Geoff Chappell - Software Analyst
The POWERSTATETASK (formally _POWERSTATETASK) enumerates the possible notifications that can percolate from the kernel to user mode to tell of changes in power state. The enumeration passes to WIN32K.SYS (or, if only in principle, whoever else registered instead) as a member of the WIN32_POWERSTATE_PARAMETERS structure.
Even among undocumented enumerations, the POWERSTATETASK is unusually obscure. Except for what looks to be known from leaked source code and then recirculated as research, Microsoft’s name for this enumeration, let alone for any of its members, was unknown for decades—and then Microsoft disclosed the whole of it twice.
First is a C-language definition in the NTOSP.H which Microsoft published with the Windows Driver Kit (WDK) for the original and 1511 releases of Windows 10. Publication of this header was apparently an oversight. Though it is chock full of previously undisclosed definitions for kernel-mode programming, it is supplied in a subdirectory (named “minwin”) of a directory named “um” as if to suggest user-mode programming. Mistake or not, this disclosure has not been repeated in later kits.
The second disclosure is in type information from symbol files for a driver named NetAdapterCx.sys. Starting with the 1803 release of Windows 10, the symbol files for this driver, as made available by Microsoft at its public symbol server, are private symbol files. They have type information for the POWERSTATETASK from the driver’s inclusion of NTOSP.H.
Microsoft’s names for the enumeration and for some of its defined values are known with certainty only for some versions of Windows 10, as described above.
|0||PowerState_BlockSessionSwitch||5.1 and higher|
|1||PowerState_Init||5.1 and higher|
|2 (5.1 to 6.0)||query||5.1 to 5.2|
|query apps||6.0 only|
|3 (6.0)||query services||6.0 only|
|3 (5.1 to 5.2);
|query failed||5.1 to 5.2|
|query failed apps||6.0 only|
|5 (6.0)||query failed services||6.0 only|
|4 (5.1 to 5.2);
|suspend||5.1 to 5.2|
|PowerState_SuspendApps||6.0 and higher|
|PowerState_SuspendServices||6.0 and higher|
|5 (5.1 to 5.2);
|show UI||5.1 to 6.0|
|6 (5.1 to 5.2);
|PowerState_NotifyWL||5.1 and higher|
|7 (5.1 to 5.2);
|resume||5.1 to 5.2|
|PowerState_ResumeApps||6.0 and higher|
|PowerState_ResumeServices||6.1 and higher|
|8 (5.1 to 5.2);
|PowerState_UnblockSessionSwitch||5.1 and higher|
|PowerState_End||6.0 and higher|
|14 (6.0)||hide UI||6.0 only|
|9||PowerState_Flush||6.1 and higher|
|10||PowerState_StartPartitionReplace||6.1 and higher|
|11||PowerState_EndPartitionReplace||6.1 and higher|
|12||PowerState_MonitorOff||10.0 and higher|
|13||PowerState_PrepareSleep||1903 and higher|