📄 kernel.h
字号:
#define Sleep SC_Sleep
#undef THGrow
#define THGrow SC_THGrow
#undef SuspendThread
#define SuspendThread SC_ThreadSuspend
#undef SetHandleOwner
#define SetHandleOwner SC_SetHandleOwner
#define SetEvent(h) EventModify(h,EVENT_SET)
#define ResetEvent(h) EventModify(h,EVENT_RESET)
#define PulseEvent(h) EventModify(h, EVENT_PULSE)
#undef SetLastError
#define SetLastError(err) (pCurThread->dwLastError = err)
#undef GetLastError
#define GetLastError() (pCurThread->dwLastError)
#undef GetModuleFileName
#define GetModuleFileName DoGetModuleFileName
#undef LoadLibraryEx
#define LoadLibraryEx SC_LoadLibraryExW
#undef FreeLibrary
#define FreeLibrary SC_FreeLibrary
#undef LoadKernelLibrary
#define LoadKernelLibrary SC_LoadKernelLibrary
#undef NKTerminateThread
#define NKTerminateThread SC_NKTerminateThread
#undef PerformCallBack4
#define PerformCallBack4 SC_PerformCallBack4
#undef RegCloseKey
#define RegCloseKey NKRegCloseKey
#undef IsSystemFile
#define IsSystemFile SC_IsSystemFile
#undef CreateFileW
#define CreateFileW SC_CreateFileW
#undef ReadFile
#define ReadFile SC_ReadFile
#undef ReadFileWithSeek
#define ReadFileWithSeek SC_ReadFileWithSeek
#undef WriteFileWithSeek
#define WriteFileWithSeek SC_WriteFileWithSeek
#undef RegCreateKeyExW
#define RegCreateKeyExW NKRegCreateKeyExW
#undef RegOpenKeyExW
#define RegOpenKeyExW NKRegOpenKeyExW
#undef RegQueryValueExW
#define RegQueryValueExW NKRegQueryValueExW
#undef RegSetValueExW
#define RegSetValueExW NKRegSetValueExW
#undef CeOidGetInfoEx2
#define CeOidGetInfoEx2 PRIV_WIN32_FS_CALL(BOOL, 12, (PCEGUID pguid, CEOID oid, CEOIDINFOEX *oidInfo))
#undef FindFirstFileW
#define FindFirstFileW PRIV_WIN32_FS_CALL(HANDLE, 8, (LPCWSTR lpFileName, LPWIN32_FIND_DATAW lpFindFileData))
#undef GetFileInformationByHandle
#define GetFileInformationByHandle PRIV_WIN32_FILE_CALL(DWORD, 6, (HANDLE hFile, LPBY_HANDLE_FILE_INFORMATION lpFileInformation))
#undef FlushFileBuffers
#define FlushFileBuffers PRIV_WIN32_FILE_CALL(BOOL, 7, (HANDLE hFile))
#undef WriteFile
#define WriteFile PRIV_WIN32_FILE_CALL(BOOL, 3, (HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped))
#undef SetFilePointer
#define SetFilePointer PRIV_WIN32_FILE_CALL(DWORD, 5, (HANDLE hFile, LONG lDistanceToMove, PLONG lpDistanceToMoveHigh, DWORD dwMoveMethod))
#undef SetEndOfFile
#define SetEndOfFile PRIV_WIN32_FILE_CALL(BOOL, 10, (HANDLE hFile))
#undef GetFileSize
#define GetFileSize PRIV_WIN32_FILE_CALL(DWORD, 4, (HANDLE hFile, LPDWORD lpFileSizeHigh))
#endif // IN_KERNEL
/* Kernel zones */
extern DBGPARAM dpCurSettings;
#define ZONE_SCHEDULE DEBUGZONE(0) /* 0x0001 */
#define ZONE_MEMORY DEBUGZONE(1) /* 0x0002 */
#define ZONE_OBJDISP DEBUGZONE(2) /* 0x0004 */
#define ZONE_DEBUGGER DEBUGZONE(3) /* 0x0008 */
#define ZONE_NEXTTHREAD DEBUGZONE(4) /* 0x0010 */
#define ZONE_LOADER1 DEBUGZONE(5) /* 0x0020 */
#define ZONE_VIRTMEM DEBUGZONE(6) /* 0x0040 */
#define ZONE_LOADER2 (DEBUGZONE(7)&&!pCurThread->bDbgCnt) /* 0x0080 */
#define ZONE_DEBUG DEBUGZONE(8) /* 0x0100 */
#define ZONE_GETINFO DEBUGZONE(9) /* 0x0200 */
#define ZONE_PHYSMEM DEBUGZONE(10) /* 0x0400 */
#define ZONE_SEH (DEBUGZONE(11)&&!pCurThread->bDbgCnt) /* 0x0800 */
#define ZONE_OPENEXE DEBUGZONE(12) /* 0x1000 */
#define ZONE_MEMTRACKER DEBUGZONE(13) /* 0x2000 */
#define ZONE_PAGING DEBUGZONE(14) /* 0x4000 */
#define ZONE_ENTRY (DEBUGZONE(15)&&!pCurThread->bDbgCnt) /* 0x8000 */
#define ZONE_MAPFILE DEBUGZONE(16)
/* Kernel Debugger interfaces */
extern BOOL (*g_pKdInit)( /* interface left undeclared */ );
extern BOOL (*KDSanitize)(BYTE* pbClean, VOID* pvAddrMem, ULONG nSize, BOOL fAlwaysCopy);
extern BOOL ReadyForStrings;
/* HDSTUB Interfaces */
extern BOOL (*g_pHdInit) (struct _HDSTUB_INIT *);
extern ULONG (*HDException) (EXCEPTION_RECORD*, CONTEXT*, BOOLEAN);
extern void (*HDPageIn) (DWORD, BOOL);
extern void (*HDModLoad) (DWORD);
extern void (*HDModUnload) (DWORD);
// Assume that any debug break within pvHDNotifyExdi and (pvHDNotifyExdi + 20) is to be ignored.
#define HD_NOTIFY_MARGIN (20)
// Pointer to the os event notification debugbreak function in hd.dll
extern void *pvHDNotifyExdi;
extern ULONG g_ulHDEventFilter;
extern BOOL (*HDConnectClient) (BOOL (*)(struct _HDSTUB_DATA *, void *), void *);
/* OsAxs Interfaces */
extern BOOL (*g_pOsAxsT0Init) (struct _HDSTUB_DATA *, void *);
extern BOOL (*g_pOsAxsT1Init) (struct _HDSTUB_DATA *, void *);
BOOLEAN NKDispatchException(PTHREAD pth, PEXCEPTION_RECORD ExceptionRecord, PCONTEXT ContextRecord);
ULONG NKGetThreadCallStack (PTHREAD pth, ULONG dwMaxFrames, LPVOID lpFrames, DWORD dwFlags, DWORD dwSkip, PCONTEXT pCtx);
PVOID DbgVerify(PVOID pvAddr, BOOL fProbeOnly, BOOL* pfPageInFailed);
// macros to deal with stack reservation
extern const DWORD cbMDStkAlign; // How stack aligned, must be defined in MD code
#define STKMSK (cbMDStkAlign-1) // mask to get stack aligned
#define ALIGNSTK(x) (((x)+STKMSK)&~STKMSK) // minimum needed to keep stack aligned
// # of bytes needed for PRETLS block
#define SIZE_PRETLS ALIGNSTK(PRETLS_RESERVED * sizeof(DWORD))
//
// Useful
//
#define ARRAY_SIZE(x) (sizeof(x) / sizeof(x[0]))
#define LAST_ELEMENT(x) (&x[ARRAY_SIZE(x)-1])
#define CCHSIZEOF(sz) (sizeof(sz)/sizeof(TCHAR))
DWORD WireBuffer(LPBYTE buf, DWORD len);
#define UnWireBuffer(buf,len) (0)
#define PageFreeCount ((long)KInfoTable[KINX_PAGEFREE])
#define HOST_TRANSCFG_NUM_REGKEYS 8 // Number of keys to preload from the desktop
int rRegGet(DWORD hKey, CHAR *szName, LPDWORD lpdwType, LPBYTE lpbData, LPDWORD lpdwSize);
int rRegOpen(DWORD hKey, CHAR *szName, LPDWORD lphKey);
int rRegClose(DWORD hKey);
extern void OEMCacheRangeFlush (LPVOID pAddr, DWORD dwLength, DWORD dwFlags);
// DList - double linked list
//
// WARNING: The double list routine are NOT preemtion safe. The list must
// be protected with a critical section or the functions should be invoked
// via KCall().
typedef struct _DList DList;
struct _DList {
DList *fwd;
DList *back;
};
// Insert an item into a double linked list
void AddToDList(DList *head, DList *item);
// Remove an item from a double linked list
void RemoveDList(DList *item);
// REFINFO - reference info for Handle Data.
typedef struct FULLREF {
ushort usRefs[MAX_PROCESSES];
} FULLREF;
typedef union REFINFO {
ulong count;
FULLREF *pFr;
} REFINFO;
// HDATA - handle data structure
typedef struct _HDATA HDATA, *PHDATA;
struct _HDATA {
DList linkage; /* 00: links for active handle list */
HANDLE hValue; /* 08: Current value of handle (nonce) */
ACCESSLOCK lock; /* 0C: access information */
REFINFO ref; /* 10: reference information */
const CINFO *pci; /* 14: ptr to object class description structure */
PVOID pvObj; /* 18: ptr to object */
DWORD dwInfo; /* 1C: extra handle info */
}; /* 20: sizeof(HDATA) */
#define HANDLE_ADDRESS_MASK 0x1ffffffc
HANDLE AllocHandle(const CINFO *pci, PVOID pvObj, PPROCESS pprc);
BOOL FreeHandle(HANDLE h);
PHDATA HandleToPointer(HANDLE h);
#define PointerToHandle(phd) ((phd)->hValue)
int GetRef(HANDLE h, PPROCESS pprc);
// Returns FALSE if handle not valid or refcnt==0.
BOOL IncRef(HANDLE h, PPROCESS pprc);
// Returns TRUE if all references removed.
BOOL DecRef(HANDLE h, PPROCESS pprc, BOOL fAll);
// Returns 0 if handle is not valid.
DWORD GetUserInfo(HANDLE h);
// Returns FALSE if handle is not valid.
BOOL SetUserInfo(HANDLE h, DWORD info);
// Returns NULL if handle is not valid.
PVOID GetObjectPtr(HANDLE h);
// Returns NULL if handle is not valid or not correct type.
PVOID GetObjectPtrByType(HANDLE h, int type);
// Returns NULL if handle is not valid or not correct type or wrong permissions
PVOID GetObjectPtrByTypePermissioned(HANDLE h, int type);
// Returns FALSE if handle is not valid.
BOOL SetObjectPtr(HANDLE h, PVOID pvObj);
// Returns 0 if handle is not valid.
int GetHandleType(HANDLE h);
// Force a reschedule when KCall returns.
#define SetReschedule() (KCResched = 1)
extern DList HandleList; // in objdisp.c
// Call a function in non-preemtible kernel mode.
// Returns the return value from the function.
typedef int (*PKFN)();
int KCall(PKFN pfn, ...);
#ifndef COREDLL
#define INVALID_PRIO 256
#endif
#ifdef x86
#define NCRPTR(pStk,cbStk) ((NK_PCR*)((ulong)pStk + cbStk - sizeof(NK_PCR)))
#define TLSPTR(pStk,cbStk) (NCRPTR(pStk, cbStk)->tls)
#define INITIAL_SP(pStk, cbStk) ((LPBYTE) NCRPTR (pStk, cbStk))
#else
#define TLSPTR(pStk,cbStk) ((LPDWORD)((ulong)pStk + cbStk - (TLS_MINIMUM_AVAILABLE*4)))
#define INITIAL_SP(pStk, cbStk) ((LPBYTE) TLSPTR (pStk, cbStk) - SIZE_PRETLS)
#endif
typedef void (* PFN_LogPageIn) (ULONG uAddr, BOOL bWrite);
extern PFN_LogPageIn pfnNKLogPageIn;
#define HandleToThread(h) ((THREAD *)GetObjectPtrByType((h),SH_CURTHREAD))
#define HandleToThreadPerm(h) ((THREAD *)GetObjectPtrByTypePermissioned((h),SH_CURTHREAD))
#define HandleToProc(h) ((PROCESS *)GetObjectPtrByType((h),SH_CURPROC))
#define HandleToEvent(h) ((EVENT *)GetObjectPtrByType((h),HT_EVENT))
#define HandleToEventPerm(h) ((EVENT *)GetObjectPtrByTypePermissioned((h),HT_EVENT))
#define HandleToMutex(h) ((MUTEX *)GetObjectPtrByType((h),HT_MUTEX))
#define HandleToMutexPerm(h) ((MUTEX *)GetObjectPtrByTypePermissioned((h),HT_MUTEX))
#define HandleToMap(h) ((FSMAP *)GetObjectPtrByType((h),HT_FSMAP))
#define HandleToMapPerm(h) ((FSMAP *)GetObjectPtrByTypePermissioned((h),HT_FSMAP))
#define HandleToAPISet(h) ((APISET *)GetObjectPtrByType((h),HT_APISET))
#define HandleToAPISetPerm(h) ((APISET *)GetObjectPtrByTypePermissioned((h),HT_APISET))
#define HandleToSem(h) ((SEMAPHORE *)GetObjectPtrByType((h),HT_SEMAPHORE))
#define HandleToToKen(h) ((PTOKENINFO)GetObjectPtrByType((h), SH_CURTOKEN))
// Test if a value is a handle or a pointer.
// NOTE: NULL is considered to be a pointer.
#define IsHandle(v) (((int)(v) & 0x02) != 0)
// the real tick is dependent on whether variable tick scheduling is enabled.
extern void (*pOEMUpdateRescheduleTime) (DWORD dwTick);
#define GETCURRTICK() ((DWORD) (pOEMUpdateRescheduleTime? SC_GetTickCount () : CurMSec))
extern BOOL fDisableNoFault;
#define IsNoFaultSet() (!fDisableNoFault && (UTlsPtr()[TLSSLOT_KERNEL] & TLSKERN_NOFAULT))
#define IsNoFaultMsgSet() (!fDisableNoFault && ((UTlsPtr()[TLSSLOT_KERNEL] & (TLSKERN_NOFAULT | TLSKERN_NOFAULTMSG)) == (TLSKERN_NOFAULT | TLSKERN_NOFAULTMSG)))
#include "heap.h"
//
// Page Table Entry from OEMAddressTable
//
typedef struct {
DWORD dwVA;
DWORD dwPA;
DWORD dwSize;
} PTE, *PPTE;
#define MAX_KCALL_PROFILE 76
#define CELOG_KCALL_ID 75
#include "celognk.h"
#if defined(KCALL_PROFILE)
typedef struct KPRF_t {
DWORD hits;
DWORD max;
DWORD min;
DWORD total;
DWORD tmp;
} KPRF_t;
extern KPRF_t KPRFInfo[MAX_KCALL_PROFILE];
#ifdef NKPROF
extern DWORD g_dwProfilerFlags;
#endif
_inline void KCALLPROFON(int IND) {
LARGE_INTEGER liPerf;
#ifdef NKPROF
if (g_dwProfilerFlags & PROFILE_KCALL) {
#endif
DEBUGCHK(InSysCall());
DEBUGCHK(!KPRFInfo[IND].tmp);
DEBUGCHK(IND<MAX_KCALL_PROFILE);
SC_QueryPerformanceCounter(&liPerf);
KPRFInfo[IND].tmp = liPerf.LowPart;
#ifdef NKPROF
}
if (IsCeLogZoneEnabled(CELZONE_KCALL)) {
CELOG_KCallEnter(IND);
}
#endif
}
_inline void KCALLPROFOFF(int IND) {
LARGE_INTEGER liPerf;
DWORD t2;
#ifdef NKPROF
if (g_dwProfilerFlags & PROFILE_KCALL) {
#endif
DEBUGCHK(InSysCall());
DEBUGCHK(KPRFInfo[IND].tmp);
DEBUGCHK(IND<MAX_KCALL_PROFILE);
SC_QueryPerformanceCounter(&liPerf);
t2 = liPerf.LowPart - KPRFInfo[IND].tmp;
KPRFInfo[IND].tmp = 0;
if (t2 > KPRFInfo[IND].max)
KPRFInfo[IND].max = t2;
if (t2 && (!KPRFInfo[IND].min || (t2 < KPRFInfo[IND].min)))
KPRFInfo[IND].min = t2;
KPRFInfo[IND].total += t2;
KPRFInfo[IND].hits++;
#ifdef NKPROF
}
if (IsCeLogZoneEnabled(CELZONE_KCALL)) {
CELOG_KCallLeave(IND);
}
#endif
}
#else // defined(KCALL_PROFILE)
#define KCALLPROFON(IND) 0
#define KCALLPROFOFF(IND) 0
#endif // defined(KCALL_PROFILE)
#ifdef IN_KERNEL // if we are in the kernel
#ifndef SHIP_BUILD // if not SHIP_BUILD
#ifdef DEBUG // and is DEBUG
#ifdef DBGCHK // if this is already defined
#undef DBGCHK // then undef it
#endif // DBGCHK
#define DBGCHK(module,exp) \
((void)((exp)?1:( \
NKDbgPrintfW ( TEXT("%s: DEBUGCHK failed in file %s at line %d \r\n"), \
(LPWSTR)module, TEXT(__FILE__) ,__LINE__ ), \
((InDebugger)?1:(DebugBreak())), \
0 \
)))
#endif // DEBUG
#endif // SHIP_BUILD
#endif // IN_KERNEL
#endif
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -