| 1 | /* $Id: nt-structures.h 82968 2020-02-04 10:35:17Z vboxsync $ */
|
|---|
| 2 | /** @file
|
|---|
| 3 | * IPRT - Header for NT structures.
|
|---|
| 4 | */
|
|---|
| 5 |
|
|---|
| 6 | /*
|
|---|
| 7 | * Copyright (C) 2010-2020 Oracle Corporation
|
|---|
| 8 | *
|
|---|
| 9 | * This file is part of VirtualBox Open Source Edition (OSE), as
|
|---|
| 10 | * available from http://www.virtualbox.org. This file is free software;
|
|---|
| 11 | * you can redistribute it and/or modify it under the terms of the GNU
|
|---|
| 12 | * General Public License (GPL) as published by the Free Software
|
|---|
| 13 | * Foundation, in version 2 as it comes in the "COPYING" file of the
|
|---|
| 14 | * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
|
|---|
| 15 | * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
|
|---|
| 16 | *
|
|---|
| 17 | * The contents of this file may alternatively be used under the terms
|
|---|
| 18 | * of the Common Development and Distribution License Version 1.0
|
|---|
| 19 | * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
|
|---|
| 20 | * VirtualBox OSE distribution, in which case the provisions of the
|
|---|
| 21 | * CDDL are applicable instead of those of the GPL.
|
|---|
| 22 | *
|
|---|
| 23 | * You may elect to license modified versions of this file under the
|
|---|
| 24 | * terms and conditions of either the GPL or the CDDL or both.
|
|---|
| 25 | */
|
|---|
| 26 |
|
|---|
| 27 | #ifndef IPRT_INCLUDED_nt_nt_structures_h
|
|---|
| 28 | #define IPRT_INCLUDED_nt_nt_structures_h
|
|---|
| 29 | #ifndef RT_WITHOUT_PRAGMA_ONCE
|
|---|
| 30 | # pragma once
|
|---|
| 31 | #endif
|
|---|
| 32 |
|
|---|
| 33 |
|
|---|
| 34 | #include <iprt/types.h>
|
|---|
| 35 |
|
|---|
| 36 |
|
|---|
| 37 | /** @name NT Kernel Structures
|
|---|
| 38 | * @{ */
|
|---|
| 39 | typedef struct KTRAP_FRAME_AMD64
|
|---|
| 40 | {
|
|---|
| 41 | uint64_t P1Home; /**< 0x00 */
|
|---|
| 42 | uint64_t P2Home; /**< 0x08 */
|
|---|
| 43 | uint64_t P3Home; /**< 0x10 */
|
|---|
| 44 | uint64_t P4Home; /**< 0x18 */
|
|---|
| 45 | uint64_t P5; /**< 0x20 */
|
|---|
| 46 | uint8_t PreviousMode; /**< 0x28: KPROCESSOR_MODE / MODE - unused? */
|
|---|
| 47 | uint8_t PreviousIrql; /**< 0x29: KIRQL - Interrupts? */
|
|---|
| 48 | uint8_t FaultIndicator; /**< 0x2a: Holds (ErrCd >> 1) & 9) for \#PF. */
|
|---|
| 49 | uint8_t ExceptionActive; /**< 0x2b: 0 if interrupt, 1 if exception, 2 if service call, */
|
|---|
| 50 | uint32_t MxCsr; /**< 0x2c */
|
|---|
| 51 | /** @name Volatile general register state. Only saved on interrupts and exceptions.
|
|---|
| 52 | * @{ */
|
|---|
| 53 | uint64_t Rax; /**< 0x30 */
|
|---|
| 54 | uint64_t Rcx; /**< 0x38 */
|
|---|
| 55 | uint64_t Rdx; /**< 0x40 */
|
|---|
| 56 | uint64_t R8; /**< 0x48 */
|
|---|
| 57 | uint64_t R9; /**< 0x50 */
|
|---|
| 58 | uint64_t R10; /**< 0x58 */
|
|---|
| 59 | uint64_t R11; /**< 0x60 */
|
|---|
| 60 | /** @} */
|
|---|
| 61 | uint64_t GsBaseOrSwap; /**< 0x68: GsBase if previous mode is kernel, GsSwap if pervious mode was user. */
|
|---|
| 62 | /** @name Volatile SSE state. Only saved on interrupts and exceptions.
|
|---|
| 63 | * @{ */
|
|---|
| 64 | RTUINT128U Xmm0; /**< 0x70 */
|
|---|
| 65 | RTUINT128U Xmm1; /**< 0x80: RBP points here. */
|
|---|
| 66 | RTUINT128U Xmm2; /**< 0x90 */
|
|---|
| 67 | RTUINT128U Xmm3; /**< 0xa0 */
|
|---|
| 68 | RTUINT128U Xmm4; /**< 0xb0 */
|
|---|
| 69 | RTUINT128U Xmm5; /**< 0xc0 */
|
|---|
| 70 | /** @} */
|
|---|
| 71 | uint64_t FaultAddrOrCtxRecOrTS; /**< 0xd0: Used to save CR2 in \#PF and NMI handlers. */
|
|---|
| 72 | /** @name Usermode debug state.
|
|---|
| 73 | * @{ */
|
|---|
| 74 | uint64_t Dr0; /**< 0xd8: Only if DR7 indicates active. */
|
|---|
| 75 | uint64_t Dr1; /**< 0xe0: Only if DR7 indicates active. */
|
|---|
| 76 | uint64_t Dr2; /**< 0xe8: Only if DR7 indicates active. */
|
|---|
| 77 | uint64_t Dr3; /**< 0xf0: Only if DR7 indicates active. */
|
|---|
| 78 | uint64_t Dr6; /**< 0xf8: Only if DR7 indicates active. */
|
|---|
| 79 | uint64_t Dr7; /**< 0x100: Considered active any of these bits are set:
|
|---|
| 80 | X86_DR7_LE_ALL | X86_DR7_LE | X86_DR7_GE. */
|
|---|
| 81 | union
|
|---|
| 82 | {
|
|---|
| 83 | struct
|
|---|
| 84 | {
|
|---|
| 85 | uint64_t LastBranchControl; /**< 0x108 */
|
|---|
| 86 | uint32_t LastBranchMSR; /**< 0x110 */
|
|---|
| 87 | } amd;
|
|---|
| 88 | struct
|
|---|
| 89 | {
|
|---|
| 90 | uint64_t DebugControl; /**< 0x108 */
|
|---|
| 91 | uint64_t LastBranchToRip; /**< 0x110 */
|
|---|
| 92 | uint64_t LastBranchFromRip; /**< 0x118 */
|
|---|
| 93 | uint64_t LastExceptionToRip; /**< 0x120 */
|
|---|
| 94 | uint64_t LastExceptionFromRip; /**< 0x128 */
|
|---|
| 95 | } intel;
|
|---|
| 96 | } u;
|
|---|
| 97 | /** @} */
|
|---|
| 98 | /** @name Segment registers. Not sure when these would actually be used.
|
|---|
| 99 | * @{ */
|
|---|
| 100 | uint16_t SegDs; /**< 0x130 */
|
|---|
| 101 | uint16_t SegEs; /**< 0x132 */
|
|---|
| 102 | uint16_t SegFs; /**< 0x134 */
|
|---|
| 103 | uint16_t SegGs; /**< 0x136 */
|
|---|
| 104 | /** @} */
|
|---|
| 105 | uint64_t TrapFrame; /**< 0x138 */
|
|---|
| 106 | /** @name Some non-volatile registers only saved in service calls.
|
|---|
| 107 | * @{ */
|
|---|
| 108 | uint64_t Rbx; /**< 0x140 */
|
|---|
| 109 | uint64_t Rdi; /**< 0x148 */
|
|---|
| 110 | uint64_t Rsi; /**< 0x150 */
|
|---|
| 111 | /** @} */
|
|---|
| 112 | uint64_t Rbp; /**< 0x158: Typically restored by: MOV RBP, [RBP + 0xd8] */
|
|---|
| 113 | uint64_t ErrCdOrXcptFrameOrS; /**< 0x160 */
|
|---|
| 114 | uint64_t Rip; /**< 0x168 - IRET RIP */
|
|---|
| 115 | uint16_t SegCs; /**< 0x170 - IRET CS */
|
|---|
| 116 | uint8_t Fill0; /**< 0x172 */
|
|---|
| 117 | uint8_t Logging; /**< 0x173 */
|
|---|
| 118 | uint16_t Fill1[2]; /**< 0x174 */
|
|---|
| 119 | uint32_t EFlags; /**< 0x178 - IRET EFLAGS - Uninitialized for stack switching/growth code path. */
|
|---|
| 120 | uint32_t Fill2; /**< 0x17c */
|
|---|
| 121 | uint64_t Rsp; /**< 0x180 - IRET RSP */
|
|---|
| 122 | uint16_t SegSs; /**< 0x188 - IRET SS */
|
|---|
| 123 | uint16_t Fill3; /**< 0x18a */
|
|---|
| 124 | uint32_t Fill4; /**< 0x18c */
|
|---|
| 125 | } KTRAP_FRAME_AMD64;
|
|---|
| 126 | AssertCompileSize(KTRAP_FRAME_AMD64, 0x190);
|
|---|
| 127 | /** Pointer to an AMD64 NT trap frame. */
|
|---|
| 128 | typedef KTRAP_FRAME_AMD64 *PKTRAP_FRAME_AMD64;
|
|---|
| 129 | /** Pointer to a const AMD64 NT trap frame. */
|
|---|
| 130 | typedef KTRAP_FRAME_AMD64 const *PCKTRAP_FRAME_AMD64;
|
|---|
| 131 |
|
|---|
| 132 | /** @} */
|
|---|
| 133 |
|
|---|
| 134 |
|
|---|
| 135 | #endif /* !IPRT_INCLUDED_nt_nt_structures_h */
|
|---|
| 136 |
|
|---|
