| OLD | NEW |
| (Empty) |
| 1 // Copyright (c) 2006-2010 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 // This file holds definitions related to the ntdll API. | |
| 6 | |
| 7 #ifndef SANDBOX_SRC_NT_INTERNALS_H__ | |
| 8 #define SANDBOX_SRC_NT_INTERNALS_H__ | |
| 9 | |
| 10 #include <windows.h> | |
| 11 | |
| 12 typedef LONG NTSTATUS; | |
| 13 #define NT_SUCCESS(st) (st >= 0) | |
| 14 | |
| 15 #define STATUS_SUCCESS ((NTSTATUS)0x00000000L) | |
| 16 #define STATUS_BUFFER_OVERFLOW ((NTSTATUS)0x80000005L) | |
| 17 #define STATUS_UNSUCCESSFUL ((NTSTATUS)0xC0000001L) | |
| 18 #define STATUS_NOT_IMPLEMENTED ((NTSTATUS)0xC0000002L) | |
| 19 #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) | |
| 20 #ifndef STATUS_INVALID_PARAMETER | |
| 21 // It is now defined in Windows 2008 SDK. | |
| 22 #define STATUS_INVALID_PARAMETER ((NTSTATUS)0xC000000DL) | |
| 23 #endif | |
| 24 #define STATUS_CONFLICTING_ADDRESSES ((NTSTATUS)0xC0000018L) | |
| 25 #define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) | |
| 26 #define STATUS_BUFFER_TOO_SMALL ((NTSTATUS)0xC0000023L) | |
| 27 #define STATUS_OBJECT_NAME_NOT_FOUND ((NTSTATUS)0xC0000034L) | |
| 28 #define STATUS_PROCEDURE_NOT_FOUND ((NTSTATUS)0xC000007AL) | |
| 29 #define STATUS_INVALID_IMAGE_FORMAT ((NTSTATUS)0xC000007BL) | |
| 30 #define STATUS_NO_TOKEN ((NTSTATUS)0xC000007CL) | |
| 31 | |
| 32 #define CURRENT_PROCESS ((HANDLE) -1) | |
| 33 #define CURRENT_THREAD ((HANDLE) -2) | |
| 34 #define NtCurrentProcess CURRENT_PROCESS | |
| 35 | |
| 36 typedef struct _UNICODE_STRING { | |
| 37 USHORT Length; | |
| 38 USHORT MaximumLength; | |
| 39 PWSTR Buffer; | |
| 40 } UNICODE_STRING; | |
| 41 typedef UNICODE_STRING *PUNICODE_STRING; | |
| 42 typedef const UNICODE_STRING *PCUNICODE_STRING; | |
| 43 | |
| 44 typedef struct _STRING { | |
| 45 USHORT Length; | |
| 46 USHORT MaximumLength; | |
| 47 PCHAR Buffer; | |
| 48 } STRING; | |
| 49 typedef STRING *PSTRING; | |
| 50 | |
| 51 typedef STRING ANSI_STRING; | |
| 52 typedef PSTRING PANSI_STRING; | |
| 53 typedef CONST PSTRING PCANSI_STRING; | |
| 54 | |
| 55 typedef STRING OEM_STRING; | |
| 56 typedef PSTRING POEM_STRING; | |
| 57 typedef CONST STRING* PCOEM_STRING; | |
| 58 | |
| 59 #define OBJ_CASE_INSENSITIVE 0x00000040L | |
| 60 | |
| 61 typedef struct _OBJECT_ATTRIBUTES { | |
| 62 ULONG Length; | |
| 63 HANDLE RootDirectory; | |
| 64 PUNICODE_STRING ObjectName; | |
| 65 ULONG Attributes; | |
| 66 PVOID SecurityDescriptor; | |
| 67 PVOID SecurityQualityOfService; | |
| 68 } OBJECT_ATTRIBUTES; | |
| 69 typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES; | |
| 70 | |
| 71 #define InitializeObjectAttributes(p, n, a, r, s) { \ | |
| 72 (p)->Length = sizeof(OBJECT_ATTRIBUTES);\ | |
| 73 (p)->RootDirectory = r;\ | |
| 74 (p)->Attributes = a;\ | |
| 75 (p)->ObjectName = n;\ | |
| 76 (p)->SecurityDescriptor = s;\ | |
| 77 (p)->SecurityQualityOfService = NULL;\ | |
| 78 } | |
| 79 | |
| 80 typedef struct _IO_STATUS_BLOCK { | |
| 81 union { | |
| 82 NTSTATUS Status; | |
| 83 PVOID Pointer; | |
| 84 }; | |
| 85 ULONG_PTR Information; | |
| 86 } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK; | |
| 87 | |
| 88 // ----------------------------------------------------------------------- | |
| 89 // File IO | |
| 90 | |
| 91 // Create disposition values. | |
| 92 | |
| 93 #define FILE_SUPERSEDE 0x00000000 | |
| 94 #define FILE_OPEN 0x00000001 | |
| 95 #define FILE_CREATE 0x00000002 | |
| 96 #define FILE_OPEN_IF 0x00000003 | |
| 97 #define FILE_OVERWRITE 0x00000004 | |
| 98 #define FILE_OVERWRITE_IF 0x00000005 | |
| 99 #define FILE_MAXIMUM_DISPOSITION 0x00000005 | |
| 100 | |
| 101 // Create/open option flags. | |
| 102 | |
| 103 #define FILE_DIRECTORY_FILE 0x00000001 | |
| 104 #define FILE_WRITE_THROUGH 0x00000002 | |
| 105 #define FILE_SEQUENTIAL_ONLY 0x00000004 | |
| 106 #define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008 | |
| 107 | |
| 108 #define FILE_SYNCHRONOUS_IO_ALERT 0x00000010 | |
| 109 #define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020 | |
| 110 #define FILE_NON_DIRECTORY_FILE 0x00000040 | |
| 111 #define FILE_CREATE_TREE_CONNECTION 0x00000080 | |
| 112 | |
| 113 #define FILE_COMPLETE_IF_OPLOCKED 0x00000100 | |
| 114 #define FILE_NO_EA_KNOWLEDGE 0x00000200 | |
| 115 #define FILE_OPEN_REMOTE_INSTANCE 0x00000400 | |
| 116 #define FILE_RANDOM_ACCESS 0x00000800 | |
| 117 | |
| 118 #define FILE_DELETE_ON_CLOSE 0x00001000 | |
| 119 #define FILE_OPEN_BY_FILE_ID 0x00002000 | |
| 120 #define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000 | |
| 121 #define FILE_NO_COMPRESSION 0x00008000 | |
| 122 | |
| 123 #define FILE_RESERVE_OPFILTER 0x00100000 | |
| 124 #define FILE_OPEN_REPARSE_POINT 0x00200000 | |
| 125 #define FILE_OPEN_NO_RECALL 0x00400000 | |
| 126 #define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000 | |
| 127 | |
| 128 typedef NTSTATUS (WINAPI *NtCreateFileFunction)( | |
| 129 OUT PHANDLE FileHandle, | |
| 130 IN ACCESS_MASK DesiredAccess, | |
| 131 IN POBJECT_ATTRIBUTES ObjectAttributes, | |
| 132 OUT PIO_STATUS_BLOCK IoStatusBlock, | |
| 133 IN PLARGE_INTEGER AllocationSize OPTIONAL, | |
| 134 IN ULONG FileAttributes, | |
| 135 IN ULONG ShareAccess, | |
| 136 IN ULONG CreateDisposition, | |
| 137 IN ULONG CreateOptions, | |
| 138 IN PVOID EaBuffer OPTIONAL, | |
| 139 IN ULONG EaLength); | |
| 140 | |
| 141 typedef NTSTATUS (WINAPI *NtOpenFileFunction)( | |
| 142 OUT PHANDLE FileHandle, | |
| 143 IN ACCESS_MASK DesiredAccess, | |
| 144 IN POBJECT_ATTRIBUTES ObjectAttributes, | |
| 145 OUT PIO_STATUS_BLOCK IoStatusBlock, | |
| 146 IN ULONG ShareAccess, | |
| 147 IN ULONG OpenOptions); | |
| 148 | |
| 149 typedef NTSTATUS (WINAPI *NtCloseFunction)( | |
| 150 IN HANDLE Handle); | |
| 151 | |
| 152 typedef enum _FILE_INFORMATION_CLASS { | |
| 153 FileRenameInformation = 10 | |
| 154 } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS; | |
| 155 | |
| 156 typedef struct _FILE_RENAME_INFORMATION { | |
| 157 BOOLEAN ReplaceIfExists; | |
| 158 HANDLE RootDirectory; | |
| 159 ULONG FileNameLength; | |
| 160 WCHAR FileName[1]; | |
| 161 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION; | |
| 162 | |
| 163 typedef NTSTATUS (WINAPI *NtSetInformationFileFunction)( | |
| 164 IN HANDLE FileHandle, | |
| 165 OUT PIO_STATUS_BLOCK IoStatusBlock, | |
| 166 IN PVOID FileInformation, | |
| 167 IN ULONG Length, | |
| 168 IN FILE_INFORMATION_CLASS FileInformationClass); | |
| 169 | |
| 170 typedef struct FILE_BASIC_INFORMATION { | |
| 171 LARGE_INTEGER CreationTime; | |
| 172 LARGE_INTEGER LastAccessTime; | |
| 173 LARGE_INTEGER LastWriteTime; | |
| 174 LARGE_INTEGER ChangeTime; | |
| 175 ULONG FileAttributes; | |
| 176 } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION; | |
| 177 | |
| 178 typedef NTSTATUS (WINAPI *NtQueryAttributesFileFunction)( | |
| 179 IN POBJECT_ATTRIBUTES ObjectAttributes, | |
| 180 OUT PFILE_BASIC_INFORMATION FileAttributes); | |
| 181 | |
| 182 typedef struct _FILE_NETWORK_OPEN_INFORMATION { | |
| 183 LARGE_INTEGER CreationTime; | |
| 184 LARGE_INTEGER LastAccessTime; | |
| 185 LARGE_INTEGER LastWriteTime; | |
| 186 LARGE_INTEGER ChangeTime; | |
| 187 LARGE_INTEGER AllocationSize; | |
| 188 LARGE_INTEGER EndOfFile; | |
| 189 ULONG FileAttributes; | |
| 190 } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION; | |
| 191 | |
| 192 typedef NTSTATUS (WINAPI *NtQueryFullAttributesFileFunction)( | |
| 193 IN POBJECT_ATTRIBUTES ObjectAttributes, | |
| 194 OUT PFILE_NETWORK_OPEN_INFORMATION FileAttributes); | |
| 195 | |
| 196 // ----------------------------------------------------------------------- | |
| 197 // Sections | |
| 198 | |
| 199 typedef NTSTATUS (WINAPI *NtCreateSectionFunction)( | |
| 200 OUT PHANDLE SectionHandle, | |
| 201 IN ACCESS_MASK DesiredAccess, | |
| 202 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, | |
| 203 IN PLARGE_INTEGER MaximumSize OPTIONAL, | |
| 204 IN ULONG SectionPageProtection, | |
| 205 IN ULONG AllocationAttributes, | |
| 206 IN HANDLE FileHandle OPTIONAL); | |
| 207 | |
| 208 typedef ULONG SECTION_INHERIT; | |
| 209 #define ViewShare 1 | |
| 210 #define ViewUnmap 2 | |
| 211 | |
| 212 typedef NTSTATUS (WINAPI *NtMapViewOfSectionFunction)( | |
| 213 IN HANDLE SectionHandle, | |
| 214 IN HANDLE ProcessHandle, | |
| 215 IN OUT PVOID *BaseAddress, | |
| 216 IN ULONG_PTR ZeroBits, | |
| 217 IN SIZE_T CommitSize, | |
| 218 IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, | |
| 219 IN OUT PSIZE_T ViewSize, | |
| 220 IN SECTION_INHERIT InheritDisposition, | |
| 221 IN ULONG AllocationType, | |
| 222 IN ULONG Win32Protect); | |
| 223 | |
| 224 typedef NTSTATUS (WINAPI *NtUnmapViewOfSectionFunction)( | |
| 225 IN HANDLE ProcessHandle, | |
| 226 IN PVOID BaseAddress); | |
| 227 | |
| 228 typedef enum _SECTION_INFORMATION_CLASS { | |
| 229 SectionBasicInformation = 0, | |
| 230 SectionImageInformation | |
| 231 } SECTION_INFORMATION_CLASS; | |
| 232 | |
| 233 typedef struct _SECTION_BASIC_INFORMATION { | |
| 234 PVOID BaseAddress; | |
| 235 ULONG Attributes; | |
| 236 LARGE_INTEGER Size; | |
| 237 } SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION; | |
| 238 | |
| 239 typedef NTSTATUS (WINAPI *NtQuerySectionFunction)( | |
| 240 IN HANDLE SectionHandle, | |
| 241 IN SECTION_INFORMATION_CLASS SectionInformationClass, | |
| 242 OUT PVOID SectionInformation, | |
| 243 IN SIZE_T SectionInformationLength, | |
| 244 OUT PSIZE_T ReturnLength OPTIONAL); | |
| 245 | |
| 246 // ----------------------------------------------------------------------- | |
| 247 // Process and Thread | |
| 248 | |
| 249 typedef struct _CLIENT_ID { | |
| 250 PVOID UniqueProcess; | |
| 251 PVOID UniqueThread; | |
| 252 } CLIENT_ID, *PCLIENT_ID; | |
| 253 | |
| 254 typedef NTSTATUS (WINAPI *NtOpenThreadFunction) ( | |
| 255 OUT PHANDLE ThreadHandle, | |
| 256 IN ACCESS_MASK DesiredAccess, | |
| 257 IN POBJECT_ATTRIBUTES ObjectAttributes, | |
| 258 IN PCLIENT_ID ClientId); | |
| 259 | |
| 260 typedef NTSTATUS (WINAPI *NtOpenProcessFunction) ( | |
| 261 OUT PHANDLE ProcessHandle, | |
| 262 IN ACCESS_MASK DesiredAccess, | |
| 263 IN POBJECT_ATTRIBUTES ObjectAttributes, | |
| 264 IN PCLIENT_ID ClientId); | |
| 265 | |
| 266 typedef enum _NT_THREAD_INFORMATION_CLASS { | |
| 267 ThreadBasicInformation, | |
| 268 ThreadTimes, | |
| 269 ThreadPriority, | |
| 270 ThreadBasePriority, | |
| 271 ThreadAffinityMask, | |
| 272 ThreadImpersonationToken, | |
| 273 ThreadDescriptorTableEntry, | |
| 274 ThreadEnableAlignmentFaultFixup, | |
| 275 ThreadEventPair, | |
| 276 ThreadQuerySetWin32StartAddress, | |
| 277 ThreadZeroTlsCell, | |
| 278 ThreadPerformanceCount, | |
| 279 ThreadAmILastThread, | |
| 280 ThreadIdealProcessor, | |
| 281 ThreadPriorityBoost, | |
| 282 ThreadSetTlsArrayAddress, | |
| 283 ThreadIsIoPending, | |
| 284 ThreadHideFromDebugger | |
| 285 } NT_THREAD_INFORMATION_CLASS, *PNT_THREAD_INFORMATION_CLASS; | |
| 286 | |
| 287 typedef NTSTATUS (WINAPI *NtSetInformationThreadFunction) ( | |
| 288 IN HANDLE ThreadHandle, | |
| 289 IN NT_THREAD_INFORMATION_CLASS ThreadInformationClass, | |
| 290 IN PVOID ThreadInformation, | |
| 291 IN ULONG ThreadInformationLength); | |
| 292 | |
| 293 // Partial definition only: | |
| 294 typedef enum _PROCESSINFOCLASS { | |
| 295 ProcessBasicInformation = 0 | |
| 296 } PROCESSINFOCLASS; | |
| 297 | |
| 298 typedef PVOID PPEB; | |
| 299 typedef PVOID KPRIORITY; | |
| 300 | |
| 301 typedef struct _PROCESS_BASIC_INFORMATION { | |
| 302 NTSTATUS ExitStatus; | |
| 303 PPEB PebBaseAddress; | |
| 304 KAFFINITY AffinityMask; | |
| 305 KPRIORITY BasePriority; | |
| 306 ULONG UniqueProcessId; | |
| 307 ULONG InheritedFromUniqueProcessId; | |
| 308 } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION; | |
| 309 | |
| 310 typedef NTSTATUS (WINAPI *NtQueryInformationProcessFunction)( | |
| 311 IN HANDLE ProcessHandle, | |
| 312 IN PROCESSINFOCLASS ProcessInformationClass, | |
| 313 OUT PVOID ProcessInformation, | |
| 314 IN ULONG ProcessInformationLength, | |
| 315 OUT PULONG ReturnLength OPTIONAL); | |
| 316 | |
| 317 typedef NTSTATUS (WINAPI *NtOpenThreadTokenFunction) ( | |
| 318 IN HANDLE ThreadHandle, | |
| 319 IN ACCESS_MASK DesiredAccess, | |
| 320 IN BOOLEAN OpenAsSelf, | |
| 321 OUT PHANDLE TokenHandle); | |
| 322 | |
| 323 typedef NTSTATUS (WINAPI *NtOpenThreadTokenExFunction) ( | |
| 324 IN HANDLE ThreadHandle, | |
| 325 IN ACCESS_MASK DesiredAccess, | |
| 326 IN BOOLEAN OpenAsSelf, | |
| 327 IN ULONG HandleAttributes, | |
| 328 OUT PHANDLE TokenHandle); | |
| 329 | |
| 330 typedef NTSTATUS (WINAPI *NtOpenProcessTokenFunction) ( | |
| 331 IN HANDLE ProcessHandle, | |
| 332 IN ACCESS_MASK DesiredAccess, | |
| 333 OUT PHANDLE TokenHandle); | |
| 334 | |
| 335 typedef NTSTATUS (WINAPI *NtOpenProcessTokenExFunction) ( | |
| 336 IN HANDLE ProcessHandle, | |
| 337 IN ACCESS_MASK DesiredAccess, | |
| 338 IN ULONG HandleAttributes, | |
| 339 OUT PHANDLE TokenHandle); | |
| 340 | |
| 341 typedef NTSTATUS (WINAPI * RtlCreateUserThreadFunction)( | |
| 342 IN HANDLE Process, | |
| 343 IN PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, | |
| 344 IN BOOLEAN CreateSuspended, | |
| 345 IN ULONG ZeroBits, | |
| 346 IN SIZE_T MaximumStackSize, | |
| 347 IN SIZE_T CommittedStackSize, | |
| 348 IN LPTHREAD_START_ROUTINE StartAddress, | |
| 349 IN PVOID Parameter, | |
| 350 OUT PHANDLE Thread, | |
| 351 OUT PCLIENT_ID ClientId); | |
| 352 | |
| 353 // ----------------------------------------------------------------------- | |
| 354 // Registry | |
| 355 | |
| 356 typedef NTSTATUS (WINAPI *NtCreateKeyFunction)( | |
| 357 OUT PHANDLE KeyHandle, | |
| 358 IN ACCESS_MASK DesiredAccess, | |
| 359 IN POBJECT_ATTRIBUTES ObjectAttributes, | |
| 360 IN ULONG TitleIndex, | |
| 361 IN PUNICODE_STRING Class OPTIONAL, | |
| 362 IN ULONG CreateOptions, | |
| 363 OUT PULONG Disposition OPTIONAL); | |
| 364 | |
| 365 typedef NTSTATUS (WINAPI *NtOpenKeyFunction)( | |
| 366 OUT PHANDLE KeyHandle, | |
| 367 IN ACCESS_MASK DesiredAccess, | |
| 368 IN POBJECT_ATTRIBUTES ObjectAttributes); | |
| 369 | |
| 370 typedef NTSTATUS (WINAPI *NtOpenKeyExFunction)( | |
| 371 OUT PHANDLE KeyHandle, | |
| 372 IN ACCESS_MASK DesiredAccess, | |
| 373 IN POBJECT_ATTRIBUTES ObjectAttributes, | |
| 374 IN DWORD open_options); | |
| 375 | |
| 376 typedef NTSTATUS (WINAPI *NtDeleteKeyFunction)( | |
| 377 IN HANDLE KeyHandle); | |
| 378 | |
| 379 // ----------------------------------------------------------------------- | |
| 380 // Memory | |
| 381 | |
| 382 // Don't really need this structure right now. | |
| 383 typedef PVOID PRTL_HEAP_PARAMETERS; | |
| 384 | |
| 385 typedef PVOID (WINAPI *RtlCreateHeapFunction)( | |
| 386 IN ULONG Flags, | |
| 387 IN PVOID HeapBase OPTIONAL, | |
| 388 IN SIZE_T ReserveSize OPTIONAL, | |
| 389 IN SIZE_T CommitSize OPTIONAL, | |
| 390 IN PVOID Lock OPTIONAL, | |
| 391 IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL); | |
| 392 | |
| 393 typedef PVOID (WINAPI *RtlDestroyHeapFunction)( | |
| 394 IN PVOID HeapHandle); | |
| 395 | |
| 396 typedef PVOID (WINAPI *RtlAllocateHeapFunction)( | |
| 397 IN PVOID HeapHandle, | |
| 398 IN ULONG Flags, | |
| 399 IN SIZE_T Size); | |
| 400 | |
| 401 typedef BOOLEAN (WINAPI *RtlFreeHeapFunction)( | |
| 402 IN PVOID HeapHandle, | |
| 403 IN ULONG Flags, | |
| 404 IN PVOID HeapBase); | |
| 405 | |
| 406 typedef NTSTATUS (WINAPI *NtAllocateVirtualMemoryFunction) ( | |
| 407 IN HANDLE ProcessHandle, | |
| 408 IN OUT PVOID *BaseAddress, | |
| 409 IN ULONG_PTR ZeroBits, | |
| 410 IN OUT PSIZE_T RegionSize, | |
| 411 IN ULONG AllocationType, | |
| 412 IN ULONG Protect); | |
| 413 | |
| 414 typedef NTSTATUS (WINAPI *NtFreeVirtualMemoryFunction) ( | |
| 415 IN HANDLE ProcessHandle, | |
| 416 IN OUT PVOID *BaseAddress, | |
| 417 IN OUT PSIZE_T RegionSize, | |
| 418 IN ULONG FreeType); | |
| 419 | |
| 420 typedef enum _MEMORY_INFORMATION_CLASS { | |
| 421 MemoryBasicInformation = 0, | |
| 422 MemoryWorkingSetList, | |
| 423 MemorySectionName, | |
| 424 MemoryBasicVlmInformation | |
| 425 } MEMORY_INFORMATION_CLASS; | |
| 426 | |
| 427 typedef struct _MEMORY_SECTION_NAME { // Information Class 2 | |
| 428 UNICODE_STRING SectionFileName; | |
| 429 } MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME; | |
| 430 | |
| 431 typedef NTSTATUS (WINAPI *NtQueryVirtualMemoryFunction)( | |
| 432 IN HANDLE ProcessHandle, | |
| 433 IN PVOID BaseAddress, | |
| 434 IN MEMORY_INFORMATION_CLASS MemoryInformationClass, | |
| 435 OUT PVOID MemoryInformation, | |
| 436 IN ULONG MemoryInformationLength, | |
| 437 OUT PULONG ReturnLength OPTIONAL); | |
| 438 | |
| 439 typedef NTSTATUS (WINAPI *NtProtectVirtualMemoryFunction)( | |
| 440 IN HANDLE ProcessHandle, | |
| 441 IN OUT PVOID* BaseAddress, | |
| 442 IN OUT PSIZE_T ProtectSize, | |
| 443 IN ULONG NewProtect, | |
| 444 OUT PULONG OldProtect); | |
| 445 | |
| 446 // ----------------------------------------------------------------------- | |
| 447 // Objects | |
| 448 | |
| 449 typedef enum _OBJECT_INFORMATION_CLASS { | |
| 450 ObjectBasicInformation, | |
| 451 ObjectNameInformation, | |
| 452 ObjectTypeInformation, | |
| 453 ObjectAllInformation, | |
| 454 ObjectDataInformation | |
| 455 } OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS; | |
| 456 | |
| 457 typedef struct _OBJDIR_INFORMATION { | |
| 458 UNICODE_STRING ObjectName; | |
| 459 UNICODE_STRING ObjectTypeName; | |
| 460 BYTE Data[1]; | |
| 461 } OBJDIR_INFORMATION; | |
| 462 | |
| 463 typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION { | |
| 464 ULONG Attributes; | |
| 465 ACCESS_MASK GrantedAccess; | |
| 466 ULONG HandleCount; | |
| 467 ULONG PointerCount; | |
| 468 ULONG Reserved[10]; // reserved for internal use | |
| 469 } PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION; | |
| 470 | |
| 471 typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION { | |
| 472 UNICODE_STRING TypeName; | |
| 473 ULONG Reserved[22]; // reserved for internal use | |
| 474 } PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION; | |
| 475 | |
| 476 typedef enum _POOL_TYPE { | |
| 477 NonPagedPool, | |
| 478 PagedPool, | |
| 479 NonPagedPoolMustSucceed, | |
| 480 ReservedType, | |
| 481 NonPagedPoolCacheAligned, | |
| 482 PagedPoolCacheAligned, | |
| 483 NonPagedPoolCacheAlignedMustS | |
| 484 } POOL_TYPE; | |
| 485 | |
| 486 typedef struct _OBJECT_BASIC_INFORMATION { | |
| 487 ULONG Attributes; | |
| 488 ACCESS_MASK GrantedAccess; | |
| 489 ULONG HandleCount; | |
| 490 ULONG PointerCount; | |
| 491 ULONG PagedPoolUsage; | |
| 492 ULONG NonPagedPoolUsage; | |
| 493 ULONG Reserved[3]; | |
| 494 ULONG NameInformationLength; | |
| 495 ULONG TypeInformationLength; | |
| 496 ULONG SecurityDescriptorLength; | |
| 497 LARGE_INTEGER CreateTime; | |
| 498 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION; | |
| 499 | |
| 500 typedef struct _OBJECT_TYPE_INFORMATION { | |
| 501 UNICODE_STRING Name; | |
| 502 ULONG TotalNumberOfObjects; | |
| 503 ULONG TotalNumberOfHandles; | |
| 504 ULONG TotalPagedPoolUsage; | |
| 505 ULONG TotalNonPagedPoolUsage; | |
| 506 ULONG TotalNamePoolUsage; | |
| 507 ULONG TotalHandleTableUsage; | |
| 508 ULONG HighWaterNumberOfObjects; | |
| 509 ULONG HighWaterNumberOfHandles; | |
| 510 ULONG HighWaterPagedPoolUsage; | |
| 511 ULONG HighWaterNonPagedPoolUsage; | |
| 512 ULONG HighWaterNamePoolUsage; | |
| 513 ULONG HighWaterHandleTableUsage; | |
| 514 ULONG InvalidAttributes; | |
| 515 GENERIC_MAPPING GenericMapping; | |
| 516 ULONG ValidAccess; | |
| 517 BOOLEAN SecurityRequired; | |
| 518 BOOLEAN MaintainHandleCount; | |
| 519 USHORT MaintainTypeList; | |
| 520 POOL_TYPE PoolType; | |
| 521 ULONG PagedPoolUsage; | |
| 522 ULONG NonPagedPoolUsage; | |
| 523 } OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION; | |
| 524 | |
| 525 typedef enum _SYSTEM_INFORMATION_CLASS { | |
| 526 SystemHandleInformation = 16 | |
| 527 } SYSTEM_INFORMATION_CLASS; | |
| 528 | |
| 529 typedef struct _SYSTEM_HANDLE_INFORMATION { | |
| 530 USHORT ProcessId; | |
| 531 USHORT CreatorBackTraceIndex; | |
| 532 UCHAR ObjectTypeNumber; | |
| 533 UCHAR Flags; | |
| 534 USHORT Handle; | |
| 535 PVOID Object; | |
| 536 ACCESS_MASK GrantedAccess; | |
| 537 } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; | |
| 538 | |
| 539 typedef struct _SYSTEM_HANDLE_INFORMATION_EX { | |
| 540 ULONG NumberOfHandles; | |
| 541 SYSTEM_HANDLE_INFORMATION Information[1]; | |
| 542 } SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX; | |
| 543 | |
| 544 typedef struct _OBJECT_NAME_INFORMATION { | |
| 545 UNICODE_STRING ObjectName; | |
| 546 } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION; | |
| 547 | |
| 548 typedef NTSTATUS (WINAPI *NtQueryObjectFunction)( | |
| 549 IN HANDLE Handle, | |
| 550 IN OBJECT_INFORMATION_CLASS ObjectInformationClass, | |
| 551 OUT PVOID ObjectInformation OPTIONAL, | |
| 552 IN ULONG ObjectInformationLength, | |
| 553 OUT PULONG ReturnLength OPTIONAL); | |
| 554 | |
| 555 typedef NTSTATUS (WINAPI *NtDuplicateObjectFunction)( | |
| 556 IN HANDLE SourceProcess, | |
| 557 IN HANDLE SourceHandle, | |
| 558 IN HANDLE TargetProcess, | |
| 559 OUT PHANDLE TargetHandle, | |
| 560 IN ACCESS_MASK DesiredAccess, | |
| 561 IN ULONG Attributes, | |
| 562 IN ULONG Options); | |
| 563 | |
| 564 typedef NTSTATUS (WINAPI *NtSignalAndWaitForSingleObjectFunction)( | |
| 565 IN HANDLE HandleToSignal, | |
| 566 IN HANDLE HandleToWait, | |
| 567 IN BOOLEAN Alertable, | |
| 568 IN PLARGE_INTEGER Timeout OPTIONAL); | |
| 569 | |
| 570 typedef NTSTATUS (WINAPI *NtQuerySystemInformation)( | |
| 571 IN SYSTEM_INFORMATION_CLASS SystemInformationClass, | |
| 572 OUT PVOID SystemInformation, | |
| 573 IN ULONG SystemInformationLength, | |
| 574 OUT PULONG ReturnLength); | |
| 575 | |
| 576 typedef NTSTATUS (WINAPI *NtQueryObject)( | |
| 577 IN HANDLE Handle, | |
| 578 IN OBJECT_INFORMATION_CLASS ObjectInformationClass, | |
| 579 OUT PVOID ObjectInformation, | |
| 580 IN ULONG ObjectInformationLength, | |
| 581 OUT PULONG ReturnLength); | |
| 582 | |
| 583 // ----------------------------------------------------------------------- | |
| 584 // Strings | |
| 585 | |
| 586 typedef int (__cdecl *_strnicmpFunction)( | |
| 587 IN const char* _Str1, | |
| 588 IN const char* _Str2, | |
| 589 IN size_t _MaxCount); | |
| 590 | |
| 591 typedef size_t (__cdecl *strlenFunction)( | |
| 592 IN const char * _Str); | |
| 593 | |
| 594 typedef size_t (__cdecl *wcslenFunction)( | |
| 595 IN const wchar_t* _Str); | |
| 596 | |
| 597 typedef NTSTATUS (WINAPI *RtlAnsiStringToUnicodeStringFunction)( | |
| 598 IN OUT PUNICODE_STRING DestinationString, | |
| 599 IN PANSI_STRING SourceString, | |
| 600 IN BOOLEAN AllocateDestinationString); | |
| 601 | |
| 602 typedef LONG (WINAPI *RtlCompareUnicodeStringFunction)( | |
| 603 IN PCUNICODE_STRING String1, | |
| 604 IN PCUNICODE_STRING String2, | |
| 605 IN BOOLEAN CaseInSensitive); | |
| 606 | |
| 607 typedef VOID (WINAPI *RtlInitUnicodeStringFunction) ( | |
| 608 IN OUT PUNICODE_STRING DestinationString, | |
| 609 IN PCWSTR SourceString); | |
| 610 | |
| 611 #endif // SANDBOX_SRC_NT_INTERNALS_H__ | |
| OLD | NEW |