authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2020-02-29 22:05:56-05:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2020-02-29 22:05:56-05:00
logd951e0402a3567dff4f139b3cb4ad404374622cd
tree44983ae4119e8406f63ef02bbc6b071a9e3e66a2
parent48cef8d5be24c40b4c845f6b07c78abd6c3d1b0d
parentd0c22619f59e41cb07d26d878ed1a9ec87e550e1
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

Merge pull request #4586 from daurnimator/windows-PEB

Fill out windows PEB definition

1 files changed, 188 insertions(+), 16 deletions(-)

lib/std/os/windows/bits.zig+188-16
...@@ -23,6 +23,7 @@ pub const BOOL = c_int;...@@ -23,6 +23,7 @@ pub const BOOL = c_int;
23pub const BOOLEAN = BYTE;23pub const BOOLEAN = BYTE;
24pub const BYTE = u8;24pub const BYTE = u8;
25pub const CHAR = u8;25pub const CHAR = u8;
26pub const UCHAR = u8;
26pub const FLOAT = f32;27pub const FLOAT = f32;
27pub const HANDLE = *c_void;28pub const HANDLE = *c_void;
28pub const HCRYPTPROV = ULONG_PTR;29pub const HCRYPTPROV = ULONG_PTR;
...@@ -54,6 +55,7 @@ pub const WORD = u16;...@@ -54,6 +55,7 @@ pub const WORD = u16;
54pub const DWORD = u32;55pub const DWORD = u32;
55pub const DWORD64 = u64;56pub const DWORD64 = u64;
56pub const LARGE_INTEGER = i64;57pub const LARGE_INTEGER = i64;
58pub const ULARGE_INTEGER = u64;
57pub const USHORT = u16;59pub const USHORT = u16;
58pub const SHORT = i16;60pub const SHORT = i16;
59pub const ULONG = u32;61pub const ULONG = u32;
...@@ -1145,32 +1147,202 @@ pub const UNICODE_STRING = extern struct {...@@ -1145,32 +1147,202 @@ pub const UNICODE_STRING = extern struct {
1145 Buffer: [*]WCHAR,1147 Buffer: [*]WCHAR,
1146};1148};
11471149
1150const ACTIVATION_CONTEXT_DATA = @OpaqueType();
1151const ASSEMBLY_STORAGE_MAP = @OpaqueType();
1152const FLS_CALLBACK_INFO = @OpaqueType();
1153const RTL_BITMAP = @OpaqueType();
1154pub const PRTL_BITMAP = *RTL_BITMAP;
1155const KAFFINITY = usize;
1156
1157/// Process Environment Block
1158/// Microsoft documentation of this is incomplete, the fields here are taken from various resources including:
1159/// - https://github.com/wine-mirror/wine/blob/1aff1e6a370ee8c0213a0fd4b220d121da8527aa/include/winternl.h#L269
1160/// - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index.htm
1148pub const PEB = extern struct {1161pub const PEB = extern struct {
1149 Reserved1: [2]BYTE,1162 // Versions: All
1150 BeingDebugged: BYTE,1163 InheritedAddressSpace: BOOLEAN,
1151 Reserved2: [1]BYTE,1164
1152 Reserved3: [2]PVOID,1165 // Versions: 3.51+
1166 ReadImageFileExecOptions: BOOLEAN,
1167 BeingDebugged: BOOLEAN,
1168
1169 // Versions: 5.2+ (previously was padding)
1170 BitField: UCHAR,
1171
1172 // Versions: all
1173 Mutant: HANDLE,
1174 ImageBaseAddress: HMODULE,
1153 Ldr: *PEB_LDR_DATA,1175 Ldr: *PEB_LDR_DATA,
1154 ProcessParameters: *RTL_USER_PROCESS_PARAMETERS,1176 ProcessParameters: *RTL_USER_PROCESS_PARAMETERS,
1155 Reserved4: [3]PVOID,1177 SubSystemData: PVOID,
1178 ProcessHeap: HANDLE,
1179
1180 // Versions: 5.1+
1181 FastPebLock: *RTL_CRITICAL_SECTION,
1182
1183 // Versions: 5.2+
1156 AtlThunkSListPtr: PVOID,1184 AtlThunkSListPtr: PVOID,
1157 Reserved5: PVOID,1185 IFEOKey: PVOID,
1158 Reserved6: ULONG,1186
1159 Reserved7: PVOID,1187 // Versions: 6.0+
1160 Reserved8: ULONG,1188
1189 /// https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/crossprocessflags.htm
1190 CrossProcessFlags: ULONG,
1191
1192 // Versions: 6.0+
1193 union1: extern union {
1194 KernelCallbackTable: PVOID,
1195 UserSharedInfoPtr: PVOID,
1196 },
1197
1198 // Versions: 5.1+
1199 SystemReserved: ULONG,
1200
1201 // Versions: 5.1, (not 5.2, not 6.0), 6.1+
1161 AtlThunkSListPtr32: ULONG,1202 AtlThunkSListPtr32: ULONG,
1162 Reserved9: [45]PVOID,1203
1163 Reserved10: [96]BYTE,1204 // Versions: 6.1+
1164 PostProcessInitRoutine: PPS_POST_PROCESS_INIT_ROUTINE,1205 ApiSetMap: PVOID,
1165 Reserved11: [128]BYTE,1206
1166 Reserved12: [1]PVOID,1207 // Versions: all
1208 TlsExpansionCounter: ULONG,
1209 // note: there is padding here on 64 bit
1210 TlsBitmap: PRTL_BITMAP,
1211 TlsBitmapBits: [2]ULONG,
1212 ReadOnlySharedMemoryBase: PVOID,
1213
1214 // Versions: 1703+
1215 SharedData: PVOID,
1216
1217 // Versions: all
1218 ReadOnlyStaticServerData: *PVOID,
1219 AnsiCodePageData: PVOID,
1220 OemCodePageData: PVOID,
1221 UnicodeCaseTableData: PVOID,
1222
1223 // Versions: 3.51+
1224 NumberOfProcessors: ULONG,
1225 NtGlobalFlag: ULONG,
1226
1227 // Versions: all
1228 CriticalSectionTimeout: LARGE_INTEGER,
1229
1230 // End of Original PEB size
1231
1232 // Fields appended in 3.51:
1233 HeapSegmentReserve: ULONG_PTR,
1234 HeapSegmentCommit: ULONG_PTR,
1235 HeapDeCommitTotalFreeThreshold: ULONG_PTR,
1236 HeapDeCommitFreeBlockThreshold: ULONG_PTR,
1237 NumberOfHeaps: ULONG,
1238 MaximumNumberOfHeaps: ULONG,
1239 ProcessHeaps: *PVOID,
1240
1241 // Fields appended in 4.0:
1242 GdiSharedHandleTable: PVOID,
1243 ProcessStarterHelper: PVOID,
1244 GdiDCAttributeList: ULONG,
1245 // note: there is padding here on 64 bit
1246 LoaderLock: *RTL_CRITICAL_SECTION,
1247 OSMajorVersion: ULONG,
1248 OSMinorVersion: ULONG,
1249 OSBuildNumber: USHORT,
1250 OSCSDVersion: USHORT,
1251 OSPlatformId: ULONG,
1252 ImageSubSystem: ULONG,
1253 ImageSubSystemMajorVersion: ULONG,
1254 ImageSubSystemMinorVersion: ULONG,
1255 // note: there is padding here on 64 bit
1256 ActiveProcessAffinityMask: KAFFINITY,
1257 GdiHandleBuffer: [switch (@sizeOf(usize)) {
1258 4 => 0x22,
1259 8 => 0x3C,
1260 else => unreachable,
1261 }]ULONG,
1262
1263 // Fields appended in 5.0 (Windows 2000):
1264 PostProcessInitRoutine: PVOID,
1265 TlsExpansionBitmap: PRTL_BITMAP,
1266 TlsExpansionBitmapBits: [32]ULONG,
1167 SessionId: ULONG,1267 SessionId: ULONG,
1268 // note: there is padding here on 64 bit
1269 // Versions: 5.1+
1270 AppCompatFlags: ULARGE_INTEGER,
1271 AppCompatFlagsUser: ULARGE_INTEGER,
1272 ShimData: PVOID,
1273 // Versions: 5.0+
1274 AppCompatInfo: PVOID,
1275 CSDVersion: UNICODE_STRING,
1276
1277 // Fields appended in 5.1 (Windows XP):
1278 ActivationContextData: *const ACTIVATION_CONTEXT_DATA,
1279 ProcessAssemblyStorageMap: *ASSEMBLY_STORAGE_MAP,
1280 SystemDefaultActivationData: *const ACTIVATION_CONTEXT_DATA,
1281 SystemAssemblyStorageMap: *ASSEMBLY_STORAGE_MAP,
1282 MinimumStackCommit: ULONG_PTR,
1283
1284 // Fields appended in 5.2 (Windows Server 2003):
1285 FlsCallback: *FLS_CALLBACK_INFO,
1286 FlsListHead: LIST_ENTRY,
1287 FlsBitmap: PRTL_BITMAP,
1288 FlsBitmapBits: [4]ULONG,
1289 FlsHighIndex: ULONG,
1290
1291 // Fields appended in 6.0 (Windows Vista):
1292 WerRegistrationData: PVOID,
1293 WerShipAssertPtr: PVOID,
1294
1295 // Fields appended in 6.1 (Windows 7):
1296 pUnused: PVOID, // previously pContextData
1297 pImageHeaderHash: PVOID,
1298
1299 /// TODO: https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/tracingflags.htm
1300 TracingFlags: ULONG,
1301
1302 // Fields appended in 6.2 (Windows 8):
1303 CsrServerReadOnlySharedMemoryBase: ULONGLONG,
1304
1305 // Fields appended in 1511:
1306 TppWorkerpListLock: ULONG,
1307 TppWorkerpList: LIST_ENTRY,
1308 WaitOnAddressHashTable: [0x80]PVOID,
1309
1310 // Fields appended in 1709:
1311 TelemetryCoverageHeader: PVOID,
1312 CloudFileFlags: ULONG,
1168};1313};
11691314
1315/// The `PEB_LDR_DATA` structure is the main record of what modules are loaded in a process.
1316/// It is essentially the head of three double-linked lists of `LDR_DATA_TABLE_ENTRY` structures which each represent one loaded module.
1317///
1318/// Microsoft documentation of this is incomplete, the fields here are taken from various resources including:
1319/// - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm
1170pub const PEB_LDR_DATA = extern struct {1320pub const PEB_LDR_DATA = extern struct {
1171 Reserved1: [8]BYTE,1321 // Versions: 3.51 and higher
1172 Reserved2: [3]PVOID,1322 /// The size in bytes of the structure
1323 Length: ULONG,
1324
1325 /// TRUE if the structure is prepared.
1326 Initialized: BOOLEAN,
1327
1328 SsHandle: PVOID,
1329 InLoadOrderModuleList: LIST_ENTRY,
1173 InMemoryOrderModuleList: LIST_ENTRY,1330 InMemoryOrderModuleList: LIST_ENTRY,
1331 InInitializationOrderModuleList: LIST_ENTRY,
1332
1333 // Versions: 5.1 and higher
1334
1335 /// No known use of this field is known in Windows 8 and higher.
1336 EntryInProgress: PVOID,
1337
1338 // Versions: 6.0 from Windows Vista SP1, and higher
1339 ShutdownInProgress: BOOLEAN,
1340
1341 /// Though ShutdownThreadId is declared as a HANDLE,
1342 /// it is indeed the thread ID as suggested by its name.
1343 /// It is picked up from the UniqueThread member of the CLIENT_ID in the
1344 /// TEB of the thread that asks to terminate the process.
1345 ShutdownThreadId: HANDLE,
1174};1346};
11751347
1176pub const RTL_USER_PROCESS_PARAMETERS = extern struct {1348pub const RTL_USER_PROCESS_PARAMETERS = extern struct {