From 43e22940a058acde6c706aecc687f34813ae0588 Mon Sep 17 00:00:00 2001
From: Michael Agun <danielagun@microsoft.com>
Date: Tue, 28 Jul 2026 10:56:43 -0700
Subject: [PATCH] Move shared NT process-telemetry declarations into a common
 header

PROCESS_TELEMETRY_ID_INFORMATION and the NtQueryInformationProcess prototype
were declared privately in src/ps.cpp and independently duplicated in the
eBPF for Windows api_test. Move them into a new leaf header,
inc/usersim/nt_process_info.h, so usersim and its consumers share one
definition instead of maintaining divergent copies.

The header declares only native NT types (no usersim platform dependencies)
so consumers can include it without pulling in usersim's internal headers.
ps.cpp now includes it and drops its local PROCESS_TELEMETRY_ID_INFORMATION,
PROCESSINFOCLASS, and NtQueryInformationProcess_t declarations; the query
logic is unchanged.
---
 inc/usersim/nt_process_info.h | 49 +++++++++++++++++++++++++++++++++++
 src/ps.cpp                    | 40 +---------------------------
 src/usersim.vcxproj           |  1 +
 3 files changed, 51 insertions(+), 39 deletions(-)
 create mode 100644 inc/usersim/nt_process_info.h

diff --git a/inc/usersim/nt_process_info.h b/inc/usersim/nt_process_info.h
new file mode 100644
index 0000000..2c049a2
--- /dev/null
+++ b/inc/usersim/nt_process_info.h
@@ -0,0 +1,49 @@
+// Copyright (c) Microsoft Corporation
+// SPDX-License-Identifier: MIT
+
+#pragma once
+
+// Native NT process-telemetry query definitions used to implement (usersim's PsGetProcessStartKey)
+// and to verify (eBPF for Windows api_test) the process start key. Per the official documentation
+// these types "have no associated import library or header file", so they must be declared locally;
+// this shared header keeps usersim and its consumers from maintaining divergent private copies.
+//
+// This is a leaf header: it only declares native NT types and depends solely on the basic Windows
+// integer/handle/status types (ULONG, ULONG64, HANDLE, PVOID, PULONG, NTSTATUS, NTAPI). Include it
+// after <windows.h> (and, where NTSTATUS is not otherwise available, a header that provides it).
+//
+// https://learn.microsoft.com/en-us/windows/win32/devnotes/process_telemetry_id_information_type
+
+typedef struct _PROCESS_TELEMETRY_ID_INFORMATION
+{
+    ULONG HeaderSize;
+    ULONG ProcessId;
+    ULONG64 ProcessStartKey;
+    ULONG64 CreateTime;
+    ULONG64 CreateInterruptTime;
+    ULONG64 CreateUnbiasedInterruptTime;
+    ULONG64 ProcessSequenceNumber;
+    ULONG64 SessionCreateTime;
+    ULONG SessionId;
+    ULONG BootId;
+    ULONG ImageChecksum;
+    ULONG ImageTimeDateStamp;
+    ULONG UserSidOffset;
+    ULONG ImagePathOffset;
+    ULONG PackageNameOffset;
+    ULONG RelativeAppNameOffset;
+    ULONG CommandLineOffset;
+} PROCESS_TELEMETRY_ID_INFORMATION, *PPROCESS_TELEMETRY_ID_INFORMATION;
+
+// ProcessInformationClass value used to query PROCESS_TELEMETRY_ID_INFORMATION.
+enum
+{
+    ProcessTelemetryIdInformation = 64
+};
+
+typedef NTSTATUS(NTAPI* NtQueryInformationProcess_t)(
+    _In_ HANDLE ProcessHandle,
+    _In_ ULONG ProcessInformationClass,
+    _Out_writes_bytes_(ProcessInformationLength) PVOID ProcessInformation,
+    _In_ ULONG ProcessInformationLength,
+    _Out_opt_ PULONG ReturnLength);
diff --git a/src/ps.cpp b/src/ps.cpp
index 89c9148..14df835 100644
--- a/src/ps.cpp
+++ b/src/ps.cpp
@@ -3,6 +3,7 @@
 
 #include "kernel_um.h"
 #include "platform.h"
+#include "usersim/nt_process_info.h"
 #include "usersim/ps.h"
 
 #include <assert.h>
@@ -19,45 +20,6 @@ _IRQL_requires_max_(DISPATCH_LEVEL) NTKERNELAPI HANDLE PsGetCurrentThreadId()
     return (HANDLE)(uintptr_t)GetCurrentThreadId();
 }
 
-typedef struct _PROCESS_TELEMETRY_ID_INFORMATION
-{
-    ULONG HeaderSize;
-    ULONG ProcessId;
-    ULONG64 ProcessStartKey;
-    ULONG64 CreateTime;
-    ULONG64 CreateInterruptTime;
-    ULONG64 CreateUnbiasedInterruptTime;
-    ULONG64 ProcessSequenceNumber;
-    ULONG64 SessionCreateTime;
-    ULONG SessionId;
-    ULONG BootId;
-    ULONG ImageChecksum;
-    ULONG ImageTimeDateStamp;
-    ULONG UserSidOffset;
-    ULONG ImagePathOffset;
-    ULONG PackageNameOffset;
-    ULONG RelativeAppNameOffset;
-    ULONG CommandLineOffset;
-} PROCESS_TELEMETRY_ID_INFORMATION, *PPROCESS_TELEMETRY_ID_INFORMATION;
-
-typedef enum _PROCESSINFOCLASS
-{
-    ProcessBasicInformation = 0,
-    ProcessDebugPort = 7,
-    ProcessWow64Information = 26,
-    ProcessImageFileName = 27,
-    ProcessBreakOnTermination = 29,
-    ProcessTelemetryIdInformation = 64,
-    ProcessSubsystemInformation = 75
-} PROCESSINFOCLASS;
-
-typedef NTSTATUS (NTAPI *NtQueryInformationProcess_t)(
-    _In_ HANDLE ProcessHandle,
-    _In_ PROCESSINFOCLASS ProcessInformationClass,
-    _Out_writes_bytes_(ProcessInformationLength) PVOID ProcessInformation,
-    _In_ ULONG ProcessInformationLength,
-    _Out_opt_ PULONG ReturnLength);
-
 static PGETPROCESSSTARTKEY _usersim_get_process_start_key_callback = nullptr;
 USERSIM_API
 void
diff --git a/src/usersim.vcxproj b/src/usersim.vcxproj
index b828daf..bce23c0 100644
--- a/src/usersim.vcxproj
+++ b/src/usersim.vcxproj
@@ -131,6 +131,7 @@
     <ClInclude Include="ndis.h" />
     <ClInclude Include="net_platform.h" />
     <ClInclude Include="nmr_impl.h" />
+    <ClInclude Include="..\inc\usersim\nt_process_info.h" />
     <ClInclude Include="..\inc\usersim\ps.h" />
     <ClInclude Include="..\inc\usersim\rtl.h" />
     <ClInclude Include="..\inc\usersim\se.h" />