windows几个重要的内核数据结构虽然网上也有相关的定义，但个人觉得不齐全定义不规范，因此用一天时间使用WinDbg+Win2000sourcecode重新定义了常用的内核数据结构，并尽可能还原微软的原结构定义，每个结构都递归到最子层的结构并且通过了测试。通过这次工作过程不仅使自己得到一次学习的机会，而且提高了自己的整体软件架构规划设计水平。
代码:
{********************************************************************************}
{* *}
{* Windows Kernel Struct Define *}
{* *}
{* [uWindowsKernelStruct.pas] *}
{* *}
{* Copyright (c)2010 codegame *}
{* Update: 2010-04-09 23:51:44 *}
{********************************************************************************}
unit uWindowsKernelStruct;
interface
uses
Windows;
type
PEXCEPTION_DISPOSITION = ^TEXCEPTION_DISPOSITION;
TEXCEPTION_DISPOSITION = (
ExceptionContinueExecution = 0,
ExceptionContinueSearch = 1,
ExceptionNestedException = 2,
ExceptionCollidedUnwind = 3);
PSECURITY_IMPERSONATION_LEVEL = ^TSECURITY_IMPERSONATION_LEVEL;
TSECURITY_IMPERSONATION_LEVEL = (
SecurityAnonymous = 0,
SecurityIdentification = 1,
SecurityImpersonation = 2,
SecurityDelegation = 3);
PUNICODE_STRING = ^TUNICODE_STRING;
TUNICODE_STRING = packed record
Length: Word;
MaximumLength: Word;
Buffer: Pointer;
end;
PLIST_ENTRY = ^TLIST_ENTRY;
TLIST_ENTRY = packed record
Flink: PLIST_ENTRY;
Blink: PLIST_ENTRY;
end;
TDISPATCHER_HEADER = packed record
bType: byte;
bAbsolute: byte;
Size: byte;
Inserted: byte;
SignalState: DWORD;
WaitListHead: TLIST_ENTRY;
end;
TKGDTENTRY = packed record
LimitLow: Word;
BaseLow: Word;
HighWord: packed record
BaseMid: Byte;
Flags1: Byte;
Flags2: Byte;
BaseHi: Byte;
end;
end;
TKIDTENTRY = packed record
Offset: Word;
Selector: Word;
Access: Word;
ExtendedOffset: Word;
end;
PSINGLE_LIST_ENTRY = ^TSINGLE_LIST_ENTRY;
TSINGLE_LIST_ENTRY = packed record
Next: PSINGLE_LIST_ENTRY;
end;
PCLIENT_ID = ^TCLIENT_ID;
TCLIENT_ID = packed record
UniqueProcess: Dword;
UniqueThread: Dword;
end;
PKPROCESS = ^TKPROCESS;
TKPROCESS = packed record
Header: TDISPATCHER_HEADER;
ProfileListHead: TLIST_ENTRY;
DirectoryTableBase: array[0..1] of Dword;
LdtDescriptor: TKGDTENTRY;
Int21Descriptor: TKIDTENTRY;
IopmOffset: Word;
Iopl: Byte;
Unused: Byte;
ActiveProcessors: DWORD;
KernelTime: DWORD;
UserTime: DWORD;
ReadyListHead: TLIST_ENTRY;
SwapListEntry: TSINGLE_LIST_ENTRY;
VdmTrapcHandler: Pointer;
ThreadListHead: TLIST_ENTRY;
ProcessLock: DWORD;
Affinity: DWORD;
StackCount: Word;
BasePriority: Char;
ThreadQuantum: Char;
AutoAlignment: Byte;
State: Byte;
ThreadSeed: Byte;
DisableBoost: Byte;
PowerState: Byte;
DisableQuantum: Byte;
IdealNode: Byte;
case Integer of
0: (Flags: byte);
1: (ExecuteOptions: byte);
end;
PKAPC_STATE = ^TKAPC_STATE;
TKAPC_STATE = packed record
ApcListHead: array[0..1] of TLIST_ENTRY;
Process: PKPROCESS;
KernelApcInProgress: Byte;
KernelApcPending: Byte;
UserApcPending: Word;
end;
PKTHREAD = ^TKTHREAD;
PKWAIT_BLOCK = ^TKWAIT_BLOCK;
TKWAIT_BLOCK = packed record
WaitListEntry: TLIST_ENTRY;
Thread: PKTHREAD;
pObject: Pointer;
NextWaitBlock: PKWAIT_BLOCK;
WaitKey: Word;
WaitType: Word;
end;
PKQUEUE = ^TKQUEUE;
TKQUEUE = packed record
Header: TDISPATCHER_HEADER;
EntryListHead: TLIST_ENTRY;
CurrentCount: Dword;
MaximumCount: Dword;
ThreadListHead: TLIST_ENTRY;
end;
PKDPC = ^TKDPC;
TKDPC = packed record
wType: word;
Number: Byte;
Importance: Byte;
DpcListEntry: TLIST_ENTRY;
DeferredRoutine: Pointer;
DeferredContext: Pointer;
SystemArgument1: Pointer;
SystemArgument2: Pointer;
Lock: PDWORD;
end;
PKTIMER = ^TKTIMER;
TKTIMER = packed record
Header: TDISPATCHER_HEADER;
DueTime: Int64;
TimerListEntry: TLIST_ENTRY;
Dpc: PKDPC;
Period: DWORD;
end;
PEXCEPTION_REGISTRATION_RECORD = ^TPEXCEPTION_REGISTRATION_RECORD;
TPEXCEPTION_REGISTRATION_RECORD = packed record
Next: PEXCEPTION_REGISTRATION_RECORD;
Handler: PEXCEPTION_DISPOSITION;
end;
PKTRAP_FRAME = ^TKTRAP_FRAME;
TKTRAP_FRAME = packed record
DbgEbp: Dword;
DbgEip: Dword;
DbgArgMark: Dword;
DbgArgPointer: Dword;
TempSegCs: Dword;
TempEsp: Dword;
Dr0: Dword;
Dr1: Dword;
Dr2: Dword;
Dr3: Dword;
Dr6: Dword;
Dr7: Dword;
SegGs: Dword;
SegEs: Dword;
SegDs: Dword;
Edx: Dword;
Ecx: Dword;
Eax: Dword;
PreviousPreviousMode: Dword;
ExceptionList: PEXCEPTION_REGISTRATION_RECORD;
SegFs: Dword;
Edi: Dword;
Esi: Dword;
Ebx: Dword;
Ebp: Dword;
ErrCode: Dword;
Eip: Dword;
SegCs: Dword;
EFlags: Dword;
HardwareEsp: Dword;
HardwareSegSs: Dword;
V86Es: Dword;
V86Ds: Dword;
V86Fs: Dword;
V86Gs: Dword;
end;
PKAPC = ^TKAPC;
TKAPC = packed record
wType: word;
Size: word;
Spare0: DWORD;
Thread: PKTHREAD;
ApcListEntry: TLIST_ENTRY;
KernelRoutine: Pointer;
RundownRoutine: Pointer;
NormalRoutine: Pointer;
NormalContext: Pointer;
SystemArgument1: Pointer;
SystemArgument2: Pointer;
ApcStateIndex: Char;
ApcMode: Char;
Inserted: Word;
end;
PKSEMAPHORE = ^TKSEMAPHORE;
TKSEMAPHORE = packed record
Header: TDISPATCHER_HEADER;
Limit: Cardinal;
end;
TKTHREAD = packed record
Header: TDISPATCHER_HEADER;
MutantListHead: TLIST_ENTRY;
InitialStack: Pointer;
StackLimit: Pointer;
Teb: Pointer;
TlsArray: Pointer;
KernelStack: Pointer;
DebugActive: Byte;
State: Byte;
Alerted: array[0..1] of Byte;
Iopl: Byte;
NpxState: Byte;
Saturation: Char;
Priority: Char;
ApcState: TKAPC_STATE;
ContextSwitches: DWORD;
IdleSwapBlock: Byte;
Spare0: array[0..2] of Byte;
WaitStatus: Cardinal;
WaitIrql: Byte;
WaitMode: Char;
WaitNext: Byte;
WaitReason: Byte;
WaitBlockList: PKWAIT_BLOCK;
Union: record case integer of
0: (WaitListEntry: TLIST_ENTRY);
1: (SwapListEntry: TSINGLE_LIST_ENTRY);
end;
WaitTime: Dword;
BasePriority: Char;
DecrementCount: Byte;
PriorityDecrement: Char;
Quantum: Char;
WaitBlock: array[0..3] of TKWAIT_BLOCK;
LegoData: Pointer;
KernelApcDisable: Dword;
UserAffinity: Dword;
SystemAffinityActive: Byte;
PowerState: Byte;
NpxIrql: Byte;
InitialNode: Byte;
ServiceTable: Pointer;
Queue: PKQUEUE;
ApcQueueLock: DWORD;
Timer: TKTIMER;
Gap1: Dword; //间隙1
QueueListEntry: TLIST_ENTRY;
SoftAffinity: Dword;
Affinity: Dword;
Preempted: Byte;
ProcessReadyQueue: Byte;
KernelStackResident: Byte;
NextProcessor: Byte;
CallbackStack: Pointer;
Win32Thread: Pointer;
TrapFrame: PKTRAP_FRAME;
ApcStatePointer: array[0..1] of PKAPC_STATE;
PreviousMode: Char;
EnableStackSwap: Byte;
LargeStack: Byte;
ResourceIndex: Byte;
KernelTime: Dword;
UserTime: Dword;
SavedApcState: TKAPC_STATE;
Alertable: Byte;
ApcStateIndex: Byte;
ApcQueueable: Byte;
AutoAlignment: Byte;
StackBase: Pointer;
SuspendApc: TKAPC;
SuspendSemaphore: TKSEMAPHORE;
ThreadListEntry: TLIST_ENTRY;
FreezeCount: Char;
SuspendCount: Char;
IdealProcessor: Byte;
DisableBoost: Byte;
Gap2: DWORD; //间隙
end;
PTERMINATION_PORT = ^TTERMINATION_PORT;
TTERMINATION_PORT = packed record
Next: PTERMINATION_PORT;
Port: Pointer;
end;
PPS_IMPERSONATION_INFORMATION = ^TPS_IMPERSONATION_INFORMATION;
TPS_IMPERSONATION_INFORMATION = packed record
Token: Pointer;
CopyOnOpen: byte;
EffectiveOnly: Byte;
ImpersonationLevel: TSECURITY_IMPERSONATION_LEVEL;
end;
PIO_STATUS_BLOCK = ^TIO_STATUS_BLOCK;
TIO_STATUS_BLOCK = packed record
Union: record case integer of
0: (Status: Cardinal);
1: (Pointer: Pointer);
end;
Information: Dword;
end;
PEPROCESS = ^TEPROCESS;
PMDL = ^TMDL;
TMDL = packed record
Next: PMDL;
Size: word;
MdlFlags: word;
Process: PEPROCESS;
MappedSystemVa: Pointer;
StartVa: Pointer;
ByteCount: Dword;
ByteOffset: Dword;
end;
PKEVENT = ^TKEVENT;
TKEVENT = packed record
Header: TDISPATCHER_HEADER;
end;
PIRP = ^TIRP;
TIRP = packed record
bType: Word;
Size: word;
MdlAddress: PMDL;
Flags: Dword;
AssociatedIrp: DWORD; //3 elements
ThreadListEntry: TLIST_ENTRY;
IoStatus: TIO_STATUS_BLOCK;
RequestorMode: Char;
PendingReturned: Byte;
StackCount: Char;
CurrentLocation: Char;
Cancel: Byte;
CancelIrql: Byte;
ApcEnvironment: Char;
AllocationFlags: Byte;
UserIosb: PIO_STATUS_BLOCK;
UserEvent: PKEVENT;
Overlay: array[0..1] of dword;
CancelRoutine: Pointer;
UserBuffer: Pointer;
Tail: array[0..11] of dword; //$30byte
end;
PDEVICE_OBJECT = ^TDEVICE_OBJECT;
PIO_TIMER = ^TIO_TIMER;
TIO_TIMER = packed record //Size $18
bType: word;
TimerFlag: word;
TimerList: TLIST_ENTRY;
TimerRoutine: Pointer;
Context: Pointer;
DeviceObject: PDEVICE_OBJECT;
end;
PVPB = ^TVPB;
TVPB = packed record //Size $58
bType: word;
Size: word;
Flags: Dword;
VolumeLabelLength: word;
DeviceObject: PDEVICE_OBJECT;
RealDevice: PDEVICE_OBJECT;
SerialNumber: Dword;
ReferenceCount: Dword;
VolumeLabel: array[0..31] of Word;
end;
PKDEVICE_QUEUE = ^TKDEVICE_QUEUE;
TKDEVICE_QUEUE = packed record //Size $14
bType: word;
Size: word;
DeviceListHead: TLIST_ENTRY;
Lock: Word;
Busy: Byte;
Gap: array[0..2] of byte;
end;
PDEVOBJ_EXTENSION = ^TDEVOBJ_EXTENSION;
TDEVOBJ_EXTENSION = packed record //Size $2C
btype: Word;
Size: Word;
DeviceObject: PDEVICE_OBJECT;
PowerFlags: DWord;
Dope: Pointer; //_DEVICE_OBJECT_POWER_EXTENSION
ExtensionFlags: DWord;
DeviceNode: Pointer;
AttachedTo: PDEVICE_OBJECT;
StartIoCount: DWord;
StartIoKey: DWord;
StartIoFlags: DWord;
Vpb: PVPB;
end;
TDEVICE_OBJECT = packed record
bType: Word;
Size: word;
ReferenceCount: dword;
DriverObject: PDEVICE_OBJECT;
NextDevice: PDEVICE_OBJECT;
AttachedDevice: PDEVICE_OBJECT;
CurrentIrp: PIRP;
Timer: PIO_TIMER;
Flags: Dword;
Characteristics: Dword;
Vpb: PVPB;
DeviceExtension: Pointer;
DeviceType: Dword;
StackSize: Char;
Queue: array[0..39] of byte;
AlignmentRequirement: DWORD;
DeviceQueue: TKDEVICE_QUEUE;
Dpc: TKDPC;
ActiveThreadCount: Dword;
SecurityDescriptor: Pointer;
DeviceLock: TKEVENT;
SectorSize: word;
Spare1: word;
DeviceObjectExtension: PDEVOBJ_EXTENSION;
Reserved: Pointer;
end;
PEX_RUNDOWN_REF = ^TEX_RUNDOWN_REF;
TEX_RUNDOWN_REF = packed record
case integer of
0: (Count: Cardinal);
1: (Ptr: Pointer);
end;
PEX_PUSH_LOCK = ^TEX_PUSH_LOCK;
TEX_PUSH_LOCK = packed record
case integer of
0: (Value: Cardinal); //Waiting:Pos 0,1Bit; Exclusive:Pos 1,1Bit ; Shared:Pos 2,30Bit
1: (Ptr: Pointer);
end;
PEThread = ^TEThread;
TEThread = packed record //Size:$258
TCB: TKTHREAD;
CreateTime: Int64; // bit0-1 - NestedFaultCount bit2 - ApcNeeded
Union1: record case integer of
0: (ExitTime: Int64);
1: (LpcReplyChain: TLIST_ENTRY);
2: (KeyedWaitChain: TLIST_ENTRY);
end;
Union2: record case integer of
0: (ExitStatus: Cardinal);
1: (OfsChain: Pointer);
end;
PostBlockList: TLIST_ENTRY;
Union3: record case integer of
0: (TerminationPort: PTERMINATION_PORT);
1: (ReaperLink: PETHREAD);
2: (KeyedWaitValue: Pointer);
end;
ActiveTimerListLock: Dword;
ActiveTimerListHead: TLIST_ENTRY;
Cid: TCLIENT_ID;
Union4: record case integer of
0: (LpcReplySemaphore: TKSEMAPHORE);
1: (KeyedWaitSemaphore: TKSEMAPHORE);
end;
Union5: record case integer of
0: (LpcReplyMessage: Pointer);
1: (LpcWaitingOnPort: Pointer);
end;
ImpersonationInfo: PPS_IMPERSONATION_INFORMATION;
IrpList: TLIST_ENTRY;
TopLevelIrp: Dword;
DeviceToVerify: PDEVICE_OBJECT;
ThreadsProcess: PEPROCESS;
StartAddress: Pointer;
Union6: record case integer of
0: (Win32StartAddress: Pointer);
1: (LpcReceivedMessageId: Dword);
end;
ThreadListEntry: TLIST_ENTRY;
RundownProtect: TEX_RUNDOWN_REF;
ThreadLock: TEX_PUSH_LOCK;
LpcReplyMessageId: Dword;
ReadClusterSize: DWORD;
GrantedAccess: DWORD;
CrossThreadFlags: DWORD;
SameThreadPassiveFlags: DWORD;
SameThreadApcFlags: DWORD;
ForwardClusterOnly: byte;
DisablePageFaultClustering: byte;
Gap: Word; //间隙
end;
PPEB_LDR_DATA = ^TPEB_LDR_DATA;
TPEB_LDR_DATA = packed record // Size: $28
Length: dword;
Initialized: byte;
SsHandle: Pointer;
InLoadOrderModuleList: TLIST_ENTRY;
InMemoryOrderModuleList: TLIST_ENTRY;
InInitializationOrderModuleList: TLIST_ENTRY;
EntryInProgress: Pointer;
end;
PCURDIR = ^TCURDIR;
TCURDIR = packed record
DosPath: TUNICODE_STRING;
Handle: Pointer;
end;
PRTL_DRIVE_LETTER_CURDIR = ^TRTL_DRIVE_LETTER_CURDIR;
TRTL_DRIVE_LETTER_CURDIR = packed record
Flags: word;
Length: word;
TimeStamp: Dword;
DosPath: TUNICODE_STRING;
end;
PRTL_USER_PROCESS_PARAMETERS = ^TRTL_USER_PROCESS_PARAMETERS;
TRTL_USER_PROCESS_PARAMETERS = packed record
MaximumLength: Dword;
Length: Dword;
Flags: Dword;
DebugFlags: Dword;
ConsoleHandle: Pointer;
ConsoleFlags: Dword;
StandardInput: Pointer;
StandardOutput: Pointer;
StandardError: Pointer;
CurrentDirectory: TCURDIR;
DllPath: TUNICODE_STRING;
ImagePathName: TUNICODE_STRING;
CommandLine: TUNICODE_STRING;
Environment: Pointer;
StartingX: Dword;
StartingY: Dword;
CountX: Dword;
CountY: Dword;
CountCharsX: Dword;
CountCharsY: Dword;
FillAttribute: Dword;
WindowFlags: Dword;
ShowWindowFlags: Dword;
WindowTitle: TUNICODE_STRING;
DesktopInfo: TUNICODE_STRING;
ShellInfo: TUNICODE_STRING;
RuntimeData: TUNICODE_STRING;
CurrentDirectores: array[0..31] of TRTL_DRIVE_LETTER_CURDIR;
end;
PRTL_CRITICAL_SECTION = ^TRTL_CRITICAL_SECTION;
PRTL_CRITICAL_SECTION_DEBUG = ^TRTL_CRITICAL_SECTION_DEBUG;
TRTL_CRITICAL_SECTION_DEBUG = record
Type_18: Word;
CreatorBackTraceIndex: Word;
CriticalSection: PRTL_CRITICAL_SECTION;
ProcessLocksList: TLIST_ENTRY;
EntryCount: DWORD;
ContentionCount: DWORD;
Spare: array[0..1] of DWORD;
end;
TRTL_CRITICAL_SECTION = record
DebugInfo: PRTL_CRITICAL_SECTION_DEBUG;
LockCount: Longint;
RecursionCount: Longint;
OwningThread: THandle;
LockSemaphore: THandle;
Reserved: DWORD;
end;
PPEB_FREE_BLOCK = ^TPEB_FREE_BLOCK;
TPEB_FREE_BLOCK = record
Next: PPEB_FREE_BLOCK;
Size: Cardinal;
end;
PPeb = ^TPeb;
TPeb = packed record
InheritedAddressSpace: Byte;
ReadImageFileExecOptions: Byte;
BeingDebugged: Byte;
SpareBool: Byte;
Mutant: Pointer;
ImageBaseAddress: Pointer;
Ldr: PPEB_LDR_DATA;
ProcessParameters: PRTL_USER_PROCESS_PARAMETERS;
SubSystemData: Pointer;
ProcessHeap: Pointer;
FastPebLock: PRTL_CRITICAL_SECTION;
FastPebLockRoutine: Pointer;
FastPebUnlockRoutine: Pointer;
EnvironmentUpdateCount: Cardinal;
KernelCallbackTable: Pointer;
SystemReserved: Dword;
AtlThunkSListPtr32: Dword;
FreeList: PPEB_FREE_BLOCK;
TlsExpansionCounter: Cardinal;
TlsBitmap: Pointer;
TlsBitmapBits: array[0..1] of Cardinal;
ReadOnlySharedMemoryBase: Pointer;
ReadOnlySharedMemoryHeap: Pointer;
ReadOnlyStaticServerData: PPointer;
AnsiCodePageData: Pointer;
OemCodePageData: Pointer;
UnicodeCaseTableData: Pointer;
NumberOfProcessors: Cardinal;
NtGlobalFlag: Cardinal;
Gap1: Dword; //间隙
CriticalSectionTimeout: Int64;
HeapSegmentReserve: DWORD;
HeapSegmentCommit: DWORD;
HeapDeCommitTotalFreeThreshold: DWORD;
HeapDeCommitFreeBlockThreshold: DWORD;
NumberOfHeaps: DWORD;
MaximumNumberOfHeaps: DWORD;
ProcessHeaps: PPointer;
GdiSharedHandleTable: Pointer;
ProcessStarterHelper: Pointer;
GdiDCAttributeList: DWORD;
LoaderLock: Pointer;
OSMajorVersion: DWORD;
OSMinorVersion: DWORD;
OSBuildNumber: word;
OSCSDVersion: word;
OSPlatformId: DWORD;
ImageSubsystem: DWORD;
ImageSubsystemMajorVersion: DWORD;
ImageSubsystemMinorVersion: DWORD;
ImageProcessAffinityMask: DWORD;
GdiHandleBuffer: array[0..33] of Dword;
PostProcessInitRoutine: Pointer;
TlsExpansionBitmap: Pointer;
TlsExpansionBitmapBits: array[0..31] of Dword;
SessionId: DWORD;
AppCompatInfo: Int64;
AppCompatFlagsUser: Int64;
pShimData: Pointer;
AppCompInfo: Pointer;
CSDVersion: TUNICODE_STRING;
ActivationContextData: Pointer;
ProcessAssemblyStorageMap: Pointer;
SystemDefaultActivationContextData: Pointer;
SystemAssemblyStorageMap: Pointer;
MinimumStackCommit: DWORD;
Gap2: Dword; //间隙
end;
PHANDLE_TRACE_DB_ENTRY = ^THANDLE_TRACE_DB_ENTRY;
THANDLE_TRACE_DB_ENTRY = packed record //size : $50 byte
ClientId: TCLIENT_ID;
Handle: Pointer;
dType: Dword;
StackTrace: array[0..15] of Pointer;
end;
PHANDLE_TRACE_DEBUG_INFO = ^THANDLE_TRACE_DEBUG_INFO;
THANDLE_TRACE_DEBUG_INFO = packed record //size : $50004 byte
CurrentStackIndex: Dword;
TraceDb: array[0..4095] of THANDLE_TRACE_DB_ENTRY;
end;
PHANDLE_TABLE = ^THANDLE_TABLE;
THANDLE_TABLE = packed record
TableCode: Dword;
QuotaProcess: PEPROCESS;
UniqueProcessId: Pointer;
HandleTableLock: array[0..3] of TEX_PUSH_LOCK;
HandleTableList: TLIST_ENTRY;
HandleContentionEvent: TEX_PUSH_LOCK;
DebugInfo: PHANDLE_TRACE_DEBUG_INFO;
ExtraInfoPages: Dword;
FirstFree: Dword;
LastFree: Dword;
NextHandleNeedingPool: Dword;
HandleCount: Dword;
Flags: Dword;
end;
PEX_FAST_REF = ^TEX_FAST_REF;
TEX_FAST_REF = packed record
case Integer of
0: (pObject: Pointer);
1: (Value: DWORD);
end;
PFAST_MUTEX = ^TFAST_MUTEX;
TFAST_MUTEX = packed record
Count: Cardinal;
Owner: PKTHREAD;
Contention: DWORD;
Event: TKEVENT;
OldIrql: DWORD;
end;
POWNER_ENTRY = ^TOWNER_ENTRY;
TOWNER_ENTRY = packed record
OwnerThread: Dword;
case Integer of
0: (OwnerCount: DWORD);
1: (TableSize: DWORD);
end;
PERESOURCE = ^TERESOURCE;
TERESOURCE = packed record
SystemResourcesList: TLIST_ENTRY;
OwnerTable: POWNER_ENTRY;
ActiveCount: word;
Flag: word;
SharedWaiters: PKSEMAPHORE;
ExclusiveWaiters: PKEVENT;
OwnerThreads: array[0..1] of TOWNER_ENTRY;
ContentionCount: Dword;
NumberOfSharedWaiters: word;
NumberOfExclusiveWaiters: word;
Address: Pointer;
CreatorBackTraceIndex: Dword;
SpinLock: Dword;
end;
PSID_AND_ATTRIBUTES = ^TSID_AND_ATTRIBUTES;
TSID_AND_ATTRIBUTES = packed record
Sid: Pointer;
Attributes: dword;
end;
PPS_JOB_TOKEN_FILTER = ^TPS_JOB_TOKEN_FILTER;
TPS_JOB_TOKEN_FILTER = packed record
CapturedSidCount: Cardinal;
CapturedSids: PSID_AND_ATTRIBUTES;
CapturedSidsLength: Cardinal;
CapturedGroupCount: Cardinal;
CapturedGroups: PSID_AND_ATTRIBUTES;
CapturedGroupsLength: Cardinal;
CapturedPrivilegeCount: Cardinal;
CapturedPrivileges: PSID_AND_ATTRIBUTES;
CapturedPrivilegesLength: Cardinal;
end;
PIO_COUNTERS = ^TIO_COUNTERS;
TIO_COUNTERS = packed record
ReadOperationCount: Int64;
WriteOperationCount: Int64;
OtherOperationCount: Int64;
ReadTransferCount: Int64;
WriteTransferCount: Int64;
OtherTransferCount: Int64;
end;
PEJOB = ^TEJOB;
TEJOB = packed record //size: $180 bytes
Event: TKEVENT;
JobLinks: TLIST_ENTRY;
ProcessListHead: TLIST_ENTRY;
JobLock: TERESOURCE;
TotalUserTime: Int64;
TotalKernelTime: Int64;
ThisPeriodTotalUserTime: Int64;
ThisPeriodTotalKernelTime: Int64;
TotalPageFaultCount: Dword;
TotalProcesses: Dword;
ActiveProcesses: Dword;
TotalTerminatedProcesses: Dword;
PerProcessUserTimeLimit: Int64;
PerJobUserTimeLimit: Int64;
LimitFlags: Dword;
MinimumWorkingSetSize: Dword;
MaximumWorkingSetSize: Dword;
ActiveProcessLimit: Dword;
Affinity: Dword;
PriorityClass: Byte;
UIRestrictionsClass: Dword;
SecurityLimitFlags: Dword;
Token: Pointer;
Filter: PPS_JOB_TOKEN_FILTER;
EndOfJobTimeAction: Dword;
CompletionPort: Pointer;
CompletionKey: Pointer;
SessionId: Dword;
SchedulingClass: Dword;
ReadOperationCount: Int64;
WriteOperationCount: Int64;
OtherOperationCount: Int64;
ReadTransferCount: Int64;
WriteTransferCount: Int64;
OtherTransferCount: Int64;
IoInfo: TIO_COUNTERS;
ProcessMemoryLimit: Dword;
JobMemoryLimit: Dword;
PeakProcessMemoryUsed: Dword;
PeakJobMemoryUsed: Dword;
CurrentJobMemoryUsed: Dword;
MemoryLimitsLock: TFAST_MUTEX;
JobSetLinks: TLIST_ENTRY;
MemberLevel: Dword;
JobFlags: Dword;
end;
PEPROCESS_QUOTA_ENTRY = ^TEPROCESS_QUOTA_ENTRY;
TEPROCESS_QUOTA_ENTRY = packed record
Usage: DWORD;
Limit: DWORD;
Peak: DWORD;
Return: DWORD;
end;
PEPROCESS_QUOTA_BLOCK = ^TEPROCESS_QUOTA_BLOCK;
TEPROCESS_QUOTA_BLOCK = packed record
QuotaEntry: array[0..3] of TEPROCESS_QUOTA_ENTRY;
QuotaList: TLIST_ENTRY;
ReferenceCount: Cardinal;
ProcessCount: Cardinal;
end;
PPROCESS_WS_WATCH_INFORMATION = ^TPROCESS_WS_WATCH_INFORMATION;
TPROCESS_WS_WATCH_INFORMATION = packed record
FaultingPc: Pointer;
FaultingVa: Pointer;
end;
PPAGEFAULT_HISTORY = ^TPAGEFAULT_HISTORY;
TPAGEFAULT_HISTORY = packed record
CurrentIndex: DWORD;
MaxIndex: DWORD;
SpinLock: DWORD;
Reserved: Pointer;
WatchInfo: TPROCESS_WS_WATCH_INFORMATION;
end;
PHARDWARE_PTE_X86 = ^THARDWARE_PTE_X86;
THARDWARE_PTE_X86 = packed record
Bit: Dword;
// Valid: Bitfield Pos 0, 1 Bit
// Write: Bitfield Pos 1, 1 Bit
// Owner: Bitfield Pos 2, 1 Bit
// WriteThrough: Bitfield Pos 3, 1 Bit
// CacheDisable: Bitfield Pos 4, 1 Bit
// Accessed: Bitfield Pos 5, 1 Bit
// Dirty: Bitfield Pos 6, 1 Bit
// LargePage: Bitfield Pos 7, 1 Bit
// Global: Bitfield Pos 8, 1 Bit
// CopyOnWrite: Bitfield Pos 9, 1 Bit
// Prototype: Bitfield Pos 10, 1 Bit
// reserved: Bitfield Pos 11, 1 Bit
// PageFrameNumber: Bitfield Pos 12, 20 Bits
end;
POBJECT_NAME_INFORMATION = ^TOBJECT_NAME_INFORMATION;
TOBJECT_NAME_INFORMATION = packed record
Name: TUNICODE_STRING;
end;
PSE_AUDIT_PROCESS_CREATION_INFO = ^TSE_AUDIT_PROCESS_CREATION_INFO;
TSE_AUDIT_PROCESS_CREATION_INFO = packed record
ImageFileName: POBJECT_NAME_INFORMATION;
end;
PMMSUPPORT_FLAGS = ^TMMSUPPORT_FLAGS;
TMMSUPPORT_FLAGS = packed record
Bit: DWORD;
//SessionSpace : Bitfield Pos 0, 1 Bit
//BeingTrimmed : Bitfield Pos 1, 1 Bit
//SessionLeader : Bitfield Pos 2, 1 Bit
//TrimHard : Bitfield Pos 3, 1 Bit
//WorkingSetHard : Bitfield Pos 4, 1 Bit
//AddressSpaceBeingDeleted : Bitfield Pos 5, 1 Bit
//Available : Bitfield Pos 6, 10 Bits
//AllowWorkingSetAdjustment : Bitfield Pos 16, 8 Bits
//MemoryPriority : Bitfield Pos 24, 8 Bits
end;
PMMWSL = ^TMMWSL;
TMMWSL = packed record
//MS Undefined
end;
PMMSUPPORT = ^TMMSUPPORT;
TMMSUPPORT = packed record
LastTrimTime: Int64;
Flags: TMMSUPPORT_FLAGS;
PageFaultCount: Dword;
PeakWorkingSetSize: Dword;
WorkingSetSize: Dword;
MinimumWorkingSetSize: Dword;
MaximumWorkingSetSize: Dword;
VmWorkingSetList: PMMWSL;
WorkingSetExpansionLinks: TLIST_ENTRY;
Claim: Dword;
NextEstimationSlot: Dword;
NextAgingSlot: Dword;
EstimatedAvailable: Dword;
GrowthSinceLastEstimate: Dword;
end;
TEPROCESS = packed record
Pcb: TKPROCESS;
ProcessLock: TEX_PUSH_LOCK;
CreateTime: Int64;
ExitTime: Int64;
RundownProtect: TEX_RUNDOWN_REF;
UniqueProcessId: Integer;
ActiveProcessLinks: TLIST_ENTRY;
QuotaUsage: array[0..2] of Cardinal;
QuotaPeak: array[0..2] of Cardinal;
CommitCharge: Cardinal;
PeakVirtualSize: Cardinal;
VirtualSize: Cardinal;
SessionProcessLinks: TLIST_ENTRY;
DebugPort: Pointer;
ExceptionPort: Pointer;
ObjectTable: PHANDLE_TABLE;
Token: TEX_FAST_REF;
WorkingSetLock: TFAST_MUTEX;
WorkingSetPage: Cardinal;
AddressCreationLock: TFAST_MUTEX;
HyperSpaceLock: Cardinal;
ForkInProgress: PEThread;
HardwareTrigger: Cardinal;
VadRoot: Pointer;
VadHint: Pointer;
CloneRoot: Pointer;
NumberOfPrivatePages: Cardinal;
NumberOfLockedPages: Cardinal;
Win32Process: Pointer;
Job: PEJOB;
SectionObject: Pointer;
SectionBaseAddress: Pointer;
QuotaBlock: PEPROCESS_QUOTA_BLOCK;
WorkingSetWatch: PPAGEFAULT_HISTORY;
Win32WindowStation: Pointer;
InheritedFromUniqueProcessId: Cardinal;
LdtInformation: Pointer;
VadFreeHint: Pointer;
VdmObjects: Pointer;
DeviceMap: Pointer;
PhysicalVadList: TLIST_ENTRY;
Union1: record case integer of
0: (PageDirectoryPte: THARDWARE_PTE_X86);
1: (Filler: Int64);
end;
Session: Pointer;
ImageFileName: array[0..$F] of Char;
JobLinks: TLIST_ENTRY;
LockedPagesList: Pointer;
ThreadListHead: TLIST_ENTRY;
SecurityPort: Pointer;
PaeTop: Pointer;
ActiveThreads: Cardinal;
GrantedAccess: Cardinal;
DefaultHardErrorProcessing: Cardinal;
LastThreadExitStatus: Dword;
Peb: PPeb;
PrefetchTrace: TEX_FAST_REF;
ReadOperationCount: Int64;
WriteOperationCount: Int64;
OtherOperationCount: Int64;
ReadTransferCount: Int64;
WriteTransferCount: Int64;
OtherTransferCount: Int64;
CommitChargeLimit: Cardinal;
CommitChargePeak: Cardinal;
AweInfo: Pointer;
SeAuditProcessCreationInfo: TSE_AUDIT_PROCESS_CREATION_INFO;
Vm: TMMSUPPORT;
LastFaultCount: Cardinal;
ModifiedPageCount: Cardinal;
NumberOfVads: Cardinal;
JobStatus: Cardinal;
Flags: Cardinal;
ExitStatus: DWORD;
NextPageColor: Word;
Union2: record case integer of
0: (SSV: record SubSystemMinorVersion: Byte; SubSystemMajorVersion: Byte; end);
1: (SubSystemVersion: Word);
end;
SubSystemVersion: Word;
PriorityClass: Byte;
WorkingSetAcquiredUnsafe: Byte;
Cookie: Cardinal;
Gap: DWORD; //间隙
end;
NTSTATUS = DWORD;
function NT_SUCCESS(Status: DWORD): Bool;
implementation
function NT_SUCCESS(Status: NTSTATUS): Bool;
begin
Result := Integer(Status) >= 0;
end;
function CTL_CODE(DeviceType, Func, Method, Access: DWORD): DWORD;
begin
result := (((DeviceType) shl 16) or ((Access) shl 14) or ((Func) shl 2) or (Method));
end;
end.