[ASM:X64] Add initial version of kxamd64.inc, macamd64.inc

This commit is contained in:
Timo Kreuzer 2018-02-09 21:04:28 +01:00
parent fe36f081c7
commit ce5aa24c50
4 changed files with 451 additions and 139 deletions

View file

@ -1,5 +1,8 @@
RAW("include kxamd64.inc"), RAW("#include <kxamd64.inc>"),
SIZE(SizeofPointer, PVOID),
HEADER("CPU type"), HEADER("CPU type"),
CONSTANT(CPU_AMD), CONSTANT(CPU_AMD),
@ -37,6 +40,8 @@ CONSTANT(DEBUG_ACTIVE_DR7),
CONSTANT(DEBUG_ACTIVE_INSTRUMENTED), CONSTANT(DEBUG_ACTIVE_INSTRUMENTED),
CONSTANT(DEBUG_ACTIVE_DBG_INSTRUMENTED), CONSTANT(DEBUG_ACTIVE_DBG_INSTRUMENTED),
CONSTANT(DEBUG_ACTIVE_MINIMAL_THREAD), CONSTANT(DEBUG_ACTIVE_MINIMAL_THREAD),
//CONSTANT(DEBUG_ACTIVE_SET_CONTEXT_STATE_LOCK_BIT),
//CONSTANT(DEBUG_ACTIVE_SET_CONTEXT_STATE_LOCK),
CONSTANT(DEBUG_ACTIVE_PRIMARY_THREAD), CONSTANT(DEBUG_ACTIVE_PRIMARY_THREAD),
CONSTANT(DEBUG_ACTIVE_PRIMARY_THREAD_BIT), CONSTANT(DEBUG_ACTIVE_PRIMARY_THREAD_BIT),
@ -58,7 +63,7 @@ CONSTANT(EFLAGS_TF_SHIFT),
CONSTANT(EFLAGS_IF_MASK), CONSTANT(EFLAGS_IF_MASK),
CONSTANT(EFLAGS_IF_SHIFT), CONSTANT(EFLAGS_IF_SHIFT),
CONSTANT(EFLAGS_ID_MASK), CONSTANT(EFLAGS_ID_MASK),
CONSTANTX(EFLAGS_IF_BIT, EFLAGS_IF_MASK), CONSTANTX(EFLAGS_IF_BIT, EFLAGS_IF_SHIFT),
HEADER("Exception codes"), HEADER("Exception codes"),
CONSTANT(EXCEPTION_DIVIDED_BY_ZERO), CONSTANT(EXCEPTION_DIVIDED_BY_ZERO),
@ -77,6 +82,7 @@ CONSTANT(EXCEPTION_GP_FAULT),
CONSTANT(EXCEPTION_RESERVED_TRAP), CONSTANT(EXCEPTION_RESERVED_TRAP),
CONSTANT(EXCEPTION_NPX_ERROR), CONSTANT(EXCEPTION_NPX_ERROR),
CONSTANT(EXCEPTION_ALIGNMENT_CHECK), CONSTANT(EXCEPTION_ALIGNMENT_CHECK),
//CONSTANT(EXCEPTION_VIRTUALIZATION_FAULT),
HEADER("Legacy Floating Status Bit Masks"), HEADER("Legacy Floating Status Bit Masks"),
CONSTANT(FSW_INVALID_OPERATION), CONSTANT(FSW_INVALID_OPERATION),
@ -105,6 +111,9 @@ HEADER("Hypervisor Enlightenment Definitions"),
//CONSTANT(HV_VIRTUAL_APIC_NO_EOI_REQUIRED), // win 10 //CONSTANT(HV_VIRTUAL_APIC_NO_EOI_REQUIRED), // win 10
//CONSTANT(HV_VIRTUAL_APIC_NO_EOI_REQUIRED_V), // not win 10 //CONSTANT(HV_VIRTUAL_APIC_NO_EOI_REQUIRED_V), // not win 10
//CONSTANT(HvApicFlags), //CONSTANT(HvApicFlags),
//HvVirtualFaultCode equ 00044H
//HvVirtualFaultParam equ 00048H
//HvExtVirtualizationFaultEpf equ 00001H
CONSTANT(KEXCEPTION_ACTIVE_INTERRUPT_FRAME), CONSTANT(KEXCEPTION_ACTIVE_INTERRUPT_FRAME),
CONSTANT(KEXCEPTION_ACTIVE_EXCEPTION_FRAME), CONSTANT(KEXCEPTION_ACTIVE_EXCEPTION_FRAME),
@ -122,6 +131,8 @@ CONSTANT(KF_XSTATE), // win 10
CONSTANT(KF_XSAVEOPT_BIT), // win 10 CONSTANT(KF_XSAVEOPT_BIT), // win 10
CONSTANT(KF_XSTATE_BIT), // win 10 CONSTANT(KF_XSTATE_BIT), // win 10
CONSTANT(KF_RDWRFSGSBASE_BIT), // win 10 CONSTANT(KF_RDWRFSGSBASE_BIT), // win 10
//CONSTANT(KF_XSAVES_BIT),
//CONSTANT(KF_FPU_LEAKAGE_BIT),
HEADER("KGDT selectors"), HEADER("KGDT selectors"),
CONSTANT(KGDT64_NULL), CONSTANT(KGDT64_NULL),
@ -157,6 +168,11 @@ CONSTANT(MSR_GS_SWAP),
CONSTANT(MSR_MCG_STATUS), CONSTANT(MSR_MCG_STATUS),
CONSTANT(MSR_AMD_ACCESS), CONSTANT(MSR_AMD_ACCESS),
CONSTANT(MSR_IA32_MISC_ENABLE), CONSTANT(MSR_IA32_MISC_ENABLE),
CONSTANT(MSR_DEBUG_CTL),
CONSTANT(MSR_LAST_BRANCH_FROM), // not win 10
CONSTANT(MSR_LAST_BRANCH_TO), // not win 10
CONSTANT(MSR_LAST_EXCEPTION_FROM), // not win 10
CONSTANT(MSR_LAST_EXCEPTION_TO), // not win 10
HEADER("Flags for MSR_EFER"), HEADER("Flags for MSR_EFER"),
CONSTANT(MSR_LMA), CONSTANT(MSR_LMA),
@ -164,11 +180,6 @@ CONSTANT(MSR_LME),
CONSTANT(MSR_SCE), CONSTANT(MSR_SCE),
CONSTANT(MSR_NXE), CONSTANT(MSR_NXE),
CONSTANT(MSR_PAT), CONSTANT(MSR_PAT),
CONSTANT(MSR_DEBUG_CTL),
CONSTANT(MSR_LAST_BRANCH_FROM), // not win 10
CONSTANT(MSR_LAST_BRANCH_TO), // not win 10
CONSTANT(MSR_LAST_EXCEPTION_FROM), // not win 10
CONSTANT(MSR_LAST_EXCEPTION_TO), // not win 10
HEADER("Flags for MSR_DEBUG_CTL"), HEADER("Flags for MSR_DEBUG_CTL"),
//CONSTANT(MSR_DEBUG_CTL_LBR), //CONSTANT(MSR_DEBUG_CTL_LBR),
@ -241,6 +252,7 @@ CONSTANT(EVENT_INCREMENT),
//CONSTANT(KUMS_UCH_VOLATILE_MASK), //CONSTANT(KUMS_UCH_VOLATILE_MASK),
CONSTANT(PF_COMPARE_EXCHANGE128), CONSTANT(PF_COMPARE_EXCHANGE128),
//CONSTANT(PF_RDWRFSGSBASE_AVAILABLE), //CONSTANT(PF_RDWRFSGSBASE_AVAILABLE),
//CONSTANT(PF_RDTSCP_INSTRUCTION_AVAILABLE),
//CONSTANT(UMS_TLS_THREAD_CONTEXT), //CONSTANT(UMS_TLS_THREAD_CONTEXT),
//CONSTANT(XHF_NOEXECUTE), //CONSTANT(XHF_NOEXECUTE),
@ -362,6 +374,8 @@ OFFSET(ExXmm12, KEXCEPTION_FRAME, Xmm12),
OFFSET(ExXmm13, KEXCEPTION_FRAME, Xmm13), OFFSET(ExXmm13, KEXCEPTION_FRAME, Xmm13),
OFFSET(ExXmm14, KEXCEPTION_FRAME, Xmm14), OFFSET(ExXmm14, KEXCEPTION_FRAME, Xmm14),
OFFSET(ExXmm15, KEXCEPTION_FRAME, Xmm15), OFFSET(ExXmm15, KEXCEPTION_FRAME, Xmm15),
OFFSET(ExOutputBuffer, KEXCEPTION_FRAME, OutputBuffer), // not Win 10
OFFSET(ExOutputLength, KEXCEPTION_FRAME, OutputLength), // not Win 10
OFFSET(ExMxCsr, KEXCEPTION_FRAME, MxCsr), OFFSET(ExMxCsr, KEXCEPTION_FRAME, MxCsr),
OFFSET(ExRbp, KEXCEPTION_FRAME, Rbp), OFFSET(ExRbp, KEXCEPTION_FRAME, Rbp),
OFFSET(ExRbx, KEXCEPTION_FRAME, Rbx), OFFSET(ExRbx, KEXCEPTION_FRAME, Rbx),
@ -413,15 +427,21 @@ OFFSET(LfMxCsr, XSAVE_FORMAT, MxCsr),
OFFSET(LfMxCsr_Mask, XSAVE_FORMAT, MxCsr_Mask), OFFSET(LfMxCsr_Mask, XSAVE_FORMAT, MxCsr_Mask),
OFFSET(LfFloatRegisters, XSAVE_FORMAT, FloatRegisters), OFFSET(LfFloatRegisters, XSAVE_FORMAT, FloatRegisters),
OFFSET(LfXmmRegisters, XSAVE_FORMAT, XmmRegisters), OFFSET(LfXmmRegisters, XSAVE_FORMAT, XmmRegisters),
//OFFSET(LfFloatSaveLength, XSAVE_FORMAT, FloatSaveLength),
//X87ErrorOffset equ 0000CH
//X87FloatSaveLength equ 0006CH
HEADER("KGDTENTRY64 offsets"), HEADER("KGDTENTRY64 offsets"),
OFFSET(KgdtBaseLow, KGDTENTRY64, BaseLow), OFFSET(KgdtBaseLow, KGDTENTRY64, BaseLow),
OFFSET(KgdtBaseMiddle, KGDTENTRY64, Bytes.BaseMiddle), OFFSET(KgdtBaseMiddle, KGDTENTRY64, Bytes.BaseMiddle),
OFFSET(KgdtBaseHigh, KGDTENTRY64, Bytes.BaseHigh), OFFSET(KgdtBaseHigh, KGDTENTRY64, Bytes.BaseHigh),
OFFSET(KgdtBaseUpper, KGDTENTRY64, BaseUpper), OFFSET(KgdtBaseUpper, KGDTENTRY64, BaseUpper),
//OFFSET(KgdtFlags1, KGDTENTRY64, Flags1),
OFFSET(KgdtLimitHigh, KGDTENTRY64, Bytes.Flags2), OFFSET(KgdtLimitHigh, KGDTENTRY64, Bytes.Flags2),
OFFSET(KgdtLimitLow, KGDTENTRY64, LimitLow), OFFSET(KgdtLimitLow, KGDTENTRY64, LimitLow),
//CONSTANT(KGDT_LIMIT_ENCODE_MASK), //CONSTANT(KGDT_LIMIT_ENCODE_MASK),
//CONSTANT(KGDT_ENTRY_PRESENT),
HEADER("MACHINE_FRAME offsets"), HEADER("MACHINE_FRAME offsets"),
OFFSET(MfRip, MACHINE_FRAME, Rip), OFFSET(MfRip, MACHINE_FRAME, Rip),
@ -450,7 +470,7 @@ OFFSET(PbPrcbLock, KPRCB, PrcbLock),
#if (NTDDI_VERSION >= NTDDI_VISTA) #if (NTDDI_VERSION >= NTDDI_VISTA)
OFFSET(PbPriorityState, KPRCB, PriorityState), OFFSET(PbPriorityState, KPRCB, PriorityState),
#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */ #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
OFFSET(PbSetMember, KPRCB, SetMember), OFFSET(PbSetMember, KPRCB, SetMember), // not Win 10
OFFSET(PbProcessorState, KPRCB, ProcessorState), OFFSET(PbProcessorState, KPRCB, ProcessorState),
OFFSET(PbCpuType, KPRCB, CpuType), OFFSET(PbCpuType, KPRCB, CpuType),
OFFSET(PbCpuID, KPRCB, CpuID), OFFSET(PbCpuID, KPRCB, CpuID),
@ -468,7 +488,7 @@ OFFSET(PbApicMask, KPRCB, ApicMask),
OFFSET(PbCFlushSize, KPRCB, CFlushSize), OFFSET(PbCFlushSize, KPRCB, CFlushSize),
OFFSET(PbAcpiReserved, KPRCB, AcpiReserved), OFFSET(PbAcpiReserved, KPRCB, AcpiReserved),
OFFSET(PbInitialApicId, KPRCB, InitialApicId), OFFSET(PbInitialApicId, KPRCB, InitialApicId),
//OFFSET(PbStride, KPRCB, Stride), //OFFSET(PbStride, KPRCB, Stride), // not Win 10
OFFSET(PbLockQueue, KPRCB, LockQueue), OFFSET(PbLockQueue, KPRCB, LockQueue),
OFFSET(PbPPLookasideList, KPRCB, PPLookasideList), OFFSET(PbPPLookasideList, KPRCB, PPLookasideList),
OFFSET(PbPPNPagedLookasideList, KPRCB, PPNPagedLookasideList), OFFSET(PbPPNPagedLookasideList, KPRCB, PPNPagedLookasideList),
@ -484,16 +504,16 @@ OFFSET(PbLookasideIrpFloat, KPRCB, LookasideIrpFloat),
//OFFSET(PbWriteTransferCount, KPRCB, IoWriteTransferCount), //OFFSET(PbWriteTransferCount, KPRCB, IoWriteTransferCount),
//OFFSET(PbOtherTransferCount, KPRCB, IoOtherTransferCount), //OFFSET(PbOtherTransferCount, KPRCB, IoOtherTransferCount),
//OFFSET(PbContextSwitches, KPRCB, KeContextSwitches), //OFFSET(PbContextSwitches, KPRCB, KeContextSwitches),
//OFFSET(PbLdtSelector, KPRCB, LdtSelector), //OFFSET(PbLdtSelector, KPRCB, LdtSelector), // not Win 10
OFFSET(PbTargetSet, KPRCB, TargetSet), OFFSET(PbTargetSet, KPRCB, TargetSet), // not Win 10
//OFFSET(PbTargetCount, KPRCB, TargetCount), //OFFSET(PbTargetCount, KPRCB, TargetCount),
OFFSET(PbIpiFrozen, KPRCB, IpiFrozen), OFFSET(PbIpiFrozen, KPRCB, IpiFrozen),
OFFSET(PbRequestMailbox, KPRCB, RequestMailbox), OFFSET(PbRequestMailbox, KPRCB, RequestMailbox),
OFFSET(PbSenderSummary, KPRCB, SenderSummary), OFFSET(PbSenderSummary, KPRCB, SenderSummary), // not Win 10
//OFFSET(PbDpcListHead, KPRCB, DpcListHead), //OFFSET(PbDpcListHead, KPRCB, DpcListHead), // not Win 10
//OFFSET(PbDpcList, KPRCB, DpcList), //OFFSET(PbDpcList, KPRCB, DpcList),
//OFFSET(PbDpcLock, KPRCB, DpcLock), //OFFSET(PbDpcLock, KPRCB, DpcLock),
//OFFSET(PbDpcQueueDepth, KPRCB, DpcQueueDepth), //OFFSET(PbDpcQueueDepth, KPRCB, DpcQueueDepth), // not Win 10
//OFFSET(PbDpcCount, KPRCB, DpcCount), //OFFSET(PbDpcCount, KPRCB, DpcCount),
OFFSET(PbDpcStack, KPRCB, DpcStack), OFFSET(PbDpcStack, KPRCB, DpcStack),
OFFSET(PbMaximumDpcQueueDepth, KPRCB, MaximumDpcQueueDepth), OFFSET(PbMaximumDpcQueueDepth, KPRCB, MaximumDpcQueueDepth),
@ -501,18 +521,18 @@ OFFSET(PbDpcRequestRate, KPRCB, DpcRequestRate),
OFFSET(PbMinimumDpcRate, KPRCB, MinimumDpcRate), OFFSET(PbMinimumDpcRate, KPRCB, MinimumDpcRate),
//OFFSET(PbDpcRequestSummary, KPRCB, DpcRequestSummary), //OFFSET(PbDpcRequestSummary, KPRCB, DpcRequestSummary),
//OFFSET(PbNormalDpcState, KPRCB, NormalDpcState), //OFFSET(PbNormalDpcState, KPRCB, NormalDpcState),
OFFSET(PbDpcInterruptRequested, KPRCB, DpcInterruptRequested), OFFSET(PbDpcInterruptRequested, KPRCB, DpcInterruptRequested), // not Win 10
OFFSET(PbDpcThreadRequested, KPRCB, DpcThreadRequested), OFFSET(PbDpcThreadRequested, KPRCB, DpcThreadRequested), // not Win 10
OFFSET(PbDpcRoutineActive, KPRCB, DpcRoutineActive), OFFSET(PbDpcRoutineActive, KPRCB, DpcRoutineActive),
OFFSET(PbDpcThreadActive, KPRCB, DpcThreadActive), OFFSET(PbDpcThreadActive, KPRCB, DpcThreadActive), // not Win 10
OFFSET(PbTimerHand, KPRCB, TimerHand), OFFSET(PbTimerHand, KPRCB, TimerHand), // not Win 10
OFFSET(PbTimerRequest, KPRCB, TimerRequest), OFFSET(PbTimerRequest, KPRCB, TimerRequest), // not Win 10
OFFSET(PbTickOffset, KPRCB, TickOffset), OFFSET(PbTickOffset, KPRCB, TickOffset), // not Win 10
//OFFSET(PbInterruptObject, KPRCB, InterruptObject), //OFFSET(PbInterruptObject, KPRCB, InterruptObject),
OFFSET(PbMasterOffset, KPRCB, MasterOffset), OFFSET(PbMasterOffset, KPRCB, MasterOffset), // not Win 10
OFFSET(PbDpcLastCount, KPRCB, DpcLastCount), OFFSET(PbDpcLastCount, KPRCB, DpcLastCount),
OFFSET(PbQuantumEnd, KPRCB, QuantumEnd), OFFSET(PbQuantumEnd, KPRCB, QuantumEnd),
OFFSET(PbDpcSetEventRequest, KPRCB, DpcSetEventRequest), OFFSET(PbDpcSetEventRequest, KPRCB, DpcSetEventRequest), // not Win 10
OFFSET(PbIdleSchedule, KPRCB, IdleSchedule), OFFSET(PbIdleSchedule, KPRCB, IdleSchedule),
OFFSET(PbReadySummary, KPRCB, ReadySummary), OFFSET(PbReadySummary, KPRCB, ReadySummary),
OFFSET(PbDispatcherReadyListHead, KPRCB, DispatcherReadyListHead), OFFSET(PbDispatcherReadyListHead, KPRCB, DispatcherReadyListHead),
@ -522,17 +542,17 @@ OFFSET(PbUserTime, KPRCB, UserTime),
OFFSET(PbDpcTime, KPRCB, DpcTime), OFFSET(PbDpcTime, KPRCB, DpcTime),
OFFSET(PbInterruptTime, KPRCB, InterruptTime), OFFSET(PbInterruptTime, KPRCB, InterruptTime),
OFFSET(PbAdjustDpcThreshold, KPRCB, AdjustDpcThreshold), OFFSET(PbAdjustDpcThreshold, KPRCB, AdjustDpcThreshold),
OFFSET(PbSkipTick, KPRCB, SkipTick), OFFSET(PbSkipTick, KPRCB, SkipTick), // not Win 10
OFFSET(PbPollSlot, KPRCB, PollSlot), OFFSET(PbPollSlot, KPRCB, PollSlot), // not Win 10
OFFSET(PbParentNode, KPRCB, ParentNode), OFFSET(PbParentNode, KPRCB, ParentNode),
OFFSET(PbMultiThreadProcessorSet, KPRCB, MultiThreadProcessorSet), OFFSET(PbMultiThreadProcessorSet, KPRCB, MultiThreadProcessorSet),
OFFSET(PbMultiThreadSetMaster, KPRCB, MultiThreadSetMaster), OFFSET(PbMultiThreadSetMaster, KPRCB, MultiThreadSetMaster), // not Win 10
//OFFSET(PbStartCycles, KPRCB, StartCycles), //OFFSET(PbStartCycles, KPRCB, StartCycles),
OFFSET(PbPageColor, KPRCB, PageColor), OFFSET(PbPageColor, KPRCB, PageColor),
OFFSET(PbNodeColor, KPRCB, NodeColor), OFFSET(PbNodeColor, KPRCB, NodeColor),
OFFSET(PbNodeShiftedColor, KPRCB,NodeShiftedColor), OFFSET(PbNodeShiftedColor, KPRCB,NodeShiftedColor),
OFFSET(PbSecondaryColorMask, KPRCB, SecondaryColorMask), OFFSET(PbSecondaryColorMask, KPRCB, SecondaryColorMask),
OFFSET(PbSleeping, KPRCB, Sleeping), OFFSET(PbSleeping, KPRCB, Sleeping), // not Win 10
//OFFSET(PbCycleTime, KPRCB, CycleTime), //OFFSET(PbCycleTime, KPRCB, CycleTime),
//OFFSET(PbFastReadNoWait, KPRCB, FastReadNoWait), //OFFSET(PbFastReadNoWait, KPRCB, FastReadNoWait),
//OFFSET(PbFastReadWait, KPRCB, FastReadWait), //OFFSET(PbFastReadWait, KPRCB, FastReadWait),
@ -544,12 +564,13 @@ OFFSET(PbSleeping, KPRCB, Sleeping),
//OFFSET(PbExceptionDispatchCount, KPRCB, ExceptionDispatchCount), //OFFSET(PbExceptionDispatchCount, KPRCB, ExceptionDispatchCount),
//OFFSET(PbKeSpinLockOrdering, KPRCB, KeSpinLockOrdering), //OFFSET(PbKeSpinLockOrdering, KPRCB, KeSpinLockOrdering),
OFFSET(PbVendorString, KPRCB, VendorString), OFFSET(PbVendorString, KPRCB, VendorString),
OFFSET(PbPowerState, KPRCB, PowerState), OFFSET(PbPowerState, KPRCB, PowerState), // not Win 10
//OFFSET(PbContext, KPRCB, Context), //OFFSET(PbContext, KPRCB, Context),
//OFFSET(PbIsrStack, KPRCB, IsrStack), //OFFSET(PbIsrStack, KPRCB, IsrStack),
//OFFSET(PbEntropyCount, KPRCB, EntropyTimingState.EntropyCount), //OFFSET(PbEntropyCount, KPRCB, EntropyTimingState.EntropyCount), // not Win 10
//OFFSET(PbEntropyBuffer, KPRCB, EntropyTimingState.Buffer), //OFFSET(PbEntropyBuffer, KPRCB, EntropyTimingState.Buffer), // not Win 10
//OFFSET(PbMailbox, KPRCB, Mailbox), //OFFSET(PbMailbox, KPRCB, Mailbox),
//OFFSET(PbBamFlags, KPRCB, BamFlags),
SIZE(ProcessorBlockLength, KPRCB), SIZE(ProcessorBlockLength, KPRCB),
HEADER("KPCR"), HEADER("KPCR"),
@ -559,8 +580,8 @@ OFFSET(PcUserRsp, KPCR, UserRsp),
OFFSET(PcSelf, KPCR, Self), OFFSET(PcSelf, KPCR, Self),
OFFSET(PcCurrentPrcb, KPCR, CurrentPrcb), OFFSET(PcCurrentPrcb, KPCR, CurrentPrcb),
OFFSET(PcLockArray, KPCR, LockArray), OFFSET(PcLockArray, KPCR, LockArray),
//OFFSET(PcTeb, KPCR, Teb), //OFFSET(PcTeb, KPCR, Used_Self),
//OFFSET(PcIdt, KPCR, Idt), //OFFSET(PcIdt, KPCR, IdtBase),
OFFSET(PcIrql, KPCR, Irql), OFFSET(PcIrql, KPCR, Irql),
OFFSET(PcStallScaleFactor, KPCR, StallScaleFactor), OFFSET(PcStallScaleFactor, KPCR, StallScaleFactor),
OFFSET(PcHalReserved, KPCR, HalReserved), OFFSET(PcHalReserved, KPCR, HalReserved),
@ -576,7 +597,7 @@ OFFSET(PcCurrentThread, KIPCR, Prcb.CurrentThread),
//OFFSET(PcNestingLevel, KPCR, NestingLevel), //OFFSET(PcNestingLevel, KPCR, NestingLevel),
OFFSET(PcRspBase, KIPCR, Prcb.RspBase), OFFSET(PcRspBase, KIPCR, Prcb.RspBase),
//OFFSET(PcPrcbLock, KPCR, PrcbLock), //OFFSET(PcPrcbLock, KPCR, PrcbLock),
OFFSET(PcSetMember, KIPCR, Prcb.SetMember), OFFSET(PcSetMember, KIPCR, Prcb.SetMember), // not Win 10
#if 0 #if 0
OFFSET(PcCr0, KIPCR, Prcb.Cr0), OFFSET(PcCr0, KIPCR, Prcb.Cr0),
OFFSET(PcCr2, KIPCR, Prcb.Cr2), OFFSET(PcCr2, KIPCR, Prcb.Cr2),
@ -610,9 +631,9 @@ OFFSET(PcSystemCalls, KIPCR, Prcb.KeSystemCalls),
OFFSET(PcDpcRoutineActive, KIPCR, Prcb.DpcRoutineActive), OFFSET(PcDpcRoutineActive, KIPCR, Prcb.DpcRoutineActive),
OFFSET(PcInterruptCount, KIPCR, Prcb.InterruptCount), OFFSET(PcInterruptCount, KIPCR, Prcb.InterruptCount),
OFFSET(PcDebuggerSavedIRQL, KIPCR, Prcb.DebuggerSavedIRQL), OFFSET(PcDebuggerSavedIRQL, KIPCR, Prcb.DebuggerSavedIRQL),
OFFSET(PcTickOffset, KIPCR, Prcb.TickOffset), OFFSET(PcTickOffset, KIPCR, Prcb.TickOffset), // not Win 10
OFFSET(PcMasterOffset, KIPCR, Prcb.MasterOffset), OFFSET(PcMasterOffset, KIPCR, Prcb.MasterOffset),
OFFSET(PcSkipTick, KIPCR, Prcb.SkipTick), OFFSET(PcSkipTick, KIPCR, Prcb.SkipTick), // not Win 10
#if (NTDDI_VERSION >= NTDDI_LONGHORN) #if (NTDDI_VERSION >= NTDDI_LONGHORN)
OFFSET(PcVirtualApicAssist, KIPCR, Prcb.VirtualApicAssist), OFFSET(PcVirtualApicAssist, KIPCR, Prcb.VirtualApicAssist),
OFFSET(PcStartCycles, KIPCR, Prcb.StartCycles), OFFSET(PcStartCycles, KIPCR, Prcb.StartCycles),
@ -620,6 +641,8 @@ OFFSET(PcStartCycles, KIPCR, Prcb.StartCycles),
//OFFSET(PcFeatureBits, KIPCR, Prcb.FeatureBits), //OFFSET(PcFeatureBits, KIPCR, Prcb.FeatureBits),
//OFFSET(PcNmiActive, KIPCR, Prcb.NmiActive), //OFFSET(PcNmiActive, KIPCR, Prcb.NmiActive),
//OFFSET(PcDeepSleep, KIPCR, Prcb.DeepSleep), //OFFSET(PcDeepSleep, KIPCR, Prcb.DeepSleep),
//OFFSET(PcSfCode equ 066A8H, KIPCR, Prcb.SfCode),
//OFFSET(PcSfVa equ 066B0H, KIPCR, Prcb.SfVa),
SIZE(ProcessorControlRegisterLength, KIPCR), SIZE(ProcessorControlRegisterLength, KIPCR),
HEADER("KPROCESSOR_START_BLOCK offsets"), HEADER("KPROCESSOR_START_BLOCK offsets"),
@ -663,6 +686,7 @@ OFFSET(PsMxCsr, KPROCESSOR_STATE, SpecialRegisters.MxCsr),
//OFFSET(PsMsrCStar, KPROCESSOR_STATE, MsrCStar), //OFFSET(PsMsrCStar, KPROCESSOR_STATE, MsrCStar),
//OFFSET(PsMsrSyscallMask, KPROCESSOR_STATE, MsrSyscallMask), //OFFSET(PsMsrSyscallMask, KPROCESSOR_STATE, MsrSyscallMask),
//OFFSET(PsXcr0, KPROCESSOR_STATE, Xcr0), //OFFSET(PsXcr0, KPROCESSOR_STATE, Xcr0),
//OFFSET(PsMsrFsBase, KPROCESSOR_STATE, MsrFsBase),
OFFSET(PsContextFrame, KPROCESSOR_STATE, ContextFrame), OFFSET(PsContextFrame, KPROCESSOR_STATE, ContextFrame),
OFFSET(PsDebugControl, KPROCESSOR_STATE, SpecialRegisters.DebugControl), OFFSET(PsDebugControl, KPROCESSOR_STATE, SpecialRegisters.DebugControl),
OFFSET(PsLastBranchToRip, KPROCESSOR_STATE, SpecialRegisters.LastBranchToRip), OFFSET(PsLastBranchToRip, KPROCESSOR_STATE, SpecialRegisters.LastBranchToRip),
@ -698,6 +722,7 @@ OFFSET(SrMsrLStar, KSPECIAL_REGISTERS, MsrLStar),
OFFSET(SrMsrCStar, KSPECIAL_REGISTERS, MsrCStar), OFFSET(SrMsrCStar, KSPECIAL_REGISTERS, MsrCStar),
OFFSET(SrMsrSyscallMask, KSPECIAL_REGISTERS, MsrSyscallMask), OFFSET(SrMsrSyscallMask, KSPECIAL_REGISTERS, MsrSyscallMask),
//OFFSET(SrXcr0, KSPECIAL_REGISTERS, Xcr0), //OFFSET(SrXcr0, KSPECIAL_REGISTERS, Xcr0),
//OFFSET(SrMsrFsBase, KSPECIAL_REGISTERS, MsrFsBase),
HEADER("KSYSTEM_TIME"), // obsolete in win 10 HEADER("KSYSTEM_TIME"), // obsolete in win 10
OFFSET(StLowTime, KSYSTEM_TIME, LowPart), OFFSET(StLowTime, KSYSTEM_TIME, LowPart),
@ -709,7 +734,7 @@ OFFSET(SwP5Home, KSWITCH_FRAME, P5Home),
OFFSET(SwApcBypass, KSWITCH_FRAME, ApcBypass), OFFSET(SwApcBypass, KSWITCH_FRAME, ApcBypass),
OFFSET(SwRbp, KSWITCH_FRAME, Rbp), OFFSET(SwRbp, KSWITCH_FRAME, Rbp),
OFFSET(SwReturn, KSWITCH_FRAME, Return), OFFSET(SwReturn, KSWITCH_FRAME, Return),
SIZE(SwitchFrameLength, KSWITCH_FRAME), SIZE(SwitchFrameLength, KSWITCH_FRAME), // not in Win 10
SIZE(KSWITCH_FRAME_LENGTH, KSWITCH_FRAME), SIZE(KSWITCH_FRAME_LENGTH, KSWITCH_FRAME),
#if (NTDDI_VERSION >= NTDDI_WIN7) #if (NTDDI_VERSION >= NTDDI_WIN7)
@ -724,60 +749,60 @@ SIZE(KTIMER_TABLE_SIZE, KTIMER_TABLE),
#if 0 // FIXME: reloffset??? #if 0 // FIXME: reloffset???
HEADER("KTRAP_FRAME offsets"), HEADER("KTRAP_FRAME offsets"),
OFFSET(TrP1Home, KTRAP_FRAME, TrP1Home), OFFSET(TrP1Home, KTRAP_FRAME, TrP1Home),
TrP2Home, KTRAP_FRAME, TrP1Home), OFFSET(TrP2Home, KTRAP_FRAME, TrP2Home),
TrP3Home, KTRAP_FRAME, TrP1Home), OFFSET(TrP3Home, KTRAP_FRAME, TrP3Home),
TrP4Home, KTRAP_FRAME, TrP1Home), OFFSET(TrP4Home, KTRAP_FRAME, TrP4Home),
TrP5, KTRAP_FRAME, TrP1Home), OFFSET(TrP5, KTRAP_FRAME, P5),
TrPreviousMode, KTRAP_FRAME, TrP1Home), OFFSET(TrPreviousMode, KTRAP_FRAME, PreviousMode),
TrPreviousIrql, KTRAP_FRAME, TrP1Home), OFFSET(TrPreviousIrql, KTRAP_FRAME, PreviousIrql),
TrFaultIndicator, KTRAP_FRAME, TrP1Home), OFFSET(TrFaultIndicator, KTRAP_FRAME, TrP1Home),
TrExceptionActive, KTRAP_FRAME, TrP1Home), OFFSET(TrExceptionActive, KTRAP_FRAME, TrP1Home),
TrMxCsr, KTRAP_FRAME, TrP1Home), OFFSET(TrMxCsr, KTRAP_FRAME, TrP1Home),
TrRax equ 0FFFFFFB0H OFFSET(TrRax equ 0FFFFFFB0H
TrRcx equ 0FFFFFFB8H OFFSET(TrRcx equ 0FFFFFFB8H
TrRdx equ 0FFFFFFC0H OFFSET(TrRdx equ 0FFFFFFC0H
TrR8 equ 0FFFFFFC8H OFFSET(TrR8 equ 0FFFFFFC8H
TrR9 equ 0FFFFFFD0H OFFSET(TrR9 equ 0FFFFFFD0H
TrR10 equ 0FFFFFFD8H OFFSET(TrR10 equ 0FFFFFFD8H
TrR11 equ 0FFFFFFE0H OFFSET(TrR11 equ 0FFFFFFE0H
TrGsBase equ 0FFFFFFE8H OFFSET(TrGsBase equ 0FFFFFFE8H
TrGsSwap equ 0FFFFFFE8H OFFSET(TrGsSwap equ 0FFFFFFE8H
TrXmm0 equ 0FFFFFFF0H OFFSET(TrXmm0 equ 0FFFFFFF0H
TrXmm1 equ 00000H OFFSET(TrXmm1 equ 00000H
TrXmm2 equ 00010H OFFSET(TrXmm2 equ 00010H
TrXmm3 equ 00020H OFFSET(TrXmm3 equ 00020H
TrXmm4 equ 00030H OFFSET(TrXmm4 equ 00030H
TrXmm5 equ 00040H OFFSET(TrXmm5 equ 00040H
TrFaultAddress equ 00050H OFFSET(TrFaultAddress equ 00050H
TrDr0 equ 00058H OFFSET(TrDr0 equ 00058H
TrDr1 equ 00060H OFFSET(TrDr1 equ 00060H
TrDr2 equ 00068H OFFSET(TrDr2 equ 00068H
TrDr3 equ 00070H OFFSET(TrDr3 equ 00070H
TrDr6 equ 00078H OFFSET(TrDr6 equ 00078H
TrDr7 equ 00080H OFFSET(TrDr7 equ 00080H
TrDebugControl equ 00088H OFFSET(TrDebugControl equ 00088H
TrLastBranchToRip equ 00090H OFFSET(TrLastBranchToRip equ 00090H
TrLastBranchFromRip equ 00098H OFFSET(TrLastBranchFromRip equ 00098H
TrLastExceptionToRip equ 000A0H OFFSET(TrLastExceptionToRip equ 000A0H
TrLastExceptionFromRip equ 000A8H OFFSET(TrLastExceptionFromRip equ 000A8H
TrSegDs equ 000B0H OFFSET(TrSegDs equ 000B0H
TrSegEs equ 000B2H OFFSET(TrSegEs equ 000B2H
TrSegFs equ 000B4H OFFSET(TrSegFs equ 000B4H
TrSegGs equ 000B6H OFFSET(TrSegGs equ 000B6H
TrTrapFrame equ 000B8H OFFSET(TrTrapFrame equ 000B8H
TrRbx equ 000C0H OFFSET(TrRbx equ 000C0H
TrRdi equ 000C8H OFFSET(TrRdi equ 000C8H
TrRsi equ 000D0H OFFSET(TrRsi equ 000D0H
TrRbp equ 000D8H OFFSET(TrRbp equ 000D8H
TrErrorCode equ 000E0H OFFSET(TrErrorCode equ 000E0H
TrRip equ 000E8H OFFSET(TrRip equ 000E8H
TrSegCs equ 000F0H OFFSET(TrSegCs equ 000F0H
TrLogging equ 000F3H OFFSET(TrLogging equ 000F3H
TrEFlags equ 000F8H OFFSET(TrEFlags equ 000F8H
TrRsp equ 00100H OFFSET(TrRsp equ 00100H
TrSegSs equ 00108H OFFSET(TrSegSs equ 00108H
SIZE(KTRAP_FRAME_LENGTH, KTRAP_FRAME),
#endif #endif
SIZE(KTRAP_FRAME_LENGTH, KTRAP_FRAME),
HEADER("KTSS offsets"), HEADER("KTSS offsets"),
OFFSET(TssRsp0, KTSS64, Rsp0), OFFSET(TssRsp0, KTSS64, Rsp0),
@ -818,6 +843,7 @@ HEADER("XSTATE_CONFIGURATION offsets"),
OFFSET(XcfgEnabledFeatures, XSTATE_CONFIGURATION, EnabledFeatures), OFFSET(XcfgEnabledFeatures, XSTATE_CONFIGURATION, EnabledFeatures),
#if (NTDDI_VERSION >= NTDDI_WIN10) #if (NTDDI_VERSION >= NTDDI_WIN10)
OFFSET(XcfgEnabledVolatileFeatures, XSTATE_CONFIGURATION, EnabledFeatures), OFFSET(XcfgEnabledVolatileFeatures, XSTATE_CONFIGURATION, EnabledFeatures),
OFFSET(XcfgEnabledSupervisorFeatures, XSTATE_CONFIGURATION, EnabledSupervisorFeaturestures),
#endif #endif
HEADER("XSTATE_CONTEXT offsets"), HEADER("XSTATE_CONTEXT offsets"),
@ -834,7 +860,7 @@ CONSTANTX(XSAVE_ALIGN, _alignof(XSAVE_AREA)),
HEADER("KTHREAD offsets"), HEADER("KTHREAD offsets"),
#if (NTDDI_VERSION >= NTDDI_VISTA) #if (NTDDI_VERSION >= NTDDI_VISTA)
OFFSET(ThTebMappedLowVa, KTHREAD, TebMappedLowVa), OFFSET(ThTebMappedLowVa, KTHREAD, TebMappedLowVa), // not Win 10
OFFSET(ThUcb, KTHREAD, Ucb), OFFSET(ThUcb, KTHREAD, Ucb),
//OFFSET(ThBase, KTHREAD, Base?), //OFFSET(ThBase, KTHREAD, Base?),
//OFFSET(ThLimit, KTHREAD, Limit?), //OFFSET(ThLimit, KTHREAD, Limit?),
@ -842,8 +868,8 @@ OFFSET(ThUcb, KTHREAD, Ucb),
#if (NTDDI_VERSION >= NTDDI_VISTA) #if (NTDDI_VERSION >= NTDDI_VISTA)
HEADER("KPROCESS offsets"), HEADER("KPROCESS offsets"),
OFFSET(PrLdtSystemDescriptor, KPROCESS, LdtSystemDescriptor), OFFSET(PrLdtSystemDescriptor, KPROCESS, LdtSystemDescriptor), // not Win 10
OFFSET(PrLdtBaseAddress, KPROCESS, LdtBaseAddress), OFFSET(PrLdtBaseAddress, KPROCESS, LdtBaseAddress), // not Win 10
#endif #endif
@ -996,6 +1022,7 @@ OFFSET(KTRAP_FRAME_Rdi, KTRAP_FRAME, Rdi),
OFFSET(KTRAP_FRAME_Rsi, KTRAP_FRAME, Rsi), OFFSET(KTRAP_FRAME_Rsi, KTRAP_FRAME, Rsi),
OFFSET(KTRAP_FRAME_Rbp, KTRAP_FRAME, Rbp), OFFSET(KTRAP_FRAME_Rbp, KTRAP_FRAME, Rbp),
OFFSET(KTRAP_FRAME_ErrorCode, KTRAP_FRAME, ErrorCode), OFFSET(KTRAP_FRAME_ErrorCode, KTRAP_FRAME, ErrorCode),
OFFSET(KTRAP_FRAME_ExceptionFrame, KTRAP_FRAME, ExceptionFrame),
OFFSET(KTRAP_FRAME_TimeStampKlog, KTRAP_FRAME, TimeStampKlog), OFFSET(KTRAP_FRAME_TimeStampKlog, KTRAP_FRAME, TimeStampKlog),
OFFSET(KTRAP_FRAME_Rip, KTRAP_FRAME, Rip), OFFSET(KTRAP_FRAME_Rip, KTRAP_FRAME, Rip),
OFFSET(KTRAP_FRAME_SegCs, KTRAP_FRAME, SegCs), OFFSET(KTRAP_FRAME_SegCs, KTRAP_FRAME, SegCs),

View file

@ -40,6 +40,8 @@ CONSTANT(ATTEMPTED_SWITCH_FROM_DPC), // 0xb8
CONSTANT(KERNEL_SECURITY_CHECK_FAILURE), // 0x139 CONSTANT(KERNEL_SECURITY_CHECK_FAILURE), // 0x139
//CONSTANT(UNSUPPORTED_INSTRUCTION_MODE), // 0x151 //CONSTANT(UNSUPPORTED_INSTRUCTION_MODE), // 0x151
//CONSTANT(BUGCHECK_CONTEXT_MODIFIER), // 0x80000000 //CONSTANT(BUGCHECK_CONTEXT_MODIFIER), // 0x80000000
//CONSTANT(INVALID_CALLBACK_STACK_ADDRESS),
//CONSTANT(INVALID_KERNEL_STACK_ADDRESS),
HEADER("Breakpoints"), HEADER("Breakpoints"),
CONSTANT(BREAKPOINT_BREAK), CONSTANT(BREAKPOINT_BREAK),
@ -89,6 +91,11 @@ CONSTANT(FAST_FAIL_GUARD_ICALL_CHECK_FAILURE),
CONSTANT(FAST_FAIL_INVALID_JUMP_BUFFER), CONSTANT(FAST_FAIL_INVALID_JUMP_BUFFER),
CONSTANT(FAST_FAIL_INVALID_SET_OF_CONTEXT), CONSTANT(FAST_FAIL_INVALID_SET_OF_CONTEXT),
#endif // _M_ASM64 #endif // _M_ASM64
//CONSTANT(FAST_FAIL_INVALID_NEXT_THREAD),
//CONSTANT(FAST_FAIL_INVALID_CONTROL_STACK),
//CONSTANT(FAST_FAIL_SET_CONTEXT_DENIED),
//CONSTANT(FAST_FAIL_ENCLAVE_CALL_FAILURE),
//CONSTANT(FAST_FAIL_GUARD_SS_FAILURE),
HEADER("Interrupt object types"), HEADER("Interrupt object types"),
CONSTANTX(InLevelSensitive, LevelSensitive), CONSTANTX(InLevelSensitive, LevelSensitive),
@ -154,9 +161,8 @@ CONSTANT(LockQueueDispatcherLock), /// FIXE: obsolete
//CONSTANT(PERF_IPI_OFFSET), // 00008H //CONSTANT(PERF_IPI_OFFSET), // 00008H
//CONSTANT(PERF_IPI_FLAG), // 0400000H //CONSTANT(PERF_IPI_FLAG), // 0400000H
//CONSTANT(PERF_IPI), // 040400000H //CONSTANT(PERF_IPI), // 040400000H
//CONSTANT(PERF_INTERRUPT), // 020004000H
#endif #endif
//CONSTANT(NTOS_YIELD_MACRO), //CONSTANT(PERF_INTERRUPT), // 020004000H//CONSTANT(NTOS_YIELD_MACRO),
HEADER("Process states"), HEADER("Process states"),
CONSTANT(ProcessInMemory), CONSTANT(ProcessInMemory),
@ -223,6 +229,7 @@ CONSTANT(STATUS_UNWIND_CONSOLIDATE),
CONSTANT(STATUS_USER_APC), CONSTANT(STATUS_USER_APC),
CONSTANT(STATUS_WAKE_SYSTEM), CONSTANT(STATUS_WAKE_SYSTEM),
CONSTANT(STATUS_WAKE_SYSTEM_DEBUGGER), CONSTANT(STATUS_WAKE_SYSTEM_DEBUGGER),
//CONSTANT(STATUS_SET_CONTEXT_DENIED),
//HEADER("Thread flags"), //HEADER("Thread flags"),
//CONSTANT(THREAD_FLAGS_CYCLE_PROFILING), //CONSTANT(THREAD_FLAGS_CYCLE_PROFILING),
@ -272,7 +279,7 @@ CONSTANT(WaitAll),
HEADER("Stack sizes"), HEADER("Stack sizes"),
CONSTANT(KERNEL_STACK_SIZE), /// FIXME: Obsolete CONSTANT(KERNEL_STACK_SIZE), /// FIXME: Obsolete
CONSTANT(KERNEL_LARGE_STACK_SIZE), CONSTANT(KERNEL_LARGE_STACK_SIZE),
CONSTANT(KERNEL_LARGE_STACK_COMMIT), /// FIXME: Obsolete CONSTANT(KERNEL_LARGE_STACK_COMMIT),
//CONSTANT(DOUBLE_FAULT_STACK_SIZE), //CONSTANT(DOUBLE_FAULT_STACK_SIZE),
#ifdef _M_AMD64 #ifdef _M_AMD64
CONSTANT(KERNEL_MCA_EXCEPTION_STACK_SIZE), CONSTANT(KERNEL_MCA_EXCEPTION_STACK_SIZE),
@ -284,6 +291,8 @@ CONSTANT(ISR_STACK_SIZE),
//CONSTANT(KTHREAD_GUI_THREAD_MASK), //CONSTANT(KTHREAD_GUI_THREAD_MASK),
//CONSTANT(KTHREAD_SYSTEM_THREAD_BIT), //CONSTANT(KTHREAD_SYSTEM_THREAD_BIT),
//CONSTANT(KTHREAD_QUEUE_DEFER_PREEMPTION_BIT), //CONSTANT(KTHREAD_QUEUE_DEFER_PREEMPTION_BIT),
//CONSTANT(KTHREAD_RESTRICTED_GUI_THREAD_MASK),
//CONSTANT(KTHREAD_BAM_QOS_LEVEL_MASK),
HEADER("Miscellaneous Definitions"), HEADER("Miscellaneous Definitions"),
CONSTANT(TRUE), CONSTANT(TRUE),
@ -309,6 +318,8 @@ CONSTANT(INITIAL_STALL_COUNT),
//CONSTANT(KI_EXCEPTION_INVALID_OP), // not i386 //CONSTANT(KI_EXCEPTION_INVALID_OP), // not i386
//CONSTANT(KI_EXCEPTION_INTEGER_DIVIDE_BY_ZERO), // amd64 //CONSTANT(KI_EXCEPTION_INTEGER_DIVIDE_BY_ZERO), // amd64
CONSTANT(KI_EXCEPTION_ACCESS_VIOLATION), CONSTANT(KI_EXCEPTION_ACCESS_VIOLATION),
//CONSTANT(KI_EXCEPTION_SECURE_FAULT),
//CONSTANT(KI_EXCEPTION_SEGMENT_NOT_PRESENT),
//CONSTANT(KINTERRUPT_STATE_DISABLED_BIT), //CONSTANT(KINTERRUPT_STATE_DISABLED_BIT),
//CONSTANT(KINTERRUPT_STATE_DISABLED), //CONSTANT(KINTERRUPT_STATE_DISABLED),
//CONSTANT(TARGET_FREEZE), // amd64 //CONSTANT(TARGET_FREEZE), // amd64
@ -318,7 +329,6 @@ CONSTANT(DBG_STATUS_CONTROL_C),
//CONSTANT(MM_SHARED_USER_DATA_VA), //CONSTANT(MM_SHARED_USER_DATA_VA),
//CONSTANT(KERNEL_STACK_CONTROL_LARGE_STACK), // FIXME: obsolete //CONSTANT(KERNEL_STACK_CONTROL_LARGE_STACK), // FIXME: obsolete
//CONSTANT(DISPATCH_LENGTH), // FIXME: obsolete //CONSTANT(DISPATCH_LENGTH), // FIXME: obsolete
//CONSTANT(MAXIMUM_PRIMARY_VECTOR), // not arm
//CONSTANT(KI_SLIST_FAULT_COUNT_MAXIMUM), // i386 //CONSTANT(KI_SLIST_FAULT_COUNT_MAXIMUM), // i386
//CONSTANTUSER_CALLBACK_FILTER), //CONSTANTUSER_CALLBACK_FILTER),
@ -338,6 +348,7 @@ CONSTANT(MODE_MASK),
//HEADER("KAFFINITY_EX"), //HEADER("KAFFINITY_EX"),
//OFFSET(AfCount, KAFFINITY_EX, Count), //OFFSET(AfCount, KAFFINITY_EX, Count),
//OFFSET(AfBitmap, KAFFINITY_EX, Bitmap), //OFFSET(AfBitmap, KAFFINITY_EX, Bitmap),
//SIZE(AffinityExLength, KAFFINITY_EX),
//HEADER("Aligned Affinity"), //HEADER("Aligned Affinity"),
//OFFSET(AfsCpuSet, ???, CpuSet), // FIXME: obsolete //OFFSET(AfsCpuSet, ???, CpuSet), // FIXME: obsolete
@ -376,7 +387,7 @@ HEADER("CLIENT_ID"),
OFFSET(CidUniqueProcess, CLIENT_ID, UniqueProcess), OFFSET(CidUniqueProcess, CLIENT_ID, UniqueProcess),
OFFSET(CidUniqueThread, CLIENT_ID, UniqueThread), OFFSET(CidUniqueThread, CLIENT_ID, UniqueThread),
HEADER("RTL_CRITICAL_SECTION"), HEADER("RTL_CRITICAL_SECTION"), // No longer in Win 10 amd64
OFFSET(CsDebugInfo, RTL_CRITICAL_SECTION, DebugInfo), OFFSET(CsDebugInfo, RTL_CRITICAL_SECTION, DebugInfo),
OFFSET(CsLockCount, RTL_CRITICAL_SECTION, LockCount), OFFSET(CsLockCount, RTL_CRITICAL_SECTION, LockCount),
OFFSET(CsRecursionCount, RTL_CRITICAL_SECTION, RecursionCount), OFFSET(CsRecursionCount, RTL_CRITICAL_SECTION, RecursionCount),
@ -384,7 +395,7 @@ OFFSET(CsOwningThread, RTL_CRITICAL_SECTION, OwningThread),
OFFSET(CsLockSemaphore, RTL_CRITICAL_SECTION, LockSemaphore), OFFSET(CsLockSemaphore, RTL_CRITICAL_SECTION, LockSemaphore),
OFFSET(CsSpinCount, RTL_CRITICAL_SECTION, SpinCount), OFFSET(CsSpinCount, RTL_CRITICAL_SECTION, SpinCount),
HEADER("RTL_CRITICAL_SECTION_DEBUG"), HEADER("RTL_CRITICAL_SECTION_DEBUG"), // No longer in Win 10 amd64
OFFSET(CsType, RTL_CRITICAL_SECTION_DEBUG, Type), OFFSET(CsType, RTL_CRITICAL_SECTION_DEBUG, Type),
OFFSET(CsCreatorBackTraceIndex, RTL_CRITICAL_SECTION_DEBUG, CreatorBackTraceIndex), OFFSET(CsCreatorBackTraceIndex, RTL_CRITICAL_SECTION_DEBUG, CreatorBackTraceIndex),
OFFSET(CsCriticalSection, RTL_CRITICAL_SECTION_DEBUG, CriticalSection), OFFSET(CsCriticalSection, RTL_CRITICAL_SECTION_DEBUG, CriticalSection),
@ -439,6 +450,7 @@ SIZE(ExecutiveProcessObjectLength, EPROCESS),
HEADER("ETHREAD offsets"), HEADER("ETHREAD offsets"),
OFFSET(EtCid, ETHREAD, Cid), // 0x364 OFFSET(EtCid, ETHREAD, Cid), // 0x364
//OFFSET(EtPicoContext, ETHREAD, PicoContext),
SIZE(ExecutiveThreadObjectLength, ETHREAD), // 0x418 SIZE(ExecutiveThreadObjectLength, ETHREAD), // 0x418
HEADER("KEVENT"), HEADER("KEVENT"),
@ -520,7 +532,7 @@ OFFSET(KcExceptionList, KSTACK_CONTROL, PreviousExceptionList),
SIZE(KSTACK_CONTROL_LENGTH, KSTACK_CONTROL), SIZE(KSTACK_CONTROL_LENGTH, KSTACK_CONTROL),
CONSTANT(KSTACK_ACTUAL_LIMIT_EXPANDED), // move somewhere else? CONSTANT(KSTACK_ACTUAL_LIMIT_EXPANDED), // move somewhere else?
#else #else
//HEADER("KERNEL_STACK_CONTROL"), //HEADER("KERNEL_STACK_CONTROL"), // obsolete
#endif #endif
#if 0 // no longer in win 10, different struct #if 0 // no longer in win 10, different struct
@ -629,7 +641,6 @@ OFFSET(PrUserTime, KPROCESS, UserTime),
OFFSET(PrVdmTrapcHandler, KPROCESS, VdmTrapcHandler), OFFSET(PrVdmTrapcHandler, KPROCESS, VdmTrapcHandler),
//OFFSET(PrVdmObjects, KPROCESS, VdmObjects), //OFFSET(PrVdmObjects, KPROCESS, VdmObjects),
OFFSET(PrFlags, KPROCESS, Flags), OFFSET(PrFlags, KPROCESS, Flags),
//PrInstrumentationCallback equ 0031CH // ???
#endif #endif
SIZE(KernelProcessObjectLength, KPROCESS), SIZE(KernelProcessObjectLength, KPROCESS),
@ -750,12 +761,13 @@ OFFSET(ThSystemCallNumber, KTHREAD, SystemCallNumber),
//OFFSET(ThFirstArgument, KTHREAD, FirstArgument), //OFFSET(ThFirstArgument, KTHREAD, FirstArgument),
OFFSET(ThTrapFrame, KTHREAD, TrapFrame), OFFSET(ThTrapFrame, KTHREAD, TrapFrame),
OFFSET(ThApcState, KTHREAD, ApcState), OFFSET(ThApcState, KTHREAD, ApcState),
OFFSET(ThPriority, KTHREAD, Priority), OFFSET(ThPriority, KTHREAD, Priority), // obsolete
OFFSET(ThContextSwitches, KTHREAD, ContextSwitches), OFFSET(ThContextSwitches, KTHREAD, ContextSwitches),
OFFSET(ThState, KTHREAD, State), OFFSET(ThState, KTHREAD, State),
OFFSET(ThProcess, KTHREAD, Process), // thProcess in native headers
OFFSET(ThNpxState, KTHREAD, NpxState), OFFSET(ThNpxState, KTHREAD, NpxState),
OFFSET(ThWaitIrql, KTHREAD, WaitIrql), OFFSET(ThWaitIrql, KTHREAD, WaitIrql),
OFFSET(ThWaitMode, KTHREAD, WaitMode), OFFSET(ThWaitMode, KTHREAD, WaitMode), // obsolete
OFFSET(ThTeb, KTHREAD, Teb), OFFSET(ThTeb, KTHREAD, Teb),
OFFSET(ThTimer, KTHREAD, Timer), OFFSET(ThTimer, KTHREAD, Timer),
OFFSET(ThWin32Thread, KTHREAD, Win32Thread), OFFSET(ThWin32Thread, KTHREAD, Win32Thread),
@ -769,31 +781,34 @@ OFFSET(ThSpecialApcDisable, KTHREAD, SpecialApcDisable),
OFFSET(ThNextProcessor, KTHREAD, NextProcessor), OFFSET(ThNextProcessor, KTHREAD, NextProcessor),
OFFSET(ThProcess, KTHREAD, Process), OFFSET(ThProcess, KTHREAD, Process),
OFFSET(ThPreviousMode, KTHREAD, PreviousMode), OFFSET(ThPreviousMode, KTHREAD, PreviousMode),
OFFSET(ThPriorityDecrement, KTHREAD, PriorityDecrement), OFFSET(ThPriorityDecrement, KTHREAD, PriorityDecrement), // obsolete
OFFSET(ThAdjustReason, KTHREAD, AdjustReason), OFFSET(ThAdjustReason, KTHREAD, AdjustReason),
OFFSET(ThAdjustIncrement, KTHREAD, AdjustIncrement), OFFSET(ThAdjustIncrement, KTHREAD, AdjustIncrement),
OFFSET(ThAffinity, KTHREAD, Affinity), OFFSET(ThAffinity, KTHREAD, Affinity), // obsolete
OFFSET(ThApcStateIndex, KTHREAD, ApcStateIndex), OFFSET(ThApcStateIndex, KTHREAD, ApcStateIndex),
OFFSET(ThIdealProcessor, KTHREAD, IdealProcessor), OFFSET(ThIdealProcessor, KTHREAD, IdealProcessor), // obsolete
OFFSET(ThApcStatePointer, KTHREAD, ApcStatePointer), OFFSET(ThApcStatePointer, KTHREAD, ApcStatePointer), // obsolete
OFFSET(ThSavedApcState, KTHREAD, SavedApcState), OFFSET(ThSavedApcState, KTHREAD, SavedApcState), // obsolete
OFFSET(ThWaitReason, KTHREAD, WaitReason), OFFSET(ThWaitReason, KTHREAD, WaitReason),
OFFSET(ThSaturation, KTHREAD, Saturation), OFFSET(ThSaturation, KTHREAD, Saturation), // obsolete
OFFSET(ThLegoData, KTHREAD, LegoData), OFFSET(ThLegoData, KTHREAD, LegoData),
//#if defined(_M_ARM) && (NTDDI_VERSION >= NTDDI_WIN10) //#if defined(_M_ARM) && (NTDDI_VERSION >= NTDDI_WIN10)
//#define ThUserRoBase 0x434 //OFFSET(ThUserRoBase, KTHREAD, UserRoBase),
//#define ThUserRwBase 0x438 //OFFSET(ThUserRwBase, KTHREAD, UserRwBase),
//#endif //#endif
#ifdef _M_IX86 #ifdef _M_IX86
OFFSET(ThSListFaultCount, KTHREAD, WaitReason), // 0x18E //OFFSET(ThSListFaultCount, KTHREAD, SListFaultCount), // 0x18E
OFFSET(ThSListFaultAddress, KTHREAD, WaitReason), // 0x10 //OFFSET(ThSListFaultAddress, KTHREAD, ListFaultAddress), // 0x10
#endif // _M_IX86 #endif // _M_IX86
#if defined(_M_IX86) || defined(_M_AMD64) #if defined(_M_IX86) || defined(_M_AMD64)
OFFSET(ThUserFsBase, KTHREAD, WaitReason), // 0x434 //OFFSET(ThUserFsBase, KTHREAD, UserFsBase), // 0x434
OFFSET(ThUserGsBase, KTHREAD, WaitReason), // 0x438 //OFFSET(ThUserGsBase, KTHREAD, GsBase), // 0x438
#endif // defined #endif // defined
SIZE(KernelThreadObjectLength, KTHREAD), SIZE(KernelThreadObjectLength, KTHREAD),
HEADER("ETHREAD"),
//OFFSET(ThSetContextState, ETHREAD, SetContextState),
HEADER("KTIMER"), HEADER("KTIMER"),
OFFSET(TiType, KTIMER, Header.Type), OFFSET(TiType, KTIMER, Header.Type),
OFFSET(TiSize, KTIMER, Header.Size), OFFSET(TiSize, KTIMER, Header.Size),
@ -876,42 +891,71 @@ OFFSET(WbNextWaitBlock, KWAIT_BLOCK, NextWaitBlock), // not in win10
OFFSET(WbWaitKey, KWAIT_BLOCK, WaitKey), OFFSET(WbWaitKey, KWAIT_BLOCK, WaitKey),
OFFSET(WbWaitType, KWAIT_BLOCK, WaitType), OFFSET(WbWaitType, KWAIT_BLOCK, WaitType),
#ifdef _M_AMD64
SIZE(KSTART_FRAME_LENGTH, KSTART_FRAME),
#endif
#if 0 #if 0
//OFFSET(IbCfgBitMap, ????, CfgBitMap),
CONSTANT(Win32BatchFlushCallout 0x7
CONSTANT(CFlushSize),
CONSTANT(Win32BatchFlushCallout),
CONSTANT(ServiceCpupReturnFromSimulatedCode),
CONSTANT(X86AMD64_R3_LONG_MODE_CODE),
CONSTANT(USER_CALLBACK_FILTER),
CONSTANT(SYSTEM_CALL_INT_2E),
#define CmThreadEnvironmentBlockOffset 0x1000 HEADER("Process mitigation option flags"),
CONSTANT(PS_MITIGATION_OPTION_BITS_PER_OPTION),
; Process Parameters Block Structure Offset Definitions CONSTANT(PS_MITIGATION_OPTION_ALWAYS_ON),
#define PpFlags 0x8 CONSTANT(PS_MITIGATION_OPTION_ALWAYS_OFF),
CONSTANT(PS_MITIGATION_OPTION_MASK),
CONSTANT(PS_MITIGATION_OPTION_RETURN_FLOW_GUARD),
// Extended context structure offset definitions CONSTANT(PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT),
#define CxxLegacyOffset 0x8
#define CxxLegacyLength 0xc
#define CxxXStateOffset 0x10
#define CxxXStateLength 0x14
#ifndef _M_ARM #ifndef _M_ARM
; Bounds Callback Status Code Definitions HEADER("Bounds Callback Status Codes"),
BoundExceptionContinueSearch equ 00000H CONSTANT(BoundExceptionContinueSearch),
BoundExceptionHandled equ 00001H CONSTANT(BoundExceptionHandled),
BoundExceptionError equ 00002H CONSTANT(BoundExceptionError),
#endif #endif
HEADER("PS_SYSTEM_DLL_INIT_BLOCK"),
OFFSET(IbCfgBitMap, PS_SYSTEM_DLL_INIT_BLOCK, CfgBitMap),
OFFSET(IbWow64CfgBitMap, PS_SYSTEM_DLL_INIT_BLOCK, Wow64CfgBitMap),
OFFSET(IbMitigationOptionsMap, PS_SYSTEM_DLL_INIT_BLOCK, MitigationOptionsMap),
HEADER("Extended context"),
OFFSET(CxxLegacyOffset 0x8
OFFSET(CxxLegacyLength 0xc
OFFSET(CxxXStateOffset 0x10
OFFSET(CxxXStateLength 0x14
HEADER("Enclave call dispatch frame"),
OFFSET(EcEnclaveNumber, ???, EnclaveNumber),
OFFSET(EcParameterAddress, ???, ParameterAddress),
OFFSET(EcParameterValue, ???, ParameterValue),
OFFSET(EcOriginalReturn, ???, OriginalReturn),
OFFSET(EcFramePointer, ???, FramePointer),
OFFSET(EcReturnAddress, ???, ReturnAddress),
#ifndef _M_ARM #ifndef _M_ARM
; Enlightenment structure definitions HEADER("Enlightenment"),
HeEnlightenments equ 00000H OFFSET(HeEnlightenments, ???, Enlightenments),
HeHypervisorConnected equ 00004H OFFSET(HeHypervisorConnected, ???, HypervisorConnected),
HeEndOfInterrupt equ 00008H OFFSET(HeEndOfInterrupt, ???, EndOfInterrupt),
HeApicWriteIcr equ 0000CH OFFSET(HeApicWriteIcr, ???, ApicWriteIcr),
HeSpinCountMask equ 00014H OFFSET(HeSpinCountMask, ???, SpinCountMask),
HeLongSpinWait equ 00018H OFFSET(HeLongSpinWait, ???, LongSpinWait),
#endif #endif
// KAFFINITY_EX HEADER("Processor Descriptor Area"),
#define AffinityExLength 0xc // not i386 OFFSET(PdaGdt, ????, ),
OFFSET(PdaKernelGsBase, ????, ),
OFFSET(PpFlags, ????, Flags),
OFFSET(EtwTSLength, ????, ),
OFFSET(CmThreadEnvironmentBlockOffset, ????, ),
OFFSET(PbEntropyCount, ????, ),
OFFSET(PbEntropyBuffer, ????, ),
#endif #endif

View file

@ -0,0 +1,82 @@
;++
; PROJECT: ReactOS SDK
; LICENSE: GPL-2.0+ (https://spdx.org/licenses/GPL-2.0+)
; PURPOSE: ReactOS AMD64 architecture asm macros
; COPYRIGHT: Timo Kreuzer (timo.kreuzer@reactos.org)
;--
#include <macamd64.inc>
MACRO(GENERATE_EXCEPTION_FRAME)
; Allocate a KEXCEPTION_FRAME on the stack
; -8 because the last field is the return address
sub rsp, KEXCEPTION_FRAME_LENGTH - 8
.allocstack KEXCEPTION_FRAME_LENGTH - 8
; Save non-volatiles in KEXCEPTION_FRAME
mov [rsp + ExRbp], rbp
.savereg rbp, ExRbp
mov [rsp + ExRbx], rbx
.savereg rbx, ExRbx
mov [rsp +ExRdi], rdi
.savereg rdi, ExRdi
mov [rsp + ExRsi], rsi
.savereg rsi, ExRsi
mov [rsp + ExR12], r12
.savereg r12, ExR12
mov [rsp + ExR13], r13
.savereg r13, ExR13
mov [rsp + ExR14], r14
.savereg r14, ExR14
mov [rsp + ExR15], r15
.savereg r15, ExR15
movaps [rsp + ExXmm6], xmm6
.savexmm128 xmm6, ExXmm6
movaps [rsp + ExXmm7], xmm7
.savexmm128 xmm7, ExXmm7
movaps [rsp + ExXmm8], xmm8
.savexmm128 xmm8, ExXmm8
movaps [rsp + ExXmm9], xmm9
.savexmm128 xmm9, ExXmm9
movaps [rsp + ExXmm10], xmm10
.savexmm128 xmm10, ExXmm10
movaps [rsp + ExXmm11], xmm11
.savexmm128 xmm11, ExXmm11
movaps [rsp + ExXmm12], xmm12
.savexmm128 xmm12, ExXmm12
movaps [rsp + ExXmm13], xmm13
.savexmm128 xmm13, ExXmm13
movaps [rsp + ExXmm14], xmm14
.savexmm128 xmm14, ExXmm14
movaps [rsp + ExXmm15], xmm15
.savexmm128 xmm15, ExXmm15
.endprolog
ENDM
MACRO(RESTORE_EXCEPTION_STATE)
; Restore non-volatile registers
mov rbp, [rsp + ExRbp]
mov rbx, [rsp + ExRbx]
mov rdi, [rsp + ExRdi]
mov rsi, [rsp + ExRsi]
mov r12, [rsp + ExR12]
mov r13, [rsp + ExR13]
mov r14, [rsp + ExR14]
mov r15, [rsp + ExR15]
movaps xmm6, [rsp + ExXmm6]
movaps xmm7, [rsp + ExXmm7]
movaps xmm8, [rsp + ExXmm8]
movaps xmm9, [rsp + ExXmm9]
movaps xmm10, [rsp + ExXmm10]
movaps xmm11, [rsp + ExXmm11]
movaps xmm12, [rsp + ExXmm12]
movaps xmm13, [rsp + ExXmm13]
movaps xmm14, [rsp + ExXmm14]
movaps xmm15, [rsp + ExXmm15]
; Clean stack and return
add rsp, KEXCEPTION_FRAME_LENGTH - 8
ENDM

View file

@ -0,0 +1,159 @@
;++
; PROJECT: ReactOS SDK
; LICENSE: GPL-2.0+ (https://spdx.org/licenses/GPL-2.0+)
; PURPOSE: ReactOS AMD64 architecture asm macros
; COPYRIGHT: Timo Kreuzer (timo.kreuzer@reactos.org)
;--
#include <asm.inc>
MACRO(push_reg, Reg)
push Reg
.pushreg Reg
ENDM
MACRO(rex_push_reg, Reg)
db HEX(048) ; REX prefix
push Reg
.pushreg Reg
ENDM
MACRO(push_eflags)
pushfq
.allocstack 8
ENDM
MACRO(rex_push_eflags)
db HEX(048) ; REX prefix
pushfq
.allocstack 8
ENDM
MACRO(rex_jmp_reg, Reg)
db HEX(048) ; REX prefix / hint tail call to unwinder
jmp Reg
ENDM
MACRO(ret_zero)
ret
ENDM
MACRO(alloc_stack, Size)
sub rsp, Size
.allocstack Size
ENDM
MACRO(save_reg, Reg, Offset)
mov [rsp + Offset], Reg
.savereg Reg, Offset
ENDM
MACRO(save_xmm128, Reg, Offset)
movaps [rsp + Offset], Reg
.savexmm128 Reg, Offset
ENDM
MACRO(push_frame, Code)
.pushframe Code
ENDM
MACRO(set_frame, Reg, Offset)
if Offset
lea Reg, [rsp + Offset]
else
mov Reg, rsp
endif
.setframe Reg, Offset
ENDM
MACRO(END_PROLOGUE)
.endprolog
ENDM
MACRO(BEGIN_EPILOGUE)
.beginepilog
ENDM
MACRO(LEAF_ENTRY, Name, Section, NoPad)
Section segment para 'CODE'
ifb <NoPad>
db 6 dup HEX(CC)
endif
align 16
public Name
Name proc frame
END_PROLOGUE
ENDM
MACRO(LEAF_ENTRY_ARG1, Name, Section, Arg1, NoPad)
Section segment para 'CODE'
ifb <NoPad>
db 6 dup HEX(CC)
endif
align 16
public Name
Name proc frame
END_PROLOGUE
ENDM
MACRO(LEAF_ENTRY_ARG2, Name, Section, Arg1, Arg2, NoPad)
Section segment para 'CODE'
ifb <NoPad>
db 6 dup HEX(CC)
endif
align 16
public Name
Name proc frame
END_PROLOGUE
ENDM
MACRO(LEAF_ENTRY_ARG3, Name, Section, Arg1, Arg2, Arg3, NoPad)
Section segment para 'CODE'
ifb <NoPad>
db 6 dup HEX(CC)
endif
align 16
public Name
Name proc frame
END_PROLOGUE
ENDM
MACRO(LEAF_END, Name, section)
Name endp
Section ends
ENDM
MACRO(NESTED_ENTR, Name, Section, Handler, NoPad)
ifdef _CurrentSection_
ifdif <Section>, _CurrentSection_
.err <NESTED_ENTRY invoked for different sections within same module>
endif
endif
_CurrentSection_ EQU <Section>
Section segment para 'CODE'
ifb <NoPad>
db 6 dup (0cch)
endif
align 16
public Name
ifb <Handler>
Name proc frame
else
Name proc frame:Handler
endif
ENDM
MACRO(NESTED_END, Name, section)
Name endp
Section ends
ENDM
MACRO(ALTERNATE_ENTRY, Name)
Name:
ENDM
MACRO(Yield)
pause
ENDM
; EOF