2020-10-31 00:53:44 +01:00
|
|
|
/* SPDX-License-Identifier: GPL-2.0
|
|
|
|
|
*
|
|
|
|
|
* Copyright (C) 2018-2020 WireGuard LLC. All Rights Reserved.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#pragma once
|
|
|
|
|
|
|
|
|
|
#include <Windows.h>
|
|
|
|
|
|
|
|
|
|
enum
|
|
|
|
|
{
|
|
|
|
|
SystemModuleInformation = 11
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
typedef struct _RTL_PROCESS_MODULE_INFORMATION
|
|
|
|
|
{
|
|
|
|
|
HANDLE Section;
|
|
|
|
|
PVOID MappedBase;
|
|
|
|
|
PVOID ImageBase;
|
|
|
|
|
ULONG ImageSize;
|
|
|
|
|
ULONG Flags;
|
|
|
|
|
USHORT LoadOrderIndex;
|
|
|
|
|
USHORT InitOrderIndex;
|
|
|
|
|
USHORT LoadCount;
|
|
|
|
|
USHORT OffsetToFileName;
|
|
|
|
|
UCHAR FullPathName[256];
|
|
|
|
|
} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;
|
|
|
|
|
|
|
|
|
|
typedef struct _RTL_PROCESS_MODULES
|
|
|
|
|
{
|
|
|
|
|
ULONG NumberOfModules;
|
|
|
|
|
RTL_PROCESS_MODULE_INFORMATION Modules[1];
|
|
|
|
|
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;
|
2020-10-31 11:55:26 +01:00
|
|
|
|
2020-11-03 15:28:17 +01:00
|
|
|
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) // TODO: #include <ntstatus.h> instead of this
|
|
|
|
|
#define STATUS_PNP_DEVICE_CONFIGURATION_PENDING ((NTSTATUS)0xC0000495L)
|
2020-10-31 11:55:26 +01:00
|
|
|
|
2020-11-03 15:28:17 +01:00
|
|
|
/* We can't use RtlGetVersion, because appcompat's aclayers.dll shims it to report Vista
|
|
|
|
|
* when run from legacy contexts. So, we instead use the undocumented RtlGetNtVersionNumbers.
|
|
|
|
|
*
|
|
|
|
|
* Another way would be reading from the PEB directly:
|
|
|
|
|
* ((DWORD *)NtCurrentTeb()->ProcessEnvironmentBlock)[sizeof(void *) == 8 ? 70 : 41]
|
|
|
|
|
* Or just read from KUSER_SHARED_DATA the same way on 32-bit and 64-bit:
|
|
|
|
|
* *(DWORD *)0x7FFE026C
|
|
|
|
|
*/
|
|
|
|
|
EXTERN_C
|
|
|
|
|
DECLSPEC_IMPORT VOID NTAPI
|
|
|
|
|
RtlGetNtVersionNumbers(_Out_opt_ DWORD *MajorVersion, _Out_opt_ DWORD *MinorVersion, _Out_opt_ DWORD *BuildNumber);
|
