📄 ntddk.inc
字号:
ELSE
.ERR
ENDIF
IF $IsAddr(Entry)
e SUBSTR <Entry>, 6
IF $IsStack(e) ;; Is relative to SS
lea ecx, e
ELSE
mov ecx, offset e
ENDIF
ELSEIF $IsReg(Entry)
IF reax ;; if eax was used report error
IFIDNI <Entry>, <eax>
line TEXTEQU %@Line
% ECHO @FileCur(line) : ERROR! Register value overwritten by InsertTailList macro.
.ERR
ENDIF
ENDIF
IFDIFI <Entry>, <ecx> ;; don't move eax onto itself
mov ecx, Entry
ENDIF
ELSEIF $IsStack(Entry)
mov ecx, Entry
ELSE
.ERR
ENDIF
mov (LIST_ENTRY PTR [ecx]).Flink, eax
push (LIST_ENTRY PTR [eax]).Blink
pop (LIST_ENTRY PTR [ecx]).Blink
push (LIST_ENTRY PTR [eax]).Blink
mov (LIST_ENTRY PTR [eax]).Blink, ecx
pop eax
mov (LIST_ENTRY PTR [eax]).Flink, ecx
ENDM
; VOID InsertHeadList( PLIST_ENTRY ListHead, PLIST_ENTRY Entry );
InsertHeadList MACRO ListHead:REQ, Entry:REQ
local h, e, reax
reax = 0
IF $IsAddr(ListHead)
h SUBSTR <ListHead>, 6
IF $IsStack(h) ;; Is relative to SS
lea eax, h
reax = 1 ;; no more eax
ELSE
mov eax, offset h
reax = 1 ;; no more eax
ENDIF
ELSEIF $IsReg(ListHead)
IFDIFI <ListHead>, <eax> ;; don't move eax onto itself
mov eax, ListHead
reax = 1 ;; no more eax
ENDIF
ELSEIF $IsStack(ListHead)
mov eax, ListHead
reax = 1 ;; no more eax
ELSE
.ERR
ENDIF
IF $IsAddr(Entry)
e SUBSTR <Entry>, 6
IF $IsStack(e) ;; Is relative to SS
lea ecx, e
ELSE
mov ecx, offset e
ENDIF
ELSEIF $IsReg(Entry)
IF reax ;; if eax was used report error
IFIDNI <Entry>, <eax>
line TEXTEQU %@Line
% ECHO @FileCur(line) : ERROR! Register value overwritten by InsertTailList macro.
.ERR
ENDIF
ENDIF
IFDIFI <Entry>, <ecx> ;; don't move eax onto itself
mov ecx, Entry
ENDIF
ELSEIF $IsStack(Entry)
mov ecx, Entry
ELSE
.ERR
ENDIF
mov (LIST_ENTRY PTR [ecx]).Blink, eax
push (LIST_ENTRY PTR [eax]).Flink
pop (LIST_ENTRY PTR [ecx]).Flink
push (LIST_ENTRY PTR [eax]).Flink
mov (LIST_ENTRY PTR [eax]).Flink, ecx
pop eax
mov (LIST_ENTRY PTR [eax]).Blink, ecx
ENDM
; Subroutines for dealing with the Registry
RTL_QUERY_REGISTRY_TABLE STRUCT
QueryRoutine PVOID ? ; 0000h PRTL_QUERY_REGISTRY_ROUTINE
Flags DWORD ? ; 0004h
_Name PWSTR ? ; 0008h (org name Name)
EntryContext PVOID ? ; 000Ch
DefaultType DWORD ? ; 0010h
DefaultData PVOID ? ; 0014h
DefaultLength DWORD ? ; 0018h
RTL_QUERY_REGISTRY_TABLE ENDS
PRTL_QUERY_REGISTRY_TABLE typedef PTR RTL_QUERY_REGISTRY_TABLE
; The following flags specify how the Name field of a RTL_QUERY_REGISTRY_TABLE
; entry is interpreted. A NULL name indicates the end of the table.
RTL_QUERY_REGISTRY_SUBKEY equ 00000001h ; Name is a subkey and remainder of
; table or until next subkey are value
; names for that subkey to look at.
RTL_QUERY_REGISTRY_TOPKEY equ 00000002h ; Reset current key to original key for
; this and all following table entries.
RTL_QUERY_REGISTRY_REQUIRED equ 00000004h ; Fail if no match found for this table entry.
RTL_QUERY_REGISTRY_NOVALUE equ 00000008h ; Used to mark a table entry that has no
; value name, just wants a call out, not
; an enumeration of all values.
RTL_QUERY_REGISTRY_NOEXPAND equ 00000010h ; Used to suppress the expansion of
; REG_MULTI_SZ into multiple callouts or
; to prevent the expansion of environment
; variable values in REG_EXPAND_SZ
RTL_QUERY_REGISTRY_DIRECT equ 00000020h ; QueryRoutine field ignored. EntryContext
; field points to location to store value.
; For null terminated strings, EntryContext
; points to UNICODE_STRING structure that
; that describes maximum size of buffer.
; If .Buffer field is NULL then a buffer is
; allocated.
RTL_QUERY_REGISTRY_DELETE equ 00000040h ; Used to delete value keys after they
; are queried.
; The following values for the RelativeTo parameter determine what the
; Path parameter to RtlQueryRegistryValues is relative to.
RTL_REGISTRY_ABSOLUTE equ 0 ; Path is a full path
RTL_REGISTRY_SERVICES equ 1 ; \Registry\Machine\System\CurrentControlSet\Services
RTL_REGISTRY_CONTROL equ 2 ; \Registry\Machine\System\CurrentControlSet\Control
RTL_REGISTRY_WINDOWS_NT equ 3 ; \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion
RTL_REGISTRY_DEVICEMAP equ 4 ; \Registry\Machine\Hardware\DeviceMap
RTL_REGISTRY_USER equ 5 ; \Registry\User\CurrentUser
RTL_REGISTRY_MAXIMUM equ 6
RTL_REGISTRY_HANDLE equ 40000000h ; Low order bits are registry handle
RTL_REGISTRY_OPTIONAL equ 80000000h ; Indicates the key node is optional
; Time conversion routines
TIME_FIELDS STRUCT ; sizeof = 010h
Year SWORD ? ; 0000h range [1601...]
Month SWORD ? ; 0002h range [1..12]
Day SWORD ? ; 0004h range [1..31]
Hour SWORD ? ; 0006h range [0..23]
Minute SWORD ? ; 0008h range [0..59]
Second SWORD ? ; 000Ah range [0..59]
Milliseconds SWORD ? ; 000Ch range [0..999]
Weekday SWORD ? ; 000Eh range [0..6] == [Sunday..Saturday]
TIME_FIELDS ENDS
PTIME_FIELDS typedef PTR TIME_FIELDS
; +
; The following macros store and retrieve USHORTS and ULONGS from potentially
; unaligned addresses, avoiding alignment faults. they should probably be
; rewritten in assembler
; -
SHORT_SIZE equ sizeof USHORT
SHORT_MASK equ (SHORT_SIZE - 1)
LONG_SIZE equ sizeof LONG
LONG_MASK equ (LONG_SIZE - 1)
LONGLONG_SIZE equ sizeof LONGLONG
LONGLONG_MASK equ (LONGLONG_SIZE - 1)
LOWBYTE_MASK equ 00FFh
; +
; BitMap routines. The following structure, routines, and macros are
; for manipulating bitmaps. The user is responsible for allocating a bitmap
; structure (which is really a header) and a buffer (which must be longword
; aligned and multiple longwords in size).
; -
RTL_BITMAP STRUCT ; sizeof = 8
SizeOfBitMap DWORD ? ; 00h Number of bits in bit map
Buffer PVOID ? ; 04h Pointer to the bit map itself
RTL_BITMAP ENDS
PRTL_BITMAP typedef PTR RTL_BITMAP
; +
; The following routine locates a set of contiguous regions of clear
; bits within the bitmap. The caller specifies whether to return the
; longest runs or just the first found lcoated. The following structure is
; used to denote a contiguous run of bits. The two routines return an array
; of this structure, one for each run located.
; -
RTL_BITMAP_RUN STRUCT ; sizeof = 8
StartingIndex DWORD ? ; 00h
NumberOfBits DWORD ? ; 04h
RTL_BITMAP_RUN ENDS
PRTL_BITMAP_RUN typedef ptr RTL_BITMAP_RUN
; Range list package
RTL_RANGE STRUCT ; sizeof = 20h
; The start of the range
_Start QWORD ? ; 000h Read only
; The end of the range
_End QWORD ? ; 008h Read only
; Data the user passed in when they created the range
UserData PVOID ? ; 010h Read/Write
; The owner of the range
Owner PVOID ? ; 014h Read/Write
; User defined flags the user specified when they created the range
Attributes BYTE ? ; 018h Read/Write
; Flags (RTL_RANGE_*)
Flags BYTE ? ; 019h Read only
db 6 dup(?) ; padding
RTL_RANGE ENDS
PRTL_RANGE typedef ptr RTL_RANGE
RTL_RANGE_SHARED equ 01
RTL_RANGE_CONFLICT equ 02
RTL_RANGE_LIST STRUCT ; sizeof = 14h
; The list of ranges
ListHead LIST_ENTRY <> ; 000h
; These always come in useful
Flags DWORD ? ; 008h use RANGE_LIST_FLAG_*
; The number of entries in the list
Count DWORD ? ; 0C0h
; Every time an add/delete operation is performed on the list this is
; incremented. It is checked during iteration to ensure that the list
; hasn't changed between GetFirst/GetNext or GetNext/GetNext calls
Stamp DWORD ? ; 010h
RTL_RANGE_LIST ENDS
PRTL_RANGE_LIST typedef ptr RTL_RANGE_LIST
RTL_RANGE_LIST_ITERATOR STRUCT
RangeListHead PVOID ? ; 000h PLIST_ENTRY
MergedHead PVOID ? ; 004h PLIST_ENTRY
Current PVOID ? ; 008h
Stamp DWORD ? ; 00Ch
RTL_RANGE_LIST_ITERATOR ENDS
PRTL_RANGE_LIST_ITERATOR typedef ptr RTL_RANGE_LIST_ITERATOR
RTL_RANGE_LIST_ADD_IF_CONFLICT equ 00000001
RTL_RANGE_LIST_ADD_SHARED equ 00000002
RTL_RANGE_LIST_SHARED_OK equ 00000001
RTL_RANGE_LIST_NULL_CONFLICT_OK equ 00000002
OSVERSIONINFOA STRUCT
dwOSVersionInfoSize DWORD ? ; 000h
dwMajorVersion DWORD ? ; 004h
dwMinorVersion DWORD ? ; 008h
dwBuildNumber DWORD ? ; 00Ch
dwPlatformId DWORD ? ; 010h
szCSDVersion BYTE 128 dup(?) ; 014h Maintenance string for PSS usage
OSVERSIONINFOA ENDS
POSVERSIONINFOA typedef ptr OSVERSIONINFOA
LPOSVERSIONINFOA typedef ptr OSVERSIONINFOA
OSVERSIONINFOW STRUCT
dwOSVersionInfoSize DWORD ? ; 000h
dwMajorVersion DWORD ? ; 004h
dwMinorVersion DWORD ? ; 008h
dwBuildNumber DWORD ? ; 00Ch
dwPlatformId DWORD ? ; 010h
szCSDVersion WORD 128 dup(?) ; 014h Maintenance string for PSS usage
OSVERSIONINFOW ENDS
POSVERSIONINFOW typedef ptr OSVERSIONINFOW
LPOSVERSIONINFOW typedef ptr OSVERSIONINFOW
RTL_OSVERSIONINFOW equ <OSVERSIONINFOW>
PRTL_OSVERSIONINFOW typedef ptr OSVERSIONINFOW
IFDEF UNICODE
OSVERSIONINFO equ <OSVERSIONINFOW>
POSVERSIONINFO typedef ptr OSVERSIONINFOW
LPOSVERSIONINFO typedef ptr OSVERSIONINFOW
ELSE
OSVERSIONINFO equ <OSVERSIONINFOA>
POSVERSIONINFO typedef ptr OSVERSIONINFOA
LPOSVERSIONINFO typedef ptr OSVERSIONINFOA
ENDIF
OSVERSIONINFOEXA STRUCT
dwOSVersionInfoSize DWORD ? ; 000h
dwMajorVersion DWORD ? ; 004h
dwMinorVersion DWORD ? ; 008h
dwBuildNumber DWORD ? ; 00Ch
dwPlatformId DWORD ? ; 010h
szCSDVersion BYTE 128 dup(?) ; 014h Maintenance string for PSS usage
wServicePackMajor WORD ? ; 094
wServicePackMinor WORD ? ; 096
wSuiteMask WORD ? ; 098
wProductType BYTE ? ; 09A
wReserved BYTE ? ; 09B
OSVERSIONINFOEXA ENDS
POSVERSIONINFOEXA typedef ptr OSVERSIONINFOEXA
LPOSVERSIONINFOEXA typedef ptr OSVERSIONINFOEXA
OSVERSIONINFOEXW STRUCT
dwOSVersionInfoSize DWORD ? ; 000h
dwMajorVersion DWORD ? ; 004h
dwMinorVersion DWORD ? ; 008h
dwBuildNumber DWORD ? ; 00Ch
dwPlatformId DWORD ? ; 010h
szCSDVersion WORD 128 dup(?) ; 014h Maintenance string for PSS usage
wServicePackMajor WORD ? ; 114h
wServicePackMinor WORD ? ; 116h
wSuiteMask WORD ? ; 118h
wProductType BYTE ? ; 11Ah
wReserved BYTE ? ; 11Bh
OSVERSIONINFOEXW ENDS
POSVERSIONINFOEXW typedef ptr OSVERSIONINFOEXW
LPOSVERSIONINFOEXW typedef ptr OSVERSIONINFOEXW
RTL_OSVERSIONINFOEXW equ <OSVERSIONINFOEXW>
PRTL_OSVERSIONINFOEXW typedef ptr OSVERSIONINFOEXW
IFDEF UNICODE
OSVERSIONINFOEX equ <OSVERSIONINFOEXW>
POSVERSIONINFOEX typedef ptr OSVERSIONINFOEXW
LPOSVERSIONINFOEX typedef ptr OSVERSIONINFOEXW
ELSE
OSVERSIONINFOEX equ <OSVERSIONINFOEXA>
POSVERSIONINFOEX typedef ptr OSVERSIONINFOEXA
LPOSVERSIONINFOEX typedef ptr OSVERSIONINFOEXA
ENDIF
; RtlVerifyVersionInfo() conditions
VER_EQUAL equ 1
VER_GREATER equ 2
VER_GREATER_EQUAL equ 3
VER_LESS equ 4
VER_LESS_EQUAL equ 5
VER_AND equ 6
VER_OR equ 7
VER_CONDITION_MASK equ 7
VER_NUM_BITS_PER_CONDITION_MASK equ 3
; RtlVerifyVersionInfo() type mask bits
VER_MINORVERSION equ 0000001h
VER_MAJORVERSION equ 0000002h
VER_BUILDNUMBER equ 0000004h
VER_PLATFORMID equ 0000008h
VER_SERVICEPACKMINOR equ 0000010h
VER_SERVICEPACKMAJOR equ 0000020h
VER_SUITENAME equ 0000040h
VER_PRODUCT_TYPE equ 0000080h
; RtlVerifyVersionInfo() os product type values
VER_NT_WORKSTATION equ 0000001
VER_NT_DOMAIN_CONTROLLER equ 0000002
VER_NT_SERVER equ 0000003
; dwPlatformId defines:
VER_PLATFORM_WIN32s equ 0
VER_PLATFORM_WIN32_WINDOWS equ 1
VER_PLATFORM_WIN32_NT equ 2
; +
; Define the various device type values. Note that values used by Microsoft
; Corporation are in the range 0-32767, and 32768-65535 are reserved for use
; by customers.
; -
DEVICE_TYPE typedef DWORD
FILE_DEVICE_BEEP equ 01
FILE_DEVICE_CD_ROM equ 02
FILE_DEVICE_CD_ROM_FILE_SYSTEM equ 03
FILE_DEVICE_CONTROLLER equ 04
FILE_DEVICE_DATALINK equ 05
FILE_DEVICE_DFS equ 06
FILE_DEVICE_DISK equ 07
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -