diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-05-04 12:41:41 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-05-04 12:41:41 +0000 |
commit | 10ee2acdd26a7f1298c6f6d6b7af9b469fe29b87 (patch) | |
tree | bdffd5d80c26cf4a7a518281a204be1ace85b4c1 /vendor/ntapi/src/ntpsapi.rs | |
parent | Releasing progress-linux version 1.70.0+dfsg1-9~progress7.99u1. (diff) | |
download | rustc-10ee2acdd26a7f1298c6f6d6b7af9b469fe29b87.tar.xz rustc-10ee2acdd26a7f1298c6f6d6b7af9b469fe29b87.zip |
Merging upstream version 1.70.0+dfsg2.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'vendor/ntapi/src/ntpsapi.rs')
-rw-r--r-- | vendor/ntapi/src/ntpsapi.rs | 1479 |
1 files changed, 0 insertions, 1479 deletions
diff --git a/vendor/ntapi/src/ntpsapi.rs b/vendor/ntapi/src/ntpsapi.rs deleted file mode 100644 index 2a0d3cde0..000000000 --- a/vendor/ntapi/src/ntpsapi.rs +++ /dev/null @@ -1,1479 +0,0 @@ -use crate::ntapi_base::{CLIENT_ID, KPRIORITY, PCLIENT_ID}; -use crate::ntexapi::{PROCESS_DISK_COUNTERS, PROCESS_ENERGY_VALUES}; -use crate::ntpebteb::{PPEB, PTEB}; -use winapi::ctypes::c_void; -use winapi::shared::basetsd::{PSIZE_T, SIZE_T, ULONG64, ULONG_PTR}; -use winapi::shared::ntdef::{ - BOOLEAN, HANDLE, LARGE_INTEGER, LIST_ENTRY, LONG, LONGLONG, NTSTATUS, NT_PRODUCT_TYPE, - PHANDLE, PLARGE_INTEGER, POBJECT_ATTRIBUTES, PROCESSOR_NUMBER, PSINGLE_LIST_ENTRY, PULONG, - PVOID, SINGLE_LIST_ENTRY, UCHAR, ULONG, ULONGLONG, UNICODE_STRING, USHORT, WCHAR, -}; -use winapi::um::winnt::{ - ACCESS_MASK, CONTEXT, HARDWARE_COUNTER_TYPE, IO_COUNTERS, JOBOBJECTINFOCLASS, - JOBOBJECT_BASIC_ACCOUNTING_INFORMATION, LDT_ENTRY, MAX_HW_COUNTERS, PCONTEXT, PJOB_SET_ARRAY, - PROCESS_MITIGATION_ASLR_POLICY, PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY, - PROCESS_MITIGATION_CHILD_PROCESS_POLICY, PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY, - PROCESS_MITIGATION_DYNAMIC_CODE_POLICY, PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY, - PROCESS_MITIGATION_FONT_DISABLE_POLICY, PROCESS_MITIGATION_IMAGE_LOAD_POLICY, - PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY, PROCESS_MITIGATION_POLICY, - PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY, PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY, - PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY, PSECURITY_QUALITY_OF_SERVICE, -}; -#[cfg(not(target_arch = "aarch64"))] -use crate::winapi_local::um::winnt::NtCurrentTeb; -pub const GDI_HANDLE_BUFFER_SIZE32: usize = 34; -pub const GDI_HANDLE_BUFFER_SIZE64: usize = 60; -#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] -pub const GDI_HANDLE_BUFFER_SIZE: usize = GDI_HANDLE_BUFFER_SIZE64; -#[cfg(target_arch = "x86")] -pub const GDI_HANDLE_BUFFER_SIZE: usize = GDI_HANDLE_BUFFER_SIZE32; -pub type GDI_HANDLE_BUFFER = [ULONG; GDI_HANDLE_BUFFER_SIZE]; -pub type GDI_HANDLE_BUFFER32 = [ULONG; GDI_HANDLE_BUFFER_SIZE32]; -pub type GDI_HANDLE_BUFFER64 = [ULONG; GDI_HANDLE_BUFFER_SIZE]; -pub const TLS_EXPANSION_SLOTS: usize = 1024; -STRUCT!{struct PEB_LDR_DATA { - Length: ULONG, - Initialized: BOOLEAN, - SsHandle: HANDLE, - InLoadOrderModuleList: LIST_ENTRY, - InMemoryOrderModuleList: LIST_ENTRY, - InInitializationOrderModuleList: LIST_ENTRY, - EntryInProgress: PVOID, - ShutdownInProgress: BOOLEAN, - ShutdownThreadId: HANDLE, -}} -pub type PPEB_LDR_DATA = *mut PEB_LDR_DATA; -STRUCT!{struct INITIAL_TEB_OldInitialTeb { - OldStackBase: PVOID, - OldStackLimit: PVOID, -}} -STRUCT!{struct INITIAL_TEB { - OldInitialTeb: INITIAL_TEB_OldInitialTeb, - StackBase: PVOID, - StackLimit: PVOID, - StackAllocationBase: PVOID, -}} -pub type PINITIAL_TEB = *mut INITIAL_TEB; -STRUCT!{struct WOW64_PROCESS { - Wow64: PVOID, -}} -pub type PWOW64_PROCESS = *mut WOW64_PROCESS; -ENUM!{enum PROCESSINFOCLASS { - ProcessBasicInformation = 0, - ProcessQuotaLimits = 1, - ProcessIoCounters = 2, - ProcessVmCounters = 3, - ProcessTimes = 4, - ProcessBasePriority = 5, - ProcessRaisePriority = 6, - ProcessDebugPort = 7, - ProcessExceptionPort = 8, - ProcessAccessToken = 9, - ProcessLdtInformation = 10, - ProcessLdtSize = 11, - ProcessDefaultHardErrorMode = 12, - ProcessIoPortHandlers = 13, - ProcessPooledUsageAndLimits = 14, - ProcessWorkingSetWatch = 15, - ProcessUserModeIOPL = 16, - ProcessEnableAlignmentFaultFixup = 17, - ProcessPriorityClass = 18, - ProcessWx86Information = 19, - ProcessHandleCount = 20, - ProcessAffinityMask = 21, - ProcessPriorityBoost = 22, - ProcessDeviceMap = 23, - ProcessSessionInformation = 24, - ProcessForegroundInformation = 25, - ProcessWow64Information = 26, - ProcessImageFileName = 27, - ProcessLUIDDeviceMapsEnabled = 28, - ProcessBreakOnTermination = 29, - ProcessDebugObjectHandle = 30, - ProcessDebugFlags = 31, - ProcessHandleTracing = 32, - ProcessIoPriority = 33, - ProcessExecuteFlags = 34, - ProcessResourceManagement = 35, - ProcessCookie = 36, - ProcessImageInformation = 37, - ProcessCycleTime = 38, - ProcessPagePriority = 39, - ProcessInstrumentationCallback = 40, - ProcessThreadStackAllocation = 41, - ProcessWorkingSetWatchEx = 42, - ProcessImageFileNameWin32 = 43, - ProcessImageFileMapping = 44, - ProcessAffinityUpdateMode = 45, - ProcessMemoryAllocationMode = 46, - ProcessGroupInformation = 47, - ProcessTokenVirtualizationEnabled = 48, - ProcessConsoleHostProcess = 49, - ProcessWindowInformation = 50, - ProcessHandleInformation = 51, - ProcessMitigationPolicy = 52, - ProcessDynamicFunctionTableInformation = 53, - ProcessHandleCheckingMode = 54, - ProcessKeepAliveCount = 55, - ProcessRevokeFileHandles = 56, - ProcessWorkingSetControl = 57, - ProcessHandleTable = 58, - ProcessCheckStackExtentsMode = 59, - ProcessCommandLineInformation = 60, - ProcessProtectionInformation = 61, - ProcessMemoryExhaustion = 62, - ProcessFaultInformation = 63, - ProcessTelemetryIdInformation = 64, - ProcessCommitReleaseInformation = 65, - ProcessDefaultCpuSetsInformation = 66, - ProcessAllowedCpuSetsInformation = 67, - ProcessSubsystemProcess = 68, - ProcessJobMemoryInformation = 69, - ProcessInPrivate = 70, - ProcessRaiseUMExceptionOnInvalidHandleClose = 71, - ProcessIumChallengeResponse = 72, - ProcessChildProcessInformation = 73, - ProcessHighGraphicsPriorityInformation = 74, - ProcessSubsystemInformation = 75, - ProcessEnergyValues = 76, - ProcessActivityThrottleState = 77, - ProcessActivityThrottlePolicy = 78, - ProcessWin32kSyscallFilterInformation = 79, - ProcessDisableSystemAllowedCpuSets = 80, - ProcessWakeInformation = 81, - ProcessEnergyTrackingState = 82, - ProcessManageWritesToExecutableMemory = 83, - ProcessCaptureTrustletLiveDump = 84, - ProcessTelemetryCoverage = 85, - ProcessEnclaveInformation = 86, - ProcessEnableReadWriteVmLogging = 87, - ProcessUptimeInformation = 88, - ProcessImageSection = 89, - ProcessDebugAuthInformation = 90, - ProcessSystemResourceManagement = 91, - ProcessSequenceNumber = 92, - ProcessLoaderDetour = 93, - ProcessSecurityDomainInformation = 94, - ProcessCombineSecurityDomainsInformation = 95, - ProcessEnableLogging = 96, - ProcessLeapSecondInformation = 97, - MaxProcessInfoClass = 98, -}} -ENUM!{enum THREADINFOCLASS { - ThreadBasicInformation = 0, - ThreadTimes = 1, - ThreadPriority = 2, - ThreadBasePriority = 3, - ThreadAffinityMask = 4, - ThreadImpersonationToken = 5, - ThreadDescriptorTableEntry = 6, - ThreadEnableAlignmentFaultFixup = 7, - ThreadEventPair = 8, - ThreadQuerySetWin32StartAddress = 9, - ThreadZeroTlsCell = 10, - ThreadPerformanceCount = 11, - ThreadAmILastThread = 12, - ThreadIdealProcessor = 13, - ThreadPriorityBoost = 14, - ThreadSetTlsArrayAddress = 15, - ThreadIsIoPending = 16, - ThreadHideFromDebugger = 17, - ThreadBreakOnTermination = 18, - ThreadSwitchLegacyState = 19, - ThreadIsTerminated = 20, - ThreadLastSystemCall = 21, - ThreadIoPriority = 22, - ThreadCycleTime = 23, - ThreadPagePriority = 24, - ThreadActualBasePriority = 25, - ThreadTebInformation = 26, - ThreadCSwitchMon = 27, - ThreadCSwitchPmu = 28, - ThreadWow64Context = 29, - ThreadGroupInformation = 30, - ThreadUmsInformation = 31, - ThreadCounterProfiling = 32, - ThreadIdealProcessorEx = 33, - ThreadCpuAccountingInformation = 34, - ThreadSuspendCount = 35, - ThreadHeterogeneousCpuPolicy = 36, - ThreadContainerId = 37, - ThreadNameInformation = 38, - ThreadSelectedCpuSets = 39, - ThreadSystemThreadInformation = 40, - ThreadActualGroupAffinity = 41, - ThreadDynamicCodePolicyInfo = 42, - ThreadExplicitCaseSensitivity = 43, - ThreadWorkOnBehalfTicket = 44, - ThreadSubsystemInformation = 45, - ThreadDbgkWerReportActive = 46, - ThreadAttachContainer = 47, - ThreadManageWritesToExecutableMemory = 48, - ThreadPowerThrottlingState = 49, - ThreadWorkloadClass = 50, - MaxThreadInfoClass = 51, -}} -STRUCT!{struct PAGE_PRIORITY_INFORMATION { - PagePriority: ULONG, -}} -pub type PPAGE_PRIORITY_INFORMATION = *mut PAGE_PRIORITY_INFORMATION; -STRUCT!{struct PROCESS_BASIC_INFORMATION { - ExitStatus: NTSTATUS, - PebBaseAddress: PPEB, - AffinityMask: ULONG_PTR, - BasePriority: KPRIORITY, - UniqueProcessId: HANDLE, - InheritedFromUniqueProcessId: HANDLE, -}} -pub type PPROCESS_BASIC_INFORMATION = *mut PROCESS_BASIC_INFORMATION; -STRUCT!{struct PROCESS_EXTENDED_BASIC_INFORMATION { - Size: SIZE_T, - BasicInfo: PROCESS_BASIC_INFORMATION, - Flags: ULONG, -}} -BITFIELD!{PROCESS_EXTENDED_BASIC_INFORMATION Flags: ULONG [ - IsProtectedProcess set_IsProtectedProcess[0..1], - IsWow64Process set_IsWow64Process[1..2], - IsProcessDeleting set_IsProcessDeleting[2..3], - IsCrossSessionCreate set_IsCrossSessionCreate[3..4], - IsFrozen set_IsFrozen[4..5], - IsBackground set_IsBackground[5..6], - IsStronglyNamed set_IsStronglyNamed[6..7], - IsSecureProcess set_IsSecureProcess[7..8], - IsSubsystemProcess set_IsSubsystemProcess[8..9], - SpareBits set_SpareBits[9..32], -]} -pub type PPROCESS_EXTENDED_BASIC_INFORMATION = *mut PROCESS_EXTENDED_BASIC_INFORMATION; -STRUCT!{struct VM_COUNTERS { - PeakVirtualSize: SIZE_T, - VirtualSize: SIZE_T, - PageFaultCount: ULONG, - PeakWorkingSetSize: SIZE_T, - WorkingSetSize: SIZE_T, - QuotaPeakPagedPoolUsage: SIZE_T, - QuotaPagedPoolUsage: SIZE_T, - QuotaPeakNonPagedPoolUsage: SIZE_T, - QuotaNonPagedPoolUsage: SIZE_T, - PagefileUsage: SIZE_T, - PeakPagefileUsage: SIZE_T, -}} -pub type PVM_COUNTERS = *mut VM_COUNTERS; -STRUCT!{struct VM_COUNTERS_EX { - PeakVirtualSize: SIZE_T, - VirtualSize: SIZE_T, - PageFaultCount: ULONG, - PeakWorkingSetSize: SIZE_T, - WorkingSetSize: SIZE_T, - QuotaPeakPagedPoolUsage: SIZE_T, - QuotaPagedPoolUsage: SIZE_T, - QuotaPeakNonPagedPoolUsage: SIZE_T, - QuotaNonPagedPoolUsage: SIZE_T, - PagefileUsage: SIZE_T, - PeakPagefileUsage: SIZE_T, - PrivateUsage: SIZE_T, -}} -pub type PVM_COUNTERS_EX = *mut VM_COUNTERS_EX; -STRUCT!{struct VM_COUNTERS_EX2 { - CountersEx: VM_COUNTERS_EX, - PrivateWorkingSetSize: SIZE_T, - SharedCommitUsage: SIZE_T, -}} -pub type PVM_COUNTERS_EX2 = *mut VM_COUNTERS_EX2; -STRUCT!{struct KERNEL_USER_TIMES { - CreateTime: LARGE_INTEGER, - ExitTime: LARGE_INTEGER, - KernelTime: LARGE_INTEGER, - UserTime: LARGE_INTEGER, -}} -pub type PKERNEL_USER_TIMES = *mut KERNEL_USER_TIMES; -STRUCT!{struct POOLED_USAGE_AND_LIMITS { - PeakPagedPoolUsage: SIZE_T, - PagedPoolUsage: SIZE_T, - PagedPoolLimit: SIZE_T, - PeakNonPagedPoolUsage: SIZE_T, - NonPagedPoolUsage: SIZE_T, - NonPagedPoolLimit: SIZE_T, - PeakPagefileUsage: SIZE_T, - PagefileUsage: SIZE_T, - PagefileLimit: SIZE_T, -}} -pub type PPOOLED_USAGE_AND_LIMITS = *mut POOLED_USAGE_AND_LIMITS; -pub const PROCESS_EXCEPTION_PORT_ALL_STATE_BITS: ULONG_PTR = 0x00000003; -pub const PROCESS_EXCEPTION_PORT_ALL_STATE_FLAGS: ULONG_PTR = - (1 << PROCESS_EXCEPTION_PORT_ALL_STATE_BITS) - 1; -STRUCT!{struct PROCESS_EXCEPTION_PORT { - ExceptionPortHandle: HANDLE, - StateFlags: ULONG, -}} -pub type PPROCESS_EXCEPTION_PORT = *mut PROCESS_EXCEPTION_PORT; -STRUCT!{struct PROCESS_ACCESS_TOKEN { - Token: HANDLE, - Thread: HANDLE, -}} -pub type PPROCESS_ACCESS_TOKEN = *mut PROCESS_ACCESS_TOKEN; -STRUCT!{struct PROCESS_LDT_INFORMATION { - Start: ULONG, - Length: ULONG, - LdtEntries: [LDT_ENTRY; 1], -}} -pub type PPROCESS_LDT_INFORMATION = *mut PROCESS_LDT_INFORMATION; -STRUCT!{struct PROCESS_LDT_SIZE { - Length: ULONG, -}} -pub type PPROCESS_LDT_SIZE = *mut PROCESS_LDT_SIZE; -STRUCT!{struct PROCESS_WS_WATCH_INFORMATION { - FaultingPc: PVOID, - FaultingVa: PVOID, -}} -pub type PPROCESS_WS_WATCH_INFORMATION = *mut PROCESS_WS_WATCH_INFORMATION; -STRUCT!{struct PROCESS_WS_WATCH_INFORMATION_EX { - BasicInfo: PROCESS_WS_WATCH_INFORMATION, - FaultingThreadId: ULONG_PTR, - Flags: ULONG_PTR, -}} -pub type PPROCESS_WS_WATCH_INFORMATION_EX = *mut PROCESS_WS_WATCH_INFORMATION_EX; -pub const PROCESS_PRIORITY_CLASS_UNKNOWN: u32 = 0; -pub const PROCESS_PRIORITY_CLASS_IDLE: u32 = 1; -pub const PROCESS_PRIORITY_CLASS_NORMAL: u32 = 2; -pub const PROCESS_PRIORITY_CLASS_HIGH: u32 = 3; -pub const PROCESS_PRIORITY_CLASS_REALTIME: u32 = 4; -pub const PROCESS_PRIORITY_CLASS_BELOW_NORMAL: u32 = 5; -pub const PROCESS_PRIORITY_CLASS_ABOVE_NORMAL: u32 = 6; -STRUCT!{struct PROCESS_PRIORITY_CLASS { - Foreground: BOOLEAN, - PriorityClass: UCHAR, -}} -pub type PPROCESS_PRIORITY_CLASS = *mut PROCESS_PRIORITY_CLASS; -STRUCT!{struct PROCESS_FOREGROUND_BACKGROUND { - Foreground: BOOLEAN, -}} -pub type PPROCESS_FOREGROUND_BACKGROUND = *mut PROCESS_FOREGROUND_BACKGROUND; -STRUCT!{struct PROCESS_DEVICEMAP_INFORMATION_Set { - DirectoryHandle: HANDLE, -}} -STRUCT!{struct PROCESS_DEVICEMAP_INFORMATION_Query { - DriveMap: ULONG, - DriveType: [UCHAR; 32], -}} -UNION!{union PROCESS_DEVICEMAP_INFORMATION { - Set: PROCESS_DEVICEMAP_INFORMATION_Set, - Query: PROCESS_DEVICEMAP_INFORMATION_Query, -}} -pub type PPROCESS_DEVICEMAP_INFORMATION = *mut PROCESS_DEVICEMAP_INFORMATION; -pub const PROCESS_LUID_DOSDEVICES_ONLY: ULONG = 0x00000001; -STRUCT!{struct PROCESS_DEVICEMAP_INFORMATION_EX_u_Set { - DirectoryHandle: HANDLE, -}} -STRUCT!{struct PROCESS_DEVICEMAP_INFORMATION_EX_u_Query { - DriveMap: ULONG, - DriveType: [UCHAR; 32], -}} -UNION!{union PROCESS_DEVICEMAP_INFORMATION_EX_u { - Set: PROCESS_DEVICEMAP_INFORMATION_EX_u_Set, - Query: PROCESS_DEVICEMAP_INFORMATION_EX_u_Query, -}} -STRUCT!{struct PROCESS_DEVICEMAP_INFORMATION_EX { - u: PROCESS_DEVICEMAP_INFORMATION_EX_u, - Flags: ULONG, -}} -pub type PPROCESS_DEVICEMAP_INFORMATION_EX = *mut PROCESS_DEVICEMAP_INFORMATION_EX; -STRUCT!{struct PROCESS_SESSION_INFORMATION { - SessionId: ULONG, -}} -pub type PPROCESS_SESSION_INFORMATION = *mut PROCESS_SESSION_INFORMATION; -pub const PROCESS_HANDLE_EXCEPTIONS_ENABLED: ULONG = 0x00000001; -pub const PROCESS_HANDLE_RAISE_EXCEPTION_ON_INVALID_HANDLE_CLOSE_DISABLED: ULONG = 0x00000000; -pub const PROCESS_HANDLE_RAISE_EXCEPTION_ON_INVALID_HANDLE_CLOSE_ENABLED: ULONG = 0x00000001; -STRUCT!{struct PROCESS_HANDLE_TRACING_ENABLE { - Flags: ULONG, -}} -pub type PPROCESS_HANDLE_TRACING_ENABLE = *mut PROCESS_HANDLE_TRACING_ENABLE; -pub const PROCESS_HANDLE_TRACING_MAX_SLOTS: ULONG = 0x20000; -STRUCT!{struct PROCESS_HANDLE_TRACING_ENABLE_EX { - Flags: ULONG, - TotalSlots: ULONG, -}} -pub type PPROCESS_HANDLE_TRACING_ENABLE_EX = *mut PROCESS_HANDLE_TRACING_ENABLE_EX; -pub const PROCESS_HANDLE_TRACING_MAX_STACKS: usize = 16; -pub const PROCESS_HANDLE_TRACE_TYPE_OPEN: ULONG = 1; -pub const PROCESS_HANDLE_TRACE_TYPE_CLOSE: ULONG = 2; -pub const PROCESS_HANDLE_TRACE_TYPE_BADREF: ULONG = 3; -STRUCT!{struct PROCESS_HANDLE_TRACING_ENTRY { - Handle: HANDLE, - ClientId: CLIENT_ID, - Type: ULONG, - Stacks: [PVOID; PROCESS_HANDLE_TRACING_MAX_STACKS], -}} -pub type PPROCESS_HANDLE_TRACING_ENTRY = *mut PROCESS_HANDLE_TRACING_ENTRY; -STRUCT!{struct PROCESS_HANDLE_TRACING_QUERY { - Handle: HANDLE, - TotalTraces: ULONG, - HandleTrace: [PROCESS_HANDLE_TRACING_ENTRY; 1], -}} -pub type PPROCESS_HANDLE_TRACING_QUERY = *mut PROCESS_HANDLE_TRACING_QUERY; -STRUCT!{struct THREAD_TLS_INFORMATION { - Flags: ULONG, - NewTlsData: PVOID, - OldTlsData: PVOID, - ThreadId: HANDLE, -}} -pub type PTHREAD_TLS_INFORMATION = *mut THREAD_TLS_INFORMATION; -ENUM!{enum PROCESS_TLS_INFORMATION_TYPE { - ProcessTlsReplaceIndex = 0, - ProcessTlsReplaceVector = 1, - MaxProcessTlsOperation = 2, -}} -pub type PPROCESS_TLS_INFORMATION_TYPE = *mut PROCESS_TLS_INFORMATION_TYPE; -STRUCT!{struct PROCESS_TLS_INFORMATION { - Flags: ULONG, - OperationType: ULONG, - ThreadDataCount: ULONG, - TlsIndex: ULONG, - PreviousCount: ULONG, - ThreadData: [THREAD_TLS_INFORMATION; 1], -}} -pub type PPROCESS_TLS_INFORMATION = *mut PROCESS_TLS_INFORMATION; -STRUCT!{struct PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION { - Version: ULONG, - Reserved: ULONG, - Callback: PVOID, -}} -pub type PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION = - *mut PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION; -STRUCT!{struct PROCESS_STACK_ALLOCATION_INFORMATION { - ReserveSize: SIZE_T, - ZeroBits: SIZE_T, - StackBase: PVOID, -}} -pub type PPROCESS_STACK_ALLOCATION_INFORMATION = *mut PROCESS_STACK_ALLOCATION_INFORMATION; -STRUCT!{struct PROCESS_STACK_ALLOCATION_INFORMATION_EX { - PreferredNode: ULONG, - Reserved0: ULONG, - Reserved1: ULONG, - Reserved2: ULONG, - AllocInfo: PROCESS_STACK_ALLOCATION_INFORMATION, -}} -pub type PPROCESS_STACK_ALLOCATION_INFORMATION_EX = *mut PROCESS_STACK_ALLOCATION_INFORMATION_EX; -STRUCT!{struct PROCESS_AFFINITY_UPDATE_MODE { - Flags: ULONG, -}} -BITFIELD!{PROCESS_AFFINITY_UPDATE_MODE Flags: ULONG [ - EnableAutoUpdate set_EnableAutoUpdate[0..1], - Permanent set_Permanent[1..2], - Reserved set_Reserved[2..32], -]} -pub type PPROCESS_AFFINITY_UPDATE_MODE = *mut PROCESS_AFFINITY_UPDATE_MODE; -STRUCT!{struct PROCESS_MEMORY_ALLOCATION_MODE { - Flags: ULONG, -}} -BITFIELD!{PROCESS_MEMORY_ALLOCATION_MODE Flags: ULONG [ - TopDown set_TopDown[0..1], - Reserved set_Reserved[1..32], -]} -pub type PPROCESS_MEMORY_ALLOCATION_MODE = *mut PROCESS_MEMORY_ALLOCATION_MODE; -STRUCT!{struct PROCESS_HANDLE_INFORMATION { - HandleCount: ULONG, - HandleCountHighWatermark: ULONG, -}} -pub type PPROCESS_HANDLE_INFORMATION = *mut PROCESS_HANDLE_INFORMATION; -STRUCT!{struct PROCESS_CYCLE_TIME_INFORMATION { - AccumulatedCycles: ULONGLONG, - CurrentCycleCount: ULONGLONG, -}} -pub type PPROCESS_CYCLE_TIME_INFORMATION = *mut PROCESS_CYCLE_TIME_INFORMATION; -STRUCT!{struct PROCESS_WINDOW_INFORMATION { - WindowFlags: ULONG, - WindowTitleLength: USHORT, - WindowTitle: [WCHAR; 1], -}} -pub type PPROCESS_WINDOW_INFORMATION = *mut PROCESS_WINDOW_INFORMATION; -STRUCT!{struct PROCESS_HANDLE_TABLE_ENTRY_INFO { - HandleValue: HANDLE, - HandleCount: ULONG_PTR, - PointerCount: ULONG_PTR, - GrantedAccess: ULONG, - ObjectTypeIndex: ULONG, - HandleAttributes: ULONG, - Reserved: ULONG, -}} -pub type PPROCESS_HANDLE_TABLE_ENTRY_INFO = *mut PROCESS_HANDLE_TABLE_ENTRY_INFO; -STRUCT!{struct PROCESS_HANDLE_SNAPSHOT_INFORMATION { - NumberOfHandles: ULONG_PTR, - Reserved: ULONG_PTR, - Handles: [PROCESS_HANDLE_TABLE_ENTRY_INFO; 1], -}} -pub type PPROCESS_HANDLE_SNAPSHOT_INFORMATION = *mut PROCESS_HANDLE_SNAPSHOT_INFORMATION; -UNION!{union PROCESS_MITIGATION_POLICY_INFORMATION_u { - ASLRPolicy: PROCESS_MITIGATION_ASLR_POLICY, - StrictHandleCheckPolicy: PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY, - SystemCallDisablePolicy: PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY, - ExtensionPointDisablePolicy: PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY, - DynamicCodePolicy: PROCESS_MITIGATION_DYNAMIC_CODE_POLICY, - ControlFlowGuardPolicy: PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY, - SignaturePolicy: PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY, - FontDisablePolicy: PROCESS_MITIGATION_FONT_DISABLE_POLICY, - ImageLoadPolicy: PROCESS_MITIGATION_IMAGE_LOAD_POLICY, - SystemCallFilterPolicy: PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY, - PayloadRestrictionPolicy: PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY, - ChildProcessPolicy: PROCESS_MITIGATION_CHILD_PROCESS_POLICY, - // SideChannelIsolationPolicy: PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY, //TODO -}} -STRUCT!{struct PROCESS_MITIGATION_POLICY_INFORMATION { - Policy: PROCESS_MITIGATION_POLICY, - u: PROCESS_MITIGATION_POLICY_INFORMATION_u, -}} -pub type PPROCESS_MITIGATION_POLICY_INFORMATION = *mut PROCESS_MITIGATION_POLICY_INFORMATION; -STRUCT!{struct PROCESS_KEEPALIVE_COUNT_INFORMATION { - WakeCount: ULONG, - NoWakeCount: ULONG, -}} -pub type PPROCESS_KEEPALIVE_COUNT_INFORMATION = *mut PROCESS_KEEPALIVE_COUNT_INFORMATION; -STRUCT!{struct PROCESS_REVOKE_FILE_HANDLES_INFORMATION { - TargetDevicePath: UNICODE_STRING, -}} -pub type PPROCESS_REVOKE_FILE_HANDLES_INFORMATION = *mut PROCESS_REVOKE_FILE_HANDLES_INFORMATION; -ENUM!{enum PROCESS_WORKING_SET_OPERATION { - ProcessWorkingSetSwap = 0, - ProcessWorkingSetEmpty = 1, - ProcessWorkingSetOperationMax = 2, -}} -STRUCT!{struct PROCESS_WORKING_SET_CONTROL { - Version: ULONG, - Operation: PROCESS_WORKING_SET_OPERATION, - Flags: ULONG, -}} -pub type PPROCESS_WORKING_SET_CONTROL = *mut PROCESS_WORKING_SET_CONTROL; -ENUM!{enum PS_PROTECTED_TYPE { - PsProtectedTypeNone = 0, - PsProtectedTypeProtectedLight = 1, - PsProtectedTypeProtected = 2, - PsProtectedTypeMax = 3, -}} -ENUM!{enum PS_PROTECTED_SIGNER { - PsProtectedSignerNone = 0, - PsProtectedSignerAuthenticode = 1, - PsProtectedSignerCodeGen = 2, - PsProtectedSignerAntimalware = 3, - PsProtectedSignerLsa = 4, - PsProtectedSignerWindows = 5, - PsProtectedSignerWinTcb = 6, - PsProtectedSignerWinSystem = 7, - PsProtectedSignerApp = 8, - PsProtectedSignerMax = 9, -}} -pub const PS_PROTECTED_SIGNER_MASK: UCHAR = 0xFF; -pub const PS_PROTECTED_AUDIT_MASK: UCHAR = 0x08; -pub const PS_PROTECTED_TYPE_MASK: UCHAR = 0x07; -#[inline] -pub const fn PsProtectedValue( - aSigner: PS_PROTECTED_SIGNER, - aAudit: u8, - aType: PS_PROTECTED_TYPE, -) -> UCHAR { - (aSigner as u8 & PS_PROTECTED_SIGNER_MASK) << 4 | (aAudit & PS_PROTECTED_AUDIT_MASK) << 3 - | (aType as u8 & PS_PROTECTED_TYPE_MASK) -} -#[inline] -pub fn InitializePsProtection( - aProtectionLevelPtr: &mut PS_PROTECTION, - aSigner: PS_PROTECTED_SIGNER, - aAudit: u8, - aType: PS_PROTECTED_TYPE, -) { - aProtectionLevelPtr.set_Signer(aSigner as u8); - aProtectionLevelPtr.set_Audit(aAudit); - aProtectionLevelPtr.set_Type(aType as u8); -} -STRUCT!{struct PS_PROTECTION { - Level: UCHAR, -}} -pub type PPS_PROTECTION = *mut PS_PROTECTION; -BITFIELD!{PS_PROTECTION Level: UCHAR [ - Type set_Type[0..3], - Audit set_Audit[3..4], - Signer set_Signer[4..8], -]} -STRUCT!{struct PROCESS_FAULT_INFORMATION { - FaultFlags: ULONG, - AdditionalInfo: ULONG, -}} -pub type PPROCESS_FAULT_INFORMATION = *mut PROCESS_FAULT_INFORMATION; -STRUCT!{struct PROCESS_TELEMETRY_ID_INFORMATION { - HeaderSize: ULONG, - ProcessId: ULONG, - ProcessStartKey: ULONGLONG, - CreateTime: ULONGLONG, - CreateInterruptTime: ULONGLONG, - CreateUnbiasedInterruptTime: ULONGLONG, - ProcessSequenceNumber: ULONGLONG, - SessionCreateTime: ULONGLONG, - SessionId: ULONG, - BootId: ULONG, - ImageChecksum: ULONG, - ImageTimeDateStamp: ULONG, - UserSidOffset: ULONG, - ImagePathOffset: ULONG, - PackageNameOffset: ULONG, - RelativeAppNameOffset: ULONG, - CommandLineOffset: ULONG, -}} -pub type PPROCESS_TELEMETRY_ID_INFORMATION = *mut PROCESS_TELEMETRY_ID_INFORMATION; -STRUCT!{struct PROCESS_COMMIT_RELEASE_INFORMATION { - Version: ULONG, - s: ULONG, - CommitDebt: SIZE_T, - CommittedMemResetSize: SIZE_T, - RepurposedMemResetSize: SIZE_T, -}} -BITFIELD!{PROCESS_COMMIT_RELEASE_INFORMATION s: ULONG [ - Eligible set_Eligible[0..1], - ReleaseRepurposedMemResetCommit set_ReleaseRepurposedMemResetCommit[1..2], - ForceReleaseMemResetCommit set_ForceReleaseMemResetCommit[2..3], - Spare set_Spare[3..32], -]} -pub type PPROCESS_COMMIT_RELEASE_INFORMATION = *mut PROCESS_COMMIT_RELEASE_INFORMATION; -STRUCT!{struct PROCESS_JOB_MEMORY_INFO { - SharedCommitUsage: ULONGLONG, - PrivateCommitUsage: ULONGLONG, - PeakPrivateCommitUsage: ULONGLONG, - PrivateCommitLimit: ULONGLONG, - TotalCommitLimit: ULONGLONG, -}} -pub type PPROCESS_JOB_MEMORY_INFO = *mut PROCESS_JOB_MEMORY_INFO; -STRUCT!{struct PROCESS_CHILD_PROCESS_INFORMATION { - ProhibitChildProcesses: BOOLEAN, - AlwaysAllowSecureChildProcess: BOOLEAN, - AuditProhibitChildProcesses: BOOLEAN, -}} -pub type PPROCESS_CHILD_PROCESS_INFORMATION = *mut PROCESS_CHILD_PROCESS_INFORMATION; -STRUCT!{struct PROCESS_WAKE_INFORMATION { - NotificationChannel: ULONGLONG, - WakeCounters: [ULONG; 7], - WakeFilter: *mut JOBOBJECT_WAKE_FILTER, -}} -pub type PPROCESS_WAKE_INFORMATION = *mut PROCESS_WAKE_INFORMATION; -STRUCT!{struct PROCESS_ENERGY_TRACKING_STATE { - StateUpdateMask: ULONG, - StateDesiredValue: ULONG, - StateSequence: ULONG, - UpdateTag: ULONG, - Tag: [WCHAR; 64], -}} -pub type PPROCESS_ENERGY_TRACKING_STATE = *mut PROCESS_ENERGY_TRACKING_STATE; -BITFIELD!{PROCESS_ENERGY_TRACKING_STATE UpdateTag: ULONG [ - UpdateTag set_UpdateTag[0..1], -]} -STRUCT!{struct MANAGE_WRITES_TO_EXECUTABLE_MEMORY { - BitFields: ULONG, -}} -BITFIELD!{MANAGE_WRITES_TO_EXECUTABLE_MEMORY BitFields: ULONG [ - Machine set_Machine[0..16], - KernelMode set_KernelMode[16..17], - UserMode set_UserMode[17..18], - Native set_Native[18..19], - Process set_Process[19..20], - ReservedZero0 set_ReservedZero0[20..32], -]} -pub type PMANAGE_WRITES_TO_EXECUTABLE_MEMORY = *mut MANAGE_WRITES_TO_EXECUTABLE_MEMORY; -pub const PROCESS_READWRITEVM_LOGGING_ENABLE_READVM: UCHAR = 1; -pub const PROCESS_READWRITEVM_LOGGING_ENABLE_WRITEVM: UCHAR = 2; -pub const PROCESS_READWRITEVM_LOGGING_ENABLE_READVM_V: UCHAR = 1; -pub const PROCESS_READWRITEVM_LOGGING_ENABLE_WRITEVM_V: UCHAR = 2; -STRUCT!{struct PROCESS_READWRITEVM_LOGGING_INFORMATION { - Flags: UCHAR, -}} -BITFIELD!{PROCESS_READWRITEVM_LOGGING_INFORMATION Flags: UCHAR [ - EnableReadVmLogging set_EnableReadVmLogging[0..1], - EnableWriteVmLogging set_EnableWriteVmLogging[1..2], - Unused set_Unused[2..8], -]} -UNION!{union PROCESS_UPTIME_INFORMATION_u { - HangCount: ULONG, - GhostCount: ULONG, - Crashed: ULONG, - Terminated: ULONG, -}} -pub type PPROCESS_READWRITEVM_LOGGING_INFORMATION = *mut PROCESS_READWRITEVM_LOGGING_INFORMATION; -STRUCT!{struct PROCESS_UPTIME_INFORMATION { - QueryInterruptTime: ULONGLONG, - QueryUnbiasedTime: ULONGLONG, - EndInterruptTime: ULONGLONG, - TimeSinceCreation: ULONGLONG, - Uptime: ULONGLONG, - SuspendedTime: ULONGLONG, - u: PROCESS_UPTIME_INFORMATION_u, -}} -pub type PPROCESS_UPTIME_INFORMATION = *mut PROCESS_UPTIME_INFORMATION; -STRUCT!{struct PROCESS_SYSTEM_RESOURCE_MANAGEMENT { - Flags: ULONG, -}} -pub type PPROCESS_SYSTEM_RESOURCE_MANAGEMENT = *mut PROCESS_SYSTEM_RESOURCE_MANAGEMENT; -BITFIELD!{PROCESS_SYSTEM_RESOURCE_MANAGEMENT Flags: ULONG [ - Foreground set_Foreground[0..1], - Reserved set_Reserved[1..32], -]} -STRUCT!{struct PROCESS_SECURITY_DOMAIN_INFORMATION { - SecurityDomain: ULONGLONG, -}} -pub type PPROCESS_SECURITY_DOMAIN_INFORMATION = *mut PROCESS_SECURITY_DOMAIN_INFORMATION; -STRUCT!{struct PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION { - ProcessHandle: HANDLE, -}} -pub type PPROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION = - *mut PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION; -STRUCT!{struct PROCESS_LOGGING_INFORMATION { - Flags: ULONG, - BitFields: ULONG, -}} -BITFIELD!{PROCESS_LOGGING_INFORMATION BitFields: ULONG [ - EnableReadVmLogging set_EnableReadVmLogging[0..1], - EnableWriteVmLogging set_EnableWriteVmLogging[1..2], - EnableProcessSuspendResumeLogging set_EnableProcessSuspendResumeLogging[2..3], - EnableThreadSuspendResumeLogging set_EnableThreadSuspendResumeLogging[3..4], - Reserved set_Reserved[4..32], -]} -pub type PPROCESS_LOGGING_INFORMATION = *mut PROCESS_LOGGING_INFORMATION; -STRUCT!{struct PROCESS_LEAP_SECOND_INFORMATION { - Flags: ULONG, - Reserved: ULONG, -}} -pub type PPROCESS_LEAP_SECOND_INFORMATION = *mut PROCESS_LEAP_SECOND_INFORMATION; -STRUCT!{struct THREAD_BASIC_INFORMATION { - ExitStatus: NTSTATUS, - TebBaseAddress: PTEB, - ClientId: CLIENT_ID, - AffinityMask: ULONG_PTR, - Priority: KPRIORITY, - BasePriority: LONG, -}} -pub type PTHREAD_BASIC_INFORMATION = *mut THREAD_BASIC_INFORMATION; -STRUCT!{struct THREAD_LAST_SYSCALL_INFORMATION { - FirstArgument: PVOID, - SystemCallNumber: USHORT, - Pad: [USHORT; 1], - WaitTime: ULONG64, -}} -pub type PTHREAD_LAST_SYSCALL_INFORMATION = *mut THREAD_LAST_SYSCALL_INFORMATION; -STRUCT!{struct THREAD_CYCLE_TIME_INFORMATION { - AccumulatedCycles: ULONGLONG, - CurrentCycleCount: ULONGLONG, -}} -pub type PTHREAD_CYCLE_TIME_INFORMATION = *mut THREAD_CYCLE_TIME_INFORMATION; -STRUCT!{struct THREAD_TEB_INFORMATION { - TebInformation: PVOID, - TebOffset: ULONG, - BytesToRead: ULONG, -}} -pub type PTHREAD_TEB_INFORMATION = *mut THREAD_TEB_INFORMATION; -STRUCT!{struct COUNTER_READING { - Type: HARDWARE_COUNTER_TYPE, - Index: ULONG, - Start: ULONG64, - Total: ULONG64, -}} -pub type PCOUNTER_READING = *mut COUNTER_READING; -STRUCT!{struct THREAD_PERFORMANCE_DATA { - Size: USHORT, - Version: USHORT, - ProcessorNumber: PROCESSOR_NUMBER, - ContextSwitches: ULONG, - HwCountersCount: ULONG, - UpdateCount: ULONG64, - WaitReasonBitMap: ULONG64, - HardwareCounters: ULONG64, - CycleTime: COUNTER_READING, - HwCounters: [COUNTER_READING; MAX_HW_COUNTERS], -}} -pub type PTHREAD_PERFORMANCE_DATA = *mut THREAD_PERFORMANCE_DATA; -STRUCT!{struct THREAD_PROFILING_INFORMATION { - HardwareCounters: ULONG64, - Flags: ULONG, - Enable: ULONG, - PerformanceData: PTHREAD_PERFORMANCE_DATA, -}} -pub type PTHREAD_PROFILING_INFORMATION = *mut THREAD_PROFILING_INFORMATION; -#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] -STRUCT!{#[repr(align(16))] struct RTL_UMS_CONTEXT { - Link: SINGLE_LIST_ENTRY, - __padding: u64, - Context: CONTEXT, - Teb: PVOID, - UserContext: PVOID, - ScheduledThread: ULONG, - Suspended: ULONG, - VolatileContext: ULONG, - Terminated: ULONG, - DebugActive: ULONG, - RunningOnSelfThread: ULONG, - DenyRunningOnSelfThread: ULONG, - Flags: LONG, - KernelUpdateLock: ULONG64, - PrimaryClientID: ULONG64, - ContextLock: ULONG64, - PrimaryUmsContext: *mut RTL_UMS_CONTEXT, - SwitchCount: ULONG, - KernelYieldCount: ULONG, - MixedYieldCount: ULONG, - YieldCount: ULONG, -}} -#[cfg(target_arch = "x86")] -STRUCT!{struct RTL_UMS_CONTEXT { - Link: SINGLE_LIST_ENTRY, - Context: CONTEXT, - Teb: PVOID, - UserContext: PVOID, - ScheduledThread: ULONG, - Suspended: ULONG, - VolatileContext: ULONG, - Terminated: ULONG, - DebugActive: ULONG, - RunningOnSelfThread: ULONG, - DenyRunningOnSelfThread: ULONG, - Flags: LONG, - KernelUpdateLock: ULONG64, - PrimaryClientID: ULONG64, - ContextLock: ULONG64, - PrimaryUmsContext: *mut RTL_UMS_CONTEXT, - SwitchCount: ULONG, - KernelYieldCount: ULONG, - MixedYieldCount: ULONG, - YieldCount: ULONG, - __padding: u32, -}} -pub type PRTL_UMS_CONTEXT = *mut RTL_UMS_CONTEXT; -ENUM!{enum THREAD_UMS_INFORMATION_COMMAND { - UmsInformationCommandInvalid = 0, - UmsInformationCommandAttach = 1, - UmsInformationCommandDetach = 2, - UmsInformationCommandQuery = 3, -}} -STRUCT!{struct RTL_UMS_COMPLETION_LIST { - ThreadListHead: PSINGLE_LIST_ENTRY, - CompletionEvent: PVOID, - CompletionFlags: ULONG, - InternalListHead: SINGLE_LIST_ENTRY, -}} -pub type PRTL_UMS_COMPLETION_LIST = *mut RTL_UMS_COMPLETION_LIST; -STRUCT!{struct THREAD_UMS_INFORMATION { - Command: THREAD_UMS_INFORMATION_COMMAND, - CompletionList: PRTL_UMS_COMPLETION_LIST, - UmsContext: PRTL_UMS_CONTEXT, - Flags: ULONG, -}} -BITFIELD!{THREAD_UMS_INFORMATION Flags: ULONG [ - IsUmsSchedulerThread set_IsUmsSchedulerThread[0..1], - IsUmsWorkerThread set_IsUmsWorkerThread[1..2], - SpareBits set_SpareBits[2..32], -]} -pub type PTHREAD_UMS_INFORMATION = *mut THREAD_UMS_INFORMATION; -STRUCT!{struct THREAD_NAME_INFORMATION { - ThreadName: UNICODE_STRING, -}} -pub type PTHREAD_NAME_INFORMATION = *mut THREAD_NAME_INFORMATION; -ENUM!{enum SUBSYSTEM_INFORMATION_TYPE { - SubsystemInformationTypeWin32 = 0, - SubsystemInformationTypeWSL = 1, - MaxSubsystemInformationType = 2, -}} -ENUM!{enum THREAD_WORKLOAD_CLASS { - ThreadWorkloadClassDefault = 0, - ThreadWorkloadClassGraphics = 1, - MaxThreadWorkloadClass = 2, -}} -EXTERN!{extern "system" { - fn NtCreateProcess( - ProcessHandle: PHANDLE, - DesiredAccess: ACCESS_MASK, - ObjectAttributes: POBJECT_ATTRIBUTES, - ParentProcess: HANDLE, - InheritObjectTable: BOOLEAN, - SectionHandle: HANDLE, - DebugPort: HANDLE, - ExceptionPort: HANDLE, - ) -> NTSTATUS; -}} -pub const PROCESS_CREATE_FLAGS_BREAKAWAY: ULONG = 0x00000001; -pub const PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT: ULONG = 0x00000002; -pub const PROCESS_CREATE_FLAGS_INHERIT_HANDLES: ULONG = 0x00000004; -pub const PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE: ULONG = 0x00000008; -pub const PROCESS_CREATE_FLAGS_LARGE_PAGES: ULONG = 0x00000010; -EXTERN!{extern "system" { - fn NtCreateProcessEx( - ProcessHandle: PHANDLE, - DesiredAccess: ACCESS_MASK, - ObjectAttributes: POBJECT_ATTRIBUTES, - ParentProcess: HANDLE, - Flags: ULONG, - SectionHandle: HANDLE, - DebugPort: HANDLE, - ExceptionPort: HANDLE, - JobMemberLevel: ULONG, - ) -> NTSTATUS; - fn NtOpenProcess( - ProcessHandle: PHANDLE, - DesiredAccess: ACCESS_MASK, - ObjectAttributes: POBJECT_ATTRIBUTES, - ClientId: PCLIENT_ID, - ) -> NTSTATUS; - fn NtTerminateProcess( - ProcessHandle: HANDLE, - ExitStatus: NTSTATUS, - ) -> NTSTATUS; - fn NtSuspendProcess( - ProcessHandle: HANDLE, - ) -> NTSTATUS; - fn NtResumeProcess( - ProcessHandle: HANDLE, - ) -> NTSTATUS; -}} -pub const NtCurrentProcess: HANDLE = -1isize as *mut c_void; -pub const ZwCurrentProcess: HANDLE = NtCurrentProcess; -pub const NtCurrentThread: HANDLE = -2isize as *mut c_void; -pub const ZwCurrentThread: HANDLE = NtCurrentThread; -pub const NtCurrentSession: HANDLE = -3isize as *mut c_void; -pub const ZwCurrentSession: HANDLE = NtCurrentSession; -#[inline] #[cfg(not(target_arch = "aarch64"))] -pub unsafe fn NtCurrentPeb() -> PPEB { - (*NtCurrentTeb()).ProcessEnvironmentBlock -} -pub const NtCurrentProcessToken: HANDLE = -4isize as *mut c_void; -pub const NtCurrentThreadToken: HANDLE = -5isize as *mut c_void; -pub const NtCurrentEffectiveToken: HANDLE = -6isize as *mut c_void; -pub const NtCurrentSilo: HANDLE = -1isize as *mut c_void; -#[inline] #[cfg(not(target_arch = "aarch64"))] -pub unsafe fn NtCurrentProcessId() -> HANDLE { - (*NtCurrentTeb()).ClientId.UniqueProcess -} -#[inline] #[cfg(not(target_arch = "aarch64"))] -pub unsafe fn NtCurrentThreadId() -> HANDLE { - (*NtCurrentTeb()).ClientId.UniqueThread -} -EXTERN!{extern "system" { - fn NtQueryInformationProcess( - ProcessHandle: HANDLE, - ProcessInformationClass: PROCESSINFOCLASS, - ProcessInformation: PVOID, - ProcessInformationLength: ULONG, - ReturnLength: PULONG, - ) -> NTSTATUS; - fn NtGetNextProcess( - ProcessHandle: HANDLE, - DesiredAccess: ACCESS_MASK, - HandleAttributes: ULONG, - Flags: ULONG, - NewProcessHandle: PHANDLE, - ) -> NTSTATUS; - fn NtGetNextThread( - ProcessHandle: HANDLE, - ThreadHandle: HANDLE, - DesiredAccess: ACCESS_MASK, - HandleAttributes: ULONG, - Flags: ULONG, - NewThreadHandle: PHANDLE, - ) -> NTSTATUS; - fn NtSetInformationProcess( - ProcessHandle: HANDLE, - ProcessInformationClass: PROCESSINFOCLASS, - ProcessInformation: PVOID, - ProcessInformationLength: ULONG, - ) -> NTSTATUS; - fn NtQueryPortInformationProcess() -> NTSTATUS; - fn NtCreateThread( - ThreadHandle: PHANDLE, - DesiredAccess: ACCESS_MASK, - ObjectAttributes: POBJECT_ATTRIBUTES, - ProcessHandle: HANDLE, - ClientId: PCLIENT_ID, - ThreadContext: PCONTEXT, - InitialTeb: PINITIAL_TEB, - CreateSuspended: BOOLEAN, - ) -> NTSTATUS; - fn NtOpenThread( - ThreadHandle: PHANDLE, - DesiredAccess: ACCESS_MASK, - ObjectAttributes: POBJECT_ATTRIBUTES, - ClientId: PCLIENT_ID, - ) -> NTSTATUS; - fn NtTerminateThread( - ThreadHandle: HANDLE, - ExitStatus: NTSTATUS, - ) -> NTSTATUS; - fn NtSuspendThread( - ThreadHandle: HANDLE, - PreviousSuspendCount: PULONG, - ) -> NTSTATUS; - fn NtResumeThread( - ThreadHandle: HANDLE, - PreviousSuspendCount: PULONG, - ) -> NTSTATUS; - fn NtGetCurrentProcessorNumber() -> ULONG; - fn NtGetContextThread( - ThreadHandle: HANDLE, - ThreadContext: PCONTEXT, - ) -> NTSTATUS; - fn NtSetContextThread( - ThreadHandle: HANDLE, - ThreadContext: PCONTEXT, - ) -> NTSTATUS; - fn NtQueryInformationThread( - ThreadHandle: HANDLE, - ThreadInformationClass: THREADINFOCLASS, - ThreadInformation: PVOID, - ThreadInformationLength: ULONG, - ReturnLength: PULONG, - ) -> NTSTATUS; - fn NtSetInformationThread( - ThreadHandle: HANDLE, - ThreadInformationClass: THREADINFOCLASS, - ThreadInformation: PVOID, - ThreadInformationLength: ULONG, - ) -> NTSTATUS; - fn NtAlertThread( - ThreadHandle: HANDLE, - ) -> NTSTATUS; - fn NtAlertResumeThread( - ThreadHandle: HANDLE, - PreviousSuspendCount: PULONG, - ) -> NTSTATUS; - fn NtTestAlert() -> NTSTATUS; - fn NtImpersonateThread( - ServerThreadHandle: HANDLE, - ClientThreadHandle: HANDLE, - SecurityQos: PSECURITY_QUALITY_OF_SERVICE, - ) -> NTSTATUS; - fn NtRegisterThreadTerminatePort( - PortHandle: HANDLE, - ) -> NTSTATUS; - fn NtSetLdtEntries( - Selector0: ULONG, - Entry0Low: ULONG, - Entry0Hi: ULONG, - Selector1: ULONG, - Entry1Low: ULONG, - Entry1Hi: ULONG, - ) -> NTSTATUS; -}} -FN!{cdecl PPS_APC_ROUTINE( - ApcArgument1: PVOID, - ApcArgument2: PVOID, - ApcArgument3: PVOID, -) -> ()} -EXTERN!{extern "system" { - fn NtQueueApcThread( - ThreadHandle: HANDLE, - ApcRoutine: PPS_APC_ROUTINE, - ApcArgument1: PVOID, - ApcArgument2: PVOID, - ApcArgument3: PVOID, - ) -> NTSTATUS; -}} -pub const APC_FORCE_THREAD_SIGNAL: HANDLE = 1 as *mut c_void; -EXTERN!{extern "system" { - fn NtQueueApcThreadEx( - ThreadHandle: HANDLE, - UserApcReserveHandle: HANDLE, - ApcRoutine: PPS_APC_ROUTINE, - ApcArgument1: PVOID, - ApcArgument2: PVOID, - ApcArgument3: PVOID, - ) -> NTSTATUS; - fn NtAlertThreadByThreadId( - ThreadId: HANDLE, - ) -> NTSTATUS; - fn NtWaitForAlertByThreadId( - Address: PVOID, - Timeout: PLARGE_INTEGER, - ) -> NTSTATUS; -}} -pub const PS_ATTRIBUTE_NUMBER_MASK: u32 = 0x0000ffff; -pub const PS_ATTRIBUTE_THREAD: u32 = 0x00010000; -pub const PS_ATTRIBUTE_INPUT: u32 = 0x00020000; -pub const PS_ATTRIBUTE_ADDITIVE: u32 = 0x00040000; -ENUM!{enum PS_ATTRIBUTE_NUM { - PsAttributeParentProcess = 0, - PsAttributeDebugPort = 1, - PsAttributeToken = 2, - PsAttributeClientId = 3, - PsAttributeTebAddress = 4, - PsAttributeImageName = 5, - PsAttributeImageInfo = 6, - PsAttributeMemoryReserve = 7, - PsAttributePriorityClass = 8, - PsAttributeErrorMode = 9, - PsAttributeStdHandleInfo = 10, - PsAttributeHandleList = 11, - PsAttributeGroupAffinity = 12, - PsAttributePreferredNode = 13, - PsAttributeIdealProcessor = 14, - PsAttributeUmsThread = 15, - PsAttributeMitigationOptions = 16, - PsAttributeProtectionLevel = 17, - PsAttributeSecureProcess = 18, - PsAttributeJobList = 19, - PsAttributeChildProcessPolicy = 20, - PsAttributeAllApplicationPackagesPolicy = 21, - PsAttributeWin32kFilter = 22, - PsAttributeSafeOpenPromptOriginClaim = 23, - PsAttributeBnoIsolation = 24, - PsAttributeDesktopAppPolicy = 25, - PsAttributeChpe = 26, - PsAttributeMax = 27, -}} -#[inline] -pub const fn PsAttributeValue( - mut Number: PS_ATTRIBUTE_NUM, - Thread: bool, - Input: bool, - Additive: bool, -) -> ULONG_PTR { - Number &= PS_ATTRIBUTE_NUMBER_MASK; - if Thread { - Number |= PS_ATTRIBUTE_THREAD; - } - if Input { - Number |= PS_ATTRIBUTE_INPUT; - } - if Additive { - Number |= PS_ATTRIBUTE_ADDITIVE; - } - Number as _ -} -pub const PS_ATTRIBUTE_PARENT_PROCESS: ULONG_PTR = 0x00060000; -pub const PS_ATTRIBUTE_DEBUG_PORT: ULONG_PTR = 0x00060001; -pub const PS_ATTRIBUTE_TOKEN: ULONG_PTR = 0x00060002; -pub const PS_ATTRIBUTE_CLIENT_ID: ULONG_PTR = 0x00010003; -pub const PS_ATTRIBUTE_TEB_ADDRESS: ULONG_PTR = 0x00010004; -pub const PS_ATTRIBUTE_IMAGE_NAME: ULONG_PTR = 0x00020005; -pub const PS_ATTRIBUTE_IMAGE_INFO: ULONG_PTR = 0x00000006; -pub const PS_ATTRIBUTE_MEMORY_RESERVE: ULONG_PTR = 0x00020007; -pub const PS_ATTRIBUTE_PRIORITY_CLASS: ULONG_PTR = 0x00020008; -pub const PS_ATTRIBUTE_ERROR_MODE: ULONG_PTR = 0x00020009; -pub const PS_ATTRIBUTE_STD_HANDLE_INFO: ULONG_PTR = 0x0002000a; -pub const PS_ATTRIBUTE_HANDLE_LIST: ULONG_PTR = 0x0002000b; -pub const PS_ATTRIBUTE_GROUP_AFFINITY: ULONG_PTR = 0x0003000c; -pub const PS_ATTRIBUTE_PREFERRED_NODE: ULONG_PTR = 0x0002000d; -pub const PS_ATTRIBUTE_IDEAL_PROCESSOR: ULONG_PTR = 0x0003000e; -pub const PS_ATTRIBUTE_UMS_THREAD: ULONG_PTR = 0x0003000f; -pub const PS_ATTRIBUTE_MITIGATION_OPTIONS: ULONG_PTR = 0x00060010; -pub const PS_ATTRIBUTE_PROTECTION_LEVEL: ULONG_PTR = 0x00060011; -pub const PS_ATTRIBUTE_SECURE_PROCESS: ULONG_PTR = 0x00020012; -pub const PS_ATTRIBUTE_JOB_LIST: ULONG_PTR = 0x00020013; -pub const PS_ATTRIBUTE_CHILD_PROCESS_POLICY: ULONG_PTR = 0x00020014; -pub const PS_ATTRIBUTE_ALL_APPLICATION_PACKAGES_POLICY: ULONG_PTR = 0x00020015; -pub const PS_ATTRIBUTE_WIN32K_FILTER: ULONG_PTR = 0x00020016; -pub const PS_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM: ULONG_PTR = 0x00020017; -pub const PS_ATTRIBUTE_BNO_ISOLATION: ULONG_PTR = 0x00020018; -pub const PS_ATTRIBUTE_DESKTOP_APP_POLICY: ULONG_PTR = 0x00020019; -UNION!{union PS_ATTRIBUTE_u { - Value: ULONG_PTR, - ValuePtr: PVOID, -}} -STRUCT!{struct PS_ATTRIBUTE { - Attribute: ULONG_PTR, - Size: SIZE_T, - u: PS_ATTRIBUTE_u, - ReturnLength: PSIZE_T, -}} -pub type PPS_ATTRIBUTE = *mut PS_ATTRIBUTE; -STRUCT!{struct PS_ATTRIBUTE_LIST { - TotalLength: SIZE_T, - Attributes: [PS_ATTRIBUTE; 1], -}} -pub type PPS_ATTRIBUTE_LIST = *mut PS_ATTRIBUTE_LIST; -STRUCT!{struct PS_MEMORY_RESERVE { - ReserveAddress: PVOID, - ReserveSize: SIZE_T, -}} -pub type PPS_MEMORY_RESERVE = *mut PS_MEMORY_RESERVE; -ENUM!{enum PS_STD_HANDLE_STATE { - PsNeverDuplicate = 0, - PsRequestDuplicate = 1, - PsAlwaysDuplicate = 2, - PsMaxStdHandleStates = 3, -}} -pub const PS_STD_INPUT_HANDLE: u32 = 0x1; -pub const PS_STD_OUTPUT_HANDLE: u32 = 0x2; -pub const PS_STD_ERROR_HANDLE: u32 = 0x4; -STRUCT!{struct PS_STD_HANDLE_INFO { - Flags: ULONG, - StdHandleSubsystemType: ULONG, -}} -pub type PPS_STD_HANDLE_INFO = *mut PS_STD_HANDLE_INFO; -BITFIELD!{PS_STD_HANDLE_INFO Flags: ULONG [ - StdHandleState set_StdHandleState[0..2], - PseudoHandleMask set_PseudoHandleMask[2..5], -]} -STRUCT!{struct PS_BNO_ISOLATION_PARAMETERS { - IsolationPrefix: UNICODE_STRING, - HandleCount: ULONG, - Handles: *mut PVOID, - IsolationEnabled: BOOLEAN, -}} -pub type PPS_BNO_ISOLATION_PARAMETERS = *mut PS_BNO_ISOLATION_PARAMETERS; -ENUM!{enum PS_MITIGATION_OPTION { - PS_MITIGATION_OPTION_NX = 0, - PS_MITIGATION_OPTION_SEHOP = 1, - PS_MITIGATION_OPTION_FORCE_RELOCATE_IMAGES = 2, - PS_MITIGATION_OPTION_HEAP_TERMINATE = 3, - PS_MITIGATION_OPTION_BOTTOM_UP_ASLR = 4, - PS_MITIGATION_OPTION_HIGH_ENTROPY_ASLR = 5, - PS_MITIGATION_OPTION_STRICT_HANDLE_CHECKS = 6, - PS_MITIGATION_OPTION_WIN32K_SYSTEM_CALL_DISABLE = 7, - PS_MITIGATION_OPTION_EXTENSION_POINT_DISABLE = 8, - PS_MITIGATION_OPTION_PROHIBIT_DYNAMIC_CODE = 9, - PS_MITIGATION_OPTION_CONTROL_FLOW_GUARD = 10, - PS_MITIGATION_OPTION_BLOCK_NON_MICROSOFT_BINARIES = 11, - PS_MITIGATION_OPTION_FONT_DISABLE = 12, - PS_MITIGATION_OPTION_IMAGE_LOAD_NO_REMOTE = 13, - PS_MITIGATION_OPTION_IMAGE_LOAD_NO_LOW_LABEL = 14, - PS_MITIGATION_OPTION_IMAGE_LOAD_PREFER_SYSTEM32 = 15, - PS_MITIGATION_OPTION_RETURN_FLOW_GUARD = 16, - PS_MITIGATION_OPTION_LOADER_INTEGRITY_CONTINUITY = 17, - PS_MITIGATION_OPTION_STRICT_CONTROL_FLOW_GUARD = 18, - PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT = 19, - PS_MITIGATION_OPTION_ROP_STACKPIVOT = 20, - PS_MITIGATION_OPTION_ROP_CALLER_CHECK = 21, - PS_MITIGATION_OPTION_ROP_SIMEXEC = 22, - PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER = 23, - PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER_PLUS = 24, - PS_MITIGATION_OPTION_RESTRICT_CHILD_PROCESS_CREATION = 25, - PS_MITIGATION_OPTION_IMPORT_ADDRESS_FILTER = 26, - PS_MITIGATION_OPTION_MODULE_TAMPERING_PROTECTION = 27, - PS_MITIGATION_OPTION_RESTRICT_INDIRECT_BRANCH_PREDICTION = 28, - PS_MITIGATION_OPTION_SPECULATIVE_STORE_BYPASS_DISABLE = 29, - PS_MITIGATION_OPTION_ALLOW_DOWNGRADE_DYNAMIC_CODE_POLICY = 30, - PS_MITIGATION_OPTION_CET_SHADOW_STACKS = 31, -}} -ENUM!{enum PS_CREATE_STATE { - PsCreateInitialState = 0, - PsCreateFailOnFileOpen = 1, - PsCreateFailOnSectionCreate = 2, - PsCreateFailExeFormat = 3, - PsCreateFailMachineMismatch = 4, - PsCreateFailExeName = 5, - PsCreateSuccess = 6, - PsCreateMaximumStates = 7, -}} -STRUCT!{struct PS_CREATE_INFO_u_InitState { - InitFlags: ULONG, - AdditionalFileAccess: ACCESS_MASK, -}} -BITFIELD!{PS_CREATE_INFO_u_InitState InitFlags: ULONG [ - WriteOutputOnExit set_WriteOutputOnExit[0..1], - DetectManifest set_DetectManifest[1..2], - IFEOSkipDebugger set_IFEOSkipDebugger[2..3], - IFEODoNotPropagateKeyState set_IFEODoNotPropagateKeyState[3..4], - SpareBits1 set_SpareBits1[4..8], - SpareBits2 set_SpareBits2[8..16], - ProhibitedImageCharacteristics set_ProhibitedImageCharacteristics[16..32], -]} -STRUCT!{struct PS_CREATE_INFO_u_SuccessState { - OutputFlags: ULONG, - FileHandle: HANDLE, - SectionHandle: HANDLE, - UserProcessParametersNative: ULONGLONG, - UserProcessParametersWow64: ULONG, - CurrentParameterFlags: ULONG, - PebAddressNative: ULONGLONG, - PebAddressWow64: ULONG, - ManifestAddress: ULONGLONG, - ManifestSize: ULONG, -}} -BITFIELD!{PS_CREATE_INFO_u_SuccessState OutputFlags: ULONG [ - ProtectedProcess set_ProtectedProcess[0..1], - AddressSpaceOverride set_AddressSpaceOverride[1..2], - DevOverrideEnabled set_DevOverrideEnabled[2..3], - ManifestDetected set_ManifestDetected[3..4], - ProtectedProcessLight set_ProtectedProcessLight[4..5], - SpareBits1 set_SpareBits1[5..8], - SpareBits2 set_SpareBits2[8..16], - SpareBits3 set_SpareBits3[16..32], -]} -UNION!{union PS_CREATE_INFO_u { - InitState: PS_CREATE_INFO_u_InitState, - FileHandle: HANDLE, - DllCharacteristics: USHORT, - IFEOKey: HANDLE, - SuccessState: PS_CREATE_INFO_u_SuccessState, -}} -STRUCT!{struct PS_CREATE_INFO { - Size: SIZE_T, - State: PS_CREATE_STATE, - u: PS_CREATE_INFO_u, -}} -pub type PPS_CREATE_INFO = *mut PS_CREATE_INFO; -pub const PROCESS_CREATE_FLAGS_LARGE_PAGE_SYSTEM_DLL: ULONG = 0x00000020; -pub const PROCESS_CREATE_FLAGS_PROTECTED_PROCESS: ULONG = 0x00000040; -pub const PROCESS_CREATE_FLAGS_CREATE_SESSION: ULONG = 0x00000080; -pub const PROCESS_CREATE_FLAGS_INHERIT_FROM_PARENT: ULONG = 0x00000100; -pub const PROCESS_CREATE_FLAGS_SUSPENDED: ULONG = 0x00000200; -pub const PROCESS_CREATE_FLAGS_EXTENDED_UNKNOWN: ULONG = 0x00000400; -EXTERN!{extern "system" { - fn NtCreateUserProcess( - ProcessHandle: PHANDLE, - ThreadHandle: PHANDLE, - ProcessDesiredAccess: ACCESS_MASK, - ThreadDesiredAccess: ACCESS_MASK, - ProcessObjectAttributes: POBJECT_ATTRIBUTES, - ThreadObjectAttributes: POBJECT_ATTRIBUTES, - ProcessFlags: ULONG, - ThreadFlags: ULONG, - ProcessParameters: PVOID, - CreateInfo: PPS_CREATE_INFO, - AttributeList: PPS_ATTRIBUTE_LIST, - ) -> NTSTATUS; -}} -pub const THREAD_CREATE_FLAGS_CREATE_SUSPENDED: ULONG = 0x00000001; -pub const THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH: ULONG = 0x00000002; -pub const THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER: ULONG = 0x00000004; -pub const THREAD_CREATE_FLAGS_HAS_SECURITY_DESCRIPTOR: ULONG = 0x00000010; -pub const THREAD_CREATE_FLAGS_ACCESS_CHECK_IN_TARGET: ULONG = 0x00000020; -pub const THREAD_CREATE_FLAGS_INITIAL_THREAD: ULONG = 0x00000080; -EXTERN!{extern "system" { - fn NtCreateThreadEx( - ThreadHandle: PHANDLE, - DesiredAccess: ACCESS_MASK, - ObjectAttributes: POBJECT_ATTRIBUTES, - ProcessHandle: HANDLE, - StartRoutine: PVOID, - Argument: PVOID, - CreateFlags: ULONG, - ZeroBits: SIZE_T, - StackSize: SIZE_T, - MaximumStackSize: SIZE_T, - AttributeList: PPS_ATTRIBUTE_LIST, - ) -> NTSTATUS; -}} -STRUCT!{struct JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION { - BasicInfo: JOBOBJECT_BASIC_ACCOUNTING_INFORMATION, - IoInfo: IO_COUNTERS, - DiskIoInfo: PROCESS_DISK_COUNTERS, - ContextSwitches: ULONG64, - TotalCycleTime: LARGE_INTEGER, - ReadyTime: ULONG64, - EnergyValues: PROCESS_ENERGY_VALUES, -}} -pub type PJOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION = - *mut JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION; -STRUCT!{struct JOBOBJECT_WAKE_INFORMATION { - NotificationChannel: HANDLE, - WakeCounters: [ULONG64; 7], -}} -pub type PJOBOBJECT_WAKE_INFORMATION = *mut JOBOBJECT_WAKE_INFORMATION; -STRUCT!{struct JOBOBJECT_WAKE_INFORMATION_V1 { - NotificationChannel: HANDLE, - WakeCounters: [ULONG64; 4], -}} -pub type PJOBOBJECT_WAKE_INFORMATION_V1 = *mut JOBOBJECT_WAKE_INFORMATION_V1; -STRUCT!{struct JOBOBJECT_INTERFERENCE_INFORMATION { - Count: ULONG64, -}} -pub type PJOBOBJECT_INTERFERENCE_INFORMATION = *mut JOBOBJECT_INTERFERENCE_INFORMATION; -STRUCT!{struct JOBOBJECT_WAKE_FILTER { - HighEdgeFilter: ULONG, - LowEdgeFilter: ULONG, -}} -pub type PJOBOBJECT_WAKE_FILTER = *mut JOBOBJECT_WAKE_FILTER; -STRUCT!{struct JOBOBJECT_FREEZE_INFORMATION { - Flags: ULONG, - Freeze: BOOLEAN, - Swap: BOOLEAN, - Reserved0: [UCHAR; 2], - WakeFilter: JOBOBJECT_WAKE_FILTER, -}} -pub type PJOBOBJECT_FREEZE_INFORMATION = *mut JOBOBJECT_FREEZE_INFORMATION; -BITFIELD!{JOBOBJECT_FREEZE_INFORMATION Flags: ULONG [ - FreezeOperation set_FreezeOperation[0..1], - FilterOperation set_FilterOperation[1..2], - SwapOperation set_SwapOperation[2..3], - Reserved set_Reserved[3..32], -]} -STRUCT!{struct JOBOBJECT_MEMORY_USAGE_INFORMATION { - JobMemory: ULONG64, - PeakJobMemoryUsed: ULONG64, -}} -pub type PJOBOBJECT_MEMORY_USAGE_INFORMATION = *mut JOBOBJECT_MEMORY_USAGE_INFORMATION; -STRUCT!{struct JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 { - BasicInfo: JOBOBJECT_MEMORY_USAGE_INFORMATION, - JobSharedMemory: ULONG64, - Reserved: [ULONG64; 2], -}} -pub type PJOBOBJECT_MEMORY_USAGE_INFORMATION_V2 = *mut JOBOBJECT_MEMORY_USAGE_INFORMATION_V2; -STRUCT!{struct SILO_USER_SHARED_DATA { - ServiceSessionId: ULONG64, - ActiveConsoleId: ULONG, - ConsoleSessionForegroundProcessId: LONGLONG, - NtProductType: NT_PRODUCT_TYPE, - SuiteMask: ULONG, - SharedUserSessionId: ULONG, - IsMultiSessionSku: BOOLEAN, - NtSystemRoot: [WCHAR; 260], - UserModeGlobalLogger: [USHORT; 16], -}} -pub type PSILO_USER_SHARED_DATA = *mut SILO_USER_SHARED_DATA; -STRUCT!{struct SILOOBJECT_ROOT_DIRECTORY { - ControlFlags: ULONG, - Path: UNICODE_STRING, -}} -pub type PSILOOBJECT_ROOT_DIRECTORY = *mut SILOOBJECT_ROOT_DIRECTORY; -STRUCT!{struct JOBOBJECT_ENERGY_TRACKING_STATE { - Value: ULONG64, - UpdateMask: ULONG, - DesiredState: ULONG, -}} -pub type PJOBOBJECT_ENERGY_TRACKING_STATE = *mut JOBOBJECT_ENERGY_TRACKING_STATE; -EXTERN!{extern "system" { - fn NtCreateJobObject( - JobHandle: PHANDLE, - DesiredAccess: ACCESS_MASK, - ObjectAttributes: POBJECT_ATTRIBUTES, - ) -> NTSTATUS; - fn NtOpenJobObject( - JobHandle: PHANDLE, - DesiredAccess: ACCESS_MASK, - ObjectAttributes: POBJECT_ATTRIBUTES, - ) -> NTSTATUS; - fn NtAssignProcessToJobObject( - JobHandle: HANDLE, - ProcessHandle: HANDLE, - ) -> NTSTATUS; - fn NtTerminateJobObject( - JobHandle: HANDLE, - ExitStatus: NTSTATUS, - ) -> NTSTATUS; - fn NtIsProcessInJob( - ProcessHandle: HANDLE, - JobHandle: HANDLE, - ) -> NTSTATUS; - fn NtQueryInformationJobObject( - JobHandle: HANDLE, - JobObjectInformationClass: JOBOBJECTINFOCLASS, - JobObjectInformation: PVOID, - JobObjectInformationLength: ULONG, - ReturnLength: PULONG, - ) -> NTSTATUS; - fn NtSetInformationJobObject( - JobHandle: HANDLE, - JobObjectInformationClass: JOBOBJECTINFOCLASS, - JobObjectInformation: PVOID, - JobObjectInformationLength: ULONG, - ) -> NTSTATUS; - fn NtCreateJobSet( - NumJob: ULONG, - UserJobSet: PJOB_SET_ARRAY, - Flags: ULONG, - ) -> NTSTATUS; - fn NtRevertContainerImpersonation() -> NTSTATUS; -}} -ENUM!{enum MEMORY_RESERVE_TYPE { - MemoryReserveUserApc = 0, - MemoryReserveIoCompletion = 1, - MemoryReserveTypeMax = 2, -}} -EXTERN!{extern "system" { - fn NtAllocateReserveObject( - MemoryReserveHandle: PHANDLE, - ObjectAttributes: POBJECT_ATTRIBUTES, - Type: MEMORY_RESERVE_TYPE, - ) -> NTSTATUS; -}} |