⭐ 欢迎来到虫虫下载站! | 📦 资源下载 📁 资源专辑 ℹ️ 关于我们
⭐ 虫虫下载站

📄 w2k_def.h

📁 Undocumented WIndows 2000 Secrets 完整简体中文版!!NT架构windows(20000、xp)Kernel Hacking必备!!附cd iso与完整附录!
💻 H
📖 第 1 页 / 共 5 页
字号:

// __________________________________________________________
//
//                         w2k_def.h
//               Windows 2000 Definitions V1.00
//                07-23-2000 Sven B. Schreiber
//                       sbs@orgon.com
// __________________________________________________________

// IMPORTANT NOTE: The definitions in this header file are NOT
// compatible to Windows NT 4.0!

#ifndef _W2K_DEF_H_
#define _W2K_DEF_H_

// =================================================================
// DISCLAIMER
// =================================================================

/*

This software is provided "as is" and any express or implied
warranties, including, but not limited to, the implied warranties of
merchantibility and fitness for a particular purpose are disclaimed.
In no event shall the author Sven B. Schreiber be liable for any
direct, indirect, incidental, special, exemplary, or consequential
damages (including, but not limited to, procurement of substitute
goods or services; loss of use, data, or profits; or business
interruption) however caused and on any theory of liability,
whether in contract, strict liability, or tort (including negligence
or otherwise) arising in any way out of the use of this software,
even if advised of the possibility of such damage.

*/

// =================================================================
// REVISION HISTORY
// =================================================================

/*

07-23-2000 V1.00 Original version (SBS).

*/

////////////////////////////////////////////////////////////////////
#ifdef _USER_MODE_
////////////////////////////////////////////////////////////////////

// =================================================================
// DISPATCHER OBJECT TYPE CODES
// =================================================================

#define DISP_TYPE_NOTIFICATION_EVENT         0
#define DISP_TYPE_SYNCHRONIZATION_EVENT      1
#define DISP_TYPE_MUTANT                     2
#define DISP_TYPE_PROCESS                    3
#define DISP_TYPE_QUEUE                      4
#define DISP_TYPE_SEMAPHORE                  5
#define DISP_TYPE_THREAD                     6
#define DISP_TYPE_NOTIFICATION_TIMER         8
#define DISP_TYPE_SYNCHRONIZATION_TIMER      9

// =================================================================
// I/O SYSTEM DATA STRUCTURE TYPE CODES
// =================================================================

#define IO_TYPE_ADAPTER                      1
#define IO_TYPE_CONTROLLER                   2
#define IO_TYPE_DEVICE                       3
#define IO_TYPE_DRIVER                       4
#define IO_TYPE_FILE                         5
#define IO_TYPE_IRP                          6
#define IO_TYPE_MASTER_ADAPTER               7
#define IO_TYPE_OPEN_PACKET                  8
#define IO_TYPE_TIMER                        9
#define IO_TYPE_VPB                         10
#define IO_TYPE_ERROR_LOG                   11
#define IO_TYPE_ERROR_MESSAGE               12
#define IO_TYPE_DEVICE_OBJECT_EXTENSION     13

#define IO_TYPE_APC                         18
#define IO_TYPE_DPC                         19
#define IO_TYPE_DEVICE_QUEUE                20
#define IO_TYPE_EVENT_PAIR                  21
#define IO_TYPE_INTERRUPT                   22
#define IO_TYPE_PROFILE                     23

// =================================================================
// FILE_OBJECT FLAGS
// =================================================================

#define FO_FILE_OPEN                        0x00000001
#define FO_SYNCHRONOUS_IO                   0x00000002
#define FO_ALERTABLE_IO                     0x00000004
#define FO_NO_INTERMEDIATE_BUFFERING        0x00000008
#define FO_WRITE_THROUGH                    0x00000010
#define FO_SEQUENTIAL_ONLY                  0x00000020
#define FO_CACHE_SUPPORTED                  0x00000040
#define FO_NAMED_PIPE                       0x00000080
#define FO_STREAM_FILE                      0x00000100
#define FO_MAILSLOT                         0x00000200
#define FO_GENERATE_AUDIT_ON_CLOSE          0x00000400
#define FO_DIRECT_DEVICE_OPEN               0x00000800
#define FO_FILE_MODIFIED                    0x00001000
#define FO_FILE_SIZE_CHANGED                0x00002000
#define FO_CLEANUP_COMPLETE                 0x00004000
#define FO_TEMPORARY_FILE                   0x00008000
#define FO_DELETE_ON_CLOSE                  0x00010000
#define FO_OPENED_CASE_SENSITIVE            0x00020000
#define FO_HANDLE_CREATED                   0x00040000
#define FO_FILE_FAST_IO_READ                0x00080000
#define FO_RANDOM_ACCESS                    0x00100000
#define FO_FILE_OPEN_CANCELLED              0x00200000
#define FO_VOLUME_OPEN                      0x00400000

// =================================================================
// I/O REQUEST PACKET FUNCTIONS
// =================================================================

#define IRP_MJ_CREATE                        0
#define IRP_MJ_CREATE_NAMED_PIPE             1
#define IRP_MJ_CLOSE                         2
#define IRP_MJ_READ                          3
#define IRP_MJ_WRITE                         4
#define IRP_MJ_QUERY_INFORMATION             5
#define IRP_MJ_SET_INFORMATION               6
#define IRP_MJ_QUERY_EA                      7
#define IRP_MJ_SET_EA                        8
#define IRP_MJ_FLUSH_BUFFERS                 9
#define IRP_MJ_QUERY_VOLUME_INFORMATION     10
#define IRP_MJ_SET_VOLUME_INFORMATION       11
#define IRP_MJ_DIRECTORY_CONTROL            12
#define IRP_MJ_FILE_SYSTEM_CONTROL          13
#define IRP_MJ_DEVICE_CONTROL               14
#define IRP_MJ_INTERNAL_DEVICE_CONTROL      15
#define IRP_MJ_SHUTDOWN                     16
#define IRP_MJ_LOCK_CONTROL                 17
#define IRP_MJ_CLEANUP                      18
#define IRP_MJ_CREATE_MAILSLOT              19
#define IRP_MJ_QUERY_SECURITY               20
#define IRP_MJ_SET_SECURITY                 21
#define IRP_MJ_POWER                        22
#define IRP_MJ_SYSTEM_CONTROL               23
#define IRP_MJ_DEVICE_CHANGE                24
#define IRP_MJ_QUERY_QUOTA                  25
#define IRP_MJ_SET_QUOTA                    26
#define IRP_MJ_PNP                          27
#define IRP_MJ_MAXIMUM_FUNCTION             27

#define IRP_MJ_FUNCTIONS (IRP_MJ_MAXIMUM_FUNCTION + 1)

// =================================================================
// STATUS CODES
// =================================================================

typedef LONG NTSTATUS, *PNTSTATUS, **PPNTSTATUS;

#define STATUS_SUCCESS                      ((NTSTATUS) 0x00000000)
#define STATUS_INFO_LENGTH_MISMATCH         ((NTSTATUS) 0xC0000004)
#define STATUS_IO_DEVICE_ERROR              ((NTSTATUS) 0xC0000185)

// =================================================================
// SIMPLE TYPES
// =================================================================

typedef DWORD KAFFINITY, *PKAFFINITY, **PPKAFFINITY;
typedef BYTE  KIRQL,     *PKIRQL,     **PPKIRQL;

// =================================================================
// ENUMERATIONS
// =================================================================

typedef enum _IO_ALLOCATION_ACTION
        {
/*001*/ KeepObject = 1,
/*002*/ DeallocateObject,
/*003*/ DeallocateObjectKeepRegisters
        }
        IO_ALLOCATION_ACTION,
     * PIO_ALLOCATION_ACTION,
    **PPIO_ALLOCATION_ACTION;

// -----------------------------------------------------------------

typedef CHAR KPROCESSOR_MODE;

typedef enum _MODE
        {
/*000*/ KernelMode,
/*001*/ UserMode,
/*002*/ MaximumMode
        }
        MODE,
     * PMODE,
    **PPMODE;

// -----------------------------------------------------------------

typedef enum _POOL_TYPE
        {
/*000*/ NonPagedPool,
/*001*/ PagedPool,
/*002*/ NonPagedPoolMustSucceed,
/*003*/ DontUseThisType,
/*004*/ NonPagedPoolCacheAligned,
/*005*/ PagedPoolCacheAligned,
/*006*/ NonPagedPoolCacheAlignedMustS,
/*007*/ MaxPoolType
        }
        POOL_TYPE,
     * PPOOL_TYPE,
    **PPPOOL_TYPE;

// -----------------------------------------------------------------

typedef enum _TDI_PNP_OPCODE
        {
/*000*/ TDI_PNP_OP_MIN,
/*001*/ TDI_PNP_OP_ADD,
/*002*/ TDI_PNP_OP_DEL,
/*003*/ TDI_PNP_OP_UPDATE,
/*004*/ TDI_PNP_OP_PROVIDERREADY,
/*005*/ TDI_PNP_OP_NETREADY,
/*006*/ TDI_PNP_OP_ADD_IGNORE_BINDING,
/*007*/ TDI_PNP_OP_DELETE_IGNORE_BINDING,
/*008*/ TDI_PNP_OP_MAX,
        }
        TDI_PNP_OPCODE,
     * PTDI_PNP_OPCODE,
    **PPTDI_PNP_OPCODE;

// =================================================================
// CALLBACK FUNCTIONS
// =================================================================

typedef NTSTATUS
        (* PDRIVER_ADD_DEVICE)
                (struct _DRIVER_OBJECT   *DriverObject,
                 struct _DEVICE_OBJECT   *PhysicalDeviceObject);

typedef IO_ALLOCATION_ACTION
        (* PDRIVER_CONTROL)
                (struct _DEVICE_OBJECT   *DeviceObject,
                 struct _IRP             *Irp,
                 PVOID                    MapRegisterBase,
                 PVOID                    Context);

typedef NTSTATUS
        (* PDRIVER_DISPATCH)
                (struct _DEVICE_OBJECT   *DeviceObject,
                 struct _IRP             *Irp);

typedef NTSTATUS
        (* PDRIVER_INITIALIZE)
                (struct _DRIVER_OBJECT   *DriverObject,
                 struct _UNICODE_STRING  *RegistryPath);

typedef VOID
        (* PDRIVER_STARTIO)
                (struct _DEVICE_OBJECT   *DeviceObject,
                 struct _IRP             *Irp);

typedef VOID
        (* PDRIVER_UNLOAD)
                (struct _DRIVER_OBJECT   *DriverObject);

typedef VOID
        (* PKDEFERRED_ROUTINE)
                (struct _KDPC            *Dpc,
                 PVOID                    DeferredContext,
                 PVOID                    SystemArgument1,
                 PVOID                    SystemArgument2);

typedef VOID
        (*PIO_TIMER_ROUTINE)
                (struct _DEVICE_OBJECT   *DeviceObject,
                 PVOID                    Context);

typedef VOID
        (* PKNORMAL_ROUTINE)
                (PVOID                    NormalContext,
                 PVOID                    SystemArgument1,
                 PVOID                    SystemArgument2);

typedef VOID
        (* PKKERNEL_ROUTINE)
                (struct _KAPC            *Apc,
                 PKNORMAL_ROUTINE        *NormalRoutine,
                 PVOID                   *NormalContext,
                 PVOID                   *SystemArgument1,
                 PVOID                   *SystemArgument2
    );

typedef VOID
        (* PKRUNDOWN_ROUTINE)
                (struct _KAPC            *Apc);

// -----------------------------------------------------------------

typedef VOID
        (* TDI_ADD_ADDRESS_HANDLER)
                (struct _TA_ADDRESS      *Address);

typedef VOID
        (* TDI_ADD_ADDRESS_HANDLER_V2)
                (struct _TA_ADDRESS      *Address,
                 struct _UNICODE_STRING  *DeviceName,
                 struct _TDI_PNP_CONTEXT *Context);

typedef VOID
        (* TDI_BIND_HANDLER)
                (struct _UNICODE_STRING  *DeviceName);

typedef VOID
        (* TDI_BINDING_HANDLER)
                (TDI_PNP_OPCODE           PnPOpcode,
                 struct _UNICODE_STRING  *DeviceName,
                 PWORD                    MultiSZBindList);

typedef VOID
        (* TDI_DEL_ADDRESS_HANDLER)
                (struct _TA_ADDRESS      *Address);

typedef VOID
        (* TDI_DEL_ADDRESS_HANDLER_V2)
                (struct _TA_ADDRESS      *Address,
                 struct _UNICODE_STRING  *DeviceName,
                 struct _TDI_PNP_CONTEXT *Context);

typedef NTSTATUS
        (* TDI_PNP_POWER_HANDLER)
                (struct _UNICODE_STRING  *DeviceName,
                 struct _NET_PNP_EVENT   *PowerEvent,
                 struct _TDI_PNP_CONTEXT *Context1,
                 struct _TDI_PNP_CONTEXT *Context2);

typedef VOID
        (* TDI_UNBIND_HANDLER)
                (struct _UNICODE_STRING  *DeviceName);

// =================================================================
// FAST I/O FUNCTIONS
// =================================================================

typedef struct _FAST_IO_DISPATCH
        {
/*000*/ DWORD SizeOfFastIoDispatch;
/*004*/ PVOID FastIoCheckIfPossible;
/*008*/ PVOID FastIoRead;
/*00C*/ PVOID FastIoWrite;
/*010*/ PVOID FastIoQueryBasicInfo;
/*014*/ PVOID FastIoQueryStandardInfo;
/*018*/ PVOID FastIoLock;
/*01C*/ PVOID FastIoUnlockSingle;
/*020*/ PVOID FastIoUnlockAll;
/*024*/ PVOID FastIoUnlockAllByKey;
/*028*/ PVOID FastIoDeviceControl;
/*02C*/ PVOID AcquireFileForNtCreateSection;
/*030*/ PVOID ReleaseFileForNtCreateSection;
/*034*/ PVOID FastIoDetachDevice;
/*038*/ PVOID FastIoQueryNetworkOpenInfo;
/*03C*/ PVOID AcquireForModWrite;
/*040*/ PVOID MdlRead;
/*044*/ PVOID MdlReadComplete;
/*048*/ PVOID PrepareMdlWrite;
/*04C*/ PVOID MdlWriteComplete;
/*050*/ PVOID FastIoReadCompressed;
/*054*/ PVOID FastIoWriteCompressed;
/*058*/ PVOID MdlReadCompleteCompressed;
/*05C*/ PVOID MdlWriteCompleteCompressed;
/*060*/ PVOID FastIoQueryOpen;
/*064*/ PVOID ReleaseForModWrite;
/*068*/ PVOID AcquireForCcFlush;
/*06C*/ PVOID ReleaseForCcFlush;
/*070*/ }
        FAST_IO_DISPATCH,
     * PFAST_IO_DISPATCH,
    **PPFAST_IO_DISPATCH;

#define FAST_IO_DISPATCH_ \
        sizeof (FAST_IO_DISPATCH)

// =================================================================
// STRING STRUCTURES
// =================================================================

typedef struct _STRING
        {
/*000*/ WORD  Length;
/*002*/ WORD  MaximumLength;
/*004*/ PBYTE Buffer;
/*008*/ }
        STRING,
     * PSTRING,
    **PPSTRING;

#define STRING_ \
        sizeof (STRING)

// -----------------------------------------------------------------

typedef STRING ANSI_STRING, *PANSI_STRING, **PPANSI_STRING;
typedef STRING OEM_STRING,  *POEM_STRING,  **PPOEM_STRING;

#define ANSI_STRING_ sizeof (ANSI_STRING)

⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -