249 lines
6.5 KiB
C
249 lines
6.5 KiB
C
#pragma once
|
|
#ifndef _EXPORTS__INDLC
|
|
#define _EXPORTS__INDLC
|
|
|
|
#include "ntifs.h"
|
|
typedef enum _SYSTEM_INFORMATION_CLASS {
|
|
SystemBasicInformation,
|
|
SystemProcessorInformation,
|
|
SystemPerformanceInformation,
|
|
SystemTimeOfDayInformation,
|
|
SystemNotImplemented1,
|
|
SystemProcessesAndThreadsInformation,
|
|
SystemCallCounts,
|
|
SystemConfigurationInformation,
|
|
SystemProcessorTimes,
|
|
SystemGlobalFlag,
|
|
SystemNotImplemented2,
|
|
SystemModuleInformation,
|
|
SystemLockInformation,
|
|
SystemNotImplemented3,
|
|
SystemNotImplemented4,
|
|
SystemNotImplemented5,
|
|
SystemHandleInformation,
|
|
SystemObjectInformation,
|
|
SystemPagefileInformation,
|
|
SystemInstructionEmulationCounts,
|
|
SystemInvalidInfoClass1,
|
|
SystemCacheInformation,
|
|
SystemPoolTagInformation,
|
|
SystemProcessorStatistics,
|
|
SystemDpcInformation,
|
|
SystemNotImplemented6,
|
|
SystemLoadImage,
|
|
SystemUnloadImage,
|
|
SystemTimeAdjustment,
|
|
SystemNotImplemented7,
|
|
SystemNotImplemented8,
|
|
SystemNotImplemented9,
|
|
SystemCrashDumpInformation,
|
|
SystemExceptionInformation,
|
|
SystemCrashDumpStateInformation,
|
|
SystemKernelDebuggerInformation,
|
|
SystemContextSwitchInformation,
|
|
SystemRegistryQuotaInformation,
|
|
SystemLoadAndCallImage,
|
|
SystemPrioritySeparation,
|
|
SystemNotImplemented10,
|
|
SystemNotImplemented11,
|
|
SystemInvalidInfoClass2,
|
|
SystemInvalidInfoClass3,
|
|
SystemTimeZoneInformation,
|
|
SystemLookasideInformation,
|
|
SystemSetTimeSlipEvent,
|
|
SystemCreateSession,
|
|
SystemDeleteSession,
|
|
SystemInvalidInfoClass4,
|
|
SystemRangeStartInformation,
|
|
SystemVerifierInformation,
|
|
SystemAddVerifier,
|
|
SystemSessionProcessesInformation
|
|
} SYSTEM_INFORMATION_CLASS, * PSYSTEM_INFORMATION_CLASS;
|
|
|
|
typedef struct _SYSTEM_HANDLE_INFORMATION {
|
|
USHORT ProcessId;
|
|
USHORT CreatorBackTraceIndex;
|
|
UCHAR ObjectTypeNumber;
|
|
UCHAR Flags;
|
|
USHORT Handle;
|
|
PVOID Object;
|
|
ACCESS_MASK GrantedAccess;
|
|
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
|
|
typedef struct _SYSTEM_HANDLE_INFORMATION_EX {
|
|
ULONG NumberOfHandles;
|
|
SYSTEM_HANDLE_INFORMATION Information[1];
|
|
} SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;
|
|
|
|
typedef struct _SYSTEM_THREAD_INFORMATION {
|
|
LARGE_INTEGER KernelTime;
|
|
LARGE_INTEGER UserTime;
|
|
LARGE_INTEGER CreateTime;
|
|
ULONG WaitTime;
|
|
PVOID StartAddress;
|
|
CLIENT_ID ClientId;
|
|
KPRIORITY Priority;
|
|
KPRIORITY BasePriority;
|
|
ULONG ContextSwitchCount;
|
|
LONG State;
|
|
LONG WaitReason;
|
|
} SYSTEM_THREAD_INFORMATION, * PSYSTEM_THREAD_INFORMATION;
|
|
typedef struct _SYSTEM_PROCESS_INFORMATION {
|
|
ULONG NextEntryDelta;
|
|
ULONG ThreadCount;
|
|
ULONG Reserved1[6];
|
|
LARGE_INTEGER CreateTime;
|
|
LARGE_INTEGER UserTime;
|
|
LARGE_INTEGER KernelTime;
|
|
UNICODE_STRING ProcessName;
|
|
KPRIORITY BasePriority;
|
|
ULONG ProcessId;
|
|
ULONG InheritedFromProcessId;
|
|
ULONG HandleCount;
|
|
ULONG Reserved2[2];
|
|
VM_COUNTERS VmCounters;
|
|
IO_COUNTERS IoCounters;
|
|
SYSTEM_THREAD_INFORMATION Threads[1];
|
|
} SYSTEM_PROCESS_INFORMATION, * PSYSTEM_PROCESS_INFORMATION;
|
|
typedef struct _SYSTEM_MODULE {
|
|
HANDLE Section;
|
|
PVOID MappedBase;
|
|
PVOID ImageBase;
|
|
ULONG ImageSize;
|
|
ULONG Flags;
|
|
USHORT LoadOrderIndex;
|
|
USHORT InitOrderIndex;
|
|
USHORT LoadCount;
|
|
USHORT OffsetToFileName;
|
|
UCHAR FullPathName[MAXIMUM_FILENAME_LENGTH];
|
|
} SYSTEM_MODULE, * PSYSTEM_MODULE;
|
|
|
|
typedef struct _SYSTEM_MODULE_INFORMATION {
|
|
ULONG NumberOfModules;
|
|
SYSTEM_MODULE Modules[1];
|
|
} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION;
|
|
|
|
typedef struct _SYSTEM_BIGPOOL_ENTRY
|
|
{
|
|
union {
|
|
PVOID VirtualAddress;
|
|
ULONG_PTR NonPaged : 1;
|
|
};
|
|
ULONG_PTR SizeInBytes;
|
|
union {
|
|
UCHAR Tag[4];
|
|
ULONG TagUlong;
|
|
};
|
|
} SYSTEM_BIGPOOL_ENTRY, *PSYSTEM_BIGPOOL_ENTRY;
|
|
|
|
typedef struct _SYSTEM_BIGPOOL_INFORMATION {
|
|
ULONG Count;
|
|
SYSTEM_BIGPOOL_ENTRY AllocatedInfo[ANYSIZE_ARRAY];
|
|
} SYSTEM_BIGPOOL_INFORMATION, *PSYSTEM_BIGPOOL_INFORMATION;
|
|
|
|
/*typedef struct _IMAGE_RUNTIME_FUNCTION_ENTRY {
|
|
DWORD BeginAddress;
|
|
DWORD EndAddress;
|
|
union {
|
|
DWORD UnwindInfoAddress;
|
|
DWORD UnwindData;
|
|
} DUMMYUNIONNAME;
|
|
} RUNTIME_FUNCTION, * PRUNTIME_FUNCTION, _IMAGE_RUNTIME_FUNCTION_ENTRY, * _PIMAGE_RUNTIME_FUNCTION_ENTRY;*/
|
|
typedef enum _MYOBJECT_INFORMATION_CLASS
|
|
{
|
|
myObjectBasicInformation = 0,
|
|
myObjectNameInformation,
|
|
myObjectTypeInformation,
|
|
myObjectTypesInformation,
|
|
myObjectHandleFlagInformation,
|
|
myObjectSessionInformation,
|
|
myMaxObjectInfoClass
|
|
} MYOBJECT_INFORMATION_CLASS, * PMYOBJECT_INFORMATION_CLASS;
|
|
typedef struct _MYOBJECT_HANDLE_ATTRIBUTE_INFORMATION
|
|
{
|
|
BOOLEAN Inherit;
|
|
BOOLEAN ProtectFromClose;
|
|
} MYOBJECT_HANDLE_ATTRIBUTE_INFORMATION, * PMYOBJECT_HANDLE_ATTRIBUTE_INFORMATION;
|
|
|
|
typedef struct _MYOBJECT_TYPE_INFORMATION
|
|
{
|
|
UNICODE_STRING TypeName;
|
|
ULONG TotalNumberOfObjects;
|
|
ULONG TotalNumberOfHandles;
|
|
ULONG TotalPagedPoolUsage;
|
|
ULONG TotalNonPagedPoolUsage;
|
|
ULONG TotalNamePoolUsage;
|
|
ULONG TotalHandleTableUsage;
|
|
ULONG HighWaterNumberOfObjects;
|
|
ULONG HighWaterNumberOfHandles;
|
|
ULONG HighWaterPagedPoolUsage;
|
|
ULONG HighWaterNonPagedPoolUsage;
|
|
ULONG HighWaterNamePoolUsage;
|
|
ULONG HighWaterHandleTableUsage;
|
|
ULONG InvalidAttributes;
|
|
GENERIC_MAPPING GenericMapping;
|
|
ULONG ValidAccessMask;
|
|
BOOLEAN SecurityRequired;
|
|
BOOLEAN MaintainHandleCount;
|
|
ULONG PoolType;
|
|
ULONG DefaultPagedPoolCharge;
|
|
ULONG DefaultNonPagedPoolCharge;
|
|
} MYOBJECT_TYPE_INFORMATION, * PMYOBJECT_TYPE_INFORMATION;
|
|
|
|
typedef struct _MYOBJECT_NAME_INFORMATION
|
|
{
|
|
UNICODE_STRING Name;
|
|
} MYOBJECT_NAME_INFORMATION, * PMYOBJECT_NAME_INFORMATION;
|
|
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQuerySystemInformation(
|
|
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
|
OUT PVOID SystemInformation,
|
|
IN ULONG SystemInformationLength,
|
|
OUT PULONG ReturnLength OPTIONAL
|
|
);
|
|
NTKERNELAPI NTSTATUS ObReferenceObjectByName(__in PUNICODE_STRING ObjectName,
|
|
__in ULONG Attributes,
|
|
__in_opt PACCESS_STATE AccessState,
|
|
__in_opt ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_TYPE ObjectType,
|
|
__in KPROCESSOR_MODE AccessMode,
|
|
__inout_opt PVOID ParseContext,
|
|
__out PVOID * Object
|
|
);
|
|
extern POBJECT_TYPE *IoDriverObjectType;
|
|
|
|
NTKERNELAPI
|
|
UCHAR* PsGetProcessImageFileName(__in PEPROCESS Process);
|
|
NTKERNELAPI HANDLE PsGetProcessInheritedFromUniqueProcessId(IN PEPROCESS Process);
|
|
NTKERNELAPI
|
|
PVOID
|
|
PsGetProcessSectionBaseAddress(
|
|
__in PEPROCESS Process
|
|
);
|
|
PEJOB NTAPI PsGetProcessJob(PEPROCESS Process);
|
|
PEPROCESS NTAPI PsGetCurrentThreadProcess(VOID);
|
|
POBJECT_TYPE NTAPI ObGetObjectType(IN PVOID pObject);
|
|
NTSTATUS NTAPI ZwQueryInformationProcess(
|
|
_In_ HANDLE ProcessHandle,
|
|
_In_ PROCESSINFOCLASS ProcessInformationClass,
|
|
_Out_ PVOID ProcessInformation,
|
|
_In_ ULONG ProcessInformationLength,
|
|
_Out_opt_ PULONG ReturnLength
|
|
);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif // !_EXPORTS__INDLC
|
|
|
|
|
|
|