?? ntifs.inc
字號:
_Type BYTE ? ; 0000h DISP_TYPE_* (original name Type)
Absolute BYTE ? ; 0001h
_Size BYTE ? ; 0002h (original name Size)
Inserted BYTE ? ; 0003h
SignalState SDWORD ? ; 0004h
WaitListHead LIST_ENTRY <> ; 0008h
DISPATCHER_HEADER ENDS
KWAIT_BLOCK STRUCT ; sizeof = 018h
WaitListEntry LIST_ENTRY <> ; 0000h
Thread PVOID ? ; 0008h PTR KTHREAD
Object PVOID ? ; 000Ch
NextWaitBlock PVOID ? ; 0010h PTR KWAIT_BLOCK
WaitKey WORD ? ; 0014h
WaitType WORD ? ; 0016h
KWAIT_BLOCK ENDS
PKWAIT_BLOCK typedef PTR KWAIT_BLOCK
PRKWAIT_BLOCK typedef PTR KWAIT_BLOCK
; Kernel object structure definitions
; Device Queue object and entry
KDEVICE_QUEUE STRUCT ; sizeof = 014h
_Type SWORD ? ; 0000h (original name Type)
_Size SWORD ? ; 0002h (original name Size)
DeviceListHead LIST_ENTRY <> ; 0004h
slLock DWORD ? ; 000Ch KSPIN_LOCK (original name Lock)
Busy BYTE ? ; 0010h BOOLEAN
db 3 dup(?) ; padding
KDEVICE_QUEUE ENDS
PKDEVICE_QUEUE typedef PTR KDEVICE_QUEUE
PRKDEVICE_QUEUE typedef PTR KDEVICE_QUEUE ; *RESTRICTED_POINTER
KDEVICE_QUEUE_ENTRY STRUCT ; sizeof = 010h
DeviceListEntry LIST_ENTRY <> ; 0000h
SortKey DWORD ? ; 0008h
Inserted BYTE ? ; 000Ch
db 3 dup(?) ; padding
KDEVICE_QUEUE_ENTRY ENDS
PKDEVICE_QUEUE_ENTRY typedef PTR KDEVICE_QUEUE_ENTRY
PRKDEVICE_QUEUE_ENTRY typedef PTR KDEVICE_QUEUE_ENTRY ; *RESTRICTED_POINTER
; begin_ntndis
; Event object
KEVENT STRUCT ; sizeof = 10h
Header DISPATCHER_HEADER <>
KEVENT ENDS
PKEVENT typedef PTR KEVENT
PRKEVENT typedef PTR KEVENT ; RESTRICTED_POINTER
; Mutant object
KMUTANT STRUCT ; sizeof = 020h
Header DISPATCHER_HEADER <>; 0000h
MutantListEntry LIST_ENTRY <> ; 0010h
OwnerThread PVOID ? ; 0018h PTR KTHREAD *RESTRICTED_POINTER
Abandoned BYTE ? ; 001Ch BOOLEAN
ApcDisable BYTE ? ; 001Dh
WORD ? ; 001Eh padding
KMUTANT ENDS
PKMUTANT typedef PTR KMUTANT
PRKMUTANT typedef PTR KMUTANT
; end_ntddk end_wdm
;typedef enum _POOL_TYPE {
NonPagedPool equ 0
PagedPool equ 1
NonPagedPoolMustSucceed equ 2
DontUseThisType equ 3
NonPagedPoolCacheAligned equ 4
PagedPoolCacheAligned equ 5
NonPagedPoolCacheAlignedMustS equ 6
MaxPoolType equ 7
; Time conversion routines
TIME_FIELDS STRUCT ; sizeof = 010h
Year SWORD ? ; 0000h range [1601...]
Month SWORD ? ; 0002h range [1..12]
Day SWORD ? ; 0004h range [1..31]
Hour SWORD ? ; 0006h range [0..23]
Minute SWORD ? ; 0008h range [0..59]
Second SWORD ? ; 000Ah range [0..59]
Milliseconds SWORD ? ; 000Ch range [0..999]
Weekday SWORD ? ; 000Eh range [0..6] == [Sunday..Saturday]
TIME_FIELDS ENDS
PTIME_FIELDS typedef PTR TIME_FIELDS
; Define the major function codes for IRPs.
IRP_MJ_CREATE equ 0
IRP_MJ_CREATE_NAMED_PIPE equ 1
IRP_MJ_CLOSE equ 2
IRP_MJ_READ equ 3
IRP_MJ_WRITE equ 4
IRP_MJ_QUERY_INFORMATION equ 5
IRP_MJ_SET_INFORMATION equ 6
IRP_MJ_QUERY_EA equ 7
IRP_MJ_SET_EA equ 8
IRP_MJ_FLUSH_BUFFERS equ 9
IRP_MJ_QUERY_VOLUME_INFORMATION equ 0Ah
IRP_MJ_SET_VOLUME_INFORMATION equ 0Bh
IRP_MJ_DIRECTORY_CONTROL equ 0Ch
IRP_MJ_FILE_SYSTEM_CONTROL equ 0Dh
IRP_MJ_DEVICE_CONTROL equ 0Eh
IRP_MJ_INTERNAL_DEVICE_CONTROL equ 0Fh
IRP_MJ_SHUTDOWN equ 10h
IRP_MJ_LOCK_CONTROL equ 11h
IRP_MJ_CLEANUP equ 12h
IRP_MJ_CREATE_MAILSLOT equ 13h
IRP_MJ_QUERY_SECURITY equ 14h
IRP_MJ_SET_SECURITY equ 15h
IRP_MJ_POWER equ 16h
IRP_MJ_SYSTEM_CONTROL equ 17h
IRP_MJ_DEVICE_CHANGE equ 18h
IRP_MJ_QUERY_QUOTA equ 19h
IRP_MJ_SET_QUOTA equ 1Ah
IRP_MJ_PNP equ 1Bh
IRP_MJ_PNP_POWER equ IRP_MJ_PNP ; Obsolete....
IRP_MJ_MAXIMUM_FUNCTION equ 1Bh
; begin_wdm
; Define Wait Context Block (WCB)
WAIT_CONTEXT_BLOCK STRUCT ; sizeof = 028h
WaitQueueEntry KDEVICE_QUEUE_ENTRY <> ; 0000h
DeviceRoutine PVOID ? ; 0010h PDRIVER_CONTROL
DeviceContext PVOID ? ; 0014h
NumberOfMapRegisters DWORD ? ; 0018h
DeviceObject PVOID ? ; 001Ch
CurrentIrp PVOID ? ; 0020h
BufferChainingDpc PVOID ? ; 0024h PTR KDPC
WAIT_CONTEXT_BLOCK ENDS
PWAIT_CONTEXT_BLOCK typedef PTR WAIT_CONTEXT_BLOCK
; end_wdm
CONTROLLER_OBJECT STRUCT
_Type SWORD ? ; 000h (original name Type)
_Size SWORD ? ; 002h (original name Size)
ControllerExtension PVOID ? ; 004h
DeviceWaitQueue KDEVICE_QUEUE <> ; 008h
Spare1 DWORD ? ; 01Ch
_Spare2 LARGE_INTEGER <> ; 020h (original name Spare2)
CONTROLLER_OBJECT ENDS
PCONTROLLER_OBJECT typedef PTR CONTROLLER_OBJECT
; begin_wdm
; Define Device Object (DO) flags
DO_VERIFY_VOLUME equ 00000002h
DO_BUFFERED_IO equ 00000004h
DO_EXCLUSIVE equ 00000008h
DO_DIRECT_IO equ 00000010h
DO_MAP_IO_BUFFER equ 00000020h
DO_DEVICE_HAS_NAME equ 00000040h
DO_DEVICE_INITIALIZING equ 00000080h
DO_SYSTEM_BOOT_PARTITION equ 00000100h
DO_LONG_TERM_REQUESTS equ 00000200h
DO_NEVER_LAST_DEVICE equ 00000400h
DO_SHUTDOWN_REGISTERED equ 00000800h
DO_BUS_ENUMERATED_DEVICE equ 00001000h
DO_POWER_PAGABLE equ 00002000h
DO_POWER_INRUSH equ 00004000h
DO_LOW_PRIORITY_FILESYSTEM equ 00010000h
; Device Object structure definition
DEVICE_OBJECT STRUCT ; sizeof = 0B8h
_Type SWORD ? ; 0000h (IO_TYPE_DEVICE = 3) (original field name Type)
_Size WORD ? ; 0002h (original name Size)
ReferenceCount SDWORD ? ; 0004h
DriverObject PVOID ? ; 0008h PTR DRIVER_OBJECT
NextDevice PVOID ? ; 000Ch PTR DEVICE_OBJECT
AttachedDevice PVOID ? ; 0010h PTR DEVICE_OBJECT
CurrentIrp PVOID ? ; 0014h PTR IRP
Timer PVOID ? ; 0018h PTR IO_TIMER
Flags DWORD ? ; 001Ch DO_*
Characteristics DWORD ? ; 0020h FILE_*
Vpb PVOID ? ; 0024h PTR VPB
DeviceExtension PVOID ? ; 0028h
DeviceType DWORD ? ; 002Ch DEVICE_TYPE
StackSize BYTE ? ; 0030h
db 3 dup(?); padding
UNION Queue
ListEntry LIST_ENTRY <> ; 0034h
Wcb WAIT_CONTEXT_BLOCK <> ; 0034h
ENDS ; Queue
AlignmentRequirement DWORD ? ; 005Ch
DeviceQueue KDEVICE_QUEUE <>; 0060h
Dpc KDPC <> ; 0074h
; The following field is for exclusive use by the filesystem to keep
; track of the number of Fsp threads currently using the device
ActiveThreadCount DWORD ? ; 0094h
SecurityDescriptor PVOID ? ; 0098h PSECURITY_DESCRIPTOR
DeviceLock KEVENT <> ; 009Ch
SectorSize WORD ? ; 00ACh
Spare1 WORD ? ; 00AEh
DeviceObjectExtension PVOID ? ; 00B0h PTR DEVOBJ_EXTENSION
Reserved PVOID ? ; 00B4h
DEVICE_OBJECT ENDS
PDEVICE_OBJECT typedef PTR DEVICE_OBJECT
DEVOBJ_EXTENSION STRUCT ; sizeof = 024h
_Type SWORD ? ; 0000h (original name Type)
_Size WORD ? ; 0002h (original name Size)
; Public part of the DeviceObjectExtension structure
DeviceObject PVOID ? ; 0004h PTR DEVICE_OBJECT owning device object
; *!!!* The fields below are not defined in original ntddk.h file *!!!*
; Use it on your own
PowerFlags DWORD ? ; 0008h
Dope PVOID ? ; 000Ch PTR DEVICE_OBJECT_POWER_EXTENSION
ExtensionFlags DWORD ? ; 0010h
DeviceNode PVOID ? ; 0014h
AttachedTo PVOID ? ; 0018h PTR DEVICE_OBJECT
FileObjectList LIST_ENTRY <> ; 001Ch
DEVOBJ_EXTENSION ENDS
PDEVOBJ_EXTENSION typedef PTR DEVOBJ_EXTENSION
DRIVER_OBJECT STRUCT ; sizeof= 0A8h
_Type SWORD ? ; 0000h (IO_TYPE_DRIVER = 4) (original field name Type)
_Size SWORD ? ; 0004h (original name Size)
; The following links all of the devices created by a single driver
; together on a list, and the Flags word provides an extensible flag
; location for driver objects.
DeviceObject PVOID ? ; 0004h PTR DEVICE_OBJECT
Flags DWORD ? ; 0008h
; The following section describes where the driver is loaded. The count
; field is used to count the number of times the driver has had its
; registered reinitialization routine invoked.
DriverStart PVOID ? ; 000Ch
DriverSize DWORD ? ; 0010h
DriverSection PVOID ? ; 0014h
DriverExtension PVOID ? ; 0018h PTR DRIVER_EXTENSION
; The driver name field is used by the error log thread
; determine the name of the driver that an I/O request is/was bound.
DriverName UNICODE_STRING <> ; 001Ch
; The following section is for registry support. Thise is a pointer
; to the path to the hardware information in the registry
HardwareDatabase PVOID ? ; 0024h PTR UNICODE_STRING
; The following section contains the optional pointer to an array of
; alternate entry points to a driver for "fast I/O" support. Fast I/O
; is performed by invoking the driver routine directly with separate
; parameters, rather than using the standard IRP call mechanism. Note
; that these functions may only be used for synchronous I/O, and when
; the file is cached.
FastIoDispatch PVOID ? ; 0028h PTR FAST_IO_DISPATCH
; The following section describes the entry points to this particular
; driver. Note that the major function dispatch table must be the last
; field in the object so that it remains extensible.
DriverInit PVOID ? ; 002Ch
DriverStartIo PVOID ? ; 0030h
DriverUnload PVOID ? ; 0034h
MajorFunction PVOID (IRP_MJ_MAXIMUM_FUNCTION + 1) dup(?) ; 0038h
DRIVER_OBJECT ENDS
PDRIVER_OBJECT typedef PTR DRIVER_OBJECT
; The following structure is pointed to by the SectionObject pointer field
; of a file object, and is allocated by the various NT file systems.
SECTION_OBJECT_POINTERS STRUCT ; sizeof = 0Ch
DataSectionObject PVOID ? ; 0000h
SharedCacheMap PVOID ? ; 0004h
ImageSectionObject PVOID ? ; 0008h
SECTION_OBJECT_POINTERS ENDS
PSECTION_OBJECT_POINTERS typedef PTR SECTION_OBJECT_POINTERS
; Define the format of a completion message.
IO_COMPLETION_CONTEXT STRUCT ; sizeof = 08h
Port PVOID ? ; 0000h
Key PVOID ? ; 0004h
IO_COMPLETION_CONTEXT ENDS
PIO_COMPLETION_CONTEXT typedef PTR IO_COMPLETION_CONTEXT
; Define File Object (FO) flags
FO_FILE_OPEN equ 00000001
FO_SYNCHRONOUS_IO equ 00000002
FO_ALERTABLE_IO equ 00000004
FO_NO_INTERMEDIATE_BUFFERING equ 00000008
FO_WRITE_THROUGH equ 00000010h
FO_SEQUENTIAL_ONLY equ 00000020h
FO_CACHE_SUPPORTED equ 00000040h
FO_NAMED_PIPE equ 00000080h
FO_STREAM_FILE equ 00000100h
FO_MAILSLOT equ 00000200h
FO_GENERATE_AUDIT_ON_CLOSE equ 00000400h
FO_DIRECT_DEVICE_OPEN equ 00000800h
FO_FILE_MODIFIED equ 00001000h
FO_FILE_SIZE_CHANGED equ 00002000h
FO_CLEANUP_COMPLETE equ 00004000h
FO_TEMPORARY_FILE equ 00008000h
FO_DELETE_ON_CLOSE equ 00010000h
FO_OPENED_CASE_SENSITIVE equ 00020000h
FO_HANDLE_CREATED equ 00040000h
FO_FILE_FAST_IO_READ equ 00080000h
FO_RANDOM_ACCESS equ 00100000h
FO_FILE_OPEN_CANCELLED equ 00200000h
FO_VOLUME_OPEN equ 00400000h
FO_REMOTE_ORIGIN equ 01000000h
FILE_OBJECT STRUCT ; sizeof = 070h
_Type SWORD ? ; 0000h IO_TYPE_FILE (original field name Type)
_Size SWORD ? ; 0002h (original name Size)
DeviceObject PVOID ? ; 0004h PTR DEVICE_OBJECT
Vpb PVOID ? ; 0008h PTR VPB
FsContext PVOID ? ; 000Ch
FsContext2 PVOID ? ; 0010h
SectionObjectPointer PVOID ? ; 0014h PTR SECTION_OBJECT_POINTERS
PrivateCacheMap PVOID ? ; 0018h
FinalStatus SDWORD ? ; 001Ch NTSTATUS
RelatedFileObject PVOID ? ; 0020h PTR FILE_OBJECT
LockOperation BYTE ? ; 0024h BOOLEAN
DeletePending BYTE ? ; 0025h BOOLEAN
ReadAccess BYTE ? ; 0026h BOOLEAN
WriteAccess BYTE ? ; 0027h BOOLEAN
DeleteAccess BYTE ? ; 0028h BOOLEAN
SharedRead BYTE ? ; 0029h BOOLEAN
SharedWrite ?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -