-
Notifications
You must be signed in to change notification settings - Fork 12
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
50 changed files
with
1,194 additions
and
806 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,160 @@ | ||
| #ifndef HERMIT_CORE_NTDLL_H | ||
| #define HERMIT_CORE_NTDLL_H | ||
|
|
||
| #include <windows.h> | ||
|
|
||
| // **For NtSystemDebugControl** | ||
| typedef enum _SYSDBG_COMMAND | ||
| { | ||
| SysDbgQueryModuleInformation, | ||
| SysDbgQueryTraceInformation, | ||
| SysDbgSetTracepoint, | ||
| SysDbgSetSpecialCall, | ||
| SysDbgClearSpecialCalls, | ||
| SysDbgQuerySpecialCalls, | ||
| SysDbgBreakPoint, | ||
| SysDbgQueryVersion, | ||
| SysDbgReadVirtual, | ||
| SysDbgWriteVirtual, | ||
| SysDbgReadPhysical, | ||
| SysDbgWritePhysical, | ||
| SysDbgReadControlSpace, | ||
| SysDbgWriteControlSpace, | ||
| SysDbgReadIoSpace, | ||
| SysDbgWriteIoSpace, | ||
| SysDbgReadMsr, | ||
| SysDbgWriteMsr, | ||
| SysDbgReadBusData, | ||
| SysDbgWriteBusData, | ||
| SysDbgCheckLowMemory, | ||
| SysDbgEnableKernelDebugger, | ||
| SysDbgDisableKernelDebugger, | ||
| SysDbgGetAutoKdEnable, | ||
| SysDbgSetAutoKdEnable, | ||
| SysDbgGetPrintBufferSize, | ||
| SysDbgSetPrintBufferSize, | ||
| SysDbgGetKdUmExceptionEnable, | ||
| SysDbgSetKdUmExceptionEnable, | ||
| SysDbgGetTriageDump, | ||
| SysDbgGetKdBlockEnable, | ||
| SysDbgSetKdBlockEnable, | ||
| SysDbgRegisterForUmBreakInfo, | ||
| SysDbgGetUmBreakPid, | ||
| SysDbgClearUmBreakPid, | ||
| SysDbgGetUmAttachPid, | ||
| SysDbgClearUmAttachPid, | ||
| SysDbgGetLiveKernelDump | ||
| } SYSDBG_COMMAND, * PSYSDBG_COMMAND; | ||
|
|
||
| typedef union _SYSDBG_LIVEDUMP_CONTROL_FLAGS | ||
| { | ||
| struct | ||
| { | ||
| ULONG UseDumpStorageStack : 1; | ||
| ULONG CompressMemoryPagesData : 1; | ||
| ULONG IncludeUserSpaceMemoryPages : 1; | ||
| ULONG AbortIfMemoryPressure : 1; // REDSTONE4 | ||
| ULONG SelectiveDump : 1; // WIN11 | ||
| ULONG Reserved : 27; | ||
| }; | ||
| ULONG AsUlong; | ||
| } SYSDBG_LIVEDUMP_CONTROL_FLAGS, *PSYSDBG_LIVEDUMP_CONTROL_FLAGS; | ||
|
|
||
| typedef union _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES | ||
| { | ||
| struct | ||
| { | ||
| ULONG HypervisorPages : 1; | ||
| ULONG NonEssentialHypervisorPages : 1; // since WIN11 | ||
| ULONG Reserved : 30; | ||
| }; | ||
| ULONG AsUlong; | ||
| } SYSDBG_LIVEDUMP_CONTROL_ADDPAGES, *PSYSDBG_LIVEDUMP_CONTROL_ADDPAGES; | ||
|
|
||
| typedef struct _SYSDBG_LIVEDUMP_SELECTIVE_CONTROL | ||
| { | ||
| ULONG Version; | ||
| ULONG Size; | ||
| union | ||
| { | ||
| ULONGLONG Flags; | ||
| struct | ||
| { | ||
| ULONGLONG ThreadKernelStacks : 1; | ||
| ULONGLONG ReservedFlags : 63; | ||
| }; | ||
| }; | ||
| ULONGLONG Reserved[4]; | ||
| } SYSDBG_LIVEDUMP_SELECTIVE_CONTROL, *PSYSDBG_LIVEDUMP_SELECTIVE_CONTROL; | ||
|
|
||
| typedef struct _SYSDBG_LIVEDUMP_CONTROL | ||
| { | ||
| ULONG Version; | ||
| ULONG BugCheckCode; | ||
| ULONG_PTR BugCheckParam1; | ||
| ULONG_PTR BugCheckParam2; | ||
| ULONG_PTR BugCheckParam3; | ||
| ULONG_PTR BugCheckParam4; | ||
| HANDLE DumpFileHandle; | ||
| HANDLE CancelEventHandle; | ||
| SYSDBG_LIVEDUMP_CONTROL_FLAGS Flags; | ||
| SYSDBG_LIVEDUMP_CONTROL_ADDPAGES AddPagesControl; | ||
| PSYSDBG_LIVEDUMP_SELECTIVE_CONTROL SelectiveControl; // since WIN11 | ||
| } SYSDBG_LIVEDUMP_CONTROL, *PSYSDBG_LIVEDUMP_CONTROL; | ||
|
|
||
| // **For NtQueryKey** | ||
| typedef enum _KEY_INFORMATION_CLASS | ||
| { | ||
| KeyBasicInformation, | ||
| KeyNodeInformation, | ||
| KeyFullInformation, | ||
| KeyNameInformation, | ||
| KeyCachedInformation, | ||
| KeyFlagsInformation, | ||
| KeyVirtualizationInformation, | ||
| KeyHandleTagsInformation, | ||
| KeyTrustInformation, | ||
| KeyLayerInformation, | ||
| MaxKeyInfoClass | ||
| } KEY_INFORMATION_CLASS; | ||
|
|
||
| typedef struct _KEY_FULL_INFORMATION | ||
| { | ||
| LARGE_INTEGER LastWriteTime; | ||
| ULONG TitleIndex; | ||
| ULONG ClassOffset; | ||
| ULONG ClassLength; | ||
| ULONG SubKeys; | ||
| ULONG MaxNameLength; | ||
| ULONG MaxClassLength; | ||
| ULONG Values; | ||
| ULONG MaxValueNameLength; | ||
| ULONG MaxValueDataLength; | ||
| WCHAR Class[1]; | ||
| } KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION; | ||
|
|
||
| // **For NtEnumerateValueKey** | ||
| typedef enum _KEY_VALUE_INFORMATION_CLASS | ||
| { | ||
| KeyValueBasicInformation, | ||
| KeyValueFullInformation, | ||
| KeyValuePartialInformation, | ||
| KeyValueFullInformationAlign64, | ||
| KeyValuePartialInformationAlign64, | ||
| KeyValueLayerInformation, | ||
| MaxKeyValueInfoClass | ||
| } KEY_VALUE_INFORMATION_CLASS; | ||
|
|
||
| typedef struct _KEY_VALUE_FULL_INFORMATION | ||
| { | ||
| ULONG TitleIndex; | ||
| ULONG Type; | ||
| ULONG DataOffset; | ||
| ULONG DataLength; | ||
| ULONG NameLength; | ||
| _Field_size_bytes_(NameLength) WCHAR Name[1]; | ||
| // ... | ||
| // UCHAR Data[1]; | ||
| } KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION; | ||
|
|
||
| #endif // HERMIT_CORE_NTDLL_H |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.