Skip to content

Commit af834a6

Browse files
fancycodefancycode
committed
initial checkin
1 parent 9399210 commit af834a6

1 file changed

Lines changed: 215 additions & 0 deletions

File tree

‎ntinternals.h‎

Lines changed: 215 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,215 @@
1+
/*
2+
* Undocumented Windows structures
3+
*
4+
* Found on http://undocumented.ntinternals.net/
5+
*/
6+
7+
#ifndef __NT_INTERNALS
8+
#define __NT_INTERNALS
9+
10+
#include <windows.h>
11+
#include <winternl.h>
12+
13+
#ifndef UNICODE_STRING
14+
// usually included in "winternl.h"
15+
16+
typedef struct _UNICODE_STRING {
17+
USHORT Length;
18+
USHORT MaximumLength;
19+
PWSTR Buffer;
20+
} UNICODE_STRING;
21+
typedef UNICODE_STRING *PUNICODE_STRING;
22+
typedef const UNICODE_STRING *PCUNICODE_STRING;
23+
24+
#endif
25+
26+
// constants from the article
27+
// "What Goes On Inside Windows 2000: Solving the Mysteries of the Loader"
28+
// by Russ Osterlund
29+
// http://msdn.microsoft.com/msdnmag/issues/02/03/Loader/default.aspx
30+
#define MAX_DLL_NAME_LENGTH 0x214
31+
32+
#define STATIC_LINK 0x00000002
33+
#define IMAGE_DLL 0x00000004
34+
#define LOAD_IN_PROGRESS 0x00001000
35+
#define UNLOAD_IN_PROGRESS 0x00002000
36+
#define ENTRY_PROCESSED 0x00004000
37+
#define ENTRY_INSERTED 0x00008000
38+
#define CURRENT_LOAD 0x00010000
39+
#define FAILED_BUILTIN_LOAD 0x00020000
40+
#define DONT_CALL_FOR_THREAD 0x00040000
41+
#define PROCESS_ATTACH_CALLED 0x00080000
42+
#define DEBUG_SYMBOLS_LOADED 0x00100000
43+
#define IMAGE_NOT_AT_BASE 0x00200000
44+
#define WX86_IGNORE_MACHINETYPE 0x00400000
45+
46+
/*
47+
* Documented by:
48+
* Reactos
49+
* Tomasz Nowak
50+
*/
51+
typedef struct _LDR_MODULE {
52+
LIST_ENTRY InLoadOrderModuleList;
53+
LIST_ENTRY InMemoryOrderModuleList;
54+
LIST_ENTRY InInitializationOrderModuleList;
55+
PVOID BaseAddress;
56+
PVOID EntryPoint;
57+
ULONG SizeOfImage;
58+
UNICODE_STRING FullDllName;
59+
UNICODE_STRING BaseDllName;
60+
ULONG Flags;
61+
SHORT LoadCount;
62+
SHORT TlsIndex;
63+
LIST_ENTRY HashTableEntry;
64+
ULONG TimeDateStamp;
65+
} LDR_MODULE, *PLDR_MODULE;
66+
67+
/*
68+
* Documented by:
69+
* Reactos
70+
* Tomasz Nowak
71+
*/
72+
typedef struct _PEB_LDR_DATA {
73+
ULONG Length;
74+
BOOLEAN Initialized;
75+
PVOID SsHandle;
76+
LIST_ENTRY InLoadOrderModuleList;
77+
LIST_ENTRY InMemoryOrderModuleList;
78+
LIST_ENTRY InInitializationOrderModuleList;
79+
} PEB_LDR_DATA, *PPEB_LDR_DATA;
80+
81+
/*
82+
* Documented by:
83+
* Reactos
84+
*/
85+
typedef struct _RTL_DRIVE_LETTER_CURDIR {
86+
USHORT Flags;
87+
USHORT Length;
88+
ULONG TimeStamp;
89+
UNICODE_STRING DosPath;
90+
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
91+
92+
/*
93+
* Documented by:
94+
* Reactos
95+
* Tomasz Nowak
96+
*/
97+
typedef struct _RTL_USER_PROCESS_PARAMETERS {
98+
ULONG MaximumLength;
99+
ULONG Length;
100+
ULONG Flags;
101+
ULONG DebugFlags;
102+
PVOID ConsoleHandle;
103+
ULONG ConsoleFlags;
104+
HANDLE StdInputHandle;
105+
HANDLE StdOutputHandle;
106+
HANDLE StdErrorHandle;
107+
UNICODE_STRING CurrentDirectoryPath;
108+
HANDLE CurrentDirectoryHandle;
109+
UNICODE_STRING DllPath;
110+
UNICODE_STRING ImagePathName;
111+
UNICODE_STRING CommandLine;
112+
PVOID Environment;
113+
ULONG StartingPositionLeft;
114+
ULONG StartingPositionTop;
115+
ULONG Width;
116+
ULONG Height;
117+
ULONG CharWidth;
118+
ULONG CharHeight;
119+
ULONG ConsoleTextAttributes;
120+
ULONG WindowFlags;
121+
ULONG ShowWindowFlags;
122+
UNICODE_STRING WindowTitle;
123+
UNICODE_STRING DesktopName;
124+
UNICODE_STRING ShellInfo;
125+
UNICODE_STRING RuntimeData;
126+
RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];
127+
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
128+
129+
/*
130+
* Address of fast-locking routine for PEB
131+
*/
132+
typedef void (*PPEBLOCKROUTINE)(
133+
PVOID PebLock
134+
);
135+
136+
typedef LPVOID *PPVOID;
137+
138+
/*
139+
* Structure PEB_FREE_BLOCK is used internally in PEB (Process Enviroment Block)
140+
* structure for describe free blocks in memory allocated for PEB.
141+
*
142+
* Documented by:
143+
* Reactos
144+
*/
145+
typedef struct _PEB_FREE_BLOCK {
146+
struct _PEB_FREE_BLOCK *Next;
147+
ULONG Size;
148+
} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
149+
150+
/*
151+
* Structure PEB (Process Enviroment Block) contains all User-Mode parameters
152+
* associated by system with current process.
153+
*
154+
* Documented by:
155+
* Reactos
156+
* Tomasz Nowak
157+
*/
158+
typedef struct _PEB {
159+
BOOLEAN InheritedAddressSpace;
160+
BOOLEAN ReadImageFileExecOptions;
161+
BOOLEAN BeingDebugged;
162+
BOOLEAN Spare;
163+
HANDLE Mutant;
164+
PVOID ImageBaseAddress;
165+
PPEB_LDR_DATA LoaderData;
166+
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
167+
PVOID SubSystemData;
168+
PVOID ProcessHeap;
169+
PVOID FastPebLock;
170+
PPEBLOCKROUTINE FastPebLockRoutine;
171+
PPEBLOCKROUTINE FastPebUnlockRoutine;
172+
ULONG EnvironmentUpdateCount;
173+
PPVOID KernelCallbackTable;
174+
PVOID EventLogSection;
175+
PVOID EventLog;
176+
PPEB_FREE_BLOCK FreeList;
177+
ULONG TlsExpansionCounter;
178+
PVOID TlsBitmap;
179+
ULONG TlsBitmapBits[0x2];
180+
PVOID ReadOnlySharedMemoryBase;
181+
PVOID ReadOnlySharedMemoryHeap;
182+
PPVOID ReadOnlyStaticServerData;
183+
PVOID AnsiCodePageData;
184+
PVOID OemCodePageData;
185+
PVOID UnicodeCaseTableData;
186+
ULONG NumberOfProcessors;
187+
ULONG NtGlobalFlag;
188+
BYTE Spare2[0x4];
189+
LARGE_INTEGER CriticalSectionTimeout;
190+
ULONG HeapSegmentReserve;
191+
ULONG HeapSegmentCommit;
192+
ULONG HeapDeCommitTotalFreeThreshold;
193+
ULONG HeapDeCommitFreeBlockThreshold;
194+
ULONG NumberOfHeaps;
195+
ULONG MaximumNumberOfHeaps;
196+
PPVOID *ProcessHeaps;
197+
PVOID GdiSharedHandleTable;
198+
PVOID ProcessStarterHelper;
199+
PVOID GdiDCAttributeList;
200+
PVOID LoaderLock;
201+
ULONG OSMajorVersion;
202+
ULONG OSMinorVersion;
203+
ULONG OSBuildNumber;
204+
ULONG OSPlatformId;
205+
ULONG ImageSubSystem;
206+
ULONG ImageSubSystemMajorVersion;
207+
ULONG ImageSubSystemMinorVersion;
208+
ULONG GdiHandleBuffer[0x22];
209+
ULONG PostProcessInitRoutine;
210+
ULONG TlsExpansionBitmap;
211+
BYTE TlsExpansionBitmapBits[0x80];
212+
ULONG SessionId;
213+
} PEB, *PPEB;
214+
215+
#endif // __NT_INTERNALS

0 commit comments

Comments
 (0)