// SystemModuleInformation (11)
typedef
-struct _SYSTEM_MODULE_ENTRY
+struct _SYSTEM_MODULE_INFORMATION
{
+ ULONG Reserved[2];
+ PVOID Base;
+ SIZE_T Size;
+ ULONG Flags;
+ USHORT Index;
+ USHORT Unknown;
+ USHORT LoadCount;
+ USHORT ModuleNameOffset;
+ CHAR ImageName[256];
+#if 0
ULONG Unknown1;
ULONG Unknown2;
PVOID BaseAddress;
USHORT NameLength; /* Length of module name not including the path, this field contains valid value only for NTOSKRNL module*/
USHORT PathLength; /* Length of 'directory path' part of modulename*/
CHAR Name [256];
-} SYSTEM_MODULE_ENTRY, * PSYSTEM_MODULE_ENTRY;
+#endif
+} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION;
typedef
-struct _SYSTEM_MODULE_INFORMATION
+struct _SYSTEM_MODULES
{
- ULONG Count;
- SYSTEM_MODULE_ENTRY Module [1];
-} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
+ SIZE_T Count;
+ SYSTEM_MODULE_INFORMATION Modules[ANYSIZE_ARRAY];
+} SYSTEM_MODULES, *PSYSTEM_MODULES;
// SystemHandleInformation (16)
// (see ontypes.h)
// Information class 2
typedef struct _IO_COUNTERS
{
- ULONG ReadOperationCount;
- ULONG WriteOperationCount;
- ULONG OtherOperationCount;
+ LARGE_INTEGER ReadOperationCount;
+ LARGE_INTEGER WriteOperationCount;
+ LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
typedef struct _FILE_BASIC_INFORMATION
{
- TIME CreationTime;
- TIME LastAccessTime;
- TIME LastWriteTime;
- TIME ChangeTime;
+ LARGE_INTEGER CreationTime;
+ LARGE_INTEGER LastAccessTime;
+ LARGE_INTEGER LastWriteTime;
+ LARGE_INTEGER ChangeTime;
ULONG FileAttributes;
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
UCHAR Reserved[3];
} FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
+typedef struct _FILE_COMPLETION_INFORMATION { // Information Class 30
+ HANDLE IoCompletionHandle;
+ ULONG CompletionKey;
+} FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
+
typedef struct _FILE_ALL_INFORMATION {
FILE_BASIC_INFORMATION BasicInformation;
FILE_STANDARD_INFORMATION StandardInformation;
ShutdownPowerOff
} SHUTDOWN_ACTION;
+typedef enum _IO_COMPLETION_INFORMATION_CLASS {
+ IoCompletionBasicInformation
+} IO_COMPLETION_INFORMATION_CLASS;
+
+typedef struct _IO_COMPLETION_BASIC_INFORMATION {
+ LONG SignalState;
+} IO_COMPLETION_BASIC_INFORMATION, *PIO_COMPLETION_BASIC_INFORMATION;
+
#else /* __USE_W32API */
#define DebugDbgLoadSymbols ((DEBUG_CONTROL_CODE)0xffffffff)
} SYSTEM_PATH_INFORMATION, * PSYSTEM_PATH_INFORMATION;
// SystemProcessInformation (5)
-typedef
-struct _SYSTEM_THREAD_INFORMATION
-{
- TIME KernelTime;
- TIME UserTime;
- TIME CreateTime;
- ULONG TickCount;
- ULONG StartEIP;
- CLIENT_ID ClientId;
- ULONG DynamicPriority;
- ULONG BasePriority;
- ULONG nSwitches;
- DWORD State;
- KWAIT_REASON WaitReason;
-
-} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
-typedef
-struct SYSTEM_PROCESS_INFORMATION
-{
- ULONG RelativeOffset;
- ULONG ThreadCount;
- ULONG Unused1 [6];
- TIME CreateTime;
- TIME UserTime;
- TIME KernelTime;
- UNICODE_STRING Name;
- ULONG BasePriority;
- ULONG ProcessId;
- ULONG ParentProcessId;
- ULONG HandleCount;
- ULONG Unused2[2];
- ULONG PeakVirtualSizeBytes;
- ULONG TotalVirtualSizeBytes;
- ULONG PageFaultCount;
- ULONG PeakWorkingSetSizeBytes;
- ULONG TotalWorkingSetSizeBytes;
- ULONG PeakPagedPoolUsagePages;
- ULONG TotalPagedPoolUsagePages;
- ULONG PeakNonPagedPoolUsagePages;
- ULONG TotalNonPagedPoolUsagePages;
- ULONG TotalPageFileUsageBytes;
- ULONG PeakPageFileUsageBytes;
- ULONG TotalPrivateBytes;
- SYSTEM_THREAD_INFORMATION ThreadSysInfo [1];
-
-} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
+typedef struct _SYSTEM_THREADS
+{
+ TIME KernelTime;
+ TIME UserTime;
+ TIME CreateTime;
+ ULONG WaitTime;
+ PVOID StartAddress;
+ CLIENT_ID ClientId;
+ KPRIORITY Priority;
+ KPRIORITY BasePriority;
+ ULONG ContextSwitchCount;
+ ULONG State;
+ KWAIT_REASON WaitReason;
+} SYSTEM_THREADS, *PSYSTEM_THREADS;
+
+typedef struct _SYSTEM_PROCESSES_NT4
+{
+ SIZE_T NextEntryDelta;
+ ULONG ThreadCount;
+ ULONG Reserved1[6];
+ TIME CreateTime;
+ TIME UserTime;
+ TIME KernelTime;
+ UNICODE_STRING ProcessName;
+ KPRIORITY BasePriority;
+ ULONG ProcessId;
+ ULONG InheritedFromProcessId;
+ ULONG HandleCount;
+ ULONG Reserved2[2];
+ VM_COUNTERS VmCounters;
+ SYSTEM_THREADS Threads[ANYSIZE_ARRAY];
+} SYSTEM_PROCESSES_NT4, *PSYSTEM_PROCESSES_NT4;
+
+typedef struct _SYSTEM_PROCESSES_NT5
+{
+ SIZE_T NextEntryDelta;
+ ULONG ThreadCount;
+ ULONG Reserved1[6];
+ TIME CreateTime;
+ TIME UserTime;
+ TIME KernelTime;
+ UNICODE_STRING ProcessName;
+ KPRIORITY BasePriority;
+ ULONG ProcessId;
+ ULONG InheritedFromProcessId;
+ ULONG HandleCount;
+ ULONG Reserved2[2];
+ VM_COUNTERS VmCounters;
+ IO_COUNTERS IoCounters;
+ SYSTEM_THREADS Threads[ANYSIZE_ARRAY];
+} SYSTEM_PROCESSES_NT5, *PSYSTEM_PROCESSES_NT5;
+
+/* Not sure. What version are we emulating? */
+typedef SYSTEM_PROCESSES_NT5 SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;
// SystemCallCountInformation (6)
typedef