The comments mirror the inline declarations. Unless explicitly marked kernel-mode only, the class may be submitted from user mode, but it can still be unsupported, privilege-gated, or filtered on a particular Windows build.
The list spans Windows 10 and Windows 11-era selectors. Presence in this enum is not a support guarantee. Apply the runtime rules in windows-versioning.md and the evidence requirements in undocumented-contracts.md.
| Information class | Operation, buffer, and restrictions |
|---|---|
SystemBasicInformation |
q: SYSTEM_BASIC_INFORMATION (system layout, page size, processor count) |
SystemProcessorInformation |
q: SYSTEM_PROCESSOR_INFORMATION (CPU architecture and feature summary) |
SystemPerformanceInformation |
q: SYSTEM_PERFORMANCE_INFORMATION (global kernel performance counters) |
SystemTimeOfDayInformation |
q: SYSTEM_TIMEOFDAY_INFORMATION (boot and current time data) |
SystemPathInformation |
reserved/obsolete; no stable public contract |
SystemProcessInformation |
q: SYSTEM_PROCESS_INFORMATION[] (process and thread snapshot) |
SystemCallCountInformation |
q: system-call counters (legacy/version-sensitive) |
SystemDeviceInformation |
q: SYSTEM_DEVICE_INFORMATION (I/O device counts) |
SystemProcessorPerformanceInformation |
q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION[] (per-CPU timing) |
SystemFlagsInformation |
qs: SYSTEM_FLAGS_INFORMATION (kernel global flags; setting requires privilege) |
SystemCallTimeInformation |
q: system-call timing data (legacy/version-sensitive) |
SystemModuleInformation |
q: RTL_PROCESS_MODULES (loaded kernel modules; restricted on some systems) |
SystemLocksInformation |
q: kernel lock statistics (debug/internal) |
SystemStackTraceInformation |
q: kernel stack-trace database (debug/internal) |
SystemPagedPoolInformation |
q: paged-pool allocation data (kernel/debug internal) |
SystemNonPagedPoolInformation |
q: nonpaged-pool allocation data (kernel/debug internal) |
SystemHandleInformation |
q: legacy system handle table |
SystemObjectInformation |
q: object-manager type/object statistics |
SystemPageFileInformation |
q: SYSTEM_PAGEFILE_INFORMATION list |
SystemVdmInstemulInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemVdmBopInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemFileCacheInformation |
qs: SYSTEM_FILECACHE_INFORMATION (cache-manager sizing) |
SystemPoolTagInformation |
q: SYSTEM_POOLTAG_INFORMATION (kernel pool usage by tag) |
SystemInterruptInformation |
q: SYSTEM_INTERRUPT_INFORMATION[] (per-CPU interrupt counters) |
SystemDpcBehaviorInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemFullMemoryInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemLoadGdiDriverInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemUnloadGdiDriverInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemTimeAdjustmentInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSummaryMemoryInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemMirrorMemoryInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemPerformanceTraceInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemObsolete0 |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemExceptionInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemCrashDumpStateInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemKernelDebuggerInformation |
q: SYSTEM_KERNEL_DEBUGGER_INFORMATION |
SystemContextSwitchInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemRegistryQuotaInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemExtendServiceTableInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemPrioritySeparation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemVerifierAddDriverInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemVerifierRemoveDriverInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemProcessorIdleInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemLegacyDriverInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemCurrentTimeZoneInformation |
q: RTL_TIME_ZONE_INFORMATION |
SystemLookasideInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemTimeSlipNotification |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSessionCreate |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSessionDetach |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSessionInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemRangeStartInformation |
q: start of system address range (kernel address disclosure is restricted) |
SystemVerifierInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemVerifierThunkExtend |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSessionProcessInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemLoadGdiDriverInSystemSpace |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemNumaProcessorMap |
q: NUMA-node processor affinity map |
SystemPrefetcherInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemExtendedProcessInformation |
q: extended process/thread snapshot |
SystemRecommendedSharedDataAlignment |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemComPlusPackage |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemNumaAvailableMemory |
q: available memory per NUMA node |
SystemProcessorPowerInformation |
q: SYSTEM_PROCESSOR_POWER_INFORMATION[] |
SystemEmulationBasicInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemEmulationProcessorInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemExtendedHandleInformation |
q: SYSTEM_HANDLE_INFORMATION_EX (pointer-width-safe handle table) |
SystemLostDelayedWriteInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemBigPoolInformation |
q: SYSTEM_BIGPOOL_INFORMATION (large kernel pool allocations) |
SystemSessionPoolTagInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSessionMappedViewInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemHotpatchInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemObjectSecurityMode |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemWatchdogTimerHandler |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemWatchdogTimerInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemLogicalProcessorInformation |
q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION[] |
SystemWow64SharedInformationObsolete |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemRegisterFirmwareTableInformationHandler |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemFirmwareTableInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemModuleInformationEx |
q: extended loaded-kernel-module records |
SystemVerifierTriageInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSuperfetchInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemMemoryListInformation |
qs: SYSTEM_MEMORY_LIST_INFORMATION (memory-list state/control; privileged operations) |
SystemFileCacheInformationEx |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemThreadPriorityClientIdInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemProcessorIdleCycleTimeInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemVerifierCancellationInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemProcessorPowerInformationEx |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemRefTraceInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSpecialPoolInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemProcessIdInformation |
q: SYSTEM_PROCESS_ID_INFORMATION (resolve process image name by PID) |
SystemErrorPortInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemBootEnvironmentInformation |
q: SYSTEM_BOOT_ENVIRONMENT_INFORMATION |
SystemHypervisorInformation |
q: SYSTEM_HYPERVISOR_QUERY_INFORMATION |
SystemVerifierInformationEx |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemTimeZoneInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemImageFileExecutionOptionsInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemCoverageInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemPrefetchPatchInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemVerifierFaultsInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSystemPartitionInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSystemDiskInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemProcessorPerformanceDistribution |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemNumaProximityNodeInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemDynamicTimeZoneInformation |
q: RTL_DYNAMIC_TIME_ZONE_INFORMATION |
SystemCodeIntegrityInformation |
q: SYSTEM_CODEINTEGRITY_INFORMATION (Code Integrity options) |
SystemProcessorMicrocodeUpdateInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemProcessorBrandString |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemVirtualAddressInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemLogicalProcessorAndGroupInformation |
q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX[] |
SystemProcessorCycleTimeInformation |
q: per-processor cycle-time data |
SystemStoreInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemRegistryAppendString |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemAitSamplingValue |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemVhdBootInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemCpuQuotaInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemNativeBasicInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemErrorPortTimeouts |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemLowPriorityIoInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemTpmBootEntropyInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemVerifierCountersInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemPagedPoolInformationEx |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSystemPtesInformationEx |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemNodeDistanceInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemAcpiAuditInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemBasicPerformanceInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemQueryPerformanceCounterInformation |
q: performance-counter source/configuration |
SystemSessionBigPoolInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemBootGraphicsInformation |
q: boot graphics/framebuffer information |
SystemScrubPhysicalMemoryInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemBadPageInformation |
q: bad physical page information (privileged/version-sensitive) |
SystemProcessorProfileControlArea |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemCombinePhysicalMemoryInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemEntropyInterruptTimingInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemConsoleInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemPlatformBinaryInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemPolicyInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemHypervisorProcessorCountInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemDeviceDataInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemDeviceDataEnumerationInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemMemoryTopologyInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemMemoryChannelInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemBootLogoInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemProcessorPerformanceInformationEx |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemCriticalProcessErrorLogInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSecureBootPolicyInformation |
q: secure-boot policy metadata |
SystemPageFileInformationEx |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSecureBootInformation |
q: SYSTEM_SECUREBOOT_INFORMATION |
SystemEntropyInterruptTimingRawInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemPortableWorkspaceEfiLauncherInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemFullProcessInformation |
q: full process information including extension records |
SystemKernelDebuggerInformationEx |
q: extended kernel-debugger state |
SystemBootMetadataInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemSoftRebootInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemElamCertificateInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemOfflineDumpConfigInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemProcessorFeaturesInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemRegistryReconciliationInformation |
internal: operation, mode, privileges, and layout are version-sensitive |
SystemEdidInformation |
q: SYSTEM_EDID_INFORMATION |
SystemManufacturingInformation |
q: SYSTEM_MANUFACTURING_INFORMATION // since THRESHOLD |
SystemEnergyEstimationConfigInformation |
q: SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION |
SystemHypervisorDetailInformation |
q: SYSTEM_HYPERVISOR_DETAIL_INFORMATION |
SystemProcessorCycleStatsInformation |
q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION (EX in: USHORT ProcessorGroup) // NtQuerySystemInformationEx // 160 |
SystemVmGenerationCountInformation |
s: PHYSICAL_ADDRESS (kernel-mode only) (vmgencounter.sys) |
SystemTrustedPlatformModuleInformation |
q: SYSTEM_TPM_INFORMATION |
SystemKernelDebuggerFlags |
q: SYSTEM_KERNEL_DEBUGGER_FLAGS |
SystemCodeIntegrityPolicyInformation |
qs: SYSTEM_CODEINTEGRITYPOLICY_INFORMATION |
SystemIsolatedUserModeInformation |
q: SYSTEM_ISOLATED_USER_MODE_INFORMATION |
SystemHardwareSecurityTestInterfaceResultsInformation |
q: SYSTEM_HARDWARE_SECURITY_TEST_INTERFACE_RESULTS_INFORMATION |
SystemSingleModuleInformation |
q: SYSTEM_SINGLE_MODULE_INFORMATION |
SystemAllowedCpuSetsInformation |
s: SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION |
SystemVsmProtectionInformation |
q: SYSTEM_VSM_PROTECTION_INFORMATION (previously SystemDmaProtectionInformation) |
SystemInterruptCpuSetsInformation |
q: SYSTEM_INTERRUPT_CPU_SET_INFORMATION // 170 |
SystemSecureBootPolicyFullInformation |
q: SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION |
SystemCodeIntegrityPolicyFullInformation |
q: SYSTEM_CODE_INTEGRITY_POLICY_FULL_INFORMATION |
SystemAffinitizedInterruptProcessorInformation |
q: KAFFINITY_EX // (requires SeIncreaseBasePriorityPrivilege) |
SystemRootSiloInformation |
q: SYSTEM_ROOT_SILO_INFORMATION |
SystemCpuSetInformation |
q: SYSTEM_CPU_SET_INFORMATION // since THRESHOLD2 |
SystemCpuSetTagInformation |
q: SYSTEM_CPU_SET_TAG_INFORMATION |
SystemWin32WerStartCallout |
s: SYSTEM_WIN32_WER_START_CALLOUT (optional; 0-length uses current process) |
SystemSecureKernelProfileInformation |
q: SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION |
SystemCodeIntegrityPlatformManifestInformation |
q: SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION // NtQuerySystemInformationEx // since REDSTONE |
SystemInterruptSteeringInformation |
q: in: SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT, out: SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT // NtQuerySystemInformationEx |
SystemSupportedProcessorArchitectures |
p: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx // 180 |
SystemMemoryUsageInformation |
q: SYSTEM_MEMORY_USAGE_INFORMATION |
SystemCodeIntegrityCertificateInformation |
q: SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION |
SystemPhysicalMemoryInformation |
q: SYSTEM_PHYSICAL_MEMORY_INFORMATION // since REDSTONE2 |
SystemControlFlowTransition |
qs: SYSTEM_CONTROL_FLOW_TRANSITION // operation-tagged Warbird control-flow transition request |
SystemKernelDebuggingAllowed |
s: ULONG |
SystemActivityModerationExeState |
s: SYSTEM_ACTIVITY_MODERATION_EXE_STATE |
SystemActivityModerationUserSettings |
q: SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS |
SystemCodeIntegrityPoliciesFullInformation |
qs: SYSTEM_CODE_INTEGRITY_POLICIES_FULL_INFORMATION // NtQuerySystemInformationEx |
SystemCodeIntegrityUnlockInformation |
q: SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION // 190 |
SystemIntegrityQuotaInformation |
s: SYSTEM_INTEGRITY_QUOTA_INFORMATION (requires SeDebugPrivilege) |
SystemFlushInformation |
q: SYSTEM_FLUSH_INFORMATION |
SystemProcessorIdleMaskInformation |
q: ULONG_PTR[ActiveGroupCount] // since REDSTONE3 |
SystemSecureDumpEncryptionInformation |
qs: SYSTEM_SECURE_DUMP_ENCRYPTION_INFORMATION // NtQuerySystemInformationEx // opaque dump-key transform buffer (q: requires SeDebugPrivilege) (s: 0-length only, requires SeTcbPrivilege) |
SystemWriteConstraintInformation |
q: SYSTEM_WRITE_CONSTRAINT_INFORMATION |
SystemKernelVaShadowInformation |
q: SYSTEM_KERNEL_VA_SHADOW_INFORMATION |
SystemHypervisorSharedPageInformation |
q: SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION // since REDSTONE4 |
SystemFirmwareBootPerformanceInformation |
q: SYSTEM_FIRMWARE_BOOT_PERFORMANCE_INFORMATION // HaliQuerySystemInformation -> HalpFwBootPerformanceTable, info class 34 |
SystemCodeIntegrityVerificationInformation |
q: SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION |
SystemFirmwarePartitionInformation |
q: SYSTEM_FIRMWARE_PARTITION_INFORMATION // 200 |
SystemSpeculationControlInformation |
q: SYSTEM_SPECULATION_CONTROL_INFORMATION // (CVE-2017-5715) REDSTONE3 and above. |
SystemDmaGuardPolicyInformation |
q: SYSTEM_DMA_GUARD_POLICY_INFORMATION |
SystemEnclaveLaunchControlInformation |
q: SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION |
SystemWorkloadAllowedCpuSetsInformation |
q: SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION // since REDSTONE5 |
SystemCodeIntegrityUnlockModeInformation |
q: SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION |
SystemLeapSecondInformation |
qs: SYSTEM_LEAP_SECOND_INFORMATION // (s: requires SeSystemtimePrivilege) |
SystemFlags2Information |
q: SYSTEM_FLAGS_INFORMATION // (s: requires SeDebugPrivilege) |
SystemSecurityModelInformation |
q: SYSTEM_SECURITY_MODEL_INFORMATION // since 19H1 |
SystemCodeIntegritySyntheticCacheInformation |
qs: NtQuerySystemInformationEx |
SystemFeatureConfigurationInformation |
q: in: SYSTEM_FEATURE_CONFIGURATION_QUERY, out: SYSTEM_FEATURE_CONFIGURATION_INFORMATION; s: SYSTEM_FEATURE_CONFIGURATION_UPDATE // NtQuerySystemInformationEx // since 20H1 // 210 |
SystemFeatureConfigurationSectionInformation |
q: in: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST, out: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION // NtQuerySystemInformationEx |
SystemFeatureUsageSubscriptionInformation |
q: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS; s: SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE |
SystemSecureSpeculationControlInformation |
q: SECURE_SPECULATION_CONTROL_INFORMATION |
SystemSpacesBootInformation |
q: SYSTEM_SPACES_BOOT_INFORMATION // variable-length opaque blob copied from ExpSpacesBootInformation (kernel mode only) // since 20H2 |
SystemFwRamdiskInformation |
q: SYSTEM_FIRMWARE_RAMDISK_INFORMATION |
SystemWheaIpmiHardwareInformation |
q: SYSTEM_WHEA_IPMI_HARDWARE_INFORMATION |
SystemDifSetRuleClassInformation |
s: SYSTEM_DIF_VOLATILE_INFORMATION (requires SeDebugPrivilege) |
SystemDifClearRuleClassInformation |
s: NULL (requires SeDebugPrivilege) |
SystemDifApplyPluginVerificationOnDriver |
q: SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION (requires SeDebugPrivilege) |
SystemDifRemovePluginVerificationOnDriver |
q: SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION (requires SeDebugPrivilege) // 220 |
SystemShadowStackInformation |
q: SYSTEM_SHADOW_STACK_INFORMATION |
SystemBuildVersionInformation |
q: in: SYSTEM_BUILD_VERSION_INFORMATION_INPUT, out: SYSTEM_BUILD_VERSION_INFORMATION // NtQuerySystemInformationEx // CmQueryBuildVersionInformation |
SystemPoolLimitInformation |
q: SYSTEM_POOL_LIMIT_INFORMATION (requires SeIncreaseQuotaPrivilege) // NtQuerySystemInformationEx |
SystemCodeIntegrityAddDynamicStore |
q: CodeIntegrity-AllowConfigurablePolicy-CustomKernelSigners |
SystemCodeIntegrityClearDynamicStores |
q: CodeIntegrity-AllowConfigurablePolicy-CustomKernelSigners |
SystemDifPoolTrackingInformation |
s: SYSTEM_DIF_POOL_TRACKING_INFORMATION (requires SeDebugPrivilege) |
SystemPoolZeroingInformation |
q: SYSTEM_POOL_ZEROING_INFORMATION |
SystemDpcWatchdogInformation |
qs: SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION |
SystemDpcWatchdogInformation2 |
qs: SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION_V2 |
SystemSupportedProcessorArchitectures2 |
q: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx // 230 |
SystemSingleProcessorRelationshipInformation |
q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // (EX in: PROCESSOR_NUMBER Processor) // NtQuerySystemInformationEx |
SystemXfgCheckFailureInformation |
q: SYSTEM_XFG_FAILURE_INFORMATION |
SystemIommuStateInformation |
q: SYSTEM_IOMMU_STATE_INFORMATION // since 22H1 |
SystemHypervisorMinrootInformation |
q: SYSTEM_HYPERVISOR_MINROOT_INFORMATION |
SystemHypervisorBootPagesInformation |
q: SYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION |
SystemPointerAuthInformation |
q: SYSTEM_POINTER_AUTH_INFORMATION |
SystemSecureKernelDebuggerInformation |
q: in: SYSTEM_SECURE_KERNEL_DEBUGGER_INFORMATION_INPUT, out: SYSTEM_SECURE_KERNEL_DEBUGGER_INFORMATION // NtQuerySystemInformationEx // kernel mode only on this build |
SystemOriginalImageFeatureInformation |
q: in: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_INPUT, out: SYSTEM_ORIGINAL_IMAGE_FEATURE_INFORMATION_OUTPUT // NtQuerySystemInformationEx |
SystemMemoryNumaInformation |
q: SYSTEM_MEMORY_NUMA_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_INFORMATION_OUTPUT // NtQuerySystemInformationEx |
SystemMemoryNumaPerformanceInformation |
q: SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_INPUT, SYSTEM_MEMORY_NUMA_PERFORMANCE_INFORMATION_OUTPUT // since 24H2 // 240 |
SystemCodeIntegritySignedPoliciesFullInformation |
qs: NtQuerySystemInformationEx |
SystemSecureCoreInformation |
qs: SystemSecureSecretsInformation |
SystemTrustedAppsRuntimeInformation |
q: SYSTEM_TRUSTEDAPPS_RUNTIME_INFORMATION |
SystemBadPageInformationEx |
q: SYSTEM_BAD_PAGE_INFORMATION |
SystemResourceDeadlockTimeout |
q: ULONG |
SystemBreakOnContextUnwindFailureInformation |
q: ULONG (requires SeDebugPrivilege) |
SystemOslRamdiskInformation |
q: SYSTEM_OSL_RAMDISK_INFORMATION |
SystemCodeIntegrityPolicyManagementInformation |
q: SYSTEM_CODEINTEGRITYPOLICY_MANAGEMENT // since 25H2 |
SystemMemoryNumaCacheInformation |
q: SYSTEM_MEMORY_NUMA_CACHE_INFORMATION |
SystemProcessorFeaturesBitMapInformation |
q: ULONG64[2] // RTL_BITMAP_EX // RtlInitializeBitMapEx // 250 |
SystemRefTraceInformationEx |
q: SYSTEM_REF_TRACE_INFORMATION_EX |
SystemBasicProcessInformation |
q: SYSTEM_BASICPROCESS_INFORMATION |
SystemHandleCountInformation |
q: SYSTEM_HANDLECOUNT_INFORMATION |
SystemRuntimeAttestationReport |
q: SYSTEM_RUNTIME_REPORT_INPUT |
SystemPoolTagInformation2 |
q: SYSTEM_POOLTAG_INFORMATION2 // since 26H1 |
SystemCodeIntegrityEndpointSecurityInformation |
q: SYSTEM_CODE_INTEGRITY_ENDPOINT_SECURITY_INFORMATION |
MaxSystemInfoClass |
sentinel: one past the highest known system information class |
FileDirectoryInformation |
internal: operation, mode, access, and layout are version-sensitive |
FileFullDirectoryInformation |
q: FILE_FULL_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) |
FileBothDirectoryInformation |
q: FILE_BOTH_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) |
FileBasicInformation |
qs: FILE_BASIC_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) |
FileStandardInformation |
q: FILE_STANDARD_INFORMATION, FILE_STANDARD_INFORMATION_EX |
FileInternalInformation |
q: FILE_INTERNAL_INFORMATION |
FileEaInformation |
q: FILE_EA_INFORMATION (requires FILE_READ_EA) |
FileAccessInformation |
q: FILE_ACCESS_INFORMATION |
FileNameInformation |
q: FILE_NAME_INFORMATION |
FileRenameInformation |
s: FILE_RENAME_INFORMATION (requires DELETE) // 10 |
FileLinkInformation |
s: FILE_LINK_INFORMATION |
FileNamesInformation |
q: FILE_NAMES_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) |
FileDispositionInformation |
s: FILE_DISPOSITION_INFORMATION (requires DELETE) |
FilePositionInformation |
qs: FILE_POSITION_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) |
FileFullEaInformation |
q: FILE_FULL_EA_INFORMATION (requires FILE_READ_EA) |
FileModeInformation |
qs: FILE_MODE_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) |
FileAlignmentInformation |
q: FILE_ALIGNMENT_INFORMATION |
FileAllInformation |
q: FILE_ALL_INFORMATION |
FileAllocationInformation |
s: FILE_ALLOCATION_INFORMATION (requires FILE_WRITE_DATA) |
FileEndOfFileInformation |
s: FILE_END_OF_FILE_INFORMATION (requires FILE_WRITE_DATA) // 20 |
FileAlternateNameInformation |
q: FILE_NAME_INFORMATION |
FileStreamInformation |
q: FILE_STREAM_INFORMATION |
FilePipeInformation |
qs: FILE_PIPE_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) |
FilePipeLocalInformation |
q: FILE_PIPE_LOCAL_INFORMATION |
FilePipeRemoteInformation |
qs: FILE_PIPE_REMOTE_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) |
FileMailslotQueryInformation |
q: FILE_MAILSLOT_QUERY_INFORMATION |
FileMailslotSetInformation |
s: FILE_MAILSLOT_SET_INFORMATION |
FileCompressionInformation |
q: FILE_COMPRESSION_INFORMATION |
FileObjectIdInformation |
q: FILE_OBJECTID_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) |
FileCompletionInformation |
s: FILE_COMPLETION_INFORMATION // 30 |
FileMoveClusterInformation |
s: FILE_MOVE_CLUSTER_INFORMATION (requires FILE_WRITE_DATA) |
FileQuotaInformation |
q: FILE_QUOTA_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) |
FileReparsePointInformation |
q: FILE_REPARSE_POINT_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) |
FileNetworkOpenInformation |
q: FILE_NETWORK_OPEN_INFORMATION |
FileAttributeTagInformation |
q: FILE_ATTRIBUTE_TAG_INFORMATION |
FileTrackingInformation |
s: FILE_TRACKING_INFORMATION (requires FILE_WRITE_DATA) |
FileIdBothDirectoryInformation |
q: FILE_ID_BOTH_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) |
FileIdFullDirectoryInformation |
q: FILE_ID_FULL_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) |
FileValidDataLengthInformation |
s: FILE_VALID_DATA_LENGTH_INFORMATION (requires FILE_WRITE_DATA and/or SeManageVolumePrivilege) |
FileShortNameInformation |
s: FILE_NAME_INFORMATION (requires DELETE) // 40 |
FileIoCompletionNotificationInformation |
qs: FILE_IO_COMPLETION_NOTIFICATION_INFORMATION (q: requires FILE_READ_ATTRIBUTES; s: requires FILE_WRITE_ATTRIBUTES) // since VISTA |
FileIoStatusBlockRangeInformation |
s: FILE_IOSTATUSBLOCK_RANGE_INFORMATION (requires SeLockMemoryPrivilege) |
FileIoPriorityHintInformation |
qs: FILE_IO_PRIORITY_HINT_INFORMATION, FILE_IO_PRIORITY_HINT_INFORMATION_EX (q: requires FILE_READ_DATA) |
FileSfioReserveInformation |
qs: FILE_SFIO_RESERVE_INFORMATION (q: requires FILE_READ_DATA) |
FileSfioVolumeInformation |
q: FILE_SFIO_VOLUME_INFORMATION |
FileHardLinkInformation |
q: FILE_LINKS_INFORMATION |
FileProcessIdsUsingFileInformation |
q: FILE_PROCESS_IDS_USING_FILE_INFORMATION |
FileNormalizedNameInformation |
q: FILE_NAME_INFORMATION |
FileNetworkPhysicalNameInformation |
q: FILE_NETWORK_PHYSICAL_NAME_INFORMATION |
FileIdGlobalTxDirectoryInformation |
q: FILE_ID_GLOBAL_TX_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) // since WIN7 // 50 |
FileIsRemoteDeviceInformation |
q: FILE_IS_REMOTE_DEVICE_INFORMATION |
FileUnusedInformation |
q: |
FileNumaNodeInformation |
q: FILE_NUMA_NODE_INFORMATION |
FileStandardLinkInformation |
q: FILE_STANDARD_LINK_INFORMATION |
FileRemoteProtocolInformation |
q: FILE_REMOTE_PROTOCOL_INFORMATION |
FileRenameInformationBypassAccessCheck |
s: FILE_RENAME_INFORMATION // (kernel-mode only) // since WIN8 |
FileLinkInformationBypassAccessCheck |
s: FILE_LINK_INFORMATION // (kernel-mode only) |
FileVolumeNameInformation |
q: FILE_VOLUME_NAME_INFORMATION |
FileIdInformation |
q: FILE_ID_INFORMATION |
FileIdExtdDirectoryInformation |
q: FILE_ID_EXTD_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) // 60 |
FileReplaceCompletionInformation |
s: FILE_COMPLETION_INFORMATION // since WINBLUE |
FileHardLinkFullIdInformation |
q: FILE_LINK_ENTRY_FULL_ID_INFORMATION // FILE_LINKS_FULL_ID_INFORMATION |
FileIdExtdBothDirectoryInformation |
q: FILE_ID_EXTD_BOTH_DIR_INFORMATION (requires FILE_LIST_DIRECTORY) (NtQueryDirectoryFile[Ex]) // since THRESHOLD |
FileDispositionInformationEx |
s: FILE_DISPOSITION_INFO_EX (requires DELETE) // since REDSTONE |
FileRenameInformationEx |
s: FILE_RENAME_INFORMATION_EX |
FileRenameInformationExBypassAccessCheck |
s: FILE_RENAME_INFORMATION_EX // (kernel-mode only) |
FileDesiredStorageClassInformation |
qs: FILE_DESIRED_STORAGE_CLASS_INFORMATION // since REDSTONE2 |
FileStatInformation |
q: FILE_STAT_INFORMATION |
FileMemoryPartitionInformation |
s: FILE_MEMORY_PARTITION_INFORMATION // since REDSTONE3 |
FileStatLxInformation |
q: FILE_STAT_LX_INFORMATION (requires FILE_READ_ATTRIBUTES and FILE_READ_EA) // since REDSTONE4 // 70 |
FileCaseSensitiveInformation |
qs: FILE_CASE_SENSITIVE_INFORMATION |
FileLinkInformationEx |
s: FILE_LINK_INFORMATION_EX // since REDSTONE5 |
FileLinkInformationExBypassAccessCheck |
s: FILE_LINK_INFORMATION_EX // (kernel-mode only) |
FileStorageReserveIdInformation |
qs: FILE_STORAGE_RESERVE_ID_INFORMATION |
FileCaseSensitiveInformationForceAccessCheck |
qs: FILE_CASE_SENSITIVE_INFORMATION |
FileKnownFolderInformation |
qs: FILE_KNOWN_FOLDER_INFORMATION // since WIN11 |
FileStatBasicInformation |
qs: FILE_STAT_BASIC_INFORMATION // since 23H2 |
FileId64ExtdDirectoryInformation |
q: FILE_ID_64_EXTD_DIR_INFORMATION |
FileId64ExtdBothDirectoryInformation |
q: FILE_ID_64_EXTD_BOTH_DIR_INFORMATION |
FileIdAllExtdDirectoryInformation |
q: FILE_ID_ALL_EXTD_DIR_INFORMATION |
FileIdAllExtdBothDirectoryInformation |
q: FILE_ID_ALL_EXTD_BOTH_DIR_INFORMATION |
FileStreamReservationInformation |
q: FILE_STREAM_RESERVATION_INFORMATION // since 24H2 |
FileMupProviderInfo |
qs: MUP_PROVIDER_INFORMATION |
FileMaximumInformation |
sentinel: one past the highest known file information class |