nt.h revision 0dce96288d862069ff8c049d6b7a8dc625f9f555
adf2bcd2e5d07d5a11553b88e147c1f4b2249bffvboxsync * IPRT - Header for code using the Native NT API.
56343f236d9d7c0e3d2b75e23f0f5575dc77f2e3vboxsync * Copyright (C) 2010-2014 Oracle Corporation
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * This file is part of VirtualBox Open Source Edition (OSE), as
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * available from http://www.virtualbox.org. This file is free software;
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * you can redistribute it and/or modify it under the terms of the GNU
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * General Public License (GPL) as published by the Free Software
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * Foundation, in version 2 as it comes in the "COPYING" file of the
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * The contents of this file may alternatively be used under the terms
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * of the Common Development and Distribution License Version 1.0
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * VirtualBox OSE distribution, in which case the provisions of the
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * CDDL are applicable instead of those of the GPL.
70bb61ea2f96e80150e807529ce5df435607706bvboxsync * You may elect to license modified versions of this file under the
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * terms and conditions of either the GPL or the CDDL or both.
edefdc20eedaf9ef5b1293e56ba9b8cca7b5c740vboxsync/** @def IPRT_NT_MAP_TO_ZW
edefdc20eedaf9ef5b1293e56ba9b8cca7b5c740vboxsync * Map Nt calls to Zw calls. In ring-0 the Zw calls let you pass kernel memory
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync * to the APIs (takes care of the previous context checks).
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync# define NtQueryInformationFile ZwQueryInformationFile
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync# define NtQueryInformationProcess ZwQueryInformationProcess
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync# define NtQueryInformationThread ZwQueryInformationThread
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync# define NtQuerySystemInformation ZwQuerySystemInformation
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync# define NtQuerySecurityObject ZwQuerySecurityObject
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync/** @todo this is very incomplete! */
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync * Hacks common to both base header sets.
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync#define RtlFreeUnicodeString WrongLinkage_RtlFreeUnicodeString
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync#define NtSetInformationObject Incomplete_NtSetInformationObject
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync#define _OBJECT_INFORMATION_CLASS Incomplete_OBJECT_INFORMATION_CLASS
8fdb854581fe3cb394d84835dc09b02e6e18d4edvboxsync#define OBJECT_INFORMATION_CLASS Incomplete_OBJECT_INFORMATION_CLASS
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync#define ObjectBasicInformation Incomplete_ObjectBasicInformation
5e0d1b28833a92e30446e95ced085bce4d794067vboxsync#define ObjectTypeInformation Incomplete_ObjectTypeInformation
6e12ccc60ac657fb87e27b7a2b26e0a63bebe024vboxsync#define _KUSER_SHARED_DATA Incomplete__KUSER_SHARED_DATA
db0ecde8f28fdb4525bc6d94056166c70b02ebb8vboxsync#define KUSER_SHARED_DATA Incomplete_KUSER_SHARED_DATA
db0ecde8f28fdb4525bc6d94056166c70b02ebb8vboxsync#define PKUSER_SHARED_DATA Incomplete_PKUSER_SHARED_DATA
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define _FILE_INFORMATION_CLASS IncompleteWinternl_FILE_INFORMATION_CLASS
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define FILE_INFORMATION_CLASS IncompleteWinternl_FILE_INFORMATION_CLASS
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define FileDirectoryInformation IncompleteWinternl_FileDirectoryInformation
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define NtQueryInformationProcess IncompleteWinternl_NtQueryInformationProcess
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define NtSetInformationProcess IncompleteWinternl_NtSetInformationProcess
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define PROCESSINFOCLASS IncompleteWinternl_PROCESSINFOCLASS
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define _PROCESSINFOCLASS IncompleteWinternl_PROCESSINFOCLASS
2a5e5a032e6f23f8937718e4ee4d6979188bdd19vboxsync# define PROCESS_BASIC_INFORMATION IncompleteWinternl_PROCESS_BASIC_INFORMATION
2a5e5a032e6f23f8937718e4ee4d6979188bdd19vboxsync# define PPROCESS_BASIC_INFORMATION IncompleteWinternl_PPROCESS_BASIC_INFORMATION
2a5e5a032e6f23f8937718e4ee4d6979188bdd19vboxsync# define _PROCESS_BASIC_INFORMATION IncompleteWinternl_PROCESS_BASIC_INFORMATION
2a5e5a032e6f23f8937718e4ee4d6979188bdd19vboxsync# define ProcessBasicInformation IncompleteWinternl_ProcessBasicInformation
2a5e5a032e6f23f8937718e4ee4d6979188bdd19vboxsync# define ProcessDebugPort IncompleteWinternl_ProcessDebugPort
2a5e5a032e6f23f8937718e4ee4d6979188bdd19vboxsync# define ProcessWow64Information IncompleteWinternl_ProcessWow64Information
2a5e5a032e6f23f8937718e4ee4d6979188bdd19vboxsync# define ProcessImageFileName IncompleteWinternl_ProcessImageFileName
2a5e5a032e6f23f8937718e4ee4d6979188bdd19vboxsync# define ProcessBreakOnTermination IncompleteWinternl_ProcessBreakOnTermination
2a5e5a032e6f23f8937718e4ee4d6979188bdd19vboxsync# define RTL_USER_PROCESS_PARAMETERS IncompleteWinternl_RTL_USER_PROCESS_PARAMETERS
2a5e5a032e6f23f8937718e4ee4d6979188bdd19vboxsync# define PRTL_USER_PROCESS_PARAMETERS IncompleteWinternl_PRTL_USER_PROCESS_PARAMETERS
2a5e5a032e6f23f8937718e4ee4d6979188bdd19vboxsync# define _RTL_USER_PROCESS_PARAMETERS IncompleteWinternl__RTL_USER_PROCESS_PARAMETERS
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define NtQueryInformationThread IncompleteWinternl_NtQueryInformationThread
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define NtSetInformationThread IncompleteWinternl_NtSetInformationThread
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync# define THREADINFOCLASS IncompleteWinternl_THREADINFOCLASS
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define _THREADINFOCLASS IncompleteWinternl_THREADINFOCLASS
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define ThreadIsIoPending IncompleteWinternl_ThreadIsIoPending
b604fbf16eda38d14b4999c245f032bfaa5aa85avboxsync# define NtQuerySystemInformation IncompleteWinternl_NtQuerySystemInformation
13d1fd6f43e9a245a4f2b4fc6845bdaa5d0f4134vboxsync# define NtSetSystemInformation IncompleteWinternl_NtSetSystemInformation
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define SYSTEM_INFORMATION_CLASS IncompleteWinternl_SYSTEM_INFORMATION_CLASS
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define _SYSTEM_INFORMATION_CLASS IncompleteWinternl_SYSTEM_INFORMATION_CLASS
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define SystemBasicInformation IncompleteWinternl_SystemBasicInformation
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define SystemPerformanceInformation IncompleteWinternl_SystemPerformanceInformation
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define SystemTimeOfDayInformation IncompleteWinternl_SystemTimeOfDayInformation
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync# define SystemProcessInformation IncompleteWinternl_SystemProcessInformation
4b9a9888c020ed3508c8ac3a5b47842d6aa3f8d2vboxsync# define SystemProcessorPerformanceInformation IncompleteWinternl_SystemProcessorPerformanceInformation
4b9a9888c020ed3508c8ac3a5b47842d6aa3f8d2vboxsync# define SystemInterruptInformation IncompleteWinternl_SystemInterruptInformation
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsync# define SystemExceptionInformation IncompleteWinternl_SystemExceptionInformation
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsync# define SystemRegistryQuotaInformation IncompleteWinternl_SystemRegistryQuotaInformation
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsync# define SystemLookasideInformation IncompleteWinternl_SystemLookasideInformation
62a515eec8de1b7804ec6997c0f2013fef5c5a6bvboxsync# define SystemPolicyInformation IncompleteWinternl_SystemPolicyInformation
40dce69ff1c2949a489337922f30f1021d62d864vboxsync# define _InterlockedAddLargeStatistic _InterlockedAddLargeStatistic_StupidDDKVsCompilerCrap
261b44f7fa60a1d4bb4102142d3aa44188908484vboxsync/** @name Useful macros
261b44f7fa60a1d4bb4102142d3aa44188908484vboxsync/** Indicates that we're targetting native NT in the current source. */
56343f236d9d7c0e3d2b75e23f0f5575dc77f2e3vboxsync/** Initializes a IO_STATUS_BLOCK. */
261b44f7fa60a1d4bb4102142d3aa44188908484vboxsync#define RTNT_IO_STATUS_BLOCK_INITIALIZER { STATUS_FAILED_DRIVER_ENTRY, ~(uintptr_t)42 }
261b44f7fa60a1d4bb4102142d3aa44188908484vboxsync/** Similar to INVALID_HANDLE_VALUE in the Windows environment. */
c33fc49611f2444dade533488bf431e29eb88bcdvboxsync#define RTNT_INVALID_HANDLE_VALUE ( (HANDLE)~(uintptr_t)0 )
261b44f7fa60a1d4bb4102142d3aa44188908484vboxsync/** Constant UNICODE_STRING initializer. */
1bf151411167b02ebdc6d6a18de8b97030341e1fvboxsync#define RTNT_CONSTANT_UNISTR(a_String) { sizeof(a_String) - sizeof(WCHAR), sizeof(a_String), (WCHAR *)a_String }
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync/** @name IPRT helper functions for NT
657b2c9f6d33f08001e5fa6f6e0572dcf0391013vboxsyncRTDECL(int) RTNtPathOpen(const char *pszPath, ACCESS_MASK fDesiredAccess, ULONG fFileAttribs, ULONG fShareAccess,
e2760cdc84c692bc46cfaf5018d313db2f122acavboxsync ULONG fCreateDisposition, ULONG fCreateOptions, ULONG fObjAttribs,
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsyncRTDECL(int) RTNtPathOpenDir(const char *pszPath, ACCESS_MASK fDesiredAccess, ULONG fShareAccess, ULONG fCreateOptions,
261b44f7fa60a1d4bb4102142d3aa44188908484vboxsync ULONG fObjAttribs, PHANDLE phHandle, bool *pfObjDir);
261b44f7fa60a1d4bb4102142d3aa44188908484vboxsync * Converts a UTF-16 windows-style path to NT format.
fc5f879e9508f333e20b37c63db9189a33059308vboxsync * @returns IPRT status code.
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync * @param pNtName Where to return the NT name. Free using
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync * RTNtPathFree.
1c6ec9a3a329da6f61978a372e509cd233f0d9f9vboxsync * @param phRootDir Where to return the root handle, if applicable.
261b44f7fa60a1d4bb4102142d3aa44188908484vboxsync * @param pwszPath The UTF-16 windows-style path.
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync * @param cwcPath The max length of the windows-style path in
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync * RTUTF16 units. Use RTSTR_MAX if unknown and @a
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync * pwszPath is correctly terminated.
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsyncRTDECL(int) RTNtPathFromWinUtf16Ex(struct _UNICODE_STRING *pNtName, HANDLE *phRootDir, PCRTUTF16 pwszPath, size_t cwcPath);
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync * Frees the native path and root handle.
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync * @param pNtName The NT path after a successful
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync * RTNtPathFromWinUtf16Ex call.
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync * @param phRootDir The root handle variable after a successfull
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync * RTNtPathFromWinUtf16Ex call.
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsyncRTDECL(void) RTNtPathFree(struct _UNICODE_STRING *pNtName, HANDLE *phRootDir);
13d1fd6f43e9a245a4f2b4fc6845bdaa5d0f4134vboxsync/** @name NT API delcarations.
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync/** @name Process access rights missing in ntddk headers
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsync# define PROCESS_CREATE_PROCESS UINT32_C(0x00000080)
3933885bc0c2c93436d858a14564c6179ec72872vboxsync# define PROCESS_SET_INFORMATION UINT32_C(0x00000200)
3933885bc0c2c93436d858a14564c6179ec72872vboxsync# define PROCESS_QUERY_INFORMATION UINT32_C(0x00000400)
060f7ec6ae5c99df18341ef2e1f3e91f4b0c89f1vboxsync# define PROCESS_SUSPEND_RESUME UINT32_C(0x00000800)
a72b5355eb89aafe6bfcc8912cf02645d7cccceavboxsync# define PROCESS_QUERY_LIMITED_INFORMATION UINT32_C(0x00001000)
6e25221ce8ef8e656d1e15eb7ec5cf8ae758ceb2vboxsync# define PROCESS_SET_LIMITED_INFORMATION UINT32_C(0x00002000)
9ca017ceee656f9d33f2cb6652e401b5f17fcfb7vboxsync# define PROCESS_ALL_ACCESS ( STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | UINT32_C(0x0000ffff) )
261b44f7fa60a1d4bb4102142d3aa44188908484vboxsync/** @name Thread access rights missing in ntddk headers
f106b549ead77cab51ff1e2c116060aaabb90d5evboxsync# define THREAD_QUERY_INFORMATION UINT32_C(0x00000040)
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync# define THREAD_SET_THREAD_TOKEN UINT32_C(0x00000080)
dbabc9de5bf52ce5eb77cf82b038e9a6166c5a04vboxsync# define THREAD_DIRECT_IMPERSONATION UINT32_C(0x00000200)
f57758f0bcf995d350d64a7c059ac93573144c05vboxsync/** @name Special handle values.
3f00104a87d8a725dfa0348b69cbdac901062a4avboxsync# define NtCurrentProcess() ( (HANDLE)-(intptr_t)1 )
7708252d252a55417a6a817041e4356797e34255vboxsync/** @name Directory object access rights.
a1b4fb3917412d2632d358ff8989f1ec971f2d5bvboxsync# define DIRECTORY_CREATE_OBJECT UINT32_C(0x00000004)
a1b4fb3917412d2632d358ff8989f1ec971f2d5bvboxsync# define DIRECTORY_CREATE_SUBDIRECTORY UINT32_C(0x00000008)
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync# define DIRECTORY_ALL_ACCESS ( STANDARD_RIGHTS_REQUIRED | UINT32_C(0x0000000f) )
a1b4fb3917412d2632d358ff8989f1ec971f2d5bvboxsynctypedef struct _CLIENT_ID
3933885bc0c2c93436d858a14564c6179ec72872vboxsync/** Extended affinity type, introduced in Windows 7 (?). */
1147e980f6ab0b7ff1d08c13ad1c03eea30d102dvboxsync /** Count of valid bitmap entries. */
1147e980f6ab0b7ff1d08c13ad1c03eea30d102dvboxsync /** Count of allocated bitmap entries. */
1147e980f6ab0b7ff1d08c13ad1c03eea30d102dvboxsync /** Reserved / aligmment padding. */
1147e980f6ab0b7ff1d08c13ad1c03eea30d102dvboxsync /** Bitmap where one bit corresponds to a CPU. */
1147e980f6ab0b7ff1d08c13ad1c03eea30d102dvboxsync/** @name User Shared Data
508452243fd3328f7b9e0405d39fb9dc004e31b8vboxsynctypedef XSTATE_CONFIGURATION *PXSTATE_CONFIGURATION;
89aedeb1d8af54aba6ae46dbbd256281315c1be6vboxsync#endif /* IPRT_NT_USE_WINTERNL */
1147e980f6ab0b7ff1d08c13ad1c03eea30d102dvboxsync BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX]; /**< 0x274 */
e59069cf1c98c1c2e90a18ec76fbc2e9907fb917vboxsync ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture; /**< 0x2c0 */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync union /**< 0x2d5 */
361a7fb527903c8dbfd0cc7dc779f943c6e348f6vboxsync union /**< 0x2f0 */
361a7fb527903c8dbfd0cc7dc779f943c6e348f6vboxsync union /**< 0x320 */
361a7fb527903c8dbfd0cc7dc779f943c6e348f6vboxsync struct /**< 0x320 */
361a7fb527903c8dbfd0cc7dc779f943c6e348f6vboxsync LONGLONG ConsoleSessionForegroundProcessId; /**< 0x338 */
b304856b23107864c9c594a80cebca6006623f31vboxsync UCHAR QpcInterruptTimeIncrementShift; /**< 0x371 */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync ULONGLONG volatile InterruptTimeBias; /**< 0x3b0 */
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync union /**< 0x3c6 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync struct /**< 0x3c6 */
3a0bc95d0adf57baefd303e94b8f1b7b31a8f080vboxsync LARGE_INTEGER TimeZoneBiasEffectiveStart; /**< 0x3c8 */
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync LARGE_INTEGER TimeZoneBiasEffectiveEnd; /**< 0x3d0 */
8b36957d815c23b479eb35d93ac76c66392e9402vboxsyncAssertCompileMemberOffset(KUSER_SHARED_DATA, InterruptTime, 0x008);
21ddd8aa21b8d7ad25b18ab341ede34c1cb4a125vboxsyncAssertCompileMemberOffset(KUSER_SHARED_DATA, SystemTime, 0x014);
21ddd8aa21b8d7ad25b18ab341ede34c1cb4a125vboxsyncAssertCompileMemberOffset(KUSER_SHARED_DATA, NtSystemRoot, 0x030);
21ddd8aa21b8d7ad25b18ab341ede34c1cb4a125vboxsyncAssertCompileMemberOffset(KUSER_SHARED_DATA, LargePageMinimum, 0x244);
8b36957d815c23b479eb35d93ac76c66392e9402vboxsyncAssertCompileMemberOffset(KUSER_SHARED_DATA, Reserved1, 0x2b4);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsyncAssertCompileMemberOffset(KUSER_SHARED_DATA, TestRetInstruction, 0x2f8);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsyncAssertCompileMemberOffset(KUSER_SHARED_DATA, Cookie, 0x330);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsyncAssertCompileMemberOffset(KUSER_SHARED_DATA, ImageFileExecutionOptions, 0x3a0);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsyncAssertCompileMemberOffset(KUSER_SHARED_DATA, XState, 0x3d8);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync/** @def MM_SHARED_USER_DATA_VA
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync * Read only userland mapping of KUSER_SHARED_DATA. */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync# define MM_SHARED_USER_DATA_VA UINT32_C(0x7ffe0000)
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync# define MM_SHARED_USER_DATA_VA UINT64_C(0x7ffe0000)
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync/** @def KI_USER_SHARED_DATA
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync * Read write kernel mapping of KUSER_SHARED_DATA. */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync# define KI_USER_SHARED_DATA UINT64_C(0xfffff78000000000)
8fdb854581fe3cb394d84835dc09b02e6e18d4edvboxsync/** @name Process And Thread Environment Blocks
5e0d1b28833a92e30446e95ced085bce4d794067vboxsync /* End NT4 */
56343f236d9d7c0e3d2b75e23f0f5575dc77f2e3vboxsynctypedef struct _PEB_COMMON
56343f236d9d7c0e3d2b75e23f0f5575dc77f2e3vboxsync BOOLEAN InheritedAddressSpace; /**< 0x000 / 0x000 */
56343f236d9d7c0e3d2b75e23f0f5575dc77f2e3vboxsync BOOLEAN ReadImageFileExecOptions; /**< 0x001 / 0x001 */
56343f236d9d7c0e3d2b75e23f0f5575dc77f2e3vboxsync uint8_t ImageUsesLargePages : 1; /**< 0x003 / 0x003 : Pos 0, 1 Bit */
56343f236d9d7c0e3d2b75e23f0f5575dc77f2e3vboxsync uint8_t ImageUsesLargePages : 1; /**< 0x003 / 0x003 : Pos 0, 1 Bit */
56343f236d9d7c0e3d2b75e23f0f5575dc77f2e3vboxsync uint8_t IsProtectedProcess : 1; /**< 0x003 / 0x003 : Pos 1, 1 Bit */
56343f236d9d7c0e3d2b75e23f0f5575dc77f2e3vboxsync uint8_t IsImageDynamicallyRelocated : 1; /**< 0x003 / 0x003 : Pos 2, 1 Bit - Differs from W80 */
56343f236d9d7c0e3d2b75e23f0f5575dc77f2e3vboxsync uint8_t SkipPatchingUser32Forwarders : 1; /**< 0x003 / 0x003 : Pos 3, 1 Bit - Differs from W80 */
56343f236d9d7c0e3d2b75e23f0f5575dc77f2e3vboxsync uint8_t IsPackagedProcess : 1; /**< 0x003 / 0x003 : Pos 4, 1 Bit - Differs from W80 */
56343f236d9d7c0e3d2b75e23f0f5575dc77f2e3vboxsync uint8_t IsAppContainer : 1; /**< 0x003 / 0x003 : Pos 5, 1 Bit - Differs from W80 */
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync uint8_t IsProtectedProcessLight : 1; /**< 0x003 / 0x003 : Pos 6, 1 Bit - Differs from W80 */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync uint8_t SpareBits : 1; /**< 0x003 / 0x003 : Pos 7, 1 Bit */
ab2292e9c32bd271ec91123ef38699a0284b72cbvboxsync uint8_t ImageUsesLargePages : 1; /**< 0x003 / 0x003 : Pos 0, 1 Bit */
db0ecde8f28fdb4525bc6d94056166c70b02ebb8vboxsync uint8_t IsProtectedProcess : 1; /**< 0x003 / 0x003 : Pos 1, 1 Bit */
121568d0a1e932e6f6acd49376827a0e593815favboxsync uint8_t IsLegacyProcess : 1; /**< 0x003 / 0x003 : Pos 2, 1 Bit - Differs from W81 */
121568d0a1e932e6f6acd49376827a0e593815favboxsync uint8_t IsImageDynamicallyRelocated : 1; /**< 0x003 / 0x003 : Pos 3, 1 Bit - Differs from W81 */
121568d0a1e932e6f6acd49376827a0e593815favboxsync uint8_t SkipPatchingUser32Forwarders : 1; /**< 0x003 / 0x003 : Pos 4, 1 Bit - Differs from W81 */
121568d0a1e932e6f6acd49376827a0e593815favboxsync uint8_t IsPackagedProcess : 1; /**< 0x003 / 0x003 : Pos 5, 1 Bit - Differs from W81 */
121568d0a1e932e6f6acd49376827a0e593815favboxsync uint8_t IsAppContainer : 1; /**< 0x003 / 0x003 : Pos 6, 1 Bit - Differs from W81 */
121568d0a1e932e6f6acd49376827a0e593815favboxsync uint8_t SpareBits : 1; /**< 0x003 / 0x003 : Pos 7, 1 Bit */
121568d0a1e932e6f6acd49376827a0e593815favboxsync uint8_t ImageUsesLargePages : 1; /**< 0x003 / 0x003 : Pos 0, 1 Bit */
121568d0a1e932e6f6acd49376827a0e593815favboxsync uint8_t IsProtectedProcess : 1; /**< 0x003 / 0x003 : Pos 1, 1 Bit */
121568d0a1e932e6f6acd49376827a0e593815favboxsync uint8_t IsLegacyProcess : 1; /**< 0x003 / 0x003 : Pos 2, 1 Bit - Differs from W81, same as W80 & W6. */
121568d0a1e932e6f6acd49376827a0e593815favboxsync uint8_t IsImageDynamicallyRelocated : 1; /**< 0x003 / 0x003 : Pos 3, 1 Bit - Differs from W81, same as W80 & W6. */
f31ac84c1c57e23801423b5bd184fadabe6456f3vboxsync uint8_t SkipPatchingUser32Forwarders : 1; /**< 0x003 / 0x003 : Pos 4, 1 Bit - Added in W7; Differs from W81, same as W80. */
121568d0a1e932e6f6acd49376827a0e593815favboxsync uint8_t SpareBits : 3; /**< 0x003 / 0x003 : Pos 5, 3 Bit - Differs from W81 & W80, more spare bits. */
db0ecde8f28fdb4525bc6d94056166c70b02ebb8vboxsync uint8_t ImageUsesLargePages : 1; /**< 0x003 / 0x003 : Pos 0, 1 Bit */
f31ac84c1c57e23801423b5bd184fadabe6456f3vboxsync uint8_t IsProtectedProcess : 1; /**< 0x003 / 0x003 : Pos 1, 1 Bit */
db0ecde8f28fdb4525bc6d94056166c70b02ebb8vboxsync uint8_t IsLegacyProcess : 1; /**< 0x003 / 0x003 : Pos 2, 1 Bit - Differs from W81, same as W80 & W7. */
db0ecde8f28fdb4525bc6d94056166c70b02ebb8vboxsync uint8_t IsImageDynamicallyRelocated : 1; /**< 0x003 / 0x003 : Pos 3, 1 Bit - Differs from W81, same as W80 & W7. */
db0ecde8f28fdb4525bc6d94056166c70b02ebb8vboxsync uint8_t SpareBits : 4; /**< 0x003 / 0x003 : Pos 4, 4 Bit - Differs from W81, W80, & W7, more spare bits. */
db0ecde8f28fdb4525bc6d94056166c70b02ebb8vboxsync uint8_t ImageUsesLargePages : 1; /**< 0x003 / 0x003 : Pos 0, 1 Bit */
db0ecde8f28fdb4525bc6d94056166c70b02ebb8vboxsync uint8_t SpareBits : 7; /**< 0x003 / 0x003 : Pos 1, 7 Bit - Differs from W81, W80, & W7, more spare bits. */
c33fc49611f2444dade533488bf431e29eb88bcdvboxsync struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters; /**< 0x020 / 0x010 */
261b44f7fa60a1d4bb4102142d3aa44188908484vboxsync struct _RTL_CRITICAL_SECTION *FastPebLock; /**< 0x038 / 0x01c */
6efcf94383d6e48c764c6518cf1b4069ad34e210vboxsync uint32_t ProcessInJob : 1; /**< 0x050 / 0x028: Pos 0, 1 Bit */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync uint32_t ProcessInitializing : 1; /**< 0x050 / 0x028: Pos 1, 1 Bit */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync uint32_t ProcessUsingVEH : 1; /**< 0x050 / 0x028: Pos 2, 1 Bit */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint32_t ProcessUsingVCH : 1; /**< 0x050 / 0x028: Pos 3, 1 Bit */
e2760cdc84c692bc46cfaf5018d313db2f122acavboxsync uint32_t ProcessUsingFTH : 1; /**< 0x050 / 0x028: Pos 4, 1 Bit */
e2760cdc84c692bc46cfaf5018d313db2f122acavboxsync uint32_t ReservedBits0 : 1; /**< 0x050 / 0x028: Pos 5, 27 Bits */
e2760cdc84c692bc46cfaf5018d313db2f122acavboxsync uint32_t ProcessInJob : 1; /**< 0x050 / 0x028: Pos 0, 1 Bit */
6e12ccc60ac657fb87e27b7a2b26e0a63bebe024vboxsync uint32_t ProcessInitializing : 1; /**< 0x050 / 0x028: Pos 1, 1 Bit */
6e12ccc60ac657fb87e27b7a2b26e0a63bebe024vboxsync uint32_t ReservedBits0 : 30; /**< 0x050 / 0x028: Pos 2, 30 Bits */
6e12ccc60ac657fb87e27b7a2b26e0a63bebe024vboxsync uint32_t EnvironmentUpdateCount; /**< 0x050 / 0x028 */
d6f9950e2cf4ba7fd217c083400d9812ff745374vboxsync uint32_t EnvironmentUpdateCount; /**< NA / 0x028 */
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync PVOID UserSharedInfoPtr; /**< 0x058 / 0x02c - Alternative use in W6.*/
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync uint32_t ExecuteOptions : 2; /**< NA / 0x034: Pos 0, 2 Bits */
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync uint32_t SpareBits : 30; /**< NA / 0x034: Pos 2, 30 Bits */
49e54e2ffe0c10864d06e9d1ebe24a8eb1327a6bvboxsync struct _PEB_FREE_BLOCK *FreeList; /**< 0x068 / 0x038 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync struct _PEB_FREE_BLOCK *FreeList; /**< NA / 0x038 */
49e54e2ffe0c10864d06e9d1ebe24a8eb1327a6bvboxsync uint32_t TlsExpansionCounter; /**< 0x070 / 0x03c */
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync struct _RTL_BITMAP *TlsBitmap; /**< 0x078 / 0x040 */
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync PVOID ReadOnlySharedMemoryBase; /**< 0x088 / 0x04c */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync PVOID SparePvoid0; /**< 0x090 / 0x050 - HotpatchInformation before W81. */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync PVOID HotpatchInformation; /**< 0x090 / 0x050 - Retired in W81. */
91f8453d16b48876deddaba298c211071d0ca3a5vboxsync PVOID *ReadOnlyStaticServerData; /**< 0x098 / 0x054 */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync LARGE_INTEGER CriticalSectionTimeout; /**< 0x0c0 / 0x070 */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync SIZE_T HeapDeCommitTotalFreeThreshold; /**< 0x0d8 / 0x080 */
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync SIZE_T HeapDeCommitFreeBlockThreshold; /**< 0x0e0 / 0x084 */
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync uint32_t MaximumNumberOfHeaps; /**< 0x0ec / 0x08c */
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync struct _RTL_CRITICAL_SECTION *LoaderLock; /**< 0x110 / 0x0a0 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint32_t ImageSubsystemMajorVersion; /**< 0x12c / 0x0b8 */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync uint32_t ImageSubsystemMinorVersion; /**< 0x130 / 0x0bc */
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync SIZE_T ActiveProcessAffinityMask; /**< 0x138 / 0x0c0 */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync SIZE_T ImageProcessAffinityMask; /**< 0x138 / 0x0c0 */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync uint32_t GdiHandleBuffer[ARCH_BITS == 64 ? 60 : 34]; /**< 0x140 / 0x0c4 */
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync PVOID PostProcessInitRoutine; /**< 0x230 / 0x14c */
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsync uint32_t TlsExpansionBitmapBits[32]; /**< 0x240 / 0x154 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync ULARGE_INTEGER AppCompatFlags; /**< 0x2c8 / 0x1d8 */
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync ULARGE_INTEGER AppCompatFlagsUser; /**< 0x2d0 / 0x1e0 */
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync struct _ACTIVATION_CONTEXT_DATA *ActivationContextData; /**< 0x2f8 / 0x1f8 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync struct _ASSEMBLY_STORAGE_MAP *ProcessAssemblyStorageMap; /**< 0x300 / 0x1fc */
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsync struct _ACTIVATION_CONTEXT_DATA *SystemDefaultActivationContextData; /**< 0x308 / 0x200 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync struct _ASSEMBLY_STORAGE_MAP *SystemAssemblyStorageMap; /**< 0x310 / 0x204 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync /* End of PEB in W52 (Windows XP (RTM))! */
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsync struct _FLS_CALLBACK_INFO *FlsCallback; /**< 0x320 / 0x20c */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync /* End of PEB in W52 (Windows Server 2003)! */
2a5e5a032e6f23f8937718e4ee4d6979188bdd19vboxsync /* End of PEB in W6 (windows Vista)! */
4a0e2f51aaf27c0bca61ff0f1adb91106264f0dbvboxsync PVOID pUnused; /**< 0x368 / 0x238 - Was pContextData in W7. */
4a0e2f51aaf27c0bca61ff0f1adb91106264f0dbvboxsync PVOID pContextData; /**< 0x368 / 0x238 - Retired in W80. */
4a0e2f51aaf27c0bca61ff0f1adb91106264f0dbvboxsync uint32_t HeapTracingEnabled : 1; /**< 0x378 / 0x240 : Pos 0, 1 Bit */
4a0e2f51aaf27c0bca61ff0f1adb91106264f0dbvboxsync uint32_t CritSecTracingEnabled : 1; /**< 0x378 / 0x240 : Pos 1, 1 Bit */
4a0e2f51aaf27c0bca61ff0f1adb91106264f0dbvboxsync uint32_t LibLoaderTracingEnabled : 1; /**< 0x378 / 0x240 : Pos 2, 1 Bit */
4a0e2f51aaf27c0bca61ff0f1adb91106264f0dbvboxsync uint32_t SpareTracingBits : 29; /**< 0x378 / 0x240 : Pos 3, 29 Bits */
4a0e2f51aaf27c0bca61ff0f1adb91106264f0dbvboxsync uint32_t HeapTracingEnabled : 1; /**< 0x378 / 0x240 : Pos 0, 1 Bit */
4a0e2f51aaf27c0bca61ff0f1adb91106264f0dbvboxsync uint32_t CritSecTracingEnabled : 1; /**< 0x378 / 0x240 : Pos 1, 1 Bit */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint32_t SpareTracingBits : 30; /**< 0x378 / 0x240 : Pos 3, 30 Bits - One bit more than W80 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint64_t CsrServerReadOnlySharedMemoryBase; /**< 0x380 / 0x248 */
a9f530691071e3496b072915b0c5ceabd4e05ea5vboxsyncAssertCompileMemberOffset(PEB_COMMON, ProcessHeap, ARCH_BITS == 64 ? 0x30 : 0x18);
a9f530691071e3496b072915b0c5ceabd4e05ea5vboxsyncAssertCompileMemberOffset(PEB_COMMON, SystemReserved, ARCH_BITS == 64 ? 0x60 : 0x30);
a9f530691071e3496b072915b0c5ceabd4e05ea5vboxsyncAssertCompileMemberOffset(PEB_COMMON, TlsExpansionCounter, ARCH_BITS == 64 ? 0x70 : 0x3c);
67e7d53d62514401efcd0e7a34f5faf772a3fe04vboxsyncAssertCompileMemberOffset(PEB_COMMON, NtGlobalFlag, ARCH_BITS == 64 ? 0xbc : 0x68);
b7a8ce033b32a429def2feb142bc1bdd1b5dffa2vboxsyncAssertCompileMemberOffset(PEB_COMMON, LoaderLock, ARCH_BITS == 64 ? 0x110 : 0xa0);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncAssertCompileMemberOffset(PEB_COMMON, Diff5.W52.ImageProcessAffinityMask, ARCH_BITS == 64 ? 0x138 : 0xc0);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncAssertCompileMemberOffset(PEB_COMMON, PostProcessInitRoutine, ARCH_BITS == 64 ? 0x230 : 0x14c);
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsyncAssertCompileMemberOffset(PEB_COMMON, AppCompatFlags, ARCH_BITS == 64 ? 0x2c8 : 0x1d8);
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsyncAssertCompileSize(PEB_COMMON, ARCH_BITS == 64 ? 0x388 : 0x250);
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsync/** The size of the windows 8.1 PEB structure. */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync/** The size of the windows 8.0 PEB structure. */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync/** The size of the windows 7 PEB structure. */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync#define PEB_SIZE_W7 RT_UOFFSETOF(PEB_COMMON, CsrServerReadOnlySharedMemoryBase)
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync/** The size of the windows vista PEB structure. */
2a5e5a032e6f23f8937718e4ee4d6979188bdd19vboxsync/** The size of the windows server 2003 PEB structure. */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync#define PEB_SIZE_W52 RT_UOFFSETOF(PEB_COMMON, WerRegistrationData)
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync/** The size of the windows XP PEB structure. */
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsync#define PEB_SIZE_W51 RT_UOFFSETOF(PEB_COMMON, FlsCallback)
2823fbb1428e982169f04923472d7c94e7ed8385vboxsynctypedef struct _NT_TIB
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync/* Common TEB. */
2823fbb1428e982169f04923472d7c94e7ed8385vboxsynctypedef struct _TEB_COMMON
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync PVOID ThreadLocalStoragePointer; /**< 0x058 / 0x02c */
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync PPEB_COMMON ProcessEnvironmentBlock; /**< 0x060 / 0x030 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint32_t CountOfOwnedCriticalSections; /**< 0x06c / 0x038 */
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsync uint32_t FpSoftwareStatusRegister; /**< 0x10c / 0x0c8 */
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsync struct _ACTIVATION_CONTEXT_STACK *ActivationContextStackPointer;/**< 0x2c8 / 0x1a8 */
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsync uint8_t SpareBytes[ARCH_BITS == 64 ? 24 : 36]; /**< 0x2d0 / 0x1ac */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync ACTIVATION_CONTEXT_STACK ActivationContextStack; /**< NA / 0x1a8 */
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsync uint32_t SpareBytesContinues; /**< 0x2e8 / 0x1d0 */
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsync /*_GDI_TEB_BATCH*/ uint8_t GdiTebBatch[ARCH_BITS == 64 ? 0x4e8 :0x4e0]; /**< 0x2f0 / 0x1d4 */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync HANDLE GdiCachedProcessHandle; /**< 0x7e8 / 0x6bc */
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsync UNICODE_STRING StaticUnicodeString; /**< 0x1258 / 0xbf8 */
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsync WCHAR StaticUnicodeBuffer[261]; /**< 0x1268 / 0xc00 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint32_t HardErrorMode; /**< 0x16b0 / 0xf28 - Called HardErrorsAreDisabled in W51. */
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsync PVOID Instrumentation[ARCH_BITS == 64 ? 11 : 9]; /**< 0x16b8 / 0xf2c */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync PVOID InstrumentationContinues[ARCH_BITS == 64 ? 3 : 5]; /**< 0x1710 / 0xf50 */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync union /**< 0x1728 / 0xf64 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync PVOID InstrumentationContinues[1]; /**< 0x1728 / 0xf64 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync PVOID InstrumentationContinues[1]; /**< 0x1730 / 0xf68 */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync PROCESSOR_NUMBER CurrentIdealProcessor; /**< 0x1744 / 0xf74 - W7+ */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync uint32_t IdealProcessorValue; /**< 0x1744 / 0xf74 - W7+ */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync uint8_t ReservedPad1; /**< 0x1744 / 0xf74 - Called SpareBool0 in W6 */
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsync uint8_t ReservedPad2; /**< 0x1745 / 0xf75 - Called SpareBool0 in W6 */
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsync uint8_t ReservedPad3; /**< 0x1746 / 0xf76 - Called SpareBool0 in W6 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync BOOLEAN FreeStackOnTermination; /**< 0x1745 / 0xf75 */
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsync uint32_t GuaranteedStackBytes; /**< 0x1748 / 0xf78 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint32_t WaitingOnLoaderLock; /**< 0x1760 / 0xf84 */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync union /**< 0x1770 / 0xf8c */
a9f530691071e3496b072915b0c5ceabd4e05ea5vboxsync SIZE_T ReservedForCodeCoverage; /**< 0x1770 / 0xf8c */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync union /**< 0x17b0 / 0xfa8 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint16_t HeapVirtualAffinity; /**< 0x17b0 / 0xfa8 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint16_t LowFragHeapDataSlot; /**< 0x17b2 / 0xfaa */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint32_t HeapVirtualAffinity; /**< 0x17b0 / 0xfa8 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync HANDLE CurrentTransactionHandle; /**< 0x17b8 / 0xfac */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync struct _TEB_ACTIVE_FRAME *ActiveFrame; /**< 0x17c0 / 0xfb0 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync /* End of TEB in W51 (Windows XP)! */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync /* End of TEB in W52 (Windows server 2003)! */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint16_t SpareCrossTebBits : 16; /**< 0x17ec / 0xfc8 : Pos 0, 16 Bits */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint16_t SafeThunkCall : 1; /**< 0x17ee / 0xfca : Pos 0, 1 Bit */
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync uint16_t InDebugPrint : 1; /**< 0x17ee / 0xfca : Pos 1, 1 Bit */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint16_t HasFiberData : 1; /**< 0x17ee / 0xfca : Pos 2, 1 Bit */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint16_t SkipThreadAttach : 1; /**< 0x17ee / 0xfca : Pos 3, 1 Bit */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint16_t WerInShipAssertCode : 1; /**< 0x17ee / 0xfca : Pos 4, 1 Bit */
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsync uint16_t RanProcessInit : 1; /**< 0x17ee / 0xfca : Pos 5, 1 Bit */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint16_t ClonedThread : 1; /**< 0x17ee / 0xfca : Pos 6, 1 Bit */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint16_t SuppressDebugMsg : 1; /**< 0x17ee / 0xfca : Pos 7, 1 Bit */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint16_t SafeThunkCall : 1; /**< 0x17ee / 0xfca : Pos 0, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t InDebugPrint : 1; /**< 0x17ee / 0xfca : Pos 1, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t HasFiberData : 1; /**< 0x17ee / 0xfca : Pos 2, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t SkipThreadAttach : 1; /**< 0x17ee / 0xfca : Pos 3, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t WerInShipAssertCode : 1; /**< 0x17ee / 0xfca : Pos 4, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t RanProcessInit : 1; /**< 0x17ee / 0xfca : Pos 5, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t ClonedThread : 1; /**< 0x17ee / 0xfca : Pos 6, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t SuppressDebugMsg : 1; /**< 0x17ee / 0xfca : Pos 7, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t DisableUserStackWalk : 1; /**< 0x17ee / 0xfca : Pos 8, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t RtlExceptionAttached : 1; /**< 0x17ee / 0xfca : Pos 9, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t InitialThread : 1; /**< 0x17ee / 0xfca : Pos 10, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t SessionAware : 1; /**< 0x17ee / 0xfca : Pos 11, 1 Bit - New Since W7. */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t SpareSameTebBits : 4; /**< 0x17ee / 0xfca : Pos 12, 4 Bits */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t SafeThunkCall : 1; /**< 0x17ee / 0xfca : Pos 0, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t InDebugPrint : 1; /**< 0x17ee / 0xfca : Pos 1, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t HasFiberData : 1; /**< 0x17ee / 0xfca : Pos 2, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t SkipThreadAttach : 1; /**< 0x17ee / 0xfca : Pos 3, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t WerInShipAssertCode : 1; /**< 0x17ee / 0xfca : Pos 4, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t RanProcessInit : 1; /**< 0x17ee / 0xfca : Pos 5, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t ClonedThread : 1; /**< 0x17ee / 0xfca : Pos 6, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t SuppressDebugMsg : 1; /**< 0x17ee / 0xfca : Pos 7, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t DisableUserStackWalk : 1; /**< 0x17ee / 0xfca : Pos 8, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t RtlExceptionAttached : 1; /**< 0x17ee / 0xfca : Pos 9, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t InitialThread : 1; /**< 0x17ee / 0xfca : Pos 10, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t SpareSameTebBits : 5; /**< 0x17ee / 0xfca : Pos 12, 4 Bits */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t DbgSafeThunkCall : 1; /**< 0x17ee / 0xfca : Pos 0, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t DbgInDebugPrint : 1; /**< 0x17ee / 0xfca : Pos 1, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t DbgHasFiberData : 1; /**< 0x17ee / 0xfca : Pos 2, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t DbgSkipThreadAttach : 1; /**< 0x17ee / 0xfca : Pos 3, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t DbgWerInShipAssertCode : 1; /**< 0x17ee / 0xfca : Pos 4, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t DbgRanProcessInit : 1; /**< 0x17ee / 0xfca : Pos 5, 1 Bit */
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsync uint16_t DbgClonedThread : 1; /**< 0x17ee / 0xfca : Pos 6, 1 Bit */
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync uint16_t DbgSuppressDebugMsg : 1; /**< 0x17ee / 0xfca : Pos 7, 1 Bit */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync uint16_t SpareSameTebBits : 8; /**< 0x17ee / 0xfca : Pos 8, 8 Bits */
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsync PVOID TxnScopeEnterCallback; /**< 0x17f0 / 0xfcc */
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync /* End of TEB in W7 (windows 7)! */
5704a317c3b6bdf4b59f6a6ebe45d443296b1995vboxsync PVOID ReservedForWdf; /**< 0x1818 / 0xfe4 - New Since W7. */
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsync /* End of TEB in W8 (windows 8.0 & 8.1)! */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync uint64_t TotalSwitchOutTime; /**< 0x1818 / 0xfe8 */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync LARGE_INTEGER WaitReasonBitMap; /**< 0x1820 / 0xff0 */
6c1f3eb64096421b9ba7272f297bac6ff3d29fe7vboxsync /* End of TEB in W6 (windows Vista)! */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncAssertCompileMemberOffset(TEB_COMMON, ExceptionCode, ARCH_BITS == 64 ? 0x2c0 : 0x1a4);
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsyncAssertCompileMemberOffset(TEB_COMMON, LastStatusValue, ARCH_BITS == 64 ? 0x1250 : 0xbf4);
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsyncAssertCompileMemberOffset(TEB_COMMON, DeallocationStack, ARCH_BITS == 64 ? 0x1478 : 0xe0c);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncAssertCompileMemberOffset(TEB_COMMON, ReservedForNtRpc, ARCH_BITS == 64 ? 0x1698 : 0xf1c);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncAssertCompileMemberOffset(TEB_COMMON, Instrumentation, ARCH_BITS == 64 ? 0x16b8 : 0xf2c);
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsyncAssertCompileMemberOffset(TEB_COMMON, Diff2, ARCH_BITS == 64 ? 0x1710 : 0xf50);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncAssertCompileMemberOffset(TEB_COMMON, Diff3, ARCH_BITS == 64 ? 0x1728 : 0xf64);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncAssertCompileMemberOffset(TEB_COMMON, Diff4, ARCH_BITS == 64 ? 0x1730 : 0xf68);
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsyncAssertCompileMemberOffset(TEB_COMMON, WinSockData, ARCH_BITS == 64 ? 0x1738 : 0xf6c);
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsyncAssertCompileMemberOffset(TEB_COMMON, GuaranteedStackBytes, ARCH_BITS == 64 ? 0x1748 : 0xf78);
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsyncAssertCompileMemberOffset(TEB_COMMON, MuiImpersonation, ARCH_BITS == 64 ? 0x17e8 : 0xfc4);
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsyncAssertCompileMemberOffset(TEB_COMMON, LockCount, ARCH_BITS == 64 ? 0x1808 : 0xfd8);
f62342e2cc901a67e27fa69c0e712ee35e9c4c68vboxsyncAssertCompileSize(TEB_COMMON, ARCH_BITS == 64 ? 0x1828 : 0xff8);
f8df398d066204e2bf0ba209ea3554fc113fb484vboxsync/** The size of the windows 8.1 PEB structure. */
f62342e2cc901a67e27fa69c0e712ee35e9c4c68vboxsync#define TEB_SIZE_W81 ( RT_UOFFSETOF(TEB_COMMON, Diff12.W8.ReservedForWdf) + sizeof(PVOID) )
f62342e2cc901a67e27fa69c0e712ee35e9c4c68vboxsync/** The size of the windows 8.0 PEB structure. */
f62342e2cc901a67e27fa69c0e712ee35e9c4c68vboxsync#define TEB_SIZE_W80 ( RT_UOFFSETOF(TEB_COMMON, Diff12.W8.ReservedForWdf) + sizeof(PVOID) )
f62342e2cc901a67e27fa69c0e712ee35e9c4c68vboxsync/** The size of the windows 7 PEB structure. */
f62342e2cc901a67e27fa69c0e712ee35e9c4c68vboxsync#define TEB_SIZE_W7 RT_UOFFSETOF(TEB_COMMON, Diff12.W8.ReservedForWdf)
f62342e2cc901a67e27fa69c0e712ee35e9c4c68vboxsync/** The size of the windows vista PEB structure. */
f62342e2cc901a67e27fa69c0e712ee35e9c4c68vboxsync#define TEB_SIZE_W6 ( RT_UOFFSETOF(TEB_COMMON, Diff12.W6.WaitReasonBitMap) + sizeof(LARGE_INTEGER) )
f62342e2cc901a67e27fa69c0e712ee35e9c4c68vboxsync/** The size of the windows server 2003 PEB structure. */
f62342e2cc901a67e27fa69c0e712ee35e9c4c68vboxsync#define TEB_SIZE_W52 RT_ALIGN_Z(RT_UOFFSETOF(TEB_COMMON, Diff9.W52.BooleanSpare), sizeof(PVOID))
f62342e2cc901a67e27fa69c0e712ee35e9c4c68vboxsync/** The size of the windows XP PEB structure. */
f62342e2cc901a67e27fa69c0e712ee35e9c4c68vboxsync#define TEB_SIZE_W51 RT_UOFFSETOF(TEB_COMMON, FlsData)
b604fbf16eda38d14b4999c245f032bfaa5aa85avboxsync#define RTNtCurrentPeb() (RTNtCurrentTeb()->ProcessEnvironmentBlock)
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync#define RTNtCurrentThreadId() ((uint32_t)(uintptr_t)RTNtCurrentTeb()->ClientId.UniqueThread)
b604fbf16eda38d14b4999c245f032bfaa5aa85avboxsyncNTSYSAPI NTSTATUS NTAPI NtCreateSection(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PLARGE_INTEGER, ULONG, ULONG, HANDLE);
b604fbf16eda38d14b4999c245f032bfaa5aa85avboxsyncNTSYSAPI NTSTATUS NTAPI NtUnmapViewOfSection(HANDLE, PVOID);
b604fbf16eda38d14b4999c245f032bfaa5aa85avboxsyncNTSYSAPI NTSTATUS NTAPI NtMapViewOfSection(HANDLE, HANDLE, PVOID *, ULONG, SIZE_T, PLARGE_INTEGER, PSIZE_T, SECTION_INHERIT,
13d1fd6f43e9a245a4f2b4fc6845bdaa5d0f4134vboxsynctypedef FILE_FS_ATTRIBUTE_INFORMATION *PFILE_FS_ATTRIBUTE_INFORMATION;
13d1fd6f43e9a245a4f2b4fc6845bdaa5d0f4134vboxsyncNTSYSAPI NTSTATUS NTAPI NtOpenProcess(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);
13d1fd6f43e9a245a4f2b4fc6845bdaa5d0f4134vboxsyncNTSYSAPI NTSTATUS NTAPI NtOpenProcessToken(HANDLE, ACCESS_MASK, PHANDLE);
13d1fd6f43e9a245a4f2b4fc6845bdaa5d0f4134vboxsyncNTSYSAPI NTSTATUS NTAPI NtOpenThread(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);
13d1fd6f43e9a245a4f2b4fc6845bdaa5d0f4134vboxsyncNTSYSAPI NTSTATUS NTAPI NtOpenThreadToken(HANDLE, ACCESS_MASK, BOOLEAN, PHANDLE);
13d1fd6f43e9a245a4f2b4fc6845bdaa5d0f4134vboxsynctypedef FS_INFORMATION_CLASS *PFS_INFORMATION_CLASS;
13d1fd6f43e9a245a4f2b4fc6845bdaa5d0f4134vboxsyncNTSYSAPI NTSTATUS NTAPI NtQueryVolumeInformationFile(HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG, FS_INFORMATION_CLASS);
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsynctypedef FILE_BOTH_DIR_INFORMATION *PFILE_BOTH_DIR_INFORMATION;
8b36957d815c23b479eb35d93ac76c66392e9402vboxsynctypedef FILE_BASIC_INFORMATION *PFILE_BASIC_INFORMATION;
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsynctypedef FILE_STANDARD_INFORMATION *PFILE_STANDARD_INFORMATION;
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsynctypedef FILE_NAME_INFORMATION *PFILE_NAME_INFORMATION;
8c58249d7f93d82395aa6c8b31526443892bc375vboxsynctypedef FILE_INFORMATION_CLASS *PFILE_INFORMATION_CLASS;
8c58249d7f93d82395aa6c8b31526443892bc375vboxsyncNTSYSAPI NTSTATUS NTAPI NtQueryInformationFile(HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG, FILE_INFORMATION_CLASS);
8c58249d7f93d82395aa6c8b31526443892bc375vboxsyncNTSYSAPI NTSTATUS NTAPI NtQueryDirectoryFile(HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, PVOID, ULONG,
8c58249d7f93d82395aa6c8b31526443892bc375vboxsync FILE_INFORMATION_CLASS, BOOLEAN, PUNICODE_STRING, BOOLEAN);
aa0553becec2abc2e781f839ba1d399c31c2c07fvboxsynctypedef PROCESS_BASIC_INFORMATION *PPROCESS_BASIC_INFORMATION;
fa80a38f04b00afbb167e46c385cf24df0e223ddvboxsyncNTSYSAPI NTSTATUS NTAPI NtQueryInformationProcess(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG);
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsyncNTSYSAPI NTSTATUS NTAPI NtSetInformationThread(HANDLE, THREADINFOCLASS, LPCVOID, ULONG);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtQueryInformationToken(HANDLE, TOKEN_INFORMATION_CLASS, PVOID, ULONG, PULONG);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtReadFile(HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER, PULONG);
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsyncNTSYSAPI NTSTATUS NTAPI NtWriteFile(HANDLE, HANDLE, PIO_APC_ROUTINE, void const *, PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER, PULONG);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtReadVirtualMemory(HANDLE, PVOID, PVOID, SIZE_T, PSIZE_T);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtWriteVirtualMemory(HANDLE, PVOID, void const *, SIZE_T, PSIZE_T);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI RtlAddAccessAllowedAce(PACL, ULONG, ULONG, PSID);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI RtlCopySid(ULONG, PSID, PSID);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI RtlCreateAcl(PACL, ULONG, ULONG);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI RtlCreateSecurityDescriptor(PSECURITY_DESCRIPTOR, ULONG);
468c2bcb36eb9a032f5dd0fcb34db10bd58e9996vboxsyncNTSYSAPI NTSTATUS NTAPI RtlGetVersion(PRTL_OSVERSIONINFOW);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI RtlInitializeSid(PSID, PSID_IDENTIFIER_AUTHORITY, UCHAR);
cb2880968807a37c9efe6d5d32d56f2def91d908vboxsyncNTSYSAPI NTSTATUS NTAPI RtlSetDaclSecurityDescriptor(PSECURITY_DESCRIPTOR, BOOLEAN, PACL, BOOLEAN);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI PULONG NTAPI RtlSubAuthoritySid(PSID, ULONG);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsync#endif /* IPRT_NT_USE_WINTERNL */
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsynctypedef OBJECT_INFORMATION_CLASS *POBJECT_INFORMATION_CLASS;
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtDuplicateObject(HANDLE, HANDLE, HANDLE, PHANDLE, ACCESS_MASK, ULONG, ULONG);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtOpenDirectoryObject(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsynctypedef OBJECT_DIRECTORY_INFORMATION *POBJECT_DIRECTORY_INFORMATION;
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtQueryDirectoryObject(HANDLE, PVOID, ULONG, BOOLEAN, BOOLEAN, PULONG, PULONG);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsync/** @name ProcessDefaultHardErrorMode bit definitions.
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsync#define PROCESS_HARDERR_CRITICAL_ERROR UINT32_C(0x00000001) /**< Inverted from the win32 define. */
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsync#define PROCESS_HARDERR_NO_GP_FAULT_ERROR UINT32_C(0x00000002)
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsync#define PROCESS_HARDERR_NO_ALIGNMENT_FAULT_ERROR UINT32_C(0x00000004)
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsync#define PROCESS_HARDERR_NO_OPEN_FILE_ERROR UINT32_C(0x00008000)
62a515eec8de1b7804ec6997c0f2013fef5c5a6bvboxsyncNTSYSAPI NTSTATUS NTAPI NtSetInformationProcess(HANDLE, PROCESSINFOCLASS, PVOID, ULONG);
62a515eec8de1b7804ec6997c0f2013fef5c5a6bvboxsyncNTSYSAPI NTSTATUS NTAPI NtTerminateProcess(HANDLE, LONG);
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsync/** Retured by ProcessImageInformation as well as NtQuerySection. */
62a515eec8de1b7804ec6997c0f2013fef5c5a6bvboxsync union /**< Since Vista, used to be a spare BOOLEAN. */
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsync ULONG CheckSum; /**< Since Vista, Used to be a reserved/spare ULONG. */
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsynctypedef SECTION_IMAGE_INFORMATION *PSECTION_IMAGE_INFORMATION;
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsyncNTSYSAPI NTSTATUS NTAPI NtQuerySection(HANDLE, SECTION_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtCreateSymbolicLinkObject(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PUNICODE_STRING pTarget);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtOpenSymbolicLinkObject(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtQuerySymbolicLinkObject(HANDLE, PUNICODE_STRING, PULONG);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsync# define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYMBOLIC_LINK_QUERY)
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtQueryInformationThread(HANDLE, THREADINFOCLASS, PVOID, ULONG, PULONG);
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsyncNTSYSAPI NTSTATUS NTAPI NtResumeThread(HANDLE, PULONG);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtSuspendThread(HANDLE, PULONG);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtTerminateThread(HANDLE, LONG);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtGetContextThread(HANDLE, PCONTEXT);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtSetContextThread(HANDLE, PCONTEXT);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsynctypedef MEMORY_BASIC_INFORMATION *PMEMORY_BASIC_INFORMATION;
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsyncNTSYSAPI NTSTATUS NTAPI NtQueryVirtualMemory(HANDLE, void const *, MEMORY_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T);
cebc93936b5bb4d867e1c086dd1b206db33c31dcvboxsyncNTSYSAPI NTSTATUS NTAPI NtAllocateVirtualMemory(HANDLE, PVOID *, ULONG, PSIZE_T, ULONG, ULONG);
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsyncNTSYSAPI NTSTATUS NTAPI NtFreeVirtualMemory(HANDLE, PVOID *, PSIZE_T, ULONG);
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsyncNTSYSAPI NTSTATUS NTAPI NtProtectVirtualMemory(HANDLE, PVOID *, PSIZE_T, ULONG, PULONG);
bdb01608062958ff140a733533f3d6574886c831vboxsync SystemLoadGdiDriverInSystemSpaceInformation, /* 54 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync /** @todo fill gap. they've added a whole bunch of things */
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsynctypedef struct _VM_COUNTERS
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsynctypedef struct _IO_COUNTERS
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync UNICODE_STRING ProcessName; /**< 0x38 / 0x38 Clean unicode encoding? */
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync IO_COUNTERS IoCounters; /**< 0x88 / 0xd0 Might not be present in earlier windows versions. */
1dc37bff2fb26897f5892d8330fe2bc0c9859aecvboxsync /* After this follows the threads, then the ProcessName.Buffer. */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsynctypedef RTNT_SYSTEM_PROCESS_INFORMATION *PRTNT_SYSTEM_PROCESS_INFORMATION;
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsynctypedef RTNT_SYSTEM_PROCESS_INFORMATION SYSTEM_PROCESS_INFORMATION;
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsynctypedef SYSTEM_PROCESS_INFORMATION *PSYSTEM_PROCESS_INFORMATION;
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsynctypedef SYSTEM_HANDLE_ENTRY_INFO *PSYSTEM_HANDLE_ENTRY_INFO;
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync/** Returned by SystemHandleInformation */
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsynctypedef SYSTEM_HANDLE_INFORMATION *PSYSTEM_HANDLE_INFORMATION;
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsync/** Extended handle information entry.
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsync * @remarks 3 x PVOID + 4 x ULONG = 28 bytes on 32-bit / 40 bytes on 64-bit */
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsynctypedef SYSTEM_HANDLE_ENTRY_INFO_EX *PSYSTEM_HANDLE_ENTRY_INFO_EX;
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsync/** Returned by SystemExtendedHandleInformation. */
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsynctypedef SYSTEM_HANDLE_INFORMATION_EX *PSYSTEM_HANDLE_INFORMATION_EX;
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsync/** Input to SystemSessionProcessInformation. */
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsync /** Return buffer, SYSTEM_PROCESS_INFORMATION entries. */
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsynctypedef SYSTEM_SESSION_PROCESS_INFORMATION *PSYSTEM_SESSION_PROCESS_INFORMATION;
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsyncNTSYSAPI NTSTATUS NTAPI NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG);
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsyncNTSYSAPI NTSTATUS NTAPI NtDelayExecution(BOOLEAN, PLARGE_INTEGER);
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsyncNTSYSAPI NTSTATUS NTAPI NtWaitForSingleObject(HANDLE, BOOLEAN PLARGE_INTEGER);
67ee25dd0b63a61dc35a35d0aade75ca6cd06350vboxsynctypedef NTSYSAPI NTSTATUS (NTAPI *PFNNTWAITFORSINGLEOBJECT)(HANDLE, BOOLEAN, PLARGE_INTEGER);
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsynctypedef enum _OBJECT_WAIT_TYPE { WaitAllObjects = 0, WaitAnyObject = 1, ObjectWaitTypeHack = 0x7fffffff } OBJECT_WAIT_TYPE;
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsyncNTSYSAPI NTSTATUS NTAPI NtWaitForMultipleObjects(ULONG, PHANDLE, OBJECT_WAIT_TYPE, BOOLEAN, PLARGE_INTEGER);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncNTSYSAPI NTSTATUS NTAPI NtQuerySecurityObject(HANDLE, ULONG, PSECURITY_DESCRIPTOR, ULONG, PULONG);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync /* Manual reset event. */
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync /* Automaitc reset event. */
8b36957d815c23b479eb35d93ac76c66392e9402vboxsyncNTSYSAPI NTSTATUS NTAPI NtCreateEvent(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, EVENT_TYPE, BOOLEAN);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsyncNTSYSAPI NTSTATUS NTAPI NtOpenEvent(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
8b36957d815c23b479eb35d93ac76c66392e9402vboxsynctypedef NTSYSAPI NTSTATUS (NTAPI *PFNNTCLEAREVENT)(HANDLE);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsyncNTSYSAPI NTSTATUS NTAPI NtResetEvent(HANDLE, PULONG);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsynctypedef NTSYSAPI NTSTATUS (NTAPI *PFNNTSETEVENT)(HANDLE, PULONG);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync/** Data returned by NtQueryEvent + EventBasicInformation. */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsynctypedef EVENT_BASIC_INFORMATION *PEVENT_BASIC_INFORMATION;
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsyncNTSYSAPI NTSTATUS NTAPI NtQueryEvent(HANDLE, EVENT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync/** For NtQueryValueKey. */
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync/** KeyValuePartialInformation and KeyValuePartialInformationAlign64 struct. */
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsynctypedef KEY_VALUE_PARTIAL_INFORMATION *PKEY_VALUE_PARTIAL_INFORMATION;
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncNTSYSAPI NTSTATUS NTAPI NtOpenKey(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncNTSYSAPI NTSTATUS NTAPI NtQueryValueKey(HANDLE, PUNICODE_STRING, KEY_VALUE_INFORMATION_CLASS, PVOID, ULONG, PULONG);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsyncNTSYSAPI NTSTATUS NTAPI RtlAddAccessDeniedAce(PACL, ULONG, ULONG, PSID);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsynctypedef struct _CURDIR
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync STRING DosPath; /**< Yeah, it's STRING according to dt ntdll!_RTL_DRIVE_LETTER_CURDIR. */
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsynctypedef RTL_DRIVE_LETTER_CURDIR *PRTL_DRIVE_LETTER_CURDIR;
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync SIZE_T EnvironmentVersion; /**< Added in Windows 7. */
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync PVOID PackageDependencyData; /**< Added Windows 8? */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsynctypedef RTL_USER_PROCESS_PARAMETERS *PRTL_USER_PROCESS_PARAMETERS;
6fe1329154975472e055284198df7fa8e64dee3avboxsynctypedef RTL_USER_PROCESS_INFORMATION *PRTL_USER_PROCESS_INFORMATION;
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsyncNTSYSAPI NTSTATUS NTAPI RtlCreateUserProcess(PUNICODE_STRING, ULONG, PRTL_USER_PROCESS_PARAMETERS, PSECURITY_DESCRIPTOR,
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync PSECURITY_DESCRIPTOR, HANDLE, BOOLEAN, HANDLE, HANDLE, PRTL_USER_PROCESS_INFORMATION);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsyncNTSYSAPI NTSTATUS NTAPI RtlCreateProcessParameters(PRTL_USER_PROCESS_PARAMETERS *, PUNICODE_STRING ImagePathName,
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync PUNICODE_STRING DllPath, PUNICODE_STRING CurrentDirectory,
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync PUNICODE_STRING CommandLine, PUNICODE_STRING Environment,
6fe1329154975472e055284198df7fa8e64dee3avboxsync PUNICODE_STRING WindowTitle, PUNICODE_STRING DesktopInfo,
6fe1329154975472e055284198df7fa8e64dee3avboxsync PUNICODE_STRING ShellInfo, PUNICODE_STRING RuntimeInfo);
6fe1329154975472e055284198df7fa8e64dee3avboxsyncNTSYSAPI VOID NTAPI RtlDestroyProcessParameters(PRTL_USER_PROCESS_PARAMETERS);
6fe1329154975472e055284198df7fa8e64dee3avboxsyncNTSYSAPI NTSTATUS NTAPI RtlCreateUserThread(HANDLE, PSECURITY_DESCRIPTOR, BOOLEAN, ULONG, SIZE_T, SIZE_T,
8b36957d815c23b479eb35d93ac76c66392e9402vboxsynctypedef RTL_CRITICAL_SECTION *PRTL_CRITICAL_SECTION;
2a171646d32f8a15e9820d6fb3bf3f9b9990ca3fvboxsync/** @name NT Kernel APIs
2a171646d32f8a15e9820d6fb3bf3f9b9990ca3fvboxsynctypedef ULONG KEPROCESSORINDEX; /**< Bitmap indexes != process numbers, apparently. */
9ca017ceee656f9d33f2cb6652e401b5f17fcfb7vboxsyncNTSYSAPI VOID NTAPI KeInitializeAffinityEx(PKAFFINITY_EX pAffinity);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsynctypedef VOID (NTAPI *PFNKEINITIALIZEAFFINITYEX)(PKAFFINITY_EX pAffinity);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsyncNTSYSAPI VOID NTAPI KeAddProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsynctypedef VOID (NTAPI *PFNKEADDPROCESSORAFFINITYEX)(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsyncNTSYSAPI VOID NTAPI KeRemoveProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsynctypedef VOID (NTAPI *PFNKEREMOVEPROCESSORAFFINITYEX)(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsyncNTSYSAPI BOOLEAN NTAPI KeInterlockedSetProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsynctypedef BOOLEAN (NTAPI *PFNKEINTERLOCKEDSETPROCESSORAFFINITYEX)(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
8b36957d815c23b479eb35d93ac76c66392e9402vboxsyncNTSYSAPI BOOLEAN NTAPI KeInterlockedClearProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsynctypedef BOOLEAN (NTAPI *PFNKEINTERLOCKEDCLEARPROCESSORAFFINITYEX)(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsyncNTSYSAPI BOOLEAN NTAPI KeCheckProcessorAffinityEx(PCKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
9ca017ceee656f9d33f2cb6652e401b5f17fcfb7vboxsynctypedef BOOLEAN (NTAPI *PFNKECHECKPROCESSORAFFINITYEX)(PCKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsyncNTSYSAPI VOID NTAPI KeCopyAffinityEx(PKAFFINITY_EX pDst, PCKAFFINITY_EX pSrc);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsynctypedef VOID (NTAPI *PFNKECOPYAFFINITYEX)(PKAFFINITY_EX pDst, PCKAFFINITY_EX pSrc);
56349fc0a23f96f82208016f8f59f8377bb284b1vboxsyncNTSYSAPI VOID NTAPI KeComplementAffinityEx(PKAFFINITY_EX pResult, PCKAFFINITY_EX pIn);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsynctypedef VOID (NTAPI *PFNKECOMPLEMENTAFFINITYEX)(PKAFFINITY_EX pResult, PCKAFFINITY_EX pIn);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsyncNTSYSAPI BOOLEAN NTAPI KeAndAffinityEx(PCKAFFINITY_EX pIn1, PCKAFFINITY_EX pIn2, PKAFFINITY_EX pResult OPTIONAL);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsynctypedef BOOLEAN (NTAPI *PFNKEANDAFFINITYEX)(PCKAFFINITY_EX pIn1, PCKAFFINITY_EX pIn2, PKAFFINITY_EX pResult OPTIONAL);
fc60d7c6501c5e676e41b11c042d4358d9faa81dvboxsyncNTSYSAPI BOOLEAN NTAPI KeOrAffinityEx(PCKAFFINITY_EX pIn1, PCKAFFINITY_EX pIn2, PKAFFINITY_EX pResult OPTIONAL);
cc74f15083bf80fbc96723a89faa06c15d0dead8vboxsynctypedef BOOLEAN (NTAPI *PFNKEORAFFINITYEX)(PCKAFFINITY_EX pIn1, PCKAFFINITY_EX pIn2, PKAFFINITY_EX pResult OPTIONAL);
3933885bc0c2c93436d858a14564c6179ec72872vboxsync/** Works like anding the complemented subtrahend with the minuend. */
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncNTSYSAPI BOOLEAN NTAPI KeSubtractAffinityEx(PCKAFFINITY_EX pMinuend, PCKAFFINITY_EX pSubtrahend, PKAFFINITY_EX pResult OPTIONAL);
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef BOOLEAN (NTAPI *PFNKESUBTRACTAFFINITYEX)(PCKAFFINITY_EX pMinuend, PCKAFFINITY_EX pSubtrahend, PKAFFINITY_EX pResult OPTIONAL);
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncNTSYSAPI BOOLEAN NTAPI KeIsEqualAffinityEx(PCKAFFINITY_EX pLeft, PCKAFFINITY_EX pRight);
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef BOOLEAN (NTAPI *PFNKEISEQUALAFFINITYEX)(PCKAFFINITY_EX pLeft, PCKAFFINITY_EX pRight);
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncNTSYSAPI BOOLEAN NTAPI KeIsEmptyAffinityEx(PCKAFFINITY_EX pAffinity);
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef BOOLEAN (NTAPI *PFNKEISEMPTYAFFINITYEX)(PCKAFFINITY_EX pAffinity);
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncNTSYSAPI BOOLEAN NTAPI KeIsSubsetAffinityEx(PCKAFFINITY_EX pSubset, PCKAFFINITY_EX pSuperSet);
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef BOOLEAN (NTAPI *PFNKEISSUBSETAFFINITYEX)(PCKAFFINITY_EX pSubset, PCKAFFINITY_EX pSuperSet);
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncNTSYSAPI ULONG NTAPI KeCountSetBitsAffinityEx(PCKAFFINITY_EX pAffinity);
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef ULONG (NTAPI *PFNKECOUNTSETAFFINITYEX)(PCKAFFINITY_EX pAffinity);
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncNTSYSAPI KEPROCESSORINDEX NTAPI KeFindFirstSetLeftAffinityEx(PCKAFFINITY_EX pAffinity);
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef KEPROCESSORINDEX (NTAPI *PFNKEFINDFIRSTSETLEFTAFFINITYEX)(PCKAFFINITY_EX pAffinity);
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef NTSTATUS (NTAPI *PFNKEGETPROCESSORNUMBERFROMINDEX)(KEPROCESSORINDEX idxProcessor, PPROCESSOR_NUMBER pProcNumber);
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef KEPROCESSORINDEX (NTAPI *PFNKEGETPROCESSORINDEXFROMNUMBER)(const PROCESSOR_NUMBER *pProcNumber);
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncNTSYSAPI BOOLEAN NTAPI ObFindHandleForObject(PEPROCESS pProcess, PVOID pvObject, POBJECT_TYPE pObjectType,
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncNTSYSAPI NTSTATUS NTAPI ObReferenceObjectByName(PUNICODE_STRING pObjectPath, ULONG fAttributes, PACCESS_STATE pAccessState,
3933885bc0c2c93436d858a14564c6179ec72872vboxsync ACCESS_MASK fDesiredAccess, POBJECT_TYPE pObjectType,
3933885bc0c2c93436d858a14564c6179ec72872vboxsync KPROCESSOR_MODE enmAccessMode, PVOID pvParseContext, PVOID *ppvObject);
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncNTSYSAPI HANDLE NTAPI PsGetProcessInheritedFromUniqueProcessId(PEPROCESS);
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncNTSYSAPI UCHAR * NTAPI PsGetProcessImageFileName(PEPROCESS);
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncNTSYSAPI BOOLEAN NTAPI PsIsProcessBeingDebugged(PEPROCESS);
cc74f15083bf80fbc96723a89faa06c15d0dead8vboxsyncNTSYSAPI ULONG NTAPI PsGetProcessSessionId(PEPROCESS);
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncextern DECLIMPORT(POBJECT_TYPE *) LpcPortObjectType; /**< In vista+ this is the ALPC port object type. */
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncextern DECLIMPORT(POBJECT_TYPE *) LpcWaitablePortObjectType; /**< In vista+ this is the ALPC port object type. */
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef VOID (NTAPI *PFNHALREQUESTIPI_PRE_W7)(KAFFINITY TargetSet);
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef VOID (NTAPI *PFNHALREQUESTIPI_W7PLUS)(ULONG uUsuallyZero, PCKAFFINITY_EX pTargetSet);
3933885bc0c2c93436d858a14564c6179ec72872vboxsync#endif /* IN_RING0 */
3933885bc0c2c93436d858a14564c6179ec72872vboxsync/** @name NT Userland APIs
3933885bc0c2c93436d858a14564c6179ec72872vboxsync#if 0 /** @todo figure this out some time... */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync#define CSR_MSG_NO_CREATED_PROCESS UINT32_C(0x10000)
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsyncNTSYSAPI NTSTATUS NTAPI CsrClientCallServer(PVOID, PVOID, ULONG, SIZE_T);
a72b5355eb89aafe6bfcc8912cf02645d7cccceavboxsyncNTSYSAPI VOID NTAPI LdrInitializeThunk(PVOID, PVOID, PVOID);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync} LDR_DLL_LOADED_NOTIFICATION_DATA, LDR_DLL_UNLOADED_NOTIFICATION_DATA;
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsynctypedef LDR_DLL_LOADED_NOTIFICATION_DATA *PLDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_UNLOADED_NOTIFICATION_DATA;
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef LDR_DLL_LOADED_NOTIFICATION_DATA const *PCLDR_DLL_LOADED_NOTIFICATION_DATA, *PCLDR_DLL_UNLOADED_NOTIFICATION_DATA;
8b36957d815c23b479eb35d93ac76c66392e9402vboxsynctypedef LDR_DLL_NOTIFICATION_DATA *PLDR_DLL_NOTIFICATION_DATA;
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsynctypedef LDR_DLL_NOTIFICATION_DATA const *PCLDR_DLL_NOTIFICATION_DATA;
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsynctypedef VOID (NTAPI *PLDR_DLL_NOTIFICATION_FUNCTION)(ULONG ulReason, PCLDR_DLL_NOTIFICATION_DATA pData, PVOID pvUser);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync#define LDR_DLL_NOTIFICATION_REASON_LOADED UINT32_C(1)
3933885bc0c2c93436d858a14564c6179ec72872vboxsync#define LDR_DLL_NOTIFICATION_REASON_UNLOADED UINT32_C(2)
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsyncNTSYSAPI NTSTATUS NTAPI LdrRegisterDllNotification(ULONG fFlags, PLDR_DLL_NOTIFICATION_FUNCTION pfnCallback, PVOID pvUser,
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsynctypedef NTSTATUS (NTAPI *PFNLDRREGISTERDLLNOTIFICATION)(ULONG, PLDR_DLL_NOTIFICATION_FUNCTION, PVOID, PVOID *);
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncNTSYSAPI NTSTATUS NTAPI LdrUnregisterDllNotification(PVOID pvCookie);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsynctypedef NTSTATUS (NTAPI *PFNLDRUNREGISTERDLLNOTIFICATION)(PVOID);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsyncNTSYSAPI NTSTATUS NTAPI LdrLoadDll(IN PWSTR pwszSearchPathOrFlags OPTIONAL, IN PULONG pfFlags OPTIONAL,
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsynctypedef NTSTATUS (NTAPI *PFNLDRLOADDLL)(IN PWSTR pwszSearchPathOrFlags OPTIONAL, IN PULONG pfFlags OPTIONAL,
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncNTSYSAPI NTSTATUS NTAPI LdrUnloadDll(IN HANDLE hMod);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsynctypedef NTSTATUS (NTAPI *PFNLDRUNLOADDLL)(IN HANDLE hMod);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncNTSYSAPI NTSTATUS NTAPI LdrGetDllHandle(IN PCWSTR pwszDllPath OPTIONAL, IN PULONG pfFlags OPTIONAL,
6e25221ce8ef8e656d1e15eb7ec5cf8ae758ceb2vboxsynctypedef NTSTATUS (NTAPI *PFNLDRGETDLLHANDLE)(IN PCWSTR pwszDllPath OPTIONAL, IN PULONG pfFlags OPTIONAL,
6e25221ce8ef8e656d1e15eb7ec5cf8ae758ceb2vboxsync#define LDRGETDLLHANDLEEX_F_UNCHANGED_REFCOUNT RT_BIT_32(0)
6e25221ce8ef8e656d1e15eb7ec5cf8ae758ceb2vboxsync/** @since Windows XP. */
6e25221ce8ef8e656d1e15eb7ec5cf8ae758ceb2vboxsyncNTSYSAPI NTSTATUS NTAPI LdrGetDllHandleEx(IN ULONG fFlags, IN PCWSTR pwszDllPath OPTIONAL, IN PULONG pfFlags OPTIONAL,
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync/** @since Windows XP. */
6e25221ce8ef8e656d1e15eb7ec5cf8ae758ceb2vboxsynctypedef NTSTATUS (NTAPI *PFNLDRGETDLLHANDLEEX)(IN ULONG fFlags, IN PCWSTR pwszDllPath OPTIONAL, IN PULONG pfFlags OPTIONAL,
6e25221ce8ef8e656d1e15eb7ec5cf8ae758ceb2vboxsync/** @since Windows 7. */
6e25221ce8ef8e656d1e15eb7ec5cf8ae758ceb2vboxsyncNTSYSAPI NTSTATUS NTAPI LdrGetDllHandleByMapping(IN PVOID pvBase, OUT PHANDLE phDll);
6e25221ce8ef8e656d1e15eb7ec5cf8ae758ceb2vboxsync/** @since Windows 7. */
56349fc0a23f96f82208016f8f59f8377bb284b1vboxsynctypedef NTSTATUS (NTAPI *PFNLDRGETDLLHANDLEBYMAPPING)(IN PVOID pvBase, OUT PHANDLE phDll);
6e25221ce8ef8e656d1e15eb7ec5cf8ae758ceb2vboxsync/** @since Windows 7. */
6e25221ce8ef8e656d1e15eb7ec5cf8ae758ceb2vboxsyncNTSYSAPI NTSTATUS NTAPI LdrGetDllHandleByName(IN PCUNICODE_STRING pName OPTIONAL, IN PCUNICODE_STRING pFullName OPTIONAL,
6e25221ce8ef8e656d1e15eb7ec5cf8ae758ceb2vboxsync/** @since Windows 7. */
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsynctypedef NTSTATUS (NTAPI *PFNLDRGETDLLHANDLEBYNAME)(IN PCUNICODE_STRING pName OPTIONAL, IN PCUNICODE_STRING pFullName OPTIONAL,
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncNTSYSAPI NTSTATUS NTAPI LdrAddRefDll(IN ULONG fFlags, IN HANDLE hDll);
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef NTSTATUS (NTAPI *PFNLDRADDREFDLL)(IN ULONG fFlags, IN HANDLE hDll);
3933885bc0c2c93436d858a14564c6179ec72872vboxsyncNTSYSAPI NTSTATUS NTAPI LdrGetProcedureAddress(IN HANDLE hDll, IN ANSI_STRING const *pSymbol OPTIONAL,
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsynctypedef NTSTATUS (NTAPI *PFNLDRGETPROCEDUREADDRESS)(IN HANDLE hDll, IN PCANSI_STRING pSymbol OPTIONAL,
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync#define LDRGETPROCEDUREADDRESSEX_F_DONT_RECORD_FORWARDER RT_BIT_32(0)
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync/** @since Windows Vista. */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncNTSYSAPI NTSTATUS NTAPI LdrGetProcedureAddressEx(IN HANDLE hDll, IN ANSI_STRING const *pSymbol OPTIONAL,
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsync IN ULONG uOrdinal OPTIONAL, OUT PVOID *ppvSymbol, ULONG fFlags);
3933885bc0c2c93436d858a14564c6179ec72872vboxsync/** @since Windows Vista. */
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef NTSTATUS (NTAPI *PFNLDRGETPROCEDUREADDRESSEX)(IN HANDLE hDll, IN ANSI_STRING const *pSymbol OPTIONAL,
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync IN ULONG uOrdinal OPTIONAL, OUT PVOID *ppvSymbol, ULONG fFlags);
3933885bc0c2c93436d858a14564c6179ec72872vboxsync#define LDRLOCKLOADERLOCK_F_RAISE_ERRORS RT_BIT_32(0)
3933885bc0c2c93436d858a14564c6179ec72872vboxsync#define LDRLOCKLOADERLOCK_DISP_NOT_ACQUIRED UINT32_C(2)
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync/** @since Windows XP. */
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsyncNTSYSAPI NTSTATUS NTAPI LdrLockLoaderLock(IN ULONG fFlags, OUT PULONG puDisposition OPTIONAL, OUT PVOID *ppvCookie);
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsync/** @since Windows XP. */
b8462d2d5e78448e277a4214655ce1cd6c7e9249vboxsynctypedef NTSTATUS (NTAPI *PFNLDRLOCKLOADERLOCK)(IN ULONG fFlags, OUT PULONG puDisposition OPTIONAL, OUT PVOID *ppvCookie);
3933885bc0c2c93436d858a14564c6179ec72872vboxsync#define LDRUNLOCKLOADERLOCK_F_RAISE_ERRORS RT_BIT_32(0)
3933885bc0c2c93436d858a14564c6179ec72872vboxsync/** @since Windows XP. */
b8462d2d5e78448e277a4214655ce1cd6c7e9249vboxsyncNTSYSAPI NTSTATUS NTAPI LdrUnlockLoaderLock(IN ULONG fFlags, OUT PVOID pvCookie);
3933885bc0c2c93436d858a14564c6179ec72872vboxsync/** @since Windows XP. */
3933885bc0c2c93436d858a14564c6179ec72872vboxsynctypedef NTSTATUS (NTAPI *PFNLDRUNLOCKLOADERLOCK)(IN ULONG fFlags, OUT PVOID pvCookie);
b8462d2d5e78448e277a4214655ce1cd6c7e9249vboxsyncNTSYSAPI NTSTATUS NTAPI RtlExpandEnvironmentStrings_U(PVOID, PUNICODE_STRING, PUNICODE_STRING, PULONG);
060f7ec6ae5c99df18341ef2e1f3e91f4b0c89f1vboxsyncNTSYSAPI VOID NTAPI RtlExitUserProcess(NTSTATUS rcExitCode); /**< Vista and later. */
060f7ec6ae5c99df18341ef2e1f3e91f4b0c89f1vboxsyncNTSYSAPI VOID NTAPI RtlExitUserThread(NTSTATUS rcExitCode);
b8462d2d5e78448e277a4214655ce1cd6c7e9249vboxsyncNTSYSAPI NTSTATUS NTAPI RtlDosApplyFileIsolationRedirection_Ustr(IN ULONG fFlags,
060f7ec6ae5c99df18341ef2e1f3e91f4b0c89f1vboxsynctypedef NTSTATUS NTAPI RTL_HEAP_COMMIT_ROUTINE(PVOID, PVOID *, PSIZE_T);
060f7ec6ae5c99df18341ef2e1f3e91f4b0c89f1vboxsynctypedef RTL_HEAP_COMMIT_ROUTINE *PRTL_HEAP_COMMIT_ROUTINE;
9601ea695ea96905d6f5d484facd272732365c40vboxsyncNTSYSAPI PVOID NTAPI RtlCreateHeap(ULONG fFlags, PVOID pvHeapBase, SIZE_T cbReserve, SIZE_T cbCommit, PVOID pvLock,
9601ea695ea96905d6f5d484facd272732365c40vboxsync/** @name Heap flags (for RtlCreateHeap).
9601ea695ea96905d6f5d484facd272732365c40vboxsync/*# define HEAP_NO_SERIALIZE UINT32_C(0x00000001)
9601ea695ea96905d6f5d484facd272732365c40vboxsync# define HEAP_GROWABLE UINT32_C(0x00000002)
9601ea695ea96905d6f5d484facd272732365c40vboxsync# define HEAP_GENERATE_EXCEPTIONS UINT32_C(0x00000004)
9601ea695ea96905d6f5d484facd272732365c40vboxsync# define HEAP_ZERO_MEMORY UINT32_C(0x00000008)
9601ea695ea96905d6f5d484facd272732365c40vboxsync# define HEAP_REALLOC_IN_PLACE_ONLY UINT32_C(0x00000010)
9601ea695ea96905d6f5d484facd272732365c40vboxsync# define HEAP_TAIL_CHECKING_ENABLED UINT32_C(0x00000020)
9601ea695ea96905d6f5d484facd272732365c40vboxsync# define HEAP_FREE_CHECKING_ENABLED UINT32_C(0x00000040)
9601ea695ea96905d6f5d484facd272732365c40vboxsync# define HEAP_DISABLE_COALESCE_ON_FREE UINT32_C(0x00000080)*/
9601ea695ea96905d6f5d484facd272732365c40vboxsync# define HEAP_SETTABLE_USER_VALUE UINT32_C(0x00000100)
9601ea695ea96905d6f5d484facd272732365c40vboxsync# define HEAP_SETTABLE_USER_FLAG1 UINT32_C(0x00000200)
9601ea695ea96905d6f5d484facd272732365c40vboxsync# define HEAP_SETTABLE_USER_FLAG2 UINT32_C(0x00000400)
9601ea695ea96905d6f5d484facd272732365c40vboxsync# define HEAP_SETTABLE_USER_FLAG3 UINT32_C(0x00000800)
9601ea695ea96905d6f5d484facd272732365c40vboxsync# define HEAP_SETTABLE_USER_FLAGS UINT32_C(0x00000e00)
bdb01608062958ff140a733533f3d6574886c831vboxsync/*# define HEAP_CREATE_ALIGN_16 UINT32_C(0x00010000)
7a7a4fb86f66f7ab919948a2ad6aae0483061e18vboxsync# define HEAP_CREATE_ENABLE_TRACING UINT32_C(0x00020000)
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsync# define HEAP_CREATE_ENABLE_EXECUTE UINT32_C(0x00040000)*/
bdb01608062958ff140a733533f3d6574886c831vboxsync# define HEAP_CREATE_VALID_MASK UINT32_C(0x0007f0ff)
bdb01608062958ff140a733533f3d6574886c831vboxsync# endif /* IPRT_NT_USE_WINTERNL */
bdb01608062958ff140a733533f3d6574886c831vboxsync/** @name Heap tagging constants
bdb01608062958ff140a733533f3d6574886c831vboxsync/*# define HEAP_MAXIMUM_TAG UINT32_C(0x00000fff)
bdb01608062958ff140a733533f3d6574886c831vboxsync# define HEAP_PSEUDO_TAG_FLAG UINT32_C(0x00008000)
bdb01608062958ff140a733533f3d6574886c831vboxsync# define HEAP_TAG_SHIFT 18 */
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsync# define HEAP_TAG_MASK (HEAP_MAXIMUM_TAG << HEAP_TAG_SHIFT)
71c8a528203c289a8585ce10ac6bafc4274058c6vboxsyncNTSYSAPI PVOID NTAPI RtlAllocateHeap(HANDLE hHeap, ULONG fFlags, SIZE_T cb);
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsyncNTSYSAPI PVOID NTAPI RtlReAllocateHeap(HANDLE hHeap, ULONG fFlags, PVOID pvOld, SIZE_T cbNew);
e214bb78026c1d64078b34ca9504d3f5abbc52efvboxsyncNTSYSAPI BOOLEAN NTAPI RtlFreeHeap(HANDLE hHeap, ULONG fFlags, PVOID pvMem);
8b36957d815c23b479eb35d93ac76c66392e9402vboxsync# endif /* IPRT_NT_USE_WINTERNL */
56349fc0a23f96f82208016f8f59f8377bb284b1vboxsyncNTSYSAPI SIZE_T NTAPI RtlCompactHeap(HANDLE hHeap, ULONG fFlags);
d29ab0cfbeef254251f0a2458163034999abb8a0vboxsyncNTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING);
1207f59aa62006952dbb0bf7700decf34d8caeb2vboxsyncNTSYSAPI SIZE_T NTAPI RtlSizeHeap(HANDLE hHeap, ULONG fFlags, PVOID pvMem);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncNTSYSAPI VOID NTAPI RtlSetLastWin32Error(ULONG uError);
9e4ea89b1085fdaa5861e45a729d9c978db1a8f1vboxsyncNTSYSAPI VOID NTAPI RtlSetLastWin32ErrorAndNtStatusFromNtStatus(NTSTATUS rcNt);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncNTSYSAPI VOID NTAPI RtlRestoreLastWin32Error(ULONG uError);
261b44f7fa60a1d4bb4102142d3aa44188908484vboxsyncNTSYSAPI BOOLEAN NTAPI RtlQueryPerformanceCounter(PLARGE_INTEGER);
147e101bcd061b5e085e4a2c0cc9fc35546ff1aavboxsyncNTSYSAPI uint64_t NTAPI RtlGetSystemTimePrecise(VOID);
e214bb78026c1d64078b34ca9504d3f5abbc52efvboxsynctypedef uint64_t (NTAPI * PFNRTLGETSYSTEMTIMEPRECISE)(VOID);
6efcf94383d6e48c764c6518cf1b4069ad34e210vboxsync#endif /* IN_RING3 */