SYSTEM_CODEINTEGRITYPOLICY_INFORMATION

The SYSTEM_CODEINTEGRITYPOLICY_INFORMATION structure is what a successful call to ZwQuerySystemInformation or NtQuerySystemInformation produces in its output buffer when given the information class SystemCodeIntegrityPolicyInformation (0xA4).

Documentation Status

The SYSTEM_CODEINTEGRITYPOLICY_INFORMATION structure is not documented.

Layout

The SYSTEM_CODEINTEGRITYPOLICY_INFORMATION is 0x20 bytes in both 32-bit and 64-bit Windows.

Offset	Definition
0x00	ULONG Options;
0x04	ULONG HVCIOptions;
0x08	ULONGLONG Version;
0x10	GUID PolicyGuid;

The implementation produces non-zero information only for the SiPolicy type. The Options are bit flags for which no symbolic information is known:

0x01 if the SiPolicy is active;
0x02 if the SiPolicy enables audit mode;
0x04 if the SiPolicy requires WHQL signatures;
0x08 if the SiPolicy requires EV signatures;
0x10 if the SiPolicy enables user-mode code integrity (UMCI).

The PolicyGuid is null.