Add a few definitions based on (Windows RT 8.1) symbol files, ks386.inc, ksamd64.inc, ksarm.inc and Windows 10 WDK (ntosp.h ftw!)

svn path=/trunk/; revision=67525
This commit is contained in:
Timo Kreuzer 2015-05-02 23:12:19 +00:00
parent 5b7d2dec59
commit e8cff2f3a5
9 changed files with 1069 additions and 323 deletions

View file

@ -34,12 +34,6 @@ Author:
#define KernelMode HEX(0)
#define UserMode HEX(1)
//
// CPU Types
//
#define CPU_INTEL HEX(1)
#define CPU_AMD HEX(2)
//
// KTSS Offsets
//

View file

@ -35,6 +35,17 @@ Author:
//#define KeGetPcr() ((volatile KPCR * const)__readfsdword(0x1C))
//#endif
//
// CPU Vendors
//
typedef enum
{
CPU_UNKNOWN,
CPU_AMD,
CPU_INTEL,
CPU_VIA
} CPU_VENDORS;
//
// Machine Types
//
@ -65,7 +76,7 @@ Author:
#define KGDT64_R3_CODE 0x0030
#define KGDT64_SYS_TSS 0x0040
#define KGDT64_R3_CMTEB 0x0050
#define KGDT64_R0_LDT 0x0060
//
// CR4
@ -81,6 +92,30 @@ Author:
#define CR4_FXSR 0x200
#define CR4_XMMEXCPT 0x400
#define CR4_CHANNELS 0x800
#define CR4_XSAVE 0x40000
//
// DR7
//
#define DR7_LEGAL 0xFFFF0355
#define DR7_ACTIVE 0x00000355
#define DR7_TRACE_BRANCH 0x00000200
#define DR7_LAST_BRANCH 0x00000100
//
// Debug flags
//
#define DEBUG_ACTIVE_DR7 0x0001
#define DEBUG_ACTIVE_INSTRUMENTED 0x0002
#define DEBUG_ACTIVE_DBG_INSTRUMENTED 0x0003
#define DEBUG_ACTIVE_MINIMAL_THREAD 0x0004
#define DEBUG_ACTIVE_PRIMARY_THREAD 0x0080
#define DEBUG_ACTIVE_PRIMARY_THREAD_BIT 0x0007
#define DEBUG_ACTIVE_PRIMARY_THREAD_LOCK_BIT 0x001F
#define DEBUG_ACTIVE_SCHEDULED_THREAD 0x0040
#define DEBUG_ACTIVE_SCHEDULED_THREAD_BIT 0x0006
#define DEBUG_ACTIVE_SCHEDULED_THREAD_LOCK_BIT 0x001E
#define DEBUG_ACTIVE_SCHEDULED_THREAD_LOCK 0x40000000
//
// EFlags
@ -104,17 +139,46 @@ Author:
#define EFLAGS_IF_MASK 0x0200
#define EFLAGS_IF_SHIFT 0x0009
//
// MXCSR Floating Control/Status Bit Masks
//
#define XSW_INVALID_OPERATION 0x0001
#define XSW_DENORMAL 0x0002
#define XSW_ZERO_DIVIDE 0x0004
#define XSW_OVERFLOW 0x0008
#define XSW_UNDERFLOW 0x0010
#define XSW_PRECISION 0x0020
#define XCW_INVALID_OPERATION 0x0080
#define XCW_DENORMAL 0x0100
#define XCW_ZERO_DIVIDE 0x0200
#define XCW_OVERFLOW 0x0400
#define XCW_UNDERFLOW 0x0800
#define XCW_PRECISION 0x1000
#define XCW_ROUND_CONTROL 0x6000
#define XCW_FLUSH_ZERO 0x8000
#define XSW_ERROR_MASK 0x003F
#define XSW_ERROR_SHIFT 7
//
// Legacy floating status word bit masks.
//
#define FSW_INVALID_OPERATION 0x0001
#define FSW_DENORMAL 0x0002
#define FSW_ZERO_DIVIDE 0x0004
#define FSW_OVERFLOW 0x0008
#define FSW_UNDERFLOW 0x0010
#define FSW_PRECISION 0x0020
#define FSW_STACK_FAULT 0x0040
#define FSW_ERROR_SUMMARY 0x0080
#define FSW_CONDITION_CODE_0 0x0100
#define FSW_CONDITION_CODE_1 0x0200
#define FSW_CONDITION_CODE_2 0x0400
#define FSW_CONDITION_CODE_3 0x4000
#define FSW_ERROR_MASK 0x003F
//
// Machine Specific Registers
//
#define MSR_MCG_STATUS 0x017A
#define MSR_DEGUG_CTL 0x01D9
#define MSR_LAST_BRANCH_FROM 0x01DB
#define MSR_LAST_BRANCH_TO 0x01DC
#define MSR_LAST_EXCEPTION_FROM 0x01DD
#define MSR_LAST_EXCEPTION_TO 0x01DE
#define MSR_PAT 0x0277
#define MSR_AMD_ACCESS 0x9C5A203A
#define MSR_EFER 0xC0000080
#define MSR_STAR 0xC0000081
#define MSR_LSTAR 0xC0000082
@ -123,6 +187,13 @@ Author:
#define MSR_FS_BASE 0xC0000100
#define MSR_GS_BASE 0xC0000101
#define MSR_GS_SWAP 0xC0000102
#define MSR_MCG_STATUS 0x017A
#define MSR_AMD_ACCESS 0x9C5A203A
#define MSR_IA32_MISC_ENABLE 0x01A0
#define MSR_LAST_BRANCH_FROM 0x01DB
#define MSR_LAST_BRANCH_TO 0x01DC
#define MSR_LAST_EXCEPTION_FROM 0x01DD
#define MSR_LAST_EXCEPTION_TO 0x01DE
//
// Caching values for the PAT MSR
@ -137,10 +208,23 @@ Author:
//
// Flags in MSR_EFER
//
#define MSR_LMA 0x0400
#define MSR_LME 0x0100
#define MSR_SCE 0x0001
#define MSR_LME 0x0100
#define MSR_LMA 0x0400
#define MSR_NXE 0x0800
#define MSR_PAT 0x0277
#define MSR_DEBUG_CTL 0x01D9
//
// Flags in MSR_IA32_MISC_ENABLE
//
#define MSR_XD_ENABLE_MASK 0xFFFFFFFB
//
// Flags in MSR_DEBUG_CTL
//
#define MSR_DEBUG_CTL_LBR equ 0x0001
#define MSR_DEBUG_CTL_BTF equ 0x0002
//
// IPI Types
@ -158,6 +242,13 @@ Author:
#define PRCB_BUILD_DEBUG 1
#define PRCB_BUILD_UNIPROCESSOR 2
//
// Exception active flags
//
#define KEXCEPTION_ACTIVE_INTERRUPT_FRAME 0x0000
#define KEXCEPTION_ACTIVE_EXCEPTION_FRAME 0x0001
#define KEXCEPTION_ACTIVE_SERVICE_FRAME 0x0002
//
// HAL Variables
//
@ -188,12 +279,28 @@ Author:
#define SYNCH_LEVEL 12
#define NMI_STACK_SIZE 0x2000
#define ISR_STACK_SIZE 0x6000
//
// Number of pool lookaside lists per pool in the PRCB
//
#define NUMBER_POOL_LOOKASIDE_LISTS 32
//
// Structure for CPUID
//
typedef union _CPU_INFO
{
UINT32 AsUINT32[4];
struct
{
ULONG Eax;
ULONG Ebx;
ULONG Ecx;
ULONG Edx;
};
} CPU_INFO, *PCPU_INFO;
//
// Trap Frame Definition
//
@ -283,23 +390,6 @@ typedef struct _KTRAP_FRAME
LONG CodePatchCycle;
} KTRAP_FRAME, *PKTRAP_FRAME;
//
// Defines the Callback Stack Layout for User Mode Callbacks
//
typedef struct _KCALLOUT_FRAME
{
ULONG64 InitialStack;
ULONG64 TrapFrame;
ULONG64 CallbackStack;
ULONG64 Rdi;
ULONG64 Rsi;
ULONG64 Rbx;
ULONG64 Rbp;
ULONG64 ReturnAddress;
ULONG64 Result;
ULONG64 ResultLength;
} KCALLOUT_FRAME, *PKCALLOUT_FRAME;
//
// Dummy LDT_ENTRY
//
@ -404,33 +494,33 @@ typedef struct _KDESCRIPTOR
//
typedef struct _KSPECIAL_REGISTERS
{
UINT64 Cr0;
UINT64 Cr2;
UINT64 Cr3;
UINT64 Cr4;
UINT64 KernelDr0;
UINT64 KernelDr1;
UINT64 KernelDr2;
UINT64 KernelDr3;
UINT64 KernelDr6;
UINT64 KernelDr7;
struct _KDESCRIPTOR Gdtr;
struct _KDESCRIPTOR Idtr;
ULONG64 Cr0;
ULONG64 Cr2;
ULONG64 Cr3;
ULONG64 Cr4;
ULONG64 KernelDr0;
ULONG64 KernelDr1;
ULONG64 KernelDr2;
ULONG64 KernelDr3;
ULONG64 KernelDr6;
ULONG64 KernelDr7;
KDESCRIPTOR Gdtr;
KDESCRIPTOR Idtr;
USHORT Tr;
USHORT Ldtr;
ULONG MxCsr;
UINT64 DebugControl;
UINT64 LastBranchToRip;
UINT64 LastBranchFromRip;
UINT64 LastExceptionToRip;
UINT64 LastExceptionFromRip;
UINT64 Cr8;
UINT64 MsrGsBase;
UINT64 MsrGsSwap;
UINT64 MsrStar;
UINT64 MsrLStar;
UINT64 MsrCStar;
UINT64 MsrSyscallMask;
ULONG64 DebugControl;
ULONG64 LastBranchToRip;
ULONG64 LastBranchFromRip;
ULONG64 LastExceptionToRip;
ULONG64 LastExceptionFromRip;
ULONG64 Cr8;
ULONG64 MsrGsBase;
ULONG64 MsrGsSwap;
ULONG64 MsrStar;
ULONG64 MsrLStar;
ULONG64 MsrCStar;
ULONG64 MsrSyscallMask;
} KSPECIAL_REGISTERS, *PKSPECIAL_REGISTERS;
//
@ -756,8 +846,7 @@ typedef struct _KPRCB
CACHE_DESCRIPTOR Cache[5];
ULONG CacheCount;
#endif
}
KPRCB, *PKPRCB;
} KPRCB, *PKPRCB;
//
// Processor Control Region
@ -837,12 +926,12 @@ typedef struct _KTSS64
//
typedef struct _KEXCEPTION_FRAME
{
UINT64 P1Home;
UINT64 P2Home;
UINT64 P3Home;
UINT64 P4Home;
UINT64 P5;
UINT64 InitialStack;
ULONG64 P1Home;
ULONG64 P2Home;
ULONG64 P3Home;
ULONG64 P4Home;
ULONG64 P5;
ULONG64 Spare1;
M128A Xmm6;
M128A Xmm7;
M128A Xmm8;
@ -853,22 +942,55 @@ typedef struct _KEXCEPTION_FRAME
M128A Xmm13;
M128A Xmm14;
M128A Xmm15;
UINT64 TrapFrame;
UINT64 CallbackStack;
UINT64 OutputBuffer;
UINT64 OutputLength;
UINT64 MxCsr;
UINT64 Rbp;
UINT64 Rbx;
UINT64 Rdi;
UINT64 Rsi;
UINT64 R12;
UINT64 R13;
UINT64 R14;
UINT64 R15;
UINT64 Return;
ULONG64 TrapFrame;
//ULONG64 CallbackStack;
ULONG64 OutputBuffer;
ULONG64 OutputLength;
ULONG64 Spare2;
ULONG64 MxCsr;
ULONG64 Rbp;
ULONG64 Rbx;
ULONG64 Rdi;
ULONG64 Rsi;
ULONG64 R12;
ULONG64 R13;
ULONG64 R14;
ULONG64 R15;
ULONG64 Return;
} KEXCEPTION_FRAME, *PKEXCEPTION_FRAME;
typedef struct _MACHINE_FRAME
{
ULONG64 Rip;
USHORT SegCs;
USHORT Fill1[3];
ULONG EFlags;
ULONG Fill2;
ULONG64 Rsp;
USHORT SegSs;
USHORT Fill3[3];
} MACHINE_FRAME, *PMACHINE_FRAME;
//
// Defines the Callback Stack Layout for User Mode Callbacks
//
typedef KEXCEPTION_FRAME KCALLOUT_FRAME, PKCALLOUT_FRAME;
//
// User side callout frame
//
typedef struct _UCALLOUT_FRAME
{
ULONG64 P1Home;
ULONG64 P2Home;
ULONG64 P3Home;
ULONG64 P4Home;
PVOID Buffer;
ULONG Length;
ULONG ApiNumber;
MACHINE_FRAME MachineFrame;
} UCALLOUT_FRAME, *PUCALLOUT_FRAME; // size = 0x0058
typedef struct _DISPATCHER_CONTEXT
{
ULONG64 ControlPc;
@ -883,14 +1005,13 @@ typedef struct _DISPATCHER_CONTEXT
ULONG ScopeIndex;
} DISPATCHER_CONTEXT, *PDISPATCHER_CONTEXT;
typedef struct _KSTART_FRAME
{
ULONG64 P1Home;
ULONG64 P2Home;
ULONG64 P3Home;
ULONG64 P4Home;
ULONG64 P5Home;
ULONG64 Reserved;
ULONG64 Return;
} KSTART_FRAME, *PKSTART_FRAME;
@ -901,11 +1022,31 @@ typedef struct _KSWITCH_FRAME
ULONG64 P3Home;
ULONG64 P4Home;
ULONG64 P5Home;
ULONG64 ApcBypass;
KIRQL ApcBypass;
UCHAR Fill1[7];
ULONG64 Rbp;
ULONG64 Return;
} KSWITCH_FRAME, *PKSWITCH_FRAME;
#define PROCESSOR_START_FLAG_FORCE_ENABLE_NX 0x0001
typedef struct _KPROCESSOR_START_BLOCK
{
ULONG CompletionFlag; // 0x0004
ULONG Flags; // 0x0008
ULONG Gdt32; // 0x000C
ULONG Idt32; // 0x0012
PVOID Gdt; // 0x0018
// ???
ULONG64 TiledMemoryMap; // 0x0058
UCHAR PmTarget[6]; // 0x0060
UCHAR LmIdentityTarget[6]; // 0x0066
ULONG64 LmTarget; // 0x0070
struct _KPROCESSOR_START_BLOCK *SelfMap; // 0x0078
ULONG64 MsrPat; // 0x0080
ULONG64 MsrEFER; // 0x0088
KPROCESSOR_STATE ProcessorState; // 0x0090
} KPROCESSOR_START_BLOCK, *PKPROCESSOR_START_BLOCK; // size 00640
//
// Inline function to get current KPRCB
//

View file

@ -13,6 +13,7 @@ Abstract:
Author:
Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
Timo Kreuzer (timo.kreuzer@reactos.org) - Updated 19-Apr-2015
--*/
@ -27,19 +28,85 @@ extern "C" {
// Dependencies
//
#define SYNCH_LEVEL DISPATCH_LEVEL
//
// CPSR Values
//
#define CPSR_THUMB_ENABLE 0x20
#define CPSR_FIQ_DISABLE 0x40
#define CPSR_IRQ_DISABLE 0x80
#define CPSR_USER_MODE 0x10
#define CPSR_FIQ_MODE 0x11
#define CPSR_IRQ_MODE 0x12
#define CPSR_SVC_MODE 0x13
#define CPSR_ABORT_MODE 0x17
#define CPSR_UND_MODE 0x1B
#define CPSR_MODES 0x1F
#define CPSRM_USER 0x10
#define CPSRM_FIQ 0x11
#define CPSRM_INT 0x12
#define CPSRM_SVC 0x13
#define CPSRM_ABT 0x17
#define CPSRM_UDF 0x1b
#define CPSRM_SYS 0x1f
#define CPSRM_MASK 0x1f
#define SYSCALL_PSR 0x30
#define CPSRF_N 0x80000000
#define CPSRF_Z 0x40000000
#define CPSRF_C 0x20000000
#define CPSRF_V 0x10000000
#define CPSRF_Q 0x08000000
#define CPSR_IT_MASK 0x600fc00
#define FPSCRF_N 0x80000000
#define FPSCRF_Z 0x40000000
#define FPSCRF_C 0x20000000
#define FPSCRF_V 0x10000000
#define FPSCRF_QC 0x08000000
#define FPSCRM_AHP 0x4000000
#define FPSCRM_DN 0x2000000
#define FPSCRM_FZ 0x1000000
#define FPSCRM_RMODE_MASK 0xc00000
#define FPSCRM_RMODE_RN 0x0
#define FPSCRM_RMODE_RP 0x400000
#define FPSCRM_RMODE_RM 0x800000
#define FPSCRM_RMODE_RZ 0xc00000
#define FPSCRM_DEPRECATED 0x370000
#define FPSCR_IDE 0x8000
#define FPSCR_IXE 0x1000
#define FPSCR_UFE 0x800
#define FPSCR_OFE 0x400
#define FPSCR_DZE 0x200
#define FPSCR_IOE 0x100
#define FPSCR_IDC 0x80
#define FPSCR_IXC 0x10
#define FPSCR_UFC 0x8
#define FPSCR_OFC 0x4
#define FPSCR_DZC 0x2
#define FPSCR_IOC 0x1
#define CPSRC_INT 0x80
#define CPSRC_ABORT 0x100
#define CPSRC_THUMB 0x20
#define SWFS_PAGE_FAULT 0x10
#define SWFS_ALIGN_FAULT 0x20
#define SWFS_HWERR_FAULT 0x40
#define SWFS_DEBUG_FAULT 0x80
#define SWFS_EXECUTE 0x8
#define SWFS_WRITE 0x1
#define CP14_DBGDSCR_MOE_MASK 0x3c
#define CP14_DBGDSCR_MOE_SHIFT 0x2
#define CP14_DBGDSCR_MOE_HALT 0x0
#define CP14_DBGDSCR_MOE_BP 0x1
#define CP14_DBGDSCR_MOE_WPASYNC 0x2
#define CP14_DBGDSCR_MOE_BKPT 0x3
#define CP14_DBGDSCR_MOE_EXTERNAL 0x4
#define CP14_DBGDSCR_MOE_VECTOR 0x5
#define CP14_DBGDSCR_MOE_WPSYNC 0xa
#define CP15_PMCR_DP 0x20
#define CP15_PMCR_X 0x10
#define CP15_PMCR_CLKCNT_DIV 0x8
#define CP15_PMCR_CLKCNT_RST 0x4
#define CP15_PMCR_CNT_RST 0x2
#define CP15_PMCR_ENABLE 0x1
//
// C1 Register Values
@ -56,7 +123,7 @@ extern "C" {
#define IPI_APC 1
#define IPI_DPC 2
#define IPI_FREEZE 4
#define IPI_PACKET_READY 8
#define IPI_PACKET_READY 6
#define IPI_SYNCH_REQUEST 16
//
@ -86,70 +153,118 @@ extern "C" {
//
#define NUMBER_POOL_LOOKASIDE_LISTS 32
//
// ARM VFP State
// Based on Windows RT 8.1 symbols and ksarm.h
//
typedef struct _KARM_VFP_STATE
{
struct _KARM_VFP_STATE* Link; // 0x00
ULONG Fpscr; // 0x04
ULONG Reserved; // 0x08
ULONG Reserved2; // 0x0c
ULONGLONG VfpD[32]; // 0x10
} KARM_VFP_STATE, *PKARM_VFP_STATE; // size = 0x110
//
// Trap Frame Definition
// Based on Windows RT 8.1 symbols and ksarm.h
//
typedef struct _KTRAP_FRAME
{
ULONG DbgArgMark;
ULONG Arg3;
ULONG FaultStatus;
union
{
ULONG FaultAddress;
ULONG TrapFrame;
};
ULONG Reserved;
BOOLEAN ExceptionActive;
BOOLEAN ContextFromKFramesUnwound;
BOOLEAN DebugRegistersValid;
union
{
CHAR PreviousMode;
KIRQL PreviousIrql;
};
PKARM_VFP_STATE VfpState;
ULONG Bvr[8];
ULONG Bcr[8];
ULONG Wvr[1];
ULONG Wcr[1];
ULONG R0;
ULONG R1;
ULONG R2;
ULONG R3;
ULONG R4;
ULONG R5;
ULONG R6;
ULONG R7;
ULONG R8;
ULONG R9;
ULONG R10;
ULONG R11;
ULONG R12;
ULONG UserSp;
ULONG UserLr;
ULONG SvcSp;
ULONG SvcLr;
ULONG Sp;
ULONG Lr;
ULONG R11;
ULONG Pc;
ULONG Spsr;
ULONG OldIrql;
ULONG PreviousMode;
ULONG PreviousTrapFrame;
ULONG Cpsr;
} KTRAP_FRAME, *PKTRAP_FRAME;
//
// Defines the Callback Stack Layout for User Mode Callbacks
//
// Just a stub with some required members for now
//
typedef struct _KCALLOUT_FRAME
{
ULONG CallbackStack;
ULONG DummyFramePointer;
} KCALLOUT_FRAME, *PKCALLOUT_FRAME;
#ifndef NTOS_MODE_USER
//
// Exception Frame Definition
// FIXME: this should go into ntddk.h
//
typedef struct _KEXCEPTION_FRAME
{
// ULONG R0;
// ULONG R1;
// ULONG R2;
// ULONG R3;
ULONG R4;
ULONG R5;
ULONG R6;
ULONG R7;
ULONG R8;
ULONG R9;
ULONG R10;
ULONG R11;
// ULONG R12;
ULONG Lr;
ULONG Psr;
} KEXCEPTION_FRAME, *PKEXCEPTION_FRAME;
ULONG Param5; // 0x00
ULONG TrapFrame; // 0x04
ULONG OutputBuffer; // 0x08
ULONG OutputLength; // 0x0c
ULONG Pad; // 0x04
ULONG R4; // 0x14
ULONG R5; // 0x18
ULONG R6; // 0x1c
ULONG R7; // 0x20
ULONG R8; // 0x24
ULONG R9; // 0x28
ULONG R10; // 0x2c
ULONG R11; // 0x30
ULONG Return; // 0x34
} KEXCEPTION_FRAME, *PKEXCEPTION_FRAME; // size = 0x38
//
// ARM Architecture State
// Based on Windows RT 8.1 symbols and ksarm.h
//
typedef struct _KARM_ARCH_STATE
{
ULONG Cp15_Cr0_CpuId;
ULONG Cp15_Cr1_Control;
ULONG Cp15_Cr1_AuxControl;
ULONG Cp15_Cr1_Cpacr;
ULONG Cp15_Cr2_TtbControl;
ULONG Cp15_Cr2_Ttb0;
ULONG Cp15_Cr2_Ttb1;
ULONG Cp15_Cr3_Dacr;
ULONG Cp15_Cr5_Dfsr;
ULONG Cp15_Cr5_Ifsr;
ULONG Cp15_Cr6_Dfar;
ULONG Cp15_Cr6_Ifar;
ULONG Cp15_Cr9_PmControl;
ULONG Cp15_Cr9_PmCountEnableSet;
ULONG Cp15_Cr9_PmCycleCounter;
ULONG Cp15_Cr9_PmEventCounter[31];
ULONG Cp15_Cr9_PmEventType[31];
ULONG Cp15_Cr9_PmInterruptSelect;
ULONG Cp15_Cr9_PmOverflowStatus;
ULONG Cp15_Cr9_PmSelect;
ULONG Cp15_Cr9_PmUserEnable;
ULONG Cp15_Cr10_PrimaryMemoryRemap;
ULONG Cp15_Cr10_NormalMemoryRemap;
ULONG Cp15_Cr12_VBARns;
ULONG Cp15_Cr13_ContextId;
} KARM_ARCH_STATE, *PKARM_ARCH_STATE;
///
/// "Custom" definition start
///
//
// ARM Internal Registers
@ -314,164 +429,442 @@ typedef enum _ARM_DOMAINS
Domain15
} ARM_DOMAINS;
///
/// "Custom" definition end
///
//
// Special Registers Structure (outside of CONTEXT)
// Based on Windows RT 8.1 symbols and ksarm.h
//
typedef struct _KSPECIAL_REGISTERS
{
ARM_CONTROL_REGISTER ControlRegister;
ARM_LOCKDOWN_REGISTER LockdownRegister;
ARM_CACHE_REGISTER CacheRegister;
ARM_STATUS_REGISTER StatusRegister;
ULONG Reserved[7]; // 0x00
ULONG Cp15_Cr13_UsrRW; // 0x1c
ULONG Cp15_Cr13_UsrRO; // 0x20
ULONG Cp15_Cr13_SvcRW; // 0x24
ULONG KernelBvr[8]; // 0x28
ULONG KernelBcr[8]; // 0x48
ULONG KernelWvr[1]; // 0x68
ULONG KernelWcr[1]; // 0x6c
ULONG Fpexc; // 0x70
ULONG Fpinst; // 0x74
ULONG Fpinst2; // 0x78
ULONG UserSp; // 0x7c
ULONG UserLr; // 0x80
ULONG AbortSp; // 0x84
ULONG AbortLr; // 0x88
ULONG AbortSpsr; // 0x8c
ULONG UdfSp; // 0x90
ULONG UdfLr; // 0x94
ULONG UdfSpsr; // 0x98
ULONG IrqSp; // 0x9c
ULONG IrqLr; // 0xa0
ULONG IrqSpsr; // 0xa4
} KSPECIAL_REGISTERS, *PKSPECIAL_REGISTERS;
//
// Processor State
// Based on Windows RT 8.1 symbols and ksarm.h
//
typedef struct _KPROCESSOR_STATE
{
struct _CONTEXT ContextFrame;
struct _KSPECIAL_REGISTERS SpecialRegisters;
KSPECIAL_REGISTERS SpecialRegisters; // 0x000
KARM_ARCH_STATE ArchState; // 0x0a8
CONTEXT ContextFrame; // 0x200
} KPROCESSOR_STATE, *PKPROCESSOR_STATE;
C_ASSERT(sizeof(KPROCESSOR_STATE) == 0x3a0);
//
// ARM Mini Stack
// Based on Windows RT 8.1 symbols and ksarm.h
//
typedef struct _KARM_MINI_STACK
{
ULONG Pc;
ULONG Cpsr;
ULONG R4;
ULONG R5;
ULONG R6;
ULONG R7;
ULONG Reserved[2];
} KARM_MINI_STACK, *PKARM_MINI_STACK; // size = 0x20
typedef struct _DISPATCHER_CONTEXT
{
ULONG ControlPc; // 0x0
PVOID ImageBase; // 0x4
PVOID FunctionEntry; // 0x8
PVOID EstablisherFrame; // 0xc
ULONG TargetPc; // 0x10
PVOID ContextRecord; // 0x14
PVOID LanguageHandler; // 0x18
PVOID HandlerData; // 0x1c
PVOID HistoryTable; // 0x20
ULONG ScopeIndex; // 0x24
ULONG ControlPcIsUnwound; // 0x28
PVOID NonVolatileRegisters; // 0x2c
ULONG Reserved; // 0x30
} DISPATCHER_CONTEXT, *PDISPATCHER_CONTEXT;
//
// Machine Frame
// Based on ksarm.h
//
typedef struct _MACHINE_FRAME
{
ULONG Sp;
ULONG Pc;
} MACHINE_FRAME, *PMACHINE_FRAME;
//
// Defines the Callback Stack Layout for User Mode Callbacks
//
typedef KEXCEPTION_FRAME KCALLOUT_FRAME, PKCALLOUT_FRAME;
//
// User mode callout frame
//
typedef struct _UCALLOUT_FRAME
{
PVOID Buffer;
ULONG Length;
ULONG ApiNumber;
ULONG OriginalLr;
MACHINE_FRAME MachineFrame;
} UCALLOUT_FRAME, *PUCALLOUT_FRAME;
typedef struct _KSTART_FRAME
{
ULONG R0;
ULONG R1;
ULONG R2;
ULONG Return;
} KSTART_FRAME, *PKSTART_FRAME;
typedef struct _KSWITCH_FRAME
{
KIRQL ApcBypass;
UCHAR Fill[7];
ULONG R11;
ULONG Return;
} KSWITCH_FRAME, *PKSWITCH_FRAME;
//
// Cache types
// (These are made up constants!)
//
enum _ARM_CACHE_TYPES
{
FirstLevelDcache = 0,
SecondLevelDcache = 1,
FirstLevelIcache = 2,
SecondLevelIcache = 3,
GlobalDcache = 4,
GlobalIcache = 5
};
#if (NTDDI_VERSION < NTDDI_LONGHORN)
#define GENERAL_LOOKASIDE_POOL PP_LOOKASIDE_LIST
#endif
//
// Processor Region Control Block
// Based on Windows RT 8.1 symbols
//
typedef struct _KPRCB
{
UCHAR LegacyNumber;
UCHAR ReservedMustBeZero;
UCHAR IdleHalt;
PKTHREAD CurrentThread;
PKTHREAD NextThread;
PKTHREAD IdleThread;
UCHAR NestingLevel;
UCHAR ClockOwner;
union
{
UCHAR PendingTickFlags;
struct
{
UCHAR PendingTick : 1;
UCHAR PendingBackupTick : 1;
};
};
UCHAR PrcbPad00[1];
ULONG Number;
ULONG PrcbLock;
PCHAR PriorityState;
KPROCESSOR_STATE ProcessorState;
USHORT ProcessorModel;
USHORT ProcessorRevision;
ULONG MHz;
UINT64 CycleCounterFrequency;
ULONG HalReserved[15];
USHORT MinorVersion;
USHORT MajorVersion;
struct _KTHREAD *CurrentThread;
struct _KTHREAD *NextThread;
struct _KTHREAD *IdleThread;
UCHAR Number;
UCHAR Reserved;
USHORT BuildType;
KAFFINITY SetMember;
UCHAR CpuType;
UCHAR CpuID;
USHORT CpuStep;
KPROCESSOR_STATE ProcessorState;
ULONG KernelReserved[16];
ULONG HalReserved[16];
UCHAR PrcbPad0[92];
KSPIN_LOCK_QUEUE LockQueue[LockQueueMaximumLock];
struct _KTHREAD *NpxThread;
ULONG InterruptCount;
ULONG KernelTime;
ULONG UserTime;
ULONG DpcTime;
ULONG DebugDpcTime;
ULONG InterruptTime;
ULONG AdjustDpcThreshold;
ULONG PageColor;
UCHAR SkipTick;
UCHAR DebuggerSavedIRQL;
UCHAR NodeColor;
UCHAR Spare1;
ULONG NodeShiftedColor;
struct _KNODE *ParentNode;
ULONG MultiThreadProcessorSet;
struct _KPRCB *MultiThreadSetMaster;
ULONG SecondaryColorMask;
LONG Sleeping;
UCHAR BuildType;
UCHAR CpuVendor;
UCHAR CoresPerPhysicalProcessor;
UCHAR LogicalProcessorsPerCore;
PVOID AcpiReserved;
ULONG GroupSetMember;
UCHAR Group;
UCHAR GroupIndex;
//UCHAR _PADDING1_[0x62];
KSPIN_LOCK_QUEUE DECLSPEC_ALIGN(128) LockQueue[17];
UCHAR ProcessorVendorString[2];
UCHAR _PADDING2_[0x2];
ULONG FeatureBits;
ULONG MaxBreakpoints;
ULONG MaxWatchpoints;
PCONTEXT Context;
ULONG ContextFlagsInit;
//UCHAR _PADDING3_[0x60];
PP_LOOKASIDE_LIST DECLSPEC_ALIGN(128) PPLookasideList[16];
LONG PacketBarrier;
SINGLE_LIST_ENTRY DeferredReadyListHead;
LONG MmPageFaultCount;
LONG MmCopyOnWriteCount;
LONG MmTransitionCount;
LONG MmDemandZeroCount;
LONG MmPageReadCount;
LONG MmPageReadIoCount;
LONG MmDirtyPagesWriteCount;
LONG MmDirtyWriteIoCount;
LONG MmMappedPagesWriteCount;
LONG MmMappedWriteIoCount;
ULONG KeSystemCalls;
ULONG KeContextSwitches;
ULONG CcFastReadNoWait;
ULONG CcFastReadWait;
ULONG CcFastReadNotPossible;
ULONG CcCopyReadNoWait;
ULONG CcCopyReadWait;
ULONG CcCopyReadNoWaitMiss;
ULONG KeAlignmentFixupCount;
ULONG SpareCounter0;
ULONG KeDcacheFlushCount;
ULONG KeExceptionDispatchCount;
ULONG KeFirstLevelTbFills;
ULONG KeFloatingEmulationCount;
ULONG KeIcacheFlushCount;
ULONG KeSecondLevelTbFills;
ULONG KeSystemCalls;
volatile ULONG IoReadOperationCount;
volatile ULONG IoWriteOperationCount;
volatile ULONG IoOtherOperationCount;
LONG LookasideIrpFloat;
LONG IoReadOperationCount;
LONG IoWriteOperationCount;
LONG IoOtherOperationCount;
LARGE_INTEGER IoReadTransferCount;
LARGE_INTEGER IoWriteTransferCount;
LARGE_INTEGER IoOtherTransferCount;
ULONG SpareCounter1[8];
PP_LOOKASIDE_LIST PPLookasideList[16];
PP_LOOKASIDE_LIST PPNPagedLookasideList[32];
PP_LOOKASIDE_LIST PPPagedLookasideList[32];
volatile ULONG PacketBarrier;
volatile ULONG ReverseStall;
PVOID IpiFrame;
UCHAR PrcbPad2[52];
volatile PVOID CurrentPacket[3];
volatile ULONG TargetSet;
volatile PKIPI_WORKER WorkerRoutine;
volatile ULONG IpiFrozen;
UCHAR PrcbPad3[40];
volatile ULONG RequestSummary;
volatile struct _KPRCB *SignalDone;
UCHAR PrcbPad4[56];
struct _KDPC_DATA DpcData[2];
UCHAR _PADDING4_[0x8];
struct _REQUEST_MAILBOX* Mailbox;
LONG TargetCount;
ULONG IpiFrozen;
ULONG RequestSummary;
KDPC_DATA DpcData[2];
PVOID DpcStack;
ULONG MaximumDpcQueueDepth;
PVOID SpBase;
LONG MaximumDpcQueueDepth;
ULONG DpcRequestRate;
ULONG MinimumDpcRate;
ULONG DpcLastCount;
UCHAR ThreadDpcEnable;
UCHAR QuantumEnd;
UCHAR DpcRoutineActive;
UCHAR IdleSchedule;
#if (NTDDI_VERSION >= NTDDI_WIN8)
union
{
LONG DpcRequestSummary;
SHORT DpcRequestSlot[2];
struct
{
SHORT NormalDpcState;
SHORT ThreadDpcState;
};
struct
{
ULONG DpcNormalProcessingActive : 1;
ULONG DpcNormalProcessingRequested : 1;
ULONG DpcNormalThreadSignal : 1;
ULONG DpcNormalTimerExpiration : 1;
ULONG DpcNormalDpcPresent : 1;
ULONG DpcNormalLocalInterrupt : 1;
ULONG DpcNormalSpare : 10;
ULONG DpcThreadActive : 1;
ULONG DpcThreadRequested : 1;
ULONG DpcThreadSpare : 14;
};
};
#else
LONG DpcSetEventRequest;
#endif
ULONG LastTimerHand;
ULONG LastTick;
ULONG ClockInterrupts;
ULONG ReadyScanTick;
ULONG PrcbPad10[1];
ULONG InterruptLastCount;
ULONG InterruptRate;
UCHAR _PADDING5_[0x4];
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
KGATE DpcGate;
#else
KEVENT DpcEvent;
#endif
ULONG MPAffinity;
KDPC CallDpc;
LONG ClockKeepAlive;
UCHAR ClockCheckSlot;
UCHAR ClockPollCycle;
//UCHAR _PADDING6_[0x2];
LONG DpcWatchdogPeriod;
LONG DpcWatchdogCount;
LONG KeSpinLockOrdering;
UCHAR _PADDING7_[0x38];
LIST_ENTRY WaitListHead;
ULONG WaitLock;
ULONG ReadySummary;
LONG AffinitizedSelectionMask;
ULONG QueueIndex;
KDPC TimerExpirationDpc;
//RTL_RB_TREE ScbQueue;
LIST_ENTRY ScbList;
UCHAR _PADDING8_[0x38];
LIST_ENTRY DispatcherReadyListHead[32];
ULONG InterruptCount;
ULONG KernelTime;
ULONG UserTime;
ULONG DpcTime;
ULONG InterruptTime;
ULONG AdjustDpcThreshold;
UCHAR SkipTick;
UCHAR DebuggerSavedIRQL;
UCHAR PollSlot;
UCHAR GroupSchedulingOverQuota;
ULONG DpcTimeCount;
ULONG DpcTimeLimit;
ULONG PeriodicCount;
ULONG PeriodicBias;
ULONG AvailableTime;
ULONG ScbOffset;
ULONG KeExceptionDispatchCount;
struct _KNODE* ParentNode;
UCHAR _PADDING9_[0x4];
ULONG64 AffinitizedCycles;
ULONG64 StartCycles;
ULONG64 GenerationTarget;
ULONG64 CycleCounterHigh;
#if (NTDDI_VERSION >= NTDDI_WIN8)
KENTROPY_TIMING_STATE EntropyTimingState;
#endif /* (NTDDI_VERSION >= NTDDI_WIN8) */
LONG MmSpinLockOrdering;
ULONG PageColor;
ULONG NodeColor;
ULONG NodeShiftedColor;
ULONG SecondaryColorMask;
ULONG64 CycleTime;
UCHAR _PADDING10_[0x58];
ULONG CcFastMdlReadNoWait;
ULONG CcFastMdlReadWait;
ULONG CcFastMdlReadNotPossible;
ULONG CcMapDataNoWait;
ULONG CcMapDataWait;
ULONG CcPinMappedDataCount;
ULONG CcPinReadNoWait;
ULONG CcPinReadWait;
ULONG CcMdlReadNoWait;
ULONG CcMdlReadWait;
ULONG CcLazyWriteHotSpots;
ULONG CcLazyWriteIos;
ULONG CcLazyWritePages;
ULONG CcDataFlushes;
ULONG CcDataPages;
ULONG CcLostDelayedWrites;
ULONG CcFastReadResourceMiss;
ULONG CcCopyReadWaitMiss;
ULONG CcFastMdlReadResourceMiss;
ULONG CcMapDataNoWaitMiss;
ULONG CcMapDataWaitMiss;
ULONG CcPinReadNoWaitMiss;
ULONG CcPinReadWaitMiss;
ULONG CcMdlReadNoWaitMiss;
ULONG CcMdlReadWaitMiss;
ULONG CcReadAheadIos;
LONG MmCacheTransitionCount;
LONG MmCacheReadCount;
LONG MmCacheIoCount;
UCHAR _PADDING11_[0xC];
PROCESSOR_POWER_STATE PowerState;
ULONG SharedReadyQueueOffset;
ULONG PrcbPad15[2];
ULONG DeviceInterrupts;
PVOID IsrDpcStats;
ULONG KeAlignmentFixupCount;
KDPC DpcWatchdogDpc;
KTIMER DpcWatchdogTimer;
SLIST_HEADER InterruptObjectPool;
//KAFFINITY_EX PackageProcessorSet;
UCHAR _PADDING12_[0x4];
ULONG SharedReadyQueueMask;
struct _KSHARED_READY_QUEUE* SharedReadyQueue;
ULONG CoreProcessorSet;
ULONG ScanSiblingMask;
ULONG LLCMask;
ULONG CacheProcessorMask[5];
ULONG ScanSiblingIndex;
CACHE_DESCRIPTOR Cache[6];
UCHAR CacheCount;
UCHAR PrcbPad20[3];
ULONG CachedCommit;
ULONG CachedResidentAvailable;
PVOID HyperPte;
PVOID WheaInfo;
PVOID EtwSupport;
UCHAR _PADDING13_[0x74];
SYNCH_COUNTERS SynchCounters;
//FILESYSTEM_DISK_COUNTERS FsCounters;
UCHAR _PADDING14_[0x8];
KARM_MINI_STACK FiqMiniStack;
KARM_MINI_STACK IrqMiniStack;
KARM_MINI_STACK UdfMiniStack;
KARM_MINI_STACK AbtMiniStack;
KARM_MINI_STACK PanicMiniStack;
ULONG PanicStackBase;
PVOID IsrStack;
ULONG PteBitCache;
ULONG PteBitOffset;
KTIMER_TABLE TimerTable;
GENERAL_LOOKASIDE_POOL PPNxPagedLookasideList[32];
GENERAL_LOOKASIDE_POOL PPNPagedLookasideList[32];
GENERAL_LOOKASIDE_POOL PPPagedLookasideList[32];
SINGLE_LIST_ENTRY AbSelfIoBoostsList;
SINGLE_LIST_ENTRY AbPropagateBoostsList;
KDPC AbDpc;
UCHAR _PADDING15_[0x58];
//REQUEST_MAILBOX RequestMailbox[1];
// FIXME: Oldstyle stuff
#if (NTDDI_VERSION < NTDDI_WIN8) // FIXME
UCHAR CpuType;
volatile UCHAR DpcInterruptRequested;
volatile UCHAR DpcThreadRequested;
volatile UCHAR DpcRoutineActive;
volatile UCHAR DpcThreadActive;
ULONG PrcbLock;
ULONG DpcLastCount;
volatile ULONG TimerHand;
volatile ULONG TimerRequest;
PVOID DpcThread;
KEVENT DpcEvent;
UCHAR ThreadDpcEnable;
volatile BOOLEAN QuantumEnd;
UCHAR PrcbPad50;
volatile UCHAR IdleSchedule;
LONG DpcSetEventRequest;
UCHAR PrcbPad5[18];
LONG TickOffset;
KDPC CallDpc;
ULONG PrcbPad7[8];
LIST_ENTRY WaitListHead;
ULONG ReadySummary;
ULONG QueueIndex;
LIST_ENTRY DispatcherReadyListHead[32];
SINGLE_LIST_ENTRY DeferredReadyListHead;
ULONG PrcbPad72[11];
PVOID ChainedInterruptList;
LONG LookasideIrpFloat;
volatile LONG MmPageFaultCount;
volatile LONG MmCopyOnWriteCount;
volatile LONG MmTransitionCount;
volatile LONG MmCacheTransitionCount;
volatile LONG MmDemandZeroCount;
volatile LONG MmPageReadCount;
volatile LONG MmPageReadIoCount;
volatile LONG MmCacheReadCount;
volatile LONG MmCacheIoCount;
volatile LONG MmDirtyPagesWriteCount;
volatile LONG MmDirtyWriteIoCount;
volatile LONG MmMappedPagesWriteCount;
volatile LONG MmMappedWriteIoCount;
ULONG SpareFields0[1];
ULONG DebugDpcTime;
LONG Sleeping;
KAFFINITY SetMember;
CHAR VendorString[13];
UCHAR InitialApicId;
UCHAR LogicalProcessorsPerPhysicalProcessor;
ULONG MHz;
ULONG FeatureBits;
LARGE_INTEGER UpdateSignature;
volatile LARGE_INTEGER IsrTime;
LARGE_INTEGER SpareField1;
//FX_SAVE_AREA NpxSaveArea;
PROCESSOR_POWER_STATE PowerState;
#endif
} KPRCB, *PKPRCB;
C_ASSERT(FIELD_OFFSET(KPRCB, ProcessorState) == 0x20);
C_ASSERT(FIELD_OFFSET(KPRCB, ProcessorModel) == 0x3C0);
C_ASSERT(FIELD_OFFSET(KPRCB, LockQueue) == 0x480);
C_ASSERT(FIELD_OFFSET(KPRCB, PacketBarrier) == 0x600);
C_ASSERT(FIELD_OFFSET(KPRCB, Mailbox) == 0x680);
C_ASSERT(FIELD_OFFSET(KPRCB, DpcData) == 0x690);
C_ASSERT(FIELD_OFFSET(KPRCB, DpcStack) == 0x6c0);
//C_ASSERT(FIELD_OFFSET(KPRCB, CallDpc) == 0x714);
//
// Processor Control Region
// Based on Windows RT 8.1 symbols
//
typedef struct _KIPCR
{
@ -480,61 +873,48 @@ typedef struct _KIPCR
NT_TIB NtTib;
struct
{
struct _EXCEPTION_REGISTRATION_RECORD *Used_ExceptionList; // Unused
PVOID Used_StackBase; // Unused
PVOID PerfGlobalGroupMask;
PVOID TssCopy; // Unused
ULONG ContextSwitches;
KAFFINITY SetMemberCopy; // Unused
ULONG TibPad0[2];
PVOID Spare1;
struct _KPCR *Self;
struct _KPRCB *CurrentPrcb;
struct _KSPIN_LOCK_QUEUE* LockArray;
PVOID Used_Self;
};
};
struct _KPCR *Self;
struct _KPRCB *Prcb;
KIRQL Irql;
ULONG IRR; // Unused
ULONG IrrActive; // Unused
ULONG IDR; // Unused
PVOID KdVersionBlock;
PVOID IDT; // Unused
PVOID GDT; // Unused
PVOID TSS; // Unused
KIRQL CurrentIrql;
UCHAR SecondLevelCacheAssociativity;
ULONG Unused0[3];
USHORT MajorVersion;
USHORT MinorVersion;
KAFFINITY SetMember;
ULONG StallScaleFactor;
UCHAR SpareUnused;
UCHAR Number;
UCHAR Spare0;
UCHAR SecondLevelCacheAssociativity;
ULONG VdmAlert;
ULONG KernelReserved[14];
PVOID Unused1[3];
ULONG KernelReserved[15];
ULONG SecondLevelCacheSize;
ULONG HalReserved[16];
// arm part
UCHAR IrqlMask[32];
ULONG IrqlTable[32];
PKINTERRUPT_ROUTINE InterruptRoutine[32];
ULONG ReservedVectors;
ULONG FirstLevelDcacheSize;
ULONG FirstLevelDcacheFillSize;
ULONG FirstLevelIcacheSize;
ULONG FirstLevelIcacheFillSize;
ULONG SecondLevelDcacheSize;
ULONG SecondLevelDcacheFillSize;
ULONG SecondLevelIcacheSize;
ULONG SecondLevelIcacheFillSize;
ULONG DcacheFillSize;
ULONG DcacheAlignment;
ULONG IcacheAlignment;
ULONG IcacheFillSize;
ULONG ProcessorId;
PVOID InterruptStack;
PVOID PanicStack;
PVOID InitialStack;
KPRCB PrcbData;
union
{
USHORT SoftwareInterruptPending;
struct
{
UCHAR ApcInterrupt;
UCHAR DispatchInterrupt;
};
};
USHORT InterruptPad;
ULONG HalReserved[32];
PVOID KdVersionBlock;
PVOID Unused3;
ULONG PcrAlign1[8];
/* Private members, not in ntddk.h */
PVOID Idt[256];
PVOID* IdtExt;
ULONG PcrAlign2[19];
UCHAR _PADDING1_[0x4];
KPRCB Prcb;
} KIPCR, *PKIPCR;
C_ASSERT(FIELD_OFFSET(KIPCR, Prcb.LegacyNumber) == 0x580);
//
// Macro to get current KPRCB
//
@ -542,20 +922,19 @@ FORCEINLINE
struct _KPRCB *
KeGetCurrentPrcb(VOID)
{
return PCR->Prcb;
return KeGetPcr()->CurrentPrcb;
}
//
// Just read it from the PCR
//
#define KeGetCurrentProcessorNumber() (int)PCR->Number
#define KeGetCurrentIrql() PCR->Irql
#define KeGetCurrentIrql() KeGetPcr()->CurrentIrql
#define _KeGetCurrentThread() KeGetCurrentPrcb()->CurrentThread
#define _KeGetPreviousMode() KeGetCurrentPrcb()->CurrentThread->PreviousMode
#define _KeIsExecutingDpc() (KeGetCurrentPrcb()->DpcRoutineActive != 0)
#define KeGetCurrentThread() _KeGetCurrentThread()
#define KeGetPreviousMode() _KeGetPreviousMode()
#define KeGetDcacheFillSize() PCR->DcacheFillSize
//#define KeGetDcacheFillSize() PCR->DcacheFillSize
#endif // !NTOS_MODE_USER

View file

@ -37,18 +37,6 @@ Author:
#define KernelMode 0x0
#define UserMode 0x1
//
// CPU Types
//
#define CPU_NONE 0x0
#define CPU_INTEL 0x1
#define CPU_AMD 0x2
#define CPU_CYRIX 0x3
#define CPU_TRANSMETA 0x4
#define CPU_CENTAUR 0x5
#define CPU_RISE 0x6
#define CPU_UNKNOWN 0x7
//
// Selector Names
//

View file

@ -33,6 +33,22 @@ Author:
#define KeGetPcr() ((KPCR *)__readfsdword(FIELD_OFFSET(KPCR, SelfPcr)))
#endif
//
// CPU Vendors
//
typedef enum
{
CPU_NONE = 0,
CPU_INTEL = 1,
CPU_AMD = 2,
CPU_CYRIX = 3,
CPU_TRANSMETA = 4,
CPU_VIA = 5,
CPU_CENTAUR = CPU_VIA,
CPU_RISE = 6,
CPU_UNKNOWN = 7
} CPU_VENDORS;
//
// Machine Types
//
@ -116,6 +132,20 @@ Author:
#define FSW_PRECISION 0x20
#define FSW_STACK_FAULT 0x40
//
// Machine Specific Registers
//
#define MSR_AMD_ACCESS 0x9C5A203A
#define MSR_IA32_MISC_ENABLE 0x01A0
#define MSR_EFER 0xC0000080
//
// MSR internal Values
//
#define MSR_NXE 0x0800
#define XHF_NOEXECUTE 0x100000
#define MSR_XD_ENABLE_MASK 0xFFFFFFFB
//
// IPI Types
//
@ -802,5 +832,82 @@ typedef struct _KTSS
// i386 CPUs don't have exception frames
//
typedef struct _KEXCEPTION_FRAME KEXCEPTION_FRAME, *PKEXCEPTION_FRAME;
#endif
#endif
#endif /* NTOS_MODE_USER */
typedef enum _WOW64_SERVICE_TYPES
{
ServiceNoTurbo = 0x0000,
Service0Arg = 0x0001,
Service0ArgReloadState = 0x0002,
Service1ArgSp = 0x0003,
Service1ArgNSp = 0x0004,
Service2ArgNSpNSp = 0x0005,
Service2ArgNSpNSpReloadState = 0x0006,
Service2ArgSpNSp = 0x0007,
Service2ArgSpSp = 0x0008,
Service2ArgNSpSp = 0x0009,
Service3ArgNSpNSpNSp = 0x000A,
Service3ArgSpSpSp = 0x000B,
Service3ArgSpNSpNSp = 0x000C,
Service3ArgSpNSpNSpReloadState = 0x000D,
Service3ArgSpSpNSp = 0x000E,
Service3ArgNSpSpNSp = 0x000F,
Service3ArgSpNSpSp = 0x0010,
Service4ArgNSpNSpNSpNSp = 0x0011,
Service4ArgSpSpNSpNSp = 0x0012,
Service4ArgSpSpNSpNSpReloadState = 0x0013,
Service4ArgSpNSpNSpNSp = 0x0014,
Service4ArgSpNSpNSpNSpReloadState = 0x0015,
Service4ArgNSpSpNSpNSp = 0x0016,
Service4ArgSpSpSpNSp = 0x0017,
ServiceCpupTdQuerySystemTime = 0x0018,
ServiceCpupTdGetCurrentProcessorNumber = 0x0019,
ServiceCpupTdReadWriteFile = 0x001A,
ServiceCpupTdDeviceIoControlFile = 0x001B,
ServiceCpupTdRemoveIoCompletion = 0x001C,
ServiceCpupTdWaitForMultipleObjects = 0x001D,
ServiceCpupTdWaitForMultipleObjects32 = 0x001E,
Wow64ServiceTypesCount // = 0x001F
} WOW64_SERVICE_TYPES, *PWOW64_SERVICE_TYPES;
typedef enum _VDM_INDEX
{
VDM_INDEX_Invalid = 0,
VDM_INDEX_0F,
VDM_INDEX_ESPrefix,
VDM_INDEX_CSPrefix,
VDM_INDEX_SSPrefix,
VDM_INDEX_DSPrefix,
VDM_INDEX_FSPrefix,
VDM_INDEX_GSPrefix,
VDM_INDEX_OPER32Prefix,
VDM_INDEX_ADDR32Prefix,
VDM_INDEX_INSB,
VDM_INDEX_INSW,
VDM_INDEX_OUTSB,
VDM_INDEX_OUTSW,
VDM_INDEX_PUSHF,
VDM_INDEX_POPF,
VDM_INDEX_INTnn,
VDM_INDEX_INTO,
VDM_INDEX_IRET,
VDM_INDEX_NPX,
VDM_INDEX_INBimm,
VDM_INDEX_INWimm,
VDM_INDEX_OUTBimm,
VDM_INDEX_OUTWimm,
VDM_INDEX_INB,
VDM_INDEX_INW,
VDM_INDEX_OUTB,
VDM_INDEX_OUTW,
VDM_INDEX_LOCKPrefix,
VDM_INDEX_REPNEPrefix,
VDM_INDEX_REPPrefix,
VDM_INDEX_CLI,
VDM_INDEX_STI,
VDM_INDEX_HLT,
MAX_VDM_INDEX
} VDM_INDEX, *PVDM_INDEX;
#endif /* _I386_KETYPES_H */

View file

@ -158,10 +158,18 @@ Author:
#define KF_AMDK6MTRR 0x00008000
#define KF_XMMI64 0x00010000
#define KF_DTS 0x00020000
#define KF_BRANCH 0x00020000 // from ksamd64.inc
#define KF_SSE3 0x00080000
#define KF_CMPXCHG16B 0x00100000
#define KF_XSTATE 0x00800000 // from ks386.inc, ksamd64.inc
#define KF_NX_BIT 0x20000000
#define KF_NX_DISABLED 0x40000000
#define KF_NX_ENABLED 0x80000000
#define KF_XSAVEOPT_BIT 15
#define KF_XSTATE_BIT 23
#define KF_RDWRFSGSBASE_BIT 28
//
// Internal Exception Codes
//
@ -776,6 +784,17 @@ typedef struct _KNODE
} KNODE, *PKNODE;
#include <poppack.h>
//
// Structure for Get/SetContext APC
//
typedef struct _GETSETCONTEXT
{
KAPC Apc;
KEVENT Event;
KPROCESSOR_MODE Mode;
CONTEXT Context;
} GETSETCONTEXT, *PGETSETCONTEXT;
//
// Kernel Profile Object
//
@ -1428,6 +1447,28 @@ typedef struct _KSERVICE_TABLE_DESCRIPTOR
PUCHAR Number;
} KSERVICE_TABLE_DESCRIPTOR, *PKSERVICE_TABLE_DESCRIPTOR;
#if (NTDDI_VERSION >= NTDDI_WIN8)
//
// Entropy Timing State
//
typedef struct _KENTROPY_TIMING_STATE
{
ULONG EntropyCount;
ULONG Buffer[64];
KDPC Dpc;
ULONG LastDeliveredBuffer;
PULONG RawDataBuffer;
} KENTROPY_TIMING_STATE, *PKENTROPY_TIMING_STATE;
//
// Constants from ks386.inc, ksamd64.inc and ksarm.h
//
#define KENTROPY_TIMING_INTERRUPTS_PER_BUFFER 0x400
#define KENTROPY_TIMING_BUFFER_MASK 0x7ff
#define KENTROPY_TIMING_ANALYSIS 0x0
#endif /* (NTDDI_VERSION >= NTDDI_WIN8) */
//
// Exported Loader Parameter Block
//

View file

@ -1395,6 +1395,98 @@ typedef struct _RTL_USER_PROCESS_INFORMATION
SECTION_IMAGE_INFORMATION ImageInformation;
} RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION;
#if (NTDDI_VERSION >= NTDDI_WIN7)
typedef enum _RTL_UMS_SCHEDULER_REASON
{
UmsSchedulerStartup = 0,
UmsSchedulerThreadBlocked = 1,
UmsSchedulerThreadYield = 2,
} RTL_UMS_SCHEDULER_REASON, *PRTL_UMS_SCHEDULER_REASON;
enum _RTL_UMSCTX_FLAGS
{
UMSCTX_SCHEDULED_THREAD_BIT = 0,
#if (NTDDI_VERSION < NTDDI_WIN8)
UMSCTX_HAS_QUANTUM_REQ_BIT,
UMSCTX_HAS_AFFINITY_REQ_BIT,
UMSCTX_HAS_PRIORITY_REQ_BIT,
#endif
UMSCTX_SUSPENDED_BIT,
UMSCTX_VOLATILE_CONTEXT_BIT,
UMSCTX_TERMINATED_BIT,
UMSCTX_DEBUG_ACTIVE_BIT,
UMSCTX_RUNNING_ON_SELF_THREAD_BIT
UMSCTX_DENY_RUNNING_ON_SELF_THREAD_BIT
} RTL_UMSCTX_FLAGS, *PRTL_UMSCTX_FLAGS;
#define UMSCTX_SCHEDULED_THREAD_MASK (1 << UMSCTX_SCHEDULED_THREAD_BIT)
#define UMSCTX_SUSPENDED_MASK (1 << UMSCTX_SUSPENDED_BIT)
#define UMSCTX_VOLATILE_CONTEXT_MASK (1 << UMSCTX_VOLATILE_CONTEXT_BIT)
#define UMSCTX_TERMINATED_MASK (1 << UMSCTX_TERMINATED_BIT)
#define UMSCTX_DEBUG_ACTIVE_MASK (1 << UMSCTX_DEBUG_ACTIVE_BIT)
#define UMSCTX_RUNNING_ON_SELF_THREAD_MASK (1 << UMSCTX_RUNNING_ON_SELF_THREAD_BIT)
#define UMSCTX_DENY_RUNNING_ON_SELF_THREAD_MASK (1 << UMSCTX_DENY_RUNNING_ON_SELF_THREAD_BIT)
//
// UMS Context
//
typedef struct DECLSPEC_ALIGN(16) _RTL_UMS_CONTEXT
{
SINGLE_LIST_ENTRY Link;
CONTEXT Context;
PVOID Teb;
PVOID UserContext;
union
{
struct
{
ULONG ScheduledThread : 1;
#if (NTDDI_VERSION < NTDDI_WIN8)
ULONG HasQuantumReq : 1;
ULONG HasAffinityReq : 1;
ULONG HasPriorityReq : 1;
#endif
ULONG Suspended : 1;
ULONG VolatileContext : 1;
ULONG Terminated : 1;
ULONG DebugActive : 1;
ULONG RunningOnSelfThread : 1;
ULONG DenyRunningOnSelfThread : 1;
#if (NTDDI_VERSION < NTDDI_WIN8)
ULONG ReservedFlags : 22;
#endif
};
LONG Flags;
};
union
{
struct
{
#if (NTDDI_VERSION >= NTDDI_WIN8)
ULONG64 KernelUpdateLock : 2;
#else
ULONG64 KernelUpdateLock : 1;
ULONG64 Reserved : 1;
#endif
ULONG64 PrimaryClientID : 62;
};
ULONG64 ContextLock;
};
#if (NTDDI_VERSION < NTDDI_WIN8)
ULONG64 QuantumValue;
GROUP_AFFINITY AffinityMask;
LONG Priority;
#endif
struct _RTL_UMS_CONTEXT* PrimaryUmsContext;
ULONG SwitchCount;
ULONG KernelYieldCount;
ULONG MixedYieldCount;
ULONG YieldCount;
} RTL_UMS_CONTEXT, *PRTL_UMS_CONTEXT;
#endif // #if (NTDDI_VERSION >= NTDDI_WIN7)
//
// RTL Atom Table Structures
//

View file

@ -396,8 +396,13 @@ KDDEBUGGER_DATA64 KdDebuggerDataBlock =
{(ULONG_PTR)RtlpBreakWithStatusInstruction},
0,
FIELD_OFFSET(KTHREAD, CallbackStack),
#if defined(_M_ARM) || defined(_M_AMD64)
0,
0,
#else
FIELD_OFFSET(KCALLOUT_FRAME, CallbackStack),
FIELD_OFFSET(KCALLOUT_FRAME, CBSTACK_FRAME_POINTER),
#endif
FALSE,
{(ULONG_PTR)KiCallUserMode},
0,

View file

@ -132,8 +132,7 @@ KiInitializeContextThread(IN PKTHREAD Thread,
StartFrame->P2Home = (ULONG64)StartContext;
StartFrame->P3Home = 0;
StartFrame->P4Home = (ULONG64)SystemRoutine;
StartFrame->P5Home = 0;
StartFrame->Reserved = 0;
}
BOOLEAN