#ifndef _NTEXAPI_H

// private
/**
 * Requests a signed runtime-attestation report through NtQuerySystemInformationEx
 * with SystemRuntimeAttestationReport (254). InputBufferLength must be exactly 48
 * bytes on x64. InputVersion and PackageVersion must both be 1,
 * and the implementation accepts only ReportTypesBitmap == 1. Nonce supplies 32 caller bytes.
 * A NULL output buffer with zero output length requests the required report size;
 * a non-NULL output buffer must have a nonzero length. The output is a report-package
 * byte buffer, not another SYSTEM_RUNTIME_REPORT_INPUT.
 */
typedef struct _SYSTEM_RUNTIME_REPORT_INPUT
{
    USHORT InputVersion;
    USHORT PackageVersion;
    ULONG Reserved;
    ULONG_PTR ReportTypesBitmap;
    UCHAR Nonce[32];
} SYSTEM_RUNTIME_REPORT_INPUT, *PSYSTEM_RUNTIME_REPORT_INPUT;

#endif
View code on GitHub