Generated from Manticore v1.1.6 • 388 packages. View on pkg.go.dev

mststs

import "github.com/TheManticoreProject/Manticore/windows/protocols/ms-tsts"

Index

Constants

TSVIP_MAX_ADAPTER_ADDRESS_LENGTH bounds the PhysicalAddress array of TSVIPAddress ([MS-TSTS] 2.2.2.5.2, allproc.h).

const TSVIP_MAX_ADAPTER_ADDRESS_LENGTH = 16

type BOUNDED\_ULONG

BOUNDED_ULONG is a scalar typedef ([MS-TSTS]).

type BOUNDED_ULONG ndr.DWORD

type ENUM\_HANDLE

ENUM_HANDLE is an RPC context handle: 20 bytes ([MS-RPCE] 2.3.2.2, [MS-TSTS]).

type ENUM_HANDLE [20]byte

type EXECENVDATA

EXECENVDATA ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type EXECENVDATA struct {
    Level ndr.DWORD
    Data  ExecEnvData
}

type EXECENVDATAEX

EXECENVDATAEX ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type EXECENVDATAEX struct {
    Level ndr.DWORD
    Data  ExecEnvDataEx
}

type EXECENVDATAEX\_LEVEL1

EXECENVDATAEX_LEVEL1 ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type EXECENVDATAEX_LEVEL1 struct {
    ExecEnvId      int32
    State          int32
    AbsSessionId   int32
    PszSessionName *ndr.WSTR `ndr:"unique"`
    PszHostName    *ndr.WSTR `ndr:"unique"`
    PszUserName    *ndr.WSTR `ndr:"unique"`
    PszDomainName  *ndr.WSTR `ndr:"unique"`
    PszFarmName    *ndr.WSTR `ndr:"unique"`
}

type EXECENVDATA\_LEVEL1

EXECENVDATA_LEVEL1 ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type EXECENVDATA_LEVEL1 struct {
    ExecEnvId   int32
    State       int32
    SessionName [33]uint16
}

type EXECENVDATA\_LEVEL2

EXECENVDATA_LEVEL2 ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type EXECENVDATA_LEVEL2 struct {
    ExecEnvId    int32
    State        int32
    SessionName  [33]uint16
    AbsSessionId int32
    HostName     [33]uint16
    UserName     [33]uint16
    DomainName   [33]uint16
    FarmName     [33]uint16
}

type ExecEnvData

ExecEnvData is a discriminated union ([MS-TSTS]); the discriminant precedes the selected arm ([C706] 14.3.8). Generated by tools/idlgen — verify case values.

type ExecEnvData struct {
    Tag                ndr.DWORD          `ndr:"switch"`
    ExecEnvEnum_Level1 EXECENVDATA_LEVEL1 `ndr:"case=1"`
    ExecEnvEnum_Level2 EXECENVDATA_LEVEL2 `ndr:"case=2"`
}

type ExecEnvDataEx

ExecEnvDataEx is a discriminated union ([MS-TSTS]); the discriminant precedes the selected arm ([C706] 14.3.8). Generated by tools/idlgen — verify case values.

type ExecEnvDataEx struct {
    Tag                ndr.DWORD            `ndr:"switch"`
    ExecEnvEnum_Level1 EXECENVDATAEX_LEVEL1 `ndr:"case=1"`
}

type HLISTENER

HLISTENER is an RPC context handle: 20 bytes ([MS-RPCE] 2.3.2.2, [MS-TSTS]).

type HLISTENER [20]byte

type LISTENERENUM

LISTENERENUM ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type LISTENERENUM struct {
    Level ndr.DWORD
    Data  ListenerInfo
}

type LISTENERENUM\_LEVEL1

LISTENERENUM_LEVEL1 ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type LISTENERENUM_LEVEL1 struct {
    Id         int32
    BListening ndr.BOOL
    Name       [33]uint16
}

type LISTENER\_NAME

LISTENER_NAME is a scalar typedef ([MS-TSTS]).

type LISTENER_NAME uint16

type LSMSESSIONINFORMATION

LSMSESSIONINFORMATION ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type LSMSESSIONINFORMATION struct {
    PszUserName     *ndr.WSTR `ndr:"unique"`
    PszDomain       *ndr.WSTR `ndr:"unique"`
    PszTerminalName *ndr.WSTR `ndr:"unique"`
    SessionState    int32
    DesktopLocked   ndr.BOOL
    ConnectTime     int64
    DisconnectTime  int64
    LogonTime       int64
}

type LSMSESSIONINFORMATION\_EX

LSMSESSIONINFORMATION_EX ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type LSMSESSIONINFORMATION_EX struct {
    Level ndr.DWORD
    Data  LSM_SESSIONINFO_EX
}

type LSM\_SESSIONINFO\_EX

LSM_SESSIONINFO_EX is a discriminated union ([MS-TSTS]); the discriminant precedes the selected arm ([C706] 14.3.8). Generated by tools/idlgen — verify case values.

type LSM_SESSIONINFO_EX struct {
    Tag                    ndr.DWORD                 `ndr:"switch"`
    LSM_SessionInfo_Level1 LSM_SESSIONINFO_EX_LEVEL1 `ndr:"case=1"`
}

type LSM\_SESSIONINFO\_EX\_LEVEL1

LSM_SESSIONINFO_EX_LEVEL1 ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type LSM_SESSIONINFO_EX_LEVEL1 struct {
    SessionState     int32
    SessionFlags     int32
    SessionName      [33]uint16
    DomainName       [18]uint16
    UserName         [21]uint16
    ConnectTime      int64
    DisconnectTime   int64
    LogonTime        int64
    LastInputTime    int64
    ProtocolDataSize ndr.DWORD
    ProtocolData     []uint8 `ndr:"unique,size_is=ProtocolDataSize"`
}

type ListenerInfo

ListenerInfo is a discriminated union ([MS-TSTS]); the discriminant precedes the selected arm ([C706] 14.3.8). Generated by tools/idlgen — verify case values.

type ListenerInfo struct {
    Tag                 ndr.DWORD           `ndr:"switch"`
    ListenerEnum_Level1 LISTENERENUM_LEVEL1 `ndr:"case=1"`
}

type NOTIFY\_HANDLE

NOTIFY_HANDLE is an RPC context handle: 20 bytes ([MS-RPCE] 2.3.2.2, [MS-TSTS]).

type NOTIFY_HANDLE [20]byte

type NT6\_TS\_UNICODE\_STRING

NT6_TS_UNICODE_STRING is the counted wide string embedded in TS_SYS_PROCESS_INFORMATION_NT6 ([MS-TSTS] 2.2.2.7.4, allproc.h _NT6_TS_UNICODE_STRING).

Its IDL bounds are size_is(MaximumLength/2)/length_is(Length/2): Length and MaximumLength are byte counts and the buffer holds half as many wide characters. The codec expresses the /2 divisor directly (see ndr.splitDivisor), so Buffer is a unique pointer to a conformant-varying array of MaximumLength/2 wide chars, Length/2 of them valid.

type NT6_TS_UNICODE_STRING struct {
    Length        uint16
    MaximumLength uint16
    Buffer        []uint16 `ndr:"unique,size_is=MaximumLength/2,length_is=Length/2"`
}

type PROTOCOLSTATUS\_INFO\_TYPE

PROTOCOLSTATUS_INFO_TYPE is an NDR enum, transmitted as a 16-bit value ([C706] 14.3.6, [MS-TSTS]).

type PROTOCOLSTATUS_INFO_TYPE uint16
const (
    PROTOCOLSTATUS_INFO_BASIC    PROTOCOLSTATUS_INFO_TYPE = 0
    PROTOCOLSTATUS_INFO_EXTENDED PROTOCOLSTATUS_INFO_TYPE = 1
)

type QUERY\_SESSION\_DATA\_TYPE

QUERY_SESSION_DATA_TYPE is an NDR enum, transmitted as a 16-bit value ([C706] 14.3.6, [MS-TSTS]).

type QUERY_SESSION_DATA_TYPE uint16
const (
    QUERY_SESSION_DATA_MODULE             QUERY_SESSION_DATA_TYPE = 0
    QUERY_SESSION_DATA_WDCONFIG           QUERY_SESSION_DATA_TYPE = 1
    QUERY_SESSION_DATA_VIRTUALDATA        QUERY_SESSION_DATA_TYPE = 2
    QUERY_SESSION_DATA_LICENSE            QUERY_SESSION_DATA_TYPE = 3
    QUERY_SESSION_DATA_DEVICEID           QUERY_SESSION_DATA_TYPE = 4
    QUERY_SESSION_DATA_LICENSE_VALIDATION QUERY_SESSION_DATA_TYPE = 5
)

type RCM\_REMOTEADDRESS

RCM_REMOTEADDRESS carries the remote network address of a session returned by RpcGetRemoteAddress ([MS-TSTS] 2.2.2.1, rcmpublic.idl _RCM_REMOTEADDRESS). It is an NDR encapsulated union discriminated by the 16-bit sin_family; the discriminant is transmitted inline ahead of the selected arm.

type RCM_REMOTEADDRESS struct {
    SinFamily uint16                 `ndr:"switch"`
    Ipv4      RCM_REMOTEADDRESS_IPV4 `ndr:"case=2"`
    Ipv6      RCM_REMOTEADDRESS_IPV6 `ndr:"case=23"`
}

type RCM\_REMOTEADDRESS\_IPV4

RCM_REMOTEADDRESS_IPV4 is the AF_INET (sin_family == 2) arm of RCM_REMOTEADDRESS.

type RCM_REMOTEADDRESS_IPV4 struct {
    SinPort uint16
    InAddr  ndr.DWORD
    SinZero [8]uint8
}

type RCM\_REMOTEADDRESS\_IPV6

RCM_REMOTEADDRESS_IPV6 is the AF_INET6 (sin_family == 23) arm of RCM_REMOTEADDRESS.

type RCM_REMOTEADDRESS_IPV6 struct {
    Sin6Port     uint16
    Sin6Flowinfo ndr.DWORD
    Sin6Addr     [8]uint16
    Sin6ScopeId  ndr.DWORD
}

type SERVER\_HANDLE

SERVER_HANDLE is an RPC context handle: 20 bytes ([MS-RPCE] 2.3.2.2, [MS-TSTS]).

type SERVER_HANDLE [20]byte

type SESSIONENUM

SESSIONENUM ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type SESSIONENUM struct {
    Level ndr.DWORD
    Data  SessionInfo
}

type SESSIONENUM\_EX

SESSIONENUM_EX ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type SESSIONENUM_EX struct {
    Level ndr.DWORD
    Data  SessionInfo_Ex
}

type SESSIONENUM\_LEVEL1

SESSIONENUM_LEVEL1 ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type SESSIONENUM_LEVEL1 struct {
    SessionId int32
    State     int32
    Name      [33]uint16
}

type SESSIONENUM\_LEVEL2

SESSIONENUM_LEVEL2 ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type SESSIONENUM_LEVEL2 struct {
    SessionId    int32
    State        int32
    Name         [33]uint16
    Source       ndr.DWORD
    BFullDesktop ndr.BOOL
    SessionType  guid.GUID
}

type SESSIONENUM\_LEVEL3

SESSIONENUM_LEVEL3 ([MS-TSTS]). Generated by tools/idlgen; verify pointer/array tags.

type SESSIONENUM_LEVEL3 struct {
    SessionId     int32
    State         int32
    Name          [33]uint16
    Source        ndr.DWORD
    BFullDesktop  ndr.BOOL
    SessionType   guid.GUID
    ProtoDataSize ndr.DWORD
    PProtocolData []uint8 `ndr:"unique,size_is=ProtoDataSize"`
}

type SESSION\_CHANGE

SESSION_CHANGE describes a single session-state change delivered by RpcWaitAsyncNotification ([MS-TSTS] 2.2.2.4, tsdef.h _SESSION_CHANGE). Both fields are 4-octet scalars, so the structure has a fixed 8-byte NDR layout.

type SESSION_CHANGE struct {
    SessionId      int32
    NotificationId TNotificationId
}

type SESSION\_FILTER

SESSION_FILTER selects which sessions RpcGetSessionIds enumerates ([MS-TSTS] 2.2.1.2, tsdef.h _SESSION_FILTER). NDR transmits an enum as a 16-bit value ([C706] 14.3.6), so it is defined as a uint16.

type SESSION_FILTER uint16
const (
    // SF_SERVICES_SESSION_POPUP requests the sessions that can display a services message box.
    SF_SERVICES_SESSION_POPUP SESSION_FILTER = 0
)

type SESSION\_HANDLE

SESSION_HANDLE is an RPC context handle: 20 bytes ([MS-RPCE] 2.3.2.2, [MS-TSTS]).

type SESSION_HANDLE [20]byte

type SHADOW\_CONTROL\_REQUEST

SHADOW_CONTROL_REQUEST selects the level of control a shadow session requests ([MS-TSTS] 2.2.1.4, SessEnvRpc.idl). NDR transmits an enum as a 16-bit value.

type SHADOW_CONTROL_REQUEST uint16
const (
    SHADOW_CONTROL_REQUEST_VIEW        SHADOW_CONTROL_REQUEST = 0
    SHADOW_CONTROL_REQUEST_TAKECONTROL SHADOW_CONTROL_REQUEST = 1
    SHADOW_CONTROL_REQUEST_Count       SHADOW_CONTROL_REQUEST = 2
)

type SHADOW\_PERMISSION\_REQUEST

SHADOW_PERMISSION_REQUEST selects whether the shadow target is prompted for permission ([MS-TSTS] 2.2.1.5, SessEnvRpc.idl). NDR transmits an enum as a 16-bit value.

type SHADOW_PERMISSION_REQUEST uint16
const (
    SHADOW_PERMISSION_REQUEST_SILENT            SHADOW_PERMISSION_REQUEST = 0
    SHADOW_PERMISSION_REQUEST_REQUESTPERMISSION SHADOW_PERMISSION_REQUEST = 1
    SHADOW_PERMISSION_REQUEST_Count             SHADOW_PERMISSION_REQUEST = 2
)

type SHADOW\_REQUEST\_RESPONSE

SHADOW_REQUEST_RESPONSE reports the outcome of a shadow request ([MS-TSTS] 2.2.1.6, SessEnvRpc.idl). NDR transmits an enum as a 16-bit value.

type SHADOW_REQUEST_RESPONSE uint16
const (
    SHADOW_REQUEST_RESPONSE_ALLOW                                SHADOW_REQUEST_RESPONSE = 0
    SHADOW_REQUEST_RESPONSE_DECLINE                              SHADOW_REQUEST_RESPONSE = 1
    SHADOW_REQUEST_RESPONSE_POLICY_PERMISSION_REQUIRED           SHADOW_REQUEST_RESPONSE = 2
    SHADOW_REQUEST_RESPONSE_POLICY_DISABLED                      SHADOW_REQUEST_RESPONSE = 3
    SHADOW_REQUEST_RESPONSE_POLICY_VIEW_ONLY                     SHADOW_REQUEST_RESPONSE = 4
    SHADOW_REQUEST_RESPONSE_POLICY_VIEW_ONLY_PERMISSION_REQUIRED SHADOW_REQUEST_RESPONSE = 5
    SHADOW_REQUEST_RESPONSE_SESSION_ALREADY_CONTROLLED           SHADOW_REQUEST_RESPONSE = 6
)

type SessionInfo

SessionInfo is a discriminated union ([MS-TSTS]); the discriminant precedes the selected arm ([C706] 14.3.8). Generated by tools/idlgen — verify case values.

type SessionInfo struct {
    Tag                ndr.DWORD          `ndr:"switch"`
    SessionEnum_Level1 SESSIONENUM_LEVEL1 `ndr:"case=1"`
    SessionEnum_Level2 SESSIONENUM_LEVEL2 `ndr:"case=2"`
}

type SessionInfo\_Ex

SessionInfo_Ex is a discriminated union ([MS-TSTS]); the discriminant precedes the selected arm ([C706] 14.3.8). Generated by tools/idlgen — verify case values.

type SessionInfo_Ex struct {
    Tag                ndr.DWORD          `ndr:"switch"`
    SessionEnum_Level1 SESSIONENUM_LEVEL1 `ndr:"case=1"`
    SessionEnum_Level2 SESSIONENUM_LEVEL2 `ndr:"case=2"`
    SessionEnum_Level3 SESSIONENUM_LEVEL3 `ndr:"case=3"`
}

type TNotificationId

TNotificationId is a 32-bit bitmask of session-change notification types (typedef ULONG TNotificationId, [MS-TSTS] Appendix A.6 tsdef.h / 2.2.1.3). It is transmitted as a 4-octet value, so it is defined as ndr.DWORD, not an NDR enum.

type TNotificationId = ndr.DWORD

Session-change notification masks ([MS-TSTS] 2.2.1.3, tsdef.h WTS_NOTIFY_*).

const (
    WTS_NOTIFY_NONE               TNotificationId = 0x00000000
    WTS_NOTIFY_CREATE             TNotificationId = 0x00000001
    WTS_NOTIFY_CONNECT            TNotificationId = 0x00000002
    WTS_NOTIFY_DISCONNECT         TNotificationId = 0x00000004
    WTS_NOTIFY_LOGON              TNotificationId = 0x00000008
    WTS_NOTIFY_LOGOFF             TNotificationId = 0x00000010
    WTS_NOTIFY_SHADOW_START       TNotificationId = 0x00000020
    WTS_NOTIFY_SHADOW_STOP        TNotificationId = 0x00000040
    WTS_NOTIFY_TERMINATE          TNotificationId = 0x00000080
    WTS_NOTIFY_CONSOLE_CONNECT    TNotificationId = 0x00000100
    WTS_NOTIFY_CONSOLE_DISCONNECT TNotificationId = 0x00000200
    WTS_NOTIFY_LOCK               TNotificationId = 0x00000400
    WTS_NOTIFY_UNLOCK             TNotificationId = 0x00000800
    WTS_NOTIFY_ALL                TNotificationId = 0xffffffff
)

type TSVIPAddress

TSVIPAddress describes the IP address leased to a session ([MS-TSTS] 2.2.2.5.2, allproc.h _TSVIPAddress).

In the IDL PhysicalAddress is `[length_is(PhysicalAddressLength)] BYTE PhysicalAddress[16]` — a fixed-bound NDR *varying* array (offset + actual_count + actual_count octets, with no maximum_count). The declarative codec has no non-conformant-varying array path (its varying encoder always prefixes a maximum_count), and it ignores array tags on a fixed Go array, so the varying framing is not emitted here: PhysicalAddress is carried as the 16 fixed octets and PhysicalAddressLength gives the valid prefix. Exact wire fidelity for RpcGetSessionIP needs a codec enhancement (or an ndr.Marshaler on this type) and is UNVERIFIED.

type TSVIPAddress struct {
    DwVersion             ndr.DWORD
    IPAddress             TSVIP_SOCKADDR
    PrefixOrSubnetMask    ndr.DWORD
    PhysicalAddressLength uint32
    PhysicalAddress       [TSVIP_MAX_ADAPTER_ADDRESS_LENGTH]uint8
    LeaseExpires          ndr.DWORD
    T1                    ndr.DWORD
    T2                    ndr.DWORD
}

type TSVIPSession

TSVIPSession is the virtual-IP assignment for a session returned by RpcGetSessionIP ([MS-TSTS] 2.2.2.5.3, allproc.h _TSVIPSession).

type TSVIPSession struct {
    DwVersion ndr.DWORD
    SessionId ndr.DWORD
    SessionIP TSVIPAddress
}

type TSVIP\_SOCKADDR

TSVIP_SOCKADDR is the encapsulated NDR union carrying either an IPv4 or IPv6 socket address, discriminated by the 16-bit sin_family ([MS-TSTS] 2.2.2.5.1, allproc.h _TSVIP_SOCKADDR). The discriminant is transmitted inline ahead of the selected arm.

type TSVIP_SOCKADDR struct {
    SinFamily uint16              `ndr:"switch"`
    Ipv4      TSVIP_SOCKADDR_IPV4 `ndr:"case=2"`
    Ipv6      TSVIP_SOCKADDR_IPV6 `ndr:"case=23"`
}

type TSVIP\_SOCKADDR\_IPV4

TSVIP_SOCKADDR_IPV4 is the AF_INET (sin_family == 2) arm of TSVIP_SOCKADDR.

type TSVIP_SOCKADDR_IPV4 struct {
    SinPort uint16
    InAddr  ndr.DWORD
    SinZero [8]uint8
}

type TSVIP\_SOCKADDR\_IPV6

TSVIP_SOCKADDR_IPV6 is the AF_INET6 (sin_family == 23) arm of TSVIP_SOCKADDR.

type TSVIP_SOCKADDR_IPV6 struct {
    Sin6Port     uint16
    Sin6Flowinfo ndr.DWORD
    Sin6Addr     [8]uint16
    Sin6ScopeId  ndr.DWORD
}

type TS\_ALL\_PROCESSES\_INFO

TS_ALL_PROCESSES_INFO pairs one process’ information with the raw bytes of its owner’s SID ([MS-TSTS] 2.2.2.7.3, allproc.h _TS_ALL_PROCESSES_INFO).

type TS_ALL_PROCESSES_INFO struct {
    PTsProcessInfo *TS_SYS_PROCESS_INFORMATION `ndr:"unique"`
    SizeOfSid      ndr.DWORD
    PSid           []byte `ndr:"unique,size_is=SizeOfSid"`
}

type TS\_ALL\_PROCESSES\_INFO\_NT6

TS_ALL_PROCESSES_INFO_NT6 is the Windows Vista+ (“NT6”) form of TS_ALL_PROCESSES_INFO ([MS-TSTS] 2.2.2.7.6, allproc.h _TS_ALL_PROCESSES_INFO_NT6).

type TS_ALL_PROCESSES_INFO_NT6 struct {
    PTsProcessInfo *TS_SYS_PROCESS_INFORMATION_NT6 `ndr:"unique"`
    SizeOfSid      ndr.DWORD
    PSid           []byte `ndr:"unique,size_is=SizeOfSid"`
}

type TS\_COUNTER

TS_COUNTER carries the value of a single Terminal Services performance counter ([MS-TSTS] 2.2.2.6.2, allproc.h _TS_COUNTER).

type TS_COUNTER struct {
    CounterHead TS_COUNTER_HEADER
    DwValue     ndr.DWORD
    StartTime   msdtyp.LARGE_INTEGER
}

type TS\_COUNTER\_HEADER

TS_COUNTER_HEADER identifies a Terminal Services performance counter and whether the operation on it succeeded ([MS-TSTS] 2.2.2.6.1, allproc.h _TS_COUNTER_HEADER). The IDL declares bResult as `boolean`, the NDR 1-octet boolean ([C706] 14.2.4) — not the 4-octet Windows BOOL — so it is modeled as ndr.BOOLEAN (Go bool).

type TS_COUNTER_HEADER struct {
    DwCounterID ndr.DWORD
    BResult     ndr.BOOLEAN
}

type TS\_SYS\_PROCESS\_INFORMATION

TS_SYS_PROCESS_INFORMATION describes a single process returned by RpcWinStationGetAllProcesses ([MS-TSTS] 2.2.2.7.2, allproc.h _TS_SYS_PROCESS_INFORMATION).

The SIZE_T fields are modeled as uint64: their on-the-wire width follows the server’s pointer size, and modern terminal servers are 64-bit. This field width is UNVERIFIED against a live 32-bit server.

type TS_SYS_PROCESS_INFORMATION struct {
    NextEntryOffset              ndr.DWORD
    NumberOfThreads              ndr.DWORD
    SpareLi1                     msdtyp.LARGE_INTEGER
    SpareLi2                     msdtyp.LARGE_INTEGER
    SpareLi3                     msdtyp.LARGE_INTEGER
    CreateTime                   msdtyp.LARGE_INTEGER
    UserTime                     msdtyp.LARGE_INTEGER
    KernelTime                   msdtyp.LARGE_INTEGER
    ImageName                    TS_UNICODE_STRING
    BasePriority                 int32
    UniqueProcessId              ndr.DWORD
    InheritedFromUniqueProcessId ndr.DWORD
    HandleCount                  ndr.DWORD
    SessionId                    ndr.DWORD
    SpareUl3                     ndr.DWORD
    PeakVirtualSize              uint64
    VirtualSize                  uint64
    PageFaultCount               ndr.DWORD
    PeakWorkingSetSize           ndr.DWORD
    WorkingSetSize               ndr.DWORD
    QuotaPeakPagedPoolUsage      uint64
    QuotaPagedPoolUsage          uint64
    QuotaPeakNonPagedPoolUsage   uint64
    QuotaNonPagedPoolUsage       uint64
    PagefileUsage                uint64
    PeakPagefileUsage            uint64
    PrivatePageCount             uint64
}

type TS\_SYS\_PROCESS\_INFORMATION\_NT6

TS_SYS_PROCESS_INFORMATION_NT6 is the Windows Vista+ (“NT6”) form of TS_SYS_PROCESS_INFORMATION returned by RpcWinStationGetAllProcesses_NT6 ([MS-TSTS] 2.2.2.7.5, allproc.h _TS_SYS_PROCESS_INFORMATION_NT6). It differs from the legacy form only in the ImageName string type. See TS_SYS_PROCESS_INFORMATION for the SIZE_T caveat.

type TS_SYS_PROCESS_INFORMATION_NT6 struct {
    NextEntryOffset              ndr.DWORD
    NumberOfThreads              ndr.DWORD
    SpareLi1                     msdtyp.LARGE_INTEGER
    SpareLi2                     msdtyp.LARGE_INTEGER
    SpareLi3                     msdtyp.LARGE_INTEGER
    CreateTime                   msdtyp.LARGE_INTEGER
    UserTime                     msdtyp.LARGE_INTEGER
    KernelTime                   msdtyp.LARGE_INTEGER
    ImageName                    NT6_TS_UNICODE_STRING
    BasePriority                 int32
    UniqueProcessId              ndr.DWORD
    InheritedFromUniqueProcessId ndr.DWORD
    HandleCount                  ndr.DWORD
    SessionId                    ndr.DWORD
    SpareUl3                     ndr.DWORD
    PeakVirtualSize              uint64
    VirtualSize                  uint64
    PageFaultCount               ndr.DWORD
    PeakWorkingSetSize           ndr.DWORD
    WorkingSetSize               ndr.DWORD
    QuotaPeakPagedPoolUsage      uint64
    QuotaPagedPoolUsage          uint64
    QuotaPeakNonPagedPoolUsage   uint64
    QuotaNonPagedPoolUsage       uint64
    PagefileUsage                uint64
    PeakPagefileUsage            uint64
    PrivatePageCount             uint64
}

type TS\_UNICODE\_STRING

TS_UNICODE_STRING is the counted wide string embedded in TS_SYS_PROCESS_INFORMATION ([MS-TSTS] 2.2.2.7.1, allproc.h _TS_UNICODE_STRING). Unlike RPC_UNICODE_STRING its size_is/length_is bounds count wide characters directly (the value of MaximumLength and Length), not bytes.

type TS_UNICODE_STRING struct {
    Length        uint16
    MaximumLength uint16
    Buffer        []uint16 `ndr:"unique,size_is=MaximumLength,length_is=Length"`
}