTE UINT32_C(0x00040000)*/
2610	# define HEAP_CREATE_VALID_MASK UINT32_C(0x0007f0ff)
2611	# endif /* IPRT_NT_USE_WINTERNL */
2612	/** @} */
2613	# ifdef IPRT_NT_USE_WINTERNL
2614	/** @name Heap tagging constants
2615	* @{ */
2616	# define HEAP_GLOBAL_TAG UINT32_C(0x00000800)
2617	/*# define HEAP_MAXIMUM_TAG UINT32_C(0x00000fff)
2618	# define HEAP_PSEUDO_TAG_FLAG UINT32_C(0x00008000)
2619	# define HEAP_TAG_SHIFT 18 */
2620	# define HEAP_TAG_MASK (HEAP_MAXIMUM_TAG << HEAP_TAG_SHIFT)
2621	/** @} */
2622	NTSYSAPI PVOID NTAPI RtlAllocateHeap(HANDLE hHeap, ULONG fFlags, SIZE_T cb);
2623	NTSYSAPI PVOID NTAPI RtlReAllocateHeap(HANDLE hHeap, ULONG fFlags, PVOID pvOld, SIZE_T cbNew);
2624	NTSYSAPI BOOLEAN NTAPI RtlFreeHeap(HANDLE hHeap, ULONG fFlags, PVOID pvMem);
2625	# endif /* IPRT_NT_USE_WINTERNL */
2626	NTSYSAPI SIZE_T NTAPI RtlCompactHeap(HANDLE hHeap, ULONG fFlags);
2627	NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING);
2628	NTSYSAPI SIZE_T NTAPI RtlSizeHeap(HANDLE hHeap, ULONG fFlags, PVOID pvMem);
2629	NTSYSAPI NTSTATUS NTAPI RtlGetLastNtStatus(VOID);
2630	NTSYSAPI ULONG NTAPI RtlGetLastWin32Error(VOID);
2631	NTSYSAPI VOID NTAPI RtlSetLastWin32Error(ULONG uError);
2632	NTSYSAPI VOID NTAPI RtlSetLastWin32ErrorAndNtStatusFromNtStatus(NTSTATUS rcNt);
2633	NTSYSAPI VOID NTAPI RtlRestoreLastWin32Error(ULONG uError);
2634	NTSYSAPI BOOLEAN NTAPI RtlQueryPerformanceCounter(PLARGE_INTEGER);
2635	NTSYSAPI uint64_t NTAPI RtlGetSystemTimePrecise(VOID);
2636	typedef uint64_t (NTAPI * PFNRTLGETSYSTEMTIMEPRECISE)(VOID);
2637
2638	RT_C_DECLS_END
2639	/** @} */
2640	#endif /* IN_RING3 */
2641
2642	#endif
2643

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/include/iprt/nt/nt.h@ 62534

Download in other formats: