t-procmonctl.h

来自「剖析Windows系统服务调用机制相关及驱动编程模式」· C头文件 代码 · 共 40 行

#ifndef T_PROCMONCTRL_H
#define T_PROCMONCTRL_H

#define FILE_DEVICE_PROCMON  0x00008201
#define DEVICE_DRIVER_NAME   L"T-ProcMon"
#define SYS_DRIVER_NAME      "T-ProcMon"
#define SYS_DRIVER_FILE      "T-ProcMon.sys"
#define SYS_INIT_FILE        "T-ProcMon.ini"
#define Version				 L"v1.0"

#define PROCMON_MONITOR (ULONG) CTL_CODE(FILE_DEVICE_PROCMON,0x01,METHOD_BUFFERED,FILE_ANY_ACCESS)
#define PROCMON_HIDDEN  (ULONG) CTL_CODE(FILE_DEVICE_PROCMON,0x02,METHOD_BUFFERED,FILE_ANY_ACCESS)
#define PROCMON_HOOK    (ULONG) CTL_CODE(FILE_DEVICE_PROCMON,0x03,METHOD_BUFFERED,FILE_ANY_ACCESS)
#define PROCMON_UNHOOK  (ULONG) CTL_CODE(FILE_DEVICE_PROCMON,0x04,METHOD_BUFFERED,FILE_ANY_ACCESS)

typedef unsigned int    UINT;
typedef char            CHAR;
typedef char *          PCHAR;
typedef unsigned char * PUCHAR;
typedef PVOID           POBJECT;
typedef LONG            KPRIORITY;

typedef struct
{
	ULONG  Sequence;
	TCHAR  Message[0];
}MESSAGEU,*PMESSAGEU;

typedef struct
{
	TCHAR  Name[0];
}PROCNAMEU,*PPROCNAMEU;

#ifndef PAGE_SIZE
#define PAGE_SIZE   1024*4
#endif

#define MAX_MESSAGE (1024*64 - 16)

#endif