| /* ********************************************************** |
| * Copyright (c) 2011-2017 Google, Inc. All rights reserved. |
| * **********************************************************/ |
| |
| /* Dr. Memory: the memory debugger |
| * |
| * This library is free software; you can redistribute it and/or |
| * modify it under the terms of the GNU Lesser General Public |
| * License as published by the Free Software Foundation; |
| * version 2.1 of the License, and no later version. |
| |
| * This library is distributed in the hope that it will be useful, |
| * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| * Library General Public License for more details. |
| |
| * You should have received a copy of the GNU Lesser General Public |
| * License along with this library; if not, write to the Free Software |
| * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
| */ |
| |
| #include "dr_api.h" |
| #include "drsyscall.h" |
| #include "drsyscall_os.h" |
| #include "drsyscall_windows.h" |
| |
| #include "../wininc/wdm.h" |
| #include "../wininc/ndk_extypes.h" |
| #include "../wininc/ndk_lpctypes.h" |
| #include "../wininc/ndk_iotypes.h" |
| #include "../wininc/wdm.h" |
| #include "../wininc/ntifs.h" |
| #include "../wininc/ntalpctyp.h" |
| #include "table_defines.h" |
| |
| extern drsys_sysnum_t sysnum_SetInformationFile; |
| |
| /* i#1549 We use the following approach here: |
| * 1) We use macros below to describe secondary syscall entries. |
| * 2) We add all syscalls with secondary components in the separate |
| * hashtable using drsys_sysnum_t. |
| */ |
| |
| #define ENTRY_QueryKey(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(KEY_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, W, 0, typename},\ |
| {2, -4, WI},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| /* Since _ version of structure names stored in PDBs, we use the same names here. */ |
| syscall_info_t syscall_QueryKey_info[] = { |
| {{0,0},"NtQueryKey.KeyBasicInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryKey("KeyBasicInformation", "_KEY_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtQueryKey.KeyNodeInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryKey("KeyNodeInformation", "_KEY_NODE_INFORMATION") |
| }, |
| {{0,0},"NtQueryKey.KeyFullInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryKey("KeyFullInformation", "_KEY_FULL_INFORMATION") |
| }, |
| {{0,0},"NtQueryKey.KeyNameInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryKey("KeyNameInformation", "_KEY_NAME_INFORMATION") |
| }, |
| {{0,0},"NtQueryKey.KeyCachedInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryKey("KeyCachedInformation", "_KEY_CACHED_INFORMATION") |
| }, |
| {{0,0},"NtQueryKey.KeyFlagsInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| /* Reserved */ |
| ENTRY_QueryKey("KeyFlagsInformation", "_KEY_FLAGS_INFORMATION") |
| }, |
| {{0,0},"NtQueryKey.KeyVirtualizationInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryKey("KeyVirtualizationInformation", |
| "_KEY_VIRTUALIZATION_INFORMATION") |
| }, |
| {{0,0},"NtQueryKey.KeyHandleTagsInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryKey("KeyHandleTagsInformation", "_KEY_HANDLE_TAGS_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtQueryKey.UNKNOWN", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryKey(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_EnumerateKey(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {2, sizeof(KEY_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {3, -4, W, 0, typename},\ |
| {3, -5, WI},\ |
| {4, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {5, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_EnumerateKey_info[] = { |
| {{0,0},"NtEnumerateKey.KeyBasicInformation", OK, RNTST, 6, |
| ENTRY_EnumerateKey("KeyBasicInformation", "_KEY_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtEnumerateKey.KeyNodeInformation", OK, RNTST, 6, |
| ENTRY_EnumerateKey("KeyNodeInformation", "_KEY_NODE_INFORMATION") |
| }, |
| {{0,0},"NtEnumerateKey.KeyFullInformation", OK, RNTST, 6, |
| ENTRY_EnumerateKey("KeyFullInformation", "_KEY_FULL_INFORMATION") |
| }, |
| {{0,0},"NtEnumerateKey.KeyNameInformation", OK, RNTST, 6, |
| ENTRY_EnumerateKey("KeyNameInformation", "_KEY_NAME_INFORMATION") |
| }, |
| {{0,0},"NtEnumerateKey.KeyCachedInformation", OK, RNTST, 6, |
| ENTRY_EnumerateKey("KeyCachedInformation", "_KEY_CACHED_INFORMATION") |
| }, |
| {{0,0},"NtEnumerateKey.KeyFlagsInformation", OK, RNTST, 6, |
| /* Reserved */ |
| ENTRY_EnumerateKey("KeyFlagsInformation", "_KEY_FLAGS_INFORMATION") |
| }, |
| {{0,0},"NtEnumerateKey.KeyVirtualizationInformation", OK, RNTST, 6, |
| ENTRY_EnumerateKey("KeyVirtualizationInformation", |
| "_KEY_VIRTUALIZATION_INFORMATION") |
| }, |
| {{0,0},"NtEnumerateKey.KeyHandleTagsInformation", OK, RNTST, 6, |
| ENTRY_EnumerateKey("KeyHandleTagsInformation", "_KEY_HANDLE_TAGS_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtEnumerateKey.UNKNOWN", OK, RNTST, 6, |
| ENTRY_EnumerateKey(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_EnumerateValueKey(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {2, sizeof(KEY_VALUE_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {3, -4, W, 0, typename},\ |
| {3, -5, WI},\ |
| {4, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {5, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_EnumerateValueKey_info[] = { |
| {{0,0},"NtEnumerateValueKey.KeyValueBasicInformation", OK, RNTST, 6, |
| ENTRY_EnumerateValueKey("KeyValueBasicInformation", |
| "_KEY_VALUE_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtEnumerateValueKey.KeyValueFullInformation", OK, RNTST, 6, |
| ENTRY_EnumerateValueKey("KeyValueFullInformation", |
| "_KEY_VALUE_FULL_INFORMATION") |
| }, |
| {{0,0},"NtEnumerateValueKey.KeyValuePartialInformation", OK, RNTST, 6, |
| ENTRY_EnumerateValueKey("KeyValuePartialInformation", |
| "_KEY_VALUE_PARTIAL_INFORMATION") |
| }, |
| {{0,0},"NtEnumerateValueKey.KeyValueFullInformationAlign64", OK, RNTST, 6, |
| ENTRY_EnumerateValueKey("KeyValueFullInformationAlign64", |
| "_KEY_VALUE_FULL_INFORMATION") |
| }, |
| {{0,0},"NtEnumerateValueKey.KeyValuePartialInformationAlign64", OK, RNTST, 6, |
| ENTRY_EnumerateValueKey("KeyValuePartialInformationAlign64", |
| "_KEY_VALUE_PARTIAL_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtEnumerateValueKey.UNKNOWN", OK, RNTST, 6, |
| ENTRY_EnumerateValueKey(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_QueryDirectoryFile(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {2, sizeof(PIO_APC_ROUTINE), SYSARG_INLINED, DRSYS_TYPE_FUNCTION},\ |
| {3, sizeof(PVOID), SYSARG_INLINED, DRSYS_TYPE_VOID},\ |
| {4, sizeof(IO_STATUS_BLOCK), W|HT, DRSYS_TYPE_IO_STATUS_BLOCK},\ |
| {5, -6, W, 0, typename},\ |
| {6, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {7, sizeof(FILE_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {8, sizeof(BOOLEAN), SYSARG_INLINED, DRSYS_TYPE_BOOL},\ |
| {9, sizeof(UNICODE_STRING), R|CT, SYSARG_TYPE_UNICODE_STRING},\ |
| {10, sizeof(BOOLEAN), SYSARG_INLINED, DRSYS_TYPE_BOOL},\ |
| } |
| |
| syscall_info_t syscall_QueryDirectoryFile_info[] = { |
| {SECONDARY_TABLE_SKIP_ENTRY}, |
| {{0,0},"NtQueryDirectoryFile.FileDirectoryInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileDirectoryInformation", |
| "_FILE_DIRECTORY_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileFullDirectoryInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileFullDirectoryInformation", |
| "_FILE_FULL_DIR_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileBothDirectoryInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileBothDirectoryInformation", |
| "_FILE_BOTH_DIR_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileBasicInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileBasicInformation", |
| "_FILE_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileStandardInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileStandardInformation", |
| "_FILE_STANDARD_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileInternalInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileInternalInformation", |
| "_FILE_INTERNAL_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileEaInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileEaInformation", |
| "_FILE_EA_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileAccessInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileAccessInformation", |
| "_FILE_ACCESS_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileNameInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileNameInformation", |
| "_FILE_NAME_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileRenameInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileRenameInformation", |
| "_FILE_RENAME_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileLinkInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileLinkInformation", |
| "_FILE_LINK_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileNamesInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileNamesInformation", |
| "_FILE_NAMES_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileDispositionInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileDispositionInformation", |
| "_FILE_DISPOSITION_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FilePositionInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FilePositionInformation", |
| "_FILE_POSITION_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileFullEaInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileFullEaInformation", |
| "_FILE_FULL_EA_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileModeInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileModeInformation", |
| "_FILE_MODE_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileAlignmentInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileAlignmentInformation", |
| "_FILE_ALIGNMENT_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileAllInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileAllInformation", |
| "_FILE_ALL_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileAllocationInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileAllocationInformation", |
| "_FILE_ALLOCATION_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileEndOfFileInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileEndOfFileInformation", |
| "_FILE_END_OF_FILE_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileAlternateNameInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileAlternateNameInformation", |
| "_FILE_NAME_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileStreamInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileStreamInformation", |
| "_FILE_STREAM_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FilePipeInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FilePipeInformation", |
| "_FILE_PIPE_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FilePipeLocalInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FilePipeLocalInformation", |
| "_FILE_PIPE_LOCAL_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FilePipeRemoteInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FilePipeRemoteInformation", |
| "_FILE_PIPE_REMOTE_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileMailslotQueryInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileMailslotQueryInformation", |
| "_FILE_MAILSLOT_QUERY_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileMailslotSetInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileMailslotSetInformation", |
| "_FILE_MAILSLOT_SET_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileCompressionInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileCompressionInformation", |
| "_FILE_COMPRESSION_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileObjectIdInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileObjectIdInformation", |
| "_FILE_OBJECTID_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileCompletionInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileCompletionInformation", |
| "_FILE_COMPLETION_INFORMATION") /* Reserved */ |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileMoveClusterInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileMoveClusterInformation", |
| "_FILE_MOVE_CLUSTER_INFORMATION") /* Reserved */ |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileQuotaInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileQuotaInformation", "_FILE_QUOTA_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileReparsePointInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileReparsePointInformation", |
| "_FILE_REPARSE_POINT_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileNetworkOpenInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileNetworkOpenInformation", |
| "_FILE_NETWORK_OPEN_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileAttributeTagInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileAttributeTagInformation", |
| "_FILE_ATTRIBUTE_TAG_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileTrackingInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileTrackingInformation", |
| "_FILE_TRACKING_INFORMATION") /* Reserved */ |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileIdBothDirectoryInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileIdBothDirectoryInformation", |
| "_FILE_ID_BOTH_DIR_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileIdFullDirectoryInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileIdFullDirectoryInformation", |
| "_FILE_ID_FULL_DIR_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileValidDataLengthInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileValidDataLengthInformation", |
| "_FILE_VALID_DATA_LENGTH_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileShortNameInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileShortNameInformation", |
| "_FILE_NAME_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileIoCompletionNotificationInformation", OK, RNTST, 11, |
| /* Reserved */ |
| ENTRY_QueryDirectoryFile("FileIoCompletionNotificationInformation", |
| "_FILE_IO_COMPLETION_NOTIFICATION_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileIoStatusBlockRangeInformation", OK, RNTST, 11, |
| /* Reserved */ |
| ENTRY_QueryDirectoryFile("FileIoStatusBlockRangeInformation", |
| "_FILE_IO_STATUS_BLOCK_RANGE_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileIoPriorityHintInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileIoPriorityHintInformation", |
| "_FILE_IO_PRIORITY_HINT_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileSfioReserveInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileSfioReserveInformation", |
| "_FILE_SFIO_RESERVE_INFORMATION") /* Reserved */ |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileSfioVolumeInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileSfioVolumeInformation", |
| "_FILE_SFIO_VOLUME_INFORMATION") /* Reserved */ |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileHardLinkInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileHardLinkInformation", |
| "_FILE_LINKS_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileProcessIdsUsingFileInformation", OK, RNTST, 11, |
| /* Reserved */ |
| ENTRY_QueryDirectoryFile("FileProcessIdsUsingFileInformation", |
| "_FILE_PROCESS_IDS_USING_FILE_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileNormalizedNameInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileNormalizedNameInformation", |
| "_FILE_NAME_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileNetworkPhysicalNameInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileNetworkPhysicalNameInformation", |
| "_FILE_NETWORK_PHYSICAL_NAME_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileIdGlobalTxDirectoryInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileIdGlobalTxDirectoryInformation", |
| "_FILE_ID_GLOBAL_TX_DIR_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileIsRemoteDeviceInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileIsRemoteDeviceInformation", |
| "_FILE_IS_REMOTE_DEVICE_INFORMATION") /* Reserved */ |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileAttributeCacheInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileAttributeCacheInformation", |
| "_FILE_ATTRIBUTE_CACHE_INFORMATION") /* Reserved */ |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileNumaNodeInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileNumaNodeInformation", |
| "_FILE_NUMA_NODE_INFORMATION") |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileStandardLinkInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileStandardLinkInformation", |
| "_FILE_STANDARD_LINK_INFORMATION") /* Reserved */ |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileRemoteProtocolInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileRemoteProtocolInformation", |
| "_FILE_REMOTE_PROTOCOL_INFORMATION") /* Reserved */ |
| }, |
| {{0,0},"NtQueryDirectoryFile.FileReplaceCompletionInformation", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile("FileReplaceCompletionInformation", |
| "_FILE_COMPLETION_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtQueryDirectoryFile.UNKNOWN", OK, RNTST, 11, |
| ENTRY_QueryDirectoryFile(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_QueryEvent(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(EVENT_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, W, 0, typename},\ |
| {2, -4, WI},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_QueryEvent_info[] = { |
| {{0,0},"NtQueryEvent.EventBasicInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryEvent("EventBasicInformation", "_EVENT_BASIC_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtQueryEvent.UNKNOWN", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryEvent(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_QueryInformationAtom(classname, typename)\ |
| {\ |
| {0, sizeof(ATOM), SYSARG_INLINED, DRSYS_TYPE_ATOM},\ |
| {1, sizeof(ATOM_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, W, 0, typename},\ |
| {2, -4, WI},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_QueryInformationAtom_info[] = { |
| {{0,0},"NtQueryInformationAtom.AtomBasicInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryInformationAtom("AtomBasicInformation", "_ATOM_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationAtom.AtomTableInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryInformationAtom("AtomTableInformation", "_ATOM_TABLE_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtQueryInformationAtom.UNKNOWN", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryInformationAtom(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_QueryInformationFile(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(IO_STATUS_BLOCK), W|HT, DRSYS_TYPE_IO_STATUS_BLOCK},\ |
| {2, -3, W, 0, typename},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(FILE_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| } |
| |
| syscall_info_t syscall_QueryInformationFile_info[] = { |
| {SECONDARY_TABLE_SKIP_ENTRY}, |
| {{0,0},"NtQueryInformationFile.FileDirectoryInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileDirectoryInformation", "_FILE_DIRECTORY_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileFullDirectoryInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileFullDirectoryInformation", "_FILE_FULL_DIR_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileBothDirectoryInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileBothDirectoryInformation", "_FILE_BOTH_DIR_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileBasicInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileBasicInformation", "_FILE_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileStandardInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileStandardInformation", "_FILE_STANDARD_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileInternalInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileInternalInformation", "_FILE_INTERNAL_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileEaInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileEaInformation", "_FILE_EA_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileAccessInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileAccessInformation", "_FILE_ACCESS_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileNameInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileNameInformation", "_FILE_NAME_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileRenameInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileRenameInformation", "_FILE_RENAME_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileLinkInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileLinkInformation", "_FILE_LINK_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileNamesInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileNamesInformation", "_FILE_NAMES_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileDispositionInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileDispositionInformation", "_FILE_DISPOSITION_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FilePositionInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FilePositionInformation", "_FILE_POSITION_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileFullEaInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileFullEaInformation", "_FILE_FULL_EA_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileModeInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileModeInformation", "_FILE_MODE_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileAlignmentInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileAlignmentInformation", "_FILE_ALIGNMENT_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileAllInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileAllInformation", "_FILE_ALL_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileAllocationInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileAllocationInformation", "_FILE_ALLOCATION_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileEndOfFileInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileEndOfFileInformation", "_FILE_END_OF_FILE_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileAlternateNameInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileAlternateNameInformation", "_FILE_NAME_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileStreamInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileStreamInformation", "_FILE_STREAM_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FilePipeInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FilePipeInformation", "_FILE_PIPE_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FilePipeLocalInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FilePipeLocalInformation", "_FILE_PIPE_LOCAL_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FilePipeRemoteInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FilePipeRemoteInformation", "_FILE_PIPE_REMOTE_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileMailslotQueryInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileMailslotQueryInformation", "_FILE_MAILSLOT_QUERY_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileMailslotSetInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileMailslotSetInformation", "_FILE_MAILSLOT_SET_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileCompressionInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileCompressionInformation", "_FILE_COMPRESSION_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileObjectIdInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileObjectIdInformation", "_FILE_OBJECTID_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileCompletionInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileCompletionInformation", "_FILE_COMPLETION_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileMoveClusterInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileMoveClusterInformation", "_FILE_MOVE_CLUSTER_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileQuotaInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileQuotaInformation", "_FILE_QUOTA_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileReparsePointInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileReparsePointInformation", "_FILE_REPARSE_POINT_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileNetworkOpenInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileNetworkOpenInformation", "_FILE_NETWORK_OPEN_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileAttributeTagInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileAttributeTagInformation", "_FILE_ATTRIBUTE_TAG_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileTrackingInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileTrackingInformation", "_FILE_TRACKING_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileIdBothDirectoryInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileIdBothDirectoryInformation", "_FILE_ID_BOTH_DIR_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileIdFullDirectoryInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileIdFullDirectoryInformation", "_FILE_ID_FULL_DIR_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileValidDataLengthInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileValidDataLengthInformation", "_FILE_VALID_DATA_LENGTH_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileShortNameInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileShortNameInformation", "_FILE_NAME_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileIoCompletionNotificationInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileIoCompletionNotificationInformation", "_FILE_IO_COMPLETION_NOTIFICATION_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileIoStatusBlockRangeInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileIoStatusBlockRangeInformation", "_FILE_IO_STATUS_BLOCK_RANGE_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileIoPriorityHintInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileIoPriorityHintInformation", "_FILE_IO_PRIORITY_HINT_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileSfioReserveInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileSfioReserveInformation", "_FILE_SFIO_RESERVE_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileSfioVolumeInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileSfioVolumeInformation", "_FILE_SFIO_VOLUME_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileHardLinkInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileHardLinkInformation", "_FILE_LINKS_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileProcessIdsUsingFileInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileProcessIdsUsingFileInformation", "_FILE_PROCESS_IDS_USING_FILE_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileNormalizedNameInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileNormalizedNameInformation", "_FILE_NAME_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileNetworkPhysicalNameInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileNetworkPhysicalNameInformation", "_FILE_NETWORK_PHYSICAL_NAME_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileIdGlobalTxDirectoryInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileIdGlobalTxDirectoryInformation", "_FILE_ID_GLOBAL_TX_DIR_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileIsRemoteDeviceInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileIsRemoteDeviceInformation", "_FILE_IS_REMOTE_DEVICE_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileAttributeCacheInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileAttributeCacheInformation", "_FILE_ATTRIBUTE_CACHE_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileNumaNodeInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileNumaNodeInformation", "_FILE_NUMA_NODE_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileStandardLinkInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileStandardLinkInformation", "_FILE_STANDARD_LINK_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileRemoteProtocolInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileRemoteProtocolInformation", "_FILE_REMOTE_PROTOCOL_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationFile.FileReplaceCompletionInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationFile("FileReplaceCompletionInformation", "_FILE_COMPLETION_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtQueryInformationFile.UNKNOWN", OK, RNTST, 5, |
| ENTRY_QueryInformationFile(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_QueryInformationPort(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(PORT_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, W, 0, typename},\ |
| {2, -4, WI},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_QueryInformationPort_info[] = { |
| {{0,0},"NtQueryInformationPort.PortBasicInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryInformationPort("PortBasicInformation", "_PORT_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationPort.PortDumpInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryInformationPort("PortDumpInformation", "_PORT_DUMP_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtQueryInformationPort.UNKNOWN", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryInformationPort(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_QueryIoCompletion(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(IO_COMPLETION_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, W, 0, typename},\ |
| {2, -4, WI},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_QueryIoCompletion_info[] = { |
| {{0,0},"NtQueryIoCompletion.IoCompletionBasicInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryIoCompletion("IoCompletionBasicInformation", "_IO_COMPLETION_BASIC_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtQueryIoCompletion.UNKNOWN", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryIoCompletion(NULL, NULL) |
| }, |
| }; |
| #define ENTRY_QueryMutant(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(MUTANT_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, W, 0, typename},\ |
| {2, -4, WI},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_QueryMutant_info[] = { |
| {{0,0},"NtQueryMutant.MutantBasicInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryMutant("MutantBasicInformation", "_MUTANT_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtQueryMutant.MutantOwnerInformation", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryMutant("MutantOwnerInformation", "_MUTANT_OWNER_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtQueryMutant.UNKNOWN", OK|SYSINFO_RET_SMALL_WRITE_LAST, RNTST, 5, |
| ENTRY_QueryMutant(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_QueryVolumeInformationFile(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(IO_STATUS_BLOCK), W|HT, DRSYS_TYPE_IO_STATUS_BLOCK},\ |
| {2, -3, W, 0, typename},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(FS_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| } |
| |
| syscall_info_t syscall_QueryVolumeInformationFile_info[] = { |
| {SECONDARY_TABLE_SKIP_ENTRY}, |
| {{0,0},"NtQueryVolumeInformationFile.FileFsVolumeInformation", OK, RNTST, 5, |
| ENTRY_QueryVolumeInformationFile("FileFsVolumeInformation", "_FILE_FS_VOLUME_INFORMATION") |
| }, |
| {{0,0},"NtQueryVolumeInformationFile.FileFsLabelInformation", OK, RNTST, 5, |
| ENTRY_QueryVolumeInformationFile("FileFsLabelInformation", "_FILE_FS_LABEL_INFORMATION") |
| }, |
| {{0,0},"NtQueryVolumeInformationFile.FileFsSizeInformation", OK, RNTST, 5, |
| ENTRY_QueryVolumeInformationFile("FileFsSizeInformation", "_FILE_FS_SIZE_INFORMATION") |
| }, |
| {{0,0},"NtQueryVolumeInformationFile.FileFsDeviceInformation", OK, RNTST, 5, |
| ENTRY_QueryVolumeInformationFile("FileFsDeviceInformation", "_FILE_FS_DEVICE_INFORMATION") |
| }, |
| {{0,0},"NtQueryVolumeInformationFile.FileFsAttributeInformation", OK, RNTST, 5, |
| ENTRY_QueryVolumeInformationFile("FileFsAttributeInformation", "_FILE_FS_ATTRIBUTE_INFORMATION") |
| }, |
| {{0,0},"NtQueryVolumeInformationFile.FileFsControlInformation", OK, RNTST, 5, |
| ENTRY_QueryVolumeInformationFile("FileFsControlInformation", "_FILE_FS_CONTROL_INFORMATION") |
| }, |
| {{0,0},"NtQueryVolumeInformationFile.FileFsFullSizeInformation", OK, RNTST, 5, |
| ENTRY_QueryVolumeInformationFile("FileFsFullSizeInformation", "_FILE_FS_FULL_SIZE_INFORMATION") |
| }, |
| {{0,0},"NtQueryVolumeInformationFile.FileFsObjectIdInformation", OK, RNTST, 5, |
| ENTRY_QueryVolumeInformationFile("FileFsObjectIdInformation", "_FILE_FS_OBJECTID_INFORMATION") |
| }, |
| {{0,0},"NtQueryVolumeInformationFile.FileFsDriverPathInformation", OK, RNTST, 5, |
| ENTRY_QueryVolumeInformationFile("FileFsDriverPathInformation", "_FILE_FS_DRIVER_PATH_INFORMATION") |
| }, |
| {{0,0},"NtQueryVolumeInformationFile.FileFsVolumeFlagsInformation", OK, RNTST, 5, |
| ENTRY_QueryVolumeInformationFile("FileFsVolumeFlagsInformation", "_FILE_FS_VOLUME_FLAGS_INFORMATION") |
| }, |
| {{0,0},"NtQueryVolumeInformationFile.FileFsSectorSizeInformation", OK, RNTST, 5, |
| ENTRY_QueryVolumeInformationFile("FileFsSectorSizeInformation", "_FILE_FS_SECTOR_SIZE_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtQueryVolumeInformationFile.UNKNOWN", OK, RNTST, 5, |
| ENTRY_QueryVolumeInformationFile(NULL, NULL) |
| }, |
| }; |
| #define ENTRY_SetInformationFile(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(IO_STATUS_BLOCK), W|HT, DRSYS_TYPE_IO_STATUS_BLOCK},\ |
| {2, -3, SYSARG_NON_MEMARG, 0, typename},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(FILE_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| } |
| |
| syscall_info_t syscall_SetInformationFile_info[] = { |
| {SECONDARY_TABLE_SKIP_ENTRY}, |
| {{0,0},"NtSetInformationFile.FileDirectoryInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileDirectoryInformation", "_FILE_DIRECTORY_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileFullDirectoryInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileFullDirectoryInformation", "_FILE_FULL_DIR_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileBothDirectoryInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileBothDirectoryInformation", "_FILE_BOTH_DIR_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileBasicInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileBasicInformation", "_FILE_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileStandardInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileStandardInformation", "_FILE_STANDARD_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileInternalInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileInternalInformation", "_FILE_INTERNAL_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileEaInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileEaInformation", "_FILE_EA_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileAccessInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileAccessInformation", "_FILE_ACCESS_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileNameInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileNameInformation", "_FILE_NAME_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileRenameInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileRenameInformation", "_FILE_RENAME_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileLinkInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileLinkInformation", "_FILE_LINK_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileNamesInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileNamesInformation", "_FILE_NAMES_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileDispositionInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileDispositionInformation", "_FILE_DISPOSITION_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FilePositionInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FilePositionInformation", "_FILE_POSITION_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileFullEaInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileFullEaInformation", "_FILE_FULL_EA_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileModeInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileModeInformation", "_FILE_MODE_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileAlignmentInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileAlignmentInformation", "_FILE_ALIGNMENT_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileAllInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileAllInformation", "_FILE_ALL_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileAllocationInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileAllocationInformation", "_FILE_ALLOCATION_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileEndOfFileInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileEndOfFileInformation", "_FILE_END_OF_FILE_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileAlternateNameInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileAlternateNameInformation", "_FILE_NAME_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileStreamInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileStreamInformation", "_FILE_STREAM_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FilePipeInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FilePipeInformation", "_FILE_PIPE_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FilePipeLocalInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FilePipeLocalInformation", "_FILE_PIPE_LOCAL_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FilePipeRemoteInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FilePipeRemoteInformation", "_FILE_PIPE_REMOTE_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileMailslotQueryInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileMailslotQueryInformation", "_FILE_MAILSLOT_QUERY_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileMailslotSetInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileMailslotSetInformation", "_FILE_MAILSLOT_SET_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileCompressionInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileCompressionInformation", "_FILE_COMPRESSION_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileObjectIdInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileObjectIdInformation", "_FILE_OBJECTID_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileCompletionInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileCompletionInformation", "_FILE_COMPLETION_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileMoveClusterInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileMoveClusterInformation", "_FILE_MOVE_CLUSTER_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileQuotaInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileQuotaInformation", "_FILE_QUOTA_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileReparsePointInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileReparsePointInformation", "_FILE_REPARSE_POINT_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileNetworkOpenInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileNetworkOpenInformation", "_FILE_NETWORK_OPEN_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileAttributeTagInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileAttributeTagInformation", "_FILE_ATTRIBUTE_TAG_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileTrackingInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileTrackingInformation", "_FILE_TRACKING_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileIdBothDirectoryInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileIdBothDirectoryInformation", "_FILE_ID_BOTH_DIR_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileIdFullDirectoryInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileIdFullDirectoryInformation", "_FILE_ID_FULL_DIR_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileValidDataLengthInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileValidDataLengthInformation", "_FILE_VALID_DATA_LENGTH_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileShortNameInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileShortNameInformation", "_FILE_NAME_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileIoCompletionNotificationInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileIoCompletionNotificationInformation", "_FILE_IO_COMPLETION_NOTIFICATION_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileIoStatusBlockRangeInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileIoStatusBlockRangeInformation", "_FILE_IO_STATUS_BLOCK_RANGE_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileIoPriorityHintInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileIoPriorityHintInformation", "_FILE_IO_PRIORITY_HINT_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileSfioReserveInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileSfioReserveInformation", "_FILE_SFIO_RESERVE_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileSfioVolumeInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileSfioVolumeInformation", "_FILE_SFIO_VOLUME_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileHardLinkInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileHardLinkInformation", "_FILE_LINKS_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileProcessIdsUsingFileInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileProcessIdsUsingFileInformation", "_FILE_PROCESS_IDS_USING_FILE_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileNormalizedNameInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileNormalizedNameInformation", "_FILE_NAME_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileNetworkPhysicalNameInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileNetworkPhysicalNameInformation", "_FILE_NETWORK_PHYSICAL_NAME_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileIdGlobalTxDirectoryInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileIdGlobalTxDirectoryInformation", "_FILE_ID_GLOBAL_TX_DIR_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileIsRemoteDeviceInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileIsRemoteDeviceInformation", "_FILE_IS_REMOTE_DEVICE_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileAttributeCacheInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileAttributeCacheInformation", "_FILE_ATTRIBUTE_CACHE_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileNumaNodeInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileNumaNodeInformation", "_FILE_NUMA_NODE_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileStandardLinkInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileStandardLinkInformation", "_FILE_STANDARD_LINK_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileRemoteProtocolInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileRemoteProtocolInformation", "_FILE_REMOTE_PROTOCOL_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationFile.FileReplaceCompletionInformation", OK, RNTST, 5, |
| ENTRY_SetInformationFile("FileReplaceCompletionInformation", "_FILE_COMPLETION_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtSetInformationFile.UNKNOWN", OK, RNTST, 5, |
| ENTRY_SetInformationFile(NULL, NULL), &sysnum_SetInformationFile |
| }, |
| }; |
| #define ENTRY_SetInformationKey(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(KEY_SET_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, R, 0, typename},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_SetInformationKey_info[] = { |
| {{0,0},"NtSetInformationKey.KeyWriteTimeInformation", OK, RNTST, 4, |
| ENTRY_SetInformationKey("KeyWriteTimeInformation", "_KEY_WRITE_TIME_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationKey.KeyWow64FlagsInformation", OK, RNTST, 4, |
| ENTRY_SetInformationKey("KeyWow64FlagsInformation", "_KEY_WOW64_FLAGS_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationKey.KeyControlFlagsInformation", OK, RNTST, 4, |
| ENTRY_SetInformationKey("KeyControlFlagsInformation", "KEY_CONTROL_FLAGS_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationKey.KeySetVirtualizationInformation", OK, RNTST, 4, |
| ENTRY_SetInformationKey("KeySetVirtualizationInformation", "_KEY_SET_VIRTUALIZATION_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationKey.KeySetDebugInformation", OK, RNTST, 4, |
| ENTRY_SetInformationKey("KeySetDebugInformation", NULL) |
| }, |
| {{0,0},"NtSetInformationKey.KeySetHandleTagsInformation", OK, RNTST, 4, |
| ENTRY_SetInformationKey("KeySetHandleTagsInformation", NULL) |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtSetInformationKey.UNKNOWN", OK, RNTST, 4, |
| ENTRY_SetInformationKey(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_SetInformationObject(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(OBJECT_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, R, 0, typename},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_SetInformationObject_info[] = { |
| {{0,0},"NtSetInformationObject.ObjectBasicInformation", OK, RNTST, 4, |
| ENTRY_SetInformationObject("ObjectBasicInformation", "_PUBLIC_OBJECT_BASIC_INFORMATION") |
| }, |
| {SECONDARY_TABLE_SKIP_ENTRY}, |
| {{0,0},"NtSetInformationObject.ObjectTypeInformation", OK, RNTST, 4, |
| ENTRY_SetInformationObject("ObjectTypeInformation", "_PUBLIC_OBJECT_TYPE_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtSetInformationObject.UNKNOWN", OK, RNTST, 4, |
| ENTRY_SetInformationObject(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_SetVolumeInformationFile(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(IO_STATUS_BLOCK), W|HT, DRSYS_TYPE_IO_STATUS_BLOCK},\ |
| {2, -3, R, DRSYS_TYPE_STRUCT, typename},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(FS_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| } |
| |
| syscall_info_t syscall_SetVolumeInformationFile_info[] = { |
| {SECONDARY_TABLE_SKIP_ENTRY}, |
| {{0,0},"NtSetVolumeInformationFile.FileFsVolumeInformation", OK, RNTST, 5, |
| ENTRY_SetVolumeInformationFile("FileFsVolumeInformation", "_FILE_FS_VOLUME_INFORMATION") |
| }, |
| {{0,0},"NtSetVolumeInformationFile.FileFsLabelInformation", OK, RNTST, 5, |
| ENTRY_SetVolumeInformationFile("FileFsLabelInformation", "_FILE_FS_LABEL_INFORMATION") |
| }, |
| {{0,0},"NtSetVolumeInformationFile.FileFsSizeInformation", OK, RNTST, 5, |
| ENTRY_SetVolumeInformationFile("FileFsSizeInformation", "_FILE_FS_SIZE_INFORMATION") |
| }, |
| {{0,0},"NtSetVolumeInformationFile.FileFsDeviceInformation", OK, RNTST, 5, |
| ENTRY_SetVolumeInformationFile("FileFsDeviceInformation", "_FILE_FS_DEVICE_INFORMATION") |
| }, |
| {{0,0},"NtSetVolumeInformationFile.FileFsAttributeInformation", OK, RNTST, 5, |
| ENTRY_SetVolumeInformationFile("FileFsAttributeInformation", "_FILE_FS_ATTRIBUTE_INFORMATION") |
| }, |
| {{0,0},"NtSetVolumeInformationFile.FileFsControlInformation", OK, RNTST, 5, |
| ENTRY_SetVolumeInformationFile("FileFsControlInformation", "_FILE_FS_CONTROL_INFORMATION") |
| }, |
| {{0,0},"NtSetVolumeInformationFile.FileFsFullSizeInformation", OK, RNTST, 5, |
| ENTRY_SetVolumeInformationFile("FileFsFullSizeInformation", "_FILE_FS_FULL_SIZE_INFORMATION") |
| }, |
| {{0,0},"NtSetVolumeInformationFile.FileFsObjectIdInformation", OK, RNTST, 5, |
| ENTRY_SetVolumeInformationFile("FileFsObjectIdInformation", "_FILE_FS_OBJECTID_INFORMATION") |
| }, |
| {{0,0},"NtSetVolumeInformationFile.FileFsDriverPathInformation", OK, RNTST, 5, |
| ENTRY_SetVolumeInformationFile("FileFsDriverPathInformation", "_FILE_FS_DRIVER_PATH_INFORMATION") |
| }, |
| {{0,0},"NtSetVolumeInformationFile.FileFsVolumeFlagsInformation", OK, RNTST, 5, |
| ENTRY_SetVolumeInformationFile("FileFsVolumeFlagsInformation", "_FILE_FS_VOLUME_FLAGS_INFORMATION") |
| }, |
| {{0,0},"NtSetVolumeInformationFile.FileFsSectorSizeInformation", OK, RNTST, 5, |
| ENTRY_SetVolumeInformationFile("FileFsSectorSizeInformation", "_FILE_FS_SECTOR_SIZE_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtSetVolumeInformationFile.UNKNOWN", OK, RNTST, 5, |
| ENTRY_SetVolumeInformationFile(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_AlpcQueryInformation(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(ALPC_PORT_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, W|HT, DRSYS_TYPE_STRUCT, typename},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_AlpcQueryInformation_info[] = { |
| {{0,0},"NtAlpcQueryInformation.AlpcBasicInformation", OK, RNTST, 5, |
| ENTRY_AlpcQueryInformation("AlpcBasicInformation", "_ALPC_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtAlpcQueryInformation.AlpcPortInformation", OK, RNTST, 5, |
| ENTRY_AlpcQueryInformation("AlpcPortInformation", NULL) |
| }, |
| {{0,0},"NtAlpcQueryInformation.AlpcAssociateCompletionPortInformation", OK, RNTST, 5, |
| ENTRY_AlpcQueryInformation("AlpcAssociateCompletionPortInformation", NULL) |
| }, |
| {{0,0},"NtAlpcQueryInformation.AlpcConnectedSIDInformation", OK, RNTST, 5, |
| ENTRY_AlpcQueryInformation("AlpcConnectedSIDInformation", NULL) |
| }, |
| {{0,0},"NtAlpcQueryInformation.AlpcServerInformation", OK, RNTST, 5, |
| ENTRY_AlpcQueryInformation("AlpcServerInformation", "_ALPC_SERVER_INFORMATION") |
| }, |
| {{0,0},"NtAlpcQueryInformation.AlpcMessageZoneInformation", OK, RNTST, 5, |
| ENTRY_AlpcQueryInformation("AlpcMessageZoneInformation", NULL) |
| }, |
| {{0,0},"NtAlpcQueryInformation.AlpcRegisterCompletionListInformation", OK, RNTST, 5, |
| ENTRY_AlpcQueryInformation("AlpcRegisterCompletionListInformation", NULL) |
| }, |
| {{0,0},"NtAlpcQueryInformation.AlpcUnregisterCompletionListInformation", OK, RNTST, 5, |
| ENTRY_AlpcQueryInformation("AlpcUnregisterCompletionListInformation", NULL) |
| }, |
| {{0,0},"NtAlpcQueryInformation.AlpcAdjustCompletionListConcurrencyCountInformation", OK, RNTST, 5, |
| ENTRY_AlpcQueryInformation("AlpcAdjustCompletionListConcurrencyCountInformation", NULL) |
| }, |
| {{0,0},"NtAlpcQueryInformation.AlpcRegisterCallbackInformation", OK, RNTST, 5, |
| ENTRY_AlpcQueryInformation("AlpcRegisterCallbackInformation", NULL) |
| }, |
| {{0,0},"NtAlpcQueryInformation.AlpcCompletionListRundownInformation", OK, RNTST, 5, |
| ENTRY_AlpcQueryInformation("AlpcCompletionListRundownInformation", NULL) |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtAlpcQueryInformation.UNKNOWN", OK, RNTST, 5, |
| ENTRY_AlpcQueryInformation(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_AlpcSetInformation(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(ALPC_PORT_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, R|HT, DRSYS_TYPE_STRUCT, typename},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_AlpcSetInformation_info[] = { |
| {{0,0},"NtAlpcSetInformation.AlpcBasicInformation", OK, RNTST, 4, |
| ENTRY_AlpcSetInformation("AlpcBasicInformation", "_ALPC_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtAlpcSetInformation.AlpcPortInformation", OK, RNTST, 4, |
| ENTRY_AlpcSetInformation("AlpcPortInformation", NULL) |
| }, |
| {{0,0},"NtAlpcSetInformation.AlpcAssociateCompletionPortInformation", OK, RNTST, 4, |
| ENTRY_AlpcSetInformation("AlpcAssociateCompletionPortInformation", NULL) |
| }, |
| {{0,0},"NtAlpcSetInformation.AlpcConnectedSIDInformation", OK, RNTST, 4, |
| ENTRY_AlpcSetInformation("AlpcConnectedSIDInformation", NULL) |
| }, |
| {{0,0},"NtAlpcSetInformation.AlpcServerInformation", OK, RNTST, 4, |
| ENTRY_AlpcSetInformation("AlpcServerInformation", "_ALPC_SERVER_INFORMATION") |
| }, |
| {{0,0},"NtAlpcSetInformation.AlpcMessageZoneInformation", OK, RNTST, 4, |
| ENTRY_AlpcSetInformation("AlpcMessageZoneInformation", NULL) |
| }, |
| {{0,0},"NtAlpcSetInformation.AlpcRegisterCompletionListInformation", OK, RNTST, 4, |
| ENTRY_AlpcSetInformation("AlpcRegisterCompletionListInformation", NULL) |
| }, |
| {{0,0},"NtAlpcSetInformation.AlpcUnregisterCompletionListInformation", OK, RNTST, 4, |
| ENTRY_AlpcSetInformation("AlpcUnregisterCompletionListInformation", NULL) |
| }, |
| {{0,0},"NtAlpcSetInformation.AlpcAdjustCompletionListConcurrencyCountInformation", OK, RNTST, 4, |
| ENTRY_AlpcSetInformation("AlpcAdjustCompletionListConcurrencyCountInformation", NULL) |
| }, |
| {{0,0},"NtAlpcSetInformation.AlpcRegisterCallbackInformation", OK, RNTST, 4, |
| ENTRY_AlpcSetInformation("AlpcRegisterCallbackInformation", NULL) |
| }, |
| {{0,0},"NtAlpcSetInformation.AlpcCompletionListRundownInformation", OK, RNTST, 4, |
| ENTRY_AlpcSetInformation("AlpcCompletionListRundownInformation", NULL) |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtAlpcSetInformation.UNKNOWN", OK, RNTST, 4, |
| ENTRY_AlpcSetInformation(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_AlpcQueryInformationMessage(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(PORT_MESSAGE), R|CT, SYSARG_TYPE_PORT_MESSAGE},\ |
| {2, sizeof(ALPC_MESSAGE_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {3, -4, W|HT, DRSYS_TYPE_STRUCT, typename},\ |
| {4, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {5, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_AlpcQueryInformationMessage_info[] = { |
| {{0,0},"NtAlpcQueryInformationMessage.AlpcMessageSidInformation", OK, RNTST, 6, |
| ENTRY_AlpcQueryInformationMessage("AlpcMessageSidInformation", NULL) |
| }, |
| {{0,0},"NtAlpcQueryInformationMessage.AlpcMessageTokenModifiedIdInformation", OK, RNTST, 6, |
| ENTRY_AlpcQueryInformationMessage("AlpcMessageTokenModifiedIdInformation", NULL) |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtAlpcQueryInformationMessage.UNKNOWN", OK, RNTST, 6, |
| ENTRY_AlpcQueryInformationMessage(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_QueryInformationEnlistment(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(ENLISTMENT_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, W|HT, DRSYS_TYPE_STRUCT, typename},\ |
| {2, -4, WI|HT, DRSYS_TYPE_STRUCT},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_QueryInformationEnlistment_info[] = { |
| {{0,0},"NtQueryInformationEnlistment.EnlistmentBasicInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationEnlistment("EnlistmentBasicInformation", "_ENLISTMENT_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationEnlistment.EnlistmentRecoveryInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationEnlistment("EnlistmentRecoveryInformation", NULL) |
| }, |
| {{0,0},"NtQueryInformationEnlistment.EnlistmentCrmInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationEnlistment("EnlistmentCrmInformation", NULL) |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtQueryInformationEnlistment.UNKNOWN", OK, RNTST, 5, |
| ENTRY_QueryInformationEnlistment(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_SetInformationEnlistment(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(ENLISTMENT_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, R|HT, DRSYS_TYPE_STRUCT, typename},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_SetInformationEnlistment_info[] = { |
| {{0,0},"NtSetInformationEnlistment.EnlistmentBasicInformation", OK, RNTST, 4, |
| ENTRY_SetInformationEnlistment("EnlistmentBasicInformation", "_ENLISTMENT_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationEnlistment.EnlistmentRecoveryInformation", OK, RNTST, 4, |
| ENTRY_SetInformationEnlistment("EnlistmentRecoveryInformation", NULL) |
| }, |
| {{0,0},"NtSetInformationEnlistment.EnlistmentCrmInformation", OK, RNTST, 4, |
| ENTRY_SetInformationEnlistment("EnlistmentCrmInformation", NULL) |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtSetInformationEnlistment.UNKNOWN", OK, RNTST, 4, |
| ENTRY_SetInformationEnlistment(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_QueryInformationResourceManager(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(RESOURCEMANAGER_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, W|HT, DRSYS_TYPE_STRUCT, typename},\ |
| {2, -4, WI|HT, DRSYS_TYPE_STRUCT},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_QueryInformationResourceManager_info[] = { |
| {{0,0},"NtQueryInformationResourceManager.ResourceManagerBasicInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationResourceManager("ResourceManagerBasicInformation", |
| "_RESOURCEMANAGER_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationResourceManager.ResourceManagerCompletionInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationResourceManager("ResourceManagerCompletionInformation", |
| "_RESOURCEMANAGER_COMPLETION_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtQueryInformationResourceManager.UNKNOWN", OK, RNTST, 5, |
| ENTRY_QueryInformationResourceManager(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_SetInformationResourceManager(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(RESOURCEMANAGER_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, R|HT, DRSYS_TYPE_STRUCT, typename},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_SetInformationResourceManager_info[] = { |
| {{0,0},"NtSetInformationResourceManager.ResourceManagerBasicInformation", OK, RNTST, 4, |
| ENTRY_SetInformationResourceManager("ResourceManagerBasicInformation", |
| "_RESOURCEMANAGER_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationResourceManager.ResourceManagerCompletionInformation", OK, RNTST, 4, |
| ENTRY_SetInformationResourceManager("ResourceManagerCompletionInformation", |
| "_RESOURCEMANAGER_COMPLETION_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtSetInformationResourceManager.UNKNOWN", OK, RNTST, 4, |
| ENTRY_SetInformationResourceManager(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_QueryInformationTransaction(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(TRANSACTION_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, W|HT, DRSYS_TYPE_STRUCT, typename},\ |
| {2, -4, WI|HT, DRSYS_TYPE_STRUCT},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_QueryInformationTransaction_info[] = { |
| {{0,0},"NtQueryInformationTransaction.TransactionBasicInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationTransaction("TransactionBasicInformation", "_TRANSACTION_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationTransaction.TransactionPropertiesInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationTransaction("TransactionPropertiesInformation", |
| "_TRANSACTION_PROPERTIES_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationTransaction.TransactionEnlistmentInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationTransaction("TransactionEnlistmentInformation", NULL) |
| }, |
| {{0,0},"NtQueryInformationTransaction.TransactionSuperiorEnlistmentInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationTransaction("TransactionSuperiorEnlistmentInformation", |
| "_TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationTransaction.TransactionBindInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationTransaction("TransactionBindInformation", "_TRANSACTION_BIND_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationTransaction.TransactionDTCPrivateInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationTransaction("TransactionDTCPrivateInformation", NULL) |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtQueryInformationTransaction.UNKNOWN", OK, RNTST, 5, |
| ENTRY_QueryInformationTransaction(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_SetInformationTransaction(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(TRANSACTION_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, R|HT, DRSYS_TYPE_STRUCT, typename},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_SetInformationTransaction_info[] = { |
| {{0,0},"NtSetInformationTransaction.TransactionBasicInformation", OK, RNTST, 4, |
| ENTRY_SetInformationTransaction("TransactionBasicInformation", "_TRANSACTION_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationTransaction.TransactionPropertiesInformation", OK, RNTST, 4, |
| ENTRY_SetInformationTransaction("TransactionPropertiesInformation", |
| "_TRANSACTION_PROPERTIES_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationTransaction.TransactionEnlistmentInformation", OK, RNTST, 4, |
| ENTRY_SetInformationTransaction("TransactionEnlistmentInformation", NULL) |
| }, |
| {{0,0},"NtSetInformationTransaction.TransactionSuperiorEnlistmentInformation", OK, RNTST, 4, |
| ENTRY_SetInformationTransaction("TransactionSuperiorEnlistmentInformation", |
| "_TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationTransaction.TransactionBindInformation", OK, RNTST, 4, |
| ENTRY_SetInformationTransaction("TransactionBindInformation", "_TRANSACTION_BIND_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationTransaction.TransactionDTCPrivateInformation", OK, RNTST, 4, |
| ENTRY_SetInformationTransaction("TransactionDTCPrivateInformation", NULL) |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtSetInformationTransaction.UNKNOWN", OK, RNTST, 4, |
| ENTRY_SetInformationTransaction(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_QueryInformationTransactionManager(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(TRANSACTIONMANAGER_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, W|HT, DRSYS_TYPE_STRUCT, typename},\ |
| {2, -4, WI|HT, DRSYS_TYPE_STRUCT},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {4, sizeof(ULONG), W|HT, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_QueryInformationTransactionManager_info[] = { |
| {{0,0},"NtQueryInformationTransactionManager.TransactionManagerBasicInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationTransactionManager("TransactionManagerBasicInformation", |
| "_TRANSACTIONMANAGER_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationTransactionManager.TransactionManagerLogInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationTransactionManager("TransactionManagerLogInformation", |
| "_TRANSACTIONMANAGER_LOG_INFORMATION") |
| }, |
| {{0,0},"NtQueryInformationTransactionManager.TransactionManagerLogPathInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationTransactionManager("TransactionManagerLogPathInformation", |
| "_TRANSACTIONMANAGER_LOGPATH_INFORMATION") |
| }, |
| {SECONDARY_TABLE_SKIP_ENTRY}, |
| {{0,0},"NtQueryInformationTransactionManager.TransactionManagerRecoveryInformation", OK, RNTST, 5, |
| ENTRY_QueryInformationTransactionManager("TransactionManagerRecoveryInformation", |
| "_TRANSACTIONMANAGER_RECOVERY_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtQueryInformationTransactionManager.UNKNOWN", OK, RNTST, 5, |
| ENTRY_QueryInformationTransactionManager(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_SetInformationTransactionManager(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| {1, sizeof(TRANSACTIONMANAGER_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, R|HT, DRSYS_TYPE_STRUCT, typename},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_SetInformationTransactionManager_info[] = { |
| {{0,0},"NtSetInformationTransactionManager.TransactionManagerBasicInformation", OK, RNTST, 4, |
| ENTRY_SetInformationTransactionManager("TransactionManagerBasicInformation", |
| "_TRANSACTIONMANAGER_BASIC_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationTransactionManager.TransactionManagerLogInformation", OK, RNTST, 4, |
| ENTRY_SetInformationTransactionManager("TransactionManagerLogInformation", |
| "_TRANSACTIONMANAGER_LOG_INFORMATION") |
| }, |
| {{0,0},"NtSetInformationTransactionManager.TransactionManagerLogPathInformation", OK, RNTST, 4, |
| ENTRY_SetInformationTransactionManager("TransactionManagerLogPathInformation", |
| "_TRANSACTIONMANAGER_LOGPATH_INFORMATION") |
| }, |
| {SECONDARY_TABLE_SKIP_ENTRY}, |
| {{0,0},"NtSetInformationTransactionManager.TransactionManagerRecoveryInformation", OK, RNTST, 4, |
| ENTRY_SetInformationTransactionManager("TransactionManagerRecoveryInformation", |
| "_TRANSACTIONMANAGER_RECOVERY_INFORMATION") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{0,0},"NtSetInformationTransactionManager.UNKNOWN", OK, RNTST, 4, |
| ENTRY_SetInformationTransactionManager(NULL, NULL) |
| }, |
| }; |
| |
| #define ENTRY_SetTimerEx(classname, typename)\ |
| {\ |
| {0, sizeof(HANDLE), SYSARG_INLINED, DRSYS_TYPE_HANDLE},\ |
| {1, sizeof(TIMER_SET_INFORMATION_CLASS), SYSARG_INLINED, DRSYS_TYPE_SIGNED_INT, classname},\ |
| {2, -3, R|W|HT, DRSYS_TYPE_STRUCT, typename},\ |
| {3, sizeof(ULONG), SYSARG_INLINED, DRSYS_TYPE_UNSIGNED_INT},\ |
| } |
| |
| syscall_info_t syscall_SetTimerEx_info[] = { |
| {{WIN7,0},"NtSetTimerEx.TimerSetCoalescableTimer", OK, RNTST, 4, |
| ENTRY_SetTimerEx("TimerSetCoalescableTimer", "_TIMER_SET_COALESCABLE_TIMER") |
| }, |
| {SECONDARY_TABLE_ENTRY_MAX_NUMBER}, |
| {{WIN7,0},"NtSetTimerEx.UNKNOWN", OK, RNTST, 4, |
| ENTRY_SetTimerEx(NULL, NULL) |
| }, |
| }; |
