nt_internals.h 27 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. // This file holds definitions related to the ntdll API.
  5. #ifndef SANDBOX_WIN_SRC_NT_INTERNALS_H__
  6. #define SANDBOX_WIN_SRC_NT_INTERNALS_H__
  7. #include <windows.h>
  8. #include <stddef.h>
  9. typedef LONG NTSTATUS;
  10. #define NT_SUCCESS(st) (st >= 0)
  11. #define NT_ERROR(st) ((((ULONG)(st)) >> 30) == 3)
  12. // clang-format off
  13. #define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
  14. #define STATUS_BUFFER_OVERFLOW ((NTSTATUS)0x80000005L)
  15. #define STATUS_UNSUCCESSFUL ((NTSTATUS)0xC0000001L)
  16. #define STATUS_NOT_IMPLEMENTED ((NTSTATUS)0xC0000002L)
  17. #define STATUS_INVALID_INFO_CLASS ((NTSTATUS)0xC0000003L)
  18. #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
  19. #ifndef STATUS_INVALID_PARAMETER
  20. // It is now defined in Windows 2008 SDK.
  21. #define STATUS_INVALID_PARAMETER ((NTSTATUS)0xC000000DL)
  22. #endif
  23. #define STATUS_CONFLICTING_ADDRESSES ((NTSTATUS)0xC0000018L)
  24. #define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)
  25. #define STATUS_BUFFER_TOO_SMALL ((NTSTATUS)0xC0000023L)
  26. #define STATUS_OBJECT_NAME_NOT_FOUND ((NTSTATUS)0xC0000034L)
  27. #define STATUS_OBJECT_NAME_COLLISION ((NTSTATUS)0xC0000035L)
  28. #define STATUS_PROCEDURE_NOT_FOUND ((NTSTATUS)0xC000007AL)
  29. #define STATUS_INVALID_IMAGE_FORMAT ((NTSTATUS)0xC000007BL)
  30. #define STATUS_NO_TOKEN ((NTSTATUS)0xC000007CL)
  31. #define STATUS_NOT_SUPPORTED ((NTSTATUS)0xC00000BBL)
  32. #define STATUS_INVALID_IMAGE_HASH ((NTSTATUS)0xC0000428L)
  33. // clang-format on
  34. #define CURRENT_PROCESS ((HANDLE)-1)
  35. #define CURRENT_THREAD ((HANDLE)-2)
  36. #define NtCurrentProcess CURRENT_PROCESS
  37. typedef struct _UNICODE_STRING {
  38. USHORT Length;
  39. USHORT MaximumLength;
  40. PWSTR Buffer;
  41. } UNICODE_STRING;
  42. typedef UNICODE_STRING* PUNICODE_STRING;
  43. typedef const UNICODE_STRING* PCUNICODE_STRING;
  44. typedef struct _STRING {
  45. USHORT Length;
  46. USHORT MaximumLength;
  47. PCHAR Buffer;
  48. } STRING;
  49. typedef STRING* PSTRING;
  50. typedef STRING ANSI_STRING;
  51. typedef PSTRING PANSI_STRING;
  52. typedef CONST PSTRING PCANSI_STRING;
  53. typedef STRING OEM_STRING;
  54. typedef PSTRING POEM_STRING;
  55. typedef CONST STRING* PCOEM_STRING;
  56. #define OBJ_CASE_INSENSITIVE 0x00000040L
  57. #define OBJ_OPENIF 0x00000080L
  58. typedef struct _OBJECT_ATTRIBUTES {
  59. ULONG Length;
  60. HANDLE RootDirectory;
  61. PUNICODE_STRING ObjectName;
  62. ULONG Attributes;
  63. PVOID SecurityDescriptor;
  64. PVOID SecurityQualityOfService;
  65. } OBJECT_ATTRIBUTES;
  66. typedef OBJECT_ATTRIBUTES* POBJECT_ATTRIBUTES;
  67. #define InitializeObjectAttributes(p, n, a, r, s) \
  68. { \
  69. (p)->Length = sizeof(OBJECT_ATTRIBUTES); \
  70. (p)->RootDirectory = r; \
  71. (p)->Attributes = a; \
  72. (p)->ObjectName = n; \
  73. (p)->SecurityDescriptor = s; \
  74. (p)->SecurityQualityOfService = nullptr; \
  75. }
  76. typedef struct _IO_STATUS_BLOCK {
  77. union {
  78. NTSTATUS Status;
  79. PVOID Pointer;
  80. };
  81. ULONG_PTR Information;
  82. } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
  83. // -----------------------------------------------------------------------
  84. // File IO
  85. // Create disposition values.
  86. #define FILE_SUPERSEDE 0x00000000
  87. #define FILE_OPEN 0x00000001
  88. #define FILE_CREATE 0x00000002
  89. #define FILE_OPEN_IF 0x00000003
  90. #define FILE_OVERWRITE 0x00000004
  91. #define FILE_OVERWRITE_IF 0x00000005
  92. #define FILE_MAXIMUM_DISPOSITION 0x00000005
  93. // Create/open option flags.
  94. #define FILE_DIRECTORY_FILE 0x00000001
  95. #define FILE_WRITE_THROUGH 0x00000002
  96. #define FILE_SEQUENTIAL_ONLY 0x00000004
  97. #define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008
  98. #define FILE_SYNCHRONOUS_IO_ALERT 0x00000010
  99. #define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
  100. #define FILE_NON_DIRECTORY_FILE 0x00000040
  101. #define FILE_CREATE_TREE_CONNECTION 0x00000080
  102. #define FILE_COMPLETE_IF_OPLOCKED 0x00000100
  103. #define FILE_NO_EA_KNOWLEDGE 0x00000200
  104. #define FILE_OPEN_REMOTE_INSTANCE 0x00000400
  105. #define FILE_RANDOM_ACCESS 0x00000800
  106. #define FILE_DELETE_ON_CLOSE 0x00001000
  107. #define FILE_OPEN_BY_FILE_ID 0x00002000
  108. #define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000
  109. #define FILE_NO_COMPRESSION 0x00008000
  110. #define FILE_RESERVE_OPFILTER 0x00100000
  111. #define FILE_OPEN_REPARSE_POINT 0x00200000
  112. #define FILE_OPEN_NO_RECALL 0x00400000
  113. #define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000
  114. // Create/open result values. These are the disposition values returned on the
  115. // io status information.
  116. #define FILE_SUPERSEDED 0x00000000
  117. #define FILE_OPENED 0x00000001
  118. #define FILE_CREATED 0x00000002
  119. #define FILE_OVERWRITTEN 0x00000003
  120. #define FILE_EXISTS 0x00000004
  121. #define FILE_DOES_NOT_EXIST 0x00000005
  122. typedef NTSTATUS(WINAPI* NtCreateFileFunction)(
  123. OUT PHANDLE FileHandle,
  124. IN ACCESS_MASK DesiredAccess,
  125. IN POBJECT_ATTRIBUTES ObjectAttributes,
  126. OUT PIO_STATUS_BLOCK IoStatusBlock,
  127. IN PLARGE_INTEGER AllocationSize OPTIONAL,
  128. IN ULONG FileAttributes,
  129. IN ULONG ShareAccess,
  130. IN ULONG CreateDisposition,
  131. IN ULONG CreateOptions,
  132. IN PVOID EaBuffer OPTIONAL,
  133. IN ULONG EaLength);
  134. typedef NTSTATUS(WINAPI* NtOpenFileFunction)(OUT PHANDLE FileHandle,
  135. IN ACCESS_MASK DesiredAccess,
  136. IN POBJECT_ATTRIBUTES
  137. ObjectAttributes,
  138. OUT PIO_STATUS_BLOCK IoStatusBlock,
  139. IN ULONG ShareAccess,
  140. IN ULONG OpenOptions);
  141. typedef NTSTATUS(WINAPI* NtCloseFunction)(IN HANDLE Handle);
  142. typedef enum _FILE_INFORMATION_CLASS {
  143. FileRenameInformation = 10
  144. } FILE_INFORMATION_CLASS,
  145. *PFILE_INFORMATION_CLASS;
  146. typedef struct _FILE_RENAME_INFORMATION {
  147. BOOLEAN ReplaceIfExists;
  148. HANDLE RootDirectory;
  149. ULONG FileNameLength;
  150. WCHAR FileName[1];
  151. } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
  152. typedef NTSTATUS(WINAPI* NtSetInformationFileFunction)(
  153. IN HANDLE FileHandle,
  154. OUT PIO_STATUS_BLOCK IoStatusBlock,
  155. IN PVOID FileInformation,
  156. IN ULONG Length,
  157. IN FILE_INFORMATION_CLASS FileInformationClass);
  158. typedef struct FILE_BASIC_INFORMATION {
  159. LARGE_INTEGER CreationTime;
  160. LARGE_INTEGER LastAccessTime;
  161. LARGE_INTEGER LastWriteTime;
  162. LARGE_INTEGER ChangeTime;
  163. ULONG FileAttributes;
  164. } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
  165. typedef NTSTATUS(WINAPI* NtQueryAttributesFileFunction)(
  166. IN POBJECT_ATTRIBUTES ObjectAttributes,
  167. OUT PFILE_BASIC_INFORMATION FileAttributes);
  168. typedef struct _FILE_NETWORK_OPEN_INFORMATION {
  169. LARGE_INTEGER CreationTime;
  170. LARGE_INTEGER LastAccessTime;
  171. LARGE_INTEGER LastWriteTime;
  172. LARGE_INTEGER ChangeTime;
  173. LARGE_INTEGER AllocationSize;
  174. LARGE_INTEGER EndOfFile;
  175. ULONG FileAttributes;
  176. } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
  177. typedef NTSTATUS(WINAPI* NtQueryFullAttributesFileFunction)(
  178. IN POBJECT_ATTRIBUTES ObjectAttributes,
  179. OUT PFILE_NETWORK_OPEN_INFORMATION FileAttributes);
  180. // -----------------------------------------------------------------------
  181. // Sections
  182. typedef NTSTATUS(WINAPI* NtCreateSectionFunction)(
  183. OUT PHANDLE SectionHandle,
  184. IN ACCESS_MASK DesiredAccess,
  185. IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
  186. IN PLARGE_INTEGER MaximumSize OPTIONAL,
  187. IN ULONG SectionPageProtection,
  188. IN ULONG AllocationAttributes,
  189. IN HANDLE FileHandle OPTIONAL);
  190. typedef ULONG SECTION_INHERIT;
  191. #define ViewShare 1
  192. #define ViewUnmap 2
  193. typedef NTSTATUS(WINAPI* NtMapViewOfSectionFunction)(
  194. IN HANDLE SectionHandle,
  195. IN HANDLE ProcessHandle,
  196. IN OUT PVOID* BaseAddress,
  197. IN ULONG_PTR ZeroBits,
  198. IN SIZE_T CommitSize,
  199. IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,
  200. IN OUT PSIZE_T ViewSize,
  201. IN SECTION_INHERIT InheritDisposition,
  202. IN ULONG AllocationType,
  203. IN ULONG Win32Protect);
  204. typedef NTSTATUS(WINAPI* NtUnmapViewOfSectionFunction)(IN HANDLE ProcessHandle,
  205. IN PVOID BaseAddress);
  206. typedef enum _SECTION_INFORMATION_CLASS {
  207. SectionBasicInformation = 0,
  208. SectionImageInformation
  209. } SECTION_INFORMATION_CLASS;
  210. typedef struct _SECTION_BASIC_INFORMATION {
  211. PVOID BaseAddress;
  212. ULONG Attributes;
  213. LARGE_INTEGER Size;
  214. } SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;
  215. typedef NTSTATUS(WINAPI* NtQuerySectionFunction)(
  216. IN HANDLE SectionHandle,
  217. IN SECTION_INFORMATION_CLASS SectionInformationClass,
  218. OUT PVOID SectionInformation,
  219. IN SIZE_T SectionInformationLength,
  220. OUT PSIZE_T ReturnLength OPTIONAL);
  221. // -----------------------------------------------------------------------
  222. // Process and Thread
  223. typedef struct _CLIENT_ID {
  224. PVOID UniqueProcess;
  225. PVOID UniqueThread;
  226. } CLIENT_ID, *PCLIENT_ID;
  227. typedef NTSTATUS(WINAPI* NtOpenThreadFunction)(OUT PHANDLE ThreadHandle,
  228. IN ACCESS_MASK DesiredAccess,
  229. IN POBJECT_ATTRIBUTES
  230. ObjectAttributes,
  231. IN PCLIENT_ID ClientId);
  232. typedef NTSTATUS(WINAPI* NtOpenProcessFunction)(OUT PHANDLE ProcessHandle,
  233. IN ACCESS_MASK DesiredAccess,
  234. IN POBJECT_ATTRIBUTES
  235. ObjectAttributes,
  236. IN PCLIENT_ID ClientId);
  237. typedef enum _NT_THREAD_INFORMATION_CLASS {
  238. ThreadBasicInformation,
  239. ThreadTimes,
  240. ThreadPriority,
  241. ThreadBasePriority,
  242. ThreadAffinityMask,
  243. ThreadImpersonationToken,
  244. ThreadDescriptorTableEntry,
  245. ThreadEnableAlignmentFaultFixup,
  246. ThreadEventPair,
  247. ThreadQuerySetWin32StartAddress,
  248. ThreadZeroTlsCell,
  249. ThreadPerformanceCount,
  250. ThreadAmILastThread,
  251. ThreadIdealProcessor,
  252. ThreadPriorityBoost,
  253. ThreadSetTlsArrayAddress,
  254. ThreadIsIoPending,
  255. ThreadHideFromDebugger
  256. } NT_THREAD_INFORMATION_CLASS,
  257. *PNT_THREAD_INFORMATION_CLASS;
  258. typedef NTSTATUS(WINAPI* NtSetInformationThreadFunction)(
  259. IN HANDLE ThreadHandle,
  260. IN NT_THREAD_INFORMATION_CLASS ThreadInformationClass,
  261. IN PVOID ThreadInformation,
  262. IN ULONG ThreadInformationLength);
  263. // Partial definition only:
  264. typedef enum _PROCESSINFOCLASS {
  265. ProcessBasicInformation = 0,
  266. ProcessExecuteFlags = 0x22,
  267. ProcessHandleTable = 0x3A
  268. } PROCESSINFOCLASS;
  269. // For the structure documentation, see
  270. // https://msdn.microsoft.com/en-us/library/windows/desktop/aa813741(v=vs.85).aspx
  271. typedef struct _RTL_USER_PROCESS_PARAMETERS {
  272. BYTE Reserved1[16];
  273. PVOID Reserved2[10];
  274. UNICODE_STRING ImagePathName;
  275. UNICODE_STRING CommandLine;
  276. } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
  277. // Partial definition only, from
  278. // https://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx
  279. typedef struct _PEB {
  280. BYTE InheritedAddressSpace;
  281. BYTE ReadImageFileExecOptions;
  282. BYTE BeingDebugged;
  283. BYTE SpareBool;
  284. PVOID Mutant;
  285. PVOID ImageBaseAddress;
  286. PVOID Ldr;
  287. PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
  288. } PEB, *PPEB;
  289. typedef LONG KPRIORITY;
  290. typedef struct _PROCESS_BASIC_INFORMATION {
  291. union {
  292. NTSTATUS ExitStatus;
  293. PVOID padding_for_x64_0;
  294. };
  295. PPEB PebBaseAddress;
  296. KAFFINITY AffinityMask;
  297. union {
  298. KPRIORITY BasePriority;
  299. PVOID padding_for_x64_1;
  300. };
  301. union {
  302. DWORD UniqueProcessId;
  303. PVOID padding_for_x64_2;
  304. };
  305. union {
  306. DWORD InheritedFromUniqueProcessId;
  307. PVOID padding_for_x64_3;
  308. };
  309. } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
  310. typedef NTSTATUS(WINAPI* NtQueryInformationProcessFunction)(
  311. IN HANDLE ProcessHandle,
  312. IN PROCESSINFOCLASS ProcessInformationClass,
  313. OUT PVOID ProcessInformation,
  314. IN ULONG ProcessInformationLength,
  315. OUT PULONG ReturnLength OPTIONAL);
  316. typedef NTSTATUS(WINAPI* NtSetInformationProcessFunction)(
  317. HANDLE ProcessHandle,
  318. IN PROCESSINFOCLASS ProcessInformationClass,
  319. IN PVOID ProcessInformation,
  320. IN ULONG ProcessInformationLength);
  321. typedef NTSTATUS(WINAPI* NtOpenThreadTokenFunction)(IN HANDLE ThreadHandle,
  322. IN ACCESS_MASK
  323. DesiredAccess,
  324. IN BOOLEAN OpenAsSelf,
  325. OUT PHANDLE TokenHandle);
  326. typedef NTSTATUS(WINAPI* NtOpenThreadTokenExFunction)(IN HANDLE ThreadHandle,
  327. IN ACCESS_MASK
  328. DesiredAccess,
  329. IN BOOLEAN OpenAsSelf,
  330. IN ULONG HandleAttributes,
  331. OUT PHANDLE TokenHandle);
  332. typedef NTSTATUS(WINAPI* NtOpenProcessTokenFunction)(IN HANDLE ProcessHandle,
  333. IN ACCESS_MASK
  334. DesiredAccess,
  335. OUT PHANDLE TokenHandle);
  336. typedef NTSTATUS(WINAPI* NtOpenProcessTokenExFunction)(
  337. IN HANDLE ProcessHandle,
  338. IN ACCESS_MASK DesiredAccess,
  339. IN ULONG HandleAttributes,
  340. OUT PHANDLE TokenHandle);
  341. typedef NTSTATUS(WINAPI* NtQueryInformationTokenFunction)(
  342. IN HANDLE TokenHandle,
  343. IN TOKEN_INFORMATION_CLASS TokenInformationClass,
  344. OUT PVOID TokenInformation,
  345. IN ULONG TokenInformationLength,
  346. OUT PULONG ReturnLength);
  347. typedef NTSTATUS(WINAPI* RtlCreateUserThreadFunction)(
  348. IN HANDLE Process,
  349. IN PSECURITY_DESCRIPTOR ThreadSecurityDescriptor,
  350. IN BOOLEAN CreateSuspended,
  351. IN ULONG ZeroBits,
  352. IN SIZE_T MaximumStackSize,
  353. IN SIZE_T CommittedStackSize,
  354. IN LPTHREAD_START_ROUTINE StartAddress,
  355. IN PVOID Parameter,
  356. OUT PHANDLE Thread,
  357. OUT PCLIENT_ID ClientId);
  358. typedef NTSTATUS(WINAPI* RtlConvertSidToUnicodeStringFunction)(
  359. OUT PUNICODE_STRING UnicodeString,
  360. IN PSID Sid,
  361. IN BOOLEAN AllocateDestinationString);
  362. typedef VOID(WINAPI* RtlFreeUnicodeStringFunction)(
  363. IN OUT PUNICODE_STRING UnicodeString);
  364. // -----------------------------------------------------------------------
  365. // Registry
  366. typedef enum _KEY_INFORMATION_CLASS {
  367. KeyBasicInformation = 0,
  368. KeyFullInformation = 2
  369. } KEY_INFORMATION_CLASS,
  370. *PKEY_INFORMATION_CLASS;
  371. typedef struct _KEY_BASIC_INFORMATION {
  372. LARGE_INTEGER LastWriteTime;
  373. ULONG TitleIndex;
  374. ULONG NameLength;
  375. WCHAR Name[1];
  376. } KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;
  377. typedef struct _KEY_FULL_INFORMATION {
  378. LARGE_INTEGER LastWriteTime;
  379. ULONG TitleIndex;
  380. ULONG ClassOffset;
  381. ULONG ClassLength;
  382. ULONG SubKeys;
  383. ULONG MaxNameLen;
  384. ULONG MaxClassLen;
  385. ULONG Values;
  386. ULONG MaxValueNameLen;
  387. ULONG MaxValueDataLen;
  388. WCHAR Class[1];
  389. } KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION;
  390. typedef enum _KEY_VALUE_INFORMATION_CLASS {
  391. KeyValueFullInformation = 1
  392. } KEY_VALUE_INFORMATION_CLASS,
  393. *PKEY_VALUE_INFORMATION_CLASS;
  394. typedef struct _KEY_VALUE_FULL_INFORMATION {
  395. ULONG TitleIndex;
  396. ULONG Type;
  397. ULONG DataOffset;
  398. ULONG DataLength;
  399. ULONG NameLength;
  400. WCHAR Name[1];
  401. } KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;
  402. typedef NTSTATUS(WINAPI* NtCreateKeyFunction)(OUT PHANDLE KeyHandle,
  403. IN ACCESS_MASK DesiredAccess,
  404. IN POBJECT_ATTRIBUTES
  405. ObjectAttributes,
  406. IN ULONG TitleIndex,
  407. IN PUNICODE_STRING Class OPTIONAL,
  408. IN ULONG CreateOptions,
  409. OUT PULONG Disposition OPTIONAL);
  410. typedef NTSTATUS(WINAPI* NtOpenKeyFunction)(OUT PHANDLE KeyHandle,
  411. IN ACCESS_MASK DesiredAccess,
  412. IN POBJECT_ATTRIBUTES
  413. ObjectAttributes);
  414. typedef NTSTATUS(WINAPI* NtOpenKeyExFunction)(OUT PHANDLE KeyHandle,
  415. IN ACCESS_MASK DesiredAccess,
  416. IN POBJECT_ATTRIBUTES
  417. ObjectAttributes,
  418. IN DWORD open_options);
  419. typedef NTSTATUS(WINAPI* NtDeleteKeyFunction)(IN HANDLE KeyHandle);
  420. typedef NTSTATUS(WINAPI* RtlFormatCurrentUserKeyPathFunction)(
  421. OUT PUNICODE_STRING RegistryPath);
  422. typedef NTSTATUS(WINAPI* NtQueryKeyFunction)(IN HANDLE KeyHandle,
  423. IN KEY_INFORMATION_CLASS
  424. KeyInformationClass,
  425. OUT PVOID KeyInformation,
  426. IN ULONG Length,
  427. OUT PULONG ResultLength);
  428. typedef NTSTATUS(WINAPI* NtEnumerateKeyFunction)(IN HANDLE KeyHandle,
  429. IN ULONG Index,
  430. IN KEY_INFORMATION_CLASS
  431. KeyInformationClass,
  432. OUT PVOID KeyInformation,
  433. IN ULONG Length,
  434. OUT PULONG ResultLength);
  435. typedef NTSTATUS(WINAPI* NtQueryValueKeyFunction)(IN HANDLE KeyHandle,
  436. IN PUNICODE_STRING ValueName,
  437. IN KEY_VALUE_INFORMATION_CLASS
  438. KeyValueInformationClass,
  439. OUT PVOID KeyValueInformation,
  440. IN ULONG Length,
  441. OUT PULONG ResultLength);
  442. typedef NTSTATUS(WINAPI* NtSetValueKeyFunction)(IN HANDLE KeyHandle,
  443. IN PUNICODE_STRING ValueName,
  444. IN ULONG TitleIndex OPTIONAL,
  445. IN ULONG Type,
  446. IN PVOID Data,
  447. IN ULONG DataSize);
  448. // -----------------------------------------------------------------------
  449. // Memory
  450. // Don't really need this structure right now.
  451. typedef PVOID PRTL_HEAP_PARAMETERS;
  452. typedef PVOID(WINAPI* RtlCreateHeapFunction)(IN ULONG Flags,
  453. IN PVOID HeapBase OPTIONAL,
  454. IN SIZE_T ReserveSize OPTIONAL,
  455. IN SIZE_T CommitSize OPTIONAL,
  456. IN PVOID Lock OPTIONAL,
  457. IN PRTL_HEAP_PARAMETERS Parameters
  458. OPTIONAL);
  459. typedef PVOID(WINAPI* RtlDestroyHeapFunction)(IN PVOID HeapHandle);
  460. typedef PVOID(WINAPI* RtlAllocateHeapFunction)(IN PVOID HeapHandle,
  461. IN ULONG Flags,
  462. IN SIZE_T Size);
  463. typedef BOOLEAN(WINAPI* RtlFreeHeapFunction)(IN PVOID HeapHandle,
  464. IN ULONG Flags,
  465. IN PVOID HeapBase);
  466. typedef NTSTATUS(WINAPI* NtAllocateVirtualMemoryFunction)(
  467. IN HANDLE ProcessHandle,
  468. IN OUT PVOID* BaseAddress,
  469. IN ULONG_PTR ZeroBits,
  470. IN OUT PSIZE_T RegionSize,
  471. IN ULONG AllocationType,
  472. IN ULONG Protect);
  473. typedef NTSTATUS(WINAPI* NtFreeVirtualMemoryFunction)(IN HANDLE ProcessHandle,
  474. IN OUT PVOID* BaseAddress,
  475. IN OUT PSIZE_T RegionSize,
  476. IN ULONG FreeType);
  477. typedef enum _MEMORY_INFORMATION_CLASS {
  478. MemoryBasicInformation = 0,
  479. MemoryWorkingSetList,
  480. MemorySectionName,
  481. MemoryBasicVlmInformation
  482. } MEMORY_INFORMATION_CLASS;
  483. typedef struct _MEMORY_SECTION_NAME { // Information Class 2
  484. UNICODE_STRING SectionFileName;
  485. } MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;
  486. typedef NTSTATUS(WINAPI* NtQueryVirtualMemoryFunction)(
  487. IN HANDLE ProcessHandle,
  488. IN PVOID BaseAddress,
  489. IN MEMORY_INFORMATION_CLASS MemoryInformationClass,
  490. OUT PVOID MemoryInformation,
  491. IN SIZE_T MemoryInformationLength,
  492. OUT PSIZE_T ReturnLength OPTIONAL);
  493. typedef NTSTATUS(WINAPI* NtProtectVirtualMemoryFunction)(
  494. IN HANDLE ProcessHandle,
  495. IN OUT PVOID* BaseAddress,
  496. IN OUT PSIZE_T ProtectSize,
  497. IN ULONG NewProtect,
  498. OUT PULONG OldProtect);
  499. // -----------------------------------------------------------------------
  500. // Objects
  501. typedef enum _OBJECT_INFORMATION_CLASS {
  502. ObjectBasicInformation,
  503. ObjectNameInformation,
  504. ObjectTypeInformation,
  505. ObjectAllInformation,
  506. ObjectDataInformation
  507. } OBJECT_INFORMATION_CLASS,
  508. *POBJECT_INFORMATION_CLASS;
  509. typedef struct _OBJDIR_INFORMATION {
  510. UNICODE_STRING ObjectName;
  511. UNICODE_STRING ObjectTypeName;
  512. BYTE Data[1];
  513. } OBJDIR_INFORMATION;
  514. typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION {
  515. ULONG Attributes;
  516. ACCESS_MASK GrantedAccess;
  517. ULONG HandleCount;
  518. ULONG PointerCount;
  519. ULONG Reserved[10]; // reserved for internal use
  520. } PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION;
  521. typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION {
  522. UNICODE_STRING TypeName;
  523. ULONG Reserved[22]; // reserved for internal use
  524. } PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION;
  525. typedef enum _POOL_TYPE {
  526. NonPagedPool,
  527. PagedPool,
  528. NonPagedPoolMustSucceed,
  529. ReservedType,
  530. NonPagedPoolCacheAligned,
  531. PagedPoolCacheAligned,
  532. NonPagedPoolCacheAlignedMustS
  533. } POOL_TYPE;
  534. typedef struct _OBJECT_BASIC_INFORMATION {
  535. ULONG Attributes;
  536. ACCESS_MASK GrantedAccess;
  537. ULONG HandleCount;
  538. ULONG PointerCount;
  539. ULONG PagedPoolUsage;
  540. ULONG NonPagedPoolUsage;
  541. ULONG Reserved[3];
  542. ULONG NameInformationLength;
  543. ULONG TypeInformationLength;
  544. ULONG SecurityDescriptorLength;
  545. LARGE_INTEGER CreateTime;
  546. } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
  547. typedef struct _OBJECT_TYPE_INFORMATION {
  548. UNICODE_STRING Name;
  549. ULONG TotalNumberOfObjects;
  550. ULONG TotalNumberOfHandles;
  551. ULONG TotalPagedPoolUsage;
  552. ULONG TotalNonPagedPoolUsage;
  553. ULONG TotalNamePoolUsage;
  554. ULONG TotalHandleTableUsage;
  555. ULONG HighWaterNumberOfObjects;
  556. ULONG HighWaterNumberOfHandles;
  557. ULONG HighWaterPagedPoolUsage;
  558. ULONG HighWaterNonPagedPoolUsage;
  559. ULONG HighWaterNamePoolUsage;
  560. ULONG HighWaterHandleTableUsage;
  561. ULONG InvalidAttributes;
  562. GENERIC_MAPPING GenericMapping;
  563. ULONG ValidAccess;
  564. BOOLEAN SecurityRequired;
  565. BOOLEAN MaintainHandleCount;
  566. USHORT MaintainTypeList;
  567. POOL_TYPE PoolType;
  568. ULONG PagedPoolUsage;
  569. ULONG NonPagedPoolUsage;
  570. } OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
  571. typedef enum _SYSTEM_INFORMATION_CLASS {
  572. SystemHandleInformation = 16
  573. } SYSTEM_INFORMATION_CLASS;
  574. typedef struct _SYSTEM_HANDLE_INFORMATION {
  575. USHORT ProcessId;
  576. USHORT CreatorBackTraceIndex;
  577. UCHAR ObjectTypeNumber;
  578. UCHAR Flags;
  579. USHORT Handle;
  580. PVOID Object;
  581. ACCESS_MASK GrantedAccess;
  582. } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
  583. typedef struct _SYSTEM_HANDLE_INFORMATION_EX {
  584. ULONG NumberOfHandles;
  585. SYSTEM_HANDLE_INFORMATION Information[1];
  586. } SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;
  587. typedef struct _OBJECT_NAME_INFORMATION {
  588. UNICODE_STRING ObjectName;
  589. } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
  590. typedef NTSTATUS(WINAPI* NtQueryObjectFunction)(
  591. IN HANDLE Handle,
  592. IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
  593. OUT PVOID ObjectInformation OPTIONAL,
  594. IN ULONG ObjectInformationLength,
  595. OUT PULONG ReturnLength OPTIONAL);
  596. typedef NTSTATUS(WINAPI* NtDuplicateObjectFunction)(IN HANDLE SourceProcess,
  597. IN HANDLE SourceHandle,
  598. IN HANDLE TargetProcess,
  599. OUT PHANDLE TargetHandle,
  600. IN ACCESS_MASK
  601. DesiredAccess,
  602. IN ULONG Attributes,
  603. IN ULONG Options);
  604. typedef NTSTATUS(WINAPI* NtSignalAndWaitForSingleObjectFunction)(
  605. IN HANDLE HandleToSignal,
  606. IN HANDLE HandleToWait,
  607. IN BOOLEAN Alertable,
  608. IN PLARGE_INTEGER Timeout OPTIONAL);
  609. typedef NTSTATUS(WINAPI* NtWaitForSingleObjectFunction)(
  610. IN HANDLE ObjectHandle,
  611. IN BOOLEAN Alertable,
  612. IN PLARGE_INTEGER TimeOut OPTIONAL);
  613. typedef NTSTATUS(WINAPI* NtQuerySystemInformation)(
  614. IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  615. OUT PVOID SystemInformation,
  616. IN ULONG SystemInformationLength,
  617. OUT PULONG ReturnLength);
  618. // -----------------------------------------------------------------------
  619. // Strings
  620. typedef int(__cdecl* _strnicmpFunction)(IN const char* _Str1,
  621. IN const char* _Str2,
  622. IN size_t _MaxCount);
  623. typedef size_t(__cdecl* strlenFunction)(IN const char* _Str);
  624. typedef size_t(__cdecl* wcslenFunction)(IN const wchar_t* _Str);
  625. typedef void*(__cdecl* memcpyFunction)(IN void* dest,
  626. IN const void* src,
  627. IN size_t count);
  628. typedef NTSTATUS(WINAPI* RtlAnsiStringToUnicodeStringFunction)(
  629. IN OUT PUNICODE_STRING DestinationString,
  630. IN PANSI_STRING SourceString,
  631. IN BOOLEAN AllocateDestinationString);
  632. typedef LONG(WINAPI* RtlCompareUnicodeStringFunction)(
  633. IN PCUNICODE_STRING String1,
  634. IN PCUNICODE_STRING String2,
  635. IN BOOLEAN CaseInSensitive);
  636. typedef VOID(WINAPI* RtlInitUnicodeStringFunction)(IN OUT PUNICODE_STRING
  637. DestinationString,
  638. IN PCWSTR SourceString);
  639. typedef ULONG(WINAPI* RtlNtStatusToDosErrorFunction)(NTSTATUS status);
  640. typedef NTSTATUS(WINAPI* NtSetInformationProcess)(IN HANDLE process_handle,
  641. IN ULONG info_class,
  642. IN PVOID process_information,
  643. IN ULONG information_length);
  644. struct PROCESS_ACCESS_TOKEN {
  645. HANDLE token;
  646. HANDLE thread;
  647. };
  648. const unsigned int NtProcessInformationAccessToken = 9;
  649. typedef NTSTATUS(WINAPI* RtlDeriveCapabilitySidsFromNameFunction)(
  650. PCUNICODE_STRING SourceString,
  651. PSID CapabilityGroupSid,
  652. PSID CapabilitySid);
  653. #endif // SANDBOX_WIN_SRC_NT_INTERNALS_H__