Skip to content

custom-structures.md

Latest commit

 

History

History
46 lines (41 loc) · 3.36 KB

custom-structures.md

File metadata and controls

46 lines (41 loc) · 3.36 KB
Raw

Custom structure guide

All types live in custom_defs to avoid collisions with SDK declarations. Variable- length members written as [1] are trailing arrays: allocate according to the size returned by the native query, not sizeof(struct) alone.

Layouts must be verified on the exact Windows 10/11 build and architecture under test. Internal PEB/loader/object layouts are not made stable by namespace scoping.

Type Use and mode notes
SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX One pointer-width-safe system handle-table entry; returned as part of SYSTEM_HANDLE_INFORMATION_EX.
SYSTEM_HANDLE_INFORMATION_EX Variable-length handle snapshot returned by the extended handle information class.
SYSTEM_PROCESS_INFORMATION Variable-length process record followed by thread records; NextEntryOffset walks the list.
RTL_PROCESS_MODULE_INFORMATION Describes one loaded kernel module in an RTL_PROCESS_MODULES result.
RTL_PROCESS_MODULES Variable-length loaded kernel-module list.
SYSTEM_MEMORY_LIST_INFORMATION Memory-manager page-list counters; some set operations are privileged.
SYSTEM_BIGPOOL_ENTRY One large kernel-pool allocation record; the low address bit is used as a nonpaged flag.
SYSTEM_BIGPOOL_INFORMATION Variable-length list of large kernel-pool allocations.
OBJECT_TYPE_INFORMATION Object-manager type metadata and accounting; internal and version-sensitive.
OBJECT_ALL_INFORMATION Variable-length collection of OBJECT_TYPE_INFORMATION records.
OBJECT_NAME_INFORMATION Variable-length object-manager name.
OBJECT_BASIC_INFORMATION Object-manager handle/reference accounting and access metadata.
RTL_DRIVE_LETTER_CURDIR Per-drive current-directory state stored in process parameters.
RTL_USER_PROCESS_PARAMETERS Internal process startup parameters; layout is version-sensitive.
PEB_LDR_DATA Loader bookkeeping reachable through the PEB; internal user-mode structure.
LDR_DATA_TABLE_ENTRY One loader module entry; internal and version-sensitive.
PROCESS_DEBUG_PORT_INFO Buffer for process debug-port information.
PROCESS_DEBUG_OBJECT_HANDLE_INFO Buffer for the process debug-object handle and presence state.
PROCESS_DEBUG_FLAGS_INFO Buffer controlling/querying debug inheritance semantics.
MEMORY_REGION_INFORMATION Internal virtual-memory region metadata.
SECTION_IMAGE_INFORMATION Image-section execution and loader metadata.
THREAD_BASIC_INFORMATION Basic native thread status, TEB address, and client identifiers.
SYSTEM_POOLTAG Pool allocation/frees/bytes aggregated by four-byte tag.
SYSTEM_POOLTAG_INFORMATION Variable-length pool-tag statistics list.
SYSTEM_ATOM_TABLE_ENTRY One system atom-table entry.
KEY_VALUE_PARTIAL_INFORMATION Registry value metadata with inline data bytes.
KEY_VALUE_FULL_INFORMATION Registry value metadata with inline name and offset-addressed data.
SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION Per-processor kernel/user/idle/DPC/interrupt timing.
ATOM_BASIC_INFORMATION Basic atom usage, flags, and inline name.

Helper

custom_defs::InitializeObjectAttributes initializes every OBJECT_ATTRIBUTES field, including clearing SecurityQualityOfService. The SDK macro with the same name is undefined in this header so the scoped helper remains callable.