Geoff Chappell - Software Analyst
The POWERSTATETASK (formally _POWERSTATETASK) enumerates the possible notifications that can percolate from the kernel to user mode to tell of changes in power state. The enumeration passes to WIN32K.SYS (or, if only in principle, whoever else registered instead) as a member of the WIN32_POWERSTATE_PARAMETERS structure.
Even among undocumented enumerations, the POWERSTATETASK is unusually obscure. Except for what looks to be known from leaked source code and then recirculated as research, Microsoft’s name for this enumeration, let alone for any of its members, was unknown for decades—and then Microsoft disclosed the whole of it twice.
First is a C-language definition in the NTOSP.H which Microsoft published with the Windows Driver Kit (WDK) for the original and 1511 releases of Windows 10. Publication of this header was apparently an oversight. Though it is chock full of previously undisclosed definitions for kernel-mode programming, it is supplied in a subdirectory (named “minwin”) of a directory named “um” as if to suggest user-mode programming. Mistake or not, this disclosure has not been repeated in later kits.
The second disclosure is in type information from symbol files for a driver named NetAdapterCx.sys. Starting with the 1803 release of Windows 10, the symbol files for this driver, as made available by Microsoft at its public symbol server, are private symbol files. They have type information for the POWERSTATETASK from the driver’s inclusion of NTOSP.H.
Or so I wrote at first. Type information for the POWERSTATETASK turns out to have been available more obscurely, in a statically linked library named CLFSMGMT.LIB which Microsoft distributes with the Software Development Kit (SDK) as if for user-mode programming. This type information goes back to Windows Vista.
Microsoft’s names for the enumeration and for some of its defined values are known with certainty only for Windows Vista and higher, as described above.
|0||PowerState_BlockSessionSwitch||5.1 and higher|
|1||PowerState_Init||5.1 and higher|
|2 (5.1 to 6.0)||query||5.1 to 5.2|
|3 (6.0)||PowerState_QueryServices||6.0 only|
|3 (5.1 to 5.2);
|query failed||5.1 to 5.2|
|5 (6.0)||PowerState_QueryServicesFailed||6.0 only|
|4 (5.1 to 5.2);
|suspend||5.1 to 5.2|
|PowerState_SuspendApps||6.0 and higher|
|PowerState_SuspendServices||6.0 and higher|
|5 (5.1 to 5.2);
|PowerState_ShowUI||5.1 to 6.0|
|6 (5.1 to 5.2);
|PowerState_NotifyWL||5.1 and higher|
|7 (5.1 to 5.2);
|resume||5.1 to 5.2|
|PowerState_ResumeApps||6.0 and higher|
|PowerState_ResumeServices||6.1 and higher|
|8 (5.1 to 5.2);
|PowerState_UnblockSessionSwitch||5.1 and higher|
|PowerState_End||6.0 and higher|
|14 (6.0)||PowerState_HideUI||6.0 only|
|9||PowerState_Flush||6.1 and higher|
|10||PowerState_StartPartitionReplace||6.1 and higher|
|11||PowerState_EndPartitionReplace||6.1 and higher|
|12||PowerState_MonitorOff||10.0 and higher|
|13||PowerState_PrepareSleep||1903 and higher|