Process Hacker
filepool.h
Go to the documentation of this file.
1 #ifndef _PH_FILEPOOL_H
2 #define _PH_FILEPOOL_H
3 
4 // On-disk structures
5 
6 // Each file has at least one segment.
7 // Each segment has a number of blocks, which are allocated
8 // from a bitmap. The segment header is always in the first block
9 // of each segment, except for the first segment. In the first segment,
10 // the file header is in the first few blocks, followed by the segment header.
11 //
12 // The segments are placed in a particular free list depending on how many
13 // blocks they have free; this allows allocators to simply skip the segments
14 // which don't have enough segments free, and allocate new segments if necessary.
15 // The free list does not however guarantee that a particular segment has
16 // a particular number of contiguous blocks free; low performance can still
17 // occur when there is fragmentation.
18 
20 #define PH_FP_BITMAP_SIZE 64
21 
22 #define PH_FP_BITMAP_SIZE_SHIFT 6
23 
24 #define PH_FP_BLOCK_COUNT (PH_FP_BITMAP_SIZE * 32)
25 
26 #define PH_FP_BLOCK_COUNT_SHIFT (PH_FP_BITMAP_SIZE_SHIFT + 5)
27 
28 #define PH_FP_FREE_LIST_COUNT 8
29 
30 // Block flags
32 #define PH_FP_BLOCK_LARGE_ALLOCATION 0x1
33 
34 typedef struct _PH_FP_BLOCK_HEADER
35 {
36  ULONG Flags; // PH_FP_BLOCK_*
39  ULONG Span;
40  ULONGLONG Body;
42 
43 typedef struct _PH_FP_SEGMENT_HEADER
44 {
46  ULONG FreeBlocks;
47  ULONG FreeFlink;
48  ULONG FreeBlink;
49  ULONG Reserved[13];
51 
52 #define PH_FP_MAGIC ('loPF')
53 
54 typedef struct _PH_FP_FILE_HEADER
55 {
56  ULONG Magic;
57  ULONG SegmentShift;
58  ULONG SegmentCount;
59  ULONGLONG UserContext;
62 
63 // Runtime
64 
66 {
67  // File options
68 
71  ULONG SegmentShift;
72 
73  // Runtime options
74 
78 
79 typedef struct _PH_FILE_POOL
80 {
81  HANDLE FileHandle;
82  HANDLE SectionHandle;
83  BOOLEAN ReadOnly;
84 
86  PLIST_ENTRY *ByIndexBuckets;
87  ULONG ByIndexSize;
89 
93 
94  PPH_FP_BLOCK_HEADER FirstBlockOfFirstSegment;
95  PPH_FP_FILE_HEADER Header;
96  ULONG SegmentShift; // The power-of-two size of each segment
97  ULONG SegmentSize; // The size of each segment
98  ULONG BlockShift; // The power-of-two size of each block in each segment
99  ULONG BlockSize; // The size of each block in each segment
100  ULONG FileHeaderBlockSpan; // The number of blocks needed to store a file header
101  ULONG SegmentHeaderBlockSpan; // The number of blocks needed to store a segment header
103 
104 NTSTATUS PhCreateFilePool(
105  _Out_ PPH_FILE_POOL *Pool,
106  _In_ HANDLE FileHandle,
107  _In_ BOOLEAN ReadOnly,
108  _In_opt_ PPH_FILE_POOL_PARAMETERS Parameters
109  );
110 
111 NTSTATUS PhCreateFilePool2(
112  _Out_ PPH_FILE_POOL *Pool,
113  _In_ PWSTR FileName,
114  _In_ BOOLEAN ReadOnly,
115  _In_ ULONG ShareAccess,
116  _In_ ULONG CreateDisposition,
117  _In_opt_ PPH_FILE_POOL_PARAMETERS Parameters
118  );
119 
121  _In_ _Post_invalid_ PPH_FILE_POOL Pool
122  );
123 
124 PVOID PhAllocateFilePool(
125  _Inout_ PPH_FILE_POOL Pool,
126  _In_ ULONG Size,
127  _Out_opt_ PULONG Rva
128  );
129 
131  _Inout_ PPH_FILE_POOL Pool,
132  _In_ PVOID Block
133  );
134 
135 BOOLEAN PhFreeFilePoolByRva(
136  _Inout_ PPH_FILE_POOL Pool,
137  _In_ ULONG Rva
138  );
139 
141  _Inout_ PPH_FILE_POOL Pool,
142  _In_ PVOID Address
143  );
144 
146  _Inout_ PPH_FILE_POOL Pool,
147  _In_ PVOID Address
148  );
149 
151  _Inout_ PPH_FILE_POOL Pool,
152  _In_ ULONG Rva
153  );
154 
156  _Inout_ PPH_FILE_POOL Pool,
157  _In_ ULONG Rva
158  );
159 
160 ULONG PhEncodeRvaFilePool(
161  _In_ PPH_FILE_POOL Pool,
162  _In_ PVOID Address
163  );
164 
166  _In_ PPH_FILE_POOL Pool,
167  _Out_ PULONGLONG Context
168  );
169 
171  _Inout_ PPH_FILE_POOL Pool,
172  _In_ PULONGLONG Context
173  );
174 
175 #endif