mirror of
https://github.com/reactos/reactos.git
synced 2024-08-19 18:02:55 +00:00
![Amine Khaldi](/assets/img/avatar_default.png)
* Create a branch for some evul shell experiments. svn path=/branches/shell-experiments/; revision=61927
395 lines
13 KiB
C
395 lines
13 KiB
C
#define PASTE2(x,y) x##y
|
|
#define PASTE(x,y) PASTE2(x,y)
|
|
|
|
#ifdef EXPLICIT_32BIT
|
|
#define STRUCT(x) PASTE(x,32)
|
|
#define PTR(x) ULONG
|
|
#elif defined(EXPLICIT_64BIT)
|
|
#define STRUCT(x) PASTE(x,64)
|
|
#define PTR(x) ULONG64
|
|
#else
|
|
#define STRUCT(x) x
|
|
#define PTR(x) x
|
|
#endif
|
|
|
|
#if (defined(_WIN64) && !defined(EXPLICIT_32BIT)) || defined(EXPLICIT_64BIT)
|
|
#define GDI_HANDLE_BUFFER_SIZE 60
|
|
#else
|
|
#define GDI_HANDLE_BUFFER_SIZE 34
|
|
#endif
|
|
|
|
#if defined(_NTDDK_INCLUDED_) || defined(_NTIFS_)
|
|
#define PPEB PPEB_RENAMED
|
|
#endif
|
|
|
|
typedef struct STRUCT(_PEB)
|
|
{
|
|
BOOLEAN InheritedAddressSpace;
|
|
BOOLEAN ReadImageFileExecOptions;
|
|
BOOLEAN BeingDebugged;
|
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
|
union
|
|
{
|
|
BOOLEAN BitField;
|
|
struct
|
|
{
|
|
BOOLEAN ImageUsesLargePages:1;
|
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
BOOLEAN IsProtectedProcess:1;
|
|
BOOLEAN IsLegacyProcess:1;
|
|
BOOLEAN IsImageDynamicallyRelocated:1;
|
|
BOOLEAN SkipPatchingUser32Forwarders:1;
|
|
BOOLEAN SpareBits:3;
|
|
#else
|
|
BOOLEAN SpareBits:7;
|
|
#endif
|
|
};
|
|
};
|
|
#else
|
|
BOOLEAN SpareBool;
|
|
#endif
|
|
PTR(HANDLE) Mutant;
|
|
PTR(PVOID) ImageBaseAddress;
|
|
PTR(PPEB_LDR_DATA) Ldr;
|
|
PTR(struct _RTL_USER_PROCESS_PARAMETERS*) ProcessParameters;
|
|
PTR(PVOID) SubSystemData;
|
|
PTR(PVOID) ProcessHeap;
|
|
PTR(struct _RTL_CRITICAL_SECTION*) FastPebLock;
|
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
PTR(PVOID) AltThunkSListPtr;
|
|
PTR(PVOID) IFEOKey;
|
|
union
|
|
{
|
|
ULONG CrossProcessFlags;
|
|
struct
|
|
{
|
|
ULONG ProcessInJob:1;
|
|
ULONG ProcessInitializing:1;
|
|
ULONG ProcessUsingVEH:1;
|
|
ULONG ProcessUsingVCH:1;
|
|
ULONG ReservedBits0:28;
|
|
};
|
|
};
|
|
union
|
|
{
|
|
PTR(PVOID) KernelCallbackTable;
|
|
PTR(PVOID) UserSharedInfoPtr;
|
|
};
|
|
#elif (NTDDI_VERSION >= NTDDI_WS03)
|
|
PTR(PVOID) AltThunkSListPtr;
|
|
PTR(PVOID) SparePtr2;
|
|
ULONG EnvironmentUpdateCount;
|
|
PTR(PVOID) KernelCallbackTable;
|
|
#else
|
|
PTR(PPEBLOCKROUTINE) FastPebLockRoutine;
|
|
PTR(PPEBLOCKROUTINE) FastPebUnlockRoutine;
|
|
ULONG EnvironmentUpdateCount;
|
|
PTR(PVOID) KernelCallbackTable;
|
|
#endif
|
|
ULONG SystemReserved[1];
|
|
ULONG SpareUlong; // AtlThunkSListPtr32
|
|
PTR(PPEB_FREE_BLOCK) FreeList;
|
|
ULONG TlsExpansionCounter;
|
|
PTR(PVOID) TlsBitmap;
|
|
ULONG TlsBitmapBits[2];
|
|
PTR(PVOID) ReadOnlySharedMemoryBase;
|
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
PTR(PVOID) HotpatchInformation;
|
|
#else
|
|
PTR(PVOID) ReadOnlySharedMemoryHeap;
|
|
#endif
|
|
PTR(PVOID*) ReadOnlyStaticServerData;
|
|
PTR(PVOID) AnsiCodePageData;
|
|
PTR(PVOID) OemCodePageData;
|
|
PTR(PVOID) UnicodeCaseTableData;
|
|
ULONG NumberOfProcessors;
|
|
ULONG NtGlobalFlag;
|
|
LARGE_INTEGER CriticalSectionTimeout;
|
|
PTR(ULONG_PTR) HeapSegmentReserve;
|
|
PTR(ULONG_PTR) HeapSegmentCommit;
|
|
PTR(ULONG_PTR) HeapDeCommitTotalFreeThreshold;
|
|
PTR(ULONG_PTR) HeapDeCommitFreeBlockThreshold;
|
|
ULONG NumberOfHeaps;
|
|
ULONG MaximumNumberOfHeaps;
|
|
PTR(PVOID*) ProcessHeaps;
|
|
PTR(PVOID) GdiSharedHandleTable;
|
|
PTR(PVOID) ProcessStarterHelper;
|
|
ULONG GdiDCAttributeList;
|
|
PTR(struct _RTL_CRITICAL_SECTION*) LoaderLock;
|
|
ULONG OSMajorVersion;
|
|
ULONG OSMinorVersion;
|
|
USHORT OSBuildNumber;
|
|
USHORT OSCSDVersion;
|
|
ULONG OSPlatformId;
|
|
ULONG ImageSubsystem;
|
|
ULONG ImageSubsystemMajorVersion;
|
|
ULONG ImageSubsystemMinorVersion;
|
|
PTR(ULONG_PTR) ImageProcessAffinityMask;
|
|
ULONG GdiHandleBuffer[GDI_HANDLE_BUFFER_SIZE];
|
|
PTR(PPOST_PROCESS_INIT_ROUTINE) PostProcessInitRoutine;
|
|
PTR(PVOID) TlsExpansionBitmap;
|
|
ULONG TlsExpansionBitmapBits[32];
|
|
ULONG SessionId;
|
|
#if (NTDDI_VERSION >= NTDDI_WINXP)
|
|
ULARGE_INTEGER AppCompatFlags;
|
|
ULARGE_INTEGER AppCompatFlagsUser;
|
|
PTR(PVOID) pShimData;
|
|
PTR(PVOID) AppCompatInfo;
|
|
STRUCT(UNICODE_STRING) CSDVersion;
|
|
PTR(struct _ACTIVATION_CONTEXT_DATA*) ActivationContextData;
|
|
PTR(struct _ASSEMBLY_STORAGE_MAP*) ProcessAssemblyStorageMap;
|
|
PTR(struct _ACTIVATION_CONTEXT_DATA*) SystemDefaultActivationContextData;
|
|
PTR(struct _ASSEMBLY_STORAGE_MAP*) SystemAssemblyStorageMap;
|
|
PTR(ULONG_PTR) MinimumStackCommit;
|
|
#endif
|
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
|
PTR(PVOID*) FlsCallback;
|
|
STRUCT(LIST_ENTRY) FlsListHead;
|
|
PTR(PVOID) FlsBitmap;
|
|
ULONG FlsBitmapBits[4]; // [FLS_MAXIMUM_AVAILABLE/(sizeof(ULONG)*8)];
|
|
ULONG FlsHighIndex;
|
|
#endif
|
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
PTR(PVOID) WerRegistrationData;
|
|
PTR(PVOID) WerShipAssertPtr;
|
|
#endif
|
|
} STRUCT(PEB), *STRUCT(PPEB);
|
|
|
|
#undef PPEB
|
|
|
|
#if defined(_WIN64) && !defined(EXPLICIT_32BIT)
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Mutant) == 0x08);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Ldr) == 0x18);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FastPebLock) == 0x038);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), TlsExpansionCounter) == 0x070);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), NtGlobalFlag) == 0x0BC);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), GdiSharedHandleTable) == 0x0F8);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), LoaderLock) == 0x110);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageSubsystem) == 0x128);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageProcessAffinityMask) == 0x138);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), PostProcessInitRoutine) == 0x230);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), SessionId) == 0x2C0);
|
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FlsHighIndex) == 0x350);
|
|
#endif
|
|
#else
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Mutant) == 0x04);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), Ldr) == 0x0C);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FastPebLock) == 0x01C);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), TlsExpansionCounter) == 0x03C);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), NtGlobalFlag) == 0x068);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), GdiSharedHandleTable) == 0x094);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), LoaderLock) == 0x0A0);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageSubsystem) == 0x0B4);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), ImageProcessAffinityMask) == 0x0C0);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), PostProcessInitRoutine) == 0x14C);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), SessionId) == 0x1D4);
|
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(PEB), FlsHighIndex) == 0x22C);
|
|
#endif
|
|
#endif
|
|
|
|
#define GDI_BATCH_BUFFER_SIZE 0x136
|
|
//
|
|
// GDI Batch Descriptor
|
|
//
|
|
typedef struct STRUCT(_GDI_TEB_BATCH)
|
|
{
|
|
ULONG Offset;
|
|
PTR(HANDLE) HDC;
|
|
ULONG Buffer[GDI_BATCH_BUFFER_SIZE];
|
|
} STRUCT(GDI_TEB_BATCH), *STRUCT(PGDI_TEB_BATCH);
|
|
|
|
//
|
|
// Thread Environment Block (TEB)
|
|
//
|
|
typedef struct STRUCT(_TEB)
|
|
{
|
|
STRUCT(NT_TIB) NtTib;
|
|
PTR(PVOID) EnvironmentPointer;
|
|
STRUCT(CLIENT_ID) ClientId;
|
|
PTR(PVOID) ActiveRpcHandle;
|
|
PTR(PVOID) ThreadLocalStoragePointer;
|
|
PTR(STRUCT(PPEB)) ProcessEnvironmentBlock;
|
|
ULONG LastErrorValue;
|
|
ULONG CountOfOwnedCriticalSections;
|
|
PTR(PVOID) CsrClientThread;
|
|
PTR(PVOID) Win32ThreadInfo;
|
|
ULONG User32Reserved[26];
|
|
ULONG UserReserved[5];
|
|
PTR(PVOID) WOW32Reserved;
|
|
LCID CurrentLocale;
|
|
ULONG FpSoftwareStatusRegister;
|
|
PTR(PVOID) SystemReserved1[54];
|
|
LONG ExceptionCode;
|
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
PTR(struct _ACTIVATION_CONTEXT_STACK*) ActivationContextStackPointer;
|
|
UCHAR SpareBytes1[0x30 - 3 * sizeof(PTR(PVOID))];
|
|
ULONG TxFsContext;
|
|
#elif (NTDDI_VERSION >= NTDDI_WS03)
|
|
PTR(struct _ACTIVATION_CONTEXT_STACK*) ActivationContextStackPointer;
|
|
UCHAR SpareBytes1[0x34 - 3 * sizeof(PTR(PVOID))];
|
|
#else
|
|
ACTIVATION_CONTEXT_STACK ActivationContextStack;
|
|
UCHAR SpareBytes1[24];
|
|
#endif
|
|
STRUCT(GDI_TEB_BATCH) GdiTebBatch;
|
|
STRUCT(CLIENT_ID) RealClientId;
|
|
PTR(PVOID) GdiCachedProcessHandle;
|
|
ULONG GdiClientPID;
|
|
ULONG GdiClientTID;
|
|
PTR(PVOID) GdiThreadLocalInfo;
|
|
PTR(SIZE_T) Win32ClientInfo[62];
|
|
PTR(PVOID) glDispatchTable[233];
|
|
PTR(SIZE_T) glReserved1[29];
|
|
PTR(PVOID) glReserved2;
|
|
PTR(PVOID) glSectionInfo;
|
|
PTR(PVOID) glSection;
|
|
PTR(PVOID) glTable;
|
|
PTR(PVOID) glCurrentRC;
|
|
PTR(PVOID) glContext;
|
|
NTSTATUS LastStatusValue;
|
|
STRUCT(UNICODE_STRING) StaticUnicodeString;
|
|
WCHAR StaticUnicodeBuffer[261];
|
|
PTR(PVOID) DeallocationStack;
|
|
PTR(PVOID) TlsSlots[64];
|
|
STRUCT(LIST_ENTRY) TlsLinks;
|
|
PTR(PVOID) Vdm;
|
|
PTR(PVOID) ReservedForNtRpc;
|
|
PTR(PVOID) DbgSsReserved[2];
|
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
|
ULONG HardErrorMode;
|
|
#else
|
|
ULONG HardErrorsAreDisabled;
|
|
#endif
|
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
PTR(PVOID) Instrumentation[13 - sizeof(GUID)/sizeof(PTR(PVOID))];
|
|
GUID ActivityId;
|
|
PTR(PVOID) SubProcessTag;
|
|
PTR(PVOID) EtwLocalData;
|
|
PTR(PVOID) EtwTraceData;
|
|
#elif (NTDDI_VERSION >= NTDDI_WS03)
|
|
PTR(PVOID) Instrumentation[14];
|
|
PTR(PVOID) SubProcessTag;
|
|
PTR(PVOID) EtwLocalData;
|
|
#else
|
|
PTR(PVOID) Instrumentation[16];
|
|
#endif
|
|
PTR(PVOID) WinSockData;
|
|
ULONG GdiBatchCount;
|
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
BOOLEAN SpareBool0;
|
|
BOOLEAN SpareBool1;
|
|
BOOLEAN SpareBool2;
|
|
#else
|
|
BOOLEAN InDbgPrint;
|
|
BOOLEAN FreeStackOnTermination;
|
|
BOOLEAN HasFiberData;
|
|
#endif
|
|
UCHAR IdealProcessor;
|
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
|
ULONG GuaranteedStackBytes;
|
|
#else
|
|
ULONG Spare3;
|
|
#endif
|
|
PTR(PVOID) ReservedForPerf;
|
|
PTR(PVOID) ReservedForOle;
|
|
ULONG WaitingOnLoaderLock;
|
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
PTR(PVOID) SavedPriorityState;
|
|
PTR(ULONG_PTR) SoftPatchPtr1;
|
|
PTR(ULONG_PTR) ThreadPoolData;
|
|
#elif (NTDDI_VERSION >= NTDDI_WS03)
|
|
PTR(ULONG_PTR) SparePointer1;
|
|
PTR(ULONG_PTR) SoftPatchPtr1;
|
|
PTR(ULONG_PTR) SoftPatchPtr2;
|
|
#else
|
|
Wx86ThreadState Wx86Thread;
|
|
#endif
|
|
PTR(PVOID*) TlsExpansionSlots;
|
|
#if defined(_WIN64) && !defined(EXPLICIT_32BIT)
|
|
PTR(PVOID) DeallocationBStore;
|
|
PTR(PVOID) BStoreLimit;
|
|
#endif
|
|
ULONG ImpersonationLocale;
|
|
ULONG IsImpersonating;
|
|
PTR(PVOID) NlsCache;
|
|
PTR(PVOID) pShimData;
|
|
ULONG HeapVirtualAffinity;
|
|
PTR(HANDLE) CurrentTransactionHandle;
|
|
PTR(PTEB_ACTIVE_FRAME) ActiveFrame;
|
|
#if (NTDDI_VERSION >= NTDDI_WS03)
|
|
PVOID FlsData;
|
|
#endif
|
|
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
PVOID PreferredLangauges;
|
|
PVOID UserPrefLanguages;
|
|
PVOID MergedPrefLanguages;
|
|
ULONG MuiImpersonation;
|
|
union
|
|
{
|
|
struct
|
|
{
|
|
USHORT SpareCrossTebFlags:16;
|
|
};
|
|
USHORT CrossTebFlags;
|
|
};
|
|
union
|
|
{
|
|
struct
|
|
{
|
|
USHORT DbgSafeThunkCall:1;
|
|
USHORT DbgInDebugPrint:1;
|
|
USHORT DbgHasFiberData:1;
|
|
USHORT DbgSkipThreadAttach:1;
|
|
USHORT DbgWerInShipAssertCode:1;
|
|
USHORT DbgIssuedInitialBp:1;
|
|
USHORT DbgClonedThread:1;
|
|
USHORT SpareSameTebBits:9;
|
|
};
|
|
USHORT SameTebFlags;
|
|
};
|
|
PTR(PVOID) TxnScopeEntercallback;
|
|
PTR(PVOID) TxnScopeExitCAllback;
|
|
PTR(PVOID) TxnScopeContext;
|
|
ULONG LockCount;
|
|
ULONG ProcessRundown;
|
|
ULONG64 LastSwitchTime;
|
|
ULONG64 TotalSwitchOutTime;
|
|
LARGE_INTEGER WaitReasonBitMap;
|
|
#else
|
|
BOOLEAN SafeThunkCall;
|
|
BOOLEAN BooleanSpare[3];
|
|
#endif
|
|
} STRUCT(TEB), *STRUCT(PTEB);
|
|
|
|
#if defined(_WIN64) && !defined(EXPLICIT_32BIT)
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), EnvironmentPointer) == 0x038);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ExceptionCode) == 0x2C0);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiTebBatch) == 0x2F0);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), LastStatusValue) == 0x1250);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), Vdm) == 0x1690);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), HardErrorMode) == 0x16B0);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiBatchCount) == 0x1740);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), IdealProcessor) == 0x1747);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), WaitingOnLoaderLock) == 0x1760);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), TlsExpansionSlots) == 0x1780);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), WaitingOnLoaderLock) == 0x1760);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ActiveFrame) == 0x17C0);
|
|
#else
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), EnvironmentPointer) == 0x01C);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ExceptionCode) == 0x1A4);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiTebBatch) == 0x1D4);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), LastStatusValue) == 0xBF4);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), Vdm) == 0xF18);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), GdiBatchCount) == 0xF70);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), TlsExpansionSlots) == 0xF94);
|
|
C_ASSERT(FIELD_OFFSET(STRUCT(TEB), ActiveFrame) == 0xFB0);
|
|
#endif
|
|
|
|
#undef PTR
|
|
#undef STRUCT
|
|
#undef PASTE
|
|
#undef PASTE2
|
|
#undef GDI_HANDLE_BUFFER_SIZE
|