【转】 Windows XPSP2(build 2600)未公开的核心数据结构定义文件

最新推荐文章于 2024-04-14 19:18:53 发布
最新推荐文章于 2024-04-14 19:18:53 发布
阅读量1.1k 收藏
点赞数
分类专栏： VC 汇编+调试+驱动 文章标签： 数据结构 windows build struct integer attributes

项目刚完, 比较空闲, 翻出以前写的一个DDK辅助定义文件, 自己命名为ntddkex.h, 主要给出xpsp2的未公开核心数据结构的定义(_EPROCESS etc.).
没法上传附件, 直接贴在下面:


// ntddkex.h

//
//
//  Author:      Eddy Zhang
//  Create Date:  2006/01/7
//  Contact:    eddyz@126.com
//  Usage:      Declare Undocument Kernel Data Structure
//
//


#ifndef _NTDDK_EX_
#define  _NTDDK_EX_

#include <ntddk.h>

#ifndef _KERNEL_2600_    // xp sp2
#define  _KERNEL_2600_

typedef struct _KTHREAD*  PKTHREAD;
typedef struct _MMWSLE*    PMMWSLE;

//typedef struct _MMWSLE
//{
//  UINT32    FirstFree;
//  UINT32    FirstDynamic;
//  UINT32    LastEntry;
//  UINT32    NextSlot;
//  UINT32    LastInitialized;
//  UINT32    NonDirect;
//  PVOID    HashTable;
//  UINT32    HashTableSize;
//} MMWSLE;

typedef struct   _KGDTENTRY
{
  USHORT    LimitLow;
  USHORT    BaseLow;
  struct 
  {
    UCHAR  BaseMid;
    UCHAR  Flags1;    // bit0-4 - Type
              // bit5-6 - Dpl
              // bit7    - Pres
    UCHAR  Flags2;    // bit0-3 - LimitHi
              // bit4   - Sys
              // bit5   - Reserved_0
              // bit6   - Default_Big
              // bit7   - Granularity
    UCHAR  BaseHi;
  } HighWord;
} KGDTENTRY, *PKGDTENTRY;

typedef struct   _KIDTENTRY
{
  USHORT    Offset;
  USHORT    Selector;
  USHORT    Access;
  USHORT    ExtendedOffset;
} KIDTENTRY, *PKIDTENTRY;

typedef struct _KEXECUTE_OPTIONS
{
  UCHAR    Value;    // bit0 - ExecuteEnable 
              // bit1 - DisableThunkEmulation
              // bit3 - Permanent
              // bit4 - ExecuteDispatchEnable
              // bit5 - ImageDispatchEnable
              // bit6,7 - Spare
} KEXECUTE_OPTIONS;
  
typedef struct _KPROCESS
{
  DISPATCHER_HEADER  Header;
  LIST_ENTRY      ProfileListHead;
  UINT32        DirectoryTableBase[2];
  KGDTENTRY      LdtDescriptor;
  KIDTENTRY      Int21Descriptor;
  USHORT        IopmOffset;
  UCHAR        Iopl;
  UCHAR        Unused;
  ULONG        ActiveProcessors;
  ULONG        KernelTime;
  ULONG        UserTime;
  LIST_ENTRY      ReadyListHead;
  SINGLE_LIST_ENTRY  SwapListEntry;
  PVOID        VdmTrapcHandler;
  LIST_ENTRY      ThreadListHead;
  ULONG        ProcessLock;
  ULONG        Affinity;
  USHORT        StackCount;
  CHAR        BasePriority;
  CHAR        ThreadQuantum;
  UCHAR        AutoAlignment;
  UCHAR        State;
  UCHAR        ThreadSeed;
  UCHAR        DisableBoost;
  UCHAR        PowerState;
  UCHAR        DisableQuantum;
  UCHAR        IdealNode;
  union
  {
    KEXECUTE_OPTIONS  Flags; 
    UCHAR        ExecuteOptions;  
  };
} KPROCESS, *PKPROCESS;

typedef struct _KAPC_STATE
{
   LIST_ENTRY      ApcListHead[2]; 
   PKPROCESS      Process;         
   UCHAR        KernelApcInProgress;
   UCHAR        KernelApcPending;
   UCHAR        UserApcPending;
} KAPC_STATE, *PKAPC_STATE;

typedef struct _KQUEUE
{
  DISPATCHER_HEADER  Header;  
  LIST_ENTRY      EntryListHead;
  UINT32        CurrentCount;    
  UINT32        MaximumCount;    
  LIST_ENTRY      ThreadListHead; 
} KQUEUE, *PKQUEUE;

typedef struct _EXCEPTION_REGISTRATION_RECORD
{
  struct _EXCEPTION_REGISTRATION_RECORD  *Next;            
  PVOID                  Handler;         
} EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;

typedef struct _KTRAP_FRAME
{
  UINT32              DbgEbp;          
  UINT32              DbgEip;          
  UINT32              DbgArgMark;      
  UINT32              DbgArgPointer;   
  UINT32              TempSegCs;       
  UINT32              TempEsp;        
  UINT32              Dr0;             
  UINT32              Dr1;             
  UINT32              Dr2;             
  UINT32              Dr3;             
  UINT32              Dr6;            
  UINT32              Dr7;             
  UINT32              SegGs;           
  UINT32              SegEs;           
  UINT32              SegDs;           
  UINT32              Edx;             
  UINT32              Ecx;             
  UINT32              Eax;             
  UINT32              PreviousPreviousMode;
  PEXCEPTION_REGISTRATION_RECORD  ExceptionList;
  UINT32              SegFs;           
  UINT32              Edi;             
  UINT32              Esi;             
  UINT32              Ebx;             
  UINT32              Ebp;             
  UINT32              ErrCode;         
  UINT32              Eip;             
  UINT32              SegCs;           
  UINT32              EFlags;          
  UINT32              HardwareEsp;     
  UINT32              HardwareSegSs;   
  UINT32              V86Es;           
  UINT32              V86Ds;           
  UINT32              V86Fs;           
  UINT32              V86Gs;           
} KTRAP_FRAME, *PKTRAP_FRAME;

typedef struct _KTHREAD
{
  DISPATCHER_HEADER  Header;
  LIST_ENTRY      MutantListHead;
  PVOID        InitialStack;
  PVOID        StackLimit;     
  PVOID        Teb;            
  PVOID        TlsArray;       
  PVOID        KernelStack;    
  UCHAR        DebugActive;    
  UCHAR        State;          
  UCHAR        Alerted[2];     
  UCHAR        Iopl;           
  UCHAR        NpxState;       
  CHAR        Saturation;      
  CHAR        Priority;        
  KAPC_STATE      ApcState;  
  UINT32        ContextSwitches;
  UCHAR        IdleSwapBlock;   
  UCHAR        Spare0[3];       
  INT32        WaitStatus;      
  UCHAR        WaitIrql;        
  CHAR        WaitMode;        
  UCHAR        WaitNext;        
  UCHAR        WaitReason;      
  PKWAIT_BLOCK    WaitBlockList;
  union
  {
    LIST_ENTRY        WaitListEntry;  
    SINGLE_LIST_ENTRY    SwapListEntry; 
  };
  UINT32        WaitTime;      
  CHAR        BasePriority;    
  UCHAR        DecrementCount; 
  CHAR        PriorityDecrement;
  CHAR        Quantum;         
  KWAIT_BLOCK      WaitBlock[4];
  PVOID        LegoData;        
  UINT32        KernelApcDisable;
  UINT32        UserAffinity;    
  UCHAR        SystemAffinityActive;
  UCHAR        PowerState;      
  UCHAR        NpxIrql;         
  UCHAR        InitialNode;     
  PVOID        ServiceTable;    
  PKQUEUE        Queue;         
  UINT32        ApcQueueLock;   
  KTIMER        Timer;          
  LIST_ENTRY      QueueListEntry; 
  UINT32        SoftAffinity;    
  UINT32        Affinity;        
  UCHAR        Preempted;        
  UCHAR        ProcessReadyQueue;
  UCHAR        KernelStackResident;
  UCHAR        NextProcessor;   
  PVOID        CallbackStack;   
  PVOID        Win32Thread;     
  PKTRAP_FRAME    TrapFrame;
  PKAPC_STATE      ApcStatePointer[2];
  CHAR        PreviousMode;    
  UCHAR        EnableStackSwap;
  UCHAR        LargeStack;     
  UCHAR        ResourceIndex;  
  UINT32        KernelTime;    
  UINT32        UserTime;      
  KAPC_STATE      SavedApcState; 
  UCHAR        Alertable;       
  UCHAR        ApcStateIndex;   
  UCHAR        ApcQueueable;    
  UCHAR        AutoAlignment;   
  PVOID        StackBase;       
  KAPC        SuspendApc;      
  KSEMAPHORE      SuspendSemaphore;
  LIST_ENTRY      ThreadListEntry; 
  CHAR        FreezeCount;     
  CHAR        SuspendCount;    
  UCHAR        IdealProcessor; 
  UCHAR        DisableBoost; 
} KTHREAD;

typedef struct _TERMINATION_PORT
{
   struct _TERMINATION_PORT *Next;           
   PVOID          Port;            
}TERMINATION_PORT, *PTERMINATION_PORT;

typedef struct _PS_IMPERSONATION_INFORMATION
{
   PVOID            Token;           
   UCHAR            CopyOnOpen;      
   UCHAR            EffectiveOnly;   
   SECURITY_IMPERSONATION_LEVEL  ImpersonationLevel;
} PS_IMPERSONATION_INFORMATION, *PPS_IMPERSONATION_INFORMATION;

typedef struct _EX_RUNDOWN_REF
{
  UINT32        Count;         
  PVOID        Ptr;            
} EX_RUNDOWN_REF, *PEX_RUNDOWN_REF;

typedef union _EX_PUSH_LOCK
{     
   UINT32        Value;    // bit0 -  Waiting
                  // bit1 - Exclusive
                  // bit2-31 - Shared
   PVOID        Ptr;            
} EX_PUSH_LOCK;

typedef struct _ETHREAD
{
  KTHREAD            Tcb;             
  LARGE_INTEGER        CreateTime;    // bit0-1 - NestedFaultCount   
                           // bit2 - ApcNeeded      
  union
  {
    LARGE_INTEGER      ExitTime;        
    LIST_ENTRY        LpcReplyChain;   
    LIST_ENTRY        KeyedWaitChain; 
  };
  union
  {
    INT32          ExitStatus;      
    PVOID          OfsChain;   
  };   
  LIST_ENTRY          PostBlockList;
  union
  {
    TERMINATION_PORT    TerminationPort; 
    struct _ETHREAD*    ReaperLink;      
    PVOID          KeyedWaitValue;  
  };
  UINT32            ActiveTimerListLock;
  LIST_ENTRY          ActiveTimerListHead;
  CLIENT_ID          Cid;
  union
  {
    KSEMAPHORE        LpcReplySemaphore;
    KSEMAPHORE        KeyedWaitSemaphore;
  };
  union
  {
    PVOID          LpcReplyMessage; 
    PVOID          LpcWaitingOnPort;
  };
  PS_IMPERSONATION_INFORMATION ImpersonationInfo;
  LIST_ENTRY          IrpList;         
  UINT32            TopLevelIrp;    
  PDEVICE_OBJECT        DeviceToVerify; 
  PEPROCESS          ThreadsProcess; 
  PVOID            StartAddress;
  union
  {
    PVOID          Win32StartAddress;
    UINT32          LpcReceivedMessageId;
  };
  LIST_ENTRY          ThreadListEntry; 
  EX_RUNDOWN_REF        RundownProtect;
  EX_PUSH_LOCK          ThreadLock;      
  UINT32            LpcReplyMessageId;
  UINT32            ReadClusterSize; 
  UINT32            GrantedAccess;   
  UINT32            CrossThreadFlags;      // bit0 - Terminated      
                                // bit1 - DeadThread      
                                 // bit2 - HideFromDebugger
                                 // bit3 - ActiveImpersonationInfo
                                 // bit4 - SystemThread    
                                 // bit5 - HardErrorsAreDisabled
                                 // bit6 - BreakOnTermination
                                 // bit7 - SkipCreationMsg 
                                 // bit8 - SkipTerminationMsg
  UINT32            SameThreadPassiveFlags;    // bit0 - ActiveExWorker;                                   
                                 // bit1 - ExWorkerCanWaitUser;
                                 // bit2 - MemoryMaker;     
  UINT32            SameThreadApcFlags;      // bit0 - LpcReceivedMsgIdValid;
                                 // bit1 - LpcExitThreadCalled;
                                 // bit2 - AddressSpaceOwner;
  UCHAR            ForwardClusterOnly;
  UCHAR            DisablePageFaultClustering;
} ETHREAD;

typedef struct _SID_AND_ATTRIBUTES
{
    PSID      Sid;
    UINT32      Attributes;
} SID_AND_ATTRIBUTES, * PSID_AND_ATTRIBUTES;

typedef struct _PS_JOB_TOKEN_FILTER
{
  UINT32          CapturedSidCount;
  PSID_AND_ATTRIBUTES    CapturedSids;   
  UINT32          CapturedSidsLength;
  UINT32          CapturedGroupCount;
  PSID_AND_ATTRIBUTES    CapturedGroups;
  UINT32          CapturedGroupsLength;
  UINT32          CapturedPrivilegeCount;
  PLUID_AND_ATTRIBUTES  CapturedPrivileges;
  UINT32          CapturedPrivilegesLength;
} PS_JOB_TOKEN_FILTER, *PPS_JOB_TOKEN_FILTER;

typedef struct _EJOB
{
  KEVENT          Event;    
  LIST_ENTRY        JobLinks;       
  LIST_ENTRY        ProcessListHead;
  ERESOURCE        JobLock;         
  LARGE_INTEGER      TotalUserTime;   
  LARGE_INTEGER      TotalKernelTime;
  LARGE_INTEGER      ThisPeriodTotalUserTime;
  LARGE_INTEGER      ThisPeriodTotalKernelTime;
  UINT32          TotalPageFaultCount;
  UINT32          TotalProcesses;  
  UINT32          ActiveProcesses; 
  UINT32          TotalTerminatedProcesses;
  LARGE_INTEGER      PerProcessUserTimeLimit;
  LARGE_INTEGER      PerJobUserTimeLimit;
  UINT32          LimitFlags;     
  UINT32          MinimumWorkingSetSize;
  UINT32          MaximumWorkingSetSize;
  UINT32          ActiveProcessLimit;
  UINT32          Affinity;       
  UCHAR          PriorityClass;   
  UINT32          UIRestrictionsClass;
  UINT32          SecurityLimitFlags;
  PVOID          Token;           
  PPS_JOB_TOKEN_FILTER  Filter;          
  UINT32          EndOfJobTimeAction;
  PVOID          CompletionPort;  
  PVOID          CompletionKey;   
  UINT32          SessionId;      
  UINT32          SchedulingClass;
  UINT64          ReadOperationCount;
  UINT64          WriteOperationCount;
  UINT64          OtherOperationCount;
  UINT64          ReadTransferCount;
  UINT64          WriteTransferCount;
  UINT64          OtherTransferCount;
  IO_COUNTERS        IoInfo;         
  UINT32          ProcessMemoryLimit;
  UINT32          JobMemoryLimit; 
  UINT32          PeakProcessMemoryUsed;
  UINT32          PeakJobMemoryUsed;
  UINT32          CurrentJobMemoryUsed;
  FAST_MUTEX        MemoryLimitsLock;
  LIST_ENTRY        JobSetLinks;     
  UINT32          MemberLevel;     
  UINT32          JobFlags;        
} EJOB, *PEJOB;

typedef struct _EPROCESS_QUOTA_ENTRY
{
  UINT32    Usage;           
  UINT32    Limit;           
  UINT32    Peak;            
  UINT32    Return;          
} EPROCESS_QUOTA_ENTRY, *PEPROCESS_QUOTA_ENTRY;

typedef struct _EPROCESS_QUOTA_BLOCK
{
  EPROCESS_QUOTA_ENTRY QuotaEntry;
  LIST_ENTRY  QuotaList;   
  UINT32    ReferenceCount;  
  UINT32    ProcessCount;    
} EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;

typedef struct _PAGEFAULT_HISTORY
{
  UINT32              CurrentIndex;   
  UINT32              MaxIndex;       
  UINT32              SpinLock;       
  PVOID              Reserved;        
  PROCESS_WS_WATCH_INFORMATION    WatchInfo[1];    
} PAGEFAULT_HISTORY, *PPAGEFAULT_HISTORY;

typedef struct _HARDWARE_PTE_X86
{
  UINT32    Value;    // bit0 - Valid           
              // bit1 - Write           
              // bit2 - Owner           
              // bit3 - WriteThrough    
              // bit4 - CacheDisable    
              // bit5 - Accessed        
              // bit6 - Dirty           
              // bit7 - LargePage       
              // bit8 - Global          
              // bit9 - CopyOnWrite     
              // bit10 - Prototype       
              // bit11 - reserved        
              // bit12-31 - PageFrameNumber 
} HARDWARE_PTE_X86;

typedef struct _EX_FAST_REF
{
  PVOID    Object;    
  UINT32    Value;    //bit0-2 - RefCnt          
} EX_FAST_REF, *PEX_FAST_REF;

typedef struct _SE_AUDIT_PROCESS_CREATION_INFO
{
   POBJECT_NAME_INFORMATION ImageFileName;
} SE_AUDIT_PROCESS_CREATION_INFO;

typedef struct _MMSUPPORT_FLAGS
{
  UINT32    Value;    // bit0 - SessionSpace  
              // bit1 - BeingTrimmed  
              // bit2 - SessionLeader 
              // bit3 - TrimHard      
              // bit4 - WorkingSetHard
              // bit5 - AddressSpaceBeingDeleted
              // bit6-15 - Available    
              // bit16-23 - AllowWorkingSetAdjustment
              // bit24-31 - MemoryPriority
} MMSUPPORT_FLAGS;

typedef struct _MMWSLE_HASH
{
  PVOID    Key;             
  UINT32    Index;          
} MMWSLE_HASH, *PMMWSLE_HASH;

typedef struct _MMWSL
{
  UINT32      Quota;           
  UINT32      FirstFree;       
  UINT32      FirstDynamic;    
  UINT32      LastEntry;       
  UINT32      NextSlot;        
  PMMWSLE      Wsle;           
  UINT32      LastInitializedWsle;
  UINT32      NonDirectCount;  
  PMMWSLE_HASH  HashTable; 
  UINT32      HashTableSize;   
  UINT32      NumberOfCommittedPageTables;
  PVOID      HashTableStart;  
  PVOID      HighestPermittedHashAddress;
  UINT32      NumberOfImageWaiters;
  UINT32      VadBitMapHint;
  union
  {
    USHORT    UsedPageTableEntries[1536];
    UINT32    CommittedPageTables[48];
  };
} MMWSL, *PMMWSL;

typedef struct _MMSUPPORT
{
  LARGE_INTEGER    LastTrimTime;
  MMSUPPORT_FLAGS    Flags;    
  UINT32        PageFaultCount;  
  UINT32        PeakWorkingSetSize;
  UINT32        WorkingSetSize;  
  UINT32        MinimumWorkingSetSize;
  UINT32        MaximumWorkingSetSize;
  PMMWSL        VmWorkingSetList;
  LIST_ENTRY      WorkingSetExpansionLinks;
  UINT32        Claim;           
  UINT32        NextEstimationSlot;
  UINT32        NextAgingSlot;   
  UINT32        EstimatedAvailable;
  UINT32        GrowthSinceLastEstimate;
} MMSUPPORT;

typedef struct _HANDLE_TRACE_DB_ENTRY
{
  CLIENT_ID      ClientId;    
  PVOID        Handle;          
  UINT32        Type;           
  PVOID        StackTrace; 
} HANDLE_TRACE_DB_ENTRY, *PHANDLE_TRACE_DB_ENTRY;

typedef struct _HANDLE_TRACE_DEBUG_INFO
{
  UINT32          CurrentStackIndex;
  HANDLE_TRACE_DB_ENTRY  TraceDb[4096];       
} HANDLE_TRACE_DEBUG_INFO, *PHANDLE_TRACE_DEBUG_INFO;

typedef struct _HANDLE_TABLE_ENTRY
{
  union
  {
    PVOID    Object;          
    UINT32    ObAttributes;   
    struct _HANDLE_TABLE_ENTRY *InfoTable;      
    UINT32    Value;
  };
  union
  {
    UINT32    GrantedAccess;
    struct 
    {
      USHORT    GrantedAccessIndex;
      USHORT    CreatorBackTraceIndex;
    };
    INT32    NextFreeTableEntry;
  }; 
} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;

typedef struct _HANDLE_TABLE
{
  UINT32            TableCode;       
  PEPROCESS          QuotaProcess; 
  PVOID            UniqueProcessId; 
  EX_PUSH_LOCK        HandleTableLock[4];
  LIST_ENTRY          HandleTableList;
  EX_PUSH_LOCK        HandleContentionEvent;
  PHANDLE_TRACE_DEBUG_INFO  DebugInfo;       
  UINT32            FirstFree;       
  UINT32            LastFree;        
  UINT32            NextHandleNeedingPool;
  INT32            HandleCount;     
  UINT32            Flags;    // bit0 - StrictFIFO
} HANDLE_TABLE, *PHANDLE_TABLE;

typedef struct _EPROCESS
{
    KPROCESS              Pcb;           
    EX_PUSH_LOCK            ProcessLock;     
    LARGE_INTEGER            CreateTime;     
    LARGE_INTEGER            ExitTime;     
    EX_RUNDOWN_REF            RundownProtect;   
    PVOID                UniqueProcessId;       
    LIST_ENTRY              ActiveProcessLinks;   
    UINT32                QuotaUsage[3];       
    UINT32                QuotaPeak[3];       
    UINT32                CommitCharge;       
    UINT32                PeakVirtualSize;     
    UINT32                VirtualSize;       
    LIST_ENTRY              SessionProcessLinks; 
    PVOID                DebugPort;         
    PVOID                ExceptionPort;       
    PHANDLE_TABLE            ObjectTable;   
    EX_FAST_REF              Token;         
    FAST_MUTEX              WorkingSetLock;     
    UINT32                WorkingSetPage;       
    FAST_MUTEX              AddressCreationLock; 
    UINT32                HyperSpaceLock;       
    PETHREAD              ForkInProgress;     
    UINT32                HardwareTrigger;     
    PVOID                VadRoot;           
    PVOID                VadHint;           
    PVOID                CloneRoot;         
    UINT32                NumberOfPrivatePages;   
    UINT32                NumberOfLockedPages;   
    PVOID                Win32Process;       
    PEJOB                Job;             
    PVOID                SectionObject;       
    PVOID                SectionBaseAddress;     
    PEPROCESS_QUOTA_BLOCK        QuotaBlock;     
    PPAGEFAULT_HISTORY          WorkingSetWatch; 
    PVOID                Win32WindowStation;       
    PVOID                InheritedFromUniqueProcessId; 
    PVOID                LdtInformation;         
    PVOID                VadFreeHint;           
    PVOID                VdmObjects;           
    PVOID                DeviceMap;           
    LIST_ENTRY              PhysicalVadList; 
  union
  {
    HARDWARE_PTE_X86  PageDirectoryPte;   
    UINT64        Filler; 
  };
    PVOID                Session;             
    UCHAR                ImageFileName[16];         
    LIST_ENTRY              JobLinks;         
    PVOID                LockedPagesList;         
    LIST_ENTRY              ThreadListHead;       
    PVOID                SecurityPort;         
    PVOID                PaeTop;             
    UINT32                ActiveThreads;         
    UINT32                GrantedAccess;         
    UINT32                DefaultHardErrorProcessing;   
    INT32                LastThreadExitStatus;     
    PPEB                Peb;               
    EX_FAST_REF              PrefetchTrace;       
    LARGE_INTEGER            ReadOperationCount;   
    LARGE_INTEGER            WriteOperationCount;   
    LARGE_INTEGER            OtherOperationCount;   
    LARGE_INTEGER            ReadTransferCount;   
    LARGE_INTEGER            WriteTransferCount;   
    LARGE_INTEGER            OtherTransferCount;   
    UINT32                CommitChargeLimit;     
    UINT32                CommitChargePeak;     
    PVOID                AweInfo;           
    SE_AUDIT_PROCESS_CREATION_INFO    SeAuditProcessCreationInfo;
    MMSUPPORT              Vm;          
    UINT32                LastFaultCount;  
    UINT32                ModifiedPageCount;
    UINT32                NumberOfVads;    
    UINT32                JobStatus;       
  UINT32                Flags;      // bit0 - CreateReported  
                          // bit1 - NoDebugInherit  
                          // bit2 - ProcessExiting  
                          // bit3 - ProcessDelete   
                          // bit4 - Wow64SplitPages 
                          // bit5 - VmDeleted       
                          // bit6 - OutswapEnabled  
                          // bit7 - Outswapped      
                          // bit8 - ForkFailed      
                          // bit9 - HasPhysicalVad  
                          // bit10-11 - AddressSpaceInitialized
                          // bit12 - SetTimerResolution
                          // bit13 - BreakOnTermination
                          // bit14 - SessionCreationUnderway
                          // bit15 - WriteWatch      
                          // bit16 - ProcessInSession
                          // bit17 - OverrideAddressSpace
                          // bit18 - HasAddressSpace 
                          // bit19 - LaunchPrefetched
                          // bit20 - InjectInpageErrors
                          // bit21 - VmTopDown       
                          // bit22 - Unused3         
                          // bit23 - Unused4         
                          // bit24 - VdmAllowed      
                          // bit25-29 - Unused          
                          // bit30 - Unused1         
                          // bit31 - Unused2         
    INT32                ExitStatus;         
    USHORT                NextPageColor;
  union
  {
    struct
    {
      UCHAR    SubSystemMinorVersion;   
      UCHAR    SubSystemMajorVersion; 
    };
    USHORT    SubSystemVersion;
  };   
  UCHAR                PriorityClass;       
  UCHAR                WorkingSetAcquiredUnsafe; 
  UCHAR                Unknow1;
  UCHAR                Unknow2;
  UINT32                Cookie; 
} EPROCESS, *PEPROCESS;

#endif

#endif

rryr2
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
xpsp2的未公开核心数据结构的定义
06-29
xpsp2的未公开核心数据结构的定义
Rootkit技术基础(5) anti-rootkit
软件调试的变革
11-05 1369
现在RK（rootkit）和ARK(anti-rootkit)的斗争已经进行了很久，在印象中最早出来的ARK工具是冰刃(IceSword)，从冰 刃开始出来到现在RK和ARK的斗争一直在继续，目前冰刃还是在流行当中，自己感觉也正是冰刃的出来才带动了当前流行的RK和ARK的斗争呵呵，现在很多 病毒木马已经广泛的带有驱动,使用一些RK的技术和方法使自己更底层些更强大些，当前流行的ARK工具主要包括：隐
读书笔记之《Windows内核原理与实现》
weixin_34306593的博客
10-27 805
最近学习《Windows内核原理与实现》发现其博大精深，粗略过了一遍，很多东西比较茫然，看书之余把书中涉及的函数，结构，全局变量的所在页数总结出来，便于以后查阅。 由于半自动半手工，难免有写错的地方，如有发现还请留言通知，谢谢。 函数 函数名称 所在页数 _KeSystemStartup 149 _KiExce...
原创翻译: 64 位 Windows 内核虚拟地址空间布局（基于 X64 CPU）
weixin_34033624的博客
01-14 890
本文为原创翻译，原文出处为http://www.codemachine.com/article_x64kvas.html对于原文中，较难理解或者论述过于简单的部分，则添加了译注；译注来自于内核调试器验证的结果，以及 WRK 源码中的逻辑，还有《深入解析 Windows 操作系统》一书中的译文。本文档解释 X64 版本的 Windows 7 与 Server 2008 R2 ...
转：解析Windows 2000/XP进程工作集
编程手札
08-30 2380
    在《解析Windows 2000/XP物理内存管理》中我详细的介绍了页框数据库(Page Frame Database)的概念，提到在物理内存的组织与管理方面对于每个页面系统都在页框数据库中保存一个结构，用于跟踪页面状态等。但页框数据库并不能真正协调物理内存的使用。我们知道，Windows是一个多任务的操作系统，而物理内存却是一个相对贫乏的资源，为避免某个进程(或是系统)耗尽这一资源，引入
从DbgView探究Windows内存管理笔记
0xDQ的博客
04-29 834
0x00 前言 讲内存管理单纯的理论比较空洞，所以本文从探究DebugVeiw的内存分布开始，来探究windows系统的内存管理。 因为windows内存管理使用的是二叉树来实现的，所以在开始探究之前，可以先去了解二叉树这一数据结构。 ...
GPS定位软件适合安装环境windows2000，xpsp2
06-13
GPS安装软件8.1版本，可以提供灵活定位信息，本软件已提供结多人使用，均安装成功
windows xpsp2双核兼容性HotFix下载
08-11
此前有人披露在Windows XP SP2下对双核心处理器有兼容性问题，会导致一些性能的降低，最近微软提供了一个Hot Fix下载，以解决这个问题，不过在安装这个补丁的同事需要修改注册表，修改方法如下： 打开注册表编辑...
IE8.0-XPSp2.rar
01-27
IE8.0For WindowsXPSP2
IIS5.0安装文件(xpsp2原版提取)
08-16
IIS5.0安装文件(xpsp2原版提取)
Windows内核编程基础篇之常见内核数据结构
知其所以然
08-28 3383
1，驱动框架常见数据结构有 驱动对象结构，  设备对象结构等。         A）驱动对象结构  (DRIVER_OBJECT)             每个驱动对象代表一个已加载的内核驱动程序，指向驱动对象结构的指针常常作为DriverEntry，AddDevice， Unload等函数的参数。驱动对象结构式半透明的。其中公开的域包括DeviceObject，DriverExtensio
Windows内核常见数据结构(内核对象)
多媒体编程、网络编程、系统编程、网络安全编程、驱动编程
07-27 792
继续学习，继续补充... 事件： lkd> dt _KEVENT ntdll!_KEVENT    +0x000 Header           : _DISPATCHER_HEADER 信号量: lkd> dt _KSEMAPHORE ntdll!_KSEMAPHORE    +0x000 Header           : _DISPATCHER_HEADER
Windows内核进程管理器解析
weixin_30275415的博客
04-22 129
Windows内核是如何实现线程挂起的？如何实现线程挂载到进程的？如何实现杀死进程和线程的？ 从源码分析一下，这些操作具体在源码上是如何实现的。 进程创建、线程切换、线程跨越CPU权限级、进程挂靠、杀死进程、杀死线程 一.进程创建 可以分几个部分来说。首先说进程的地址空间是怎么创建起来的，进程的EPROCESS->VadRoot是用来描述进程的用户地址空间的。只有在VadRoot结构...
从hook开始聊聊那些windows内核数据结构
weixin_34278190的博客
01-16 355
总览： IAT HOOK Object Hook Ssdt Hook 源码 内核知识及源码 内核知识级源码 一、IAT HOOK： 因为上一篇博客对已经对IAT Hook基本流程及作用进行了介绍，希望能先学懂PE再来看IATHook.下面贴上Iathook的源码，源码中有详细的注释，还记着为什么不能结束360的进程吗？参考思路如下图（因为写代码的时候解决方案写到了源码中，不粘贴...
C语言简单的数据结构：双向链表的实现
最新发布
2302_82004664的博客
04-14 1028
目录： 1.双向链表的结构和初始化 1.1双向链表的结构 1.2双向链表的初始化 2.双向链表的相关操作 2.1双向链表的尾插、打印和头插 2.11双向链表的尾插 2.12双向链表的打印 2.13双向链表的头插 2.2双向链表的尾删和头删 2.21双向链表的尾删 2.22双向链表的头删 2.3双向链表查找和任意位置插入、删除 2.31双向链表查找 2.32双向链表任意位置之后插入 2.33双向链表任意位置删除 2.4双向链表的销毁
[数据结构]——二叉树——堆的实现
2303_77720864的博客
04-12 1162
如果有一个关键码的集合K = { ， ， ，…， }，把它的所有元素按完全二叉树的顺序存储方式存储在一个一维数组中，并满足： = ) i = 0，1，2…，则称为小堆(或大堆)。将根节点最大的堆叫做最大堆或大根堆，根节点最小的堆叫做最小堆或小根堆。堆的性质：堆中某个节点的值总是不大于或不小于其父节点的值；堆总是一棵完全二叉树。
C++11 数据结构1 线性表的概念，线性表的顺序存储，实现，测试
hunandede的博客
04-12 177
线性结构是一种最简单且常用的数据结构。线性结构的基本特点是节点之间满足线性关系。本章讨论的动态数组、链表、栈、队列都属于线性结构。他们的共同之处，是节点中有且只有一个开始节点和终端节点。按这种关系，可以把它们的所有节点排列成一个线性序列。但是，他们分别属于几种不同的抽象数据类型实现，它们之间的区别，主要就是操作的不同。线性表是零个或者多个数据元素的有限序列。
数据结构（图）
shenli_MLZS
04-12 548
图，Graph点，Vertex边，edge有空表，空树，但没有空图图可以没有边|E| = 0，但不能没有一个点是边的多少决定的无向图，23条边，度为4的有5个点，度为3的有4个点，度为2的有多少个点？无向图的度总数 = 每个点的度数之和 = 2倍的边数。
排序算法之插入排序
qq_45649553的博客
04-12 334
排序算法之插入排序
VC6.0__directories_默认设置.doc
01-03
VC6.0 中文版安装时可能会出错，directories的设置会丢失，后果是源文件无法编译。这个文档记录的是正确安装时的设置，还包含了“Platform SDK for XPSP2”的directories设置。

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值