Windows XP 常用内核数据结构定义[Delphi/Pascal格式]

Reverse.King 2010-04-10 12:26:39

加精

windows几个重要的内核数据结构虽然网上也有相关的定义，但个人觉得不齐全定义不规范，因此用一天时间使用WinDbg+Win2000sourcecode重新定义了常用的内核数据结构，并尽可能还原微软的原结构定义，每个结构都递归到最子层的结构并且通过了测试。通过这次工作过程不仅使自己得到一次学习的机会，而且提高了自己的整体软件架构规划设计水平。
(如果转帖请著名出处，谢谢。)



{*********************************************************}

{*                                                       *}

{*             Windows Kernel Struct Define              *}

{*                                                       *}

{*              [uWindowsKernelStruct.pas]               *}

{*                                                       *}

{*                          Copyright (c)2010  codegame  *}

{*                          Update:  2010-04-09 23:51:44 *}

{*********************************************************}



type



  PEXCEPTION_DISPOSITION = ^TEXCEPTION_DISPOSITION;

  TEXCEPTION_DISPOSITION = (

    ExceptionContinueExecution = 0,

    ExceptionContinueSearch = 1,

    ExceptionNestedException = 2,

    ExceptionCollidedUnwind = 3);



  PSECURITY_IMPERSONATION_LEVEL = ^TSECURITY_IMPERSONATION_LEVEL;

  TSECURITY_IMPERSONATION_LEVEL = (

    SecurityAnonymous = 0,

    SecurityIdentification = 1,

    SecurityImpersonation = 2,

    SecurityDelegation = 3);



  PUNICODE_STRING = ^TUNICODE_STRING;

  TUNICODE_STRING = packed record

    Length: Word;

    MaximumLength: Word;

    Buffer: Pointer;

  end;



  PLIST_ENTRY = ^TLIST_ENTRY;

  TLIST_ENTRY = packed record

    Flink: PLIST_ENTRY;

    Blink: PLIST_ENTRY;

  end;



  TDISPATCHER_HEADER = packed record

    bType: byte;

    bAbsolute: byte;

    Size: byte;

    Inserted: byte;

    SignalState: DWORD;

    WaitListHead: TLIST_ENTRY;

  end;



  TKGDTENTRY = packed record

    LimitLow: Word;

    BaseLow: Word;

    HighWord: packed record

      BaseMid: Byte;

      Flags1: Byte;

      Flags2: Byte;

      BaseHi: Byte;

    end;

  end;



  TKIDTENTRY = packed record

    Offset: Word;

    Selector: Word;

    Access: Word;

    ExtendedOffset: Word;

  end;



  PSINGLE_LIST_ENTRY = ^TSINGLE_LIST_ENTRY;

  TSINGLE_LIST_ENTRY = packed record

    Next: PSINGLE_LIST_ENTRY;

  end;



  PCLIENT_ID = ^TCLIENT_ID;

  TCLIENT_ID = packed record

    UniqueProcess: Dword;

    UniqueThread: Dword;

  end;



  PKPROCESS = ^TKPROCESS;

  TKPROCESS = packed record

    Header: TDISPATCHER_HEADER;

    ProfileListHead: TLIST_ENTRY;

    DirectoryTableBase: array[0..1] of Dword;

    LdtDescriptor: TKGDTENTRY;

    Int21Descriptor: TKIDTENTRY;

    IopmOffset: Word;

    Iopl: Byte;

    Unused: Byte;

    ActiveProcessors: DWORD;

    KernelTime: DWORD;

    UserTime: DWORD;

    ReadyListHead: TLIST_ENTRY;

    SwapListEntry: TSINGLE_LIST_ENTRY;

    VdmTrapcHandler: Pointer;

    ThreadListHead: TLIST_ENTRY;

    ProcessLock: DWORD;

    Affinity: DWORD;

    StackCount: Word;

    BasePriority: Char;

    ThreadQuantum: Char;

    AutoAlignment: Byte;

    State: Byte;

    ThreadSeed: Byte;

    DisableBoost: Byte;

    PowerState: Byte;

    DisableQuantum: Byte;

    IdealNode: Byte;

    case Integer of

      0: (Flags: byte);

      1: (ExecuteOptions: byte);

  end;



  PKAPC_STATE = ^TKAPC_STATE;

  TKAPC_STATE = packed record

    ApcListHead: array[0..1] of TLIST_ENTRY;

    Process: PKPROCESS;

    KernelApcInProgress: Byte;

    KernelApcPending: Byte;

    UserApcPending: Word;

  end;



  PKTHREAD = ^TKTHREAD;

  PKWAIT_BLOCK = ^TKWAIT_BLOCK;

  TKWAIT_BLOCK = packed record

    WaitListEntry: TLIST_ENTRY;

    Thread: PKTHREAD;

    pObject: Pointer;

    NextWaitBlock: PKWAIT_BLOCK;

    WaitKey: Word;

    WaitType: Word;

  end;



  PKQUEUE = ^TKQUEUE;

  TKQUEUE = packed record

    Header: TDISPATCHER_HEADER;

    EntryListHead: TLIST_ENTRY;

    CurrentCount: Dword;

    MaximumCount: Dword;

    ThreadListHead: TLIST_ENTRY;

  end;



  PKDPC = ^TKDPC;

  TKDPC = packed record

    wType: word;

    Number: Byte;

    Importance: Byte;

    DpcListEntry: TLIST_ENTRY;

    DeferredRoutine: Pointer;

    DeferredContext: Pointer;

    SystemArgument1: Pointer;

    SystemArgument2: Pointer;

    Lock: PDWORD;

  end;



  PKTIMER = ^TKTIMER;

  TKTIMER = packed record

    Header: TDISPATCHER_HEADER;

    DueTime: Int64;

    TimerListEntry: TLIST_ENTRY;

    Dpc: PKDPC;

    Period: DWORD;

  end;



  PEXCEPTION_REGISTRATION_RECORD = ^TPEXCEPTION_REGISTRATION_RECORD;

  TPEXCEPTION_REGISTRATION_RECORD = packed record

    Next: PEXCEPTION_REGISTRATION_RECORD;

    Handler: PEXCEPTION_DISPOSITION;

  end;



  PKTRAP_FRAME = ^TKTRAP_FRAME;

  TKTRAP_FRAME = packed record

    DbgEbp: Dword;

    DbgEip: Dword;

    DbgArgMark: Dword;

    DbgArgPointer: Dword;

    TempSegCs: Dword;

    TempEsp: Dword;

    Dr0: Dword;

    Dr1: Dword;

    Dr2: Dword;

    Dr3: Dword;

    Dr6: Dword;

    Dr7: Dword;

    SegGs: Dword;

    SegEs: Dword;

    SegDs: Dword;

    Edx: Dword;

    Ecx: Dword;

    Eax: Dword;

    PreviousPreviousMode: Dword;

    ExceptionList: PEXCEPTION_REGISTRATION_RECORD;

    SegFs: Dword;

    Edi: Dword;

    Esi: Dword;

    Ebx: Dword;

    Ebp: Dword;

    ErrCode: Dword;

    Eip: Dword;

    SegCs: Dword;

    EFlags: Dword;

    HardwareEsp: Dword;

    HardwareSegSs: Dword;

    V86Es: Dword;

    V86Ds: Dword;

    V86Fs: Dword;

    V86Gs: Dword;

  end;



  PKAPC = ^TKAPC;

  TKAPC = packed record

    wType: word;

    Size: word;

    Spare0: DWORD;

    Thread: PKTHREAD;

    ApcListEntry: TLIST_ENTRY;

    KernelRoutine: Pointer;

    RundownRoutine: Pointer;

    NormalRoutine: Pointer;

    NormalContext: Pointer;

    SystemArgument1: Pointer;

    SystemArgument2: Pointer;

    ApcStateIndex: Char;

    ApcMode: Char;

    Inserted: Word;

  end;



  PKSEMAPHORE = ^TKSEMAPHORE;

  TKSEMAPHORE = packed record

    Header: TDISPATCHER_HEADER;

    Limit: Cardinal;

  end;