| /* |
| * ntapi.h |
| * |
| * Windows NT Native API |
| * |
| * Most structures in this file is obtained from Windows NT/2000 Native API |
| * Reference by Gary Nebbett, ISBN 1578701996. |
| * |
| * This file is part of the w32api package. |
| * |
| * Contributors: |
| * Created by Casper S. Hornstrup <chorns@users.sourceforge.net> |
| * |
| * THIS SOFTWARE IS NOT COPYRIGHTED |
| * |
| * This source code is offered for use in the public domain. You may |
| * use, modify or distribute it freely. |
| * |
| * This code is distributed in the hope that it will be useful but |
| * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY |
| * DISCLAIMED. This includes but is not limited to warranties of |
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
| * |
| */ |
| |
| #ifndef __NTAPI_H |
| #define __NTAPI_H |
| |
| #if __GNUC__ >= 3 |
| #pragma GCC system_header |
| #endif |
| |
| #ifdef __cplusplus |
| extern "C" { |
| #endif |
| |
| #include <stdarg.h> |
| #include <winbase.h> |
| #include "ntddk.h" |
| #include "ntpoapi.h" |
| |
| #pragma pack(push,4) |
| |
| typedef struct _PEB *PPEB; |
| |
| /* FIXME: Unknown definitions */ |
| typedef PVOID POBJECT_TYPE_LIST; |
| typedef PVOID PEXECUTION_STATE; |
| typedef PVOID PLANGID; |
| |
| #ifndef NtCurrentProcess |
| #define NtCurrentProcess() ((HANDLE)0xFFFFFFFF) |
| #endif /* NtCurrentProcess */ |
| #ifndef NtCurrentThread |
| #define NtCurrentThread() ((HANDLE)0xFFFFFFFE) |
| #endif /* NtCurrentThread */ |
| |
| /* System information and control */ |
| |
| typedef enum _SYSTEM_INFORMATION_CLASS { |
| SystemInformationClassMin = 0, |
| SystemBasicInformation = 0, |
| SystemProcessorInformation = 1, |
| SystemPerformanceInformation = 2, |
| SystemTimeOfDayInformation = 3, |
| SystemPathInformation = 4, |
| SystemNotImplemented1 = 4, |
| SystemProcessInformation = 5, |
| SystemProcessesAndThreadsInformation = 5, |
| SystemCallCountInfoInformation = 6, |
| SystemCallCounts = 6, |
| SystemDeviceInformation = 7, |
| SystemConfigurationInformation = 7, |
| SystemProcessorPerformanceInformation = 8, |
| SystemProcessorTimes = 8, |
| SystemFlagsInformation = 9, |
| SystemGlobalFlag = 9, |
| SystemCallTimeInformation = 10, |
| SystemNotImplemented2 = 10, |
| SystemModuleInformation = 11, |
| SystemLocksInformation = 12, |
| SystemLockInformation = 12, |
| SystemStackTraceInformation = 13, |
| SystemNotImplemented3 = 13, |
| SystemPagedPoolInformation = 14, |
| SystemNotImplemented4 = 14, |
| SystemNonPagedPoolInformation = 15, |
| SystemNotImplemented5 = 15, |
| SystemHandleInformation = 16, |
| SystemObjectInformation = 17, |
| SystemPageFileInformation = 18, |
| SystemPagefileInformation = 18, |
| SystemVdmInstemulInformation = 19, |
| SystemInstructionEmulationCounts = 19, |
| SystemVdmBopInformation = 20, |
| SystemInvalidInfoClass1 = 20, |
| SystemFileCacheInformation = 21, |
| SystemCacheInformation = 21, |
| SystemPoolTagInformation = 22, |
| SystemInterruptInformation = 23, |
| SystemProcessorStatistics = 23, |
| SystemDpcBehaviourInformation = 24, |
| SystemDpcInformation = 24, |
| SystemFullMemoryInformation = 25, |
| SystemNotImplemented6 = 25, |
| SystemLoadImage = 26, |
| SystemUnloadImage = 27, |
| SystemTimeAdjustmentInformation = 28, |
| SystemTimeAdjustment = 28, |
| SystemSummaryMemoryInformation = 29, |
| SystemNotImplemented7 = 29, |
| SystemNextEventIdInformation = 30, |
| SystemNotImplemented8 = 30, |
| SystemEventIdsInformation = 31, |
| SystemNotImplemented9 = 31, |
| SystemCrashDumpInformation = 32, |
| SystemExceptionInformation = 33, |
| SystemCrashDumpStateInformation = 34, |
| SystemKernelDebuggerInformation = 35, |
| SystemContextSwitchInformation = 36, |
| SystemRegistryQuotaInformation = 37, |
| SystemLoadAndCallImage = 38, |
| SystemPrioritySeparation = 39, |
| SystemPlugPlayBusInformation = 40, |
| SystemNotImplemented10 = 40, |
| SystemDockInformation = 41, |
| SystemNotImplemented11 = 41, |
| /* SystemPowerInformation = 42, Conflicts with POWER_INFORMATION_LEVEL 1 */ |
| SystemInvalidInfoClass2 = 42, |
| SystemProcessorSpeedInformation = 43, |
| SystemInvalidInfoClass3 = 43, |
| SystemCurrentTimeZoneInformation = 44, |
| SystemTimeZoneInformation = 44, |
| SystemLookasideInformation = 45, |
| SystemSetTimeSlipEvent = 46, |
| SystemCreateSession = 47, |
| SystemDeleteSession = 48, |
| SystemInvalidInfoClass4 = 49, |
| SystemRangeStartInformation = 50, |
| SystemVerifierInformation = 51, |
| SystemAddVerifier = 52, |
| SystemSessionProcessesInformation = 53, |
| SystemInformationClassMax |
| } SYSTEM_INFORMATION_CLASS; |
| |
| typedef struct _SYSTEM_BASIC_INFORMATION { |
| ULONG Unknown; |
| ULONG MaximumIncrement; |
| ULONG PhysicalPageSize; |
| ULONG NumberOfPhysicalPages; |
| ULONG LowestPhysicalPage; |
| ULONG HighestPhysicalPage; |
| ULONG AllocationGranularity; |
| ULONG LowestUserAddress; |
| ULONG HighestUserAddress; |
| ULONG ActiveProcessors; |
| UCHAR NumberProcessors; |
| } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION; |
| |
| typedef struct _SYSTEM_PROCESSOR_INFORMATION { |
| USHORT ProcessorArchitecture; |
| USHORT ProcessorLevel; |
| USHORT ProcessorRevision; |
| USHORT Unknown; |
| ULONG FeatureBits; |
| } SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION; |
| |
| typedef struct _SYSTEM_PERFORMANCE_INFORMATION { |
| LARGE_INTEGER IdleTime; |
| LARGE_INTEGER ReadTransferCount; |
| LARGE_INTEGER WriteTransferCount; |
| LARGE_INTEGER OtherTransferCount; |
| ULONG ReadOperationCount; |
| ULONG WriteOperationCount; |
| ULONG OtherOperationCount; |
| ULONG AvailablePages; |
| ULONG TotalCommittedPages; |
| ULONG TotalCommitLimit; |
| ULONG PeakCommitment; |
| ULONG PageFaults; |
| ULONG WriteCopyFaults; |
| ULONG TransitionFaults; |
| ULONG CacheTransitionFaults; |
| ULONG DemandZeroFaults; |
| ULONG PagesRead; |
| ULONG PageReadIos; |
| ULONG CacheReads; |
| ULONG CacheIos; |
| ULONG PagefilePagesWritten; |
| ULONG PagefilePageWriteIos; |
| ULONG MappedFilePagesWritten; |
| ULONG MappedFilePageWriteIos; |
| ULONG PagedPoolUsage; |
| ULONG NonPagedPoolUsage; |
| ULONG PagedPoolAllocs; |
| ULONG PagedPoolFrees; |
| ULONG NonPagedPoolAllocs; |
| ULONG NonPagedPoolFrees; |
| ULONG TotalFreeSystemPtes; |
| ULONG SystemCodePage; |
| ULONG TotalSystemDriverPages; |
| ULONG TotalSystemCodePages; |
| ULONG SmallNonPagedLookasideListAllocateHits; |
| ULONG SmallPagedLookasideListAllocateHits; |
| ULONG Reserved3; |
| ULONG MmSystemCachePage; |
| ULONG PagedPoolPage; |
| ULONG SystemDriverPage; |
| ULONG FastReadNoWait; |
| ULONG FastReadWait; |
| ULONG FastReadResourceMiss; |
| ULONG FastReadNotPossible; |
| ULONG FastMdlReadNoWait; |
| ULONG FastMdlReadWait; |
| ULONG FastMdlReadResourceMiss; |
| ULONG FastMdlReadNotPossible; |
| ULONG MapDataNoWait; |
| ULONG MapDataWait; |
| ULONG MapDataNoWaitMiss; |
| ULONG MapDataWaitMiss; |
| ULONG PinMappedDataCount; |
| ULONG PinReadNoWait; |
| ULONG PinReadWait; |
| ULONG PinReadNoWaitMiss; |
| ULONG PinReadWaitMiss; |
| ULONG CopyReadNoWait; |
| ULONG CopyReadWait; |
| ULONG CopyReadNoWaitMiss; |
| ULONG CopyReadWaitMiss; |
| ULONG MdlReadNoWait; |
| ULONG MdlReadWait; |
| ULONG MdlReadNoWaitMiss; |
| ULONG MdlReadWaitMiss; |
| ULONG ReadAheadIos; |
| ULONG LazyWriteIos; |
| ULONG LazyWritePages; |
| ULONG DataFlushes; |
| ULONG DataPages; |
| ULONG ContextSwitches; |
| ULONG FirstLevelTbFills; |
| ULONG SecondLevelTbFills; |
| ULONG SystemCalls; |
| } SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION; |
| |
| typedef struct _SYSTEM_TIME_OF_DAY_INFORMATION { |
| LARGE_INTEGER BootTime; |
| LARGE_INTEGER CurrentTime; |
| LARGE_INTEGER TimeZoneBias; |
| ULONG CurrentTimeZoneId; |
| } SYSTEM_TIME_OF_DAY_INFORMATION, *PSYSTEM_TIME_OF_DAY_INFORMATION; |
| |
| typedef struct _VM_COUNTERS { |
| ULONG PeakVirtualSize; |
| ULONG VirtualSize; |
| ULONG PageFaultCount; |
| ULONG PeakWorkingSetSize; |
| ULONG WorkingSetSize; |
| ULONG QuotaPeakPagedPoolUsage; |
| ULONG QuotaPagedPoolUsage; |
| ULONG QuotaPeakNonPagedPoolUsage; |
| ULONG QuotaNonPagedPoolUsage; |
| ULONG PagefileUsage; |
| ULONG PeakPagefileUsage; |
| } VM_COUNTERS; |
| |
| typedef enum _THREAD_STATE { |
| StateInitialized, |
| StateReady, |
| StateRunning, |
| StateStandby, |
| StateTerminated, |
| StateWait, |
| StateTransition, |
| StateUnknown |
| } THREAD_STATE; |
| |
| typedef struct _SYSTEM_THREADS { |
| LARGE_INTEGER KernelTime; |
| LARGE_INTEGER UserTime; |
| LARGE_INTEGER CreateTime; |
| ULONG WaitTime; |
| PVOID StartAddress; |
| CLIENT_ID ClientId; |
| KPRIORITY Priority; |
| KPRIORITY BasePriority; |
| ULONG ContextSwitchCount; |
| THREAD_STATE State; |
| KWAIT_REASON WaitReason; |
| } SYSTEM_THREADS, *PSYSTEM_THREADS; |
| |
| typedef struct _SYSTEM_PROCESSES { |
| ULONG NextEntryDelta; |
| ULONG ThreadCount; |
| ULONG Reserved1[6]; |
| LARGE_INTEGER CreateTime; |
| LARGE_INTEGER UserTime; |
| LARGE_INTEGER KernelTime; |
| UNICODE_STRING ProcessName; |
| KPRIORITY BasePriority; |
| ULONG ProcessId; |
| ULONG InheritedFromProcessId; |
| ULONG HandleCount; |
| ULONG Reserved2[2]; |
| VM_COUNTERS VmCounters; |
| IO_COUNTERS IoCounters; |
| SYSTEM_THREADS Threads[1]; |
| } SYSTEM_PROCESSES, *PSYSTEM_PROCESSES; |
| |
| typedef struct _SYSTEM_CALLS_INFORMATION { |
| ULONG Size; |
| ULONG NumberOfDescriptorTables; |
| ULONG NumberOfRoutinesInTable[1]; |
| ULONG CallCounts[ANYSIZE_ARRAY]; |
| } SYSTEM_CALLS_INFORMATION, *PSYSTEM_CALLS_INFORMATION; |
| |
| typedef struct _SYSTEM_CONFIGURATION_INFORMATION { |
| ULONG DiskCount; |
| ULONG FloppyCount; |
| ULONG CdRomCount; |
| ULONG TapeCount; |
| ULONG SerialCount; |
| ULONG ParallelCount; |
| } SYSTEM_CONFIGURATION_INFORMATION, *PSYSTEM_CONFIGURATION_INFORMATION; |
| |
| typedef struct _SYSTEM_PROCESSOR_TIMES { |
| LARGE_INTEGER IdleTime; |
| LARGE_INTEGER KernelTime; |
| LARGE_INTEGER UserTime; |
| LARGE_INTEGER DpcTime; |
| LARGE_INTEGER InterruptTime; |
| ULONG InterruptCount; |
| } SYSTEM_PROCESSOR_TIMES, *PSYSTEM_PROCESSOR_TIMES; |
| |
| /* SYSTEM_GLOBAL_FLAG.GlobalFlag constants */ |
| #define FLG_STOP_ON_EXCEPTION 0x00000001 |
| #define FLG_SHOW_LDR_SNAPS 0x00000002 |
| #define FLG_DEBUG_INITIAL_COMMAND 0x00000004 |
| #define FLG_STOP_ON_HUNG_GUI 0x00000008 |
| #define FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010 |
| #define FLG_HEAP_ENABLE_FREE_CHECK 0x00000020 |
| #define FLG_HEAP_VALIDATE_PARAMETERS 0x00000040 |
| #define FLG_HEAP_VALIDATE_ALL 0x00000080 |
| #define FLG_POOL_ENABLE_TAIL_CHECK 0x00000100 |
| #define FLG_POOL_ENABLE_FREE_CHECK 0x00000200 |
| #define FLG_POOL_ENABLE_TAGGING 0x00000400 |
| #define FLG_HEAP_ENABLE_TAGGING 0x00000800 |
| #define FLG_USER_STACK_TRACE_DB 0x00001000 |
| #define FLG_KERNEL_STACK_TRACE_DB 0x00002000 |
| #define FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000 |
| #define FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000 |
| #define FLG_IGNORE_DEBUG_PRIV 0x00010000 |
| #define FLG_ENABLE_CSRDEBUG 0x00020000 |
| #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000 |
| #define FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000 |
| #define FLG_HEAP_ENABLE_CALL_TRACING 0x00100000 |
| #define FLG_HEAP_DISABLE_COALESCING 0x00200000 |
| #define FLG_ENABLE_CLOSE_EXCEPTIONS 0x00400000 |
| #define FLG_ENABLE_EXCEPTION_LOGGING 0x00800000 |
| #define FLG_ENABLE_DBGPRINT_BUFFERING 0x08000000 |
| |
| typedef struct _SYSTEM_GLOBAL_FLAG { |
| ULONG GlobalFlag; |
| } SYSTEM_GLOBAL_FLAG, *PSYSTEM_GLOBAL_FLAG; |
| |
| typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY { |
| ULONG Unknown1; |
| ULONG Unknown2; |
| PVOID Base; |
| ULONG Size; |
| ULONG Flags; |
| USHORT Index; |
| /* Length of module name not including the path, this |
| field contains valid value only for NTOSKRNL module */ |
| USHORT NameLength; |
| USHORT LoadCount; |
| USHORT PathLength; |
| CHAR ImageName[256]; |
| } SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY; |
| |
| typedef struct _SYSTEM_MODULE_INFORMATION { |
| ULONG Count; |
| SYSTEM_MODULE_INFORMATION_ENTRY Module[1]; |
| } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; |
| |
| typedef struct _SYSTEM_LOCK_INFORMATION { |
| PVOID Address; |
| USHORT Type; |
| USHORT Reserved1; |
| ULONG ExclusiveOwnerThreadId; |
| ULONG ActiveCount; |
| ULONG ContentionCount; |
| ULONG Reserved2[2]; |
| ULONG NumberOfSharedWaiters; |
| ULONG NumberOfExclusiveWaiters; |
| } SYSTEM_LOCK_INFORMATION, *PSYSTEM_LOCK_INFORMATION; |
| |
| /*SYSTEM_HANDLE_INFORMATION.Flags cosntants */ |
| #define PROTECT_FROM_CLOSE 0x01 |
| #define INHERIT 0x02 |
| |
| typedef struct _SYSTEM_HANDLE_INFORMATION { |
| ULONG ProcessId; |
| UCHAR ObjectTypeNumber; |
| UCHAR Flags; |
| USHORT Handle; |
| PVOID Object; |
| ACCESS_MASK GrantedAccess; |
| } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; |
| |
| typedef struct _SYSTEM_OBJECT_TYPE_INFORMATION { |
| ULONG NextEntryOffset; |
| ULONG ObjectCount; |
| ULONG HandleCount; |
| ULONG TypeNumber; |
| ULONG InvalidAttributes; |
| GENERIC_MAPPING GenericMapping; |
| ACCESS_MASK ValidAccessMask; |
| POOL_TYPE PoolType; |
| UCHAR Unknown; |
| UNICODE_STRING Name; |
| } SYSTEM_OBJECT_TYPE_INFORMATION, *PSYSTEM_OBJECT_TYPE_INFORMATION; |
| |
| /* SYSTEM_OBJECT_INFORMATION.Flags constants */ |
| #define FLG_SYSOBJINFO_SINGLE_HANDLE_ENTRY 0x40 |
| #define FLG_SYSOBJINFO_DEFAULT_SECURITY_QUOTA 0x20 |
| #define FLG_SYSOBJINFO_PERMANENT 0x10 |
| #define FLG_SYSOBJINFO_EXCLUSIVE 0x08 |
| #define FLG_SYSOBJINFO_CREATOR_INFO 0x04 |
| #define FLG_SYSOBJINFO_KERNEL_MODE 0x02 |
| |
| typedef struct _SYSTEM_OBJECT_INFORMATION { |
| ULONG NextEntryOffset; |
| PVOID Object; |
| ULONG CreatorProcessId; |
| USHORT Unknown; |
| USHORT Flags; |
| ULONG PointerCount; |
| ULONG HandleCount; |
| ULONG PagedPoolUsage; |
| ULONG NonPagedPoolUsage; |
| ULONG ExclusiveProcessId; |
| PSECURITY_DESCRIPTOR SecurityDescriptor; |
| UNICODE_STRING Name; |
| } SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION; |
| |
| typedef struct _SYSTEM_PAGEFILE_INFORMATION { |
| ULONG NextEntryOffset; |
| ULONG CurrentSize; |
| ULONG TotalUsed; |
| ULONG PeakUsed; |
| UNICODE_STRING FileName; |
| } SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION; |
| |
| typedef struct _SYSTEM_INSTRUCTION_EMULATION_INFORMATION { |
| ULONG SegmentNotPresent; |
| ULONG TwoByteOpcode; |
| ULONG ESprefix; |
| ULONG CSprefix; |
| ULONG SSprefix; |
| ULONG DSprefix; |
| ULONG FSPrefix; |
| ULONG GSprefix; |
| ULONG OPER32prefix; |
| ULONG ADDR32prefix; |
| ULONG INSB; |
| ULONG INSW; |
| ULONG OUTSB; |
| ULONG OUTSW; |
| ULONG PUSHFD; |
| ULONG POPFD; |
| ULONG INTnn; |
| ULONG INTO; |
| ULONG IRETD; |
| ULONG INBimm; |
| ULONG INWimm; |
| ULONG OUTBimm; |
| ULONG OUTWimm; |
| ULONG INB; |
| ULONG INW; |
| ULONG OUTB; |
| ULONG OUTW; |
| ULONG LOCKprefix; |
| ULONG REPNEprefix; |
| ULONG REPprefix; |
| ULONG HLT; |
| ULONG CLI; |
| ULONG STI; |
| ULONG GenericInvalidOpcode; |
| } SYSTEM_INSTRUCTION_EMULATION_INFORMATION, *PSYSTEM_INSTRUCTION_EMULATION_INFORMATION; |
| |
| typedef struct _SYSTEM_POOL_TAG_INFORMATION { |
| CHAR Tag[4]; |
| ULONG PagedPoolAllocs; |
| ULONG PagedPoolFrees; |
| ULONG PagedPoolUsage; |
| ULONG NonPagedPoolAllocs; |
| ULONG NonPagedPoolFrees; |
| ULONG NonPagedPoolUsage; |
| } SYSTEM_POOL_TAG_INFORMATION, *PSYSTEM_POOL_TAG_INFORMATION; |
| |
| typedef struct _SYSTEM_PROCESSOR_STATISTICS { |
| ULONG ContextSwitches; |
| ULONG DpcCount; |
| ULONG DpcRequestRate; |
| ULONG TimeIncrement; |
| ULONG DpcBypassCount; |
| ULONG ApcBypassCount; |
| } SYSTEM_PROCESSOR_STATISTICS, *PSYSTEM_PROCESSOR_STATISTICS; |
| |
| typedef struct _SYSTEM_DPC_INFORMATION { |
| ULONG Reserved; |
| ULONG MaximumDpcQueueDepth; |
| ULONG MinimumDpcRate; |
| ULONG AdjustDpcThreshold; |
| ULONG IdealDpcRate; |
| } SYSTEM_DPC_INFORMATION, *PSYSTEM_DPC_INFORMATION; |
| |
| typedef struct _SYSTEM_LOAD_IMAGE { |
| UNICODE_STRING ModuleName; |
| PVOID ModuleBase; |
| PVOID SectionPointer; |
| PVOID EntryPoint; |
| PVOID ExportDirectory; |
| } SYSTEM_LOAD_IMAGE, *PSYSTEM_LOAD_IMAGE; |
| |
| typedef struct _SYSTEM_UNLOAD_IMAGE { |
| PVOID ModuleBase; |
| } SYSTEM_UNLOAD_IMAGE, *PSYSTEM_UNLOAD_IMAGE; |
| |
| typedef struct _SYSTEM_QUERY_TIME_ADJUSTMENT { |
| ULONG TimeAdjustment; |
| ULONG MaximumIncrement; |
| BOOLEAN TimeSynchronization; |
| } SYSTEM_QUERY_TIME_ADJUSTMENT, *PSYSTEM_QUERY_TIME_ADJUSTMENT; |
| |
| typedef struct _SYSTEM_SET_TIME_ADJUSTMENT { |
| ULONG TimeAdjustment; |
| BOOLEAN TimeSynchronization; |
| } SYSTEM_SET_TIME_ADJUSTMENT, *PSYSTEM_SET_TIME_ADJUSTMENT; |
| |
| typedef struct _SYSTEM_CRASH_DUMP_INFORMATION { |
| HANDLE CrashDumpSectionHandle; |
| HANDLE Unknown; |
| } SYSTEM_CRASH_DUMP_INFORMATION, *PSYSTEM_CRASH_DUMP_INFORMATION; |
| |
| typedef struct _SYSTEM_EXCEPTION_INFORMATION { |
| ULONG AlignmentFixupCount; |
| ULONG ExceptionDispatchCount; |
| ULONG FloatingEmulationCount; |
| ULONG Reserved; |
| } SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION; |
| |
| typedef struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION { |
| ULONG CrashDumpSectionExists; |
| ULONG Unknown; |
| } SYSTEM_CRASH_DUMP_STATE_INFORMATION, *PSYSTEM_CRASH_DUMP_STATE_INFORMATION; |
| |
| typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION { |
| BOOLEAN DebuggerEnabled; |
| BOOLEAN DebuggerNotPresent; |
| } SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION; |
| |
| typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION { |
| ULONG ContextSwitches; |
| ULONG ContextSwitchCounters[11]; |
| } SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION; |
| |
| typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION { |
| ULONG RegistryQuota; |
| ULONG RegistryQuotaInUse; |
| ULONG PagedPoolSize; |
| } SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION; |
| |
| typedef struct _SYSTEM_LOAD_AND_CALL_IMAGE { |
| UNICODE_STRING ModuleName; |
| } SYSTEM_LOAD_AND_CALL_IMAGE, *PSYSTEM_LOAD_AND_CALL_IMAGE; |
| |
| typedef struct _SYSTEM_PRIORITY_SEPARATION { |
| ULONG PrioritySeparation; |
| } SYSTEM_PRIORITY_SEPARATION, *PSYSTEM_PRIORITY_SEPARATION; |
| |
| typedef struct _SYSTEM_TIME_ZONE_INFORMATION { |
| LONG Bias; |
| WCHAR StandardName[32]; |
| LARGE_INTEGER StandardDate; |
| LONG StandardBias; |
| WCHAR DaylightName[32]; |
| LARGE_INTEGER DaylightDate; |
| LONG DaylightBias; |
| } SYSTEM_TIME_ZONE_INFORMATION, *PSYSTEM_TIME_ZONE_INFORMATION; |
| |
| typedef struct _SYSTEM_LOOKASIDE_INFORMATION { |
| USHORT Depth; |
| USHORT MaximumDepth; |
| ULONG TotalAllocates; |
| ULONG AllocateMisses; |
| ULONG TotalFrees; |
| ULONG FreeMisses; |
| POOL_TYPE Type; |
| ULONG Tag; |
| ULONG Size; |
| } SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION; |
| |
| typedef struct _SYSTEM_SET_TIME_SLIP_EVENT { |
| HANDLE TimeSlipEvent; |
| } SYSTEM_SET_TIME_SLIP_EVENT, *PSYSTEM_SET_TIME_SLIP_EVENT; |
| |
| typedef struct _SYSTEM_CREATE_SESSION { |
| ULONG SessionId; |
| } SYSTEM_CREATE_SESSION, *PSYSTEM_CREATE_SESSION; |
| |
| typedef struct _SYSTEM_DELETE_SESSION { |
| ULONG SessionId; |
| } SYSTEM_DELETE_SESSION, *PSYSTEM_DELETE_SESSION; |
| |
| typedef struct _SYSTEM_RANGE_START_INFORMATION { |
| PVOID SystemRangeStart; |
| } SYSTEM_RANGE_START_INFORMATION, *PSYSTEM_RANGE_START_INFORMATION; |
| |
| typedef struct _SYSTEM_SESSION_PROCESSES_INFORMATION { |
| ULONG SessionId; |
| ULONG BufferSize; |
| PVOID Buffer; |
| } SYSTEM_SESSION_PROCESSES_INFORMATION, *PSYSTEM_SESSION_PROCESSES_INFORMATION; |
| |
| typedef struct _SYSTEM_POOL_BLOCK { |
| BOOLEAN Allocated; |
| USHORT Unknown; |
| ULONG Size; |
| CHAR Tag[4]; |
| } SYSTEM_POOL_BLOCK, *PSYSTEM_POOL_BLOCK; |
| |
| typedef struct _SYSTEM_POOL_BLOCKS_INFORMATION { |
| ULONG PoolSize; |
| PVOID PoolBase; |
| USHORT Unknown; |
| ULONG NumberOfBlocks; |
| SYSTEM_POOL_BLOCK PoolBlocks[1]; |
| } SYSTEM_POOL_BLOCKS_INFORMATION, *PSYSTEM_POOL_BLOCKS_INFORMATION; |
| |
| typedef struct _SYSTEM_MEMORY_USAGE { |
| PVOID Name; |
| USHORT Valid; |
| USHORT Standby; |
| USHORT Modified; |
| USHORT PageTables; |
| } SYSTEM_MEMORY_USAGE, *PSYSTEM_MEMORY_USAGE; |
| |
| typedef struct _SYSTEM_MEMORY_USAGE_INFORMATION { |
| ULONG Reserved; |
| PVOID EndOfData; |
| SYSTEM_MEMORY_USAGE MemoryUsage[1]; |
| } SYSTEM_MEMORY_USAGE_INFORMATION, *PSYSTEM_MEMORY_USAGE_INFORMATION; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtQuerySystemInformation( |
| /*IN*/ SYSTEM_INFORMATION_CLASS SystemInformationClass, |
| /*IN OUT*/ PVOID SystemInformation, |
| /*IN*/ ULONG SystemInformationLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQuerySystemInformation( |
| /*IN*/ SYSTEM_INFORMATION_CLASS SystemInformationClass, |
| /*IN OUT*/ PVOID SystemInformation, |
| /*IN*/ ULONG SystemInformationLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTAPI |
| NTSTATUS |
| NtQueryFullAttributesFile( |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*OUT*/ PFILE_NETWORK_OPEN_INFORMATION FileInformation); |
| |
| NTOSAPI |
| NTAPI |
| NTSTATUS |
| ZwQueryFullAttributesFile( |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*OUT*/ PFILE_NETWORK_OPEN_INFORMATION FileInformation); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetSystemInformation( |
| /*IN*/ SYSTEM_INFORMATION_CLASS SystemInformationClass, |
| /*IN OUT*/ PVOID SystemInformation, |
| /*IN*/ ULONG SystemInformationLength); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQuerySystemEnvironmentValue( |
| /*IN*/ PUNICODE_STRING Name, |
| /*OUT*/ PVOID Value, |
| /*IN*/ ULONG ValueLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetSystemEnvironmentValue( |
| /*IN*/ PUNICODE_STRING Name, |
| /*IN*/ PUNICODE_STRING Value); |
| |
| typedef enum _SHUTDOWN_ACTION { |
| ShutdownNoReboot, |
| ShutdownReboot, |
| ShutdownPowerOff |
| } SHUTDOWN_ACTION; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtShutdownSystem( |
| /*IN*/ SHUTDOWN_ACTION Action); |
| |
| typedef enum _DEBUG_CONTROL_CODE { |
| DebugGetTraceInformation = 1, |
| DebugSetInternalBreakpoint, |
| DebugSetSpecialCall, |
| DebugClearSpecialCalls, |
| DebugQuerySpecialCalls, |
| DebugDbgBreakPoint, |
| DebugMaximum |
| } DEBUG_CONTROL_CODE; |
| |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSystemDebugControl( |
| /*IN*/ DEBUG_CONTROL_CODE ControlCode, |
| /*IN*/ PVOID InputBuffer /*OPTIONAL*/, |
| /*IN*/ ULONG InputBufferLength, |
| /*OUT*/ PVOID OutputBuffer /*OPTIONAL*/, |
| /*IN*/ ULONG OutputBufferLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| |
| |
| /* Objects, Object directories, and symbolic links */ |
| |
| typedef enum _OBJECT_INFORMATION_CLASS { |
| ObjectBasicInformation, |
| ObjectNameInformation, |
| ObjectTypeInformation, |
| ObjectAllTypesInformation, |
| ObjectHandleInformation |
| } OBJECT_INFORMATION_CLASS; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryObject( |
| /*IN*/ HANDLE ObjectHandle, |
| /*IN*/ OBJECT_INFORMATION_CLASS ObjectInformationClass, |
| /*OUT*/ PVOID ObjectInformation, |
| /*IN*/ ULONG ObjectInformationLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetInformationObject( |
| /*IN*/ HANDLE ObjectHandle, |
| /*IN*/ OBJECT_INFORMATION_CLASS ObjectInformationClass, |
| /*IN*/ PVOID ObjectInformation, |
| /*IN*/ ULONG ObjectInformationLength); |
| |
| /* OBJECT_BASIC_INFORMATION.Attributes constants */ |
| /* also in winbase.h */ |
| #define HANDLE_FLAG_INHERIT 0x01 |
| #define HANDLE_FLAG_PROTECT_FROM_CLOSE 0x02 |
| /* end winbase.h */ |
| #define PERMANENT 0x10 |
| #define EXCLUSIVE 0x20 |
| |
| typedef struct _OBJECT_BASIC_INFORMATION { |
| ULONG Attributes; |
| ACCESS_MASK GrantedAccess; |
| ULONG HandleCount; |
| ULONG PointerCount; |
| ULONG PagedPoolUsage; |
| ULONG NonPagedPoolUsage; |
| ULONG Reserved[3]; |
| ULONG NameInformationLength; |
| ULONG TypeInformationLength; |
| ULONG SecurityDescriptorLength; |
| LARGE_INTEGER CreateTime; |
| } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION; |
| #if 0 |
| /* FIXME: Enable later */ |
| typedef struct _OBJECT_TYPE_INFORMATION { |
| UNICODE_STRING Name; |
| ULONG ObjectCount; |
| ULONG HandleCount; |
| ULONG Reserved1[4]; |
| ULONG PeakObjectCount; |
| ULONG PeakHandleCount; |
| ULONG Reserved2[4]; |
| ULONG InvalidAttributes; |
| GENERIC_MAPPING GenericMapping; |
| ULONG ValidAccess; |
| UCHAR Unknown; |
| BOOLEAN MaintainHandleDatabase; |
| POOL_TYPE PoolType; |
| ULONG PagedPoolUsage; |
| ULONG NonPagedPoolUsage; |
| } OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION; |
| |
| typedef struct _OBJECT_ALL_TYPES_INFORMATION { |
| ULONG NumberOfTypes; |
| OBJECT_TYPE_INFORMATION TypeInformation; |
| } OBJECT_ALL_TYPES_INFORMATION, *POBJECT_ALL_TYPES_INFORMATION; |
| #endif |
| typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFORMATION { |
| BOOLEAN Inherit; |
| BOOLEAN ProtectFromClose; |
| } OBJECT_HANDLE_ATTRIBUTE_INFORMATION, *POBJECT_HANDLE_ATTRIBUTE_INFORMATION; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtDuplicateObject( |
| /*IN*/ HANDLE SourceProcessHandle, |
| /*IN*/ HANDLE SourceHandle, |
| /*IN*/ HANDLE TargetProcessHandle, |
| /*OUT*/ PHANDLE TargetHandle /*OPTIONAL*/, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ ULONG Attributes, |
| /*IN*/ ULONG Options); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwDuplicateObject( |
| /*IN*/ HANDLE SourceProcessHandle, |
| /*IN*/ HANDLE SourceHandle, |
| /*IN*/ HANDLE TargetProcessHandle, |
| /*OUT*/ PHANDLE TargetHandle /*OPTIONAL*/, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ ULONG Attributes, |
| /*IN*/ ULONG Options); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtQuerySecurityObject( |
| /*IN*/ HANDLE Handle, |
| /*IN*/ SECURITY_INFORMATION SecurityInformation, |
| /*OUT*/ PSECURITY_DESCRIPTOR SecurityDescriptor, |
| /*IN*/ ULONG SecurityDescriptorLength, |
| /*OUT*/ PULONG ReturnLength); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQuerySecurityObject( |
| /*IN*/ HANDLE Handle, |
| /*IN*/ SECURITY_INFORMATION SecurityInformation, |
| /*OUT*/ PSECURITY_DESCRIPTOR SecurityDescriptor, |
| /*IN*/ ULONG SecurityDescriptorLength, |
| /*OUT*/ PULONG ReturnLength); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtSetSecurityObject( |
| /*IN*/ HANDLE Handle, |
| /*IN*/ SECURITY_INFORMATION SecurityInformation, |
| /*IN*/ PSECURITY_DESCRIPTOR SecurityDescriptor); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetSecurityObject( |
| /*IN*/ HANDLE Handle, |
| /*IN*/ SECURITY_INFORMATION SecurityInformation, |
| /*IN*/ PSECURITY_DESCRIPTOR SecurityDescriptor); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwOpenDirectoryObject( |
| /*OUT*/ PHANDLE DirectoryHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryDirectoryObject( |
| /*IN*/ HANDLE DirectoryHandle, |
| /*OUT*/ PVOID Buffer, |
| /*IN*/ ULONG BufferLength, |
| /*IN*/ BOOLEAN ReturnSingleEntry, |
| /*IN*/ BOOLEAN RestartScan, |
| /*IN OUT*/ PULONG Context, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| typedef struct _DIRECTORY_BASIC_INFORMATION { |
| UNICODE_STRING ObjectName; |
| UNICODE_STRING ObjectTypeName; |
| } DIRECTORY_BASIC_INFORMATION, *PDIRECTORY_BASIC_INFORMATION; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCreateSymbolicLinkObject( |
| /*OUT*/ PHANDLE SymbolicLinkHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*IN*/ PUNICODE_STRING TargetName); |
| |
| |
| |
| |
| /* Virtual memory */ |
| |
| typedef enum _MEMORY_INFORMATION_CLASS { |
| MemoryBasicInformation, |
| MemoryWorkingSetList, |
| MemorySectionName, |
| MemoryBasicVlmInformation |
| } MEMORY_INFORMATION_CLASS; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtAllocateVirtualMemory( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN OUT*/ PVOID *BaseAddress, |
| /*IN*/ ULONG ZeroBits, |
| /*IN OUT*/ PULONG AllocationSize, |
| /*IN*/ ULONG AllocationType, |
| /*IN*/ ULONG Protect); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAllocateVirtualMemory( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN OUT*/ PVOID *BaseAddress, |
| /*IN*/ ULONG ZeroBits, |
| /*IN OUT*/ PULONG AllocationSize, |
| /*IN*/ ULONG AllocationType, |
| /*IN*/ ULONG Protect); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtFreeVirtualMemory( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN OUT*/ PVOID *BaseAddress, |
| /*IN OUT*/ PULONG FreeSize, |
| /*IN*/ ULONG FreeType); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwFreeVirtualMemory( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN OUT*/ PVOID *BaseAddress, |
| /*IN OUT*/ PULONG FreeSize, |
| /*IN*/ ULONG FreeType); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryVirtualMemory( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN*/ PVOID BaseAddress, |
| /*IN*/ MEMORY_INFORMATION_CLASS MemoryInformationClass, |
| /*OUT*/ PVOID MemoryInformation, |
| /*IN*/ ULONG MemoryInformationLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| /* MEMORY_WORKING_SET_LIST.WorkingSetList constants */ |
| #define WSLE_PAGE_READONLY 0x001 |
| #define WSLE_PAGE_EXECUTE 0x002 |
| #define WSLE_PAGE_READWRITE 0x004 |
| #define WSLE_PAGE_EXECUTE_READ 0x003 |
| #define WSLE_PAGE_WRITECOPY 0x005 |
| #define WSLE_PAGE_EXECUTE_READWRITE 0x006 |
| #define WSLE_PAGE_EXECUTE_WRITECOPY 0x007 |
| #define WSLE_PAGE_SHARE_COUNT_MASK 0x0E0 |
| #define WSLE_PAGE_SHAREABLE 0x100 |
| |
| typedef struct _MEMORY_WORKING_SET_LIST { |
| ULONG NumberOfPages; |
| ULONG WorkingSetList[1]; |
| } MEMORY_WORKING_SET_LIST, *PMEMORY_WORKING_SET_LIST; |
| |
| typedef struct _MEMORY_SECTION_NAME { |
| UNICODE_STRING SectionFileName; |
| } MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME; |
| |
| /* Zw[Lock|Unlock]VirtualMemory.LockType constants */ |
| #define LOCK_VM_IN_WSL 0x01 |
| #define LOCK_VM_IN_RAM 0x02 |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwLockVirtualMemory( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN OUT*/ PVOID *BaseAddress, |
| /*IN OUT*/ PULONG LockSize, |
| /*IN*/ ULONG LockType); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwUnlockVirtualMemory( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN OUT*/ PVOID *BaseAddress, |
| /*IN OUT*/ PULONG LockSize, |
| /*IN*/ ULONG LockType); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwReadVirtualMemory( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN*/ PVOID BaseAddress, |
| /*OUT*/ PVOID Buffer, |
| /*IN*/ ULONG BufferLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwWriteVirtualMemory( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN*/ PVOID BaseAddress, |
| /*IN*/ PVOID Buffer, |
| /*IN*/ ULONG BufferLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwProtectVirtualMemory( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN OUT*/ PVOID *BaseAddress, |
| /*IN OUT*/ PULONG ProtectSize, |
| /*IN*/ ULONG NewProtect, |
| /*OUT*/ PULONG OldProtect); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwFlushVirtualMemory( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN OUT*/ PVOID *BaseAddress, |
| /*IN OUT*/ PULONG FlushSize, |
| /*OUT*/ PIO_STATUS_BLOCK IoStatusBlock); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAllocateUserPhysicalPages( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN*/ PULONG NumberOfPages, |
| /*OUT*/ PULONG PageFrameNumbers); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwFreeUserPhysicalPages( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN OUT*/ PULONG NumberOfPages, |
| /*IN*/ PULONG PageFrameNumbers); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwMapUserPhysicalPages( |
| /*IN*/ PVOID BaseAddress, |
| /*IN*/ PULONG NumberOfPages, |
| /*IN*/ PULONG PageFrameNumbers); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwMapUserPhysicalPagesScatter( |
| /*IN*/ PVOID *BaseAddresses, |
| /*IN*/ PULONG NumberOfPages, |
| /*IN*/ PULONG PageFrameNumbers); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwGetWriteWatch( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN*/ ULONG Flags, |
| /*IN*/ PVOID BaseAddress, |
| /*IN*/ ULONG RegionSize, |
| /*OUT*/ PULONG Buffer, |
| /*IN OUT*/ PULONG BufferEntries, |
| /*OUT*/ PULONG Granularity); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwResetWriteWatch( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN*/ PVOID BaseAddress, |
| /*IN*/ ULONG RegionSize); |
| |
| |
| |
| |
| /* Sections */ |
| |
| typedef enum _SECTION_INFORMATION_CLASS { |
| SectionBasicInformation, |
| SectionImageInformation |
| } SECTION_INFORMATION_CLASS; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtCreateSection( |
| /*OUT*/ PHANDLE SectionHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*IN*/ PLARGE_INTEGER SectionSize /*OPTIONAL*/, |
| /*IN*/ ULONG Protect, |
| /*IN*/ ULONG Attributes, |
| /*IN*/ HANDLE FileHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCreateSection( |
| /*OUT*/ PHANDLE SectionHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*IN*/ PLARGE_INTEGER SectionSize /*OPTIONAL*/, |
| /*IN*/ ULONG Protect, |
| /*IN*/ ULONG Attributes, |
| /*IN*/ HANDLE FileHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQuerySection( |
| /*IN*/ HANDLE SectionHandle, |
| /*IN*/ SECTION_INFORMATION_CLASS SectionInformationClass, |
| /*OUT*/ PVOID SectionInformation, |
| /*IN*/ ULONG SectionInformationLength, |
| /*OUT*/ PULONG ResultLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwExtendSection( |
| /*IN*/ HANDLE SectionHandle, |
| /*IN*/ PLARGE_INTEGER SectionSize); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAreMappedFilesTheSame( |
| /*IN*/ PVOID Address1, |
| /*IN*/ PVOID Address2); |
| |
| |
| |
| |
| /* Threads */ |
| |
| typedef struct _USER_STACK { |
| PVOID FixedStackBase; |
| PVOID FixedStackLimit; |
| PVOID ExpandableStackBase; |
| PVOID ExpandableStackLimit; |
| PVOID ExpandableStackBottom; |
| } USER_STACK, *PUSER_STACK; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCreateThread( |
| /*OUT*/ PHANDLE ThreadHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*IN*/ HANDLE ProcessHandle, |
| /*OUT*/ PCLIENT_ID ClientId, |
| /*IN*/ PCONTEXT ThreadContext, |
| /*IN*/ PUSER_STACK UserStack, |
| /*IN*/ BOOLEAN CreateSuspended); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtOpenThread( |
| /*OUT*/ PHANDLE ThreadHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*IN*/ PCLIENT_ID ClientId); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwOpenThread( |
| /*OUT*/ PHANDLE ThreadHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*IN*/ PCLIENT_ID ClientId); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwTerminateThread( |
| /*IN*/ HANDLE ThreadHandle /*OPTIONAL*/, |
| /*IN*/ NTSTATUS ExitStatus); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtQueryInformationThread( |
| /*IN*/ HANDLE ThreadHandle, |
| /*IN*/ THREADINFOCLASS ThreadInformationClass, |
| /*OUT*/ PVOID ThreadInformation, |
| /*IN*/ ULONG ThreadInformationLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryInformationThread( |
| /*IN*/ HANDLE ThreadHandle, |
| /*IN*/ THREADINFOCLASS ThreadInformationClass, |
| /*OUT*/ PVOID ThreadInformation, |
| /*IN*/ ULONG ThreadInformationLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtSetInformationThread( |
| /*IN*/ HANDLE ThreadHandle, |
| /*IN*/ THREADINFOCLASS ThreadInformationClass, |
| /*IN*/ PVOID ThreadInformation, |
| /*IN*/ ULONG ThreadInformationLength); |
| |
| typedef struct _THREAD_BASIC_INFORMATION { |
| NTSTATUS ExitStatus; |
| PNT_TIB TebBaseAddress; |
| CLIENT_ID ClientId; |
| KAFFINITY AffinityMask; |
| KPRIORITY Priority; |
| KPRIORITY BasePriority; |
| } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION; |
| |
| typedef struct _KERNEL_USER_TIMES { |
| LARGE_INTEGER CreateTime; |
| LARGE_INTEGER ExitTime; |
| LARGE_INTEGER KernelTime; |
| LARGE_INTEGER UserTime; |
| } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSuspendThread( |
| /*IN*/ HANDLE ThreadHandle, |
| /*OUT*/ PULONG PreviousSuspendCount /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwResumeThread( |
| /*IN*/ HANDLE ThreadHandle, |
| /*OUT*/ PULONG PreviousSuspendCount /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwGetContextThread( |
| /*IN*/ HANDLE ThreadHandle, |
| /*OUT*/ PCONTEXT Context); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetContextThread( |
| /*IN*/ HANDLE ThreadHandle, |
| /*IN*/ PCONTEXT Context); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueueApcThread( |
| /*IN*/ HANDLE ThreadHandle, |
| /*IN*/ PKNORMAL_ROUTINE ApcRoutine, |
| /*IN*/ PVOID ApcContext /*OPTIONAL*/, |
| /*IN*/ PVOID Argument1 /*OPTIONAL*/, |
| /*IN*/ PVOID Argument2 /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwTestAlert( |
| VOID); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAlertThread( |
| /*IN*/ HANDLE ThreadHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAlertResumeThread( |
| /*IN*/ HANDLE ThreadHandle, |
| /*OUT*/ PULONG PreviousSuspendCount /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwRegisterThreadTerminatePort( |
| /*IN*/ HANDLE PortHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwImpersonateThread( |
| /*IN*/ HANDLE ThreadHandle, |
| /*IN*/ HANDLE TargetThreadHandle, |
| /*IN*/ PSECURITY_QUALITY_OF_SERVICE SecurityQos); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwImpersonateAnonymousToken( |
| /*IN*/ HANDLE ThreadHandle); |
| |
| |
| |
| |
| /* Processes */ |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCreateProcess( |
| /*OUT*/ PHANDLE ProcessHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*IN*/ HANDLE InheritFromProcessHandle, |
| /*IN*/ BOOLEAN InheritHandles, |
| /*IN*/ HANDLE SectionHandle /*OPTIONAL*/, |
| /*IN*/ HANDLE DebugPort /*OPTIONAL*/, |
| /*IN*/ HANDLE ExceptionPort /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCreateProcess( |
| /*OUT*/ PHANDLE ProcessHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*IN*/ HANDLE InheritFromProcessHandle, |
| /*IN*/ BOOLEAN InheritHandles, |
| /*IN*/ HANDLE SectionHandle /*OPTIONAL*/, |
| /*IN*/ HANDLE DebugPort /*OPTIONAL*/, |
| /*IN*/ HANDLE ExceptionPort /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwTerminateProcess( |
| /*IN*/ HANDLE ProcessHandle /*OPTIONAL*/, |
| /*IN*/ NTSTATUS ExitStatus); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryInformationProcess( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN*/ PROCESSINFOCLASS ProcessInformationClass, |
| /*OUT*/ PVOID ProcessInformation, |
| /*IN*/ ULONG ProcessInformationLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtSetInformationProcess( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN*/ PROCESSINFOCLASS ProcessInformationClass, |
| /*IN*/ PVOID ProcessInformation, |
| /*IN*/ ULONG ProcessInformationLength); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetInformationProcess( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN*/ PROCESSINFOCLASS ProcessInformationClass, |
| /*IN*/ PVOID ProcessInformation, |
| /*IN*/ ULONG ProcessInformationLength); |
| |
| typedef struct _PROCESS_BASIC_INFORMATION { |
| NTSTATUS ExitStatus; |
| PPEB PebBaseAddress; |
| KAFFINITY AffinityMask; |
| KPRIORITY BasePriority; |
| ULONG UniqueProcessId; |
| ULONG InheritedFromUniqueProcessId; |
| } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION; |
| |
| typedef struct _PROCESS_ACCESS_TOKEN { |
| HANDLE Token; |
| HANDLE Thread; |
| } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN; |
| |
| /* DefaultHardErrorMode constants */ |
| /* also in winbase.h */ |
| #define SEM_FAILCRITICALERRORS 0x0001 |
| #define SEM_NOGPFAULTERRORBOX 0x0002 |
| #define SEM_NOALIGNMENTFAULTEXCEPT 0x0004 |
| #define SEM_NOOPENFILEERRORBOX 0x8000 |
| /* end winbase.h */ |
| typedef struct _POOLED_USAGE_AND_LIMITS { |
| ULONG PeakPagedPoolUsage; |
| ULONG PagedPoolUsage; |
| ULONG PagedPoolLimit; |
| ULONG PeakNonPagedPoolUsage; |
| ULONG NonPagedPoolUsage; |
| ULONG NonPagedPoolLimit; |
| ULONG PeakPagefileUsage; |
| ULONG PagefileUsage; |
| ULONG PagefileLimit; |
| } POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS; |
| |
| typedef struct _PROCESS_WS_WATCH_INFORMATION { |
| PVOID FaultingPc; |
| PVOID FaultingVa; |
| } PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION; |
| |
| /* PROCESS_PRIORITY_CLASS.PriorityClass constants */ |
| #define PC_IDLE 1 |
| #define PC_NORMAL 2 |
| #define PC_HIGH 3 |
| #define PC_REALTIME 4 |
| #define PC_BELOW_NORMAL 5 |
| #define PC_ABOVE_NORMAL 6 |
| |
| typedef struct _PROCESS_PRIORITY_CLASS { |
| BOOLEAN Foreground; |
| UCHAR PriorityClass; |
| } PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS; |
| |
| /* PROCESS_DEVICEMAP_INFORMATION.DriveType constants */ |
| #define DRIVE_UNKNOWN 0 |
| #define DRIVE_NO_ROOT_DIR 1 |
| #define DRIVE_REMOVABLE 2 |
| #define DRIVE_FIXED 3 |
| #define DRIVE_REMOTE 4 |
| #define DRIVE_CDROM 5 |
| #define DRIVE_RAMDISK 6 |
| |
| typedef struct _PROCESS_DEVICEMAP_INFORMATION { |
| _ANONYMOUS_UNION union { |
| struct { |
| HANDLE DirectoryHandle; |
| } Set; |
| struct { |
| ULONG DriveMap; |
| UCHAR DriveType[32]; |
| } Query; |
| } DUMMYUNIONNAME; |
| } PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION; |
| |
| typedef struct _PROCESS_SESSION_INFORMATION { |
| ULONG SessionId; |
| } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION; |
| |
| typedef struct _RTL_USER_PROCESS_PARAMETERS { |
| ULONG AllocationSize; |
| ULONG Size; |
| ULONG Flags; |
| ULONG DebugFlags; |
| HANDLE hConsole; |
| ULONG ProcessGroup; |
| HANDLE hStdInput; |
| HANDLE hStdOutput; |
| HANDLE hStdError; |
| UNICODE_STRING CurrentDirectoryName; |
| HANDLE CurrentDirectoryHandle; |
| UNICODE_STRING DllPath; |
| UNICODE_STRING ImagePathName; |
| UNICODE_STRING CommandLine; |
| PWSTR Environment; |
| ULONG dwX; |
| ULONG dwY; |
| ULONG dwXSize; |
| ULONG dwYSize; |
| ULONG dwXCountChars; |
| ULONG dwYCountChars; |
| ULONG dwFillAttribute; |
| ULONG dwFlags; |
| ULONG wShowWindow; |
| UNICODE_STRING WindowTitle; |
| UNICODE_STRING DesktopInfo; |
| UNICODE_STRING ShellInfo; |
| UNICODE_STRING RuntimeInfo; |
| } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS; |
| |
| NTSTATUS |
| NTAPI |
| RtlCreateProcessParameters( |
| /*OUT*/ PRTL_USER_PROCESS_PARAMETERS *ProcessParameters, |
| /*IN*/ PUNICODE_STRING ImageFile, |
| /*IN*/ PUNICODE_STRING DllPath /*OPTIONAL*/, |
| /*IN*/ PUNICODE_STRING CurrentDirectory /*OPTIONAL*/, |
| /*IN*/ PUNICODE_STRING CommandLine /*OPTIONAL*/, |
| /*IN*/ PWSTR Environment /*OPTIONAL*/, |
| /*IN*/ PUNICODE_STRING WindowTitle /*OPTIONAL*/, |
| /*IN*/ PUNICODE_STRING DesktopInfo /*OPTIONAL*/, |
| /*IN*/ PUNICODE_STRING ShellInfo /*OPTIONAL*/, |
| /*IN*/ PUNICODE_STRING RuntimeInfo /*OPTIONAL*/); |
| |
| NTSTATUS |
| NTAPI |
| RtlDestroyProcessParameters( |
| /*IN*/ PRTL_USER_PROCESS_PARAMETERS ProcessParameters); |
| |
| typedef struct _DEBUG_BUFFER { |
| HANDLE SectionHandle; |
| PVOID SectionBase; |
| PVOID RemoteSectionBase; |
| ULONG SectionBaseDelta; |
| HANDLE EventPairHandle; |
| ULONG Unknown[2]; |
| HANDLE RemoteThreadHandle; |
| ULONG InfoClassMask; |
| ULONG SizeOfInfo; |
| ULONG AllocatedSize; |
| ULONG SectionSize; |
| PVOID ModuleInformation; |
| PVOID BackTraceInformation; |
| PVOID HeapInformation; |
| PVOID LockInformation; |
| PVOID Reserved[8]; |
| } DEBUG_BUFFER, *PDEBUG_BUFFER; |
| |
| PDEBUG_BUFFER |
| NTAPI |
| RtlCreateQueryDebugBuffer( |
| /*IN*/ ULONG Size, |
| /*IN*/ BOOLEAN EventPair); |
| |
| /* RtlQueryProcessDebugInformation.DebugInfoClassMask constants */ |
| #define PDI_MODULES 0x01 |
| #define PDI_BACKTRACE 0x02 |
| #define PDI_HEAPS 0x04 |
| #define PDI_HEAP_TAGS 0x08 |
| #define PDI_HEAP_BLOCKS 0x10 |
| #define PDI_LOCKS 0x20 |
| |
| NTSTATUS |
| NTAPI |
| RtlQueryProcessDebugInformation( |
| /*IN*/ ULONG ProcessId, |
| /*IN*/ ULONG DebugInfoClassMask, |
| /*IN OUT*/ PDEBUG_BUFFER DebugBuffer); |
| |
| NTSTATUS |
| NTAPI |
| RtlDestroyQueryDebugBuffer( |
| /*IN*/ PDEBUG_BUFFER DebugBuffer); |
| |
| /* DEBUG_MODULE_INFORMATION.Flags constants */ |
| #define LDRP_STATIC_LINK 0x00000002 |
| #define LDRP_IMAGE_DLL 0x00000004 |
| #define LDRP_LOAD_IN_PROGRESS 0x00001000 |
| #define LDRP_UNLOAD_IN_PROGRESS 0x00002000 |
| #define LDRP_ENTRY_PROCESSED 0x00004000 |
| #define LDRP_ENTRY_INSERTED 0x00008000 |
| #define LDRP_CURRENT_LOAD 0x00010000 |
| #define LDRP_FAILED_BUILTIN_LOAD 0x00020000 |
| #define LDRP_DONT_CALL_FOR_THREADS 0x00040000 |
| #define LDRP_PROCESS_ATTACH_CALLED 0x00080000 |
| #define LDRP_DEBUG_SYMBOLS_LOADED 0x00100000 |
| #define LDRP_IMAGE_NOT_AT_BASE 0x00200000 |
| #define LDRP_WX86_IGNORE_MACHINETYPE 0x00400000 |
| |
| typedef struct _DEBUG_MODULE_INFORMATION { |
| ULONG Reserved[2]; |
| ULONG Base; |
| ULONG Size; |
| ULONG Flags; |
| USHORT Index; |
| USHORT Unknown; |
| USHORT LoadCount; |
| USHORT ModuleNameOffset; |
| CHAR ImageName[256]; |
| } DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION; |
| |
| typedef struct _DEBUG_HEAP_INFORMATION { |
| ULONG Base; |
| ULONG Flags; |
| USHORT Granularity; |
| USHORT Unknown; |
| ULONG Allocated; |
| ULONG Committed; |
| ULONG TagCount; |
| ULONG BlockCount; |
| ULONG Reserved[7]; |
| PVOID Tags; |
| PVOID Blocks; |
| } DEBUG_HEAP_INFORMATION, *PDEBUG_HEAP_INFORMATION; |
| |
| typedef struct _DEBUG_LOCK_INFORMATION { |
| PVOID Address; |
| USHORT Type; |
| USHORT CreatorBackTraceIndex; |
| ULONG OwnerThreadId; |
| ULONG ActiveCount; |
| ULONG ContentionCount; |
| ULONG EntryCount; |
| ULONG RecursionCount; |
| ULONG NumberOfSharedWaiters; |
| ULONG NumberOfExclusiveWaiters; |
| } DEBUG_LOCK_INFORMATION, *PDEBUG_LOCK_INFORMATION; |
| |
| |
| |
| /* Jobs */ |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCreateJobObject( |
| /*OUT*/ PHANDLE JobHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwOpenJobObject( |
| /*OUT*/ PHANDLE JobHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwTerminateJobObject( |
| /*IN*/ HANDLE JobHandle, |
| /*IN*/ NTSTATUS ExitStatus); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAssignProcessToJobObject( |
| /*IN*/ HANDLE JobHandle, |
| /*IN*/ HANDLE ProcessHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryInformationJobObject( |
| /*IN*/ HANDLE JobHandle, |
| /*IN*/ JOBOBJECTINFOCLASS JobInformationClass, |
| /*OUT*/ PVOID JobInformation, |
| /*IN*/ ULONG JobInformationLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetInformationJobObject( |
| /*IN*/ HANDLE JobHandle, |
| /*IN*/ JOBOBJECTINFOCLASS JobInformationClass, |
| /*IN*/ PVOID JobInformation, |
| /*IN*/ ULONG JobInformationLength); |
| |
| |
| /* Tokens */ |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCreateToken( |
| /*OUT*/ PHANDLE TokenHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*IN*/ TOKEN_TYPE Type, |
| /*IN*/ PLUID AuthenticationId, |
| /*IN*/ PLARGE_INTEGER ExpirationTime, |
| /*IN*/ PTOKEN_USER User, |
| /*IN*/ PTOKEN_GROUPS Groups, |
| /*IN*/ PTOKEN_PRIVILEGES Privileges, |
| /*IN*/ PTOKEN_OWNER Owner, |
| /*IN*/ PTOKEN_PRIMARY_GROUP PrimaryGroup, |
| /*IN*/ PTOKEN_DEFAULT_DACL DefaultDacl, |
| /*IN*/ PTOKEN_SOURCE Source |
| ); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtOpenProcessToken( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*OUT*/ PHANDLE TokenHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwOpenProcessToken( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*OUT*/ PHANDLE TokenHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtOpenThreadToken( |
| /*IN*/ HANDLE ThreadHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ BOOLEAN OpenAsSelf, |
| /*OUT*/ PHANDLE TokenHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwOpenThreadToken( |
| /*IN*/ HANDLE ThreadHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ BOOLEAN OpenAsSelf, |
| /*OUT*/ PHANDLE TokenHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtDuplicateToken( |
| /*IN*/ HANDLE ExistingTokenHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*IN*/ BOOLEAN EffectiveOnly, |
| /*IN*/ TOKEN_TYPE TokenType, |
| /*OUT*/ PHANDLE NewTokenHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwDuplicateToken( |
| /*IN*/ HANDLE ExistingTokenHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*IN*/ BOOLEAN EffectiveOnly, |
| /*IN*/ TOKEN_TYPE TokenType, |
| /*OUT*/ PHANDLE NewTokenHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwFilterToken( |
| /*IN*/ HANDLE ExistingTokenHandle, |
| /*IN*/ ULONG Flags, |
| /*IN*/ PTOKEN_GROUPS SidsToDisable, |
| /*IN*/ PTOKEN_PRIVILEGES PrivilegesToDelete, |
| /*IN*/ PTOKEN_GROUPS SidsToRestricted, |
| /*OUT*/ PHANDLE NewTokenHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtAdjustPrivilegesToken( |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ BOOLEAN DisableAllPrivileges, |
| /*IN*/ PTOKEN_PRIVILEGES NewState, |
| /*IN*/ ULONG BufferLength, |
| /*OUT*/ PTOKEN_PRIVILEGES PreviousState /*OPTIONAL*/, |
| /*OUT*/ PULONG ReturnLength); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAdjustPrivilegesToken( |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ BOOLEAN DisableAllPrivileges, |
| /*IN*/ PTOKEN_PRIVILEGES NewState, |
| /*IN*/ ULONG BufferLength, |
| /*OUT*/ PTOKEN_PRIVILEGES PreviousState /*OPTIONAL*/, |
| /*OUT*/ PULONG ReturnLength); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAdjustGroupsToken( |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ BOOLEAN ResetToDefault, |
| /*IN*/ PTOKEN_GROUPS NewState, |
| /*IN*/ ULONG BufferLength, |
| /*OUT*/ PTOKEN_GROUPS PreviousState /*OPTIONAL*/, |
| /*OUT*/ PULONG ReturnLength); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtQueryInformationToken( |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ TOKEN_INFORMATION_CLASS TokenInformationClass, |
| /*OUT*/ PVOID TokenInformation, |
| /*IN*/ ULONG TokenInformationLength, |
| /*OUT*/ PULONG ReturnLength); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryInformationToken( |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ TOKEN_INFORMATION_CLASS TokenInformationClass, |
| /*OUT*/ PVOID TokenInformation, |
| /*IN*/ ULONG TokenInformationLength, |
| /*OUT*/ PULONG ReturnLength); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetInformationToken( |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ TOKEN_INFORMATION_CLASS TokenInformationClass, |
| /*IN*/ PVOID TokenInformation, |
| /*IN*/ ULONG TokenInformationLength); |
| |
| |
| |
| |
| /* Time */ |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQuerySystemTime( |
| /*OUT*/ PLARGE_INTEGER CurrentTime); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetSystemTime( |
| /*IN*/ PLARGE_INTEGER NewTime, |
| /*OUT*/ PLARGE_INTEGER OldTime /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryPerformanceCounter( |
| /*OUT*/ PLARGE_INTEGER PerformanceCount, |
| /*OUT*/ PLARGE_INTEGER PerformanceFrequency /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryPerformanceCounter( |
| /*OUT*/ PLARGE_INTEGER PerformanceCount, |
| /*OUT*/ PLARGE_INTEGER PerformanceFrequency /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryTimerResolution( |
| /*OUT*/ PULONG CoarsestResolution, |
| /*OUT*/ PULONG FinestResolution, |
| /*OUT*/ PULONG ActualResolution); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwDelayExecution( |
| /*IN*/ BOOLEAN Alertable, |
| /*IN*/ PLARGE_INTEGER Interval); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwYieldExecution( |
| VOID); |
| |
| NTOSAPI |
| ULONG |
| NTAPI |
| ZwGetTickCount( |
| VOID); |
| |
| |
| |
| |
| /* Execution profiling */ |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCreateProfile( |
| /*OUT*/ PHANDLE ProfileHandle, |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN*/ PVOID Base, |
| /*IN*/ ULONG Size, |
| /*IN*/ ULONG BucketShift, |
| /*IN*/ PULONG Buffer, |
| /*IN*/ ULONG BufferLength, |
| /*IN*/ KPROFILE_SOURCE Source, |
| /*IN*/ ULONG ProcessorMask); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetIntervalProfile( |
| /*IN*/ ULONG Interval, |
| /*IN*/ KPROFILE_SOURCE Source); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryIntervalProfile( |
| /*IN*/ KPROFILE_SOURCE Source, |
| /*OUT*/ PULONG Interval); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwStartProfile( |
| /*IN*/ HANDLE ProfileHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwStopProfile( |
| /*IN*/ HANDLE ProfileHandle); |
| |
| /* Local Procedure Call (LPC) */ |
| |
| typedef struct _LPC_MESSAGE { |
| USHORT DataSize; |
| USHORT MessageSize; |
| USHORT MessageType; |
| USHORT VirtualRangesOffset; |
| CLIENT_ID ClientId; |
| ULONG MessageId; |
| ULONG SectionSize; |
| UCHAR Data[ANYSIZE_ARRAY]; |
| } LPC_MESSAGE, *PLPC_MESSAGE; |
| |
| #define LPC_MESSAGE_BASE_SIZE 24 |
| |
| typedef enum _LPC_TYPE { |
| LPC_NEW_MESSAGE, |
| LPC_REQUEST, |
| LPC_REPLY, |
| LPC_DATAGRAM, |
| LPC_LOST_REPLY, |
| LPC_PORT_CLOSED, |
| LPC_CLIENT_DIED, |
| LPC_EXCEPTION, |
| LPC_DEBUG_EVENT, |
| LPC_ERROR_EVENT, |
| LPC_CONNECTION_REQUEST, |
| LPC_CONNECTION_REFUSED, |
| LPC_MAXIMUM |
| } LPC_TYPE; |
| |
| typedef struct _LPC_SECTION_WRITE { |
| ULONG Length; |
| HANDLE SectionHandle; |
| ULONG SectionOffset; |
| ULONG ViewSize; |
| PVOID ViewBase; |
| PVOID TargetViewBase; |
| } LPC_SECTION_WRITE, *PLPC_SECTION_WRITE; |
| |
| typedef struct _LPC_SECTION_READ { |
| ULONG Length; |
| ULONG ViewSize; |
| PVOID ViewBase; |
| } LPC_SECTION_READ, *PLPC_SECTION_READ; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCreatePort( |
| /*OUT*/ PHANDLE PortHandle, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*IN*/ ULONG MaxDataSize, |
| /*IN*/ ULONG MaxMessageSize, |
| /*IN*/ ULONG Reserved); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCreateWaitablePort( |
| /*OUT*/ PHANDLE PortHandle, |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes, |
| /*IN*/ ULONG MaxDataSize, |
| /*IN*/ ULONG MaxMessageSize, |
| /*IN*/ ULONG Reserved); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtConnectPort( |
| /*OUT*/ PHANDLE PortHandle, |
| /*IN*/ PUNICODE_STRING PortName, |
| /*IN*/ PSECURITY_QUALITY_OF_SERVICE SecurityQos, |
| /*IN OUT*/ PLPC_SECTION_WRITE WriteSection /*OPTIONAL*/, |
| /*IN OUT*/ PLPC_SECTION_READ ReadSection /*OPTIONAL*/, |
| /*OUT*/ PULONG MaxMessageSize /*OPTIONAL*/, |
| /*IN OUT*/ PVOID ConnectData /*OPTIONAL*/, |
| /*IN OUT*/ PULONG ConnectDataLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwConnectPort( |
| /*OUT*/ PHANDLE PortHandle, |
| /*IN*/ PUNICODE_STRING PortName, |
| /*IN*/ PSECURITY_QUALITY_OF_SERVICE SecurityQos, |
| /*IN OUT*/ PLPC_SECTION_WRITE WriteSection /*OPTIONAL*/, |
| /*IN OUT*/ PLPC_SECTION_READ ReadSection /*OPTIONAL*/, |
| /*OUT*/ PULONG MaxMessageSize /*OPTIONAL*/, |
| /*IN OUT*/ PVOID ConnectData /*OPTIONAL*/, |
| /*IN OUT*/ PULONG ConnectDataLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwConnectPort( |
| /*OUT*/ PHANDLE PortHandle, |
| /*IN*/ PUNICODE_STRING PortName, |
| /*IN*/ PSECURITY_QUALITY_OF_SERVICE SecurityQos, |
| /*IN OUT*/ PLPC_SECTION_WRITE WriteSection /*OPTIONAL*/, |
| /*IN OUT*/ PLPC_SECTION_READ ReadSection /*OPTIONAL*/, |
| /*OUT*/ PULONG MaxMessageSize /*OPTIONAL*/, |
| /*IN OUT*/ PVOID ConnectData /*OPTIONAL*/, |
| /*IN OUT*/ PULONG ConnectDataLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwListenPort( |
| /*IN*/ HANDLE PortHandle, |
| /*OUT*/ PLPC_MESSAGE Message); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAcceptConnectPort( |
| /*OUT*/ PHANDLE PortHandle, |
| /*IN*/ ULONG PortIdentifier, |
| /*IN*/ PLPC_MESSAGE Message, |
| /*IN*/ BOOLEAN Accept, |
| /*IN OUT*/ PLPC_SECTION_WRITE WriteSection /*OPTIONAL*/, |
| /*IN OUT*/ PLPC_SECTION_READ ReadSection /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCompleteConnectPort( |
| /*IN*/ HANDLE PortHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtRequestPort( |
| /*IN*/ HANDLE PortHandle, |
| /*IN*/ PLPC_MESSAGE RequestMessage); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtRequestWaitReplyPort( |
| /*IN*/ HANDLE PortHandle, |
| /*IN*/ PLPC_MESSAGE RequestMessage, |
| /*OUT*/ PLPC_MESSAGE ReplyMessage); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwRequestWaitReplyPort( |
| /*IN*/ HANDLE PortHandle, |
| /*IN*/ PLPC_MESSAGE RequestMessage, |
| /*OUT*/ PLPC_MESSAGE ReplyMessage); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwReplyPort( |
| /*IN*/ HANDLE PortHandle, |
| /*IN*/ PLPC_MESSAGE ReplyMessage); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwReplyWaitReplyPort( |
| /*IN*/ HANDLE PortHandle, |
| /*IN OUT*/ PLPC_MESSAGE ReplyMessage); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwReplyWaitReceivePort( |
| /*IN*/ HANDLE PortHandle, |
| /*OUT*/ PULONG PortIdentifier /*OPTIONAL*/, |
| /*IN*/ PLPC_MESSAGE ReplyMessage /*OPTIONAL*/, |
| /*OUT*/ PLPC_MESSAGE Message); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwReplyWaitReceivePortEx( |
| /*IN*/ HANDLE PortHandle, |
| /*OUT*/ PULONG PortIdentifier /*OPTIONAL*/, |
| /*IN*/ PLPC_MESSAGE ReplyMessage /*OPTIONAL*/, |
| /*OUT*/ PLPC_MESSAGE Message, |
| /*IN*/ PLARGE_INTEGER Timeout); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwReadRequestData( |
| /*IN*/ HANDLE PortHandle, |
| /*IN*/ PLPC_MESSAGE Message, |
| /*IN*/ ULONG Index, |
| /*OUT*/ PVOID Buffer, |
| /*IN*/ ULONG BufferLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwWriteRequestData( |
| /*IN*/ HANDLE PortHandle, |
| /*IN*/ PLPC_MESSAGE Message, |
| /*IN*/ ULONG Index, |
| /*IN*/ PVOID Buffer, |
| /*IN*/ ULONG BufferLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| typedef enum _PORT_INFORMATION_CLASS { |
| PortBasicInformation |
| } PORT_INFORMATION_CLASS; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryInformationPort( |
| /*IN*/ HANDLE PortHandle, |
| /*IN*/ PORT_INFORMATION_CLASS PortInformationClass, |
| /*OUT*/ PVOID PortInformation, |
| /*IN*/ ULONG PortInformationLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwImpersonateClientOfPort( |
| /*IN*/ HANDLE PortHandle, |
| /*IN*/ PLPC_MESSAGE Message); |
| |
| |
| |
| |
| /* Files */ |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtDeleteFile( |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwDeleteFile( |
| /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwFlushBuffersFile( |
| /*IN*/ HANDLE FileHandle, |
| /*OUT*/ PIO_STATUS_BLOCK IoStatusBlock); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCancelIoFile( |
| /*IN*/ HANDLE FileHandle, |
| /*OUT*/ PIO_STATUS_BLOCK IoStatusBlock); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwReadFileScatter( |
| /*IN*/ HANDLE FileHandle, |
| /*IN*/ HANDLE Event /*OPTIONAL*/, |
| /*IN*/ PIO_APC_ROUTINE ApcRoutine /*OPTIONAL*/, |
| /*IN*/ PVOID ApcContext /*OPTIONAL*/, |
| /*OUT*/ PIO_STATUS_BLOCK IoStatusBlock, |
| /*IN*/ PFILE_SEGMENT_ELEMENT Buffer, |
| /*IN*/ ULONG Length, |
| /*IN*/ PLARGE_INTEGER ByteOffset /*OPTIONAL*/, |
| /*IN*/ PULONG Key /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwWriteFileGather( |
| /*IN*/ HANDLE FileHandle, |
| /*IN*/ HANDLE Event /*OPTIONAL*/, |
| /*IN*/ PIO_APC_ROUTINE ApcRoutine /*OPTIONAL*/, |
| /*IN*/ PVOID ApcContext /*OPTIONAL*/, |
| /*OUT*/ PIO_STATUS_BLOCK IoStatusBlock, |
| /*IN*/ PFILE_SEGMENT_ELEMENT Buffer, |
| /*IN*/ ULONG Length, |
| /*IN*/ PLARGE_INTEGER ByteOffset /*OPTIONAL*/, |
| /*IN*/ PULONG Key /*OPTIONAL*/); |
| |
| |
| |
| |
| /* Registry keys */ |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSaveKey( |
| /*IN*/ HANDLE KeyHandle, |
| /*IN*/ HANDLE FileHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSaveMergedKeys( |
| /*IN*/ HANDLE KeyHandle1, |
| /*IN*/ HANDLE KeyHandle2, |
| /*IN*/ HANDLE FileHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwRestoreKey( |
| /*IN*/ HANDLE KeyHandle, |
| /*IN*/ HANDLE FileHandle, |
| /*IN*/ ULONG Flags); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwLoadKey( |
| /*IN*/ POBJECT_ATTRIBUTES KeyObjectAttributes, |
| /*IN*/ POBJECT_ATTRIBUTES FileObjectAttributes); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwLoadKey2( |
| /*IN*/ POBJECT_ATTRIBUTES KeyObjectAttributes, |
| /*IN*/ POBJECT_ATTRIBUTES FileObjectAttributes, |
| /*IN*/ ULONG Flags); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwUnloadKey( |
| /*IN*/ POBJECT_ATTRIBUTES KeyObjectAttributes); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryOpenSubKeys( |
| /*IN*/ POBJECT_ATTRIBUTES KeyObjectAttributes, |
| /*OUT*/ PULONG NumberOfKeys); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwReplaceKey( |
| /*IN*/ POBJECT_ATTRIBUTES NewFileObjectAttributes, |
| /*IN*/ HANDLE KeyHandle, |
| /*IN*/ POBJECT_ATTRIBUTES OldFileObjectAttributes); |
| |
| typedef enum _KEY_SET_INFORMATION_CLASS { |
| KeyLastWriteTimeInformation |
| } KEY_SET_INFORMATION_CLASS; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetInformationKey( |
| /*IN*/ HANDLE KeyHandle, |
| /*IN*/ KEY_SET_INFORMATION_CLASS KeyInformationClass, |
| /*IN*/ PVOID KeyInformation, |
| /*IN*/ ULONG KeyInformationLength); |
| |
| typedef struct _KEY_LAST_WRITE_TIME_INFORMATION { |
| LARGE_INTEGER LastWriteTime; |
| } KEY_LAST_WRITE_TIME_INFORMATION, *PKEY_LAST_WRITE_TIME_INFORMATION; |
| |
| typedef struct _KEY_NAME_INFORMATION { |
| ULONG NameLength; |
| WCHAR Name[1]; |
| } KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwNotifyChangeKey( |
| /*IN*/ HANDLE KeyHandle, |
| /*IN*/ HANDLE EventHandle /*OPTIONAL*/, |
| /*IN*/ PIO_APC_ROUTINE ApcRoutine /*OPTIONAL*/, |
| /*IN*/ PVOID ApcContext /*OPTIONAL*/, |
| /*OUT*/ PIO_STATUS_BLOCK IoStatusBlock, |
| /*IN*/ ULONG NotifyFilter, |
| /*IN*/ BOOLEAN WatchSubtree, |
| /*IN*/ PVOID Buffer, |
| /*IN*/ ULONG BufferLength, |
| /*IN*/ BOOLEAN Asynchronous); |
| |
| /* ZwNotifyChangeMultipleKeys.Flags constants */ |
| #define REG_MONITOR_SINGLE_KEY 0x00 |
| #define REG_MONITOR_SECOND_KEY 0x01 |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwNotifyChangeMultipleKeys( |
| /*IN*/ HANDLE KeyHandle, |
| /*IN*/ ULONG Flags, |
| /*IN*/ POBJECT_ATTRIBUTES KeyObjectAttributes, |
| /*IN*/ HANDLE EventHandle /*OPTIONAL*/, |
| /*IN*/ PIO_APC_ROUTINE ApcRoutine /*OPTIONAL*/, |
| /*IN*/ PVOID ApcContext /*OPTIONAL*/, |
| /*OUT*/ PIO_STATUS_BLOCK IoStatusBlock, |
| /*IN*/ ULONG NotifyFilter, |
| /*IN*/ BOOLEAN WatchSubtree, |
| /*IN*/ PVOID Buffer, |
| /*IN*/ ULONG BufferLength, |
| /*IN*/ BOOLEAN Asynchronous); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryMultipleValueKey( |
| /*IN*/ HANDLE KeyHandle, |
| /*IN OUT*/ PKEY_VALUE_ENTRY ValueList, |
| /*IN*/ ULONG NumberOfValues, |
| /*OUT*/ PVOID Buffer, |
| /*IN OUT*/ PULONG Length, |
| /*OUT*/ PULONG ReturnLength); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwInitializeRegistry( |
| /*IN*/ BOOLEAN Setup); |
| |
| |
| |
| |
| /* Security and auditing */ |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwPrivilegeCheck( |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ PPRIVILEGE_SET RequiredPrivileges, |
| /*OUT*/ PBOOLEAN Result); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwPrivilegeObjectAuditAlarm( |
| /*IN*/ PUNICODE_STRING SubsystemName, |
| /*IN*/ PVOID HandleId, |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ PPRIVILEGE_SET Privileges, |
| /*IN*/ BOOLEAN AccessGranted); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwPrivilegeObjectAuditAlarm( |
| /*IN*/ PUNICODE_STRING SubsystemName, |
| /*IN*/ PVOID HandleId, |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ PPRIVILEGE_SET Privileges, |
| /*IN*/ BOOLEAN AccessGranted); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAccessCheck( |
| /*IN*/ PSECURITY_DESCRIPTOR SecurityDescriptor, |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ PGENERIC_MAPPING GenericMapping, |
| /*IN*/ PPRIVILEGE_SET PrivilegeSet, |
| /*IN*/ PULONG PrivilegeSetLength, |
| /*OUT*/ PACCESS_MASK GrantedAccess, |
| /*OUT*/ PBOOLEAN AccessStatus); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAccessCheckAndAuditAlarm( |
| /*IN*/ PUNICODE_STRING SubsystemName, |
| /*IN*/ PVOID HandleId, |
| /*IN*/ PUNICODE_STRING ObjectTypeName, |
| /*IN*/ PUNICODE_STRING ObjectName, |
| /*IN*/ PSECURITY_DESCRIPTOR SecurityDescriptor, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ PGENERIC_MAPPING GenericMapping, |
| /*IN*/ BOOLEAN ObjectCreation, |
| /*OUT*/ PACCESS_MASK GrantedAccess, |
| /*OUT*/ PBOOLEAN AccessStatus, |
| /*OUT*/ PBOOLEAN GenerateOnClose); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAccessCheckByType( |
| /*IN*/ PSECURITY_DESCRIPTOR SecurityDescriptor, |
| /*IN*/ PSID PrincipalSelfSid, |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ ULONG DesiredAccess, |
| /*IN*/ POBJECT_TYPE_LIST ObjectTypeList, |
| /*IN*/ ULONG ObjectTypeListLength, |
| /*IN*/ PGENERIC_MAPPING GenericMapping, |
| /*IN*/ PPRIVILEGE_SET PrivilegeSet, |
| /*IN*/ PULONG PrivilegeSetLength, |
| /*OUT*/ PACCESS_MASK GrantedAccess, |
| /*OUT*/ PULONG AccessStatus); |
| |
| typedef enum _AUDIT_EVENT_TYPE { |
| AuditEventObjectAccess, |
| AuditEventDirectoryServiceAccess |
| } AUDIT_EVENT_TYPE, *PAUDIT_EVENT_TYPE; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAccessCheckByTypeAndAuditAlarm( |
| /*IN*/ PUNICODE_STRING SubsystemName, |
| /*IN*/ PVOID HandleId, |
| /*IN*/ PUNICODE_STRING ObjectTypeName, |
| /*IN*/ PUNICODE_STRING ObjectName, |
| /*IN*/ PSECURITY_DESCRIPTOR SecurityDescriptor, |
| /*IN*/ PSID PrincipalSelfSid, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ AUDIT_EVENT_TYPE AuditType, |
| /*IN*/ ULONG Flags, |
| /*IN*/ POBJECT_TYPE_LIST ObjectTypeList, |
| /*IN*/ ULONG ObjectTypeListLength, |
| /*IN*/ PGENERIC_MAPPING GenericMapping, |
| /*IN*/ BOOLEAN ObjectCreation, |
| /*OUT*/ PACCESS_MASK GrantedAccess, |
| /*OUT*/ PULONG AccessStatus, |
| /*OUT*/ PBOOLEAN GenerateOnClose); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAccessCheckByTypeResultList( |
| /*IN*/ PSECURITY_DESCRIPTOR SecurityDescriptor, |
| /*IN*/ PSID PrincipalSelfSid, |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ POBJECT_TYPE_LIST ObjectTypeList, |
| /*IN*/ ULONG ObjectTypeListLength, |
| /*IN*/ PGENERIC_MAPPING GenericMapping, |
| /*IN*/ PPRIVILEGE_SET PrivilegeSet, |
| /*IN*/ PULONG PrivilegeSetLength, |
| /*OUT*/ PACCESS_MASK GrantedAccessList, |
| /*OUT*/ PULONG AccessStatusList); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAccessCheckByTypeResultListAndAuditAlarm( |
| /*IN*/ PUNICODE_STRING SubsystemName, |
| /*IN*/ PVOID HandleId, |
| /*IN*/ PUNICODE_STRING ObjectTypeName, |
| /*IN*/ PUNICODE_STRING ObjectName, |
| /*IN*/ PSECURITY_DESCRIPTOR SecurityDescriptor, |
| /*IN*/ PSID PrincipalSelfSid, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ AUDIT_EVENT_TYPE AuditType, |
| /*IN*/ ULONG Flags, |
| /*IN*/ POBJECT_TYPE_LIST ObjectTypeList, |
| /*IN*/ ULONG ObjectTypeListLength, |
| /*IN*/ PGENERIC_MAPPING GenericMapping, |
| /*IN*/ BOOLEAN ObjectCreation, |
| /*OUT*/ PACCESS_MASK GrantedAccessList, |
| /*OUT*/ PULONG AccessStatusList, |
| /*OUT*/ PULONG GenerateOnClose); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwAccessCheckByTypeResultListAndAuditAlarmByHandle( |
| /*IN*/ PUNICODE_STRING SubsystemName, |
| /*IN*/ PVOID HandleId, |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ PUNICODE_STRING ObjectTypeName, |
| /*IN*/ PUNICODE_STRING ObjectName, |
| /*IN*/ PSECURITY_DESCRIPTOR SecurityDescriptor, |
| /*IN*/ PSID PrincipalSelfSid, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ AUDIT_EVENT_TYPE AuditType, |
| /*IN*/ ULONG Flags, |
| /*IN*/ POBJECT_TYPE_LIST ObjectTypeList, |
| /*IN*/ ULONG ObjectTypeListLength, |
| /*IN*/ PGENERIC_MAPPING GenericMapping, |
| /*IN*/ BOOLEAN ObjectCreation, |
| /*OUT*/ PACCESS_MASK GrantedAccessList, |
| /*OUT*/ PULONG AccessStatusList, |
| /*OUT*/ PULONG GenerateOnClose); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwOpenObjectAuditAlarm( |
| /*IN*/ PUNICODE_STRING SubsystemName, |
| /*IN*/ PVOID *HandleId, |
| /*IN*/ PUNICODE_STRING ObjectTypeName, |
| /*IN*/ PUNICODE_STRING ObjectName, |
| /*IN*/ PSECURITY_DESCRIPTOR SecurityDescriptor, |
| /*IN*/ HANDLE TokenHandle, |
| /*IN*/ ACCESS_MASK DesiredAccess, |
| /*IN*/ ACCESS_MASK GrantedAccess, |
| /*IN*/ PPRIVILEGE_SET Privileges /*OPTIONAL*/, |
| /*IN*/ BOOLEAN ObjectCreation, |
| /*IN*/ BOOLEAN AccessGranted, |
| /*OUT*/ PBOOLEAN GenerateOnClose); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCloseObjectAuditAlarm( |
| /*IN*/ PUNICODE_STRING SubsystemName, |
| /*IN*/ PVOID HandleId, |
| /*IN*/ BOOLEAN GenerateOnClose); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwDeleteObjectAuditAlarm( |
| /*IN*/ PUNICODE_STRING SubsystemName, |
| /*IN*/ PVOID HandleId, |
| /*IN*/ BOOLEAN GenerateOnClose); |
| |
| |
| |
| |
| /* Plug and play and power management */ |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwRequestWakeupLatency( |
| /*IN*/ LATENCY_TIME Latency); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwRequestDeviceWakeup( |
| /*IN*/ HANDLE DeviceHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCancelDeviceWakeupRequest( |
| /*IN*/ HANDLE DeviceHandle); |
| |
| NTOSAPI |
| BOOLEAN |
| NTAPI |
| ZwIsSystemResumeAutomatic( |
| VOID); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetThreadExecutionState( |
| /*IN*/ EXECUTION_STATE ExecutionState, |
| /*OUT*/ PEXECUTION_STATE PreviousExecutionState); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwGetDevicePowerState( |
| /*IN*/ HANDLE DeviceHandle, |
| /*OUT*/ PDEVICE_POWER_STATE DevicePowerState); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetSystemPowerState( |
| /*IN*/ POWER_ACTION SystemAction, |
| /*IN*/ SYSTEM_POWER_STATE MinSystemState, |
| /*IN*/ ULONG Flags); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwInitiatePowerAction( |
| /*IN*/ POWER_ACTION SystemAction, |
| /*IN*/ SYSTEM_POWER_STATE MinSystemState, |
| /*IN*/ ULONG Flags, |
| /*IN*/ BOOLEAN Asynchronous); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwPowerInformation( |
| /*IN*/ POWER_INFORMATION_LEVEL PowerInformationLevel, |
| /*IN*/ PVOID InputBuffer /*OPTIONAL*/, |
| /*IN*/ ULONG InputBufferLength, |
| /*OUT*/ PVOID OutputBuffer /*OPTIONAL*/, |
| /*IN*/ ULONG OutputBufferLength); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwPlugPlayControl( |
| /*IN*/ ULONG ControlCode, |
| /*IN OUT*/ PVOID Buffer, |
| /*IN*/ ULONG BufferLength); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwGetPlugPlayEvent( |
| /*IN*/ ULONG Reserved1, |
| /*IN*/ ULONG Reserved2, |
| /*OUT*/ PVOID Buffer, |
| /*IN*/ ULONG BufferLength); |
| |
| |
| |
| |
| /* Miscellany */ |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwRaiseException( |
| /*IN*/ PEXCEPTION_RECORD ExceptionRecord, |
| /*IN*/ PCONTEXT Context, |
| /*IN*/ BOOLEAN SearchFrames); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwContinue( |
| /*IN*/ PCONTEXT Context, |
| /*IN*/ BOOLEAN TestAlert); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwW32Call( |
| /*IN*/ ULONG RoutineIndex, |
| /*IN*/ PVOID Argument, |
| /*IN*/ ULONG ArgumentLength, |
| /*OUT*/ PVOID *Result /*OPTIONAL*/, |
| /*OUT*/ PULONG ResultLength /*OPTIONAL*/); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetLowWaitHighThread( |
| VOID); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetHighWaitLowThread( |
| VOID); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwLoadDriver( |
| /*IN*/ PUNICODE_STRING DriverServiceName); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwUnloadDriver( |
| /*IN*/ PUNICODE_STRING DriverServiceName); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwFlushInstructionCache( |
| /*IN*/ HANDLE ProcessHandle, |
| /*IN*/ PVOID BaseAddress /*OPTIONAL*/, |
| /*IN*/ ULONG FlushSize); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwFlushWriteBuffer( |
| VOID); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryDefaultLocale( |
| /*IN*/ BOOLEAN ThreadOrSystem, |
| /*OUT*/ PLCID Locale); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetDefaultLocale( |
| /*IN*/ BOOLEAN ThreadOrSystem, |
| /*IN*/ LCID Locale); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryDefaultUILanguage( |
| /*OUT*/ PLANGID LanguageId); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetDefaultUILanguage( |
| /*IN*/ LANGID LanguageId); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwQueryInstallUILanguage( |
| /*OUT*/ PLANGID LanguageId); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtAllocateLocallyUniqueId( |
| /*OUT*/ PLUID Luid); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtAllocateUuids( |
| /*OUT*/ PLARGE_INTEGER UuidLastTimeAllocated, |
| /*OUT*/ PULONG UuidDeltaTime, |
| /*OUT*/ PULONG UuidSequenceNumber, |
| /*OUT*/ PUCHAR UuidSeed); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetUuidSeed( |
| /*IN*/ PUCHAR UuidSeed); |
| |
| typedef enum _HARDERROR_RESPONSE_OPTION { |
| OptionAbortRetryIgnore, |
| OptionOk, |
| OptionOkCancel, |
| OptionRetryCancel, |
| OptionYesNo, |
| OptionYesNoCancel, |
| OptionShutdownSystem |
| } HARDERROR_RESPONSE_OPTION, *PHARDERROR_RESPONSE_OPTION; |
| |
| typedef enum _HARDERROR_RESPONSE { |
| ResponseReturnToCaller, |
| ResponseNotHandled, |
| ResponseAbort, |
| ResponseCancel, |
| ResponseIgnore, |
| ResponseNo, |
| ResponseOk, |
| ResponseRetry, |
| ResponseYes |
| } HARDERROR_RESPONSE, *PHARDERROR_RESPONSE; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwRaiseHardError( |
| /*IN*/ NTSTATUS Status, |
| /*IN*/ ULONG NumberOfArguments, |
| /*IN*/ ULONG StringArgumentsMask, |
| /*IN*/ PULONG Arguments, |
| /*IN*/ HARDERROR_RESPONSE_OPTION ResponseOption, |
| /*OUT*/ PHARDERROR_RESPONSE Response); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetDefaultHardErrorPort( |
| /*IN*/ HANDLE PortHandle); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwDisplayString( |
| /*IN*/ PUNICODE_STRING String); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwCreatePagingFile( |
| /*IN*/ PUNICODE_STRING FileName, |
| /*IN*/ PULARGE_INTEGER InitialSize, |
| /*IN*/ PULARGE_INTEGER MaximumSize, |
| /*IN*/ ULONG Reserved); |
| |
| typedef USHORT RTL_ATOM, *PRTL_ATOM; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtAddAtom( |
| /*IN*/ PWSTR AtomName, |
| /*IN*/ ULONG AtomNameLength, |
| /*OUT*/ PRTL_ATOM Atom); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtFindAtom( |
| /*IN*/ PWSTR AtomName, |
| /*IN*/ ULONG AtomNameLength, |
| /*OUT*/ PRTL_ATOM Atom); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtDeleteAtom( |
| /*IN*/ RTL_ATOM Atom); |
| |
| typedef enum _ATOM_INFORMATION_CLASS { |
| AtomBasicInformation, |
| AtomListInformation |
| } ATOM_INFORMATION_CLASS; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtQueryInformationAtom( |
| /*IN*/ RTL_ATOM Atom, |
| /*IN*/ ATOM_INFORMATION_CLASS AtomInformationClass, |
| /*OUT*/ PVOID AtomInformation, |
| /*IN*/ ULONG AtomInformationLength, |
| /*OUT*/ PULONG ReturnLength /*OPTIONAL*/); |
| |
| typedef struct _ATOM_BASIC_INFORMATION { |
| USHORT ReferenceCount; |
| USHORT Pinned; |
| USHORT NameLength; |
| WCHAR Name[1]; |
| } ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION; |
| |
| typedef struct _ATOM_LIST_INFORMATION { |
| ULONG NumberOfAtoms; |
| ATOM Atoms[1]; |
| } ATOM_LIST_INFORMATION, *PATOM_LIST_INFORMATION; |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| ZwSetLdtEntries( |
| /*IN*/ ULONG Selector1, |
| /*IN*/ LDT_ENTRY LdtEntry1, |
| /*IN*/ ULONG Selector2, |
| /*IN*/ LDT_ENTRY LdtEntry2); |
| |
| NTOSAPI |
| NTSTATUS |
| NTAPI |
| NtVdmControl( |
| /*IN*/ ULONG ControlCode, |
| /*IN*/ PVOID ControlData); |
| |
| #pragma pack(pop) |
| |
| #ifdef __cplusplus |
| } |
| #endif |
| |
| #endif /* __NTAPI_H */ |
