mirror of
https://github.com/reactos/reactos.git
synced 2025-05-07 18:56:48 +00:00
Merge from amd64-branch:
44501 (tkreuzer) [NDK] - Add CLIENT_ID32/64 - Create explicit 32/64 bit versions of PEB, GDI_TEB_BATCH and TEB, using macros. - Fix some member names. 44503 (tkreuzer) [CMD] Fix a teb member name 44504 (tkreuzer) [NTSOKRNL] Fix a teb member name 44506 (tkreuzer) [NDK] fix a typo in the TEB definition 44511 (tkreuzer) [NDK] - Add Wx86ThreadState - Add WinXP version of ACTIVATION_CONTEXT_STACK - rtltypes doesn't depend on pstypes, but the opposite way around now 44512 (tkreuzer) [NDK] Fix some dependencies 44521 (tkreuzer) [NTDKK] - Don't use PEB::FastPeb(Un)LockRoutine, these members are deprecated since Windows 2003, use RtlEnter/LeaveCriticalSection instead. 44523 (tkreuzer) [NTDLL] Fix usage of PEB::KernelCallbacktable. It's a PVOID. 44524 (tkreuzer) NDK] - Add missing TEB member for Vista 44525 (tkreuzer) [NDK] Fix a TEB array size. 44526 (tkreuzer) [USER32] More fix of TEB::KernelCallbackTable usage svn path=/trunk/; revision=46434
This commit is contained in:
commit
fb69e522da
17 changed files with 502 additions and 309 deletions
|
@ -244,7 +244,7 @@ static BOOL IsConsoleProcess(HANDLE Process)
|
||||||
return TRUE;
|
return TRUE;
|
||||||
}
|
}
|
||||||
|
|
||||||
return IMAGE_SUBSYSTEM_WINDOWS_CUI == ProcessPeb.ImageSubSystem;
|
return IMAGE_SUBSYSTEM_WINDOWS_CUI == ProcessPeb.ImageSubsystem;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -259,7 +259,7 @@ DbgUiConvertStateChangeStructure(IN PDBGUI_WAIT_STATE_CHANGE WaitStateChange,
|
||||||
/* Save the image name from the TIB */
|
/* Save the image name from the TIB */
|
||||||
DebugEvent->u.LoadDll.lpImageName =
|
DebugEvent->u.LoadDll.lpImageName =
|
||||||
((PTEB)ThreadBasicInfo.TebBaseAddress)->
|
((PTEB)ThreadBasicInfo.TebBaseAddress)->
|
||||||
Tib.ArbitraryUserPointer;
|
NtTib.ArbitraryUserPointer;
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
|
|
|
@ -79,8 +79,8 @@ KiUserCallbackDispatcher(ULONG Index,
|
||||||
ULONG ArgumentLength)
|
ULONG ArgumentLength)
|
||||||
{
|
{
|
||||||
/* Return with the result of the callback function */
|
/* Return with the result of the callback function */
|
||||||
|
USER_CALL *KernelCallbackTable = NtCurrentPeb()->KernelCallbackTable;
|
||||||
ZwCallbackReturn(NULL,
|
ZwCallbackReturn(NULL,
|
||||||
0,
|
0,
|
||||||
((USER_CALL)(NtCurrentPeb()->KernelCallbackTable[Index]))
|
KernelCallbackTable[Index](Argument, ArgumentLength));
|
||||||
(Argument, ArgumentLength));
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -343,8 +343,6 @@ LdrpInit2(PCONTEXT Context,
|
||||||
/* initalize peb lock support */
|
/* initalize peb lock support */
|
||||||
RtlInitializeCriticalSection(&PebLock);
|
RtlInitializeCriticalSection(&PebLock);
|
||||||
Peb->FastPebLock = &PebLock;
|
Peb->FastPebLock = &PebLock;
|
||||||
Peb->FastPebLockRoutine = (PPEBLOCKROUTINE)RtlEnterCriticalSection;
|
|
||||||
Peb->FastPebUnlockRoutine = (PPEBLOCKROUTINE)RtlLeaveCriticalSection;
|
|
||||||
|
|
||||||
/* initialize tls bitmaps */
|
/* initialize tls bitmaps */
|
||||||
RtlInitializeBitMap(&TlsBitMap, Peb->TlsBitmapBits, TLS_MINIMUM_AVAILABLE);
|
RtlInitializeBitMap(&TlsBitMap, Peb->TlsBitmapBits, TLS_MINIMUM_AVAILABLE);
|
||||||
|
|
|
@ -2299,8 +2299,8 @@ LdrpLoadModule(IN PWSTR SearchPath OPTIONAL,
|
||||||
/* Map the dll into the process */
|
/* Map the dll into the process */
|
||||||
ViewSize = 0;
|
ViewSize = 0;
|
||||||
ImageBase = 0;
|
ImageBase = 0;
|
||||||
ArbitraryUserPointer = NtCurrentTeb()->Tib.ArbitraryUserPointer;
|
ArbitraryUserPointer = NtCurrentTeb()->NtTib.ArbitraryUserPointer;
|
||||||
NtCurrentTeb()->Tib.ArbitraryUserPointer = FullDosName.Buffer;
|
NtCurrentTeb()->NtTib.ArbitraryUserPointer = FullDosName.Buffer;
|
||||||
Status = NtMapViewOfSection(SectionHandle,
|
Status = NtMapViewOfSection(SectionHandle,
|
||||||
NtCurrentProcess(),
|
NtCurrentProcess(),
|
||||||
&ImageBase,
|
&ImageBase,
|
||||||
|
@ -2311,7 +2311,7 @@ LdrpLoadModule(IN PWSTR SearchPath OPTIONAL,
|
||||||
ViewShare,
|
ViewShare,
|
||||||
0,
|
0,
|
||||||
PAGE_READONLY);
|
PAGE_READONLY);
|
||||||
NtCurrentTeb()->Tib.ArbitraryUserPointer = ArbitraryUserPointer;
|
NtCurrentTeb()->NtTib.ArbitraryUserPointer = ArbitraryUserPointer;
|
||||||
if (!NT_SUCCESS(Status))
|
if (!NT_SUCCESS(Status))
|
||||||
{
|
{
|
||||||
DPRINT1("map view of section failed (Status 0x%08lx)\n", Status);
|
DPRINT1("map view of section failed (Status 0x%08lx)\n", Status);
|
||||||
|
|
|
@ -83,7 +83,7 @@ VOID NTAPI
|
||||||
RtlAcquirePebLock(VOID)
|
RtlAcquirePebLock(VOID)
|
||||||
{
|
{
|
||||||
PPEB Peb = NtCurrentPeb ();
|
PPEB Peb = NtCurrentPeb ();
|
||||||
Peb->FastPebLockRoutine (Peb->FastPebLock);
|
RtlEnterCriticalSection(Peb->FastPebLock);
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -93,7 +93,7 @@ VOID NTAPI
|
||||||
RtlReleasePebLock(VOID)
|
RtlReleasePebLock(VOID)
|
||||||
{
|
{
|
||||||
PPEB Peb = NtCurrentPeb ();
|
PPEB Peb = NtCurrentPeb ();
|
||||||
Peb->FastPebUnlockRoutine (Peb->FastPebLock);
|
RtlLeaveCriticalSection(Peb->FastPebLock);
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -201,11 +201,24 @@ RtlpCaptureStackLimits(IN ULONG_PTR Ebp,
|
||||||
IN ULONG_PTR *StackEnd)
|
IN ULONG_PTR *StackEnd)
|
||||||
{
|
{
|
||||||
/* FIXME: Verify */
|
/* FIXME: Verify */
|
||||||
*StackBegin = (ULONG_PTR)NtCurrentTeb()->Tib.StackLimit;
|
*StackBegin = (ULONG_PTR)NtCurrentTeb()->NtTib.StackLimit;
|
||||||
*StackEnd = (ULONG_PTR)NtCurrentTeb()->Tib.StackBase;
|
*StackEnd = (ULONG_PTR)NtCurrentTeb()->NtTib.StackBase;
|
||||||
return TRUE;
|
return TRUE;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#ifdef _AMD64_
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
RtlpGetStackLimits(
|
||||||
|
OUT PULONG_PTR LowLimit,
|
||||||
|
OUT PULONG_PTR HighLimit)
|
||||||
|
{
|
||||||
|
*LowLimit = (ULONG_PTR)NtCurrentTeb()->NtTib.StackLimit;
|
||||||
|
*HighLimit = (ULONG_PTR)NtCurrentTeb()->NtTib.StackBase;
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
BOOLEAN
|
BOOLEAN
|
||||||
NTAPI
|
NTAPI
|
||||||
RtlIsThreadWithinLoaderCallout(VOID)
|
RtlIsThreadWithinLoaderCallout(VOID)
|
||||||
|
|
|
@ -47,9 +47,9 @@ ConvertFiberToThread(VOID)
|
||||||
pTeb->HasFiberData = FALSE;
|
pTeb->HasFiberData = FALSE;
|
||||||
|
|
||||||
/* free the fiber */
|
/* free the fiber */
|
||||||
if (pTeb->Tib.FiberData != NULL)
|
if(pTeb->NtTib.FiberData != NULL)
|
||||||
{
|
{
|
||||||
RtlFreeHeap(GetProcessHeap(), 0, pTeb->Tib.FiberData);
|
RtlFreeHeap(GetProcessHeap(), 0, pTeb->NtTib.FiberData);
|
||||||
}
|
}
|
||||||
|
|
||||||
/* success */
|
/* success */
|
||||||
|
@ -69,7 +69,7 @@ ConvertThreadToFiberEx(LPVOID lpParameter,
|
||||||
DPRINT1("Converting Thread to Fiber\n");
|
DPRINT1("Converting Thread to Fiber\n");
|
||||||
|
|
||||||
/* the current thread is already a fiber */
|
/* the current thread is already a fiber */
|
||||||
if(pTeb->HasFiberData && pTeb->Tib.FiberData) return pTeb->Tib.FiberData;
|
if(pTeb->HasFiberData && pTeb->NtTib.FiberData) return pTeb->NtTib.FiberData;
|
||||||
|
|
||||||
/* allocate the fiber */
|
/* allocate the fiber */
|
||||||
pfCurFiber = (PFIBER)RtlAllocateHeap(GetProcessHeap(),
|
pfCurFiber = (PFIBER)RtlAllocateHeap(GetProcessHeap(),
|
||||||
|
@ -85,9 +85,9 @@ ConvertThreadToFiberEx(LPVOID lpParameter,
|
||||||
|
|
||||||
/* copy some contextual data from the thread to the fiber */
|
/* copy some contextual data from the thread to the fiber */
|
||||||
pfCurFiber->Parameter = lpParameter;
|
pfCurFiber->Parameter = lpParameter;
|
||||||
pfCurFiber->ExceptionList = pTeb->Tib.ExceptionList;
|
pfCurFiber->ExceptionList = pTeb->NtTib.ExceptionList;
|
||||||
pfCurFiber->StackBase = pTeb->Tib.StackBase;
|
pfCurFiber->StackBase = pTeb->NtTib.StackBase;
|
||||||
pfCurFiber->StackLimit = pTeb->Tib.StackLimit;
|
pfCurFiber->StackLimit = pTeb->NtTib.StackLimit;
|
||||||
pfCurFiber->DeallocationStack = pTeb->DeallocationStack;
|
pfCurFiber->DeallocationStack = pTeb->DeallocationStack;
|
||||||
pfCurFiber->FlsData = pTeb->FlsData;
|
pfCurFiber->FlsData = pTeb->FlsData;
|
||||||
pfCurFiber->GuaranteedStackBytes = pTeb->GuaranteedStackBytes;
|
pfCurFiber->GuaranteedStackBytes = pTeb->GuaranteedStackBytes;
|
||||||
|
@ -101,7 +101,7 @@ ConvertThreadToFiberEx(LPVOID lpParameter,
|
||||||
}
|
}
|
||||||
|
|
||||||
/* associate the fiber to the current thread */
|
/* associate the fiber to the current thread */
|
||||||
pTeb->Tib.FiberData = pfCurFiber;
|
pTeb->NtTib.FiberData = pfCurFiber;
|
||||||
pTeb->HasFiberData = TRUE;
|
pTeb->HasFiberData = TRUE;
|
||||||
|
|
||||||
/* success */
|
/* success */
|
||||||
|
@ -227,7 +227,7 @@ DeleteFiber(LPVOID lpFiber)
|
||||||
RtlFreeHeap(GetProcessHeap(), 0, lpFiber);
|
RtlFreeHeap(GetProcessHeap(), 0, lpFiber);
|
||||||
|
|
||||||
/* the fiber is deleting itself: let the system deallocate the stack */
|
/* the fiber is deleting itself: let the system deallocate the stack */
|
||||||
if(NtCurrentTeb()->Tib.FiberData == lpFiber) ExitThread(1);
|
if(NtCurrentTeb()->NtTib.FiberData == lpFiber) ExitThread(1);
|
||||||
|
|
||||||
/* deallocate the stack */
|
/* deallocate the stack */
|
||||||
NtFreeVirtualMemory(NtCurrentProcess(),
|
NtFreeVirtualMemory(NtCurrentProcess(),
|
||||||
|
|
|
@ -217,23 +217,25 @@ BOOL
|
||||||
Init(VOID)
|
Init(VOID)
|
||||||
{
|
{
|
||||||
USERCONNECT UserCon;
|
USERCONNECT UserCon;
|
||||||
|
PVOID *KernelCallbackTable;
|
||||||
|
|
||||||
/* Set up the kernel callbacks. */
|
/* Set up the kernel callbacks. */
|
||||||
NtCurrentPeb()->KernelCallbackTable[USER32_CALLBACK_WINDOWPROC] =
|
KernelCallbackTable = NtCurrentPeb()->KernelCallbackTable;
|
||||||
|
KernelCallbackTable[USER32_CALLBACK_WINDOWPROC] =
|
||||||
(PVOID)User32CallWindowProcFromKernel;
|
(PVOID)User32CallWindowProcFromKernel;
|
||||||
NtCurrentPeb()->KernelCallbackTable[USER32_CALLBACK_SENDASYNCPROC] =
|
KernelCallbackTable[USER32_CALLBACK_SENDASYNCPROC] =
|
||||||
(PVOID)User32CallSendAsyncProcForKernel;
|
(PVOID)User32CallSendAsyncProcForKernel;
|
||||||
NtCurrentPeb()->KernelCallbackTable[USER32_CALLBACK_LOADSYSMENUTEMPLATE] =
|
KernelCallbackTable[USER32_CALLBACK_LOADSYSMENUTEMPLATE] =
|
||||||
(PVOID)User32LoadSysMenuTemplateForKernel;
|
(PVOID)User32LoadSysMenuTemplateForKernel;
|
||||||
NtCurrentPeb()->KernelCallbackTable[USER32_CALLBACK_LOADDEFAULTCURSORS] =
|
KernelCallbackTable[USER32_CALLBACK_LOADDEFAULTCURSORS] =
|
||||||
(PVOID)User32SetupDefaultCursors;
|
(PVOID)User32SetupDefaultCursors;
|
||||||
NtCurrentPeb()->KernelCallbackTable[USER32_CALLBACK_HOOKPROC] =
|
KernelCallbackTable[USER32_CALLBACK_HOOKPROC] =
|
||||||
(PVOID)User32CallHookProcFromKernel;
|
(PVOID)User32CallHookProcFromKernel;
|
||||||
NtCurrentPeb()->KernelCallbackTable[USER32_CALLBACK_EVENTPROC] =
|
KernelCallbackTable[USER32_CALLBACK_EVENTPROC] =
|
||||||
(PVOID)User32CallEventProcFromKernel;
|
(PVOID)User32CallEventProcFromKernel;
|
||||||
NtCurrentPeb()->KernelCallbackTable[USER32_CALLBACK_LOADMENU] =
|
KernelCallbackTable[USER32_CALLBACK_LOADMENU] =
|
||||||
(PVOID)User32CallLoadMenuFromKernel;
|
(PVOID)User32CallLoadMenuFromKernel;
|
||||||
NtCurrentPeb()->KernelCallbackTable[USER32_CALLBACK_CLIENTTHREADSTARTUP] =
|
KernelCallbackTable[USER32_CALLBACK_CLIENTTHREADSTARTUP] =
|
||||||
(PVOID)User32CallClientThreadSetupFromKernel;
|
(PVOID)User32CallClientThreadSetupFromKernel;
|
||||||
|
|
||||||
NtUserProcessConnect( NtCurrentProcess(),
|
NtUserProcessConnect( NtCurrentProcess(),
|
||||||
|
|
389
reactos/include/ndk/peb_teb.h
Normal file
389
reactos/include/ndk/peb_teb.h
Normal file
|
@ -0,0 +1,389 @@
|
||||||
|
|
||||||
|
#define PASTE2(x,y) x##y
|
||||||
|
#define PASTE(x,y) PASTE2(x,y)
|
||||||
|
|
||||||
|
#ifdef EXPLICIT_32BIT
|
||||||
|
#define STRUCT(x) PASTE(x,32)
|
||||||
|
#define PTR(x) ULONG
|
||||||
|
#elif defined(EXPLICIT_64BIT)
|
||||||
|
#define STRUCT(x) PASTE(x,64)
|
||||||
|
#define PTR(x) ULONG64
|
||||||
|
#else
|
||||||
|
#define STRUCT(x) x
|
||||||
|
#define PTR(x) x
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if defined(_WIN64) && !defined(EXPLICIT_32BIT)
|
||||||
|
#define GDI_HANDLE_BUFFER_SIZE 60
|
||||||
|
#else
|
||||||
|
#define GDI_HANDLE_BUFFER_SIZE 34
|
||||||
|
#endif
|
||||||
|
|
||||||
|
typedef struct STRUCT(_PEB)
|
||||||
|
{
|
||||||
|
BOOLEAN InheritedAddressSpace;
|
||||||
|
BOOLEAN ReadImageFileExecOptions;
|
||||||
|
BOOLEAN BeingDebugged;
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
||||||
|
union
|
||||||
|
{
|
||||||
|
BOOLEAN BitField;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
BOOLEAN ImageUsesLargePages:1;
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
||||||
|
BOOLEAN IsProtectedProcess:1;
|
||||||
|
BOOLEAN IsLegacyProcess:1;
|
||||||
|
BOOLEAN IsImageDynamicallyRelocated:1;
|
||||||
|
BOOLEAN SkipPatchingUser32Forwarders:1;
|
||||||
|
BOOLEAN SpareBits:3;
|
||||||
|
#else
|
||||||
|
BOOLEAN SpareBits:7;
|
||||||
|
#endif
|
||||||
|
};
|
||||||
|
};
|
||||||
|
#else
|
||||||
|
BOOLEAN SpareBool;
|
||||||
|
#endif
|
||||||
|
PTR(HANDLE) Mutant;
|
||||||
|
PTR(PVOID) ImageBaseAddress;
|
||||||
|
PTR(PPEB_LDR_DATA) Ldr;
|
||||||
|
PTR(struct _RTL_USER_PROCESS_PARAMETERS*) ProcessParameters;
|
||||||
|
PTR(PVOID) SubSystemData;
|
||||||
|
PTR(PVOID) ProcessHeap;
|
||||||
|
PTR(struct _RTL_CRITICAL_SECTION*) FastPebLock;
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
||||||
|
PTR(PVOID) AltThunkSListPtr;
|
||||||
|
PTR(PVOID) IFEOKey;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
ULONG CrossProcessFlags;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG ProcessInJob:1;
|
||||||
|
ULONG ProcessInitializing:1;
|
||||||
|
ULONG ProcessUsingVEH:1;
|
||||||
|
ULONG ProcessUsingVCH:1;
|
||||||
|
ULONG ReservedBits0:28;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
union
|
||||||
|
{
|
||||||
|
PTR(PVOID) KernelCallbackTable;
|
||||||
|
PTR(PVOID) UserSharedInfoPtr;
|
||||||
|
};
|
||||||
|
#elif (NTDDI_VERSION >= NTDDI_WS03)
|
||||||
|
PTR(PVOID) AltThunkSListPtr;
|
||||||
|
PTR(PVOID) SparePtr2;
|
||||||
|
ULONG EnvironmentUpdateCount;
|
||||||
|
PTR(PVOID) KernelCallbackTable;
|
||||||
|
#else
|
||||||
|
PTR(PPEBLOCKROUTINE) FastPebLockRoutine;
|
||||||
|
PTR(PPEBLOCKROUTINE) FastPebUnlockRoutine;
|
||||||
|
ULONG EnvironmentUpdateCount;
|
||||||
|
PTR(PVOID) KernelCallbackTable;
|
||||||
|
#endif
|
||||||
|
ULONG SystemReserved[1];
|
||||||
|
ULONG SpareUlong; // AtlThunkSListPtr32
|
||||||
|
PTR(PPEB_FREE_BLOCK) FreeList;
|
||||||
|
ULONG TlsExpansionCounter;
|
||||||
|
PTR(PVOID) TlsBitmap;
|
||||||
|
ULONG TlsBitmapBits[2];
|
||||||
|
PTR(PVOID) ReadOnlySharedMemoryBase;
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
||||||
|
PTR(PVOID) HotpatchInformation;
|
||||||
|
#else
|
||||||
|
PTR(PVOID) ReadOnlySharedMemoryHeap;
|
||||||
|
#endif
|
||||||
|
PTR(PVOID*) ReadOnlyStaticServerData;
|
||||||
|
PTR(PVOID) AnsiCodePageData;
|
||||||
|
PTR(PVOID) OemCodePageData;
|
||||||
|
PTR(PVOID) UnicodeCaseTableData;
|
||||||
|
ULONG NumberOfProcessors;
|
||||||
|
ULONG NtGlobalFlag;
|
||||||
|
LARGE_INTEGER CriticalSectionTimeout;
|
||||||
|
PTR(ULONG_PTR) HeapSegmentReserve;
|
||||||
|
PTR(ULONG_PTR) HeapSegmentCommit;
|
||||||
|
PTR(ULONG_PTR) HeapDeCommitTotalFreeThreshold;
|
||||||
|
PTR(ULONG_PTR) HeapDeCommitFreeBlockThreshold;
|
||||||
|
ULONG NumberOfHeaps;
|
||||||
|
ULONG MaximumNumberOfHeaps;
|
||||||
|
PTR(PVOID*) ProcessHeaps;
|
||||||
|
PTR(PVOID) GdiSharedHandleTable;
|
||||||
|
PTR(PVOID) ProcessStarterHelper;
|
||||||
|
ULONG GdiDCAttributeList;
|
||||||
|
PTR(struct _RTL_CRITICAL_SECTION*) LoaderLock;
|
||||||
|
ULONG OSMajorVersion;
|
||||||
|
ULONG OSMinorVersion;
|
||||||
|
USHORT OSBuildNumber;
|
||||||
|
USHORT OSCSDVersion;
|
||||||
|
ULONG OSPlatformId;
|
||||||
|
ULONG ImageSubsystem;
|
||||||
|
ULONG ImageSubsystemMajorVersion;
|
||||||
|
ULONG ImageSubsystemMinorVersion;
|
||||||
|
PTR(ULONG_PTR) ImageProcessAffinityMask;
|
||||||
|
ULONG GdiHandleBuffer[GDI_HANDLE_BUFFER_SIZE];
|
||||||
|
PTR(PPOST_PROCESS_INIT_ROUTINE) PostProcessInitRoutine;
|
||||||
|
PTR(PVOID) TlsExpansionBitmap;
|
||||||
|
ULONG TlsExpansionBitmapBits[32];
|
||||||
|
ULONG SessionId;
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_WINXP)
|
||||||
|
ULARGE_INTEGER AppCompatFlags;
|
||||||
|
ULARGE_INTEGER AppCompatFlagsUser;
|
||||||
|
PTR(PVOID) pShimData;
|
||||||
|
PTR(PVOID) AppCompatInfo;
|
||||||
|
STRUCT(UNICODE_STRING) CSDVersion;
|
||||||
|
PTR(struct _ACTIVATION_CONTEXT_DATA*) ActivationContextData;
|
||||||
|
PTR(struct _ASSEMBLY_STORAGE_MAP*) ProcessAssemblyStorageMap;
|
||||||
|
PTR(struct _ACTIVATION_CONTEXT_DATA*) SystemDefaultActivationContextData;
|
||||||
|
PTR(struct _ASSEMBLY_STORAGE_MAP*) SystemAssemblyStorageMap;
|
||||||
|
PTR(ULONG_PTR) MinimumStackCommit;
|
||||||
|
#endif
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
||||||
|
PTR(PVOID*) FlsCallback;
|
||||||
|
STRUCT(LIST_ENTRY) FlsListHead;
|
||||||
|
PTR(PVOID) FlsBitmap;
|
||||||
|
ULONG FlsBitmapBits[4];
|
||||||
|
ULONG FlsHighIndex;
|
||||||
|
#endif
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
||||||
|
PTR(PVOID) WerRegistrationData;
|
||||||
|
PTR(PVOID) WerShipAssertPtr;
|
||||||
|
#endif
|
||||||
|
} STRUCT(PEB), *STRUCT(PPEB);
|
||||||
|
|
||||||
|
|
||||||
|
#if defined(_WIN64) && !defined(EXPLICIT_32BIT)
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Mutant) == 0x08);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Ldr) == 0x18);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FastPebLock) == 0x038);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), TlsExpansionCounter) == 0x070);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), NtGlobalFlag) == 0x0BC);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), GdiSharedHandleTable) == 0x0F8);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), LoaderLock) == 0x110);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageSubsystem) == 0x128);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageProcessAffinityMask) == 0x138);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), PostProcessInitRoutine) == 0x230);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), SessionId) == 0x2C0);
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FlsHighIndex) == 0x350);
|
||||||
|
#endif
|
||||||
|
#else
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Mutant) == 0x04);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Ldr) == 0x0C);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FastPebLock) == 0x01C);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), TlsExpansionCounter) == 0x03C);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), NtGlobalFlag) == 0x068);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), GdiSharedHandleTable) == 0x094);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), LoaderLock) == 0x0A0);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageSubsystem) == 0x0B4);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageProcessAffinityMask) == 0x0C0);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), PostProcessInitRoutine) == 0x14C);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), SessionId) == 0x1D4);
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FlsHighIndex) == 0x22C);
|
||||||
|
#endif
|
||||||
|
#endif
|
||||||
|
|
||||||
|
//
|
||||||
|
// GDI Batch Descriptor
|
||||||
|
//
|
||||||
|
typedef struct STRUCT(_GDI_TEB_BATCH)
|
||||||
|
{
|
||||||
|
ULONG Offset;
|
||||||
|
PTR(HANDLE) HDC;
|
||||||
|
ULONG Buffer[0x136];
|
||||||
|
} STRUCT(GDI_TEB_BATCH), *STRUCT(PGDI_TEB_BATCH);
|
||||||
|
|
||||||
|
//
|
||||||
|
// Thread Environment Block (TEB)
|
||||||
|
//
|
||||||
|
typedef struct STRUCT(_TEB)
|
||||||
|
{
|
||||||
|
STRUCT(NT_TIB) NtTib;
|
||||||
|
PTR(PVOID) EnvironmentPointer;
|
||||||
|
STRUCT(CLIENT_ID) ClientId;
|
||||||
|
PTR(PVOID) ActiveRpcHandle;
|
||||||
|
PTR(PVOID) ThreadLocalStoragePointer;
|
||||||
|
PTR(STRUCT(PPEB)) ProcessEnvironmentBlock;
|
||||||
|
ULONG LastErrorValue;
|
||||||
|
ULONG CountOfOwnedCriticalSections;
|
||||||
|
PTR(PVOID) CsrClientThread;
|
||||||
|
PTR(PVOID) Win32ThreadInfo;
|
||||||
|
ULONG User32Reserved[26];
|
||||||
|
ULONG UserReserved[5];
|
||||||
|
PTR(PVOID) WOW32Reserved;
|
||||||
|
LCID CurrentLocale;
|
||||||
|
ULONG FpSoftwareStatusRegister;
|
||||||
|
PTR(PVOID) SystemReserved1[54];
|
||||||
|
LONG ExceptionCode;
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
||||||
|
PTR(struct _ACTIVATION_CONTEXT_STACK*) ActivationContextStackPointer;
|
||||||
|
UCHAR SpareBytes1[0x30 - 3 * sizeof(PTR(PVOID))];
|
||||||
|
ULONG TxFsContext;
|
||||||
|
#elif (NTDDI_VERSION >= NTDDI_WS03)
|
||||||
|
PTR(struct _ACTIVATION_CONTEXT_STACK*) ActivationContextStackPointer;
|
||||||
|
UCHAR SpareBytes1[0x34 - 3 * sizeof(PTR(PVOID))];
|
||||||
|
#else
|
||||||
|
ACTIVATION_CONTEXT_STACK ActivationContextStack;
|
||||||
|
UCHAR SpareBytes1[24];
|
||||||
|
#endif
|
||||||
|
STRUCT(GDI_TEB_BATCH) GdiTebBatch;
|
||||||
|
STRUCT(CLIENT_ID) RealClientId;
|
||||||
|
PTR(PVOID) GdiCachedProcessHandle;
|
||||||
|
ULONG GdiClientPID;
|
||||||
|
ULONG GdiClientTID;
|
||||||
|
PTR(PVOID) GdiThreadLocalInfo;
|
||||||
|
PTR(SIZE_T) Win32ClientInfo[62];
|
||||||
|
PTR(PVOID) glDispatchTable[233];
|
||||||
|
PTR(SIZE_T) glReserved1[29];
|
||||||
|
PTR(PVOID) glReserved2;
|
||||||
|
PTR(PVOID) glSectionInfo;
|
||||||
|
PTR(PVOID) glSection;
|
||||||
|
PTR(PVOID) glTable;
|
||||||
|
PTR(PVOID) glCurrentRC;
|
||||||
|
PTR(PVOID) glContext;
|
||||||
|
NTSTATUS LastStatusValue;
|
||||||
|
STRUCT(UNICODE_STRING) StaticUnicodeString;
|
||||||
|
WCHAR StaticUnicodeBuffer[261];
|
||||||
|
PTR(PVOID) DeallocationStack;
|
||||||
|
PTR(PVOID) TlsSlots[64];
|
||||||
|
STRUCT(LIST_ENTRY) TlsLinks;
|
||||||
|
PTR(PVOID) Vdm;
|
||||||
|
PTR(PVOID) ReservedForNtRpc;
|
||||||
|
PTR(PVOID) DbgSsReserved[2];
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
||||||
|
ULONG HardErrorMode;
|
||||||
|
#else
|
||||||
|
ULONG HardErrorsAreDisabled;
|
||||||
|
#endif
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
||||||
|
PTR(PVOID) Instrumentation[13 - sizeof(GUID)/sizeof(PTR(PVOID))];
|
||||||
|
GUID ActivityId;
|
||||||
|
PTR(PVOID) SubProcessTag;
|
||||||
|
PTR(PVOID) EtwLocalData;
|
||||||
|
PTR(PVOID) EtwTraceData;
|
||||||
|
#elif (NTDDI_VERSION >= NTDDI_WS03)
|
||||||
|
PTR(PVOID) Instrumentation[14];
|
||||||
|
PTR(PVOID) SubProcessTag;
|
||||||
|
PTR(PVOID) EtwLocalData;
|
||||||
|
#else
|
||||||
|
PTR(PVOID) Instrumentation[16];
|
||||||
|
#endif
|
||||||
|
PTR(PVOID) WinSockData;
|
||||||
|
ULONG GdiBatchCount;
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
||||||
|
BOOLEAN SpareBool0;
|
||||||
|
BOOLEAN SpareBool1;
|
||||||
|
BOOLEAN SpareBool2;
|
||||||
|
#else
|
||||||
|
BOOLEAN InDbgPrint;
|
||||||
|
BOOLEAN FreeStackOnTermination;
|
||||||
|
BOOLEAN HasFiberData;
|
||||||
|
#endif
|
||||||
|
UCHAR IdealProcessor;
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
||||||
|
ULONG GuaranteedStackBytes;
|
||||||
|
#else
|
||||||
|
ULONG Spare3;
|
||||||
|
#endif
|
||||||
|
PTR(PVOID) ReservedForPerf;
|
||||||
|
PTR(PVOID) ReservedForOle;
|
||||||
|
ULONG WaitingOnLoaderLock;
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
||||||
|
PTR(PVOID) SavedPriorityState;
|
||||||
|
PTR(ULONG_PTR) SoftPatchPtr1;
|
||||||
|
PTR(ULONG_PTR) ThreadPoolData;
|
||||||
|
#elif (NTDDI_VERSION >= NTDDI_WS03)
|
||||||
|
PTR(ULONG_PTR) SparePointer1;
|
||||||
|
PTR(ULONG_PTR) SoftPatchPtr1;
|
||||||
|
PTR(ULONG_PTR) SoftPatchPtr2;
|
||||||
|
#else
|
||||||
|
Wx86ThreadState Wx86Thread;
|
||||||
|
#endif
|
||||||
|
PTR(PVOID*) TlsExpansionSlots;
|
||||||
|
#if defined(_WIN64) && !defined(EXPLICIT_32BIT)
|
||||||
|
PTR(PVOID) DeallocationBStore;
|
||||||
|
PTR(PVOID) BStoreLimit;
|
||||||
|
#endif
|
||||||
|
ULONG ImpersonationLocale;
|
||||||
|
ULONG IsImpersonating;
|
||||||
|
PTR(PVOID) NlsCache;
|
||||||
|
PTR(PVOID) pShimData;
|
||||||
|
ULONG HeapVirtualAffinity;
|
||||||
|
PTR(HANDLE) CurrentTransactionHandle;
|
||||||
|
PTR(PTEB_ACTIVE_FRAME) ActiveFrame;
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
||||||
|
PVOID FlsData;
|
||||||
|
#endif
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
||||||
|
PVOID PreferredLangauges;
|
||||||
|
PVOID UserPrefLanguages;
|
||||||
|
PVOID MergedPrefLanguages;
|
||||||
|
ULONG MuiImpersonation;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
USHORT SpareCrossTebFlags:16;
|
||||||
|
};
|
||||||
|
USHORT CrossTebFlags;
|
||||||
|
};
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
USHORT DbgSafeThunkCall:1;
|
||||||
|
USHORT DbgInDebugPrint:1;
|
||||||
|
USHORT DbgHasFiberData:1;
|
||||||
|
USHORT DbgSkipThreadAttach:1;
|
||||||
|
USHORT DbgWerInShipAssertCode:1;
|
||||||
|
USHORT DbgIssuedInitialBp:1;
|
||||||
|
USHORT DbgClonedThread:1;
|
||||||
|
USHORT SpareSameTebBits:9;
|
||||||
|
};
|
||||||
|
USHORT SameTebFlags;
|
||||||
|
};
|
||||||
|
PTR(PVOID) TxnScopeEntercallback;
|
||||||
|
PTR(PVOID) TxnScopeExitCAllback;
|
||||||
|
PTR(PVOID) TxnScopeContext;
|
||||||
|
ULONG LockCount;
|
||||||
|
ULONG ProcessRundown;
|
||||||
|
ULONG64 LastSwitchTime;
|
||||||
|
ULONG64 TotalSwitchOutTime;
|
||||||
|
LARGE_INTEGER WaitReasonBitMap;
|
||||||
|
#else
|
||||||
|
BOOLEAN SafeThunkCall;
|
||||||
|
BOOLEAN BooleanSpare[3];
|
||||||
|
#endif
|
||||||
|
} STRUCT(TEB), *STRUCT(PTEB);
|
||||||
|
|
||||||
|
#if defined(_WIN64) && !defined(EXPLICIT_32BIT)
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), EnvironmentPointer) == 0x038);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ExceptionCode) == 0x2C0);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiTebBatch) == 0x2F0);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), LastStatusValue) == 0x1250);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), Vdm) == 0x1690);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), HardErrorMode) == 0x16B0);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiBatchCount) == 0x1740);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), IdealProcessor) == 0x1747);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), WaitingOnLoaderLock) == 0x1760);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), TlsExpansionSlots) == 0x1780);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), WaitingOnLoaderLock) == 0x1760);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ActiveFrame) == 0x17C0);
|
||||||
|
#else
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), EnvironmentPointer) == 0x01C);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ExceptionCode) == 0x1A4);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiTebBatch) == 0x1D4);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), LastStatusValue) == 0xBF4);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), Vdm) == 0xF18);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiBatchCount) == 0xF70);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), TlsExpansionSlots) == 0xF94);
|
||||||
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ActiveFrame) == 0xFB0);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#undef PTR
|
||||||
|
#undef STRUCT
|
||||||
|
#undef PASTE
|
||||||
|
#undef PASTE2
|
||||||
|
#undef GDI_HANDLE_BUFFER_SIZE
|
|
@ -26,6 +26,7 @@ Author:
|
||||||
#include <ldrtypes.h>
|
#include <ldrtypes.h>
|
||||||
#include <mmtypes.h>
|
#include <mmtypes.h>
|
||||||
#include <obtypes.h>
|
#include <obtypes.h>
|
||||||
|
#include <rtltypes.h>
|
||||||
#ifndef NTOS_MODE_USER
|
#ifndef NTOS_MODE_USER
|
||||||
#include <extypes.h>
|
#include <extypes.h>
|
||||||
#include <setypes.h>
|
#include <setypes.h>
|
||||||
|
@ -616,133 +617,6 @@ typedef struct _INITIAL_PEB
|
||||||
HANDLE Mutant;
|
HANDLE Mutant;
|
||||||
} INITIAL_PEB, *PINITIAL_PEB;
|
} INITIAL_PEB, *PINITIAL_PEB;
|
||||||
|
|
||||||
//
|
|
||||||
// Process Environment Block (PEB)
|
|
||||||
//
|
|
||||||
typedef struct _PEB
|
|
||||||
{
|
|
||||||
BOOLEAN InheritedAddressSpace;
|
|
||||||
BOOLEAN ReadImageFileExecOptions;
|
|
||||||
BOOLEAN BeingDebugged;
|
|
||||||
#if (NTDDI_VERSION >= NTDDI_WS03)
|
|
||||||
struct
|
|
||||||
{
|
|
||||||
BOOLEAN ImageUsesLargePages:1;
|
|
||||||
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
||||||
BOOLEAN IsProtectedProcess:1;
|
|
||||||
BOOLEAN IsLegacyProcess:1;
|
|
||||||
BOOLEAN SpareBits:5;
|
|
||||||
#else
|
|
||||||
BOOLEAN SpareBits:7;
|
|
||||||
#endif
|
|
||||||
};
|
|
||||||
#else
|
|
||||||
BOOLEAN SpareBool;
|
|
||||||
#endif
|
|
||||||
HANDLE Mutant;
|
|
||||||
PVOID ImageBaseAddress;
|
|
||||||
PPEB_LDR_DATA Ldr;
|
|
||||||
struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters;
|
|
||||||
PVOID SubSystemData;
|
|
||||||
PVOID ProcessHeap;
|
|
||||||
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
||||||
struct _RTL_CRITICAL_SECTION *FastPebLock;
|
|
||||||
PVOID AltThunkSListPtr;
|
|
||||||
PVOID IFEOKey;
|
|
||||||
ULONG Spare;
|
|
||||||
union
|
|
||||||
{
|
|
||||||
PVOID* KernelCallbackTable;
|
|
||||||
PVOID UserSharedInfoPtr;
|
|
||||||
};
|
|
||||||
ULONG SystemReserved[1];
|
|
||||||
ULONG SpareUlong;
|
|
||||||
#else
|
|
||||||
PVOID FastPebLock;
|
|
||||||
PPEBLOCKROUTINE FastPebLockRoutine;
|
|
||||||
PPEBLOCKROUTINE FastPebUnlockRoutine;
|
|
||||||
ULONG EnvironmentUpdateCount;
|
|
||||||
PVOID* KernelCallbackTable;
|
|
||||||
PVOID EventLogSection;
|
|
||||||
PVOID EventLog;
|
|
||||||
#endif
|
|
||||||
PPEB_FREE_BLOCK FreeList;
|
|
||||||
ULONG TlsExpansionCounter;
|
|
||||||
PVOID TlsBitmap;
|
|
||||||
ULONG TlsBitmapBits[0x2];
|
|
||||||
PVOID ReadOnlySharedMemoryBase;
|
|
||||||
PVOID ReadOnlySharedMemoryHeap;
|
|
||||||
PVOID* ReadOnlyStaticServerData;
|
|
||||||
PVOID AnsiCodePageData;
|
|
||||||
PVOID OemCodePageData;
|
|
||||||
PVOID UnicodeCaseTableData;
|
|
||||||
ULONG NumberOfProcessors;
|
|
||||||
ULONG NtGlobalFlag;
|
|
||||||
LARGE_INTEGER CriticalSectionTimeout;
|
|
||||||
ULONG HeapSegmentReserve;
|
|
||||||
ULONG HeapSegmentCommit;
|
|
||||||
ULONG HeapDeCommitTotalFreeThreshold;
|
|
||||||
ULONG HeapDeCommitFreeBlockThreshold;
|
|
||||||
ULONG NumberOfHeaps;
|
|
||||||
ULONG MaximumNumberOfHeaps;
|
|
||||||
PVOID* ProcessHeaps;
|
|
||||||
PVOID GdiSharedHandleTable;
|
|
||||||
PVOID ProcessStarterHelper;
|
|
||||||
ULONG GdiDCAttributeList;
|
|
||||||
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
||||||
struct _RTL_CRITICAL_SECTION *LoaderLock;
|
|
||||||
#else
|
|
||||||
PVOID LoaderLock;
|
|
||||||
#endif
|
|
||||||
ULONG OSMajorVersion;
|
|
||||||
ULONG OSMinorVersion;
|
|
||||||
USHORT OSBuildNumber;
|
|
||||||
USHORT OSCSDVersion;
|
|
||||||
ULONG OSPlatformId;
|
|
||||||
ULONG ImageSubSystem;
|
|
||||||
ULONG ImageSubSystemMajorVersion;
|
|
||||||
ULONG ImageSubSystemMinorVersion;
|
|
||||||
ULONG ImageProcessAffinityMask;
|
|
||||||
ULONG GdiHandleBuffer[0x22];
|
|
||||||
PPOST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
|
|
||||||
struct _RTL_BITMAP *TlsExpansionBitmap;
|
|
||||||
ULONG TlsExpansionBitmapBits[0x20];
|
|
||||||
ULONG SessionId;
|
|
||||||
#if (NTDDI_VERSION >= NTDDI_WINXP)
|
|
||||||
ULARGE_INTEGER AppCompatFlags;
|
|
||||||
ULARGE_INTEGER AppCompatFlagsUser;
|
|
||||||
PVOID pShimData;
|
|
||||||
PVOID AppCompatInfo;
|
|
||||||
UNICODE_STRING CSDVersion;
|
|
||||||
struct _ACTIVATION_CONTEXT_DATA *ActivationContextData;
|
|
||||||
struct _ASSEMBLY_STORAGE_MAP *ProcessAssemblyStorageMap;
|
|
||||||
struct _ACTIVATION_CONTEXT_DATA *SystemDefaultActivationContextData;
|
|
||||||
struct _ASSEMBLY_STORAGE_MAP *SystemAssemblyStorageMap;
|
|
||||||
ULONG MinimumStackCommit;
|
|
||||||
#endif
|
|
||||||
#if (NTDDI_VERSION >= NTDDI_WS03)
|
|
||||||
PVOID *FlsCallback;
|
|
||||||
LIST_ENTRY FlsListHead;
|
|
||||||
struct _RTL_BITMAP *FlsBitmap;
|
|
||||||
ULONG FlsBitmapBits[4];
|
|
||||||
ULONG FlsHighIndex;
|
|
||||||
#endif
|
|
||||||
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
||||||
PVOID WerRegistrationData;
|
|
||||||
PVOID WerShipAssertPtr;
|
|
||||||
#endif
|
|
||||||
} PEB, *PPEB;
|
|
||||||
|
|
||||||
//
|
|
||||||
// GDI Batch Descriptor
|
|
||||||
//
|
|
||||||
typedef struct _GDI_TEB_BATCH
|
|
||||||
{
|
|
||||||
ULONG Offset;
|
|
||||||
HANDLE HDC;
|
|
||||||
ULONG Buffer[0x136];
|
|
||||||
} GDI_TEB_BATCH, *PGDI_TEB_BATCH;
|
|
||||||
|
|
||||||
//
|
//
|
||||||
// Initial TEB
|
// Initial TEB
|
||||||
//
|
//
|
||||||
|
@ -771,146 +645,50 @@ typedef struct _TEB_ACTIVE_FRAME
|
||||||
PTEB_ACTIVE_FRAME_CONTEXT Context;
|
PTEB_ACTIVE_FRAME_CONTEXT Context;
|
||||||
} TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
|
} TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
|
||||||
|
|
||||||
|
typedef struct _CLIENT_ID32
|
||||||
|
{
|
||||||
|
ULONG UniqueProcess;
|
||||||
|
ULONG UniqueThread;
|
||||||
|
} CLIENT_ID32, *PCLIENT_ID32;
|
||||||
|
|
||||||
|
typedef struct _CLIENT_ID64
|
||||||
|
{
|
||||||
|
ULONG64 UniqueProcess;
|
||||||
|
ULONG64 UniqueThread;
|
||||||
|
} CLIENT_ID64, *PCLIENT_ID64;
|
||||||
|
|
||||||
|
#if (NTDDI_VERSION < NTDDI_WS03)
|
||||||
|
typedef struct _Wx86ThreadState
|
||||||
|
{
|
||||||
|
PULONG CallBx86Eip;
|
||||||
|
PVOID DeallocationCpu;
|
||||||
|
BOOLEAN UseKnownWx86Dll;
|
||||||
|
CHAR OleStubInvoked;
|
||||||
|
} Wx86ThreadState, *PWx86ThreadState;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
|
||||||
//
|
//
|
||||||
|
// Process Environment Block (PEB)
|
||||||
// Thread Environment Block (TEB)
|
// Thread Environment Block (TEB)
|
||||||
//
|
//
|
||||||
typedef struct _TEB
|
#include "peb_teb.h"
|
||||||
{
|
|
||||||
NT_TIB Tib;
|
|
||||||
PVOID EnvironmentPointer;
|
|
||||||
CLIENT_ID ClientId;
|
|
||||||
PVOID ActiveRpcHandle;
|
|
||||||
PVOID ThreadLocalStoragePointer;
|
|
||||||
struct _PEB *ProcessEnvironmentBlock;
|
|
||||||
ULONG LastErrorValue;
|
|
||||||
ULONG CountOfOwnedCriticalSections;
|
|
||||||
PVOID CsrClientThread;
|
|
||||||
struct _W32THREAD* Win32ThreadInfo;
|
|
||||||
ULONG User32Reserved[0x1A];
|
|
||||||
ULONG UserReserved[5];
|
|
||||||
PVOID WOW32Reserved;
|
|
||||||
LCID CurrentLocale;
|
|
||||||
ULONG FpSoftwareStatusRegister;
|
|
||||||
PVOID SystemReserved1[0x36];
|
|
||||||
LONG ExceptionCode;
|
|
||||||
struct _ACTIVATION_CONTEXT_STACK *ActivationContextStackPointer;
|
|
||||||
#ifdef _WIN64
|
#ifdef _WIN64
|
||||||
UCHAR SpareBytes1[24];
|
//
|
||||||
#else
|
// Explicit 32 bit PEB/TEB
|
||||||
UCHAR SpareBytes1[0x24];
|
//
|
||||||
|
#define EXPLICIT_32BIT
|
||||||
|
#include "peb_teb.h"
|
||||||
|
#undef EXPLICIT_32BIT
|
||||||
|
|
||||||
|
//
|
||||||
|
// Explicit 64 bit PEB/TEB
|
||||||
|
//
|
||||||
|
#define EXPLICIT_64BIT
|
||||||
|
#include "peb_teb.h"
|
||||||
|
#undef EXPLICIT_64BIT
|
||||||
#endif
|
#endif
|
||||||
ULONG TxFsContext;
|
|
||||||
GDI_TEB_BATCH GdiTebBatch;
|
|
||||||
CLIENT_ID RealClientId;
|
|
||||||
PVOID GdiCachedProcessHandle;
|
|
||||||
ULONG GdiClientPID;
|
|
||||||
ULONG GdiClientTID;
|
|
||||||
PVOID GdiThreadLocalInfo;
|
|
||||||
SIZE_T Win32ClientInfo[62];
|
|
||||||
PVOID glDispatchTable[0xE9];
|
|
||||||
SIZE_T glReserved1[0x1D];
|
|
||||||
PVOID glReserved2;
|
|
||||||
PVOID glSectionInfo;
|
|
||||||
PVOID glSection;
|
|
||||||
PVOID glTable;
|
|
||||||
PVOID glCurrentRC;
|
|
||||||
PVOID glContext;
|
|
||||||
NTSTATUS LastStatusValue;
|
|
||||||
UNICODE_STRING StaticUnicodeString;
|
|
||||||
WCHAR StaticUnicodeBuffer[0x105];
|
|
||||||
PVOID DeallocationStack;
|
|
||||||
PVOID TlsSlots[0x40];
|
|
||||||
LIST_ENTRY TlsLinks;
|
|
||||||
PVOID Vdm;
|
|
||||||
PVOID ReservedForNtRpc;
|
|
||||||
PVOID DbgSsReserved[0x2];
|
|
||||||
ULONG HardErrorDisabled;
|
|
||||||
#ifdef _WIN64
|
|
||||||
PVOID Instrumentation[11];
|
|
||||||
#else
|
|
||||||
PVOID Instrumentation[9];
|
|
||||||
#endif
|
|
||||||
GUID ActivityId;
|
|
||||||
PVOID SubProcessTag;
|
|
||||||
PVOID EtwTraceData;
|
|
||||||
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
||||||
PVOID EtwLocalData;
|
|
||||||
#endif
|
|
||||||
PVOID WinSockData;
|
|
||||||
ULONG GdiBatchCount;
|
|
||||||
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
||||||
BOOLEAN SpareBool0;
|
|
||||||
BOOLEAN SpareBool1;
|
|
||||||
BOOLEAN SpareBool2;
|
|
||||||
#else
|
|
||||||
BOOLEAN InDbgPrint;
|
|
||||||
BOOLEAN FreeStackOnTermination;
|
|
||||||
BOOLEAN HasFiberData;
|
|
||||||
#endif
|
|
||||||
UCHAR IdealProcessor;
|
|
||||||
ULONG GuaranteedStackBytes;
|
|
||||||
PVOID ReservedForPerf;
|
|
||||||
PVOID ReservedForOle;
|
|
||||||
ULONG WaitingOnLoaderLock;
|
|
||||||
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
||||||
PVOID SavedPriorityState;
|
|
||||||
#else
|
|
||||||
ULONG SparePointer1;
|
|
||||||
#endif
|
|
||||||
ULONG SoftPatchPtr1;
|
|
||||||
ULONG SoftPatchPtr2;
|
|
||||||
PVOID *TlsExpansionSlots;
|
|
||||||
ULONG ImpersonationLocale;
|
|
||||||
ULONG IsImpersonating;
|
|
||||||
PVOID NlsCache;
|
|
||||||
PVOID pShimData;
|
|
||||||
ULONG HeapVirualAffinity;
|
|
||||||
PVOID CurrentTransactionHandle;
|
|
||||||
PTEB_ACTIVE_FRAME ActiveFrame;
|
|
||||||
#if (NTDDI_VERSION >= NTDDI_WS03)
|
|
||||||
PVOID FlsData;
|
|
||||||
#endif
|
|
||||||
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
||||||
PVOID PreferredLangauges;
|
|
||||||
PVOID UserPrefLanguages;
|
|
||||||
PVOID MergedPrefLanguages;
|
|
||||||
ULONG MuiImpersonation;
|
|
||||||
union
|
|
||||||
{
|
|
||||||
struct
|
|
||||||
{
|
|
||||||
USHORT SpareCrossTebFlags:16;
|
|
||||||
};
|
|
||||||
USHORT CrossTebFlags;
|
|
||||||
};
|
|
||||||
union
|
|
||||||
{
|
|
||||||
struct
|
|
||||||
{
|
|
||||||
USHORT DbgSafeThunkCall:1;
|
|
||||||
USHORT DbgInDebugPrint:1;
|
|
||||||
USHORT DbgHasFiberData:1;
|
|
||||||
USHORT DbgSkipThreadAttach:1;
|
|
||||||
USHORT DbgWerInShipAssertCode:1;
|
|
||||||
USHORT DbgIssuedInitialBp:1;
|
|
||||||
USHORT DbgClonedThread:1;
|
|
||||||
USHORT SpareSameTebBits:9;
|
|
||||||
};
|
|
||||||
USHORT SameTebFlags;
|
|
||||||
};
|
|
||||||
PVOID TxnScopeEntercallback;
|
|
||||||
PVOID TxnScopeExitCAllback;
|
|
||||||
PVOID TxnScopeContext;
|
|
||||||
ULONG LockCount;
|
|
||||||
ULONG ProcessRundown;
|
|
||||||
ULONGLONG LastSwitchTime;
|
|
||||||
ULONGLONG TotalSwitchOutTime;
|
|
||||||
LARGE_INTEGER WaitReasonBitMap;
|
|
||||||
#else
|
|
||||||
UCHAR SafeThunkCall;
|
|
||||||
UCHAR BooleanSpare[3];
|
|
||||||
#endif
|
|
||||||
} TEB, *PTEB;
|
|
||||||
|
|
||||||
#ifdef NTOS_MODE_USER
|
#ifdef NTOS_MODE_USER
|
||||||
|
|
||||||
|
|
|
@ -25,6 +25,7 @@ Author:
|
||||||
#include <umtypes.h>
|
#include <umtypes.h>
|
||||||
#include <ntnls.h>
|
#include <ntnls.h>
|
||||||
#include <rtltypes.h>
|
#include <rtltypes.h>
|
||||||
|
#include <pstypes.h>
|
||||||
#include <extypes.h>
|
#include <extypes.h>
|
||||||
#include "in6addr.h"
|
#include "in6addr.h"
|
||||||
#include "inaddr.h"
|
#include "inaddr.h"
|
||||||
|
|
|
@ -23,7 +23,8 @@ Author:
|
||||||
// Dependencies
|
// Dependencies
|
||||||
//
|
//
|
||||||
#include <umtypes.h>
|
#include <umtypes.h>
|
||||||
#include <pstypes.h>
|
#include <mmtypes.h>
|
||||||
|
#include <ldrtypes.h>
|
||||||
|
|
||||||
//
|
//
|
||||||
// Maximum Atom Length
|
// Maximum Atom Length
|
||||||
|
@ -760,6 +761,7 @@ typedef struct _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
|
||||||
} RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED,
|
} RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED,
|
||||||
*PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED;
|
*PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED;
|
||||||
|
|
||||||
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
||||||
typedef struct _ACTIVATION_CONTEXT_STACK
|
typedef struct _ACTIVATION_CONTEXT_STACK
|
||||||
{
|
{
|
||||||
PRTL_ACTIVATION_CONTEXT_STACK_FRAME ActiveFrame;
|
PRTL_ACTIVATION_CONTEXT_STACK_FRAME ActiveFrame;
|
||||||
|
@ -769,6 +771,15 @@ typedef struct _ACTIVATION_CONTEXT_STACK
|
||||||
ULONG StackId;
|
ULONG StackId;
|
||||||
} ACTIVATION_CONTEXT_STACK,
|
} ACTIVATION_CONTEXT_STACK,
|
||||||
*PACTIVATION_CONTEXT_STACK;
|
*PACTIVATION_CONTEXT_STACK;
|
||||||
|
#else
|
||||||
|
typedef struct _ACTIVATION_CONTEXT_STACK
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
ULONG NextCookieSequenceNumber;
|
||||||
|
PVOID ActiveFrame;
|
||||||
|
LIST_ENTRY FrameListCache;
|
||||||
|
} ACTIVATION_CONTEXT_STACK, *PACTIVATION_CONTEXT_STACK;
|
||||||
|
#endif
|
||||||
|
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
|
|
@ -151,6 +151,8 @@ typedef struct _CSTRING
|
||||||
CONST CHAR *Buffer;
|
CONST CHAR *Buffer;
|
||||||
} CSTRING, *PCSTRING;
|
} CSTRING, *PCSTRING;
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
typedef struct _STRING32 {
|
typedef struct _STRING32 {
|
||||||
USHORT Length;
|
USHORT Length;
|
||||||
USHORT MaximumLength;
|
USHORT MaximumLength;
|
||||||
|
@ -167,7 +169,6 @@ typedef struct _STRING64 {
|
||||||
UNICODE_STRING64, *PUNICODE_STRING64,
|
UNICODE_STRING64, *PUNICODE_STRING64,
|
||||||
ANSI_STRING64, *PANSI_STRING64;
|
ANSI_STRING64, *PANSI_STRING64;
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
typedef struct _OBJECT_ATTRIBUTES
|
typedef struct _OBJECT_ATTRIBUTES
|
||||||
{
|
{
|
||||||
|
|
|
@ -243,10 +243,10 @@ DbgkCreateThread(IN PETHREAD Thread,
|
||||||
wcsncpy(Teb->StaticUnicodeBuffer,
|
wcsncpy(Teb->StaticUnicodeBuffer,
|
||||||
L"ntdll.dll",
|
L"ntdll.dll",
|
||||||
sizeof(Teb->StaticUnicodeBuffer) / sizeof(WCHAR));
|
sizeof(Teb->StaticUnicodeBuffer) / sizeof(WCHAR));
|
||||||
Teb->Tib.ArbitraryUserPointer = Teb->StaticUnicodeBuffer;
|
Teb->NtTib.ArbitraryUserPointer = Teb->StaticUnicodeBuffer;
|
||||||
|
|
||||||
/* Return it in the debug event as well */
|
/* Return it in the debug event as well */
|
||||||
LoadDll->NamePointer = &Teb->Tib.ArbitraryUserPointer;
|
LoadDll->NamePointer = &Teb->NtTib.ArbitraryUserPointer;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Get a handle */
|
/* Get a handle */
|
||||||
|
|
|
@ -169,7 +169,7 @@ KeUserModeCallback(IN ULONG RoutineIndex,
|
||||||
|
|
||||||
/* Save the exception list */
|
/* Save the exception list */
|
||||||
Teb = KeGetCurrentThread()->Teb;
|
Teb = KeGetCurrentThread()->Teb;
|
||||||
ExceptionList = Teb->Tib.ExceptionList;
|
ExceptionList = Teb->NtTib.ExceptionList;
|
||||||
|
|
||||||
/* Jump to user mode */
|
/* Jump to user mode */
|
||||||
*UserEsp = NewStack;
|
*UserEsp = NewStack;
|
||||||
|
@ -177,7 +177,7 @@ KeUserModeCallback(IN ULONG RoutineIndex,
|
||||||
if (CallbackStatus != STATUS_CALLBACK_POP_STACK)
|
if (CallbackStatus != STATUS_CALLBACK_POP_STACK)
|
||||||
{
|
{
|
||||||
/* Only restore the exception list if we didn't crash in ring 3 */
|
/* Only restore the exception list if we didn't crash in ring 3 */
|
||||||
Teb->Tib.ExceptionList = ExceptionList;
|
Teb->NtTib.ExceptionList = ExceptionList;
|
||||||
CallbackStatus = STATUS_SUCCESS;
|
CallbackStatus = STATUS_SUCCESS;
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
|
|
|
@ -517,9 +517,9 @@ MmCreatePeb(IN PEPROCESS Process,
|
||||||
//
|
//
|
||||||
// Write subsystem data
|
// Write subsystem data
|
||||||
//
|
//
|
||||||
Peb->ImageSubSystem = NtHeaders->OptionalHeader.Subsystem;
|
Peb->ImageSubsystem = NtHeaders->OptionalHeader.Subsystem;
|
||||||
Peb->ImageSubSystemMajorVersion = NtHeaders->OptionalHeader.MajorSubsystemVersion;
|
Peb->ImageSubsystemMajorVersion = NtHeaders->OptionalHeader.MajorSubsystemVersion;
|
||||||
Peb->ImageSubSystemMinorVersion = NtHeaders->OptionalHeader.MinorSubsystemVersion;
|
Peb->ImageSubsystemMinorVersion = NtHeaders->OptionalHeader.MinorSubsystemVersion;
|
||||||
|
|
||||||
//
|
//
|
||||||
// Check for version data
|
// Check for version data
|
||||||
|
@ -635,13 +635,13 @@ MmCreateTeb(IN PEPROCESS Process,
|
||||||
//
|
//
|
||||||
// Set TIB Data
|
// Set TIB Data
|
||||||
//
|
//
|
||||||
Teb->Tib.ExceptionList = EXCEPTION_CHAIN_END;
|
Teb->NtTib.ExceptionList = EXCEPTION_CHAIN_END;
|
||||||
Teb->Tib.Self = (PNT_TIB)Teb;
|
Teb->NtTib.Self = (PNT_TIB)Teb;
|
||||||
|
|
||||||
//
|
//
|
||||||
// Identify this as an OS/2 V3.0 ("Cruiser") TIB
|
// Identify this as an OS/2 V3.0 ("Cruiser") TIB
|
||||||
//
|
//
|
||||||
Teb->Tib.Version = 30 << 8;
|
Teb->NtTib.Version = 30 << 8;
|
||||||
|
|
||||||
//
|
//
|
||||||
// Set TEB Data
|
// Set TEB Data
|
||||||
|
@ -660,8 +660,8 @@ MmCreateTeb(IN PEPROCESS Process,
|
||||||
//
|
//
|
||||||
// Use initial TEB values
|
// Use initial TEB values
|
||||||
//
|
//
|
||||||
Teb->Tib.StackBase = InitialTeb->StackBase;
|
Teb->NtTib.StackBase = InitialTeb->StackBase;
|
||||||
Teb->Tib.StackLimit = InitialTeb->StackLimit;
|
Teb->NtTib.StackLimit = InitialTeb->StackLimit;
|
||||||
Teb->DeallocationStack = InitialTeb->AllocatedStackBase;
|
Teb->DeallocationStack = InitialTeb->AllocatedStackBase;
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
|
@ -669,8 +669,8 @@ MmCreateTeb(IN PEPROCESS Process,
|
||||||
//
|
//
|
||||||
// Use grandparent TEB values
|
// Use grandparent TEB values
|
||||||
//
|
//
|
||||||
Teb->Tib.StackBase = InitialTeb->PreviousStackBase;
|
Teb->NtTib.StackBase = InitialTeb->PreviousStackBase;
|
||||||
Teb->Tib.StackLimit = InitialTeb->PreviousStackLimit;
|
Teb->NtTib.StackLimit = InitialTeb->PreviousStackLimit;
|
||||||
}
|
}
|
||||||
|
|
||||||
//
|
//
|
||||||
|
|
|
@ -340,8 +340,8 @@ RtlWalkFrameChain(OUT PVOID *Callers,
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Get the stack limits */
|
/* Get the stack limits */
|
||||||
StackBegin = (ULONG_PTR)Teb->Tib.StackLimit;
|
StackBegin = (ULONG_PTR)Teb->NtTib.StackLimit;
|
||||||
StackEnd = (ULONG_PTR)Teb->Tib.StackBase;
|
StackEnd = (ULONG_PTR)Teb->NtTib.StackBase;
|
||||||
#ifdef _M_IX86
|
#ifdef _M_IX86
|
||||||
Stack = TrapFrame->Ebp;
|
Stack = TrapFrame->Ebp;
|
||||||
#elif defined(_M_PPC)
|
#elif defined(_M_PPC)
|
||||||
|
|
Loading…
Reference in a new issue