#include <stdint.h>
#include <stddef.h>
#include "me.h"
#include "ht.h"
#include "ob.h"
#include "core.h"
#include "exception.h"

Data Structures
struct	_LDR_DATA_TABLE_ENTRY
struct	_PEB_LDR_DATA
struct	_PEB
struct	_MT_TIB
struct	_TEB
struct	_MT_MODULE_INFO
struct	_MTDLL_BASIC_TYPES
struct	_EPROCESS
struct	_ETHREAD
struct	_STACK_REAPER_ENTRY

Macros
#define	MT_THREAD_TERMINATE 0x0001
#define	MT_THREAD_SUSPEND_RESUME 0x0002
#define	MT_THREAD_SET_CONTEXT 0x0004
#define	MT_THREAD_GET_CONTEXT 0x0008
#define	MT_THREAD_QUERY_INFO 0x0010
#define	MT_THREAD_SET_INFO 0x0020
#define	MT_THREAD_ALL_ACCESS 0x003F
#define	MT_PROCESS_TERMINATE 0x0001
#define	MT_PROCESS_CREATE_THREAD 0x0002
#define	MT_PROCESS_VM_OPERATION 0x0004
#define	MT_PROCESS_VM_READ 0x0008
#define	MT_PROCESS_VM_WRITE 0x0010
#define	MT_PROCESS_DUP_HANDLE 0x0020
#define	MT_PROCESS_SET_INFO 0x0040
#define	MT_PROCESS_QUERY_INFO 0x0080
#define	MT_PROCESS_SUSPEND_RESUME 0x0100
#define	MT_PROCESS_CREATE_PROCESS 0x0200
#define	MT_PROCESS_ALL_ACCESS 0x03FF
#define	PROCESS_STACK_SIZE (32*1024)
#define	PROCESS_STACK_ALIGNMENT 16

Typedefs
typedef enum _THREAD_STATE	THREAD_STATE
typedef enum _THREAD_STATE *	PTHREAD_STATE
typedef enum _PROCESS_STATE	PROCESS_STATE
typedef enum _PROCESS_STATE *	PPROCESS_STATE
typedef enum _PS_PHASE_ROUTINE	PS_PHASE_ROUTINE
typedef enum _PROCESS_FLAGS	PROCESS_FLAGS
typedef struct _LDR_DATA_TABLE_ENTRY	LDR_DATA_TABLE_ENTRY
typedef struct _LDR_DATA_TABLE_ENTRY *	PLDR_DATA_TABLE_ENTRY
typedef struct _PEB_LDR_DATA	PEB_LDR_DATA
typedef struct _PEB_LDR_DATA *	PPEB_LDR_DATA
typedef struct _PEB	PEB
typedef struct _PEB *	PPEB
typedef struct _MT_TIB	MT_TIB
typedef struct _MT_TIB *	PMT_TIB
typedef struct _TEB	TEB
typedef struct _TEB *	PTEB
typedef struct _MT_MODULE_INFO	MT_MODULE_INFO
typedef struct _MTDLL_BASIC_TYPES	MTDLL_BASIC_TYPES
typedef struct _MTDLL_BASIC_TYPES *	PMTDLL_BASIC_TYPES
typedef struct _EPROCESS	EPROCESS
typedef struct _EPROCESS *	PEPROCESS
typedef struct _ETHREAD	ETHREAD
typedef struct _ETHREAD *	PETHREAD
typedef struct _STACK_REAPER_ENTRY	STACK_REAPER_ENTRY
typedef struct _STACK_REAPER_ENTRY *	PSTACK_REAPER_ENTRY
typedef void *	THREAD_PARAMETER
typedef void(*	ThreadEntry) (THREAD_PARAMETER)

Enumerations
enum	_THREAD_STATE { THREAD_RUNNING , THREAD_READY , THREAD_BLOCKED , THREAD_TERMINATING , THREAD_TERMINATED , THREAD_ZOMBIE }
enum	_PROCESS_STATE { PROCESS_RUNNING = 0 , PROCESS_READY , PROCESS_WAITING , PROCESS_TERMINATING , PROCESS_TERMINATED , PROCESS_SUSPENDED }
enum	_PS_PHASE_ROUTINE { PS_PHASE_INITIALIZE_SYSTEM = 0 , PS_PHASE_INITIALIZE_WORKER_THREADS }
enum	_PROCESS_FLAGS { ProcessBreakOnTermination = (1 << 0) , ProcessBeingTerminated = (1 << 1) , ProcessBeingDeleted = (1 << 2) }

Functions
MTSTATUS	PsCreateProcess (IN const char *ExecutablePath, OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, _In_Opt HANDLE ParentProcess)
MTSTATUS	PsCreateThread (HANDLE ProcessHandle, PHANDLE ThreadHandle, ThreadEntry EntryPoint, THREAD_PARAMETER ThreadParameter, TimeSliceTicks TimeSlice, ThreadEntry MtdllEntrypoint)
void	MsYieldExecution (PTRAP_FRAME threadRegisters)
MTSTATUS	PsCreateSystemThread (ThreadEntry entry, THREAD_PARAMETER parameter, TimeSliceTicks TIMESLICE, _Out_Opt PETHREAD *OutThread)
MTSTATUS	PsInitializeSystem (IN enum _PS_PHASE_ROUTINE Phase)
void	PsDeferKernelStackDeletion (void *StackBase, bool IsLarge)
MTSTATUS	PsTerminateProcess (IN PEPROCESS Process, IN MTSTATUS ExitCode)
MTSTATUS	PsTerminateThread (IN PETHREAD Thread, IN MTSTATUS ExitStatus)
NORETURN void	PspExitThread (IN MTSTATUS ExitStatus)
void	PsDeleteThread (IN void *Object)
void	PsDeleteProcess (IN void *ProcessObject)
PETHREAD	PsGetNextProcessThread (IN PEPROCESS Process, _In_Opt PETHREAD LastThread)
PETHREAD	PsGetCurrentThread (void)
void	PsInitializeWorkerThreads (void)
void	PsInitializeCidTable (void)
FORCEINLINE PEPROCESS	PsGetCurrentProcess (void)
FORCEINLINE PETHREAD	PsGetEThreadFromIThread (IN PITHREAD IThread)
FORCEINLINE PEPROCESS	PsGetEProcessFromIProcess (IN PIPROCESS IProcess)
FORCEINLINE bool	PsIsKernelThread (IN PETHREAD Thread)
FORCEINLINE MTSTATUS	GetExceptionCode (void)
HANDLE	PsAllocateProcessId (IN PEPROCESS Process)
HANDLE	PsAllocateThreadId (IN PETHREAD Thread)
PEPROCESS	PsLookupProcessByProcessId (IN HANDLE ProcessId)
PETHREAD	PsLookupThreadByThreadId (IN HANDLE ThreadId)
void	PsFreeCid (IN HANDLE Cid)
FORCEINLINE void	MeEnqueueThreadWithLock (Queue *queue, PETHREAD thread)
FORCEINLINE PETHREAD	MeDequeueThreadWithLock (Queue *q)
FORCEINLINE void	MeEnqueueThread (Queue *queue, PETHREAD thread)
FORCEINLINE PETHREAD	MeDequeueThread (Queue *q)

Variables
EPROCESS	PsInitialSystemProcess

Macro Definition Documentation

◆ MT_PROCESS_ALL_ACCESS

#define MT_PROCESS_ALL_ACCESS 0x03FF

Definition at line 89 of file ps.h.

◆ MT_PROCESS_CREATE_PROCESS

#define MT_PROCESS_CREATE_PROCESS 0x0200

Definition at line 87 of file ps.h.

◆ MT_PROCESS_CREATE_THREAD

#define MT_PROCESS_CREATE_THREAD 0x0002

Definition at line 79 of file ps.h.

◆ MT_PROCESS_DUP_HANDLE

#define MT_PROCESS_DUP_HANDLE 0x0020

Definition at line 83 of file ps.h.

◆ MT_PROCESS_QUERY_INFO

#define MT_PROCESS_QUERY_INFO 0x0080

Definition at line 85 of file ps.h.

◆ MT_PROCESS_SET_INFO

#define MT_PROCESS_SET_INFO 0x0040

Definition at line 84 of file ps.h.

◆ MT_PROCESS_SUSPEND_RESUME

#define MT_PROCESS_SUSPEND_RESUME 0x0100

Definition at line 86 of file ps.h.

◆ MT_PROCESS_TERMINATE

#define MT_PROCESS_TERMINATE 0x0001

Definition at line 78 of file ps.h.

◆ MT_PROCESS_VM_OPERATION

#define MT_PROCESS_VM_OPERATION 0x0004

Definition at line 80 of file ps.h.

◆ MT_PROCESS_VM_READ

#define MT_PROCESS_VM_READ 0x0008

Definition at line 81 of file ps.h.

◆ MT_PROCESS_VM_WRITE

#define MT_PROCESS_VM_WRITE 0x0010

Definition at line 82 of file ps.h.

◆ MT_THREAD_ALL_ACCESS

#define MT_THREAD_ALL_ACCESS 0x003F

Definition at line 72 of file ps.h.

◆ MT_THREAD_GET_CONTEXT

#define MT_THREAD_GET_CONTEXT 0x0008

Definition at line 68 of file ps.h.

◆ MT_THREAD_QUERY_INFO

#define MT_THREAD_QUERY_INFO 0x0010

Definition at line 69 of file ps.h.

◆ MT_THREAD_SET_CONTEXT

#define MT_THREAD_SET_CONTEXT 0x0004

Definition at line 67 of file ps.h.

◆ MT_THREAD_SET_INFO

#define MT_THREAD_SET_INFO 0x0020

Definition at line 70 of file ps.h.

◆ MT_THREAD_SUSPEND_RESUME

#define MT_THREAD_SUSPEND_RESUME 0x0002

Definition at line 66 of file ps.h.

◆ MT_THREAD_TERMINATE

#define MT_THREAD_TERMINATE 0x0001

Definition at line 65 of file ps.h.

◆ PROCESS_STACK_ALIGNMENT

#define PROCESS_STACK_ALIGNMENT 16

Definition at line 213 of file ps.h.

◆ PROCESS_STACK_SIZE

#define PROCESS_STACK_SIZE (32*1024)

Definition at line 212 of file ps.h.

Typedef Documentation

◆ EPROCESS

typedef struct _EPROCESS EPROCESS

◆ ETHREAD

typedef struct _ETHREAD ETHREAD

◆ LDR_DATA_TABLE_ENTRY

typedef struct _LDR_DATA_TABLE_ENTRY LDR_DATA_TABLE_ENTRY

◆ MT_MODULE_INFO

typedef struct _MT_MODULE_INFO MT_MODULE_INFO

◆ MT_TIB

typedef struct _MT_TIB MT_TIB

◆ MTDLL_BASIC_TYPES

typedef struct _MTDLL_BASIC_TYPES MTDLL_BASIC_TYPES

◆ PEB

typedef struct _PEB PEB

◆ PEB_LDR_DATA

typedef struct _PEB_LDR_DATA PEB_LDR_DATA

◆ PEPROCESS

typedef struct _EPROCESS * PEPROCESS

◆ PETHREAD

typedef struct _ETHREAD * PETHREAD

◆ PLDR_DATA_TABLE_ENTRY

typedef struct _LDR_DATA_TABLE_ENTRY * PLDR_DATA_TABLE_ENTRY

◆ PMT_TIB

typedef struct _MT_TIB * PMT_TIB

◆ PMTDLL_BASIC_TYPES

typedef struct _MTDLL_BASIC_TYPES * PMTDLL_BASIC_TYPES

◆ PPEB

typedef struct _PEB * PPEB

◆ PPEB_LDR_DATA

typedef struct _PEB_LDR_DATA * PPEB_LDR_DATA

◆ PPROCESS_STATE

typedef enum _PROCESS_STATE * PPROCESS_STATE

◆ PROCESS_FLAGS

typedef enum _PROCESS_FLAGS PROCESS_FLAGS

◆ PROCESS_STATE

typedef enum _PROCESS_STATE PROCESS_STATE

◆ PS_PHASE_ROUTINE

typedef enum _PS_PHASE_ROUTINE PS_PHASE_ROUTINE

◆ PSTACK_REAPER_ENTRY

typedef struct _STACK_REAPER_ENTRY * PSTACK_REAPER_ENTRY

◆ PTEB

typedef struct _TEB * PTEB

◆ PTHREAD_STATE

typedef enum _THREAD_STATE * PTHREAD_STATE

◆ STACK_REAPER_ENTRY

typedef struct _STACK_REAPER_ENTRY STACK_REAPER_ENTRY

◆ TEB

typedef struct _TEB TEB

◆ THREAD_PARAMETER

typedef void* THREAD_PARAMETER

Definition at line 217 of file ps.h.

◆ THREAD_STATE

typedef enum _THREAD_STATE THREAD_STATE

◆ ThreadEntry

typedef void(* ThreadEntry) (THREAD_PARAMETER)

Definition at line 218 of file ps.h.

Enumeration Type Documentation

◆ _PROCESS_FLAGS

enum _PROCESS_FLAGS

Enumerator
ProcessBreakOnTermination
ProcessBeingTerminated
ProcessBeingDeleted

Definition at line 91 of file ps.h.

◆ _PROCESS_STATE

enum _PROCESS_STATE

Enumerator
PROCESS_RUNNING
PROCESS_READY
PROCESS_WAITING
PROCESS_TERMINATING
PROCESS_TERMINATED
PROCESS_SUSPENDED

Definition at line 46 of file ps.h.

◆ _PS_PHASE_ROUTINE

enum _PS_PHASE_ROUTINE

Enumerator
PS_PHASE_INITIALIZE_SYSTEM
PS_PHASE_INITIALIZE_WORKER_THREADS

Definition at line 55 of file ps.h.

◆ _THREAD_STATE

enum _THREAD_STATE

Enumerator
THREAD_RUNNING
THREAD_READY
THREAD_BLOCKED
THREAD_TERMINATING
THREAD_TERMINATED
THREAD_ZOMBIE

Definition at line 37 of file ps.h.

Function Documentation

◆ GetExceptionCode()

FORCEINLINE MTSTATUS GetExceptionCode ( void )

Definition at line 346 of file ps.h.

◆ MeDequeueThread()

FORCEINLINE PETHREAD MeDequeueThread ( Queue * q )

Definition at line 475 of file ps.h.

◆ MeDequeueThreadWithLock()

FORCEINLINE PETHREAD MeDequeueThreadWithLock ( Queue * q )

Definition at line 415 of file ps.h.

◆ MeEnqueueThread()

FORCEINLINE void MeEnqueueThread	(	Queue *	queue,
		PETHREAD	thread )

Definition at line 452 of file ps.h.

◆ MeEnqueueThreadWithLock()

FORCEINLINE void MeEnqueueThreadWithLock	(	Queue *	queue,
		PETHREAD	thread )

Definition at line 385 of file ps.h.

◆ MsYieldExecution()

void MsYieldExecution ( PTRAP_FRAME threadRegisters )

extern

◆ PsAllocateProcessId()

HANDLE PsAllocateProcessId ( IN PEPROCESS Process )

Definition at line 60 of file cid.c.

◆ PsAllocateThreadId()

HANDLE PsAllocateThreadId ( IN PETHREAD Thread )

Definition at line 89 of file cid.c.

◆ PsCreateProcess()

MTSTATUS PsCreateProcess	(	IN const char *	ExecutablePath,
		OUT PHANDLE	ProcessHandle,
		IN ACCESS_MASK	DesiredAccess,
		_In_Opt HANDLE	ParentProcess )

Definition at line 181 of file process.c.

◆ PsCreateSystemThread()

MTSTATUS PsCreateSystemThread	(	ThreadEntry	entry,
		THREAD_PARAMETER	parameter,
		TimeSliceTicks	TIMESLICE,
		_Out_Opt PETHREAD *	OutThread )

Definition at line 196 of file thread.c.

◆ PsCreateThread()

MTSTATUS PsCreateThread	(	HANDLE	ProcessHandle,
		PHANDLE	ThreadHandle,
		ThreadEntry	EntryPoint,
		THREAD_PARAMETER	ThreadParameter,
		TimeSliceTicks	TimeSlice,
		ThreadEntry	MtdllEntrypoint )

Definition at line 38 of file thread.c.

◆ PsDeferKernelStackDeletion()

void PsDeferKernelStackDeletion	(	void *	StackBase,
		bool	IsLarge )

Definition at line 65 of file pswork.c.

◆ PsDeleteProcess()

void PsDeleteProcess ( IN void * ProcessObject )

Definition at line 522 of file process.c.

◆ PsDeleteThread()

void PsDeleteThread ( IN void * Object )

Definition at line 305 of file thread.c.

◆ PsFreeCid()

void PsFreeCid ( IN HANDLE Cid )

Definition at line 164 of file cid.c.

◆ PsGetCurrentProcess()

FORCEINLINE PEPROCESS PsGetCurrentProcess ( void )

Definition at line 300 of file ps.h.

◆ PsGetCurrentThread()

PETHREAD PsGetCurrentThread ( void )

Definition at line 279 of file thread.c.

◆ PsGetEProcessFromIProcess()

FORCEINLINE PEPROCESS PsGetEProcessFromIProcess ( IN PIPROCESS IProcess )

Definition at line 325 of file ps.h.

◆ PsGetEThreadFromIThread()

FORCEINLINE PETHREAD PsGetEThreadFromIThread ( IN PITHREAD IThread )

Definition at line 315 of file ps.h.

◆ PsGetNextProcessThread()

PETHREAD PsGetNextProcessThread	(	IN PEPROCESS	Process,
		_In_Opt PETHREAD	LastThread )

Definition at line 563 of file process.c.

◆ PsInitializeCidTable()

void PsInitializeCidTable ( void )

Definition at line 27 of file cid.c.

◆ PsInitializeSystem()

MTSTATUS PsInitializeSystem ( IN enum _PS_PHASE_ROUTINE Phase )

Definition at line 93 of file psmgr.c.

◆ PsInitializeWorkerThreads()

void PsInitializeWorkerThreads ( void )

Definition at line 93 of file pswork.c.

◆ PsIsKernelThread()

FORCEINLINE bool PsIsKernelThread ( IN PETHREAD Thread )

Definition at line 335 of file ps.h.

◆ PsLookupProcessByProcessId()

PEPROCESS PsLookupProcessByProcessId ( IN HANDLE ProcessId )

Definition at line 114 of file cid.c.

◆ PsLookupThreadByThreadId()

PETHREAD PsLookupThreadByThreadId ( IN HANDLE ThreadId )

Definition at line 139 of file cid.c.

◆ PspExitThread()

NORETURN void PspExitThread ( IN MTSTATUS ExitStatus )

Definition at line 335 of file thread.c.

◆ PsTerminateProcess()

MTSTATUS PsTerminateProcess	(	IN PEPROCESS	Process,
		IN MTSTATUS	ExitCode )

Definition at line 435 of file process.c.

◆ PsTerminateThread()

MTSTATUS PsTerminateThread	(	IN PETHREAD	Thread,
		IN MTSTATUS	ExitStatus )

Definition at line 284 of file thread.c.

Variable Documentation

◆ PsInitialSystemProcess

EPROCESS PsInitialSystemProcess