winkernel.h

进程获取工具。process hunter

	USHORT Size;
	ULONG  Base;
} TIdt;

typedef struct _EX_PUSH_LOCK 
{
	union
	{
		struct
		{
			ULONG Waiting   :0x01;
			ULONG Exclusive :0x01;
			ULONG Shared    :0x1E;
		};

		ULONG Value;
		PVOID Ptr;
	};
} EX_PUSH_LOCK, *PEX_PUSH_LOCK;

typedef struct _HANDLE_TRACE_DB_ENTRY 
{
	CLIENT_ID ClientId;
	HANDLE    Handle;
	ULONG     Type;
	PVOID     StackTrace[16];
} HANDLE_TRACE_DB_ENTRY, *PHANDLE_TRACE_DB_ENTRY;

typedef PVOID PHANDLE_TABLE_ENTRY_INFO;

typedef struct _HANDLE_TRACE_DEBUG_INFO 
{
	ULONG                 CurrentStackIndex;
	HANDLE_TRACE_DB_ENTRY TraceDb[4096];
} HANDLE_TRACE_DEBUG_INFO, *PHANDLE_TRACE_DEBUG_INFO;

typedef struct _HANDLE_TABLE_ENTRY 
{
	union 
	{
		PVOID                    Object;
        ULONG                    ObAttributes;
		PHANDLE_TABLE_ENTRY_INFO InfoTable;
		ULONG                    Value;
    };

	union 
	{
		union 
		{
			ACCESS_MASK GrantedAccess;

            struct 
			{
				USHORT GrantedAccessIndex;
                USHORT CreatorBackTraceIndex;
            };
        };

        LONG NextFreeTableEntry;
    };

} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;

typedef struct _EXHANDLE 
{
	union 
	{
		struct 
		{
			ULONG TagBits : 02;
			ULONG Index   : 30;
        };

        HANDLE GenericHandleOverlay;
    };

} EXHANDLE, *PEXHANDLE;

typedef PVOID PHANDLE_TABLE;

typedef struct _XP_HANDLE_TABLE 
{
	ULONG                    TableCode;
	PEPROCESS                QuotaProcess;
	PVOID                    UniqueProcessId;
	EX_PUSH_LOCK             HandleTableLock[4];
	LIST_ENTRY               HandleTableList;
	EX_PUSH_LOCK             HandleContentionEvent;
	PHANDLE_TRACE_DEBUG_INFO DebugInfo;
	LONG                     ExtraInfoPages;
	ULONG                    FirstFree;
	ULONG                    LastFree;
	ULONG                    NextHandleNeedingPool;
	LONG                     HandleCount;
	LONG                     Flags;
	UCHAR                    StrictFIFO;
} XP_HANDLE_TABLE, *PXP_HANDLE_TABLE;


typedef struct _WIN2K_HANDLE_TABLE 
{
	ULONG                 Flags;
	LONG                  HandleCount;
	PHANDLE_TABLE_ENTRY **Table;
	PEPROCESS             QuotaProcess;
    HANDLE                UniqueProcessId;
	LONG                  FirstFreeTableEntry;
    LONG                  NextIndexNeedingPool;
	ERESOURCE             HandleTableLock;
	LIST_ENTRY            HandleTableList;
	KEVENT                HandleContentionEvent;
} WIN2K_HANDLE_TABLE , *PWIN2K_HANDLE_TABLE ;



/***********************************************************************************/
#ifdef __cplusplus
extern "C" {
#endif

extern POBJECT_TYPE *ExEventPairObjectType;
extern POBJECT_TYPE *PsProcessType;
extern POBJECT_TYPE *PsThreadType;
extern POBJECT_TYPE *PsJobType;
extern POBJECT_TYPE *LpcPortObjectType;
extern POBJECT_TYPE *LpcWaitablePortObjectType;
extern POBJECT_TYPE *IoDriverObjectType;
extern POBJECT_TYPE *IoDeviceObjectType;


extern 
PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable;

extern 
NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySystemInformation(
    IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
    IN OUT PVOID SystemInformation,
    IN ULONG SystemInformationLength,
    OUT PULONG ReturnLength OPTIONAL);

extern 
NTSYSAPI
NTSTATUS
NTAPI
NtDuplicateObject(
    IN HANDLE SourceProcessHandle,
    IN HANDLE SourceHandle,
    IN HANDLE TargetProcessHandle,
    OUT PHANDLE TargetHandle OPTIONAL,
    IN ACCESS_MASK DesiredAccess,
    IN ULONG Attributes,
    IN ULONG Options);

extern
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryObject(
    IN HANDLE ObjectHandle,
    IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
    OUT PVOID ObjectInformation,
    IN ULONG ObjectInformationLength,
    OUT PULONG ReturnLength OPTIONAL);

extern
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryInformationThread(
		IN HANDLE ThreadHandle,
		IN THREADINFOCLASS ThreadInformationClass,
		OUT PVOID ThreadInformation,
		IN ULONG ThreadInformationLength,
		OUT PULONG ReturnLength OPTIONAL);

extern
NTSYSAPI
NTSTATUS
NTAPI
NtCreateSection(
    OUT PHANDLE SectionHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN PLARGE_INTEGER SectionSize OPTIONAL,
    IN ULONG Protect,
    IN ULONG Attributes,
    IN HANDLE FileHandle);

extern
NTSYSAPI
NTSTATUS
NTAPI
ZwTerminateProcess(
	IN HANDLE hProcess,
	IN ULONG ExitCode);

extern
NTSYSAPI
NTSTATUS
NTAPI
NtConnectPort(
     OUT PHANDLE PortHandle,
     IN PUNICODE_STRING PortName,
     IN PSECURITY_QUALITY_OF_SERVICE SecurityQos,
     IN OUT PPORT_SECTION_WRITE WriteSection OPTIONAL,
     IN OUT PPORT_SECTION_READ ReadSection OPTIONAL,
     OUT PULONG MaxMessageSize OPTIONAL,
     IN OUT PVOID ConnectData OPTIONAL,
     IN OUT PULONG ConnectDataLength OPTIONAL);

extern
NTSYSAPI
NTSTATUS
NTAPI
NtRequestWaitReplyPort(
    IN HANDLE PortHandle,
    IN PPORT_MESSAGE RequestMessage,
    OUT PPORT_MESSAGE ReplyMessage);

extern
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenProcess(
    OUT PHANDLE ProcessHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN PCLIENT_ID ClientId OPTIONAL);

extern
NTSYSAPI
NTSTATUS
NTAPI
ZwDuplicateObject(
    IN HANDLE SourceProcessHandle,
    IN HANDLE SourceHandle,
    IN HANDLE TargetProcessHandle,
    OUT PHANDLE TargetHandle OPTIONAL,
    IN ACCESS_MASK DesiredAccess,
    IN ULONG Attributes,
    IN ULONG Options);

extern 
NTSYSAPI
NTSTATUS
NTAPI
PsLookupThreadByThreadId (
    IN  HANDLE    UniqueThreadId,
    OUT PVOID Thread);

extern
NTSYSAPI
NTSTATUS
NTAPI
PsLookupProcessByProcessId(IN HANDLE ProcessId, 
						   OUT PEPROCESS *Process);

extern 
NTSYSAPI
NTSTATUS
NTAPI
PsLookupThreadByThreadId (
    IN  HANDLE    UniqueThreadId,
    OUT PVOID Thread);

extern
NTSTATUS ObOpenObjectByName (IN POBJECT_ATTRIBUTES ObjectAttributes,
							 IN POBJECT_TYPE ObjectType OPTIONAL, 
							 IN KPROCESSOR_MODE AccessMode,
							 IN OUT PACCESS_STATE AccessState OPTIONAL, 
							 IN ACCESS_MASK DesiredAccess OPTIONAL,
							 IN OUT PVOID ParseContext OPTIONAL, 
							 OUT PHANDLE Handle);

extern 
void KeInitializeApc(PKAPC Apc, PKTHREAD thread,
                     UCHAR state_index,
                     PKKERNEL_ROUTINE ker_routine,
                     PKRUNDOWN_ROUTINE rd_routine,
                     PKNORMAL_ROUTINE nor_routine,
                     UCHAR mode,
                     PVOID context);
                            
extern 
void KeInsertQueueApc(PKAPC APC,
                      PVOID SysArg1,
                      PVOID SysArg2,
                      UCHAR arg4);

extern
void KeAttachProcess(PEPROCESS Process);

extern
void KeDetachProcess(void);


extern 
NTKERNELAPI 
void KeStackAttachProcess(IN PVOID Process, OUT PKAPC_STATE ApcState);


extern 
NTKERNELAPI 
void KeUnstackDetachProcess(IN OUT PKAPC_STATE ApcState);

extern
NTKERNELAPI 
NTSTATUS KeSetAffinityThread(ULONG lParam1, ULONG lParam2);

extern 
PUSHORT NtBuildNumber;

extern
NTKERNELAPI
NTSTATUS
ObReferenceObjectByName	(
	IN PUNICODE_STRING	ObjectName,
	IN ULONG			Attributes,
	IN PACCESS_STATE	PassedAccessState OPTIONAL,
	IN ACCESS_MASK		DesiredAccess OPTIONAL,
	IN POBJECT_TYPE		ObjectType OPTIONAL,
	IN KPROCESSOR_MODE	AccessMode,
	IN OUT PVOID		ParseContext OPTIONAL,
	OUT	PVOID			*Object);

extern
NTKERNELAPI 
void KiDispatchInterrupt(void);

#ifdef __cplusplus
}
#endif

#endif