└── README.md /README.md: -------------------------------------------------------------------------------- 1 | # InformationClasses 2 | Documenting system information classes and their uses 3 | 4 | ## System Information classes support in NtSet vs. NtQuery APIs: 5 | 6 | | Information Class | NtSetSystemInformation | NtQuerySystemInformation | NtQuerySystemInformationEx | Supported | Allowed to restricted caller | Required privilege | 7 | | ------- | --- | --- | --- | --- | --- | --- | 8 | | SystemBasicInformation | Invalid | Valid | Invalid | Yes | Yes | - | 9 | | SystemProcessorInformation | Invalid | Valid | Invalid | Yes | Yes | - | 10 | | SystemPerformanceInformation | Invalid | Valid | Invalid | Yes | Yes | - | 11 | | SystemTimeOfDayInformation | Invalid | Valid | Invalid | Yes | Yes | - | 12 | | SystemPathInformation | Invalid | Not implemented | Invalid | Yes | Yes | - | 13 | | SystemProcessInformation | Invalid | Valid | Invalid | Yes | Yes | - | 14 | | SystemCallCountInformation | Invalid | Valid | Invalid | No | Yes | - | 15 | | SystemDeviceInformation | Invalid | Valid | Invalid | Yes | Yes | - | 16 | | SystemProcessorPerformanceInformation | Invalid | Valid | Valid | Yes | Yes | - | 17 | | SystemFlagsInformation | Valid | Valid | Invalid | Yes | Yes | SeDebugPrivilege + SeSystemtimePrivilege (set only) | 18 | | SystemCallTimeInformation | Invalid | Not implemented | Invalid | Yes | Yes | - | 19 | | SystemModuleInformation | Invalid | Valid | Invalid | Yes | No | - | 20 | | SystemLocksInformation | Invalid | Valid | Invalid | Yes | No | - | 21 | | SystemStackTraceInformation | Invalid | Valid | Invalid | Yes | Yes | - | 22 | | SystemPagedPoolInformation | Invalid | Not implemented | Invalid | Yes | Yes | - | 23 | | SystemNonPagedPoolInformation | Invalid | Not implemented | Invalid | Yes | Yes | - | 24 | | SystemHandleInformation | Invalid | Valid | Invalid | Yes | No | - | 25 | | SystemObjectInformation | Invalid | Valid | Invalid | Yes | No | - | 26 | | SystemPageFileInformation | Invalid | Valid | Invalid | Yes | Yes | - | 27 | | SystemVdmInstemulInformation | Invalid | Not implemented | Invalid | Yes | Yes | - | 28 | | SystemVdmBopInformation | Invalid | Invalid | Invalid | Yes | Yes | - | 29 | | SystemFileCacheInformation | Valid | Valid | Invalid | Yes | Yes | SeIncreaseQuotaPrivilege | 30 | | SystemPoolTagInformation | Invalid | Valid | Invalid | Yes | Yes | - | 31 | | SystemInterruptInformation | Invalid | Valid | Valid | Yes | Yes | - | 32 | | SystemDpcBehaviorInformation | Valid | Valid | Invalid | Yes | Yes | SeLoadDriverPrivilege | 33 | | SystemFullMemoryInformation | Invalid | Not implemented | Invalid | Yes | Yes | - | 34 | | SystemLoadGdiDriverInformation | Valid | Invalid | Invalid | Yes | Yes | - | 35 | | SystemUnloadGdiDriverInformation | Valid | Invalid | Invalid | Yes | Yes | - | 36 | | SystemTimeAdjustmentInformation | Valid | Valid | Invalid | Yes | Yes | - | 37 | | SystemSummaryMemoryInformation | Invalid | Not implemented | Invalid | Yes | Yes | - | 38 | | SystemMirrorMemoryInformation | Valid | Invalid | Invalid | Yes | Yes | - | 39 | | SystemPerformanceTraceInformation | Not implemented | Not implemented | Invalid | Yes | Yes | - | 40 | | SystemObsolete0 | Invalid | Invalid | Invalid | Yes | Yes | - | 41 | | SystemExceptionInformation | Invalid | Valid | Invalid | Yes | Yes | - | 42 | | SystemCrashDumpStateInformation | Valid | Invalid | Invalid | Yes | Yes | SeDebugPrivilege | 43 | | SystemKernelDebuggerInformation | Invalid | Valid | Invalid | Yes | Yes | - | 44 | | SystemContextSwitchInformation | Invalid | Valid | Invalid | Yes | Yes | - | 45 | | SystemRegistryQuotaInformation | Valid | Valid | Invalid | Yes | Yes | SeIncreaseQuotaPrivilege | 46 | | SystemExtendServiceTableInformation | Valid | Invalid | Invalid | Yes | Yes | SeLoadDriverPrivilege | 47 | | SystemPrioritySeperation | Valid | Invalid | Invalid | Yes | Yes | SeTcbPrivilege | 48 | | SystemVerifierAddDriverInformation | Valid | Invalid | Invalid | Yes | Yes | SeDebugPrivilege | 49 | | SystemVerifierRemoveDriverInformation | Valid | Invalid | Invalid | Yes | Yes | SeDebugPrivilege | 50 | | SystemProcessorIdleInformation | Invalid | Valid | Valid | Yes | Yes | - | 51 | | SystemLegacyDriverInformation | Invalid | Valid | Invalid | Yes | Yes | - | 52 | | SystemCurrentTimeZoneInformation | Invalid | Valid | Invalid | Yes | Yes | - | 53 | | SystemLookasideInformation | Invalid | Valid | Invalid | Yes | Yes | - | 54 | | SystemTimeSlipNotification | Valid | Invalid | Invalid | Yes | Yes | SeSystemtimePrivilege | 55 | | SystemSessionCreate | Not implemented | Invalid | Invalid | Yes | Yes | - | 56 | | SystemSessionDetach | Not implemented | Invalid | Invalid | Yes | Yes | - | 57 | | SystemSessionInformation | Invalid | Invalid | Invalid | Yes | Yes | - | 58 | | SystemRangeStartInformation | Invalid | Valid | Invalid | Yes | Yes | - | 59 | | SystemVerifierInformation | Valid | Valid | Invalid | Yes | Yes | SeDebugPrivilege | 60 | | SystemVerifierThunkExtend | Valid | Invalid | Invalid | Yes | Yes | - | 61 | | SystemSessionProcessInformation | Invalid | Valid | Invalid | Yes | Yes | - | 62 | | SystemLoadGdiDriverInSystemSpace | Valid | Invalid | Invalid | Yes | Yes | - | 63 | | SystemNumaProcessorMap | Invalid | Valid | Invalid | Yes | Yes | - | 64 | | SystemPrefetcherInformation | Valid | Valid | Invalid | Yes | Yes | - | 65 | | SystemExtendedProcessInformation | Invalid | Valid | Invalid | Yes | Yes | - | 66 | | SystemRecommendedSharedDataAlignment | Invalid | Valid | Invalid | Yes | Yes | - | 67 | | SystemComPlusPackage | Valid | Valid | Invalid | Yes | Yes | - | 68 | | SystemNumaAvailableMemory | Invalid | Valid | Invalid | Yes | Yes | - | 69 | | SystemProcessorPowerInformation | Invalid | Valid | Valid | Yes | Yes | - | 70 | | SystemEmulationBasicInformation | Invalid | Valid | Invalid | Yes | Yes | - | 71 | | SystemEmulationProcessorInformation | Invalid | Valid | Invalid | Yes | Yes | - | 72 | | SystemExtendedHandleInformation | Invalid | Valid | Invalid | Yes | No | - | 73 | | SystemLostDelayedWriteInformation | Invalid | Valid | Invalid | Yes | Yes | - | 74 | | SystemBigPoolInformation | Invalid | Valid | Invalid | Yes | No | - | 75 | | SystemSessionPoolTagInformation | Invalid | Valid | Invalid | Yes | Yes | - | 76 | | SystemSessionMappedViewInformation | Invalid | Valid | Invalid | Yes | Yes | - | 77 | | SystemHotpatchInformation | Valid | Valid | Invalid | No | Yes | - | 78 | | SystemObjectSecurityMode | Invalid | Valid | Invalid | Yes | Yes | - | 79 | | SystemWatchdogTimerHandler | Valid | Invalid | Invalid | No | Yes | - | 80 | | SystemWatchdogTimerInformation | Valid | Valid | Invalid | Yes | Yes | Kernel mode only (set only) | 81 | | SystemLogicalProcessorInformation | Invalid | Valid | Invalid | Yes | Yes | - | 82 | | SystemWow64SharedInformationObsolete | Not implemented | Invalid | Invalid | Yes | Yes | - | 83 | | SystemRegisterFirmwareTableInformationHandler | Valid | Invalid | Invalid | Yes | Yes | - | 84 | | SystemFirmwareTableInformation | Invalid | Valid | Invalid | Yes | Yes | - | 85 | | SystemModuleInformationEx | Invalid | Valid | Invalid | Yes | No | SeLoadDriverPrivilege | 86 | | SystemVerifierTriageInformation | Invalid | Invalid | Invalid | Yes | Yes | - | 87 | | SystemSuperfetchInformation | Valid | Valid | Invalid | Yes | Yes | SeProfileSingleProcessPrivilege | 88 | | SystemMemoryListInformation | Valid | Valid | Invalid | Yes | Yes | - | 89 | | SystemFileCacheInformationEx | Valid | Valid | Invalid | Yes | Yes | SeIncreaseQuotaPrivilege | 90 | | SystemThreadPriorityClientIdInformation | Valid | Invalid | Invalid | Yes | Yes | SeIncreaseBasePriorityPrivilege | 91 | | SystemProcessorIdleCycleTimeInformation | Invalid | Valid | Valid | Yes | Yes | - | 92 | | SystemVerifierCancellationInformation | Invalid | Invalid | Invalid | Yes | Yes | - | 93 | | SystemProcessorPowerInformationEx | Invalid | Invalid | Invalid | Yes | Yes | - | 94 | | SystemRefTraceInformation | Valid | Valid | Invalid | Yes | Yes | - | 95 | | SystemSpecialPoolInformation | Valid | Valid | Invalid | Yes | Yes | SeDebugPrivilege (set only) | 96 | | SystemProcessIdInformation | Invalid | Valid | Invalid | Yes | Yes | - | 97 | | SystemErrorPortInformation | Valid | Invalid | Invalid | Yes | Yes | SeTcbPrivilege | 98 | | SystemBootEnvironmentInformation | Invalid | Valid | Invalid | Yes | Yes | - | 99 | | SystemHypervisorInformation | Valid | Valid | Invalid | Yes | Yes | - | 100 | | SystemVerifierInformationEx | Valid | Valid | Invalid | Yes | Yes | SeDebugPrivilege | 101 | | SystemTimeZoneInformation | Valid | Invalid | Invalid | Yes | Yes | SeTimeZonePrivilege | 102 | | SystemImageFileExecutionOptionsInformation | Valid | Invalid | Invalid | Yes | Yes | SeTcbPrivilege | 103 | | SystemCoverageInformation | Valid | Valid | Invalid | Yes | Yes | SeDebugPrivilege | 104 | | SystemPrefetchPatchInformation | Invalid | Not implemented | Invalid | Yes | Yes | SeProfileSingleProcessPrivilege | 105 | | SystemVerifierFaultsInformation | Valid | Invalid | Invalid | Yes | Yes | SeDebugPrivilege | 106 | | SystemSystemPartitionInformation | Invalid | Valid | Invalid | Yes | Yes | - | 107 | | SystemSystemDiskInformation | Invalid | Valid | Invalid | Yes | Yes | - | 108 | | SystemProcessorPerformanceDistribution | Invalid | Valid | Valid | Yes | Yes | - | 109 | | SystemNumaProximityNodeInformation | Invalid | Valid | Invalid | Yes | Yes | - | 110 | | SystemDynamicTimeZoneInformation | Valid | Valid | Invalid | Yes | Yes | - | 111 | | SystemCodeIntegrityInformation | Invalid | Valid | Invalid | Yes | Yes | - | 112 | | SystemProcessorMicrocodeUpdateInformation | Valid | Invalid | Invalid | Yes | Yes | - | 113 | | SystemProcessorBrandString | Invalid | Valid | Invalid | Yes | Yes | - | 114 | | SystemVirtualAddressInformation | Invalid | Invalid | Invalid | Yes | Yes | - | 115 | | SystemLogicalProcessorAndGroupInformation | Invalid | Invalid | Valid | Yes | Yes | - | 116 | | SystemProcessorCycleTimeInformation | Invalid | Valid | Valid | Yes | Yes | - | 117 | | SystemStoreInformation | Valid | Valid | Invalid | Yes | Yes | SeProfileSingleProcessPrivilege | 118 | | SystemRegistryAppendString | Not implemented | Invalid | Invalid | Yes | Yes | - | 119 | | SystemAitSamplingValue | Valid | Invalid | Invalid | Yes | Yes | SeProfileSingleProcessPrivilege | 120 | | SystemVhdBootInformation | Invalid | Valid | Invalid | Yes | Yes | - | 121 | | SystemCpuQuotaInformation | Valid | Valid | Invalid | Yes | Yes | SeIncreaseQuotaPrivilege | 122 | | SystemNativeBasicInformation | Invalid | Valid | Invalid | Yes | Yes | - | 123 | | SystemErrorPortTimeouts | Invalid | Valid | Invalid | Yes | Yes | - | 124 | | SystemLowPriorityIoInformation | Invalid | Valid | Invalid | Yes | Yes | - | 125 | | SystemBootEntropyInformation | Invalid | Valid | Invalid | Yes | Yes | Kernel mode only | 126 | | SystemVerifierCountersInformation | Invalid | Valid | Invalid | Yes | Yes | - | 127 | | SystemPagedPoolInformationEx | Invalid | Valid | Invalid | Yes | Yes | - | 128 | | SystemSystemPtesInformationEx | Invalid | Valid | Invalid | Yes | Yes | - | 129 | | SystemNodeDistanceInformation | Invalid | Invalid | Valid | Yes | Yes | - | 130 | | SystemAcpiAuditInformation | Invalid | Valid | Invalid | Yes | Yes | - | 131 | | SystemBasicPerformanceInformation | Invalid | Valid | Invalid | Yes | Yes | - | 132 | | SystemQueryPerformanceCounterInformation | Invalid | Valid | Invalid | No | Yes | - | 133 | | SystemSessionBigPoolInformation | Invalid | Valid | Invalid | Yes | No | - | 134 | | SystemBootGraphicsInformation | Valid | Valid | Invalid | Yes | Yes | - | 135 | | SystemScrubPhysicalMemoryInformation | Valid | Invalid | Invalid | Yes | Yes | SeProfileSingleProcessPrivilege | 136 | | SystemBadPageInformation | Invalid | Valid | Invalid | Yes | Yes | - | 137 | | SystemProcessorProfileControlArea | Valid | Invalid | Invalid | Yes | Yes | - | 138 | | SystemCombinePhysicalMemoryInformation | Valid | Invalid | Invalid | Yes | Yes | SeProfileSingleProcessPrivilege | 139 | | SystemEntropyInterruptTimingInformation | Valid | Invalid | Invalid | Yes | Yes | - | 140 | | SystemConsoleInformation | Valid | Invalid | Invalid | Yes | Yes | SeLoadDriverPrivilege | 141 | | SystemPlatformBinaryInformation | Invalid | Valid | Invalid | Yes | Yes | SeTcbPrivilege | 142 | | SystemPolicyInformation | Valid | Valid | Invalid | Yes | Yes | - | 143 | | SystemHypervisorProcessorCountInformation | Invalid | Valid | Invalid | Yes | Yes | - | 144 | | SystemDeviceDataInformation | Invalid | Valid | Invalid | Yes | Yes | - | 145 | | SystemDeviceDataEnumerationInformation | Invalid | Valid | Invalid | Yes | Yes | - | 146 | | SystemMemoryTopologyInformation | Invalid | Valid | Invalid | Yes | Yes | - | 147 | | SystemMemoryChannelInformation | Invalid | Valid | Invalid | Yes | Yes | - | 148 | | SystemBootLogoInformation | Invalid | Valid | Invalid | Yes | Yes | - | 149 | | SystemProcessorPerformanceInformationEx | Invalid | Valid | Valid | Yes | Yes | - | 150 | | SystemCriticalProcessErrorLogInformation | Valid | Invalid | Invalid | Yes | Yes | SeShutdownPrivilege | 151 | | SystemSecureBootPolicyInformation | Invalid | Valid | Invalid | Yes | Yes | - | 152 | | SystemPageFileInformationEx | Invalid | Valid | Invalid | Yes | Yes | - | 153 | | SystemSecureBootInformation | Invalid | Valid | Invalid | Yes | Yes | - | 154 | | SystemEntropyInterruptTimingRawInformation | Invalid | Invalid | Invalid | Yes | Yes | - | 155 | | SystemPortableWorkspaceEfiLauncherInformation | Invalid | Valid | Invalid | Yes | Yes | - | 156 | | SystemFullProcessInformation | Invalid | Valid | Invalid | Yes | Yes | - | 157 | | SystemKernelDebuggerInformationEx | Invalid | Valid | Invalid | Yes | Yes | - | 158 | | SystemBootMetadataInformation | Valid | Valid | Invalid | Yes | Yes | SeTcbPrivilege | 159 | | SystemSoftRebootInformation | Valid | Valid | Invalid | Yes | Yes | SeShutdownPrivilege | 160 | | SystemElamCertificateInformation | Valid | Invalid | Invalid | Yes | Yes | - | 161 | | SystemOfflineDumpConfigInformation | Invalid | Valid | Invalid | Yes | Yes | - | 162 | | SystemProcessorFeaturesInformation | Invalid | Valid | Invalid | Yes | Yes | - | 163 | | SystemRegistryReconciliationInformation | Valid | Invalid | Invalid | Yes | Yes | - | 164 | | SystemEdidInformation | Invalid | Valid | Invalid | Yes | Yes | - | 165 | | SystemManufacturingInformation | Invalid | Valid | Invalid | Yes | Yes | - | 166 | | SystemEnergyEstimationConfigInformation | Invalid | Valid | Invalid | Yes | Yes | - | 167 | | SystemHypervisorDetailInformation | Valid | Valid | Invalid | Yes | Yes | - | 168 | | SystemProcessorCycleStatsInformation | Invalid | Valid | Valid | Yes | Yes | - | 169 | | SystemVmGenerationCountInformation | Valid | Invalid | Invalid | Yes | Yes | - | 170 | | SystemTrustedPlatformModuleInformation | Invalid | Valid | Invalid | Yes | Yes | - | 171 | | SystemKernelDebuggerFlags | Invalid | Valid | Invalid | Yes | Yes | - | 172 | | SystemCodeIntegrityPolicyInformation | Valid | Valid | Invalid | Yes | Yes | - | 173 | | SystemIsolatedUserModeInformation | Invalid | Valid | Valid | Yes | Yes | - | 174 | | SystemHardwareSecurityTestInterfaceResultsInformation | Invalid | Valid | Invalid | Yes | Yes | - | 175 | | SystemSingleModuleInformation | Invalid | Valid | Invalid | Yes | Yes | Kernel mode only | 176 | | SystemAllowedCpuSetsInformation | Valid | Invalid | Invalid | Yes | Yes | - | 177 | | SystemVsmProtectionInformation | Invalid | Valid | Invalid | Yes | Yes | - | 178 | | SystemInterruptCpuSetsInformation | Valid | Invalid | Invalid | Yes | Yes | SeIncreaseBasePriorityPrivilege | 179 | | SystemSecureBootPolicyFullInformation | Invalid | Valid | Invalid | Yes | Yes | - | 180 | | SystemCodeIntegrityPolicyFullInformation | Invalid | Valid | Invalid | Yes | Yes | - | 181 | | SystemAffinitizedInterruptProcessorInformation | Invalid | Valid | Invalid | Yes | Yes | SeIncreaseBasePriorityPrivilege | 182 | | SystemRootSiloInformation | Invalid | Valid | Invalid | Yes | Yes | - | 183 | | SystemCpuSetInformation | Invalid | Valid | Valid | Yes | Yes | - | 184 | | SystemCpuSetTagInformation | Valid | Invalid | Invalid | Yes | Yes | - | 185 | | SystemWin32WerStartCallout | Valid | Invalid | Invalid | Yes | Yes | SeTcbPrivilege | 186 | | SystemSecureKernelProfileInformation | Invalid | Valid | Valid | Yes | Yes | SeSystemProfilePrivilege | 187 | | SystemCodeIntegrityPlatformManifestInformation | Invalid | Valid | Invalid | Yes | Yes | - | 188 | | SystemInterruptSteeringInformation | Invalid | Invalid | Valid | Yes | Yes | - | 189 | | SystemSupportedProcessorArchitectures | Invalid | Valid | Valid | Yes | Yes | - | 190 | | SystemMemoryUsageInformation | Invalid | Valid | Invalid | Yes | Yes | - | 191 | | SystemCodeIntegrityCertificateInformation | Invalid | Valid | Invalid | Yes | Yes | - | 192 | | SystemPhysicalMemoryInformation | Invalid | Valid | Invalid | Yes | Yes | - | 193 | | SystemControlFlowTransition | Invalid | Valid | Invalid | Yes | Yes | - | 194 | | SystemKernelDebuggingAllowed | Invalid | Valid | Invalid | Yes | Yes | - | 195 | | SystemActivityModerationExeState | Valid | Invalid | Invalid | Yes | Yes | - | 196 | | SystemActivityModerationUserSettings | Invalid | Valid | Invalid | Yes | Yes | - | 197 | | SystemCodeIntegrityPoliciesFullInformation | Invalid | Valid | Invalid | Yes | Yes | - | 198 | | SystemCodeIntegrityUnlockInformation | Valid | Valid | Invalid | Yes | Yes | - | 199 | | SystemIntegrityQuotaInformation | Valid | Invalid | Invalid | Yes | Yes | SeDebugPrivilege | 200 | | SystemFlushInformation | Invalid | Valid | Invalid | Yes | Yes | - | 201 | | SystemProcessorIdleMaskInformation | Invalid | Valid | Invalid | Yes | Yes | - | 202 | | SystemSecureDumpEncryptionInformation | Valid | Valid | Valid | Yes | Yes | SeDebugPrivilege (query), SeTcbPrivilege (set) | 203 | | SystemWriteConstraintInformation | Invalid | Valid | Invalid | Yes | Yes | - | 204 | | SystemKernelVaShadowInformation | Invalid | Valid | Invalid | Yes | Yes | - | 205 | | SystemHypervisorSharedPageInformation | Invalid | Valid | Invalid | Yes | Yes | - | 206 | | SystemFirmwareBootPerformanceInformation | Invalid | Valid | Invalid | Yes | Yes | - | 207 | | SystemCodeIntegrityVerificationInformation | Valid | Valid | Invalid | Yes | Yes | - | 208 | | SystemFirmwarePartitionInformation | Invalid | Valid | Invalid | Yes | Yes | - | 209 | | SystemSpeculationControlInformation | Invalid | Valid | Invalid | Yes | Yes | - | 210 | | SystemDmaGuardPolicyInformation | Invalid | Valid | Invalid | Yes | Yes | - | 211 | | SystemEnclaveLaunchControlInformation | Invalid | Invalid | Invalid | Yes | Yes | - | 212 | | SystemWorkloadAllowedCpuSetsInformation | Valid | Invalid | Invalid | Yes | Yes | - | 213 | | SystemCodeIntegrityUnlockModeInformation | Invalid | Invalid | Invalid | Yes | Yes | - | 214 | | SystemLeapSecondInformation | Valid | Valid | Invalid | Yes | Yes | SeSystemtimePrivilege (set only) | 215 | | SystemFlags2Information | Valid | Valid | Invalid | Yes | Yes | SeDebugPrivilege (set only) | 216 | | SystemSecurityModelInformation | Invalid | Valid | Invalid | Yes | Yes | - | 217 | | SystemCodeIntegritySyntheticCacheInformation | Invalid | Valid | Valid | Yes | Yes | - | 218 | | SystemFeatureConfigurationInformation | Valid | Invalid | Valid | Yes | Yes | - | 219 | | SystemFeatureConfigurationSectionInformation | Invalid | Invalid | Valid | Yes | Yes | - | 220 | | SystemFeatureUsageSubscriptionInformation | Valid | Invalid | Invalid | Yes | Yes | - | 221 | | SystemSecureSpeculationControlInformation | Invalid | Valid | Invalid | Yes | Yes | - | 222 | | SystemSpacesBootInformation | Invalid | Valid | Invalid | Yes | Yes | Kernel mode only | 223 | | SystemFwRamdiskInformation | Invalid | Valid | Invalid | Yes | Yes | Kernel mode only | 224 | | SystemWheaIpmiHardwareInformation | Invalid | Valid | Invalid | Yes | Yes | - | 225 | | SystemDifSetRuleClassInformation | Valid | Invalid | Invalid | Yes | Yes | SeDebugPrivilege | 226 | | SystemDifClearRuleClassInformation | Valid | Invalid | Invalid | Yes | Yes | SeDebugPrivilege | 227 | | SystemDifApplyPluginVerificationOnDriver | Valid | Invalid | Invalid | Yes | Yes | SeDebugPrivilege | 228 | | SystemDifRemovePluginVerificationOnDriver | Valid | Invalid | Invalid | Yes | Yes | SeDebugPrivilege | 229 | | SystemShadowStackInformation | Invalid | Valid | Invalid | Yes | Yes | - | 230 | | SystemBuildVersionInformation | Invalid | Invalid | Valid | Yes | Yes | - | 231 | | SystemPoolLimitInformation | Valid | Invalid | Valid | Yes | Yes | SeIncreaseQuotaPrivilege | 232 | | SystemCodeIntegrityAddDynamicStore | Valid | Invalid | Invalid | Yes | Yes | - | 233 | | SystemCodeIntegrityClearDynamicStores | Valid | Invalid | Invalid | Yes | Yes | - | 234 | | SystemDifPoolTrackingInformation | Valid | Invalid | Invalid | Yes | Yes | SeDebugPrivilege | 235 | | SystemPoolZeroingInformation | Invalid | Valid | Invalid | Yes | Yes | - | 236 | | SystemDpcWatchdogInformation | Valid | Valid | Invalid | Yes | Yes | - | 237 | | SystemDpcWatchdogInformation2 | Valid | Valid | Invalid | Yes | Yes | - | 238 | | SystemSupportedProcessorArchitectures2 | Invalid | Valid | Valid | Yes | Yes | - | 239 | | SystemSingleProcessorRelationshipInformation | Invalid | Invalid | Valid | Yes | Yes | - | 240 | | SystemXfgCheckFailureInformation | Invalid | Valid | Valid | Yes | Yes | - | 241 | | SystemIommuStateInformation | Valid | Invalid | Invalid | Yes | Yes | - | 242 | | SystemHypervisorMinrootInformation | Invalid | Valid | Invalid | Yes | Yes | - | 243 | | SystemHypervisorBootPagesInformation | Valid | Invalid | Invalid | Yes | Yes | - | 244 | | SystemPointerAuthInformation | Invalid | Valid | Invalid | No | Yes | - | 245 | | SystemSecureKernelDebuggerInformation | Invalid | Valid | Invalid | No | Yes | - | 246 | 247 | ## Structures for Information Classes 248 | Here are the structures for most of the system information classes. These were mostly gathered from public symbols and extracted using ntdiff, few were reverse engineered. Where there are embedded structures inside the one used by the API, these were included as well. 249 | In some cases the class can be used for both NtSet and NtQuery APIs, then there are sometimes two separate structures for the two APIs. 250 | 251 | ### SystemBasicInformation + SystemNativeBasicInformation 252 | Enum values: 0 + 114 253 | ``` 254 | typedef struct _SYSTEM_BASIC_INFORMATION 255 | { 256 | ULONG Reserved; 257 | ULONG TimerResolution; 258 | ULONG PageSize; 259 | ULONG NumberOfPhysicalPages; 260 | ULONG LowestPhysicalPageNumber; 261 | ULONG HighestPhysicalPageNumber; 262 | ULONG AllocationGranularity; 263 | ULONG64 MinimumUserModeAddress; 264 | ULONG64 MaximumUserModeAddress; 265 | ULONG64 ActiveProcessorsAffinityMask; 266 | CHAR NumberOfProcessors; 267 | CHAR __PADDING__[7]; 268 | } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION; 269 | ``` 270 | 271 | ### SystemProcessorInformation 272 | Enum value: 1 273 | ``` 274 | typedef struct _SYSTEM_PROCESSOR_INFORMATION 275 | { 276 | USHIRT ProcessorArchitecture; 277 | USHIRT ProcessorLevel; 278 | USHIRT ProcessorRevision; 279 | USHIRT MaximumProcessors; 280 | ULONG ProcessorFeatureBits; 281 | } SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION; 282 | ``` 283 | 284 | ### SystemPerformanceInformation 285 | Enum value: 2 286 | ``` 287 | typedef struct _SYSTEM_PERFORMANCE_INFORMATION 288 | { 289 | LARGE_INTEGER IdleProcessTime; 290 | LARGE_INTEGER IoReadTransferCount; 291 | LARGE_INTEGER IoWriteTransferCount; 292 | LARGE_INTEGER IoOtherTransferCount; 293 | ULONG IoReadOperationCount; 294 | ULONG IoWriteOperationCount; 295 | ULONG IoOtherOperationCount; 296 | ULONG AvailablePages; 297 | ULONG CommittedPages; 298 | ULONG CommitLimit; 299 | ULONG PeakCommitment; 300 | ULONG PageFaultCount; 301 | ULONG CopyOnWriteCount; 302 | ULONG TransitionCount; 303 | ULONG CacheTransitionCount; 304 | ULONG DemandZeroCount; 305 | ULONG PageReadCount; 306 | ULONG PageReadIoCount; 307 | ULONG CacheReadCount; 308 | ULONG CacheIoCount; 309 | ULONG DirtyPagesWriteCount; 310 | ULONG DirtyWriteIoCount; 311 | ULONG MappedPagesWriteCount; 312 | ULONG MappedWriteIoCount; 313 | ULONG PagedPoolPages; 314 | ULONG NonPagedPoolPages; 315 | ULONG PagedPoolAllocs; 316 | ULONG PagedPoolFrees; 317 | ULONG NonPagedPoolAllocs; 318 | ULONG NonPagedPoolFrees; 319 | ULONG FreeSystemPtes; 320 | ULONG ResidentSystemCodePage; 321 | ULONG TotalSystemDriverPages; 322 | ULONG TotalSystemCodePages; 323 | ULONG NonPagedPoolLookasideHits; 324 | ULONG PagedPoolLookasideHits; 325 | ULONG AvailablePagedPoolPages; 326 | ULONG ResidentSystemCachePage; 327 | ULONG ResidentPagedPoolPage; 328 | ULONG ResidentSystemDriverPage; 329 | ULONG CcFastReadNoWait; 330 | ULONG CcFastReadWait; 331 | ULONG CcFastReadResourceMiss; 332 | ULONG CcFastReadNotPossible; 333 | ULONG CcFastMdlReadNoWait; 334 | ULONG CcFastMdlReadWait; 335 | ULONG CcFastMdlReadResourceMiss; 336 | ULONG CcFastMdlReadNotPossible; 337 | ULONG CcMapDataNoWait; 338 | ULONG CcMapDataWait; 339 | ULONG CcMapDataNoWaitMiss; 340 | ULONG CcMapDataWaitMiss; 341 | ULONG CcPinMappedDataCount; 342 | ULONG CcPinReadNoWait; 343 | ULONG CcPinReadWait; 344 | ULONG CcPinReadNoWaitMiss; 345 | ULONG CcPinReadWaitMiss; 346 | ULONG CcCopyReadNoWait; 347 | ULONG CcCopyReadWait; 348 | ULONG CcCopyReadNoWaitMiss; 349 | ULONG CcCopyReadWaitMiss; 350 | ULONG CcMdlReadNoWait; 351 | ULONG CcMdlReadWait; 352 | ULONG CcMdlReadNoWaitMiss; 353 | ULONG CcMdlReadWaitMiss; 354 | ULONG CcReadAheadIos; 355 | ULONG CcLazyWriteIos; 356 | ULONG CcLazyWritePages; 357 | ULONG CcDataFlushes; 358 | ULONG CcDataPages; 359 | ULONG ContextSwitches; 360 | ULONG FirstLevelTbFills; 361 | ULONG SecondLevelTbFills; 362 | ULONG SystemCalls; 363 | ULONG64 CcTotalDirtyPages; 364 | ULONG64 CcDirtyPageThreshold; 365 | ULONG64 ResidentAvailablePages; 366 | ULONG64 SharedCommittedPages; 367 | } SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION; 368 | ``` 369 | 370 | ### SystemTimeOfDayInformation 371 | Enum value: 3 372 | ``` 373 | typedef struct _SYSTEM_TIMEOFDAY_INFORMATION 374 | { 375 | LARGE_INTEGER BootTime; 376 | LARGE_INTEGER CurrentTime; 377 | LARGE_INTEGER TimeZoneBias; 378 | ULONG TimeZoneId; 379 | ULONG Reserved; 380 | ULONG64 BootTimeBias; 381 | ULONG64 SleepTimeBias; 382 | } SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION; 383 | ``` 384 | 385 | ### SystemProcessInformation 386 | Enum value: 5 387 | ``` 388 | typedef struct _SYSTEM_PROCESS_INFORMATION 389 | { 390 | ULONG NextEntryOffset; 391 | ULONG NumberOfThreads; 392 | LARGE_INTEGER WorkingSetPrivateSize; 393 | ULONG HardFaultCount; 394 | ULONG NumberOfThreadsHighWatermark; 395 | ULONG64 CycleTime; 396 | LARGE_INTEGER CreateTime; 397 | LARGE_INTEGER UserTime; 398 | LARGE_INTEGER KernelTime; 399 | UNICODE_STRING ImageName; 400 | LONG BasePriority; 401 | PVOID UniqueProcessId; 402 | PVOID InheritedFromUniqueProcessId; 403 | ULONG HandleCount; 404 | ULONG SessionId; 405 | ULONG64 UniqueProcessKey; 406 | ULONG64 PeakVirtualSize; 407 | ULONG64 VirtualSize; 408 | ULONG PageFaultCount; 409 | ULONG64 PeakWorkingSetSize; 410 | ULONG64 WorkingSetSize; 411 | ULONG64 QuotaPeakPagedPoolUsage; 412 | ULONG64 QuotaPagedPoolUsage; 413 | ULONG64 QuotaPeakNonPagedPoolUsage; 414 | ULONG64 QuotaNonPagedPoolUsage; 415 | ULONG64 PagefileUsage; 416 | ULONG64 PeakPagefileUsage; 417 | ULONG64 PrivatePageCount; 418 | LARGE_INTEGER ReadOperationCount; 419 | LARGE_INTEGER WriteOperationCount; 420 | LARGE_INTEGER OtherOperationCount; 421 | LARGE_INTEGER ReadTransferCount; 422 | LARGE_INTEGER WriteTransferCount; 423 | LARGE_INTEGER OtherTransferCount; 424 | } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION; 425 | ``` 426 | 427 | ### SystemCallCountInformation 428 | Enum value: 6 429 | ``` 430 | typedef struct _SYSTEM_CALL_COUNT_INFORMATION 431 | { 432 | ULONG Length; 433 | ULONG NumberOfTables; 434 | } SYSTEM_CALL_COUNT_INFORMATION, *PSYSTEM_CALL_COUNT_INFORMATION; 435 | ``` 436 | 437 | ### SystemDeviceInformation 438 | Enum value: 7 439 | ``` 440 | typedef struct _SYSTEM_DEVICE_INFORMATION 441 | { 442 | ULONG NumberOfDisks; 443 | ULONG NumberOfFloppies; 444 | ULONG NumberOfCdRoms; 445 | ULONG NumberOfTapes; 446 | ULONG NumberOfSerialPorts; 447 | ULONG NumberOfParallelPorts; 448 | } SYSTEM_DEVICE_INFORMATION, *PSYSTEM_DEVICE_INFORMATION; 449 | ``` 450 | 451 | ### SystemProcessorPerformanceInformation 452 | Enum value: 8 453 | ``` 454 | typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION 455 | { 456 | LARGE_INTEGER IdleTime; 457 | LARGE_INTEGER KernelTime; 458 | LARGE_INTEGER UserTime; 459 | LARGE_INTEGER DpcTime; 460 | LARGE_INTEGER InterruptTime; 461 | ULONG InterruptCount; 462 | LONG __PADDING__[1]; 463 | } SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION; 464 | ``` 465 | 466 | ### SystemFlagsInformation 467 | Eunm value: 9 468 | ``` 469 | typedef struct _SYSTEM_FLAGS_INFORMATION 470 | { 471 | ULONG Flags; 472 | } SYSTEM_FLAGS_INFORMATION, *PSYSTEM_FLAGS_INFORMATION; 473 | ``` 474 | 475 | ### SystemCallTimeInformation 476 | Enum value: 10 477 | ``` 478 | typedef struct _SYSTEM_CALL_TIME_INFORMATION 479 | { 480 | ULONG Length; 481 | ULONG TotalCalls; 482 | LARGE_INTEGER TimeOfCalls[1]; 483 | } SYSTEM_CALL_TIME_INFORMATION, *PSYSTEM_CALL_TIME_INFORMATION; 484 | ``` 485 | 486 | ### SystemModuleInformation 487 | Enum value: 11 488 | ``` 489 | typedef struct _RTL_PROCESS_MODULE_INFORMATION 490 | { 491 | PVOID Section; 492 | PVOID MappedBase; 493 | PVOID ImageBase; 494 | ULONG ImageSize; 495 | ULONG Flags; 496 | USHORT LoadOrderIndex; 497 | USHORT InitOrderIndex; 498 | USHORT LoadCount; 499 | USHORT OffsetToFileName; 500 | CHAR FullPathName[256]; 501 | } RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION; 502 | ``` 503 | 504 | ### SystemLocksInformation 505 | Enum value: 12 506 | ``` 507 | typedef struct _RTL_PROCESS_LOCK_INFORMATION 508 | { 509 | PVOID Address; 510 | USHORT Type; 511 | USHORT CreatorBackTraceIndex; 512 | PVOID OwningThread; 513 | LONG LockCount; 514 | ULONG ContentionCount; 515 | ULONG EntryCount; 516 | LONG RecursionCount; 517 | ULONG NumberOfWaitingShared; 518 | ULONG NumberOfWaitingExclusive; 519 | } RTL_PROCESS_LOCK_INFORMATION, *PRTL_PROCESS_LOCK_INFORMATION; 520 | ``` 521 | 522 | ### SystemStackTraceInformation 523 | Enum value: 13 524 | ``` 525 | typedef struct _RTL_PROCESS_BACKTRACE_INFORMATION 526 | { 527 | CHAR* SymbolicBackTrace; 528 | ULONG TraceCount; 529 | USHORT Index; 530 | USHORT Depth; 531 | PVOID BackTrace[32]; 532 | } RTL_PROCESS_BACKTRACE_INFORMATION, *PRTL_PROCESS_BACKTRACE_INFORMATION; 533 | 534 | typedef struct _RTL_PROCESS_BACKTRACES 535 | { 536 | ULONG64 CommittedMemory; 537 | ULONG64 ReservedMemory; 538 | ULONG NumberOfBackTraceLookups; 539 | ULONG NumberOfBackTraces; 540 | RTL_PROCESS_BACKTRACE_INFORMATION BackTraces[1]; 541 | } RTL_PROCESS_BACKTRACES, *PRTL_PROCESS_BACKTRACES; 542 | ``` 543 | 544 | ### SystemPagedPoolInformation + SystemNonPagedPoolInformation 545 | Enum values: 14 + 15 546 | ``` 547 | typedef struct _SYSTEM_POOL_ENTRY 548 | { 549 | CHAR Allocated; 550 | CHAR Spare0; 551 | USHORT AllocatorBackTraceIndex; 552 | ULONG Size; 553 | union 554 | { 555 | CHAR Tag[4]; 556 | ULONG TagULONG; 557 | PVOID ProcessCHARgedQuota; 558 | }; 559 | } SYSTEM_POOL_ENTRY, *PSYSTEM_POOL_ENTRY; 560 | 561 | typedef struct _SYSTEM_POOL_INFORMATION 562 | { 563 | ULONG64 TotalSize; 564 | PVOID FirstEntry; 565 | USHORT EntryOverhead; 566 | CHAR PoolTagPresent; 567 | CHAR Spare0; 568 | ULONG NumberOfEntries; 569 | SYSTEM_POOL_ENTRY Entries[1]; 570 | } SYSTEM_POOL_INFORMATION, *PSYSTEM_POOL_INFORMATION; 571 | ``` 572 | 573 | ### SystemHandleInformation 574 | Enum value: 16 575 | ``` 576 | typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO 577 | { 578 | USHORT UniqueProcessId; 579 | USHORT CreatorBackTraceIndex; 580 | CHAR ObjectTypeIndex; 581 | CHAR HandleAttributes; 582 | USHORT HandleValue; 583 | PVOID Object; 584 | ULONG GrantedAccess; 585 | LONG __PADDING__[1]; 586 | } SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO; 587 | 588 | typedef struct _SYSTEM_HANDLE_INFORMATION 589 | { 590 | ULONG NumberOfHandles; 591 | SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1]; 592 | } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; 593 | ``` 594 | 595 | ### SystemObjectInformation 596 | Enum value: 17 597 | ``` 598 | typedef struct _SYSTEM_OBJECT_INFORMATION 599 | { 600 | ULONG NextEntryOffset; 601 | PVOID Object; 602 | PVOID CreatorUniqueProcess; 603 | USHORT CreatorBackTraceIndex; 604 | USHORT Flags; 605 | LONG PointerCount; 606 | LONG HandleCount; 607 | ULONG PagedPoolCHARge; 608 | ULONG NonPagedPoolCHARge; 609 | PVOID ExclusiveProcessId; 610 | PVOID SecurityDescriptor; 611 | OBJECT_NAME_INFORMATION NameInfo; 612 | } SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION; 613 | ``` 614 | 615 | ### SystemPageFileInformation 616 | Enum value: 18 617 | ``` 618 | typedef struct _SYSTEM_PAGEFILE_INFORMATION 619 | { 620 | ULONG NextEntryOffset; 621 | ULONG TotalSize; 622 | ULONG TotalInUse; 623 | ULONG PeakUsage; 624 | UNICODE_STRING PageFileName; 625 | } SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION; 626 | ``` 627 | 628 | ### SystemFileCacheInformation 629 | Enum value: 21 630 | ``` 631 | typedef struct _SYSTEM_FILECACHE_INFORMATION 632 | { 633 | ULONG64 CurrentSize; 634 | ULONG64 PeakSize; 635 | ULONG PageFaultCount; 636 | ULONG64 MinimumWorkingSet; 637 | ULONG64 MaximumWorkingSet; 638 | ULONG64 CurrentSizeIncludingTransitionInPages; 639 | ULONG64 PeakSizeIncludingTransitionInPages; 640 | ULONG TransitionRePurposeCount; 641 | ULONG Flags; 642 | } SYSTEM_FILECACHE_INFORMATION, *PSYSTEM_FILECACHE_INFORMATION; 643 | ``` 644 | 645 | ### SystemPoolTagInformation 646 | Enum value: 22 647 | ``` 648 | typedef struct _SYSTEM_POOLTAG 649 | { 650 | union 651 | { 652 | CHAR Tag[4]; 653 | ULONG TagULONG; 654 | }; 655 | ULONG PagedAllocs; 656 | ULONG PagedFrees; 657 | ULONG64 PagedUsed; 658 | ULONG NonPagedAllocs; 659 | ULONG NonPagedFrees; 660 | ULONG64 NonPagedUsed; 661 | } SYSTEM_POOLTAG, *PSYSTEM_POOLTAG; 662 | 663 | typedef struct _SYSTEM_POOLTAG_INFORMATION 664 | { 665 | ULONG Count; 666 | SYSTEM_POOLTAG TagInfo[1]; 667 | } SYSTEM_POOLTAG_INFORMATION, *PSYSTEM_POOLTAG_INFORMATION; 668 | ``` 669 | 670 | ### SystemInterruptInformation 671 | Enum value: 23 672 | ``` 673 | typedef struct _SYSTEM_INTERRUPT_INFORMATION 674 | { 675 | ULONG ContextSwitches; 676 | ULONG DpcCount; 677 | ULONG DpcRate; 678 | ULONG TimeIncrement; 679 | ULONG DpcBypassCount; 680 | ULONG ApcBypassCount; 681 | } SYSTEM_INTERRUPT_INFORMATION, *PSYSTEM_INTERRUPT_INFORMATION; 682 | ``` 683 | 684 | ### SystemDpcBehaviorInformation 685 | Enum value: 24 686 | ``` 687 | typedef struct _SYSTEM_DPC_BEHAVIOR_INFORMATION 688 | { 689 | ULONG Spare; 690 | ULONG DpcQueueDepth; 691 | ULONG MinimumDpcRate; 692 | ULONG AdjustDpcThreshold; 693 | ULONG IdealDpcRate; 694 | } SYSTEM_DPC_BEHAVIOR_INFORMATION, *PSYSTEM_DPC_BEHAVIOR_INFORMATION; 695 | ``` 696 | 697 | ### SystemLoadGdiDriverInformation + SystemUnloadGdiDriverInformation + SystemLoadGdiDriverInSystemSpace 698 | Enum values: 26 + 27 + 54 699 | ``` 700 | typedef struct _SYSTEM_GDI_DRIVER_INFORMATION 701 | { 702 | UNICODE_STRING DriverName; 703 | PVOID ImageAddress; 704 | PVOID SectionPointer; 705 | PVOID EntryPoint; 706 | IMAGE_EXPORT_DIRECTORY* ExportSectionPointer; 707 | ULONG ImageLength; 708 | LONG __PADDING__[1]; 709 | } SYSTEM_GDI_DRIVER_INFORMATION, *PSYSTEM_GDI_DRIVER_INFORMATION; 710 | ``` 711 | 712 | ### SystemTimeAdjustmentInformation 713 | Enum value: 28 714 | ``` 715 | typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION 716 | { 717 | ULONG TimeAdjustment; 718 | CHAR Enable; 719 | CHAR __PADDING__[3]; 720 | } SYSTEM_SET_TIME_ADJUST_INFORMATION, *PSYSTEM_SET_TIME_ADJUST_INFORMATION; 721 | 722 | typedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION 723 | { 724 | ULONG TimeAdjustment; 725 | ULONG TimeIncrement; 726 | CHAR Enable; 727 | CHAR __PADDING__[3]; 728 | } SYSTEM_QUERY_TIME_ADJUST_INFORMATION, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION; 729 | ``` 730 | 731 | ### SystemMirrorMemoryInformation 732 | Enum value: 30 733 | 734 | Requires no input buffer. 735 | 736 | ### SystemExceptionInformation 737 | Enum value: 33 738 | ``` 739 | typedef struct _SYSTEM_EXCEPTION_INFORMATION 740 | { 741 | ULONG AlignmentFixupCount; 742 | ULONG ExceptionDispatchCount; 743 | ULONG FloatingEmulationCount; 744 | ULONG ByteWordEmulationCount; 745 | } SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION; 746 | ``` 747 | 748 | ### SystemCrashDumpStateInformation 749 | Enum value: 34 750 | ``` 751 | typedef enum _SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS 752 | { 753 | SystemCrashDumpDisable = 0, 754 | SystemCrashDumpReconfigure = 1, 755 | SystemCrashDumpInitializationComplete = 2, 756 | } SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS, *PSYSTEM_CRASH_DUMP_CONFIGURATION_CLASS; 757 | 758 | typedef struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION 759 | { 760 | enum _SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS CrashDumpConfigurationClass; 761 | } SYSTEM_CRASH_DUMP_STATE_INFORMATION, *PSYSTEM_CRASH_DUMP_STATE_INFORMATION; 762 | ``` 763 | 764 | ### SystemKernelDebuggerInformation 765 | Enum value: 35 766 | ``` 767 | typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION 768 | { 769 | CHAR KernelDebuggerEnabled; 770 | CHAR KernelDebuggerNotPresent; 771 | } SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION; 772 | ``` 773 | 774 | ### SystemContextSwitchInformation 775 | Enum value: 36 776 | ``` 777 | typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION 778 | { 779 | ULONG ContextSwitches; 780 | ULONG FindAny; 781 | ULONG FindLast; 782 | ULONG FindIdeal; 783 | ULONG IdleAny; 784 | ULONG IdleCurrent; 785 | ULONG IdleLast; 786 | ULONG IdleIdeal; 787 | ULONG PreemptAny; 788 | ULONG PreemptCurrent; 789 | ULONG PreemptLast; 790 | ULONG SwitchToIdle; 791 | } SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION; 792 | ``` 793 | 794 | ### SystemRegistryQuotaInformation 795 | Enum value: 37 796 | ``` 797 | typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION 798 | { 799 | ULONG RegistryQuotaAllowed; 800 | ULONG RegistryQuotaUsed; 801 | ULONG64 PagedPoolSize; 802 | } SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION; 803 | ``` 804 | 805 | ### SystemExtendServiceTableInformation 806 | Enum value: 38 807 | ``` 808 | typedef struct _SYSTEM_SERVICE_TABLE_EXTEND_INFORMATION 809 | { 810 | UNICODE_STRING DriverName; 811 | } SYSTEM_SERVICE_TABLE_EXTEND_INFORMATION, *PSYSTEM_SERVICE_TABLE_EXTEND_INFORMATION; 812 | ``` 813 | 814 | ### SystemPrioritySeperation 815 | Enum value: 39 816 | ``` 817 | typedef struct _SYSTEM_PRIORITY_SEPARATION_INFORMATION 818 | { 819 | ULONG PrioritySeparation; 820 | } SYSTEM_PRIORITY_SEPARATION_INFORMATION, *PSYSTEM_PRIORITY_SEPARATION_INFORMATION; 821 | ``` 822 | 823 | ### SystemVerifierAddDriverInformation + SystemVerifierRemoveDriverInformation 824 | Enum values: 40 + 41 825 | ``` 826 | typedef struct _SYSTEM_VERIFIER_DRIVER_INFORMATION 827 | { 828 | UNICODE_STRING DriverName; 829 | } SYSTEM_VERIFIER_DRIVER_INFORMATION, *PSYSTEM_VERIFIER_DRIVER_INFORMATION; 830 | ``` 831 | 832 | ### SystemProcessorIdleInformation 833 | Enum value: 42 834 | ``` 835 | typedef struct _SYSTEM_PROCESSOR_IDLE_INFORMATION 836 | { 837 | ULONG64 IdleTime; 838 | ULONG64 C1Time; 839 | ULONG64 C2Time; 840 | ULONG64 C3Time; 841 | ULONG C1Transitions; 842 | ULONG C2Transitions; 843 | ULONG C3Transitions; 844 | ULONG Padding; 845 | } SYSTEM_PROCESSOR_IDLE_INFORMATION, *PSYSTEM_PROCESSOR_IDLE_INFORMATION; 846 | ``` 847 | 848 | ### SystemLegacyDriverInformation 849 | Enum value: 43 850 | ``` 851 | typedef struct _SYSTEM_LEGACY_DRIVER_INFORMATION 852 | { 853 | ULONG VetoType; 854 | UNICODE_STRING VetoList; 855 | } SYSTEM_LEGACY_DRIVER_INFORMATION, *PSYSTEM_LEGACY_DRIVER_INFORMATION; 856 | ``` 857 | 858 | ### SystemCurrentTimeZoneInformation 859 | Enum value: 44 860 | ``` 861 | typedef struct _RTL_TIME_ZONE_INFORMATION 862 | { 863 | LONG Bias; 864 | wCHAR_t StandardName[32]; 865 | TIME_FIELDS StandardStart; 866 | LONG StandardBias; 867 | wCHAR_t DaylightName[32]; 868 | TIME_FIELDS DaylightStart; 869 | LONG DaylightBias; 870 | } RTL_TIME_ZONE_INFORMATION, *PRTL_TIME_ZONE_INFORMATION; 871 | ``` 872 | 873 | ### SystemLookasideInformation 874 | Enum value: 45 875 | ``` 876 | typedef struct _SYSTEM_LOOKASIDE_INFORMATION 877 | { 878 | USHORT CurrentDepth; 879 | USHORT MaximumDepth; 880 | ULONG TotalAllocates; 881 | ULONG AllocateMisses; 882 | ULONG TotalFrees; 883 | ULONG FreeMisses; 884 | ULONG Type; 885 | ULONG Tag; 886 | ULONG Size; 887 | } SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION; 888 | ``` 889 | 890 | ### SystemTimeSlipNotification 891 | Enum value: 46 892 | ``` 893 | typedef struct _SYSTEM_TIME_SLIP_NOTIFICATION_INFORMATION 894 | { 895 | HANDLE EventHandle; 896 | } SYSTEM_TIME_SLIP_NOTIFICATION_INFORMATION, *PSYSTEM_TIME_SLIP_NOTIFICATION_INFORMATION; 897 | ``` 898 | 899 | ### SystemRangeStartInformation 900 | Enum value: 50 901 | ``` 902 | typedef struct _SYSTEM_RANGE_START_INFORMATION 903 | { 904 | PVOID RangeStartAddress; 905 | } SYSTEM_RANGE_START_INFORMATION, *PSYSTEM_RANGE_START_INFORMATION; 906 | ``` 907 | 908 | ### SystemVerifierInformation 909 | Enum value: 51 910 | ``` 911 | typedef struct _SYSTEM_VERIFIER_INFORMATION 912 | { 913 | ULONG NextEntryOffset; 914 | ULONG Level; 915 | ULONG RuleClasses[2]; 916 | ULONG TriageContext; 917 | union 918 | { 919 | union 920 | { 921 | struct 922 | { 923 | struct 924 | { 925 | ULONG AreAllDriversBeingVerified : 1; 926 | ULONG DisabledFromCrash : 1; 927 | ULONG Spare : 30; 928 | }; 929 | } Flags; 930 | ULONG Whole; 931 | }; 932 | } u1; 933 | UNICODE_STRING DriverName; 934 | ULONG RaiseIrqls; 935 | ULONG AcquireSpinLocks; 936 | ULONG SynchronizeExecutions; 937 | ULONG AllocationsAttempted; 938 | ULONG AllocationsSucceeded; 939 | ULONG AllocationsSucceededSpecialPool; 940 | ULONG AllocationsWithNoTag; 941 | ULONG TrimRequests; 942 | ULONG Trims; 943 | ULONG AllocationsFailed; 944 | ULONG AllocationsFailedDeliberately; 945 | ULONG Loads; 946 | ULONG Unloads; 947 | ULONG UnTrackedPool; 948 | ULONG CurrentPagedPoolAllocations; 949 | ULONG CurrentNonPagedPoolAllocations; 950 | ULONG PeakPagedPoolAllocations; 951 | ULONG PeakNonPagedPoolAllocations; 952 | ULONG64 PagedPoolUsageInBytes; 953 | ULONG64 NonPagedPoolUsageInBytes; 954 | ULONG64 PeakPagedPoolUsageInBytes; 955 | ULONG64 PeakNonPagedPoolUsageInBytes; 956 | } SYSTEM_VERIFIER_INFORMATION, *PSYSTEM_VERIFIER_INFORMATION; 957 | ``` 958 | 959 | ### SystemVerifierThunkExtend 960 | Enum value: 52 961 | 962 | Receives an array of DRIVER_VERIFIER_THUNK_PAIRS: 963 | ``` 964 | typedef struct _DRIVER_VERIFIER_THUNK_PAIRS 965 | { 966 | PVOID PristineRoutine ; 967 | PVOID NewRoutine ; 968 | } DRIVER_VERIFIER_THUNK_PAIRS, *PDRIVER_VERIFIER_THUNK_PAIRS; 969 | ``` 970 | 971 | ### SystemSessionProcessInformation 972 | Enum value: 53 973 | ``` 974 | typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION 975 | { 976 | ULONG SessionId; 977 | ULONG SizeOfBuf; 978 | PVOID Buffer; 979 | } SYSTEM_SESSION_PROCESS_INFORMATION, *PSYSTEM_SESSION_PROCESS_INFORMATION; 980 | ``` 981 | 982 | ### SystemNumaProcessorMap 983 | Enum value: 55 984 | ``` 985 | typedef struct _SYSTEM_NUMA_INFORMATION 986 | { 987 | ULONG HighestNodeNumber; 988 | ULONG Reserved; 989 | union 990 | { 991 | GROUP_AFFINITY ActiveProcessorsGroupAffinity[64]; 992 | ULONG64 AvailableMemory[64]; 993 | ULONG64 Pad[128]; 994 | }; 995 | } SYSTEM_NUMA_INFORMATION, *PSYSTEM_NUMA_INFORMATION; 996 | ``` 997 | 998 | ### SystemPrefetcherInformation 999 | Enum value: 56 1000 | ``` 1001 | typedef struct _SYSTEM_PREFETCH_INFORMATION 1002 | { 1003 | ULONG Version; 1004 | ULONG Signature; 1005 | ULONG Flags; 1006 | ULONG Unknown; 1007 | ULONG BootPhase; 1008 | ULONG BufferSize; 1009 | ULONG Flags2; 1010 | ULONG Pad[4]; 1011 | } SYSTEM_PREFETCH_INFORMATION, *PSYSTEM_PREFETCH_INFORMATION; 1012 | ``` 1013 | 1014 | ### SystemExtendedProcessInformation 1015 | Enum value: 57 1016 | 1017 | Returns a buffer containing a SYSTEM_PROCESS_INFORMATION structure followed by SYSTEM_PROCESS_INFORMATION_EXTENSION: 1018 | ``` 1019 | typedef struct _SYSTEM_PROCESS_INFORMATION_EXTENSION 1020 | { 1021 | PROCESS_DISK_COUNTERS DiskCounters; 1022 | ULONG64 ContextSwitches; 1023 | union 1024 | { 1025 | ULONG Flags; 1026 | struct 1027 | { 1028 | ULONG HasStrongId : 1; 1029 | ULONG Classification : 4; 1030 | ULONG BackgroundActivityModerated : 1; 1031 | ULONG Spare : 26; 1032 | }; 1033 | }; 1034 | ULONG UserSidOffset; 1035 | ULONG PackageFullNameOffset; 1036 | PROCESS_ENERGY_VALUES EnergyValues; 1037 | ULONG AppIdOffset; 1038 | ULONG64 SharedCommitCHARge; 1039 | ULONG JobObjectId; 1040 | ULONG SpareULONG; 1041 | ULONG64 ProcessSequenceNumber; 1042 | } SYSTEM_PROCESS_INFORMATION_EXTENSION, *PSYSTEM_PROCESS_INFORMATION_EXTENSION; 1043 | ``` 1044 | 1045 | ### SystemRecommendedSharedDataAlignment 1046 | Enum value: 58 1047 | ``` 1048 | typedef struct _SYSTEM_RECOMMENDED_ALIGNMENT_INFORMATION 1049 | { 1050 | ULONG RecommendedAlignment; 1051 | } SYSTEM_RECOMMENDED_ALIGNMENT_INFORMATION, *PSYSTEM_RECOMMENDED_ALIGNMENT_INFORMATION; 1052 | ``` 1053 | 1054 | ### SystemComPlusPackage 1055 | Enum value: 59 1056 | ``` 1057 | typedef struct _SYSTEM_PACKAGE_INFORMATION 1058 | { 1059 | ULONG Value; 1060 | } SYSTEM_PACKAGE_INFORMATION, *PSYSTEM_PACKAGE_INFORMATION; 1061 | ``` 1062 | 1063 | ### SystemNumaAvailableMemory 1064 | Enum value: 60 1065 | ``` 1066 | typedef struct _SYSTEM_NUMA_INFORMATION 1067 | { 1068 | ULONG HighestNodeNumber; 1069 | ULONG Reserved; 1070 | union 1071 | { 1072 | GROUP_AFFINITY ActiveProcessorsGroupAffinity[64]; 1073 | ULONG64 AvailableMemory[64]; 1074 | ULONG64 Pad[128]; 1075 | }; 1076 | } SYSTEM_NUMA_INFORMATION, *PSYSTEM_NUMA_INFORMATION; 1077 | ``` 1078 | 1079 | ### SystemProcessorPowerInformation 1080 | Enum value: 61 1081 | ``` 1082 | typedef struct _SYSTEM_PROCESSOR_POWER_INFORMATION 1083 | { 1084 | CHAR CurrentFrequency; 1085 | CHAR ThermalLimitFrequency; 1086 | CHAR ConstantThrottleFrequency; 1087 | CHAR DegradedThrottleFrequency; 1088 | CHAR LastBusyFrequency; 1089 | CHAR LastC3Frequency; 1090 | CHAR LastAdjustedBusyFrequency; 1091 | CHAR ProcessorMinThrottle; 1092 | CHAR ProcessorMaxThrottle; 1093 | ULONG NumberOfFrequencies; 1094 | ULONG PromotionCount; 1095 | ULONG DemotionCount; 1096 | ULONG ErrorCount; 1097 | ULONG RetryCount; 1098 | ULONG64 CurrentFrequencyTime; 1099 | ULONG64 CurrentProcessorTime; 1100 | ULONG64 CurrentProcessorIdleTime; 1101 | ULONG64 LastProcessorTime; 1102 | ULONG64 LastProcessorIdleTime; 1103 | ULONG64 Energy; 1104 | } SYSTEM_PROCESSOR_POWER_INFORMATION, *PSYSTEM_PROCESSOR_POWER_INFORMATION; 1105 | ``` 1106 | 1107 | ### SystemEmulationBasicInformation 1108 | Enum value: 62 1109 | ``` 1110 | typedef struct _SYSTEM_BASIC_INFORMATION 1111 | { 1112 | ULONG Reserved; 1113 | ULONG TimerResolution; 1114 | ULONG PageSize; 1115 | ULONG NumberOfPhysicalPages; 1116 | ULONG LowestPhysicalPageNumber; 1117 | ULONG HighestPhysicalPageNumber; 1118 | ULONG AllocationGranularity; 1119 | ULONG64 MinimumUserModeAddress; 1120 | ULONG64 MaximumUserModeAddress; 1121 | ULONG64 ActiveProcessorsAffinityMask; 1122 | CHAR NumberOfProcessors; 1123 | CHAR __PADDING__[7]; 1124 | } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION; 1125 | ``` 1126 | 1127 | ### SystemEmulationProcessorInformation 1128 | Enum value: 63 1129 | ``` 1130 | typedef struct _SYSTEM_PROCESSOR_INFORMATION 1131 | { 1132 | USHORT ProcessorArchitecture; 1133 | USHORT ProcessorLevel; 1134 | USHORT ProcessorRevision; 1135 | USHORT MaximumProcessors; 1136 | ULONG ProcessorFeatureBits; 1137 | } SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION; 1138 | ``` 1139 | 1140 | ### SystemExtendedHandleInformation 1141 | Enum value: 64 1142 | ``` 1143 | typedef struct _SYSTEM_HANDLE_INFORMATION_EX 1144 | { 1145 | ULONG64 NumberOfHandles; 1146 | ULONG64 Reserved; 1147 | SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1]; 1148 | } SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX; 1149 | ``` 1150 | 1151 | ### SystemLostDelayedWriteInformation 1152 | Enum value: 65 1153 | ``` 1154 | typedef struct _SYSTEM_LOST_DELAYED_WRITES_INFORMATION 1155 | { 1156 | ULONG LostDelayedWrites; 1157 | } SYSTEM_LOST_DELAYED_WRITES_INFORMATION, *PSYSTEM_LOST_DELAYED_WRITES_INFORMATION; 1158 | ``` 1159 | 1160 | ### SystemBigPoolInformation 1161 | Enum value: 66 1162 | ``` 1163 | typedef struct _SYSTEM_BIGPOOL_ENTRY 1164 | { 1165 | union 1166 | { 1167 | PVOID VirtualAddress; 1168 | ULONG64 NonPaged : 1; 1169 | }; 1170 | ULONG64 SizeInBytes; 1171 | union 1172 | { 1173 | CHAR Tag[4]; 1174 | ULONG TagULONG; 1175 | }; 1176 | LONG __PADDING__[1]; 1177 | } SYSTEM_BIGPOOL_ENTRY, *PSYSTEM_BIGPOOL_ENTRY; 1178 | 1179 | typedef struct _SYSTEM_SESSION_BIGPOOL_INFORMATION 1180 | { 1181 | ULONG64 NextEntryOffset; 1182 | ULONG SessionId; 1183 | ULONG Count; 1184 | SYSTEM_BIGPOOL_ENTRY AllocatedInfo[1]; 1185 | } SYSTEM_SESSION_BIGPOOL_INFORMATION, *PSYSTEM_SESSION_BIGPOOL_INFORMATION; 1186 | ``` 1187 | 1188 | ### SystemSessionPoolTagInformation 1189 | Enum value: 67 1190 | ``` 1191 | typedef struct _SYSTEM_POOLTAG 1192 | { 1193 | union 1194 | { 1195 | CHAR Tag[4]; 1196 | ULONG TagULONG; 1197 | }; 1198 | ULONG PagedAllocs; 1199 | ULONG PagedFrees; 1200 | ULONG64 PagedUsed; 1201 | ULONG NonPagedAllocs; 1202 | ULONG NonPagedFrees; 1203 | ULONG64 NonPagedUsed; 1204 | } SYSTEM_POOLTAG, *PSYSTEM_POOLTAG; 1205 | 1206 | typedef struct _SYSTEM_SESSION_POOLTAG_INFORMATION 1207 | { 1208 | ULONG64 NextEntryOffset; 1209 | ULONG SessionId; 1210 | ULONG Count; 1211 | SYSTEM_POOLTAG TagInfo[1]; 1212 | } SYSTEM_SESSION_POOLTAG_INFORMATION, *PSYSTEM_SESSION_POOLTAG_INFORMATION; 1213 | ``` 1214 | 1215 | ### SystemSessionMappedViewInformation 1216 | Enum value: 68 1217 | ``` 1218 | typedef struct _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION 1219 | { 1220 | ULONG64 NextEntryOffset; 1221 | ULONG SessionId; 1222 | ULONG ViewFailures; 1223 | ULONG64 NumberOfBytesAvailable; 1224 | ULONG64 NumberOfBytesAvailableContiguous; 1225 | } SYSTEM_SESSION_MAPPED_VIEW_INFORMATION, *PSYSTEM_SESSION_MAPPED_VIEW_INFORMATION; 1226 | ``` 1227 | 1228 | ### SystemObjectSecurityMode 1229 | Enum value: 70 1230 | ``` 1231 | typedef struct _SYSTEM_OBJECT_SECURITY_MODE_INFORMATION 1232 | { 1233 | ULONG ObjectSecurityMode; 1234 | } SYSTEM_OBJECT_SECURITY_MODE_INFORMATION, *PSYSTEM_OBJECT_SECURITY_MODE_INFORMATION; 1235 | ``` 1236 | 1237 | ### SystemWatchdogTimerInformation 1238 | Enum value: 72 1239 | ``` 1240 | typedef enum _WATCHDOG_INFORMATION_CLASS 1241 | { 1242 | WdInfoTimeoutValue = 0, 1243 | WdInfoResetTimer = 1, 1244 | WdInfoStopTimer = 2, 1245 | WdInfoStartTimer = 3, 1246 | WdInfoTriggerAction = 4, 1247 | WdInfoState = 5, 1248 | WdInfoTriggerReset = 6, 1249 | WdInfoNop = 7, 1250 | WdInfoGeneratedLastReset = 8, 1251 | WdInfoInvalid = 9, 1252 | } WATCHDOG_INFORMATION_CLASS, *PWATCHDOG_INFORMATION_CLASS; 1253 | 1254 | typedef struct _SYSTEM_WATCHDOG_TIMER_INFORMATION 1255 | { 1256 | enum _WATCHDOG_INFORMATION_CLASS WdInfoClass; 1257 | ULONG DataValue; 1258 | } SYSTEM_WATCHDOG_TIMER_INFORMATION, *PSYSTEM_WATCHDOG_TIMER_INFORMATION; 1259 | ``` 1260 | 1261 | ### SystemLogicalProcessorInformation 1262 | Enum value: 73 1263 | ``` 1264 | typedef enum _LOGICAL_PROCESSOR_RELATIONSHIP 1265 | { 1266 | RelationProcessorCore = 0, 1267 | RelationNumaNode = 1, 1268 | RelationCache = 2, 1269 | RelationProcessorPackage = 3, 1270 | RelationGroup = 4, 1271 | RelationProcessorDie = 5, 1272 | RelationNumaNodeEx = 6, 1273 | RelationProcessorModule = 7, 1274 | RelationAll = 0xffffffff, 1275 | } LOGICAL_PROCESSOR_RELATIONSHIP, *PLOGICAL_PROCESSOR_RELATIONSHIP; 1276 | 1277 | typedef enum _PROCESSOR_CACHE_TYPE 1278 | { 1279 | CacheUnified = 0, 1280 | CacheInstruction = 1, 1281 | CacheData = 2, 1282 | CacheTrace = 3, 1283 | } PROCESSOR_CACHE_TYPE, *PPROCESSOR_CACHE_TYPE; 1284 | 1285 | typedef struct _CACHE_DESCRIPTOR 1286 | { 1287 | CHAR Level; 1288 | CHAR Associativity; 1289 | USHORT LineSize; 1290 | ULONG Size; 1291 | enum _PROCESSOR_CACHE_TYPE Type; 1292 | } CACHE_DESCRIPTOR, *PCACHE_DESCRIPTOR; 1293 | 1294 | typedef struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION 1295 | { 1296 | ULONG64 ProcessorMask; 1297 | enum _LOGICAL_PROCESSOR_RELATIONSHIP Relationship; 1298 | union 1299 | { 1300 | struct 1301 | { 1302 | CHAR Flags; 1303 | } ProcessorCore; 1304 | struct 1305 | { 1306 | ULONG NodeNumber; 1307 | } NumaNode; 1308 | CACHE_DESCRIPTOR Cache; 1309 | ULONG64 Reserved[2]; 1310 | }; 1311 | } SYSTEM_LOGICAL_PROCESSOR_INFORMATION, *PSYSTEM_LOGICAL_PROCESSOR_INFORMATION; 1312 | ``` 1313 | 1314 | ### SystemRegisterFirmwareTableInformationHandler 1315 | Enum value: 75 1316 | ``` 1317 | typedef struct _SYSTEM_FIRMWARE_TABLE_HANDLER 1318 | { 1319 | ULONG ProviderSignature; 1320 | CHAR Register; 1321 | PVOID FirmwareTableHandler ; 1322 | PVOID DriverObject; 1323 | } SYSTEM_FIRMWARE_TABLE_HANDLER, *PSYSTEM_FIRMWARE_TABLE_HANDLER; 1324 | ``` 1325 | 1326 | ### SystemFirmwareTableInformation 1327 | Enum value: 76 1328 | ``` 1329 | typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION 1330 | { 1331 | SystemFirmwareTable_Enumerate = 0, 1332 | SystemFirmwareTable_Get = 1, 1333 | } SYSTEM_FIRMWARE_TABLE_ACTION, *PSYSTEM_FIRMWARE_TABLE_ACTION; 1334 | 1335 | typedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION 1336 | { 1337 | ULONG ProviderSignature; 1338 | enum _SYSTEM_FIRMWARE_TABLE_ACTION Action; 1339 | ULONG TableID; 1340 | ULONG TableBufferLength; 1341 | CHAR TableBuffer[1]; 1342 | CHAR __PADDING__[3]; 1343 | } SYSTEM_FIRMWARE_TABLE_INFORMATION, *PSYSTEM_FIRMWARE_TABLE_INFORMATION; 1344 | ``` 1345 | 1346 | ### SystemModuleInformationEx 1347 | Enum value: 77 1348 | ``` 1349 | typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX 1350 | { 1351 | USHORT NextOffset; 1352 | RTL_PROCESS_MODULE_INFORMATION BaseInfo; 1353 | ULONG ImageChecksum; 1354 | ULONG TimeDateStamp; 1355 | PVOID DefaultBase; 1356 | } RTL_PROCESS_MODULE_INFORMATION_EX, *PRTL_PROCESS_MODULE_INFORMATION_EX; 1357 | ``` 1358 | 1359 | ### SystemVerifierTriageInformation 1360 | Enum value: 78 1361 | ``` 1362 | typedef struct _SYSTEM_VERIFIER_TRIAGE_INFORMATION 1363 | { 1364 | ULONG ActionTaken; 1365 | ULONG64 CrashData[5]; 1366 | ULONG VerifierMode; 1367 | ULONG VerifierFlags; 1368 | wCHAR_t VerifierTargets[256]; 1369 | } SYSTEM_VERIFIER_TRIAGE_INFORMATION, *PSYSTEM_VERIFIER_TRIAGE_INFORMATION; 1370 | ``` 1371 | 1372 | ### SystemSuperfetchInformation 1373 | Enum value: 79 1374 | ``` 1375 | typedef struct _SYSTEM_PREFETCH_INFORMATION 1376 | { 1377 | ULONG Version; 1378 | ULONG Signature; 1379 | ULONG Flags; 1380 | ULONG Unknown; 1381 | ULONG BootPhase; 1382 | ULONG BufferSize; 1383 | ULONG Flags2; 1384 | ULONG Pad[4]; 1385 | } SYSTEM_PREFETCH_INFORMATION, *PSYSTEM_PREFETCH_INFORMATION; 1386 | ``` 1387 | 1388 | ### SystemMemoryListInformation 1389 | Enum value: 80 1390 | ``` 1391 | typedef struct _SYSTEM_MEMORY_LIST_INFORMATION 1392 | { 1393 | ULONG64 ZeroPageCount; 1394 | ULONG64 FreePageCount; 1395 | ULONG64 ModifiedPageCount; 1396 | ULONG64 ModifiedNoWritePageCount; 1397 | ULONG64 BadPageCount; 1398 | ULONG64 PageCountByPriority[8]; 1399 | ULONG64 RepurposedPagesByPriority[8]; 1400 | ULONG64 ModifiedPageCountPageFile; 1401 | } SYSTEM_MEMORY_LIST_INFORMATION, *PSYSTEM_MEMORY_LIST_INFORMATION; 1402 | ``` 1403 | 1404 | ### SystemFileCacheInformationEx 1405 | Enum value: 81 1406 | ``` 1407 | typedef struct _SYSTEM_FILECACHE_INFORMATION 1408 | { 1409 | ULONG64 CurrentSize; 1410 | ULONG64 PeakSize; 1411 | ULONG PageFaultCount; 1412 | ULONG64 MinimumWorkingSet; 1413 | ULONG64 MaximumWorkingSet; 1414 | ULONG64 CurrentSizeIncludingTransitionInPages; 1415 | ULONG64 PeakSizeIncludingTransitionInPages; 1416 | ULONG TransitionRePurposeCount; 1417 | ULONG Flags; 1418 | } SYSTEM_FILECACHE_INFORMATION, *PSYSTEM_FILECACHE_INFORMATION; 1419 | ``` 1420 | 1421 | ### SystemThreadPriorityClientIdInformation 1422 | Enum value: 82 1423 | ``` 1424 | typedef struct _SYSTEM_THREAD_CID_PRIORITY_INFORMATION 1425 | { 1426 | CLIENT_ID ClientId; 1427 | LONG Priority; 1428 | LONG __PADDING__[1]; 1429 | } SYSTEM_THREAD_CID_PRIORITY_INFORMATION, *PSYSTEM_THREAD_CID_PRIORITY_INFORMATION; 1430 | ``` 1431 | 1432 | ### SystemProcessorIdleCycleTimeInformation 1433 | Enum value: 83 1434 | ``` 1435 | typedef struct _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION 1436 | { 1437 | ULONG64 CycleTime; 1438 | } SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION, *PSYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION; 1439 | ``` 1440 | 1441 | ### SystemVerifierCancellationInformation 1442 | Enum value: 84 1443 | ``` 1444 | typedef struct _SYSTEM_VERIFIER_ISSUE 1445 | { 1446 | ULONG64 IssueType; 1447 | PVOID Address; 1448 | ULONG64 Parameters[2]; 1449 | } SYSTEM_VERIFIER_ISSUE, *PSYSTEM_VERIFIER_ISSUE; 1450 | 1451 | typedef struct _SYSTEM_VERIFIER_CANCELLATION_INFORMATION 1452 | { 1453 | ULONG CancelProbability; 1454 | ULONG CancelThreshold; 1455 | ULONG CompletionThreshold; 1456 | ULONG CancellationVerifierDisabled; 1457 | ULONG AvailableIssues; 1458 | SYSTEM_VERIFIER_ISSUE Issues[128]; 1459 | } SYSTEM_VERIFIER_CANCELLATION_INFORMATION, *PSYSTEM_VERIFIER_CANCELLATION_INFORMATION; 1460 | ``` 1461 | 1462 | ### SystemRefTraceInformation 1463 | Enum value: 86 1464 | ``` 1465 | typedef struct _SYSTEM_REF_TRACE_INFORMATION 1466 | { 1467 | CHAR TraceEnable; 1468 | CHAR TracePermanent; 1469 | UNICODE_STRING TraceProcessName; 1470 | UNICODE_STRING TracePoolTags; 1471 | } SYSTEM_REF_TRACE_INFORMATION, *PSYSTEM_REF_TRACE_INFORMATION; 1472 | ``` 1473 | 1474 | ### SystemSpecialPoolInformation 1475 | Enum value: 87 1476 | ``` 1477 | typedef struct _SYSTEM_SPECIAL_POOL_INFORMATION 1478 | { 1479 | ULONG PoolTag; 1480 | ULONG Flags; 1481 | } SYSTEM_SPECIAL_POOL_INFORMATION, *PSYSTEM_SPECIAL_POOL_INFORMATION; 1482 | ``` 1483 | 1484 | ### SystemProcessIdInformation 1485 | Enum value: 88 1486 | ``` 1487 | typedef struct _SYSTEM_PROCESS_ID_INFORMATION 1488 | { 1489 | PVOID ProcessId; 1490 | UNICODE_STRING ImageName; 1491 | } SYSTEM_PROCESS_ID_INFORMATION, *PSYSTEM_PROCESS_ID_INFORMATION; 1492 | ``` 1493 | 1494 | ### SystemBootEnvironmentInformation 1495 | Enum value: 90 1496 | ``` 1497 | typedef enum _FIRMWARE_TYPE 1498 | { 1499 | FirmwareTypeUnknown = 0, 1500 | FirmwareTypeBios = 1, 1501 | FirmwareTypeUefi = 2, 1502 | FirmwareTypeMax = 3, 1503 | } FIRMWARE_TYPE, *PFIRMWARE_TYPE; 1504 | 1505 | typedef struct _SYSTEM_BOOT_ENVIRONMENT_INFORMATION 1506 | { 1507 | GUID BootIdentifier; 1508 | enum _FIRMWARE_TYPE FirmwareType; 1509 | union 1510 | { 1511 | ULONG64 BootFlags; 1512 | struct 1513 | { 1514 | ULONG64 DbgMenuOsSelection : 1; 1515 | ULONG64 DbgHiberBoot : 1; 1516 | ULONG64 DbgSoftBoot : 1; 1517 | ULONG64 DbgMeasuredLaunch : 1; 1518 | ULONG64 DbgMeasuredLaunchCapable : 1; 1519 | ULONG64 DbgSystemHiveReplace : 1; 1520 | ULONG64 DbgMeasuredLaunchSmmProtections : 1; 1521 | ULONG64 DbgMeasuredLaunchSmmLevel : 7; 1522 | }; 1523 | }; 1524 | } SYSTEM_BOOT_ENVIRONMENT_INFORMATION, *PSYSTEM_BOOT_ENVIRONMENT_INFORMATION; 1525 | ``` 1526 | 1527 | ### SystemHypervisorInformation 1528 | Enum value: 91 1529 | ``` 1530 | typedef struct _SYSTEM_HYPERVISOR_QUERY_INFORMATION 1531 | { 1532 | CHAR HypervisorConnected; 1533 | CHAR HypervisorDebuggingEnabled; 1534 | CHAR HypervisorPresent; 1535 | CHAR HypervisorSchedulerType; 1536 | CHAR Spare0[4]; 1537 | ULONG64 EnabledEnlightenments; 1538 | } SYSTEM_HYPERVISOR_QUERY_INFORMATION, *PSYSTEM_HYPERVISOR_QUERY_INFORMATION; 1539 | ``` 1540 | 1541 | ### SystemVerifierInformationEx 1542 | Enum value: 92 1543 | ``` 1544 | typedef struct _SYSTEM_VERIFIER_INFORMATION_EX 1545 | { 1546 | ULONG VerifyMode; 1547 | ULONG OptionChanges; 1548 | UNICODE_STRING PreviousBucketName; 1549 | ULONG IrpCancelTimeoutMsec; 1550 | ULONG VerifierExtensionEnabled; 1551 | ULONG Reserved[1]; 1552 | LONG __PADDING__[1]; 1553 | } SYSTEM_VERIFIER_INFORMATION_EX, *PSYSTEM_VERIFIER_INFORMATION_EX; 1554 | ``` 1555 | 1556 | ### SystemTimeZoneInformation 1557 | Enum value: 93 1558 | ``` 1559 | typedef struct _RTL_TIME_ZONE_INFORMATION 1560 | { 1561 | LONG Bias; 1562 | wCHAR_t StandardName[32]; 1563 | TIME_FIELDS StandardStart; 1564 | LONG StandardBias; 1565 | wCHAR_t DaylightName[32]; 1566 | TIME_FIELDS DaylightStart; 1567 | LONG DaylightBias; 1568 | } RTL_TIME_ZONE_INFORMATION, *PRTL_TIME_ZONE_INFORMATION; 1569 | ``` 1570 | 1571 | ### SystemImageFileExecutionOptionsInformation 1572 | Enum value: 94 1573 | ``` 1574 | typedef struct _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION 1575 | { 1576 | ULONG FlagsToEnable; 1577 | ULONG FlagsToDisable; 1578 | } SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION, *PSYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION; 1579 | ``` 1580 | 1581 | ### SystemCoverageInformation 1582 | Enum value: 95 1583 | ``` 1584 | typedef struct _COVERAGE_MODULES 1585 | { 1586 | ULONG ListAndReset; 1587 | ULONG NumberOfModules; 1588 | COVERAGE_MODULE_REQUEST ModuleRequestInfo; 1589 | COVERAGE_MODULE_INFO Modules[1]; 1590 | } COVERAGE_MODULES, *PCOVERAGE_MODULES; 1591 | ``` 1592 | 1593 | ### SystemPrefetchPatchInformation 1594 | Enum value: 96 1595 | ``` 1596 | typedef struct _SYSTEM_PREFETCH_PATCH_INFORMATION 1597 | { 1598 | ULONG PrefetchPatchCount; 1599 | } SYSTEM_PREFETCH_PATCH_INFORMATION, *PSYSTEM_PREFETCH_PATCH_INFORMATION; 1600 | ``` 1601 | 1602 | ### SystemVerifierFaultsInformation 1603 | Enum value: 97 1604 | ``` 1605 | typedef struct _SYSTEM_VERIFIER_FAULTS_INFORMATION 1606 | { 1607 | ULONG Probability; 1608 | ULONG MaxProbability; 1609 | UNICODE_STRING PoolTags; 1610 | UNICODE_STRING Applications; 1611 | } SYSTEM_VERIFIER_FAULTS_INFORMATION, *PSYSTEM_VERIFIER_FAULTS_INFORMATION; 1612 | ``` 1613 | 1614 | ### SystemSystemPartitionInformation 1615 | Enum value: 98 1616 | ``` 1617 | typedef struct _SYSTEM_SYSTEM_PARTITION_INFORMATION 1618 | { 1619 | UNICODE_STRING SystemPartition; 1620 | } SYSTEM_SYSTEM_PARTITION_INFORMATION, *PSYSTEM_SYSTEM_PARTITION_INFORMATION; 1621 | ``` 1622 | 1623 | ### SystemSystemDiskInformation 1624 | Enum value: 99 1625 | ``` 1626 | typedef struct _SYSTEM_SYSTEM_DISK_INFORMATION 1627 | { 1628 | UNICODE_STRING SystemDisk; 1629 | } SYSTEM_SYSTEM_DISK_INFORMATION, *PSYSTEM_SYSTEM_DISK_INFORMATION; 1630 | ``` 1631 | 1632 | ### SystemProcessorPerformanceDistribution 1633 | Enum value: 100 1634 | ``` 1635 | typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION 1636 | { 1637 | ULONG ProcessorCount; 1638 | ULONG Offsets[1]; 1639 | } SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION, *PSYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION; 1640 | ``` 1641 | 1642 | ### SystemNumaProximityNodeInformation 1643 | Enum value: 101 1644 | ``` 1645 | typedef struct _SYSTEM_NUMA_PROXIMITY_MAP 1646 | { 1647 | ULONG NodeProximityId; 1648 | USHORT NodeNumber; 1649 | CHAR __PADDING__[2]; 1650 | } SYSTEM_NUMA_PROXIMITY_MAP, *PSYSTEM_NUMA_PROXIMITY_MAP; 1651 | ``` 1652 | 1653 | ### SystemDynamicTimeZoneInformation 1654 | Enum value: 102 1655 | ``` 1656 | typedef struct _TIME_DYNAMIC_ZONE_INFORMATION 1657 | { 1658 | LONG Bias; 1659 | wCHAR_t StandardName[32]; 1660 | SYSTEMTIME StandardDate; 1661 | LONG StandardBias; 1662 | wCHAR_t DaylightName[32]; 1663 | SYSTEMTIME DaylightDate; 1664 | LONG DaylightBias; 1665 | wCHAR_t TimeZoneKeyName[128]; 1666 | CHAR DynamicDaylightTimeDisabled; 1667 | CHAR __PADDING__[3]; 1668 | } TIME_DYNAMIC_ZONE_INFORMATION, *PTIME_DYNAMIC_ZONE_INFORMATION; 1669 | ``` 1670 | 1671 | ### SystemCodeIntegrityInformation 1672 | Enum value: 103 1673 | ``` 1674 | typedef struct _SYSTEM_CODEINTEGRITY_INFORMATION 1675 | { 1676 | ULONG Length; 1677 | ULONG CodeIntegrityOptions; 1678 | } SYSTEM_CODEINTEGRITY_INFORMATION, *PSYSTEM_CODEINTEGRITY_INFORMATION; 1679 | ``` 1680 | 1681 | ### SystemProcessorMicrocodeUpdateInformation 1682 | Enum value: 104 1683 | ``` 1684 | typedef struct _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION 1685 | { 1686 | ULONG Operation; 1687 | } SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION, *PSYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION; 1688 | ``` 1689 | 1690 | ### SystemLogicalProcessorAndGroupInformation 1691 | Enum value: 107 1692 | ``` 1693 | typedef struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX 1694 | { 1695 | enum _LOGICAL_PROCESSOR_RELATIONSHIP Relationship; 1696 | ULONG Size; 1697 | union 1698 | { 1699 | PROCESSOR_RELATIONSHIP Processor; 1700 | NUMA_NODE_RELATIONSHIP NumaNode; 1701 | CACHE_RELATIONSHIP Cache; 1702 | GROUP_RELATIONSHIP Group; 1703 | }; 1704 | } SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX, *PSYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX; 1705 | ``` 1706 | 1707 | ### SystemProcessorCycleTimeInformation 1708 | Enum value: 108 1709 | ``` 1710 | typedef struct _SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION 1711 | { 1712 | ULONG64 CycleTime; 1713 | } SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION, *PSYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION; 1714 | ``` 1715 | 1716 | ### SystemVhdBootInformation 1717 | Enum value: 112 1718 | ``` 1719 | typedef struct _SYSTEM_VHD_BOOT_INFORMATION 1720 | { 1721 | CHAR OsDiskIsVhd; 1722 | ULONG OsVhdFilePathOffset; 1723 | wCHAR_t OsVhdParentVolume[1]; 1724 | CHAR __PADDING__[2]; 1725 | } SYSTEM_VHD_BOOT_INFORMATION, *PSYSTEM_VHD_BOOT_INFORMATION; 1726 | ``` 1727 | 1728 | ### SystemCpuQuotaInformation 1729 | Enum value: 113 1730 | ``` 1731 | typedef struct _PS_CPU_QUOTA_QUERY_ENTRY 1732 | { 1733 | ULONG SessionId; 1734 | ULONG Weight; 1735 | } PS_CPU_QUOTA_QUERY_ENTRY, *PPS_CPU_QUOTA_QUERY_ENTRY; 1736 | 1737 | typedef struct _PS_CPU_QUOTA_QUERY_INFORMATION 1738 | { 1739 | ULONG SessionCount; 1740 | PS_CPU_QUOTA_QUERY_ENTRY SessionInformation[1]; 1741 | } PS_CPU_QUOTA_QUERY_INFORMATION, *PPS_CPU_QUOTA_QUERY_INFORMATION; 1742 | 1743 | typedef struct _PS_CPU_QUOTA_SET_INFORMATION 1744 | { 1745 | __int64 SessionHandle; 1746 | ULONG Weight; 1747 | LONG __PADDING__[1]; 1748 | } PS_CPU_QUOTA_SET_INFORMATION, *PPS_CPU_QUOTA_SET_INFORMATION; 1749 | ``` 1750 | 1751 | ### SystemErrorPortTimeouts 1752 | Enum value: 115 1753 | ``` 1754 | typedef struct _SYSTEM_ERROR_PORT_TIMEOUTS 1755 | { 1756 | ULONG StartTimeout; 1757 | ULONG CommTimeout; 1758 | } SYSTEM_ERROR_PORT_TIMEOUTS, *PSYSTEM_ERROR_PORT_TIMEOUTS; 1759 | ``` 1760 | 1761 | ### SystemLowPriorityIoInformation 1762 | Enum value: 116 1763 | ``` 1764 | typedef struct _SYSTEM_LOW_PRIORITY_IO_INFORMATION 1765 | { 1766 | ULONG LowPriReadOperations; 1767 | ULONG LowPriWriteOperations; 1768 | ULONG KernelBumpedToNormalOperations; 1769 | ULONG LowPriPagingReadOperations; 1770 | ULONG KernelPagingReadsBumpedToNormal; 1771 | ULONG LowPriPagingWriteOperations; 1772 | ULONG KernelPagingWritesBumpedToNormal; 1773 | ULONG BoostedIrpCount; 1774 | ULONG BoostedPagingIrpCount; 1775 | ULONG BlanketBoostCount; 1776 | } SYSTEM_LOW_PRIORITY_IO_INFORMATION, *PSYSTEM_LOW_PRIORITY_IO_INFORMATION; 1777 | ``` 1778 | 1779 | ### SystemBootEntropyInformation 1780 | Enum value: 117 1781 | ``` 1782 | typedef enum _BOOT_ENTROPY_SOURCE_ID 1783 | { 1784 | BootEntropySourceNone = 0, 1785 | BootEntropySourceSeedfile = 1, 1786 | BootEntropySourceExternal = 2, 1787 | BootEntropySourceTpm = 3, 1788 | BootEntropySourceRdrand = 4, 1789 | BootEntropySourceTime = 5, 1790 | BootEntropySourceAcpiOem0 = 6, 1791 | BootEntropySourceUefi = 7, 1792 | BootEntropySourceCng = 8, 1793 | BootEntropySourceTcbTpm = 9, 1794 | BootEntropySourceTcbRdrand = 10, 1795 | BootMaxEntropySources = 10, 1796 | } BOOT_ENTROPY_SOURCE_ID, *PBOOT_ENTROPY_SOURCE_ID; 1797 | 1798 | typedef enum _BOOT_ENTROPY_SOURCE_RESULT_CODE 1799 | { 1800 | BootEntropySourceStructureUninitialized = 0, 1801 | BootEntropySourceDisabledByPolicy = 1, 1802 | BootEntropySourceNotPresent = 2, 1803 | BootEntropySourceError = 3, 1804 | BootEntropySourceSuccess = 4, 1805 | } BOOT_ENTROPY_SOURCE_RESULT_CODE, *PBOOT_ENTROPY_SOURCE_RESULT_CODE; 1806 | 1807 | typedef struct _BOOT_ENTROPY_SOURCE_NT_RESULT 1808 | { 1809 | enum _BOOT_ENTROPY_SOURCE_ID SourceId; 1810 | ULONG64 Policy; 1811 | enum _BOOT_ENTROPY_SOURCE_RESULT_CODE ResultCode; 1812 | LONG ResultStatus; 1813 | ULONG64 Time; 1814 | ULONG EntropyLength; 1815 | CHAR EntropyData[64]; 1816 | LONG __PADDING__[1]; 1817 | } BOOT_ENTROPY_SOURCE_NT_RESULT, *PBOOT_ENTROPY_SOURCE_NT_RESULT; 1818 | 1819 | typedef struct _BOOT_ENTROPY_NT_RESULT 1820 | { 1821 | ULONG maxEntropySources; 1822 | BOOT_ENTROPY_SOURCE_NT_RESULT EntropySourceResult[10]; 1823 | CHAR SeedBytesForCng[48]; 1824 | } BOOT_ENTROPY_NT_RESULT, *PBOOT_ENTROPY_NT_RESULT; x` 1825 | ``` 1826 | 1827 | ### SystemVerifierCountersInformation 1828 | Enum value: 118 1829 | ``` 1830 | typedef struct _SYSTEM_VERIFIER_COUNTERS_INFORMATION 1831 | { 1832 | SYSTEM_VERIFIER_INFORMATION Legacy; 1833 | ULONG RaiseIrqls; 1834 | ULONG AcquireSpinLocks; 1835 | ULONG SynchronizeExecutions; 1836 | ULONG AllocationsWithNoTag; 1837 | ULONG AllocationsFailed; 1838 | ULONG AllocationsFailedDeliberately; 1839 | ULONG64 LockedBytes; 1840 | ULONG64 PeakLockedBytes; 1841 | ULONG64 MappedLockedBytes; 1842 | ULONG64 PeakMappedLockedBytes; 1843 | ULONG64 MappedIoSpaceBytes; 1844 | ULONG64 PeakMappedIoSpaceBytes; 1845 | ULONG64 PagesForMdlBytes; 1846 | ULONG64 PeakPagesForMdlBytes; 1847 | ULONG64 ContiguousMemoryBytes; 1848 | ULONG64 PeakContiguousMemoryBytes; 1849 | ULONG ExecutePoolTypes; 1850 | ULONG ExecutePageProtections; 1851 | ULONG ExecutePageMappings; 1852 | ULONG ExecuteWriteSections; 1853 | ULONG SectionAlignmentFailures; 1854 | ULONG IATInExecutableSection; 1855 | } SYSTEM_VERIFIER_COUNTERS_INFORMATION, *PSYSTEM_VERIFIER_COUNTERS_INFORMATION; 1856 | ``` 1857 | 1858 | ### SystemNodeDistanceInformation 1859 | Enum value: 121 1860 | 1861 | returns an array of ULONGs with NodeDistance information. Length of the array is the number of numa nodes in the system. 1862 | 1863 | ### SystemAcpiAuditInformation 1864 | Enum value: 122 1865 | ``` 1866 | typedef struct _SYSTEM_ACPI_AUDIT_INFORMATION 1867 | { 1868 | ULONG RsdpCount; 1869 | struct 1870 | { 1871 | ULONG SameRsdt : 1; 1872 | ULONG SlicPresent : 1; 1873 | ULONG SlicDifferent : 1; 1874 | }; 1875 | } SYSTEM_ACPI_AUDIT_INFORMATION, *PSYSTEM_ACPI_AUDIT_INFORMATION; 1876 | ``` 1877 | 1878 | ### SystemBasicPerformanceInformation 1879 | Enum value: 123 1880 | ``` 1881 | typedef struct _SYSTEM_BASIC_PERFORMANCE_INFORMATION 1882 | { 1883 | ULONG64 AvailablePages; 1884 | ULONG64 CommittedPages; 1885 | ULONG64 CommitLimit; 1886 | ULONG64 PeakCommitment; 1887 | } SYSTEM_BASIC_PERFORMANCE_INFORMATION, *PSYSTEM_BASIC_PERFORMANCE_INFORMATION; 1888 | ``` 1889 | 1890 | ### SystemQueryPerformanceCounterInformation 1891 | Enum value: 124 1892 | ``` 1893 | typedef struct _QUERY_PERFORMANCE_COUNTER_FLAGS 1894 | { 1895 | union 1896 | { 1897 | struct 1898 | { 1899 | ULONG KernelTransition : 1; 1900 | ULONG Reserved : 31; 1901 | }; 1902 | ULONG ul; 1903 | }; 1904 | } QUERY_PERFORMANCE_COUNTER_FLAGS, *PQUERY_PERFORMANCE_COUNTER_FLAGS; 1905 | 1906 | typedef struct _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION 1907 | { 1908 | ULONG Version; 1909 | QUERY_PERFORMANCE_COUNTER_FLAGS Flags; 1910 | QUERY_PERFORMANCE_COUNTER_FLAGS ValidFlags; 1911 | } SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION, *PSYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION; 1912 | ``` 1913 | 1914 | ### SystemBootGraphicsInformation 1915 | Enum value: 126 1916 | ``` 1917 | typedef enum _SYSTEM_PIXEL_FORMAT 1918 | { 1919 | SystemPixelFormatUnknown = 0, 1920 | SystemPixelFormatR8G8B8 = 1, 1921 | SystemPixelFormatR8G8B8X8 = 2, 1922 | SystemPixelFormatB8G8R8 = 3, 1923 | SystemPixelFormatB8G8R8X8 = 4, 1924 | } SYSTEM_PIXEL_FORMAT, *PSYSTEM_PIXEL_FORMAT; 1925 | 1926 | typedef struct _SYSTEM_BOOT_GRAPHICS_INFORMATION 1927 | { 1928 | LARGE_INTEGER FrameBuffer; 1929 | ULONG Width; 1930 | ULONG Height; 1931 | ULONG PixelStride; 1932 | ULONG Flags; 1933 | enum _SYSTEM_PIXEL_FORMAT Format; 1934 | ULONG DisplayRotation; 1935 | } SYSTEM_BOOT_GRAPHICS_INFORMATION, *PSYSTEM_BOOT_GRAPHICS_INFORMATION; 1936 | ``` 1937 | 1938 | ### SystemScrubPhysicalMemoryInformation 1939 | Enum value: 127 1940 | ``` 1941 | typedef struct _MEMORY_SCRUB_INFORMATION 1942 | { 1943 | PVOID Handle; 1944 | ULONG64 PagesScrubbed; 1945 | } MEMORY_SCRUB_INFORMATION, *PMEMORY_SCRUB_INFORMATION; 1946 | ``` 1947 | 1948 | ### SystemProcessorProfileControlArea 1949 | Enum value: 129 1950 | ``` 1951 | typedef struct _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA 1952 | { 1953 | PROCESSOR_PROFILE_CONTROL_AREA* ProcessorProfileControlArea; 1954 | CHAR Allocate; 1955 | CHAR __PADDING__[7]; 1956 | } SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA, *PSYSTEM_PROCESSOR_PROFILE_CONTROL_AREA; 1957 | ``` 1958 | 1959 | ### SystemCombinePhysicalMemoryInformation 1960 | Enum value: 130 1961 | ``` 1962 | typedef struct _MEMORY_COMBINE_INFORMATION 1963 | { 1964 | PVOID Handle; 1965 | ULONG64 PagesCombined; 1966 | } MEMORY_COMBINE_INFORMATION, *PMEMORY_COMBINE_INFORMATION; 1967 | ``` 1968 | 1969 | ### SystemEntropyInterruptTimingInformation 1970 | Enum value: 131 1971 | ``` 1972 | typedef struct _SYSTEM_ENTROPY_TIMING_INFORMATION 1973 | { 1974 | PVOID EntropyRoutine ; 1975 | PVOID InitializationRoutine ; 1976 | PVOID InitializationContext; 1977 | } SYSTEM_ENTROPY_TIMING_INFORMATION, *PSYSTEM_ENTROPY_TIMING_INFORMATION; 1978 | ``` 1979 | 1980 | ### SystemConsoleInformation 1981 | Enum value: 132 1982 | ``` 1983 | typedef struct _SYSTEM_CONSOLE_INFORMATION 1984 | { 1985 | struct 1986 | { 1987 | ULONG DriverLoaded : 1; 1988 | ULONG Spare : 31; 1989 | }; 1990 | } SYSTEM_CONSOLE_INFORMATION, *PSYSTEM_CONSOLE_INFORMATION; 1991 | ``` 1992 | 1993 | ### SystemPlatformBinaryInformation 1994 | Enum value: 133 1995 | ``` 1996 | typedef struct _SYSTEM_PLATFORM_BINARY_INFORMATION 1997 | { 1998 | ULONG64 PhysicalAddress; 1999 | PVOID HandoffBuffer; 2000 | PVOID CommandLineBuffer; 2001 | ULONG HandoffBufferSize; 2002 | ULONG CommandLineBufferSize; 2003 | } SYSTEM_PLATFORM_BINARY_INFORMATION, *PSYSTEM_PLATFORM_BINARY_INFORMATION; 2004 | ``` 2005 | 2006 | ### SystemPolicyInformation 2007 | Enum value: 134 2008 | ``` 2009 | typedef struct _SYSTEM_POLICY_INFORMATION 2010 | { 2011 | PVOID InputData; 2012 | PVOID OutputData; 2013 | ULONG InputDataSize; 2014 | ULONG OutputDataSize; 2015 | ULONG Version; 2016 | LONG __PADDING__[1]; 2017 | } SYSTEM_POLICY_INFORMATION, *PSYSTEM_POLICY_INFORMATION; 2018 | ``` 2019 | 2020 | ### SystemHypervisorProcessorCountInformation 2021 | Enum value: 135 2022 | ``` 2023 | typedef struct _SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION 2024 | { 2025 | ULONG NumberOfLogicalProcessors; 2026 | ULONG NumberOfCores; 2027 | } SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION, *PSYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION; 2028 | ``` 2029 | 2030 | ### SystemDeviceDataInformation + SystemDeviceDataEnumerationInformation 2031 | Enum value: 136 + 137 2032 | ``` 2033 | typedef struct _SYSTEM_DEVICE_DATA_INFORMATION 2034 | { 2035 | UNICODE_STRING DeviceId; 2036 | UNICODE_STRING DataName; 2037 | ULONG DataType; 2038 | ULONG DataBufferLength; 2039 | PVOID DataBuffer; 2040 | } SYSTEM_DEVICE_DATA_INFORMATION, *PSYSTEM_DEVICE_DATA_INFORMATION; 2041 | ``` 2042 | 2043 | ### SystemMemoryTopologyInformation 2044 | Enum value: 138 2045 | ``` 2046 | typedef struct _PHYSICAL_CHANNEL_RUN 2047 | { 2048 | ULONG NodeNumber; 2049 | ULONG ChannelNumber; 2050 | ULONG64 BasePage; 2051 | ULONG64 PageCount; 2052 | ULONG64 Flags; 2053 | } PHYSICAL_CHANNEL_RUN, *PPHYSICAL_CHANNEL_RUN; 2054 | 2055 | typedef struct _SYSTEM_MEMORY_TOPOLOGY_INFORMATION 2056 | { 2057 | ULONG64 NumberOfRuns; 2058 | ULONG NumberOfNodes; 2059 | ULONG NumberOfChannels; 2060 | PHYSICAL_CHANNEL_RUN Run[1]; 2061 | } SYSTEM_MEMORY_TOPOLOGY_INFORMATION, *PSYSTEM_MEMORY_TOPOLOGY_INFORMATION; 2062 | ``` 2063 | 2064 | ### SystemMemoryChannelInformation 2065 | Enum value: 139 2066 | ``` 2067 | typedef struct _SYSTEM_MEMORY_CHANNEL_INFORMATION 2068 | { 2069 | ULONG ChannelNumber; 2070 | ULONG ChannelHeatIndex; 2071 | ULONG64 TotalPageCount; 2072 | ULONG64 ZeroPageCount; 2073 | ULONG64 FreePageCount; 2074 | ULONG64 StandbyPageCount; 2075 | } SYSTEM_MEMORY_CHANNEL_INFORMATION, *PSYSTEM_MEMORY_CHANNEL_INFORMATION; 2076 | ``` 2077 | 2078 | ### SystemBootLogoInformation 2079 | Enum value: 140 2080 | ``` 2081 | typedef struct _SYSTEM_BOOT_LOGO_INFORMATION 2082 | { 2083 | ULONG Flags; 2084 | ULONG BitmapOffset; 2085 | } SYSTEM_BOOT_LOGO_INFORMATION, *PSYSTEM_BOOT_LOGO_INFORMATION; 2086 | ``` 2087 | 2088 | ### SystemSecureBootPolicyInformation 2089 | Enum value: 143 2090 | ``` 2091 | typedef struct _SYSTEM_SECUREBOOT_POLICY_INFORMATION 2092 | { 2093 | GUID PolicyPublisher; 2094 | ULONG PolicyVersion; 2095 | ULONG PolicyOptions; 2096 | } SYSTEM_SECUREBOOT_POLICY_INFORMATION, *PSYSTEM_SECUREBOOT_POLICY_INFORMATION; 2097 | ``` 2098 | 2099 | ### SystemPageFileInformationEx 2100 | Enum value: 144 2101 | ``` 2102 | typedef struct _SYSTEM_PAGEFILE_INFORMATION_EX 2103 | { 2104 | SYSTEM_PAGEFILE_INFORMATION Info; 2105 | ULONG MinimumSize; 2106 | ULONG MaximumSize; 2107 | } SYSTEM_PAGEFILE_INFORMATION_EX, *PSYSTEM_PAGEFILE_INFORMATION_EX; 2108 | ``` 2109 | 2110 | ### SystemSecureBootInformation 2111 | Enum value: 145 2112 | ``` 2113 | typedef struct _SYSTEM_SECUREBOOT_INFORMATION 2114 | { 2115 | CHAR SecureBootEnabled; 2116 | CHAR SecureBootCapable; 2117 | } SYSTEM_SECUREBOOT_INFORMATION, *PSYSTEM_SECUREBOOT_INFORMATION; 2118 | ``` 2119 | 2120 | ### SystemPortableWorkspaceEfiLauncherInformation 2121 | Enum value: 147 2122 | ``` 2123 | typedef struct _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION 2124 | { 2125 | UCHAR EfiLauncherEnabled; 2126 | } SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION, *PSYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION; 2127 | ``` 2128 | 2129 | ### SystemKernelDebuggerInformationEx 2130 | Enum value: 149 2131 | ``` 2132 | typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX 2133 | { 2134 | CHAR DebuggerAllowed; 2135 | CHAR DebuggerEnabled; 2136 | CHAR DebuggerPresent; 2137 | } SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION_EX; 2138 | ``` 2139 | 2140 | ### SystemSoftRebootInformation 2141 | Enum value: 151 2142 | ``` 2143 | typedef struct _SYSTEM_SOFT_REBOOT_INFORMATION 2144 | { 2145 | ULONG SoftRebootFlags; 2146 | } SYSTEM_SOFT_REBOOT_INFORMATION, *PSYSTEM_SOFT_REBOOT_INFORMATION; 2147 | ``` 2148 | 2149 | ### SystemElamCertificateInformation 2150 | Enum value: 152 2151 | ``` 2152 | typedef struct _SYSTEM_ELAM_CERTIFICATE_INFORMATION 2153 | { 2154 | PVOID ElamDriverFile; 2155 | } SYSTEM_ELAM_CERTIFICATE_INFORMATION, *PSYSTEM_ELAM_CERTIFICATE_INFORMATION; 2156 | ``` 2157 | 2158 | ### SystemOfflineDumpConfigInformation 2159 | Enum value: 153 2160 | ``` 2161 | typedef struct _OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2 2162 | { 2163 | ULONG Version; 2164 | ULONG AbnormalResetOccurred; 2165 | ULONG OfflineMemoryDumpCapable; 2166 | LARGE_INTEGER ResetDataAddress; 2167 | ULONG ResetDataSize; 2168 | LONG __PADDING__[1]; 2169 | } OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2, *POFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2; 2170 | ``` 2171 | 2172 | ### SystemProcessorFeaturesInformation 2173 | Enum value: 154 2174 | ``` 2175 | typedef struct _SYSTEM_PROCESSOR_FEATURES_INFORMATION 2176 | { 2177 | ULONG64 ProcessorFeatureBits; 2178 | ULONG64 Reserved[3]; 2179 | } SYSTEM_PROCESSOR_FEATURES_INFORMATION, *PSYSTEM_PROCESSOR_FEATURES_INFORMATION; 2180 | ``` 2181 | 2182 | ### SystemManufacturingInformation 2183 | Enum value: 157 2184 | ``` 2185 | typedef struct _SYSTEM_MANUFACTURING_INFORMATION 2186 | { 2187 | ULONG Options; 2188 | UNICODE_STRING ProfileName; 2189 | } SYSTEM_MANUFACTURING_INFORMATION, *PSYSTEM_MANUFACTURING_INFORMATION; 2190 | ``` 2191 | 2192 | ### SystemEnergyEstimationConfigInformation 2193 | Enum value: 158 2194 | ``` 2195 | typedef struct _SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION 2196 | { 2197 | CHAR Enabled; 2198 | } SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION, *PSYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION; 2199 | ``` 2200 | 2201 | ### SystemHypervisorDetailInformation 2202 | Enum value: 159 2203 | ``` 2204 | typedef struct _HV_DETAILS 2205 | { 2206 | ULONG Data[4]; 2207 | } HV_DETAILS, *PHV_DETAILS; 2208 | 2209 | typedef struct _SYSTEM_HYPERVISOR_DETAIL_INFORMATION 2210 | { 2211 | HV_DETAILS HvVendorAndMaxFunction; 2212 | HV_DETAILS HypervisorInterface; 2213 | HV_DETAILS HypervisorVersion; 2214 | HV_DETAILS HvFeatures; 2215 | HV_DETAILS HwFeatures; 2216 | HV_DETAILS EnlightenmentInfo; 2217 | HV_DETAILS ImplementationLimits; 2218 | } SYSTEM_HYPERVISOR_DETAIL_INFORMATION, *PSYSTEM_HYPERVISOR_DETAIL_INFORMATION; 2219 | ``` 2220 | 2221 | ### SystemProcessorCycleStatsInformation 2222 | Enum value: 160 2223 | ``` 2224 | typedef struct _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION 2225 | { 2226 | ULONG64 Cycles[2][4]; 2227 | } SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION, *PSYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION; 2228 | ``` 2229 | 2230 | ### SystemTrustedPlatformModuleInformation 2231 | Enum value: 162 2232 | ``` 2233 | typedef struct _SYSTEM_TPM_INFORMATION 2234 | { 2235 | ULONG Flags; 2236 | } SYSTEM_TPM_INFORMATION, *PSYSTEM_TPM_INFORMATION; 2237 | ``` 2238 | 2239 | ### SystemKernelDebuggerFlags 2240 | Enum value: 163 2241 | ``` 2242 | typedef struct _SYSTEM_KERNEL_DEBUGGER_FLAGS 2243 | { 2244 | CHAR KernelDebuggerIgnoreUmExceptions; 2245 | } SYSTEM_KERNEL_DEBUGGER_FLAGS, *PSYSTEM_KERNEL_DEBUGGER_FLAGS; 2246 | ``` 2247 | 2248 | ### SystemCodeIntegrityPolicyInformation 2249 | Enum value: 164 2250 | ``` 2251 | typedef struct _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION 2252 | { 2253 | ULONG Options; 2254 | ULONG HVCIOptions; 2255 | ULONG64 Version; 2256 | GUID PolicyGuid; 2257 | } SYSTEM_CODEINTEGRITYPOLICY_INFORMATION, *PSYSTEM_CODEINTEGRITYPOLICY_INFORMATION; 2258 | ``` 2259 | 2260 | ### SystemIsolatedUserModeInformation 2261 | Enum value: 165 2262 | ``` 2263 | typedef struct _SYSTEM_ISOLATED_USER_MODE_INFORMATION 2264 | { 2265 | struct 2266 | { 2267 | CHAR SecureKernelRunning : 1; 2268 | CHAR HvciEnabled : 1; 2269 | CHAR HvciStrictMode : 1; 2270 | CHAR DebugEnabled : 1; 2271 | CHAR FirmwarePageProtection : 1; 2272 | CHAR EncryptionKeyAvailable : 1; 2273 | CHAR SpareFlags : 2; 2274 | }; 2275 | struct 2276 | { 2277 | CHAR TrustletRunning : 1; 2278 | CHAR HvciDisableAllowed : 1; 2279 | CHAR HardwareEnforcedVbs : 1; 2280 | CHAR NoSecrets : 1; 2281 | CHAR SpareFlags2 : 4; 2282 | }; 2283 | CHAR Spare0[6]; 2284 | ULONG64 Spare1; 2285 | } SYSTEM_ISOLATED_USER_MODE_INFORMATION, *PSYSTEM_ISOLATED_USER_MODE_INFORMATION; 2286 | ``` 2287 | 2288 | ### SystemSingleModuleInformation 2289 | Enum value: 167 2290 | ``` 2291 | typedef struct _SYSTEM_SINGLE_MODULE_INFORMATION 2292 | { 2293 | PVOID TargetModuleAddress; 2294 | RTL_PROCESS_MODULE_INFORMATION_EX ExInfo; 2295 | } SYSTEM_SINGLE_MODULE_INFORMATION, *PSYSTEM_SINGLE_MODULE_INFORMATION; 2296 | ``` 2297 | 2298 | ### SystemAllowedCpuSetsInformation 2299 | Enum value: 168 2300 | ``` 2301 | typedef struct _SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION 2302 | { 2303 | ULONG64 WorkloadClass; 2304 | ULONG64 CpuSets[1]; 2305 | } SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION, *PSYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION; 2306 | ``` 2307 | 2308 | ### SystemVsmProtectionInformation 2309 | Enum value: 169 2310 | ``` 2311 | typedef struct _SYSTEM_VSM_PROTECTION_INFORMATION 2312 | { 2313 | CHAR DmaProtectionsAvailable; 2314 | CHAR DmaProtectionsInUse; 2315 | CHAR HardwareMbecAvailable; 2316 | CHAR ApicVirtualizationAvailable; 2317 | } SYSTEM_VSM_PROTECTION_INFORMATION, *PSYSTEM_VSM_PROTECTION_INFORMATION; 2318 | ``` 2319 | 2320 | ### SystemInterruptCpuSetsInformation 2321 | Enum value: 170 2322 | ``` 2323 | typedef struct _SYSTEM_INTERRUPT_CPU_SET_INFORMATION 2324 | { 2325 | ULONG Gsiv; 2326 | USHORT Group; 2327 | ULONG64 CpuSets; 2328 | } SYSTEM_INTERRUPT_CPU_SET_INFORMATION, *PSYSTEM_INTERRUPT_CPU_SET_INFORMATION; 2329 | ``` 2330 | 2331 | ### SystemSecureBootPolicyFullInformation 2332 | Enum value: 171 2333 | ``` 2334 | typedef struct _SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION 2335 | { 2336 | SYSTEM_SECUREBOOT_POLICY_INFORMATION PolicyInformation; 2337 | ULONG PolicySize; 2338 | CHAR Policy[1]; 2339 | CHAR __PADDING__[3]; 2340 | } SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION, *PSYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION; 2341 | ``` 2342 | 2343 | ### SystemRootSiloInformation 2344 | Enum value: 174 2345 | ``` 2346 | typedef struct _SYSTEM_ROOT_SILO_INFORMATION 2347 | { 2348 | ULONG NumberOfSilos; 2349 | ULONG SiloIdList[1]; 2350 | } SYSTEM_ROOT_SILO_INFORMATION, *PSYSTEM_ROOT_SILO_INFORMATION; 2351 | ``` 2352 | 2353 | ### SystemCpuSetInformation 2354 | Enum value: 175 2355 | ``` 2356 | typedef enum _CPU_SET_INFORMATION_TYPE 2357 | { 2358 | CpuSetInformation = 0, 2359 | } CPU_SET_INFORMATION_TYPE, *PCPU_SET_INFORMATION_TYPE; 2360 | 2361 | typedef struct _SYSTEM_CPU_SET_INFORMATION 2362 | { 2363 | ULONG Size; 2364 | enum _CPU_SET_INFORMATION_TYPE Type; 2365 | struct 2366 | { 2367 | ULONG Id; 2368 | USHORT Group; 2369 | CHAR LogicalProcessorIndex; 2370 | CHAR CoreIndex; 2371 | CHAR LastLevelCacheIndex; 2372 | CHAR NumaNodeIndex; 2373 | CHAR EfficiencyClass; 2374 | union 2375 | { 2376 | CHAR AllFlags; 2377 | struct 2378 | { 2379 | CHAR Parked : 1; 2380 | CHAR Allocated : 1; 2381 | CHAR AllocatedToTargetProcess : 1; 2382 | CHAR RealTime : 1; 2383 | CHAR ReservedFlags : 4; 2384 | }; 2385 | }; 2386 | union 2387 | { 2388 | ULONG Reserved; 2389 | CHAR SchedulingClass; 2390 | }; 2391 | ULONG64 AllocationTag; 2392 | } CpuSet; 2393 | } SYSTEM_CPU_SET_INFORMATION, *PSYSTEM_CPU_SET_INFORMATION; 2394 | ``` 2395 | 2396 | ### SystemCpuSetTagInformation 2397 | Enum value: 176 2398 | ``` 2399 | typedef struct _SYSTEM_CPU_SET_TAG_INFORMATION 2400 | { 2401 | ULONG64 Tag; 2402 | ULONG64 CpuSets[1]; 2403 | } SYSTEM_CPU_SET_TAG_INFORMATION, *PSYSTEM_CPU_SET_TAG_INFORMATION; 2404 | ``` 2405 | 2406 | ### SystemSecureKernelProfileInformation 2407 | Enum value: 178 2408 | ``` 2409 | typedef struct _SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION 2410 | { 2411 | ULONG ExtentCount; 2412 | ULONG ValidStructureSize; 2413 | ULONG NextExtentIndex; 2414 | ULONG ExtentRestart; 2415 | ULONG CycleCount; 2416 | ULONG TimeoutCount; 2417 | ULONG64 CycleTime; 2418 | ULONG64 CycleTimeMax; 2419 | ULONG64 ExtentTime; 2420 | ULONG ExtentTimeIndex; 2421 | ULONG ExtentTimeMaxIndex; 2422 | ULONG64 ExtentTimeMax; 2423 | ULONG64 HyperFlushTimeMax; 2424 | ULONG64 TranslateVaTimeMax; 2425 | ULONG64 DebugExemptionCount; 2426 | ULONG64 TbHitCount; 2427 | ULONG64 TbMissCount; 2428 | ULONG64 VinaPendingYield; 2429 | ULONG64 HashCycles; 2430 | ULONG HistogramOffset; 2431 | ULONG HistogramBuckets; 2432 | ULONG HistogramShift; 2433 | ULONG Reserved1; 2434 | ULONG64 PageNotPresentCount; 2435 | } SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION, *PSYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION; 2436 | ``` 2437 | 2438 | ### SystemInterruptSteeringInformation 2439 | Enum value: 180 2440 | ``` 2441 | typedef struct _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT 2442 | { 2443 | union 2444 | { 2445 | struct 2446 | { 2447 | ULONG Enabled : 1; 2448 | ULONG Reserved : 31; 2449 | }; 2450 | ULONG AsULONG; 2451 | }; 2452 | } SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT, *PSYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT; 2453 | ``` 2454 | 2455 | ### SystemSupportedProcessorArchitectures 2456 | Enum value: 181 2457 | ``` 2458 | typedef struct _SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION 2459 | { 2460 | struct 2461 | { 2462 | ULONG Machine : 16; 2463 | ULONG KernelMode : 1; 2464 | ULONG UserMode : 1; 2465 | ULONG Native : 1; 2466 | ULONG Process : 1; 2467 | ULONG WoW64Container : 1; 2468 | ULONG ReservedZero0 : 11; 2469 | }; 2470 | } SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION, *PSYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION; 2471 | ``` 2472 | 2473 | ### SystemMemoryUsageInformation 2474 | Enum value: 182 2475 | ``` 2476 | typedef struct _SYSTEM_MEMORY_USAGE_INFORMATION 2477 | { 2478 | ULONG64 TotalPhysicalBytes; 2479 | ULONG64 AvailableBytes; 2480 | __int64 ResidentAvailableBytes; 2481 | ULONG64 CommittedBytes; 2482 | ULONG64 SharedCommittedBytes; 2483 | ULONG64 CommitLimitBytes; 2484 | ULONG64 PeakCommitmentBytes; 2485 | } SYSTEM_MEMORY_USAGE_INFORMATION, *PSYSTEM_MEMORY_USAGE_INFORMATION; 2486 | ``` 2487 | 2488 | ### SystemCodeIntegrityCertificateInformation 2489 | Enum value: 183 2490 | ``` 2491 | typedef struct _SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION 2492 | { 2493 | PVOID ImageFile; 2494 | ULONG Type; 2495 | LONG __PADDING__[1]; 2496 | } SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION, *PSYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION; 2497 | ``` 2498 | 2499 | ### SystemPhysicalMemoryInformation 2500 | Enum value: 184 2501 | ``` 2502 | typedef struct _SYSTEM_PHYSICAL_MEMORY_INFORMATION 2503 | { 2504 | ULONG64 TotalPhysicalBytes; 2505 | ULONG64 LowestPhysicalAddress; 2506 | ULONG64 HighestPhysicalAddress; 2507 | } SYSTEM_PHYSICAL_MEMORY_INFORMATION, *PSYSTEM_PHYSICAL_MEMORY_INFORMATION; 2508 | ``` 2509 | 2510 | ### SystemKernelDebuggingAllowed 2511 | Enum value: 186 2512 | 2513 | returns boolean indicating if kernel debugging is allowed 2514 | 2515 | ### SystemActivityModerationExeState 2516 | Enum value: 187 2517 | ``` 2518 | typedef enum _SYSTEM_ACTIVITY_MODERATION_STATE 2519 | { 2520 | SystemActivityModerationStateSystemManaged = 0, 2521 | SystemActivityModerationStateUserManagedAllowThrottling = 1, 2522 | SystemActivityModerationStateUserManagedDisableThrottling = 2, 2523 | MaxSystemActivityModerationState = 3, 2524 | } SYSTEM_ACTIVITY_MODERATION_STATE, *PSYSTEM_ACTIVITY_MODERATION_STATE; 2525 | ``` 2526 | 2527 | ### SystemActivityModerationUserSettings 2528 | Enum value: 188 2529 | ``` 2530 | typedef struct _SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS 2531 | { 2532 | PVOID UserKeyHandle; 2533 | } SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS, *PSYSTEM_ACTIVITY_MODERATION_USER_SETTINGS; 2534 | ``` 2535 | 2536 | ### SystemCodeIntegrityUnlockInformation 2537 | Enum value: 190 2538 | ``` 2539 | typedef struct _SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION 2540 | { 2541 | union 2542 | { 2543 | ULONG Flags; 2544 | struct 2545 | { 2546 | ULONG Locked : 1; 2547 | ULONG UnlockApplied : 1; 2548 | ULONG UnlockIdValid : 1; 2549 | ULONG Reserved : 29; 2550 | }; 2551 | }; 2552 | CHAR UnlockId[32]; 2553 | } SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION, *PSYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION; 2554 | ``` 2555 | 2556 | ### SystemFlushInformation 2557 | Enum value: 192 2558 | ``` 2559 | typedef struct _SYSTEM_FLUSH_INFORMATION 2560 | { 2561 | ULONG SupportedFlushMethods; 2562 | ULONG ProcessorCacheFlushSize; 2563 | ULONG64 SystemFlushCapabilities; 2564 | ULONG64 Reserved[2]; 2565 | } SYSTEM_FLUSH_INFORMATION, *PSYSTEM_FLUSH_INFORMATION; 2566 | ``` 2567 | 2568 | ### SystemWriteConstraintInformation 2569 | Enum value: 195 2570 | ``` 2571 | typedef struct _SYSTEM_WRITE_CONSTRAINT_INFORMATION 2572 | { 2573 | ULONG WriteConstraintPolicy; 2574 | ULONG Reserved; 2575 | } SYSTEM_WRITE_CONSTRAINT_INFORMATION, *PSYSTEM_WRITE_CONSTRAINT_INFORMATION; 2576 | ``` 2577 | 2578 | ### SystemKernelVaShadowInformation 2579 | Enum value: 196 2580 | ``` 2581 | typedef struct _SYSTEM_KERNEL_VA_SHADOW_INFORMATION 2582 | { 2583 | struct 2584 | { 2585 | struct 2586 | { 2587 | ULONG KvaShadowEnabled : 1; 2588 | ULONG KvaShadowUserGlobal : 1; 2589 | ULONG KvaShadowPcid : 1; 2590 | ULONG KvaShadowInvpcid : 1; 2591 | ULONG KvaShadowRequired : 1; 2592 | ULONG KvaShadowRequiredAvailable : 1; 2593 | ULONG InvalidPteBit : 6; 2594 | ULONG L1DataCacheFlushSupported : 1; 2595 | ULONG L1TerminalFaultMitigationPresent : 1; 2596 | ULONG Reserved : 18; 2597 | }; 2598 | } KvaShadowFlags; 2599 | } SYSTEM_KERNEL_VA_SHADOW_INFORMATION, *PSYSTEM_KERNEL_VA_SHADOW_INFORMATION; 2600 | ``` 2601 | 2602 | ### SystemHypervisorSharedPageInformation 2603 | Enum value: 197 2604 | ``` 2605 | typedef struct _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION 2606 | { 2607 | PVOID HypervisorSharedUserVa; 2608 | } SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION, *PSYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION; 2609 | ``` 2610 | 2611 | ### SystemCodeIntegrityVerificationInformation 2612 | Enum value: 199 2613 | ``` 2614 | typedef struct _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION 2615 | { 2616 | PVOID FileHandle; 2617 | ULONG ImageSize; 2618 | PVOID Image; 2619 | } SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION, *PSYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION; 2620 | ``` 2621 | 2622 | ### SystemFirmwarePartitionInformation 2623 | Enum value: 200 2624 | ``` 2625 | typedef struct _SYSTEM_FIRMWARE_PARTITION_INFORMATION 2626 | { 2627 | UNICODE_STRING FirmwarePartition; 2628 | } SYSTEM_FIRMWARE_PARTITION_INFORMATION, *PSYSTEM_FIRMWARE_PARTITION_INFORMATION; 2629 | ``` 2630 | 2631 | ### SystemSpeculationControlInformation 2632 | Enum value: 201 2633 | ``` 2634 | typedef struct _SYSTEM_SPECULATION_CONTROL_INFORMATION 2635 | { 2636 | struct 2637 | { 2638 | struct 2639 | { 2640 | ULONG BpbEnabled : 1; 2641 | ULONG BpbDisabledSystemPolicy : 1; 2642 | ULONG BpbDisabledNoHardwareSupport : 1; 2643 | ULONG SpecCtrlEnumerated : 1; 2644 | ULONG SpecCmdEnumerated : 1; 2645 | ULONG IbrsPresent : 1; 2646 | ULONG StibpPresent : 1; 2647 | ULONG SmepPresent : 1; 2648 | ULONG SpeculativeStoreBypassDisableAvailable : 1; 2649 | ULONG SpeculativeStoreBypassDisableSupported : 1; 2650 | ULONG SpeculativeStoreBypassDisabledSystemWide : 1; 2651 | ULONG SpeculativeStoreBypassDisabledKernel : 1; 2652 | ULONG SpeculativeStoreBypassDisableRequired : 1; 2653 | ULONG BpbDisabledKernelToUser : 1; 2654 | ULONG SpecCtrlRetpolineEnabled : 1; 2655 | ULONG SpecCtrlImportOptimizationEnabled : 1; 2656 | ULONG EnhancedIbrs : 1; 2657 | ULONG HvL1tfStatusAvailable : 1; 2658 | ULONG HvL1tfProcessorNotAffected : 1; 2659 | ULONG HvL1tfMigitationEnabled : 1; 2660 | ULONG HvL1tfMigitationNotEnabled_Hardware : 1; 2661 | ULONG HvL1tfMigitationNotEnabled_LoadOption : 1; 2662 | ULONG HvL1tfMigitationNotEnabled_CoreScheduler : 1; 2663 | ULONG EnhancedIbrsReported : 1; 2664 | ULONG MdsHardwareProtected : 1; 2665 | ULONG MbClearEnabled : 1; 2666 | ULONG MbClearReported : 1; 2667 | ULONG Reserved : 5; 2668 | }; 2669 | } SpeculationControlFlags; 2670 | } SYSTEM_SPECULATION_CONTROL_INFORMATION, *PSYSTEM_SPECULATION_CONTROL_INFORMATION; 2671 | ``` 2672 | 2673 | ### SystemDmaGuardPolicyInformation 2674 | Enum value: 202 2675 | ``` 2676 | typedef struct _SYSTEM_DMA_GUARD_POLICY_INFORMATION 2677 | { 2678 | CHAR DmaGuardPolicyEnabled; 2679 | } SYSTEM_DMA_GUARD_POLICY_INFORMATION, *PSYSTEM_DMA_GUARD_POLICY_INFORMATION; 2680 | ``` 2681 | 2682 | ### SystemEnclaveLaunchControlInformation 2683 | Enum value: 203 2684 | ``` 2685 | typedef struct _SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION 2686 | { 2687 | CHAR EnclaveLaunchSigner[32]; 2688 | } SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION, *PSYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION; 2689 | ``` 2690 | 2691 | ### SystemWorkloadAllowedCpuSetsInformation 2692 | Enum value: 204 2693 | ``` 2694 | typedef struct _SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION 2695 | { 2696 | ULONG64 WorkloadClass; 2697 | ULONG64 CpuSets[1]; 2698 | } SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION, *PSYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION; 2699 | ``` 2700 | 2701 | ### SystemCodeIntegrityUnlockModeInformation 2702 | Enum value: 205 2703 | ``` 2704 | typedef struct _SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION 2705 | { 2706 | union 2707 | { 2708 | ULONG Flags; 2709 | struct 2710 | { 2711 | ULONG Locked : 1; 2712 | ULONG UnlockApplied : 1; 2713 | ULONG UnlockIdValid : 1; 2714 | ULONG Reserved : 29; 2715 | }; 2716 | }; 2717 | CHAR UnlockId[32]; 2718 | } SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION, *PSYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION; 2719 | ``` 2720 | 2721 | ### SystemLeapSecondInformation 2722 | Enum value: 206 2723 | ``` 2724 | typedef struct _SYSTEM_LEAP_SECOND_INFORMATION 2725 | { 2726 | CHAR Enabled; 2727 | ULONG Flags; 2728 | } SYSTEM_LEAP_SECOND_INFORMATION, *PSYSTEM_LEAP_SECOND_INFORMATION; 2729 | ``` 2730 | 2731 | ### SystemSecurityModelInformation 2732 | Enum value: 208 2733 | ``` 2734 | typedef struct _SYSTEM_SECURITY_MODEL_INFORMATION 2735 | { 2736 | struct 2737 | { 2738 | struct 2739 | { 2740 | ULONG ReservedFlag : 1; 2741 | ULONG AllowDeviceOwnerProtectionDowngrade : 1; 2742 | ULONG Reserved : 30; 2743 | }; 2744 | } SecurityModelFlags; 2745 | } SYSTEM_SECURITY_MODEL_INFORMATION, *PSYSTEM_SECURITY_MODEL_INFORMATION; 2746 | ``` 2747 | 2748 | ### SystemFeatureConfigurationInformation 2749 | Enum value: 210 2750 | ``` 2751 | typedef struct _RTL_FEATURE_CONFIGURATION 2752 | { 2753 | unsigned int FeatureId; 2754 | struct 2755 | { 2756 | unsigned int Priority : 4; 2757 | unsigned int EnabledState : 2; 2758 | unsigned int IsWexpConfiguration : 1; 2759 | unsigned int HasSubscriptions : 1; 2760 | unsigned int Variant : 6; 2761 | unsigned int VariantPayloadKind : 2; 2762 | }; 2763 | unsigned int VariantPayload; 2764 | } RTL_FEATURE_CONFIGURATION, *PRTL_FEATURE_CONFIGURATION; 2765 | 2766 | typedef struct _SYSTEM_FEATURE_CONFIGURATION_INFORMATION 2767 | { 2768 | ULONG64 ChangeStamp; 2769 | RTL_FEATURE_CONFIGURATION Configuration; 2770 | LONG __PADDING__[1]; 2771 | } SYSTEM_FEATURE_CONFIGURATION_INFORMATION, *PSYSTEM_FEATURE_CONFIGURATION_INFORMATION; 2772 | ``` 2773 | 2774 | ### SystemFeatureConfigurationSectionInformation 2775 | Enum value: 211 2776 | ``` 2777 | typedef struct _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY 2778 | { 2779 | ULONG64 ChangeStamp; 2780 | PVOID Section; 2781 | ULONG64 Size; 2782 | } SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY, *PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY; 2783 | 2784 | typedef struct _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION 2785 | { 2786 | ULONG64 OverallChangeStamp; 2787 | SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY Descriptors[3]; 2788 | } SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION, *PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION; 2789 | ``` 2790 | 2791 | ### SystemFeatureUsageSubscriptionInformation 2792 | Enum value: 212 2793 | ``` 2794 | typedef struct _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET 2795 | { 2796 | ULONG Data[2]; 2797 | } RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET, *PRTL_FEATURE_USAGE_SUBSCRIPTION_TARGET; 2798 | 2799 | typedef struct _RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS 2800 | { 2801 | unsigned int FeatureId; 2802 | USHORT ReportingKind; 2803 | USHORT ReportingOptions; 2804 | RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET ReportingTarget; 2805 | } RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS, *PRTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS; 2806 | ``` 2807 | 2808 | ### SystemFwRamdiskInformation 2809 | Enum value: 215 2810 | ``` 2811 | typedef struct _SYSTEM_FIRMWARE_RAMDISK_INFORMATION 2812 | { 2813 | ULONG Version; 2814 | ULONG BlockSize; 2815 | ULONG64 BaseAddress; 2816 | ULONG64 Size; 2817 | } SYSTEM_FIRMWARE_RAMDISK_INFORMATION, *PSYSTEM_FIRMWARE_RAMDISK_INFORMATION; 2818 | ``` 2819 | 2820 | ### SystemDifSetRuleClassInformation 2821 | Enum valie: 217 2822 | 2823 | typedef struct _SYSTEM_DIF_VOLATILE_INFORMATION 2824 | { 2825 | ULONG RuleClasses[2]; 2826 | ULONG VerifierOption; 2827 | ULONG TriageContext; 2828 | } SYSTEM_DIF_VOLATILE_INFORMATION, *PSYSTEM_DIF_VOLATILE_INFORMATION; 2829 | 2830 | ### SystemDifClearRuleClassInformation 2831 | Enum value: 218 2832 | 2833 | Takes no input data. 2834 | 2835 | ### SystemDifApplyPluginVerificationOnDriver + SystemDifRemovePluginVerificationOnDriver 2836 | Enum values: 219 + 220 2837 | ``` 2838 | typedef struct _SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION 2839 | { 2840 | UNICODE_STRING DriverName; 2841 | } SYSTEM_DIF_PLUGIN_DRIVER_INFORMATION, *PSYSTEM_DIF_PLUGIN_DRIVER_INFORMATION; 2842 | ``` 2843 | 2844 | ### SystemShadowStackInformation 2845 | Enum value: 221 2846 | ``` 2847 | typedef struct _SYSTEM_SHADOW_STACK_INFORMATION 2848 | { 2849 | union 2850 | { 2851 | ULONG Flags; 2852 | struct 2853 | { 2854 | ULONG CetCapable : 1; 2855 | ULONG UserCetAllowed : 1; 2856 | ULONG ReservedForUserCet : 6; 2857 | ULONG KernelCetEnabled : 1; 2858 | ULONG KernelCetAuditModeEnabled : 1; 2859 | ULONG ReservedForKernelCet : 6; 2860 | ULONG Reserved : 16; 2861 | }; 2862 | }; 2863 | } SYSTEM_SHADOW_STACK_INFORMATION, *PSYSTEM_SHADOW_STACK_INFORMATION; 2864 | ``` 2865 | 2866 | ### SystemBuildVersionInformation 2867 | Enum value: 222 2868 | ``` 2869 | typedef struct _SYSTEM_BUILD_VERSION_INFORMATION 2870 | { 2871 | USHORT LayerNumber; 2872 | USHORT LayerCount; 2873 | ULONG OsMajorVersion; 2874 | ULONG OsMinorVersion; 2875 | ULONG NtBuildNumber; 2876 | ULONG NtBuildQfe; 2877 | CHAR LayerName[128]; 2878 | CHAR NtBuildBranch[128]; 2879 | CHAR NtBuildLab[128]; 2880 | CHAR NtBuildLabEx[128]; 2881 | CHAR NtBuildStamp[26]; 2882 | CHAR NtBuildArch[16]; 2883 | union 2884 | { 2885 | union 2886 | { 2887 | ULONG Value32; 2888 | struct 2889 | { 2890 | ULONG IsTopLevel : 1; 2891 | ULONG IsChecked : 1; 2892 | }; 2893 | }; 2894 | } Flags; 2895 | } SYSTEM_BUILD_VERSION_INFORMATION, *PSYSTEM_BUILD_VERSION_INFORMATION; 2896 | ``` 2897 | 2898 | ### SystemPoolLimitInformation 2899 | Enum value: 223 2900 | ``` 2901 | typedef struct _SYSTEM_POOL_LIMIT_MEM_INFO 2902 | { 2903 | ULONG64 MemoryLimit; 2904 | ULONG64 NotificationLimit; 2905 | } SYSTEM_POOL_LIMIT_MEM_INFO, *PSYSTEM_POOL_LIMIT_MEM_INFO; 2906 | 2907 | typedef struct _WNF_STATE_NAME 2908 | { 2909 | ULONG Data[2]; 2910 | } WNF_STATE_NAME, *PWNF_STATE_NAME; 2911 | 2912 | typedef struct _SYSTEM_POOL_LIMIT_INFO 2913 | { 2914 | ULONG PoolTag; 2915 | SYSTEM_POOL_LIMIT_MEM_INFO MemLimits[2]; 2916 | WNF_STATE_NAME NotificationHandle; 2917 | } SYSTEM_POOL_LIMIT_INFO, *PSYSTEM_POOL_LIMIT_INFO; 2918 | 2919 | typedef struct _SYSTEM_POOL_LIMIT_INFORMATION 2920 | { 2921 | ULONG Version; 2922 | ULONG EntryCount; 2923 | SYSTEM_POOL_LIMIT_INFO LimitEntries[1]; 2924 | } SYSTEM_POOL_LIMIT_INFORMATION, *PSYSTEM_POOL_LIMIT_INFORMATION; 2925 | ``` 2926 | 2927 | ### SystemCodeIntegrityAddDynamicStore + SystemCodeIntegrityClearDynamicStores 2928 | Enum values: 224 + 225 2929 | 2930 | Takes no input data. 2931 | 2932 | ### SystemDifPoolTrackingInformatio 2933 | Enum value: 226 2934 | 2935 | Takes in no input data. 2936 | 2937 | ### SystemPoolZeroingInformation 2938 | Enum value: 227 2939 | ``` 2940 | typedef struct _SYSTEM_POOL_ZEROING_INFORMATION 2941 | { 2942 | UCHAR PoolZeroingSupportPresent; 2943 | } SYSTEM_POOL_ZEROING_INFORMATION, *PSYSTEM_POOL_ZEROING_INFORMATION; 2944 | ``` 2945 | 2946 | ### SystemDpcWatchdogInformation 2947 | Enum value: 228 2948 | ``` 2949 | typedef struct _SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION 2950 | { 2951 | union 2952 | { 2953 | struct 2954 | { 2955 | ULONG Version : 8; 2956 | ULONG AllFlags : 24; 2957 | }; 2958 | struct 2959 | { 2960 | struct 2961 | { 2962 | ULONG Dummy : 8; 2963 | ULONG SingleDpcTimeLimitPresent : 1; 2964 | ULONG CumulativeDpcTimeLimitPresent : 1; 2965 | ULONG SingleDpcSoftTimeLimitPresent : 1; 2966 | ULONG CumulativeDpcSoftTimeLimitPresent : 1; 2967 | ULONG Reserved : 20; 2968 | }; 2969 | } Flags; 2970 | }; 2971 | ULONG SingleDpcTimeLimitMs; 2972 | ULONG CumulativeDpcTimeLimitMs; 2973 | ULONG SingleDpcSoftTimeLimitMs; 2974 | ULONG CumulativeDpcSoftTimeLimitMs; 2975 | } SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION, *PSYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION; 2976 | ``` 2977 | 2978 | ### SystemDpcWatchdogInformation2 2979 | Enum value: 229 2980 | ``` 2981 | typedef struct _SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION_V2 2982 | { 2983 | union 2984 | { 2985 | struct 2986 | { 2987 | ULONG Version : 8; 2988 | ULONG AllFlags : 24; 2989 | }; 2990 | struct 2991 | { 2992 | struct 2993 | { 2994 | ULONG Dummy : 8; 2995 | ULONG SingleDpcTimeLimitPresent : 1; 2996 | ULONG CumulativeDpcTimeLimitPresent : 1; 2997 | ULONG SingleDpcSoftTimeLimitPresent : 1; 2998 | ULONG CumulativeDpcSoftTimeLimitPresent : 1; 2999 | ULONG SingleDpcProfileThresholdPresent : 1; 3000 | ULONG CumulativeDpcProfileThresholdPresent : 1; 3001 | ULONG ProfileBufferSizePresent : 1; 3002 | ULONG Reserved : 17; 3003 | }; 3004 | } Flags; 3005 | }; 3006 | ULONG SingleDpcTimeLimitMs; 3007 | ULONG CumulativeDpcTimeLimitMs; 3008 | ULONG SingleDpcSoftTimeLimitMs; 3009 | ULONG CumulativeDpcSoftTimeLimitMs; 3010 | ULONG SingleDpcProfileThresholdMs; 3011 | ULONG CumulativeDpcProfileThresholdMs; 3012 | ULONG ProfileBufferSizeBytes; 3013 | } SYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION_V2, *PSYSTEM_DPC_WATCHDOG_CONFIGURATION_INFORMATION_V2; 3014 | ``` 3015 | 3016 | ### SystemSingleProcessorRelationshipInformation 3017 | Enum value: 231 3018 | ``` 3019 | typedef enum _LOGICAL_PROCESSOR_RELATIONSHIP 3020 | { 3021 | RelationProcessorCore = 0, 3022 | RelationNumaNode = 1, 3023 | RelationCache = 2, 3024 | RelationProcessorPackage = 3, 3025 | RelationGroup = 4, 3026 | RelationProcessorDie = 5, 3027 | RelationNumaNodeEx = 6, 3028 | RelationProcessorModule = 7, 3029 | RelationAll = 0xffffffff, 3030 | } LOGICAL_PROCESSOR_RELATIONSHIP, *PLOGICAL_PROCESSOR_RELATIONSHIP; 3031 | 3032 | typedef struct _PROCESSOR_NUMBER 3033 | { 3034 | USHORT Group; 3035 | CHAR Number; 3036 | CHAR Reserved; 3037 | } PROCESSOR_NUMBER, *PPROCESSOR_NUMBER; 3038 | 3039 | typedef struct _SYSTEM_SINGLE_PROCESSOR_RELATIONSHIP_INFORMATION_REQUEST 3040 | { 3041 | enum _LOGICAL_PROCESSOR_RELATIONSHIP Relationship; 3042 | PROCESSOR_NUMBER ProcessorNumber; 3043 | } SYSTEM_SINGLE_PROCESSOR_RELATIONSHIP_INFORMATION_REQUEST, *PSYSTEM_SINGLE_PROCESSOR_RELATIONSHIP_INFORMATION_REQUEST; 3044 | ``` 3045 | 3046 | ### SystemXfgCheckFailureInformation 3047 | Enum value: 232 3048 | ``` 3049 | typedef struct _SYSTEM_XFG_FAILURE_INFORMATION 3050 | { 3051 | PVOID ReturnAddress; 3052 | PVOID TargetAddress; 3053 | ULONG DispatchMode; 3054 | ULONG64 XfgValue; 3055 | } SYSTEM_XFG_FAILURE_INFORMATION, *PSYSTEM_XFG_FAILURE_INFORMATION; 3056 | ``` 3057 | 3058 | ### SystemIommuStateInformation 3059 | Enum value: 233 3060 | ``` 3061 | typedef enum _SYSTEM_IOMMU_STATE 3062 | { 3063 | IommuStateBlock = 0, 3064 | IommuStateUnblock = 1, 3065 | } SYSTEM_IOMMU_STATE, *PSYSTEM_IOMMU_STATE; 3066 | 3067 | typedef struct _SYSTEM_IOMMU_STATE_INFORMATION 3068 | { 3069 | enum _SYSTEM_IOMMU_STATE State; 3070 | PVOID Pdo; 3071 | } SYSTEM_IOMMU_STATE_INFORMATION, *PSYSTEM_IOMMU_STATE_INFORMATION; 3072 | ``` 3073 | 3074 | ### SystemHypervisorMinrootInformation 3075 | Enum value: 234 3076 | ``` 3077 | typedef struct _HV_MINROOT_NUMA_LPS 3078 | { 3079 | ULONG NodeIndex; 3080 | ULONG64 Mask[16]; 3081 | } HV_MINROOT_NUMA_LPS, *PHV_MINROOT_NUMA_LPS; 3082 | 3083 | typedef struct _SYSTEM_HYPERVISOR_MINROOT_INFORMATION 3084 | { 3085 | ULONG NumProc; 3086 | ULONG RootProc; 3087 | ULONG RootProcNumaNodesSpecified; 3088 | USHORT RootProcNumaNodes[64]; 3089 | ULONG RootProcPerCore; 3090 | ULONG RootProcPerNode; 3091 | ULONG RootProcNumaNodesLpsSpecified; 3092 | HV_MINROOT_NUMA_LPS RootProcNumaNodeLps[64]; 3093 | } SYSTEM_HYPERVISOR_MINROOT_INFORMATION, *PSYSTEM_HYPERVISOR_MINROOT_INFORMATION; 3094 | ``` 3095 | 3096 | ### SystemHypervisorBootPagesInformation 3097 | Enum value: 235 3098 | ``` 3099 | typedef struct _SYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION 3100 | { 3101 | ULONG RangeCount; 3102 | ULONG Pad; 3103 | ULONG64 RangeArray[1]; 3104 | } SYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION, *PSYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION; 3105 | ``` 3106 | 3107 | ### SystemPointerAuthInformation 3108 | Enum value: 236 3109 | ``` 3110 | typedef struct _SYSTEM_POINTER_AUTH_INFORMATION 3111 | { 3112 | union 3113 | { 3114 | USHORT SupportedFlags; 3115 | struct 3116 | { 3117 | USHORT AddressAuthSupported : 1; 3118 | USHORT AddressAuthQarma : 1; 3119 | USHORT GenericAuthSupported : 1; 3120 | USHORT GenericAuthQarma : 1; 3121 | USHORT SupportedReserved : 12; 3122 | }; 3123 | }; 3124 | union 3125 | { 3126 | USHORT EnabledFlags; 3127 | struct 3128 | { 3129 | USHORT UserPerProcessIpAuthEnabled : 1; 3130 | USHORT UserGlobalIpAuthEnabled : 1; 3131 | USHORT UserEnabledReserved : 6; 3132 | USHORT KernelIpAuthEnabled : 1; 3133 | USHORT KernelEnabledReserved : 7; 3134 | }; 3135 | }; 3136 | } SYSTEM_POINTER_AUTH_INFORMATION, *PSYSTEM_POINTER_AUTH_INFORMATION; 3137 | ``` 3138 | --------------------------------------------------------------------------------