ULONG WaitTime; PVOID StartAddress; CLIENT_ID ClientId; LONG Priority; LONG BasePriority; ULONG ContextSwitches; ULONG ThreadState; ULONG WaitReason; } SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION; #ifdef __cplusplus } #endif Appendix A.7: allproc.h For ease of implementation, the full header file is provided. #ifndef TS_ALLPROC_ALREADY_SET #define TS_ALLPROC_ALREADY_SET #ifdef __midl cpp_quote( "#define TS_PROCESS_INFO_MAGIC_NT4 0x23495452" ) #else #define TS_PROCESS_INFO_MAGIC_NT4 0x23495452 #endif typedef struct _TS_PROCESS_INFORMATION_NT4 { ULONG MagicNumber; ULONG LogonId; PVOID ProcessSid; ULONG Pad; } TS_PROCESS_INFORMATION_NT4, * PTS_PROCESS_INFORMATION_NT4; // sizes of TS4.0 structures (size has changed in Windows 2000) #ifdef __midl cpp_quote( "#define SIZEOF_TS4_SYSTEM_THREAD_INFORMATION 64" ) cpp_quote( "#define SIZEOF_TS4_SYSTEM_PROCESS_INFORMATION 136" ) #else #define SIZEOF_TS4_SYSTEM_THREAD_INFORMATION 64 #define SIZEOF_TS4_SYSTEM_PROCESS_INFORMATION 136 #endif #ifdef __midl cpp_quote( "#define GAP_LEVEL_BASIC 0" ) #else #define GAP_LEVEL_BASIC 0 #endif typedef struct _TS_UNICODE_STRING { USHORT Length; USHORT MaximumLength;
ULONG WaitTime; PVOID StartAddress; CLIENT_ID ClientId; LONG Priority; LONG BasePriority; ULONG ContextSwitches; ULONG ThreadState; ULONG WaitReason; } SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION; #ifdef __cplusplus } #endif Appendix A.7: allproc.h For ease of implementation, the full header file is provided. #ifndef TS_ALLPROC_ALREADY_SET #define TS_ALLPROC_ALREADY_SET #ifdef __midl cpp_quote( "#define TS_PROCESS_INFO_MAGIC_NT4 0x23495452" ) #else #define TS_PROCESS_INFO_MAGIC_NT4 0x23495452 #endif typedef struct _TS_PROCESS_INFORMATION_NT4 { ULONG MagicNumber; ULONG LogonId; PVOID ProcessSid; ULONG Pad; } TS_PROCESS_INFORMATION_NT4, * PTS_PROCESS_INFORMATION_NT4; // sizes of TS4.0 structures (size has changed in Windows 2000) #ifdef __midl cpp_quote( "#define SIZEOF_TS4_SYSTEM_THREAD_INFORMATION 64" ) cpp_quote( "#define SIZEOF_TS4_SYSTEM_PROCESS_INFORMATION 136" ) #else #define SIZEOF_TS4_SYSTEM_THREAD_INFORMATION 64 #define SIZEOF_TS4_SYSTEM_PROCESS_INFORMATION 136 #endif #ifdef __midl cpp_quote( "#define GAP_LEVEL_BASIC 0" ) #else #define GAP_LEVEL_BASIC 0 #endif typedef struct _TS_UNICODE_STRING { USHORT Length; USHORT MaximumLength;
%5BMS-TSTS%5D-160714.docx