mirror of
https://github.com/BeneficialCode/WinArk.git
synced 2026-10-17 04:40:35 +08:00
CORP\zengquan
219 lines
15 KiB
C
219 lines
15 KiB
C
#pragma once
|
|
|
|
#include "pch.h"
|
|
|
|
typedef struct _IO_TIMER {
|
|
CSHORT Type;
|
|
CSHORT TimerFlag;
|
|
LIST_ENTRY TimerList;
|
|
PIO_TIMER_ROUTINE TimerRoutine;
|
|
PVOID Context;
|
|
struct _DEVICE_OBJECT* DeviceObject;
|
|
}IO_TIMER;
|
|
|
|
typedef struct _KTIMER_TABLE_ENTRY {
|
|
ULONG_PTR Lock;
|
|
LIST_ENTRY Entry;
|
|
ULARGE_INTEGER Time;
|
|
}KTIMER_TABLE_ENTRY, * PKTIMER_TABLE_ENTRY;
|
|
|
|
|
|
typedef enum _SYSTEM_INFORMATION_CLASS {
|
|
SystemBasicInformation, // q: SYSTEM_BASIC_INFORMATION
|
|
SystemProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION
|
|
SystemPerformanceInformation, // q: SYSTEM_PERFORMANCE_INFORMATION
|
|
SystemTimeOfDayInformation, // q: SYSTEM_TIMEOFDAY_INFORMATION
|
|
SystemPathInformation, // not implemented
|
|
SystemProcessInformation, // q: SYSTEM_PROCESS_INFORMATION
|
|
SystemCallCountInformation, // q: SYSTEM_CALL_COUNT_INFORMATION
|
|
SystemDeviceInformation, // q: SYSTEM_DEVICE_INFORMATION
|
|
SystemProcessorPerformanceInformation, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
|
|
SystemFlagsInformation, // q: SYSTEM_FLAGS_INFORMATION
|
|
SystemCallTimeInformation, // not implemented // SYSTEM_CALL_TIME_INFORMATION // 10
|
|
SystemModuleInformation, // q: RTL_PROCESS_MODULES
|
|
SystemLocksInformation, // q: RTL_PROCESS_LOCKS
|
|
SystemStackTraceInformation, // q: RTL_PROCESS_BACKTRACES
|
|
SystemPagedPoolInformation, // not implemented
|
|
SystemNonPagedPoolInformation, // not implemented
|
|
SystemHandleInformation, // q: SYSTEM_HANDLE_INFORMATION
|
|
SystemObjectInformation, // q: SYSTEM_OBJECTTYPE_INFORMATION mixed with SYSTEM_OBJECT_INFORMATION
|
|
SystemPageFileInformation, // q: SYSTEM_PAGEFILE_INFORMATION
|
|
SystemVdmInstemulInformation, // q
|
|
SystemVdmBopInformation, // not implemented // 20
|
|
SystemFileCacheInformation, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemCache)
|
|
SystemPoolTagInformation, // q: SYSTEM_POOLTAG_INFORMATION
|
|
SystemInterruptInformation, // q: SYSTEM_INTERRUPT_INFORMATION
|
|
SystemDpcBehaviorInformation, // q: SYSTEM_DPC_BEHAVIOR_INFORMATION; s: SYSTEM_DPC_BEHAVIOR_INFORMATION (requires SeLoadDriverPrivilege)
|
|
SystemFullMemoryInformation, // not implemented
|
|
SystemLoadGdiDriverInformation, // s (kernel-mode only)
|
|
SystemUnloadGdiDriverInformation, // s (kernel-mode only)
|
|
SystemTimeAdjustmentInformation, // q: SYSTEM_QUERY_TIME_ADJUST_INFORMATION; s: SYSTEM_SET_TIME_ADJUST_INFORMATION (requires SeSystemtimePrivilege)
|
|
SystemSummaryMemoryInformation, // not implemented
|
|
SystemMirrorMemoryInformation, // s (requires license value "Kernel-MemoryMirroringSupported") (requires SeShutdownPrivilege) // 30
|
|
SystemPerformanceTraceInformation, // q; s: (type depends on EVENT_TRACE_INFORMATION_CLASS)
|
|
SystemObsolete0, // not implemented
|
|
SystemExceptionInformation, // q: SYSTEM_EXCEPTION_INFORMATION
|
|
SystemCrashDumpStateInformation, // s (requires SeDebugPrivilege)
|
|
SystemKernelDebuggerInformation, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION
|
|
SystemContextSwitchInformation, // q: SYSTEM_CONTEXT_SWITCH_INFORMATION
|
|
SystemRegistryQuotaInformation, // q: SYSTEM_REGISTRY_QUOTA_INFORMATION; s (requires SeIncreaseQuotaPrivilege)
|
|
SystemExtendServiceTableInformation, // s (requires SeLoadDriverPrivilege) // loads win32k only
|
|
SystemPrioritySeperation, // s (requires SeTcbPrivilege)
|
|
SystemVerifierAddDriverInformation, // s (requires SeDebugPrivilege) // 40
|
|
SystemVerifierRemoveDriverInformation, // s (requires SeDebugPrivilege)
|
|
SystemProcessorIdleInformation, // q: SYSTEM_PROCESSOR_IDLE_INFORMATION
|
|
SystemLegacyDriverInformation, // q: SYSTEM_LEGACY_DRIVER_INFORMATION
|
|
SystemCurrentTimeZoneInformation, // q; s: RTL_TIME_ZONE_INFORMATION
|
|
SystemLookasideInformation, // q: SYSTEM_LOOKASIDE_INFORMATION
|
|
SystemTimeSlipNotification, // s (requires SeSystemtimePrivilege)
|
|
SystemSessionCreate, // not implemented
|
|
SystemSessionDetach, // not implemented
|
|
SystemSessionInformation, // not implemented (SYSTEM_SESSION_INFORMATION)
|
|
SystemRangeStartInformation, // q: SYSTEM_RANGE_START_INFORMATION // 50
|
|
SystemVerifierInformation, // q: SYSTEM_VERIFIER_INFORMATION; s (requires SeDebugPrivilege)
|
|
SystemVerifierThunkExtend, // s (kernel-mode only)
|
|
SystemSessionProcessInformation, // q: SYSTEM_SESSION_PROCESS_INFORMATION
|
|
SystemLoadGdiDriverInSystemSpace, // s (kernel-mode only) (same as SystemLoadGdiDriverInformation)
|
|
SystemNumaProcessorMap, // q
|
|
SystemPrefetcherInformation, // q: PREFETCHER_INFORMATION; s: PREFETCHER_INFORMATION // PfSnQueryPrefetcherInformation
|
|
SystemExtendedProcessInformation, // q: SYSTEM_PROCESS_INFORMATION
|
|
SystemRecommendedSharedDataAlignment, // q
|
|
SystemComPlusPackage, // q; s
|
|
SystemNumaAvailableMemory, // 60
|
|
SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION
|
|
SystemEmulationBasicInformation, // q
|
|
SystemEmulationProcessorInformation,
|
|
SystemExtendedHandleInformation, // q: SYSTEM_HANDLE_INFORMATION_EX
|
|
SystemLostDelayedWriteInformation, // q: ULONG
|
|
SystemBigPoolInformation, // q: SYSTEM_BIGPOOL_INFORMATION
|
|
SystemSessionPoolTagInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION
|
|
SystemSessionMappedViewInformation, // q: SYSTEM_SESSION_MAPPED_VIEW_INFORMATION
|
|
SystemHotpatchInformation, // q; s: SYSTEM_HOTPATCH_CODE_INFORMATION
|
|
SystemObjectSecurityMode, // q: ULONG // 70
|
|
SystemWatchdogTimerHandler, // s (kernel-mode only)
|
|
SystemWatchdogTimerInformation, // q (kernel-mode only); s (kernel-mode only)
|
|
SystemLogicalProcessorInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION
|
|
SystemWow64SharedInformationObsolete, // not implemented
|
|
SystemRegisterFirmwareTableInformationHandler, // s (kernel-mode only)
|
|
SystemFirmwareTableInformation, // SYSTEM_FIRMWARE_TABLE_INFORMATION
|
|
SystemModuleInformationEx, // q: RTL_PROCESS_MODULE_INFORMATION_EX
|
|
SystemVerifierTriageInformation, // not implemented
|
|
SystemSuperfetchInformation, // q; s: SUPERFETCH_INFORMATION // PfQuerySuperfetchInformation
|
|
SystemMemoryListInformation, // q: SYSTEM_MEMORY_LIST_INFORMATION; s: SYSTEM_MEMORY_LIST_COMMAND (requires SeProfileSingleProcessPrivilege) // 80
|
|
SystemFileCacheInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (same as SystemFileCacheInformation)
|
|
SystemThreadPriorityClientIdInformation, // s: SYSTEM_THREAD_CID_PRIORITY_INFORMATION (requires SeIncreaseBasePriorityPrivilege)
|
|
SystemProcessorIdleCycleTimeInformation, // q: SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION[]
|
|
SystemVerifierCancellationInformation, // not implemented // name:wow64:whNT32QuerySystemVerifierCancellationInformation
|
|
SystemProcessorPowerInformationEx, // not implemented
|
|
SystemRefTraceInformation, // q; s: SYSTEM_REF_TRACE_INFORMATION // ObQueryRefTraceInformation
|
|
SystemSpecialPoolInformation, // q; s (requires SeDebugPrivilege) // MmSpecialPoolTag, then MmSpecialPoolCatchOverruns != 0
|
|
SystemProcessIdInformation, // q: SYSTEM_PROCESS_ID_INFORMATION
|
|
SystemErrorPortInformation, // s (requires SeTcbPrivilege)
|
|
SystemBootEnvironmentInformation, // q: SYSTEM_BOOT_ENVIRONMENT_INFORMATION // 90
|
|
SystemHypervisorInformation, // q; s (kernel-mode only)
|
|
SystemVerifierInformationEx, // q; s: SYSTEM_VERIFIER_INFORMATION_EX
|
|
SystemTimeZoneInformation, // s (requires SeTimeZonePrivilege)
|
|
SystemImageFileExecutionOptionsInformation, // s: SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION (requires SeTcbPrivilege)
|
|
SystemCoverageInformation, // q; s // name:wow64:whNT32QuerySystemCoverageInformation; ExpCovQueryInformation
|
|
SystemPrefetchPatchInformation, // not implemented
|
|
SystemVerifierFaultsInformation, // s (requires SeDebugPrivilege)
|
|
SystemSystemPartitionInformation, // q: SYSTEM_SYSTEM_PARTITION_INFORMATION
|
|
SystemSystemDiskInformation, // q: SYSTEM_SYSTEM_DISK_INFORMATION
|
|
SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION // 100
|
|
SystemNumaProximityNodeInformation, // q
|
|
SystemDynamicTimeZoneInformation, // q; s (requires SeTimeZonePrivilege)
|
|
SystemCodeIntegrityInformation, // q: SYSTEM_CODEINTEGRITY_INFORMATION // SeCodeIntegrityQueryInformation
|
|
SystemProcessorMicrocodeUpdateInformation, // s
|
|
SystemProcessorBrandString, // q // HaliQuerySystemInformation -> HalpGetProcessorBrandString, info class 23
|
|
SystemVirtualAddressInformation, // q: SYSTEM_VA_LIST_INFORMATION[]; s: SYSTEM_VA_LIST_INFORMATION[] (requires SeIncreaseQuotaPrivilege) // MmQuerySystemVaInformation
|
|
SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // since WIN7 // KeQueryLogicalProcessorRelationship
|
|
SystemProcessorCycleTimeInformation, // q: SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[]
|
|
SystemStoreInformation, // q; s // SmQueryStoreInformation
|
|
SystemRegistryAppendString, // s: SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // 110
|
|
SystemAitSamplingValue, // s: ULONG (requires SeProfileSingleProcessPrivilege)
|
|
SystemVhdBootInformation, // q: SYSTEM_VHD_BOOT_INFORMATION
|
|
SystemCpuQuotaInformation, // q; s // PsQueryCpuQuotaInformation
|
|
SystemNativeBasicInformation, // not implemented
|
|
SystemSpare1, // not implemented
|
|
SystemLowPriorityIoInformation, // q: SYSTEM_LOW_PRIORITY_IO_INFORMATION
|
|
SystemTpmBootEntropyInformation, // q: TPM_BOOT_ENTROPY_NT_RESULT // ExQueryTpmBootEntropyInformation
|
|
SystemVerifierCountersInformation, // q: SYSTEM_VERIFIER_COUNTERS_INFORMATION
|
|
SystemPagedPoolInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypePagedPool)
|
|
SystemSystemPtesInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemPtes) // 120
|
|
SystemNodeDistanceInformation, // q
|
|
SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26
|
|
SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation
|
|
SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1
|
|
SystemSessionBigPoolInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION // since WIN8
|
|
SystemBootGraphicsInformation, // q; s: SYSTEM_BOOT_GRAPHICS_INFORMATION (kernel-mode only)
|
|
SystemScrubPhysicalMemoryInformation, // q; s: MEMORY_SCRUB_INFORMATION
|
|
SystemBadPageInformation,
|
|
SystemProcessorProfileControlArea, // q; s: SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA
|
|
SystemCombinePhysicalMemoryInformation, // s: MEMORY_COMBINE_INFORMATION, MEMORY_COMBINE_INFORMATION_EX, MEMORY_COMBINE_INFORMATION_EX2 // 130
|
|
SystemEntropyInterruptTimingCallback,
|
|
SystemConsoleInformation, // q: SYSTEM_CONSOLE_INFORMATION
|
|
SystemPlatformBinaryInformation, // q: SYSTEM_PLATFORM_BINARY_INFORMATION
|
|
SystemThrottleNotificationInformation,
|
|
SystemHypervisorProcessorCountInformation, // q: SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION
|
|
SystemDeviceDataInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION
|
|
SystemDeviceDataEnumerationInformation,
|
|
SystemMemoryTopologyInformation, // q: SYSTEM_MEMORY_TOPOLOGY_INFORMATION
|
|
SystemMemoryChannelInformation, // q: SYSTEM_MEMORY_CHANNEL_INFORMATION
|
|
SystemBootLogoInformation, // q: SYSTEM_BOOT_LOGO_INFORMATION // 140
|
|
SystemProcessorPerformanceInformationEx, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // since WINBLUE
|
|
SystemSpare0,
|
|
SystemSecureBootPolicyInformation, // q: SYSTEM_SECUREBOOT_POLICY_INFORMATION
|
|
SystemPageFileInformationEx, // q: SYSTEM_PAGEFILE_INFORMATION_EX
|
|
SystemSecureBootInformation, // q: SYSTEM_SECUREBOOT_INFORMATION
|
|
SystemEntropyInterruptTimingRawInformation,
|
|
SystemPortableWorkspaceEfiLauncherInformation, // q: SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION
|
|
SystemFullProcessInformation, // q: SYSTEM_PROCESS_INFORMATION with SYSTEM_PROCESS_INFORMATION_EXTENSION (requires admin)
|
|
SystemKernelDebuggerInformationEx, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX
|
|
SystemBootMetadataInformation, // 150
|
|
SystemSoftRebootInformation,
|
|
SystemElamCertificateInformation, // s: SYSTEM_ELAM_CERTIFICATE_INFORMATION
|
|
SystemOfflineDumpConfigInformation,
|
|
SystemProcessorFeaturesInformation, // q: SYSTEM_PROCESSOR_FEATURES_INFORMATION
|
|
SystemRegistryReconciliationInformation,
|
|
SystemEdidInformation,
|
|
SystemManufacturingInformation, // q: SYSTEM_MANUFACTURING_INFORMATION // since THRESHOLD
|
|
SystemEnergyEstimationConfigInformation, // q: SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION
|
|
SystemHypervisorDetailInformation, // q: SYSTEM_HYPERVISOR_DETAIL_INFORMATION
|
|
SystemProcessorCycleStatsInformation, // q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION // 160
|
|
SystemVmGenerationCountInformation,
|
|
SystemTrustedPlatformModuleInformation, // q: SYSTEM_TPM_INFORMATION
|
|
SystemKernelDebuggerFlags,
|
|
SystemCodeIntegrityPolicyInformation, // q: SYSTEM_CODEINTEGRITYPOLICY_INFORMATION
|
|
SystemIsolatedUserModeInformation, // q: SYSTEM_ISOLATED_USER_MODE_INFORMATION
|
|
SystemHardwareSecurityTestInterfaceResultsInformation,
|
|
SystemSingleModuleInformation, // q: SYSTEM_SINGLE_MODULE_INFORMATION
|
|
SystemAllowedCpuSetsInformation,
|
|
SystemDmaProtectionInformation, // q: SYSTEM_DMA_PROTECTION_INFORMATION
|
|
SystemInterruptCpuSetsInformation, // q: SYSTEM_INTERRUPT_CPU_SET_INFORMATION // 170
|
|
SystemSecureBootPolicyFullInformation, // q: SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION
|
|
SystemCodeIntegrityPolicyFullInformation,
|
|
SystemAffinitizedInterruptProcessorInformation,
|
|
SystemRootSiloInformation, // q: SYSTEM_ROOT_SILO_INFORMATION
|
|
SystemCpuSetInformation, // q: SYSTEM_CPU_SET_INFORMATION // since THRESHOLD2
|
|
SystemCpuSetTagInformation, // q: SYSTEM_CPU_SET_TAG_INFORMATION
|
|
SystemWin32WerStartCallout,
|
|
SystemSecureKernelProfileInformation, // q: SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION
|
|
SystemCodeIntegrityPlatformManifestInformation, // q: SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION // since REDSTONE
|
|
SystemInterruptSteeringInformation, // 180
|
|
SystemSupportedProcessorArchitectures,
|
|
SystemMemoryUsageInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION
|
|
SystemCodeIntegrityCertificateInformation, // q: SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION
|
|
SystemPhysicalMemoryInformation, // q: SYSTEM_PHYSICAL_MEMORY_INFORMATION // since REDSTONE2
|
|
SystemControlFlowTransition,
|
|
SystemKernelDebuggingAllowed,
|
|
SystemActivityModerationExeState, // SYSTEM_ACTIVITY_MODERATION_EXE_STATE
|
|
SystemActivityModerationUserSettings, // SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS
|
|
SystemCodeIntegrityPoliciesFullInformation,
|
|
SystemCodeIntegrityUnlockInformation, // SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION // 190
|
|
SystemIntegrityQuotaInformation,
|
|
SystemFlushInformation, // q: SYSTEM_FLUSH_INFORMATION
|
|
SystemProcessorIdleMaskInformation, // since REDSTONE3
|
|
SystemSecureDumpEncryptionInformation,
|
|
SystemWriteConstraintInformation, // SYSTEM_WRITE_CONSTRAINT_INFORMATION
|
|
MaxSystemInfoClass
|
|
} SYSTEM_INFORMATION_CLASS; |