转自:https://www.cnblogs.com/gwsbhqt/p/5092390.html
为了能使用上Ntdll.lib库函数，从几份不完整的Ntdll.h中拼凑整理出了比较完整美观的Ntdll.h。
测试平台：Windows 10 Professional / Visual Studio 2015 Community Update 1
测试Lib：Visual Studio 2015 Community Update 1 (x86 / x64) Ntdll.lib
1 /*/////////////////////////////////////////////////////////////// 2 Name: Ntdll.h 3 BaseLib: <Ntdll.lib> 4 BaseHead: <stdarg.h> <winbase.h> <windef.h> 5 Author: gwsbhqt@163.com 6 LastCode: 20160102 7 Description: Reference the undeclared Native API in Ntdll.lib 8 ///////////////////////////////////////////////////////////////*/ 9 10 #pragma once 11 12 #ifndef __NTDLL_H__ 13 #define __NTDLL_H__ 14 15 #pragma region HEAD 16 17 #include <stdarg.h> 18 #include <winbase.h> 19 #include <windef.h> 20 21 #ifdef __cplusplus 22 extern "C" { 23 #endif 24 25 #ifdef _NTDDK_ 26 #error This head file can not be compiled together with Ntddk.h 27 #endif 28 29 #ifndef WIN64 30 #pragma comment(lib, "Lib\x86\Ntdll.lib") 31 #else 32 #pragma comment(lib, "Lib\x64\Ntdll.lib") 33 #endif 34 35 #pragma endregion 36 37 #pragma region NTDLL BASE DEFINE 38 39 #ifndef NTSTATUS 40 typedef LONG NTSTATUS; 41 #endif 42 43 #ifndef NT_SUCCESS 44 #define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0) 45 #endif // NT_SUCCESS 46 47 #ifndef STATUS_SUCCESS 48 #define STATUS_SUCCESS ((NTSTATUS)0x00000000L) 49 #endif // STATUS_SUCCESS 50 51 #ifndef STATUS_UNSUCCESSFUL 52 #define STATUS_UNSUCCESSFUL ((NTSTATUS)0xC0000001L) 53 #endif // STATUS_UNSUCCESSFUL 54 55 #ifndef ASSERT 56 #ifdef _DEBUG 57 #define ASSERT(x) assert(x) 58 #else // _DEBUG 59 #define ASSERT(x) 60 #endif // _DEBUG 61 #endif // ASSERT 62 63 #pragma endregion 64 65 #pragma region DEFINE 66 67 #define DEVICE_TYPE DWORD 68 69 #define FLG_STOP_ON_EXCEPTION 0x0000001L 70 #define FLG_SHOW_LDR_SNAPS 0x0000002L 71 #define FLG_DEBUG_INITIAL_COMMAND 0x0000004L 72 #define FLG_STOP_ON_HUNG_GUI 0x0000008L 73 #define FLG_HEAP_ENABLE_TAIL_CHECK 0x0000010L 74 #define FLG_HEAP_ENABLE_FREE_CHECK 0x0000020L 75 #define FLG_HEAP_VALIDATE_PARAMETERS 0x0000040L 76 #define FLG_HEAP_VALIDATE_ALL 0x0000080L 77 #define FLG_POOL_ENABLE_TAIL_CHECK 0x0000100L 78 #define FLG_POOL_ENABLE_FREE_CHECK 0x0000200L 79 #define FLG_POOL_ENABLE_TAGGING 0x0000400L 80 #define FLG_HEAP_ENABLE_TAGGING 0x0000800L 81 #define FLG_USER_STACK_TRACE_DB 0x0001000L 82 #define FLG_KERNEL_STACK_TRACE_DB 0x0002000L 83 #define FLG_MAINTAIN_OBJECT_TYPELIST 0x0004000L 84 #define FLG_HEAP_ENABLE_TAG_BY_DLL 0x0008000L 85 #define FLG_IGNORE_DEBUG_PRIV 0x0010000L 86 #define FLG_ENABLE_CSRDEBUG 0x0020000L 87 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x0040000L 88 #define FLG_DISABLE_PAGE_KERNEL_STACKS 0x0080000L 89 #define FLG_HEAP_ENABLE_CALL_TRACING 0x0100000L 90 #define FLG_HEAP_DISABLE_COALESCING 0x0200000L 91 #define FLG_ENABLE_CLOSE_EXCEPTIONS 0x0400000L 92 #define FLG_ENABLE_EXCEPTION_LOGGING 0x0800000L 93 #define FLG_ENABLE_DBGPRINT_BUFFERING 0x8000000L 94 95 #define PROTECT_FROM_CLOSE 0x1L 96 #define INHERIT 0x2L 97 98 #define FLG_SYSOBJINFO_SINGLE_HANDLE_ENTRY 0x40L 99 #define FLG_SYSOBJINFO_DEFAULT_SECURITY_QUOTA 0x20L 100 #define FLG_SYSOBJINFO_PERMANENT 0x10L 101 #define FLG_SYSOBJINFO_EXCLUSIVE 0x08L 102 #define FLG_SYSOBJINFO_CREATOR_INFO 0x04L 103 #define FLG_SYSOBJINFO_KERNEL_MODE 0x02L 104 105 #define PERMANENT 0x10L 106 #define EXCLUSIVE 0x20L 107 108 #define WSLE_PAGE_READONLY 0x001L 109 #define WSLE_PAGE_EXECUTE 0x002L 110 #define WSLE_PAGE_READWRITE 0x004L 111 #define WSLE_PAGE_EXECUTE_READ 0x003L 112 #define WSLE_PAGE_WRITECOPY 0x005L 113 #define WSLE_PAGE_EXECUTE_READWRITE 0x006L 114 #define WSLE_PAGE_EXECUTE_WRITECOPY 0x007L 115 #define WSLE_PAGE_SHARE_COUNT_MASK 0x0E0L 116 #define WSLE_PAGE_SHAREABLE 0x100L 117 118 #define LOCK_VM_IN_WSL 0x1L 119 #define LOCK_VM_IN_RAM 0x2L 120 121 #define PC_IDLE 0x1L 122 #define PC_NORMAL 0x2L 123 #define PC_HIGH 0x3L 124 #define PC_REALTIME 0x4L 125 #define PC_BELOW_NORMAL 0x5L 126 #define PC_ABOVE_NORMAL 0x6L 127 128 #define PDI_MODULES 0x01L 129 #define PDI_BACKTRACE 0x02L 130 #define PDI_HEAPS 0x04L 131 #define PDI_HEAP_TAGS 0x08L 132 #define PDI_HEAP_BLOCKS 0x10L 133 #define PDI_LOCKS 0x20L 134 135 #define LDRP_STATIC_LINK 0x000002L 136 #define LDRP_IMAGE_DLL 0x000004L 137 #define LDRP_LOAD_IN_PROGRESS 0x001000L 138 #define LDRP_UNLOAD_IN_PROGRESS 0x002000L 139 #define LDRP_ENTRY_PROCESSED 0x004000L 140 #define LDRP_ENTRY_INSERTED 0x008000L 141 #define LDRP_CURRENT_LOAD 0x010000L 142 #define LDRP_FAILED_BUILTIN_LOAD 0x020000L 143 #define LDRP_DONT_CALL_FOR_THREADS 0x040000L 144 #define LDRP_PROCESS_ATTACH_CALLED 0x080000L 145 #define LDRP_DEBUG_SYMBOLS_LOADED 0x100000L 146 #define LDRP_IMAGE_NOT_AT_BASE 0x200000L 147 #define LDRP_WX86_IGNORE_MACHINETYPE 0x400000L 148 149 #define LPC_MESSAGE_BASE_SIZE 0x18L 150 151 #define FILE_SUPERSEDE 0x0L 152 #define FILE_OPEN 0x1L 153 #define FILE_CREATE 0x2L 154 #define FILE_OPEN_IF 0x3L 155 #define FILE_OVERWRITE 0x4L 156 #define FILE_OVERWRITE_IF 0x5L 157 #define FILE_MAXIMUM_DISPOSITION 0x5L 158 159 #define FILE_SUPERSEDED 0x0L 160 #define FILE_OPENED 0x1L 161 #define FILE_CREATED 0x2L 162 #define FILE_OVERWRITTEN 0x3L 163 #define FILE_EXISTS 0x4L 164 #define FILE_DOES_NOT_EXIST 0x5L 165 166 #define REG_MONITOR_SINGLE_KEY 0x0L 167 #define REG_MONITOR_SECOND_KEY 0x1L 168 169 #define HASH_STRING_ALGORITHM_DEFAULT 0x00000000L 170 #define HASH_STRING_ALGORITHM_X65599 0x00000001L 171 #define HASH_STRING_ALGORITHM_INVALID 0xFFFFFFFFL 172 173 #define SE_MIN_WELL_KNOWN_PRIVILEGE 0x02L 174 #define SE_CREATE_TOKEN_PRIVILEGE 0x02L 175 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 0x03L 176 #define SE_LOCK_MEMORY_PRIVILEGE 0x04L 177 #define SE_INCREASE_QUOTA_PRIVILEGE 0x05L 178 #define SE_UNSOLICITED_INPUT_PRIVILEGE 0x06L 179 #define SE_MACHINE_ACCOUNT_PRIVILEGE 0x06L 180 #define SE_TCB_PRIVILEGE 0x07L 181 #define SE_SECURITY_PRIVILEGE 0x08L 182 #define SE_TAKE_OWNERSHIP_PRIVILEGE 0x09L 183 #define SE_LOAD_DRIVER_PRIVILEGE 0x0AL 184 #define SE_SYSTEM_PROFILE_PRIVILEGE 0x0BL 185 #define SE_SYSTEMTIME_PRIVILEGE 0x0CL 186 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 0x0DL 187 #define SE_INC_BASE_PRIORITY_PRIVILEGE 0x0EL 188 #define SE_CREATE_PAGEFILE_PRIVILEGE 0x0FL 189 #define SE_CREATE_PERMANENT_PRIVILEGE 0x10L 190 #define SE_BACKUP_PRIVILEGE 0x11L 191 #define SE_RESTORE_PRIVILEGE 0x12L 192 #define SE_SHUTDOWN_PRIVILEGE 0x13L 193 #define SE_DEBUG_PRIVILEGE 0x14L 194 #define SE_AUDIT_PRIVILEGE 0x15L 195 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 0x16L 196 #define SE_CHANGE_NOTIFY_PRIVILEGE 0x17L 197 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 0x18L 198 #define SE_UNDOCK_PRIVILEGE 0x19L 199 #define SE_SYNC_AGENT_PRIVILEGE 0x1AL 200 #define SE_ENABLE_DELEGATION_PRIVILEGE 0x1BL 201 #define SE_MANAGE_VOLUME_PRIVILEGE 0x1CL 202 #define SE_IMPERSONATE_PRIVILEGE 0x1DL 203 #define SE_CREATE_GLOBAL_PRIVILEGE 0x1EL 204 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE 205 206 #define OBJ_INHERIT 0x002L 207 #define OBJ_PERMANENT 0x010L 208 #define OBJ_EXCLUSIVE 0x020L 209 #define OBJ_CASE_INSENSITIVE 0x040L 210 #define OBJ_OPENIF 0x080L 211 #define OBJ_OPENLINK 0x100L 212 #define OBJ_KERNEL_HANDLE 0x200L 213 #define OBJ_FORCE_ACCESS_CHECK 0x400L 214 #define OBJ_VALID_ATTRIBUTES 0x7F2L 215 216 #define DIRECTORY_QUERY 0x0001L 217 #define DIRECTORY_TRAVERSE 0x0002L 218 #define DIRECTORY_CREATE_OBJECT 0x0004L 219 #define DIRECTORY_CREATE_SUBDIRECTORY 0x0008L 220 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x000FL) 221 222 #define LEVEL_HANDLE_ID 0x74000000L 223 #define LEVEL_HANDLE_ID_MASK 0xFF000000L 224 #define LEVEL_HANDLE_INDEX_MASK 0x00FFFFFFL 225 226 #define RTL_QUERY_REGISTRY_SUBKEY 0x01L 227 #define RTL_QUERY_REGISTRY_TOPKEY 0x02L 228 #define RTL_QUERY_REGISTRY_REQUIRED 0x04L 229 #define RTL_QUERY_REGISTRY_NOVALUE 0x08L 230 #define RTL_QUERY_REGISTRY_NOEXPAND 0x10L 231 #define RTL_QUERY_REGISTRY_DIRECT 0x20L 232 #define RTL_QUERY_REGISTRY_DELETE 0x40L 233 234 #define RTL_REGISTRY_ABSOLUTE 0x00000000L 235 #define RTL_REGISTRY_SERVICES 0x00000001L 236 #define RTL_REGISTRY_CONTROL 0x00000002L 237 #define RTL_REGISTRY_WINDOWS_NT 0x00000003L 238 #define RTL_REGISTRY_DEVICEMAP 0x00000004L 239 #define RTL_REGISTRY_USER 0x00000005L 240 #define RTL_REGISTRY_MAXIMUM 0x00000006L 241 #define RTL_REGISTRY_HANDLE 0x40000000L 242 #define RTL_REGISTRY_OPTIONAL 0x80000000L 243 244 #define OLD_DOS_VOLID 0x8L 245 246 #define FILE_DIRECTORY_FILE 0x000001L 247 #define FILE_WRITE_THROUGH 0x000002L 248 #define FILE_SEQUENTIAL_ONLY 0x000004L 249 #define FILE_NO_INTERMEDIATE_BUFFERING 0x000008L 250 #define FILE_SYNCHRONOUS_IO_ALERT 0x000010L 251 #define FILE_SYNCHRONOUS_IO_NONALERT 0x000020L 252 #define FILE_NON_DIRECTORY_FILE 0x000040L 253 #define FILE_CREATE_TREE_CONNECTION 0x000080L 254 #define FILE_COMPLETE_IF_OPLOCKED 0x000100L 255 #define FILE_NO_EA_KNOWLEDGE 0x000200L 256 #define FILE_OPEN_FOR_RECOVERY 0x000400L 257 #define FILE_RANDOM_ACCESS 0x000800L 258 #define FILE_DELETE_ON_CLOSE 0x001000L 259 #define FILE_OPEN_BY_FILE_ID 0x002000L 260 #define FILE_OPEN_FOR_BACKUP_INTENT 0x004000L 261 #define FILE_NO_COMPRESSION 0x008000L 262 #define FILE_OPEN_REQUIRING_OPLOCK 0x010000L 263 #define FILE_DISALLOW_EXCLUSIVE 0x020000L 264 #define FILE_RESERVE_OPFILTER 0x100000L 265 #define FILE_OPEN_REPARSE_POINT 0x200000L 266 #define FILE_OPEN_NO_RECALL 0x400000L 267 #define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x800000L 268 269 #define GDI_HANDLE_BUFFER_SIZE 0x22L 270 271 #define MEM_EXECUTE_OPTION_DISABLE 0x01L 272 #define MEM_EXECUTE_OPTION_ENABLE 0x02L 273 #define MEM_EXECUTE_OPTION_PERMANENT 0x08L 274 275 #define MAX_LPC_DATA 0x130L 276 277 #define ALPC_REQUEST 0x2000L | LPC_REQUEST 278 #define ALPC_CONNECTION_REQUEST 0x2000L | LPC_CONNECTION_REQUEST 279 280 #define SYMBOLIC_LINK_QUERY 0x1L 281 #define SYMBOLIC_LINK_ALL_ACCESS STANDARD_RIGHTS_REQUIRED | 0x1L 282 283 #define EVENT_PAIR_ALL_ACCESS STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE 284 285 #pragma endregion 286 287 #pragma region TYPEDEF 288 289 typedef LONG KPRIORITY; 290 typedef PVOID PLANGID; 291 typedef DWORD ULONG_PTR; 292 typedef ULONG_PTR KAFFINITY; 293 typedef USHORT RTL_ATOM, *PRTL_ATOM; 294 typedef LARGE_INTEGER PHYSICAL_ADDRESS; 295 296 #pragma endregion 297 298 #pragma region ENUM 299 300 typedef enum _THREADINFOCLASS 301 { 302 ThreadBasicInformation, 303 ThreadTimes, 304 ThreadPriority, 305 ThreadBasePriority, 306 ThreadAffinityMask, 307 ThreadImpersonationToken, 308 ThreadDescriptorTableEntry, 309 ThreadEnableAlignmentFaultFixup, 310 ThreadEventPair_Reusable, 311 ThreadQuerySetWin32StartAddress, 312 ThreadZeroTlsCell, 313 ThreadPerformanceCount, 314 ThreadAmILastThread, 315 ThreadIdealProcessor, 316 ThreadPriorityBoost, 317 ThreadSetTlsArrayAddress, 318 ThreadIsIoPending, 319 ThreadHideFromDebugger, 320 ThreadBreakOnTermination, 321 MaxThreadInfoClass 322 } THREADINFOCLASS; 323 324 typedef enum _KPROFILE_SOURCE 325 { 326 ProfileTime, 327 ProfileAlignmentFixup, 328 ProfileTotalIssues, 329 ProfilePipelineDry, 330 ProfileLoadInstructions, 331 ProfilePipelineFrozen, 332 ProfileBranchInstructions, 333 ProfileTotalNonissues, 334 ProfileDcacheMisses, 335 ProfileIcacheMisses, 336 ProfileCacheMisses, 337 ProfileBranchMispredictions, 338 ProfileStoreInstructions, 339 ProfileFpInstructions, 340 ProfileIntegerInstructions, 341 Profile2Issue, 342 Profile3Issue, 343 Profile4Issue, 344 ProfileSpecialInstructions, 345 ProfileTotalCycles, 346 ProfileIcacheIssues, 347 ProfileDcacheAccesses, 348 ProfileMemoryBarrierCycles, 349 ProfileLoadLinkedIssues, 350 ProfileMaximum 351 } KPROFILE_SOURCE; 352 353 typedef enum _KWAIT_REASON 354 { 355 Executive, 356 FreePage, 357 PageIn, 358 PoolAllocation, 359 DelayExecution, 360 Suspended, 361 UserRequest, 362 WrExecutive, 363 WrFreePage, 364 WrPageIn, 365 WrPoolAllocation, 366 WrDelayExecution, 367 WrSuspended, 368 WrUserRequest, 369 WrEventPair, 370 WrQueue, 371 WrLpcReceive, 372 WrLpcReply, 373 WrVirtualMemory, 374 WrPageOut, 375 WrRendezvous, 376 Spare2, 377 Spare3, 378 Spare4, 379 Spare5, 380 Spare6, 381 WrKernel, 382 MaximumWaitReason 383 } KWAIT_REASON; 384 385 typedef enum _POOL_TYPE 386 { 387 NonPagedPool, 388 PagedPool, 389 NonPagedPoolMustSucceed, 390 DontUseThisType, 391 NonPagedPoolCacheAligned, 392 PagedPoolCacheAligned, 393 NonPagedPoolCacheAlignedMustS, 394 MaxPoolType, 395 NonPagedPoolSession = 32, 396 PagedPoolSession, 397 NonPagedPoolMustSucceedSession, 398 DontUseThisTypeSession, 399 NonPagedPoolCacheAlignedSession, 400 PagedPoolCacheAlignedSession, 401 NonPagedPoolCacheAlignedMustSSession 402 } POOL_TYPE; 403 404 typedef enum _THREAD_STATE 405 { 406 StateInitialized, 407 StateReady, 408 StateRunning, 409 StateStandby, 410 StateTerminated, 411 StateWait, 412 StateTransition, 413 StateUnknown 414 } THREAD_STATE; 415 416 typedef enum _SYSTEM_HANDLE_TYPE 417 { 418 OB_TYPE_UNKNOWN, 419 OB_TYPE_TYPE, 420 OB_TYPE_DIRECTORY, 421 OB_TYPE_SYMBOLIC_LINK, 422 OB_TYPE_TOKEN, 423 OB_TYPE_PROCESS, 424 OB_TYPE_THREAD, 425 OB_TYPE_UNKNOWN_7, 426 OB_TYPE_EVENT, 427 OB_TYPE_EVENT_PAIR, 428 OB_TYPE_MUTANT, 429 OB_TYPE_UNKNOWN_11, 430 OB_TYPE_SEMAPHORE, 431 OB_TYPE_TIMER, 432 OB_TYPE_PROFILE, 433 OB_TYPE_WINDOW_STATION, 434 OB_TYPE_DESKTOP, 435 OB_TYPE_SECTION, 436 OB_TYPE_KEY, 437 OB_TYPE_PORT, 438 OB_TYPE_WAITABLE_PORT, 439 OB_TYPE_UNKNOWN_21, 440 OB_TYPE_UNKNOWN_22, 441 OB_TYPE_UNKNOWN_23, 442 OB_TYPE_UNKNOWN_24, 443 OB_TYPE_IO_COMPLETION, 444 OB_TYPE_FILE 445 }SYSTEM_HANDLE_TYPE; 446 447 typedef enum _DEBUG_CONTROL_CODE 448 { 449 DebugGetTraceInformation = 1, 450 DebugSetInternalBreakpoint, 451 DebugSetSpecialCall, 452 DebugClearSpecialCalls, 453 DebugQuerySpecialCalls, 454 DebugDbgBreakPoint, 455 DebugMaximum 456 } DEBUG_CONTROL_CODE; 457 458 typedef enum _SYSDBG_COMMAND 459 { 460 SysDbgQueryModuleInformation = 0, 461 SysDbgQueryTraceInformation, 462 SysDbgSetTracepoint, 463 SysDbgSetSpecialCall, 464 SysDbgClearSpecialCalls, 465 SysDbgQuerySpecialCalls, 466 SysDbgBreakPoint, 467 SysDbgQueryVersion, 468 SysDbgReadVirtual, 469 SysDbgWriteVirtual, 470 SysDbgReadPhysical, 471 SysDbgWritePhysical, 472 SysDbgReadControlSpace, 473 SysDbgWriteControlSpace, 474 SysDbgReadIoSpace, 475 SysDbgWriteIoSpace, 476 SysDbgReadMsr, 477 SysDbgWriteMsr, 478 SysDbgReadBusData, 479 SysDbgWriteBusData, 480 SysDbgCheckLowMemory, 481 SysDbgEnableKernelDebugger, 482 SysDbgDisableKernelDebugger, 483 SysDbgGetAutoKdEnable, 484 SysDbgSetAutoKdEnable, 485 SysDbgGetPrintBufferSize, 486 SysDbgSetPrintBufferSize, 487 SysDbgGetKdUmExceptionEnable, 488 SysDbgSetKdUmExceptionEnable, 489 SysDbgGetTriageDump, 490 SysDbgGetKdBlockEnable, 491 SysDbgSetKdBlockEnable, 492 } SYSDBG_COMMAND, *PSYSDBG_COMMAND; 493 494 typedef enum _INTERFACE_TYPE 495 { 496 InterfaceTypeUndefined = -1, 497 Internal, 498 Isa, 499 Eisa, 500 MicroChannel, 501 TurboChannel, 502 PCIBus, 503 VMEBus, 504 NuBus, 505 PCMCIABus, 506 CBus, 507 MPIBus, 508 MPSABus, 509 ProcessorInternal, 510 InternalPowerBus, 511 PNPISABus, 512 PNPBus, 513 MaximumInterfaceType 514 }INTERFACE_TYPE, *PINTERFACE_TYPE; 515 516 typedef enum _BUS_DATA_TYPE 517 { 518 ConfigurationSpaceUndefined = -1, 519 Cmos, 520 EisaConfiguration, 521 Pos, 522 CbusConfiguration, 523 PCIConfiguration, 524 VMEConfiguration, 525 NuBusConfiguration, 526 PCMCIAConfiguration, 527 MPIConfiguration, 528 MPSAConfiguration, 529 PNPISAConfiguration, 530 SgiInternalConfiguration, 531 MaximumBusDataType 532 } BUS_DATA_TYPE, *PBUS_DATA_TYPE; 533 534 typedef enum _OBJECT_INFORMATION_CLASS 535 { 536 ObjectBasicInformation, 537 ObjectNameInformation, 538 ObjectTypeInformation, 539 ObjectAllTypesInformation, 540 ObjectHandleInformation 541 } OBJECT_INFORMATION_CLASS; 542 543 typedef enum _LPC_TYPE 544 { 545 LPC_NEW_MESSAGE, 546 LPC_REQUEST, 547 LPC_REPLY, 548 LPC_DATAGRAM, 549 LPC_LOST_REPLY, 550 LPC_PORT_CLOSED, 551 LPC_CLIENT_DIED, 552 LPC_EXCEPTION, 553 LPC_DEBUG_EVENT, 554 LPC_ERROR_EVENT, 555 LPC_CONNECTION_REQUEST, 556 LPC_CONNECTION_REFUSED, 557 LPC_MAXIMUM 558 } LPC_TYPE; 559 560 typedef enum _KEY_SET_INFORMATION_CLASS 561 { 562 KeyLastWriteTimeInformation 563 } KEY_SET_INFORMATION_CLASS; 564 565 typedef enum _HARDERROR_RESPONSE_OPTION 566 { 567 OptionAbortRetryIgnore, 568 OptionOk, 569 OptionOkCancel, 570 OptionRetryCancel, 571 OptionYesNo, 572 OptionYesNoCancel, 573 OptionShutdownSystem 574 } HARDERROR_RESPONSE_OPTION, *PHARDERROR_RESPONSE_OPTION; 575 576 typedef enum _HARDERROR_RESPONSE 577 { 578 ResponseReturnToCaller, 579 ResponseNotHandled, 580 ResponseAbort, 581 ResponseCancel, 582 ResponseIgnore, 583 ResponseNo, 584 ResponseOk, 585 ResponseRetry, 586 ResponseYes 587 } HARDERROR_RESPONSE, *PHARDERROR_RESPONSE; 588 589 typedef enum _ATOM_INFORMATION_CLASS 590 { 591 AtomBasicInformation, 592 AtomListInformation 593 } ATOM_INFORMATION_CLASS; 594 595 typedef enum _PORT_INFORMATION_CLASS 596 { 597 PortBasicInformation 598 } PORT_INFORMATION_CLASS; 599 600 typedef enum _EVENT_TYPE 601 { 602 NotificationEvent, 603 SynchronizationEvent 604 } EVENT_TYPE; 605 606 typedef enum _RTL_GENERIC_COMPARE_RESULTS 607 { 608 GenericLessThan, 609 GenericGreaterThan, 610 GenericEqual 611 } RTL_GENERIC_COMPARE_RESULTS; 612 613 typedef enum _SECTION_INHERIT 614 { 615 ViewShare = 1, 616 ViewUnmap = 2 617 } SECTION_INHERIT; 618 619 typedef enum _KEY_VALUE_INFORMATION_CLASS 620 { 621 KeyValueBasicInformation, 622 KeyValueFullInformation, 623 KeyValuePartialInformation, 624 KeyValueFullInformationAlign64, 625 KeyValuePartialInformationAlign64, 626 MaxKeyValueInfoClass 627 } KEY_VALUE_INFORMATION_CLASS; 628 629 typedef enum _KEY_INFORMATION_CLASS 630 { 631 KeyBasicInformation, 632 KeyNodeInformation, 633 KeyFullInformation, 634 KeyNameInformation, 635 KeyCachedInformation, 636 KeyFlagsInformation, 637 MaxKeyInfoClass 638 } KEY_INFORMATION_CLASS; 639 640 typedef enum _SYSTEM_INFORMATION_CLASS 641 { 642 SystemBasicInformation, 643 SystemProcessorInformation, 644 SystemPerformanceInformation, 645 SystemTimeOfDayInformation, 646 SystemPathInformation, 647 SystemProcessInformation, 648 SystemCallCountInformation, 649 SystemDeviceInformation, 650 SystemProcessorPerformanceInformation, 651 SystemFlagsInformation, 652 SystemCallTimeInformation, 653 SystemModuleInformation, 654 SystemLocksInformation, 655 SystemStackTraceInformation, 656 SystemPagedPoolInformation, 657 SystemNonPagedPoolInformation, 658 SystemHandleInformation, 659 SystemObjectInformation, 660 SystemPageFileInformation, 661 SystemVdmInstemulInformation, 662 SystemVdmBopInformation, 663 SystemFileCacheInformation, 664 SystemPoolTagInformation, 665 SystemInterruptInformation, 666 SystemDpcBehaviorInformation, 667 SystemFullMemoryInformation, 668 SystemLoadGdiDriverInformation, 669 SystemUnloadGdiDriverInformation, 670 SystemTimeAdjustmentInformation, 671 SystemSummaryMemoryInformation, 672 SystemMirrorMemoryInformation, 673 SystemPerformanceTraceInformation, 674 SystemObsolete0, 675 SystemExceptionInformation, 676 SystemCrashDumpStateInformation, 677 SystemKernelDebuggerInformation, 678 SystemContextSwitchInformation, 679 SystemRegistryQuotaInformation, 680 SystemExtendServiceTableInformation, 681 SystemPrioritySeperation, 682 SystemPlugPlayBusInformation, 683 SystemDockInformation, 684 SystemPowerInformationNative, 685 SystemProcessorSpeedInformation, 686 SystemCurrentTimeZoneInformation, 687 SystemLookasideInformation, 688 SystemTimeSlipNotification, 689 SystemSessionCreate, 690 SystemSessionDetach, 691 SystemSessionInformation, 692 SystemRangeStartInformation, 693 SystemVerifierInformation, 694 SystemAddVerifier, 695 SystemSessionProcessesInformation, 696 SystemLoadGdiDriverInSystemSpaceInformation, 697 SystemNumaProcessorMap, 698 SystemPrefetcherInformation, 699 SystemExtendedProcessInformation, 700 SystemRecommendedSharedDataAlignment, 701 SystemComPlusPackage, 702 SystemNumaAvailableMemory, 703 SystemProcessorPowerInformation, 704 SystemEmulationBasicInformation, 705 SystemEmulationProcessorInformation, 706 SystemExtendedHanfleInformation, 707 SystemLostDelayedWriteInformation, 708 SystemBigPoolInformation, 709 SystemSessionPoolTagInformation, 710 SystemSessionMappedViewInformation, 711 SystemHotpatchInformation, 712 SystemObjectSecurityMode, 713 SystemWatchDogTimerHandler, 714 SystemWatchDogTimerInformation, 715 SystemLogicalProcessorInformation, 716 SystemWo64SharedInformationObosolete, 717 SystemRegisterFirmwareTableInformationHandler, 718 SystemFirmwareTableInformation, 719 SystemModuleInformationEx, 720 SystemVerifierTriageInformation, 721 SystemSuperfetchInformation, 722 SystemMemoryListInformation, 723 SystemFileCacheInformationEx, 724 SystemThreadPriorityClientIdInformation, 725 SystemProcessorIdleCycleTimeInformation, 726 SystemVerifierCancellationInformation, 727 SystemProcessorPowerInformationEx, 728 SystemRefTraceInformation, 729 SystemSpecialPoolInformation, 730 SystemProcessIdInformation, 731 SystemErrorPortInformation, 732 SystemBootEnvironmentInformation, 733 SystemHypervisorInformation, 734 SystemVerifierInformationEx, 735 SystemTimeZoneInformation, 736 SystemImageFileExecutionOptionsInformation, 737 SystemCoverageInformation, 738 SystemPrefetchPathInformation, 739 SystemVerifierFaultsInformation, 740 MaxSystemInfoClass 741 } SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS; 742 743 typedef enum _SHUTDOWN_ACTION 744 { 745 ShutdownNoReboot, 746 ShutdownReboot, 747 ShutdownPowerOff 748 } SHUTDOWN_ACTION, *PSHUTDOWN_ACTION; 749 750 typedef enum _FILE_INFORMATION_CLASS 751 { 752 FileDirectoryInformation = 1, 753 FileFullDirectoryInformation, 754 FileBothDirectoryInformation, 755 FileBasicInformation, 756 FileStandardInformation, 757 FileInternalInformation, 758 FileEaInformation, 759 FileAccessInformation, 760 FileNameInformation, 761 FileRenameInformation, 762 FileLinkInformation, 763 FileNamesInformation, 764 FileDispositionInformation, 765 FilePositionInformation, 766 FileFullEaInformation, 767 FileModeInformation, 768 FileAlignmentInformation, 769 FileAllInformation, 770 FileAllocationInformation, 771 FileEndOfFileInformation, 772 FileAlternateNameInformation, 773 FileStreamInformation, 774 FilePipeInformation, 775 FilePipeLocalInformation, 776 FilePipeRemoteInformation, 777 FileMailslotQueryInformation, 778 FileMailslotSetInformation, 779 FileCompressionInformation, 780 FileObjectIdInformation, 781 FileCompletionInformation, 782 FileMoveClusterInformation, 783 FileQuotaInformation, 784 FileReparsePointInformation, 785 FileNetworkOpenInformation, 786 FileAttributeTagInformation, 787 FileTrackingInformation, 788 FileIdBothDirectoryInformation, 789 FileIdFullDirectoryInformation, 790 FileValidDataLengthInformation, 791 FileShortNameInformation, 792 FileIoCompletionNotificationInformation, 793 FileIoStatusBlockRangeInformation, 794 FileIoPriorityHintInformation, 795 FileSfioReserveInformation, 796 FileSfioVolumeInformation, 797 FileHardLinkInformation, 798 FileProcessIdsUsingFileInformation, 799 FileNormalizedNameInformation, 800 FileNetworkPhysicalNameInformation, 801 FileIdGlobalTxDirectoryInformation, 802 FileIsRemoteDeviceInformation, 803 FileAttributeCacheInformation, 804 FileNumaNodeInformation, 805 FileStandardLinkInformation, 806 FileRemoteProtocolInformation, 807 FileMaximumInformation 808 } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS; 809 810 typedef enum _IO_PRIORITY_HINT 811 { 812 IoPriorityVeryLow, 813 IoPriorityLow, 814 IoPriorityNormal, 815 IoPriorityHigh, 816 IoPriorityCritical, 817 MaxIoPriorityTypes 818 } IO_PRIORITY_HINT; 819 820 typedef enum _FSINFOCLASS 821 { 822 FileFsVolumeInformation = 1, 823 FileFsLabelInformation, 824 FileFsSizeInformation, 825 FileFsDeviceInformation, 826 FileFsAttributeInformation, 827 FileFsControlInformation, 828 FileFsFullSizeInformation, 829 FileFsObjectIdInformation, 830 FileFsDriverPathInformation, 831 FileFsVolumeFlagsInformation, 832 FileFsMaximumInformation 833 } FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS; 834 835 typedef enum _PROCESSINFOCLASS 836 { 837 ProcessBasicInformation, 838 ProcessQuotaLimits, 839 ProcessIoCounters, 840 ProcessVmCounters, 841 ProcessTimes, 842 ProcessBasePriority, 843 ProcessRaisePriority, 844 ProcessDebugPort, 845 ProcessExceptionPort, 846 ProcessAccessToken, 847 ProcessLdtInformation, 848 ProcessLdtSize, 849 ProcessDefaultHardErrorMode, 850 ProcessIoPortHandlers, 851 ProcessPooledUsageAndLimits, 852 ProcessWorkingSetWatch, 853 ProcessUserModeIOPL, 854 ProcessEnableAlignmentFaultFixup, 855 ProcessPriorityClass, 856 ProcessWx86Information, 857 ProcessHandleCount, 858 ProcessAffinityMask, 859 ProcessPriorityBoost, 860 ProcessDeviceMap, 861 ProcessSessionInformation, 862 ProcessForegroundInformation, 863 ProcessWow64Information, 864 ProcessImageFileName, 865 ProcessLUIDDeviceMapsEnabled, 866 ProcessBreakOnTermination, 867 ProcessDebugObjectHandle, 868 ProcessDebugFlags, 869 ProcessHandleTracing, 870 ProcessIoPriority, 871 ProcessExecuteFlags, 872 ProcessTlsInformation, 873 ProcessCookie, 874 ProcessImageInformation, 875 ProcessCycleTime, 876 ProcessPagePriority, 877 ProcessInstrumentationCallback, 878 ProcessThreadStackAllocation, 879 ProcessWorkingSetWatchEx, 880 ProcessImageFileNameWin32, 881 ProcessImageFileMapping, 882 ProcessAffinityUpdateMode, 883 ProcessMemoryAllocationMode, 884 ProcessGroupInformation, 885 ProcessTokenVirtualizationEnabled, 886 ProcessConsoleHostProcess, 887 ProcessWindowInformation, 888 MaxProcessInfoClass 889 } PROCESSINFOCLASS; 890 891 typedef enum _MEMORY_INFORMATION_CLASS 892 { 893 MemoryBasicInformation, 894 MemoryWorkingSetInformation, 895 MemoryMappedFilenameInformation, 896 MemoryRegionInformation, 897 MemoryWorkingSetExInformation 898 } MEMORY_INFORMATION_CLASS; 899 900 typedef enum _WAIT_TYPE 901 { 902 WaitAll, 903 WaitAny 904 } WAIT_TYPE; 905 906 typedef enum _EVENT_INFORMATION_CLASS 907 { 908 EventBasicInformation 909 } EVENT_INFORMATION_CLASS; 910 911 typedef enum _SECTION_INFORMATION_CLASS 912 { 913 SectionBasicInformation, 914 SectionImageInformation 915 } SECTION_INFORMATION_CLASS, *PSECTION_INFORMATION_CLASS; 916 917 #pragma endregion 918 919 #pragma region STRUCT 920 921 typedef struct _STRING 922 { 923 USHORT Length; 924 USHORT MaximumLength; 925 PCHAR Buffer; 926 } STRING, ANSI_STRING, OEM_STRING, *PSTRING, *PANSI_STRING, *PCANSI_STRING, *POEM_STRING; 927 typedef const STRING *PCOEM_STRING; 928 929 typedef struct _UNICODE_STRING 930 { 931 USHORT Length; 932 USHORT MaximumLength; 933 PWSTR Buffer; 934 } UNICODE_STRING, *PUNICODE_STRING; 935 typedef const UNICODE_STRING *PCUNICODE_STRING; 936 937 typedef struct _CLIENT_ID 938 { 939 HANDLE UniqueProcess; 940 HANDLE UniqueThread; 941 } CLIENT_ID, *PCLIENT_ID; 942 943 typedef struct _CURDIR 944 { 945 UNICODE_STRING DosPath; 946 HANDLE Handle; 947 } CURDIR, *PCURDIR; 948 949 typedef struct _OBJECT_ATTRIBUTES 950 { 951 ULONG Length; 952 HANDLE RootDirectory; 953 PUNICODE_STRING ObjectName; 954 ULONG Attributes; 955 PVOID SecurityDescriptor; 956 PVOID SecurityQualityOfService; 957 } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; 958 959 typedef struct _PEB_FREE_BLOCK 960 { 961 struct _PEB_FREE_BLOCK *Next; 962 ULONG Size; 963 } PEB_FREE_BLOCK, *PPEB_FREE_BLOCK; 964 965 typedef struct _PEB_LDR_DATA 966 { 967 ULONG Length; 968 BOOLEAN Initialized; 969 HANDLE SsHandle; 970 LIST_ENTRY InLoadOrderModuleList; 971 LIST_ENTRY InMemoryOrderModuleList; 972 LIST_ENTRY InInitializationOrderModuleList; 973 PVOID EntryInProgress; 974 } PEB_LDR_DATA, *PPEB_LDR_DATA; 975 976 typedef struct _RTL_DRIVE_LETTER_CURDIR 977 { 978 USHORT Flags; 979 USHORT Length; 980 ULONG TimeStamp; 981 STRING DosPath; 982 } RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR; 983 984 typedef struct _RTL_USER_PROCESS_PARAMETERS 985 { 986 ULONG MaximumLength; 987 ULONG Length; 988 ULONG Flags; 989 ULONG DebugFlags; 990 PVOID ConsoleHandle; 991 ULONG ConsoleFlags; 992 HANDLE StandardInput; 993 HANDLE StandardOutput; 994 HANDLE StandardError; 995 CURDIR CurrentDirectory; 996 UNICODE_STRING DllPath; 997 UNICODE_STRING ImagePathName; 998 UNICODE_STRING CommandLine; 999 PVOID Environment; 1000 ULONG StartingX; 1001 ULONG StartingY; 1002 ULONG CountX; 1003 ULONG CountY; 1004 ULONG CountCharsX; 1005 ULONG CountCharsY; 1006 ULONG FillAttribute; 1007 ULONG WindowFlags; 1008 ULONG ShowWindowFlags; 1009 UNICODE_STRING WindowTitle; 1010 UNICODE_STRING DesktopInfo; 1011 UNICODE_STRING ShellInfo; 1012 UNICODE_STRING RuntimeData; 1013 RTL_DRIVE_LETTER_CURDIR CurrentDirectores[0x20]; 1014 } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS; 1015 1016 typedef struct _PEB 1017 { 1018 BOOLEAN InheritedAddressSpace; 1019 BOOLEAN ReadImageFileExecOptions; 1020 BOOLEAN BeingDebugged; 1021 BOOLEAN SpareBool; 1022 HANDLE Mutant; 1023 PVOID ImageBaseAddress; 1024 PPEB_LDR_DATA Ldr; 1025 PRTL_USER_PROCESS_PARAMETERS ProcessParameters; 1026 PVOID SubSystemData; 1027 PVOID ProcessHeap; 1028 PVOID FastPebLock; 1029 PVOID FastPebLockRoutine; 1030 PVOID FastPebUnlockRoutine; 1031 ULONG EnvironmentUpdateCount; 1032 PVOID KernelCallbackTable; 1033 HANDLE SystemReserved; 1034 PVOID AtlThunkSListPtr32; 1035 PPEB_FREE_BLOCK FreeList; 1036 ULONG TlsExpansionCounter; 1037 PVOID TlsBitmap; 1038 ULONG TlsBitmapBits[2]; 1039 PVOID ReadOnlySharedMemoryBase; 1040 PVOID ReadOnlySharedMemoryHeap; 1041 PVOID *ReadOnlyStaticServerData; 1042 PVOID AnsiCodePageData; 1043 PVOID OemCodePageData; 1044 PVOID UnicodeCaseTableData; 1045 ULONG NumberOfProcessors; 1046 ULONG NtGlobalFlag; 1047 LARGE_INTEGER CriticalSectionTimeout; 1048 ULONG HeapSegmentReserve; 1049 ULONG HeapSegmentCommit; 1050 ULONG HeapDeCommitTotalFreeThreshold; 1051 ULONG HeapDeCommitFreeBlockThreshold; 1052 ULONG NumberOfHeaps; 1053 ULONG MaximumNumberOfHeaps; 1054 PVOID *ProcessHeaps; 1055 PVOID GdiSharedHandleTable; 1056 PVOID ProcessStarterHelper; 1057 PVOID GdiDCAttributeList; 1058 PVOID LoaderLock; 1059 ULONG OSMajorVersion; 1060 ULONG OSMinorVersion; 1061 USHORT OSBuildNumber; 1062 USHORT OSCSDVersion; 1063 ULONG OSPlatformId; 1064 ULONG ImageSubsystem; 1065 ULONG ImageSubsystemMajorVersion; 1066 ULONG ImageSubsystemMinorVersion; 1067 ULONG ImageProcessAffinityMask; 1068 ULONG GdiHandleBuffer[GDI_HANDLE_BUFFER_SIZE]; 1069 } PEB, *PPEB; 1070 1071 typedef struct _TEB 1072 { 1073 NT_TIB NtTib; 1074 PVOID EnvironmentPointer; 1075 CLIENT_ID ClientId; 1076 PVOID ActiveRpcHandle; 1077 PVOID ThreadLocalStoragePointer; 1078 PPEB ProcessEnvironmentBlock; 1079 ULONG LastErrorValue; 1080 ULONG CountOfOwnedCriticalSections; 1081 PVOID CsrClientThread; 1082 PVOID Win32ThreadInfo; 1083 } TEB, *PTEB; 1084 1085 typedef struct _PROCESS_BASIC_INFORMATION 1086 { 1087 NTSTATUS ExitStatus; 1088 PPEB PebBaseAddress; 1089 KAFFINITY AffinityMask; 1090 KPRIORITY BasePriority; 1091 ULONG UniqueProcessId; 1092 ULONG InheritedFromUniqueProcessId; 1093 } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION; 1094 1095 typedef struct _FILE_NETWORK_OPEN_INFORMATION 1096 { 1097 LARGE_INTEGER CreationTime; 1098 LARGE_INTEGER LastAccessTime; 1099 LARGE_INTEGER LastWriteTime; 1100 LARGE_INTEGER ChangeTime; 1101 LARGE_INTEGER AllocationSize; 1102 LARGE_INTEGER EndOfFile; 1103 ULONG FileAttributes; 1104 } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION; 1105 1106 typedef struct _IO_STATUS_BLOCK 1107 { 1108 union 1109 { 1110 NTSTATUS Status; 1111 PVOID Pointer; 1112 }; 1113 ULONG_PTR Information; 1114 } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK; 1115 1116 typedef struct _KEY_VALUE_ENTRY 1117 { 1118 PUNICODE_STRING ValueName; 1119 ULONG DataLength; 1120 ULONG DataOffset; 1121 ULONG Type; 1122 } KEY_VALUE_ENTRY, *PKEY_VALUE_ENTRY; 1123 1124 typedef struct _SYSTEM_BASIC_INFORMATION 1125 { 1126 ULONG Reserved; 1127 ULONG TimerResolution; 1128 ULONG PageSize; 1129 ULONG NumberOfPhysicalPages; 1130 ULONG LowestPhysicalPageNumber; 1131 ULONG HighestPhysicalPageNumber; 1132 ULONG AllocationGranularity; 1133 ULONG MinimumUserModeAddress; 1134 ULONG MaximumUserModeAddress; 1135 KAFFINITY ActiveProcessorsAffinityMask; 1136 CCHAR NumberOfProcessors; 1137 } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION; 1138 1139 typedef struct _SYSTEM_PROCESSOR_INFORMATION 1140 { 1141 USHORT ProcessorArchitecture; 1142 USHORT ProcessorLevel; 1143 USHORT ProcessorRevision; 1144 USHORT Unknown; 1145 ULONG FeatureBits; 1146 } SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION; 1147 1148 typedef struct _SYSTEM_PERFORMANCE_INFORMATION 1149 { 1150 LARGE_INTEGER IdleProcessTime; 1151 LARGE_INTEGER IoReadTransferCount; 1152 LARGE_INTEGER IoWriteTransferCount; 1153 LARGE_INTEGER IoOtherTransferCount; 1154 ULONG IoReadOperationCount; 1155 ULONG IoWriteOperationCount; 1156 ULONG IoOtherOperationCount; 1157 ULONG AvailablePages; 1158 ULONG CommittedPages; 1159 ULONG CommitLimit; 1160 ULONG PeakCommitment; 1161 ULONG PageFaultCount; 1162 ULONG CopyOnWriteCount; 1163 ULONG TransitionCount; 1164 ULONG CacheTransitionCount; 1165 ULONG DemandZeroCount; 1166 ULONG PageReadCount; 1167 ULONG PageReadIoCount; 1168 ULONG CacheReadCount; 1169 ULONG CacheIoCount; 1170 ULONG DirtyPagesWriteCount; 1171 ULONG DirtyWriteIoCount; 1172 ULONG MappedPagesWriteCount; 1173 ULONG MappedWriteIoCount; 1174 ULONG PagedPoolPages; 1175 ULONG NonPagedPoolPages; 1176 ULONG PagedPoolAllocs; 1177 ULONG PagedPoolFrees; 1178 ULONG NonPagedPoolAllocs; 1179 ULONG NonPagedPoolFrees; 1180 ULONG FreeSystemPtes; 1181 ULONG ResidentSystemCodePage; 1182 ULONG TotalSystemDriverPages; 1183 ULONG TotalSystemCodePages; 1184 ULONG NonPagedPoolLookasideHits; 1185 ULONG PagedPoolLookasideHits; 1186 ULONG Spare3Count; 1187 ULONG ResidentSystemCachePage; 1188 ULONG ResidentPagedPoolPage; 1189 ULONG ResidentSystemDriverPage; 1190 ULONG CcFastReadNoWait; 1191 ULONG CcFastReadWait; 1192 ULONG CcFastReadResourceMiss; 1193 ULONG CcFastReadNotPossible; 1194 ULONG CcFastMdlReadNoWait; 1195 ULONG CcFastMdlReadWait; 1196 ULONG CcFastMdlReadResourceMiss; 1197 ULONG CcFastMdlReadNotPossible; 1198 ULONG CcMapDataNoWait; 1199 ULONG CcMapDataWait; 1200 ULONG CcMapDataNoWaitMiss; 1201 ULONG CcMapDataWaitMiss; 1202 ULONG CcPinMappedDataCount; 1203 ULONG CcPinReadNoWait; 1204 ULONG CcPinReadWait; 1205 ULONG CcPinReadNoWaitMiss; 1206 ULONG CcPinReadWaitMiss; 1207 ULONG CcCopyReadNoWait; 1208 ULONG CcCopyReadWait; 1209 ULONG CcCopyReadNoWaitMiss; 1210 ULONG CcCopyReadWaitMiss; 1211 ULONG CcMdlReadNoWait; 1212 ULONG CcMdlReadWait; 1213 ULONG CcMdlReadNoWaitMiss; 1214 ULONG CcMdlReadWaitMiss; 1215 ULONG CcReadAheadIos; 1216 ULONG CcLazyWriteIos; 1217 ULONG CcLazyWritePages; 1218 ULONG CcDataFlushes; 1219 ULONG CcDataPages; 1220 ULONG ContextSwitches; 1221 ULONG FirstLevelTbFills; 1222 ULONG SecondLevelTbFills; 1223 ULONG SystemCalls; 1224 } SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION; 1225 1226 typedef struct _SYSTEM_TIME_OF_DAY_INFORMATION 1227 { 1228 LARGE_INTEGER BootTime; 1229 LARGE_INTEGER CurrentTime; 1230 LARGE_INTEGER TimeZoneBias; 1231 ULONG CurrentTimeZoneId; 1232 } SYSTEM_TIME_OF_DAY_INFORMATION, *PSYSTEM_TIME_OF_DAY_INFORMATION; 1233 1234 typedef struct _VM_COUNTERS 1235 { 1236 ULONG PeakVirtualSize; 1237 ULONG VirtualSize; 1238 ULONG PageFaultCount; 1239 ULONG PeakWorkingSetSize; 1240 ULONG WorkingSetSize; 1241 ULONG QuotaPeakPagedPoolUsage; 1242 ULONG QuotaPagedPoolUsage; 1243 ULONG QuotaPeakNonPagedPoolUsage; 1244 ULONG QuotaNonPagedPoolUsage; 1245 ULONG PagefileUsage; 1246 ULONG PeakPagefileUsage; 1247 ULONG PrivatePageCount; 1248 } VM_COUNTERS; 1249 1250 typedef struct _SYSTEM_THREADS 1251 { 1252 LARGE_INTEGER KernelTime; 1253 LARGE_INTEGER UserTime; 1254 LARGE_INTEGER CreateTime; 1255 ULONG WaitTime; 1256 PVOID StartAddress; 1257 CLIENT_ID ClientId; 1258 KPRIORITY Priority; 1259 KPRIORITY BasePriority; 1260 ULONG ContextSwitchCount; 1261 THREAD_STATE State; 1262 KWAIT_REASON WaitReason; 1263 ULONG Reversed; 1264 } SYSTEM_THREADS, *PSYSTEM_THREADS; 1265 1266 typedef struct _SYSTEM_PROCESSES 1267 { 1268 ULONG NextEntryDelta; 1269 ULONG ThreadCount; 1270 LARGE_INTEGER Reserved1[3]; 1271 LARGE_INTEGER CreateTime; 1272 LARGE_INTEGER UserTime; 1273 LARGE_INTEGER KernelTime; 1274 UNICODE_STRING ProcessName; 1275 KPRIORITY BasePriority; 1276 ULONG ProcessId; 1277 ULONG InheritedFromProcessId; 1278 ULONG HandleCount; 1279 ULONG SessionId; 1280 ULONG_PTR PageDirectoryBase; 1281 VM_COUNTERS VmCounters; 1282 ULONG PrivatePageCount; 1283 IO_COUNTERS IoCounters; 1284 SYSTEM_THREADS Threads[1]; 1285 } SYSTEM_PROCESSES, *PSYSTEM_PROCESSES; 1286 1287 typedef struct _SYSTEM_CALLS_INFORMATION 1288 { 1289 ULONG Size; 1290 ULONG NumberOfDescriptorTables; 1291 ULONG NumberOfRoutinesInTable[1]; 1292 ULONG CallCounts[ANYSIZE_ARRAY]; 1293 } SYSTEM_CALLS_INFORMATION, *PSYSTEM_CALLS_INFORMATION; 1294 1295 typedef struct _SYSTEM_CONFIGURATION_INFORMATION 1296 { 1297 ULONG DiskCount; 1298 ULONG FloppyCount; 1299 ULONG CdRomCount; 1300 ULONG TapeCount; 1301 ULONG SerialCount; 1302 ULONG ParallelCount; 1303 } SYSTEM_CONFIGURATION_INFORMATION, *PSYSTEM_CONFIGURATION_INFORMATION; 1304 1305 typedef struct _SYSTEM_PROCESSOR_TIMES 1306 { 1307 LARGE_INTEGER IdleTime; 1308 LARGE_INTEGER KernelTime; 1309 LARGE_INTEGER UserTime; 1310 LARGE_INTEGER DpcTime; 1311 LARGE_INTEGER InterruptTime; 1312 ULONG InterruptCount; 1313 } SYSTEM_PROCESSOR_TIMES, *PSYSTEM_PROCESSOR_TIMES; 1314 1315 typedef struct _SYSTEM_GLOBAL_FLAG 1316 { 1317 ULONG GlobalFlag; 1318 } SYSTEM_GLOBAL_FLAG, *PSYSTEM_GLOBAL_FLAG; 1319 1320 typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY 1321 { 1322 HANDLE Section; 1323 PVOID MappedBase; 1324 PVOID Base; 1325 ULONG Size; 1326 ULONG Flags; 1327 USHORT LoadOrderIndex; 1328 USHORT InitOrderIndex; 1329 USHORT LoadCount; 1330 USHORT PathLength; 1331 CHAR ImageName[256]; 1332 } SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY; 1333 1334 typedef struct _SYSTEM_MODULE 1335 { 1336 HANDLE Section; 1337 PVOID MappedBase; 1338 PVOID ImageBase; 1339 ULONG ImageSize; 1340 ULONG Flags; 1341 USHORT LoadOrderIndex; 1342 USHORT InitOrderIndex; 1343 USHORT LoadCount; 1344 USHORT OffsetToFileName; 1345 CHAR ImageName[256]; 1346 } SYSTEM_MODULE, *PSYSTEM_MODULE; 1347 1348 typedef struct _SYSTEM_MODULE_INFORMATION 1349 { 1350 ULONG ModulesCount; 1351 SYSTEM_MODULE Modules[1]; 1352 } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; 1353 1354 typedef struct _SYSTEM_LOCK_INFORMATION 1355 { 1356 PVOID Address; 1357 USHORT Type; 1358 USHORT Reserved1; 1359 ULONG ExclusiveOwnerThreadId; 1360 ULONG ActiveCount; 1361 ULONG ContentionCount; 1362 ULONG Reserved2[2]; 1363 ULONG NumberOfSharedWaiters; 1364 ULONG NumberOfExclusiveWaiters; 1365 } SYSTEM_LOCK_INFORMATION, *PSYSTEM_LOCK_INFORMATION; 1366 1367 typedef struct _SYSTEM_HANDLE_INFORMATION 1368 { 1369 ULONG ProcessId; 1370 UCHAR ObjectTypeNumber; 1371 UCHAR Flags; 1372 USHORT Handle; 1373 PVOID Object; 1374 ACCESS_MASK GrantedAccess; 1375 } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; 1376 1377 typedef struct _SYSTEM_OBJECT_TYPE_INFORMATION 1378 { 1379 ULONG NextEntryOffset; 1380 ULONG ObjectCount; 1381 ULONG HandleCount; 1382 ULONG TypeNumber; 1383 ULONG InvalidAttributes; 1384 GENERIC_MAPPING GenericMapping; 1385 ACCESS_MASK ValidAccessMask; 1386 POOL_TYPE PoolType; 1387 UCHAR Unknown; 1388 UNICODE_STRING Name; 1389 } SYSTEM_OBJECT_TYPE_INFORMATION, *PSYSTEM_OBJECT_TYPE_INFORMATION; 1390 1391 typedef struct _SYSTEM_OBJECT_INFORMATION 1392 { 1393 ULONG NextEntryOffset; 1394 PVOID Object; 1395 ULONG CreatorProcessId; 1396 USHORT Unknown; 1397 USHORT Flags; 1398 ULONG PointerCount; 1399 ULONG HandleCount; 1400 ULONG PagedPoolUsage; 1401 ULONG NonPagedPoolUsage; 1402 ULONG ExclusiveProcessId; 1403 PSECURITY_DESCRIPTOR SecurityDescriptor; 1404 UNICODE_STRING Name; 1405 } SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION; 1406 1407 typedef struct _SYSTEM_PAGEFILE_INFORMATION 1408 { 1409 ULONG NextEntryOffset; 1410 ULONG CurrentSize; 1411 ULONG TotalUsed; 1412 ULONG PeakUsed; 1413 UNICODE_STRING FileName; 1414 } SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION; 1415 1416 typedef struct _SYSTEM_INSTRUCTION_EMULATION_INFORMATION 1417 { 1418 ULONG SegmentNotPresent; 1419 ULONG TwoByteOpcode; 1420 ULONG ESprefix; 1421 ULONG CSprefix; 1422 ULONG SSprefix; 1423 ULONG DSprefix; 1424 ULONG FSPrefix; 1425 ULONG GSprefix; 1426 ULONG OPER32prefix; 1427 ULONG ADDR32prefix; 1428 ULONG INSB; 1429 ULONG INSW; 1430 ULONG OUTSB; 1431 ULONG OUTSW; 1432 ULONG PUSHFD; 1433 ULONG POPFD; 1434 ULONG INTnn; 1435 ULONG INTO; 1436 ULONG IRETD; 1437 ULONG INBimm; 1438 ULONG INWimm; 1439 ULONG OUTBimm; 1440 ULONG OUTWimm; 1441 ULONG INB; 1442 ULONG INW; 1443 ULONG OUTB; 1444 ULONG OUTW; 1445 ULONG LOCKprefix; 1446 ULONG REPNEprefix; 1447 ULONG REPprefix; 1448 ULONG HLT; 1449 ULONG CLI; 1450 ULONG STI; 1451 ULONG GenericInvalidOpcode; 1452 } SYSTEM_INSTRUCTION_EMULATION_INFORMATION, *PSYSTEM_INSTRUCTION_EMULATION_INFORMATION; 1453 1454 typedef struct _SYSTEM_POOL_TAG_INFORMATION 1455 { 1456 CHAR Tag[4]; 1457 ULONG PagedPoolAllocs; 1458 ULONG PagedPoolFrees; 1459 ULONG PagedPoolUsage; 1460 ULONG NonPagedPoolAllocs; 1461 ULONG NonPagedPoolFrees; 1462 ULONG NonPagedPoolUsage; 1463 } SYSTEM_POOL_TAG_INFORMATION, *PSYSTEM_POOL_TAG_INFORMATION; 1464 1465 typedef struct _SYSTEM_PROCESSOR_STATISTICS 1466 { 1467 ULONG ContextSwitches; 1468 ULONG DpcCount; 1469 ULONG DpcRequestRate; 1470 ULONG TimeIncrement; 1471 ULONG DpcBypassCount; 1472 ULONG ApcBypassCount; 1473 } SYSTEM_PROCESSOR_STATISTICS, *PSYSTEM_PROCESSOR_STATISTICS; 1474 1475 typedef struct _SYSTEM_DPC_INFORMATION 1476 { 1477 ULONG Reserved; 1478 ULONG MaximumDpcQueueDepth; 1479 ULONG MinimumDpcRate; 1480 ULONG AdjustDpcThreshold; 1481 ULONG IdealDpcRate; 1482 } SYSTEM_DPC_INFORMATION, *PSYSTEM_DPC_INFORMATION; 1483 1484 typedef struct _SYSTEM_LOAD_IMAGE 1485 { 1486 UNICODE_STRING ModuleName; 1487 PVOID ModuleBase; 1488 PVOID SectionPointer; 1489 PVOID EntryPoint; 1490 PVOID ExportDirectory; 1491 } SYSTEM_LOAD_IMAGE, *PSYSTEM_LOAD_IMAGE; 1492 1493 typedef struct _SYSTEM_UNLOAD_IMAGE 1494 { 1495 PVOID ModuleBase; 1496 } SYSTEM_UNLOAD_IMAGE, *PSYSTEM_UNLOAD_IMAGE; 1497 1498 typedef struct _SYSTEM_QUERY_TIME_ADJUSTMENT 1499 { 1500 ULONG TimeAdjustment; 1501 ULONG MaximumIncrement; 1502 BOOLEAN TimeSynchronization; 1503 } SYSTEM_QUERY_TIME_ADJUSTMENT, *PSYSTEM_QUERY_TIME_ADJUSTMENT; 1504 1505 typedef struct _SYSTEM_SET_TIME_ADJUSTMENT 1506 { 1507 ULONG TimeAdjustment; 1508 BOOLEAN TimeSynchronization; 1509 } SYSTEM_SET_TIME_ADJUSTMENT, *PSYSTEM_SET_TIME_ADJUSTMENT; 1510 1511 typedef struct _SYSTEM_CRASH_DUMP_INFORMATION 1512 { 1513 HANDLE CrashDumpSectionHandle; 1514 HANDLE Unknown; 1515 } SYSTEM_CRASH_DUMP_INFORMATION, *PSYSTEM_CRASH_DUMP_INFORMATION; 1516 1517 typedef struct _SYSTEM_EXCEPTION_INFORMATION 1518 { 1519 ULONG AlignmentFixupCount; 1520 ULONG ExceptionDispatchCount; 1521 ULONG FloatingEmulationCount; 1522 ULONG Reserved; 1523 } SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION; 1524 1525 typedef struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION 1526 { 1527 ULONG CrashDumpSectionExists; 1528 ULONG Unknown; 1529 } SYSTEM_CRASH_DUMP_STATE_INFORMATION, *PSYSTEM_CRASH_DUMP_STATE_INFORMATION; 1530 1531 typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION 1532 { 1533 BOOLEAN KernelDebuggerEnabled; 1534 BOOLEAN KernelDebuggerNotPresent; 1535 } SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION; 1536 1537 typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION 1538 { 1539 ULONG ContextSwitches; 1540 ULONG ContextSwitchCounters[11]; 1541 } SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION; 1542 1543 typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION 1544 { 1545 ULONG RegistryQuotaAllowed; 1546 ULONG RegistryQuotaUsed; 1547 ULONG PagedPoolSize; 1548 } SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION; 1549 1550 typedef struct _SYSTEM_LOAD_AND_CALL_IMAGE 1551 { 1552 UNICODE_STRING ModuleName; 1553 } SYSTEM_LOAD_AND_CALL_IMAGE, *PSYSTEM_LOAD_AND_CALL_IMAGE; 1554 1555 typedef struct _SYSTEM_PRIORITY_SEPARATION 1556 { 1557 ULONG PrioritySeparation; 1558 } SYSTEM_PRIORITY_SEPARATION, *PSYSTEM_PRIORITY_SEPARATION; 1559 1560 typedef struct _SYSTEM_TIME_ZONE_INFORMATION 1561 { 1562 LONG Bias; 1563 WCHAR StandardName[32]; 1564 LARGE_INTEGER StandardDate; 1565 LONG StandardBias; 1566 WCHAR DaylightName[32]; 1567 LARGE_INTEGER DaylightDate; 1568 LONG DaylightBias; 1569 } SYSTEM_TIME_ZONE_INFORMATION, *PSYSTEM_TIME_ZONE_INFORMATION; 1570 1571 typedef struct _SYSTEM_LOOKASIDE_INFORMATION 1572 { 1573 USHORT Depth; 1574 USHORT MaximumDepth; 1575 ULONG TotalAllocates; 1576 ULONG AllocateMisses; 1577 ULONG TotalFrees; 1578 ULONG FreeMisses; 1579 POOL_TYPE Type; 1580 ULONG Tag; 1581 ULONG Size; 1582 } SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION; 1583 1584 typedef struct _SYSTEM_SET_TIME_SLIP_EVENT 1585 { 1586 HANDLE TimeSlipEvent; 1587 } SYSTEM_SET_TIME_SLIP_EVENT, *PSYSTEM_SET_TIME_SLIP_EVENT; 1588 1589 typedef struct _SYSTEM_CREATE_SESSION 1590 { 1591 ULONG SessionId; 1592 } SYSTEM_CREATE_SESSION, *PSYSTEM_CREATE_SESSION; 1593 1594 typedef struct _SYSTEM_DELETE_SESSION 1595 { 1596 ULONG SessionId; 1597 } SYSTEM_DELETE_SESSION, *PSYSTEM_DELETE_SESSION; 1598 1599 typedef struct _SYSTEM_RANGE_START_INFORMATION 1600 { 1601 PVOID SystemRangeStart; 1602 } SYSTEM_RANGE_START_INFORMATION, *PSYSTEM_RANGE_START_INFORMATION; 1603 1604 typedef struct _SYSTEM_SESSION_PROCESSES_INFORMATION 1605 { 1606 ULONG SessionId; 1607 ULONG BufferSize; 1608 PVOID Buffer; 1609 } SYSTEM_SESSION_PROCESSES_INFORMATION, *PSYSTEM_SESSION_PROCESSES_INFORMATION; 1610 1611 typedef struct _SYSTEM_POOL_BLOCK 1612 { 1613 BOOLEAN Allocated; 1614 USHORT Unknown; 1615 ULONG Size; 1616 CHAR Tag[4]; 1617 } SYSTEM_POOL_BLOCK, *PSYSTEM_POOL_BLOCK; 1618 1619 typedef struct _SYSTEM_POOL_BLOCKS_INFORMATION 1620 { 1621 ULONG PoolSize; 1622 PVOID PoolBase; 1623 USHORT Unknown; 1624 ULONG NumberOfBlocks; 1625 SYSTEM_POOL_BLOCK PoolBlocks[1]; 1626 } SYSTEM_POOL_BLOCKS_INFORMATION, *PSYSTEM_POOL_BLOCKS_INFORMATION; 1627 1628 typedef struct _SYSTEM_MEMORY_USAGE 1629 { 1630 PVOID Name; 1631 USHORT Valid; 1632 USHORT Standby; 1633 USHORT Modified; 1634 USHORT PageTables; 1635 } SYSTEM_MEMORY_USAGE, *PSYSTEM_MEMORY_USAGE; 1636 1637 typedef struct _SYSTEM_MEMORY_USAGE_INFORMATION 1638 { 1639 ULONG Reserved; 1640 PVOID EndOfData; 1641 SYSTEM_MEMORY_USAGE MemoryUsage[1]; 1642 } SYSTEM_MEMORY_USAGE_INFORMATION, *PSYSTEM_MEMORY_USAGE_INFORMATION; 1643 1644 typedef struct _SYSDBG_PHYSICAL 1645 { 1646 PHYSICAL_ADDRESS Address; 1647 PVOID Buffer; 1648 ULONG Request; 1649 } SYSDBG_PHYSICAL, *PSYSDBG_PHYSICAL; 1650 1651 typedef struct _SYSDBG_CONTROL_SPACE 1652 { 1653 ULONG64 Address; 1654 PVOID Buffer; 1655 ULONG Request; 1656 ULONG Processor; 1657 } SYSDBG_CONTROL_SPACE, *PSYSDBG_CONTROL_SPACE; 1658 1659 typedef struct _SYSDBG_IO_SPACE 1660 { 1661 ULONG64 Address; 1662 PVOID Buffer; 1663 ULONG Request; 1664 INTERFACE_TYPE InterfaceType; 1665 ULONG BusNumber; 1666 ULONG AddressSpace; 1667 } SYSDBG_IO_SPACE, *PSYSDBG_IO_SPACE; 1668 1669 typedef struct _SYSDBG_MSR 1670 { 1671 ULONG Msr; 1672 ULONG64 Data; 1673 } SYSDBG_MSR, *PSYSDBG_MSR; 1674 1675 typedef struct _SYSDBG_BUS_DATA 1676 { 1677 ULONG Address; 1678 PVOID Buffer; 1679 ULONG Request; 1680 BUS_DATA_TYPE BusDataType; 1681 ULONG BusNumber; 1682 ULONG SlotNumber; 1683 } SYSDBG_BUS_DATA, *PSYSDBG_BUS_DATA; 1684 1685 typedef struct _DBGKD_GET_VERSION 1686 { 1687 USHORT MajorVersion; 1688 USHORT MinorVersion; 1689 USHORT ProtocolVersion; 1690 USHORT Flags; 1691 USHORT MachineType; 1692 UCHAR MaxPacketType; 1693 UCHAR MaxStateChange; 1694 UCHAR MaxManipulate; 1695 UCHAR Simulation; 1696 USHORT Unused[1]; 1697 ULONG64 KernBase; 1698 ULONG64 PsLoadedModuleList; 1699 ULONG64 DebuggerDataList; 1700 } DBGKD_GET_VERSION, *PDBGKD_GET_VERSION; 1701 1702 typedef struct _SYSDBG_VIRTUAL 1703 { 1704 PVOID Address; 1705 PVOID Buffer; 1706 ULONG Request; 1707 } SYSDBG_VIRTUAL, *PSYSDBG_VIRTUAL; 1708 1709 typedef struct _OBJECT_BASIC_INFORMATION 1710 { 1711 ULONG Attributes; 1712 ACCESS_MASK GrantedAccess; 1713 ULONG HandleCount; 1714 ULONG PointerCount; 1715 ULONG PagedPoolCharge; 1716 ULONG NonPagedPoolCharge; 1717 ULONG Reserved[3]; 1718 ULONG NameInfoSize; 1719 ULONG TypeInfoSize; 1720 ULONG SecurityDescriptorSize; 1721 LARGE_INTEGER CreationTime; 1722 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION; 1723 1724 typedef struct _OBJECT_NAME_INFORMATION 1725 { 1726 UNICODE_STRING Name; 1727 } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION; 1728 1729 typedef struct _OBJECT_TYPE_INFORMATION 1730 { 1731 UNICODE_STRING TypeName; 1732 ULONG TotalNumberOfObjects; 1733 ULONG TotalNumberOfHandles; 1734 ULONG TotalPagedPoolUsage; 1735 ULONG TotalNonPagedPoolUsage; 1736 ULONG TotalNamePoolUsage; 1737 ULONG TotalHandleTableUsage; 1738 ULONG HighWaterNumberOfObjects; 1739 ULONG HighWaterNumberOfHandles; 1740 ULONG HighWaterPagedPoolUsage; 1741 ULONG HighWaterNonPagedPoolUsage; 1742 ULONG HighWaterNamePoolUsage; 1743 ULONG HighWaterHandleTableUsage; 1744 ULONG InvalidAttributes; 1745 GENERIC_MAPPING GenericMapping; 1746 ULONG ValidAccessMask; 1747 BOOLEAN SecurityRequired; 1748 BOOLEAN MaintainHandleCount; 1749 POOL_TYPE PoolType; 1750 ULONG DefaultPagedPoolCharge; 1751 ULONG DefaultNonPagedPoolCharge; 1752 } OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION; 1753 1754 typedef struct _OBJECT_ALL_TYPES_INFORMATION 1755 { 1756 ULONG NumberOfTypes; 1757 OBJECT_TYPE_INFORMATION TypeInformation; 1758 } OBJECT_ALL_TYPES_INFORMATION, *POBJECT_ALL_TYPES_INFORMATION; 1759 1760 typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFORMATION 1761 { 1762 BOOLEAN Inherit; 1763 BOOLEAN ProtectFromClose; 1764 } OBJECT_HANDLE_ATTRIBUTE_INFORMATION, *POBJECT_HANDLE_ATTRIBUTE_INFORMATION; 1765 1766 typedef struct _OBJECT_HANDLE_FLAG_INFORMATION 1767 { 1768 BOOLEAN Inherit; 1769 BOOLEAN ProtectFromClose; 1770 } OBJECT_HANDLE_FLAG_INFORMATION, *POBJECT_HANDLE_FLAG_INFORMATION; 1771 1772 typedef struct _OBJECT_DIRECTORY_INFORMATION 1773 { 1774 UNICODE_STRING Name; 1775 UNICODE_STRING TypeName; 1776 } OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION; 1777 1778 typedef struct _DIRECTORY_BASIC_INFORMATION 1779 { 1780 UNICODE_STRING ObjectName; 1781 UNICODE_STRING ObjectTypeName; 1782 } DIRECTORY_BASIC_INFORMATION, *PDIRECTORY_BASIC_INFORMATION; 1783 1784 typedef struct _MEMORY_WORKING_SET_LIST 1785 { 1786 ULONG NumberOfPages; 1787 ULONG WorkingSetList[1]; 1788 } MEMORY_WORKING_SET_LIST, *PMEMORY_WORKING_SET_LIST; 1789 1790 typedef struct _MEMORY_SECTION_NAME 1791 { 1792 UNICODE_STRING SectionFileName; 1793 } MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME; 1794 1795 typedef struct _USER_STACK 1796 { 1797 PVOID FixedStackBase; 1798 PVOID FixedStackLimit; 1799 PVOID ExpandableStackBase; 1800 PVOID ExpandableStackLimit; 1801 PVOID ExpandableStackBottom; 1802 } USER_STACK, *PUSER_STACK; 1803 1804 typedef struct _THREAD_BASIC_INFORMATION 1805 { 1806 NTSTATUS ExitStatus; 1807 PNT_TIB TebBaseAddress; 1808 CLIENT_ID ClientId; 1809 KAFFINITY AffinityMask; 1810 KPRIORITY Priority; 1811 KPRIORITY BasePriority; 1812 } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION; 1813 1814 typedef struct _KERNEL_USER_TIMES 1815 { 1816 LARGE_INTEGER CreateTime; 1817 LARGE_INTEGER ExitTime; 1818 LARGE_INTEGER KernelTime; 1819 LARGE_INTEGER UserTime; 1820 } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES; 1821 1822 typedef struct _PROCESS_ACCESS_TOKEN 1823 { 1824 HANDLE Token; 1825 HANDLE Thread; 1826 } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN; 1827 1828 typedef struct _POOLED_USAGE_AND_LIMITS 1829 { 1830 ULONG PeakPagedPoolUsage; 1831 ULONG PagedPoolUsage; 1832 ULONG PagedPoolLimit; 1833 ULONG PeakNonPagedPoolUsage; 1834 ULONG NonPagedPoolUsage; 1835 ULONG NonPagedPoolLimit; 1836 ULONG PeakPagefileUsage; 1837 ULONG PagefileUsage; 1838 ULONG PagefileLimit; 1839 } POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS; 1840 1841 typedef struct _PROCESS_WS_WATCH_INFORMATION 1842 { 1843 PVOID FaultingPc; 1844 PVOID FaultingVa; 1845 } PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION; 1846 1847 typedef struct _PROCESS_PRIORITY_CLASS 1848 { 1849 BOOLEAN Foreground; 1850 UCHAR PriorityClass; 1851 } PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS; 1852 1853 typedef struct _PROCESS_DEVICEMAP_INFORMATION 1854 { 1855 union 1856 { 1857 struct 1858 { 1859 HANDLE DirectoryHandle; 1860 } Set; 1861 struct 1862 { 1863 ULONG DriveMap; 1864 UCHAR DriveType[32]; 1865 } Query; 1866 }; 1867 } PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION; 1868 1869 typedef struct _PROCESS_SESSION_INFORMATION 1870 { 1871 ULONG SessionId; 1872 } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION; 1873 1874 typedef struct _DEBUG_BUFFER 1875 { 1876 HANDLE SectionHandle; 1877 PVOID SectionBase; 1878 PVOID RemoteSectionBase; 1879 ULONG SectionBaseDelta; 1880 HANDLE EventPairHandle; 1881 ULONG Unknown[2]; 1882 HANDLE RemoteThreadHandle; 1883 ULONG InfoClassMask; 1884 ULONG SizeOfInfo; 1885 ULONG AllocatedSize; 1886 ULONG SectionSize; 1887 PVOID ModuleInformation; 1888 PVOID BackTraceInformation; 1889 PVOID HeapInformation; 1890 PVOID LockInformation; 1891 PVOID Reserved[8]; 1892 } DEBUG_BUFFER, *PDEBUG_BUFFER; 1893 1894 typedef struct _DEBUG_MODULE_INFORMATION 1895 { 1896 ULONG Reserved[2]; 1897 ULONG Base; 1898 ULONG Size; 1899 ULONG Flags; 1900 USHORT Index; 1901 USHORT Unknown; 1902 USHORT LoadCount; 1903 USHORT ModuleNameOffset; 1904 CHAR ImageName[256]; 1905 } DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION; 1906 1907 typedef struct _DEBUG_HEAP_INFORMATION 1908 { 1909 ULONG Base; 1910 ULONG Flags; 1911 USHORT Granularity; 1912 USHORT Unknown; 1913 ULONG Allocated; 1914 ULONG Committed; 1915 ULONG TagCount; 1916 ULONG BlockCount; 1917 ULONG Reserved[7]; 1918 PVOID Tags; 1919 PVOID Blocks; 1920 } DEBUG_HEAP_INFORMATION, *PDEBUG_HEAP_INFORMATION; 1921 1922 typedef struct _DEBUG_LOCK_INFORMATION 1923 { 1924 PVOID Address; 1925 USHORT Type; 1926 USHORT CreatorBackTraceIndex; 1927 ULONG OwnerThreadId; 1928 ULONG ActiveCount; 1929 ULONG ContentionCount; 1930 ULONG EntryCount; 1931 ULONG RecursionCount; 1932 ULONG NumberOfSharedWaiters; 1933 ULONG NumberOfExclusiveWaiters; 1934 } DEBUG_LOCK_INFORMATION, *PDEBUG_LOCK_INFORMATION; 1935 1936 typedef struct _LPC_MESSAGE 1937 { 1938 USHORT DataSize; 1939 USHORT MessageSize; 1940 USHORT MessageType; 1941 USHORT VirtualRangesOffset; 1942 CLIENT_ID ClientId; 1943 ULONG MessageId; 1944 ULONG SectionSize; 1945 UCHAR Data[ANYSIZE_ARRAY]; 1946 } LPC_MESSAGE, *PLPC_MESSAGE; 1947 1948 typedef struct _LPC_SECTION_WRITE 1949 { 1950 ULONG Length; 1951 HANDLE SectionHandle; 1952 ULONG SectionOffset; 1953 ULONG ViewSize; 1954 PVOID ViewBase; 1955 PVOID TargetViewBase; 1956 } LPC_SECTION_WRITE, *PLPC_SECTION_WRITE; 1957 1958 typedef struct _LPC_SECTION_READ 1959 { 1960 ULONG Length; 1961 ULONG ViewSize; 1962 PVOID ViewBase; 1963 } LPC_SECTION_READ, *PLPC_SECTION_READ; 1964 1965 typedef struct _KEY_LAST_WRITE_TIME_INFORMATION 1966 { 1967 LARGE_INTEGER LastWriteTime; 1968 } KEY_LAST_WRITE_TIME_INFORMATION, *PKEY_LAST_WRITE_TIME_INFORMATION; 1969 1970 typedef struct _KEY_NAME_INFORMATION 1971 { 1972 ULONG NameLength; 1973 WCHAR Name[1]; 1974 } KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION; 1975 1976 typedef struct _ATOM_BASIC_INFORMATION 1977 { 1978 USHORT ReferenceCount; 1979 USHORT Pinned; 1980 USHORT NameLength; 1981 WCHAR Name[1]; 1982 } ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION; 1983 1984 typedef struct _ATOM_LIST_INFORMATION 1985 { 1986 ULONG NumberOfAtoms; 1987 ATOM Atoms[1]; 1988 } ATOM_LIST_INFORMATION, *PATOM_LIST_INFORMATION; 1989 1990 typedef struct _RTL_SPLAY_LINKS 1991 { 1992 struct _RTL_SPLAY_LINKS *Parent; 1993 struct _RTL_SPLAY_LINKS *LeftChild; 1994 struct _RTL_SPLAY_LINKS *RightChild; 1995 } RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS; 1996 1997 typedef struct _RTL_HANDLE_TABLE_ENTRY 1998 { 1999 struct _RTL_HANDLE_TABLE_ENTRY *Next; 2000 PVOID Object; 2001 } RTL_HANDLE_TABLE_ENTRY, *PRTL_HANDLE_TABLE_ENTRY; 2002 2003 typedef struct _RTL_HANDLE_TABLE 2004 { 2005 ULONG MaximumNumberOfHandles; 2006 ULONG SizeOfHandleTableEntry; 2007 ULONG Unknown01; 2008 ULONG Unknown02; 2009 PRTL_HANDLE_TABLE_ENTRY FreeHandles; 2010 PRTL_HANDLE_TABLE_ENTRY CommittedHandles; 2011 PRTL_HANDLE_TABLE_ENTRY UnCommittedHandles; 2012 PRTL_HANDLE_TABLE_ENTRY MaxReservedHandles; 2013 } RTL_HANDLE_TABLE, *PRTL_HANDLE_TABLE; 2014 2015 typedef struct _KEY_BASIC_INFORMATION 2016 { 2017 LARGE_INTEGER LastWriteTime; 2018 ULONG TitleIndex; 2019 ULONG NameLength; 2020 WCHAR Name[1]; 2021 } KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION; 2022 2023 typedef struct _KEY_NODE_INFORMATION 2024 { 2025 LARGE_INTEGER LastWriteTime; 2026 ULONG TitleIndex; 2027 ULONG ClassOffset; 2028 ULONG ClassLength; 2029 ULONG NameLength; 2030 WCHAR Name[1]; 2031 } KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION; 2032 2033 typedef struct _KEY_FULL_INFORMATION 2034 { 2035 LARGE_INTEGER LastWriteTime; 2036 ULONG TitleIndex; 2037 ULONG ClassOffset; 2038 ULONG ClassLength; 2039 ULONG SubKeys; 2040 ULONG MaxNameLen; 2041 ULONG MaxClassLen; 2042 ULONG Values; 2043 ULONG MaxValueNameLen; 2044 ULONG MaxValueDataLen; 2045 WCHAR Class[1]; 2046 } KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION; 2047 2048 typedef struct _KEY_CACHED_INFORMATION 2049 { 2050 LARGE_INTEGER LastWriteTime; 2051 ULONG TitleIndex; 2052 ULONG SubKeys; 2053 ULONG MaxNameLen; 2054 ULONG Values; 2055 ULONG MaxValueNameLen; 2056 ULONG MaxValueDataLen; 2057 ULONG NameLength; 2058 WCHAR Name[1]; 2059 } KEY_CACHED_INFORMATION, *PKEY_CACHED_INFORMATION; 2060 2061 typedef struct _KEY_FLAGS_INFORMATION 2062 { 2063 ULONG UserFlags; 2064 } KEY_FLAGS_INFORMATION, *PKEY_FLAGS_INFORMATION; 2065 2066 typedef struct _KEY_VALUE_BASIC_INFORMATION 2067 { 2068 ULONG TitleIndex; 2069 ULONG Type; 2070 ULONG NameLength; 2071 WCHAR Name[1]; 2072 } KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION; 2073 2074 typedef struct _KEY_VALUE_FULL_INFORMATION 2075 { 2076 ULONG TitleIndex; 2077 ULONG Type; 2078 ULONG DataOffset; 2079 ULONG DataLength; 2080 ULONG NameLength; 2081 WCHAR Name[1]; 2082 } KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION; 2083 2084 typedef struct _KEY_VALUE_PARTIAL_INFORMATION 2085 { 2086 ULONG TitleIndex; 2087 ULONG Type; 2088 ULONG DataLength; 2089 UCHAR Data[1]; 2090 } KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION; 2091 2092 typedef struct _SYSTEM_TIMEOFDAY_INFORMATION 2093 { 2094 LARGE_INTEGER BootTime; 2095 LARGE_INTEGER CurrentTime; 2096 LARGE_INTEGER TimeZoneBias; 2097 ULONG TimeZoneId; 2098 ULONG Reserved; 2099 } SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION; 2100 2101 typedef struct _SYSTEM_PROCESS_INFORMATION 2102 { 2103 ULONG NextEntryOffset; 2104 ULONG NumberOfThreads; 2105 LARGE_INTEGER SpareLi1; 2106 LARGE_INTEGER SpareLi2; 2107 LARGE_INTEGER SpareLi3; 2108 LARGE_INTEGER CreateTime; 2109 LARGE_INTEGER UserTime; 2110 LARGE_INTEGER KernelTime; 2111 UNICODE_STRING ImageName; 2112 KPRIORITY BasePriority; 2113 ULONG_PTR UniqueProcessId; 2114 ULONG_PTR InheritedFromUniqueProcessId; 2115 ULONG HandleCount; 2116 } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION; 2117 2118 typedef struct _SYSTEM_DEVICE_INFORMATION 2119 { 2120 ULONG NumberOfDisks; 2121 ULONG NumberOfFloppies; 2122 ULONG NumberOfCdRoms; 2123 ULONG NumberOfTapes; 2124 ULONG NumberOfSerialPorts; 2125 ULONG NumberOfParallelPorts; 2126 } SYSTEM_DEVICE_INFORMATION, *PSYSTEM_DEVICE_INFORMATION; 2127 2128 typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION 2129 { 2130 LARGE_INTEGER IdleTime; 2131 LARGE_INTEGER KernelTime; 2132 LARGE_INTEGER UserTime; 2133 LARGE_INTEGER DpcTime; 2134 LARGE_INTEGER InterruptTime; 2135 ULONG InterruptCount; 2136 } SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION; 2137 2138 typedef struct _SYSTEM_FLAGS_INFORMATION 2139 { 2140 ULONG GlobalFlag; 2141 } SYSTEM_FLAGS_INFORMATION, *PSYSTEM_FLAGS_INFORMATION; 2142 2143 typedef struct _SYSTEM_VDM_INSTEMUL_INFO 2144 { 2145 ULONG SegmentNotPresent; 2146 ULONG VdmOpcode0F; 2147 ULONG OpcodeESPrefix; 2148 ULONG OpcodeCSPrefix; 2149 ULONG OpcodeSSPrefix; 2150 ULONG OpcodeDSPrefix; 2151 ULONG OpcodeFSPrefix; 2152 ULONG OpcodeGSPrefix; 2153 ULONG OpcodeOPER32Prefix; 2154 ULONG OpcodeADDR32Prefix; 2155 ULONG OpcodeINSB; 2156 ULONG OpcodeINSW; 2157 ULONG OpcodeOUTSB; 2158 ULONG OpcodeOUTSW; 2159 ULONG OpcodePUSHF; 2160 ULONG OpcodePOPF; 2161 ULONG OpcodeINTnn; 2162 ULONG OpcodeINTO; 2163 ULONG OpcodeIRET; 2164 ULONG OpcodeINBimm; 2165 ULONG OpcodeINWimm; 2166 ULONG OpcodeOUTBimm; 2167 ULONG OpcodeOUTWimm; 2168 ULONG OpcodeINB; 2169 ULONG OpcodeINW; 2170 ULONG OpcodeOUTB; 2171 ULONG OpcodeOUTW; 2172 ULONG OpcodeLOCKPrefix; 2173 ULONG OpcodeREPNEPrefix; 2174 ULONG OpcodeREPPrefix; 2175 ULONG OpcodeHLT; 2176 ULONG OpcodeCLI; 2177 ULONG OpcodeSTI; 2178 ULONG BopCount; 2179 } SYSTEM_VDM_INSTEMUL_INFO, *PSYSTEM_VDM_INSTEMUL_INFO; 2180 2181 typedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION 2182 { 2183 ULONG TimeAdjustment; 2184 ULONG TimeIncrement; 2185 BOOLEAN Enable; 2186 } SYSTEM_QUERY_TIME_ADJUST_INFORMATION, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION; 2187 2188 typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION 2189 { 2190 ULONG TimeAdjustment; 2191 BOOLEAN Enable; 2192 } SYSTEM_SET_TIME_ADJUST_INFORMATION, *PSYSTEM_SET_TIME_ADJUST_INFORMATION; 2193 2194 typedef struct _SYSTEM_THREAD_INFORMATION 2195 { 2196 LARGE_INTEGER KernelTime; 2197 LARGE_INTEGER UserTime; 2198 LARGE_INTEGER CreateTime; 2199 ULONG WaitTime; 2200 PVOID StartAddress; 2201 CLIENT_ID ClientId; 2202 KPRIORITY Priority; 2203 LONG BasePriority; 2204 ULONG ContextSwitches; 2205 ULONG ThreadState; 2206 ULONG WaitReason; 2207 } SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION; 2208 2209 typedef struct _SYSTEM_MEMORY_INFO 2210 { 2211 PUCHAR StringOffset; 2212 USHORT ValidCount; 2213 USHORT TransitionCount; 2214 USHORT ModifiedCount; 2215 USHORT PageTableCount; 2216 } SYSTEM_MEMORY_INFO, *PSYSTEM_MEMORY_INFO; 2217 2218 typedef struct _SYSTEM_MEMORY_INFORMATION 2219 { 2220 ULONG InfoSize; 2221 ULONG StringStart; 2222 SYSTEM_MEMORY_INFO Memory[1]; 2223 } SYSTEM_MEMORY_INFORMATION, *PSYSTEM_MEMORY_INFORMATION; 2224 2225 typedef struct _SYSTEM_CRASH_STATE_INFORMATION 2226 { 2227 ULONG ValidCrashDump; 2228 } SYSTEM_CRASH_STATE_INFORMATION, *PSYSTEM_CRASH_STATE_INFORMATION; 2229 2230 typedef struct _SYSTEM_GDI_DRIVER_INFORMATION 2231 { 2232 UNICODE_STRING DriverName; 2233 PVOID ImageAddress; 2234 PVOID SectionPointer; 2235 PVOID EntryPoint; 2236 PIMAGE_EXPORT_DIRECTORY ExportSectionPointer; 2237 ULONG ImageLength; 2238 } SYSTEM_GDI_DRIVER_INFORMATION, *PSYSTEM_GDI_DRIVER_INFORMATION; 2239 2240 typedef struct _SYSTEM_BOOT_ENVIRONMENT_INFORMATION 2241 { 2242 GUID CurrentBootGuid; 2243 ULONG Unknown; 2244 } SYSTEM_BOOT_ENVIRONMENT_INFORMATION, *PSYSTEM_BOOT_ENVIRONMENT_INFORMATION; 2245 2246 typedef struct _FILE_DIRECTORY_INFORMATION 2247 { 2248 ULONG NextEntryOffset; 2249 ULONG FileIndex; 2250 LARGE_INTEGER CreationTime; 2251 LARGE_INTEGER LastAccessTime; 2252 LARGE_INTEGER LastWriteTime; 2253 LARGE_INTEGER ChangeTime; 2254 LARGE_INTEGER EndOfFile; 2255 LARGE_INTEGER AllocationSize; 2256 ULONG FileAttributes; 2257 ULONG FileNameLength; 2258 WCHAR FileName[1]; 2259 } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION; 2260 2261 typedef struct _FILE_FULL_DIR_INFORMATION 2262 { 2263 ULONG NextEntryOffset; 2264 ULONG FileIndex; 2265 LARGE_INTEGER CreationTime; 2266 LARGE_INTEGER LastAccessTime; 2267 LARGE_INTEGER LastWriteTime; 2268 LARGE_INTEGER ChangeTime; 2269 LARGE_INTEGER EndOfFile; 2270 LARGE_INTEGER AllocationSize; 2271 ULONG FileAttributes; 2272 ULONG FileNameLength; 2273 ULONG EaSize; 2274 WCHAR FileName[1]; 2275 } FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION; 2276 2277 typedef struct _FILE_BOTH_DIR_INFORMATION 2278 { 2279 ULONG NextEntryOffset; 2280 ULONG FileIndex; 2281 LARGE_INTEGER CreationTime; 2282 LARGE_INTEGER LastAccessTime; 2283 LARGE_INTEGER LastWriteTime; 2284 LARGE_INTEGER ChangeTime; 2285 LARGE_INTEGER EndOfFile; 2286 LARGE_INTEGER AllocationSize; 2287 ULONG FileAttributes; 2288 ULONG FileNameLength; 2289 ULONG EaSize; 2290 CCHAR ShortNameLength; 2291 WCHAR ShortName[12]; 2292 WCHAR FileName[1]; 2293 } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION; 2294 2295 typedef struct _FILE_BASIC_INFORMATION 2296 { 2297 LARGE_INTEGER CreationTime; 2298 LARGE_INTEGER LastAccessTime; 2299 LARGE_INTEGER LastWriteTime; 2300 LARGE_INTEGER ChangeTime; 2301 ULONG FileAttributes; 2302 } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION; 2303 2304 typedef struct _FILE_STANDARD_INFORMATION 2305 { 2306 LARGE_INTEGER AllocationSize; 2307 LARGE_INTEGER EndOfFile; 2308 ULONG NumberOfLinks; 2309 BOOLEAN DeletePending; 2310 BOOLEAN Directory; 2311 } FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION; 2312 2313 typedef struct _FILE_INTERNAL_INFORMATION 2314 { 2315 LARGE_INTEGER IndexNumber; 2316 } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION; 2317 2318 typedef struct _FILE_EA_INFORMATION 2319 { 2320 ULONG EaSize; 2321 } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION; 2322 2323 typedef struct _FILE_ACCESS_INFORMATION 2324 { 2325 ACCESS_MASK AccessFlags; 2326 } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION; 2327 2328 typedef struct _FILE_NAME_INFORMATION 2329 { 2330 ULONG FileNameLength; 2331 WCHAR FileName[1]; 2332 } FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION; 2333 2334 typedef struct _FILE_RENAME_INFORMATION 2335 { 2336 BOOLEAN ReplaceIfExists; 2337 HANDLE RootDirectory; 2338 ULONG FileNameLength; 2339 WCHAR FileName[1]; 2340 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION; 2341 2342 typedef struct _FILE_NAMES_INFORMATION 2343 { 2344 ULONG NextEntryOffset; 2345 ULONG FileIndex; 2346 ULONG FileNameLength; 2347 WCHAR FileName[1]; 2348 } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION; 2349 2350 typedef struct _FILE_DISPOSITION_INFORMATION 2351 { 2352 BOOLEAN DeleteFile; 2353 } FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION; 2354 2355 typedef struct _FILE_POSITION_INFORMATION 2356 { 2357 LARGE_INTEGER CurrentByteOffset; 2358 } FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION; 2359 2360 typedef struct _FILE_FULL_EA_INFORMATION 2361 { 2362 ULONG NextEntryOffset; 2363 UCHAR Flags; 2364 UCHAR EaNameLength; 2365 USHORT EaValueLength; 2366 CHAR EaName[1]; 2367 } FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION; 2368 2369 typedef struct _FILE_MODE_INFORMATION 2370 { 2371 ULONG Mode; 2372 } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION; 2373 2374 typedef struct _FILE_ALIGNMENT_INFORMATION 2375 { 2376 ULONG AlignmentRequirement; 2377 } FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION; 2378 2379 typedef struct _FILE_ALL_INFORMATION 2380 { 2381 FILE_BASIC_INFORMATION BasicInformation; 2382 FILE_STANDARD_INFORMATION StandardInformation; 2383 FILE_INTERNAL_INFORMATION InternalInformation; 2384 FILE_EA_INFORMATION EaInformation; 2385 FILE_ACCESS_INFORMATION AccessInformation; 2386 FILE_POSITION_INFORMATION PositionInformation; 2387 FILE_MODE_INFORMATION ModeInformation; 2388 FILE_ALIGNMENT_INFORMATION AlignmentInformation; 2389 FILE_NAME_INFORMATION NameInformation; 2390 } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION; 2391 2392 typedef struct _FILE_ALLOCATION_INFORMATION 2393 { 2394 LARGE_INTEGER AllocationSize; 2395 } FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION; 2396 2397 typedef struct _FILE_END_OF_FILE_INFORMATION 2398 { 2399 LARGE_INTEGER EndOfFile; 2400 } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION; 2401 2402 typedef struct _FILE_STREAM_INFORMATION 2403 { 2404 ULONG NextEntryOffset; 2405 ULONG StreamNameLength; 2406 LARGE_INTEGER StreamSize; 2407 LARGE_INTEGER StreamAllocationSize; 2408 WCHAR StreamName[1]; 2409 } FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION; 2410 2411 typedef struct _FILE_PIPE_INFORMATION 2412 { 2413 ULONG ReadMode; 2414 ULONG CompletionMode; 2415 } FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION; 2416 2417 typedef struct _FILE_PIPE_LOCAL_INFORMATION 2418 { 2419 ULONG NamedPipeType; 2420 ULONG NamedPipeConfiguration; 2421 ULONG MaximumInstances; 2422 ULONG CurrentInstances; 2423 ULONG InboundQuota; 2424 ULONG ReadDataAvailable; 2425 ULONG OutboundQuota; 2426 ULONG WriteQuotaAvailable; 2427 ULONG NamedPipeState; 2428 ULONG NamedPipeEnd; 2429 } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION; 2430 2431 typedef struct _FILE_PIPE_REMOTE_INFORMATION 2432 { 2433 LARGE_INTEGER CollectDataTime; 2434 ULONG MaximumCollectionCount; 2435 } FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION; 2436 2437 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION 2438 { 2439 ULONG MaximumMessageSize; 2440 ULONG MailslotQuota; 2441 ULONG NextMessageSize; 2442 ULONG MessagesAvailable; 2443 LARGE_INTEGER ReadTimeout; 2444 } FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION; 2445 2446 typedef struct _FILE_MAILSLOT_SET_INFORMATION 2447 { 2448 PLARGE_INTEGER ReadTimeout; 2449 } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION; 2450 2451 typedef struct _FILE_COMPRESSION_INFORMATION 2452 { 2453 LARGE_INTEGER CompressedFileSize; 2454 USHORT CompressionFormat; 2455 UCHAR CompressionUnitShift; 2456 UCHAR ChunkShift; 2457 UCHAR ClusterShift; 2458 UCHAR Reserved[3]; 2459 } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION; 2460 2461 typedef struct _FILE_LINK_INFORMATION 2462 { 2463 BOOLEAN ReplaceIfExists; 2464 HANDLE RootDirectory; 2465 ULONG FileNameLength; 2466 WCHAR FileName[1]; 2467 } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION; 2468 2469 typedef struct _FILE_OBJECTID_INFORMATION 2470 { 2471 LONGLONG FileReference; 2472 UCHAR ObjectId[16]; 2473 union 2474 { 2475 struct 2476 { 2477 UCHAR BirthVolumeId[16]; 2478 UCHAR BirthObjectId[16]; 2479 UCHAR DomainId[16]; 2480 }; 2481 UCHAR ExtendedInfo[48]; 2482 }; 2483 } FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION; 2484 2485 typedef struct _FILE_COMPLETION_INFORMATION 2486 { 2487 HANDLE Port; 2488 PVOID Key; 2489 } FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION; 2490 2491 typedef struct _FILE_MOVE_CLUSTER_INFORMATION 2492 { 2493 ULONG ClusterCount; 2494 HANDLE RootDirectory; 2495 ULONG FileNameLength; 2496 WCHAR FileName[1]; 2497 } FILE_MOVE_CLUSTER_INFORMATION, *PFILE_MOVE_CLUSTER_INFORMATION; 2498 2499 typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION 2500 { 2501 ULONG FileAttributes; 2502 ULONG ReparseTag; 2503 } FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION; 2504 2505 typedef struct _FILE_TRACKING_INFORMATION 2506 { 2507 HANDLE DestinationFile; 2508 ULONG ObjectInformationLength; 2509 CHAR ObjectInformation[1]; 2510 } FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION; 2511 2512 typedef struct _FILE_REPARSE_POINT_INFORMATION 2513 { 2514 LONGLONG FileReference; 2515 ULONG Tag; 2516 } FILE_REPARSE_POINT_INFORMATION, *PFILE_REPARSE_POINT_INFORMATION; 2517 2518 typedef struct _FILE_QUOTA_INFORMATION 2519 { 2520 ULONG NextEntryOffset; 2521 ULONG SidLength; 2522 LARGE_INTEGER ChangeTime; 2523 LARGE_INTEGER QuotaUsed; 2524 LARGE_INTEGER QuotaThreshold; 2525 LARGE_INTEGER QuotaLimit; 2526 SID Sid; 2527 } FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION; 2528 2529 typedef struct _FILE_ID_BOTH_DIR_INFORMATION 2530 { 2531 ULONG NextEntryOffset; 2532 ULONG FileIndex; 2533 LARGE_INTEGER CreationTime; 2534 LARGE_INTEGER LastAccessTime; 2535 LARGE_INTEGER LastWriteTime; 2536 LARGE_INTEGER ChangeTime; 2537 LARGE_INTEGER EndOfFile; 2538 LARGE_INTEGER AllocationSize; 2539 ULONG FileAttributes; 2540 ULONG FileNameLength; 2541 ULONG EaSize; 2542 CCHAR ShortNameLength; 2543 WCHAR ShortName[12]; 2544 LARGE_INTEGER FileId; 2545 WCHAR FileName[1]; 2546 } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION; 2547 2548 typedef struct _FILE_ID_FULL_DIR_INFORMATION 2549 { 2550 ULONG NextEntryOffset; 2551 ULONG FileIndex; 2552 LARGE_INTEGER CreationTime; 2553 LARGE_INTEGER LastAccessTime; 2554 LARGE_INTEGER LastWriteTime; 2555 LARGE_INTEGER ChangeTime; 2556 LARGE_INTEGER EndOfFile; 2557 LARGE_INTEGER AllocationSize; 2558 ULONG FileAttributes; 2559 ULONG FileNameLength; 2560 ULONG EaSize; 2561 LARGE_INTEGER FileId; 2562 WCHAR FileName[1]; 2563 } FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION; 2564 2565 typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION 2566 { 2567 LARGE_INTEGER ValidDataLength; 2568 } FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION; 2569 2570 typedef struct _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION 2571 { 2572 ULONG Flags; 2573 } FILE_IO_COMPLETION_NOTIFICATION_INFORMATION, *PFILE_IO_COMPLETION_NOTIFICATION_INFORMATION; 2574 2575 typedef struct _FILE_PROCESS_IDS_USING_FILE_INFORMATION 2576 { 2577 ULONG NumberOfProcessIdsInList; 2578 ULONG_PTR ProcessIdList[1]; 2579 } FILE_PROCESS_IDS_USING_FILE_INFORMATION, *PFILE_PROCESS_IDS_USING_FILE_INFORMATION; 2580 2581 typedef struct _FILE_IOSTATUSBLOCK_RANGE_INFORMATION 2582 { 2583 PUCHAR IoStatusBlockRange; 2584 ULONG Length; 2585 } FILE_IOSTATUSBLOCK_RANGE_INFORMATION, *PFILE_IOSTATUSBLOCK_RANGE_INFORMATION; 2586 2587 typedef struct _FILE_IO_PRIORITY_HINT_INFORMATION 2588 { 2589 IO_PRIORITY_HINT PriorityHint; 2590 } FILE_IO_PRIORITY_HINT_INFORMATION, *PFILE_IO_PRIORITY_HINT_INFORMATION; 2591 2592 typedef struct _FILE_SFIO_RESERVE_INFORMATION 2593 { 2594 ULONG RequestsPerPeriod; 2595 ULONG Period; 2596 BOOLEAN RetryFailures; 2597 BOOLEAN Discardable; 2598 ULONG RequestSize; 2599 ULONG NumOutstandingRequests; 2600 } FILE_SFIO_RESERVE_INFORMATION, *PFILE_SFIO_RESERVE_INFORMATION; 2601 2602 typedef struct _FILE_SFIO_VOLUME_INFORMATION 2603 { 2604 ULONG MaximumRequestsPerPeriod; 2605 ULONG MinimumPeriod; 2606 ULONG MinimumTransferSize; 2607 } FILE_SFIO_VOLUME_INFORMATION, *PFILE_SFIO_VOLUME_INFORMATION; 2608 2609 typedef struct _FILE_LINK_ENTRY_INFORMATION 2610 { 2611 ULONG NextEntryOffset; 2612 LONGLONG ParentFileId; 2613 ULONG FileNameLength; 2614 WCHAR FileName[1]; 2615 } FILE_LINK_ENTRY_INFORMATION, *PFILE_LINK_ENTRY_INFORMATION; 2616 2617 typedef struct _FILE_LINKS_INFORMATION 2618 { 2619 ULONG BytesNeeded; 2620 ULONG EntriesReturned; 2621 FILE_LINK_ENTRY_INFORMATION Entry; 2622 } FILE_LINKS_INFORMATION, *PFILE_LINKS_INFORMATION; 2623 2624 typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION 2625 { 2626 ULONG NextEntryOffset; 2627 ULONG FileIndex; 2628 LARGE_INTEGER CreationTime; 2629 LARGE_INTEGER LastAccessTime; 2630 LARGE_INTEGER LastWriteTime; 2631 LARGE_INTEGER ChangeTime; 2632 LARGE_INTEGER EndOfFile; 2633 LARGE_INTEGER AllocationSize; 2634 ULONG FileAttributes; 2635 ULONG FileNameLength; 2636 LARGE_INTEGER FileId; 2637 GUID LockingTransactionId; 2638 ULONG TxInfoFlags; 2639 WCHAR FileName[1]; 2640 } FILE_ID_GLOBAL_TX_DIR_INFORMATION, *PFILE_ID_GLOBAL_TX_DIR_INFORMATION; 2641 2642 typedef struct _FILE_IS_REMOTE_DEVICE_INFORMATION 2643 { 2644 BOOLEAN IsRemote; 2645 } FILE_IS_REMOTE_DEVICE_INFORMATION, *PFILE_IS_REMOTE_DEVICE_INFORMATION; 2646 2647 typedef struct _FILE_NUMA_NODE_INFORMATION 2648 { 2649 USHORT NodeNumber; 2650 } FILE_NUMA_NODE_INFORMATION, *PFILE_NUMA_NODE_INFORMATION; 2651 2652 typedef struct _FILE_FS_VOLUME_INFORMATION 2653 { 2654 LARGE_INTEGER VolumeCreationTime; 2655 ULONG VolumeSerialNumber; 2656 ULONG VolumeLabelLength; 2657 BOOLEAN SupportsObjects; 2658 WCHAR VolumeLabel[1]; 2659 } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION; 2660 2661 typedef struct _FILE_FS_LABEL_INFORMATION 2662 { 2663 ULONG VolumeLabelLength; 2664 WCHAR VolumeLabel[1]; 2665 } FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION; 2666 2667 typedef struct _FILE_FS_SIZE_INFORMATION 2668 { 2669 LARGE_INTEGER TotalAllocationUnits; 2670 LARGE_INTEGER AvailableAllocationUnits; 2671 ULONG SectorsPerAllocationUnit; 2672 ULONG BytesPerSector; 2673 } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION; 2674 2675 typedef struct _FILE_FS_DEVICE_INFORMATION 2676 { 2677 DEVICE_TYPE DeviceType; 2678 ULONG Characteristics; 2679 } FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION; 2680 2681 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION 2682 { 2683 ULONG FileSystemAttributes; 2684 LONG MaximumComponentNameLength; 2685 ULONG FileSystemNameLength; 2686 WCHAR FileSystemName[1]; 2687 } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION; 2688 2689 typedef struct _FILE_FS_CONTROL_INFORMATION 2690 { 2691 LARGE_INTEGER FreeSpaceStartFiltering; 2692 LARGE_INTEGER FreeSpaceThreshold; 2693 LARGE_INTEGER FreeSpaceStopFiltering; 2694 LARGE_INTEGER DefaultQuotaThreshold; 2695 LARGE_INTEGER DefaultQuotaLimit; 2696 ULONG FileSystemControlFlags; 2697 } FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION; 2698 2699 typedef struct _FILE_FS_FULL_SIZE_INFORMATION 2700 { 2701 LARGE_INTEGER TotalAllocationUnits; 2702 LARGE_INTEGER CallerAvailableAllocationUnits; 2703 LARGE_INTEGER ActualAvailableAllocationUnits; 2704 ULONG SectorsPerAllocationUnit; 2705 ULONG BytesPerSector; 2706 } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION; 2707 2708 typedef struct _FILE_FS_OBJECTID_INFORMATION 2709 { 2710 UCHAR ObjectId[16]; 2711 UCHAR ExtendedInfo[48]; 2712 } FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION; 2713 2714 typedef struct _FILE_FS_DRIVER_PATH_INFORMATION 2715 { 2716 BOOLEAN DriverInPath; 2717 ULONG DriverNameLength; 2718 WCHAR DriverName[1]; 2719 } FILE_FS_DRIVER_PATH_INFORMATION, *PFILE_FS_DRIVER_PATH_INFORMATION; 2720 2721 typedef struct _FILE_FS_VOLUME_FLAGS_INFORMATION 2722 { 2723 ULONG Flags; 2724 } FILE_FS_VOLUME_FLAGS_INFORMATION, *PFILE_FS_VOLUME_FLAGS_INFORMATION; 2725 2726 typedef struct _SECTION_IMAGE_INFORMATION 2727 { 2728 PVOID TransferAddress; 2729 ULONG ZeroBits; 2730 ULONG_PTR MaximumStackSize; 2731 ULONG_PTR CommittedStackSize; 2732 ULONG SubSystemType; 2733 union _SECTION_IMAGE_INFORMATION_u0 2734 { 2735 struct _SECTION_IMAGE_INFORMATION_s0 2736 { 2737 USHORT SubSystemMinorVersion; 2738 USHORT SubSystemMajorVersion; 2739 }; 2740 ULONG SubSystemVersion; 2741 }; 2742 ULONG GpValue; 2743 USHORT ImageCharacteristics; 2744 USHORT DllCharacteristics; 2745 USHORT Machine; 2746 BOOLEAN ImageContainsCode; 2747 BOOLEAN Spare1; 2748 ULONG LoaderFlags; 2749 ULONG Reserved[2]; 2750 } SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION; 2751 2752 typedef struct _RTL_USER_PROCESS_INFORMATION 2753 { 2754 ULONG Length; 2755 HANDLE ProcessHandle; 2756 HANDLE ThreadHandle; 2757 CLIENT_ID ClientId; 2758 SECTION_IMAGE_INFORMATION ImageInformation; 2759 } RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION; 2760 2761 typedef struct _LDR_DATA_TABLE_ENTRY 2762 { 2763 LIST_ENTRY InLoadOrderLinks; 2764 LIST_ENTRY InMemoryOrderLinks; 2765 LIST_ENTRY InInitializationOrderLinks; 2766 PVOID DllBase; 2767 PVOID EntryPoint; 2768 ULONG SizeOfImage; 2769 UNICODE_STRING FullDllName; 2770 UNICODE_STRING BaseDllName; 2771 ULONG Flags; 2772 USHORT LoadCount; 2773 USHORT TlsIndex; 2774 LIST_ENTRY HashLinks; 2775 PVOID SectionPointer; 2776 ULONG CheckSum; 2777 ULONG TimeDateStamp; 2778 PVOID LoadedImports; 2779 PVOID EntryPointActivationContext; 2780 PVOID PatchInformation; 2781 PVOID Unknown1; 2782 PVOID Unknown2; 2783 PVOID Unknown3; 2784 } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; 2785 2786 typedef struct _PORT_MESSAGE 2787 { 2788 union 2789 { 2790 struct 2791 { 2792 USHORT DataLength; 2793 USHORT TotalLength; 2794 } s1; 2795 ULONG Length; 2796 } u1; 2797 union 2798 { 2799 struct 2800 { 2801 USHORT Type; 2802 USHORT DataInfoOffset; 2803 } s2; 2804 ULONG ZeroInit; 2805 } u2; 2806 union 2807 { 2808 CLIENT_ID ClientId; 2809 double DoNotUseThisField; 2810 }; 2811 ULONG MessageId; 2812 union 2813 { 2814 ULONG_PTR ClientViewSize; 2815 ULONG CallbackId; 2816 }; 2817 } PORT_MESSAGE, *PPORT_MESSAGE; 2818 2819 typedef struct _PORT_VIEW 2820 { 2821 ULONG Length; 2822 HANDLE SectionHandle; 2823 ULONG SectionOffset; 2824 SIZE_T ViewSize; 2825 PVOID ViewBase; 2826 PVOID ViewRemoteBase; 2827 } PORT_VIEW, *PPORT_VIEW; 2828 2829 typedef struct _REMOTE_PORT_VIEW 2830 { 2831 ULONG Length; 2832 SIZE_T ViewSize; 2833 PVOID ViewBase; 2834 } REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW; 2835 2836 typedef struct RTL_HEAP_PARAMETERS 2837 { 2838 ULONG Length; 2839 ULONG SegmentReserve; 2840 ULONG SegmentCommit; 2841 ULONG DeCommitFreeBlockThreshold; 2842 ULONG DeCommitTotalFreeThreshold; 2843 ULONG MaximumAllocationSize; 2844 ULONG VirtualMemoryThreshold; 2845 ULONG InitialCommit; 2846 ULONG InitialReserve; 2847 PVOID CommitRoutine; 2848 ULONG Reserved; 2849 } RTL_HEAP_PARAMETERS, *PRTL_HEAP_PARAMETERS; 2850 2851 typedef struct _EVENT_BASIC_INFORMATION 2852 { 2853 EVENT_TYPE EventType; 2854 LONG EventState; 2855 } EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION; 2856 2857 #pragma endregion 2858 2859 #pragma region TYPEDEF API 2860 2861 typedef VOID(NTAPI *PKNORMAL_ROUTINE)( 2862 IN PVOID NormalContext, 2863 IN PVOID SystemArgument1, 2864 IN PVOID SystemArgument2 2865 ); 2866 2867 typedef VOID(NTAPI *PIO_APC_ROUTINE)( 2868 IN PVOID ApcContext, 2869 IN PIO_STATUS_BLOCK IoStatusBlock, 2870 IN ULONG Reserved 2871 ); 2872 2873 typedef VOID(NTAPI *PIO_APC_ROUTINE)( 2874 IN PVOID ApcContext, 2875 IN PIO_STATUS_BLOCK IoStatusBlock, 2876 IN ULONG Reserved 2877 ); 2878 2879 typedef VOID(NTAPI *PUSER_THREAD_START_ROUTINE)( 2880 IN PVOID ApcArgument1 2881 ); 2882 2883 #pragma endregion 2884 2885 #pragma region DEFINE API 2886 2887 #ifndef WIN64 2888 #define NtCurrentProcess() ((HANDLE)0xFFFFFFFF) 2889 #define NtCurrentThread() ((HANDLE)0xFFFFFFFE) 2890 #else // WIN64 2891 #define NtCurrentProcess() ((HANDLE)0xFFFFFFFFFFFFFFFF) 2892 #define NtCurrentThread() ((HANDLE)0xFFFFFFFFFFFFFFFE) 2893 #endif // WIN64 2894 2895 #define NtCurrentPeb() (PPEB)(NtCurrentTeb()->ProcessEnvironmentBlock) 2896 2897 #define RtlProcessHeap() (HANDLE)(NtCurrentTeb()->ProcessEnvironmentBlock->ProcessHeap) 2898 2899 #define DECLARE_INTERNAL_OBJECT(x) struct _##x; typedef struct _##x *P##x; 2900 2901 #define DECLARE_INTERNAL_OBJECT2(x,y) struct _##x; typedef struct _##x *P##y; 2902 2903 #define InitializeObjectAttributes(p, n, a, r, s) 2904 { 2905 (p)->Length = sizeof( OBJECT_ATTRIBUTES ); 2906 (p)->RootDirectory = r; 2907 (p)->Attributes = a; 2908 (p)->ObjectName = n; 2909 (p)->SecurityDescriptor = s; 2910 (p)->SecurityQualityOfService = NULL; 2911 } 2912 2913 #define InitializeMessageHeader(ph, l, t) 2914 { 2915 (ph)->u1.s1.TotalLength = (USHORT)(l); 2916 (ph)->u1.s1.DataLength = (USHORT)(l - sizeof(PORT_MESSAGE)); 2917 (ph)->u2.s2.Type = (USHORT)(t); 2918 (ph)->u2.s2.DataInfoOffset = 0; 2919 (ph)->ClientId.UniqueProcess = NULL; 2920 (ph)->ClientId.UniqueThread = NULL; 2921 (ph)->MessageId = 0; 2922 (ph)->ClientViewSize = 0; 2923 } 2924 2925 #define RtlInitEmptyUnicodeString(ucStr, buf, bufSize) 2926 { 2927 (ucStr)->Buffer = (buf); 2928 (ucStr)->Length = 0; 2929 (ucStr)->MaximumLength = (USHORT)(bufSize); 2930 } 2931 2932 #define ABSOLUTE_INTERVAL(wait) (wait) 2933 2934 #define RELATIVE_INTERVAL(wait) (-(wait)) 2935 2936 #define NANOSECONDS(nanos) (((signed __int64)(nanos)) / 100L) 2937 2938 #define MICROSECONDS(micros) (((signed __int64)(micros)) * NANOSECONDS(1000L)) 2939 2940 #define MILISECONDS(mili) (((signed __int64)(mili)) * MICROSECONDS(1000L)) 2941 2942 #define SECONDS(seconds) (((signed __int64)(seconds)) * MILISECONDS(1000L)) 2943 2944 #pragma endregion 2945 2946 #pragma region REAL API 2947 2948 BOOLEAN FORCEINLINE IsListEmpty(IN const LIST_ENTRY *ListHead) 2949 { 2950 return (BOOLEAN)(ListHead->Flink == ListHead); 2951 } 2952 2953 FORCEINLINE VOID InitializeListHead(IN PLIST_ENTRY ListHead) 2954 { 2955 ListHead->Flink = ListHead->Blink = ListHead; 2956 } 2957 2958 FORCEINLINE VOID InsertHeadList(IN OUT PLIST_ENTRY ListHead, IN OUT PLIST_ENTRY Entry) 2959 { 2960 PLIST_ENTRY Flink; 2961 Flink = ListHead->Flink; 2962 Entry->Flink = Flink; 2963 Entry->Blink = ListHead; 2964 Flink->Blink = Entry; 2965 ListHead->Flink = Entry; 2966 } 2967 2968 FORCEINLINE VOID InsertTailList(IN OUT PLIST_ENTRY ListHead, IN OUT PLIST_ENTRY Entry) 2969 { 2970 PLIST_ENTRY Blink; 2971 Blink = ListHead->Blink; 2972 Entry->Flink = ListHead; 2973 Entry->Blink = Blink; 2974 Blink->Flink = Entry; 2975 ListHead->Blink = Entry; 2976 } 2977 2978 FORCEINLINE BOOLEAN RemoveEntryList(IN PLIST_ENTRY Entry) 2979 { 2980 PLIST_ENTRY Blink; 2981 PLIST_ENTRY Flink; 2982 Flink = Entry->Flink; 2983 Blink = Entry->Blink; 2984 Blink->Flink = Flink; 2985 Flink->Blink = Blink; 2986 return (BOOLEAN)(Flink == Blink); 2987 } 2988 2989 #pragma endregion 2990 2991 #pragma region NATIVE API 2992 2993 NTSYSAPI NTSTATUS NTAPI NtAcceptConnectPort( 2994 OUT PHANDLE PortHandle, 2995 IN PVOID PortContext OPTIONAL, 2996 IN PPORT_MESSAGE ConnectionRequest, 2997 IN BOOLEAN AcceptConnection, 2998 IN OUT PPORT_VIEW ServerView OPTIONAL, 2999 OUT PREMOTE_PORT_VIEW ClientView OPTIONAL 3000 ); 3001 3002 NTSYSAPI NTSTATUS NTAPI NtAccessCheck( 3003 IN PSECURITY_DESCRIPTOR SecurityDescriptor, 3004 IN HANDLE TokenHandle, 3005 IN ACCESS_MASK DesiredAccess, 3006 IN PGENERIC_MAPPING GenericMapping, 3007 OUT PPRIVILEGE_SET PrivilegeSet, 3008 IN PULONG PrivilegeSetLength, 3009 OUT PACCESS_MASK GrantedAccess, 3010 OUT PBOOLEAN AccessStatus 3011 ); 3012 3013 NTSYSAPI NTSTATUS NTAPI NtAccessCheckAndAuditAlarm( 3014 IN PUNICODE_STRING SubsystemName, 3015 IN PVOID HandleId, 3016 IN PUNICODE_STRING ObjectTypeName, 3017 IN PUNICODE_STRING ObjectName, 3018 IN PSECURITY_DESCRIPTOR SecurityDescriptor, 3019 IN ACCESS_MASK DesiredAccess, 3020 IN PGENERIC_MAPPING GenericMapping, 3021 IN BOOLEAN ObjectCreation, 3022 OUT PACCESS_MASK GrantedAccess, 3023 OUT PBOOLEAN AccessStatus, 3024 OUT PBOOLEAN GenerateOnClose 3025 ); 3026 3027 NTSYSAPI NTSTATUS NTAPI NtAccessCheckByType( 3028 IN PSECURITY_DESCRIPTOR SecurityDescriptor, 3029 IN PSID PrincipalSelfSid, 3030 IN HANDLE TokenHandle, 3031 IN ULONG DesiredAccess, 3032 IN POBJECT_TYPE_LIST ObjectTypeList, 3033 IN ULONG ObjectTypeListLength, 3034 IN PGENERIC_MAPPING GenericMapping, 3035 IN PPRIVILEGE_SET PrivilegeSet, 3036 IN PULONG PrivilegeSetLength, 3037 OUT PACCESS_MASK GrantedAccess, 3038 OUT PULONG AccessStatus 3039 ); 3040 3041 NTSYSAPI NTSTATUS NTAPI NtAccessCheckByTypeAndAuditAlarm( 3042 IN PUNICODE_STRING SubsystemName, 3043 IN PVOID HandleId, 3044 IN PUNICODE_STRING ObjectTypeName, 3045 IN PUNICODE_STRING ObjectName, 3046 IN PSECURITY_DESCRIPTOR SecurityDescriptor, 3047 IN PSID PrincipalSelfSid, 3048 IN ACCESS_MASK DesiredAccess, 3049 IN AUDIT_EVENT_TYPE AuditType, 3050 IN ULONG Flags, 3051 IN POBJECT_TYPE_LIST ObjectTypeList, 3052 IN ULONG ObjectTypeListLength, 3053 IN PGENERIC_MAPPING GenericMapping, 3054 IN BOOLEAN ObjectCreation, 3055 OUT PACCESS_MASK GrantedAccess, 3056 OUT PULONG AccessStatus, 3057 OUT PBOOLEAN GenerateOnClose 3058 ); 3059 3060 NTSYSAPI NTSTATUS NTAPI NtAccessCheckByTypeResultList( 3061 IN PSECURITY_DESCRIPTOR SecurityDescriptor, 3062 IN PSID PrincipalSelfSid, 3063 IN HANDLE TokenHandle, 3064 IN ACCESS_MASK DesiredAccess, 3065 IN POBJECT_TYPE_LIST ObjectTypeList, 3066 IN ULONG ObjectTypeListLength, 3067 IN PGENERIC_MAPPING GenericMapping, 3068 IN PPRIVILEGE_SET PrivilegeSet, 3069 IN PULONG PrivilegeSetLength, 3070 OUT PACCESS_MASK GrantedAccessList, 3071 OUT PULONG AccessStatusList 3072 ); 3073 3074 NTSYSAPI NTSTATUS NTAPI NtAccessCheckByTypeResultListAndAuditAlarm( 3075 IN PUNICODE_STRING SubsystemName, 3076 IN PVOID HandleId, 3077 IN PUNICODE_STRING ObjectTypeName, 3078 IN PUNICODE_STRING ObjectName, 3079 IN PSECURITY_DESCRIPTOR SecurityDescriptor, 3080 IN PSID PrincipalSelfSid, 3081 IN ACCESS_MASK DesiredAccess, 3082 IN AUDIT_EVENT_TYPE AuditType, 3083 IN ULONG Flags, 3084 IN POBJECT_TYPE_LIST ObjectTypeList, 3085 IN ULONG ObjectTypeListLength, 3086 IN PGENERIC_MAPPING GenericMapping, 3087 IN BOOLEAN ObjectCreation, 3088 OUT PACCESS_MASK GrantedAccessList, 3089 OUT PULONG AccessStatusList, 3090 OUT PULONG GenerateOnClose 3091 ); 3092 3093 NTSYSAPI NTSTATUS NTAPI NtAccessCheckByTypeResultListAndAuditAlarmByHandle( 3094 IN PUNICODE_STRING SubsystemName, 3095 IN PVOID HandleId, 3096 IN HANDLE TokenHandle, 3097 IN PUNICODE_STRING ObjectTypeName, 3098 IN PUNICODE_STRING ObjectName, 3099 IN PSECURITY_DESCRIPTOR SecurityDescriptor, 3100 IN PSID PrincipalSelfSid, 3101 IN ACCESS_MASK DesiredAccess, 3102 IN AUDIT_EVENT_TYPE AuditType, 3103 IN ULONG Flags, 3104 IN POBJECT_TYPE_LIST ObjectTypeList, 3105 IN ULONG ObjectTypeListLength, 3106 IN PGENERIC_MAPPING GenericMapping, 3107 IN BOOLEAN ObjectCreation, 3108 OUT PACCESS_MASK GrantedAccessList, 3109 OUT PULONG AccessStatusList, 3110 OUT PULONG GenerateOnClose 3111 ); 3112 3113 NTSYSAPI NTSTATUS NTAPI NtAddAtom( 3114 IN PWSTR String, 3115 IN ULONG StringLength, 3116 OUT PUSHORT Atom 3117 ); 3118 3119 NTSYSAPI NTSTATUS NTAPI NtAddBootEntry( 3120 IN PUNICODE_STRING EntryName, 3121 IN PUNICODE_STRING EntryValue 3122 ); 3123 3124 NTSYSAPI NTSTATUS NTAPI NtAddDriverEntry( 3125 IN PUNICODE_STRING DriverName, 3126 IN PUNICODE_STRING DriverPath 3127 ); 3128 3129 NTSYSAPI NTSTATUS NTAPI NtAdjustGroupsToken( 3130 IN HANDLE TokenHandle, 3131 IN BOOLEAN ResetToDefault, 3132 IN PTOKEN_GROUPS NewState, 3133 IN ULONG BufferLength, 3134 OUT PTOKEN_GROUPS PreviousState OPTIONAL, 3135 OUT PULONG ReturnLength 3136 ); 3137 3138 NTSYSAPI NTSTATUS NTAPI NtAdjustPrivilegesToken( 3139 IN HANDLE TokenHandle, 3140 IN BOOLEAN DisableAllPrivileges, 3141 IN PTOKEN_PRIVILEGES NewState OPTIONAL, 3142 IN ULONG BufferLength OPTIONAL, 3143 IN PTOKEN_PRIVILEGES PreviousState OPTIONAL, 3144 OUT PULONG ReturnLength 3145 ); 3146 3147 NTSYSAPI NTSTATUS NTAPI NtAlertResumeThread( 3148 IN HANDLE ThreadHandle, 3149 OUT PULONG PreviousSuspendCount OPTIONAL 3150 ); 3151 3152 NTSYSAPI NTSTATUS NTAPI NtAllocateLocallyUniqueId( 3153 OUT PLUID Luid 3154 ); 3155 3156 NTSYSAPI NTSTATUS NTAPI NtAllocateUserPhysicalPages( 3157 IN HANDLE ProcessHandle, 3158 IN PULONG NumberOfPages, 3159 OUT PULONG PageFrameNumbers 3160 ); 3161 3162 NTSYSAPI NTSTATUS NTAPI NtAllocateUuids( 3163 OUT PLARGE_INTEGER UuidLastTimeAllocated, 3164 OUT PULONG UuidDeltaTime, 3165 OUT PULONG UuidSequenceNumber, 3166 OUT PUCHAR UuidSeed 3167 ); 3168 NTSYSAPI NTSTATUS NTAPI NtAllocateVirtualMemory( 3169 IN HANDLE ProcessHandle, 3170 IN OUT PVOID *BaseAddress, 3171 IN ULONG ZeroBits, 3172 IN OUT PULONG AllocationSize, 3173 IN ULONG AllocationType, 3174 IN ULONG Protect 3175 ); 3176 3177 NTSYSAPI NTSTATUS NTAPI NtAreMappedFilesTheSame( 3178 IN PVOID Address1, 3179 IN PVOID Address2 3180 ); 3181 3182 NTSYSAPI NTSTATUS NTAPI NtAssignProcessToJobObject( 3183 IN HANDLE JobHandle, 3184 IN HANDLE ProcessHandle 3185 ); 3186 3187 NTSYSAPI NTSTATUS NTAPI NtCallbackReturn( 3188 IN PVOID Result OPTIONAL, 3189 IN ULONG ResultLength, 3190 IN NTSTATUS Status 3191 ); 3192 3193 NTSYSAPI NTSTATUS NTAPI NtCancelDeviceWakeupRequest( 3194 IN HANDLE DeviceHandle 3195 ); 3196 3197 NTSYSAPI NTSTATUS NTAPI NtCancelIoFile( 3198 IN HANDLE FileHandle, 3199 OUT PIO_STATUS_BLOCK IoStatusBlock 3200 ); 3201 3202 NTSYSAPI NTSTATUS NTAPI NtCancelTimer( 3203 IN HANDLE TimerHandle, 3204 OUT PBOOLEAN PreviousState OPTIONAL 3205 ); 3206 3207 NTSYSAPI NTSTATUS NTAPI NtClearEvent( 3208 IN HANDLE EventHandle 3209 ); 3210 3211 NTSYSAPI NTSTATUS NTAPI NtClose( 3212 IN HANDLE Handle 3213 ); 3214 3215 NTSYSAPI NTSTATUS NTAPI NtCloseObjectAuditAlarm( 3216 IN PUNICODE_STRING SubsystemName, 3217 IN PVOID HandleId, 3218 IN BOOLEAN GenerateOnClose 3219 ); 3220 3221 NTSYSAPI NTSTATUS NTAPI NtCompactKeys( 3222 IN ULONG Length, 3223 IN HANDLE Key 3224 ); 3225 3226 NTSYSAPI NTSTATUS NTAPI NtCompareTokens( 3227 IN HANDLE FirstTokenHandle, 3228 IN HANDLE SecondTokenHandle, 3229 OUT PBOOLEAN IdenticalTokens 3230 ); 3231 3232 NTSYSAPI NTSTATUS NTAPI NtCompleteConnectPort( 3233 IN HANDLE PortHandle 3234 ); 3235 3236 NTSYSAPI NTSTATUS NTAPI NtCompressKey( 3237 IN HANDLE Key 3238 ); 3239 3240 NTSYSAPI NTSTATUS NTAPI NtConnectPort( 3241 OUT PHANDLE PortHandle, 3242 IN PUNICODE_STRING PortName, 3243 IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, 3244 IN OUT PLPC_SECTION_WRITE WriteSection OPTIONAL, 3245 IN OUT PLPC_SECTION_READ ReadSection OPTIONAL, 3246 OUT PULONG MaxMessageSize OPTIONAL, 3247 IN OUT PVOID ConnectData OPTIONAL, 3248 IN OUT PULONG ConnectDataLength OPTIONAL 3249 ); 3250 3251 NTSYSAPI NTSTATUS NTAPI NtContinue( 3252 IN PCONTEXT Context, 3253 IN BOOLEAN TestAlert 3254 ); 3255 3256 NTSYSAPI NTSTATUS NTAPI NtCreateDebugObject( 3257 OUT PHANDLE DebugObject, 3258 IN ULONG AccessRequired, 3259 IN POBJECT_ATTRIBUTES ObjectAttributes, 3260 IN BOOLEAN KillProcessOnExit 3261 ); 3262 3263 NTSYSAPI NTSTATUS NTAPI NtCreateDirectoryObject( 3264 OUT PHANDLE DirectoryHandle, 3265 IN ACCESS_MASK DesiredAccess, 3266 IN POBJECT_ATTRIBUTES ObjectAttributes 3267 ); 3268 3269 NTSYSAPI NTSTATUS NTAPI NtCreateEvent( 3270 OUT PHANDLE EventHandle, 3271 IN ACCESS_MASK DesiredAccess, 3272 IN POBJECT_ATTRIBUTES ObjectAttributes, 3273 IN EVENT_TYPE EventType, 3274 IN BOOLEAN InitialState 3275 ); 3276 3277 NTSYSAPI NTSTATUS NTAPI NtCreateEventPair( 3278 OUT PHANDLE EventPairHandle, 3279 IN ACCESS_MASK DesiredAccess, 3280 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL 3281 ); 3282 3283 NTSYSAPI NTSTATUS NTAPI NtCreateFile( 3284 OUT PHANDLE FileHandle, 3285 IN ACCESS_MASK DesiredAccess, 3286 IN POBJECT_ATTRIBUTES ObjectAttributes, 3287 OUT PIO_STATUS_BLOCK IoStatusBlock, 3288 IN PLARGE_INTEGER AllocationSize OPTIONAL, 3289 IN ULONG FileAttributes, 3290 IN ULONG ShareAccess, 3291 IN ULONG CreateDisposition, 3292 IN ULONG CreateOptions, 3293 IN PVOID EaBuffer OPTIONAL, 3294 IN ULONG EaLength 3295 ); 3296 3297 NTSYSAPI NTSTATUS NTAPI NtCreateIoCompletion( 3298 OUT PHANDLE IoCompletionHandle, 3299 IN ACCESS_MASK DesiredAccess, 3300 IN POBJECT_ATTRIBUTES ObjectAttributes, 3301 IN ULONG NumberOfConcurrentThreads 3302 ); 3303 3304 NTSYSAPI NTSTATUS NTAPI NtCreateJobObject( 3305 OUT PHANDLE JobHandle, 3306 IN ACCESS_MASK DesiredAccess, 3307 IN POBJECT_ATTRIBUTES ObjectAttributes 3308 ); 3309 3310 NTSYSAPI NTSTATUS NTAPI NtCreateJobSet( 3311 IN ULONG Jobs, 3312 IN PJOB_SET_ARRAY JobSet, 3313 IN ULONG Reserved 3314 ); 3315 3316 NTSYSAPI NTSTATUS NTAPI NtCreateKey( 3317 OUT PHANDLE KeyHandle, 3318 IN ACCESS_MASK DesiredAccess, 3319 IN POBJECT_ATTRIBUTES ObjectAttributes, 3320 IN ULONG TitleIndex, 3321 IN PUNICODE_STRING Class OPTIONAL, 3322 IN ULONG CreateOptions, 3323 OUT PULONG Disposition OPTIONAL 3324 ); 3325 3326 NTSYSAPI NTSTATUS NTAPI NtCreateKeyedEvent( 3327 OUT PHANDLE KeyedEventHandle, 3328 IN ACCESS_MASK DesiredAccess, 3329 IN POBJECT_ATTRIBUTES ObjectAttributes, 3330 IN ULONG Reserved 3331 ); 3332 3333 NTSYSAPI NTSTATUS NTAPI NtCreateMailslotFile( 3334 OUT PHANDLE FileHandle, 3335 IN ACCESS_MASK DesiredAccess, 3336 IN POBJECT_ATTRIBUTES ObjectAttributes, 3337 OUT PIO_STATUS_BLOCK IoStatusBlock, 3338 IN ULONG CreateOptions, 3339 IN ULONG InBufferSize, 3340 IN ULONG MaxMessageSize, 3341 IN PLARGE_INTEGER ReadTimeout OPTIONAL 3342 ); 3343 3344 NTSYSAPI NTSTATUS NTAPI NtCreateMutant( 3345 OUT PHANDLE MutantHandle, 3346 IN ACCESS_MASK DesiredAccess, 3347 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, 3348 IN BOOLEAN InitialOwner 3349 ); 3350 3351 NTSYSAPI NTSTATUS NTAPI NtCreateNamedPipeFile( 3352 OUT PHANDLE FileHandle, 3353 IN ACCESS_MASK DesiredAccess, 3354 IN POBJECT_ATTRIBUTES ObjectAttributes, 3355 OUT PIO_STATUS_BLOCK IoStatusBlock, 3356 IN ULONG ShareAccess, 3357 IN ULONG CreateDisposition, 3358 IN ULONG CreateOptions, 3359 IN BOOLEAN TypeMessage, 3360 IN BOOLEAN ReadmodeMessage, 3361 IN BOOLEAN Nonblocking, 3362 IN ULONG MaxInstances, 3363 IN ULONG InBufferSize, 3364 IN ULONG OutBufferSize, 3365 IN PLARGE_INTEGER DefaultTimeout OPTIONAL 3366 ); 3367 3368 NTSYSAPI NTSTATUS NTAPI NtCreatePort( 3369 OUT PHANDLE PortHandle, 3370 IN POBJECT_ATTRIBUTES ObjectAttributes, 3371 IN ULONG MaxConnectionInfoLength, 3372 IN ULONG MaxMessageLength, 3373 IN ULONG MaxPoolUsage 3374 ); 3375 3376 NTSYSAPI NTSTATUS NTAPI NtCreateProcess( 3377 OUT PHANDLE ProcessHandle, 3378 IN ACCESS_MASK DesiredAccess, 3379 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, 3380 IN HANDLE ParentProcess, 3381 IN BOOLEAN InheritObjectTable, 3382 IN HANDLE SectionHandle OPTIONAL, 3383 IN HANDLE DebugPort OPTIONAL, 3384 IN HANDLE ExceptionPort OPTIONAL 3385 ); 3386 3387 NTSYSAPI NTSTATUS NTAPI NtCreateProcessEx( 3388 OUT PHANDLE ProcessHandle, 3389 IN ACCESS_MASK DesiredAccess, 3390 IN POBJECT_ATTRIBUTES ObjectAttributes, 3391 IN HANDLE InheritFromProcessHandle, 3392 IN ULONG CreateFlags, 3393 IN HANDLE SectionHandle OPTIONAL, 3394 IN HANDLE DebugObject OPTIONAL, 3395 IN HANDLE ExceptionPort OPTIONAL, 3396 IN ULONG JobMemberLevel 3397 ); 3398 3399 NTSYSAPI NTSTATUS NTAPI NtCreateProfile( 3400 OUT PHANDLE ProfileHandle, 3401 IN HANDLE ProcessHandle, 3402 IN PVOID Base, 3403 IN ULONG Size, 3404 IN ULONG BucketShift, 3405 IN PULONG Buffer, 3406 IN ULONG BufferLength, 3407 IN KPROFILE_SOURCE Source, 3408 IN ULONG ProcessorMask 3409 ); 3410 3411 NTSYSAPI NTSTATUS NTAPI NtCreateSection( 3412 OUT PHANDLE SectionHandle, 3413 IN ACCESS_MASK DesiredAccess, 3414 IN POBJECT_ATTRIBUTES ObjectAttributes, 3415 IN PLARGE_INTEGER SectionSize OPTIONAL, 3416 IN ULONG Protect, 3417 IN ULONG Attributes, 3418 IN HANDLE FileHandle 3419 ); 3420 3421 NTSYSAPI NTSTATUS NTAPI NtCreateSemaphore( 3422 OUT PHANDLE SemaphoreHandle, 3423 IN ACCESS_MASK DesiredAccess, 3424 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, 3425 IN ULONG InitialCount, 3426 IN ULONG MaximumCount 3427 ); 3428 3429 NTSYSAPI NTSTATUS NTAPI NtCreateSymbolicLinkObject( 3430 OUT PHANDLE SymbolicLinkHandle, 3431 IN ACCESS_MASK DesiredAccess, 3432 IN POBJECT_ATTRIBUTES ObjectAttributes, 3433 IN PUNICODE_STRING TargetName 3434 ); 3435 3436 NTSYSAPI NTSTATUS NTAPI NtCreateThread( 3437 OUT PHANDLE ThreadHandle, 3438 IN ACCESS_MASK DesiredAccess, 3439 IN POBJECT_ATTRIBUTES ObjectAttributes, 3440 IN HANDLE ProcessHandle, 3441 OUT PCLIENT_ID ClientId, 3442 IN PCONTEXT ThreadContext, 3443 IN PUSER_STACK UserStack, 3444 IN BOOLEAN CreateSuspended 3445 ); 3446 3447 NTSYSAPI NTSTATUS NTAPI NtCreateToken( 3448 OUT PHANDLE TokenHandle, 3449 IN ACCESS_MASK DesiredAccess, 3450 IN POBJECT_ATTRIBUTES ObjectAttributes, 3451 IN TOKEN_TYPE Type, 3452 IN PLUID AuthenticationId, 3453 IN PLARGE_INTEGER ExpirationTime, 3454 IN PTOKEN_USER User, 3455 IN PTOKEN_GROUPS Groups, 3456 IN PTOKEN_PRIVILEGES Privileges, 3457 IN PTOKEN_OWNER Owner, 3458 IN PTOKEN_PRIMARY_GROUP PrimaryGroup, 3459 IN PTOKEN_DEFAULT_DACL DefaultDacl, 3460 IN PTOKEN_SOURCE Source 3461 ); 3462 3463 NTSYSAPI NTSTATUS NTAPI NtCreateWaitablePort( 3464 OUT PHANDLE PortHandle, 3465 IN POBJECT_ATTRIBUTES ObjectAttributes, 3466 IN ULONG MaxConnectionInfoLength, 3467 IN ULONG MaxMessageLength, 3468 IN ULONG MaxPoolUsage 3469 ); 3470 3471 NTSYSAPI NTSTATUS NTAPI NtDebugActiveProcess( 3472 IN HANDLE Process, 3473 IN HANDLE DebugObject 3474 ); 3475 3476 NTSYSAPI NTSTATUS NTAPI NtDebugContinue( 3477 IN HANDLE DebugObject, 3478 IN PCLIENT_ID AppClientId, 3479 IN NTSTATUS ContinueStatus 3480 ); 3481 3482 NTSYSAPI NTSTATUS NTAPI NtDelayExecution( 3483 IN BOOLEAN Alertable, 3484 IN PLARGE_INTEGER DelayInterval 3485 ); 3486 3487 NTSYSAPI NTSTATUS NTAPI NtDeleteAtom( 3488 IN USHORT Atom 3489 ); 3490 3491 NTSYSAPI NTSTATUS NTAPI NtDeleteBootEntry( 3492 IN PUNICODE_STRING EntryName, 3493 IN PUNICODE_STRING EntryValue 3494 ); 3495 3496 NTSYSAPI NTSTATUS NTAPI NtDeleteDriverEntry( 3497 IN PUNICODE_STRING DriverName, 3498 IN PUNICODE_STRING DriverPath 3499 ); 3500 3501 NTSYSAPI NTSTATUS NTAPI NtDeleteFile( 3502 IN POBJECT_ATTRIBUTES ObjectAttributes 3503 ); 3504 3505 NTSYSAPI NTSTATUS NTAPI NtDeleteKey( 3506 IN HANDLE KeyHandle 3507 ); 3508 3509 NTSYSAPI NTSTATUS NTAPI NtDeleteObjectAuditAlarm( 3510 IN PUNICODE_STRING SubsystemName, 3511 IN PVOID HandleId, 3512 IN BOOLEAN GenerateOnClose 3513 ); 3514 3515 NTSYSAPI NTSTATUS NTAPI NtDeleteValueKey( 3516 IN HANDLE KeyHandle, 3517 IN PUNICODE_STRING ValueName 3518 ); 3519 3520 NTSYSAPI NTSTATUS NTAPI NtDeviceIoControlFile( 3521 IN HANDLE FileHandle, 3522 IN HANDLE Event OPTIONAL, 3523 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 3524 IN PVOID ApcContext OPTIONAL, 3525 OUT PIO_STATUS_BLOCK IoStatusBlock, 3526 IN ULONG IoControlCode, 3527 IN PVOID InputBuffer OPTIONAL, 3528 IN ULONG InputBufferLength, 3529 OUT PVOID OutputBuffer OPTIONAL, 3530 IN ULONG OutputBufferLength 3531 ); 3532 3533 NTSYSAPI NTSTATUS NTAPI NtDisplayString( 3534 IN PUNICODE_STRING String 3535 ); 3536 3537 NTSYSAPI NTSTATUS NTAPI NtDuplicateObject( 3538 IN HANDLE SourceProcessHandle, 3539 IN HANDLE SourceHandle, 3540 IN HANDLE TargetProcessHandle OPTIONAL, 3541 OUT PHANDLE TargetHandle OPTIONAL, 3542 IN ACCESS_MASK DesiredAccess, 3543 IN ULONG HandleAttributes, 3544 IN ULONG Options 3545 ); 3546 3547 NTSYSAPI NTSTATUS NTAPI NtDuplicateToken( 3548 IN HANDLE ExistingTokenHandle, 3549 IN ACCESS_MASK DesiredAccess, 3550 IN POBJECT_ATTRIBUTES ObjectAttributes, 3551 IN BOOLEAN EffectiveOnly, 3552 IN TOKEN_TYPE TokenType, 3553 OUT PHANDLE NewTokenHandle 3554 ); 3555 3556 NTSYSAPI NTSTATUS NTAPI NtEnumerateBootEntries( 3557 IN ULONG Unknown1, 3558 IN ULONG Unknown2 3559 ); 3560 NTSYSAPI NTSTATUS NTAPI NtEnumerateKey( 3561 IN HANDLE KeyHandle, 3562 IN ULONG Index, 3563 IN KEY_INFORMATION_CLASS KeyInformationClass, 3564 OUT PVOID KeyInformation, 3565 IN ULONG KeyInformationLength, 3566 OUT PULONG ResultLength 3567 ); 3568 3569 NTSYSAPI NTSTATUS NTAPI NtEnumerateSystemEnvironmentValuesEx( 3570 IN ULONG Unknown1, 3571 IN ULONG Unknown2, 3572 IN ULONG Unknown3 3573 ); 3574 3575 NTSYSAPI NTSTATUS NTAPI NtEnumerateValueKey( 3576 IN HANDLE KeyHandle, 3577 IN ULONG Index, 3578 IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, 3579 OUT PVOID KeyValueInformation, 3580 IN ULONG KeyValueInformationLength, 3581 OUT PULONG ResultLength 3582 ); 3583 3584 NTSYSAPI NTSTATUS NTAPI NtExtendSection( 3585 IN HANDLE SectionHandle, 3586 IN PLARGE_INTEGER SectionSize 3587 ); 3588 3589 NTSYSAPI NTSTATUS NTAPI NtFilterToken( 3590 IN HANDLE ExistingTokenHandle, 3591 IN ULONG Flags, 3592 IN PTOKEN_GROUPS SidsToDisable, 3593 IN PTOKEN_PRIVILEGES PrivilegesToDelete, 3594 IN PTOKEN_GROUPS SidsToRestricted, 3595 OUT PHANDLE NewTokenHandle 3596 ); 3597 3598 NTSYSAPI NTSTATUS NTAPI NtFindAtom( 3599 IN PWSTR String, 3600 IN ULONG StringLength, 3601 OUT PUSHORT Atom 3602 ); 3603 3604 NTSYSAPI NTSTATUS NTAPI NtFlushBuffersFile( 3605 IN HANDLE FileHandle, 3606 OUT PIO_STATUS_BLOCK IoStatusBlock 3607 ); 3608 3609 NTSYSAPI NTSTATUS NTAPI NtFlushInstructionCache( 3610 IN HANDLE ProcessHandle, 3611 IN PVOID BaseAddress OPTIONAL, 3612 IN ULONG FlushSize 3613 ); 3614 3615 NTSYSAPI NTSTATUS NTAPI NtFlushKey( 3616 IN HANDLE KeyHandle 3617 ); 3618 3619 NTSYSAPI NTSTATUS NTAPI NtFlushVirtualMemory( 3620 IN HANDLE ProcessHandle, 3621 IN OUT PVOID *BaseAddress, 3622 IN OUT PULONG FlushSize, 3623 OUT PIO_STATUS_BLOCK IoStatusBlock 3624 ); 3625 3626 NTSYSAPI NTSTATUS NTAPI NtFlushWriteBuffer( 3627 VOID 3628 ); 3629 3630 NTSYSAPI NTSTATUS NTAPI NtYieldExecution( 3631 VOID 3632 ); 3633 3634 NTSYSAPI NTSTATUS NTAPI NtWriteVirtualMemory( 3635 IN HANDLE ProcessHandle, 3636 IN PVOID BaseAddress, 3637 IN PVOID Buffer, 3638 IN ULONG BufferLength, 3639 OUT PULONG ReturnLength OPTIONAL 3640 ); 3641 3642 NTSYSAPI NTSTATUS NTAPI NtWriteRequestData( 3643 IN HANDLE PortHandle, 3644 IN PPORT_MESSAGE Message, 3645 IN ULONG Index, 3646 IN PVOID Buffer, 3647 IN ULONG BufferLength, 3648 OUT PULONG ReturnLength OPTIONAL 3649 ); 3650 3651 NTSYSAPI NTSTATUS NTAPI NtWriteFileGather( 3652 IN HANDLE FileHandle, 3653 IN HANDLE Event OPTIONAL, 3654 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 3655 IN PVOID ApcContext OPTIONAL, 3656 OUT PIO_STATUS_BLOCK IoStatusBlock, 3657 IN PFILE_SEGMENT_ELEMENT Buffer, 3658 IN ULONG Length, 3659 IN PLARGE_INTEGER ByteOffset OPTIONAL, 3660 IN PULONG Key OPTIONAL 3661 ); 3662 3663 NTSYSAPI NTSTATUS NTAPI NtWriteFile( 3664 IN HANDLE FileHandle, 3665 IN HANDLE Event OPTIONAL, 3666 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 3667 IN PVOID ApcContext OPTIONAL, 3668 OUT PIO_STATUS_BLOCK IoStatusBlock, 3669 IN PVOID Buffer, 3670 IN ULONG Length, 3671 IN PLARGE_INTEGER ByteOffset OPTIONAL, 3672 IN PULONG Key OPTIONAL 3673 ); 3674 3675 NTSYSAPI NTSTATUS NTAPI NtWaitLowEventPair( 3676 IN HANDLE EventPairHandle 3677 ); 3678 3679 NTSYSAPI NTSTATUS NTAPI NtWaitHighEventPair( 3680 IN HANDLE EventPairHandle 3681 ); 3682 3683 NTSYSAPI NTSTATUS NTAPI NtWaitForSingleObject( 3684 IN HANDLE Handle, 3685 IN BOOLEAN Alertable, 3686 IN PLARGE_INTEGER Timeout OPTIONAL 3687 ); 3688 3689 NTSYSAPI NTSTATUS NTAPI NtWaitForMultipleObjects32( 3690 IN ULONG HandleCount, 3691 IN PHANDLE Handles, 3692 IN WAIT_TYPE WaitType, 3693 IN BOOLEAN Alertable, 3694 IN PLARGE_INTEGER Timeout OPTIONAL 3695 ); 3696 3697 NTSYSAPI NTSTATUS NTAPI NtWaitForMultipleObjects( 3698 IN ULONG HandleCount, 3699 IN PHANDLE Handles, 3700 IN WAIT_TYPE WaitType, 3701 IN BOOLEAN Alertable, 3702 IN PLARGE_INTEGER Timeout OPTIONAL 3703 ); 3704 3705 NTSYSAPI NTSTATUS NTAPI NtWaitForKeyedEvent( 3706 IN HANDLE KeyedEventHandle, 3707 IN PVOID Key, 3708 IN BOOLEAN Alertable, 3709 IN PLARGE_INTEGER Timeout OPTIONAL 3710 ); 3711 3712 NTSYSAPI NTSTATUS NTAPI NtUnmapViewOfSection( 3713 IN HANDLE ProcessHandle, 3714 IN PVOID BaseAddress 3715 ); 3716 3717 NTSYSAPI NTSTATUS NTAPI NtUnlockVirtualMemory( 3718 IN HANDLE ProcessHandle, 3719 IN OUT PVOID *BaseAddress, 3720 IN OUT PULONG LockSize, 3721 IN ULONG LockType 3722 ); 3723 3724 NTSYSAPI NTSTATUS NTAPI NtUnlockFile( 3725 IN HANDLE FileHandle, 3726 OUT PIO_STATUS_BLOCK IoStatusBlock, 3727 IN PULARGE_INTEGER LockOffset, 3728 IN PULARGE_INTEGER LockLength, 3729 IN ULONG Key 3730 ); 3731 3732 NTSYSAPI NTSTATUS NTAPI NtUnloadKeyEx( 3733 IN POBJECT_ATTRIBUTES KeyObjectAttributes, 3734 IN HANDLE EventHandle OPTIONAL 3735 ); 3736 3737 NTSYSAPI NTSTATUS NTAPI NtUnloadKey2( 3738 IN POBJECT_ATTRIBUTES KeyObjectAttributes, 3739 IN BOOLEAN ForceUnload 3740 ); 3741 3742 NTSYSAPI NTSTATUS NTAPI NtUnloadKey( 3743 IN POBJECT_ATTRIBUTES KeyObjectAttributes 3744 ); 3745 3746 NTSYSAPI NTSTATUS NTAPI NtUnloadDriver( 3747 IN PUNICODE_STRING DriverServiceName 3748 ); 3749 3750 NTSYSAPI NTSTATUS NTAPI NtTerminateThread( 3751 IN HANDLE ThreadHandle OPTIONAL, 3752 IN NTSTATUS ExitStatus 3753 ); 3754 3755 NTSYSAPI NTSTATUS NTAPI NtTerminateProcess( 3756 IN HANDLE ProcessHandle OPTIONAL, 3757 IN NTSTATUS ExitStatus 3758 ); 3759 3760 NTSYSAPI NTSTATUS NTAPI NtTerminateJobObject( 3761 IN HANDLE JobHandle, 3762 IN NTSTATUS ExitStatus 3763 ); 3764 3765 NTSYSAPI NTSTATUS NTAPI NtSystemDebugControl( 3766 IN DEBUG_CONTROL_CODE ControlCode, 3767 IN PVOID InputBuffer OPTIONAL, 3768 IN ULONG InputBufferLength, 3769 OUT PVOID OutputBuffer OPTIONAL, 3770 IN ULONG OutputBufferLength, 3771 OUT PULONG ReturnLength OPTIONAL 3772 ); 3773 3774 NTSYSAPI NTSTATUS NTAPI NtSuspendThread( 3775 IN HANDLE ThreadHandle, 3776 OUT PULONG PreviousSuspendCount OPTIONAL 3777 ); 3778 3779 NTSYSAPI NTSTATUS NTAPI NtSuspendProcess( 3780 IN HANDLE Process 3781 ); 3782 3783 NTSYSAPI NTSTATUS NTAPI NtStopProfile( 3784 IN HANDLE ProfileHandle 3785 ); 3786 NTSYSAPI NTSTATUS NTAPI NtStartProfile( 3787 IN HANDLE ProfileHandle 3788 ); 3789 3790 NTSYSAPI NTSTATUS NTAPI NtSignalAndWaitForSingleObject( 3791 IN HANDLE HandleToSignal, 3792 IN HANDLE HandleToWait, 3793 IN BOOLEAN Alertable, 3794 IN PLARGE_INTEGER Timeout OPTIONAL 3795 ); 3796 3797 NTSYSAPI NTSTATUS NTAPI NtShutdownSystem( 3798 IN SHUTDOWN_ACTION Action 3799 ); 3800 3801 NTSYSAPI NTSTATUS NTAPI NtSetVolumeInformationFile( 3802 IN HANDLE FileHandle, 3803 OUT PIO_STATUS_BLOCK IoStatusBlock, 3804 IN PVOID Buffer, 3805 IN ULONG BufferLength, 3806 IN FS_INFORMATION_CLASS VolumeInformationClass 3807 ); 3808 3809 NTSYSAPI NTSTATUS NTAPI NtSetValueKey( 3810 IN HANDLE KeyHandle, 3811 IN PUNICODE_STRING ValueName, 3812 IN ULONG TitleIndex OPTIONAL, 3813 IN ULONG Type, 3814 IN PVOID Data, 3815 IN ULONG DataSize 3816 ); 3817 3818 NTSYSAPI NTSTATUS NTAPI NtSetUuidSeed( 3819 IN PUCHAR UuidSeed 3820 ); 3821 3822 NTSYSAPI NTSTATUS NTAPI NtSetTimerResolution( 3823 IN ULONG RequestedResolution, 3824 IN BOOLEAN Set, 3825 OUT PULONG ActualResolution 3826 ); 3827 3828 NTSYSAPI NTSTATUS NTAPI NtSetThreadExecutionState( 3829 IN EXECUTION_STATE ExecutionState, 3830 OUT PEXECUTION_STATE PreviousExecutionState 3831 ); 3832 3833 NTSYSAPI NTSTATUS NTAPI NtSetSystemTime( 3834 IN PLARGE_INTEGER NewTime, 3835 OUT PLARGE_INTEGER OldTime OPTIONAL 3836 ); 3837 3838 NTSYSAPI NTSTATUS NTAPI NtSetSystemPowerState( 3839 IN POWER_ACTION SystemAction, 3840 IN SYSTEM_POWER_STATE MinSystemState, 3841 IN ULONG Flags 3842 ); 3843 3844 NTSYSAPI NTSTATUS NTAPI NtSetSystemInformation( 3845 IN SYSTEM_INFORMATION_CLASS SystemInformationClass, 3846 IN OUT PVOID SystemInformation, 3847 IN ULONG SystemInformationLength 3848 ); 3849 3850 NTSYSAPI NTSTATUS NTAPI NtSetSystemEnvironmentValue( 3851 IN PUNICODE_STRING Name, 3852 IN PUNICODE_STRING Value 3853 ); 3854 3855 NTSYSAPI NTSTATUS NTAPI NtSetSecurityObject( 3856 IN HANDLE Handle, 3857 IN SECURITY_INFORMATION SecurityInformation, 3858 IN PSECURITY_DESCRIPTOR SecurityDescriptor 3859 ); 3860 3861 NTSYSAPI NTSTATUS NTAPI NtSetLowWaitHighEventPair( 3862 IN HANDLE EventPairHandle 3863 ); 3864 3865 NTSYSAPI NTSTATUS NTAPI NtSetLowEventPair( 3866 IN HANDLE EventPairHandle 3867 ); 3868 3869 NTSYSAPI NTSTATUS NTAPI NtSetLdtEntries( 3870 IN ULONG Selector1, 3871 IN LDT_ENTRY LdtEntry1, 3872 IN ULONG Selector2, 3873 IN LDT_ENTRY LdtEntry2 3874 ); 3875 3876 NTSYSAPI NTSTATUS NTAPI NtSetIoCompletion( 3877 IN HANDLE IoCompletionHandle, 3878 IN ULONG CompletionKey, 3879 IN ULONG CompletionValue, 3880 IN NTSTATUS Status, 3881 IN ULONG Information 3882 ); 3883 3884 NTSYSAPI NTSTATUS NTAPI NtSetIntervalProfile( 3885 IN ULONG Interval, 3886 IN KPROFILE_SOURCE Source 3887 ); 3888 3889 NTSYSAPI NTSTATUS NTAPI NtSetInformationToken( 3890 IN HANDLE TokenHandle, 3891 IN TOKEN_INFORMATION_CLASS TokenInformationClass, 3892 IN PVOID TokenInformation, 3893 IN ULONG TokenInformationLength 3894 ); 3895 3896 NTSYSAPI NTSTATUS NTAPI NtSetInformationThread( 3897 IN HANDLE ThreadHandle, 3898 IN THREADINFOCLASS ThreadInformationClass, 3899 IN PVOID ThreadInformation, 3900 IN ULONG ThreadInformationLength 3901 ); 3902 3903 NTSYSAPI NTSTATUS NTAPI NtSetInformationProcess( 3904 IN HANDLE ProcessHandle, 3905 IN PROCESSINFOCLASS ProcessInformationClass, 3906 IN PVOID ProcessInformation, 3907 IN ULONG ProcessInformationLength 3908 ); 3909 3910 NTSYSAPI NTSTATUS NTAPI NtSetInformationObject( 3911 IN HANDLE ObjectHandle, 3912 IN OBJECT_INFORMATION_CLASS ObjectInformationClass, 3913 IN PVOID ObjectInformation, 3914 IN ULONG ObjectInformationLength 3915 ); 3916 3917 NTSYSAPI NTSTATUS NTAPI NtSetInformationKey( 3918 IN HANDLE KeyHandle, 3919 IN KEY_SET_INFORMATION_CLASS KeyInformationClass, 3920 IN PVOID KeyInformation, 3921 IN ULONG KeyInformationLength 3922 ); 3923 3924 NTSYSAPI NTSTATUS NTAPI NtSetInformationJobObject( 3925 IN HANDLE JobHandle, 3926 IN JOBOBJECTINFOCLASS JobInformationClass, 3927 IN PVOID JobInformation, 3928 IN ULONG JobInformationLength 3929 ); 3930 3931 NTSYSAPI NTSTATUS NTAPI NtSetInformationFile( 3932 IN HANDLE FileHandle, 3933 OUT PIO_STATUS_BLOCK IoStatusBlock, 3934 IN PVOID FileInformation, 3935 IN ULONG FileInformationLength, 3936 IN FILE_INFORMATION_CLASS FileInformationClass 3937 ); 3938 3939 NTSYSAPI NTSTATUS NTAPI NtSetHighWaitLowEventPair( 3940 IN HANDLE EventPairHandle 3941 ); 3942 3943 NTSYSAPI NTSTATUS NTAPI NtSetHighEventPair( 3944 IN HANDLE EventPairHandle 3945 ); 3946 3947 NTSYSAPI NTSTATUS NTAPI NtSetEventBoostPriority( 3948 IN HANDLE EventHandle 3949 ); 3950 3951 NTSYSAPI NTSTATUS NTAPI NtSetEvent( 3952 IN HANDLE EventHandle, 3953 OUT PULONG PreviousState OPTIONAL 3954 ); 3955 3956 NTSYSAPI NTSTATUS NTAPI NtSetEaFile( 3957 IN HANDLE FileHandle, 3958 OUT PIO_STATUS_BLOCK IoStatusBlock, 3959 IN PFILE_FULL_EA_INFORMATION Buffer, 3960 IN ULONG BufferLength 3961 ); 3962 3963 NTSYSAPI NTSTATUS NTAPI NtSetDefaultUILanguage( 3964 IN LANGID LanguageId 3965 ); 3966 3967 NTSYSAPI NTSTATUS NTAPI NtSetDefaultLocale( 3968 IN BOOLEAN ThreadOrSystem, 3969 IN LCID Locale 3970 ); 3971 3972 NTSYSAPI NTSTATUS NTAPI NtSetDefaultHardErrorPort( 3973 IN HANDLE PortHandle 3974 ); 3975 3976 NTSYSAPI NTSTATUS NTAPI NtSetDebugFilterState( 3977 IN ULONG ComponentId, 3978 IN ULONG Level, 3979 IN BOOLEAN Enable 3980 ); 3981 3982 NTSYSAPI NTSTATUS NTAPI NtSetContextThread( 3983 IN HANDLE ThreadHandle, 3984 IN PCONTEXT Context 3985 ); 3986 3987 NTSYSAPI NTSTATUS NTAPI NtSetContextChannel( 3988 IN HANDLE CHannelHandle 3989 ); 3990 3991 NTSYSAPI NTSTATUS NTAPI NtSetBootEntryOrder( 3992 IN ULONG Unknown1, 3993 IN ULONG Unknown2 3994 ); 3995 3996 NTSYSAPI NTSTATUS NTAPI NtSecureConnectPort( 3997 OUT PHANDLE PortHandle, 3998 IN PUNICODE_STRING PortName, 3999 IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, 4000 IN OUT PPORT_VIEW ClientView OPTIONAL, 4001 IN PSID ServerSid OPTIONAL, 4002 OUT PREMOTE_PORT_VIEW ServerView OPTIONAL, 4003 OUT PULONG MaxMessageLength OPTIONAL, 4004 IN OUT PVOID ConnectInformation OPTIONAL, 4005 IN OUT PULONG ConnectInformationLength OPTIONAL 4006 ); 4007 4008 NTSYSAPI NTSTATUS NTAPI NtSaveMergedKeys( 4009 IN HANDLE KeyHandle1, 4010 IN HANDLE KeyHandle2, 4011 IN HANDLE FileHandle 4012 ); 4013 4014 NTSYSAPI NTSTATUS NTAPI NtSaveKeyEx( 4015 IN HANDLE KeyHandle, 4016 IN HANDLE FileHandle, 4017 IN ULONG Flags 4018 ); 4019 4020 NTSYSAPI NTSTATUS NTAPI NtSaveKey( 4021 IN HANDLE KeyHandle, 4022 IN HANDLE FileHandle 4023 ); 4024 4025 NTSYSAPI NTSTATUS NTAPI NtResumeThread( 4026 IN HANDLE ThreadHandle, 4027 OUT PULONG PreviousSuspendCount OPTIONAL 4028 ); 4029 4030 NTSYSAPI NTSTATUS NTAPI NtResumeProcess( 4031 IN HANDLE Process 4032 ); 4033 4034 NTSYSAPI NTSTATUS NTAPI NtRestoreKey( 4035 IN HANDLE KeyHandle, 4036 IN HANDLE FileHandle, 4037 IN ULONG Flags 4038 ); 4039 4040 NTSYSAPI NTSTATUS NTAPI NtResetWriteWatch( 4041 IN HANDLE ProcessHandle, 4042 IN PVOID BaseAddress, 4043 IN ULONG RegionSize 4044 ); 4045 4046 NTSYSAPI NTSTATUS NTAPI NtResetEvent( 4047 IN HANDLE EventHandle, 4048 OUT PULONG PreviousState OPTIONAL 4049 ); 4050 4051 NTSYSAPI NTSTATUS NTAPI NtRequestWakeupLatency( 4052 IN LATENCY_TIME Latency 4053 ); 4054 4055 NTSYSAPI NTSTATUS NTAPI NtRequestWaitReplyPort( 4056 IN HANDLE PortHandle, 4057 IN PPORT_MESSAGE RequestMessage, 4058 OUT PPORT_MESSAGE ReplyMessage 4059 ); 4060 4061 NTSYSAPI NTSTATUS NTAPI NtRequestPort( 4062 IN HANDLE PortHandle, 4063 IN PPORT_MESSAGE RequestMessage 4064 ); 4065 4066 NTSYSAPI NTSTATUS NTAPI NtRequestDeviceWakeup( 4067 IN HANDLE DeviceHandle 4068 ); 4069 4070 NTSYSAPI NTSTATUS NTAPI NtReplyWaitReplyPort( 4071 IN HANDLE PortHandle, 4072 IN OUT PPORT_MESSAGE ReplyMessage 4073 ); 4074 4075 NTSYSAPI NTSTATUS NTAPI NtReplyWaitReceivePortEx( 4076 IN HANDLE PortHandle, 4077 OUT PVOID* PortIdentifier OPTIONAL, 4078 IN PPORT_MESSAGE ReplyMessage OPTIONAL, 4079 OUT PPORT_MESSAGE Message, 4080 IN PLARGE_INTEGER Timeout 4081 ); 4082 4083 NTSYSAPI NTSTATUS NTAPI NtReplyWaitReceivePort( 4084 IN HANDLE PortHandle, 4085 OUT PULONG PortIdentifier OPTIONAL, 4086 IN PPORT_MESSAGE ReplyMessage OPTIONAL, 4087 OUT PPORT_MESSAGE Message 4088 ); 4089 4090 NTSYSAPI NTSTATUS NTAPI NtReplyPort( 4091 IN HANDLE PortHandle, 4092 IN PPORT_MESSAGE ReplyMessage 4093 ); 4094 4095 NTSYSAPI NTSTATUS NTAPI NtReplaceKey( 4096 IN POBJECT_ATTRIBUTES NewFileObjectAttributes, 4097 IN HANDLE KeyHandle, 4098 IN POBJECT_ATTRIBUTES OldFileObjectAttributes 4099 ); 4100 4101 NTSYSAPI NTSTATUS NTAPI NtRenameKey( 4102 IN HANDLE KeyHandle, 4103 IN PUNICODE_STRING ReplacementName 4104 ); 4105 4106 NTSYSAPI NTSTATUS NTAPI NtRemoveProcessDebug( 4107 IN HANDLE Process, 4108 IN HANDLE DebugObject 4109 ); 4110 4111 NTSYSAPI NTSTATUS NTAPI NtRemoveIoCompletion( 4112 IN HANDLE IoCompletionHandle, 4113 OUT PULONG CompletionKey, 4114 OUT PULONG CompletionValue, 4115 OUT PIO_STATUS_BLOCK IoStatusBlock, 4116 IN PLARGE_INTEGER Timeout OPTIONAL 4117 ); 4118 4119 NTSYSAPI NTSTATUS NTAPI NtReleaseSemaphore( 4120 IN HANDLE SemaphoreHandle, 4121 IN LONG ReleaseCount, 4122 OUT PLONG PreviousCount OPTIONAL 4123 ); 4124 4125 NTSYSAPI NTSTATUS NTAPI NtReleaseMutant( 4126 IN HANDLE MutantHandle, 4127 OUT PULONG PreviousState 4128 ); 4129 4130 NTSYSAPI NTSTATUS NTAPI NtReleaseKeyedEvent( 4131 IN HANDLE KeyedEventHandle, 4132 IN PVOID Key, 4133 IN BOOLEAN Alertable, 4134 IN PLARGE_INTEGER Timeout OPTIONAL 4135 ); 4136 4137 NTSYSAPI NTSTATUS NTAPI NtRegisterThreadTerminatePort( 4138 IN HANDLE PortHandle 4139 ); 4140 4141 NTSYSAPI NTSTATUS NTAPI NtReadVirtualMemory( 4142 IN HANDLE ProcessHandle, 4143 IN PVOID BaseAddress, 4144 OUT PVOID Buffer, 4145 IN ULONG BufferLength, 4146 OUT PULONG ReturnLength OPTIONAL 4147 ); 4148 4149 NTSYSAPI NTSTATUS NTAPI NtReadRequestData( 4150 IN HANDLE PortHandle, 4151 IN PPORT_MESSAGE Message, 4152 IN ULONG Index, 4153 OUT PVOID Buffer, 4154 IN ULONG BufferLength, 4155 OUT PULONG ReturnLength OPTIONAL 4156 ); 4157 4158 NTSYSAPI NTSTATUS NTAPI NtReadFileScatter( 4159 IN HANDLE FileHandle, 4160 IN HANDLE Event OPTIONAL, 4161 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 4162 IN PVOID ApcContext OPTIONAL, 4163 OUT PIO_STATUS_BLOCK IoStatusBlock, 4164 IN PFILE_SEGMENT_ELEMENT Buffer, 4165 IN ULONG Length, 4166 IN PLARGE_INTEGER ByteOffset OPTIONAL, 4167 IN PULONG Key OPTIONAL 4168 ); 4169 4170 NTSYSAPI NTSTATUS NTAPI NtReadFile( 4171 IN HANDLE FileHandle, 4172 IN HANDLE Event OPTIONAL, 4173 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 4174 IN PVOID ApcContext OPTIONAL, 4175 OUT PIO_STATUS_BLOCK IoStatusBlock, 4176 OUT PVOID Buffer, 4177 IN ULONG Length, 4178 IN PLARGE_INTEGER ByteOffset OPTIONAL, 4179 IN PULONG Key OPTIONAL 4180 ); 4181 4182 NTSYSAPI NTSTATUS NTAPI NtRaiseHardError( 4183 IN NTSTATUS Status, 4184 IN ULONG NumberOfArguments, 4185 IN ULONG StringArgumentsMask, 4186 IN PULONG_PTR Arguments, 4187 IN HARDERROR_RESPONSE_OPTION ResponseOption, 4188 OUT PHARDERROR_RESPONSE Response 4189 ); 4190 4191 NTSYSAPI NTSTATUS NTAPI NtRaiseException( 4192 IN PEXCEPTION_RECORD ExceptionRecord, 4193 IN PCONTEXT Context, 4194 IN BOOLEAN SearchFrames 4195 ); 4196 4197 NTSYSAPI NTSTATUS NTAPI NtQueueApcThread( 4198 IN HANDLE ThreadHandle, 4199 IN PKNORMAL_ROUTINE ApcRoutine, 4200 IN PVOID ApcContext OPTIONAL, 4201 IN PVOID Argument1 OPTIONAL, 4202 IN PVOID Argument2 OPTIONAL 4203 ); 4204 4205 NTSYSAPI NTSTATUS NTAPI NtQueryVolumeInformationFile( 4206 IN HANDLE FileHandle, 4207 OUT PIO_STATUS_BLOCK IoStatusBlock, 4208 OUT PVOID VolumeInformation, 4209 IN ULONG VolumeInformationLength, 4210 IN FS_INFORMATION_CLASS VolumeInformationClass 4211 ); 4212 4213 NTSYSAPI NTSTATUS NTAPI NtQueryVirtualMemory( 4214 IN HANDLE ProcessHandle, 4215 IN PVOID BaseAddress, 4216 IN MEMORY_INFORMATION_CLASS MemoryInformationClass, 4217 OUT PVOID MemoryInformation, 4218 IN ULONG MemoryInformationLength, 4219 OUT PULONG ReturnLength OPTIONAL 4220 ); 4221 4222 NTSYSAPI NTSTATUS NTAPI NtQueryValueKey( 4223 IN HANDLE KeyHandle, 4224 IN PUNICODE_STRING ValueName, 4225 IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, 4226 OUT PVOID KeyValueInformation, 4227 IN ULONG KeyValueInformationLength, 4228 OUT PULONG ResultLength 4229 ); 4230 4231 NTSYSAPI NTSTATUS NTAPI NtQueryTimerResolution( 4232 OUT PULONG CoarsestResolution, 4233 OUT PULONG FinestResolution, 4234 OUT PULONG ActualResolution 4235 ); 4236 4237 NTSYSAPI NTSTATUS NTAPI NtQuerySystemTime( 4238 OUT PLARGE_INTEGER CurrentTime 4239 ); 4240 4241 NTSYSAPI NTSTATUS NTAPI NtQuerySystemInformation( 4242 IN SYSTEM_INFORMATION_CLASS SystemInformationClass, 4243 IN OUT PVOID SystemInformation, 4244 IN ULONG SystemInformationLength, 4245 OUT PULONG ReturnLength OPTIONAL 4246 ); 4247 4248 NTSYSAPI NTSTATUS NTAPI NtQuerySystemEnvironmentValueEx( 4249 IN ULONG Unknown1, 4250 IN ULONG Unknown2, 4251 IN ULONG Unknown3, 4252 IN ULONG Unknown4, 4253 IN ULONG Unknown5 4254 ); 4255 4256 NTSYSAPI NTSTATUS NTAPI NtQuerySystemEnvironmentValue( 4257 IN PUNICODE_STRING Name, 4258 OUT PVOID Value, 4259 IN ULONG ValueLength, 4260 OUT PULONG ReturnLength OPTIONAL 4261 ); 4262 4263 NTSYSAPI NTSTATUS NTAPI NtQuerySymbolicLinkObject( 4264 IN HANDLE SymbolicLinkHandle, 4265 IN OUT PUNICODE_STRING TargetName, 4266 OUT PULONG ReturnLength OPTIONAL 4267 ); 4268 4269 NTSYSAPI NTSTATUS NTAPI NtQuerySecurityObject( 4270 IN HANDLE ObjectHandle, 4271 IN SECURITY_INFORMATION SecurityInformation, 4272 OUT PSECURITY_DESCRIPTOR SecurityDescriptor, 4273 IN ULONG DescriptorLength, 4274 OUT PULONG ReturnLength 4275 ); 4276 4277 NTSYSAPI NTSTATUS NTAPI NtQuerySection( 4278 IN HANDLE SectionHandle, 4279 IN SECTION_INFORMATION_CLASS SectionInformationClass, 4280 OUT PVOID SectionInformation, 4281 IN ULONG SectionInformationLength, 4282 OUT PULONG ResultLength OPTIONAL 4283 ); 4284 4285 NTSYSAPI BOOLEAN NTAPI NtQueryPortInformationProcess( 4286 VOID 4287 ); 4288 4289 NTSYSAPI NTSTATUS NTAPI NtQueryPerformanceCounter( 4290 OUT PLARGE_INTEGER PerformanceCount, 4291 OUT PLARGE_INTEGER PerformanceFrequency OPTIONAL 4292 ); 4293 4294 NTSYSAPI NTSTATUS NTAPI NtQueryOpenSubKeys( 4295 IN POBJECT_ATTRIBUTES KeyObjectAttributes, 4296 OUT PULONG NumberOfKeys 4297 ); 4298 4299 NTSYSAPI NTSTATUS NTAPI NtQueryObject( 4300 IN HANDLE ObjectHandle, 4301 IN OBJECT_INFORMATION_CLASS ObjectInformationClass, 4302 OUT PVOID ObjectInformation, 4303 IN ULONG ObjectInformationLength, 4304 OUT PULONG ReturnLength OPTIONAL 4305 ); 4306 4307 NTSYSAPI NTSTATUS NTAPI NtQueryMultipleValueKey( 4308 IN HANDLE KeyHandle, 4309 IN OUT PKEY_VALUE_ENTRY ValueList, 4310 IN ULONG NumberOfValues, 4311 OUT PVOID Buffer, 4312 IN OUT PULONG Length, 4313 OUT PULONG ReturnLength 4314 ); 4315 4316 NTSYSAPI NTSTATUS NTAPI NtQueryKey( 4317 IN HANDLE KeyHandle, 4318 IN KEY_INFORMATION_CLASS KeyInformationClass, 4319 OUT PVOID KeyInformation, 4320 IN ULONG KeyInformationLength, 4321 OUT PULONG ResultLength 4322 ); 4323 4324 NTSYSAPI NTSTATUS NTAPI NtQueryIntervalProfile( 4325 IN KPROFILE_SOURCE Source, 4326 OUT PULONG Interval 4327 ); 4328 4329 NTSYSAPI NTSTATUS NTAPI NtQueryInstallUILanguage( 4330 OUT PLANGID LanguageId 4331 ); 4332 4333 NTSYSAPI NTSTATUS NTAPI NtQueryInformationToken( 4334 IN HANDLE TokenHandle, 4335 IN TOKEN_INFORMATION_CLASS TokenInformationClass, 4336 OUT PVOID TokenInformation, 4337 IN ULONG TokenInformationLength, 4338 OUT PULONG ReturnLength 4339 ); 4340 4341 NTSYSAPI NTSTATUS NTAPI NtQueryInformationThread( 4342 IN HANDLE ThreadHandle, 4343 IN THREADINFOCLASS ThreadInformationClass, 4344 OUT PVOID ThreadInformation, 4345 IN ULONG ThreadInformationLength, 4346 OUT PULONG ReturnLength OPTIONAL 4347 ); 4348 4349 NTSYSAPI NTSTATUS NTAPI NtQueryInformationProcess( 4350 IN HANDLE ProcessHandle, 4351 IN PROCESSINFOCLASS ProcessInformationClass, 4352 OUT PVOID ProcessInformation, 4353 IN ULONG ProcessInformationLength, 4354 OUT PULONG ReturnLength OPTIONAL 4355 ); 4356 4357 NTSYSAPI NTSTATUS NTAPI NtQueryInformationPort( 4358 IN HANDLE PortHandle, 4359 IN PORT_INFORMATION_CLASS PortInformationClass, 4360 OUT PVOID PortInformation, 4361 IN ULONG PortInformationLength, 4362 OUT PULONG ReturnLength OPTIONAL 4363 ); 4364 4365 NTSYSAPI NTSTATUS NTAPI NtQueryInformationJobObject( 4366 IN HANDLE JobHandle, 4367 IN JOBOBJECTINFOCLASS JobInformationClass, 4368 OUT PVOID JobInformation, 4369 IN ULONG JobInformationLength, 4370 OUT PULONG ReturnLength OPTIONAL 4371 ); 4372 4373 NTSYSAPI NTSTATUS NTAPI NtQueryInformationFile( 4374 IN HANDLE FileHandle, 4375 OUT PIO_STATUS_BLOCK IoStatusBlock, 4376 OUT PVOID FileInformation, 4377 IN ULONG FileInformationLength, 4378 IN FILE_INFORMATION_CLASS FileInformationClass 4379 ); 4380 4381 NTSYSAPI NTSTATUS NTAPI NtQueryInformationAtom( 4382 IN USHORT Atom, 4383 IN ATOM_INFORMATION_CLASS AtomInformationClass, 4384 OUT PVOID AtomInformation, 4385 IN ULONG AtomInformationLength, 4386 OUT PULONG ReturnLength OPTIONAL 4387 ); 4388 4389 NTSYSAPI NTSTATUS NTAPI NtQueryFullAttributesFile( 4390 IN POBJECT_ATTRIBUTES ObjectAttributes, 4391 OUT PFILE_NETWORK_OPEN_INFORMATION FileInformation 4392 ); 4393 4394 NTSYSAPI NTSTATUS NTAPI NtQueryEvent( 4395 IN HANDLE EventHandle, 4396 IN EVENT_INFORMATION_CLASS EventInformationClass, 4397 OUT PVOID EventInformation, 4398 IN ULONG EventInformationLength, 4399 OUT PULONG ResultLength OPTIONAL 4400 ); 4401 4402 NTSYSAPI NTSTATUS NTAPI NtQueryDirectoryObject( 4403 IN HANDLE DirectoryHandle, 4404 OUT PVOID Buffer, 4405 IN ULONG BufferLength, 4406 IN BOOLEAN ReturnSingleEntry, 4407 IN BOOLEAN RestartScan, 4408 IN OUT PULONG Context, 4409 OUT PULONG ReturnLength OPTIONAL 4410 ); 4411 4412 NTSYSAPI NTSTATUS NTAPI NtQueryDirectoryFile( 4413 IN HANDLE FileHandle, 4414 IN HANDLE Event OPTIONAL, 4415 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 4416 IN PVOID ApcContext OPTIONAL, 4417 OUT PIO_STATUS_BLOCK IoStatusBlock, 4418 OUT PVOID FileInformation, 4419 IN ULONG FileInformationLength, 4420 IN FILE_INFORMATION_CLASS FileInformationClass, 4421 IN BOOLEAN ReturnSingleEntry, 4422 IN PUNICODE_STRING FileName OPTIONAL, 4423 IN BOOLEAN RestartScan 4424 ); 4425 4426 NTSYSAPI NTSTATUS NTAPI NtQueryDefaultUILanguage( 4427 OUT PLANGID LanguageId 4428 ); 4429 4430 NTSYSAPI NTSTATUS NTAPI NtQueryDefaultLocale( 4431 IN BOOLEAN ThreadOrSystem, 4432 OUT PLCID Locale 4433 ); 4434 4435 NTSYSAPI NTSTATUS NTAPI NtQueryDebugFilterState( 4436 IN ULONG ComponentId, 4437 IN ULONG Level 4438 ); 4439 4440 NTSYSAPI NTSTATUS NTAPI NtQueryBootOptions( 4441 IN ULONG Unknown1, 4442 IN ULONG Unknown2 4443 ); 4444 4445 NTSYSAPI NTSTATUS NTAPI NtQueryBootEntryOrder( 4446 IN ULONG Unknown1, 4447 IN ULONG Unknown2 4448 ); 4449 4450 NTSYSAPI NTSTATUS NTAPI NtQueryAttributesFile( 4451 IN POBJECT_ATTRIBUTES ObjectAttributes, 4452 OUT PFILE_BASIC_INFORMATION FileInformation 4453 ); 4454 4455 NTSYSAPI NTSTATUS NTAPI NtPulseEvent( 4456 IN HANDLE EventHandle, 4457 OUT PULONG PreviousState OPTIONAL 4458 ); 4459 4460 NTSYSAPI NTSTATUS NTAPI NtProtectVirtualMemory( 4461 IN HANDLE ProcessHandle, 4462 IN OUT PVOID *BaseAddress, 4463 IN OUT PULONG ProtectSize, 4464 IN ULONG NewProtect, 4465 OUT PULONG OldProtect 4466 ); 4467 4468 NTSYSAPI NTSTATUS NTAPI NtPrivilegedServiceAuditAlarm( 4469 IN PUNICODE_STRING SubsystemName, 4470 IN PUNICODE_STRING ServiceName, 4471 IN HANDLE TokenHandle, 4472 IN PPRIVILEGE_SET Privileges, 4473 IN BOOLEAN AccessGranted 4474 ); 4475 4476 NTSYSAPI NTSTATUS NTAPI NtPrivilegeObjectAuditAlarm( 4477 IN PUNICODE_STRING SubsystemName, 4478 IN PVOID HandleId, 4479 IN HANDLE TokenHandle, 4480 IN ACCESS_MASK DesiredAccess, 4481 IN PPRIVILEGE_SET Privileges, 4482 IN BOOLEAN AccessGranted 4483 ); 4484 4485 NTSYSAPI NTSTATUS NTAPI NtPrivilegeCheck( 4486 IN HANDLE TokenHandle, 4487 IN PPRIVILEGE_SET RequiredPrivileges, 4488 OUT PBOOLEAN Result 4489 ); 4490 4491 NTSYSAPI NTSTATUS NTAPI NtPowerInformation( 4492 IN POWER_INFORMATION_LEVEL PowerInformationLevel, 4493 IN PVOID InputBuffer OPTIONAL, 4494 IN ULONG InputBufferLength, 4495 OUT PVOID OutputBuffer OPTIONAL, 4496 IN ULONG OutputBufferLength 4497 ); 4498 4499 NTSYSAPI NTSTATUS NTAPI NtPlugPlayControl( 4500 IN ULONG ControlCode, 4501 IN OUT PVOID Buffer, 4502 IN ULONG BufferLength, 4503 IN PVOID Unknown OPTIONAL 4504 ); 4505 4506 NTSYSAPI NTSTATUS NTAPI NtOpenTimer( 4507 OUT PHANDLE TimerHandle, 4508 IN ACCESS_MASK DesiredAccess, 4509 IN POBJECT_ATTRIBUTES ObjectAttributes 4510 ); 4511 4512 NTSYSAPI NTSTATUS NTAPI NtOpenThreadTokenEx( 4513 IN HANDLE ThreadHandle, 4514 IN ACCESS_MASK DesiredAccess, 4515 IN BOOLEAN OpenAsSelf, 4516 IN ULONG HandleAttributes, 4517 OUT PHANDLE TokenHandle 4518 ); 4519 4520 NTSYSAPI NTSTATUS NTAPI NtOpenThreadToken( 4521 IN HANDLE ThreadHandle, 4522 IN ACCESS_MASK DesiredAccess, 4523 IN BOOLEAN OpenAsSelf, 4524 OUT PHANDLE TokenHandle 4525 ); 4526 4527 NTSYSAPI NTSTATUS NTAPI NtOpenThread( 4528 OUT PHANDLE ThreadHandle, 4529 IN ACCESS_MASK DesiredAccess, 4530 IN POBJECT_ATTRIBUTES ObjectAttributes, 4531 IN PCLIENT_ID ClientId 4532 ); 4533 4534 NTSYSAPI NTSTATUS NTAPI NtOpenSymbolicLinkObject( 4535 OUT PHANDLE SymbolicLinkHandle, 4536 IN ACCESS_MASK DesiredAccess, 4537 IN POBJECT_ATTRIBUTES ObjectAttributes 4538 ); 4539 4540 NTSYSAPI NTSTATUS NTAPI NtOpenSemaphore( 4541 OUT PHANDLE SemaphoreHandle, 4542 IN ACCESS_MASK DesiredAccess, 4543 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL 4544 ); 4545 4546 NTSYSAPI NTSTATUS NTAPI NtOpenSection( 4547 OUT PHANDLE SectionHandle, 4548 IN ACCESS_MASK DesiredAccess, 4549 IN POBJECT_ATTRIBUTES ObjectAttributes 4550 ); 4551 4552 NTSYSAPI NTSTATUS NTAPI NtOpenProcessTokenEx( 4553 IN HANDLE ProcessHandle, 4554 IN ACCESS_MASK DesiredAccess, 4555 IN ULONG HandleAttributes, 4556 OUT PHANDLE TokenHandle 4557 ); 4558 4559 NTSYSAPI NTSTATUS NTAPI NtOpenProcessToken( 4560 IN HANDLE ProcessHandle, 4561 IN ACCESS_MASK DesiredAccess, 4562 OUT PHANDLE TokenHandle 4563 ); 4564 4565 NTSYSAPI NTSTATUS NTAPI NtOpenProcess( 4566 OUT PHANDLE ProcessHandle, 4567 IN ACCESS_MASK DesiredAccess, 4568 IN POBJECT_ATTRIBUTES ObjectAttributes, 4569 IN PCLIENT_ID ClientId OPTIONAL 4570 ); 4571 4572 NTSYSAPI NTSTATUS NTAPI NtOpenObjectAuditAlarm( 4573 IN PUNICODE_STRING SubsystemName, 4574 IN PVOID *HandleId, 4575 IN PUNICODE_STRING ObjectTypeName, 4576 IN PUNICODE_STRING ObjectName, 4577 IN PSECURITY_DESCRIPTOR SecurityDescriptor, 4578 IN HANDLE TokenHandle, 4579 IN ACCESS_MASK DesiredAccess, 4580 IN ACCESS_MASK GrantedAccess, 4581 IN PPRIVILEGE_SET Privileges OPTIONAL, 4582 IN BOOLEAN ObjectCreation, 4583 IN BOOLEAN AccessGranted, 4584 OUT PBOOLEAN GenerateOnClose 4585 ); 4586 4587 NTSYSAPI NTSTATUS NTAPI NtOpenMutant( 4588 OUT PHANDLE MutantHandle, 4589 IN ACCESS_MASK DesiredAccess, 4590 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL 4591 ); 4592 4593 NTSYSAPI NTSTATUS NTAPI NtOpenKeyedEvent( 4594 OUT PHANDLE KeyedEventHandle, 4595 IN ACCESS_MASK DesiredAccess, 4596 IN POBJECT_ATTRIBUTES ObjectAttributes 4597 ); 4598 4599 NTSYSAPI NTSTATUS NTAPI NtOpenKey( 4600 OUT PHANDLE KeyHandle, 4601 IN ACCESS_MASK DesiredAccess, 4602 IN POBJECT_ATTRIBUTES ObjectAttributes 4603 ); 4604 4605 NTSYSAPI NTSTATUS NTAPI NtOpenJobObject( 4606 OUT PHANDLE JobHandle, 4607 IN ACCESS_MASK DesiredAccess, 4608 IN POBJECT_ATTRIBUTES ObjectAttributes 4609 ); 4610 4611 NTSYSAPI NTSTATUS NTAPI NtOpenIoCompletion( 4612 OUT PHANDLE IoCompletionHandle, 4613 IN ACCESS_MASK DesiredAccess, 4614 IN POBJECT_ATTRIBUTES ObjectAttributes 4615 ); 4616 4617 NTSYSAPI NTSTATUS NTAPI NtOpenFile( 4618 OUT PHANDLE FileHandle, 4619 IN ACCESS_MASK DesiredAccess, 4620 IN POBJECT_ATTRIBUTES ObjectAttributes, 4621 OUT PIO_STATUS_BLOCK IoStatusBlock, 4622 IN ULONG ShareAccess, 4623 IN ULONG OpenOptions 4624 ); 4625 4626 NTSYSAPI NTSTATUS NTAPI NtOpenEventPair( 4627 OUT PHANDLE EventPairHandle, 4628 IN ACCESS_MASK DesiredAccess, 4629 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL 4630 ); 4631 4632 NTSYSAPI NTSTATUS NTAPI NtOpenEvent( 4633 OUT PHANDLE EventHandle, 4634 IN ACCESS_MASK DesiredAccess, 4635 IN POBJECT_ATTRIBUTES ObjectAttributes 4636 ); 4637 4638 NTSYSAPI NTSTATUS NTAPI NtOpenDirectoryObject( 4639 OUT PHANDLE DirectoryHandle, 4640 IN ACCESS_MASK DesiredAccess, 4641 IN POBJECT_ATTRIBUTES ObjectAttributes 4642 ); 4643 4644 NTSYSAPI NTSTATUS NTAPI NtNotifyChangeMultipleKeys( 4645 IN HANDLE KeyHandle, 4646 IN ULONG Flags, 4647 IN POBJECT_ATTRIBUTES KeyObjectAttributes, 4648 IN HANDLE EventHandle OPTIONAL, 4649 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 4650 IN PVOID ApcContext OPTIONAL, 4651 OUT PIO_STATUS_BLOCK IoStatusBlock, 4652 IN ULONG NotifyFilter, 4653 IN BOOLEAN WatchSubtree, 4654 IN PVOID Buffer, 4655 IN ULONG BufferLength, 4656 IN BOOLEAN Asynchronous 4657 ); 4658 4659 NTSYSAPI NTSTATUS NTAPI NtNotifyChangeKey( 4660 IN HANDLE KeyHandle, 4661 IN HANDLE EventHandle OPTIONAL, 4662 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 4663 IN PVOID ApcContext OPTIONAL, 4664 OUT PIO_STATUS_BLOCK IoStatusBlock, 4665 IN ULONG NotifyFilter, 4666 IN BOOLEAN WatchSubtree, 4667 IN PVOID Buffer, 4668 IN ULONG BufferLength, 4669 IN BOOLEAN Asynchronous 4670 ); 4671 4672 NTSYSAPI NTSTATUS NTAPI NtNotifyChangeDirectoryFile( 4673 IN HANDLE FileHandle, 4674 IN HANDLE Event OPTIONAL, 4675 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 4676 IN PVOID ApcContext OPTIONAL, 4677 OUT PIO_STATUS_BLOCK IoStatusBlock, 4678 OUT PFILE_NOTIFY_INFORMATION Buffer, 4679 IN ULONG BufferLength, 4680 IN ULONG NotifyFilter, 4681 IN BOOLEAN WatchSubtree 4682 ); 4683 4684 NTSYSAPI NTSTATUS NTAPI NtModifyDriverEntry( 4685 IN PUNICODE_STRING DriverName, 4686 IN PUNICODE_STRING DriverPath 4687 ); 4688 4689 NTSYSAPI NTSTATUS NTAPI NtModifyBootEntry( 4690 IN PUNICODE_STRING EntryName, 4691 IN PUNICODE_STRING EntryValue 4692 ); 4693 4694 NTSYSAPI NTSTATUS NTAPI NtMapViewOfSection( 4695 IN HANDLE SectionHandle, 4696 IN HANDLE ProcessHandle, 4697 IN OUT PVOID *BaseAddress, 4698 IN ULONG ZeroBits, 4699 IN ULONG CommitSize, 4700 IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, 4701 IN OUT PULONG ViewSize, 4702 IN SECTION_INHERIT InheritDisposition, 4703 IN ULONG AllocationType, 4704 IN ULONG Protect 4705 ); 4706 4707 NTSYSAPI NTSTATUS NTAPI NtMapUserPhysicalPagesScatter( 4708 IN PVOID *BaseAddresses, 4709 IN PULONG NumberOfPages, 4710 IN PULONG PageFrameNumbers 4711 ); 4712 4713 NTSYSAPI NTSTATUS NTAPI NtMapUserPhysicalPages( 4714 IN PVOID BaseAddress, 4715 IN PULONG NumberOfPages, 4716 IN PULONG PageFrameNumbers 4717 ); 4718 4719 NTSYSAPI NTSTATUS NTAPI NtMakeTemporaryObject( 4720 IN HANDLE ObjectHandle 4721 ); 4722 4723 NTSYSAPI NTSTATUS NTAPI NtMakePermanentObject( 4724 IN HANDLE Object 4725 ); 4726 4727 NTSYSAPI NTSTATUS NTAPI NtLockVirtualMemory( 4728 IN HANDLE ProcessHandle, 4729 IN OUT PVOID *BaseAddress, 4730 IN OUT PULONG LockSize, 4731 IN ULONG LockType 4732 ); 4733 4734 NTSYSAPI NTSTATUS NTAPI NtLockRegistryKey( 4735 IN HANDLE Key 4736 ); 4737 4738 NTSYSAPI NTSTATUS NTAPI NtLockFile( 4739 IN HANDLE FileHandle, 4740 IN HANDLE Event OPTIONAL, 4741 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 4742 IN PVOID ApcContext OPTIONAL, 4743 OUT PIO_STATUS_BLOCK IoStatusBlock, 4744 IN PULARGE_INTEGER LockOffset, 4745 IN PULARGE_INTEGER LockLength, 4746 IN ULONG Key, 4747 IN BOOLEAN FailImmediately, 4748 IN BOOLEAN ExclusiveLock 4749 ); 4750 4751 NTSYSAPI NTSTATUS NTAPI NtLoadKey( 4752 IN POBJECT_ATTRIBUTES KeyObjectAttributes, 4753 IN POBJECT_ATTRIBUTES FileObjectAttributes 4754 ); 4755 4756 NTSYSAPI NTSTATUS NTAPI NtLoadKey2( 4757 IN POBJECT_ATTRIBUTES KeyObjectAttributes, 4758 IN POBJECT_ATTRIBUTES FileObjectAttributes, 4759 IN ULONG Flags 4760 ); 4761 4762 NTSYSAPI NTSTATUS NTAPI NtLoadDriver( 4763 IN PUNICODE_STRING DriverServiceName 4764 ); 4765 4766 NTSYSAPI NTSTATUS NTAPI NtListenPort( 4767 IN HANDLE PortHandle, 4768 OUT PPORT_MESSAGE RequestMessage 4769 ); 4770 4771 NTSYSAPI NTSTATUS NTAPI NtFreeUserPhysicalPages( 4772 IN HANDLE ProcessHandle, 4773 IN OUT PULONG NumberOfPages, 4774 IN PULONG PageFrameNumbers 4775 ); 4776 4777 NTSYSAPI NTSTATUS NTAPI NtFreeVirtualMemory( 4778 IN HANDLE ProcessHandle, 4779 IN OUT PVOID *BaseAddress, 4780 IN OUT PULONG FreeSize, 4781 IN ULONG FreeType 4782 ); 4783 4784 NTSYSAPI NTSTATUS NTAPI NtFsControlFile( 4785 IN HANDLE FileHandle, 4786 IN HANDLE Event OPTIONAL, 4787 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 4788 IN PVOID ApcContext OPTIONAL, 4789 OUT PIO_STATUS_BLOCK IoStatusBlock, 4790 IN ULONG FsControlCode, 4791 IN PVOID InputBuffer OPTIONAL, 4792 IN ULONG InputBufferLength, 4793 OUT PVOID OutputBuffer OPTIONAL, 4794 IN ULONG OutputBufferLength 4795 ); 4796 4797 NTSYSAPI NTSTATUS NTAPI NtGetContextThread( 4798 IN HANDLE ThreadHandle, 4799 OUT PCONTEXT Context 4800 ); 4801 4802 NTSYSAPI NTSTATUS NTAPI NtGetDevicePowerState( 4803 IN HANDLE DeviceHandle, 4804 OUT PDEVICE_POWER_STATE DevicePowerState 4805 ); 4806 4807 NTSYSAPI NTSTATUS NTAPI NtGetPlugPlayEvent( 4808 IN ULONG Reserved1, 4809 IN ULONG Reserved2, 4810 OUT PVOID Buffer, 4811 IN ULONG BufferLength 4812 ); 4813 4814 NTSYSAPI NTSTATUS NTAPI NtGetWriteWatch( 4815 IN HANDLE ProcessHandle, 4816 IN ULONG Flags, 4817 IN PVOID BaseAddress, 4818 IN ULONG RegionSize, 4819 OUT PULONG Buffer, 4820 IN OUT PULONG BufferEntries, 4821 OUT PULONG Granularity 4822 ); 4823 4824 NTSYSAPI NTSTATUS NTAPI NtImpersonateAnonymousToken( 4825 IN HANDLE ThreadHandle 4826 ); 4827 4828 NTSYSAPI NTSTATUS NTAPI NtImpersonateClientOfPort( 4829 IN HANDLE PortHandle, 4830 IN PPORT_MESSAGE Message 4831 ); 4832 4833 NTSYSAPI NTSTATUS NTAPI NtImpersonateThread( 4834 IN HANDLE ThreadHandle, 4835 IN HANDLE TargetThreadHandle, 4836 IN PSECURITY_QUALITY_OF_SERVICE SecurityQos 4837 ); 4838 4839 NTSYSAPI NTSTATUS NTAPI NtInitializeRegistry( 4840 IN BOOLEAN Setup 4841 ); 4842 4843 NTSYSAPI NTSTATUS NTAPI NtInitiatePowerAction( 4844 IN POWER_ACTION SystemAction, 4845 IN SYSTEM_POWER_STATE MinSystemState, 4846 IN ULONG Flags, 4847 IN BOOLEAN Asynchronous 4848 ); 4849 4850 NTSYSAPI NTSTATUS NTAPI NtIsProcessInJob( 4851 IN HANDLE ProcessHandle, 4852 IN HANDLE JobHandle OPTIONAL 4853 ); 4854 4855 NTSYSAPI BOOLEAN NTAPI NtIsSystemResumeAutomatic( 4856 VOID 4857 ); 4858 4859 NTSYSAPI NTSTATUS NTAPI NtTestAlert( 4860 VOID 4861 ); 4862 4863 NTSYSAPI NTSTATUS NTAPI NtAlertThread( 4864 IN HANDLE ThreadHandle 4865 ); 4866 4867 NTSYSAPI ULONG NTAPI NtGetTickCount( 4868 VOID 4869 ); 4870 4871 NTSYSAPI NTSTATUS NTAPI NtW32Call( 4872 IN ULONG RoutineIndex, 4873 IN PVOID Argument, 4874 IN ULONG ArgumentLength, 4875 OUT PVOID *Result OPTIONAL, 4876 OUT PULONG ResultLength OPTIONAL 4877 ); 4878 4879 NTSYSAPI NTSTATUS NTAPI NtSetLowWaitHighThread( 4880 VOID 4881 ); 4882 4883 NTSYSAPI NTSTATUS NTAPI NtSetHighWaitLowThread( 4884 VOID 4885 ); 4886 4887 NTSYSAPI NTSTATUS NTAPI NtCreatePagingFile( 4888 IN PUNICODE_STRING FileName, 4889 IN PULARGE_INTEGER InitialSize, 4890 IN PULARGE_INTEGER MaximumSize, 4891 IN ULONG Priority OPTIONAL 4892 ); 4893 4894 NTSYSAPI NTSTATUS NTAPI NtVdmControl( 4895 IN ULONG ControlCode, 4896 IN PVOID ControlData 4897 ); 4898 4899 NTSYSAPI NTSTATUS NTAPI NtQueryEaFile( 4900 IN HANDLE FileHandle, 4901 OUT PIO_STATUS_BLOCK IoStatusBlock, 4902 OUT PVOID Buffer, 4903 IN ULONG Length, 4904 IN BOOLEAN ReturnSingleEntry, 4905 IN PVOID EaList OPTIONAL, 4906 IN ULONG EaListLength, 4907 IN PULONG EaIndex OPTIONAL, 4908 IN BOOLEAN RestartScan 4909 ); 4910 4911 NTSTATUS NTAPI RtlCreateProcessParameters( 4912 OUT PRTL_USER_PROCESS_PARAMETERS *ProcessParameters, 4913 IN PUNICODE_STRING ImageFile, 4914 IN PUNICODE_STRING DllPath OPTIONAL, 4915 IN PUNICODE_STRING CurrentDirectory OPTIONAL, 4916 IN PUNICODE_STRING CommandLine OPTIONAL, 4917 IN PWSTR Environment OPTIONAL, 4918 IN PUNICODE_STRING WindowTitle OPTIONAL, 4919 IN PUNICODE_STRING DesktopInfo OPTIONAL, 4920 IN PUNICODE_STRING ShellInfo OPTIONAL, 4921 IN PUNICODE_STRING RuntimeInfo OPTIONAL 4922 ); 4923 4924 NTSTATUS NTAPI RtlDestroyProcessParameters( 4925 IN PRTL_USER_PROCESS_PARAMETERS ProcessParameters 4926 ); 4927 4928 PDEBUG_BUFFER NTAPI RtlCreateQueryDebugBuffer( 4929 IN ULONG Size, 4930 IN BOOLEAN EventPair 4931 ); 4932 4933 NTSTATUS NTAPI RtlQueryProcessDebugInformation( 4934 IN ULONG ProcessId, 4935 IN ULONG DebugInfoClassMask, 4936 IN OUT PDEBUG_BUFFER DebugBuffer 4937 ); 4938 4939 NTSTATUS NTAPI RtlDestroyQueryDebugBuffer( 4940 IN PDEBUG_BUFFER DebugBuffer 4941 ); 4942 4943 NTSYSAPI VOID NTAPI RtlInitUnicodeString( 4944 OUT PUNICODE_STRING DestinationString, 4945 IN PCWSTR SourceString 4946 ); 4947 4948 NTSYSAPI VOID NTAPI RtlInitString( 4949 PSTRING DestinationString, 4950 PCSTR SourceString 4951 ); 4952 4953 NTSYSAPI VOID NTAPI RtlInitAnsiString( 4954 OUT PANSI_STRING DestinationString, 4955 IN PCSTR SourceString 4956 ); 4957 4958 NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString( 4959 OUT PUNICODE_STRING DestinationString, 4960 IN PANSI_STRING SourceString, 4961 IN BOOLEAN AllocateDestinationString 4962 ); 4963 4964 NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToAnsiString( 4965 OUT PANSI_STRING DestinationString, 4966 IN PCUNICODE_STRING SourceString, 4967 IN BOOLEAN AllocateDestinationString 4968 ); 4969 4970 NTSYSAPI LONG NTAPI RtlCompareUnicodeString( 4971 IN PUNICODE_STRING String1, 4972 IN PUNICODE_STRING String2, 4973 IN BOOLEAN CaseInSensitive 4974 ); 4975 4976 NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString( 4977 IN PCUNICODE_STRING String1, 4978 IN PCUNICODE_STRING String2, 4979 IN BOOLEAN CaseInSensitive 4980 ); 4981 4982 NTSYSAPI NTSTATUS NTAPI RtlHashUnicodeString( 4983 IN CONST UNICODE_STRING *String, 4984 IN BOOLEAN CaseInSensitive, 4985 IN ULONG HashAlgorithm, 4986 OUT PULONG HashValue 4987 ); 4988 4989 NTSYSAPI VOID NTAPI RtlCopyUnicodeString( 4990 OUT PUNICODE_STRING DestinationString, 4991 IN PUNICODE_STRING SourceString 4992 ); 4993 4994 NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString( 4995 IN OUT PUNICODE_STRING Destination, 4996 IN PUNICODE_STRING Source 4997 ); 4998 4999 NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeToString( 5000 PUNICODE_STRING Destination, 5001 PCWSTR Source 5002 ); 5003 5004 NTSYSAPI VOID NTAPI RtlFreeUnicodeString( 5005 PUNICODE_STRING UnicodeString 5006 ); 5007 5008 NTSYSAPI VOID NTAPI RtlFreeAnsiString( 5009 PANSI_STRING AnsiString 5010 ); 5011 5012 NTSYSAPI ULONG NTAPI RtlxUnicodeStringToAnsiSize( 5013 PCUNICODE_STRING UnicodeString 5014 ); 5015 5016 NTSYSAPI DWORD NTAPI RtlNtStatusToDosError( 5017 IN NTSTATUS status 5018 ); 5019 5020 NTSYSAPI NTSTATUS NTAPI RtlAdjustPrivilege( 5021 ULONG Privilege, 5022 BOOLEAN Enable, 5023 BOOLEAN CurrentThread, 5024 PBOOLEAN Enabled 5025 ); 5026 5027 NTSYSAPI BOOLEAN NTAPI RtlCreateUnicodeString( 5028 OUT PUNICODE_STRING DestinationString, 5029 IN PCWSTR SourceString 5030 ); 5031 5032 NTSYSAPI BOOLEAN NTAPI RtlCreateUnicodeStringFromAsciiz( 5033 OUT PUNICODE_STRING Destination, 5034 IN PCSTR Source 5035 ); 5036 5037 NTSYSAPI BOOLEAN NTAPI RtlPrefixUnicodeString( 5038 IN PUNICODE_STRING String1, 5039 IN PUNICODE_STRING String2, 5040 IN BOOLEAN CaseInSensitive 5041 ); 5042 5043 NTSYSAPI NTSTATUS NTAPI RtlDuplicateUnicodeString( 5044 IN BOOLEAN AllocateNew, 5045 IN PUNICODE_STRING SourceString, 5046 OUT PUNICODE_STRING TargetString 5047 ); 5048 5049 NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToInteger( 5050 IN PUNICODE_STRING String, 5051 IN ULONG Base OPTIONAL, 5052 OUT PULONG Value 5053 ); 5054 5055 NTSYSAPI NTSTATUS NTAPI RtlIntegerToUnicodeString( 5056 IN ULONG Value, 5057 IN ULONG Base OPTIONAL, 5058 IN OUT PUNICODE_STRING String 5059 ); 5060 5061 NTSYSAPI NTSTATUS NTAPI RtlGUIDFromString( 5062 IN PUNICODE_STRING GuidString, 5063 OUT GUID *Guid 5064 ); 5065 5066 NTSYSAPI NTSTATUS NTAPI RtlUpcaseUnicodeString( 5067 OUT PUNICODE_STRING DestinationString, 5068 IN PUNICODE_STRING SourceString, 5069 IN BOOLEAN AllocateDestinationString 5070 ); 5071 5072 NTSYSAPI NTSTATUS NTAPI RtlDowncaseUnicodeString( 5073 OUT PUNICODE_STRING DestinationString, 5074 IN PUNICODE_STRING SourceString, 5075 IN BOOLEAN AllocateDestinationString 5076 ); 5077 5078 NTSYSAPI NTSTATUS NTAPI RtlFormatCurrentUserKeyPath( 5079 OUT PUNICODE_STRING CurrentUserKeyPath 5080 ); 5081 5082 NTSYSAPI VOID NTAPI RtlRaiseStatus( 5083 IN NTSTATUS Status 5084 ); 5085 5086 NTSYSAPI ULONG NTAPI RtlRandom( 5087 IN OUT PULONG Seed 5088 ); 5089 5090 NTSYSAPI NTSTATUS NTAPI RtlInitializeCriticalSection( 5091 IN PRTL_CRITICAL_SECTION CriticalSection 5092 ); 5093 5094 NTSYSAPI BOOL NTAPI RtlTryEnterCriticalSection( 5095 IN PRTL_CRITICAL_SECTION CriticalSection 5096 ); 5097 5098 NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection( 5099 IN PRTL_CRITICAL_SECTION CriticalSection 5100 ); 5101 5102 NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection( 5103 IN PRTL_CRITICAL_SECTION CriticalSection 5104 ); 5105 5106 NTSYSAPI NTSTATUS NTAPI RtlDeleteCriticalSection( 5107 IN PRTL_CRITICAL_SECTION CriticalSection 5108 ); 5109 5110 NTSYSAPI NTSTATUS NTAPI RtlCompressBuffer( 5111 IN USHORT CompressionFormatAndEngine, 5112 IN PUCHAR UncompressedBuffer, 5113 IN ULONG UncompressedBufferSize, 5114 OUT PUCHAR CompressedBuffer, 5115 IN ULONG CompressedBufferSize, 5116 IN ULONG UncompressedChunkSize, 5117 OUT PULONG FinalCompressedSize, 5118 IN PVOID WorkSpace 5119 ); 5120 5121 NTSYSAPI NTSTATUS NTAPI RtlDecompressBuffer( 5122 IN USHORT CompressionFormat, 5123 OUT PUCHAR UncompressedBuffer, 5124 IN ULONG UncompressedBufferSize, 5125 IN PUCHAR CompressedBuffer, 5126 IN ULONG CompressedBufferSize, 5127 OUT PULONG FinalUncompressedSize 5128 ); 5129 5130 NTSYSAPI VOID NTAPI RtlInitializeHandleTable( 5131 IN ULONG MaximumNumberOfHandles, 5132 IN ULONG SizeOfHandleTableEntry, 5133 OUT PRTL_HANDLE_TABLE HandleTable 5134 ); 5135 5136 NTSYSAPI PRTL_HANDLE_TABLE_ENTRY NTAPI RtlAllocateHandle( 5137 IN PRTL_HANDLE_TABLE HandleTable, 5138 OUT PULONG HandleIndex OPTIONAL 5139 ); 5140 5141 NTSYSAPI BOOLEAN NTAPI RtlFreeHandle( 5142 IN PRTL_HANDLE_TABLE HandleTable, 5143 IN PRTL_HANDLE_TABLE_ENTRY Handle 5144 ); 5145 5146 NTSYSAPI BOOLEAN NTAPI RtlIsValidIndexHandle( 5147 IN PRTL_HANDLE_TABLE HandleTable, 5148 IN ULONG HandleIndex, 5149 OUT PRTL_HANDLE_TABLE_ENTRY *Handle 5150 ); 5151 5152 NTSYSAPI NTSTATUS NTAPI RtlOpenCurrentUser( 5153 IN ULONG DesiredAccess, 5154 OUT PHANDLE CurrentUserKey 5155 ); 5156 5157 NTSYSAPI NTSTATUS NTAPI RtlCreateEnvironment( 5158 BOOLEAN CloneCurrentEnvironment, 5159 PVOID *Environment 5160 ); 5161 5162 NTSYSAPI NTSTATUS NTAPI RtlQueryEnvironmentVariable_U( 5163 PVOID Environment, 5164 PUNICODE_STRING Name, 5165 PUNICODE_STRING Value 5166 ); 5167 5168 NTSYSAPI NTSTATUS NTAPI RtlSetEnvironmentVariable( 5169 PVOID *Environment, 5170 PUNICODE_STRING Name, 5171 PUNICODE_STRING Value 5172 ); 5173 5174 NTSYSAPI NTSTATUS NTAPI RtlDestroyEnvironment( 5175 PVOID Environment 5176 ); 5177 5178 NTSYSAPI BOOLEAN NTAPI RtlDosPathNameToNtPathName_U( 5179 IN PWSTR DosPathName, 5180 OUT PUNICODE_STRING NtPathName, 5181 OUT PWSTR * NtFileNamePart OPTIONAL, 5182 OUT PCURDIR DirectoryInfo OPTIONAL 5183 ); 5184 5185 NTSYSAPI NTSTATUS NTAPI RtlCreateUserProcess( 5186 PUNICODE_STRING NtImagePathName, 5187 ULONG Attributes, 5188 PRTL_USER_PROCESS_PARAMETERS ProcessParameters, 5189 PSECURITY_DESCRIPTOR ProcessSecurityDescriptor, 5190 PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, 5191 HANDLE ParentProcess, 5192 BOOLEAN InheritHandles, 5193 HANDLE DebugPort, 5194 HANDLE ExceptionPort, 5195 PRTL_USER_PROCESS_INFORMATION ProcessInformation 5196 ); 5197 5198 NTSYSAPI NTSTATUS NTAPI RtlCreateUserThread( 5199 IN HANDLE Process, 5200 IN PSECURITY_DESCRIPTOR ThreadSecurityDescriptor OPTIONAL, 5201 IN BOOLEAN CreateSuspended, 5202 IN ULONG_PTR ZeroBits OPTIONAL, 5203 IN SIZE_T MaximumStackSize OPTIONAL, 5204 IN SIZE_T CommittedStackSize OPTIONAL, 5205 IN PUSER_THREAD_START_ROUTINE StartAddress, 5206 IN PVOID Parameter OPTIONAL, 5207 OUT PHANDLE Thread OPTIONAL, 5208 OUT PCLIENT_ID ClientId OPTIONAL 5209 ); 5210 5211 NTSYSAPI HANDLE NTAPI RtlCreateHeap( 5212 IN ULONG Flags, 5213 IN PVOID BaseAddress OPTIONAL, 5214 IN ULONG SizeToReserve, 5215 IN ULONG SizeToCommit, 5216 IN BOOLEAN Lock OPTIONAL, 5217 IN PRTL_HEAP_PARAMETERS Definition OPTIONAL 5218 ); 5219 5220 NTSYSAPI ULONG NTAPI RtlDestroyHeap( 5221 IN HANDLE HeapHandle 5222 ); 5223 5224 NTSYSAPI PVOID NTAPI RtlAllocateHeap( 5225 IN HANDLE HeapHandle, 5226 IN ULONG Flags, 5227 IN SIZE_T Size 5228 ); 5229 5230 NTSYSAPI PVOID NTAPI RtlReAllocateHeap( 5231 IN HANDLE HeapHandle, 5232 IN ULONG Flags, 5233 IN LPVOID Address, 5234 IN SIZE_T Size 5235 ); 5236 5237 NTSYSAPI BOOLEAN NTAPI RtlFreeHeap( 5238 IN HANDLE HeapHandle, 5239 IN ULONG Flags, 5240 IN PVOID Address 5241 ); 5242 5243 NTSYSAPI ULONG NTAPI RtlCompactHeap( 5244 IN HANDLE HeapHandle, 5245 IN ULONG Flags 5246 ); 5247 5248 NTSYSAPI BOOLEAN NTAPI RtlLockHeap( 5249 IN HANDLE HeapHandle 5250 ); 5251 5252 NTSYSAPI BOOLEAN NTAPI RtlUnlockHeap( 5253 IN HANDLE HeapHandle 5254 ); 5255 5256 NTSYSAPI ULONG NTAPI RtlSizeHeap( 5257 IN HANDLE HeapHandle, 5258 IN ULONG Flags, 5259 IN PVOID Address 5260 ); 5261 5262 NTSYSAPI BOOLEAN NTAPI RtlValidateHeap( 5263 IN HANDLE HeapHandle, 5264 IN ULONG Flags, 5265 IN PVOID Address OPTIONAL 5266 ); 5267 5268 NTSYSAPI NTSTATUS NTAPI RtlCreateSecurityDescriptor( 5269 IN PSECURITY_DESCRIPTOR SecurityDescriptor, 5270 IN ULONG Revision 5271 ); 5272 5273 NTSYSAPI NTSTATUS NTAPI RtlGetDaclSecurityDescriptor( 5274 IN PSECURITY_DESCRIPTOR SecurityDescriptor, 5275 OUT PBOOLEAN DaclPresent, 5276 OUT PACL *Dacl, 5277 OUT PBOOLEAN DaclDefaulted 5278 ); 5279 5280 NTSYSAPI NTSTATUS NTAPI RtlSetDaclSecurityDescriptor( 5281 IN PSECURITY_DESCRIPTOR SecurityDescriptor, 5282 IN BOOLEAN DaclPresent, 5283 IN PACL Dacl OPTIONAL, 5284 IN BOOLEAN DaclDefaulted OPTIONAL 5285 ); 5286 5287 NTSYSAPI NTSTATUS NTAPI RtlSetOwnerSecurityDescriptor( 5288 IN PSECURITY_DESCRIPTOR SecurityDescriptor, 5289 IN PSID Owner OPTIONAL, 5290 IN BOOLEAN OwnerDefaulted OPTIONAL 5291 ); 5292 5293 NTSYSAPI NTSTATUS NTAPI RtlAllocateAndInitializeSid( 5294 IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority, 5295 IN UCHAR SubAuthorityCount, 5296 IN ULONG SubAuthority0, 5297 IN ULONG SubAuthority1, 5298 IN ULONG SubAuthority2, 5299 IN ULONG SubAuthority3, 5300 IN ULONG SubAuthority4, 5301 IN ULONG SubAuthority5, 5302 IN ULONG SubAuthority6, 5303 IN ULONG SubAuthority7, 5304 OUT PSID *Sid 5305 ); 5306 5307 NTSYSAPI ULONG NTAPI RtlLengthSid( 5308 IN PSID Sid 5309 ); 5310 5311 NTSYSAPI BOOLEAN NTAPI RtlEqualSid( 5312 IN PSID Sid1, 5313 IN PSID Sid2 5314 ); 5315 5316 NTSYSAPI PVOID NTAPI RtlFreeSid( 5317 IN PSID Sid 5318 ); 5319 5320 NTSYSAPI NTSTATUS NTAPI RtlCreateAcl( 5321 IN PACL Acl, 5322 IN ULONG AclLength, 5323 IN ULONG AclRevision 5324 ); 5325 5326 NTSYSAPI NTSTATUS NTAPI RtlGetAce( 5327 IN PACL Acl, 5328 IN ULONG AceIndex, 5329 OUT PVOID *Ace 5330 ); 5331 5332 NTSYSAPI NTSTATUS NTAPI RtlAddAccessAllowedAce( 5333 IN OUT PACL Acl, 5334 IN ULONG AceRevision, 5335 IN ACCESS_MASK AccessMask, 5336 IN PSID Sid 5337 ); 5338 5339 NTSYSAPI NTSTATUS NTAPI RtlAddAccessAllowedAceEx( 5340 IN OUT PACL Acl, 5341 IN ULONG AceRevision, 5342 IN ULONG AceFlags, 5343 IN ULONG AccessMask, 5344 IN PSID Sid 5345 ); 5346 5347 NTSYSAPI ULONG NTAPI RtlNtStatusToDosErrorNoTeb( 5348 NTSTATUS Status 5349 ); 5350 5351 NTSYSAPI NTSTATUS NTAPI RtlGetLastNtStatus( 5352 ); 5353 5354 NTSYSAPI ULONG NTAPI RtlGetLastWin32Error( 5355 ); 5356 5357 NTSYSAPI VOID NTAPI RtlSetLastWin32Error( 5358 ULONG WinError 5359 ); 5360 5361 NTSYSAPI VOID NTAPI RtlSetLastWin32ErrorAndNtStatusFromNtStatus( 5362 NTSTATUS Status 5363 ); 5364 5365 NTSYSAPI VOID NTAPI DbgBreakPoint( 5366 VOID 5367 ); 5368 5369 NTSYSAPI ULONG _cdecl DbgPrint( 5370 PCH Format, 5371 ... 5372 ); 5373 5374 NTSYSAPI NTSTATUS NTAPI LdrLoadDll( 5375 IN PWSTR DllPath OPTIONAL, 5376 IN PULONG DllCharacteristics OPTIONAL, 5377 IN PUNICODE_STRING DllName, 5378 OUT PVOID *DllHandle 5379 ); 5380 5381 NTSYSAPI NTSTATUS NTAPI LdrGetDllHandle( 5382 IN PWSTR DllPath OPTIONAL, 5383 IN PULONG DllCharacteristics OPTIONAL, 5384 IN PUNICODE_STRING DllName, 5385 OUT PVOID * DllHandle 5386 ); 5387 5388 NTSYSAPI NTSTATUS NTAPI LdrUnloadDll( 5389 IN PVOID DllHandle 5390 ); 5391 5392 NTSYSAPI NTSTATUS NTAPI LdrGetProcedureAddress( 5393 IN PVOID DllHandle, 5394 IN PANSI_STRING ProcedureName OPTIONAL, 5395 IN ULONG ProcedureNumber OPTIONAL, 5396 OUT PVOID *ProcedureAddress 5397 ); 5398 5399 #pragma endregion 5400 5401 #pragma region TAIL 5402 5403 #ifdef __cplusplus 5404 } // extern "C" 5405 #endif 5406 5407 #pragma endregion 5408 5409 #endif // __NTDLL_H__ 5410 5411 Ntdll.h