#ifndef _NTSXS_H

/**
 * Serialized assembly metadata. String lengths are byte counts; strings need not be null-terminated.
 * Use the explicit lengths, in particular for EncodedAssemblyIdentity. The corresponding offsets
 * are relative to the assembly information section header.
 * The two-part timestamps intentionally have 4-byte alignment. Replacing them with LARGE_INTEGER
 * would change the serialized layout: ManifestLastWriteTime is at offset 28 and PolicyLastWriteTime
 * is at offset 48. The fixed structure, including RunLevel and UiAccess, is 108 bytes.
 */
typedef struct _ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION
{
    ULONG Size;
    ULONG Flags; // ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION_*
    ULONG EncodedAssemblyIdentityLength;
    ULONG EncodedAssemblyIdentityOffset; // to WCHAR[], from section header
    ULONG ManifestPathType; // ACTIVATION_CONTEXT_PATH_TYPE_*
    ULONG ManifestPathLength;
    ULONG ManifestPathOffset; // to WCHAR[], from section header
    struct
    {
        ULONG LowPart;
        LONG HighPart;
    } ManifestLastWriteTime;
    ULONG PolicyPathType; // ACTIVATION_CONTEXT_PATH_TYPE_*
    ULONG PolicyPathLength;
    ULONG PolicyPathOffset; // to WCHAR[], from section header
    struct
    {
        ULONG LowPart;
        LONG HighPart;
    } PolicyLastWriteTime;
    ULONG MetadataSatelliteRosterIndex;
    ULONG Unused2;
    ULONG ManifestVersionMajor;
    ULONG ManifestVersionMinor;
    ULONG PolicyVersionMajor;
    ULONG PolicyVersionMinor;
    ULONG AssemblyDirectoryNameLength;
    ULONG AssemblyDirectoryNameOffset; // to WCHAR[], from section header
    ULONG NumOfFilesInAssembly;
    ULONG LanguageLength;
    ULONG LanguageOffset; // to WCHAR[], from section header
    ACTCTX_REQUESTED_RUN_LEVEL RunLevel;
    ULONG UiAccess;
} ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION, *PACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION;

#endif
View code on GitHub