Process Hacker
winsta.h
Go to the documentation of this file.
1 #ifndef _WINSTA_H
2 #define _WINSTA_H
3 
4 // begin_msdn:http://msdn.microsoft.com/en-us/library/cc248779%28PROT.10%29.aspx
5 
6 // Access rights
7 
8 #define WINSTATION_QUERY 0x00000001 // WinStationQueryInformation
9 #define WINSTATION_SET 0x00000002 // WinStationSetInformation
10 #define WINSTATION_RESET 0x00000004 // WinStationReset
11 #define WINSTATION_VIRTUAL 0x00000008 //read/write direct data
12 #define WINSTATION_SHADOW 0x00000010 // WinStationShadow
13 #define WINSTATION_LOGON 0x00000020 // logon to WinStation
14 #define WINSTATION_LOGOFF 0x00000040 // WinStationLogoff
15 #define WINSTATION_MSG 0x00000080 // WinStationMsg
16 #define WINSTATION_CONNECT 0x00000100 // WinStationConnect
17 #define WINSTATION_DISCONNECT 0x00000200 // WinStationDisconnect
18 #define WINSTATION_GUEST_ACCESS WINSTATION_LOGON
19 
20 #define WINSTATION_CURRENT_GUEST_ACCESS (WINSTATION_VIRTUAL | WINSTATION_LOGOFF)
21 #define WINSTATION_USER_ACCESS (WINSTATION_GUEST_ACCESS | WINSTATION_QUERY | WINSTATION_CONNECT)
22 #define WINSTATION_CURRENT_USER_ACCESS \
23  (WINSTATION_SET | WINSTATION_RESET | WINSTATION_VIRTUAL | \
24  WINSTATION_LOGOFF | WINSTATION_DISCONNECT)
25 #define WINSTATION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | WINSTATION_QUERY | \
26  WINSTATION_SET | WINSTATION_RESET | WINSTATION_VIRTUAL | \
27  WINSTATION_SHADOW | WINSTATION_LOGON | WINSTATION_MSG | \
28  WINSTATION_CONNECT | WINSTATION_DISCONNECT)
29 
30 #define WDPREFIX_LENGTH 12
31 #define STACK_ADDRESS_LENGTH 128
32 #define MAX_BR_NAME 65
33 #define DIRECTORY_LENGTH 256
34 #define INITIALPROGRAM_LENGTH 256
35 #define USERNAME_LENGTH 20
36 #define DOMAIN_LENGTH 17
37 #define PASSWORD_LENGTH 14
38 #define NASISPECIFICNAME_LENGTH 14
39 #define NASIUSERNAME_LENGTH 47
40 #define NASIPASSWORD_LENGTH 24
41 #define NASISESSIONNAME_LENGTH 16
42 #define NASIFILESERVER_LENGTH 47
43 
44 #define CLIENTDATANAME_LENGTH 7
45 #define CLIENTNAME_LENGTH 20
46 #define CLIENTADDRESS_LENGTH 30
47 #define IMEFILENAME_LENGTH 32
48 #define DIRECTORY_LENGTH 256
49 #define CLIENTLICENSE_LENGTH 32
50 #define CLIENTMODEM_LENGTH 40
51 #define CLIENT_PRODUCT_ID_LENGTH 32
52 #define MAX_COUNTER_EXTENSIONS 2
53 #define WINSTATIONNAME_LENGTH 32
54 
55 #define TERMSRV_TOTAL_SESSIONS 1
56 #define TERMSRV_DISC_SESSIONS 2
57 #define TERMSRV_RECON_SESSIONS 3
58 #define TERMSRV_CURRENT_ACTIVE_SESSIONS 4
59 #define TERMSRV_CURRENT_DISC_SESSIONS 5
60 #define TERMSRV_PENDING_SESSIONS 6
61 #define TERMSRV_SUCC_TOTAL_LOGONS 7
62 #define TERMSRV_SUCC_LOCAL_LOGONS 8
63 #define TERMSRV_SUCC_REMOTE_LOGONS 9
64 #define TERMSRV_SUCC_SESSION0_LOGONS 10
65 #define TERMSRV_CURRENT_TERMINATING_SESSIONS 11
66 #define TERMSRV_CURRENT_LOGGEDON_SESSIONS 12
67 
69 
71 
72 // Variable length data descriptor (not needed)
73 typedef struct _VARDATA_WIRE
74 {
75  USHORT Size;
76  USHORT Offset;
78 
80 {
92 
93 typedef struct _SESSIONIDW
94 {
95  union
96  {
97  ULONG SessionId;
98  ULONG LogonId;
99  };
103 
105 {
149 
150 // WinStationCreateData
151 typedef struct _WINSTATIONCREATE
152 {
153  ULONG fEnableWinStation : 1;
156 
157 // WinStationClient
158 typedef struct _WINSTATIONCLIENT
159 {
160  ULONG fTextOnly : 1;
162  ULONG fMouse : 1;
164  ULONG fINetClient : 1;
166  ULONG fMaximizeShell : 1;
167  ULONG fEnableWindowsKey : 1;
169  ULONG fPasswordIsScPin : 1;
170  ULONG fNoAudioPlayback : 1;
171  ULONG fUsingSavedCreds : 1;
173  WCHAR Domain[DOMAIN_LENGTH + 1];
182  USHORT HRes;
183  USHORT VRes;
184  USHORT ColorDepth;
185  USHORT ProtocolType;
199  USHORT OutBufLength;
200  WCHAR AudioDriverName[9];
207 
208 typedef struct _TSHARE_COUNTERS
209 {
210  ULONG Reserved;
212 
213 typedef struct _PROTOCOLCOUNTERS
214 {
215  ULONG WdBytes;
216  ULONG WdFrames;
218  ULONG Frames;
219  ULONG Bytes;
222  ULONG Errors;
223  ULONG Timeouts;
228  ULONG TdErrors;
229  USHORT ProtocolType;
230  USHORT Length;
231  union
232  {
234  ULONG Reserved[100];
235  } Specific;
237 
238 typedef struct _THINWIRECACHE
239 {
240  ULONG CacheReads;
241  ULONG CacheHits;
243 
244 #define MAX_THINWIRECACHE 4
245 
246 typedef struct _RESERVED_CACHE
247 {
250 
251 typedef struct _TSHARE_CACHE
252 {
253  ULONG Reserved;
255 
256 typedef struct CACHE_STATISTICS
257 {
258  USHORT ProtocolType;
259  USHORT Length;
260  union
261  {
264  ULONG Reserved[20];
265  } Specific;
267 
268 typedef struct _PROTOCOLSTATUS
269 {
273  ULONG AsyncSignal;
276 
277 // WinStationInformation
279 {
282  ULONG LogonId;
283  LARGE_INTEGER ConnectTime;
284  LARGE_INTEGER DisconnectTime;
285  LARGE_INTEGER LastInputTime;
286  LARGE_INTEGER LogonTime;
288  WCHAR Domain[DOMAIN_LENGTH + 1];
290  LARGE_INTEGER CurrentTime;
292 
293 // WinStationUserToken
294 typedef struct _WINSTATIONUSERTOKEN
295 {
296  HANDLE ProcessId;
297  HANDLE ThreadId;
298  HANDLE UserToken;
300 
301 // WinStationVideoData
302 typedef struct _WINSTATIONVIDEODATA
303 {
304  USHORT HResolution;
305  USHORT VResolution;
306  USHORT fColorDepth;
308 
309 // WinStationDigProductId
310 typedef struct _WINSTATIONPRODID
311 {
319 
320 // WinStationRemoteAddress
322 {
323  USHORT sin_family;
324  union
325  {
326  struct
327  {
328  USHORT sin_port;
329  ULONG sin_addr;
330  UCHAR sin_zero[8];
331  } ipv4;
332  struct
333  {
334  USHORT sin6_port;
336  USHORT sin6_addr[8];
338  } ipv6;
339  };
341 
342 // WinStationInformationEx
343 
344 // private
346 {
347  ULONG SessionId;
353  LARGE_INTEGER LogonTime;
354  LARGE_INTEGER ConnectTime;
355  LARGE_INTEGER DisconnectTime;
356  LARGE_INTEGER LastInputTime;
357  LARGE_INTEGER CurrentTime;
360 
361 // private
363 {
364  ULONG SessionId;
370  LARGE_INTEGER LogonTime;
371  LARGE_INTEGER ConnectTime;
372  LARGE_INTEGER DisconnectTime;
373  LARGE_INTEGER LastInputTime;
374  LARGE_INTEGER CurrentTime;
376  WCHAR UserName[257];
377  WCHAR DomainName[256];
379 
380 // private
382 {
386 
387 // private
389 {
390  ULONG Level;
393 
394 #define TS_PROCESS_INFO_MAGIC_NT4 0x23495452
395 
397 {
398  ULONG MagicNumber;
399  ULONG LogonId;
400  PVOID ProcessSid;
401  ULONG Pad;
403 
404 #define SIZEOF_TS4_SYSTEM_THREAD_INFORMATION 64
405 #define SIZEOF_TS4_SYSTEM_PROCESS_INFORMATION 136
406 
408 {
411  LARGE_INTEGER SpareLi1;
412  LARGE_INTEGER SpareLi2;
413  LARGE_INTEGER SpareLi3;
414  LARGE_INTEGER CreateTime;
415  LARGE_INTEGER UserTime;
416  LARGE_INTEGER KernelTime;
421  ULONG HandleCount;
422  ULONG SessionId;
423  ULONG SpareUl3;
425  SIZE_T VirtualSize;
437 
439 {
440  PTS_SYS_PROCESS_INFORMATION pTsProcessInfo;
441  ULONG SizeOfSid;
442  PSID pSid;
444 
445 typedef struct _TS_COUNTER_HEADER
446 {
447  DWORD dwCounterID;
448  BOOLEAN bResult;
450 
451 typedef struct _TS_COUNTER
452 {
454  DWORD dwValue;
455  LARGE_INTEGER StartTime;
457 
458 // Flags for WinStationShutdownSystem
459 #define WSD_LOGOFF 0x1
460 #define WSD_SHUTDOWN 0x2
461 #define WSD_REBOOT 0x4
462 #define WSD_POWEROFF 0x8
463 
464 // Flags for WinStationWaitSystemEvent
465 #define WEVENT_NONE 0x0
466 #define WEVENT_CREATE 0x1
467 #define WEVENT_DELETE 0x2
468 #define WEVENT_RENAME 0x4
469 #define WEVENT_CONNECT 0x8
470 #define WEVENT_DISCONNECT 0x10
471 #define WEVENT_LOGON 0x20
472 #define WEVENT_LOGOFF 0x40
473 #define WEVENT_STATECHANGE 0x80
474 #define WEVENT_LICENSE 0x100
475 #define WEVENT_ALL 0x7fffffff
476 #define WEVENT_FLUSH 0x80000000
477 
478 // Hotkey modifiers for WinStationShadow
479 #define KBDSHIFT 0x1
480 #define KBDCTRL 0x2
481 #define KBDALT 0x4
482 
483 // begin_rev
484 // Flags for WinStationRegisterConsoleNotification
485 #define WNOTIFY_ALL_SESSIONS 0x1
486 // end_rev
487 
488 // In the functions below, memory returned can be freed using LocalFree.
489 // NULL can be specified for server handles to indicate the local server.
490 // -1 can be specified for session IDs to indicate the current session ID.
491 
492 #define LOGONID_CURRENT (-1)
493 #define SERVERNAME_CURRENT (NULL)
494 
495 // rev
496 BOOLEAN
497 WINAPI
499  _In_ PVOID Buffer
500  );
501 
502 // rev
503 HANDLE
504 WINAPI
506  _In_ PWSTR ServerName
507  );
508 
509 // rev
510 BOOLEAN
511 WINAPI
513  _In_ HANDLE hServer
514  );
515 
516 // rev
517 BOOLEAN
518 WINAPI
520  _In_opt_ HANDLE hServer
521  );
522 
523 // rev
524 BOOLEAN
525 WINAPI
527  _In_opt_ HANDLE hServer,
528  _In_ ULONG Count,
529  _Inout_ PTS_COUNTER Counters // set counter IDs before calling
530  );
531 
532 BOOLEAN
533 WINAPI
535  _In_opt_ HANDLE hServer,
536  _In_ ULONG ShutdownFlags // WSD_*
537  );
538 
539 // rev
540 BOOLEAN
541 WINAPI
543  _In_opt_ HANDLE hServer,
544  _In_ ULONG EventMask, // WEVENT_*
545  _Out_ PULONG EventFlags
546  );
547 
548 // rev
549 BOOLEAN
550 WINAPI
552  _In_opt_ HANDLE hServer,
553  _In_ HWND WindowHandle,
554  _In_ ULONG Flags
555  );
556 
557 // rev
558 BOOLEAN
559 WINAPI
561  _In_opt_ HANDLE hServer,
562  _In_ HWND WindowHandle
563  );
564 
565 // Sessions
566 
567 // rev
568 BOOLEAN
569 WINAPI
571  _In_opt_ HANDLE hServer,
572  _Out_ PSESSIONIDW *SessionIds,
573  _Out_ PULONG Count
574  );
575 
576 BOOLEAN
577 WINAPI
579  _In_opt_ HANDLE hServer,
580  _In_ ULONG SessionId,
581  _In_ WINSTATIONINFOCLASS WinStationInformationClass,
582  _Out_writes_bytes_(WinStationInformationLength) PVOID pWinStationInformation,
583  _In_ ULONG WinStationInformationLength,
584  _Out_ PULONG pReturnLength
585  );
586 
587 // rev
588 BOOLEAN
589 WINAPI
591  _In_opt_ HANDLE hServer,
592  _In_ ULONG SessionId,
593  _In_ WINSTATIONINFOCLASS WinStationInformationClass,
594  _In_reads_bytes_(WinStationInformationLength) PVOID pWinStationInformation,
595  _In_ ULONG WinStationInformationLength
596  );
597 
598 BOOLEAN
599 WINAPI
601  _In_opt_ HANDLE hServer,
602  _In_ ULONG SessionId,
603  _Out_writes_(WINSTATIONNAME_LENGTH + 1) PWSTR pWinStationName
604  );
605 
606 // rev
607 BOOLEAN
608 WINAPI
610  _In_opt_ HANDLE hServer,
611  _In_ ULONG SessionId,
612  _In_ PWSTR Title,
613  _In_ ULONG TitleLength,
614  _In_ PWSTR Message,
615  _In_ ULONG MessageLength,
616  _In_ ULONG Style,
617  _In_ ULONG Timeout,
618  _Out_ PULONG Response,
619  _In_ BOOLEAN DoNotWait
620  );
621 
622 BOOLEAN
623 WINAPI
625  _In_opt_ HANDLE hServer,
626  _In_ ULONG SessionId,
627  _In_ ULONG TargetSessionId,
628  _In_opt_ PWSTR pPassword,
629  _In_ BOOLEAN bWait
630  );
631 
632 BOOLEAN
633 WINAPI
635  _In_opt_ HANDLE hServer,
636  _In_ ULONG SessionId,
637  _In_ BOOLEAN bWait
638  );
639 
640 // rev
641 BOOLEAN
642 WINAPI
644  _In_opt_ HANDLE hServer,
645  _In_ ULONG SessionId,
646  _In_ BOOLEAN bWait
647  );
648 
649 // rev
650 BOOLEAN
651 WINAPI
653  _In_opt_ HANDLE hServer,
654  _In_ PWSTR TargetServerName,
655  _In_ ULONG TargetSessionId,
656  _In_ UCHAR HotKeyVk,
657  _In_ USHORT HotkeyModifiers // KBD*
658  );
659 
660 // rev
661 BOOLEAN
662 WINAPI
664  _In_opt_ HANDLE hServer,
665  _In_ ULONG SessionId,
666  _In_ BOOLEAN bWait // ignored
667  );
668 
669 // Processes
670 
671 // rev
672 BOOLEAN
673 WINAPI
675  _In_opt_ HANDLE hServer,
676  _Out_ PVOID *Processes
677  );
678 
679 // rev
680 BOOLEAN
681 WINAPI
683  _In_opt_ HANDLE hServer,
684  _In_ ULONG Level,
685  _Out_ PULONG NumberOfProcesses,
686  _Out_ PTS_ALL_PROCESSES_INFO *Processes
687  );
688 
689 // rev
690 BOOLEAN
691 WINAPI
693  _In_ ULONG Level,
694  _In_ PTS_ALL_PROCESSES_INFO Processes,
695  _In_ ULONG NumberOfProcesses
696  );
697 
698 // rev
699 BOOLEAN
700 WINAPI
702  _In_opt_ HANDLE hServer,
703  _In_ ULONG ProcessId,
704  _In_ ULONG ExitCode
705  );
706 
707 BOOLEAN
708 WINAPI
710  _In_opt_ HANDLE hServer,
711  _In_ ULONG ProcessId,
712  _In_ FILETIME ProcessStartTime,
713  _Out_ PVOID pProcessUserSid,
714  _Inout_ PULONG dwSidSize
715  );
716 
717 // Services isolation
718 
719 #if (PHNT_VERSION >= PHNT_VISTA)
720 
721 // rev
722 BOOLEAN
723 WINAPI
725  VOID
726  );
727 
728 // rev
729 BOOLEAN
730 WINAPI
732  VOID
733  );
734 
735 #endif
736 
737 // Misc.
738 
739 BOOLEAN
740 WINAPI
742  VOID
743  );
744 
745 // end_msdn
746 
747 #endif