Last active
August 12, 2024 15:15
-
-
Save alexander-hanel/bb9d756dd18e4886450b1c7bc4cfcf0f to your computer and use it in GitHub Desktop.
IDAPython PROCESSINFOCLASS & THREADINFOCLASS Enum Values for ZwQueryInformationProcess & ZwQueryInformationThread
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # IDAPYTHON 7.4 | |
| id = idc.add_enum(-1, "PROCESSINFOCLASS", idaapi.hex_flag()) | |
| # 0x0 ProcessBasicInformation, // 0, q: PROCESS_BASIC_INFORMATION, PROCESS_EXTENDED_BASIC_INFORMATION | |
| idc.add_enum_member(id, "ProcessBasicInformation", 0, -1) | |
| # 0x1 ProcessQuotaLimits, // 1, qs: QUOTA_LIMITS, QUOTA_LIMITS_EX | |
| idc.add_enum_member(id, "ProcessQuotaLimits", 1, -1) | |
| # 0x2 ProcessIoCounters, // 2, q: IO_COUNTERS | |
| idc.add_enum_member(id, "ProcessIoCounters", 2, -1) | |
| # 0x3 ProcessVmCounters, //3, q: VM_COUNTERS, VM_COUNTERS_EX, VM_COUNTERS_EX2 | |
| idc.add_enum_member(id, "ProcessVmCounters", 3, -1) | |
| # 0x4 ProcessTimes, // 4 q: KERNEL_USER_TIMES | |
| idc.add_enum_member(id, "ProcessTimes", 4, -1) | |
| # 0x5 ProcessBasePriority, // s: KPRIORITY | |
| idc.add_enum_member(id, "ProcessBasePriority", 5, -1) | |
| # 0x6 ProcessRaisePriority, // s: ULONG | |
| idc.add_enum_member(id, "ProcessRaisePriority", 6, -1) | |
| # 0x7 ProcessDebugPort, // q: HANDLE | |
| idc.add_enum_member(id, "ProcessDebugPort", 7, -1) | |
| # 0x8 ProcessExceptionPort, // s: HANDLE | |
| idc.add_enum_member(id, "ProcessExceptionPort", 8, -1) | |
| # 0x9 ProcessAccessToken, // s: PROCESS_ACCESS_TOKEN | |
| idc.add_enum_member(id, "ProcessAccessToken", 9, -1) | |
| # 0xa ProcessLdtInformation, // 10, qs: PROCESS_LDT_INFORMATION | |
| idc.add_enum_member(id, "ProcessLdtInformation", 10, -1) | |
| # 0xb ProcessLdtSize, // s: PROCESS_LDT_SIZE | |
| idc.add_enum_member(id, "ProcessLdtSize", 11, -1) | |
| # 0xc ProcessDefaultHardErrorMode, // qs: ULONG | |
| idc.add_enum_member(id, "ProcessDefaultHardErrorMode", 12, -1) | |
| # 0xd ProcessIoPortHandlers, // (kernel-mode only) | |
| idc.add_enum_member(id, "ProcessIoPortHandlers", 13, -1) | |
| # 0xe ProcessPooledUsageAndLimits, // q: POOLED_USAGE_AND_LIMITS | |
| idc.add_enum_member(id, "ProcessPooledUsageAndLimits", 14, -1) | |
| # 0xf ProcessWorkingSetWatch, // q: PROCESS_WS_WATCH_INFORMATION[]; s: void | |
| idc.add_enum_member(id, "ProcessWorkingSetWatch", 15, -1) | |
| # 0x10 ProcessUserModeIOPL, | |
| idc.add_enum_member(id, "ProcessUserModeIOPL", 16, -1) | |
| # 0x11 ProcessEnableAlignmentFaultFixup, // s: BOOLEAN | |
| idc.add_enum_member(id, "ProcessEnableAlignmentFaultFixup", 17, -1) | |
| # 0x12 ProcessPriorityClass, // qs: PROCESS_PRIORITY_CLASS | |
| idc.add_enum_member(id, "ProcessPriorityClass", 18, -1) | |
| # 0x13 ProcessWx86Information, | |
| idc.add_enum_member(id, "ProcessWx86Information", 19, -1) | |
| # 0x14 ProcessHandleCount, // 20, q: ULONG, PROCESS_HANDLE_INFORMATION | |
| idc.add_enum_member(id, "ProcessHandleCount", 20, -1) | |
| # 0x15 ProcessAffinityMask, // s: KAFFINITY | |
| idc.add_enum_member(id, "ProcessAffinityMask", 21, -1) | |
| # 0x16 ProcessPriorityBoost, // qs: ULONG | |
| idc.add_enum_member(id, "ProcessPriorityBoost", 22, -1) | |
| # 0x17 ProcessDeviceMap, // qs: PROCESS_DEVICEMAP_INFORMATION, PROCESS_DEVICEMAP_INFORMATION_EX | |
| idc.add_enum_member(id, "ProcessDeviceMap", 23, -1) | |
| # 0x18 ProcessSessionInformation, // q: PROCESS_SESSION_INFORMATION | |
| idc.add_enum_member(id, "ProcessSessionInformation", 24, -1) | |
| # 0x19 ProcessForegroundInformation, // s: PROCESS_FOREGROUND_BACKGROUND | |
| idc.add_enum_member(id, "ProcessForegroundInformation", 25, -1) | |
| # 0x1a ProcessWow64Information, // q: ULONG_PTR | |
| idc.add_enum_member(id, "ProcessWow64Information", 26, -1) | |
| # 0x1b ProcessImageFileName, // q: UNICODE_STRING | |
| idc.add_enum_member(id, "ProcessImageFileName", 27, -1) | |
| # 0x1c ProcessLUIDDeviceMapsEnabled, // q: ULONG | |
| idc.add_enum_member(id, "ProcessLUIDDeviceMapsEnabled", 28, -1) | |
| # 0x1d ProcessBreakOnTermination, // qs: ULONG | |
| idc.add_enum_member(id, "ProcessBreakOnTermination", 29, -1) | |
| # 0x1e ProcessDebugObjectHandle, // 30, q: HANDLE | |
| idc.add_enum_member(id, "ProcessDebugObjectHandle", 30, -1) | |
| # 0x1f ProcessDebugFlags, // qs: ULONG | |
| idc.add_enum_member(id, "ProcessDebugFlags", 31, -1) | |
| # 0x20 ProcessHandleTracing, // q: PROCESS_HANDLE_TRACING_QUERY; s: size 0 disables, otherwise enables | |
| idc.add_enum_member(id, "ProcessHandleTracing", 32, -1) | |
| # 0x21 ProcessIoPriority, // qs: ULONG | |
| idc.add_enum_member(id, "ProcessIoPriority", 33, -1) | |
| # 0x22 ProcessExecuteFlags, // qs: ULONG | |
| idc.add_enum_member(id, "ProcessExecuteFlags", 34, -1) | |
| # 0x23 ProcessResourceManagement, | |
| idc.add_enum_member(id, "ProcessResourceManagement", 35, -1) | |
| # 0x24 ProcessCookie, // q: ULONG | |
| idc.add_enum_member(id, "ProcessCookie", 36, -1) | |
| # 0x25 ProcessImageInformation, // q: SECTION_IMAGE_INFORMATION | |
| idc.add_enum_member(id, "ProcessImageInformation", 37, -1) | |
| # 0x26 ProcessCycleTime, // q: PROCESS_CYCLE_TIME_INFORMATION // since VISTA | |
| idc.add_enum_member(id, "ProcessCycleTime", 38, -1) | |
| # 0x27 ProcessPagePriority, // q: ULONG | |
| idc.add_enum_member(id, "ProcessPagePriority", 39, -1) | |
| # 0x28 ProcessInstrumentationCallback, // 40 | |
| idc.add_enum_member(id, "ProcessInstrumentationCallback", 40, -1) | |
| # 0x29 ProcessThreadStackAllocation, // s: PROCESS_STACK_ALLOCATION_INFORMATION, PROCESS_STACK_ALLOCATION_INFORMATION_EX | |
| idc.add_enum_member(id, "ProcessThreadStackAllocation", 41, -1) | |
| # 0x2a ProcessWorkingSetWatchEx, // q: PROCESS_WS_WATCH_INFORMATION_EX[] | |
| idc.add_enum_member(id, "ProcessWorkingSetWatchEx", 42, -1) | |
| # 0x2b ProcessImageFileNameWin32, // q: UNICODE_STRING | |
| idc.add_enum_member(id, "ProcessImageFileNameWin32", 43, -1) | |
| # 0x2c ProcessImageFileMapping, // q: HANDLE (input) | |
| idc.add_enum_member(id, "ProcessImageFileMapping", 44, -1) | |
| # 0x2d ProcessAffinityUpdateMode, // qs: PROCESS_AFFINITY_UPDATE_MODE | |
| idc.add_enum_member(id, "ProcessAffinityUpdateMode", 45, -1) | |
| # 0x2e ProcessMemoryAllocationMode, // qs: PROCESS_MEMORY_ALLOCATION_MODE | |
| idc.add_enum_member(id, "ProcessMemoryAllocationMode", 46, -1) | |
| # 0x2f ProcessGroupInformation, // q: USHORT[] | |
| idc.add_enum_member(id, "ProcessGroupInformation", 47, -1) | |
| # 0x30 ProcessTokenVirtualizationEnabled, // s: ULONG | |
| idc.add_enum_member(id, "ProcessTokenVirtualizationEnabled", 48, -1) | |
| # 0x31 ProcessConsoleHostProcess, // q: ULONG_PTR | |
| idc.add_enum_member(id, "ProcessConsoleHostProcess", 49, -1) | |
| # 0x32 ProcessWindowInformation, // 50, q: PROCESS_WINDOW_INFORMATION | |
| idc.add_enum_member(id, "ProcessWindowInformation", 50, -1) | |
| # 0x33 ProcessHandleInformation, // q: PROCESS_HANDLE_SNAPSHOT_INFORMATION // since WIN8 | |
| idc.add_enum_member(id, "ProcessHandleInformation", 51, -1) | |
| # 0x34 ProcessMitigationPolicy, // s: PROCESS_MITIGATION_POLICY_INFORMATION | |
| idc.add_enum_member(id, "ProcessMitigationPolicy", 52, -1) | |
| # 0x35 ProcessDynamicFunctionTableInformation, | |
| idc.add_enum_member(id, "ProcessDynamicFunctionTableInformation", 53, -1) | |
| # 0x36 ProcessHandleCheckingMode, | |
| idc.add_enum_member(id, "ProcessHandleCheckingMode", 54, -1) | |
| # 0x37 ProcessKeepAliveCount, // q: PROCESS_KEEPALIVE_COUNT_INFORMATION | |
| idc.add_enum_member(id, "ProcessKeepAliveCount", 55, -1) | |
| # 0x38 ProcessRevokeFileHandles, // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION | |
| idc.add_enum_member(id, "ProcessRevokeFileHandles", 56, -1) | |
| # 0x39 ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL | |
| idc.add_enum_member(id, "ProcessWorkingSetControl", 57, -1) | |
| # 0x3a ProcessHandleTable, // since WINBLUE | |
| idc.add_enum_member(id, "ProcessHandleTable", 58, -1) | |
| # 0x3b ProcessCheckStackExtentsMode, | |
| idc.add_enum_member(id, "ProcessCheckStackExtentsMode", 59, -1) | |
| # 0x3c ProcessCommandLineInformation, // 60, q: UNICODE_STRING | |
| idc.add_enum_member(id, "ProcessCommandLineInformation", 60, -1) | |
| # 0x3d ProcessProtectionInformation, // q: PS_PROTECTION | |
| idc.add_enum_member(id, "ProcessProtectionInformation", 61, -1) | |
| # 0x3e ProcessMemoryExhaustion, // PROCESS_MEMORY_EXHAUSTION_INFO // since THRESHOLD | |
| idc.add_enum_member(id, "ProcessMemoryExhaustion", 62, -1) | |
| # 0x3f ProcessFaultInformation, // PROCESS_FAULT_INFORMATION | |
| idc.add_enum_member(id, "ProcessFaultInformation", 63, -1) | |
| # 0x40 ProcessTelemetryIdInformation, // PROCESS_TELEMETRY_ID_INFORMATION | |
| idc.add_enum_member(id, "ProcessTelemetryIdInformation", 64, -1) | |
| # 0x41 ProcessCommitReleaseInformation, // PROCESS_COMMIT_RELEASE_INFORMATION | |
| idc.add_enum_member(id, "ProcessCommitReleaseInformation", 65, -1) | |
| # 0x42 ProcessDefaultCpuSetsInformation, | |
| idc.add_enum_member(id, "ProcessDefaultCpuSetsInformation", 66, -1) | |
| # 0x43 ProcessAllowedCpuSetsInformation, | |
| idc.add_enum_member(id, "ProcessAllowedCpuSetsInformation", 67, -1) | |
| # 0x44 ProcessReserved1Information, | |
| idc.add_enum_member(id, "ProcessReserved1Information", 68, -1) | |
| # 0x45 ProcessReserved2Information, | |
| idc.add_enum_member(id, "ProcessReserved2Information", 69, -1) | |
| # 0x46 ProcessSubsystemProcess, // 70 | |
| idc.add_enum_member(id, "ProcessSubsystemProcess", 70, -1) | |
| # 0x47 ProcessJobMemoryInformation, // PROCESS_JOB_MEMORY_INFO | |
| idc.add_enum_member(id, "ProcessJobMemoryInformation", 71, -1) | |
| # 0x48 MaxProcessInfoClass, | |
| idc.add_enum_member(id, "MaxProcessInfoClass", 72, -1) | |
| thread_id = idc.add_enum(-1, "THREADINFOCLASS", idaapi.hex_flag()) | |
| # 0x0 sicInformation, // q: THREAD_BASIC_INFORMATION | |
| idc.add_enum_member(thread_id, "sicInformation", 0, -1) | |
| # 0x1 ThreadTimes, // q: KERNEL_USER_TIMES | |
| idc.add_enum_member(thread_id, "ThreadTimes", 1, -1) | |
| # 0x2 ThreadPriority, // s: KPRIORITY | |
| idc.add_enum_member(thread_id, "ThreadPriority", 2, -1) | |
| # 0x3 ThreadBasePriority, // s: LONG | |
| idc.add_enum_member(thread_id, "ThreadBasePriority", 3, -1) | |
| # 0x4 ThreadAffinityMask, // s: KAFFINITY | |
| idc.add_enum_member(thread_id, "ThreadAffinityMask", 4, -1) | |
| # 0x5 ThreadImpersonationToken, // s: HANDLE | |
| idc.add_enum_member(thread_id, "ThreadImpersonationToken", 5, -1) | |
| # 0x6 ThreadDescriptorTableEntry, // q: DESCRIPTOR_TABLE_ENTRY (or WOW64_DESCRIPTOR_TABLE_ENTRY) | |
| idc.add_enum_member(thread_id, "ThreadDescriptorTableEntry", 6, -1) | |
| # 0x7 ThreadEnableAlignmentFaultFixup, // s: BOOLEAN | |
| idc.add_enum_member(thread_id, "ThreadEnableAlignmentFaultFixup", 7, -1) | |
| # 0x8 ThreadEventPair, | |
| idc.add_enum_member(thread_id, "ThreadEventPair", 8, -1) | |
| # 0x9 ThreadQuerySetWin32StartAddress, // q: PVOID | |
| idc.add_enum_member(thread_id, "ThreadQuerySetWin32StartAddress", 9, -1) | |
| # 0xa ThreadZeroTlsCell, // 10 | |
| idc.add_enum_member(thread_id, "ThreadZeroTlsCell", 10, -1) | |
| # 0xb ThreadPerformanceCount, // q: LARGE_INTEGER | |
| idc.add_enum_member(thread_id, "ThreadPerformanceCount", 11, -1) | |
| # 0xc ThreadAmILastThread, // q: ULONG | |
| idc.add_enum_member(thread_id, "ThreadAmILastThread", 12, -1) | |
| # 0xd ThreadIdealProcessor, // s: ULONG | |
| idc.add_enum_member(thread_id, "ThreadIdealProcessor", 13, -1) | |
| # 0xe ThreadPriorityBoost, // qs: ULONG | |
| idc.add_enum_member(thread_id, "ThreadPriorityBoost", 14, -1) | |
| # 0xf ThreadSetTlsArrayAddress, | |
| idc.add_enum_member(thread_id, "ThreadSetTlsArrayAddress", 15, -1) | |
| # 0x10 ThreadIsIoPending, // q: ULONG | |
| idc.add_enum_member(thread_id, "ThreadIsIoPending", 16, -1) | |
| # 0x11 ThreadHideFromDebugger, // s: void | |
| idc.add_enum_member(thread_id, "ThreadHideFromDebugger", 17, -1) | |
| # 0x12 ThreadBreakOnTermination, // qs: ULONG | |
| idc.add_enum_member(thread_id, "ThreadBreakOnTermination", 18, -1) | |
| # 0x13 ThreadSwitchLegacyState, | |
| idc.add_enum_member(thread_id, "ThreadSwitchLegacyState", 19, -1) | |
| # 0x14 ThreadIsTerminated, // 20, q: ULONG | |
| idc.add_enum_member(thread_id, "ThreadIsTerminated", 20, -1) | |
| # 0x15 ThreadLastSystemCall, // q: THREAD_LAST_SYSCALL_INFORMATION | |
| idc.add_enum_member(thread_id, "ThreadLastSystemCall", 21, -1) | |
| # 0x16 ThreadIoPriority, // qs: ULONG | |
| idc.add_enum_member(thread_id, "ThreadIoPriority", 22, -1) | |
| # 0x17 ThreadCycleTime, // q: THREAD_CYCLE_TIME_INFORMATION | |
| idc.add_enum_member(thread_id, "ThreadCycleTime", 23, -1) | |
| # 0x18 ThreadPagePriority, // q: ULONG | |
| idc.add_enum_member(thread_id, "ThreadPagePriority", 24, -1) | |
| # 0x19 ThreadActualBasePriority, | |
| idc.add_enum_member(thread_id, "ThreadActualBasePriority", 25, -1) | |
| # 0x1a ThreadTebInformation, // q: THREAD_TEB_INFORMATION (requires THREAD_GET_CONTEXT + THREAD_SET_CONTEXT) | |
| idc.add_enum_member(thread_id, "ThreadTebInformation", 26, -1) | |
| # 0x1b ThreadCSwitchMon, | |
| idc.add_enum_member(thread_id, "ThreadCSwitchMon", 27, -1) | |
| # 0x1c ThreadCSwitchPmu, | |
| idc.add_enum_member(thread_id, "ThreadCSwitchPmu", 28, -1) | |
| # 0x1d ThreadWow64Context, // q: WOW64_CONTEXT | |
| idc.add_enum_member(thread_id, "ThreadWow64Context", 29, -1) | |
| # 0x1e ThreadGroupInformation, // 30, q: GROUP_AFFINITY | |
| idc.add_enum_member(thread_id, "ThreadGroupInformation", 30, -1) | |
| # 0x1f ThreadUmsInformation, | |
| idc.add_enum_member(thread_id, "ThreadUmsInformation", 31, -1) | |
| # 0x20 ThreadCounterProfiling, | |
| idc.add_enum_member(thread_id, "ThreadCounterProfiling", 32, -1) | |
| # 0x21 ThreadIdealProcessorEx, // q: PROCESSOR_NUMBER | |
| idc.add_enum_member(thread_id, "ThreadIdealProcessorEx", 33, -1) | |
| # 0x22 ThreadCpuAccountingInformation, // since WIN8 | |
| idc.add_enum_member(thread_id, "ThreadCpuAccountingInformation", 34, -1) | |
| # 0x23 ThreadSuspendCount, // since WINBLUE | |
| idc.add_enum_member(thread_id, "ThreadSuspendCount", 35, -1) | |
| # 0x24 ThreadHeterogeneousCpuPolicy, // KHETERO_CPU_POLICY // since THRESHOLD | |
| idc.add_enum_member(thread_id, "ThreadHeterogeneousCpuPolicy", 36, -1) | |
| # 0x25 ThreadContainerId, | |
| idc.add_enum_member(thread_id, "ThreadContainerId", 37, -1) | |
| # 0x26 ThreadNameInformation, | |
| idc.add_enum_member(thread_id, "ThreadNameInformation", 38, -1) | |
| # 0x27 ThreadProperty, | |
| idc.add_enum_member(thread_id, "ThreadProperty", 39, -1) | |
| # 0x28 ThreadSelectedCpuSets, | |
| idc.add_enum_member(thread_id, "ThreadSelectedCpuSets", 40, -1) | |
| # 0x29 ThreadSystemThreadInformation, | |
| idc.add_enum_member(thread_id, "ThreadSystemThreadInformation", 41, -1) | |
| # 0x2a MaxThreadInfoClass | |
| idc.add_enum_member(thread_id, "MaxThreadInfoClass ", 42, -1) | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Source https://processhacker.sourceforge.io/doc/ntpsapi_8h_source.html