Teddy Rogers Posted July 11, 2013 Posted July 11, 2013 I came across this nice article from Matthew Graeber regarding NtQuerySystemInformation and it's undocumented structures of the function. Thought others here may find it of interest... enum _SYSTEM_INFORMATION_CLASS{SystemBasicInformation=0x0000,SystemProcessorInformation=0x0001,SystemPerformanceInformation=0x0002,SystemTimeOfDayInformation=0x0003,SystemPathInformation=0x0004,SystemProcessInformation=0x0005,SystemCallCountInformation=0x0006,SystemDeviceInformation=0x0007,SystemProcessorPerformanceInformation=0x0008,SystemFlagsInformation=0x0009,SystemCallTimeInformation=0x000A,SystemModuleInformation=0x000B,SystemLocksInformation=0x000C,SystemStackTraceInformation=0x000D,SystemPagedPoolInformation=0x000E,SystemNonPagedPoolInformation=0x000F,SystemHandleInformation=0x0010,SystemObjectInformation=0x0011,SystemPageFileInformation=0x0012,SystemVdmInstemulInformation=0x0013,SystemVdmBopInformation=0x0014,SystemFileCacheInformation=0x0015,SystemPoolTagInformation=0x0016,SystemInterruptInformation=0x0017,SystemDpcBehaviorInformation=0x0018,SystemFullMemoryInformation=0x0019,SystemLoadGdiDriverInformation=0x001A,SystemUnloadGdiDriverInformation=0x001B,SystemTimeAdjustmentInformation=0x001C,SystemSummaryMemoryInformation=0x001D,SystemMirrorMemoryInformation=0x001E,SystemPerformanceTraceInformation=0x001F,SystemCrashDumpInformation=0x0020,SystemExceptionInformation=0x0021,SystemCrashDumpStateInformation=0x0022,SystemKernelDebuggerInformation=0x0023,SystemContextSwitchInformation=0x0024,SystemRegistryQuotaInformation=0x0025,SystemExtendServiceTableInformation=0x0026,SystemPrioritySeperation=0x0027,SystemVerifierAddDriverInformation=0x0028,SystemVerifierRemoveDriverInformation=0x0029,SystemProcessorIdleInformation=0x002A,SystemLegacyDriverInformation=0x002B,SystemCurrentTimeZoneInformation=0x002C,SystemLookasideInformation=0x002D,SystemTimeSlipNotification=0x002E,SystemSessionCreate=0x002F,SystemSessionDetach=0x0030,SystemSessionInformation=0x0031,SystemRangeStartInformation=0x0032,SystemVerifierInformation=0x0033,SystemVerifierThunkExtend=0x0034,SystemSessionProcessInformation=0x0035,SystemLoadGdiDriverInSystemSpace=0x0036,SystemNumaProcessorMap=0x0037,SystemPrefetcherInformation=0x0038,SystemExtendedProcessInformation=0x0039,SystemRecommendedSharedDataAlignment=0x003A,SystemComPlusPackage=0x003B,SystemNumaAvailableMemory=0x003C,SystemProcessorPowerInformation=0x003D,SystemEmulationBasicInformation=0x003E,SystemEmulationProcessorInformation=0x003F,SystemExtendedHandleInformation=0x0040,SystemLostDelayedWriteInformation=0x0041,SystemBigPoolInformation=0x0042,SystemSessionPoolTagInformation=0x0043,SystemSessionMappedViewInformation=0x0044,SystemHotpatchInformation=0x0045,SystemObjectSecurityMode=0x0046,SystemWatchdogTimerHandler=0x0047,SystemWatchdogTimerInformation=0x0048,SystemLogicalProcessorInformation=0x0049,SystemWow64SharedInformationObsolete=0x004A,SystemRegisterFirmwareTableInformationHandler=0x004B,SystemFirmwareTableInformation=0x004C,SystemModuleInformationEx=0x004D,SystemVerifierTriageInformation=0x004E,SystemSuperfetchInformation=0x004F,SystemMemoryListInformation=0x0050,SystemFileCacheInformationEx=0x0051,SystemThreadPriorityClientIdInformation=0x0052,SystemProcessorIdleCycleTimeInformation=0x0053,SystemVerifierCancellationInformation=0x0054,SystemProcessorPowerInformationEx=0x0055,SystemRefTraceInformation=0x0056,SystemSpecialPoolInformation=0x0057,SystemProcessIdInformation=0x0058,SystemErrorPortInformation=0x0059,SystemBootEnvironmentInformation=0x005A,SystemHypervisorInformation=0x005B,SystemVerifierInformationEx=0x005C,SystemTimeZoneInformation=0x005D,SystemImageFileExecutionOptionsInformation=0x005E,SystemCoverageInformation=0x005F,SystemPrefetchPatchInformation=0x0060,SystemVerifierFaultsInformation=0x0061,SystemSystemPartitionInformation=0x0062,SystemSystemDiskInformation=0x0063,SystemProcessorPerformanceDistribution=0x0064,SystemNumaProximityNodeInformation=0x0065,SystemDynamicTimeZoneInformation=0x0066,SystemCodeIntegrityInformation=0x0067,SystemProcessorMicrocodeUpdateInformation=0x0068,SystemProcessorBrandString=0x0069,SystemVirtualAddressInformation=0x006A,SystemLogicalProcessorAndGroupInformation=0x006B,SystemProcessorCycleTimeInformation=0x006C,SystemStoreInformation=0x006D,SystemRegistryAppendString=0x006E,SystemAitSamplingValue=0x006F,SystemVhdBootInformation=0x0070,SystemCpuQuotaInformation=0x0071,SystemNativeBasicInformation=0x0072,SystemErrorPortTimeouts=0x0073,SystemLowPriorityIoInformation=0x0074,SystemBootEntropyInformation=0x0075,SystemVerifierCountersInformation=0x0076,SystemPagedPoolInformationEx=0x0077,SystemSystemPtesInformationEx=0x0078,SystemNodeDistanceInformation=0x0079,SystemAcpiAuditInformation=0x007A,SystemBasicPerformanceInformation=0x007B,SystemQueryPerformanceCounterInformation=0x007C,SystemSessionBigPoolInformation=0x007D,SystemBootGraphicsInformation=0x007E,SystemScrubPhysicalMemoryInformation=0x007F,SystemBadPageInformation=0x0080,SystemProcessorProfileControlArea=0x0081,SystemCombinePhysicalMemoryInformation=0x0082,SystemEntropyInterruptTimingInformation=0x0083,SystemConsoleInformation=0x0084,SystemPlatformBinaryInformation=0x0085,SystemThrottleNotificationInformation=0x0086,SystemHypervisorProcessorCountInformation=0x0087,SystemDeviceDataInformation=0x0088,SystemDeviceDataEnumerationInformation=0x0089,SystemMemoryTopologyInformation=0x008A,SystemMemoryChannelInformation=0x008B,SystemBootLogoInformation=0x008C,SystemProcessorPerformanceInformationEx=0x008D,SystemSpare0=0x008E,SystemSecureBootPolicyInformation=0x008F,SystemPageFileInformationEx=0x0090,SystemSecureBootInformation=0x0091,SystemEntropyInterruptTimingRawInformation=0x0092,SystemPortableWorkspaceEfiLauncherInformation=0x0093,SystemFullProcessInformation=0x0094,MaxSystemInfoClass=0x0095};typedef unsigned short USHORT, *USHORT_PTR;typedef PVOID HANDLE;typedef struct _UNICODE_STRING // Size=8{USHORT Length; // Size=2 Offset=0USHORT MaximumLength; // Size=2 Offset=2USHORT_PTR Buffer; // Size=4 Offset=4} UNICODE_STRING, *PUNICODE_STRING;typedef struct _LARGE_INTEGER // Size=8{ULONG LowPart; // Size=4 Offset=0LONG HighPart; // Size=4 Offset=4} LARGE_INTEGER;typedef struct _GENERIC_MAPPING // Size=16{ULONG GenericRead; // Size=4 Offset=0ULONG GenericWrite; // Size=4 Offset=4ULONG GenericExecute; // Size=4 Offset=8ULONG GenericAll; // Size=4 Offset=12} GENERIC_MAPPING;struct _SYSTEM_BASIC_INFORMATION // Size=44{ULONG Reserved; // Size=4 Offset=0ULONG TimerResolution; // Size=4 Offset=4ULONG PageSize; // Size=4 Offset=8ULONG NumberOfPhysicalPages; // Size=4 Offset=12ULONG LowestPhysicalPageNumber; // Size=4 Offset=16ULONG HighestPhysicalPageNumber; // Size=4 Offset=20ULONG AllocationGranularity; // Size=4 Offset=24ULONG MinimumUserModeAddress; // Size=4 Offset=28ULONG MaximumUserModeAddress; // Size=4 Offset=32ULONG ActiveProcessorsAffinityMask; // Size=4 Offset=36UCHAR NumberOfProcessors; // Size=1 Offset=40};struct _SYSTEM_PROCESSOR_INFORMATION // Size=12{USHORT ProcessorArchitecture; // Size=2 Offset=0USHORT ProcessorLevel; // Size=2 Offset=2USHORT ProcessorRevision; // Size=2 Offset=4USHORT MaximumProcessors; // Size=2 Offset=6ULONG ProcessorFeatureBits; // Size=4 Offset=8};struct _SYSTEM_PERFORMANCE_INFORMATION // Size=344{LARGE_INTEGER IdleProcessTime; // Size=8 Offset=0LARGE_INTEGER IoReadTransferCount; // Size=8 Offset=8LARGE_INTEGER IoWriteTransferCount; // Size=8 Offset=16LARGE_INTEGER IoOtherTransferCount; // Size=8 Offset=24ULONG IoReadOperationCount; // Size=4 Offset=32ULONG IoWriteOperationCount; // Size=4 Offset=36ULONG IoOtherOperationCount; // Size=4 Offset=40ULONG AvailablePages; // Size=4 Offset=44ULONG CommittedPages; // Size=4 Offset=48ULONG CommitLimit; // Size=4 Offset=52ULONG PeakCommitment; // Size=4 Offset=56ULONG PageFaultCount; // Size=4 Offset=60ULONG CopyOnWriteCount; // Size=4 Offset=64ULONG TransitionCount; // Size=4 Offset=68ULONG CacheTransitionCount; // Size=4 Offset=72ULONG DemandZeroCount; // Size=4 Offset=76ULONG PageReadCount; // Size=4 Offset=80ULONG PageReadIoCount; // Size=4 Offset=84ULONG CacheReadCount; // Size=4 Offset=88ULONG CacheIoCount; // Size=4 Offset=92ULONG DirtyPagesWriteCount; // Size=4 Offset=96ULONG DirtyWriteIoCount; // Size=4 Offset=100ULONG MappedPagesWriteCount; // Size=4 Offset=104ULONG MappedWriteIoCount; // Size=4 Offset=108ULONG PagedPoolPages; // Size=4 Offset=112ULONG NonPagedPoolPages; // Size=4 Offset=116ULONG PagedPoolAllocs; // Size=4 Offset=120ULONG PagedPoolFrees; // Size=4 Offset=124ULONG NonPagedPoolAllocs; // Size=4 Offset=128ULONG NonPagedPoolFrees; // Size=4 Offset=132ULONG FreeSystemPtes; // Size=4 Offset=136ULONG ResidentSystemCodePage; // Size=4 Offset=140ULONG TotalSystemDriverPages; // Size=4 Offset=144ULONG TotalSystemCodePages; // Size=4 Offset=148ULONG NonPagedPoolLookasideHits; // Size=4 Offset=152ULONG PagedPoolLookasideHits; // Size=4 Offset=156ULONG AvailablePagedPoolPages; // Size=4 Offset=160ULONG ResidentSystemCachePage; // Size=4 Offset=164ULONG ResidentPagedPoolPage; // Size=4 Offset=168ULONG ResidentSystemDriverPage; // Size=4 Offset=172ULONG CcFastReadNoWait; // Size=4 Offset=176ULONG CcFastReadWait; // Size=4 Offset=180ULONG CcFastReadResourceMiss; // Size=4 Offset=184ULONG CcFastReadNotPossible; // Size=4 Offset=188ULONG CcFastMdlReadNoWait; // Size=4 Offset=192ULONG CcFastMdlReadWait; // Size=4 Offset=196ULONG CcFastMdlReadResourceMiss; // Size=4 Offset=200ULONG CcFastMdlReadNotPossible; // Size=4 Offset=204ULONG CcMapDataNoWait; // Size=4 Offset=208ULONG CcMapDataWait; // Size=4 Offset=212ULONG CcMapDataNoWaitMiss; // Size=4 Offset=216ULONG CcMapDataWaitMiss; // Size=4 Offset=220ULONG CcPinMappedDataCount; // Size=4 Offset=224ULONG CcPinReadNoWait; // Size=4 Offset=228ULONG CcPinReadWait; // Size=4 Offset=232ULONG CcPinReadNoWaitMiss; // Size=4 Offset=236ULONG CcPinReadWaitMiss; // Size=4 Offset=240ULONG CcCopyReadNoWait; // Size=4 Offset=244ULONG CcCopyReadWait; // Size=4 Offset=248ULONG CcCopyReadNoWaitMiss; // Size=4 Offset=252ULONG CcCopyReadWaitMiss; // Size=4 Offset=256ULONG CcMdlReadNoWait; // Size=4 Offset=260ULONG CcMdlReadWait; // Size=4 Offset=264ULONG CcMdlReadNoWaitMiss; // Size=4 Offset=268ULONG CcMdlReadWaitMiss; // Size=4 Offset=272ULONG CcReadAheadIos; // Size=4 Offset=276ULONG CcLazyWriteIos; // Size=4 Offset=280ULONG CcLazyWritePages; // Size=4 Offset=284ULONG CcDataFlushes; // Size=4 Offset=288ULONG CcDataPages; // Size=4 Offset=292ULONG ContextSwitches; // Size=4 Offset=296ULONG FirstLevelTbFills; // Size=4 Offset=300ULONG SecondLevelTbFills; // Size=4 Offset=304ULONG SystemCalls; // Size=4 Offset=308ULONGLONG CcTotalDirtyPages; // Size=8 Offset=312ULONGLONG CcDirtyPageThreshold; // Size=8 Offset=320LONGLONG ResidentAvailablePages; // Size=8 Offset=328ULONGLONG SharedCommittedPages; // Size=8 Offset=336};struct _SYSTEM_TIMEOFDAY_INFORMATION // Size=48{LARGE_INTEGER BootTime; // Size=8 Offset=0LARGE_INTEGER CurrentTime; // Size=8 Offset=8LARGE_INTEGER TimeZoneBias; // Size=8 Offset=16ULONG TimeZoneId; // Size=4 Offset=24ULONG Reserved; // Size=4 Offset=28ULONGLONG BootTimeBias; // Size=8 Offset=32ULONGLONG SleepTimeBias; // Size=8 Offset=40};typedef struct _SYSTEM_PROCESS_INFORMATION // Size=184{ULONG NextEntryOffset; // Size=4 Offset=0ULONG NumberOfThreads; // Size=4 Offset=4LARGE_INTEGER WorkingSetPrivateSize; // Size=8 Offset=8ULONG HardFaultCount; // Size=4 Offset=16ULONG NumberOfThreadsHighWatermark; // Size=4 Offset=20ULONGLONG CycleTime; // Size=8 Offset=24LARGE_INTEGER CreateTime; // Size=8 Offset=32LARGE_INTEGER UserTime; // Size=8 Offset=40LARGE_INTEGER KernelTime; // Size=8 Offset=48UNICODE_STRING ImageName; // Size=8 Offset=56LONG BasePriority; // Size=4 Offset=64PVOID UniqueProcessId; // Size=4 Offset=68PVOID InheritedFromUniqueProcessId; // Size=4 Offset=72ULONG HandleCount; // Size=4 Offset=76ULONG SessionId; // Size=4 Offset=80ULONG UniqueProcessKey; // Size=4 Offset=84ULONG PeakVirtualSize; // Size=4 Offset=88ULONG VirtualSize; // Size=4 Offset=92ULONG PageFaultCount; // Size=4 Offset=96ULONG PeakWorkingSetSize; // Size=4 Offset=100ULONG WorkingSetSize; // Size=4 Offset=104ULONG QuotaPeakPagedPoolUsage; // Size=4 Offset=108ULONG QuotaPagedPoolUsage; // Size=4 Offset=112ULONG QuotaPeakNonPagedPoolUsage; // Size=4 Offset=116ULONG QuotaNonPagedPoolUsage; // Size=4 Offset=120ULONG PagefileUsage; // Size=4 Offset=124ULONG PeakPagefileUsage; // Size=4 Offset=128ULONG PrivatePageCount; // Size=4 Offset=132LARGE_INTEGER ReadOperationCount; // Size=8 Offset=136LARGE_INTEGER WriteOperationCount; // Size=8 Offset=144LARGE_INTEGER OtherOperationCount; // Size=8 Offset=152LARGE_INTEGER ReadTransferCount; // Size=8 Offset=160LARGE_INTEGER WriteTransferCount; // Size=8 Offset=168LARGE_INTEGER OtherTransferCount; // Size=8 Offset=176} SYSTEM_PROCESS_INFORMATION;struct _SYSTEM_CALL_COUNT_INFORMATION // Size=8{ULONG Length; // Size=4 Offset=0ULONG NumberOfTables; // Size=4 Offset=4};struct _SYSTEM_DEVICE_INFORMATION // Size=24{ULONG NumberOfDisks; // Size=4 Offset=0ULONG NumberOfFloppies; // Size=4 Offset=4ULONG NumberOfCdRoms; // Size=4 Offset=8ULONG NumberOfTapes; // Size=4 Offset=12ULONG NumberOfSerialPorts; // Size=4 Offset=16ULONG NumberOfParallelPorts; // Size=4 Offset=20};struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION // Size=48{LARGE_INTEGER IdleTime; // Size=8 Offset=0LARGE_INTEGER KernelTime; // Size=8 Offset=8LARGE_INTEGER UserTime; // Size=8 Offset=16LARGE_INTEGER DpcTime; // Size=8 Offset=24LARGE_INTEGER InterruptTime; // Size=8 Offset=32ULONG InterruptCount; // Size=4 Offset=40};typedef enum _SYSTEM_GLOBAL_FLAGS{FLG_DISABLE_DBGPRINT=0x08000000,FLG_KERNEL_STACK_TRACE_DB=0x00002000,FLG_USER_STACK_TRACE_DB=0x00001000,FLG_DEBUG_INITIAL_COMMAND=0x00000004,FLG_DEBUG_INITIAL_COMMAND_EX=0x04000000,FLG_HEAP_DISABLE_COALESCING=0x00200000,FLG_DISABLE_PAGE_KERNEL_STACKS=0x00080000,FLG_DISABLE_PROTDLLS=0x80000000,FLG_DISABLE_STACK_EXTENSION=0x00010000,FLG_CRITSEC_EVENT_CREATION=0x10000000,FLG_APPLICATION_VERIFIER=0x00000100,FLG_ENABLE_HANDLE_EXCEPTIONS=0x40000000,FLG_ENABLE_CLOSE_EXCEPTIONS=0x00400000,FLG_ENABLE_CSRDEBUG=0x00020000,FLG_ENABLE_EXCEPTION_LOGGING=0x00800000,FLG_HEAP_ENABLE_FREE_CHECK=0x00000020,FLG_HEAP_VALIDATE_PARAMETERS=0x00000040,FLG_HEAP_ENABLE_TAGGING=0x00000800,FLG_HEAP_ENABLE_TAG_BY_DLL=0x00008000,FLG_HEAP_ENABLE_TAIL_CHECK=0x00000010,FLG_HEAP_VALIDATE_ALL=0x00000080,FLG_ENABLE_KDEBUG_SYMBOL_LOAD=0x00040000,FLG_ENABLE_HANDLE_TYPE_TAGGING=0x01000000,FLG_HEAP_PAGE_ALLOCS=0x02000000,FLG_POOL_ENABLE_TAGGING=0x00000400,FLG_ENABLE_SYSTEM_CRIT_BREAKS=0x00100000,FLG_MAINTAIN_OBJECT_TYPELIST=0x00004000,FLG_MONITOR_SILENT_PROCESS_EXIT=0x00000200,FLG_SHOW_LDR_SNAPS=0x00000002,FLG_STOP_ON_EXCEPTION=0x00000001,FLG_STOP_ON_HUNG_GUI=0x00000008} SYSTEM_GLOBAL_FLAGS;struct _SYSTEM_FLAGS_INFORMATION // Size=4{SYSTEM_GLOBAL_FLAGS Flags; // Size=4 Offset=0};struct _SYSTEM_CALL_TIME_INFORMATION // Size=16{ULONG Length; // Size=4 Offset=0ULONG TotalCalls; // Size=4 Offset=4LARGE_INTEGER TimeOfCalls[1]; // Size=8 Offset=8};typedef struct _SYSTEM_MODULE // Size=280{USHORT Reserved1; // Size=2 Offset=0USHORT Reserved2; // Size=2 Offset=2ULONG ImageBaseAddress; // Size=4 Offset=4ULONG ImageSize; // Size=4 Offset=8ULONG Flags; // Size=4 Offset=12USHORT Index; // Size=2 Offset=16USHORT Rank; // Size=2 Offset=18USHORT LoadCount; // Size=2 Offset=20USHORT NameOffset; // Size=2 Offset=22UCHAR Name[256]; // Size=256 Offset=24} SYSTEM_MODULE;struct _SYSTEM_MODULE_INFORMATION // Size=284{ULONG Count; // Size=4 Offset=0SYSTEM_MODULE Modules[1]; // Size=280 Offset=4};typedef struct _SYSTEM_LOCK // Size=36{PVOID Address; // Size=4 Offset=0USHORT Type; // Size=2 Offset=4USHORT Reserved1; // Size=2 Offset=6ULONG ExclusiveOwnerThreadId; // Size=4 Offset=8ULONG ActiveCount; // Size=4 Offset=12ULONG ContentionCount; // Size=4 Offset=16ULONG Reserved2[2]; // Size=8 Offset=20ULONG NumberOfSharedWaiters; // Size=4 Offset=28ULONG NumberOfExclusiveWaiters; // Size=4 Offset=32} SYSTEM_LOCK;struct _SYSTEM_LOCK_INFORMATION // Size=40{ULONG Count; // Size=4 Offset=0SYSTEM_LOCK Locks[1]; // Size=36 Offset=4};typedef enum _SYSTEM_HANDLE_FLAGS{PROTECT_FROM_CLOSE=1,INHERIT=2} SYSTEM_HANDLE_FLAGS;typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO // Size=16{USHORT UniqueProcessId; // Size=2 Offset=0USHORT CreatorBackTraceIndex; // Size=2 Offset=2UCHAR ObjectTypeIndex; // Size=1 Offset=4SYSTEM_HANDLE_FLAGS HandleAttributes; // Size=1 Offset=5USHORT HandleValue; // Size=2 Offset=6PVOID Object; // Size=4 Offset=8ULONG GrantedAccess; // Size=4 Offset=12} SYSTEM_HANDLE_TABLE_ENTRY_INFO;struct _SYSTEM_HANDLE_INFORMATION // Size=20{ULONG NumberOfHandles; // Size=4 Offset=0SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1]; // Size=16 Offset=4};struct _SYSTEM_OBJECTTYPE_INFORMATION // Size=56{ULONG NextEntryOffset; // Size=4 Offset=0ULONG NumberOfObjects; // Size=4 Offset=4ULONG NumberOfHandles; // Size=4 Offset=8ULONG TypeIndex; // Size=4 Offset=12ULONG InvalidAttributes; // Size=4 Offset=16GENERIC_MAPPING GenericMapping; // Size=16 Offset=20ULONG ValidAccessMask; // Size=4 Offset=36ULONG PoolType; // Size=4 Offset=40UCHAR SecurityRequired; // Size=1 Offset=44UCHAR WaitableObject; // Size=1 Offset=45UNICODE_STRING TypeName; // Size=8 Offset=48};typedef struct _OBJECT_NAME_INFORMATION // Size=8{UNICODE_STRING Name; // Size=8 Offset=0} OBJECT_NAME_INFORMATION;struct _SYSTEM_OBJECT_INFORMATION // Size=48{ULONG NextEntryOffset; // Size=4 Offset=0PVOID Object; // Size=4 Offset=4PVOID CreatorUniqueProcess; // Size=4 Offset=8USHORT CreatorBackTraceIndex; // Size=2 Offset=12USHORT Flags; // Size=2 Offset=14LONG PointerCount; // Size=4 Offset=16LONG HandleCount; // Size=4 Offset=20ULONG PagedPoolCharge; // Size=4 Offset=24ULONG NonPagedPoolCharge; // Size=4 Offset=28PVOID ExclusiveProcessId; // Size=4 Offset=32PVOID SecurityDescriptor; // Size=4 Offset=36OBJECT_NAME_INFORMATION NameInfo; // Size=8 Offset=40};struct _SYSTEM_PAGEFILE_INFORMATION // Size=24{ULONG NextEntryOffset; // Size=4 Offset=0ULONG TotalSize; // Size=4 Offset=4ULONG TotalInUse; // Size=4 Offset=8ULONG PeakUsage; // Size=4 Offset=12UNICODE_STRING PageFileName; // Size=8 Offset=16};struct _SYSTEM_VDM_INSTEMUL_INFO // Size=136{ULONG SegmentNotPresent; // Size=4 Offset=0ULONG VdmOpcode0F; // Size=4 Offset=4ULONG OpcodeESPrefix; // Size=4 Offset=8ULONG OpcodeCSPrefix; // Size=4 Offset=12ULONG OpcodeSSPrefix; // Size=4 Offset=16ULONG OpcodeDSPrefix; // Size=4 Offset=20ULONG OpcodeFSPrefix; // Size=4 Offset=24ULONG OpcodeGSPrefix; // Size=4 Offset=28ULONG OpcodeOPER32Prefix; // Size=4 Offset=32ULONG OpcodeADDR32Prefix; // Size=4 Offset=36ULONG OpcodeINSB; // Size=4 Offset=40ULONG OpcodeINSW; // Size=4 Offset=44ULONG OpcodeOUTSB; // Size=4 Offset=48ULONG OpcodeOUTSW; // Size=4 Offset=52ULONG OpcodePUSHF; // Size=4 Offset=56ULONG OpcodePOPF; // Size=4 Offset=60ULONG OpcodeINTnn; // Size=4 Offset=64ULONG OpcodeINTO; // Size=4 Offset=68ULONG OpcodeIRET; // Size=4 Offset=72ULONG OpcodeINBimm; // Size=4 Offset=76ULONG OpcodeINWimm; // Size=4 Offset=80ULONG OpcodeOUTBimm; // Size=4 Offset=84ULONG OpcodeOUTWimm; // Size=4 Offset=88ULONG OpcodeINB; // Size=4 Offset=92ULONG OpcodeINW; // Size=4 Offset=96ULONG OpcodeOUTB; // Size=4 Offset=100ULONG OpcodeOUTW; // Size=4 Offset=104ULONG OpcodeLOCKPrefix; // Size=4 Offset=108ULONG OpcodeREPNEPrefix; // Size=4 Offset=112ULONG OpcodeREPPrefix; // Size=4 Offset=116ULONG OpcodeHLT; // Size=4 Offset=120ULONG OpcodeCLI; // Size=4 Offset=124ULONG OpcodeSTI; // Size=4 Offset=128ULONG BopCount; // Size=4 Offset=132};struct _SYSTEM_FILECACHE_INFORMATION // Size=36{ULONG CurrentSize; // Size=4 Offset=0ULONG PeakSize; // Size=4 Offset=4ULONG PageFaultCount; // Size=4 Offset=8ULONG MinimumWorkingSet; // Size=4 Offset=12ULONG MaximumWorkingSet; // Size=4 Offset=16ULONG CurrentSizeIncludingTransitionInPages; // Size=4 Offset=20ULONG PeakSizeIncludingTransitionInPages; // Size=4 Offset=24ULONG TransitionRePurposeCount; // Size=4 Offset=28ULONG Flags; // Size=4 Offset=32};typedef struct _SYSTEM_POOLTAG // Size=28{UCHAR Tag[4]; // Size=4 Offset=0ULONG PagedAllocs; // Size=4 Offset=4ULONG PagedFrees; // Size=4 Offset=8ULONG PagedUsed; // Size=4 Offset=12ULONG NonPagedAllocs; // Size=4 Offset=16ULONG NonPagedFrees; // Size=4 Offset=20ULONG NonPagedUsed; // Size=4 Offset=24} SYSTEM_POOLTAG;struct _SYSTEM_POOLTAG_INFORMATION // Size=32{ULONG Count; // Size=4 Offset=0SYSTEM_POOLTAG TagInfo[1]; // Size=28 Offset=4};struct _SYSTEM_INTERRUPT_INFORMATION // Size=24{ULONG ContextSwitches; // Size=4 Offset=0ULONG DpcCount; // Size=4 Offset=4ULONG DpcRate; // Size=4 Offset=8ULONG TimeIncrement; // Size=4 Offset=12ULONG DpcBypassCount; // Size=4 Offset=16ULONG ApcBypassCount; // Size=4 Offset=20};struct _SYSTEM_DPC_BEHAVIOR_INFORMATION // Size=20{ULONG Spare; // Size=4 Offset=0ULONG DpcQueueDepth; // Size=4 Offset=4ULONG MinimumDpcRate; // Size=4 Offset=8ULONG AdjustDpcThreshold; // Size=4 Offset=12ULONG IdealDpcRate; // Size=4 Offset=16};typedef struct _IMAGE_EXPORT_DIRECTORY // Size=40{ULONG Characteristics; // Size=4 Offset=0ULONG TimeDateStamp; // Size=4 Offset=4USHORT MajorVersion; // Size=2 Offset=8USHORT MinorVersion; // Size=2 Offset=10ULONG Name; // Size=4 Offset=12ULONG Base; // Size=4 Offset=16ULONG NumberOfFunctions; // Size=4 Offset=20ULONG NumberOfNames; // Size=4 Offset=24ULONG AddressOfFunctions; // Size=4 Offset=28ULONG AddressOfNames; // Size=4 Offset=32ULONG AddressOfNameOrdinals; // Size=4 Offset=36} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;struct _SYSTEM_LOADED_GDI_DRIVER_INFORMATION // Size=28{UNICODE_STRING DriverName; // Size=8 Offset=0PVOID ImageAddress; // Size=4 Offset=8PVOID SectionPointer; // Size=4 Offset=12PVOID EntryPoint; // Size=4 Offset=16PIMAGE_EXPORT_DIRECTORY ExportSectionPointer; // Size=4 Offset=20ULONG ImageLength; // Size=4 Offset=24};struct _SYSTEM_UNLOADED_GDI_DRIVER_INFORMATION // Size=28{PVOID ImageAddress; // Size=4 Offset=0};struct _SYSTEM_CRASH_DUMP_INFORMATION{HANDLE CrashDumpSectionHandle; // Size=4 Offset=0};struct _SYSTEM_EXCEPTION_INFORMATION // Size=16{ULONG AlignmentFixupCount; // Size=4 Offset=0ULONG ExceptionDispatchCount; // Size=4 Offset=4ULONG FloatingEmulationCount; // Size=4 Offset=8ULONG ByteWordEmulationCount; // Size=4 Offset=12};typedef enum _SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS{SystemCrashDumpDisable=0,SystemCrashDumpReconfigure=1,SystemCrashDumpInitializationComplete=2} SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS;struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION // Size=4{SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS CrashDumpConfigurationClass; // Size=4 Offset=0};struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION // Size=2{UCHAR KernelDebuggerEnabled; // Size=1 Offset=0UCHAR KernelDebuggerNotPresent; // Size=1 Offset=1};struct _SYSTEM_PRIORITY_SEPARATION{ULONG PrioritySeparation; // Size=4 Offset=0};typedef struct _SYSTEMTIME {WORD wYear; // Size=2 Offset=0WORD wMonth; // Size=2 Offset=2WORD wDayOfWeek; // Size=2 Offset=4WORD wDay; // Size=2 Offset=6WORD wHour; // Size=2 Offset=8WORD wMinute; // Size=2 Offset=10WORD wSecond; // Size=2 Offset=12WORD wMilliseconds; // Size=2 Offset=14} SYSTEMTIME;struct _SYSTEM_TIME_ZONE_INFORMATION{LONG Bias;WCHAR StandardName[32];SYSTEMTIME StandardDate;LONG StandardBias;WCHAR DaylightName[32];SYSTEMTIME DaylightDate;LONG DaylightBias;};struct _SYSTEM_CONTEXT_SWITCH_INFORMATION // Size=48{ULONG ContextSwitches; // Size=4 Offset=0ULONG FindAny; // Size=4 Offset=4ULONG FindLast; // Size=4 Offset=8ULONG FindIdeal; // Size=4 Offset=12ULONG IdleAny; // Size=4 Offset=16ULONG IdleCurrent; // Size=4 Offset=20ULONG IdleLast; // Size=4 Offset=24ULONG IdleIdeal; // Size=4 Offset=28ULONG PreemptAny; // Size=4 Offset=32ULONG PreemptCurrent; // Size=4 Offset=36ULONG PreemptLast; // Size=4 Offset=40ULONG SwitchToIdle; // Size=4 Offset=44};struct _SYSTEM_REGISTRY_QUOTA_INFORMATION // Size=12{ULONG RegistryQuotaAllowed; // Size=4 Offset=0ULONG RegistryQuotaUsed; // Size=4 Offset=4ULONG PagedPoolSize; // Size=4 Offset=8};struct _SYSTEM_PROCESSOR_IDLE_INFORMATION // Size=48{ULONGLONG IdleTime; // Size=8 Offset=0ULONGLONG C1Time; // Size=8 Offset=8ULONGLONG C2Time; // Size=8 Offset=16ULONGLONG C3Time; // Size=8 Offset=24ULONG C1Transitions; // Size=4 Offset=32ULONG C2Transitions; // Size=4 Offset=36ULONG C3Transitions; // Size=4 Offset=40ULONG Padding; // Size=4 Offset=44};struct _SYSTEM_LEGACY_DRIVER_INFORMATION // Size=12{ULONG VetoType; // Size=4 Offset=0UNICODE_STRING VetoList; // Size=8 Offset=4};typedef enum _POOL_TYPE {NonPagedPool,NonPagedPoolExecute = NonPagedPool,PagedPool,NonPagedPoolMustSucceed = NonPagedPool + 2,DontUseThisType,NonPagedPoolCacheAligned = NonPagedPool + 4,PagedPoolCacheAligned,NonPagedPoolCacheAlignedMustS = NonPagedPool + 6,MaxPoolType,NonPagedPoolBase = 0,NonPagedPoolBaseMustSucceed = NonPagedPoolBase + 2,NonPagedPoolBaseCacheAligned = NonPagedPoolBase + 4,NonPagedPoolBaseCacheAlignedMustS = NonPagedPoolBase + 6,NonPagedPoolSession = 32,PagedPoolSession = NonPagedPoolSession + 1,NonPagedPoolMustSucceedSession = PagedPoolSession + 1,DontUseThisTypeSession = NonPagedPoolMustSucceedSession + 1,NonPagedPoolCacheAlignedSession = DontUseThisTypeSession + 1,PagedPoolCacheAlignedSession = NonPagedPoolCacheAlignedSession + 1,NonPagedPoolCacheAlignedMustSSession = PagedPoolCacheAlignedSession + 1,NonPagedPoolNx = 512,NonPagedPoolNxCacheAligned = NonPagedPoolNx + 4,NonPagedPoolSessionNx = NonPagedPoolNx + 32} POOL_TYPE;struct _SYSTEM_LOOKASIDE_INFORMATION // Size=32{USHORT CurrentDepth; // Size=2 Offset=0USHORT MaximumDepth; // Size=2 Offset=2ULONG TotalAllocates; // Size=4 Offset=4ULONG AllocateMisses; // Size=4 Offset=8ULONG TotalFrees; // Size=4 Offset=12ULONG FreeMisses; // Size=4 Offset=16POOL_TYPE Type; // Size=4 Offset=20ULONG Tag; // Size=4 Offset=24ULONG Size; // Size=4 Offset=28};struct _SYSTEM_SET_TIME_SLIP_EVENT{HANDLE TimeSlipEvent;};struct _SYSTEM_SESSION{ULONG SessionId;};struct _SYSTEM_RANGE_START_INFORMATION{PVOID SystemRangeStart;};typedef struct _SYSTEM_VERIFIER_INFORMATION // Size=104{ULONG NextEntryOffset; // Size=4 Offset=0ULONG Level; // Size=4 Offset=4UNICODE_STRING DriverName; // Size=8 Offset=8ULONG RaiseIrqls; // Size=4 Offset=16ULONG AcquireSpinLocks; // Size=4 Offset=20ULONG SynchronizeExecutions; // Size=4 Offset=24ULONG AllocationsAttempted; // Size=4 Offset=28ULONG AllocationsSucceeded; // Size=4 Offset=32ULONG AllocationsSucceededSpecialPool; // Size=4 Offset=36ULONG AllocationsWithNoTag; // Size=4 Offset=40ULONG TrimRequests; // Size=4 Offset=44ULONG Trims; // Size=4 Offset=48ULONG AllocationsFailed; // Size=4 Offset=52ULONG AllocationsFailedDeliberately; // Size=4 Offset=56ULONG Loads; // Size=4 Offset=60ULONG Unloads; // Size=4 Offset=64ULONG UnTrackedPool; // Size=4 Offset=68ULONG CurrentPagedPoolAllocations; // Size=4 Offset=72ULONG CurrentNonPagedPoolAllocations; // Size=4 Offset=76ULONG PeakPagedPoolAllocations; // Size=4 Offset=80ULONG PeakNonPagedPoolAllocations; // Size=4 Offset=84ULONG PagedPoolUsageInBytes; // Size=4 Offset=88ULONG NonPagedPoolUsageInBytes; // Size=4 Offset=92ULONG PeakPagedPoolUsageInBytes; // Size=4 Offset=96ULONG PeakNonPagedPoolUsageInBytes; // Size=4 Offset=100} SYSTEM_VERIFIER_INFORMATION;struct _SYSTEM_SESSION_PROCESS_INFORMATION // Size=12{ULONG SessionId; // Size=4 Offset=0ULONG SizeOfBuf; // Size=4 Offset=4PVOID Buffer; // Size=4 Offset=8};typedef struct _SYSTEM_POOL_BLOCK{BOOLEAN Allocated;USHORT Unknown;ULONG Size;CHAR Tag[4];} SYSTEM_POOL_BLOCK;struct _SYSTEM_POOL_BLOCKS_INFORMATION{ULONG PoolSize;PVOID PoolBase;USHORT PoolAlignment;ULONG NumberOfBlocks;SYSTEM_POOL_BLOCK PoolBlocks[1];};typedef struct _SYSTEM_MEMORY_USAGE{PVOID Name;USHORT Valid;USHORT Standby;USHORT Modified;USHORT PageTables;} SYSTEM_MEMORY_USAGE;struct _SYSTEM_MEMORY_USAGE_INFORMATION{ULONG Reserved;PVOID EndOfData;SYSTEM_MEMORY_USAGE MemoryUsage[1];};typedef struct _CLIENT_ID // Size=8{PVOID UniqueProcess; // Size=4 Offset=0PVOID UniqueThread; // Size=4 Offset=4} CLIENT_ID;typedef struct _SYSTEM_THREAD_INFORMATION // Size=64{LARGE_INTEGER KernelTime; // Size=8 Offset=0LARGE_INTEGER UserTime; // Size=8 Offset=8LARGE_INTEGER CreateTime; // Size=8 Offset=16ULONG WaitTime; // Size=4 Offset=24PVOID StartAddress; // Size=4 Offset=28CLIENT_ID ClientId; // Size=8 Offset=32LONG Priority; // Size=4 Offset=40LONG BasePriority; // Size=4 Offset=44ULONG ContextSwitches; // Size=4 Offset=48ULONG ThreadState; // Size=4 Offset=52ULONG WaitReason; // Size=4 Offset=56} SYSTEM_THREAD_INFORMATION;typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION // Size=96{SYSTEM_THREAD_INFORMATION ThreadInfo; // Size=64 Offset=0PVOID StackBase; // Size=4 Offset=64PVOID StackLimit; // Size=4 Offset=68PVOID Win32StartAddress; // Size=4 Offset=72PVOID TebBase; // Size=4 Offset=76ULONG Reserved2; // Size=4 Offset=80ULONG Reserved3; // Size=4 Offset=84ULONG Reserved4; // Size=4 Offset=88} SYSTEM_EXTENDED_THREAD_INFORMATION;// I have not validated this structurestruct _SYSTEM_EXTENDED_PROCESS_INFORMATION{SYSTEM_PROCESS_INFORMATION ProcessInfo;SYSTEM_EXTENDED_THREAD_INFORMATION ThreadInfo;};struct _SYSTEM_PROCESSOR_POWER_INFORMATION // Size=72{UCHAR CurrentFrequency; // Size=1 Offset=0UCHAR ThermalLimitFrequency; // Size=1 Offset=1UCHAR ConstantThrottleFrequency; // Size=1 Offset=2UCHAR DegradedThrottleFrequency; // Size=1 Offset=3UCHAR LastBusyFrequency; // Size=1 Offset=4UCHAR LastC3Frequency; // Size=1 Offset=5UCHAR LastAdjustedBusyFrequency; // Size=1 Offset=6UCHAR ProcessorMinThrottle; // Size=1 Offset=7UCHAR ProcessorMaxThrottle; // Size=1 Offset=8ULONG NumberOfFrequencies; // Size=4 Offset=12ULONG PromotionCount; // Size=4 Offset=16ULONG DemotionCount; // Size=4 Offset=20ULONG ErrorCount; // Size=4 Offset=24ULONG RetryCount; // Size=4 Offset=28ULONGLONG CurrentFrequencyTime; // Size=8 Offset=32ULONGLONG CurrentProcessorTime; // Size=8 Offset=40ULONGLONG CurrentProcessorIdleTime; // Size=8 Offset=48ULONGLONG LastProcessorTime; // Size=8 Offset=56ULONGLONG LastProcessorIdleTime; // Size=8 Offset=64};struct SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX // Size=28{PVOID Object; // Size=4 Offset=0ULONG UniqueProcessId; // Size=4 Offset=4ULONG HandleValue; // Size=4 Offset=8ULONG GrantedAccess; // Size=4 Offset=12USHORT CreatorBackTraceIndex; // Size=2 Offset=16USHORT ObjectTypeIndex; // Size=2 Offset=18ULONG HandleAttributes; // Size=4 Offset=20ULONG Reserved; // Size=4 Offset=24};struct _SYSTEM_HANDLE_INFORMATION_EX // Size=36{ULONG NumberOfHandles; // Size=4 Offset=0ULONG Reserved; // Size=4 Offset=4SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1]; // Size=36 Offset=8};typedef struct _SYSTEM_BIGPOOL_ENTRY // Size=12{PVOID VirtualAddress; // Size=4 Offset=0ULONG SizeInBytes; // Size=4 Offset=4UCHAR Tag[4]; // Size=4 Offset=8} SYSTEM_BIGPOOL_ENTRY;struct _SYSTEM_BIGPOOL_INFORMATION // Size=16{ULONG Count; // Size=4 Offset=0SYSTEM_BIGPOOL_ENTRY AllocatedInfo[1]; // Size=12 Offset=4};struct _SYSTEM_SESSION_POOLTAG_INFORMATION // Size=40{ULONG NextEntryOffset; // Size=4 Offset=0ULONG SessionId; // Size=4 Offset=4ULONG Count; // Size=4 Offset=8SYSTEM_POOLTAG TagInfo[1]; // Size=28 Offset=12};struct _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION // Size=20{ULONG NextEntryOffset; // Size=4 Offset=0ULONG SessionId; // Size=4 Offset=4ULONG ViewFailures; // Size=4 Offset=8ULONG NumberOfBytesAvailable; // Size=4 Offset=12ULONG NumberOfBytesAvailableContiguous; // Size=4 Offset=16};typedef struct _HOTPATCH_HOOK_DESCRIPTOR // Size=40{ULONGLONG TargetAddress; // Size=8 Offset=0ULONGLONG MappedAddress; // Size=8 Offset=8ULONG CodeOffset; // Size=4 Offset=16ULONG CodeSize; // Size=4 Offset=20ULONG OrigCodeOffset; // Size=4 Offset=24ULONG ValidationOffset; // Size=4 Offset=28ULONG ValidationSize; // Size=4 Offset=32} HOTPATCH_HOOK_DESCRIPTOR;struct _SYSTEM_HOTPATCH_CODE_INFORMATION_KERNEL_INFO // Size=4{USHORT NameOffset; // Size=2 Offset=0USHORT NameLength; // Size=2 Offset=2};struct _SYSTEM_HOTPATCH_CODE_INFORMATION_USERMODE_INFO // Size=14{USHORT NameOffset; // Size=2 Offset=0USHORT NameLength; // Size=2 Offset=2USHORT TargetNameOffset; // Size=2 Offset=4USHORT TargetNameLength; // Size=2 Offset=6USHORT ColdpatchImagePathOffset; // Size=2 Offset=8USHORT ColdpatchImagePathLength; // Size=2 Offset=10UCHAR PatchingFinished; // Size=1 Offset=12};struct _SYSTEM_HOTPATCH_CODE_INFORMATION_INJECTION_INFO // Size=24{USHORT NameOffset; // Size=2 Offset=0USHORT NameLength; // Size=2 Offset=2USHORT TargetNameOffset; // Size=2 Offset=4USHORT TargetNameLength; // Size=2 Offset=6USHORT ColdpatchImagePathOffset; // Size=2 Offset=8USHORT ColdpatchImagePathLength; // Size=2 Offset=10ULONGLONG TargetProcess; // Size=8 Offset=16};struct _SYSTEM_HOTPATCH_CODE_INFORMATION_ATOMIC_SWAP // Size=24{ULONGLONG ParentDirectory; // Size=8 Offset=0ULONGLONG ObjectHandle1; // Size=8 Offset=8ULONGLONG ObjectHandle2; // Size=8 Offset=16};struct _SYSTEM_HOTPATCH_CODE_INFORMATION_CODE_INFO // Size=48{ULONG DescriptorsCount; // Size=4 Offset=0HOTPATCH_HOOK_DESCRIPTOR CodeDescriptors[1]; // Size=40 Offset=8};typedef enum _WATCHDOG_INFORMATION_CLASS{WdInfoTimeoutValue=0,WdInfoResetTimer=1,WdInfoStopTimer=2,WdInfoStartTimer=3,WdInfoTriggerAction=4,WdInfoState=5} WATCHDOG_INFORMATION_CLASS;struct _SYSTEM_WATCHDOG_TIMER_INFORMATION // Size=8{WATCHDOG_INFORMATION_CLASS WdInfoClass; // Size=4 Offset=0ULONG DataValue; // Size=4 Offset=4};struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_PROCESSOR_CORE // Size=1{UCHAR Flags; // Size=1 Offset=0};struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_NUMA_CODE // Size=4{ULONG NodeNumber; // Size=4 Offset=0};typedef enum _PROCESSOR_CACHE_TYPE{CacheUnified=0,CacheInstruction=1,CacheData=2,CacheTrace=3} PROCESSOR_CACHE_TYPE;typedef enum _LOGICAL_PROCESSOR_RELATIONSHIP{RelationProcessorCore=0,RelationNumaNode=1,RelationCache=2,RelationProcessorPackage=3,RelationGroup=4,RelationAll=65535} LOGICAL_PROCESSOR_RELATIONSHIP;struct _CACHE_DESCRIPTOR // Size=12{UCHAR Level; // Size=1 Offset=0UCHAR Associativity; // Size=1 Offset=1USHORT LineSize; // Size=2 Offset=2ULONG Size; // Size=4 Offset=4PROCESSOR_CACHE_TYPE Type; // Size=4 Offset=8};struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION // Size=24{ULONG ProcessorMask; // Size=4 Offset=0LOGICAL_PROCESSOR_RELATIONSHIP Relationship; // Size=4 Offset=4union{_SYSTEM_LOGICAL_PROCESSOR_INFORMATION_PROCESSOR_CORE; // Size=1 Offset=8_SYSTEM_LOGICAL_PROCESSOR_INFORMATION_NUMA_CODE NumaNode; // Size=4 Offset=8_CACHE_DESCRIPTOR Cache; // Size=12 Offset=8ULONGLONG Reserved[2]; // Size=16 Offset=8};};typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION{SystemFirmwareTable_Enumerate=0,SystemFirmwareTable_Get=1} SYSTEM_FIRMWARE_TABLE_ACTION;struct _SYSTEM_FIRMWARE_TABLE_INFORMATION // Size=20{ULONG ProviderSignature; // Size=4 Offset=0SYSTEM_FIRMWARE_TABLE_ACTION Action; // Size=4 Offset=4ULONG TableID; // Size=4 Offset=8ULONG TableBufferLength; // Size=4 Offset=12UCHAR TableBuffer[1]; // Size=1 Offset=16};struct _SYSTEM_VERIFIER_TRIAGE_INFORMATION // Size=544{ULONG ActionTaken; // Size=4 Offset=0ULONG CrashData[5]; // Size=20 Offset=4ULONG VerifierMode; // Size=4 Offset=24ULONG VerifierFlags; // Size=4 Offset=28WCHAR VerifierTargets[256]; // Size=512 Offset=32};struct _SYSTEM_MEMORY_LIST_INFORMATION // Size=88{ULONG ZeroPageCount; // Size=4 Offset=0ULONG FreePageCount; // Size=4 Offset=4ULONG ModifiedPageCount; // Size=4 Offset=8ULONG ModifiedNoWritePageCount; // Size=4 Offset=12ULONG BadPageCount; // Size=4 Offset=16ULONG PageCountByPriority[8]; // Size=32 Offset=20ULONG RepurposedPagesByPriority[8]; // Size=32 Offset=52ULONG ModifiedPageCountPageFile; // Size=4 Offset=84};struct _SYSTEM_THREAD_CID_PRIORITY_INFORMATION // Size=12{CLIENT_ID ClientId; // Size=8 Offset=0LONG Priority; // Size=4 Offset=8};struct _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION // Size=8{ULONGLONG CycleTime; // Size=8 Offset=0};typedef struct _SYSTEM_VERIFIER_ISSUE // Size=16{ULONG IssueType; // Size=4 Offset=0PVOID Address; // Size=4 Offset=4ULONG Parameters[2]; // Size=8 Offset=8} SYSTEM_VERIFIER_ISSUE;struct _SYSTEM_VERIFIER_CANCELLATION_INFORMATION // Size=2068{ULONG CancelProbability; // Size=4 Offset=0ULONG CancelThreshold; // Size=4 Offset=4ULONG CompletionThreshold; // Size=4 Offset=8ULONG CancellationVerifierDisabled; // Size=4 Offset=12ULONG AvailableIssues; // Size=4 Offset=16SYSTEM_VERIFIER_ISSUE Issues[128]; // Size=2048 Offset=20};struct _SYSTEM_REF_TRACE_INFORMATION // Size=20{UCHAR TraceEnable; // Size=1 Offset=0UCHAR TracePermanent; // Size=1 Offset=1UNICODE_STRING TraceProcessName; // Size=8 Offset=4UNICODE_STRING TracePoolTags; // Size=8 Offset=12};struct _SYSTEM_SPECIAL_POOL_INFORMATION // Size=8{ULONG PoolTag; // Size=4 Offset=0ULONG Flags; // Size=4 Offset=4};struct _SYSTEM_PROCESS_ID_INFORMATION // Size=12{PVOID ProcessId; // Size=4 Offset=0UNICODE_STRING ImageName; // Size=8 Offset=4};typedef struct _GUID // Size=16{ULONG Data1; // Size=4 Offset=0USHORT Data2; // Size=2 Offset=4USHORT Data3; // Size=2 Offset=6UCHAR Data4[8]; // Size=8 Offset=8} GUID;typedef enum _FIRMWARE_TYPE{FirmwareTypeUnknown=0,FirmwareTypeBios=1,FirmwareTypeUefi=2,FirmwareTypeMax=3} FIRMWARE_TYPE;struct _SYSTEM_BOOT_ENVIRONMENT_INFORMATION // Size=32{GUID BootIdentifier; // Size=16 Offset=0FIRMWARE_TYPE FirmwareType; // Size=4 Offset=16ULONGLONG BootFlags; // Size=8 Offset=24};struct _SYSTEM_VERIFIER_INFORMATION_EX // Size=36{ULONG VerifyMode; // Size=4 Offset=0ULONG OptionChanges; // Size=4 Offset=4UNICODE_STRING PreviousBucketName; // Size=8 Offset=8ULONG IrpCancelTimeoutMsec; // Size=4 Offset=16ULONG VerifierExtensionEnabled; // Size=4 Offset=20ULONG Reserved[3]; // Size=12 Offset=24};struct _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION // Size=8{ULONG FlagsToEnable; // Size=4 Offset=0ULONG FlagsToDisable; // Size=4 Offset=4};struct _SYSTEM_PREFETCH_PATCH_INFORMATION // Size=4{ULONG PrefetchPatchCount; // Size=4 Offset=0};struct _SYSTEM_VERIFIER_FAULTS_INFORMATION // Size=24{ULONG Probability; // Size=4 Offset=0ULONG MaxProbability; // Size=4 Offset=4UNICODE_STRING PoolTags; // Size=8 Offset=8UNICODE_STRING Applications; // Size=8 Offset=16};struct _SYSTEM_SYSTEM_PARTITION_INFORMATION // Size=8{UNICODE_STRING SystemPartition; // Size=8 Offset=0};struct _SYSTEM_SYSTEM_DISK_INFORMATION // Size=8{UNICODE_STRING SystemDisk; // Size=8 Offset=0};struct _SYSTEM_CODEINTEGRITY_INFORMATION // Size=8{ULONG Length; // Size=4 Offset=0ULONG CodeIntegrityOptions; // Size=4 Offset=4};struct _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION // Size=4{ULONG Operation; // Size=4 Offset=0};struct _SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION // Size=8{ULONGLONG CycleTime; // Size=8 Offset=0};struct _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // Size=36{PVOID KeyHandle; // Size=4 Offset=0PUNICODE_STRING ValueNamePointer; // Size=4 Offset=4ULONG_PTR RequiredLengthPointer; // Size=4 Offset=8PUCHAR Buffer; // Size=4 Offset=12ULONG BufferLength; // Size=4 Offset=16ULONG Type; // Size=4 Offset=20PUCHAR AppendBuffer; // Size=4 Offset=24ULONG AppendBufferLength; // Size=4 Offset=28UCHAR CreateIfDoesntExist; // Size=1 Offset=32UCHAR TruncateExistingValue; // Size=1 Offset=33};struct _SYSTEM_VHD_BOOT_INFORMATION // Size=12{UCHAR OsDiskIsVhd; // Size=1 Offset=0ULONG OsVhdFilePathOffset; // Size=4 Offset=4WCHAR OsVhdParentVolume[1]; // Size=2 Offset=8};struct _SYSTEM_ERROR_PORT_TIMEOUTS // Size=8{ULONG StartTimeout; // Size=4 Offset=0ULONG CommTimeout; // Size=4 Offset=4};struct _SYSTEM_LOW_PRIORITY_IO_INFORMATION // Size=40{ULONG LowPriReadOperations; // Size=4 Offset=0ULONG LowPriWriteOperations; // Size=4 Offset=4ULONG KernelBumpedToNormalOperations; // Size=4 Offset=8ULONG LowPriPagingReadOperations; // Size=4 Offset=12ULONG KernelPagingReadsBumpedToNormal; // Size=4 Offset=16ULONG LowPriPagingWriteOperations; // Size=4 Offset=20ULONG KernelPagingWritesBumpedToNormal; // Size=4 Offset=24ULONG BoostedIrpCount; // Size=4 Offset=28ULONG BoostedPagingIrpCount; // Size=4 Offset=32ULONG BlanketBoostCount; // Size=4 Offset=36};struct _SYSTEM_VERIFIER_COUNTERS_INFORMATION // Size=168{SYSTEM_VERIFIER_INFORMATION Legacy; // Size=104 Offset=0ULONG RaiseIrqls; // Size=4 Offset=104ULONG AcquireSpinLocks; // Size=4 Offset=108ULONG SynchronizeExecutions; // Size=4 Offset=112ULONG AllocationsWithNoTag; // Size=4 Offset=116ULONG AllocationsFailed; // Size=4 Offset=120ULONG AllocationsFailedDeliberately; // Size=4 Offset=124ULONG LockedBytes; // Size=4 Offset=128ULONG PeakLockedBytes; // Size=4 Offset=132ULONG MappedLockedBytes; // Size=4 Offset=136ULONG PeakMappedLockedBytes; // Size=4 Offset=140ULONG MappedIoSpaceBytes; // Size=4 Offset=144ULONG PeakMappedIoSpaceBytes; // Size=4 Offset=148ULONG PagesForMdlBytes; // Size=4 Offset=152ULONG PeakPagesForMdlBytes; // Size=4 Offset=156ULONG ContiguousMemoryBytes; // Size=4 Offset=160ULONG PeakContiguousMemoryBytes; // Size=4 Offset=164};struct _SYSTEM_ACPI_AUDIT_INFORMATION // Size=8{ULONG RsdpCount; // Size=4 Offset=0struct{ULONG SameRsdt: 1; // Size=4 Offset=4 BitOffset=0 BitCount=1ULONG SlicPresent: 1; // Size=4 Offset=4 BitOffset=1 BitCount=1ULONG SlicDifferent: 1; // Size=4 Offset=4 BitOffset=2 BitCount=1};};struct _SYSTEM_BASIC_PERFORMANCE_INFORMATION // Size=16{ULONG AvailablePages; // Size=4 Offset=0ULONG CommittedPages; // Size=4 Offset=4ULONG CommitLimit; // Size=4 Offset=8ULONG PeakCommitment; // Size=4 Offset=12};typedef struct _QUERY_PERFORMANCE_COUNTER_FLAGS // Size=4{struct{ULONG KernelTransition: 1; // Size=4 Offset=0 BitOffset=0 BitCount=1ULONG Reserved: 31; // Size=4 Offset=0 BitOffset=1 BitCount=31};ULONG ul; // Size=4 Offset=0} QUERY_PERFORMANCE_COUNTER_FLAGS;struct _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // Size=12{ULONG Version; // Size=4 Offset=0QUERY_PERFORMANCE_COUNTER_FLAGS Flags; // Size=4 Offset=4QUERY_PERFORMANCE_COUNTER_FLAGS ValidFlags; // Size=4 Offset=8};struct _SYSTEM_SESSION_BIGPOOL_INFORMATION // Size=24{ULONG NextEntryOffset; // Size=4 Offset=0ULONG SessionId; // Size=4 Offset=4ULONG Count; // Size=4 Offset=8SYSTEM_BIGPOOL_ENTRY AllocatedInfo[1]; // Size=12 Offset=12};typedef enum _SYSTEM_PIXEL_FORMAT{SystemPixelFormatUnknown=0,SystemPixelFormatR8G8B8=1,SystemPixelFormatR8G8B8X8=2,SystemPixelFormatB8G8R8=3,SystemPixelFormatB8G8R8X8=4} SYSTEM_PIXEL_FORMAT;struct _SYSTEM_BOOT_GRAPHICS_INFORMATION // Size=32{LARGE_INTEGER FrameBuffer; // Size=8 Offset=0ULONG Width; // Size=4 Offset=8ULONG Height; // Size=4 Offset=12ULONG PixelStride; // Size=4 Offset=16ULONG Flags; // Size=4 Offset=20SYSTEM_PIXEL_FORMAT Format; // Size=4 Offset=24};typedef struct _PEBS_DS_SAVE_AREA // Size=96{ULONGLONG BtsBufferBase; // Size=8 Offset=0ULONGLONG BtsIndex; // Size=8 Offset=8ULONGLONG BtsAbsoluteMaximum; // Size=8 Offset=16ULONGLONG BtsInterruptThreshold; // Size=8 Offset=24ULONGLONG PebsBufferBase; // Size=8 Offset=32ULONGLONG PebsIndex; // Size=8 Offset=40ULONGLONG PebsAbsoluteMaximum; // Size=8 Offset=48ULONGLONG PebsInterruptThreshold; // Size=8 Offset=56ULONGLONG PebsCounterReset0; // Size=8 Offset=64ULONGLONG PebsCounterReset1; // Size=8 Offset=72ULONGLONG PebsCounterReset2; // Size=8 Offset=80ULONGLONG PebsCounterReset3; // Size=8 Offset=88} PEBS_DS_SAVE_AREA;typedef struct _PROCESSOR_PROFILE_CONTROL_AREA // Size=96{PEBS_DS_SAVE_AREA PebsDsSaveArea; // Size=96 Offset=0} *PPROCESSOR_PROFILE_CONTROL_AREA;struct _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA // Size=8{PPROCESSOR_PROFILE_CONTROL_AREA ProcessorProfileControlArea; // Size=4 Offset=0UCHAR Allocate; // Size=1 Offset=4};struct _SYSTEM_ENTROPY_TIMING_INFORMATION // Size=12{PVOID EntropyRoutine; // Size=4 Offset=0 VOID (* EntropyRoutine)(PVOID,ULONG)PVOID InitializationRoutine; // Size=4 Offset=4 VOID ( * InitializationRoutine)(PVOID,ULONG,PVOID)PVOID InitializationContext; // Size=4 Offset=8};struct _SYSTEM_CONSOLE_INFORMATION // Size=4{ULONG DriverLoaded: 1; // Size=4 Offset=0 BitOffset=0 BitCount=1ULONG Spare: 31; // Size=4 Offset=0 BitOffset=1 BitCount=31};struct _SYSTEM_PLATFORM_BINARY_INFORMATION // Size=24{ULONGLONG PhysicalAddress; // Size=8 Offset=0PVOID HandoffBuffer; // Size=4 Offset=8PVOID CommandLineBuffer; // Size=4 Offset=12ULONG HandoffBufferSize; // Size=4 Offset=16ULONG CommandLineBufferSize; // Size=4 Offset=20};struct _SYSTEM_DEVICE_DATA_INFORMATION // Size=28{UNICODE_STRING DeviceId; // Size=8 Offset=0UNICODE_STRING DataName; // Size=8 Offset=8ULONG DataType; // Size=4 Offset=16ULONG DataBufferLength; // Size=4 Offset=20PVOID DataBuffer; // Size=4 Offset=24};typedef struct _PHYSICAL_CHANNEL_RUN // Size=32{ULONG NodeNumber; // Size=4 Offset=0ULONG ChannelNumber; // Size=4 Offset=4ULONGLONG BasePage; // Size=8 Offset=8ULONGLONG PageCount; // Size=8 Offset=16ULONG Flags; // Size=4 Offset=24} PHYSICAL_CHANNEL_RUN;struct _SYSTEM_MEMORY_TOPOLOGY_INFORMATION // Size=48{ULONGLONG NumberOfRuns; // Size=8 Offset=0ULONG NumberOfNodes; // Size=4 Offset=8ULONG NumberOfChannels; // Size=4 Offset=12PHYSICAL_CHANNEL_RUN Run[1]; // Size=32 Offset=16};struct _SYSTEM_MEMORY_CHANNEL_INFORMATION // Size=40{ULONG ChannelNumber; // Size=4 Offset=0ULONG ChannelHeatIndex; // Size=4 Offset=4ULONGLONG TotalPageCount; // Size=8 Offset=8ULONGLONG ZeroPageCount; // Size=8 Offset=16ULONGLONG FreePageCount; // Size=8 Offset=24ULONGLONG StandbyPageCount; // Size=8 Offset=32};struct _SYSTEM_BOOT_LOGO_INFORMATION // Size=8{ULONG Flags; // Size=4 Offset=0ULONG BitmapOffset; // Size=4 Offset=4};struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // Size=72{LARGE_INTEGER IdleTime; // Size=8 Offset=0LARGE_INTEGER KernelTime; // Size=8 Offset=8LARGE_INTEGER UserTime; // Size=8 Offset=16LARGE_INTEGER DpcTime; // Size=8 Offset=24LARGE_INTEGER InterruptTime; // Size=8 Offset=32ULONG InterruptCount; // Size=4 Offset=40ULONG Spare0; // Size=4 Offset=44LARGE_INTEGER AvailableTime; // Size=8 Offset=48LARGE_INTEGER Spare1; // Size=8 Offset=56LARGE_INTEGER Spare2; // Size=8 Offset=64};struct _SYSTEM_SECUREBOOT_POLICY_INFORMATION // Size=24{GUID PolicyPublisher; // Size=16 Offset=0ULONG PolicyVersion; // Size=4 Offset=16ULONG PolicyOptions; // Size=4 Offset=20};struct _SYSTEM_SECUREBOOT_INFORMATION // Size=2{UCHAR SecureBootEnabled; // Size=1 Offset=0UCHAR SecureBootCapable; // Size=1 Offset=1};struct _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION // Size=1{UCHAR EfiLauncherEnabled; // Size=1 Offset=0}; http://www.exploit-monday.com/2013/06/undocumented-ntquerysysteminformation.html Ted.Undocumented NtQuerySystemInformation Structures.zip 5
master131 Posted July 13, 2013 Posted July 13, 2013 Undocumented functions and structures are definately fun to play around with. The SystemModuleInformation value along with the _SYSTEM_MODULE_INFORMATION and _SYSTEM_MODULE structs can be used to list drivers loaded in the system, which Nirsoft's DriverView does. Those new Windows 8 values seem interesting too because of the addition of secure boot and other UEFI features. Thanks Ted!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now