Add a few definitions based on (Windows RT 8.1) symbol files, ks386.inc, ksamd64.inc, ksarm.inc and Windows 10 WDK (ntosp.h ftw!)

svn path=/trunk/; revision=67525
This commit is contained in:
Timo Kreuzer 2015-05-02 23:12:19 +00:00
parent 5b7d2dec59
commit e8cff2f3a5
9 changed files with 1069 additions and 323 deletions

View file

@ -34,12 +34,6 @@ Author:
#define KernelMode HEX(0) #define KernelMode HEX(0)
#define UserMode HEX(1) #define UserMode HEX(1)
//
// CPU Types
//
#define CPU_INTEL HEX(1)
#define CPU_AMD HEX(2)
// //
// KTSS Offsets // KTSS Offsets
// //

View file

@ -35,6 +35,17 @@ Author:
//#define KeGetPcr() ((volatile KPCR * const)__readfsdword(0x1C)) //#define KeGetPcr() ((volatile KPCR * const)__readfsdword(0x1C))
//#endif //#endif
//
// CPU Vendors
//
typedef enum
{
CPU_UNKNOWN,
CPU_AMD,
CPU_INTEL,
CPU_VIA
} CPU_VENDORS;
// //
// Machine Types // Machine Types
// //
@ -65,7 +76,7 @@ Author:
#define KGDT64_R3_CODE 0x0030 #define KGDT64_R3_CODE 0x0030
#define KGDT64_SYS_TSS 0x0040 #define KGDT64_SYS_TSS 0x0040
#define KGDT64_R3_CMTEB 0x0050 #define KGDT64_R3_CMTEB 0x0050
#define KGDT64_R0_LDT 0x0060
// //
// CR4 // CR4
@ -81,6 +92,30 @@ Author:
#define CR4_FXSR 0x200 #define CR4_FXSR 0x200
#define CR4_XMMEXCPT 0x400 #define CR4_XMMEXCPT 0x400
#define CR4_CHANNELS 0x800 #define CR4_CHANNELS 0x800
#define CR4_XSAVE 0x40000
//
// DR7
//
#define DR7_LEGAL 0xFFFF0355
#define DR7_ACTIVE 0x00000355
#define DR7_TRACE_BRANCH 0x00000200
#define DR7_LAST_BRANCH 0x00000100
//
// Debug flags
//
#define DEBUG_ACTIVE_DR7 0x0001
#define DEBUG_ACTIVE_INSTRUMENTED 0x0002
#define DEBUG_ACTIVE_DBG_INSTRUMENTED 0x0003
#define DEBUG_ACTIVE_MINIMAL_THREAD 0x0004
#define DEBUG_ACTIVE_PRIMARY_THREAD 0x0080
#define DEBUG_ACTIVE_PRIMARY_THREAD_BIT 0x0007
#define DEBUG_ACTIVE_PRIMARY_THREAD_LOCK_BIT 0x001F
#define DEBUG_ACTIVE_SCHEDULED_THREAD 0x0040
#define DEBUG_ACTIVE_SCHEDULED_THREAD_BIT 0x0006
#define DEBUG_ACTIVE_SCHEDULED_THREAD_LOCK_BIT 0x001E
#define DEBUG_ACTIVE_SCHEDULED_THREAD_LOCK 0x40000000
// //
// EFlags // EFlags
@ -104,17 +139,46 @@ Author:
#define EFLAGS_IF_MASK 0x0200 #define EFLAGS_IF_MASK 0x0200
#define EFLAGS_IF_SHIFT 0x0009 #define EFLAGS_IF_SHIFT 0x0009
//
// MXCSR Floating Control/Status Bit Masks
//
#define XSW_INVALID_OPERATION 0x0001
#define XSW_DENORMAL 0x0002
#define XSW_ZERO_DIVIDE 0x0004
#define XSW_OVERFLOW 0x0008
#define XSW_UNDERFLOW 0x0010
#define XSW_PRECISION 0x0020
#define XCW_INVALID_OPERATION 0x0080
#define XCW_DENORMAL 0x0100
#define XCW_ZERO_DIVIDE 0x0200
#define XCW_OVERFLOW 0x0400
#define XCW_UNDERFLOW 0x0800
#define XCW_PRECISION 0x1000
#define XCW_ROUND_CONTROL 0x6000
#define XCW_FLUSH_ZERO 0x8000
#define XSW_ERROR_MASK 0x003F
#define XSW_ERROR_SHIFT 7
//
// Legacy floating status word bit masks.
//
#define FSW_INVALID_OPERATION 0x0001
#define FSW_DENORMAL 0x0002
#define FSW_ZERO_DIVIDE 0x0004
#define FSW_OVERFLOW 0x0008
#define FSW_UNDERFLOW 0x0010
#define FSW_PRECISION 0x0020
#define FSW_STACK_FAULT 0x0040
#define FSW_ERROR_SUMMARY 0x0080
#define FSW_CONDITION_CODE_0 0x0100
#define FSW_CONDITION_CODE_1 0x0200
#define FSW_CONDITION_CODE_2 0x0400
#define FSW_CONDITION_CODE_3 0x4000
#define FSW_ERROR_MASK 0x003F
// //
// Machine Specific Registers // Machine Specific Registers
// //
#define MSR_MCG_STATUS 0x017A
#define MSR_DEGUG_CTL 0x01D9
#define MSR_LAST_BRANCH_FROM 0x01DB
#define MSR_LAST_BRANCH_TO 0x01DC
#define MSR_LAST_EXCEPTION_FROM 0x01DD
#define MSR_LAST_EXCEPTION_TO 0x01DE
#define MSR_PAT 0x0277
#define MSR_AMD_ACCESS 0x9C5A203A
#define MSR_EFER 0xC0000080 #define MSR_EFER 0xC0000080
#define MSR_STAR 0xC0000081 #define MSR_STAR 0xC0000081
#define MSR_LSTAR 0xC0000082 #define MSR_LSTAR 0xC0000082
@ -123,6 +187,13 @@ Author:
#define MSR_FS_BASE 0xC0000100 #define MSR_FS_BASE 0xC0000100
#define MSR_GS_BASE 0xC0000101 #define MSR_GS_BASE 0xC0000101
#define MSR_GS_SWAP 0xC0000102 #define MSR_GS_SWAP 0xC0000102
#define MSR_MCG_STATUS 0x017A
#define MSR_AMD_ACCESS 0x9C5A203A
#define MSR_IA32_MISC_ENABLE 0x01A0
#define MSR_LAST_BRANCH_FROM 0x01DB
#define MSR_LAST_BRANCH_TO 0x01DC
#define MSR_LAST_EXCEPTION_FROM 0x01DD
#define MSR_LAST_EXCEPTION_TO 0x01DE
// //
// Caching values for the PAT MSR // Caching values for the PAT MSR
@ -137,10 +208,23 @@ Author:
// //
// Flags in MSR_EFER // Flags in MSR_EFER
// //
#define MSR_LMA 0x0400
#define MSR_LME 0x0100
#define MSR_SCE 0x0001 #define MSR_SCE 0x0001
#define MSR_LME 0x0100
#define MSR_LMA 0x0400
#define MSR_NXE 0x0800 #define MSR_NXE 0x0800
#define MSR_PAT 0x0277
#define MSR_DEBUG_CTL 0x01D9
//
// Flags in MSR_IA32_MISC_ENABLE
//
#define MSR_XD_ENABLE_MASK 0xFFFFFFFB
//
// Flags in MSR_DEBUG_CTL
//
#define MSR_DEBUG_CTL_LBR equ 0x0001
#define MSR_DEBUG_CTL_BTF equ 0x0002
// //
// IPI Types // IPI Types
@ -158,6 +242,13 @@ Author:
#define PRCB_BUILD_DEBUG 1 #define PRCB_BUILD_DEBUG 1
#define PRCB_BUILD_UNIPROCESSOR 2 #define PRCB_BUILD_UNIPROCESSOR 2
//
// Exception active flags
//
#define KEXCEPTION_ACTIVE_INTERRUPT_FRAME 0x0000
#define KEXCEPTION_ACTIVE_EXCEPTION_FRAME 0x0001
#define KEXCEPTION_ACTIVE_SERVICE_FRAME 0x0002
// //
// HAL Variables // HAL Variables
// //
@ -188,12 +279,28 @@ Author:
#define SYNCH_LEVEL 12 #define SYNCH_LEVEL 12
#define NMI_STACK_SIZE 0x2000 #define NMI_STACK_SIZE 0x2000
#define ISR_STACK_SIZE 0x6000
// //
// Number of pool lookaside lists per pool in the PRCB // Number of pool lookaside lists per pool in the PRCB
// //
#define NUMBER_POOL_LOOKASIDE_LISTS 32 #define NUMBER_POOL_LOOKASIDE_LISTS 32
//
// Structure for CPUID
//
typedef union _CPU_INFO
{
UINT32 AsUINT32[4];
struct
{
ULONG Eax;
ULONG Ebx;
ULONG Ecx;
ULONG Edx;
};
} CPU_INFO, *PCPU_INFO;
// //
// Trap Frame Definition // Trap Frame Definition
// //
@ -283,23 +390,6 @@ typedef struct _KTRAP_FRAME
LONG CodePatchCycle; LONG CodePatchCycle;
} KTRAP_FRAME, *PKTRAP_FRAME; } KTRAP_FRAME, *PKTRAP_FRAME;
//
// Defines the Callback Stack Layout for User Mode Callbacks
//
typedef struct _KCALLOUT_FRAME
{
ULONG64 InitialStack;
ULONG64 TrapFrame;
ULONG64 CallbackStack;
ULONG64 Rdi;
ULONG64 Rsi;
ULONG64 Rbx;
ULONG64 Rbp;
ULONG64 ReturnAddress;
ULONG64 Result;
ULONG64 ResultLength;
} KCALLOUT_FRAME, *PKCALLOUT_FRAME;
// //
// Dummy LDT_ENTRY // Dummy LDT_ENTRY
// //
@ -404,33 +494,33 @@ typedef struct _KDESCRIPTOR
// //
typedef struct _KSPECIAL_REGISTERS typedef struct _KSPECIAL_REGISTERS
{ {
UINT64 Cr0; ULONG64 Cr0;
UINT64 Cr2; ULONG64 Cr2;
UINT64 Cr3; ULONG64 Cr3;
UINT64 Cr4; ULONG64 Cr4;
UINT64 KernelDr0; ULONG64 KernelDr0;
UINT64 KernelDr1; ULONG64 KernelDr1;
UINT64 KernelDr2; ULONG64 KernelDr2;
UINT64 KernelDr3; ULONG64 KernelDr3;
UINT64 KernelDr6; ULONG64 KernelDr6;
UINT64 KernelDr7; ULONG64 KernelDr7;
struct _KDESCRIPTOR Gdtr; KDESCRIPTOR Gdtr;
struct _KDESCRIPTOR Idtr; KDESCRIPTOR Idtr;
USHORT Tr; USHORT Tr;
USHORT Ldtr; USHORT Ldtr;
ULONG MxCsr; ULONG MxCsr;
UINT64 DebugControl; ULONG64 DebugControl;
UINT64 LastBranchToRip; ULONG64 LastBranchToRip;
UINT64 LastBranchFromRip; ULONG64 LastBranchFromRip;
UINT64 LastExceptionToRip; ULONG64 LastExceptionToRip;
UINT64 LastExceptionFromRip; ULONG64 LastExceptionFromRip;
UINT64 Cr8; ULONG64 Cr8;
UINT64 MsrGsBase; ULONG64 MsrGsBase;
UINT64 MsrGsSwap; ULONG64 MsrGsSwap;
UINT64 MsrStar; ULONG64 MsrStar;
UINT64 MsrLStar; ULONG64 MsrLStar;
UINT64 MsrCStar; ULONG64 MsrCStar;
UINT64 MsrSyscallMask; ULONG64 MsrSyscallMask;
} KSPECIAL_REGISTERS, *PKSPECIAL_REGISTERS; } KSPECIAL_REGISTERS, *PKSPECIAL_REGISTERS;
// //
@ -756,8 +846,7 @@ typedef struct _KPRCB
CACHE_DESCRIPTOR Cache[5]; CACHE_DESCRIPTOR Cache[5];
ULONG CacheCount; ULONG CacheCount;
#endif #endif
} } KPRCB, *PKPRCB;
KPRCB, *PKPRCB;
// //
// Processor Control Region // Processor Control Region
@ -837,12 +926,12 @@ typedef struct _KTSS64
// //
typedef struct _KEXCEPTION_FRAME typedef struct _KEXCEPTION_FRAME
{ {
UINT64 P1Home; ULONG64 P1Home;
UINT64 P2Home; ULONG64 P2Home;
UINT64 P3Home; ULONG64 P3Home;
UINT64 P4Home; ULONG64 P4Home;
UINT64 P5; ULONG64 P5;
UINT64 InitialStack; ULONG64 Spare1;
M128A Xmm6; M128A Xmm6;
M128A Xmm7; M128A Xmm7;
M128A Xmm8; M128A Xmm8;
@ -853,22 +942,55 @@ typedef struct _KEXCEPTION_FRAME
M128A Xmm13; M128A Xmm13;
M128A Xmm14; M128A Xmm14;
M128A Xmm15; M128A Xmm15;
UINT64 TrapFrame; ULONG64 TrapFrame;
UINT64 CallbackStack; //ULONG64 CallbackStack;
UINT64 OutputBuffer; ULONG64 OutputBuffer;
UINT64 OutputLength; ULONG64 OutputLength;
UINT64 MxCsr; ULONG64 Spare2;
UINT64 Rbp; ULONG64 MxCsr;
UINT64 Rbx; ULONG64 Rbp;
UINT64 Rdi; ULONG64 Rbx;
UINT64 Rsi; ULONG64 Rdi;
UINT64 R12; ULONG64 Rsi;
UINT64 R13; ULONG64 R12;
UINT64 R14; ULONG64 R13;
UINT64 R15; ULONG64 R14;
UINT64 Return; ULONG64 R15;
ULONG64 Return;
} KEXCEPTION_FRAME, *PKEXCEPTION_FRAME; } KEXCEPTION_FRAME, *PKEXCEPTION_FRAME;
typedef struct _MACHINE_FRAME
{
ULONG64 Rip;
USHORT SegCs;
USHORT Fill1[3];
ULONG EFlags;
ULONG Fill2;
ULONG64 Rsp;
USHORT SegSs;
USHORT Fill3[3];
} MACHINE_FRAME, *PMACHINE_FRAME;
//
// Defines the Callback Stack Layout for User Mode Callbacks
//
typedef KEXCEPTION_FRAME KCALLOUT_FRAME, PKCALLOUT_FRAME;
//
// User side callout frame
//
typedef struct _UCALLOUT_FRAME
{
ULONG64 P1Home;
ULONG64 P2Home;
ULONG64 P3Home;
ULONG64 P4Home;
PVOID Buffer;
ULONG Length;
ULONG ApiNumber;
MACHINE_FRAME MachineFrame;
} UCALLOUT_FRAME, *PUCALLOUT_FRAME; // size = 0x0058
typedef struct _DISPATCHER_CONTEXT typedef struct _DISPATCHER_CONTEXT
{ {
ULONG64 ControlPc; ULONG64 ControlPc;
@ -883,14 +1005,13 @@ typedef struct _DISPATCHER_CONTEXT
ULONG ScopeIndex; ULONG ScopeIndex;
} DISPATCHER_CONTEXT, *PDISPATCHER_CONTEXT; } DISPATCHER_CONTEXT, *PDISPATCHER_CONTEXT;
typedef struct _KSTART_FRAME typedef struct _KSTART_FRAME
{ {
ULONG64 P1Home; ULONG64 P1Home;
ULONG64 P2Home; ULONG64 P2Home;
ULONG64 P3Home; ULONG64 P3Home;
ULONG64 P4Home; ULONG64 P4Home;
ULONG64 P5Home; ULONG64 Reserved;
ULONG64 Return; ULONG64 Return;
} KSTART_FRAME, *PKSTART_FRAME; } KSTART_FRAME, *PKSTART_FRAME;
@ -901,11 +1022,31 @@ typedef struct _KSWITCH_FRAME
ULONG64 P3Home; ULONG64 P3Home;
ULONG64 P4Home; ULONG64 P4Home;
ULONG64 P5Home; ULONG64 P5Home;
ULONG64 ApcBypass; KIRQL ApcBypass;
UCHAR Fill1[7];
ULONG64 Rbp; ULONG64 Rbp;
ULONG64 Return; ULONG64 Return;
} KSWITCH_FRAME, *PKSWITCH_FRAME; } KSWITCH_FRAME, *PKSWITCH_FRAME;
#define PROCESSOR_START_FLAG_FORCE_ENABLE_NX 0x0001
typedef struct _KPROCESSOR_START_BLOCK
{
ULONG CompletionFlag; // 0x0004
ULONG Flags; // 0x0008
ULONG Gdt32; // 0x000C
ULONG Idt32; // 0x0012
PVOID Gdt; // 0x0018
// ???
ULONG64 TiledMemoryMap; // 0x0058
UCHAR PmTarget[6]; // 0x0060
UCHAR LmIdentityTarget[6]; // 0x0066
ULONG64 LmTarget; // 0x0070
struct _KPROCESSOR_START_BLOCK *SelfMap; // 0x0078
ULONG64 MsrPat; // 0x0080
ULONG64 MsrEFER; // 0x0088
KPROCESSOR_STATE ProcessorState; // 0x0090
} KPROCESSOR_START_BLOCK, *PKPROCESSOR_START_BLOCK; // size 00640
// //
// Inline function to get current KPRCB // Inline function to get current KPRCB
// //

View file

@ -13,6 +13,7 @@ Abstract:
Author: Author:
Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
Timo Kreuzer (timo.kreuzer@reactos.org) - Updated 19-Apr-2015
--*/ --*/
@ -27,19 +28,85 @@ extern "C" {
// Dependencies // Dependencies
// //
#define SYNCH_LEVEL DISPATCH_LEVEL
// //
// CPSR Values // CPSR Values
// //
#define CPSR_THUMB_ENABLE 0x20 #define CPSRM_USER 0x10
#define CPSR_FIQ_DISABLE 0x40 #define CPSRM_FIQ 0x11
#define CPSR_IRQ_DISABLE 0x80 #define CPSRM_INT 0x12
#define CPSR_USER_MODE 0x10 #define CPSRM_SVC 0x13
#define CPSR_FIQ_MODE 0x11 #define CPSRM_ABT 0x17
#define CPSR_IRQ_MODE 0x12 #define CPSRM_UDF 0x1b
#define CPSR_SVC_MODE 0x13 #define CPSRM_SYS 0x1f
#define CPSR_ABORT_MODE 0x17 #define CPSRM_MASK 0x1f
#define CPSR_UND_MODE 0x1B #define SYSCALL_PSR 0x30
#define CPSR_MODES 0x1F
#define CPSRF_N 0x80000000
#define CPSRF_Z 0x40000000
#define CPSRF_C 0x20000000
#define CPSRF_V 0x10000000
#define CPSRF_Q 0x08000000
#define CPSR_IT_MASK 0x600fc00
#define FPSCRF_N 0x80000000
#define FPSCRF_Z 0x40000000
#define FPSCRF_C 0x20000000
#define FPSCRF_V 0x10000000
#define FPSCRF_QC 0x08000000
#define FPSCRM_AHP 0x4000000
#define FPSCRM_DN 0x2000000
#define FPSCRM_FZ 0x1000000
#define FPSCRM_RMODE_MASK 0xc00000
#define FPSCRM_RMODE_RN 0x0
#define FPSCRM_RMODE_RP 0x400000
#define FPSCRM_RMODE_RM 0x800000
#define FPSCRM_RMODE_RZ 0xc00000
#define FPSCRM_DEPRECATED 0x370000
#define FPSCR_IDE 0x8000
#define FPSCR_IXE 0x1000
#define FPSCR_UFE 0x800
#define FPSCR_OFE 0x400
#define FPSCR_DZE 0x200
#define FPSCR_IOE 0x100
#define FPSCR_IDC 0x80
#define FPSCR_IXC 0x10
#define FPSCR_UFC 0x8
#define FPSCR_OFC 0x4
#define FPSCR_DZC 0x2
#define FPSCR_IOC 0x1
#define CPSRC_INT 0x80
#define CPSRC_ABORT 0x100
#define CPSRC_THUMB 0x20
#define SWFS_PAGE_FAULT 0x10
#define SWFS_ALIGN_FAULT 0x20
#define SWFS_HWERR_FAULT 0x40
#define SWFS_DEBUG_FAULT 0x80
#define SWFS_EXECUTE 0x8
#define SWFS_WRITE 0x1
#define CP14_DBGDSCR_MOE_MASK 0x3c
#define CP14_DBGDSCR_MOE_SHIFT 0x2
#define CP14_DBGDSCR_MOE_HALT 0x0
#define CP14_DBGDSCR_MOE_BP 0x1
#define CP14_DBGDSCR_MOE_WPASYNC 0x2
#define CP14_DBGDSCR_MOE_BKPT 0x3
#define CP14_DBGDSCR_MOE_EXTERNAL 0x4
#define CP14_DBGDSCR_MOE_VECTOR 0x5
#define CP14_DBGDSCR_MOE_WPSYNC 0xa
#define CP15_PMCR_DP 0x20
#define CP15_PMCR_X 0x10
#define CP15_PMCR_CLKCNT_DIV 0x8
#define CP15_PMCR_CLKCNT_RST 0x4
#define CP15_PMCR_CNT_RST 0x2
#define CP15_PMCR_ENABLE 0x1
// //
// C1 Register Values // C1 Register Values
@ -56,7 +123,7 @@ extern "C" {
#define IPI_APC 1 #define IPI_APC 1
#define IPI_DPC 2 #define IPI_DPC 2
#define IPI_FREEZE 4 #define IPI_FREEZE 4
#define IPI_PACKET_READY 8 #define IPI_PACKET_READY 6
#define IPI_SYNCH_REQUEST 16 #define IPI_SYNCH_REQUEST 16
// //
@ -86,70 +153,118 @@ extern "C" {
// //
#define NUMBER_POOL_LOOKASIDE_LISTS 32 #define NUMBER_POOL_LOOKASIDE_LISTS 32
//
// ARM VFP State
// Based on Windows RT 8.1 symbols and ksarm.h
//
typedef struct _KARM_VFP_STATE
{
struct _KARM_VFP_STATE* Link; // 0x00
ULONG Fpscr; // 0x04
ULONG Reserved; // 0x08
ULONG Reserved2; // 0x0c
ULONGLONG VfpD[32]; // 0x10
} KARM_VFP_STATE, *PKARM_VFP_STATE; // size = 0x110
// //
// Trap Frame Definition // Trap Frame Definition
// Based on Windows RT 8.1 symbols and ksarm.h
// //
typedef struct _KTRAP_FRAME typedef struct _KTRAP_FRAME
{ {
ULONG DbgArgMark; ULONG Arg3;
ULONG FaultStatus;
union
{
ULONG FaultAddress;
ULONG TrapFrame;
};
ULONG Reserved;
BOOLEAN ExceptionActive;
BOOLEAN ContextFromKFramesUnwound;
BOOLEAN DebugRegistersValid;
union
{
CHAR PreviousMode;
KIRQL PreviousIrql;
};
PKARM_VFP_STATE VfpState;
ULONG Bvr[8];
ULONG Bcr[8];
ULONG Wvr[1];
ULONG Wcr[1];
ULONG R0; ULONG R0;
ULONG R1; ULONG R1;
ULONG R2; ULONG R2;
ULONG R3; ULONG R3;
ULONG R4;
ULONG R5;
ULONG R6;
ULONG R7;
ULONG R8;
ULONG R9;
ULONG R10;
ULONG R11;
ULONG R12; ULONG R12;
ULONG UserSp; ULONG Sp;
ULONG UserLr; ULONG Lr;
ULONG SvcSp; ULONG R11;
ULONG SvcLr;
ULONG Pc; ULONG Pc;
ULONG Spsr; ULONG Cpsr;
ULONG OldIrql;
ULONG PreviousMode;
ULONG PreviousTrapFrame;
} KTRAP_FRAME, *PKTRAP_FRAME; } KTRAP_FRAME, *PKTRAP_FRAME;
//
// Defines the Callback Stack Layout for User Mode Callbacks
//
// Just a stub with some required members for now
//
typedef struct _KCALLOUT_FRAME
{
ULONG CallbackStack;
ULONG DummyFramePointer;
} KCALLOUT_FRAME, *PKCALLOUT_FRAME;
#ifndef NTOS_MODE_USER #ifndef NTOS_MODE_USER
// //
// Exception Frame Definition // Exception Frame Definition
// FIXME: this should go into ntddk.h
// //
typedef struct _KEXCEPTION_FRAME typedef struct _KEXCEPTION_FRAME
{ {
// ULONG R0; ULONG Param5; // 0x00
// ULONG R1; ULONG TrapFrame; // 0x04
// ULONG R2; ULONG OutputBuffer; // 0x08
// ULONG R3; ULONG OutputLength; // 0x0c
ULONG R4; ULONG Pad; // 0x04
ULONG R5; ULONG R4; // 0x14
ULONG R6; ULONG R5; // 0x18
ULONG R7; ULONG R6; // 0x1c
ULONG R8; ULONG R7; // 0x20
ULONG R9; ULONG R8; // 0x24
ULONG R10; ULONG R9; // 0x28
ULONG R11; ULONG R10; // 0x2c
// ULONG R12; ULONG R11; // 0x30
ULONG Lr; ULONG Return; // 0x34
ULONG Psr; } KEXCEPTION_FRAME, *PKEXCEPTION_FRAME; // size = 0x38
} KEXCEPTION_FRAME, *PKEXCEPTION_FRAME;
//
// ARM Architecture State
// Based on Windows RT 8.1 symbols and ksarm.h
//
typedef struct _KARM_ARCH_STATE
{
ULONG Cp15_Cr0_CpuId;
ULONG Cp15_Cr1_Control;
ULONG Cp15_Cr1_AuxControl;
ULONG Cp15_Cr1_Cpacr;
ULONG Cp15_Cr2_TtbControl;
ULONG Cp15_Cr2_Ttb0;
ULONG Cp15_Cr2_Ttb1;
ULONG Cp15_Cr3_Dacr;
ULONG Cp15_Cr5_Dfsr;
ULONG Cp15_Cr5_Ifsr;
ULONG Cp15_Cr6_Dfar;
ULONG Cp15_Cr6_Ifar;
ULONG Cp15_Cr9_PmControl;
ULONG Cp15_Cr9_PmCountEnableSet;
ULONG Cp15_Cr9_PmCycleCounter;
ULONG Cp15_Cr9_PmEventCounter[31];
ULONG Cp15_Cr9_PmEventType[31];
ULONG Cp15_Cr9_PmInterruptSelect;
ULONG Cp15_Cr9_PmOverflowStatus;
ULONG Cp15_Cr9_PmSelect;
ULONG Cp15_Cr9_PmUserEnable;
ULONG Cp15_Cr10_PrimaryMemoryRemap;
ULONG Cp15_Cr10_NormalMemoryRemap;
ULONG Cp15_Cr12_VBARns;
ULONG Cp15_Cr13_ContextId;
} KARM_ARCH_STATE, *PKARM_ARCH_STATE;
///
/// "Custom" definition start
///
// //
// ARM Internal Registers // ARM Internal Registers
@ -314,164 +429,442 @@ typedef enum _ARM_DOMAINS
Domain15 Domain15
} ARM_DOMAINS; } ARM_DOMAINS;
///
/// "Custom" definition end
///
// //
// Special Registers Structure (outside of CONTEXT) // Special Registers Structure (outside of CONTEXT)
// Based on Windows RT 8.1 symbols and ksarm.h
// //
typedef struct _KSPECIAL_REGISTERS typedef struct _KSPECIAL_REGISTERS
{ {
ARM_CONTROL_REGISTER ControlRegister; ULONG Reserved[7]; // 0x00
ARM_LOCKDOWN_REGISTER LockdownRegister; ULONG Cp15_Cr13_UsrRW; // 0x1c
ARM_CACHE_REGISTER CacheRegister; ULONG Cp15_Cr13_UsrRO; // 0x20
ARM_STATUS_REGISTER StatusRegister; ULONG Cp15_Cr13_SvcRW; // 0x24
ULONG KernelBvr[8]; // 0x28
ULONG KernelBcr[8]; // 0x48
ULONG KernelWvr[1]; // 0x68
ULONG KernelWcr[1]; // 0x6c
ULONG Fpexc; // 0x70
ULONG Fpinst; // 0x74
ULONG Fpinst2; // 0x78
ULONG UserSp; // 0x7c
ULONG UserLr; // 0x80
ULONG AbortSp; // 0x84
ULONG AbortLr; // 0x88
ULONG AbortSpsr; // 0x8c
ULONG UdfSp; // 0x90
ULONG UdfLr; // 0x94
ULONG UdfSpsr; // 0x98
ULONG IrqSp; // 0x9c
ULONG IrqLr; // 0xa0
ULONG IrqSpsr; // 0xa4
} KSPECIAL_REGISTERS, *PKSPECIAL_REGISTERS; } KSPECIAL_REGISTERS, *PKSPECIAL_REGISTERS;
// //
// Processor State // Processor State
// Based on Windows RT 8.1 symbols and ksarm.h
// //
typedef struct _KPROCESSOR_STATE typedef struct _KPROCESSOR_STATE
{ {
struct _CONTEXT ContextFrame; KSPECIAL_REGISTERS SpecialRegisters; // 0x000
struct _KSPECIAL_REGISTERS SpecialRegisters; KARM_ARCH_STATE ArchState; // 0x0a8
CONTEXT ContextFrame; // 0x200
} KPROCESSOR_STATE, *PKPROCESSOR_STATE; } KPROCESSOR_STATE, *PKPROCESSOR_STATE;
C_ASSERT(sizeof(KPROCESSOR_STATE) == 0x3a0);
//
// ARM Mini Stack
// Based on Windows RT 8.1 symbols and ksarm.h
//
typedef struct _KARM_MINI_STACK
{
ULONG Pc;
ULONG Cpsr;
ULONG R4;
ULONG R5;
ULONG R6;
ULONG R7;
ULONG Reserved[2];
} KARM_MINI_STACK, *PKARM_MINI_STACK; // size = 0x20
typedef struct _DISPATCHER_CONTEXT
{
ULONG ControlPc; // 0x0
PVOID ImageBase; // 0x4
PVOID FunctionEntry; // 0x8
PVOID EstablisherFrame; // 0xc
ULONG TargetPc; // 0x10
PVOID ContextRecord; // 0x14
PVOID LanguageHandler; // 0x18
PVOID HandlerData; // 0x1c
PVOID HistoryTable; // 0x20
ULONG ScopeIndex; // 0x24
ULONG ControlPcIsUnwound; // 0x28
PVOID NonVolatileRegisters; // 0x2c
ULONG Reserved; // 0x30
} DISPATCHER_CONTEXT, *PDISPATCHER_CONTEXT;
//
// Machine Frame
// Based on ksarm.h
//
typedef struct _MACHINE_FRAME
{
ULONG Sp;
ULONG Pc;
} MACHINE_FRAME, *PMACHINE_FRAME;
//
// Defines the Callback Stack Layout for User Mode Callbacks
//
typedef KEXCEPTION_FRAME KCALLOUT_FRAME, PKCALLOUT_FRAME;
//
// User mode callout frame
//
typedef struct _UCALLOUT_FRAME
{
PVOID Buffer;
ULONG Length;
ULONG ApiNumber;
ULONG OriginalLr;
MACHINE_FRAME MachineFrame;
} UCALLOUT_FRAME, *PUCALLOUT_FRAME;
typedef struct _KSTART_FRAME
{
ULONG R0;
ULONG R1;
ULONG R2;
ULONG Return;
} KSTART_FRAME, *PKSTART_FRAME;
typedef struct _KSWITCH_FRAME
{
KIRQL ApcBypass;
UCHAR Fill[7];
ULONG R11;
ULONG Return;
} KSWITCH_FRAME, *PKSWITCH_FRAME;
//
// Cache types
// (These are made up constants!)
//
enum _ARM_CACHE_TYPES
{
FirstLevelDcache = 0,
SecondLevelDcache = 1,
FirstLevelIcache = 2,
SecondLevelIcache = 3,
GlobalDcache = 4,
GlobalIcache = 5
};
#if (NTDDI_VERSION < NTDDI_LONGHORN)
#define GENERAL_LOOKASIDE_POOL PP_LOOKASIDE_LIST
#endif
// //
// Processor Region Control Block // Processor Region Control Block
// Based on Windows RT 8.1 symbols
// //
typedef struct _KPRCB typedef struct _KPRCB
{ {
UCHAR LegacyNumber;
UCHAR ReservedMustBeZero;
UCHAR IdleHalt;
PKTHREAD CurrentThread;
PKTHREAD NextThread;
PKTHREAD IdleThread;
UCHAR NestingLevel;
UCHAR ClockOwner;
union
{
UCHAR PendingTickFlags;
struct
{
UCHAR PendingTick : 1;
UCHAR PendingBackupTick : 1;
};
};
UCHAR PrcbPad00[1];
ULONG Number;
ULONG PrcbLock;
PCHAR PriorityState;
KPROCESSOR_STATE ProcessorState;
USHORT ProcessorModel;
USHORT ProcessorRevision;
ULONG MHz;
UINT64 CycleCounterFrequency;
ULONG HalReserved[15];
USHORT MinorVersion; USHORT MinorVersion;
USHORT MajorVersion; USHORT MajorVersion;
struct _KTHREAD *CurrentThread; UCHAR BuildType;
struct _KTHREAD *NextThread; UCHAR CpuVendor;
struct _KTHREAD *IdleThread; UCHAR CoresPerPhysicalProcessor;
UCHAR Number; UCHAR LogicalProcessorsPerCore;
UCHAR Reserved; PVOID AcpiReserved;
USHORT BuildType; ULONG GroupSetMember;
KAFFINITY SetMember; UCHAR Group;
UCHAR CpuType; UCHAR GroupIndex;
UCHAR CpuID; //UCHAR _PADDING1_[0x62];
USHORT CpuStep; KSPIN_LOCK_QUEUE DECLSPEC_ALIGN(128) LockQueue[17];
KPROCESSOR_STATE ProcessorState; UCHAR ProcessorVendorString[2];
ULONG KernelReserved[16]; UCHAR _PADDING2_[0x2];
ULONG HalReserved[16]; ULONG FeatureBits;
UCHAR PrcbPad0[92]; ULONG MaxBreakpoints;
KSPIN_LOCK_QUEUE LockQueue[LockQueueMaximumLock]; ULONG MaxWatchpoints;
struct _KTHREAD *NpxThread; PCONTEXT Context;
ULONG InterruptCount; ULONG ContextFlagsInit;
ULONG KernelTime; //UCHAR _PADDING3_[0x60];
ULONG UserTime; PP_LOOKASIDE_LIST DECLSPEC_ALIGN(128) PPLookasideList[16];
ULONG DpcTime; LONG PacketBarrier;
ULONG DebugDpcTime; SINGLE_LIST_ENTRY DeferredReadyListHead;
ULONG InterruptTime; LONG MmPageFaultCount;
ULONG AdjustDpcThreshold; LONG MmCopyOnWriteCount;
ULONG PageColor; LONG MmTransitionCount;
UCHAR SkipTick; LONG MmDemandZeroCount;
UCHAR DebuggerSavedIRQL; LONG MmPageReadCount;
UCHAR NodeColor; LONG MmPageReadIoCount;
UCHAR Spare1; LONG MmDirtyPagesWriteCount;
ULONG NodeShiftedColor; LONG MmDirtyWriteIoCount;
struct _KNODE *ParentNode; LONG MmMappedPagesWriteCount;
ULONG MultiThreadProcessorSet; LONG MmMappedWriteIoCount;
struct _KPRCB *MultiThreadSetMaster; ULONG KeSystemCalls;
ULONG SecondaryColorMask; ULONG KeContextSwitches;
LONG Sleeping;
ULONG CcFastReadNoWait; ULONG CcFastReadNoWait;
ULONG CcFastReadWait; ULONG CcFastReadWait;
ULONG CcFastReadNotPossible; ULONG CcFastReadNotPossible;
ULONG CcCopyReadNoWait; ULONG CcCopyReadNoWait;
ULONG CcCopyReadWait; ULONG CcCopyReadWait;
ULONG CcCopyReadNoWaitMiss; ULONG CcCopyReadNoWaitMiss;
ULONG KeAlignmentFixupCount; LONG LookasideIrpFloat;
ULONG SpareCounter0; LONG IoReadOperationCount;
ULONG KeDcacheFlushCount; LONG IoWriteOperationCount;
ULONG KeExceptionDispatchCount; LONG IoOtherOperationCount;
ULONG KeFirstLevelTbFills;
ULONG KeFloatingEmulationCount;
ULONG KeIcacheFlushCount;
ULONG KeSecondLevelTbFills;
ULONG KeSystemCalls;
volatile ULONG IoReadOperationCount;
volatile ULONG IoWriteOperationCount;
volatile ULONG IoOtherOperationCount;
LARGE_INTEGER IoReadTransferCount; LARGE_INTEGER IoReadTransferCount;
LARGE_INTEGER IoWriteTransferCount; LARGE_INTEGER IoWriteTransferCount;
LARGE_INTEGER IoOtherTransferCount; LARGE_INTEGER IoOtherTransferCount;
ULONG SpareCounter1[8]; UCHAR _PADDING4_[0x8];
PP_LOOKASIDE_LIST PPLookasideList[16]; struct _REQUEST_MAILBOX* Mailbox;
PP_LOOKASIDE_LIST PPNPagedLookasideList[32]; LONG TargetCount;
PP_LOOKASIDE_LIST PPPagedLookasideList[32]; ULONG IpiFrozen;
volatile ULONG PacketBarrier; ULONG RequestSummary;
volatile ULONG ReverseStall; KDPC_DATA DpcData[2];
PVOID IpiFrame;
UCHAR PrcbPad2[52];
volatile PVOID CurrentPacket[3];
volatile ULONG TargetSet;
volatile PKIPI_WORKER WorkerRoutine;
volatile ULONG IpiFrozen;
UCHAR PrcbPad3[40];
volatile ULONG RequestSummary;
volatile struct _KPRCB *SignalDone;
UCHAR PrcbPad4[56];
struct _KDPC_DATA DpcData[2];
PVOID DpcStack; PVOID DpcStack;
ULONG MaximumDpcQueueDepth; PVOID SpBase;
LONG MaximumDpcQueueDepth;
ULONG DpcRequestRate; ULONG DpcRequestRate;
ULONG MinimumDpcRate; ULONG MinimumDpcRate;
ULONG DpcLastCount;
UCHAR ThreadDpcEnable;
UCHAR QuantumEnd;
UCHAR DpcRoutineActive;
UCHAR IdleSchedule;
#if (NTDDI_VERSION >= NTDDI_WIN8)
union
{
LONG DpcRequestSummary;
SHORT DpcRequestSlot[2];
struct
{
SHORT NormalDpcState;
SHORT ThreadDpcState;
};
struct
{
ULONG DpcNormalProcessingActive : 1;
ULONG DpcNormalProcessingRequested : 1;
ULONG DpcNormalThreadSignal : 1;
ULONG DpcNormalTimerExpiration : 1;
ULONG DpcNormalDpcPresent : 1;
ULONG DpcNormalLocalInterrupt : 1;
ULONG DpcNormalSpare : 10;
ULONG DpcThreadActive : 1;
ULONG DpcThreadRequested : 1;
ULONG DpcThreadSpare : 14;
};
};
#else
LONG DpcSetEventRequest;
#endif
ULONG LastTimerHand;
ULONG LastTick;
ULONG ClockInterrupts;
ULONG ReadyScanTick;
ULONG PrcbPad10[1];
ULONG InterruptLastCount;
ULONG InterruptRate;
UCHAR _PADDING5_[0x4];
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
KGATE DpcGate;
#else
KEVENT DpcEvent;
#endif
ULONG MPAffinity;
KDPC CallDpc;
LONG ClockKeepAlive;
UCHAR ClockCheckSlot;
UCHAR ClockPollCycle;
//UCHAR _PADDING6_[0x2];
LONG DpcWatchdogPeriod;
LONG DpcWatchdogCount;
LONG KeSpinLockOrdering;
UCHAR _PADDING7_[0x38];
LIST_ENTRY WaitListHead;
ULONG WaitLock;
ULONG ReadySummary;
LONG AffinitizedSelectionMask;
ULONG QueueIndex;
KDPC TimerExpirationDpc;
//RTL_RB_TREE ScbQueue;
LIST_ENTRY ScbList;
UCHAR _PADDING8_[0x38];
LIST_ENTRY DispatcherReadyListHead[32];
ULONG InterruptCount;
ULONG KernelTime;
ULONG UserTime;
ULONG DpcTime;
ULONG InterruptTime;
ULONG AdjustDpcThreshold;
UCHAR SkipTick;
UCHAR DebuggerSavedIRQL;
UCHAR PollSlot;
UCHAR GroupSchedulingOverQuota;
ULONG DpcTimeCount;
ULONG DpcTimeLimit;
ULONG PeriodicCount;
ULONG PeriodicBias;
ULONG AvailableTime;
ULONG ScbOffset;
ULONG KeExceptionDispatchCount;
struct _KNODE* ParentNode;
UCHAR _PADDING9_[0x4];
ULONG64 AffinitizedCycles;
ULONG64 StartCycles;
ULONG64 GenerationTarget;
ULONG64 CycleCounterHigh;
#if (NTDDI_VERSION >= NTDDI_WIN8)
KENTROPY_TIMING_STATE EntropyTimingState;
#endif /* (NTDDI_VERSION >= NTDDI_WIN8) */
LONG MmSpinLockOrdering;
ULONG PageColor;
ULONG NodeColor;
ULONG NodeShiftedColor;
ULONG SecondaryColorMask;
ULONG64 CycleTime;
UCHAR _PADDING10_[0x58];
ULONG CcFastMdlReadNoWait;
ULONG CcFastMdlReadWait;
ULONG CcFastMdlReadNotPossible;
ULONG CcMapDataNoWait;
ULONG CcMapDataWait;
ULONG CcPinMappedDataCount;
ULONG CcPinReadNoWait;
ULONG CcPinReadWait;
ULONG CcMdlReadNoWait;
ULONG CcMdlReadWait;
ULONG CcLazyWriteHotSpots;
ULONG CcLazyWriteIos;
ULONG CcLazyWritePages;
ULONG CcDataFlushes;
ULONG CcDataPages;
ULONG CcLostDelayedWrites;
ULONG CcFastReadResourceMiss;
ULONG CcCopyReadWaitMiss;
ULONG CcFastMdlReadResourceMiss;
ULONG CcMapDataNoWaitMiss;
ULONG CcMapDataWaitMiss;
ULONG CcPinReadNoWaitMiss;
ULONG CcPinReadWaitMiss;
ULONG CcMdlReadNoWaitMiss;
ULONG CcMdlReadWaitMiss;
ULONG CcReadAheadIos;
LONG MmCacheTransitionCount;
LONG MmCacheReadCount;
LONG MmCacheIoCount;
UCHAR _PADDING11_[0xC];
PROCESSOR_POWER_STATE PowerState;
ULONG SharedReadyQueueOffset;
ULONG PrcbPad15[2];
ULONG DeviceInterrupts;
PVOID IsrDpcStats;
ULONG KeAlignmentFixupCount;
KDPC DpcWatchdogDpc;
KTIMER DpcWatchdogTimer;
SLIST_HEADER InterruptObjectPool;
//KAFFINITY_EX PackageProcessorSet;
UCHAR _PADDING12_[0x4];
ULONG SharedReadyQueueMask;
struct _KSHARED_READY_QUEUE* SharedReadyQueue;
ULONG CoreProcessorSet;
ULONG ScanSiblingMask;
ULONG LLCMask;
ULONG CacheProcessorMask[5];
ULONG ScanSiblingIndex;
CACHE_DESCRIPTOR Cache[6];
UCHAR CacheCount;
UCHAR PrcbPad20[3];
ULONG CachedCommit;
ULONG CachedResidentAvailable;
PVOID HyperPte;
PVOID WheaInfo;
PVOID EtwSupport;
UCHAR _PADDING13_[0x74];
SYNCH_COUNTERS SynchCounters;
//FILESYSTEM_DISK_COUNTERS FsCounters;
UCHAR _PADDING14_[0x8];
KARM_MINI_STACK FiqMiniStack;
KARM_MINI_STACK IrqMiniStack;
KARM_MINI_STACK UdfMiniStack;
KARM_MINI_STACK AbtMiniStack;
KARM_MINI_STACK PanicMiniStack;
ULONG PanicStackBase;
PVOID IsrStack;
ULONG PteBitCache;
ULONG PteBitOffset;
KTIMER_TABLE TimerTable;
GENERAL_LOOKASIDE_POOL PPNxPagedLookasideList[32];
GENERAL_LOOKASIDE_POOL PPNPagedLookasideList[32];
GENERAL_LOOKASIDE_POOL PPPagedLookasideList[32];
SINGLE_LIST_ENTRY AbSelfIoBoostsList;
SINGLE_LIST_ENTRY AbPropagateBoostsList;
KDPC AbDpc;
UCHAR _PADDING15_[0x58];
//REQUEST_MAILBOX RequestMailbox[1];
// FIXME: Oldstyle stuff
#if (NTDDI_VERSION < NTDDI_WIN8) // FIXME
UCHAR CpuType;
volatile UCHAR DpcInterruptRequested; volatile UCHAR DpcInterruptRequested;
volatile UCHAR DpcThreadRequested; volatile UCHAR DpcThreadRequested;
volatile UCHAR DpcRoutineActive;
volatile UCHAR DpcThreadActive; volatile UCHAR DpcThreadActive;
ULONG PrcbLock;
ULONG DpcLastCount;
volatile ULONG TimerHand; volatile ULONG TimerHand;
volatile ULONG TimerRequest; volatile ULONG TimerRequest;
PVOID DpcThread; ULONG DebugDpcTime;
KEVENT DpcEvent; LONG Sleeping;
UCHAR ThreadDpcEnable; KAFFINITY SetMember;
volatile BOOLEAN QuantumEnd;
UCHAR PrcbPad50;
volatile UCHAR IdleSchedule;
LONG DpcSetEventRequest;
UCHAR PrcbPad5[18];
LONG TickOffset;
KDPC CallDpc;
ULONG PrcbPad7[8];
LIST_ENTRY WaitListHead;
ULONG ReadySummary;
ULONG QueueIndex;
LIST_ENTRY DispatcherReadyListHead[32];
SINGLE_LIST_ENTRY DeferredReadyListHead;
ULONG PrcbPad72[11];
PVOID ChainedInterruptList;
LONG LookasideIrpFloat;
volatile LONG MmPageFaultCount;
volatile LONG MmCopyOnWriteCount;
volatile LONG MmTransitionCount;
volatile LONG MmCacheTransitionCount;
volatile LONG MmDemandZeroCount;
volatile LONG MmPageReadCount;
volatile LONG MmPageReadIoCount;
volatile LONG MmCacheReadCount;
volatile LONG MmCacheIoCount;
volatile LONG MmDirtyPagesWriteCount;
volatile LONG MmDirtyWriteIoCount;
volatile LONG MmMappedPagesWriteCount;
volatile LONG MmMappedWriteIoCount;
ULONG SpareFields0[1];
CHAR VendorString[13]; CHAR VendorString[13];
UCHAR InitialApicId; #endif
UCHAR LogicalProcessorsPerPhysicalProcessor;
ULONG MHz;
ULONG FeatureBits;
LARGE_INTEGER UpdateSignature;
volatile LARGE_INTEGER IsrTime;
LARGE_INTEGER SpareField1;
//FX_SAVE_AREA NpxSaveArea;
PROCESSOR_POWER_STATE PowerState;
} KPRCB, *PKPRCB; } KPRCB, *PKPRCB;
C_ASSERT(FIELD_OFFSET(KPRCB, ProcessorState) == 0x20);
C_ASSERT(FIELD_OFFSET(KPRCB, ProcessorModel) == 0x3C0);
C_ASSERT(FIELD_OFFSET(KPRCB, LockQueue) == 0x480);
C_ASSERT(FIELD_OFFSET(KPRCB, PacketBarrier) == 0x600);
C_ASSERT(FIELD_OFFSET(KPRCB, Mailbox) == 0x680);
C_ASSERT(FIELD_OFFSET(KPRCB, DpcData) == 0x690);
C_ASSERT(FIELD_OFFSET(KPRCB, DpcStack) == 0x6c0);
//C_ASSERT(FIELD_OFFSET(KPRCB, CallDpc) == 0x714);
// //
// Processor Control Region // Processor Control Region
// Based on Windows RT 8.1 symbols
// //
typedef struct _KIPCR typedef struct _KIPCR
{ {
@ -480,61 +873,48 @@ typedef struct _KIPCR
NT_TIB NtTib; NT_TIB NtTib;
struct struct
{ {
struct _EXCEPTION_REGISTRATION_RECORD *Used_ExceptionList; // Unused ULONG TibPad0[2];
PVOID Used_StackBase; // Unused PVOID Spare1;
PVOID PerfGlobalGroupMask; struct _KPCR *Self;
PVOID TssCopy; // Unused struct _KPRCB *CurrentPrcb;
ULONG ContextSwitches; struct _KSPIN_LOCK_QUEUE* LockArray;
KAFFINITY SetMemberCopy; // Unused
PVOID Used_Self; PVOID Used_Self;
}; };
}; };
struct _KPCR *Self; KIRQL CurrentIrql;
struct _KPRCB *Prcb; UCHAR SecondLevelCacheAssociativity;
KIRQL Irql; ULONG Unused0[3];
ULONG IRR; // Unused
ULONG IrrActive; // Unused
ULONG IDR; // Unused
PVOID KdVersionBlock;
PVOID IDT; // Unused
PVOID GDT; // Unused
PVOID TSS; // Unused
USHORT MajorVersion; USHORT MajorVersion;
USHORT MinorVersion; USHORT MinorVersion;
KAFFINITY SetMember;
ULONG StallScaleFactor; ULONG StallScaleFactor;
UCHAR SpareUnused; PVOID Unused1[3];
UCHAR Number; ULONG KernelReserved[15];
UCHAR Spare0;
UCHAR SecondLevelCacheAssociativity;
ULONG VdmAlert;
ULONG KernelReserved[14];
ULONG SecondLevelCacheSize; ULONG SecondLevelCacheSize;
ULONG HalReserved[16]; union
// arm part {
UCHAR IrqlMask[32]; USHORT SoftwareInterruptPending;
ULONG IrqlTable[32]; struct
PKINTERRUPT_ROUTINE InterruptRoutine[32]; {
ULONG ReservedVectors; UCHAR ApcInterrupt;
ULONG FirstLevelDcacheSize; UCHAR DispatchInterrupt;
ULONG FirstLevelDcacheFillSize; };
ULONG FirstLevelIcacheSize; };
ULONG FirstLevelIcacheFillSize; USHORT InterruptPad;
ULONG SecondLevelDcacheSize; ULONG HalReserved[32];
ULONG SecondLevelDcacheFillSize; PVOID KdVersionBlock;
ULONG SecondLevelIcacheSize; PVOID Unused3;
ULONG SecondLevelIcacheFillSize; ULONG PcrAlign1[8];
ULONG DcacheFillSize;
ULONG DcacheAlignment; /* Private members, not in ntddk.h */
ULONG IcacheAlignment; PVOID Idt[256];
ULONG IcacheFillSize; PVOID* IdtExt;
ULONG ProcessorId; ULONG PcrAlign2[19];
PVOID InterruptStack; UCHAR _PADDING1_[0x4];
PVOID PanicStack; KPRCB Prcb;
PVOID InitialStack;
KPRCB PrcbData;
} KIPCR, *PKIPCR; } KIPCR, *PKIPCR;
C_ASSERT(FIELD_OFFSET(KIPCR, Prcb.LegacyNumber) == 0x580);
// //
// Macro to get current KPRCB // Macro to get current KPRCB
// //
@ -542,20 +922,19 @@ FORCEINLINE
struct _KPRCB * struct _KPRCB *
KeGetCurrentPrcb(VOID) KeGetCurrentPrcb(VOID)
{ {
return PCR->Prcb; return KeGetPcr()->CurrentPrcb;
} }
// //
// Just read it from the PCR // Just read it from the PCR
// //
#define KeGetCurrentProcessorNumber() (int)PCR->Number #define KeGetCurrentIrql() KeGetPcr()->CurrentIrql
#define KeGetCurrentIrql() PCR->Irql
#define _KeGetCurrentThread() KeGetCurrentPrcb()->CurrentThread #define _KeGetCurrentThread() KeGetCurrentPrcb()->CurrentThread
#define _KeGetPreviousMode() KeGetCurrentPrcb()->CurrentThread->PreviousMode #define _KeGetPreviousMode() KeGetCurrentPrcb()->CurrentThread->PreviousMode
#define _KeIsExecutingDpc() (KeGetCurrentPrcb()->DpcRoutineActive != 0) #define _KeIsExecutingDpc() (KeGetCurrentPrcb()->DpcRoutineActive != 0)
#define KeGetCurrentThread() _KeGetCurrentThread() #define KeGetCurrentThread() _KeGetCurrentThread()
#define KeGetPreviousMode() _KeGetPreviousMode() #define KeGetPreviousMode() _KeGetPreviousMode()
#define KeGetDcacheFillSize() PCR->DcacheFillSize //#define KeGetDcacheFillSize() PCR->DcacheFillSize
#endif // !NTOS_MODE_USER #endif // !NTOS_MODE_USER

View file

@ -37,18 +37,6 @@ Author:
#define KernelMode 0x0 #define KernelMode 0x0
#define UserMode 0x1 #define UserMode 0x1
//
// CPU Types
//
#define CPU_NONE 0x0
#define CPU_INTEL 0x1
#define CPU_AMD 0x2
#define CPU_CYRIX 0x3
#define CPU_TRANSMETA 0x4
#define CPU_CENTAUR 0x5
#define CPU_RISE 0x6
#define CPU_UNKNOWN 0x7
// //
// Selector Names // Selector Names
// //

View file

@ -33,6 +33,22 @@ Author:
#define KeGetPcr() ((KPCR *)__readfsdword(FIELD_OFFSET(KPCR, SelfPcr))) #define KeGetPcr() ((KPCR *)__readfsdword(FIELD_OFFSET(KPCR, SelfPcr)))
#endif #endif
//
// CPU Vendors
//
typedef enum
{
CPU_NONE = 0,
CPU_INTEL = 1,
CPU_AMD = 2,
CPU_CYRIX = 3,
CPU_TRANSMETA = 4,
CPU_VIA = 5,
CPU_CENTAUR = CPU_VIA,
CPU_RISE = 6,
CPU_UNKNOWN = 7
} CPU_VENDORS;
// //
// Machine Types // Machine Types
// //
@ -116,6 +132,20 @@ Author:
#define FSW_PRECISION 0x20 #define FSW_PRECISION 0x20
#define FSW_STACK_FAULT 0x40 #define FSW_STACK_FAULT 0x40
//
// Machine Specific Registers
//
#define MSR_AMD_ACCESS 0x9C5A203A
#define MSR_IA32_MISC_ENABLE 0x01A0
#define MSR_EFER 0xC0000080
//
// MSR internal Values
//
#define MSR_NXE 0x0800
#define XHF_NOEXECUTE 0x100000
#define MSR_XD_ENABLE_MASK 0xFFFFFFFB
// //
// IPI Types // IPI Types
// //
@ -802,5 +832,82 @@ typedef struct _KTSS
// i386 CPUs don't have exception frames // i386 CPUs don't have exception frames
// //
typedef struct _KEXCEPTION_FRAME KEXCEPTION_FRAME, *PKEXCEPTION_FRAME; typedef struct _KEXCEPTION_FRAME KEXCEPTION_FRAME, *PKEXCEPTION_FRAME;
#endif
#endif #endif /* NTOS_MODE_USER */
typedef enum _WOW64_SERVICE_TYPES
{
ServiceNoTurbo = 0x0000,
Service0Arg = 0x0001,
Service0ArgReloadState = 0x0002,
Service1ArgSp = 0x0003,
Service1ArgNSp = 0x0004,
Service2ArgNSpNSp = 0x0005,
Service2ArgNSpNSpReloadState = 0x0006,
Service2ArgSpNSp = 0x0007,
Service2ArgSpSp = 0x0008,
Service2ArgNSpSp = 0x0009,
Service3ArgNSpNSpNSp = 0x000A,
Service3ArgSpSpSp = 0x000B,
Service3ArgSpNSpNSp = 0x000C,
Service3ArgSpNSpNSpReloadState = 0x000D,
Service3ArgSpSpNSp = 0x000E,
Service3ArgNSpSpNSp = 0x000F,
Service3ArgSpNSpSp = 0x0010,
Service4ArgNSpNSpNSpNSp = 0x0011,
Service4ArgSpSpNSpNSp = 0x0012,
Service4ArgSpSpNSpNSpReloadState = 0x0013,
Service4ArgSpNSpNSpNSp = 0x0014,
Service4ArgSpNSpNSpNSpReloadState = 0x0015,
Service4ArgNSpSpNSpNSp = 0x0016,
Service4ArgSpSpSpNSp = 0x0017,
ServiceCpupTdQuerySystemTime = 0x0018,
ServiceCpupTdGetCurrentProcessorNumber = 0x0019,
ServiceCpupTdReadWriteFile = 0x001A,
ServiceCpupTdDeviceIoControlFile = 0x001B,
ServiceCpupTdRemoveIoCompletion = 0x001C,
ServiceCpupTdWaitForMultipleObjects = 0x001D,
ServiceCpupTdWaitForMultipleObjects32 = 0x001E,
Wow64ServiceTypesCount // = 0x001F
} WOW64_SERVICE_TYPES, *PWOW64_SERVICE_TYPES;
typedef enum _VDM_INDEX
{
VDM_INDEX_Invalid = 0,
VDM_INDEX_0F,
VDM_INDEX_ESPrefix,
VDM_INDEX_CSPrefix,
VDM_INDEX_SSPrefix,
VDM_INDEX_DSPrefix,
VDM_INDEX_FSPrefix,
VDM_INDEX_GSPrefix,
VDM_INDEX_OPER32Prefix,
VDM_INDEX_ADDR32Prefix,
VDM_INDEX_INSB,
VDM_INDEX_INSW,
VDM_INDEX_OUTSB,
VDM_INDEX_OUTSW,
VDM_INDEX_PUSHF,
VDM_INDEX_POPF,
VDM_INDEX_INTnn,
VDM_INDEX_INTO,
VDM_INDEX_IRET,
VDM_INDEX_NPX,
VDM_INDEX_INBimm,
VDM_INDEX_INWimm,
VDM_INDEX_OUTBimm,
VDM_INDEX_OUTWimm,
VDM_INDEX_INB,
VDM_INDEX_INW,
VDM_INDEX_OUTB,
VDM_INDEX_OUTW,
VDM_INDEX_LOCKPrefix,
VDM_INDEX_REPNEPrefix,
VDM_INDEX_REPPrefix,
VDM_INDEX_CLI,
VDM_INDEX_STI,
VDM_INDEX_HLT,
MAX_VDM_INDEX
} VDM_INDEX, *PVDM_INDEX;
#endif /* _I386_KETYPES_H */

View file

@ -158,10 +158,18 @@ Author:
#define KF_AMDK6MTRR 0x00008000 #define KF_AMDK6MTRR 0x00008000
#define KF_XMMI64 0x00010000 #define KF_XMMI64 0x00010000
#define KF_DTS 0x00020000 #define KF_DTS 0x00020000
#define KF_BRANCH 0x00020000 // from ksamd64.inc
#define KF_SSE3 0x00080000
#define KF_CMPXCHG16B 0x00100000
#define KF_XSTATE 0x00800000 // from ks386.inc, ksamd64.inc
#define KF_NX_BIT 0x20000000 #define KF_NX_BIT 0x20000000
#define KF_NX_DISABLED 0x40000000 #define KF_NX_DISABLED 0x40000000
#define KF_NX_ENABLED 0x80000000 #define KF_NX_ENABLED 0x80000000
#define KF_XSAVEOPT_BIT 15
#define KF_XSTATE_BIT 23
#define KF_RDWRFSGSBASE_BIT 28
// //
// Internal Exception Codes // Internal Exception Codes
// //
@ -776,6 +784,17 @@ typedef struct _KNODE
} KNODE, *PKNODE; } KNODE, *PKNODE;
#include <poppack.h> #include <poppack.h>
//
// Structure for Get/SetContext APC
//
typedef struct _GETSETCONTEXT
{
KAPC Apc;
KEVENT Event;
KPROCESSOR_MODE Mode;
CONTEXT Context;
} GETSETCONTEXT, *PGETSETCONTEXT;
// //
// Kernel Profile Object // Kernel Profile Object
// //
@ -1428,6 +1447,28 @@ typedef struct _KSERVICE_TABLE_DESCRIPTOR
PUCHAR Number; PUCHAR Number;
} KSERVICE_TABLE_DESCRIPTOR, *PKSERVICE_TABLE_DESCRIPTOR; } KSERVICE_TABLE_DESCRIPTOR, *PKSERVICE_TABLE_DESCRIPTOR;
#if (NTDDI_VERSION >= NTDDI_WIN8)
//
// Entropy Timing State
//
typedef struct _KENTROPY_TIMING_STATE
{
ULONG EntropyCount;
ULONG Buffer[64];
KDPC Dpc;
ULONG LastDeliveredBuffer;
PULONG RawDataBuffer;
} KENTROPY_TIMING_STATE, *PKENTROPY_TIMING_STATE;
//
// Constants from ks386.inc, ksamd64.inc and ksarm.h
//
#define KENTROPY_TIMING_INTERRUPTS_PER_BUFFER 0x400
#define KENTROPY_TIMING_BUFFER_MASK 0x7ff
#define KENTROPY_TIMING_ANALYSIS 0x0
#endif /* (NTDDI_VERSION >= NTDDI_WIN8) */
// //
// Exported Loader Parameter Block // Exported Loader Parameter Block
// //

View file

@ -1395,6 +1395,98 @@ typedef struct _RTL_USER_PROCESS_INFORMATION
SECTION_IMAGE_INFORMATION ImageInformation; SECTION_IMAGE_INFORMATION ImageInformation;
} RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION; } RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION;
#if (NTDDI_VERSION >= NTDDI_WIN7)
typedef enum _RTL_UMS_SCHEDULER_REASON
{
UmsSchedulerStartup = 0,
UmsSchedulerThreadBlocked = 1,
UmsSchedulerThreadYield = 2,
} RTL_UMS_SCHEDULER_REASON, *PRTL_UMS_SCHEDULER_REASON;
enum _RTL_UMSCTX_FLAGS
{
UMSCTX_SCHEDULED_THREAD_BIT = 0,
#if (NTDDI_VERSION < NTDDI_WIN8)
UMSCTX_HAS_QUANTUM_REQ_BIT,
UMSCTX_HAS_AFFINITY_REQ_BIT,
UMSCTX_HAS_PRIORITY_REQ_BIT,
#endif
UMSCTX_SUSPENDED_BIT,
UMSCTX_VOLATILE_CONTEXT_BIT,
UMSCTX_TERMINATED_BIT,
UMSCTX_DEBUG_ACTIVE_BIT,
UMSCTX_RUNNING_ON_SELF_THREAD_BIT
UMSCTX_DENY_RUNNING_ON_SELF_THREAD_BIT
} RTL_UMSCTX_FLAGS, *PRTL_UMSCTX_FLAGS;
#define UMSCTX_SCHEDULED_THREAD_MASK (1 << UMSCTX_SCHEDULED_THREAD_BIT)
#define UMSCTX_SUSPENDED_MASK (1 << UMSCTX_SUSPENDED_BIT)
#define UMSCTX_VOLATILE_CONTEXT_MASK (1 << UMSCTX_VOLATILE_CONTEXT_BIT)
#define UMSCTX_TERMINATED_MASK (1 << UMSCTX_TERMINATED_BIT)
#define UMSCTX_DEBUG_ACTIVE_MASK (1 << UMSCTX_DEBUG_ACTIVE_BIT)
#define UMSCTX_RUNNING_ON_SELF_THREAD_MASK (1 << UMSCTX_RUNNING_ON_SELF_THREAD_BIT)
#define UMSCTX_DENY_RUNNING_ON_SELF_THREAD_MASK (1 << UMSCTX_DENY_RUNNING_ON_SELF_THREAD_BIT)
//
// UMS Context
//
typedef struct DECLSPEC_ALIGN(16) _RTL_UMS_CONTEXT
{
SINGLE_LIST_ENTRY Link;
CONTEXT Context;
PVOID Teb;
PVOID UserContext;
union
{
struct
{
ULONG ScheduledThread : 1;
#if (NTDDI_VERSION < NTDDI_WIN8)
ULONG HasQuantumReq : 1;
ULONG HasAffinityReq : 1;
ULONG HasPriorityReq : 1;
#endif
ULONG Suspended : 1;
ULONG VolatileContext : 1;
ULONG Terminated : 1;
ULONG DebugActive : 1;
ULONG RunningOnSelfThread : 1;
ULONG DenyRunningOnSelfThread : 1;
#if (NTDDI_VERSION < NTDDI_WIN8)
ULONG ReservedFlags : 22;
#endif
};
LONG Flags;
};
union
{
struct
{
#if (NTDDI_VERSION >= NTDDI_WIN8)
ULONG64 KernelUpdateLock : 2;
#else
ULONG64 KernelUpdateLock : 1;
ULONG64 Reserved : 1;
#endif
ULONG64 PrimaryClientID : 62;
};
ULONG64 ContextLock;
};
#if (NTDDI_VERSION < NTDDI_WIN8)
ULONG64 QuantumValue;
GROUP_AFFINITY AffinityMask;
LONG Priority;
#endif
struct _RTL_UMS_CONTEXT* PrimaryUmsContext;
ULONG SwitchCount;
ULONG KernelYieldCount;
ULONG MixedYieldCount;
ULONG YieldCount;
} RTL_UMS_CONTEXT, *PRTL_UMS_CONTEXT;
#endif // #if (NTDDI_VERSION >= NTDDI_WIN7)
// //
// RTL Atom Table Structures // RTL Atom Table Structures
// //

View file

@ -396,8 +396,13 @@ KDDEBUGGER_DATA64 KdDebuggerDataBlock =
{(ULONG_PTR)RtlpBreakWithStatusInstruction}, {(ULONG_PTR)RtlpBreakWithStatusInstruction},
0, 0,
FIELD_OFFSET(KTHREAD, CallbackStack), FIELD_OFFSET(KTHREAD, CallbackStack),
#if defined(_M_ARM) || defined(_M_AMD64)
0,
0,
#else
FIELD_OFFSET(KCALLOUT_FRAME, CallbackStack), FIELD_OFFSET(KCALLOUT_FRAME, CallbackStack),
FIELD_OFFSET(KCALLOUT_FRAME, CBSTACK_FRAME_POINTER), FIELD_OFFSET(KCALLOUT_FRAME, CBSTACK_FRAME_POINTER),
#endif
FALSE, FALSE,
{(ULONG_PTR)KiCallUserMode}, {(ULONG_PTR)KiCallUserMode},
0, 0,

View file

@ -132,8 +132,7 @@ KiInitializeContextThread(IN PKTHREAD Thread,
StartFrame->P2Home = (ULONG64)StartContext; StartFrame->P2Home = (ULONG64)StartContext;
StartFrame->P3Home = 0; StartFrame->P3Home = 0;
StartFrame->P4Home = (ULONG64)SystemRoutine; StartFrame->P4Home = (ULONG64)SystemRoutine;
StartFrame->P5Home = 0; StartFrame->Reserved = 0;
} }
BOOLEAN BOOLEAN