diff --git a/src/common/impl/processing_windows.c b/src/common/impl/processing_windows.c index 27da6f3bb..0faf27b41 100644 --- a/src/common/impl/processing_windows.c +++ b/src/common/impl/processing_windows.c @@ -7,7 +7,6 @@ #include #include #include -#include enum { FF_PIPE_BUFSIZ = 8192 }; diff --git a/src/common/windows/nt.h b/src/common/windows/nt.h index 27d516ec9..22859f728 100644 --- a/src/common/windows/nt.h +++ b/src/common/windows/nt.h @@ -1,5 +1,6 @@ #pragma once +#include #include #include #include @@ -437,6 +438,12 @@ typedef struct _KSYSTEM_TIME LONG High2Time; } KSYSTEM_TIME, *PKSYSTEM_TIME; +/** + * PROCESSOR_FEATURE_MAX defines the maximum number of processor feature flags + * that may be reported by the system. + */ +#define PROCESSOR_FEATURE_MAX 64 + /** * The KUSER_SHARED_DATA structure contains information shared with user-mode. * @@ -489,6 +496,142 @@ typedef struct _KUSER_SHARED_DATA WCHAR NtSystemRoot[260]; + // + // Maximum stack trace depth if tracing enabled. + // + + ULONG MaxStackTraceDepth; + + // + // Crypto exponent value. + // + + ULONG CryptoExponent; + + // + // Time zone ID. + // + + ULONG TimeZoneId; + + // + // Minimum size of a large page on the system, in bytes. + // + // N.B. Returned by GetLargePageMinimum() function. + // + + ULONG LargePageMinimum; + + // + // This value controls the Application Impact Telemetry (AIT) Sampling rate. + // + // This value determines how frequently the system records AIT events, + // which are used by the Application Experience and compatibility + // subsystems to evaluate application behavior, performance, and + // potential compatibility issues. + // + // Lower values increase sampling frequency, while higher values reduce it. + // The kernel updates this field as part of its internal telemetry and + // heuristics logic. + // + + ULONG AitSamplingValue; + + // + // This value controls Application Compatibility (AppCompat) switchback processing. + // + + union + { + ULONG AppCompatFlag; + struct + { + ULONG SwitchbackEnabled : 1; // Basic switchback processing + ULONG ExtendedHeuristics : 1; // Extended switchback heuristics + ULONG TelemetryFallback : 1; // Telemetry-driven fallback + ULONG Reserved : 29; + } AppCompatFlags; + }; + + // + // Current Kernel Root RNG state seed version + // + + ULONGLONG RNGSeedVersion; + + // + // This value controls assertion failure handling. + // + // Historically (prior to Windows 10), this value was also used by + // Code Integrity (CI), AppLocker, and related security components to + // determine the minimum validation requirements for executable images, + // drivers, and privileged operations. + // + // In modern Windows versions, this field is used primarily by the kernel's + // diagnostic and validation infrastructure to decide how assertion failures + // should be handled (e.g., logging, debugger break-in, or bugcheck). + + ULONG GlobalValidationRunlevel; + + // + // Monotonic stamp incremented by the kernel whenever the system's + // time zone bias value changes. + // + // N.B. This field must be accessed via the RtlGetSystemTimeAndBias API for + // an accurate result. + // This value is read before and after accessing the bias fields to determine + // whether the time zone data changed during the read. If the stamp differs, + // the caller must re-read the bias values to ensure consistency. + // + + volatile LONG TimeZoneBiasStamp; + + // + // The shared collective build number undecorated with C or F. + // GetVersionEx hides the real number + // + + ULONG NtBuildNumber; + + // + // Product type. + // + // N.B. This field must be accessed via the RtlGetNtProductType API for + // an accurate result. + // + + NT_PRODUCT_TYPE NtProductType; + BOOLEAN ProductTypeIsValid; + BOOLEAN Reserved0[1]; + + // + // Native hardware processor architecture of the running system. + // + // N.B. User-mode components read this field to determine the true system + // architecture, especially in WOW64 scenarios where the process architecture + // differs from the native one. + // + + USHORT NativeProcessorArchitecture; + + // + // The NT Version. + // + // N. B. Note that each process sees a version from its PEB, but if the + // process is running with an altered view of the system version, + // the following two fields are used to correctly identify the + // version + // + + ULONG NtMajorVersion; + ULONG NtMinorVersion; + + // + // Processor features. + // + + BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX]; + // ... more fields follow, but we don't need them } KUSER_SHARED_DATA, *PKUSER_SHARED_DATA; diff --git a/src/detection/battery/battery_windows.c b/src/detection/battery/battery_windows.c index ba0111d3a..319688511 100644 --- a/src/detection/battery/battery_windows.c +++ b/src/detection/battery/battery_windows.c @@ -11,7 +11,6 @@ #include #include #include -#include static const char* detectWithCmApi(FFBatteryOptions* options, FFlist* results) { diff --git a/src/detection/bootmgr/bootmgr_windows.c b/src/detection/bootmgr/bootmgr_windows.c index 9af455ff0..e8aced137 100644 --- a/src/detection/bootmgr/bootmgr_windows.c +++ b/src/detection/bootmgr/bootmgr_windows.c @@ -3,7 +3,6 @@ #include "common/io.h" #include "common/windows/nt.h" -#include #include const char* enablePrivilege(const wchar_t* privilege) diff --git a/src/detection/keyboard/keyboard_windows.c b/src/detection/keyboard/keyboard_windows.c index c02d1f5a1..1853d72fb 100644 --- a/src/detection/keyboard/keyboard_windows.c +++ b/src/detection/keyboard/keyboard_windows.c @@ -5,7 +5,6 @@ #include "common/mallocHelper.h" #include "common/windows/unicode.h" -#include #include #include #include diff --git a/src/detection/mouse/mouse_windows.c b/src/detection/mouse/mouse_windows.c index 73c6c7955..0bc9b35d2 100644 --- a/src/detection/mouse/mouse_windows.c +++ b/src/detection/mouse/mouse_windows.c @@ -5,7 +5,6 @@ #include "common/mallocHelper.h" #include "common/windows/unicode.h" -#include #include #include #include diff --git a/src/detection/swap/swap_windows.c b/src/detection/swap/swap_windows.c index 0909267ec..ced111f6c 100644 --- a/src/detection/swap/swap_windows.c +++ b/src/detection/swap/swap_windows.c @@ -1,5 +1,4 @@ #include "swap.h" -#include "common/mallocHelper.h" #include "common/windows/unicode.h" #include diff --git a/src/detection/wm/wm_windows.c b/src/detection/wm/wm_windows.c index 5c9c1e2b0..b1b6268c9 100644 --- a/src/detection/wm/wm_windows.c +++ b/src/detection/wm/wm_windows.c @@ -10,7 +10,6 @@ #include #include #include -#include #include #include