|
@@ -0,0 +1,219 @@
|
|
|
+// These datatypes are used in system.pas and ndk.pas
|
|
|
+
|
|
|
+const
|
|
|
+{$ifdef kmode}
|
|
|
+ ntdll = 'ntoskrnl.exe';
|
|
|
+{$else}
|
|
|
+ ntdll = 'ntdll.dll';
|
|
|
+{$endif}
|
|
|
+
|
|
|
+type
|
|
|
+ //
|
|
|
+ // some basic types
|
|
|
+ //
|
|
|
+ HANDLE = THandle;
|
|
|
+ PVOID = Pointer;
|
|
|
+ LONG = LongInt;
|
|
|
+ ULONG = LongWord;
|
|
|
+
|
|
|
+
|
|
|
+ NTSTATUS = LongInt;
|
|
|
+
|
|
|
+ UNICODE_STRING = packed record
|
|
|
+ Length: Word; // used characters in buffer
|
|
|
+ MaximumLength: Word; // maximum characters in buffer
|
|
|
+ Buffer: PWideChar;
|
|
|
+ end;
|
|
|
+ PUNICODE_STRING = ^UNICODE_STRING;
|
|
|
+ // alias to differ from TUnicodeString
|
|
|
+ TNtUnicodeString = UNICODE_STRING;
|
|
|
+ PNtUnicodeString = ^TNtUnicodeString;
|
|
|
+
|
|
|
+ // using Int64 is an alternative (QWord might have unintended side effects)
|
|
|
+ LARGE_INTEGER = packed record
|
|
|
+ case Boolean of
|
|
|
+ True:(LowPart: LongWord;
|
|
|
+ HighPart: LongInt);
|
|
|
+ False:(QuadPart: Int64);
|
|
|
+ end;
|
|
|
+ PLARGE_INTEGER = ^LARGE_INTEGER;
|
|
|
+ TLargeInteger = LARGE_INTEGER;
|
|
|
+ PLargeInteger = ^TLargeInteger;
|
|
|
+
|
|
|
+
|
|
|
+//
|
|
|
+// Object Attributes structure
|
|
|
+//
|
|
|
+ POBJECT_ATTRIBUTES = ^OBJECT_ATTRIBUTES;
|
|
|
+ _OBJECT_ATTRIBUTES = record
|
|
|
+ Length: ULONG;
|
|
|
+ RootDirectory: HANDLE;
|
|
|
+ ObjectName: PUNICODE_STRING;
|
|
|
+ Attributes: ULONG;
|
|
|
+ SecurityDescriptor: PVOID; // Points to type SECURITY_DESCRIPTOR
|
|
|
+ SecurityQualityOfService: PVOID; // Points to type SECURITY_QUALITY_OF_SERVICE
|
|
|
+ end;
|
|
|
+ OBJECT_ATTRIBUTES = _OBJECT_ATTRIBUTES;
|
|
|
+ TObjectAttributes = OBJECT_ATTRIBUTES;
|
|
|
+ PObjectAttributes = POBJECT_ATTRIBUTES;
|
|
|
+
|
|
|
+ TRtlDriveLetterCurDir = packed record
|
|
|
+ Flags: Word;
|
|
|
+ Length: Word;
|
|
|
+ TimeStamp: LongWord;
|
|
|
+ DosPath: TNtUnicodeString;
|
|
|
+ end;
|
|
|
+
|
|
|
+ TCurDir = packed record
|
|
|
+ DosPath: TNtUnicodeString;
|
|
|
+ Handle: THandle;
|
|
|
+ end;
|
|
|
+
|
|
|
+ TRtlUserProcessParameters = packed record
|
|
|
+ MaximumLength: LongWord;
|
|
|
+ Length: LongWord;
|
|
|
+ Flags: LongWord;
|
|
|
+ DebugFlags: LongWord;
|
|
|
+ ConsoleHandle: THandle;
|
|
|
+ ConsoleFlags: LongWord;
|
|
|
+ StandardInput: THandle;
|
|
|
+ StandardOutput: THandle;
|
|
|
+ StandardError: THandle;
|
|
|
+ CurrentDirectory: TCurDir;
|
|
|
+ DllPath: TNtUnicodeString;
|
|
|
+ ImagePathName: TNtUnicodeString;
|
|
|
+ CommandLine: TNtUnicodeString;
|
|
|
+ Environment: ^Word; // PWSTR
|
|
|
+ StartingX: LongWord;
|
|
|
+ StartingY: LongWord;
|
|
|
+ CountX: LongWord;
|
|
|
+ CountY: LongWord;
|
|
|
+ CountCharsX: LongWord;
|
|
|
+ CountCharsY: LongWord;
|
|
|
+ FillAttribute: LongWord;
|
|
|
+ WindowFlags: LongWord;
|
|
|
+ ShowWindowFlags: LongWord;
|
|
|
+ WindowTitle: TNtUnicodeString;
|
|
|
+ DesktopInfo: TNtUnicodeString;
|
|
|
+ ShellInfo: TNtUnicodeString;
|
|
|
+ RuntimeData: TNtUnicodeString;
|
|
|
+ CurrentDirectories: array[0..31] of TRtlDriveLetterCurDir;
|
|
|
+ end;
|
|
|
+ PRtlUserProcessParameters = ^TRtlUserProcessParameters;
|
|
|
+
|
|
|
+ TSimplePEB = packed record
|
|
|
+ InheritedAddressSpace: Byte;
|
|
|
+ ReadImageFileExecOptions: Byte;
|
|
|
+ BeingDebugged: Byte;
|
|
|
+//#if (NTDDI_VERSION >= NTDDI_WS03)
|
|
|
+// struct
|
|
|
+ {
|
|
|
+ UCHAR ImageUsesLargePages:1;
|
|
|
+ #if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
|
+ UCHAR IsProtectedProcess:1;
|
|
|
+ UCHAR IsLegacyProcess:1;
|
|
|
+ UCHAR SpareBits:5;
|
|
|
+ #else
|
|
|
+ UCHAR SpareBits:7;
|
|
|
+ #endif
|
|
|
+ }//;
|
|
|
+//#else
|
|
|
+ SpareBool: Byte;
|
|
|
+//#endif
|
|
|
+ Mutant: THandle;
|
|
|
+ ImageBaseAddress: Pointer;
|
|
|
+ Ldr: Pointer; // PPEB_LDR_DATA
|
|
|
+ ProcessParameters: PRtlUserProcessParameters;
|
|
|
+ SubSystemData: Pointer;
|
|
|
+ ProcessHeap: Pointer;
|
|
|
+//#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
|
+(* struct _RTL_CRITICAL_SECTION *FastPebLock;
|
|
|
+ PVOID AltThunkSListPtr;
|
|
|
+ PVOID IFEOKey;
|
|
|
+ ULONG Spare;
|
|
|
+ union
|
|
|
+ {
|
|
|
+ PVOID* KernelCallbackTable;
|
|
|
+ PVOID UserSharedInfoPtr;
|
|
|
+ };
|
|
|
+ ULONG SystemReserved[1];
|
|
|
+ ULONG SpareUlong;*)
|
|
|
+//#else
|
|
|
+ FastPebLock: Pointer;
|
|
|
+ FastPebLockRoutine: Pointer; // PPEBLOCKROUTINE
|
|
|
+ FastPebUnlockRoutine: Pointer; // PPEBLOCKROUTINE
|
|
|
+ EnvironmentUpdateCount: LongWord;
|
|
|
+ KernelCallbackTable: Pointer; // PVOID*
|
|
|
+ EventLogSection: Pointer;
|
|
|
+ EventLog: Pointer;
|
|
|
+//#endif
|
|
|
+ FreeList: Pointer; // PPEB_FREE_BLOCK
|
|
|
+ TlsExpansionCounter: LongWord;
|
|
|
+ TlsBitmap: Pointer;
|
|
|
+ TlsBitmapBits: array[0..1] of LongWord; //TlsBitmapBits[0x2]
|
|
|
+ ReadOnlySharedMemoryBase: Pointer;
|
|
|
+ ReadOnlySharedMemoryHeap: Pointer;
|
|
|
+ ReadOnlyStaticServerData: Pointer; //PVOID*
|
|
|
+ AnsiCodePageData: Pointer;
|
|
|
+ OemCodePageData: Pointer;
|
|
|
+ UnicodeCaseTableData: Pointer;
|
|
|
+ NumberOfProcessors: LongWord;
|
|
|
+ NtGlobalFlag: LongWord;
|
|
|
+ CriticalSectionTimeout: Int64; // LARGE_INTEGER
|
|
|
+ HeapSegmentReserve: LongWord;
|
|
|
+ HeapSegmentCommit: LongWord;
|
|
|
+ HeapDeCommitTotalFreeThreshold: LongWord;
|
|
|
+ HeapDeCommitFreeBlockThreshold: LongWord;
|
|
|
+ NumberOfHeaps: LongWord;
|
|
|
+ MaximumNumberOfHeaps: LongWord;
|
|
|
+ ProcessHeaps: Pointer; // PVOID*
|
|
|
+ GdiSharedHandleTable: Pointer;
|
|
|
+ ProcessStarterHelper: Pointer;
|
|
|
+ GdiDCAttributeList: LongWord;
|
|
|
+//#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
|
+// struct _RTL_CRITICAL_SECTION *LoaderLock;
|
|
|
+//#else
|
|
|
+ LoaderLock: Pointer;
|
|
|
+//#endif
|
|
|
+ OSMajorVersion: LongWord;
|
|
|
+ OSMinorVersion: LongWord;
|
|
|
+ OSBuildNumber: Word; // USHORT
|
|
|
+ OSCSDVersion: Word; // USHORT
|
|
|
+ OSPlatformId: LongWord;
|
|
|
+ ImageSubSystem: LongWord;
|
|
|
+ ImageSubSystemMajorVersion: LongWord;
|
|
|
+ ImageSubSystemMinorVersion: LongWord;
|
|
|
+ ImageProcessAffinityMask: LongWord;
|
|
|
+ GdiHandleBuffer: array[0..$21] of LongWord; // GdiHandleBuffer[0x22]
|
|
|
+ PostProcessInitRoutine: Pointer; //PPOST_PROCESS_INIT_ROUTINE
|
|
|
+ TlsExpansionBitmap: Pointer; //struct _RTL_BITMAP *TlsExpansionBitmap
|
|
|
+ TlsExpansionBitmapBits: array[0..$19] of Word; //TlsExpansionBitmapBits[0x20]
|
|
|
+ SessionId: LongWord;
|
|
|
+{#if (NTDDI_VERSION >= NTDDI_WINXP)
|
|
|
+ ULARGE_INTEGER AppCompatFlags;
|
|
|
+ ULARGE_INTEGER AppCompatFlagsUser;
|
|
|
+ PVOID pShimData;
|
|
|
+ PVOID AppCompatInfo;
|
|
|
+ UNICODE_STRING CSDVersion;
|
|
|
+ struct _ACTIVATION_CONTEXT_DATA *ActivationContextData;
|
|
|
+ struct _ASSEMBLY_STORAGE_MAP *ProcessAssemblyStorageMap;
|
|
|
+ struct _ACTIVATION_CONTEXT_DATA *SystemDefaultActivationContextData;
|
|
|
+ struct _ASSEMBLY_STORAGE_MAP *SystemAssemblyStorageMap;
|
|
|
+ ULONG MinimumStackCommit;
|
|
|
+#endif
|
|
|
+#if (NTDDI_VERSION >= NTDDI_WS03)
|
|
|
+ PVOID *FlsCallback;
|
|
|
+ LIST_ENTRY FlsListHead;
|
|
|
+ struct _RTL_BITMAP *FlsBitmap;
|
|
|
+ ULONG FlsBitmapBits[4];
|
|
|
+ ULONG FlsHighIndex;
|
|
|
+#endif
|
|
|
+#if (NTDDI_VERSION >= NTDDI_LONGHORN)
|
|
|
+ PVOID WerRegistrationData;
|
|
|
+ PVOID WerShipAssertPtr;
|
|
|
+#endif}
|
|
|
+ end;
|
|
|
+ PPEB = ^TSimplePEB;
|
|
|
+
|
|
|
+function NtDisplayString(aString: PNtUnicodeString): NTSTATUS; stdcall; external ntdll;
|
|
|
+
|