00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
#ifndef _PSP_
00022
#define _PSP_
00023
00024
#include "ntos.h"
00025
#include "ntrtl.h"
00026
#include "nturtl.h"
00027
#include "zwapi.h"
00028
#include "ki.h"
00029
#if defined(_X86_)
00030
#include <vdmntos.h>
00031
#endif
00032 #define NOEXTAPI
00033
#include "wdbgexts.h"
00034
#include "ntdbg.h"
00035
#include <string.h>
00036
#if defined(_WIN64)
00037
#include <wow64t.h>
00038
#endif
00039
00040
#ifdef POOL_TAGGING
00041
#define ExAllocatePool(a,b) ExAllocatePoolWithTag(a,b,' sP')
00042
#define ExAllocatePoolWithQuota(a,b) ExAllocatePoolWithQuotaTag(a,b,' sP')
00043
#endif
00044
00045
00046
00047
00048
00049
00050
00051
00052
00053
00054
00055 #define PSP_PROCESS_PAGED_CHARGE (PAGE_SIZE)
00056 #define PSP_PROCESS_NONPAGED_CHARGE (sizeof(EPROCESS))
00057
00058
00059
00060
00061
00062
00063
00064
00065
00066
00067
00068 #define PSP_THREAD_PAGED_CHARGE (0)
00069 #define PSP_THREAD_NONPAGED_CHARGE (sizeof(ETHREAD))
00070
00071 typedef struct _TERMINATION_PORT {
00072 LIST_ENTRY
Links;
00073 PVOID
Port;
00074 }
TERMINATION_PORT, *
PTERMINATION_PORT;
00075
00076 typedef struct _GETSETCONTEXT {
00077 KAPC Apc;
00078 KPROCESSOR_MODE Mode;
00079 KEVENT OperationComplete;
00080 CONTEXT
Context;
00081 KNONVOLATILE_CONTEXT_POINTERS
NonVolatileContext;
00082 }
GETSETCONTEXT, *
PGETSETCONTEXT;
00083
00084 typedef struct _SYSTEM_DLL {
00085 PVOID
Section;
00086 PVOID
DllBase;
00087 PKNORMAL_ROUTINE LoaderInitRoutine;
00088 }
SYSTEM_DLL,
PSYSTEM_DLL;
00089
00090 typedef struct _JOB_WORKING_SET_CHANGE_HEAD {
00091 LIST_ENTRY
Links;
00092 FAST_MUTEX Lock;
00093 SIZE_T
MinimumWorkingSetSize;
00094 SIZE_T
MaximumWorkingSetSize;
00095 }
JOB_WORKING_SET_CHANGE_HEAD, *
PJOB_WORKING_SET_CHANGE_HEAD;
00096
00097 typedef struct _JOB_WORKING_SET_CHANGE_RECORD {
00098 LIST_ENTRY
Links;
00099 PEPROCESS Process;
00100 }
JOB_WORKING_SET_CHANGE_RECORD, *
PJOB_WORKING_SET_CHANGE_RECORD;
00101
00102 JOB_WORKING_SET_CHANGE_HEAD PspWorkingSetChangeHead;
00103
00104
00105
00106
00107
00108
VOID
00109
PspProcessDump(
00110 IN PVOID Object,
00111 IN
POB_DUMP_CONTROL Control OPTIONAL
00112 );
00113
00114
VOID
00115
PspProcessDelete(
00116 IN PVOID Object
00117 );
00118
00119
00120
VOID
00121
PspThreadDump(
00122 IN PVOID Object,
00123 IN
POB_DUMP_CONTROL Control OPTIONAL
00124 );
00125
00126
VOID
00127
PspInheritQuota(
00128 IN
PEPROCESS NewProcess,
00129 IN
PEPROCESS ParentProcess
00130 );
00131
00132
VOID
00133
PspDereferenceQuota(
00134 IN
PEPROCESS Process
00135 );
00136
00137
VOID
00138
PspThreadDelete(
00139 IN PVOID Object
00140 );
00141
00142
00143
00144
00145
00146 BOOLEAN
00147
PspInitPhase0 (
00148 IN
PLOADER_PARAMETER_BLOCK LoaderBlock
00149 );
00150
00151 BOOLEAN
00152
PspInitPhase1 (
00153 IN
PLOADER_PARAMETER_BLOCK LoaderBlock
00154 );
00155
00156
NTSTATUS
00157
PspInitializeSystemDll( VOID );
00158
00159
NTSTATUS
00160
PspLookupSystemDllEntryPoint(
00161 IN PSZ EntryPointName,
00162 OUT PVOID *EntryPointAddress
00163 );
00164
00165
NTSTATUS
00166
PspLookupKernelUserEntryPoints(
00167 VOID
00168 );
00169
00170
USHORT
00171
PspNameToOrdinal(
00172 IN PSZ EntryPointName,
00173 IN ULONG DllBase,
00174 IN ULONG NumberOfNames,
00175 IN PULONG NameTableBase,
00176 IN PUSHORT OrdinalTableBase
00177 );
00178
00179
NTSTATUS
00180
PspMapSystemDll(
00181 IN
PEPROCESS Process,
00182 OUT PVOID *DllBase OPTIONAL
00183 );
00184
00185
00186
00187
00188
00189 #define PSP_MAX_CREATE_PROCESS_NOTIFY 8
00190
00191 ULONG
PspCreateProcessNotifyRoutineCount;
00192 PCREATE_PROCESS_NOTIFY_ROUTINE PspCreateProcessNotifyRoutine[
PSP_MAX_CREATE_PROCESS_NOTIFY ];
00193
00194
NTSTATUS
00195
PspCreateProcess(
00196 OUT PHANDLE ProcessHandle,
00197 IN ACCESS_MASK DesiredAccess,
00198 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
00199 IN HANDLE ParentProcess OPTIONAL,
00200 IN BOOLEAN InheritObjectTable,
00201 IN HANDLE SectionHandle OPTIONAL,
00202 IN HANDLE DebugPort OPTIONAL,
00203 IN HANDLE ExceptionPort OPTIONAL
00204 );
00205
00206 #define PSP_MAX_CREATE_THREAD_NOTIFY 8
00207
00208 ULONG
PspCreateThreadNotifyRoutineCount;
00209 PCREATE_THREAD_NOTIFY_ROUTINE PspCreateThreadNotifyRoutine[
PSP_MAX_CREATE_THREAD_NOTIFY ];
00210
00211
00212 #define PSP_MAX_LOAD_IMAGE_NOTIFY 8
00213 ULONG
PspLoadImageNotifyRoutineCount;
00214 PLOAD_IMAGE_NOTIFY_ROUTINE PspLoadImageNotifyRoutine[
PSP_MAX_LOAD_IMAGE_NOTIFY ];
00215
00216
00217
NTSTATUS
00218
PspCreateThread(
00219 OUT PHANDLE ThreadHandle,
00220 IN ACCESS_MASK DesiredAccess,
00221 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
00222 IN HANDLE ProcessHandle,
00223 IN
PEPROCESS ProcessPointer,
00224 OUT PCLIENT_ID ClientId OPTIONAL,
00225 IN PCONTEXT ThreadContext OPTIONAL,
00226 IN PINITIAL_TEB InitialTeb OPTIONAL,
00227 IN BOOLEAN CreateSuspended,
00228 IN PKSTART_ROUTINE StartRoutine OPTIONAL,
00229 IN PVOID StartContext
00230 );
00231
00232
00233
00234
00235
00236
VOID
00237
PspUserThreadStartup(
00238 IN PKSTART_ROUTINE StartRoutine,
00239 IN PVOID StartContext
00240 );
00241
00242
VOID
00243
PspSystemThreadStartup(
00244 IN PKSTART_ROUTINE StartRoutine,
00245 IN PVOID StartContext
00246 );
00247
00248
VOID
00249
PspReaper(
00250 IN PVOID StartContext
00251 );
00252
00253
VOID
00254
PspNullSpecialApc(
00255 IN
PKAPC Apc,
00256 IN OUT PKNORMAL_ROUTINE *NormalRoutine,
00257 IN OUT PVOID *NormalContext,
00258 IN OUT PVOID *SystemArgument1,
00259 IN OUT PVOID *SystemArgument2
00260 );
00261
00262
00263
00264
00265
00266 DECLSPEC_NORETURN
00267
VOID
00268
PspExitThread(
00269 IN NTSTATUS ExitStatus
00270 );
00271
00272
NTSTATUS
00273
PspTerminateThreadByPointer(
00274 IN
PETHREAD Thread,
00275 IN NTSTATUS ExitStatus
00276 );
00277
00278
VOID
00279
PspExitSpecialApc(
00280 IN
PKAPC Apc,
00281 IN OUT PKNORMAL_ROUTINE *NormalRoutine,
00282 IN OUT PVOID *NormalContext,
00283 IN OUT PVOID *SystemArgument1,
00284 IN OUT PVOID *SystemArgument2
00285 );
00286
00287
VOID
00288
PspExitProcess(
00289 IN BOOLEAN TrimAddressSpace,
00290 IN
PEPROCESS Process
00291 );
00292
00293
00294
00295
00296
00297
00298
VOID
00299
PspSetContext(
00300 OUT PKTRAP_FRAME TrapFrame,
00301 OUT PKNONVOLATILE_CONTEXT_POINTERS NonVolatileContext,
00302 IN PCONTEXT Context,
00303 KPROCESSOR_MODE Mode
00304 );
00305
00306
VOID
00307
PspGetContext(
00308 IN PKTRAP_FRAME TrapFrame,
00309 IN PKNONVOLATILE_CONTEXT_POINTERS NonVolatileContext,
00310 IN OUT PCONTEXT Context
00311 );
00312
00313
VOID
00314
PspGetSetContextSpecialApc(
00315 IN
PKAPC Apc,
00316 IN OUT PKNORMAL_ROUTINE *NormalRoutine,
00317 IN OUT PVOID *NormalContext,
00318 IN OUT PVOID *SystemArgument1,
00319 IN OUT PVOID *SystemArgument2
00320 );
00321
00322
VOID
00323
PspExitNormalApc(
00324 IN PVOID NormalContext,
00325 IN PVOID SystemArgument1,
00326 IN PVOID SystemArgument2
00327 );
00328
00329
00330
00331
00332
00333
NTSTATUS
00334
PspInitializeProcessSecurity(
00335 IN
PEPROCESS Parent OPTIONAL,
00336 IN
PEPROCESS Child
00337 );
00338
00339
VOID
00340
PspDeleteProcessSecurity(
00341 IN
PEPROCESS Process
00342 );
00343
00344
VOID
00345
PspInitializeThreadSecurity(
00346 IN
PEPROCESS Process,
00347 IN
PETHREAD Thread
00348 );
00349
00350
VOID
00351
PspDeleteThreadSecurity(
00352 IN
PETHREAD Thread
00353 );
00354
00355
NTSTATUS
00356
PspAssignPrimaryToken(
00357 IN
PEPROCESS Process,
00358 IN HANDLE Token OPTIONAL,
00359 IN PACCESS_TOKEN TokenPointer OPTIONAL
00360 );
00361
00362
NTSTATUS
00363
PspSetPrimaryToken(
00364 IN HANDLE ProcessHandle,
00365 IN HANDLE TokenHandle OPTIONAL,
00366 IN PACCESS_TOKEN TokenPointer OPTIONAL
00367 );
00368
00369
00370
00371
00372
00373
#if defined(i386)
00374
NTSTATUS
00375
PspLdtInitialize(
00376 );
00377
#endif
00378
00379
00380
00381
00382
#if defined(i386)
00383
NTSTATUS
00384
PspVdmInitialize(
00385 );
00386
#endif
00387
00388
NTSTATUS
00389
PspQueryLdtInformation(
00390 IN
PEPROCESS Process,
00391 OUT PVOID LdtInformation,
00392 IN ULONG LdtInformationLength,
00393 OUT PULONG ReturnLength
00394 );
00395
00396
NTSTATUS
00397
PspSetLdtInformation(
00398 IN
PEPROCESS Process,
00399 IN PVOID LdtInformation,
00400 IN ULONG LdtInformationLength
00401 );
00402
00403
NTSTATUS
00404
PspSetLdtSize(
00405 IN
PEPROCESS Process,
00406 IN PVOID LdtSize,
00407 IN ULONG LdtSizeLength
00408 );
00409
00410
VOID
00411
PspDeleteLdt(
00412 IN
PEPROCESS Process
00413 );
00414
00415
00416
00417
00418
00419
00420
NTSTATUS
00421
PspSetProcessIoHandlers(
00422 IN
PEPROCESS Process,
00423 IN PVOID IoHandlerInformation,
00424 IN ULONG IoHandlerLength
00425 );
00426
00427
VOID
00428
PspDeleteVdmObjects(
00429 IN
PEPROCESS Process
00430 );
00431
00432
NTSTATUS
00433
PspQueryDescriptorThread (
00434
PETHREAD Thread,
00435 PVOID ThreadInformation,
00436 ULONG ThreadInformationLength,
00437 PULONG ReturnLength
00438 );
00439
00440
00441
00442
00443
00444
VOID
00445
PspJobDelete(
00446 IN PVOID Object
00447 );
00448
00449
VOID
00450
PspJobClose (
00451 IN
PEPROCESS Process,
00452 IN PVOID Object,
00453 IN ACCESS_MASK GrantedAccess,
00454 IN ULONG ProcessHandleCount,
00455 IN ULONG SystemHandleCount
00456 );
00457
00458
NTSTATUS
00459
PspAddProcessToJob(
00460
PEJOB Job,
00461
PEPROCESS Process
00462 );
00463
00464
VOID
00465
PspRemoveProcessFromJob(
00466
PEJOB Job,
00467
PEPROCESS Process
00468 );
00469
00470
VOID
00471
PspExitProcessFromJob(
00472
PEJOB Job,
00473
PEPROCESS Process
00474 );
00475
00476
NTSTATUS
00477
PspTerminateProcess(
00478
PEPROCESS Process,
00479 NTSTATUS Status,
00480 PSLOCKPROCESSMODE LockMode
00481 );
00482
00483
VOID
00484
PspApplyJobLimitsToProcessSet(
00485
PEJOB Job
00486 );
00487
00488
VOID
00489
PspApplyJobLimitsToProcess(
00490
PEJOB Job,
00491
PEPROCESS Process
00492 );
00493
00494 BOOLEAN
00495
PspTerminateAllProcessesInJob(
00496
PEJOB Job,
00497 NTSTATUS Status,
00498 PSLOCKPROCESSMODE LockMode
00499 );
00500
00501
VOID
00502
PspFoldProcessAccountingIntoJob(
00503
PEJOB Job,
00504
PEPROCESS Process
00505 );
00506
00507
NTSTATUS
00508
PspCaptureTokenFilter(
00509 KPROCESSOR_MODE PreviousMode,
00510 PJOBOBJECT_SECURITY_LIMIT_INFORMATION SecurityLimitInfo,
00511
PPS_JOB_TOKEN_FILTER * TokenFilter
00512 );
00513
00514
00515
00516
00517
00518
00519 extern PHANDLE_TABLE PspCidTable;
00520 extern HANDLE
PspInitialSystemProcessHandle;
00521 extern PACCESS_TOKEN
PspBootAccessToken;
00522 extern KSPIN_LOCK
PspEventPairLock;
00523 extern SYSTEM_DLL PspSystemDll;
00524 extern FAST_MUTEX PspActiveProcessMutex;
00525 extern FAST_MUTEX PspProcessLockMutex;
00526
00527 extern ULONG
PspDefaultPagedLimit;
00528 extern ULONG
PspDefaultNonPagedLimit;
00529 extern ULONG
PspDefaultPagefileLimit;
00530
00531 extern EPROCESS_QUOTA_BLOCK PspDefaultQuotaBlock;
00532 extern BOOLEAN
PspDoingGiveBacks;
00533
00534 extern PKWIN32_PROCESS_CALLOUT PspW32ProcessCallout;
00535 extern PKWIN32_THREAD_CALLOUT PspW32ThreadCallout;
00536 extern PKWIN32_JOB_CALLOUT PspW32JobCallout;
00537 extern ULONG
PspW32ProcessSize;
00538 extern ULONG
PspW32ThreadSize;
00539 extern SCHAR
PspForegroundQuantum[3];
00540
00541
00542 #define PSP_NUMBER_OF_SCHEDULING_CLASSES 10
00543 #define PSP_DEFAULT_SCHEDULING_CLASSES 5
00544
00545 extern SCHAR
PspJobSchedulingClasses[
PSP_NUMBER_OF_SCHEDULING_CLASSES];
00546 extern BOOLEAN
PspUseJobSchedulingClasses;
00547
00548 extern FAST_MUTEX PspJobListLock;
00549 extern LIST_ENTRY
PspJobList;
00550
00551
#endif // _PSP_