-
-
Windows XPSP2(build 2600)未公开的核心数据结构定义文件
-
发表于:
2006-5-9 16:17
8303
-
Windows XPSP2(build 2600)未公开的核心数据结构定义文件
项目刚完, 比较空闲, 翻出以前写的一个DDK辅助定义文件, 自己命名为ntddkex.h, 主要给出xpsp2的未公开核心数据结构的定义(_EPROCESS etc.).
没法上传附件, 直接贴在下面:
// ntddkex.h
//////////////////////////////////////////////////////////////////////////
//
// Author: Eddy Zhang
// Create Date: 2006/01/7
// Contact: eddyz@126.com
// Usage: Declare Undocument Kernel Data Structure
//
//////////////////////////////////////////////////////////////////////////
#ifndef _NTDDK_EX_
#define _NTDDK_EX_
#include <ntddk.h>
#ifndef _KERNEL_2600_ // xp sp2
#define _KERNEL_2600_
typedef struct _KTHREAD* PKTHREAD;
typedef struct _MMWSLE* PMMWSLE;
//typedef struct _MMWSLE
//{
// UINT32 FirstFree;
// UINT32 FirstDynamic;
// UINT32 LastEntry;
// UINT32 NextSlot;
// UINT32 LastInitialized;
// UINT32 NonDirect;
// PVOID HashTable;
// UINT32 HashTableSize;
//} MMWSLE;
typedef struct _KGDTENTRY
{
USHORT LimitLow;
USHORT BaseLow;
struct
{
UCHAR BaseMid;
UCHAR Flags1; // bit0-4 - Type
// bit5-6 - Dpl
// bit7 - Pres
UCHAR Flags2; // bit0-3 - LimitHi
// bit4 - Sys
// bit5 - Reserved_0
// bit6 - Default_Big
// bit7 - Granularity
UCHAR BaseHi;
} HighWord;
} KGDTENTRY, *PKGDTENTRY;
typedef struct _KIDTENTRY
{
USHORT Offset;
USHORT Selector;
USHORT Access;
USHORT ExtendedOffset;
} KIDTENTRY, *PKIDTENTRY;
typedef struct _KEXECUTE_OPTIONS
{
UCHAR Value; // bit0 - ExecuteEnable
// bit1 - DisableThunkEmulation
// bit3 - Permanent
// bit4 - ExecuteDispatchEnable
// bit5 - ImageDispatchEnable
// bit6,7 - Spare
} KEXECUTE_OPTIONS;
typedef struct _KPROCESS
{
DISPATCHER_HEADER Header;
LIST_ENTRY ProfileListHead;
UINT32 DirectoryTableBase[2];
KGDTENTRY LdtDescriptor;
KIDTENTRY Int21Descriptor;
USHORT IopmOffset;
UCHAR Iopl;
UCHAR Unused;
ULONG ActiveProcessors;
ULONG KernelTime;
ULONG UserTime;
LIST_ENTRY ReadyListHead;
SINGLE_LIST_ENTRY SwapListEntry;
PVOID VdmTrapcHandler;
LIST_ENTRY ThreadListHead;
ULONG ProcessLock;
ULONG Affinity;
USHORT StackCount;
CHAR BasePriority;
CHAR ThreadQuantum;
UCHAR AutoAlignment;
UCHAR State;
UCHAR ThreadSeed;
UCHAR DisableBoost;
UCHAR PowerState;
UCHAR DisableQuantum;
UCHAR IdealNode;
union
{
KEXECUTE_OPTIONS Flags;
UCHAR ExecuteOptions;
};
} KPROCESS, *PKPROCESS;
typedef struct _KAPC_STATE
{
LIST_ENTRY ApcListHead[2];
PKPROCESS Process;
UCHAR KernelApcInProgress;
UCHAR KernelApcPending;
UCHAR UserApcPending;
} KAPC_STATE, *PKAPC_STATE;
typedef struct _KQUEUE
{
DISPATCHER_HEADER Header;
LIST_ENTRY EntryListHead;
UINT32 CurrentCount;
UINT32 MaximumCount;
LIST_ENTRY ThreadListHead;
} KQUEUE, *PKQUEUE;
typedef struct _EXCEPTION_REGISTRATION_RECORD
{
struct _EXCEPTION_REGISTRATION_RECORD *Next;
PVOID Handler;
} EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;
typedef struct _KTRAP_FRAME
{
UINT32 DbgEbp;
UINT32 DbgEip;
UINT32 DbgArgMark;
UINT32 DbgArgPointer;
UINT32 TempSegCs;
UINT32 TempEsp;
UINT32 Dr0;
UINT32 Dr1;
UINT32 Dr2;
UINT32 Dr3;
UINT32 Dr6;
UINT32 Dr7;
UINT32 SegGs;
UINT32 SegEs;
UINT32 SegDs;
UINT32 Edx;
UINT32 Ecx;
UINT32 Eax;
UINT32 PreviousPreviousMode;
PEXCEPTION_REGISTRATION_RECORD ExceptionList;
UINT32 SegFs;
UINT32 Edi;
UINT32 Esi;
UINT32 Ebx;
UINT32 Ebp;
UINT32 ErrCode;
UINT32 Eip;
UINT32 SegCs;
UINT32 EFlags;
UINT32 HardwareEsp;
UINT32 HardwareSegSs;
UINT32 V86Es;
UINT32 V86Ds;
UINT32 V86Fs;
UINT32 V86Gs;
} KTRAP_FRAME, *PKTRAP_FRAME;
typedef struct _KTHREAD
{
DISPATCHER_HEADER Header;
LIST_ENTRY MutantListHead;
PVOID InitialStack;
PVOID StackLimit;
PVOID Teb;
PVOID TlsArray;
PVOID KernelStack;
UCHAR DebugActive;
UCHAR State;
UCHAR Alerted[2];
UCHAR Iopl;
UCHAR NpxState;
CHAR Saturation;
CHAR Priority;
KAPC_STATE ApcState;
UINT32 ContextSwitches;
UCHAR IdleSwapBlock;
UCHAR Spare0[3];
INT32 WaitStatus;
UCHAR WaitIrql;
CHAR WaitMode;
UCHAR WaitNext;
UCHAR WaitReason;
PKWAIT_BLOCK WaitBlockList;
union
{
LIST_ENTRY WaitListEntry;
SINGLE_LIST_ENTRY SwapListEntry;
};
UINT32 WaitTime;
CHAR BasePriority;
UCHAR DecrementCount;
CHAR PriorityDecrement;
CHAR Quantum;
KWAIT_BLOCK WaitBlock[4];
PVOID LegoData;
UINT32 KernelApcDisable;
UINT32 UserAffinity;
UCHAR SystemAffinityActive;
UCHAR PowerState;
UCHAR NpxIrql;
UCHAR InitialNode;
PVOID ServiceTable;
PKQUEUE Queue;
UINT32 ApcQueueLock;
KTIMER Timer;
LIST_ENTRY QueueListEntry;
UINT32 SoftAffinity;
UINT32 Affinity;
UCHAR Preempted;
UCHAR ProcessReadyQueue;
UCHAR KernelStackResident;
UCHAR NextProcessor;
PVOID CallbackStack;
PVOID Win32Thread;
PKTRAP_FRAME TrapFrame;
PKAPC_STATE ApcStatePointer[2];
CHAR PreviousMode;
UCHAR EnableStackSwap;
UCHAR LargeStack;
UCHAR ResourceIndex;
UINT32 KernelTime;
UINT32 UserTime;
KAPC_STATE SavedApcState;
UCHAR Alertable;
UCHAR ApcStateIndex;
UCHAR ApcQueueable;
UCHAR AutoAlignment;
PVOID StackBase;
KAPC SuspendApc;
KSEMAPHORE SuspendSemaphore;
LIST_ENTRY ThreadListEntry;
CHAR FreezeCount;
CHAR SuspendCount;
UCHAR IdealProcessor;
UCHAR DisableBoost;
} KTHREAD;
typedef struct _TERMINATION_PORT
{
struct _TERMINATION_PORT *Next;
PVOID Port;
}TERMINATION_PORT, *PTERMINATION_PORT;
typedef struct _PS_IMPERSONATION_INFORMATION
{
PVOID Token;
UCHAR CopyOnOpen;
UCHAR EffectiveOnly;
SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
} PS_IMPERSONATION_INFORMATION, *PPS_IMPERSONATION_INFORMATION;
typedef struct _EX_RUNDOWN_REF
{
UINT32 Count;
PVOID Ptr;
} EX_RUNDOWN_REF, *PEX_RUNDOWN_REF;
typedef union _EX_PUSH_LOCK
{
UINT32 Value; // bit0 - Waiting
// bit1 - Exclusive
// bit2-31 - Shared
PVOID Ptr;
} EX_PUSH_LOCK;
typedef struct _ETHREAD
{
KTHREAD Tcb;
LARGE_INTEGER CreateTime; // bit0-1 - NestedFaultCount
// bit2 - ApcNeeded
union
{
LARGE_INTEGER ExitTime;
LIST_ENTRY LpcReplyChain;
LIST_ENTRY KeyedWaitChain;
};
union
{
INT32 ExitStatus;
PVOID OfsChain;
};
LIST_ENTRY PostBlockList;
union
{
TERMINATION_PORT TerminationPort;
struct _ETHREAD* ReaperLink;
PVOID KeyedWaitValue;
};
UINT32 ActiveTimerListLock;
LIST_ENTRY ActiveTimerListHead;
CLIENT_ID Cid;
union
{
KSEMAPHORE LpcReplySemaphore;
KSEMAPHORE KeyedWaitSemaphore;
};
union
{
PVOID LpcReplyMessage;
PVOID LpcWaitingOnPort;
};
PS_IMPERSONATION_INFORMATION ImpersonationInfo;
LIST_ENTRY IrpList;
UINT32 TopLevelIrp;
PDEVICE_OBJECT DeviceToVerify;
PEPROCESS ThreadsProcess;
PVOID StartAddress;
union
{
PVOID Win32StartAddress;
UINT32 LpcReceivedMessageId;
};
LIST_ENTRY ThreadListEntry;
EX_RUNDOWN_REF RundownProtect;
EX_PUSH_LOCK ThreadLock;
UINT32 LpcReplyMessageId;
UINT32 ReadClusterSize;
UINT32 GrantedAccess;
UINT32 CrossThreadFlags; // bit0 - Terminated
// bit1 - DeadThread
// bit2 - HideFromDebugger
// bit3 - ActiveImpersonationInfo
// bit4 - SystemThread
// bit5 - HardErrorsAreDisabled
// bit6 - BreakOnTermination
// bit7 - SkipCreationMsg
// bit8 - SkipTerminationMsg
UINT32 SameThreadPassiveFlags; // bit0 - ActiveExWorker;
// bit1 - ExWorkerCanWaitUser;
// bit2 - MemoryMaker;
UINT32 SameThreadApcFlags; // bit0 - LpcReceivedMsgIdValid;
// bit1 - LpcExitThreadCalled;
// bit2 - AddressSpaceOwner;
UCHAR ForwardClusterOnly;
UCHAR DisablePageFaultClustering;
} ETHREAD;
typedef struct _SID_AND_ATTRIBUTES
{
PSID Sid;
UINT32 Attributes;
} SID_AND_ATTRIBUTES, * PSID_AND_ATTRIBUTES;
typedef struct _PS_JOB_TOKEN_FILTER
{
UINT32 CapturedSidCount;
PSID_AND_ATTRIBUTES CapturedSids;
UINT32 CapturedSidsLength;
UINT32 CapturedGroupCount;
PSID_AND_ATTRIBUTES CapturedGroups;
UINT32 CapturedGroupsLength;
UINT32 CapturedPrivilegeCount;
PLUID_AND_ATTRIBUTES CapturedPrivileges;
UINT32 CapturedPrivilegesLength;
} PS_JOB_TOKEN_FILTER, *PPS_JOB_TOKEN_FILTER;
typedef struct _EJOB
{
KEVENT Event;
LIST_ENTRY JobLinks;
LIST_ENTRY ProcessListHead;
ERESOURCE JobLock;
LARGE_INTEGER TotalUserTime;
LARGE_INTEGER TotalKernelTime;
LARGE_INTEGER ThisPeriodTotalUserTime;
LARGE_INTEGER ThisPeriodTotalKernelTime;
UINT32 TotalPageFaultCount;
UINT32 TotalProcesses;
UINT32 ActiveProcesses;
UINT32 TotalTerminatedProcesses;
LARGE_INTEGER PerProcessUserTimeLimit;
LARGE_INTEGER PerJobUserTimeLimit;
UINT32 LimitFlags;
UINT32 MinimumWorkingSetSize;
UINT32 MaximumWorkingSetSize;
UINT32 ActiveProcessLimit;
UINT32 Affinity;
UCHAR PriorityClass;
UINT32 UIRestrictionsClass;
UINT32 SecurityLimitFlags;
PVOID Token;
PPS_JOB_TOKEN_FILTER Filter;
UINT32 EndOfJobTimeAction;
PVOID CompletionPort;
PVOID CompletionKey;
UINT32 SessionId;
UINT32 SchedulingClass;
UINT64 ReadOperationCount;
UINT64 WriteOperationCount;
UINT64 OtherOperationCount;
UINT64 ReadTransferCount;
UINT64 WriteTransferCount;
UINT64 OtherTransferCount;
IO_COUNTERS IoInfo;
UINT32 ProcessMemoryLimit;
UINT32 JobMemoryLimit;
UINT32 PeakProcessMemoryUsed;
UINT32 PeakJobMemoryUsed;
UINT32 CurrentJobMemoryUsed;
FAST_MUTEX MemoryLimitsLock;
LIST_ENTRY JobSetLinks;
UINT32 MemberLevel;
UINT32 JobFlags;
} EJOB, *PEJOB;
typedef struct _EPROCESS_QUOTA_ENTRY
{
UINT32 Usage;
UINT32 Limit;
UINT32 Peak;
UINT32 Return;
} EPROCESS_QUOTA_ENTRY, *PEPROCESS_QUOTA_ENTRY;
typedef struct _EPROCESS_QUOTA_BLOCK
{
EPROCESS_QUOTA_ENTRY QuotaEntry;
LIST_ENTRY QuotaList;
UINT32 ReferenceCount;
UINT32 ProcessCount;
} EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;
typedef struct _PAGEFAULT_HISTORY
{
UINT32 CurrentIndex;
UINT32 MaxIndex;
UINT32 SpinLock;
PVOID Reserved;
PROCESS_WS_WATCH_INFORMATION WatchInfo[1];
} PAGEFAULT_HISTORY, *PPAGEFAULT_HISTORY;
typedef struct _HARDWARE_PTE_X86
{
UINT32 Value; // bit0 - Valid
// bit1 - Write
// bit2 - Owner
// bit3 - WriteThrough
// bit4 - CacheDisable
// bit5 - Accessed
// bit6 - Dirty
// bit7 - LargePage
// bit8 - Global
// bit9 - CopyOnWrite
// bit10 - Prototype
// bit11 - reserved
// bit12-31 - PageFrameNumber
} HARDWARE_PTE_X86;
typedef struct _EX_FAST_REF
{
PVOID Object;
UINT32 Value; //bit0-2 - RefCnt
} EX_FAST_REF, *PEX_FAST_REF;
typedef struct _SE_AUDIT_PROCESS_CREATION_INFO
{
POBJECT_NAME_INFORMATION ImageFileName;
} SE_AUDIT_PROCESS_CREATION_INFO;
typedef struct _MMSUPPORT_FLAGS
{
UINT32 Value; // bit0 - SessionSpace
// bit1 - BeingTrimmed
// bit2 - SessionLeader
// bit3 - TrimHard
// bit4 - WorkingSetHard
// bit5 - AddressSpaceBeingDeleted
// bit6-15 - Available
// bit16-23 - AllowWorkingSetAdjustment
// bit24-31 - MemoryPriority
} MMSUPPORT_FLAGS;
typedef struct _MMWSLE_HASH
{
PVOID Key;
UINT32 Index;
} MMWSLE_HASH, *PMMWSLE_HASH;
typedef struct _MMWSL
{
UINT32 Quota;
UINT32 FirstFree;
UINT32 FirstDynamic;
UINT32 LastEntry;
UINT32 NextSlot;
PMMWSLE Wsle;
UINT32 LastInitializedWsle;
UINT32 NonDirectCount;
PMMWSLE_HASH HashTable;
UINT32 HashTableSize;
UINT32 NumberOfCommittedPageTables;
PVOID HashTableStart;
PVOID HighestPermittedHashAddress;
UINT32 NumberOfImageWaiters;
UINT32 VadBitMapHint;
union
{
USHORT UsedPageTableEntries[1536];
UINT32 CommittedPageTables[48];
};
} MMWSL, *PMMWSL;
typedef struct _MMSUPPORT
{
LARGE_INTEGER LastTrimTime;
MMSUPPORT_FLAGS Flags;
UINT32 PageFaultCount;
UINT32 PeakWorkingSetSize;
UINT32 WorkingSetSize;
UINT32 MinimumWorkingSetSize;
UINT32 MaximumWorkingSetSize;
PMMWSL VmWorkingSetList;
LIST_ENTRY WorkingSetExpansionLinks;
UINT32 Claim;
UINT32 NextEstimationSlot;
UINT32 NextAgingSlot;
UINT32 EstimatedAvailable;
UINT32 GrowthSinceLastEstimate;
} MMSUPPORT;
typedef struct _HANDLE_TRACE_DB_ENTRY
{
CLIENT_ID ClientId;
PVOID Handle;
UINT32 Type;
PVOID StackTrace;
} HANDLE_TRACE_DB_ENTRY, *PHANDLE_TRACE_DB_ENTRY;
typedef struct _HANDLE_TRACE_DEBUG_INFO
{
UINT32 CurrentStackIndex;
HANDLE_TRACE_DB_ENTRY TraceDb[4096];
} HANDLE_TRACE_DEBUG_INFO, *PHANDLE_TRACE_DEBUG_INFO;
typedef struct _HANDLE_TABLE_ENTRY
{
union
{
PVOID Object;
UINT32 ObAttributes;
struct _HANDLE_TABLE_ENTRY *InfoTable;
UINT32 Value;
};
union
{
UINT32 GrantedAccess;
struct
{
USHORT GrantedAccessIndex;
USHORT CreatorBackTraceIndex;
};
INT32 NextFreeTableEntry;
};
} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;
typedef struct _HANDLE_TABLE
{
UINT32 TableCode;
PEPROCESS QuotaProcess;
PVOID UniqueProcessId;
EX_PUSH_LOCK HandleTableLock[4];
LIST_ENTRY HandleTableList;
EX_PUSH_LOCK HandleContentionEvent;
PHANDLE_TRACE_DEBUG_INFO DebugInfo;
UINT32 FirstFree;
UINT32 LastFree;
UINT32 NextHandleNeedingPool;
INT32 HandleCount;
UINT32 Flags; // bit0 - StrictFIFO
} HANDLE_TABLE, *PHANDLE_TABLE;
typedef struct _EPROCESS
{
KPROCESS Pcb;
EX_PUSH_LOCK ProcessLock;
LARGE_INTEGER CreateTime;
LARGE_INTEGER ExitTime;
EX_RUNDOWN_REF RundownProtect;
PVOID UniqueProcessId;
LIST_ENTRY ActiveProcessLinks;
UINT32 QuotaUsage[3];
UINT32 QuotaPeak[3];
UINT32 CommitCharge;
UINT32 PeakVirtualSize;
UINT32 VirtualSize;
LIST_ENTRY SessionProcessLinks;
PVOID DebugPort;
PVOID ExceptionPort;
PHANDLE_TABLE ObjectTable;
EX_FAST_REF Token;
FAST_MUTEX WorkingSetLock;
UINT32 WorkingSetPage;
FAST_MUTEX AddressCreationLock;
UINT32 HyperSpaceLock;
PETHREAD ForkInProgress;
UINT32 HardwareTrigger;
PVOID VadRoot;
PVOID VadHint;
PVOID CloneRoot;
UINT32 NumberOfPrivatePages;
UINT32 NumberOfLockedPages;
PVOID Win32Process;
PEJOB Job;
PVOID SectionObject;
PVOID SectionBaseAddress;
PEPROCESS_QUOTA_BLOCK QuotaBlock;
PPAGEFAULT_HISTORY WorkingSetWatch;
PVOID Win32WindowStation;
PVOID InheritedFromUniqueProcessId;
PVOID LdtInformation;
PVOID VadFreeHint;
PVOID VdmObjects;
PVOID DeviceMap;
LIST_ENTRY PhysicalVadList;
union
{
HARDWARE_PTE_X86 PageDirectoryPte;
UINT64 Filler;
};
PVOID Session;
UCHAR ImageFileName[16];
LIST_ENTRY JobLinks;
PVOID LockedPagesList;
LIST_ENTRY ThreadListHead;
PVOID SecurityPort;
PVOID PaeTop;
UINT32 ActiveThreads;
UINT32 GrantedAccess;
UINT32 DefaultHardErrorProcessing;
INT32 LastThreadExitStatus;
PPEB Peb;
EX_FAST_REF PrefetchTrace;
LARGE_INTEGER ReadOperationCount;
LARGE_INTEGER WriteOperationCount;
LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
UINT32 CommitChargeLimit;
UINT32 CommitChargePeak;
PVOID AweInfo;
SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;
MMSUPPORT Vm;
UINT32 LastFaultCount;
UINT32 ModifiedPageCount;
UINT32 NumberOfVads;
UINT32 JobStatus;
UINT32 Flags; // bit0 - CreateReported
// bit1 - NoDebugInherit
// bit2 - ProcessExiting
// bit3 - ProcessDelete
// bit4 - Wow64SplitPages
// bit5 - VmDeleted
// bit6 - OutswapEnabled
// bit7 - Outswapped
// bit8 - ForkFailed
// bit9 - HasPhysicalVad
// bit10-11 - AddressSpaceInitialized
// bit12 - SetTimerResolution
// bit13 - BreakOnTermination
// bit14 - SessionCreationUnderway
// bit15 - WriteWatch
// bit16 - ProcessInSession
// bit17 - OverrideAddressSpace
// bit18 - HasAddressSpace
// bit19 - LaunchPrefetched
// bit20 - InjectInpageErrors
// bit21 - VmTopDown
// bit22 - Unused3
// bit23 - Unused4
// bit24 - VdmAllowed
// bit25-29 - Unused
// bit30 - Unused1
// bit31 - Unused2
INT32 ExitStatus;
USHORT NextPageColor;
union
{
struct
{
UCHAR SubSystemMinorVersion;
UCHAR SubSystemMajorVersion;
};
USHORT SubSystemVersion;
};
UCHAR PriorityClass;
UCHAR WorkingSetAcquiredUnsafe;
UCHAR Unknow1;
UCHAR Unknow2;
UINT32 Cookie;
} EPROCESS, *PEPROCESS;
#endif
#endif
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
