summaryrefslogtreecommitdiffstats
path: root/third_party/rust/ntapi/src/ntexapi.rs
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 09:22:09 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 09:22:09 +0000
commit43a97878ce14b72f0981164f87f2e35e14151312 (patch)
tree620249daf56c0258faa40cbdcf9cfba06de2a846 /third_party/rust/ntapi/src/ntexapi.rs
parentInitial commit. (diff)
downloadfirefox-upstream.tar.xz
firefox-upstream.zip
Adding upstream version 110.0.1.upstream/110.0.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'third_party/rust/ntapi/src/ntexapi.rs')
-rw-r--r--third_party/rust/ntapi/src/ntexapi.rs2998
1 files changed, 2998 insertions, 0 deletions
diff --git a/third_party/rust/ntapi/src/ntexapi.rs b/third_party/rust/ntapi/src/ntexapi.rs
new file mode 100644
index 0000000000..5fa47c9137
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntexapi.rs
@@ -0,0 +1,2998 @@
+use core::mem::uninitialized;
+use core::ptr::read_volatile;
+#[cfg(target_arch = "x86")]
+use core::sync::atomic::spin_loop_hint;
+use crate::ntapi_base::{CLIENT_ID, KPRIORITY, KSYSTEM_TIME, PRTL_ATOM, RTL_ATOM};
+use crate::ntioapi::{BUS_DATA_TYPE, FILE_IO_COMPLETION_INFORMATION, INTERFACE_TYPE};
+use crate::ntkeapi::{KPROFILE_SOURCE, KTHREAD_STATE, KWAIT_REASON};
+use crate::ntldr::RTL_PROCESS_MODULE_INFORMATION_EX;
+use crate::ntpebteb::PTEB;
+use crate::ntpoapi::COUNTED_REASON_CONTEXT;
+use winapi::shared::basetsd::{KAFFINITY, PULONG64, PULONG_PTR, SIZE_T, ULONG64, ULONG_PTR};
+use winapi::shared::evntrace::PROFILE_SOURCE_INFO;
+use winapi::shared::guiddef::{GUID, LPGUID};
+use winapi::shared::ntdef::{
+ BOOLEAN, CCHAR, EVENT_TYPE, HANDLE, LANGID, LARGE_INTEGER, LCID, LOGICAL, LONG, LONGLONG,
+ NTSTATUS, NT_PRODUCT_TYPE, PBOOLEAN, PCHAR, PCWNF_STATE_NAME, PGROUP_AFFINITY, PHANDLE,
+ PHYSICAL_ADDRESS, PLARGE_INTEGER, PLCID, PLONG, PLUID, POBJECT_ATTRIBUTES, PUCHAR,
+ PULARGE_INTEGER, PULONG, PUNICODE_STRING, PUSHORT, PVOID, PWNF_STATE_NAME, PWSTR, TIMER_TYPE,
+ UCHAR, ULARGE_INTEGER, ULONG, ULONGLONG, UNICODE_STRING, USHORT, VOID, WCHAR, WNF_STATE_NAME,
+};
+use winapi::um::winnt::{
+ ACCESS_MASK, ANYSIZE_ARRAY, FIRMWARE_TYPE, GENERIC_MAPPING, PSECURITY_DESCRIPTOR,
+ STANDARD_RIGHTS_REQUIRED, SYNCHRONIZE, XSTATE_CONFIGURATION,
+};
+use crate::winapi_local::um::winnt::UInt32x32To64;
+EXTERN!{extern "system" {
+ fn NtDelayExecution(
+ Alertable: BOOLEAN,
+ DelayInterval: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtQuerySystemEnvironmentValue(
+ VariableName: PUNICODE_STRING,
+ VariableValue: PWSTR,
+ ValueLength: USHORT,
+ ReturnLength: PUSHORT,
+ ) -> NTSTATUS;
+ fn NtSetSystemEnvironmentValue(
+ VariableName: PUNICODE_STRING,
+ VariableValue: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn NtQuerySystemEnvironmentValueEx(
+ VariableName: PUNICODE_STRING,
+ VendorGuid: LPGUID,
+ Value: PVOID,
+ ValueLength: PULONG,
+ Attributes: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetSystemEnvironmentValueEx(
+ VariableName: PUNICODE_STRING,
+ VendorGuid: LPGUID,
+ Value: PVOID,
+ ValueLength: ULONG,
+ Attributes: ULONG,
+ ) -> NTSTATUS;
+ fn NtEnumerateSystemEnvironmentValuesEx(
+ InformationClass: ULONG,
+ Buffer: PVOID,
+ BufferLength: PULONG,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct BOOT_ENTRY {
+ Version: ULONG,
+ Length: ULONG,
+ Id: ULONG,
+ Attributes: ULONG,
+ FriendlyNameOffset: ULONG,
+ BootFilePathOffset: ULONG,
+ OsOptionsLength: ULONG,
+ OsOptions: [UCHAR; 1],
+}}
+pub type PBOOT_ENTRY = *mut BOOT_ENTRY;
+STRUCT!{struct BOOT_ENTRY_LIST {
+ NextEntryOffset: ULONG,
+ BootEntry: BOOT_ENTRY,
+}}
+pub type PBOOT_ENTRY_LIST = *mut BOOT_ENTRY_LIST;
+STRUCT!{struct BOOT_OPTIONS {
+ Version: ULONG,
+ Length: ULONG,
+ Timeout: ULONG,
+ CurrentBootEntryId: ULONG,
+ NextBootEntryId: ULONG,
+ HeadlessRedirection: [WCHAR; 1],
+}}
+pub type PBOOT_OPTIONS = *mut BOOT_OPTIONS;
+STRUCT!{struct FILE_PATH {
+ Version: ULONG,
+ Length: ULONG,
+ Type: ULONG,
+ FilePath: [UCHAR; 1],
+}}
+pub type PFILE_PATH = *mut FILE_PATH;
+STRUCT!{struct EFI_DRIVER_ENTRY {
+ Version: ULONG,
+ Length: ULONG,
+ Id: ULONG,
+ FriendlyNameOffset: ULONG,
+ DriverFilePathOffset: ULONG,
+}}
+pub type PEFI_DRIVER_ENTRY = *mut EFI_DRIVER_ENTRY;
+STRUCT!{struct EFI_DRIVER_ENTRY_LIST {
+ NextEntryOffset: ULONG,
+ DriverEntry: EFI_DRIVER_ENTRY,
+}}
+pub type PEFI_DRIVER_ENTRY_LIST = *mut EFI_DRIVER_ENTRY_LIST;
+EXTERN!{extern "system" {
+ fn NtAddBootEntry(
+ BootEntry: PBOOT_ENTRY,
+ Id: PULONG,
+ ) -> NTSTATUS;
+ fn NtDeleteBootEntry(
+ Id: ULONG,
+ ) -> NTSTATUS;
+ fn NtModifyBootEntry(
+ BootEntry: PBOOT_ENTRY,
+ ) -> NTSTATUS;
+ fn NtEnumerateBootEntries(
+ Buffer: PVOID,
+ BufferLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtQueryBootEntryOrder(
+ Ids: PULONG,
+ Count: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetBootEntryOrder(
+ Ids: PULONG,
+ Count: ULONG,
+ ) -> NTSTATUS;
+ fn NtQueryBootOptions(
+ BootOptions: PBOOT_OPTIONS,
+ BootOptionsLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetBootOptions(
+ BootOptions: PBOOT_OPTIONS,
+ FieldsToChange: ULONG,
+ ) -> NTSTATUS;
+ fn NtTranslateFilePath(
+ InputFilePath: PFILE_PATH,
+ OutputType: ULONG,
+ OutputFilePath: PFILE_PATH,
+ OutputFilePathLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtAddDriverEntry(
+ DriverEntry: PEFI_DRIVER_ENTRY,
+ Id: PULONG,
+ ) -> NTSTATUS;
+ fn NtDeleteDriverEntry(
+ Id: ULONG,
+ ) -> NTSTATUS;
+ fn NtModifyDriverEntry(
+ DriverEntry: PEFI_DRIVER_ENTRY,
+ ) -> NTSTATUS;
+ fn NtEnumerateDriverEntries(
+ Buffer: PVOID,
+ BufferLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtQueryDriverEntryOrder(
+ Ids: PULONG,
+ Count: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetDriverEntryOrder(
+ Ids: PULONG,
+ Count: ULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum FILTER_BOOT_OPTION_OPERATION {
+ FilterBootOptionOperationOpenSystemStore = 0,
+ FilterBootOptionOperationSetElement = 1,
+ FilterBootOptionOperationDeleteElement = 2,
+ FilterBootOptionOperationMax = 3,
+}}
+EXTERN!{extern "system" {
+ fn NtFilterBootOption(
+ FilterOperation: FILTER_BOOT_OPTION_OPERATION,
+ ObjectType: ULONG,
+ ElementType: ULONG,
+ Data: PVOID,
+ DataSize: ULONG,
+ ) -> NTSTATUS;
+}}
+pub const EVENT_QUERY_STATE: u32 = 0x0001;
+ENUM!{enum EVENT_INFORMATION_CLASS {
+ EventBasicInformation = 0,
+}}
+STRUCT!{struct EVENT_BASIC_INFORMATION {
+ EventType: EVENT_TYPE,
+ EventState: LONG,
+}}
+pub type PEVENT_BASIC_INFORMATION = *mut EVENT_BASIC_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtCreateEvent(
+ EventHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ EventType: EVENT_TYPE,
+ InitialState: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtOpenEvent(
+ EventHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtSetEvent(
+ EventHandle: HANDLE,
+ PreviousState: PLONG,
+ ) -> NTSTATUS;
+ fn NtSetEventBoostPriority(
+ EventHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtClearEvent(
+ EventHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtResetEvent(
+ EventHandle: HANDLE,
+ PreviousState: PLONG,
+ ) -> NTSTATUS;
+ fn NtPulseEvent(
+ EventHandle: HANDLE,
+ PreviousState: PLONG,
+ ) -> NTSTATUS;
+ fn NtQueryEvent(
+ EventHandle: HANDLE,
+ EventInformationClass: EVENT_INFORMATION_CLASS,
+ EventInformation: PVOID,
+ EventInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
+pub const EVENT_PAIR_ALL_ACCESS: ACCESS_MASK = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE;
+EXTERN!{extern "system" {
+ fn NtCreateEventPair(
+ EventPairHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtOpenEventPair(
+ EventPairHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtSetLowEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtSetHighEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtWaitLowEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtWaitHighEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtSetLowWaitHighEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtSetHighWaitLowEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum MUTANT_INFORMATION_CLASS {
+ MutantBasicInformation = 0,
+ MutantOwnerInformation = 1,
+}}
+STRUCT!{struct MUTANT_BASIC_INFORMATION {
+ CurrentCount: LONG,
+ OwnedByCaller: BOOLEAN,
+ AbandonedState: BOOLEAN,
+}}
+pub type PMUTANT_BASIC_INFORMATION = *mut MUTANT_BASIC_INFORMATION;
+STRUCT!{struct MUTANT_OWNER_INFORMATION {
+ ClientId: CLIENT_ID,
+}}
+pub type PMUTANT_OWNER_INFORMATION = *mut MUTANT_OWNER_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtCreateMutant(
+ MutantHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ InitialOwner: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtOpenMutant(
+ MutantHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtReleaseMutant(
+ MutantHandle: HANDLE,
+ PreviousCount: PLONG,
+ ) -> NTSTATUS;
+ fn NtQueryMutant(
+ MutantHandle: HANDLE,
+ MutantInformationClass: MUTANT_INFORMATION_CLASS,
+ MutantInformation: PVOID,
+ MutantInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
+pub const SEMAPHORE_QUERY_STATE: u32 = 0x0001;
+ENUM!{enum SEMAPHORE_INFORMATION_CLASS {
+ SemaphoreBasicInformation = 0,
+}}
+STRUCT!{struct SEMAPHORE_BASIC_INFORMATION {
+ CurrentCount: LONG,
+ MaximumCount: LONG,
+}}
+pub type PSEMAPHORE_BASIC_INFORMATION = *mut SEMAPHORE_BASIC_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtCreateSemaphore(
+ SemaphoreHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ InitialCount: LONG,
+ MaximumCount: LONG,
+ ) -> NTSTATUS;
+ fn NtOpenSemaphore(
+ SemaphoreHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtReleaseSemaphore(
+ SemaphoreHandle: HANDLE,
+ ReleaseCount: LONG,
+ PreviousCount: PLONG,
+ ) -> NTSTATUS;
+ fn NtQuerySemaphore(
+ SemaphoreHandle: HANDLE,
+ SemaphoreInformationClass: SEMAPHORE_INFORMATION_CLASS,
+ SemaphoreInformation: PVOID,
+ SemaphoreInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum TIMER_INFORMATION_CLASS {
+ TimerBasicInformation = 0,
+}}
+STRUCT!{struct TIMER_BASIC_INFORMATION {
+ RemainingTime: LARGE_INTEGER,
+ TimerState: BOOLEAN,
+}}
+pub type PTIMER_BASIC_INFORMATION = *mut TIMER_BASIC_INFORMATION;
+FN!{stdcall PTIMER_APC_ROUTINE(
+ TimerContext: PVOID,
+ TimerLowValue: ULONG,
+ TimerHighValue: LONG,
+) -> ()}
+ENUM!{enum TIMER_SET_INFORMATION_CLASS {
+ TimerSetCoalescableTimer = 0,
+ MaxTimerInfoClass = 1,
+}}
+STRUCT!{struct TIMER_SET_COALESCABLE_TIMER_INFO {
+ DueTime: LARGE_INTEGER,
+ TimerApcRoutine: PTIMER_APC_ROUTINE,
+ TimerContext: PVOID,
+ WakeContext: *mut COUNTED_REASON_CONTEXT,
+ Period: ULONG,
+ TolerableDelay: ULONG,
+ PreviousState: PBOOLEAN,
+}}
+pub type PTIMER_SET_COALESCABLE_TIMER_INFO = *mut TIMER_SET_COALESCABLE_TIMER_INFO;
+EXTERN!{extern "system" {
+ fn NtCreateTimer(
+ TimerHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ TimerType: TIMER_TYPE,
+ ) -> NTSTATUS;
+ fn NtOpenTimer(
+ TimerHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtSetTimer(
+ TimerHandle: HANDLE,
+ DueTime: PLARGE_INTEGER,
+ TimerApcRoutine: PTIMER_APC_ROUTINE,
+ TimerContext: PVOID,
+ ResumeTimer: BOOLEAN,
+ Period: LONG,
+ PreviousState: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn NtSetTimerEx(
+ TimerHandle: HANDLE,
+ TimerSetInformationClass: TIMER_SET_INFORMATION_CLASS,
+ TimerSetInformation: PVOID,
+ TimerSetInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtCancelTimer(
+ TimerHandle: HANDLE,
+ CurrentState: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn NtQueryTimer(
+ TimerHandle: HANDLE,
+ TimerInformationClass: TIMER_INFORMATION_CLASS,
+ TimerInformation: PVOID,
+ TimerInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtCreateIRTimer(
+ TimerHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ) -> NTSTATUS;
+ fn NtSetIRTimer(
+ TimerHandle: HANDLE,
+ DueTime: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct T2_SET_PARAMETERS {
+ Version: ULONG,
+ Reserved: ULONG,
+ NoWakeTolerance: LONGLONG,
+}}
+pub type PT2_SET_PARAMETERS = *mut T2_SET_PARAMETERS;
+pub type PT2_CANCEL_PARAMETERS = PVOID;
+EXTERN!{extern "system" {
+ fn NtCreateTimer2(
+ TimerHandle: PHANDLE,
+ Reserved1: PVOID,
+ Reserved2: PVOID,
+ Attributes: ULONG,
+ DesiredAccess: ACCESS_MASK,
+ ) -> NTSTATUS;
+ fn NtSetTimer2(
+ TimerHandle: HANDLE,
+ DueTime: PLARGE_INTEGER,
+ Period: PLARGE_INTEGER,
+ Parameters: PT2_SET_PARAMETERS,
+ ) -> NTSTATUS;
+ fn NtCancelTimer2(
+ TimerHandle: HANDLE,
+ Parameters: PT2_CANCEL_PARAMETERS,
+ ) -> NTSTATUS;
+}}
+pub const PROFILE_CONTROL: u32 = 0x0001;
+pub const PROFILE_ALL_ACCESS: u32 = STANDARD_RIGHTS_REQUIRED | PROFILE_CONTROL;
+EXTERN!{extern "system" {
+ fn NtCreateProfile(
+ ProfileHandle: PHANDLE,
+ Process: HANDLE,
+ ProfileBase: PVOID,
+ ProfileSize: SIZE_T,
+ BucketSize: ULONG,
+ Buffer: PULONG,
+ BufferSize: ULONG,
+ ProfileSource: KPROFILE_SOURCE,
+ Affinity: KAFFINITY,
+ ) -> NTSTATUS;
+ fn NtCreateProfileEx(
+ ProfileHandle: PHANDLE,
+ Process: HANDLE,
+ ProfileBase: PVOID,
+ ProfileSize: SIZE_T,
+ BucketSize: ULONG,
+ Buffer: PULONG,
+ BufferSize: ULONG,
+ ProfileSource: KPROFILE_SOURCE,
+ GroupCount: USHORT,
+ GroupAffinity: PGROUP_AFFINITY,
+ ) -> NTSTATUS;
+ fn NtStartProfile(
+ ProfileHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtStopProfile(
+ ProfileHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtQueryIntervalProfile(
+ ProfileSource: KPROFILE_SOURCE,
+ Interval: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetIntervalProfile(
+ Interval: ULONG,
+ Source: KPROFILE_SOURCE,
+ ) -> NTSTATUS;
+}}
+pub const KEYEDEVENT_WAIT: ULONG = 0x0001;
+pub const KEYEDEVENT_WAKE: ULONG = 0x0002;
+pub const KEYEDEVENT_ALL_ACCESS: ACCESS_MASK =
+ STANDARD_RIGHTS_REQUIRED | KEYEDEVENT_WAIT | KEYEDEVENT_WAKE;
+EXTERN!{extern "system" {
+ fn NtCreateKeyedEvent(
+ KeyedEventHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtOpenKeyedEvent(
+ KeyedEventHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtReleaseKeyedEvent(
+ KeyedEventHandle: HANDLE,
+ KeyValue: PVOID,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtWaitForKeyedEvent(
+ KeyedEventHandle: HANDLE,
+ KeyValue: PVOID,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtUmsThreadYield(
+ SchedulerParam: PVOID,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum WNF_STATE_NAME_LIFETIME {
+ WnfWellKnownStateName = 0,
+ WnfPermanentStateName = 1,
+ WnfPersistentStateName = 2,
+ WnfTemporaryStateName = 3,
+}}
+ENUM!{enum WNF_STATE_NAME_INFORMATION {
+ WnfInfoStateNameExist = 0,
+ WnfInfoSubscribersPresent = 1,
+ WnfInfoIsQuiescent = 2,
+}}
+ENUM!{enum WNF_DATA_SCOPE {
+ WnfDataScopeSystem = 0,
+ WnfDataScopeSession = 1,
+ WnfDataScopeUser = 2,
+ WnfDataScopeProcess = 3,
+ WnfDataScopeMachine = 4,
+}}
+STRUCT!{struct WNF_TYPE_ID {
+ TypeId: GUID,
+}}
+pub type PWNF_TYPE_ID = *mut WNF_TYPE_ID;
+pub type PCWNF_TYPE_ID = *const WNF_TYPE_ID;
+pub type PWNF_CHANGE_STAMP = *mut ULONG;
+pub type WNF_CHANGE_STAMP = ULONG;
+STRUCT!{struct WNF_DELIVERY_DESCRIPTOR {
+ SubscriptionId: ULONGLONG,
+ StateName: WNF_STATE_NAME,
+ ChangeStamp: WNF_CHANGE_STAMP,
+ StateDataSize: ULONG,
+ EventMask: ULONG,
+ TypeId: WNF_TYPE_ID,
+ StateDataOffset: ULONG,
+}}
+pub type PWNF_DELIVERY_DESCRIPTOR = *mut WNF_DELIVERY_DESCRIPTOR;
+EXTERN!{extern "system" {
+ fn NtCreateWnfStateName(
+ StateName: PWNF_STATE_NAME,
+ NameLifetime: WNF_STATE_NAME_LIFETIME,
+ DataScope: WNF_DATA_SCOPE,
+ PersistData: BOOLEAN,
+ TypeId: PCWNF_TYPE_ID,
+ MaximumStateSize: ULONG,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ) -> NTSTATUS;
+ fn NtDeleteWnfStateName(
+ StateName: PCWNF_STATE_NAME,
+ ) -> NTSTATUS;
+ fn NtUpdateWnfStateData(
+ StateName: PCWNF_STATE_NAME,
+ Buffer: *const VOID,
+ Length: ULONG,
+ TypeId: PCWNF_TYPE_ID,
+ ExplicitScope: *const VOID,
+ MatchingChangeStamp: WNF_CHANGE_STAMP,
+ CheckStamp: LOGICAL,
+ ) -> NTSTATUS;
+ fn NtDeleteWnfStateData(
+ StateName: PCWNF_STATE_NAME,
+ ExplicitScope: *const VOID,
+ ) -> NTSTATUS;
+ fn NtQueryWnfStateData(
+ StateName: PCWNF_STATE_NAME,
+ TypeId: PCWNF_TYPE_ID,
+ ExplicitScope: *const VOID,
+ ChangeStamp: PWNF_CHANGE_STAMP,
+ Buffer: PVOID,
+ BufferSize: PULONG,
+ ) -> NTSTATUS;
+ fn NtQueryWnfStateNameInformation(
+ StateName: PCWNF_STATE_NAME,
+ NameInfoClass: WNF_STATE_NAME_INFORMATION,
+ ExplicitScope: *const VOID,
+ InfoBuffer: PVOID,
+ InfoBufferSize: ULONG,
+ ) -> NTSTATUS;
+ fn NtSubscribeWnfStateChange(
+ StateName: PCWNF_STATE_NAME,
+ ChangeStamp: WNF_CHANGE_STAMP,
+ EventMask: ULONG,
+ SubscriptionId: PULONG64,
+ ) -> NTSTATUS;
+ fn NtUnsubscribeWnfStateChange(
+ StateName: PCWNF_STATE_NAME,
+ ) -> NTSTATUS;
+ fn NtGetCompleteWnfStateSubscription(
+ OldDescriptorStateName: PWNF_STATE_NAME,
+ OldSubscriptionId: *mut ULONG64,
+ OldDescriptorEventMask: ULONG,
+ OldDescriptorStatus: ULONG,
+ NewDeliveryDescriptor: PWNF_DELIVERY_DESCRIPTOR,
+ DescriptorSize: ULONG,
+ ) -> NTSTATUS;
+ fn NtSetWnfProcessNotificationEvent(
+ NotificationEvent: HANDLE,
+ ) -> NTSTATUS;
+}}
+pub const WORKER_FACTORY_RELEASE_WORKER: u32 = 0x0001;
+pub const WORKER_FACTORY_WAIT: u32 = 0x0002;
+pub const WORKER_FACTORY_SET_INFORMATION: u32 = 0x0004;
+pub const WORKER_FACTORY_QUERY_INFORMATION: u32 = 0x0008;
+pub const WORKER_FACTORY_READY_WORKER: u32 = 0x0010;
+pub const WORKER_FACTORY_SHUTDOWN: u32 = 0x0020;
+pub const WORKER_FACTORY_ALL_ACCESS: ACCESS_MASK = STANDARD_RIGHTS_REQUIRED
+ | WORKER_FACTORY_RELEASE_WORKER | WORKER_FACTORY_WAIT | WORKER_FACTORY_SET_INFORMATION
+ | WORKER_FACTORY_QUERY_INFORMATION | WORKER_FACTORY_READY_WORKER | WORKER_FACTORY_SHUTDOWN;
+ENUM!{enum WORKERFACTORYINFOCLASS {
+ WorkerFactoryTimeout = 0,
+ WorkerFactoryRetryTimeout = 1,
+ WorkerFactoryIdleTimeout = 2,
+ WorkerFactoryBindingCount = 3,
+ WorkerFactoryThreadMinimum = 4,
+ WorkerFactoryThreadMaximum = 5,
+ WorkerFactoryPaused = 6,
+ WorkerFactoryBasicInformation = 7,
+ WorkerFactoryAdjustThreadGoal = 8,
+ WorkerFactoryCallbackType = 9,
+ WorkerFactoryStackInformation = 10,
+ WorkerFactoryThreadBasePriority = 11,
+ WorkerFactoryTimeoutWaiters = 12,
+ WorkerFactoryFlags = 13,
+ WorkerFactoryThreadSoftMaximum = 14,
+ MaxWorkerFactoryInfoClass = 15,
+}}
+pub type PWORKERFACTORYINFOCLASS = *mut WORKERFACTORYINFOCLASS;
+STRUCT!{struct WORKER_FACTORY_BASIC_INFORMATION {
+ Timeout: LARGE_INTEGER,
+ RetryTimeout: LARGE_INTEGER,
+ IdleTimeout: LARGE_INTEGER,
+ Paused: BOOLEAN,
+ TimerSet: BOOLEAN,
+ QueuedToExWorker: BOOLEAN,
+ MayCreate: BOOLEAN,
+ CreateInProgress: BOOLEAN,
+ InsertedIntoQueue: BOOLEAN,
+ Shutdown: BOOLEAN,
+ BindingCount: ULONG,
+ ThreadMinimum: ULONG,
+ ThreadMaximum: ULONG,
+ PendingWorkerCount: ULONG,
+ WaitingWorkerCount: ULONG,
+ TotalWorkerCount: ULONG,
+ ReleaseCount: ULONG,
+ InfiniteWaitGoal: LONGLONG,
+ StartRoutine: PVOID,
+ StartParameter: PVOID,
+ ProcessId: HANDLE,
+ StackReserve: SIZE_T,
+ StackCommit: SIZE_T,
+ LastThreadCreationStatus: NTSTATUS,
+}}
+pub type PWORKER_FACTORY_BASIC_INFORMATION = *mut WORKER_FACTORY_BASIC_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtCreateWorkerFactory(
+ WorkerFactoryHandleReturn: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ CompletionPortHandle: HANDLE,
+ WorkerProcessHandle: HANDLE,
+ StartRoutine: PVOID,
+ StartParameter: PVOID,
+ MaxThreadCount: ULONG,
+ StackReserve: SIZE_T,
+ StackCommit: SIZE_T,
+ ) -> NTSTATUS;
+ fn NtQueryInformationWorkerFactory(
+ WorkerFactoryHandle: HANDLE,
+ WorkerFactoryInformationClass: WORKERFACTORYINFOCLASS,
+ WorkerFactoryInformation: PVOID,
+ WorkerFactoryInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetInformationWorkerFactory(
+ WorkerFactoryHandle: HANDLE,
+ WorkerFactoryInformationClass: WORKERFACTORYINFOCLASS,
+ WorkerFactoryInformation: PVOID,
+ WorkerFactoryInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtShutdownWorkerFactory(
+ WorkerFactoryHandle: HANDLE,
+ PendingWorkerCount: *mut LONG,
+ ) -> NTSTATUS;
+ fn NtReleaseWorkerFactoryWorker(
+ WorkerFactoryHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtWorkerFactoryWorkerReady(
+ WorkerFactoryHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtWaitForWorkViaWorkerFactory(
+ WorkerFactoryHandle: HANDLE,
+ MiniPacket: *mut FILE_IO_COMPLETION_INFORMATION,
+ ) -> NTSTATUS;
+ fn NtQuerySystemTime(
+ SystemTime: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtSetSystemTime(
+ SystemTime: PLARGE_INTEGER,
+ PreviousTime: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtQueryTimerResolution(
+ MaximumTime: PULONG,
+ MinimumTime: PULONG,
+ CurrentTime: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetTimerResolution(
+ DesiredTime: ULONG,
+ SetResolution: BOOLEAN,
+ ActualTime: PULONG,
+ ) -> NTSTATUS;
+ fn NtQueryPerformanceCounter(
+ PerformanceCounter: PLARGE_INTEGER,
+ PerformanceFrequency: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtAllocateLocallyUniqueId(
+ Luid: PLUID,
+ ) -> NTSTATUS;
+ fn NtSetUuidSeed(
+ Seed: PCHAR,
+ ) -> NTSTATUS;
+ fn NtAllocateUuids(
+ Time: PULARGE_INTEGER,
+ Range: PULONG,
+ Sequence: PULONG,
+ Seed: PCHAR,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum SYSTEM_INFORMATION_CLASS {
+ SystemBasicInformation = 0,
+ SystemProcessorInformation = 1,
+ SystemPerformanceInformation = 2,
+ SystemTimeOfDayInformation = 3,
+ SystemPathInformation = 4,
+ SystemProcessInformation = 5,
+ SystemCallCountInformation = 6,
+ SystemDeviceInformation = 7,
+ SystemProcessorPerformanceInformation = 8,
+ SystemFlagsInformation = 9,
+ SystemCallTimeInformation = 10,
+ SystemModuleInformation = 11,
+ SystemLocksInformation = 12,
+ SystemStackTraceInformation = 13,
+ SystemPagedPoolInformation = 14,
+ SystemNonPagedPoolInformation = 15,
+ SystemHandleInformation = 16,
+ SystemObjectInformation = 17,
+ SystemPageFileInformation = 18,
+ SystemVdmInstemulInformation = 19,
+ SystemVdmBopInformation = 20,
+ SystemFileCacheInformation = 21,
+ SystemPoolTagInformation = 22,
+ SystemInterruptInformation = 23,
+ SystemDpcBehaviorInformation = 24,
+ SystemFullMemoryInformation = 25,
+ SystemLoadGdiDriverInformation = 26,
+ SystemUnloadGdiDriverInformation = 27,
+ SystemTimeAdjustmentInformation = 28,
+ SystemSummaryMemoryInformation = 29,
+ SystemMirrorMemoryInformation = 30,
+ SystemPerformanceTraceInformation = 31,
+ SystemObsolete0 = 32,
+ SystemExceptionInformation = 33,
+ SystemCrashDumpStateInformation = 34,
+ SystemKernelDebuggerInformation = 35,
+ SystemContextSwitchInformation = 36,
+ SystemRegistryQuotaInformation = 37,
+ SystemExtendServiceTableInformation = 38,
+ SystemPrioritySeperation = 39,
+ SystemVerifierAddDriverInformation = 40,
+ SystemVerifierRemoveDriverInformation = 41,
+ SystemProcessorIdleInformation = 42,
+ SystemLegacyDriverInformation = 43,
+ SystemCurrentTimeZoneInformation = 44,
+ SystemLookasideInformation = 45,
+ SystemTimeSlipNotification = 46,
+ SystemSessionCreate = 47,
+ SystemSessionDetach = 48,
+ SystemSessionInformation = 49,
+ SystemRangeStartInformation = 50,
+ SystemVerifierInformation = 51,
+ SystemVerifierThunkExtend = 52,
+ SystemSessionProcessInformation = 53,
+ SystemLoadGdiDriverInSystemSpace = 54,
+ SystemNumaProcessorMap = 55,
+ SystemPrefetcherInformation = 56,
+ SystemExtendedProcessInformation = 57,
+ SystemRecommendedSharedDataAlignment = 58,
+ SystemComPlusPackage = 59,
+ SystemNumaAvailableMemory = 60,
+ SystemProcessorPowerInformation = 61,
+ SystemEmulationBasicInformation = 62,
+ SystemEmulationProcessorInformation = 63,
+ SystemExtendedHandleInformation = 64,
+ SystemLostDelayedWriteInformation = 65,
+ SystemBigPoolInformation = 66,
+ SystemSessionPoolTagInformation = 67,
+ SystemSessionMappedViewInformation = 68,
+ SystemHotpatchInformation = 69,
+ SystemObjectSecurityMode = 70,
+ SystemWatchdogTimerHandler = 71,
+ SystemWatchdogTimerInformation = 72,
+ SystemLogicalProcessorInformation = 73,
+ SystemWow64SharedInformationObsolete = 74,
+ SystemRegisterFirmwareTableInformationHandler = 75,
+ SystemFirmwareTableInformation = 76,
+ SystemModuleInformationEx = 77,
+ SystemVerifierTriageInformation = 78,
+ SystemSuperfetchInformation = 79,
+ SystemMemoryListInformation = 80,
+ SystemFileCacheInformationEx = 81,
+ SystemThreadPriorityClientIdInformation = 82,
+ SystemProcessorIdleCycleTimeInformation = 83,
+ SystemVerifierCancellationInformation = 84,
+ SystemProcessorPowerInformationEx = 85,
+ SystemRefTraceInformation = 86,
+ SystemSpecialPoolInformation = 87,
+ SystemProcessIdInformation = 88,
+ SystemErrorPortInformation = 89,
+ SystemBootEnvironmentInformation = 90,
+ SystemHypervisorInformation = 91,
+ SystemVerifierInformationEx = 92,
+ SystemTimeZoneInformation = 93,
+ SystemImageFileExecutionOptionsInformation = 94,
+ SystemCoverageInformation = 95,
+ SystemPrefetchPatchInformation = 96,
+ SystemVerifierFaultsInformation = 97,
+ SystemSystemPartitionInformation = 98,
+ SystemSystemDiskInformation = 99,
+ SystemProcessorPerformanceDistribution = 100,
+ SystemNumaProximityNodeInformation = 101,
+ SystemDynamicTimeZoneInformation = 102,
+ SystemCodeIntegrityInformation = 103,
+ SystemProcessorMicrocodeUpdateInformation = 104,
+ SystemProcessorBrandString = 105,
+ SystemVirtualAddressInformation = 106,
+ SystemLogicalProcessorAndGroupInformation = 107,
+ SystemProcessorCycleTimeInformation = 108,
+ SystemStoreInformation = 109,
+ SystemRegistryAppendString = 110,
+ SystemAitSamplingValue = 111,
+ SystemVhdBootInformation = 112,
+ SystemCpuQuotaInformation = 113,
+ SystemNativeBasicInformation = 114,
+ SystemSpare1 = 115,
+ SystemLowPriorityIoInformation = 116,
+ SystemTpmBootEntropyInformation = 117,
+ SystemVerifierCountersInformation = 118,
+ SystemPagedPoolInformationEx = 119,
+ SystemSystemPtesInformationEx = 120,
+ SystemNodeDistanceInformation = 121,
+ SystemAcpiAuditInformation = 122,
+ SystemBasicPerformanceInformation = 123,
+ SystemQueryPerformanceCounterInformation = 124,
+ SystemSessionBigPoolInformation = 125,
+ SystemBootGraphicsInformation = 126,
+ SystemScrubPhysicalMemoryInformation = 127,
+ SystemBadPageInformation = 128,
+ SystemProcessorProfileControlArea = 129,
+ SystemCombinePhysicalMemoryInformation = 130,
+ SystemEntropyInterruptTimingCallback = 131,
+ SystemConsoleInformation = 132,
+ SystemPlatformBinaryInformation = 133,
+ SystemThrottleNotificationInformation = 134,
+ SystemHypervisorProcessorCountInformation = 135,
+ SystemDeviceDataInformation = 136,
+ SystemDeviceDataEnumerationInformation = 137,
+ SystemMemoryTopologyInformation = 138,
+ SystemMemoryChannelInformation = 139,
+ SystemBootLogoInformation = 140,
+ SystemProcessorPerformanceInformationEx = 141,
+ SystemSpare0 = 142,
+ SystemSecureBootPolicyInformation = 143,
+ SystemPageFileInformationEx = 144,
+ SystemSecureBootInformation = 145,
+ SystemEntropyInterruptTimingRawInformation = 146,
+ SystemPortableWorkspaceEfiLauncherInformation = 147,
+ SystemFullProcessInformation = 148,
+ SystemKernelDebuggerInformationEx = 149,
+ SystemBootMetadataInformation = 150,
+ SystemSoftRebootInformation = 151,
+ SystemElamCertificateInformation = 152,
+ SystemOfflineDumpConfigInformation = 153,
+ SystemProcessorFeaturesInformation = 154,
+ SystemRegistryReconciliationInformation = 155,
+ SystemEdidInformation = 156,
+ SystemManufacturingInformation = 157,
+ SystemEnergyEstimationConfigInformation = 158,
+ SystemHypervisorDetailInformation = 159,
+ SystemProcessorCycleStatsInformation = 160,
+ SystemVmGenerationCountInformation = 161,
+ SystemTrustedPlatformModuleInformation = 162,
+ SystemKernelDebuggerFlags = 163,
+ SystemCodeIntegrityPolicyInformation = 164,
+ SystemIsolatedUserModeInformation = 165,
+ SystemHardwareSecurityTestInterfaceResultsInformation = 166,
+ SystemSingleModuleInformation = 167,
+ SystemAllowedCpuSetsInformation = 168,
+ SystemVsmProtectionInformation = 169,
+ SystemInterruptCpuSetsInformation = 170,
+ SystemSecureBootPolicyFullInformation = 171,
+ SystemCodeIntegrityPolicyFullInformation = 172,
+ SystemAffinitizedInterruptProcessorInformation = 173,
+ SystemRootSiloInformation = 174,
+ SystemCpuSetInformation = 175,
+ SystemCpuSetTagInformation = 176,
+ SystemWin32WerStartCallout = 177,
+ SystemSecureKernelProfileInformation = 178,
+ SystemCodeIntegrityPlatformManifestInformation = 179,
+ SystemInterruptSteeringInformation = 180,
+ SystemSupportedProcessorArchitectures = 181,
+ SystemMemoryUsageInformation = 182,
+ SystemCodeIntegrityCertificateInformation = 183,
+ SystemPhysicalMemoryInformation = 184,
+ SystemControlFlowTransition = 185,
+ SystemKernelDebuggingAllowed = 186,
+ SystemActivityModerationExeState = 187,
+ SystemActivityModerationUserSettings = 188,
+ SystemCodeIntegrityPoliciesFullInformation = 189,
+ SystemCodeIntegrityUnlockInformation = 190,
+ SystemIntegrityQuotaInformation = 191,
+ SystemFlushInformation = 192,
+ SystemProcessorIdleMaskInformation = 193,
+ SystemSecureDumpEncryptionInformation = 194,
+ SystemWriteConstraintInformation = 195,
+ SystemKernelVaShadowInformation = 196,
+ SystemHypervisorSharedPageInformation = 197,
+ SystemFirmwareBootPerformanceInformation = 198,
+ SystemCodeIntegrityVerificationInformation = 199,
+ SystemFirmwarePartitionInformation = 200,
+ SystemSpeculationControlInformation = 201,
+ SystemDmaGuardPolicyInformation = 202,
+ SystemEnclaveLaunchControlInformation = 203,
+ SystemWorkloadAllowedCpuSetsInformation = 204,
+ SystemCodeIntegrityUnlockModeInformation = 205,
+ SystemLeapSecondInformation = 206,
+ SystemFlags2Information = 207,
+ MaxSystemInfoClass = 208,
+}}
+STRUCT!{struct SYSTEM_BASIC_INFORMATION {
+ Reserved: ULONG,
+ TimerResolution: ULONG,
+ PageSize: ULONG,
+ NumberOfPhysicalPages: ULONG,
+ LowestPhysicalPageNumber: ULONG,
+ HighestPhysicalPageNumber: ULONG,
+ AllocationGranularity: ULONG,
+ MinimumUserModeAddress: ULONG_PTR,
+ MaximumUserModeAddress: ULONG_PTR,
+ ActiveProcessorsAffinityMask: ULONG_PTR,
+ NumberOfProcessors: CCHAR,
+}}
+pub type PSYSTEM_BASIC_INFORMATION = *mut SYSTEM_BASIC_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_INFORMATION {
+ ProcessorArchitecture: USHORT,
+ ProcessorLevel: USHORT,
+ ProcessorRevision: USHORT,
+ MaximumProcessors: USHORT,
+ ProcessorFeatureBits: ULONG,
+}}
+pub type PSYSTEM_PROCESSOR_INFORMATION = *mut SYSTEM_PROCESSOR_INFORMATION;
+STRUCT!{struct SYSTEM_PERFORMANCE_INFORMATION {
+ IdleProcessTime: LARGE_INTEGER,
+ IoReadTransferCount: LARGE_INTEGER,
+ IoWriteTransferCount: LARGE_INTEGER,
+ IoOtherTransferCount: LARGE_INTEGER,
+ IoReadOperationCount: ULONG,
+ IoWriteOperationCount: ULONG,
+ IoOtherOperationCount: ULONG,
+ AvailablePages: ULONG,
+ CommittedPages: ULONG,
+ CommitLimit: ULONG,
+ PeakCommitment: ULONG,
+ PageFaultCount: ULONG,
+ CopyOnWriteCount: ULONG,
+ TransitionCount: ULONG,
+ CacheTransitionCount: ULONG,
+ DemandZeroCount: ULONG,
+ PageReadCount: ULONG,
+ PageReadIoCount: ULONG,
+ CacheReadCount: ULONG,
+ CacheIoCount: ULONG,
+ DirtyPagesWriteCount: ULONG,
+ DirtyWriteIoCount: ULONG,
+ MappedPagesWriteCount: ULONG,
+ MappedWriteIoCount: ULONG,
+ PagedPoolPages: ULONG,
+ NonPagedPoolPages: ULONG,
+ PagedPoolAllocs: ULONG,
+ PagedPoolFrees: ULONG,
+ NonPagedPoolAllocs: ULONG,
+ NonPagedPoolFrees: ULONG,
+ FreeSystemPtes: ULONG,
+ ResidentSystemCodePage: ULONG,
+ TotalSystemDriverPages: ULONG,
+ TotalSystemCodePages: ULONG,
+ NonPagedPoolLookasideHits: ULONG,
+ PagedPoolLookasideHits: ULONG,
+ AvailablePagedPoolPages: ULONG,
+ ResidentSystemCachePage: ULONG,
+ ResidentPagedPoolPage: ULONG,
+ ResidentSystemDriverPage: ULONG,
+ CcFastReadNoWait: ULONG,
+ CcFastReadWait: ULONG,
+ CcFastReadResourceMiss: ULONG,
+ CcFastReadNotPossible: ULONG,
+ CcFastMdlReadNoWait: ULONG,
+ CcFastMdlReadWait: ULONG,
+ CcFastMdlReadResourceMiss: ULONG,
+ CcFastMdlReadNotPossible: ULONG,
+ CcMapDataNoWait: ULONG,
+ CcMapDataWait: ULONG,
+ CcMapDataNoWaitMiss: ULONG,
+ CcMapDataWaitMiss: ULONG,
+ CcPinMappedDataCount: ULONG,
+ CcPinReadNoWait: ULONG,
+ CcPinReadWait: ULONG,
+ CcPinReadNoWaitMiss: ULONG,
+ CcPinReadWaitMiss: ULONG,
+ CcCopyReadNoWait: ULONG,
+ CcCopyReadWait: ULONG,
+ CcCopyReadNoWaitMiss: ULONG,
+ CcCopyReadWaitMiss: ULONG,
+ CcMdlReadNoWait: ULONG,
+ CcMdlReadWait: ULONG,
+ CcMdlReadNoWaitMiss: ULONG,
+ CcMdlReadWaitMiss: ULONG,
+ CcReadAheadIos: ULONG,
+ CcLazyWriteIos: ULONG,
+ CcLazyWritePages: ULONG,
+ CcDataFlushes: ULONG,
+ CcDataPages: ULONG,
+ ContextSwitches: ULONG,
+ FirstLevelTbFills: ULONG,
+ SecondLevelTbFills: ULONG,
+ SystemCalls: ULONG,
+ CcTotalDirtyPages: ULONGLONG,
+ CcDirtyPageThreshold: ULONGLONG,
+ ResidentAvailablePages: LONGLONG,
+ SharedCommittedPages: ULONGLONG,
+}}
+pub type PSYSTEM_PERFORMANCE_INFORMATION = *mut SYSTEM_PERFORMANCE_INFORMATION;
+STRUCT!{struct SYSTEM_TIMEOFDAY_INFORMATION {
+ BootTime: LARGE_INTEGER,
+ CurrentTime: LARGE_INTEGER,
+ TimeZoneBias: LARGE_INTEGER,
+ TimeZoneId: ULONG,
+ Reserved: ULONG,
+ BootTimeBias: ULONGLONG,
+ SleepTimeBias: ULONGLONG,
+}}
+pub type PSYSTEM_TIMEOFDAY_INFORMATION = *mut SYSTEM_TIMEOFDAY_INFORMATION;
+STRUCT!{struct SYSTEM_THREAD_INFORMATION {
+ KernelTime: LARGE_INTEGER,
+ UserTime: LARGE_INTEGER,
+ CreateTime: LARGE_INTEGER,
+ WaitTime: ULONG,
+ StartAddress: PVOID,
+ ClientId: CLIENT_ID,
+ Priority: KPRIORITY,
+ BasePriority: LONG,
+ ContextSwitches: ULONG,
+ ThreadState: KTHREAD_STATE,
+ WaitReason: KWAIT_REASON,
+}}
+pub type PSYSTEM_THREAD_INFORMATION = *mut SYSTEM_THREAD_INFORMATION;
+STRUCT!{struct SYSTEM_EXTENDED_THREAD_INFORMATION {
+ ThreadInfo: SYSTEM_THREAD_INFORMATION,
+ StackBase: PVOID,
+ StackLimit: PVOID,
+ Win32StartAddress: PVOID,
+ TebBase: PTEB,
+ Reserved2: ULONG_PTR,
+ Reserved3: ULONG_PTR,
+ Reserved4: ULONG_PTR,
+}}
+pub type PSYSTEM_EXTENDED_THREAD_INFORMATION = *mut SYSTEM_EXTENDED_THREAD_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESS_INFORMATION {
+ NextEntryOffset: ULONG,
+ NumberOfThreads: ULONG,
+ WorkingSetPrivateSize: LARGE_INTEGER,
+ HardFaultCount: ULONG,
+ NumberOfThreadsHighWatermark: ULONG,
+ CycleTime: ULONGLONG,
+ CreateTime: LARGE_INTEGER,
+ UserTime: LARGE_INTEGER,
+ KernelTime: LARGE_INTEGER,
+ ImageName: UNICODE_STRING,
+ BasePriority: KPRIORITY,
+ UniqueProcessId: HANDLE,
+ InheritedFromUniqueProcessId: HANDLE,
+ HandleCount: ULONG,
+ SessionId: ULONG,
+ UniqueProcessKey: ULONG_PTR,
+ PeakVirtualSize: SIZE_T,
+ VirtualSize: SIZE_T,
+ PageFaultCount: ULONG,
+ PeakWorkingSetSize: SIZE_T,
+ WorkingSetSize: SIZE_T,
+ QuotaPeakPagedPoolUsage: SIZE_T,
+ QuotaPagedPoolUsage: SIZE_T,
+ QuotaPeakNonPagedPoolUsage: SIZE_T,
+ QuotaNonPagedPoolUsage: SIZE_T,
+ PagefileUsage: SIZE_T,
+ PeakPagefileUsage: SIZE_T,
+ PrivatePageCount: SIZE_T,
+ ReadOperationCount: LARGE_INTEGER,
+ WriteOperationCount: LARGE_INTEGER,
+ OtherOperationCount: LARGE_INTEGER,
+ ReadTransferCount: LARGE_INTEGER,
+ WriteTransferCount: LARGE_INTEGER,
+ OtherTransferCount: LARGE_INTEGER,
+ Threads: [SYSTEM_THREAD_INFORMATION; 1],
+}}
+pub type PSYSTEM_PROCESS_INFORMATION = *mut SYSTEM_PROCESS_INFORMATION;
+STRUCT!{struct SYSTEM_CALL_COUNT_INFORMATION {
+ Length: ULONG,
+ NumberOfTables: ULONG,
+}}
+pub type PSYSTEM_CALL_COUNT_INFORMATION = *mut SYSTEM_CALL_COUNT_INFORMATION;
+STRUCT!{struct SYSTEM_DEVICE_INFORMATION {
+ NumberOfDisks: ULONG,
+ NumberOfFloppies: ULONG,
+ NumberOfCdRoms: ULONG,
+ NumberOfTapes: ULONG,
+ NumberOfSerialPorts: ULONG,
+ NumberOfParallelPorts: ULONG,
+}}
+pub type PSYSTEM_DEVICE_INFORMATION = *mut SYSTEM_DEVICE_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION {
+ IdleTime: LARGE_INTEGER,
+ KernelTime: LARGE_INTEGER,
+ UserTime: LARGE_INTEGER,
+ DpcTime: LARGE_INTEGER,
+ InterruptTime: LARGE_INTEGER,
+ InterruptCount: ULONG,
+}}
+pub type PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = *mut SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;
+STRUCT!{struct SYSTEM_FLAGS_INFORMATION {
+ Flags: ULONG,
+}}
+pub type PSYSTEM_FLAGS_INFORMATION = *mut SYSTEM_FLAGS_INFORMATION;
+STRUCT!{struct SYSTEM_CALL_TIME_INFORMATION {
+ Length: ULONG,
+ TotalCalls: ULONG,
+ TimeOfCalls: [LARGE_INTEGER; 1],
+}}
+pub type PSYSTEM_CALL_TIME_INFORMATION = *mut SYSTEM_CALL_TIME_INFORMATION;
+STRUCT!{struct RTL_PROCESS_LOCK_INFORMATION {
+ Address: PVOID,
+ Type: USHORT,
+ CreatorBackTraceIndex: USHORT,
+ OwningThread: HANDLE,
+ LockCount: LONG,
+ ContentionCount: ULONG,
+ EntryCount: ULONG,
+ RecursionCount: LONG,
+ NumberOfWaitingShared: ULONG,
+ NumberOfWaitingExclusive: ULONG,
+}}
+pub type PRTL_PROCESS_LOCK_INFORMATION = *mut RTL_PROCESS_LOCK_INFORMATION;
+STRUCT!{struct RTL_PROCESS_LOCKS {
+ NumberOfLocks: ULONG,
+ Locks: [RTL_PROCESS_LOCK_INFORMATION; 1],
+}}
+pub type PRTL_PROCESS_LOCKS = *mut RTL_PROCESS_LOCKS;
+STRUCT!{struct RTL_PROCESS_BACKTRACE_INFORMATION {
+ SymbolicBackTrace: PCHAR,
+ TraceCount: ULONG,
+ Index: USHORT,
+ Depth: USHORT,
+ BackTrace: [PVOID; 32],
+}}
+pub type PRTL_PROCESS_BACKTRACE_INFORMATION = *mut RTL_PROCESS_BACKTRACE_INFORMATION;
+STRUCT!{struct RTL_PROCESS_BACKTRACES {
+ CommittedMemory: ULONG,
+ ReservedMemory: ULONG,
+ NumberOfBackTraceLookups: ULONG,
+ NumberOfBackTraces: ULONG,
+ BackTraces: [RTL_PROCESS_BACKTRACE_INFORMATION; 1],
+}}
+pub type PRTL_PROCESS_BACKTRACES = *mut RTL_PROCESS_BACKTRACES;
+STRUCT!{struct SYSTEM_HANDLE_TABLE_ENTRY_INFO {
+ UniqueProcessId: USHORT,
+ CreatorBackTraceIndex: USHORT,
+ ObjectTypeIndex: UCHAR,
+ HandleAttributes: UCHAR,
+ HandleValue: USHORT,
+ Object: PVOID,
+ GrantedAccess: ULONG,
+}}
+pub type PSYSTEM_HANDLE_TABLE_ENTRY_INFO = *mut SYSTEM_HANDLE_TABLE_ENTRY_INFO;
+STRUCT!{struct SYSTEM_HANDLE_INFORMATION {
+ NumberOfHandles: ULONG,
+ Handles: [SYSTEM_HANDLE_TABLE_ENTRY_INFO; 1],
+}}
+pub type PSYSTEM_HANDLE_INFORMATION = *mut SYSTEM_HANDLE_INFORMATION;
+STRUCT!{struct SYSTEM_OBJECTTYPE_INFORMATION {
+ NextEntryOffset: ULONG,
+ NumberOfObjects: ULONG,
+ NumberOfHandles: ULONG,
+ TypeIndex: ULONG,
+ InvalidAttributes: ULONG,
+ GenericMapping: GENERIC_MAPPING,
+ ValidAccessMask: ULONG,
+ PoolType: ULONG,
+ SecurityRequired: BOOLEAN,
+ WaitableObject: BOOLEAN,
+ TypeName: UNICODE_STRING,
+}}
+pub type PSYSTEM_OBJECTTYPE_INFORMATION = *mut SYSTEM_OBJECTTYPE_INFORMATION;
+STRUCT!{struct SYSTEM_OBJECT_INFORMATION {
+ NextEntryOffset: ULONG,
+ Object: PVOID,
+ CreatorUniqueProcess: HANDLE,
+ CreatorBackTraceIndex: USHORT,
+ Flags: USHORT,
+ PointerCount: LONG,
+ HandleCount: LONG,
+ PagedPoolCharge: ULONG,
+ NonPagedPoolCharge: ULONG,
+ ExclusiveProcessId: HANDLE,
+ SecurityDescriptor: PVOID,
+ NameInfo: UNICODE_STRING,
+}}
+pub type PSYSTEM_OBJECT_INFORMATION = *mut SYSTEM_OBJECT_INFORMATION;
+STRUCT!{struct SYSTEM_PAGEFILE_INFORMATION {
+ NextEntryOffset: ULONG,
+ TotalSize: ULONG,
+ TotalInUse: ULONG,
+ PeakUsage: ULONG,
+ PageFileName: UNICODE_STRING,
+}}
+pub type PSYSTEM_PAGEFILE_INFORMATION = *mut SYSTEM_PAGEFILE_INFORMATION;
+pub const MM_WORKING_SET_MAX_HARD_ENABLE: ULONG = 0x1;
+pub const MM_WORKING_SET_MAX_HARD_DISABLE: ULONG = 0x2;
+pub const MM_WORKING_SET_MIN_HARD_ENABLE: ULONG = 0x4;
+pub const MM_WORKING_SET_MIN_HARD_DISABLE: ULONG = 0x8;
+STRUCT!{struct SYSTEM_FILECACHE_INFORMATION {
+ CurrentSize: SIZE_T,
+ PeakSize: SIZE_T,
+ PageFaultCount: ULONG,
+ MinimumWorkingSet: SIZE_T,
+ MaximumWorkingSet: SIZE_T,
+ CurrentSizeIncludingTransitionInPages: SIZE_T,
+ PeakSizeIncludingTransitionInPages: SIZE_T,
+ TransitionRePurposeCount: ULONG,
+ Flags: ULONG,
+}}
+pub type PSYSTEM_FILECACHE_INFORMATION = *mut SYSTEM_FILECACHE_INFORMATION;
+STRUCT!{struct SYSTEM_BASIC_WORKING_SET_INFORMATION {
+ CurrentSize: SIZE_T,
+ PeakSize: SIZE_T,
+ PageFaultCount: ULONG,
+}}
+pub type PSYSTEM_BASIC_WORKING_SET_INFORMATION = *mut SYSTEM_BASIC_WORKING_SET_INFORMATION;
+UNION!{union SYSTEM_POOLTAG_u {
+ Tag: [UCHAR; 4],
+ TagUlong: ULONG,
+}}
+STRUCT!{struct SYSTEM_POOLTAG {
+ u: SYSTEM_POOLTAG_u,
+ PagedAllocs: ULONG,
+ PagedFrees: ULONG,
+ PagedUsed: SIZE_T,
+ NonPagedAllocs: ULONG,
+ NonPagedFrees: ULONG,
+ NonPagedUsed: SIZE_T,
+}}
+pub type PSYSTEM_POOLTAG = *mut SYSTEM_POOLTAG;
+STRUCT!{struct SYSTEM_POOLTAG_INFORMATION {
+ Count: ULONG,
+ TagInfo: [SYSTEM_POOLTAG; 1],
+}}
+pub type PSYSTEM_POOLTAG_INFORMATION = *mut SYSTEM_POOLTAG_INFORMATION;
+STRUCT!{struct SYSTEM_INTERRUPT_INFORMATION {
+ ContextSwitches: ULONG,
+ DpcCount: ULONG,
+ DpcRate: ULONG,
+ TimeIncrement: ULONG,
+ DpcBypassCount: ULONG,
+ ApcBypassCount: ULONG,
+}}
+pub type PSYSTEM_INTERRUPT_INFORMATION = *mut SYSTEM_INTERRUPT_INFORMATION;
+STRUCT!{struct SYSTEM_DPC_BEHAVIOR_INFORMATION {
+ Spare: ULONG,
+ DpcQueueDepth: ULONG,
+ MinimumDpcRate: ULONG,
+ AdjustDpcThreshold: ULONG,
+ IdealDpcRate: ULONG,
+}}
+pub type PSYSTEM_DPC_BEHAVIOR_INFORMATION = *mut SYSTEM_DPC_BEHAVIOR_INFORMATION;
+STRUCT!{struct SYSTEM_QUERY_TIME_ADJUST_INFORMATION {
+ TimeAdjustment: ULONG,
+ TimeIncrement: ULONG,
+ Enable: BOOLEAN,
+}}
+pub type PSYSTEM_QUERY_TIME_ADJUST_INFORMATION = *mut SYSTEM_QUERY_TIME_ADJUST_INFORMATION;
+STRUCT!{struct SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE {
+ TimeAdjustment: ULONGLONG,
+ TimeIncrement: ULONGLONG,
+ Enable: BOOLEAN,
+}}
+pub type PSYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE =
+ *mut SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE;
+STRUCT!{struct SYSTEM_SET_TIME_ADJUST_INFORMATION {
+ TimeAdjustment: ULONG,
+ Enable: BOOLEAN,
+}}
+pub type PSYSTEM_SET_TIME_ADJUST_INFORMATION = *mut SYSTEM_SET_TIME_ADJUST_INFORMATION;
+STRUCT!{struct SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE {
+ TimeAdjustment: ULONGLONG,
+ Enable: BOOLEAN,
+}}
+pub type PSYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE =
+ *mut SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE;
+ENUM!{enum EVENT_TRACE_INFORMATION_CLASS {
+ EventTraceKernelVersionInformation = 0,
+ EventTraceGroupMaskInformation = 1,
+ EventTracePerformanceInformation = 2,
+ EventTraceTimeProfileInformation = 3,
+ EventTraceSessionSecurityInformation = 4,
+ EventTraceSpinlockInformation = 5,
+ EventTraceStackTracingInformation = 6,
+ EventTraceExecutiveResourceInformation = 7,
+ EventTraceHeapTracingInformation = 8,
+ EventTraceHeapSummaryTracingInformation = 9,
+ EventTracePoolTagFilterInformation = 10,
+ EventTracePebsTracingInformation = 11,
+ EventTraceProfileConfigInformation = 12,
+ EventTraceProfileSourceListInformation = 13,
+ EventTraceProfileEventListInformation = 14,
+ EventTraceProfileCounterListInformation = 15,
+ EventTraceStackCachingInformation = 16,
+ EventTraceObjectTypeFilterInformation = 17,
+ EventTraceSoftRestartInformation = 18,
+ EventTraceLastBranchConfigurationInformation = 19,
+ EventTraceLastBranchEventListInformation = 20,
+ EventTraceProfileSourceAddInformation = 21,
+ EventTraceProfileSourceRemoveInformation = 22,
+ EventTraceProcessorTraceConfigurationInformation = 23,
+ EventTraceProcessorTraceEventListInformation = 24,
+ EventTraceCoverageSamplerInformation = 25,
+ MaxEventTraceInfoClass = 26,
+}}
+STRUCT!{struct EVENT_TRACE_VERSION_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ EventTraceKernelVersion: ULONG,
+}}
+pub type PEVENT_TRACE_VERSION_INFORMATION = *mut EVENT_TRACE_VERSION_INFORMATION;
+STRUCT!{struct PERFINFO_GROUPMASK {
+ Masks: [ULONG; 8],
+}}
+pub type PPERFINFO_GROUPMASK = *mut PERFINFO_GROUPMASK;
+STRUCT!{struct EVENT_TRACE_GROUPMASK_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ TraceHandle: HANDLE,
+ EventTraceGroupMasks: PERFINFO_GROUPMASK,
+}}
+pub type PEVENT_TRACE_GROUPMASK_INFORMATION = *mut EVENT_TRACE_GROUPMASK_INFORMATION;
+STRUCT!{struct EVENT_TRACE_PERFORMANCE_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ LogfileBytesWritten: LARGE_INTEGER,
+}}
+pub type PEVENT_TRACE_PERFORMANCE_INFORMATION = *mut EVENT_TRACE_PERFORMANCE_INFORMATION;
+STRUCT!{struct EVENT_TRACE_TIME_PROFILE_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ ProfileInterval: ULONG,
+}}
+pub type PEVENT_TRACE_TIME_PROFILE_INFORMATION = *mut EVENT_TRACE_TIME_PROFILE_INFORMATION;
+STRUCT!{struct EVENT_TRACE_SESSION_SECURITY_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ SecurityInformation: ULONG,
+ TraceHandle: HANDLE,
+ SecurityDescriptor: [UCHAR; 1],
+}}
+pub type PEVENT_TRACE_SESSION_SECURITY_INFORMATION = *mut EVENT_TRACE_SESSION_SECURITY_INFORMATION;
+STRUCT!{struct EVENT_TRACE_SPINLOCK_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ SpinLockSpinThreshold: ULONG,
+ SpinLockAcquireSampleRate: ULONG,
+ SpinLockContentionSampleRate: ULONG,
+ SpinLockHoldThreshold: ULONG,
+}}
+pub type PEVENT_TRACE_SPINLOCK_INFORMATION = *mut EVENT_TRACE_SPINLOCK_INFORMATION;
+STRUCT!{struct EVENT_TRACE_SYSTEM_EVENT_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ TraceHandle: HANDLE,
+ HookId: [ULONG; 1],
+}}
+pub type PEVENT_TRACE_SYSTEM_EVENT_INFORMATION = *mut EVENT_TRACE_SYSTEM_EVENT_INFORMATION;
+STRUCT!{struct EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ ReleaseSamplingRate: ULONG,
+ ContentionSamplingRate: ULONG,
+ NumberOfExcessiveTimeouts: ULONG,
+}}
+pub type PEVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION =
+ *mut EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION;
+STRUCT!{struct EVENT_TRACE_HEAP_TRACING_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ ProcessId: ULONG,
+}}
+pub type PEVENT_TRACE_HEAP_TRACING_INFORMATION = *mut EVENT_TRACE_HEAP_TRACING_INFORMATION;
+STRUCT!{struct EVENT_TRACE_TAG_FILTER_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ TraceHandle: HANDLE,
+ Filter: [ULONG; 1],
+}}
+pub type PEVENT_TRACE_TAG_FILTER_INFORMATION = *mut EVENT_TRACE_TAG_FILTER_INFORMATION;
+STRUCT!{struct EVENT_TRACE_PROFILE_COUNTER_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ TraceHandle: HANDLE,
+ ProfileSource: [ULONG; 1],
+}}
+pub type PEVENT_TRACE_PROFILE_COUNTER_INFORMATION = *mut EVENT_TRACE_PROFILE_COUNTER_INFORMATION;
+STRUCT!{struct EVENT_TRACE_PROFILE_LIST_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ Spare: ULONG,
+ Profile: [*mut PROFILE_SOURCE_INFO; 1],
+}}
+pub type PEVENT_TRACE_PROFILE_LIST_INFORMATION = *mut EVENT_TRACE_PROFILE_LIST_INFORMATION;
+STRUCT!{struct EVENT_TRACE_STACK_CACHING_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ TraceHandle: HANDLE,
+ Enabled: BOOLEAN,
+ Reserved: [UCHAR; 3],
+ CacheSize: ULONG,
+ BucketCount: ULONG,
+}}
+pub type PEVENT_TRACE_STACK_CACHING_INFORMATION = *mut EVENT_TRACE_STACK_CACHING_INFORMATION;
+STRUCT!{struct EVENT_TRACE_SOFT_RESTART_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ TraceHandle: HANDLE,
+ PersistTraceBuffers: BOOLEAN,
+ FileName: [WCHAR; 1],
+}}
+pub type PEVENT_TRACE_SOFT_RESTART_INFORMATION = *mut EVENT_TRACE_SOFT_RESTART_INFORMATION;
+STRUCT!{struct EVENT_TRACE_PROFILE_ADD_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ PerfEvtEventSelect: BOOLEAN,
+ PerfEvtUnitSelect: BOOLEAN,
+ PerfEvtType: ULONG,
+ CpuInfoHierarchy: [ULONG; 3],
+ InitialInterval: ULONG,
+ AllowsHalt: BOOLEAN,
+ Persist: BOOLEAN,
+ ProfileSourceDescription: [WCHAR; 1],
+}}
+pub type PEVENT_TRACE_PROFILE_ADD_INFORMATION = *mut EVENT_TRACE_PROFILE_ADD_INFORMATION;
+STRUCT!{struct EVENT_TRACE_PROFILE_REMOVE_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ ProfileSource: KPROFILE_SOURCE,
+ CpuInfoHierarchy: [ULONG; 3],
+}}
+pub type PEVENT_TRACE_PROFILE_REMOVE_INFORMATION = *mut EVENT_TRACE_PROFILE_REMOVE_INFORMATION;
+STRUCT!{struct EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ CoverageSamplerInformationClass: BOOLEAN,
+ MajorVersion: UCHAR,
+ MinorVersion: UCHAR,
+ Reserved: UCHAR,
+ SamplerHandle: HANDLE,
+}}
+pub type PEVENT_TRACE_COVERAGE_SAMPLER_INFORMATION = *mut EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION;
+STRUCT!{struct SYSTEM_EXCEPTION_INFORMATION {
+ AlignmentFixupCount: ULONG,
+ ExceptionDispatchCount: ULONG,
+ FloatingEmulationCount: ULONG,
+ ByteWordEmulationCount: ULONG,
+}}
+pub type PSYSTEM_EXCEPTION_INFORMATION = *mut SYSTEM_EXCEPTION_INFORMATION;
+STRUCT!{struct SYSTEM_KERNEL_DEBUGGER_INFORMATION {
+ KernelDebuggerEnabled: BOOLEAN,
+ KernelDebuggerNotPresent: BOOLEAN,
+}}
+pub type PSYSTEM_KERNEL_DEBUGGER_INFORMATION = *mut SYSTEM_KERNEL_DEBUGGER_INFORMATION;
+STRUCT!{struct SYSTEM_CONTEXT_SWITCH_INFORMATION {
+ ContextSwitches: ULONG,
+ FindAny: ULONG,
+ FindLast: ULONG,
+ FindIdeal: ULONG,
+ IdleAny: ULONG,
+ IdleCurrent: ULONG,
+ IdleLast: ULONG,
+ IdleIdeal: ULONG,
+ PreemptAny: ULONG,
+ PreemptCurrent: ULONG,
+ PreemptLast: ULONG,
+ SwitchToIdle: ULONG,
+}}
+pub type PSYSTEM_CONTEXT_SWITCH_INFORMATION = *mut SYSTEM_CONTEXT_SWITCH_INFORMATION;
+STRUCT!{struct SYSTEM_REGISTRY_QUOTA_INFORMATION {
+ RegistryQuotaAllowed: ULONG,
+ RegistryQuotaUsed: ULONG,
+ PagedPoolSize: SIZE_T,
+}}
+pub type PSYSTEM_REGISTRY_QUOTA_INFORMATION = *mut SYSTEM_REGISTRY_QUOTA_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_IDLE_INFORMATION {
+ IdleTime: ULONGLONG,
+ C1Time: ULONGLONG,
+ C2Time: ULONGLONG,
+ C3Time: ULONGLONG,
+ C1Transitions: ULONG,
+ C2Transitions: ULONG,
+ C3Transitions: ULONG,
+ Padding: ULONG,
+}}
+pub type PSYSTEM_PROCESSOR_IDLE_INFORMATION = *mut SYSTEM_PROCESSOR_IDLE_INFORMATION;
+STRUCT!{struct SYSTEM_LEGACY_DRIVER_INFORMATION {
+ VetoType: ULONG,
+ VetoList: UNICODE_STRING,
+}}
+pub type PSYSTEM_LEGACY_DRIVER_INFORMATION = *mut SYSTEM_LEGACY_DRIVER_INFORMATION;
+STRUCT!{struct SYSTEM_LOOKASIDE_INFORMATION {
+ CurrentDepth: USHORT,
+ MaximumDepth: USHORT,
+ TotalAllocates: ULONG,
+ AllocateMisses: ULONG,
+ TotalFrees: ULONG,
+ FreeMisses: ULONG,
+ Type: ULONG,
+ Tag: ULONG,
+ Size: ULONG,
+}}
+pub type PSYSTEM_LOOKASIDE_INFORMATION = *mut SYSTEM_LOOKASIDE_INFORMATION;
+STRUCT!{struct SYSTEM_RANGE_START_INFORMATION {
+ SystemRangeStart: PVOID,
+}}
+pub type PSYSTEM_RANGE_START_INFORMATION = *mut SYSTEM_RANGE_START_INFORMATION;
+STRUCT!{struct SYSTEM_VERIFIER_INFORMATION {
+ NextEntryOffset: ULONG,
+ Level: ULONG,
+ DriverName: UNICODE_STRING,
+ RaiseIrqls: ULONG,
+ AcquireSpinLocks: ULONG,
+ SynchronizeExecutions: ULONG,
+ AllocationsAttempted: ULONG,
+ AllocationsSucceeded: ULONG,
+ AllocationsSucceededSpecialPool: ULONG,
+ AllocationsWithNoTag: ULONG,
+ TrimRequests: ULONG,
+ Trims: ULONG,
+ AllocationsFailed: ULONG,
+ AllocationsFailedDeliberately: ULONG,
+ Loads: ULONG,
+ Unloads: ULONG,
+ UnTrackedPool: ULONG,
+ CurrentPagedPoolAllocations: ULONG,
+ CurrentNonPagedPoolAllocations: ULONG,
+ PeakPagedPoolAllocations: ULONG,
+ PeakNonPagedPoolAllocations: ULONG,
+ PagedPoolUsageInBytes: SIZE_T,
+ NonPagedPoolUsageInBytes: SIZE_T,
+ PeakPagedPoolUsageInBytes: SIZE_T,
+ PeakNonPagedPoolUsageInBytes: SIZE_T,
+}}
+pub type PSYSTEM_VERIFIER_INFORMATION = *mut SYSTEM_VERIFIER_INFORMATION;
+STRUCT!{struct SYSTEM_SESSION_PROCESS_INFORMATION {
+ SessionId: ULONG,
+ SizeOfBuf: ULONG,
+ Buffer: PVOID,
+}}
+pub type PSYSTEM_SESSION_PROCESS_INFORMATION = *mut SYSTEM_SESSION_PROCESS_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_POWER_INFORMATION {
+ CurrentFrequency: UCHAR,
+ ThermalLimitFrequency: UCHAR,
+ ConstantThrottleFrequency: UCHAR,
+ DegradedThrottleFrequency: UCHAR,
+ LastBusyFrequency: UCHAR,
+ LastC3Frequency: UCHAR,
+ LastAdjustedBusyFrequency: UCHAR,
+ ProcessorMinThrottle: UCHAR,
+ ProcessorMaxThrottle: UCHAR,
+ NumberOfFrequencies: ULONG,
+ PromotionCount: ULONG,
+ DemotionCount: ULONG,
+ ErrorCount: ULONG,
+ RetryCount: ULONG,
+ CurrentFrequencyTime: ULONGLONG,
+ CurrentProcessorTime: ULONGLONG,
+ CurrentProcessorIdleTime: ULONGLONG,
+ LastProcessorTime: ULONGLONG,
+ LastProcessorIdleTime: ULONGLONG,
+ Energy: ULONGLONG,
+}}
+pub type PSYSTEM_PROCESSOR_POWER_INFORMATION = *mut SYSTEM_PROCESSOR_POWER_INFORMATION;
+STRUCT!{struct SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX {
+ Object: PVOID,
+ UniqueProcessId: ULONG_PTR,
+ HandleValue: ULONG_PTR,
+ GrantedAccess: ULONG,
+ CreatorBackTraceIndex: USHORT,
+ ObjectTypeIndex: USHORT,
+ HandleAttributes: ULONG,
+ Reserved: ULONG,
+}}
+pub type PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX = *mut SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;
+STRUCT!{struct SYSTEM_HANDLE_INFORMATION_EX {
+ NumberOfHandles: ULONG_PTR,
+ Reserved: ULONG_PTR,
+ Handles: [SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX; 1],
+}}
+pub type PSYSTEM_HANDLE_INFORMATION_EX = *mut SYSTEM_HANDLE_INFORMATION_EX;
+UNION!{union SYSTEM_BIGPOOL_ENTRY_u1 {
+ VirtualAddress: PVOID,
+ Bitfields: ULONG_PTR,
+}}
+UNION!{union SYSTEM_BIGPOOL_ENTRY_u2 {
+ Tag: [UCHAR; 4],
+ TagUlong: ULONG,
+}}
+BITFIELD!{unsafe SYSTEM_BIGPOOL_ENTRY_u1 Bitfields: ULONG_PTR [
+ NonPaged set_NonPaged[0..1],
+]}
+STRUCT!{struct SYSTEM_BIGPOOL_ENTRY {
+ u1: SYSTEM_BIGPOOL_ENTRY_u1,
+ SizeInBytes: SIZE_T,
+ u2: SYSTEM_BIGPOOL_ENTRY_u2,
+}}
+pub type PSYSTEM_BIGPOOL_ENTRY = *mut SYSTEM_BIGPOOL_ENTRY;
+STRUCT!{struct SYSTEM_BIGPOOL_INFORMATION {
+ Count: ULONG,
+ AllocatedInfo: [SYSTEM_BIGPOOL_ENTRY; 1],
+}}
+pub type PSYSTEM_BIGPOOL_INFORMATION = *mut SYSTEM_BIGPOOL_INFORMATION;
+UNION!{union SYSTEM_POOL_ENTRY_u {
+ Tag: [UCHAR; 4],
+ TagUlong: ULONG,
+ ProcessChargedQuota: PVOID,
+}}
+STRUCT!{struct SYSTEM_POOL_ENTRY {
+ Allocated: BOOLEAN,
+ Spare0: BOOLEAN,
+ AllocatorBackTraceIndex: USHORT,
+ Size: ULONG,
+ u: SYSTEM_POOL_ENTRY_u,
+}}
+pub type PSYSTEM_POOL_ENTRY = *mut SYSTEM_POOL_ENTRY;
+STRUCT!{struct SYSTEM_POOL_INFORMATION {
+ TotalSize: SIZE_T,
+ FirstEntry: PVOID,
+ EntryOverhead: USHORT,
+ PoolTagPresent: BOOLEAN,
+ Spare0: BOOLEAN,
+ NumberOfEntries: ULONG,
+ Entries: [SYSTEM_POOL_ENTRY; 1],
+}}
+pub type PSYSTEM_POOL_INFORMATION = *mut SYSTEM_POOL_INFORMATION;
+STRUCT!{struct SYSTEM_SESSION_POOLTAG_INFORMATION {
+ NextEntryOffset: SIZE_T,
+ SessionId: ULONG,
+ Count: ULONG,
+ TagInfo: [SYSTEM_POOLTAG; 1],
+}}
+pub type PSYSTEM_SESSION_POOLTAG_INFORMATION = *mut SYSTEM_SESSION_POOLTAG_INFORMATION;
+STRUCT!{struct SYSTEM_SESSION_MAPPED_VIEW_INFORMATION {
+ NextEntryOffset: SIZE_T,
+ SessionId: ULONG,
+ ViewFailures: ULONG,
+ NumberOfBytesAvailable: SIZE_T,
+ NumberOfBytesAvailableContiguous: SIZE_T,
+}}
+pub type PSYSTEM_SESSION_MAPPED_VIEW_INFORMATION = *mut SYSTEM_SESSION_MAPPED_VIEW_INFORMATION;
+ENUM!{enum SYSTEM_FIRMWARE_TABLE_ACTION {
+ SystemFirmwareTableEnumerate = 0,
+ SystemFirmwareTableGet = 1,
+ SystemFirmwareTableMax = 2,
+}}
+STRUCT!{struct SYSTEM_FIRMWARE_TABLE_INFORMATION {
+ ProviderSignature: ULONG,
+ Action: SYSTEM_FIRMWARE_TABLE_ACTION,
+ TableID: ULONG,
+ TableBufferLength: ULONG,
+ TableBuffer: [UCHAR; 1],
+}}
+pub type PSYSTEM_FIRMWARE_TABLE_INFORMATION = *mut SYSTEM_FIRMWARE_TABLE_INFORMATION;
+STRUCT!{struct SYSTEM_MEMORY_LIST_INFORMATION {
+ ZeroPageCount: ULONG_PTR,
+ FreePageCount: ULONG_PTR,
+ ModifiedPageCount: ULONG_PTR,
+ ModifiedNoWritePageCount: ULONG_PTR,
+ BadPageCount: ULONG_PTR,
+ PageCountByPriority: [ULONG_PTR; 8],
+ RepurposedPagesByPriority: [ULONG_PTR; 8],
+ ModifiedPageCountPageFile: ULONG_PTR,
+}}
+pub type PSYSTEM_MEMORY_LIST_INFORMATION = *mut SYSTEM_MEMORY_LIST_INFORMATION;
+ENUM!{enum SYSTEM_MEMORY_LIST_COMMAND {
+ MemoryCaptureAccessedBits = 0,
+ MemoryCaptureAndResetAccessedBits = 1,
+ MemoryEmptyWorkingSets = 2,
+ MemoryFlushModifiedList = 3,
+ MemoryPurgeStandbyList = 4,
+ MemoryPurgeLowPriorityStandbyList = 5,
+ MemoryCommandMax = 6,
+}}
+STRUCT!{struct SYSTEM_THREAD_CID_PRIORITY_INFORMATION {
+ ClientId: CLIENT_ID,
+ Priority: KPRIORITY,
+}}
+pub type PSYSTEM_THREAD_CID_PRIORITY_INFORMATION = *mut SYSTEM_THREAD_CID_PRIORITY_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION {
+ CycleTime: ULONGLONG,
+}}
+pub type PSYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION =
+ *mut SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION;
+STRUCT!{struct SYSTEM_REF_TRACE_INFORMATION {
+ TraceEnable: BOOLEAN,
+ TracePermanent: BOOLEAN,
+ TraceProcessName: UNICODE_STRING,
+ TracePoolTags: UNICODE_STRING,
+}}
+pub type PSYSTEM_REF_TRACE_INFORMATION = *mut SYSTEM_REF_TRACE_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESS_ID_INFORMATION {
+ ProcessId: HANDLE,
+ ImageName: UNICODE_STRING,
+}}
+pub type PSYSTEM_PROCESS_ID_INFORMATION = *mut SYSTEM_PROCESS_ID_INFORMATION;
+STRUCT!{struct SYSTEM_BOOT_ENVIRONMENT_INFORMATION {
+ BootIdentifier: GUID,
+ FirmwareType: FIRMWARE_TYPE,
+ BootFlags: ULONGLONG,
+}}
+BITFIELD!{SYSTEM_BOOT_ENVIRONMENT_INFORMATION BootFlags: ULONGLONG [
+ DbgMenuOsSelection set_DbgMenuOsSelection[0..1],
+ DbgHiberBoot set_DbgHiberBoot[1..2],
+ DbgSoftBoot set_DbgSoftBoot[2..3],
+ DbgMeasuredLaunch set_DbgMeasuredLaunch[3..4],
+]}
+pub type PSYSTEM_BOOT_ENVIRONMENT_INFORMATION = *mut SYSTEM_BOOT_ENVIRONMENT_INFORMATION;
+STRUCT!{struct SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION {
+ FlagsToEnable: ULONG,
+ FlagsToDisable: ULONG,
+}}
+pub type PSYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION =
+ *mut SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION;
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+STRUCT!{struct SYSTEM_VERIFIER_INFORMATION_EX {
+ VerifyMode: ULONG,
+ OptionChanges: ULONG,
+ PreviousBucketName: UNICODE_STRING,
+ IrpCancelTimeoutMsec: ULONG,
+ VerifierExtensionEnabled: ULONG,
+ Reserved: [ULONG; 1],
+}}
+#[cfg(target_arch = "x86")]
+STRUCT!{struct SYSTEM_VERIFIER_INFORMATION_EX {
+ VerifyMode: ULONG,
+ OptionChanges: ULONG,
+ PreviousBucketName: UNICODE_STRING,
+ IrpCancelTimeoutMsec: ULONG,
+ VerifierExtensionEnabled: ULONG,
+ Reserved: [ULONG; 3],
+}}
+pub type PSYSTEM_VERIFIER_INFORMATION_EX = *mut SYSTEM_VERIFIER_INFORMATION_EX;
+STRUCT!{struct SYSTEM_SYSTEM_PARTITION_INFORMATION {
+ SystemPartition: UNICODE_STRING,
+}}
+pub type PSYSTEM_SYSTEM_PARTITION_INFORMATION = *mut SYSTEM_SYSTEM_PARTITION_INFORMATION;
+STRUCT!{struct SYSTEM_SYSTEM_DISK_INFORMATION {
+ SystemDisk: UNICODE_STRING,
+}}
+pub type PSYSTEM_SYSTEM_DISK_INFORMATION = *mut SYSTEM_SYSTEM_DISK_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT {
+ Hits: ULONGLONG,
+ PercentFrequency: UCHAR,
+}}
+pub type PSYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT = *mut SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT;
+STRUCT!{struct SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT_WIN8 {
+ Hits: ULONG,
+ PercentFrequency: UCHAR,
+}}
+pub type PSYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT_WIN8 =
+ *mut SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT_WIN8;
+STRUCT!{struct SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION {
+ ProcessorNumber: ULONG,
+ StateCount: ULONG,
+ States: [SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT; 1],
+}}
+pub type PSYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION =
+ *mut SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION;
+STRUCT!{struct SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION {
+ ProcessorCount: ULONG,
+ Offsets: [ULONG; 1],
+}}
+pub type PSYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION =
+ *mut SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION;
+STRUCT!{struct SYSTEM_CODEINTEGRITY_INFORMATION {
+ Length: ULONG,
+ CodeIntegrityOptions: ULONG,
+}}
+pub type PSYSTEM_CODEINTEGRITY_INFORMATION = *mut SYSTEM_CODEINTEGRITY_INFORMATION;
+ENUM!{enum SYSTEM_VA_TYPE {
+ SystemVaTypeAll = 0,
+ SystemVaTypeNonPagedPool = 1,
+ SystemVaTypePagedPool = 2,
+ SystemVaTypeSystemCache = 3,
+ SystemVaTypeSystemPtes = 4,
+ SystemVaTypeSessionSpace = 5,
+ SystemVaTypeMax = 6,
+}}
+pub type PSYSTEM_VA_TYPE = *mut SYSTEM_VA_TYPE;
+STRUCT!{struct SYSTEM_VA_LIST_INFORMATION {
+ VirtualSize: SIZE_T,
+ VirtualPeak: SIZE_T,
+ VirtualLimit: SIZE_T,
+ AllocationFailures: SIZE_T,
+}}
+pub type PSYSTEM_VA_LIST_INFORMATION = *mut SYSTEM_VA_LIST_INFORMATION;
+STRUCT!{struct SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS {
+ KeyHandle: HANDLE,
+ ValueNamePointer: PUNICODE_STRING,
+ RequiredLengthPointer: PULONG,
+ Buffer: PUCHAR,
+ BufferLength: ULONG,
+ Type: ULONG,
+ AppendBuffer: PUCHAR,
+ AppendBufferLength: ULONG,
+ CreateIfDoesntExist: BOOLEAN,
+ TruncateExistingValue: BOOLEAN,
+}}
+pub type PSYSTEM_REGISTRY_APPEND_STRING_PARAMETERS = *mut SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS;
+STRUCT!{struct SYSTEM_VHD_BOOT_INFORMATION {
+ OsDiskIsVhd: BOOLEAN,
+ OsVhdFilePathOffset: ULONG,
+ OsVhdParentVolume: [WCHAR; ANYSIZE_ARRAY],
+}}
+pub type PSYSTEM_VHD_BOOT_INFORMATION = *mut SYSTEM_VHD_BOOT_INFORMATION;
+STRUCT!{struct SYSTEM_LOW_PRIORITY_IO_INFORMATION {
+ LowPriReadOperations: ULONG,
+ LowPriWriteOperations: ULONG,
+ KernelBumpedToNormalOperations: ULONG,
+ LowPriPagingReadOperations: ULONG,
+ KernelPagingReadsBumpedToNormal: ULONG,
+ LowPriPagingWriteOperations: ULONG,
+ KernelPagingWritesBumpedToNormal: ULONG,
+ BoostedIrpCount: ULONG,
+ BoostedPagingIrpCount: ULONG,
+ BlanketBoostCount: ULONG,
+}}
+pub type PSYSTEM_LOW_PRIORITY_IO_INFORMATION = *mut SYSTEM_LOW_PRIORITY_IO_INFORMATION;
+ENUM!{enum TPM_BOOT_ENTROPY_RESULT_CODE {
+ TpmBootEntropyStructureUninitialized = 0,
+ TpmBootEntropyDisabledByPolicy = 1,
+ TpmBootEntropyNoTpmFound = 2,
+ TpmBootEntropyTpmError = 3,
+ TpmBootEntropySuccess = 4,
+}}
+STRUCT!{struct TPM_BOOT_ENTROPY_NT_RESULT {
+ Policy: ULONGLONG,
+ ResultCode: TPM_BOOT_ENTROPY_RESULT_CODE,
+ ResultStatus: NTSTATUS,
+ Time: ULONGLONG,
+ EntropyLength: ULONG,
+ EntropyData: [UCHAR; 40],
+}}
+pub type PTPM_BOOT_ENTROPY_NT_RESULT = *mut TPM_BOOT_ENTROPY_NT_RESULT;
+STRUCT!{struct SYSTEM_VERIFIER_COUNTERS_INFORMATION {
+ Legacy: SYSTEM_VERIFIER_INFORMATION,
+ RaiseIrqls: ULONG,
+ AcquireSpinLocks: ULONG,
+ SynchronizeExecutions: ULONG,
+ AllocationsWithNoTag: ULONG,
+ AllocationsFailed: ULONG,
+ AllocationsFailedDeliberately: ULONG,
+ LockedBytes: SIZE_T,
+ PeakLockedBytes: SIZE_T,
+ MappedLockedBytes: SIZE_T,
+ PeakMappedLockedBytes: SIZE_T,
+ MappedIoSpaceBytes: SIZE_T,
+ PeakMappedIoSpaceBytes: SIZE_T,
+ PagesForMdlBytes: SIZE_T,
+ PeakPagesForMdlBytes: SIZE_T,
+ ContiguousMemoryBytes: SIZE_T,
+ PeakContiguousMemoryBytes: SIZE_T,
+ ExecutePoolTypes: ULONG,
+ ExecutePageProtections: ULONG,
+ ExecutePageMappings: ULONG,
+ ExecuteWriteSections: ULONG,
+ SectionAlignmentFailures: ULONG,
+ UnsupportedRelocs: ULONG,
+ IATInExecutableSection: ULONG,
+}}
+pub type PSYSTEM_VERIFIER_COUNTERS_INFORMATION = *mut SYSTEM_VERIFIER_COUNTERS_INFORMATION;
+STRUCT!{struct SYSTEM_ACPI_AUDIT_INFORMATION {
+ RsdpCount: ULONG,
+ Bitfields: ULONG,
+}}
+BITFIELD!{SYSTEM_ACPI_AUDIT_INFORMATION Bitfields: ULONG [
+ SameRsdt set_SameRsdt[0..1],
+ SlicPresent set_SlicPresent[1..2],
+ SlicDifferent set_SlicDifferent[2..3],
+]}
+pub type PSYSTEM_ACPI_AUDIT_INFORMATION = *mut SYSTEM_ACPI_AUDIT_INFORMATION;
+STRUCT!{struct SYSTEM_BASIC_PERFORMANCE_INFORMATION {
+ AvailablePages: SIZE_T,
+ CommittedPages: SIZE_T,
+ CommitLimit: SIZE_T,
+ PeakCommitment: SIZE_T,
+}}
+pub type PSYSTEM_BASIC_PERFORMANCE_INFORMATION = *mut SYSTEM_BASIC_PERFORMANCE_INFORMATION;
+STRUCT!{struct QUERY_PERFORMANCE_COUNTER_FLAGS {
+ ul: ULONG,
+}}
+BITFIELD!{QUERY_PERFORMANCE_COUNTER_FLAGS ul: ULONG [
+ KernelTransition set_KernelTransition[0..1],
+ Reserved set_Reserved[1..32],
+]}
+STRUCT!{struct SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION {
+ Version: ULONG,
+ Flags: QUERY_PERFORMANCE_COUNTER_FLAGS,
+ ValidFlags: QUERY_PERFORMANCE_COUNTER_FLAGS,
+}}
+pub type PSYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION =
+ *mut SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION;
+ENUM!{enum SYSTEM_PIXEL_FORMAT {
+ SystemPixelFormatUnknown = 0,
+ SystemPixelFormatR8G8B8 = 1,
+ SystemPixelFormatR8G8B8X8 = 2,
+ SystemPixelFormatB8G8R8 = 3,
+ SystemPixelFormatB8G8R8X8 = 4,
+}}
+STRUCT!{struct SYSTEM_BOOT_GRAPHICS_INFORMATION {
+ FrameBuffer: LARGE_INTEGER,
+ Width: ULONG,
+ Height: ULONG,
+ PixelStride: ULONG,
+ Flags: ULONG,
+ Format: SYSTEM_PIXEL_FORMAT,
+ DisplayRotation: ULONG,
+}}
+pub type PSYSTEM_BOOT_GRAPHICS_INFORMATION = *mut SYSTEM_BOOT_GRAPHICS_INFORMATION;
+STRUCT!{struct MEMORY_SCRUB_INFORMATION {
+ Handle: HANDLE,
+ PagesScrubbed: ULONG,
+}}
+pub type PMEMORY_SCRUB_INFORMATION = *mut MEMORY_SCRUB_INFORMATION;
+STRUCT!{struct PEBS_DS_SAVE_AREA {
+ BtsBufferBase: ULONGLONG,
+ BtsIndex: ULONGLONG,
+ BtsAbsoluteMaximum: ULONGLONG,
+ BtsInterruptThreshold: ULONGLONG,
+ PebsBufferBase: ULONGLONG,
+ PebsIndex: ULONGLONG,
+ PebsAbsoluteMaximum: ULONGLONG,
+ PebsInterruptThreshold: ULONGLONG,
+ PebsCounterReset0: ULONGLONG,
+ PebsCounterReset1: ULONGLONG,
+ PebsCounterReset2: ULONGLONG,
+ PebsCounterReset3: ULONGLONG,
+}}
+pub type PPEBS_DS_SAVE_AREA = *mut PEBS_DS_SAVE_AREA;
+STRUCT!{struct PROCESSOR_PROFILE_CONTROL_AREA {
+ PebsDsSaveArea: PEBS_DS_SAVE_AREA,
+}}
+pub type PPROCESSOR_PROFILE_CONTROL_AREA = *mut PROCESSOR_PROFILE_CONTROL_AREA;
+STRUCT!{struct SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA {
+ ProcessorProfileControlArea: PROCESSOR_PROFILE_CONTROL_AREA,
+ Allocate: BOOLEAN,
+}}
+pub type PSYSTEM_PROCESSOR_PROFILE_CONTROL_AREA = *mut SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA;
+STRUCT!{struct MEMORY_COMBINE_INFORMATION {
+ Handle: HANDLE,
+ PagesCombined: ULONG_PTR,
+}}
+pub type PMEMORY_COMBINE_INFORMATION = *mut MEMORY_COMBINE_INFORMATION;
+pub const MEMORY_COMBINE_FLAGS_COMMON_PAGES_ONLY: ULONG = 0x4;
+STRUCT!{struct MEMORY_COMBINE_INFORMATION_EX {
+ Handle: HANDLE,
+ PagesCombined: ULONG_PTR,
+ Flags: ULONG,
+}}
+pub type PMEMORY_COMBINE_INFORMATION_EX = *mut MEMORY_COMBINE_INFORMATION_EX;
+STRUCT!{struct MEMORY_COMBINE_INFORMATION_EX2 {
+ Handle: HANDLE,
+ PagesCombined: ULONG_PTR,
+ Flags: ULONG,
+ ProcessHandle: HANDLE,
+}}
+pub type PMEMORY_COMBINE_INFORMATION_EX2 = *mut MEMORY_COMBINE_INFORMATION_EX2;
+STRUCT!{struct SYSTEM_CONSOLE_INFORMATION {
+ Bitfields: ULONG,
+}}
+BITFIELD!{SYSTEM_CONSOLE_INFORMATION Bitfields: ULONG [
+ DriverLoaded set_DriverLoaded[0..1],
+ Spare set_Spare[1..32],
+]}
+pub type PSYSTEM_CONSOLE_INFORMATION = *mut SYSTEM_CONSOLE_INFORMATION;
+STRUCT!{struct SYSTEM_PLATFORM_BINARY_INFORMATION {
+ PhysicalAddress: ULONG64,
+ HandoffBuffer: PVOID,
+ CommandLineBuffer: PVOID,
+ HandoffBufferSize: ULONG,
+ CommandLineBufferSize: ULONG,
+}}
+pub type PSYSTEM_PLATFORM_BINARY_INFORMATION = *mut SYSTEM_PLATFORM_BINARY_INFORMATION;
+STRUCT!{struct SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION {
+ NumberOfLogicalProcessors: ULONG,
+ NumberOfCores: ULONG,
+}}
+pub type PSYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION =
+ *mut SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION;
+STRUCT!{struct SYSTEM_DEVICE_DATA_INFORMATION {
+ DeviceId: UNICODE_STRING,
+ DataName: UNICODE_STRING,
+ DataType: ULONG,
+ DataBufferLength: ULONG,
+ DataBuffer: PVOID,
+}}
+pub type PSYSTEM_DEVICE_DATA_INFORMATION = *mut SYSTEM_DEVICE_DATA_INFORMATION;
+STRUCT!{struct PHYSICAL_CHANNEL_RUN {
+ NodeNumber: ULONG,
+ ChannelNumber: ULONG,
+ BasePage: ULONGLONG,
+ PageCount: ULONGLONG,
+ Flags: ULONG,
+}}
+pub type PPHYSICAL_CHANNEL_RUN = *mut PHYSICAL_CHANNEL_RUN;
+STRUCT!{struct SYSTEM_MEMORY_TOPOLOGY_INFORMATION {
+ NumberOfRuns: ULONGLONG,
+ NumberOfNodes: ULONG,
+ NumberOfChannels: ULONG,
+ Run: [PHYSICAL_CHANNEL_RUN; 1],
+}}
+pub type PSYSTEM_MEMORY_TOPOLOGY_INFORMATION = *mut SYSTEM_MEMORY_TOPOLOGY_INFORMATION;
+STRUCT!{struct SYSTEM_MEMORY_CHANNEL_INFORMATION {
+ ChannelNumber: ULONG,
+ ChannelHeatIndex: ULONG,
+ TotalPageCount: ULONGLONG,
+ ZeroPageCount: ULONGLONG,
+ FreePageCount: ULONGLONG,
+ StandbyPageCount: ULONGLONG,
+}}
+pub type PSYSTEM_MEMORY_CHANNEL_INFORMATION = *mut SYSTEM_MEMORY_CHANNEL_INFORMATION;
+STRUCT!{struct SYSTEM_BOOT_LOGO_INFORMATION {
+ Flags: ULONG,
+ BitmapOffset: ULONG,
+}}
+pub type PSYSTEM_BOOT_LOGO_INFORMATION = *mut SYSTEM_BOOT_LOGO_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX {
+ IdleTime: LARGE_INTEGER,
+ KernelTime: LARGE_INTEGER,
+ UserTime: LARGE_INTEGER,
+ DpcTime: LARGE_INTEGER,
+ InterruptTime: LARGE_INTEGER,
+ InterruptCount: ULONG,
+ Spare0: ULONG,
+ AvailableTime: LARGE_INTEGER,
+ Spare1: LARGE_INTEGER,
+ Spare2: LARGE_INTEGER,
+}}
+pub type PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX =
+ *mut SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX;
+STRUCT!{struct SYSTEM_SECUREBOOT_POLICY_INFORMATION {
+ PolicyPublisher: GUID,
+ PolicyVersion: ULONG,
+ PolicyOptions: ULONG,
+}}
+pub type PSYSTEM_SECUREBOOT_POLICY_INFORMATION = *mut SYSTEM_SECUREBOOT_POLICY_INFORMATION;
+STRUCT!{struct SYSTEM_PAGEFILE_INFORMATION_EX {
+ Info: SYSTEM_PAGEFILE_INFORMATION,
+ MinimumSize: ULONG,
+ MaximumSize: ULONG,
+}}
+pub type PSYSTEM_PAGEFILE_INFORMATION_EX = *mut SYSTEM_PAGEFILE_INFORMATION_EX;
+STRUCT!{struct SYSTEM_SECUREBOOT_INFORMATION {
+ SecureBootEnabled: BOOLEAN,
+ SecureBootCapable: BOOLEAN,
+}}
+pub type PSYSTEM_SECUREBOOT_INFORMATION = *mut SYSTEM_SECUREBOOT_INFORMATION;
+STRUCT!{struct PROCESS_DISK_COUNTERS {
+ BytesRead: ULONGLONG,
+ BytesWritten: ULONGLONG,
+ ReadOperationCount: ULONGLONG,
+ WriteOperationCount: ULONGLONG,
+ FlushOperationCount: ULONGLONG,
+}}
+pub type PPROCESS_DISK_COUNTERS = *mut PROCESS_DISK_COUNTERS;
+UNION!{union ENERGY_STATE_DURATION_u {
+ Value: ULONGLONG,
+ LastChangeTime: ULONG,
+}}
+UNION!{union ENERGY_STATE_DURATION {
+ u: ENERGY_STATE_DURATION_u,
+ BitFields: ULONG,
+}}
+pub type PENERGY_STATE_DURATION = *mut ENERGY_STATE_DURATION;
+BITFIELD!{unsafe ENERGY_STATE_DURATION BitFields: ULONG [
+ Duration set_Duration[0..31],
+ IsInState set_IsInState[31..32],
+]}
+STRUCT!{struct PROCESS_ENERGY_VALUES {
+ Cycles: [[ULONGLONG; 4]; 2],
+ DiskEnergy: ULONGLONG,
+ NetworkTailEnergy: ULONGLONG,
+ MBBTailEnergy: ULONGLONG,
+ NetworkTxRxBytes: ULONGLONG,
+ MBBTxRxBytes: ULONGLONG,
+ ForegroundDuration: ENERGY_STATE_DURATION,
+ DesktopVisibleDuration: ENERGY_STATE_DURATION,
+ PSMForegroundDuration: ENERGY_STATE_DURATION,
+ CompositionRendered: ULONG,
+ CompositionDirtyGenerated: ULONG,
+ CompositionDirtyPropagated: ULONG,
+ Reserved1: ULONG,
+ AttributedCycles: [[ULONGLONG; 2]; 4],
+ WorkOnBehalfCycles: [[ULONGLONG; 2]; 4],
+}}
+pub type PPROCESS_ENERGY_VALUES = *mut PROCESS_ENERGY_VALUES;
+STRUCT!{struct TIMELINE_BITMAP {
+ Value: ULONGLONG,
+ EndTime: ULONG,
+ Bitmap: ULONG,
+}}
+pub type PTIMELINE_BITMAP = *mut TIMELINE_BITMAP;
+STRUCT!{struct PROCESS_ENERGY_VALUES_EXTENSION_Timelines {
+ CpuTimeline: TIMELINE_BITMAP,
+ DiskTimeline: TIMELINE_BITMAP,
+ NetworkTimeline: TIMELINE_BITMAP,
+ MBBTimeline: TIMELINE_BITMAP,
+ ForegroundTimeline: TIMELINE_BITMAP,
+ DesktopVisibleTimeline: TIMELINE_BITMAP,
+ CompositionRenderedTimeline: TIMELINE_BITMAP,
+ CompositionDirtyGeneratedTimeline: TIMELINE_BITMAP,
+ CompositionDirtyPropagatedTimeline: TIMELINE_BITMAP,
+ InputTimeline: TIMELINE_BITMAP,
+ AudioInTimeline: TIMELINE_BITMAP,
+ AudioOutTimeline: TIMELINE_BITMAP,
+ DisplayRequiredTimeline: TIMELINE_BITMAP,
+ KeyboardInputTimeline: TIMELINE_BITMAP,
+}}
+STRUCT!{struct PROCESS_ENERGY_VALUES_EXTENSION_Durations {
+ InputDuration: ENERGY_STATE_DURATION,
+ AudioInDuration: ENERGY_STATE_DURATION,
+ AudioOutDuration: ENERGY_STATE_DURATION,
+ DisplayRequiredDuration: ENERGY_STATE_DURATION,
+ PSMBackgroundDuration: ENERGY_STATE_DURATION,
+}}
+STRUCT!{struct PROCESS_ENERGY_VALUES_EXTENSION {
+ Timelines: PROCESS_ENERGY_VALUES_EXTENSION_Timelines,
+ Durations: PROCESS_ENERGY_VALUES_EXTENSION_Durations,
+ KeyboardInput: ULONG,
+ MouseInput: ULONG,
+}}
+pub type PPROCESS_ENERGY_VALUES_EXTENSION = *mut PROCESS_ENERGY_VALUES_EXTENSION;
+STRUCT!{struct PROCESS_EXTENDED_ENERGY_VALUES {
+ Base: PROCESS_ENERGY_VALUES,
+ Extension: PROCESS_ENERGY_VALUES_EXTENSION,
+}}
+pub type PPROCESS_EXTENDED_ENERGY_VALUES = *mut PROCESS_EXTENDED_ENERGY_VALUES;
+ENUM!{enum SYSTEM_PROCESS_CLASSIFICATION {
+ SystemProcessClassificationNormal = 0,
+ SystemProcessClassificationSystem = 1,
+ SystemProcessClassificationSecureSystem = 2,
+ SystemProcessClassificationMemCompression = 3,
+ SystemProcessClassificationRegistry = 4,
+ SystemProcessClassificationMaximum = 5,
+}}
+STRUCT!{struct SYSTEM_PROCESS_INFORMATION_EXTENSION {
+ DiskCounters: PROCESS_DISK_COUNTERS,
+ ContextSwitches: ULONGLONG,
+ Flags: ULONG,
+ UserSidOffset: ULONG,
+ PackageFullNameOffset: ULONG,
+ EnergyValues: PROCESS_ENERGY_VALUES,
+ AppIdOffset: ULONG,
+ SharedCommitCharge: SIZE_T,
+ JobObjectId: ULONG,
+ SpareUlong: ULONG,
+ ProcessSequenceNumber: ULONGLONG,
+}}
+BITFIELD!{SYSTEM_PROCESS_INFORMATION_EXTENSION Flags: ULONG [
+ HasStrongId set_HasStrongId[0..1],
+ Classification set_Classification[1..5],
+ BackgroundActivityModerated set_BackgroundActivityModerated[5..6],
+ Spare set_Spare[6..32],
+]}
+pub type PSYSTEM_PROCESS_INFORMATION_EXTENSION = *mut SYSTEM_PROCESS_INFORMATION_EXTENSION;
+STRUCT!{struct SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION {
+ EfiLauncherEnabled: BOOLEAN,
+}}
+pub type PSYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION =
+ *mut SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION;
+STRUCT!{struct SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX {
+ DebuggerAllowed: BOOLEAN,
+ DebuggerEnabled: BOOLEAN,
+ DebuggerPresent: BOOLEAN,
+}}
+pub type PSYSTEM_KERNEL_DEBUGGER_INFORMATION_EX = *mut SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX;
+STRUCT!{struct SYSTEM_ELAM_CERTIFICATE_INFORMATION {
+ ElamDriverFile: HANDLE,
+}}
+pub type PSYSTEM_ELAM_CERTIFICATE_INFORMATION = *mut SYSTEM_ELAM_CERTIFICATE_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_FEATURES_INFORMATION {
+ ProcessorFeatureBits: ULONGLONG,
+ Reserved: [ULONGLONG; 3],
+}}
+pub type PSYSTEM_PROCESSOR_FEATURES_INFORMATION = *mut SYSTEM_PROCESSOR_FEATURES_INFORMATION;
+STRUCT!{struct SYSTEM_MANUFACTURING_INFORMATION {
+ Options: ULONG,
+ ProfileName: UNICODE_STRING,
+}}
+pub type PSYSTEM_MANUFACTURING_INFORMATION = *mut SYSTEM_MANUFACTURING_INFORMATION;
+STRUCT!{struct SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION {
+ Enabled: BOOLEAN,
+}}
+pub type PSYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION =
+ *mut SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION;
+STRUCT!{struct HV_DETAILS {
+ Data: [ULONG; 4],
+}}
+pub type PHV_DETAILS = *mut HV_DETAILS;
+STRUCT!{struct SYSTEM_HYPERVISOR_DETAIL_INFORMATION {
+ HvVendorAndMaxFunction: HV_DETAILS,
+ HypervisorInterface: HV_DETAILS,
+ HypervisorVersion: HV_DETAILS,
+ HvFeatures: HV_DETAILS,
+ HwFeatures: HV_DETAILS,
+ EnlightenmentInfo: HV_DETAILS,
+ ImplementationLimits: HV_DETAILS,
+}}
+pub type PSYSTEM_HYPERVISOR_DETAIL_INFORMATION = *mut SYSTEM_HYPERVISOR_DETAIL_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION {
+ Cycles: [[ULONGLONG; 4]; 2],
+}}
+pub type PSYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION = *mut SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION;
+STRUCT!{struct SYSTEM_TPM_INFORMATION {
+ Flags: ULONG,
+}}
+pub type PSYSTEM_TPM_INFORMATION = *mut SYSTEM_TPM_INFORMATION;
+STRUCT!{struct SYSTEM_VSM_PROTECTION_INFORMATION {
+ DmaProtectionsAvailable: BOOLEAN,
+ DmaProtectionsInUse: BOOLEAN,
+ HardwareMbecAvailable: BOOLEAN,
+}}
+pub type PSYSTEM_VSM_PROTECTION_INFORMATION = *mut SYSTEM_VSM_PROTECTION_INFORMATION;
+STRUCT!{struct SYSTEM_CODEINTEGRITYPOLICY_INFORMATION {
+ Options: ULONG,
+ HVCIOptions: ULONG,
+ Version: ULONGLONG,
+ PolicyGuid: GUID,
+}}
+pub type PSYSTEM_CODEINTEGRITYPOLICY_INFORMATION = *mut SYSTEM_CODEINTEGRITYPOLICY_INFORMATION;
+STRUCT!{struct SYSTEM_ISOLATED_USER_MODE_INFORMATION {
+ Bitfields1: BOOLEAN,
+ Bitfields2: BOOLEAN,
+ Spare0: [BOOLEAN; 6],
+ Spare1: ULONGLONG,
+}}
+BITFIELD!{SYSTEM_ISOLATED_USER_MODE_INFORMATION Bitfields1: BOOLEAN [
+ SecureKernelRunning set_SecureKernelRunning[0..1],
+ HvciEnabled set_HvciEnabled[1..2],
+ HvciStrictMode set_HvciStrictMode[2..3],
+ DebugEnabled set_DebugEnabled[3..4],
+ FirmwarePageProtection set_FirmwarePageProtection[4..5],
+ EncryptionKeyAvailable set_EncryptionKeyAvailable[5..6],
+ SpareFlags set_SpareFlags[6..7],
+ TrustletRunning set_TrustletRunning[7..8],
+]}
+BITFIELD!{SYSTEM_ISOLATED_USER_MODE_INFORMATION Bitfields2: BOOLEAN [
+ SpareFlags2 set_SpareFlags2[0..1],
+]}
+pub type PSYSTEM_ISOLATED_USER_MODE_INFORMATION = *mut SYSTEM_ISOLATED_USER_MODE_INFORMATION;
+STRUCT!{struct SYSTEM_SINGLE_MODULE_INFORMATION {
+ TargetModuleAddress: PVOID,
+ ExInfo: RTL_PROCESS_MODULE_INFORMATION_EX,
+}}
+pub type PSYSTEM_SINGLE_MODULE_INFORMATION = *mut SYSTEM_SINGLE_MODULE_INFORMATION;
+STRUCT!{struct SYSTEM_INTERRUPT_CPU_SET_INFORMATION {
+ Gsiv: ULONG,
+ Group: USHORT,
+ CpuSets: ULONGLONG,
+}}
+pub type PSYSTEM_INTERRUPT_CPU_SET_INFORMATION = *mut SYSTEM_INTERRUPT_CPU_SET_INFORMATION;
+STRUCT!{struct SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION {
+ PolicyInformation: SYSTEM_SECUREBOOT_POLICY_INFORMATION,
+ PolicySize: ULONG,
+ Policy: [UCHAR; 1],
+}}
+pub type PSYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION =
+ *mut SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION;
+STRUCT!{struct SYSTEM_ROOT_SILO_INFORMATION {
+ NumberOfSilos: ULONG,
+ SiloIdList: [ULONG; 1],
+}}
+pub type PSYSTEM_ROOT_SILO_INFORMATION = *mut SYSTEM_ROOT_SILO_INFORMATION;
+STRUCT!{struct SYSTEM_CPU_SET_TAG_INFORMATION {
+ Tag: ULONGLONG,
+ CpuSets: [ULONGLONG; 1],
+}}
+pub type PSYSTEM_CPU_SET_TAG_INFORMATION = *mut SYSTEM_CPU_SET_TAG_INFORMATION;
+STRUCT!{struct SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION {
+ ExtentCount: ULONG,
+ ValidStructureSize: ULONG,
+ NextExtentIndex: ULONG,
+ ExtentRestart: ULONG,
+ CycleCount: ULONG,
+ TimeoutCount: ULONG,
+ CycleTime: ULONGLONG,
+ CycleTimeMax: ULONGLONG,
+ ExtentTime: ULONGLONG,
+ ExtentTimeIndex: ULONG,
+ ExtentTimeMaxIndex: ULONG,
+ ExtentTimeMax: ULONGLONG,
+ HyperFlushTimeMax: ULONGLONG,
+ TranslateVaTimeMax: ULONGLONG,
+ DebugExemptionCount: ULONGLONG,
+ TbHitCount: ULONGLONG,
+ TbMissCount: ULONGLONG,
+ VinaPendingYield: ULONGLONG,
+ HashCycles: ULONGLONG,
+ HistogramOffset: ULONG,
+ HistogramBuckets: ULONG,
+ HistogramShift: ULONG,
+ Reserved1: ULONG,
+ PageNotPresentCount: ULONGLONG,
+}}
+pub type PSYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION =
+ *mut SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION;
+STRUCT!{struct SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION {
+ PlatformManifestSize: ULONG,
+ PlatformManifest: [UCHAR; 1],
+}}
+pub type PSYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION =
+ *mut SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION;
+STRUCT!{struct SYSTEM_MEMORY_USAGE_INFORMATION {
+ TotalPhysicalBytes: ULONGLONG,
+ AvailableBytes: ULONGLONG,
+ ResidentAvailableBytes: LONGLONG,
+ CommittedBytes: ULONGLONG,
+ SharedCommittedBytes: ULONGLONG,
+ CommitLimitBytes: ULONGLONG,
+ PeakCommitmentBytes: ULONGLONG,
+}}
+pub type PSYSTEM_MEMORY_USAGE_INFORMATION = *mut SYSTEM_MEMORY_USAGE_INFORMATION;
+STRUCT!{struct SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION {
+ ImageFile: HANDLE,
+ Type: ULONG,
+}}
+pub type PSYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION =
+ *mut SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION;
+STRUCT!{struct SYSTEM_PHYSICAL_MEMORY_INFORMATION {
+ TotalPhysicalBytes: ULONGLONG,
+ LowestPhysicalAddress: ULONGLONG,
+ HighestPhysicalAddress: ULONGLONG,
+}}
+pub type PSYSTEM_PHYSICAL_MEMORY_INFORMATION = *mut SYSTEM_PHYSICAL_MEMORY_INFORMATION;
+ENUM!{enum SYSTEM_ACTIVITY_MODERATION_STATE {
+ SystemActivityModerationStateSystemManaged = 0,
+ SystemActivityModerationStateUserManagedAllowThrottling = 1,
+ SystemActivityModerationStateUserManagedDisableThrottling = 2,
+ MaxSystemActivityModerationState = 3,
+}}
+ENUM!{enum SYSTEM_ACTIVITY_MODERATION_APP_TYPE {
+ SystemActivityModerationAppTypeClassic = 0,
+ SystemActivityModerationAppTypePackaged = 1,
+ MaxSystemActivityModerationAppType = 2,
+}}
+STRUCT!{struct SYSTEM_ACTIVITY_MODERATION_INFO {
+ Identifier: UNICODE_STRING,
+ ModerationState: SYSTEM_ACTIVITY_MODERATION_STATE,
+ AppType: SYSTEM_ACTIVITY_MODERATION_APP_TYPE,
+}}
+pub type PSYSTEM_ACTIVITY_MODERATION_INFO = *mut SYSTEM_ACTIVITY_MODERATION_INFO;
+STRUCT!{struct SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS {
+ UserKeyHandle: HANDLE,
+}}
+pub type PSYSTEM_ACTIVITY_MODERATION_USER_SETTINGS = *mut SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS;
+STRUCT!{struct SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION {
+ Flags: ULONG,
+ UnlockId: [UCHAR; 32],
+}}
+BITFIELD!{SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION Flags: ULONG [
+ Locked set_Locked[0..1],
+ Unlockable set_Unlockable[1..2],
+ UnlockApplied set_UnlockApplied[2..3],
+ UnlockIdValid set_UnlockIdValid[3..4],
+ Reserved set_Reserved[4..32],
+]}
+pub type PSYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION = *mut SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION;
+STRUCT!{struct SYSTEM_FLUSH_INFORMATION {
+ SupportedFlushMethods: ULONG,
+ ProcessorCacheFlushSize: ULONG,
+ SystemFlushCapabilities: ULONGLONG,
+ Reserved: [ULONGLONG; 2],
+}}
+pub type PSYSTEM_FLUSH_INFORMATION = *mut SYSTEM_FLUSH_INFORMATION;
+STRUCT!{struct SYSTEM_WRITE_CONSTRAINT_INFORMATION {
+ WriteConstraintPolicy: ULONG,
+ Reserved: ULONG,
+}}
+pub type PSYSTEM_WRITE_CONSTRAINT_INFORMATION = *mut SYSTEM_WRITE_CONSTRAINT_INFORMATION;
+STRUCT!{struct SYSTEM_KERNEL_VA_SHADOW_INFORMATION {
+ Flags: ULONG,
+}}
+BITFIELD!{SYSTEM_KERNEL_VA_SHADOW_INFORMATION Flags: ULONG [
+ KvaShadowEnabled set_KvaShadowEnabled[0..1],
+ KvaShadowUserGlobal set_KvaShadowUserGlobal[1..2],
+ KvaShadowPcid set_KvaShadowPcid[2..3],
+ KvaShadowInvpcid set_KvaShadowInvpcid[3..4],
+ KvaShadowRequired set_KvaShadowRequired[4..5],
+ KvaShadowRequiredAvailable set_KvaShadowRequiredAvailable[5..6],
+ InvalidPteBit set_InvalidPteBit[6..12],
+ L1DataCacheFlushSupported set_L1DataCacheFlushSupported[12..13],
+ L1TerminalFaultMitigationPresent set_L1TerminalFaultMitigationPresent[13..14],
+ Reserved set_Reserved[14..32],
+]}
+pub type PSYSTEM_KERNEL_VA_SHADOW_INFORMATION = *mut SYSTEM_KERNEL_VA_SHADOW_INFORMATION;
+STRUCT!{struct SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION {
+ FileHandle: HANDLE,
+ ImageSize: ULONG,
+ Image: PVOID,
+}}
+pub type PSYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION =
+ *mut SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION;
+STRUCT!{struct SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION {
+ HypervisorSharedUserVa: PVOID,
+}}
+pub type PSYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION =
+ *mut SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION;
+STRUCT!{struct SYSTEM_SPECULATION_CONTROL_INFORMATION {
+ Flags: ULONG,
+}}
+BITFIELD!{SYSTEM_SPECULATION_CONTROL_INFORMATION Flags: ULONG [
+ BpbEnabled set_BpbEnabled[0..1],
+ BpbDisabledSystemPolicy set_BpbDisabledSystemPolicy[1..2],
+ BpbDisabledNoHardwareSupport set_BpbDisabledNoHardwareSupport[2..3],
+ SpecCtrlEnumerated set_SpecCtrlEnumerated[3..4],
+ SpecCmdEnumerated set_SpecCmdEnumerated[4..5],
+ IbrsPresent set_IbrsPresent[5..6],
+ StibpPresent set_StibpPresent[6..7],
+ SmepPresent set_SmepPresent[7..8],
+ SpeculativeStoreBypassDisableAvailable set_SpeculativeStoreBypassDisableAvailable[8..9],
+ SpeculativeStoreBypassDisableSupported set_SpeculativeStoreBypassDisableSupported[9..10],
+ SpeculativeStoreBypassDisabledSystemWide set_SpeculativeStoreBypassDisabledSystemWide[10..11],
+ SpeculativeStoreBypassDisabledKernel set_SpeculativeStoreBypassDisabledKernel[11..12],
+ SpeculativeStoreBypassDisableRequired set_SpeculativeStoreBypassDisableRequired[12..13],
+ BpbDisabledKernelToUser set_BpbDisabledKernelToUser[13..14],
+ SpecCtrlRetpolineEnabled set_SpecCtrlRetpolineEnabled[14..15],
+ SpecCtrlImportOptimizationEnabled set_SpecCtrlImportOptimizationEnabled[15..16],
+ Reserved set_Reserved[16..32],
+]}
+pub type PSYSTEM_SPECULATION_CONTROL_INFORMATION = *mut SYSTEM_SPECULATION_CONTROL_INFORMATION;
+STRUCT!{struct SYSTEM_DMA_GUARD_POLICY_INFORMATION {
+ DmaGuardPolicyEnabled: BOOLEAN,
+}}
+pub type PSYSTEM_DMA_GUARD_POLICY_INFORMATION = *mut SYSTEM_DMA_GUARD_POLICY_INFORMATION;
+STRUCT!{struct SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION {
+ EnclaveLaunchSigner: [UCHAR; 32],
+}}
+pub type PSYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION =
+ *mut SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION;
+STRUCT!{struct SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION {
+ WorkloadClass: ULONGLONG,
+ CpuSets: [ULONGLONG; 1],
+}}
+pub type PSYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION =
+ *mut SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtQuerySystemInformation(
+ SystemInformationClass: SYSTEM_INFORMATION_CLASS,
+ SystemInformation: PVOID,
+ SystemInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtQuerySystemInformationEx(
+ SystemInformationClass: SYSTEM_INFORMATION_CLASS,
+ InputBuffer: PVOID,
+ InputBufferLength: ULONG,
+ SystemInformation: PVOID,
+ SystemInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetSystemInformation(
+ SystemInformationClass: SYSTEM_INFORMATION_CLASS,
+ SystemInformation: PVOID,
+ SystemInformationLength: ULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum SYSDBG_COMMAND {
+ SysDbgQueryModuleInformation = 0,
+ SysDbgQueryTraceInformation = 1,
+ SysDbgSetTracepoint = 2,
+ SysDbgSetSpecialCall = 3,
+ SysDbgClearSpecialCalls = 4,
+ SysDbgQuerySpecialCalls = 5,
+ SysDbgBreakPoint = 6,
+ SysDbgQueryVersion = 7,
+ SysDbgReadVirtual = 8,
+ SysDbgWriteVirtual = 9,
+ SysDbgReadPhysical = 10,
+ SysDbgWritePhysical = 11,
+ SysDbgReadControlSpace = 12,
+ SysDbgWriteControlSpace = 13,
+ SysDbgReadIoSpace = 14,
+ SysDbgWriteIoSpace = 15,
+ SysDbgReadMsr = 16,
+ SysDbgWriteMsr = 17,
+ SysDbgReadBusData = 18,
+ SysDbgWriteBusData = 19,
+ SysDbgCheckLowMemory = 20,
+ SysDbgEnableKernelDebugger = 21,
+ SysDbgDisableKernelDebugger = 22,
+ SysDbgGetAutoKdEnable = 23,
+ SysDbgSetAutoKdEnable = 24,
+ SysDbgGetPrintBufferSize = 25,
+ SysDbgSetPrintBufferSize = 26,
+ SysDbgGetKdUmExceptionEnable = 27,
+ SysDbgSetKdUmExceptionEnable = 28,
+ SysDbgGetTriageDump = 29,
+ SysDbgGetKdBlockEnable = 30,
+ SysDbgSetKdBlockEnable = 31,
+ SysDbgRegisterForUmBreakInfo = 32,
+ SysDbgGetUmBreakPid = 33,
+ SysDbgClearUmBreakPid = 34,
+ SysDbgGetUmAttachPid = 35,
+ SysDbgClearUmAttachPid = 36,
+ SysDbgGetLiveKernelDump = 37,
+}}
+pub type PSYSDBG_COMMAND = *mut SYSDBG_COMMAND;
+STRUCT!{struct SYSDBG_VIRTUAL {
+ Address: PVOID,
+ Buffer: PVOID,
+ Request: ULONG,
+}}
+pub type PSYSDBG_VIRTUAL = *mut SYSDBG_VIRTUAL;
+STRUCT!{struct SYSDBG_PHYSICAL {
+ Address: PHYSICAL_ADDRESS,
+ Buffer: PVOID,
+ Request: ULONG,
+}}
+pub type PSYSDBG_PHYSICAL = *mut SYSDBG_PHYSICAL;
+STRUCT!{struct SYSDBG_CONTROL_SPACE {
+ Address: ULONG64,
+ Buffer: PVOID,
+ Request: ULONG,
+ Processor: ULONG,
+}}
+pub type PSYSDBG_CONTROL_SPACE = *mut SYSDBG_CONTROL_SPACE;
+STRUCT!{struct SYSDBG_IO_SPACE {
+ Address: ULONG64,
+ Buffer: PVOID,
+ Request: ULONG,
+ InterfaceType: INTERFACE_TYPE,
+ BusNumber: ULONG,
+ AddressSpace: ULONG,
+}}
+pub type PSYSDBG_IO_SPACE = *mut SYSDBG_IO_SPACE;
+STRUCT!{struct SYSDBG_MSR {
+ Msr: ULONG,
+ Data: ULONG64,
+}}
+pub type PSYSDBG_MSR = *mut SYSDBG_MSR;
+STRUCT!{struct SYSDBG_BUS_DATA {
+ Address: ULONG,
+ Buffer: PVOID,
+ Request: ULONG,
+ BusDataType: BUS_DATA_TYPE,
+ BusNumber: ULONG,
+ SlotNumber: ULONG,
+}}
+pub type PSYSDBG_BUS_DATA = *mut SYSDBG_BUS_DATA;
+STRUCT!{struct SYSDBG_TRIAGE_DUMP {
+ Flags: ULONG,
+ BugCheckCode: ULONG,
+ BugCheckParam1: ULONG_PTR,
+ BugCheckParam2: ULONG_PTR,
+ BugCheckParam3: ULONG_PTR,
+ BugCheckParam4: ULONG_PTR,
+ ProcessHandles: ULONG,
+ ThreadHandles: ULONG,
+ Handles: PHANDLE,
+}}
+pub type PSYSDBG_TRIAGE_DUMP = *mut SYSDBG_TRIAGE_DUMP;
+STRUCT!{struct SYSDBG_LIVEDUMP_CONTROL_FLAGS {
+ AsUlong: ULONG,
+}}
+BITFIELD!{SYSDBG_LIVEDUMP_CONTROL_FLAGS AsUlong: ULONG [
+ UseDumpStorageStack set_UseDumpStorageStack[0..1],
+ CompressMemoryPagesData set_CompressMemoryPagesData[1..2],
+ IncludeUserSpaceMemoryPages set_IncludeUserSpaceMemoryPages[2..3],
+ AbortIfMemoryPressure set_AbortIfMemoryPressure[3..4],
+ Reserved set_Reserved[4..32],
+]}
+pub type PSYSDBG_LIVEDUMP_CONTROL_FLAGS = *mut SYSDBG_LIVEDUMP_CONTROL_FLAGS;
+STRUCT!{struct SYSDBG_LIVEDUMP_CONTROL_ADDPAGES {
+ AsUlong: ULONG,
+}}
+BITFIELD!{SYSDBG_LIVEDUMP_CONTROL_ADDPAGES AsUlong: ULONG [
+ HypervisorPages set_HypervisorPages[0..1],
+ Reserved set_Reserved[1..32],
+]}
+pub type PSYSDBG_LIVEDUMP_CONTROL_ADDPAGES = *mut SYSDBG_LIVEDUMP_CONTROL_ADDPAGES;
+pub const SYSDBG_LIVEDUMP_CONTROL_VERSION: ULONG = 1;
+STRUCT!{struct SYSDBG_LIVEDUMP_CONTROL {
+ Version: ULONG,
+ BugCheckCode: ULONG,
+ BugCheckParam1: ULONG_PTR,
+ BugCheckParam2: ULONG_PTR,
+ BugCheckParam3: ULONG_PTR,
+ BugCheckParam4: ULONG_PTR,
+ DumpFileHandle: HANDLE,
+ CancelEventHandle: HANDLE,
+ Flags: SYSDBG_LIVEDUMP_CONTROL_FLAGS,
+ AddPagesControl: SYSDBG_LIVEDUMP_CONTROL_ADDPAGES,
+}}
+pub type PSYSDBG_LIVEDUMP_CONTROL = *mut SYSDBG_LIVEDUMP_CONTROL;
+EXTERN!{extern "system" {
+ fn NtSystemDebugControl(
+ Command: SYSDBG_COMMAND,
+ InputBuffer: PVOID,
+ InputBufferLength: ULONG,
+ OutputBuffer: PVOID,
+ OutputBufferLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum HARDERROR_RESPONSE_OPTION {
+ OptionAbortRetryIgnore = 0,
+ OptionOk = 1,
+ OptionOkCancel = 2,
+ OptionRetryCancel = 3,
+ OptionYesNo = 4,
+ OptionYesNoCancel = 5,
+ OptionShutdownSystem = 6,
+ OptionOkNoWait = 7,
+ OptionCancelTryContinue = 8,
+}}
+ENUM!{enum HARDERROR_RESPONSE {
+ ResponseReturnToCaller = 0,
+ ResponseNotHandled = 1,
+ ResponseAbort = 2,
+ ResponseCancel = 3,
+ ResponseIgnore = 4,
+ ResponseNo = 5,
+ ResponseOk = 6,
+ ResponseRetry = 7,
+ ResponseYes = 8,
+ ResponseTryAgain = 9,
+ ResponseContinue = 10,
+}}
+pub const HARDERROR_OVERRIDE_ERRORMODE: ULONG = 0x10000000;
+EXTERN!{extern "system" {
+ fn NtRaiseHardError(
+ ErrorStatus: NTSTATUS,
+ NumberOfParameters: ULONG,
+ UnicodeStringParameterMask: ULONG,
+ Parameters: PULONG_PTR,
+ ValidResponseOptions: ULONG,
+ Response: PULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum ALTERNATIVE_ARCHITECTURE_TYPE {
+ StandardDesign = 0,
+ NEC98x86 = 1,
+ EndAlternatives = 2,
+}}
+pub const PROCESSOR_FEATURE_MAX: usize = 64;
+pub const MAX_WOW64_SHARED_ENTRIES: u32 = 16;
+pub const NX_SUPPORT_POLICY_ALWAYSOFF: u32 = 0;
+pub const NX_SUPPORT_POLICY_ALWAYSON: u32 = 1;
+pub const NX_SUPPORT_POLICY_OPTIN: u32 = 2;
+pub const NX_SUPPORT_POLICY_OPTOUT: u32 = 3;
+UNION!{union KUSER_SHARED_DATA_u {
+ TickCount: KSYSTEM_TIME,
+ TickCountQuad: ULONG64,
+ ReservedTickCountOverlay: [ULONG; 3],
+}}
+STRUCT!{#[repr(packed(4))] struct KUSER_SHARED_DATA {
+ TickCountLowDeprecated: ULONG,
+ TickCountMultiplier: ULONG,
+ InterruptTime: KSYSTEM_TIME,
+ SystemTime: KSYSTEM_TIME,
+ TimeZoneBias: KSYSTEM_TIME,
+ ImageNumberLow: USHORT,
+ ImageNumberHigh: USHORT,
+ NtSystemRoot: [WCHAR; 260],
+ MaxStackTraceDepth: ULONG,
+ CryptoExponent: ULONG,
+ TimeZoneId: ULONG,
+ LargePageMinimum: ULONG,
+ AitSamplingValue: ULONG,
+ AppCompatFlag: ULONG,
+ RNGSeedVersion: ULONGLONG,
+ GlobalValidationRunlevel: ULONG,
+ TimeZoneBiasStamp: LONG,
+ NtBuildNumber: ULONG,
+ NtProductType: NT_PRODUCT_TYPE,
+ ProductTypeIsValid: BOOLEAN,
+ Reserved0: [UCHAR; 1],
+ NativeProcessorArchitecture: USHORT,
+ NtMajorVersion: ULONG,
+ NtMinorVersion: ULONG,
+ ProcessorFeatures: [BOOLEAN; PROCESSOR_FEATURE_MAX],
+ Reserved1: ULONG,
+ Reserved3: ULONG,
+ TimeSlip: ULONG,
+ AlternativeArchitecture: ALTERNATIVE_ARCHITECTURE_TYPE,
+ BootId: ULONG,
+ SystemExpirationDate: LARGE_INTEGER,
+ SuiteMask: ULONG,
+ KdDebuggerEnabled: BOOLEAN,
+ MitigationPolicies: UCHAR,
+ Reserved6: [UCHAR; 2],
+ ActiveConsoleId: ULONG,
+ DismountCount: ULONG,
+ ComPlusPackage: ULONG,
+ LastSystemRITEventTickCount: ULONG,
+ NumberOfPhysicalPages: ULONG,
+ SafeBootMode: BOOLEAN,
+ VirtualizationFlags: UCHAR,
+ Reserved12: [UCHAR; 2],
+ SharedDataFlags: ULONG,
+ DataFlagsPad: [ULONG; 1],
+ TestRetInstruction: ULONGLONG,
+ QpcFrequency: LONGLONG,
+ SystemCall: ULONG,
+ SystemCallPad0: ULONG,
+ SystemCallPad: [ULONGLONG; 2],
+ u: KUSER_SHARED_DATA_u,
+ //TickCountPad: [ULONG; 1],
+ Cookie: ULONG,
+ CookiePad: [ULONG; 1],
+ ConsoleSessionForegroundProcessId: LONGLONG,
+ TimeUpdateLock: ULONGLONG,
+ BaselineSystemTimeQpc: ULONGLONG,
+ BaselineInterruptTimeQpc: ULONGLONG,
+ QpcSystemTimeIncrement: ULONGLONG,
+ QpcInterruptTimeIncrement: ULONGLONG,
+ QpcSystemTimeIncrementShift: UCHAR,
+ QpcInterruptTimeIncrementShift: UCHAR,
+ UnparkedProcessorCount: USHORT,
+ EnclaveFeatureMask: [ULONG; 4],
+ TelemetryCoverageRound: ULONG,
+ UserModeGlobalLogger: [USHORT; 16],
+ ImageFileExecutionOptions: ULONG,
+ LangGenerationCount: ULONG,
+ Reserved4: ULONGLONG,
+ InterruptTimeBias: ULONG64,
+ QpcBias: ULONG64,
+ ActiveProcessorCount: ULONG,
+ ActiveGroupCount: UCHAR,
+ Reserved9: UCHAR,
+ QpcData: UCHAR,
+ TimeZoneBiasEffectiveStart: LARGE_INTEGER,
+ TimeZoneBiasEffectiveEnd: LARGE_INTEGER,
+ XState: XSTATE_CONFIGURATION,
+}}
+BITFIELD!{KUSER_SHARED_DATA MitigationPolicies: UCHAR [
+ NXSupportPolicy set_NXSupportPolicy[0..2],
+ SEHValidationPolicy set_SEHValidationPolicy[2..4],
+ CurDirDevicesSkippedForDlls set_CurDirDevicesSkippedForDlls[4..6],
+ Reserved set_Reserved[6..8],
+]}
+BITFIELD!{KUSER_SHARED_DATA SharedDataFlags: ULONG [
+ DbgErrorPortPresent set_DbgErrorPortPresent[0..1],
+ DbgElevationEnabled set_DbgElevationEnabled[1..2],
+ DbgVirtEnabled set_DbgVirtEnabled[2..3],
+ DbgInstallerDetectEnabled set_DbgInstallerDetectEnabled[3..4],
+ DbgLkgEnabled set_DbgLkgEnabled[4..5],
+ DbgDynProcessorEnabled set_DbgDynProcessorEnabled[5..6],
+ DbgConsoleBrokerEnabled set_DbgConsoleBrokerEnabled[6..7],
+ DbgSecureBootEnabled set_DbgSecureBootEnabled[7..8],
+ DbgMultiSessionSku set_DbgMultiSessionSku[8..9],
+ DbgMultiUsersInSessionSku set_DbgMultiUsersInSessionSku[9..10],
+ DbgStateSeparationEnabled set_DbgStateSeparationEnabled[10..11],
+ SpareBits set_SpareBits[11..32],
+]}
+BITFIELD!{KUSER_SHARED_DATA QpcData: UCHAR [
+ QpcBypassEnabled set_QpcBypassEnabled[0..1],
+ QpcShift set_QpcShift[1..2],
+]}
+pub type PKUSER_SHARED_DATA = *mut KUSER_SHARED_DATA;
+pub const USER_SHARED_DATA: *const KUSER_SHARED_DATA = 0x7ffe0000 as *const _;
+#[inline]
+pub unsafe fn NtGetTickCount64() -> ULONGLONG {
+ let mut tick_count: ULARGE_INTEGER = uninitialized();
+ #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] {
+ *tick_count.QuadPart_mut() = read_volatile(&(*USER_SHARED_DATA).u.TickCountQuad);
+ }
+ #[cfg(target_arch = "x86")] {
+ loop {
+ tick_count.s_mut().HighPart =
+ read_volatile(&(*USER_SHARED_DATA).u.TickCount.High1Time) as u32;
+ tick_count.s_mut().LowPart = read_volatile(&(*USER_SHARED_DATA).u.TickCount.LowPart);
+ if tick_count.s().HighPart == read_volatile(&(*USER_SHARED_DATA).u.TickCount.High2Time)
+ as u32
+ {
+ break;
+ }
+ spin_loop_hint();
+ }
+ }
+ (UInt32x32To64(tick_count.s().LowPart, (*USER_SHARED_DATA).TickCountMultiplier) >> 24)
+ + (UInt32x32To64(
+ tick_count.s().HighPart as u32,
+ (*USER_SHARED_DATA).TickCountMultiplier,
+ ) << 8)
+}
+#[inline]
+pub unsafe fn NtGetTickCount() -> ULONG {
+ #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] {
+ ((read_volatile(&(*USER_SHARED_DATA).u.TickCountQuad)
+ * (*USER_SHARED_DATA).TickCountMultiplier as u64) >> 24) as u32
+ }
+ #[cfg(target_arch = "x86")] {
+ let mut tick_count: ULARGE_INTEGER = uninitialized();
+ loop {
+ tick_count.s_mut().HighPart = read_volatile(&(*USER_SHARED_DATA).u.TickCount.High1Time)
+ as u32;
+ tick_count.s_mut().LowPart = read_volatile(&(*USER_SHARED_DATA).u.TickCount.LowPart);
+ if tick_count.s().HighPart == read_volatile(&(*USER_SHARED_DATA).u.TickCount.High2Time)
+ as u32
+ {
+ break;
+ }
+ spin_loop_hint();
+ }
+ ((UInt32x32To64(tick_count.s().LowPart, (*USER_SHARED_DATA).TickCountMultiplier) >> 24)
+ + UInt32x32To64(
+ (tick_count.s().HighPart as u32) << 8,
+ (*USER_SHARED_DATA).TickCountMultiplier,
+ )) as u32
+ }
+}
+EXTERN!{extern "system" {
+ fn NtQueryDefaultLocale(
+ UserProfile: BOOLEAN,
+ DefaultLocaleId: PLCID,
+ ) -> NTSTATUS;
+ fn NtSetDefaultLocale(
+ UserProfile: BOOLEAN,
+ DefaultLocaleId: LCID,
+ ) -> NTSTATUS;
+ fn NtQueryInstallUILanguage(
+ InstallUILanguageId: *mut LANGID,
+ ) -> NTSTATUS;
+ fn NtFlushInstallUILanguage(
+ InstallUILanguage: LANGID,
+ SetComittedFlag: ULONG,
+ ) -> NTSTATUS;
+ fn NtQueryDefaultUILanguage(
+ DefaultUILanguageId: *mut LANGID,
+ ) -> NTSTATUS;
+ fn NtSetDefaultUILanguage(
+ DefaultUILanguageId: LANGID,
+ ) -> NTSTATUS;
+ fn NtIsUILanguageComitted() -> NTSTATUS;
+ fn NtInitializeNlsFiles(
+ BaseAddress: *mut PVOID,
+ DefaultLocaleId: PLCID,
+ DefaultCasingTableSize: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtGetNlsSectionPtr(
+ SectionType: ULONG,
+ SectionData: ULONG,
+ ContextData: PVOID,
+ SectionPointer: *mut PVOID,
+ SectionSize: PULONG,
+ ) -> NTSTATUS;
+ fn NtMapCMFModule(
+ What: ULONG,
+ Index: ULONG,
+ CacheIndexOut: PULONG,
+ CacheFlagsOut: PULONG,
+ ViewSizeOut: PULONG,
+ BaseAddress: *mut PVOID,
+ ) -> NTSTATUS;
+ fn NtGetMUIRegistryInfo(
+ Flags: ULONG,
+ DataSize: PULONG,
+ Data: PVOID,
+ ) -> NTSTATUS;
+ fn NtAddAtom(
+ AtomName: PWSTR,
+ Length: ULONG,
+ Atom: PRTL_ATOM,
+ ) -> NTSTATUS;
+}}
+pub const ATOM_FLAG_GLOBAL: ULONG = 0x2;
+EXTERN!{extern "system" {
+ fn NtAddAtomEx(
+ AtomName: PWSTR,
+ Length: ULONG,
+ Atom: PRTL_ATOM,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtFindAtom(
+ AtomName: PWSTR,
+ Length: ULONG,
+ Atom: PRTL_ATOM,
+ ) -> NTSTATUS;
+ fn NtDeleteAtom(
+ Atom: RTL_ATOM,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum ATOM_INFORMATION_CLASS {
+ AtomBasicInformation = 0,
+ AtomTableInformation = 1,
+}}
+STRUCT!{struct ATOM_BASIC_INFORMATION {
+ UsageCount: USHORT,
+ Flags: USHORT,
+ NameLength: USHORT,
+ Name: [WCHAR; 1],
+}}
+pub type PATOM_BASIC_INFORMATION = *mut ATOM_BASIC_INFORMATION;
+STRUCT!{struct ATOM_TABLE_INFORMATION {
+ NumberOfAtoms: ULONG,
+ Atoms: [RTL_ATOM; 1],
+}}
+pub type PATOM_TABLE_INFORMATION = *mut ATOM_TABLE_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtQueryInformationAtom(
+ Atom: RTL_ATOM,
+ AtomInformationClass: ATOM_INFORMATION_CLASS,
+ AtomInformation: PVOID,
+ AtomInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
+pub const FLG_STOP_ON_EXCEPTION: u32 = 0x00000001;
+pub const FLG_SHOW_LDR_SNAPS: u32 = 0x00000002;
+pub const FLG_DEBUG_INITIAL_COMMAND: u32 = 0x00000004;
+pub const FLG_STOP_ON_HUNG_GUI: u32 = 0x00000008;
+pub const FLG_HEAP_ENABLE_TAIL_CHECK: u32 = 0x00000010;
+pub const FLG_HEAP_ENABLE_FREE_CHECK: u32 = 0x00000020;
+pub const FLG_HEAP_VALIDATE_PARAMETERS: u32 = 0x00000040;
+pub const FLG_HEAP_VALIDATE_ALL: u32 = 0x00000080;
+pub const FLG_APPLICATION_VERIFIER: u32 = 0x00000100;
+pub const FLG_POOL_ENABLE_TAGGING: u32 = 0x00000400;
+pub const FLG_HEAP_ENABLE_TAGGING: u32 = 0x00000800;
+pub const FLG_USER_STACK_TRACE_DB: u32 = 0x00001000;
+pub const FLG_KERNEL_STACK_TRACE_DB: u32 = 0x00002000;
+pub const FLG_MAINTAIN_OBJECT_TYPELIST: u32 = 0x00004000;
+pub const FLG_HEAP_ENABLE_TAG_BY_DLL: u32 = 0x00008000;
+pub const FLG_DISABLE_STACK_EXTENSION: u32 = 0x00010000;
+pub const FLG_ENABLE_CSRDEBUG: u32 = 0x00020000;
+pub const FLG_ENABLE_KDEBUG_SYMBOL_LOAD: u32 = 0x00040000;
+pub const FLG_DISABLE_PAGE_KERNEL_STACKS: u32 = 0x00080000;
+pub const FLG_ENABLE_SYSTEM_CRIT_BREAKS: u32 = 0x00100000;
+pub const FLG_HEAP_DISABLE_COALESCING: u32 = 0x00200000;
+pub const FLG_ENABLE_CLOSE_EXCEPTIONS: u32 = 0x00400000;
+pub const FLG_ENABLE_EXCEPTION_LOGGING: u32 = 0x00800000;
+pub const FLG_ENABLE_HANDLE_TYPE_TAGGING: u32 = 0x01000000;
+pub const FLG_HEAP_PAGE_ALLOCS: u32 = 0x02000000;
+pub const FLG_DEBUG_INITIAL_COMMAND_EX: u32 = 0x04000000;
+pub const FLG_DISABLE_DBGPRINT: u32 = 0x08000000;
+pub const FLG_CRITSEC_EVENT_CREATION: u32 = 0x10000000;
+pub const FLG_LDR_TOP_DOWN: u32 = 0x20000000;
+pub const FLG_ENABLE_HANDLE_EXCEPTIONS: u32 = 0x40000000;
+pub const FLG_DISABLE_PROTDLLS: u32 = 0x80000000;
+pub const FLG_VALID_BITS: u32 = 0xfffffdff;
+pub const FLG_USERMODE_VALID_BITS: u32 = FLG_STOP_ON_EXCEPTION | FLG_SHOW_LDR_SNAPS
+ | FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS
+ | FLG_HEAP_VALIDATE_ALL | FLG_APPLICATION_VERIFIER | FLG_HEAP_ENABLE_TAGGING
+ | FLG_USER_STACK_TRACE_DB | FLG_HEAP_ENABLE_TAG_BY_DLL | FLG_DISABLE_STACK_EXTENSION
+ | FLG_ENABLE_SYSTEM_CRIT_BREAKS | FLG_HEAP_DISABLE_COALESCING | FLG_DISABLE_PROTDLLS
+ | FLG_HEAP_PAGE_ALLOCS | FLG_CRITSEC_EVENT_CREATION | FLG_LDR_TOP_DOWN;
+pub const FLG_BOOTONLY_VALID_BITS: u32 = FLG_KERNEL_STACK_TRACE_DB | FLG_MAINTAIN_OBJECT_TYPELIST
+ | FLG_ENABLE_CSRDEBUG | FLG_DEBUG_INITIAL_COMMAND | FLG_DEBUG_INITIAL_COMMAND_EX
+ | FLG_DISABLE_PAGE_KERNEL_STACKS;
+pub const FLG_KERNELMODE_VALID_BITS: u32 = FLG_STOP_ON_EXCEPTION | FLG_SHOW_LDR_SNAPS
+ | FLG_STOP_ON_HUNG_GUI | FLG_POOL_ENABLE_TAGGING | FLG_ENABLE_KDEBUG_SYMBOL_LOAD
+ | FLG_ENABLE_CLOSE_EXCEPTIONS | FLG_ENABLE_EXCEPTION_LOGGING | FLG_ENABLE_HANDLE_TYPE_TAGGING
+ | FLG_DISABLE_DBGPRINT | FLG_ENABLE_HANDLE_EXCEPTIONS;
+EXTERN!{extern "system" {
+ fn NtQueryLicenseValue(
+ ValueName: PUNICODE_STRING,
+ Type: PULONG,
+ Data: PVOID,
+ DataSize: ULONG,
+ ResultDataSize: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetDefaultHardErrorPort(
+ DefaultHardErrorPort: HANDLE,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum SHUTDOWN_ACTION {
+ ShutdownNoReboot = 0,
+ ShutdownReboot = 1,
+ ShutdownPowerOff = 2,
+}}
+EXTERN!{extern "system" {
+ fn NtShutdownSystem(
+ Action: SHUTDOWN_ACTION,
+ ) -> NTSTATUS;
+ fn NtDisplayString(
+ String: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn NtDrawText(
+ Text: PUNICODE_STRING,
+ ) -> NTSTATUS;
+}}
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-23 19:55:47 +0000